[ghghghgh]

I want someone experienced to discuss a vulnerability of the exam

[GeneralGrievous]

Haven't done the exam but I'm down to listen

[ghghghgh]

Haven't done the exam but I'm down to listen

There is a part with blind xxe blind vulnerability, I was able to use php filter to read internal file, then i tried to use expect:// wrapper and curl my local webserver and i got the request, so I guess the expect wrapper is enabled and it can lead to rce. But when i tried for example to `cat somefile > /tmp/somefile` with expect and then read /tmp/somefile with php filter, i dont get anything.

Payload for expect that i used is `expect://curl$IFS'ip/hello'`

My question is what payload i can try to use here if it seems that only curl is working?

[GeneralGrievous]

Haven't done the exam but I'm down to listen

There is a part with blind xxe blind vulnerability, I was able to use php filter to read internal file, then i tried to use expect:// wrapper and curl my local webserver and i got the request, so I guess the expect wrapper is enabled and it can lead to rce. But when i tried for example to `cat somefile > /tmp/somefile` with expect and then read /tmp/somefile with php filter, i dont get anything.

Payload for expect that i used is `expect://curl$IFS'ip/hello'`

My question is what payload i can try to use here if it seems that only curl is working?

If the only thing you could is send HTTP requests, maybe a SSRF
Are you encoding the payload correctly?

[Addka72424]

The last non-spam response in the topic was more than a month ago. I close the topic as irrelevant to prevent spam. If this is not the case, please send a pm and I will open the topic for discussion again.