Chemistry

1. CIF File upload
2. CVE-2024-23346 to run a python script flaw in the pymatgen library cve
3. Get a reverse shell to our machine

---

1. netstat -tunlp | grep LISTEN -> A localhost server is running on port 8080
2. curl -I localhost:8080 -> An AIOHTTP/3.9.1 server is running here
3. CVE-2024-23334 github bash cript
4. This script does not give us any output as the static folder might not be same in our target machine
5. curl localhost:8080

6. Reading through the request, we can see it is fetching data from the assets folder.

7. Modify the github exploit to use assets as the payload instead of static. Run the bash exploit again to get the /root/root.txt flag.