Finally, I managed to root this box. First, thanks to @MrR3boot for creating it, but I don’t really like this machine, the user part isn’t real lifelike, but anyways, I learned new things with the root part.
These are my hints.
USER:
If you aren’t a native English speaker as I’m, and you need to “open” something to get the result that you want, try to be literal with the words. Think like if you are guiding someone to do something. Word by word.
ROOT:
This part is plenty of rabbit holes, I think that I fell in all of them before finding the correct path.
To avoid waste time in rabbit holes, check versions of the things that you are trying to exploit. The exploit is not very common or famous.
Focus on the cat and try to find his four legs. Read it carefully and look for each word that seems to be suspicious on Google.
This is the first machine that I asked for help, thanks to @bumika and @w4x for helping me.
@Warlord711 said:
I think this is the first machine that I skip. I like the idea but to test 20+ TTS to find one that works is just waste of time.
You will find it in second google result and its so obvious available best utility for *nix. Hint: Let’s Celebrate the xxxxxxxx
Mmm Im trying with that tool, trying like “do XXX and now XXX”, but some stuff is not being interpeted correctly, am I in the right path? otherwise Im kind really confused (I already know literally commands…doesn’t work, that made me to change the approach on how to tell), is there any special hint if Im ok?
Hmm totally stuck on init foothold, how are people getting AI to recognize any symbols/punctuations besides the ones on i********e.p, I only have words so far.
or if this is not even needed to get the required info out of the qy page
Pay attention to what is said on i*********e.**p and do some googlefu
Well… both user and root were not so hard as I thought from the beginning.
Thanks to @mRr3b00t for one more enjoyable box
Many thanks to @bumika for initial foothold nudge due I totally missed the hint
For user:
If you know the way but can not pass through some specific symbols - make sure that you fully read the page with the reference table. What if you will be able to find missed parts somewhere outside the box?
For root:
Enumerate. Check if you understand what every unusual executable\service doing, check every parameter to know how it works exactly and you will find something interesting.
Box is exploitable and as was written above - you don’t need to wait to trigger it, so continue to check if you found yourself waiting things to be done.
This machine is a real pain in … .
I got the idea. I found internal reference. I found external reference.
I have managed to generate output proving existence of the vulnerability, but still cannot proceed further.
I understand that I need to perform full blown manual exploitation of the vulnerability but there are still too many unknowns. For instance how to make it to generate a number (I mean numeral number not the word)? Internal reference is lacking info, external does not work. Really frustrating.
Edit:
Got user, many thanx to @bumika !
Sorry to say, but this was really insane. Even knowing what to do, finding the voice …
Not a great fan to be honest.
Just rooted. Regarding user I already wrote everything in my previous post. Amount of time I spent on finding the voice … well Im still very angry. It was very CTFish and Im not fan of that.
Root part was nice. Classified as difficult (by users), but for someone who knows this particular solution very long, finding the right “thing” to exploit takes only a short while. Just a quick look and you see that there is something what basically should not be there.
Author of the box has of course viciously eliminated possibility to connect and use default set of exploit parameters to complete the machine, but finding an alternative should not take more than a few minutes. Overal the root part very enjoyable. Well done @MrR3boot !!!
Finally got this one rooted. This box was a huge pain, even when you know what needs to be done. As others have said, don’t even bother with offline tts (I was not able to get the celebrated recommendation to be recognized properly). I ended up getting it to work with an online tts demo from a well known company. it’s elementary my dear
Root was very interesting and can be done manually, or via a script, but there are a few quirks about the process.
I just got root. Painful box, The only thing that I learnt that box is patient. Try again, try again, try again. Unstable exploits, a bit guessing, broken implementation. Painful ever box in HTB.
