[insect1285]

>How were you able to get the data of the closed ones?

Just swapping to "Closed". I could not open the tickets though.

I still think it's something around SSH Key Vuln. We have a user, a different SSH running on 2222 and several open tickets about SSH not working correctly. But I can't find any CVEs or direction on how to exploit a possible vuln.

[UnkownWombat]

I was thinking the same, if you try to access ticket page without id parameter, you get this error

<div class="main"><br />
<b>Warning</b>:  Undefined array key "id" in <b>/var/www/itrc/ticket.php</b> on line <b>5</b><br />
<script>window.location = '/';</script>

Also there is a db.php file

Edit: oh you meant create_comment, it seems like vulnerable to IDOR, at least the response is {"status":"success"}

Closed tickets hint at other servers. Maybe need to track those down? Or find their specific pages?

```

Ticket ID
Subject
Status
1
Need SSH Access to HR Server
closed
2
Decommission ITRC SSH Certificate
closed
4
Please provision access to marketing servers
closed
```

How were you able to get the data of the closed ones?

I just got back on, but earlier before I was able to close all the tickets regardless of ID or ownership, tested it with separate accounts. As well as the comment on whatever ID you like as already mentioned prior in this thread.

http://itrc.ssg.htb/index.php?page=admin

and then click the open button, then set to closed

[sharknpls]

another useless tidbit:

this image http://itrc.ssg.htb/assets/img/office is not shown anywhere that that i have seen already, but likely just something from the back end or admin side.

[ggorilla1337]

I was able to leak some of the user zzinter hash

user=zzinter&pass[$eq]=ramdom

The response

<br />
<b>Fatal error</b>:  Uncaught TypeError: password_verify(): Argument #1 ($password) must be of type string, array given in /var/www/itrc/api/login.php:16
Stack trace:
#0 /var/www/itrc/api/login.php(16): password_verify(Array, '$2y$10$VCpu.vx5...')
#1 {main}
  thrown in <b>/var/www/itrc/api/login.php</b> on line <b>16</b><br />

[glock05]

Also found this error. Unsure if can be exploited by passing some kind of special `id`.

GET /?page=/var/www/itrc/ticket

<b>Warning</b>:  Undefined array key "id" in <b>/var/www/itrc/ticket.php</b> on line <b>5</b><br />

I think it doesn't lead somewhere, because the error indicates that you need to specify the id parameter, so something like this would work  http://itrc.ssg.htb/?page=/var/www/itrc/ticket&id=19 (the id value must be of a ticket you own)

[ggorilla1337]

Also found this error. Unsure if can be exploited by passing some kind of special `id`.

GET /?page=/var/www/itrc/ticket

<b>Warning</b>:  Undefined array key "id" in <b>/var/www/itrc/ticket.php</b> on line <b>5</b><br />

You are only viewing the ticket, it isn't special, it is standard functionality

closed</div></div><div class='row ticket-row' onclick="location.href='/?page=ticket&id=29'">

---

Anyone had success trying to load a PHP file from an uploaded ZIP with the zip:// scheme?
Like this:

zip://uploads/<hash>.zip%23shell

[UnkownWombat]

its this: https://github.com/Mr-xn/thinkphp_lang_RCE

but use ?page instead of ?lang

now go find me the root method and report back please

im fucking sick of this guessing game bullshit

lol fair the only review is a 1* xD

---

I was able to leak some of the user zzinter hash

user=zzinter&pass[$eq]=ramdom

The response

<br />
<b>Fatal error</b>:  Uncaught TypeError: password_verify(): Argument #1 ($password) must be of type string, array given in /var/www/itrc/api/login.php:16
Stack trace:
#0 /var/www/itrc/api/login.php(16): password_verify(Array, '$2y$10$VCpu.vx5...')
#1 {main}
  thrown in <b>/var/www/itrc/api/login.php</b> on line <b>16</b><br />

for learning purposes could you explain this a bit more - its pretty interesting

[UnkownWombat]

its this: https://github.com/Mr-xn/thinkphp_lang_RCE

but use ?page instead of ?lang

now go find me the root method and report back please

im fucking sick of this guessing game bullshit

This gets me phpinfo and other basic commands... hints on the rev. shell used? I can't seem to figure out the command that doesn't result in server error.

can you explain the link youre using rn?

[wranglerray]

http://signserv.ssg.htb/docs

[glock05]

http://signserv.ssg.htb/docs

bro what wordlist you used to enumerate that vHost?