Official Caption Discussion

HTB Content Machines
86

Why is the default username and password changed? I thought that was the intentional first step?

87

Anyone I can DM for a nudge for user? Iā€™m stuck after getting a valid login to port 80.

88

Hey anyone no if HTB has changed the way to acces GitBucket because the default creds are not works anymore unfortunately, anyone know if there any other existing way to access to root interface without the default creds set ?
Thanks

89

Hello ! do you know if its normal to not access the GT interface without the default creds, because it s not working :confused:

90

Iā€™ve been looking at this too, they did change it on purpose so they must have another intended way. I just didnā€™t want to work on it if it was brokenā€¦

91

You can see it in the ā€œChangelogā€ of the box that it was patched.

92

have you figure it out yet?

93

Is anyone able to give me a hint. Iā€™ve gotten the admin cookie but not sure how to leverage it or the method I obtained the cookie. Feel free to DM to avoid mass spoilers

edit: nevermind, found an exploit I needed to pair it with.

1 Like
94

Nope lol I gave up a long time ago. Iā€™m waiting for the writeup.

95

canā€™t find default creds :sob: :sob: :sob:

97

There are no ā€œdefaultā€ creds. That path was unintended and has been patched.

1 Like
98

If you want a hint - that 403 is ā€œfront end authenticationā€ that you need to bypass, look for common ways to get around that, especially when multiple web technologies are in useā€¦

DM me if you want more than that.

99

Fresh install ā€“ The default creds donā€™t work anymore. You have to bypass something else

102

Can anyone help i have found one user to app but i canā€™t find anything intresting :frowning:

103

Any help with the foothold is appreciated.

I have thrown everything I can think of at copyparty trying to revive the traversal but am out of ideas. Also used the /download SSRF to scan for more endpoints but didnā€™t find anything.

104

Hi,

after some initial enumeration I stuck on 2 things:

  • no access to found username for GitBucket: do I need a password here?
  • playing with **proxy (and smuggling) but with no luck so far.

May I ask for a hint to make an init foothold?

Thanks

105

Lol Iā€™m so stuck getting that dumb admin cookie that I will just wait for the write up :joy::joy: