http://www.adhikariashwin0.com.np/tags/eval-injection/ Recent content in Eval Injection on the008Killer Hugo en Sat, 30 May 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/hackthebox/interpreter/ Sat, 30 May 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/hackthebox/interpreter/ <h2 id="overview">Overview</h2> <table style="width:100%; table-layout:fixed;"> <thead> <tr> <th style="width:40%; text-align:left;">Category</th> <th style="width:60%; text-align:left;">Info</th> </tr> </thead> <tbody> <tr><td>Machine Name</td><td>Interpreter</td></tr> <tr><td>Difficulty</td><td>Medium</td></tr> <tr><td>Release Date</td><td>21 February, 2026</td></tr> <tr><td>Author</td><td>ReziT</td></tr> <tr><td>OS</td><td>Linux</td></tr> <tr><td>Pwned Date</td><td>23 February, 2026</td></tr> </tbody> </table> <hr> <h2 id="enumeration">Enumeration</h2> <h3 id="port-scan">Port Scan</h3> <p>Initial enumeration revealed the following open ports:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">PORT STATE SERVICE VERSION </span></span><span class="line"><span class="cl">22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 <span class="o">(</span>protocol 2.0<span class="o">)</span> </span></span><span class="line"><span class="cl"><span class="p">|</span> ssh-hostkey: </span></span><span class="line"><span class="cl"><span class="p">|</span> <span class="m">256</span> 07:eb:d1:b1:61:9a:6f:38:08:e0:1e:3e:5b:61:03:b9 <span class="o">(</span>ECDSA<span class="o">)</span> </span></span><span class="line"><span class="cl"><span class="p">|</span>_ <span class="m">256</span> fc:d5:7a:ca:8c:4f:c1:bd:c7:2f:3a:ef:e1:5e:99:0f <span class="o">(</span>ED25519<span class="o">)</span> </span></span><span class="line"><span class="cl">80/tcp open http Jetty </span></span><span class="line"><span class="cl"><span class="p">|</span>_http-title: Mirth Connect Administrator </span></span><span class="line"><span class="cl"><span class="p">|</span> http-methods: </span></span><span class="line"><span class="cl"><span class="p">|</span>_ Potentially risky methods: TRACE </span></span><span class="line"><span class="cl">443/tcp open ssl/http Jetty </span></span><span class="line"><span class="cl"><span class="p">|</span>_http-title: Mirth Connect Administrator </span></span><span class="line"><span class="cl"><span class="p">|</span> http-methods: </span></span><span class="line"><span class="cl"><span class="p">|</span>_ Potentially risky methods: TRACE </span></span><span class="line"><span class="cl"><span class="p">|</span> ssl-cert: Subject: <span class="nv">commonName</span><span class="o">=</span>mirth-connect </span></span><span class="line"><span class="cl"><span class="p">|</span> Not valid before: 2025-09-19T12:50:05 </span></span><span class="line"><span class="cl"><span class="p">|</span>_Not valid after: 2075-09-19T12:50:05 </span></span><span class="line"><span class="cl"><span class="p">|</span>_ssl-date: TLS randomness does not represent <span class="nb">time</span> </span></span><span class="line"><span class="cl">6661/tcp open unknown </span></span><span class="line"><span class="cl">Service Info: OS: Linux<span class="p">;</span> CPE: cpe:/o:linux:linux_kernel </span></span></code></pre></div><p>The two localhost-only ports stood out immediately as targets for SSH tunneling after gaining a foothold.</p>