Filtered View

Tag: #php-deserialization

1 posts

Web HTB Cyber Apocalypse 2023 — The Cursed Mission

UnEarthly Shop: MongoDB Aggregation to PHP Object Injection

An HTB Cyber Apocalypse 2023 write-up chaining MongoDB $lookup, mass assignment, and autoloader abuse to reach a Monolog deserialization gadget and execute /readflag.

#writeup#mongodb#nosql-injection#mass-assignment
hard 3 min read