Get ready for this… 
Any progress?
I’ve only been trolled by a file which sounded promising until now.
Yep - Got nothing amazing so far, I had a lead but not sure yet if valid.
Also got some worthless creds but i guess they are an hint
i take it you guys get results from nmap. For some reason i cannot even ping
Type your comment> @j3wker said:
Yep - Got nothing amazing so far, I had a lead but not sure yet if valid.
Also got some worthless creds but i guess they are an hint
Found /a** but can’t get it to do very much…
All sorted, Box needed a reset
If anyone knows anything about that .N** pm me
maybe De***ial****** ?
Really enjoyed this box. I’m not sure that I did root the intended way. Likely multiple paths forward there. Tip for user: the box is named JSON for a reason. Find it. Make it talk back.
One of the nice boxes that I actually enjoyed a lot!
For user, you might need to google a lot if you have no experience in this subject. I used a tool for PoC (Proof of Concept) then modified to fit my own needs.
For root, it really is a breeze as long as you know basic windows privescs. I even have a github repo for it specifically.
Not too many rabbit holes, pretty stable box IMO and straight to the point. Loved this box!
Rooted and hour ago or so 
Liked it a lot ! Nice machine - i learned a thing or two ! and its really real life applicable !
Tips for user?
Cant really give any - its either you know about it or you dont.
Tips for root?
Meterpreter is your best friend - but it wont work first try
Rooted. Tips:
- User: Watch the requests, and remember the name of the box
- Root: Pretty simple, but the first thing you try probably won’t work
rooted. funny box. Tips:
User: Just look at the name of the box and listen to all requests; then use google
Root: Check all open ports.
quick box but fun and enjoyable non the less
User: Google is your friend, when it works, its easier then you would have expected.
Root: I might have taken the “harder” which required a bit of picking things apart and sorta putting them back together again. after that it was just a few commands away.
@Cyb3rb0b thanks for giving me enjoyable sunday
*seems i did take one of the harder routes, thanks @ratone
quick box but fun and enjoyable non the less
User: Google is your friend, when it works, its easier then you would have expected.
Root: I might have taken the “harder” which required a bit of picking things apart and sorta putting them back together again. after that it was just a few commands away.@Cyb3rb0b thanks for giving me enjoyable sunday
*seems i did take one of the harder routes, thanks @ratone
i have rooted the box in the lazy way (5 mins or so). Can you give me some hints what the harder way is?
Type your comment> @FLX0x00 said:
quick box but fun and enjoyable non the less
User: Google is your friend, when it works, its easier then you would have expected.
Root: I might have taken the “harder” which required a bit of picking things apart and sorta putting them back together again. after that it was just a few commands away.@Cyb3rb0b thanks for giving me enjoyable sunday
*seems i did take one of the harder routes, thanks @ratone
i have rooted the box in the lazy way (5 mins or so). Can you give me some hints what the harder way is?
If this is to much of a spoiler, please delete this.
→ homemade is never ideal ←
Type your comment> @j3wker said:
Yep - Got nothing amazing so far, I had a lead but not sure yet if valid.
Also got some worthless creds but i guess they are an hint
Working my way through atm.
Did those creds end up being as useless as they have seemed, with the exception of a bit of guidance?
i did not use any creds for this target to get root…but maybe there are other ways to get into this box.
rooted - nice box, I really appreciate that the box was stable and could be exploited without stumbling over spoilers from others (being on the free server, often that’s an issue). Now I know what people meant with “its easier than expected if you know it” (for getting user). Hint for user: Use the name of the box for an INITIAL pointer for where to take a closer look at, nothing more. First, I had the right idea but wasted some time because I somehow got misled by those “look at the name of the box” posts (my fault, I know…). root was easy, guess I did it the lazy way.
If anyone is around that I can hit up about the initial entry, let me know. I’ve found a few things I think might be useful, but I have no idea what to Google at this point to find any sort of information to learn from as everything I’ve tried didn’t appear applicable to this. I’m sort of week on the javascript/json/api side of things and would really like to strengthen that, but it’s hard to do when you have no idea where to start.
Type your comment> @wizliz said:
If anyone is around that I can hit up about the initial entry, let me know. I’ve found a few things I think might be useful, but I have no idea what to Google at this point to find any sort of information to learn from as everything I’ve tried didn’t appear applicable to this. I’m sort of week on the javascript/json/api side of things and would really like to strengthen that, but it’s hard to do when you have no idea where to start.
I’m in the same boat. I know what I need to do (roughly) but based on talking to some other people, I don’t know if I have the tools to do it. 