# Previse

Previse

Thursday, 25 November, 2021 9:40 PM

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FpOvg2yIwP1z9ci0xwl6L%2F0?alt=media) ![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FmV2l1nXGnULXFVgAT4Bz%2F1?alt=media) ![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FdECW5vuc5SbUZsGVhvBd%2F2?alt=media)

Maybe there is other php files ?

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2F0XW85iQ4hvgxzNKJQSA8%2F3?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FjGGeZXMacZcxY1eAKmn9%2F4?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2Fxeqi74invHGGyCbQKkVw%2F5?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2F9q8VrzzLhWUyfCuQjOqK%2F6?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FEyiKcoFuErkQsqBF3jOH%2F7?alt=media)Get the response at burp

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FGtVP8sPttO3PlzDwmhGH%2F8?alt=media)

Forward the request until the response appear

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2F7nqvGtDMdmCvGmb5b2pA%2F9?alt=media)

Then change 302 to 200 and forward it

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2Fd6pdHdaR2UjVkISYy7ae%2F10?alt=media)

Then , on browser we will see the the adding user page

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FVptff9S8mrrSWCYrW1vZ%2F11?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FJ0PpJVPGWgz8Gw0sE8kK%2F12?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FO5rLnbs9z6evPC8AlbIO%2F13?alt=media) ![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2F3fvxTHc6ZetRR3VpvsqC%2F14?alt=media) ![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2F7mtuOxyCIhyW2WTPt8s4%2F15?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FSCK0No09MjcEFI7HDkNB%2F16?alt=media)

We might ask server for shell >:D

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FHr7RdPbqKqcv0AWukC0T%2F17?alt=media)

Forward it and we get a shell !

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FYmwEHEyF8u2Xd6Dehlpp%2F18?alt=media)

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FAPJCQyhzxwv6Du4m5PNU%2F19?alt=media)

Command has no absolute path !

![](https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FD7bZwA8zVoLIGaeEiky4%2F20?alt=media)

<figure><img src="https://2011733002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUXBmBmYDcC25imVwnzZE%2Fuploads%2FJFhZr9vFFQ2s1QpzOZSZ%2Fimage.png?alt=media&#x26;token=90c2c6e8-39fc-44c7-aa04-ae00951d0954" alt=""><figcaption></figcaption></figure>

System will find "gzip" executable using the environment which by default is at usr/bin ":" means or

We can change the environment to export PATH=/dev/shm:$PATH so that

The system will start search at /dev/shm for our created "gzip" executable and run it

https\://[www.hackthebox.com/achievement/machine/336799/373](http://www.hackthebox.com/achievement/machine/336799/373)
