Celestial hint

There are some reverse shells for this platform that should not crash the server - according to a comment in the code. As far as I can tell from my tests this is not true (unless every time I tested with such shells somebody crashed the server with their hack).

Otherwise, it’s a really interesting box. I also agree with @3ndG4me that you don’t need THAT ARTICLE. Seems I did not find it initially, but used only more generally advice on vulnerabilities in code in this language - which evil function not to use as a developer :wink: I learned a lot from building up my own exploit code, testing snippets in the browser console locally etc. You can trigger different server-side messages, and one will confirm that you are on the right track as it mentions the evil function :wink:

I also tried different variations for the reverse shell code in that language - seems with some shells you get you an initial connect but then they aren’t stable … which can be hard to troubleshoot because of the frequents resets. I finally found THAT ARTICLE but only used the part of another linked article that creates the reverse shell - seems that shell was more stable than others. I would be interested in discussing details over PM - which reverse shell code you used and what detail of the code really makes the shell stable … I think it is related to handling errors and disconnects …