Thanks for answering, I have since found my way in, I wasn’t looking in the right place !
Boom, rooted 
soooooo pleased
1 Like
Really nice box, thank you for this!
This was fun - took me two whole nights 
but it was only my third one on here.
I think I saw you on there, PaulStat.
Got it too, in the end!
gitea_token is the right way?
Rooted finally! Great machine!
It was hard a bit but I’ve obtained a hint and all were enlighted!
Edit: Yeah… wasted 3 days due to company’s VPN. 
I am new to this field. I got the tokens cant find away around would appreciate some hints)
Edit : Oopsie.
For foothold, a token can be used as is. Just read docs for service authentication.
There’s a script to get bcrypt hashes. Is it useful to crack admin password?
I found the creds for a certain status page
I’ve been at it for two days now, but I cannot get the new line injection to work to inject redis server configuration, am I digging at a rabbit hole?
I read the blog, but I got stuck there.
Is it correct to use the leaked information?
Hey i m trying to get an initial foothold for the Catch machine.
The only think i found is tree tokens … i tried to insert that tokens for authentication but nothing
Is the right way or there’s a particular cve ?
Make sure you enumerate all of the services running on machines IP address 
I’m stuck attempting to get a foothold on this machine. I’ve found the creds I need to log in to the vulnerable service/exploit it but I know that the R*** is not the way to go. I can’t seem to wrap my head around how I go about leaking the desired data I need.
Hello everybody,
I have login access to the vulnerable service, and 3 CVEs for the version. However i can’t find any poc or exploits to move on and i searched everywhere for like hours… If anyone care to hint me on the poc i would be grateful.
I have all the necessary tokens to read API endpoints, tried all authentication headers but still doesn’t work. Reverted the box just in case someone tampered with the box but leads nowhere. Any nudge if someone still active on this box?
Thank you @MrR3boot ! It was an interesting machine.
FOOTHOLD : don’t be a fool like me. You have all what you need in your first immediate Recon. No calculations or cracking needed. There are many rabbit holes and unuseful services.
USER : Grab the flag.
ROOT : Look at obvious directories and check content. One variable can be manipulated. All tools needed are in the box.
2 Likes
Can someone point me in the right direction for leaking the desired information from the vulnerable service? I have the required access into the settings, but I seem to be really bad at understanding how I move on from here.
If you are viewing the blog which covers the three vulnerabilities, use the one which is about nested variables and to be more specific try the ones, it suggests would have impact.
And then use that for a password reuse attack.