Programming & Development
0
UPVOTE
dev.to

TryHackMe : Infinity Pool Writeup

Summary Recon on <MACHINE_IP> revealed a Gunicorn-hosted "Byte Lotus" hotel site with two paths disallowed in robots.txt - /internal/ and /status. The /status page exposes an internal staff tool ("Sister-property connectivity") that POSTs a host parameter to /internal/netcheck, which shells out to ping without sanitizing input. This allowed OS command injection as the web user, leading to an initial foothold and the user flag. From there, an internal-only "Watchtower" ops console (127.0.0.1:3000) leaked FreePBX UCP credentials that were explicitly noted as unrotated default template creds. Logging into the UCP dashboard (via SSH port forwarding, since curl-based login kept looping) and adding a voicemail widget exposed an "Automation Key" bearer token that had leaked into a caller-ID field. That key authenticated to a root-run internal automation service (127.0.0.1:9000), whose /jobs/export endpoint built a shell command from an unsanitized report parameter - a second
Sofia Bennett

Sofia Bennett

2h ago
0 0

Discussion

Get the discussion rolling

A single comment can start something great.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

No upvotes yet.

Be the first to show your appreciation for this content.

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

infoq.com
AI Is Transforming Incident Response - but the Hardest Problems…

Artificial intelligence is rapidly changing how engineering teams respond to production incidents, offering the ability to summarize incident channels, analyze…
IN

InfoQ

2026-08-07 13:50
0
bbc.com
US strikes $1.2B deal to pay German firm to halt offshore wind …

Comments
FK

Fashion Kavitha

just now
0
css-tricks.com
2026 State of CSS, Devs Surveys

A few notes and takeaways from the 2026 State of CSS survey results, including a nice CSS-Tricks cameo! 2026 State of CSS, Devs Surveys originally handwritten…
CS

CSS-Tricks

3h ago
0
dev.to
When ‘Are We Affected?’ Requires Reconstructing Yesterday’s npm…

The concrete problem A package is reported compromised. Your security channel immediately fills with one question: did we ship it? Looking at the repositor…
FK

Fashion Kavitha

8h ago
0
dev.to
I built 623 web tools with AI. Ad revenue: about $0.07 a day. A…

Numbers first. What I built: 623 browser-based web tools × 5 languages (ja/en/es/fr/pt) How: an AI-driven generation pipeline, nearly fully automated Current…
DC

DEV Community

10h ago
0
dev.to
Cache and Redis: Why and How to Use

Imagine your application makes thousands of queries to the same database. All this traffic generates latency, CPU load, disk load, and increases costs. In such…
DC

DEV Community

14h ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Programming & Development.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

dev.to
When ‘Are We Affected?’ Requires Reconstructing Yesterday’s npm…

The concrete problem A package is reported compromised. Your security channel immediately fills with one question: did we ship it? Looking at the repositor…
FK

Fashion Kavitha

8h ago
0
dev.to
I built 623 web tools with AI. Ad revenue: about $0.07 a day. A…

Numbers first. What I built: 623 browser-based web tools × 5 languages (ja/en/es/fr/pt) How: an AI-driven generation pipeline, nearly fully automated Current…
DC

DEV Community

10h ago
0
dev.to
Cache and Redis: Why and How to Use

Imagine your application makes thousands of queries to the same database. All this traffic generates latency, CPU load, disk load, and increases costs. In such…
DC

DEV Community

14h ago
0
dev.to
Nobody Hacked the CRM Software. They Just Logged In

Originally published at ictcrm. com Short answer: the CRM software was not broken. In the biggest CRM breaches of 2026, attackers turned up holding a valid c…
Sophie Weber

Sophie Weber

23h ago
0
dev.to
Create multilanguage apps in Laravel with Laratext

You have a Laravel app in English and you need it in Spanish too. The built-in __() helper works, but it forces an awkward trade. Either your templates are ful…
Anna Theodorou

Anna Theodorou

1d ago
0
dev.to
Serving Gemma 4 2B on a Single TPU v5e Chip with MCP and Antigr…

This article is the v5e follow-on to the v6e-1 debugging guide. Same MCP tooling, same Antigravity CLI driver, smaller and cheaper silicon — and a different se…
HA

Hans

1d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest