Nightmare

HTB Content Machines
1

Hello,

I need some hint on Nightmare. I did lots of enum for the web and found some interesting things.

1/ do i need to bruteforce any login?
2/ shall i consider client side attacks??
3/ do i need to “guess” request parameters names ??

plz help

2

These sound like questions rather that findings… :stuck_out_tongue:

3

okay :slight_smile:

4

@eks said:
These sound like questions rather that findings… :stuck_out_tongue:

lol :smiley:

5

i need little bit help for this box. could anyone pm me ?

6

can anyone give a hint on what this box was based on?

7

Hi! could someone help me with Nightmare! I passed first step and can access to machine via s*** but now I have no more ideas :frowning: PM Please

8

@s3b4stian said:
Hi! could someone help me with Nightmare! I passed first step and can access to machine via s*** but now I have no more ideas :frowning: PM Please

There’s an exploit that will apply well to your situation. Just make sure it matches your environment and I mean really make sure, don’t just give it a cursory check :slight_smile:

9

@Booj said:

@s3b4stian said:
Hi! could someone help me with Nightmare! I passed first step and can access to machine via s*** but now I have no more ideas :frowning: PM Please

There’s an exploit that will apply well to your situation. Just make sure it matches your environment and I mean really make sure, don’t just give it a cursory check :slight_smile:

:+1: Thanks!

10

[Spoiler]. However, these [Spoiler] don’t seem to [Spoiler]. Shall I search for [Spoiler]?

11

I need help with this machine, PM anyone?

12

Apologies for spoiling. Wasn’t meant.

13

Hi I am able to have a shell, I enumerated the system but didn’t find anything for privesc. hint needed please! Thanks! PM or netsec chat

14

Hey guys, I’m kinda stuck after initial enumeration. Would some kind soul PM me (here or on Mattermost) for a nudge (or just discussing my approach)? I’ll show what I found so far.

15

Hello , could someone please help me for some hint ? That I’ve decoded the dante.txt to the poem and I’ve also noticed that’s also xss vuln on my newly registered account on the site. And I have no idea to step forward. Thanks.

16

enumerate more and more, play with all web app functionalities

17

Could also use some guidance for privesc. Not sure how to explain without spoilers, and I’m not sure if I’m even on the right track.

I see that the [redacted] has two [redacted]s of [redacted] [redacted]. I got a [redacted] that should [redacted] both [redacted]s, but having trouble getting [redacted] to [redacted] either [redacted].

Hope that’s confusing enough :wink:

18

yes, quite confusing. I also noticed the XSS and then there is another *** thing which kind of seems relevant, but I haven’t been able to use it for anything useful so far. And there is a third thing behaving in a way which would suggest that there might be *** there but haven’t gotten anything out of it with my list of suggestions. Confusing and confused.

19

@Booj said:

@s3b4stian said:
Hi! could someone help me with Nightmare! I passed first step and can access to machine via s*** but now I have no more ideas :frowning: PM Please

There’s an exploit that will apply well to your situation. Just make sure it matches your environment and I mean really make sure, don’t just give it a cursory check :slight_smile:

Can PM me please ? I found the exploit for my specific target but it doesn’t work …

20

May I have some nudge?