[l3rka]

How did you manage to find http://sea.htb/index.php?page=loginURL

find in exploit
https://github.com/prodigiousMind/CVE-20...exploit.py

[frfrfrfrfrfrf]

How did you manage to find http://sea.htb/index.php?page=loginURL

no need for this ?page just put loginURL and it will take you to the login.

[teky]

anything for the root?

[DeDeLaPouille]

anything for the root?

Not yet, maybe in opt/google/chrome ?

[andy1]

login page
http://sea.htb/index.php?page=loginURL

how did you find this login page?

[GilbertoCosta]

os injection on internal 8080 port ))

[peRd1]

How did you manage to find http://sea.htb/index.php?page=loginURL

Enumerate the whole site. You can find in the theme this - http:// sea.htb/themes/bike/README.md - you confirm it's wonderCMS, find the required CVE, and yes, it's CVE-2023-41425. It won't work by itself, check the script how it creates the xss.js, how it installs the module (from where?) and the how revshell is being fired up. You need to adapt little things and don't just edit the xss.js then re-run the python expl since it's going to recreate it, lol. Simple things like this result in struggles. Once you get shell, check for creds, there's the database.js file, it's for the said user (see above in this thread), and you'll end up with user.

Root - check for what's running on the box, portfwd to it, check it out, how it works (see how it requests those log files the log analyzer), find the vulnerability, use and abuse - you can leak the flag or pop a revshell, do whatever.
Hint - command injection, perhaps?

[kewlcat002]

os injection on internal 8080 port ))

I confirm that it is true indeed

[ametah]

i got shell but permission denied to read user.txt at /home/amay/user.txt
I see password $2y$10$iOrk210RQSAzNCx6Vyq2X.aJ\/D.GuE4jRIikYiWrD3TM\/PjDnXm4q but don't know what to do with it.

[osamy7593]

lol only me after foothold did /usr/bin/bash -p and got root lol