> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-armaxis.md).
# HTB - Armaxis
the zip file password protected use the password provided to unzip the file.
there is a database file in the challenge directory.
the database file leaks the admin user name
### HTTP
that said browsing to the given ip addresses leak a login page with reset functionality and email access page of
observing the password reset functionality source code leak a vulnerability
```powershell
router.post("/reset-password", async (req, res) => {
const { token, newPassword, email } = req.body;
...
const reset = await getPasswordReset(token); // looks up token only
if (!reset) return res.status(400).send("Invalid or expired token.");
const user = await getUserByEmail(email); // <-- separate lookup, unrelated to `reset`
...
await updateUserPassword(user.id, newPassword); // updates whichever user `email` points to
```
`reset` (found via `token`) is never cross-checked against `email`. The code confirms the token is *valid* (exists, not expired) but never confirms it belongs to the account being reset. So:
* Register your own account (`you@email.htb`)
* Call `/reset-password/request` with your own email → you legitimately receive a valid, unexpired token (via the MailHog inbox you already have working, since it's hardcoded to `test@email.htb` so register/reset using `test@email.htb` as your account email to actually receive it)
* Then call `/reset-password` with:
* `token` = the token you received
* `email` = `admin@armaxis.htb`
* `newPassword` = whatever you want
Since `getPasswordReset(token)` only validates the token itself and `getUserByEmail(email)` is looked up independently, this resets **admin's** password to your chosen value full auth bypass / account takeover, no admin email interaction needed.
### Resetting the admin password via IDOR
First register a account as
use the reset functionality to send a reset token.
observing the email page we get a token to reset.
use the token for resetting
change the email address to admin email and click forward this resets the admin user password.
and it worked admin password is reset. we can use that to login.
there is a dispatch functionality available for admin.
enumerating the source code revealed a command injection vulnerability
The url comes straight out of the markdown image syntax !alt in the note field, and it's interpolated directly into a shell command string passed to execSync. No sanitization, no escaping, no allowlist on the URL. Since execSync runs via /bin/sh -c, anything with shell metacharacters (;, |, \`, $(), &&) in that "URL" gets executed as a separate/chained command.
### Command execution via /dispatch
similarly i can read the flag.txt
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-armaxis.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
