📌 Description

This Python script demonstrates a full exploitation chain for the Era machine on Hack The Box. It performs:

• User login as yuri
• Reset of the admin account’s security questions
• Login as admin via security bypass
• Enumeration of available file IDs
• File upload (if no files were found on server)
• Triggering remote code execution via a misused ssh2.exec handler
• Optional automatic listener launch via nc

---

⚠️ Prerequisites

• HTB VPN connected

• http://file.era.htb added to /etc/hosts:

• Python 3.7+

• Required tools:

• curl (only for testing)

• nc (netcat) for reverse shell

• requests module (should be pre-installed)

---

🛠️ Usage

python3 era_rce.py <your-IP> <your-port>

If you want to skip automatic listener:

start netcat nc -lvnp 5050

execute code python3 era_rce.py 10.10.14.60 5050 --no-listen