Hack The Box Web Pentest 2019

Posted 2022-05-29 qftm

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Hack The Box Web Pentest 2019相关的知识，希望对你有一定的参考价值。

[20 Points] Emdee five for life [by L4mpje]

问题描述：

Can you encrypt fast enough?

技术图片

初始页面，不管怎么样点击Submit都会显示"Too slow!"

技术图片

依据html源码，编写Python脚本进行利用

技术图片

import requests
import hashlib
import re

url="http://docker.hackthebox.eu:34650/"

r=requests.session()
out=r.get(url)

rr = re.compile(r"<h3 align=‘center‘>(\\S+)</h3>", re.I)
str1 = rr.findall(out.text)
str2=hashlib.md5(str1[0].encode(‘utf-8‘)).hexdigest()

data=‘hash‘: str2
out = r.post(url = url, data = data)

print(out.text)

Run result

<html>
<head>
<title>emdee five for life</title>
</head>
<body style="background-color:powderblue;">
<h1 align=‘center‘>MD5 encrypt this string</h1><h3 align=‘center‘>JBUxqcV4rWsw17043rxv</h3><p align=‘center‘>HTBN1c3_ScrIpt1nG_B0i!</p><center><form action="" method="post">
<input type="text" name="hash" placeholder="MD5" align=‘center‘></input>
</br>
<input type="submit" value="Submit"></input>
</form></center>
</body>
</html>

[20 Points] Fuzzy [by Arrexel]

问题描述：

We have gained access to some infrastructure which we believe is connected to the internal network of our target. We need you to help obtain the administrator password for the website they are currently developing.

技术图片