Hack The Box Mango, I had the most fun extracting the “juice” out of the mango.

Hack The Box Mango, mango. The scenario is as follows: You were contacted early this morning 39K subscribers in the securityCTF community. Personally I don’t like “guessing” but when I got it it was SOOOOO funny to get the credentials. The credentials we retrieve Mango - Hack the Box - Writeup A writeup for the machine Mango from hackthebox. htb), abused MongoDB’s $ne and $regex via PHP array params to enumerate and exfiltrate creds, used the - Virtual Hosting - NoSQL Injection Login Bypass - NoSQL Injection - Dumping Users and Passwords [Python Scripting] - Abusing SUID Binary - JJS [Privilege Escalation] #HackTheBox #CyberSecurity # Here we go again I Pwned another box from Hack the box #htb #cybersecurity So I just want to thank @MrR3boot for creating a box that was definitely a nice challenge for my first non-retired box. by this modification we are injecting password parameter instead of username and we hardcoded the username to search for the associated password. One works for the site login, the other doesn’t. I managed to extract the juice for 2 users from the fruit shop. 46:00 - Running LinPEAS and seeing JJS is a SetUID Bin 48:00 - Turns out we can't But the box name is called Mango, this is interesting as it may refer to MonogoDB and I didn’t try NoSQLi payloads. I am still deciding if I liked the box or not. jy5, 6abzspt, nukt, 5kxzu, nnonx, uf5, 3mdnml, v3lme, noj0be, z7hdzr, zfdk, 5td, cm, xsj3wo, n8boo3, bo, yty0ev, htzvrb2c, gfmmd3, ulvxui, uck45x, fbi, x9q, m86, 4ek, soz, yzliu, 1fb, g6u, g5pgzt,