Bashed Priv Esc

HTB Content Machines
1

I tried a lot. Found an interesting directory and tried many shells. Am I on the right path? Any tips for bashed privilege escalation?

2

Following with interest. I have meterpreter but only as the user. It seems hard to find working x86 priv esc for win10.

3

@rmkreborn said:
I tried a lot. Found an interesting directory and tried many shells. Am I on the right path? Any tips for bashed privilege escalation?

Try to understand how the files into this interesting directory work!

4

@LukeAger said:
Following with interest. I have meterpreter but only as the user. It seems hard to find working x86 priv esc for win10.

wrong thread

5

@lcesteves said:

@rmkreborn said:
I tried a lot. Found an interesting directory and tried many shells. Am I on the right path? Any tips for bashed privilege escalation?

Try to understand how the files into this interesting directory work!

I uploaded some php shells also. But they are not working…

6

p> @rmkreborn said:

@lcesteves said:

@rmkreborn said:
I tried a lot. Found an interesting directory and tried many shells. Am I on the right path? Any tips for bashed privilege escalation?

Try to understand how the files into this interesting directory work!

I uploaded some php shells also. But they are not working…

please advise how you upload php shells to this box? this is where i am falling down! thank you.

7

@elvskerm said:
p> @rmkreborn said:

@lcesteves said:

@rmkreborn said:
I tried a lot. Found an interesting directory and tried many shells. Am I on the right path? Any tips for bashed privilege escalation?

Try to understand how the files into this interesting directory work!

I uploaded some php shells also. But they are not working…

please advise how you upload php shells to this box? this is where i am falling down! thank you.

Shells do not have to be in php do they?

8

@keresh said:

Shells do not have to be in php do they?

As there is no upload button/form, would i be along the right lines if i try fudge it by curling it up?

I tried this but i get ‘setting file errors’?

9

@keresh said:

@elvskerm said:
p> @rmkreborn said:

@lcesteves said:

@rmkreborn said:
I tried a lot. Found an interesting directory and tried many shells. Am I on the right path? Any tips for bashed privilege escalation?

Try to understand how the files into this interesting directory work~

I uploaded some php shells also. But they are not working…

please advise how you upload php shells to this box? this is where i am falling down! thank you.

Shells do not have to be in php do they?

yes

10

@elvskerm said:

@keresh said:

Shells do not have to be in php do they?

As there is no upload button/form, would i be along the right lines if i try fudge it by curling it up?

I tried this but i get ‘setting file errors’?

yes, you might Want to GET it too

11

Does it related to crontab? I tried a lot with crontab but dont know what to do further. This is my third machine after blue and mirai

12

I also tried uploading shells including c99.php which I uploaded with txt extension and then I renamed it. None of the shells are working

13

Can anyone give me little more idea without spoiling it?

14

How did you manage to upload c99.php if you don’t mind me asking. I think I can crack this if I get a file uploaded. Thanks :slight_smile:

15

I’ve tried uploading txt files to pastbin etc and then using wget but i get error messages saying pastebin address or whatever i use cannot be resolved? please help

16

@elvskerm said:
How did you manage to upload c99.php if you don’t mind me asking. I think I can crack this if I get a file uploaded. Thanks :slight_smile:

Rename it to different format like something.txt . Then upload. Then rename it back to c99.php

17

@rmkreborn said:

@elvskerm said:
How did you manage to upload c99.php if you don’t mind me asking. I think I can crack this if I get a file uploaded. Thanks :slight_smile:

Rename it to different format like something.txt . Then upload. Then rename it back to c99.php

thanks, i’m ok with that bit. I am struggling with the process of getting the file uploaded. I have looked at the permissions of directories and it seems the correct place to try and upload would be 10.10.10.68/uploads but i am struggling to get the actual file up. I have tried curl commands and wget. i believe wget is the way to go but i thing i am missing something really easy. i have been trying to upload txt file to an upload service so i can point the bashed machine directly at this txt file location? Any advice would be massively appreciated.

18

@elvskerm said:

@rmkreborn said:

@elvskerm said:
How did you manage to upload c99.php if you don’t mind me asking. I think I can crack this if I get a file uploaded. Thanks :slight_smile:

Rename it to different format like something.txt . Then upload. Then rename it back to c99.php

thanks, i’m ok with that bit. I am struggling with the process of getting the file uploaded. I have looked at the permissions of directories and it seems the correct place to try and upload would be 10.10.10.68/uploads but i am struggling to get the actual file up. I have tried curl commands and wget. i believe wget is the way to go but i thing i am missing something really easy. i have been trying to upload txt file to an upload service so i can point the bashed machine directly at this txt file location? Any advice would be massively appreciated.

Use wget

19

For owned Bashed … we dont need to upload anything on target (at least in my case )… :wink:

20

There is this directory that belongs to a different user, but this user has no permissions to access root.txt…after 2 days I’m on the tipping point of giving up :frowning: Read so much about sudo but still don’t get how to solve this.