Include

Include

🔍 LFI Analysis

🕵️ Let’s check the inputs:

💻 When we update the field, it updates the display accordingly:

As you can see, the request goes to an internal server. While exploring the settings, I found a place to update the banner. Since it fetches from an external URL, I tried to pass a request to it:

The result:

🕵️ Exploiting SSH Credential Leakage

🔑 So, I logged into the sysmoon app using those credentials:

💡 Next, I used a wordlist for the LFI exploit: https://github.com/danielmiessler/SecLists/blob/master/Fuzzing/LFI/LFI-Jhaddix.txt

⚡ Then, I added it to Replay in Caido (you can also use Burp Suite):

joshua:x:1002:1002:,,,:/home/joshua:/bin/bash
charles:x:1003:1003:,,,:/home/charles:/bin/bash

⚡ Privilege Escalation

📌 You can see there are two users, so I tried brute-forcing SSH: 🏁 I got it!