Official discussion thread for BoardLight. Please do not post any spoilers or big hints.
5 Likes
any ideas for first vector guys? Im stucked
1 Like
found a comment in the source, and the file seems to exist, but cant find working params for it so far with ffuf or manually
1 Like
That’s where I am. Since all was blocked, going back to test importing.
Any hint for root?
I am so stuck on the user so far… Any hint in dm?
Whats the first vector ? found a commented file but no parameters seems to be working for it ?
For the foothold, you should try all the common enum. If you need extra info to do so, you should search in what you already know…
any hints for root?
Any hints for first vector?
Have no idea…
Read the page from top to bottom, then enumerate properly web content. You should see attack vector
all in all fun box! nothing too crazy, but not so easy its dumb.
initial foothold: honestly missed this first time around, there is another domain to be found, enumerate well. searching for vhosts there leads to cve immediately
user: look around closely for something that could be used elsewhere
root: buddhists seek this. linpeas will find it also. if you find something and it doesn’t work, seek further info on WHY it doesn’t work, you may need to edit a little, there is a great writeup you can find also
much enjoyed cY83rR0H1t!!
10 Likes
Fun little box. If anyone needs a nudge, feel free to DM.
1 Like
i used multiple lists on SecLists nothing so far what list worked for you ?
Feel free to DM me. If you’re not picking it up with a standard word list, I wonder if the command you’re using is the issue.
1 Like
For some reason I needed to try multiple times until i got a hit on the right vhost. Any seclists default subdomain enumeration list should work. Maybe someone screwed the machine instance that i was trying to explore. Try changing your VPN.
the thing resets every 3mn or so interrupting my tests how annoying 
1 Like
i found it thanks for the help it s the thing after that that’s a bit annoying to work with
Rooted, very easy machine. User is super easy and so is Root. For root dont overlook anything I missed something very important during enumeration and wasted a couple hours of time.
Can I dm you for hint?