Note: the bot has no internet

Note: the flag is in a random file

meaning we need RCE

XSS

there is a bot we need XSS to get admin cookie and login as admin after trying injecting payloads in the Parameters and finally An alert popped up.

and it was in not expected parameter and there is the payload

in /upload and when you upload anything becomes in your logs and u can report it to the admin

we can get the token admin but the admin does not connect to network how can we get admin cookie??

1- Deliver payload to XSS for the bot

2-Execute document.cookie

3-make the admin upload his cookie with my cookie

4–we got admin cookie in our logs

with this payload we can get admin cookie

get admin cookie

<script>var c=document.cookie;document.cookie='token=YOUR_COOKIE;path=/upload';var f=new FormData();f.append('description',c);fetch('/upload',{method:'POST',body:f});</script>

after inject the payload in the logs and report it we can get admin cookie

after get admin cookie we can use it and /admin now is available and there is a Check health for links

now we need RCE to get the flag because it was random file how can we get RCE from SSRF ?? Now it is time for our New CVE React2shell (CVE-2025–66478)and when you type http://internal-service:1337 and check Health It sends the request powered by next.js

React2shell

Now it is time to get RCE with react2shell and this the request sent to service

and this is the request send two the service

GET / HTTP/1.1
User-Agent: DevPortal-AdminBot/1.0
Host: internal-service:1337
Connection: keep-alive

we need to make it like that

after struggling a get the perfect payload to Get RCE

RCE

we get the id

and here is the flag

flag

_nullctf{br0_7h15_3xpl017_15_50_r3c3n7_why_d1d_y0u_m4k3_7h15_4_ch4ll3ng3}_

woo-hoo, we got the flag

And that’s a wrap for this challenge — see you in the next hack!👾