Pallangyo98/Trickster-HTB

PoC

This report details exploiting Trickster via an XSS in PrestaShop (CVE-2024-34716) to gain www-data access, extracting database credentials for SSH as james. A root shell in Docker is obtained via ChangeDetection.io (CVE-2024-32651), revealing adam’s credentials, followed by root escalation with CVE-2023-47268 in PrusaSlicer.

view exploit source poc_in_githubauthor Pallangyo98published 2025-02-19catalog poc_in_github

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2023-47268US	—	0.72% (54th)	Exploit	2026-05-08
In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code expo…
CVE-2024-34716US	medium6.1	56.4% (99th)	Exploit	2024-05-14
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is prese…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan