Parameter Fuzzing

May 15, 2023

Interface – HackTheBox Writeup

Thoviti Siddharth Uncategorized API, Arithmetic Expression Injection, code review, Curl, CVE-2022-28368, Directory Fuzzing, DomPDF, exiftool, ffuf, HackTheBox, HTB, Infosec, Linux Box, Parameter Fuzzing, pspy, Writeup 0

Machine Name: Interface
IP: 10.10.11.200
Difficulty: Medium

Summary

Interface is a medium machine that requires some “curling” skills to form request and demystify their respective response codes. The machine has a lot of fuzzing for API endpoints and parameters which lead to an exploit for DomPDF. The vulnerability deals with how DomPDF caches the font file and allows remote files to be read. The privilege escalation teaches a new technique that abuses Arithmetic Expression Injection in bash scripts.