Official BountyHunter Discussion

A lot of fun!

Definitely more easy-medium than easy, but I liked it a lot since a machine that’s too point-and-shoot can feel a bit meaningless. The foothold was a good introduction to that particular type of vuln, and privesc was straightforward while still requiring a tiny bit of work to determine what was needed.

Don’t bother with hints beyond the aforementioned “OWASP Top-10” on this one, it’s fairly easy for a beginner - some googling will get you there :slight_smile:

Type your comment> @sharkmoos said:

Rooted. Excellent beginner box. If you’re stuck, maybe research OWASP top 10

root@bountyhunter:~# id
uid=0(root) gid=0(root) groups=0(root)

I think you are a cheater. How did you rooted 12 challenges for like a minute?? ahahah busted RAIDFORUMS scriptkiddies lol

need some nudges and ideas, i got the list of all users and also db user & password, now i stucked. i cant find any sql neither ssh password.

Type your comment> @1z3n said:

Type your comment> @sharkmoos said:

Rooted. Excellent beginner box. If you’re stuck, maybe research OWASP top 10

root@bountyhunter:~# id
uid=0(root) gid=0(root) groups=0(root)

I think you are a cheater. How did you rooted 12 challenges for like a minute?? ahahah busted RAIDFORUMS scriptkiddies lol

You can think whatever you want. idk what RAIDFORUMS is but sure lol. Probs wouldn’t be posting on the forums helping fellow players if I was cheating though.

No idea what your’re talking about with the challenges. Jealous people will be jealous I guess

Spoiler Removed

Spoiler Removed

Spoiler Removed

I am not really sure what is going on with this discussion. It is on the edge of being inappropriate for a discussion around a specific box.

In general, if you feel someone is cheating then reporting it to the HTB team is probably the best approach (I don’t know, maybe a Direct Message to one of the admins on here or on discord). I only really get involved around the forums and behaviour here.

It is probably not a sensible thing to accuse people in general threads, because it is going to be pretty difficult to prove.

While I don’t want people to think I’ve taken a side here, I don’t know where the accusation has come from. There isn’t anything strange on @sharkmoos profile that I can see.


I don’t see any examples of “12 challenges in a minute”, or anything that seems unusual.

I’d also be cautious around assuming the same username is the same person on different platforms. Although in this instance it does look strange that the sharkmoos account on Raidforums appears to have vanished. I’d still be very wary of using that as evidence they are the same person and that it means cheating has happened.

For example, how did you know that the account was posting in HTB discussions on Raidforums?

It’s a very dangerous path to head down. Raidforums has a lot more than the HTB board (and most people working in any CTI type role will use it a lot). If you think people checking out threads there are automatically cheating, then you can only find out they are cheating by cheating yourself.

tl;dr - keep the thread focused on the box or posts will be deleted in future.

Spoiler Removed

Type your comment> @DemChuck said:

need some nudges and ideas, i got the list of all users and also db user & password, now i stucked. i cant find any sql neither ssh password.

If you have a password and a list of users, try using those to get into the system. There is more than port 80 to get in.

Type your comment> @obfucipher said:

Type your comment> @DemChuck said:

need some nudges and ideas, i got the list of all users and also db user & password, now i stucked. i cant find any sql neither ssh password.

If you have a password and a list of users, try using those to get into the system. There is more than port 80 to get in.

thank you so much!

Type your comment> @DemChuck said:

Type your comment> @obfucipher said:

Type your comment> @DemChuck said:

need some nudges and ideas, i got the list of all users and also db user & password, now i stucked. i cant find any sql neither ssh password.

If you have a password and a list of users, try using those to get into the system. There is more than port 80 to get in.

thank you so much!

Happy to help :slight_smile:

i’m stuck at the very beginning any help?

Nice and easy box. I would recommend this to beginners who are starting at HTB.
Hints:
User: what you have (enumerated) will be needed once you get the vul.
Root: You know what you have to do (mostly) when you have the SSH of an easy box.
read it, understand it, get the root flag.
Discord - luckythandel#6053

I feel like I’m blowin’ in on all nmap scans thus far. I’m getting nothing useful from them. As to the WASP comments, I see what could be a “thing”, but thus far haven’t been able to get any"thing" to work. burps.

root@bountyhunter:~# id
uid=0(root) gid=0(root) groups=0(root)

thx!

Where are the server files on the machine?

Hello, I’m stuck. I found a vulnerability. I have read the database configuration file and the classic /passwd, but now I’m stuck. Some advice?

Type your comment> @hum4N3rd said:

Hello, I’m stuck. I found a vulnerability. I have read the database configuration file and the classic /passwd, but now I’m stuck. Some advice?

Sent you a message

This was a fun beginner box for me. Reminded me I need to enumerate more and was good exposure to an attack vector I haven’t gotten to play with yet.

User:
Good enumeration will give you most of what you need. The attack vector could be a little tricky if it’s your first time, but googling cheat sheets will help.

Root:
Pretty easy to figure out what needs to be done as the instructions are very clear. The implementation can be tricky but google and trial and error are enough to get it done.

Feel free to PM for nudge