I’ll use those to get execution on the box, which turns out to be a bit trickier than expected. There’s a file read vulnerability in the application, and the Flask server is running in debug mode.

I’ll find a virtualhost with Gitea, and use that along with different creds to eventually find the source for the script, and identify how to run it to get arbitrary execution as root.Ĭtf hackthebox htb-agile nmap ubuntu flask python feroxbuster file-read werkzeug werkzeug-debug flask-debug-pin youtube python-venv pytest selenium chrome chrome-debug sudoedit cve-2023-22809 idor flask-cookieĪgile is a box hosting a password manager solution. On the host, the user can run sudo to run a Python script, but I can’t see the script.

Under the hood, it is using the Python Searchor command line tool, and I’ll find an unsafe eval vulnerability and exploit that to get code execution. Hackthebox htb-busqueda ctf nmap flask ubuntu searchor feroxbuster python-eval command-injection burp burp-repeater password-reuse giteaīusqueda presents a website that gives links to various sites based on user input.

Modern combat versus pc hack dll