$ file privacy.odtprivacy.odt: Zip archive, with extra data prepended$ unzip privacy.odtArchive: privacy.odtwarning [privacy.odt]: 2919 extra bytes at beginning or within zipfile (attempting to process anyway) extracting: mimetype creating: Configurations2/accelerator/ creating: Configurations2/images/Bitmaps/ creating: Configurations2/toolpanel/ creating: Configurations2/floater/ creating: Configurations2/statusbar/ creating: Configurations2/toolbar/ creating: Configurations2/progressbar/ creating: Configurations2/popupmenu/ creating: Configurations2/menubar/ inflating: styles.xml inflating: manifest.rdf inflating: content.xml inflating: meta.xml inflating: settings.xml extracting: Thumbnails/thumbnail.png inflating: META-INF/manifest.xml$ cat content.xml
*snip*</text:p><text:p text:style-name="P1">Nocturnal has set the following temporary password for you: arHkG7HAI68X8s1J. This password has been set for all our services, so it is essential that you change it on your first login to ensure the security of your account and our infrastructure.</text:p><text:p text:style-name="P1">The file has been created and provided by Nocturnal's IT team. If you have any questions or need additional assistance during the password change process, please do not hesitate to contact us.</text:p><text:p text:style-name="P1">Remember that maintaining the security of your credentials is paramount to protecting your information and that of the company. We appreciate your prompt attention to this matter.</text:p><text:p text:style-name="P1"/><text:p text:style-name="P1">Yours sincerely,</text:p><text:p text:style-name="P1">Nocturnal's IT team</text:p></office:text></office:body></office:document-content>
amanda : arHkG7HAI68X8s1J
User
Access admin panel
Review admin.php source to reveal injection in password field (whitespace)
Now backup and download with nocturnal_database.db file added
Inspect database
$ sqlite3 nocturnal_database.db
sqlite> .dumpPRAGMA foreign_keys=OFF;BEGIN TRANSACTION;CREATE TABLE users ( id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT NOT NULL UNIQUE, password TEXT NOT NULL);INSERT INTO users VALUES(1,'admin','d725aeba143f575736b07e045d8ceebb');INSERT INTO users VALUES(2,'amanda','df8b20aa0c935023f99ea58358fb63c4');INSERT INTO users VALUES(4,'tobias','55c82b1ccd55ab219b3b109b07d5061d');INSERT INTO users VALUES(6,'asdf','912ec803b2ce49e4a541068d495ab570');CREATE TABLE uploads ( id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL, file_name TEXT NOT NULL, upload_time DATETIME DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY(user_id) REFERENCES users(id));INSERT INTO uploads VALUES(4,2,'privacy.odt','2024-10-18 02:05:53');INSERT INTO uploads VALUES(5,6,'test.pdf','2025-04-15 17:29:29');INSERT INTO uploads VALUES(6,6,'test.pdf','2025-04-15 17:36:46');DELETE FROM sqlite_sequence;INSERT INTO sqlite_sequence VALUES('users',6);INSERT INTO sqlite_sequence VALUES('uploads',6);COMMIT;sqlite> .exit
