PS - Exploiting vulnerabilities in LLM APIs

• Access the lab here

Instructions

Instructions

Solving

When we launch the lab we get on this page:

We need to click on Live Chat to access the AI Chatbot.

First we can ask it which API it uses:

Now we could ask more info about the newsletter for example:

We can also try to add an address to the newsletter:

In the above screen capture, we asked the newsletter to add an email address. As we have access to an email client we can ask to be added. And then we can try to inject a command. Here we inject whoami and it works as we can see below.

cmd

So as the goal is to delete a specific morale.txt file in Carlo's home directory we can try to inject: rm /home/carlos/morale.txt If we try to print the file with cat it won't work because it says the address is invalid, however if we rm the file the lab is solved

remove

And we solved this lab :)

Solved