HackTheBox : Void Whispers Writeup

Short summary

A detailed HackTheBox CTF writeup demonstrating OS command injection in a PHP mail-settings panel. The sendMailPath field is passed unsanitized into shell_exec() with only a whitespace regex filter, which is bypassed using bash's ${IFS} variable. The author confirms execution via timing delays, exfiltrates data through an out-of-band webhook callback, and ultimately reads the flag file.

• •sendMailPath passed directly to shell_exec() with no escaping beyond a whitespace regex
• •${IFS} bypasses the space filter since it contains no literal space character
• •Command execution confirmed via timing oracle and OOB webhook callback, flag exfiltrated via curl

Generated with AI, which can make mistakes.