[mazafaka555]

second flag is a binary exploitation (pwn challenge). good luck

[mazafaka555]

Flag 2 exploit code...

Bro.. at least charge more credits for this.. what are faka you doing??

[JonathanC0mradeJames]

I am sharing the flags in this thread. https://bf.st/Thread-Solar-Writeup?pid=734297#pid734297


If you want full writeup, DM me. Trading it for reputation!

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Reputation System Rules 5.1) You are not allowed to ask for, buy, sell, or trade reputation (You may ask after a deal is made, only exception)

[mhsoraa]

Anyone can help me with a hint on flag 3's Phar deserialization?

[monkeyNo1]

curl and wget not work, only this:

scp -P 2222 -i private.key /my_path/linpeas.sh [email protected]:/usr/home/backup_adm/linpeas.sh

I tried to use ligolo-ng to check other ip adresses but it's impossible to execute binary file on victim.
If you'll get 3rd flag PLS share

[mhsoraa]

curl and wget not work, only this:

scp -P 2222 -i private.key /my_path/linpeas.sh [email protected]:/usr/home/backup_adm/linpeas.sh

I tried to use ligolo-ng to check other ip adresses but it's impossible to execute binary file on victim.
If you'll get 3rd flag PLS share

Based on leaked flag...

 SOLAR{...snipped..._phar-fetched} 

Flag 3 is about Phar deserialization attack.

Flag 3:   

Hidden Content

You must register or login to view this content.

We need writeup or hint on Flag 3's Phar deserialization attack in order to proceed further on next flags...

[tupaya_p1zd4]

I am sharing the flags in this thread. http://breachqr3dqbysbq5khaadg5ynnpxn2wr...#pid734297


If you want full writeup, DM me. Trading it for reputation!

Please share Mister !
I will give you a reputation and my virginity

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[mhsoraa]

where is the location of this app running  from /backups/neptune/usr/local/www  ??
i can't find it anywhere

What is the app you are trying to find?

php app for internal fileserver. suppose to be running on neptune jail

backup_adm@jupiter:~ % ll /backups/neptune/usr/local/www/apache24/
total 20
-rw-r--r--  1 root  wheel  48 May 18  2021 .htpasswd
drwxr-xr-x  2 root  www      4 Jan 29  2020 cgi-bin/
drwxrwxr-x  2 root  www      3 Mar  3  2021 data/
drwxr-xr-x  3 root  www    22 Jan 29  2020 error/
drwxr-xr-x  3 root  www      3 Mar  3  2021 fileserver/
drwxr-xr-x  3 root  www    179 Jan 29  2020 icons/
drwxrwxr-x  2 root  www      2 Mar  5  2022 tmpfiles/
backup_adm@jupiter:~ % ll /backups/neptune/usr/local/www/apache24/fileserver/upload/
total 37
-rw-r--r--  1 root  www  5505 Mar  3  2021 admin.php
drwxr-xr-x  2 root  www    3 Feb 15  2020 api/
-rw-r--r--  1 root  www  930 Mar  3  2021 approve.php
drwxr-xr-x  2 root  www    7 Feb 14  2020 classes/
drwxr-xr-x  2 root  www    4 Feb 20  2020 css/
-rw-r--r--  1 root  www  688 Feb 20  2020 download.php
-rw-r--r--  1 root  www  4695 Mar  3  2021 index.php
-rw-r--r--  1 root  www  358 Mar  2  2021 init.php
drwxr-xr-x  2 root  www    5 Mar  2  2021 settings/
-rw-r--r--  1 root  www  280 Mar  3  2021 upload.php
backup_adm@jupiter:~ %

i think it is behind fileserver binary and we need to pop a proper shell to access it. i found everything on outer jails and such, except this app.
inner jails aren't directly accessible.

php app...

❯ nc 10.13.38.23 33333
Username: ...snipped...
Password: ...snipped...

Fetching index...

<!DOCTYPE html>
<html lang="en">
<title>FileServer Upload</title>

...snipped...

File (q to quit): admin.php    <=== php app here

Fetching file...

<!DOCTYPE html>
<html lang="en">
<title>FileServer Admin</title>
...snipped...

[MrBlue]

Hi, could someone please help me with BOF? How did you guys do it?

[weakdaw22]

1st flag please