webmedium

Dark Runes

hackthebox

Task: Read /flag.txt from a Node.js web app with PDF generation capabilities. Solution: Register as "admin" (no admin user pre-created), brute-force a 4-digit access code on the unsanitized debug export endpoint, and use PhantomJS file:// protocol via iframe in the PDF payload to read the local flag file.

$ ls tags/ techniques/

ssrf lfi nodejs express access-control brute-force phantomjs markdown-pdf admin-registration file-protocol pdf-generation cookie-auth

admin_registration_bypassaccess_code_brute_forcephantomjs_file_readssrf_via_pdf_generationiframe_file_protocol

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]