Official BroScience Discussion

HTB Content Machines
21

Anyone else have pspy hang on startup? Running with --debug flag it says “ERROR: parsing events: possible inotify event overflow”

22

Developer fixed this issue and committed the change to master some time in October, but never released a new version. A build from master branch will fix it.

A work-around is to use the -r flag to watch a specific folder.

Long story short, as I understand it, one of the startup processes never completes, so with the unpatched version it never gets past the draining phase.

2 Likes
23

This is great advice, thanks for sharing. I had to do the -r tricks to solve it too and I was just about the ask what was up and if others had the same issue.

25

ROOTED!

Foothold:

  1. Web enumeration will lead you to specific file that will tell you about very common PHP vulnerability, but the developers take care about certain filters that you should bypass to success.
  2. When you able to map certain application files you will understand how to login to the application with certain action that you will need to fuzz and understand.
  3. When your logged in - its takes you to a nice user preferences trip with certain vulnerability.

Root:

  1. You should have already find a good information before that will give you an access to a salted hashes of users.
  2. Enumeration is the key to find the certain file that will help you to go further

If you stuck feel free to PM.

1 Like
26

A hint for root: If you have problem running p*** to monitor processes, you should consider to run it with -r option.

I guess the default configuration monitors too many folders and crash the shell.

1 Like
27

Fantastic box, especially the foothold part. Sadly I got stuck for a long time because p*** wouldn’t run and I thought there was some kind of protection. I guess there is a way to do what the tool does manually but I don’t know how and without that piece of information you have very little chance of succeeding…
But, apart from that frustrating part, as I said : fantastic box :slight_smile:

28

Rooted! Thanks all who gave a nudge where needed. If anyone would like a nudge feel free to get me on discord:

MrRed#8802

29

Rooted, Foothold was very interesting and fun. Thanks to the creator :green_heart: and this discussion, which has some nice hints if anyone needs more Dm me.

30

This was a great box. Had a ton of fun, thanks!

31

Rooted !

Foothold is fantastic ! Thanks for this box.
However, for root, there is a much easier path other than the expected one I guess. Would be great if there was only the expected path :slight_smile:

1 Like
32

Root !!

For ROOT :
Was curious is there any other way to identify the “process” without using any third-party tool?
Please do let us know if there is :thinking:

Feel free to DM if you’d like to bounce ideas.

33

Rooted the box :slight_smile: If you’ve got stuck feel free to pm me for some hints

34

This machine was really harder than the average one :flushed:

I was lucky that in some previous machine I learnt a way of bypassing the method while I was stuck in a rabbit hole, guess that if they don’t help in one challenge, they will help in another :sweat_smile:

In one way or another, great machine, just need to pay attention to the details, enumerate everything you can, have patience while your tools do their work and understand what you are searching for

If anybody at anytime ends up needing help, R is always here, just send me a message and I will be more than ready to guide you :heart:

35

though i can bypass the filter nothing is responsed

36

ok, i understand
file not exist or can’t show on browser

37

about brute force of the code: HTTP Response header is good to know exact time

38

Fun box, but the hardest I’ve done so far. Spent an hour honing the root exploit to no avail, but after resetting the machine, it worked first time. The process was triggering and my cert was being moved, but my code wasn’t being invoked.

39

Why the activation code has been unavailable. The time is taken from the http response header, my code is as follows, please give me some hints.

<?php
function generate_activation_code() {
     $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890";
     srand(strtotime('Mon, 20 Feb 2023 13:26:53 GMT'));
     $activation_code = "";
     for ($i = 0; $i < 32; $i++) {
         $activation_code = $activation_code . $chars[rand(0, strlen($chars) - 1)];
     }
     echo $activation_code;
}

  generate_activation_code();
40

hash cracking doesn’t succeed…

edit i just misread the salt

41

Hello,
After account created and activated, it seems after a while that user is finally removed from database. I must recreate account. Is it normal ?