This post is password protected
This write-up is locked to comply with HTB’s Terms of Service. Use the flag as the password once you’ve solved the challenge.
Overview
- Initial analysis
- Application functionality
- Source code review
- Source code analysis
- 1. Entry point - Register/Login
- 2. The Attack surface - order.php
- 3. Magic method in Models and Helpers
- Vulnerability Discovery
- PHP Object Injection (POP Chain)
- POP Chain flow
- Exploitation
- Crafting the payload
- Build Python Exploit
- Key takeaways
- References