Magic

HTB Content Machines
422

@shinjikun said:

rooted the box! but root.txt doesn’t seem to have the right Hash.
Did somebody experience the same Thing ?

Its a dynamic hash so chances are:

  1. the box reset between you getting the hash and submitting it.
  2. the hash you have was submitted before was recognised (I have no idea how the dynamic hashes work)
  3. somehow you ended with an old hash.

Its never happened to me so I have no idea what the solutions are but people have suggested resetting the box and re-rooting it so you know you have the right hash or wait a bit and try again.

At the very least this should be reported to HTB via Jira Jira Service Management - they cant fix the process if they don’t know it is broken.

423

any hints on root? got user

424

Nice box with good exploitation path.

User:

  • You don’t have to login in order to go further, but if you want to login, it’s a basic challenge.
  • Basic RCE, check what actions you can do there - lots of explanation about it. Just google.
  • Once you have a reverse shell, enumerate everything.

Root:

  • I assume there is a rabbit hole so if it’s not working, go on…
  • Again basic enumeration will give you all the details you need.
  • Pay attention to who you are and what you own.

Hope it’s not a spoiler.

425

Just got the root on Magic…thanks to Mty0x for a nudge on root…pm me if you are stuck

426

This is infuriating. Somebody keeps deleting my shell and killing my session. Am I doing something wrong or is someone being a ■■■■?
I can’t work on root because my session dies after 2 minutes…

427

@89jase said:

This is infuriating. Somebody keeps deleting my shell and killing my session. Am I doing something wrong or is someone being a ■■■■?
I can’t work on root because my session dies after 2 minutes…

Shells are getting automatically removed after a short amount of time, IIRC. The session should be stable, though. Maybe try another payload for generating your shell :wink:

428

f***ing stuck at user…
someone can PM me?

429

great boX!
learned a lot of stuff!!!

430

Rooted! Finally

Lesson learn: don’t dig too deep to a rabbit hole

431 
root@ubuntu:~# id
uid=0(root) gid=0(root) groups=0(root)

Got root, but the hash in root.txt appears to be wrong? Wtffff

432

@nicoswd said:

Got root, but the hash in root.txt appears to be wrong? Wtffff

433

Type your comment> @TazWake said:

@nicoswd said:

Got root, but the hash in root.txt appears to be wrong? Wtffff

Magic - #422 by TazWake - Machines - Hack The Box :: Forums

Thank you! I’ll try that ?

EDIT: That did it, thanks!

434

Type your comment> @TazWake said:

@shinjikun said:

rooted the box! but root.txt doesn’t seem to have the right Hash.
Did somebody experience the same Thing ?

Its a dynamic hash so chances are:

  1. the box reset between you getting the hash and submitting it.
  2. the hash you have was submitted before was recognised (I have no idea how the dynamic hashes work)
  3. somehow you ended with an old hash.

Its never happened to me so I have no idea what the solutions are but people have suggested resetting the box and re-rooting it so you know you have the right hash or wait a bit and try again.

At the very least this should be reported to HTB via Jira Jira Service Management - they cant fix the process if they don’t know it is broken.

Thanks you! Worked great!

435

id

uid=0(root) gid=0(root) groups=0(root),100(users)
Nice box!

436

every time a upload an image it says

what are you trying to do there

i tried png and jpg with and without a shell
any idea

437

Type your comment> @AhmedSaedAbdo said:

every time a upload an image it says

what are you trying to do there

I was getting this as well and it was quite annoying. I haven’t looked too deeply into why this is happening, but maybe it’s session related. At some point, the same request that was being blocked before would suddenly start working again.

I’ve lost a lot of time on this because I discarded methods that turned out to work later.

438

Any hints or guides on getting root. Please send. I’m using suid3num.py and pspy but not sure what i should be looking for or exploiting.

440

Type your comment> @unethicalnoob said:

Type your comment> @schizo said:

is it normal to have
theseus@10.10.10.185: Permission denied (publickey). ???
stuck in www-data

got a USER !!!
Hint: use alternative way

Can you DM me the alternative way? can’t get past it

Whatever you find, keep it, and use it. (:

442

Type your comment> @unethicalnoob said:

Type your comment> @a3n3a said:

Type your comment> @unethicalnoob said:

Type your comment> @schizo said:

is it normal to have
theseus@10.10.10.185: Permission denied (publickey). ???
stuck in www-data

got a USER !!!
Hint: use alternative way

Can you DM me the alternative way? can’t get past it

Whatever you find, keep it, and use it. (:

got user but root seems difficult.
linpeas,pspy got me nothing

In same position pretty much

444

Rooted, fun and pretty straightforward box. I’m ashamed that rooting took me so long. It should be 5 minutes. But well :slight_smile:
Thank you for nice box!