Bounty

HTB Content Machines
341

Has anybody a hint for me about how to find the directory where the uploaded files are being stored?
Thanks

342

Gobuster and dirbuster are useful enumeration tools

343

That’s what I already did. (with and without file extension parameters,). But I haven’t found anything apart from the aspnet_client folder, which I am not allowed to access.
Btw. I also tried different wordlists (common.txt, big.txt ), but nothing seems to work…

344

@joesch said:
That’s what I already did. (with and without file extension parameters,). But I haven’t found anything apart from the aspnet_client folder, which I am not allowed to access.
Btw. I also tried different wordlists (common.txt, big.txt ), but nothing seems to work…

Aaah, finally found the directory.

345

This machine is terribly unstable

346

I’m not having any luck with getting RCE to work. Could any one give me any tips? I believe I’m bypassing the extension correctly.

Thanks!

347

Actually I think ive found out what to do for RCE

348

Rooted, good box ! :slight_smile:

349

Hi all,

Can I PM anyone to bounce some ideas off on how to gain an initial foothold? I enumerated 2 directories and trying to figure how to leverage what’s there…

Thanks

350

Rooted. User is tougher than root.

351

I am new to here and decided to start from bounty machine… But need help from where to start… can any1 help me out…

352

seriously dude? try page 1

353

Can someone please give me an hint on which payload to use?
I got RCE and I can run basic commands but I can’t get a shell and some of the outputs are not shown. I always get error 500. Tried powershell one liner, msfvenom asp/aspx payloads, and similar bind/reverse shells found on google, but no success so far.
I feel pretty dumb since this box is marked easy, yet it’s giving me more troubles than more complicated machines.

Also PM is appreciated!
Thanks

354

Can someone give me a hint by pm? I got user. I have rce, Now, im trying upload a nc but file writing is failing, maybe permissions, i dont know the right dir to upload. I did try powershell rev, but im failing. Am i in the right path?

355

EDIT: Found a working delivery mechanism.

356

Got user and root in one hour. Very nice idea and box. Great :slight_smile:

357

Can anyone help me with an initial foothold because I can’t find the upload file?
Tried a lot of wordlists and only found two dirs aspent/ and up**es/ and can’t use them of course

358

@D4Vinci said:
Can anyone help me with an initial foothold because I can’t find the upload file?
Tried a lot of wordlists and only found two dirs aspent/ and up**es/ and can’t use them of course

Have you tried enumerating for files to go with your folders? What extensions go with that type of webserver?

359

@Underworld said:

@D4Vinci said:
Can anyone help me with an initial foothold because I can’t find the upload file?
Tried a lot of wordlists and only found two dirs aspent/ and up**es/ and can’t use them of course

Have you tried enumerating for files to go with your folders? What extensions go with that type of webserver?

It’s aspx files I know, the problem is I can’t find this aspx upload file. If you can tell the wordlist you used, or the file name directly :joy:, would be a great help from you :smile:

360

HI guys, i got rce and stable shell. Any hints to root it? Msf Bypassuac is not working. Please pm