XXE
OFFSEC - Proving Grounds - GLIDER
·1919 words·10 mins
OFFSEC PG PRACTICE
XXE
PHP FILTER
PSPY
MQTT
XXE on port 80 enables PHP file reads and RCE. After gaining access, pspy64 reveals Mosquitto credentials; subscribing to the MQTT topic exposes root credentials.
OFFSEC - Proving Grounds - SCARECROW1.1
·1985 words·10 mins
OFFSEC PG PRACTICE
XXE
PHP WRAPPER
NEWLINE INJECTION
SUID
Used XXE and PHP wrappers to read files/source code, bypassed the upload blacklist with a PHP reverse shell for initial access, then exploited SUID find to escalate privileges to root.
OFFSEC - Proving Grounds - CONVERTEX
·2078 words·10 mins
OFFSEC PG PRACTICE
XXE
SELENIUM
CHISEL
XXE in web application on port 5000 and leaks gustavo SSH private key for initial access. Forward selenium port 4444 with chisel, exploit with Python script to gain root.