Hint for HELP

HTB Content Machines
21

@23Y4D said:
I managed to find whatever I upload… but I’m starting to have a feeling it is a rabbit hole…
Sooo… is it?

Same here…thought I could trick it to upload a specific file type but no luck…

22

Revelant.

23

Did anyone get code execution?

24

Rooted. Loved the box. Hints:

  1. No brute force is necessary
  2. It is possible to get RCE (hard), but much easier to find creds
  3. You have to partially guess a username
25

The N***.JS is the way to go?

26

I didn’t need that. But seems others used another path and did need it.

27

Ok, so i have been sitting a while trying to get a shell. Could someone PM me so i can find out if my method is not a waste of my time? (Don’t want any spoilers) Cause i feel my method is the way to go.

28

are we supposed to get creds? cause i seem to be failing on that
also the unauthenticated exploit is not working (maybe modification is needed?)

29

Could I get a hint please? Ticket portal or JOSN page?

30

You can use one or the other. There is at least two ways you can go.

31

hints on privesc?

32

Should i keep on trying different bypass methods for my shell upload or am i wasting my time? Should i try and get a shell in a different way?

33

hint for root please :frowning:

34

Got half the user… need some tips for finding the rest?

35

@r0tt3d said:
Should i keep on trying different bypass methods for my shell upload or am i wasting my time? Should i try and get a shell in a different way?

I really can’t say too much without spoiling things, but I would strongly advise you to review the code on github. If you look closely, you’ll be very surprised at what you find.

36

deleted

37

@opt1kz said:

@r0tt3d said:
Should i keep on trying different bypass methods for my shell upload or am i wasting my time? Should i try and get a shell in a different way?

I really can’t say too much without spoiling things, but I would strongly advise you to review the code on github. If you look closely, you’ll be very surprised at what you find.

That is a good hint :slight_smile:

38

It seems I bypassed the file extensions upload for my php session, but I have not idea where its uploaded to. Looking through the GitHub I dont see anything.

39

Took me a while to know I had to time travel, I feel discriminated.

40

@vanquish said:
It seems I bypassed the file extensions upload for my php session, but I have not idea where its uploaded to. Looking through the GitHub I dont see anything.

Look harder. It tells you where to look if you’re reading the code.