{"uuid": "0dac0cfa-3b1d-42d5-a4b9-68a70450e674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-28368", "type": "published-proof-of-concept", "source": "https://t.me/timcore_hacking/2534", "content": "#hackthebox\n#htb\n#hacking\n\nHackTheBox - Interface\n\n00:00 - Introduciton\n00:50 - Start of nmap, navigating to the page and identifying the framework based upon 404\n02:30 - Playing around looking at javascript source, not getting anything\n04:30 - Playing around with prd.m.rengering-api.interface.htb... I'm guessing file not found is the webserver, not actual code.\n07:40 - Showing the difficulty of dirbusting API Servers\n11:20 - Showing importance of updating FeroxBuster\n15:00 - Playing with the HTML2PDF endpoint and discovering we need to send a POST with HTML as an argument\n18:20 - The PDF Generated has dompdf 1.2.0 in the exif data searching for exploits\n20:40 - Researching how CVE-2022-28368 works, then manually exploiting the vulnerabiltiy\n28:50 - The CSS/Font is created, running the exploit and finding where the Font (PHP File) gets uploaded to\n34:30 - Reverse shell returned\n38:15 - Uploading pspy to examine how the box cleans itself up\n40:20 - Discovering and exploiting Bash Arithmetic Injection\n\nhttps://www.youtube.com/watch?v=yM914q6zS-U", "creation_timestamp": "2023-05-15T13:37:09.000000Z"}