↓Skip to main content

pspy

2023

Htb Gofer

·21 mins
HTB Linux htb-hard SMB cme wfuzz phishing macros LibreOffice SSRF gopher Gopherus smtp pspy Ghidra dangling-pointer use-after-free path-hijack
Gofer is a hard linux box, I discovered a HTTP proxy vulnerable to Server-Side Request Forgery. Utilizing this SSRF vulnerability, I sent a phishing email through the internal SMTP server via the gopher protocol, embedding a malicious macro that activates upon document opening. Next, I obtained user credentials from a background process linked to the proxy. Finally, I found a vulnerability in the ’notes’ binary, exploiting a use-after-free vulnerability associated with a dangling pointer.