Official Busqueda Discussion

HTB Content Machines
41

Its gotta be the way, its an easy box and the vuln was pretty straightforwrd to find. I dont think theyd make this a rabbit hole

50

Any hints on how to get user? Trying to fuzz params on Burp but no luck so far

51

Got the user creds, trying to figure out how the sudo script works, anyone got a hint?

52

+1

53

im stucked at the same step :slight_smile:
feeling like a blind

54

iā€™m stucked. iā€™ve got cody creds and login in tea. Hints?

55

the sameā€¦

56

I believe it is something related to the api, I have been searching someway to exploit, but there are so many methods that it starts to take long

1 Like
57

API is really huge, you are right.

58

have you tried using SSH login with found cred?

1 Like
59

Stuck figuring out how to use the script which can be ran as sudo.

60

Is there something to do with sudo -l any hints?

63

using cody?

64

Try another user you found when you dumped the /etc/passwd file

1 Like
66

In thesis it has, I found what I believe is a way to login as admin in gitea, but couldnā€™t use it

67

Same. Found credentials through Hydra, but theyā€™re invalid.

68

finally rooted.

some hints for privEsc:

sudo -l is just the beginning. You have to enumerate more (check other services running). To get access to the service, you might need the docker documentation.
With some magic, you will be able to read the source codes. After that, the relevant vuln to root will reveal.

69

you may find this useful in PE:

3 Likes
73

One more HTB ā€œeasyā€ machine :face_with_hand_over_mouth:

I canā€™t deny it was an interesting one, I liked it very much, and for everyone coming, my main advices are ā€œread the docsā€ and ā€œread the repoā€, both vulnerabilities for root and for user doesnā€™t have any public POC, and so you will need to make the payloads and hack it by yourself, it is a good learning opportunity in any way :smiling_face:

And for anyone needing help, you can surely send me a message, R is always here :heart:

10 Likes
74

Just rooted this box. Itā€™s very easy and straightforward. Some hints:
user: play around with the post request
root: check what is running & try to get the source code. After you see what the vulnerability is, exploiting it is a piece of cake.
Root part was very fun, kudos to the author of the box!
PM me if you need any hints :slight_smile:

2 Likes