Chatterbox

HTB Content Machines
101

@mokrea said:

@sqw3Egl said:
Woo - got root.txt. Once I got a stable meterpreter session it was easy - took longer to do the nmap scan :slight_smile:

did you do with metasploit or python script?

just with metasploit - there are options you can configure to make it work and be stable.

102

@War4uthor said:
Ok scratch that I found a payload that works. Itā€™s just very unstable!

are you using a payload in msf? can you share your process of elimination without a spoiler?

103

@Kwicster said:

@bianca said:
My session keeps getting killed with error message Died from Errno::ECONNRESET before I can do anything. Is that because someone else is on the machine? I tried several payloads already. This oneā€™s the only one that opened a session.

Happened to me too, google up auto migrating meterpreter sessions. The exploit used will naturally close out the connection unless migrated

Thanks, this is really helpful !

104

@wirepigeon said:

@estihex said:
i cant find any :frowning: wasted 3 hours with nmap :smiley: hehe

nmap -sT --min-rate 5000 --max-retries 1 -p-

Kudos man!

105

Is someone willing to DM me with help on this one? Trying to get the python script to work. Have generate what I think is the right payload with none of the forbidden characters and under the size limit (iā€™m around 692 bytes) But nothing is happening. I know itā€™s a stupid simple mistake, it usually is.

106

Best thing to do is to spin up a Windows 7 VM, install the vulnerable service and keep messing with it by testing and restarting until you get a solid shell back. Just got user without Metasploit, working on root

107

no open ports foundā€¦what to do

108

is there a user.txt? or just root.txt?

109

@n0tl33t said:
is there a user.txt? or just root.txt?

Nvm. Reset the box and the user.txt showed up, also need to do something before being able to read root.txt now. Almost missed a chance to learn something

110

Got a meterpreter connection, but for every commands it returns:
Error running command command_name: Rex::TimeoutError Operation timed out.

Any hint?

111

try masscan guys. Its the fastest

112

@F2F said:
Got a meterpreter connection, but for every commands it returns:
Error running command command_name: Rex::TimeoutError Operation timed out.

Any hint?

Iā€™ve been having the same problem since yesterday, I got the user.txt then decided to go back for root, not Im getting crashes every time I get a session.

113

any info to start looking for? I donā€™t know where to start on this machine. Found a port, a service and a exploit, buuut itā€™s failing, so I think Iā€™m gonna start reading about the exploit. Any recomendation?

114

Have managed to get a stable shell on this and taken the user flag, however privesc to system is baffling me, donā€™t know where to start. Feel like Iā€™m missing something obvious ?

115

hi folks
i have get the user.txt and the root.txt file
now the questions isā€¦ how get an Administrator shell?
some suggestions?

116

@Ben83 said:
Have managed to get a stable shell on this and taken the user flag, however privesc to system is baffling me, donā€™t know where to start. Feel like Iā€™m missing something obvious ?

dont over think it, think basics. it has been mentioned already but research cacls :wink:

117

@Ar3s said:

@Ben83 said:
Have managed to get a stable shell on this and taken the user flag, however privesc to system is baffling me, donā€™t know where to start. Feel like Iā€™m missing something obvious ?

dont over think it, think basics. it has been mentioned already but research cacls :wink:

Thanks, managed to get the root flag this a short while after i posted that by doing just that.

118

@pennega said:
hi folks
i have get the user.txt and the root.txt file
now the questions isā€¦ how get an Administrator shell?
some suggestions?

Iā€™m wondering the same thingā€¦is it really fully pwned if you donā€™t actually have SYSTEM privs? This took me forever to solve as I was trying to privescā€¦

119

@Alexander1212 said:
no open ports foundā€¦what to do

use masscan . worked for me

120

DEFINITELY DEFINITELY DEFINITELY recommend installing a local copy of whatever you find and testing your own payloads on it. (as some others have mentioned)

Also helps to read what the bad characters are (I think I wasted an hour or two wondering why nothing was workingā€¦). I used the python script.

My first attempt doing it on the box ( after figuring stuff out locally) went off flawlessly.