Trickster Discussion [HTB] [HINTS]

HackTheBox
24

Does this POC requires you to have access to admin panel? or can you create a random email and sent the attachment to it?

26

Then check this file for mysql credentials

/var/www/prestashop/app/config/parameters.php
1 Like
27

No, the challenge itself simulates admin login. it’s just enough to run the poc

28

thanks a lot you saved me

29

The user i created never receives the email in my alerts (assuming i will get it there).
i have done the following:
in the php reverse shell file: i changed to my ip
in exploit.html: i changed to url to shop.trickster.htb/admin (the admin path i found at the directory in .git)
when i run the exploit.py i submit the info as follow:
http://shop.trickster.htb
email: the one i created for the shop
message: blah blah
html file: ./exploit.html

What am i doing wrong? There must be something i am missing

30

Add reverse_shell.php inside the malicious theme zip.

1 Like
31

Root Hints

  1. Scan the internal Docker network and locate the changedetection web application.

  2. Notice that it’s vulnerable to CVE-2024-32651, but you need to disable the password first.

  3. If you’ve made it this far, you already know the password! :smile:

After obtaining a Docker shell, inspect all the files to gain root access on the host machine.

32

Just another question, this step from james or from adam user ? thanks :slight_smile:

33

I disabled the password but not getting a docker connection back. Was there an extra step you did?

34

we are directly rooting from james.

1 Like
35

got it thanks, i will check again

36

Which notification url are you using? Local web server on attack machine?

37

Check the documentation and create a valid notification URL. That’s enough.

38

sorry can i get hint i got shell but it colsed i got this error
[*] Got EOF while sending in interactive

39

can anyone please help i am stuck with shell last part

40

Log in to the web application yourself, identify the errors, review the logs carefully and then modify the exploit accordingly.

1 Like
41

Exclusive content is now available for Trickster.

What is Exclusive Content?

You can still ask for help and specific hints in this thread.

1 Like
42

is the admin panel something related to the .git/refs/heads/admin_panel contents?

43

@SXBmaQqq you should download the git folder with GitHub - arthaud/git-dumper: A tool to dump a git repository from a website so you can find the admin folder

44

i’ve run
git-dumper http://shop.trickster.htb ./git but i can’t find the admin directory