Official Buff Discussion

HTB Content Machines
41

Spoiler Removed

42

Finally Rooted The machineā€¦ @egotisticalSW nice machine. I got so much headache at the root part, despite doing right things, worked at a time and didnā€™t work at another. Though learnt new things, nice machine.

43

One tip for root, make sure you have the right exploitdb page, one works and another doesnt

44

Have been stuck with root for several hours now, i must be really close but canā€™t seem to pull it off. Nudges in PM welcome :slight_smile:

45

hmm, user is really simple, it takes 3 minute, time to root

46

Thanks to @egotisticalSW for publishing this nice machine

My hint for user and root

  • 5 seconds of enumeration and CVE

if this is spoiler, feel free to remove it

47

Nice easy box.

  • User: Enumerate; check for known vulnerabilities
  • Root: Enumerate; compare outside/inside ā€œviewā€

If you already tried hard and need a hint, write me a PM.

48

This turned out to be a fun box. Frustrating at times, but Iā€™ve learnt a few new things from this. Root was quite a bit of trial and error for me. As always the box does provide a clue.

49

Some may find this to be helpful GitHub - tobor88/ReversePowerShell: Functions that can be used to gain Reverse Shells with PowerShell

50

how do i run the python exploit on victim when python is not installed in it

*if you know what i am talking about

51

Type your comment> @agpriyansh said:

how do i run the python exploit on victim when python is not installed in it

*if you know what i am talking about

You donā€™t. How else could you use your code from your attacking machine?

52

@limelight said:
Type your comment> @agpriyansh said:

how do i run the python exploit on victim when python is not installed in it

*if you know what i am talking about

You donā€™t. How else could you use your code from your attacking machine?

maybe converting py to exe

53

the easiest box i ever seen

thanks @egotisticalSW

54

hi guys

Iā€™ve got user access, found an exe and found a couple of exploits for that exe which relate to the name of the box. so i believe iā€™m on the right track to getting root here.

iā€™ve modified the exploit so that i can run it from my machine, but after running the exe on the box, the box only listens on the required port on the loopback interface (127.0.0.1)

what am i missing please? how do we make this thing listen on its ā€œrealā€ IP ??

thanks!

55

can any give me a nudge for root i got user flag
i am really appreciate if you help me

56

Type your comment> @lightfu said:

hi guys

Iā€™ve got user access, found an exe and found a couple of exploits for that exe which relate to the name of the box. so i believe iā€™m on the right track to getting root here.

iā€™ve modified the exploit so that i can run it from my machine, but after running the exe on the box, the box only listens on the required port on the loopback interface (127.0.0.1)

what am i missing please? how do we make this thing listen on its ā€œrealā€ IP ??

thanks!

Same situation. Did you figure anything out?

57

~~Anyone able to DM for a tip? ~~

nevermind, got it.

58

Just got the User Flag. For root, downloaded the content in Users Do****** Folder. Is the machine name the way to get root? I see a exploit on exploit-db for the file i found Do******.

59

Hi, Have user. Looking to upgrade shell, however appear to be having what I suspect are AV detection issues. No stderr for further info. Attempting to encode payloads, using veil and shellter, no success yet. Any tips with this, and resources with the latest evasion techniques (now and in the future)?

60

Spoiler Removed