ok, managed to get user.txt and shell as the root user. However I’m not sure where root.txt is, or what to do next? any clues
Can anyone point me kinda in the right direction after logging-in?
For the root flag, do I need pivoting?
I only got user.txt so far, and from what I can tell… seems like, we are in only one of the containers within a multitude of containers (that horror)…
I think I know why this box is called carrier… (that horror again)…
@Center said:
Can anyone point me kinda in the right direction after logging-in?
Would appreciate a hint too…
EDIT:
Now needing help to form a rev shell
EDIT2:
Rev shell obtained, wokring on root.
@wilsonnkwan said:
I think I know why this box is called carrier… (that horror again)…
I think I have the same suspicion as you and it is breaking my heart…
@dragonitesec said:
@AlexanderNagy said:
Could someone please send me a hint about the RCE. Thanks!if your login has been successful, analyze the only point which “executes” something…
In hindsight this is a very, very useful tip. I wish I’d seen it earlier…
Anyone know if you have to b** something with a q to another box?
Just look at the routing table. 
I got user. And I got a private key. However when I try to ssh in, it asks me for a password. I assume the key has a password on it as well?
Dumb question - BUT IM LEARNING :bleep_bloop:
@Underworld said:
I got user. And I got a private key. However when I try to ssh in, it asks me for a password. I assume the key has a password on it as well?Dumb question - BUT IM LEARNING :bleep_bloop:
The private key you have is not exactly in the Carrier IP.
Check ifconfig on the machine…
Who well know network and got root, using only B**?
@AuxSarge said:
@opt1kz said:
I just started poking at it, so I’m still enumerating and working on user. Is the serial number thing a dead end? Edit: It is not a dead end. Just had to enumerate more.Thank you for this. I have been scratching my head for too many minutes.
@taytay said:
@0xlc said:
@taytay said:
struggling to even get user. any help would be appreciatedthanks
did you find the doc? it seems we need to get default user/pwd from the chasiss but enumerating with common tools and wordlists didn’t work out for me
I have found a few documents yes, still not able to find any chassis that it refers to. i’ll pm you.
same boat
hint on login creds…?
Hints for the reverse shell? I am able to execute commands but no luck getting reverse shell. It shuts down the connection always instantly…
@Kykli said:
Hints for the reverse shell? I am able to execute commands but no luck getting reverse shell. It shuts down the connection always instantly…
try a different rev shell 
@0xlc said:
@Kykli said:
Hints for the reverse shell? I am able to execute commands but no luck getting reverse shell. It shuts down the connection always instantly…try a different rev shell
Have tried so many ways already and nothing is working 
any hint after rce …? got the Shell!
@sakyb said:
any hint after rce …? got the Shell!
Same boat.
Found some IPs and found a service is running on one of the IP. Login the service, but there is nothing. Any hint…?