{"uuid": "0455d07e-d0ee-4651-a3c6-22b41e46626c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-39174", "type": "seen", "source": "https://t.me/timcore_hacking/2059", "content": "#hackthebox\n#hacking\n\nHackTheBox - Catch\n\n01:00 - Start of nmap, going over some standard cookies and knowing the web technology behind it\n06:15 - Checking what the main webpage is, discovering an APK File\n07:00 - Analysing the APK file with JADX-GUI\n09:00 - Searching for strings, finding some tokens\n10:15 - Looking at the Gitea API to discover how to use our token\n14:15 - Looking at the Lets Chat API to discover how to use our token and dumping a list of rooms\n16:30 - Using the Lets Chat API to dump messages from a room and discovering credentials\n17:40 - Logging into the Catchet webserver finding the version and discovering known vulnerabilities\n19:20 - Using a CVE-2021-39174 POC to dump the Catchet Configuration and get a password (SSTI)\n23:50 - Logging into the box as will\n25:40 - Discovering a verify.sh script that has a command injection when verifying APK Files\n29:00 - Using apktool to decompile the APK so we can change the name and repackage it\n33:15 - Having trouble repacking our APK file, need to update APKTool. Then getting root\n38:00 - Showing another way to pop the Catchet server, by updating the Cache configuration to point to our REDIS instance and phpggc to create a deserialization gadget\n\nhttps://www.youtube.com/watch?v=XAZI361XgRU", "creation_timestamp": "2022-07-24T08:12:39.000000Z"}