Writeup

  • HTB: Inject - Easy 11 Mar '23
    Exploited image parameter LFI to enumerate system, used Spring Cloud Function vulnerability for initial access, and escalated to root through a writable Ansible playbook.
  • HTB: Stocker - Easy 14 Jan '23
    Exploited NoSQL injection for login bypass, used HTML injection in PDF generation to leak credentials, and escalated to root via sudo NodeJS privileges.