Attacking Common Applications - Skills Assessment II

22

Try: ffuf -w subdomains-10000.txt -H “Host: FUZZ.inlanefreight.local” -u http://MACHINE_IP -fs {size}

3 Likes
23

Can you please give me a hint what exploit did you use to get root user?
I tried different things, but got only RCE with www-data exploiting Nagios

24

I used metasploit, search Nagios XI 5.7.5 and there are two exploit.

1 Like
25

Thx, got it!
My mistake was that I thought that the flag is in /root folder, but it was in /usr/local/nagiosxi/html/admin :slight_smile:

4 Likes
26

I’m glad you solved :wink:

28

Can anyone help with getting the admin password. I have tried the default creds as well as bruteforcing using rockyou.txt but no lick

29

nvm solved it

30

i am stuck in the first question in the lab [Attacking Common Applications - Skills Assessment II]
What is the URL of the WordPress instance?

i did resolve all the other question exept the fisrt one , ant hint please

1 Like
31

To help others reading this, try FFUF-ing.

32

Thanks for the clue! i spent hours doing it the hardway!

1 Like
34

I cant find the third vHost if my life dependend on it I have done all except that one the format i am using is this n*****.something.something

35

Hello dear. I am stuck at the same point. Did you get it finally ?
I have found it.

36

This was very easy.Everything you need is in Gitlab projects. Vhost for network monitor is there, password and username is also there. When you login to network monitor research for exploit.

37

How did you find the wordpress url, what wordlist did you use for ffuf and is it just the gitlab.inlanefreight.local:8180 domain?

38

Hello. I think @Baudejas already answered your question. but for wordlist you can use the following /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt

39

isnt that wordlist for subdomains not wordpress?

40

The wordpress URL is a subdomain or vhost.

44

OK Guys. It is an easy one. But for some reason, the first answer does not like the https in the URL. just make it http instead and stop looking endlessly.

45

Why are the questions in HTB Academy so vague.
They could simply ask, “What are the other vhosts?” or "What theme is being used in WordPress?
And trailing slash is not accepted.

http://xxxxx.inlanefreight.local/
46

how did u find it ???