[mhsoraa]

https://www.hackthebox.com/machines/caption
https://app.hackthebox.com/machines/625

Have fun and good luck everyone!

[rootme1122]

okkkkk Let's Gooooooooooo!!!

[HooptieDooptie]

Let the games begin!

[jsvensson]

Someone has system already, and before user

[HooptieDooptie]

Someone has system already, and before user

lolz guess thats not meant to be that way XD

[rootme1122]

https://github.com/kacperszurek/exploits...ted-rce.md

[HooptieDooptie]

https://github.com/kacperszurek/exploits...ted-rce.md

Does that work? Its only unauthenticated if the server it's running on is a windows.

[rootme1122]

https://github.com/kacperszurek/exploits...ted-rce.md

Does that work? Its only unauthenticated if the server it's running on is a windows.

GitBucket 4.23.1 Authenticated Arbitrary File Read
by Kacper Szurek
https://security.szurek.pl/
[+] Try login
Login successfully, cookie: {'JSESSIONID': 'node0fri9aghbcmet1opbu4zid3l88139377.node0'}
[+] Try create exploit repo: exploit--------
[+] Run exploit
[-] Error on sending exploit, probably file not exist

[antolint]

http://caption.htb:8080/root

I don't know if can be somehow useful

[johnny123456]

http://caption.htb:8080/root

I don't know if can be somehow useful

has some source code, guessing these lines inside server.go
logs := fmt.Sprintf("echo 'IP Address: %s, User-Agent: %s, Timestamp: %s' >> output.log", ip, userAgent, timestamp)
        exec.Command{"/bin/sh", "-c", logs}
may be the way