Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API

hackadvisor

Task: NetPulse monitoring platform with internal Agent API protected by IP-based authentication behind nginx; script-type data sources execute shell commands with unsanitized parameters. Solution: spoof source IP via X-Forwarded-For: 127.0.0.1 to access agent API, then inject OS commands through poller_id parameter in script data source execution to read /root/flag.txt.