@s4m3sh said:
I got a “valid pair” with brute forcing the login page with a tool. But it does not work with web login. Any idea?
got it working
i got dab.
@badman89 said:
can someone pm me i think im on the right track for privesc, swapped the thing for my own thing to be called by the thing but not working because of S**D??Edit- rooted thanks snowscan learnt loads getting this flag
I’m in the same boat right now. I’m doing a lot of reading on this method of privesc and I can’t figure out what I’m missing to make the thing run the way I want it to. It runs, but not the way I want it to.
Edit - I got root. My advice to anyone stuck at this point is to keep your exploit as simple as possible.
Got root on dab. I will be willing to help if someone needs a hint 
Got root, it was a nice journey
any one for user , i found the service running and can use some command, but i dont know what to do 
EDIT: got it 
Got no idea on how to get user.txt; I’m stuck… I already got the dab.jpg file but anyway can’t find a way to go further… any hints?
Feel free to PM me if you’re struggling.
Dance Dance Dance…
Have root on Dab…
Last part was difficult for me… And I’ll redo my track again, to clean up my notes… Nice machine @snowscan!
Is there someone who can guide my train of thought?
I got user and found the needed file. I got the correct password and am looking at the result which is a mention of a placeholder…after that I’m a bit stuck.
— edit —
nvm…I found the solution.
Rooted the box and it was quite a challage for me.
Thanks @CHUCHO very much for putting me in the direction !
If anyone needs help feel free to PM me.
very cool machine. rooted. Got my ■■■ kicked for a bit there 
Until I figured out wtf was going on with a few binaries.
props @snowscan
Tried to force it to use my own l*****y. No success. Any hints?
rooted, my favorite box so far, thanks to @Baikuya for the final hint and props to @snowscan for making it
I’m pretty stuck on this, have been for a while.
Would appreciate if someone could provide a hint to the socks/cookie part by PM.
Completely stuck on the privesc part… Does it have something todo with loading the *.6 file into the memory from the volatile location pointed to by the “test” config? When I pass my own crafted *.6 file, it completely breaks down the box, so it needs to be rebooted afterwards 
Could someone PM with a hint, please…?
Can anyone give a nudge on the elusive cookie monster ?
need help with cookie part some one PM me or at lease provide me a reference link