---
description: https://app.hackthebox.com/challenges/lovetok
---

# LoveTok

<figure><img src="https://content.gitbook.com/content/KdaWjtRJTpQ2jgzGIr4R/blobs/L4uudEs4jbXdxjHI9Mpa/grafik.png" alt=""><figcaption></figcaption></figure>

By pressing on "Nah, that doesn't..." we get redirected to http://IP:PORT/?format=r which indicates to command injection. Starting with a basic command like ls so format=id or format=ls just prints the date in different formats.  So we need to escape the routine this can be done with the following payload

```
${system($_GET[cmd])}&cmd=ls /
```

Now we can see where the flag is store and get it using cat

<figure><img src="https://content.gitbook.com/content/KdaWjtRJTpQ2jgzGIr4R/blobs/0yOAPPoBbm8lql6H0EYQ/grafik.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://content.gitbook.com/content/KdaWjtRJTpQ2jgzGIr4R/blobs/dmUo3UffCO1AtyqDGh8T/grafik.png" alt=""><figcaption></figcaption></figure>
