libreoffice openoffice bug allows hackers spoof

#Libreoffice openoffice bug allows hackers spoof pdf#
#Libreoffice openoffice bug allows hackers spoof code#
#Libreoffice openoffice bug allows hackers spoof password#
#Libreoffice openoffice bug allows hackers spoof plus#

I’ll have to find and chain together a reflective cross site scripting (XSS), a client side template injection (CSTI), and a cross site request forgery (CSRF) to leak an admin’s token. The initial web exploitation in Overgraph was really hard. Htb-overgraph ctf hackthebox nmap wfuzz vhost feroxbuster graphql angularjs otp nosql-injection graphql-playground graphql-voyager local-storage csti xss reflective-xss csrf ffmpeg ssrf local-file-read exploit patchelf ghidra checksec python gdb youtube pwntools In Beyond Root, some loose ends that were annoying me. With a shell, I’ll throw a symlink into a backup directory and get an SSH key from the user. I’ll use ROP to make the stack executable, and then run a reverse shell shellcode from it. There’s a buffer overflow, which I can exploit via an uploaded file. With that, I’ll get a copy of a binary that gets fed a file via an upload on the website. (There’s also an EAR vulnerability that I originally missed, but added in later).

#Libreoffice openoffice bug allows hackers spoof plus#

Retired starts out with a file read plus a directory traversal vulnerability.

#Libreoffice openoffice bug allows hackers spoof password#

With that read access, I’ll get the administrator password and use Evil-WinRM to get a shell.Ĭtf hackthebox htb-retired nmap feroxbuster upload directory-traversal local-file-read filter bof wfuzz ghidra reverse-engineering proc maps gdb pattern mprotect rop jmp-rsp msfvenom shellcode python symlink make capabilities cap-dac-override binfmt-misc sched_debug htb-previse htb-fingerprint execute-after-redirect That user can read from LAPS, the technology that helps to keep local administrator passwords safe and unique. As the initial user, I’ll find creds in the PowerShell history file for the next user. I’ll crack the zip and the keys within, and use Evil-WinRM differently than I have shown before to authenticate to Timelapse using the keys. It starts by finding a set of keys used for authentication to the Windows host on an SMB share. Timelapse is a really nice introduction level active directory box. This container has a dangerous capabilities, CAP_DAC_READ_SEARCH, which I’ll abuse to both read and write files on the host.Ĭtf htb-timelapse hackthebox nmap windows active-directory crackmapexec smbclient laps zip2john john pfx2john evil-winrm winrm-keys powershell-history htb-pivotapi I’ll abuse the Rocket Chat webhook functionality to get a shell in yet another Docker container. I’ll connect to that and use it to get access as admin for a Rocket Chat instance. From the host, I’ll find a different network of containers, and find MongoDB running in one. From that container, I can SSH into the main host.

#Libreoffice openoffice bug allows hackers spoof code#

There I’ll find creds for the Bolt CMS instance, and use those to log into the admin panel and edit a template to get code execution in the next container. I’ll start by abusing the built-in R scripter in jamovi to get execution and shell in a docker container. Talkative is about hacking a communications platform. Hackthebox ctf htb-talkative nmap wfuzz jamovi bolt-cms feroxbuster rocket-chat r-lang docker webhook twig ssti mongo deepce shocker cap-dac-read-search htb-paper htb-anubis htb-registry

To get root, I’ll find MySQL running as root and use the Raptor exploit to get command execution through MySQL.

#Libreoffice openoffice bug allows hackers spoof pdf#

As admin, I get the site source, and find a RCE, both the intended way exploiting a markdown to PDF JavaScript library, as well as an unintended command injection. With access as a higher priv user on the website, I get creds to the FTP server, where I find the default password scheme, and use that to pivot to the FTP admin. I’ll show a couple different ways to find a username, by generating tons of valid cookies and testing them, and by using the login error messages to find a valid username.

It’s crackable, but I don’t have another user’s name or anything else to fake of value. Noter starts by registering an account on the website and looking at the Flask cookie. Ctf hackthebox htb-noter nmap ftp python flask flask-cookie flask-unsign feroxbuster wfuzz source-code md-to-pdf command-injection mysql raptor shared-object