TryHackMe 'Infinity Pool' CTF: Dual Command Injections Lead to Root Access

·1 views

A TryHackMe capture-the-flag challenge called 'Infinity Pool' centered on a fictional hotel website called 'Byte Lotus', hosted via Gunicorn on port 80. An unsanitized host parameter in an internal network-check tool allowed OS command injection, granting an initial foothold and the user flag. An internally exposed operations console on port 3000 leaked unrotated FreePBX credentials, and accessing its dashboard via SSH port forwarding revealed a bearer token hidden in a caller-ID field. That token authenticated to a root-run automation service on port 9000, whose report parameter was also unsanitized, enabling a second command injection as root. Chaining these two vulnerabilities — both classic command injection flaws stemming from missing input sanitization — ultimately yielded the root flag.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Vanilla JS Colour Palette Generator as Part of Weekly Project Challenge

A developer learning software engineering built a colour palette generator using only HTML, CSS, and JavaScript as part of a self-imposed challenge to ship one project per week before adopting frameworks. The tool generates a random five-colour palette on load or button click, allowing users to copy any hex code to their clipboard by clicking a colour swatch or its icon. Key techniques used include DOM manipulation, event delegation on a parent container for better performance, and the browser's Promise-based navigator.clipboard API for handling copy actions. A visual confirmation feature briefly swaps the copy icon to a checkmark for 1.5 seconds to provide clear user feedback. The developer plans future improvements such as locking individual colours, saving palettes via localStorage, keyboard shortcuts, and CSS variable exports.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How S3 Object Lock Compliance Mode Meets FINRA Recordkeeping Rules in 2026

FINRA Rule 17a-4(f) requires broker-dealers to store electronic records in a non-rewriteable, non-erasable (WORM) format, and S3 Object Lock in Compliance mode is the accepted technical standard for satisfying this requirement. Unlike Governance mode, Compliance mode prevents deletion or modification by any user, including administrators, until the retention period expires. Major storage platforms including AWS S3, MinIO, Wasabi, and RustFS support full Compliance mode locking, while systems like SeaweedFS and Garage offer no Object Lock support at all. FINRA enforcement actions related to recordkeeping reached approximately 340 cases in 2025, with average fines of $225,000 per firm, underscoring the regulatory risk of non-compliant storage. Around 73% of firms now use cloud-based WORM storage for 17a-4(f) compliance, though self-hosted solutions can be significantly more cost-effective at data volumes above 50 terabytes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Claude Code's Weekly Usage Limit Works and How to Avoid Hitting It

Claude Code enforces two overlapping usage limits: a rolling 5-hour window that resets after a short wait, and a harder weekly cap that can lock users out for days regardless of how long they wait. Both limits draw from a shared pool that covers Claude Code, claude.ai chat, and Cowork simultaneously, meaning activity outside the coding tool still depletes the same budget. Usage drains faster than expected because Claude Code sends the full conversation history with every request, making long sessions, cache misses after breaks, and compaction operations particularly costly. Background agent tasks and parallel teammates can consume roughly seven times the tokens of a normal session, silently exhausting the weekly allowance. Users can monitor both limits, reset times, and per-feature usage attribution in real time by running the built-in /usage command or visiting the Usage section in claude.ai settings.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Opinion Piece Claims Climate Narrative Built on Fundamental Deception

An opinion article published by Current Affairs argues that a significant falsehood underpins mainstream climate discourse. The piece contends this deception poses a serious threat to human civilization. The article was shared on Hacker News, where it received 3 points and no comments at the time of indexing. The original source URL and discussion thread are publicly accessible. Insufficient article detail is available to summarize the specific claims made within the piece.

0 comments Read more at Hacker News