Possibly Related Threads…

DataNinja · 06-01-2024, 10:45 PM

any hint to root?

maggi · (This post was last modified: 06-01-2024, 10:55 PM by maggi.)

Oh wait I got it....

osamy7593 · 06-01-2024, 10:49 PM

(06-01-2024, 10:45 PM)DataNinja Wrote: any hint to root?

bro how did u use idor in qr code

DataNinja · 06-01-2024, 11:05 PM

(06-01-2024, 10:49 PM)osamy7593 Wrote:
(06-01-2024, 10:45 PM)DataNinja Wrote: any hint to root?

bro how did u use idor in qr code

That is simple, you need to find the ID of an employee with admin privileges for example '2' and convert it to base64. After that, obtain the QR code and get the content similar to this: http://freelancer.htb/accounts/login/otp/Njk2OQo=/670765xxx/. Then, only change the value 'Njk2OQo' to the base64 ID(2), and you will get this: http://freelancer.htb/accounts/login/otp/Mgo=/670765xxx/. You will be an admin.

maggi · 06-01-2024, 11:16 PM

I kep getting OTP expired

NoNameBTW · (This post was last modified: 06-01-2024, 11:20 PM by NoNameBTW.)

I got admin account but idk how to get user anyone can help

maggi · 06-01-2024, 11:27 PM

(06-01-2024, 11:05 PM)DataNinja Wrote:
(06-01-2024, 10:49 PM)osamy7593 Wrote:
(06-01-2024, 10:45 PM)DataNinja Wrote: any hint to root?

bro how did u use idor in qr code

That is simple, you need to find the ID of an employee with admin privileges for example '2' and convert it to base64. After that, obtain the QR code and get the content similar to this: http://freelancer.htb/accounts/login/otp/Njk2OQo=/670765xxx/. Then, only change the value 'Njk2OQo' to the base64 ID(2), and you will get this: http://freelancer.htb/accounts/login/otp/Mgo=/670765xxx/. You will be an admin.

How do you find the id I keep getting otp errors when entered?

NoNameBTW · 06-01-2024, 11:30 PM

(06-01-2024, 11:27 PM)maggi Wrote:
(06-01-2024, 11:05 PM)DataNinja Wrote:
(06-01-2024, 10:49 PM)osamy7593 Wrote:
(06-01-2024, 10:45 PM)DataNinja Wrote: any hint to root?

bro how did u use idor in qr code

That is simple, you need to find the ID of an employee with admin privileges for example '2' and convert it to base64. After that, obtain the QR code and get the content similar to this: http://freelancer.htb/accounts/login/otp/Njk2OQo=/670765xxx/. Then, only change the value 'Njk2OQo' to the base64 ID(2), and you will get this: http://freelancer.htb/accounts/login/otp/Mgo=/670765xxx/. You will be an admin.

How do you find the id I keep getting otp errors when entered?

Just visit Jobs dashboard, click on that and click on the profile pic, you can see in the URL the user id.

osamy7593 · (This post was last modified: 06-01-2024, 11:40 PM by osamy7593.)

i'm the admin now what after ? where is sql terminal to get a rev shell?

DataNinja · 06-01-2024, 11:42 PM

(06-01-2024, 11:31 PM)osamy7593 Wrote: i'm the admin now what after ? where is sql terminal to get a rev shell?

http://freelancer.htb/admin/

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	366	113,491	6 hours ago Last Post: llsdd9
	HTB Eloquia User and Root Flags - Insane Box	69646B	14	17,671	08-21-2026, 07:27 PM Last Post: tangol
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	94	26,295	08-21-2026, 06:20 AM Last Post: jamoski
	[FREE] HTB-ProLabs APTLABS Just Flags	kewlsunny	25	19,561	08-15-2026, 06:06 PM Last Post: m4573rx
	HTB - ALL Challenges you Stuck in	osamy7593	3	17,714	08-15-2026, 01:58 AM Last Post: 0xIDA