lol facepalm root. Bed, then breakfast, then coffee with a side of root.
Edit: well that took longer than it should have. Brainlock. Was so very very close for hours, had the pieces, then finally got it with a little nudge over the finish line. Nice and oldschool at the end.
I liked this box. Thanks!
Type your comment> @limbernie said:
Do you need to find the token string in order to generate the OTPs?
getting the token string is possible. it was late when i did it yesterday, so did not look into it that much. but from replies i got above it seems like something like that may be needed
Type your comment> @MrR3boot said:
Loved your creation @0xEA31. Great learning path to me. Though i’m still in progress but a brainstorming puzzle which really keeping me close to solve it.
Edit: Rooted
Thanks a lot!
Sadly, I really did not enjoy this box. User was not to my taste at all. Although, root reminded me of an older box, but with a twist, Root > User.
Either way, thanks to the Donkeys Leader for the box 
I sorta ‘guessed’ the username from the comments. Now, how do I search for attributes in the four-letter directory service? Step up my enumeration game?
Very interesting box…
Find some sample search code that might be relevant and think about where to insert something malicious, in the style of sqli.
Rooted, thanks to help from that guy there ^^^, really go box that inspired to me write tool (doesn’t work here kinda on purpose, kinda not, but if you know how to do what you need to it can be tweaked that way) any, good box, if you need help feel free to ask. It’s not as hard as you would think given the amount of points you get, but if you just stumble upon stuff it can actually make it harder because there’s a logic that’s supposed to be followed.
I’m trying to enumerate the 4 char directory service but I can’t seem to get any output. Can someone tell me if I’m wasting my time or is this the right path?
you are not wasting your time, you probably just haven’t satisfied all of your requirements.
I found a script that backs things up and I also found a way to exploit it, but I need some password to unpack it.
@Frinto said:
I found a script that backs things up and I also found a way to exploit it, but I need some password to unpack it.
Brilliant, how did you do it without getting banned?
@limbernie said:
@Frinto said:
I found a script that backs things up and I also found a way to exploit it, but I need some password to unpack it.Brilliant, how did you do it without getting banned?
Mate what? I did not understand a single thing you just said…
@Frinto said:
@limbernie said:
@Frinto said:
I found a script that backs things up and I also found a way to exploit it, but I need some password to unpack it.Brilliant, how did you do it without getting banned?
Mate what? I did not understand a single thing you just said…
Finding the script involves enumeration, no? Enumeration with a tool gets your IP banned. That’s what I meant :lol:
@limbernie said:
@Frinto said:
@limbernie said:
@Frinto said:
I found a script that backs things up and I also found a way to exploit it, but I need some password to unpack it.Brilliant, how did you do it without getting banned?
Mate what? I did not understand a single thing you just said…
Finding the script involves enumeration, no? Enumeration with a tool gets your IP banned. That’s what I meant :lol:
Ah, no. I mean on the box itself. I already got ssh access.
I see. My bad :lol:
Hey, It seems that the username is somewhat guessable… I tried bruteforce with big throttle and i couldnt find anything.I used some tool that extract words from webpages… Tried to follow every link to find some information/username but no results. Any hints?
Type your comment> @Frinto said:
I found a script that backs things up and I also found a way to exploit it, but I need some password to unpack it.
you don’t need to, figure out what the script is doing, there may be an exploit that you immediately see when you google it, but that exploit is nothing more than a hint as to how to root the box
so stuck on the after login part…
error message hint is a bit vague, or i am missing the picture here
@w31rd0 said:
so stuck on the after login part…
error message hint is a bit vague, or i am missing the picture here
Same here 
but I got to admit, the extraction of the token string was really fun…
Type your comment> @w31rd0 said:
so stuck on the after login part…
error message hint is a bit vague, or i am missing the picture here
missing the picture, the error message tells you why you can’t do what you want.