ı solved, my linux distros firewall has blocked external connection 
I never heard of whatweb! it’s installed on Kali by default, sheesh…
Thanks
I have foothold but could anybody explain why only specific reverse shells work ? Is this some sort of security feature built into Linux or python ? How did you guys know what shell to use and what would work ?
Not sure where I’m going wrong here, or even if I am. I’ve been able to access the low-level user and enumerate ports and services, even have the aiohttp PoC that corresponds to the service version. Whether I curl into the service as Rosa, or whether I use the SSH port forwarding to browse the service that netstat reveals, the PoC doesn’t give anything other than 000 or 404 response codes. Going to bed, brain is scrambled.
Nvm, I figured it out. The PoC script needs to be modified to suit the directory structure and port of the app on 8080. Nmap and Feroxbuster did the trick for finding that info. It was also useful to me to modify the script so that the successful command is echoed to the prompt where it can be copy-pasted for ease of manipulation.
Pwnded. Thanks all for the tips.
I used LFI/Directory Traversal
my sequence is wrong. i wasted my time on initial foothold going immediately “inside” using an exploit though i initially got that “file” by fuzzing. when you get that “file” crack it. but maybe still going into the server on my initial foothold helped me atleast to see who among them to focus with.
once inside using user:pass, enumerate enumerate enumerate. you’ll see something that’s only accessible from inside. configure your ssh to be able to access that local thingie. you might fall to a rabbit hole at first because of fuzzing but enumeration on the forwarded port will lead you to read something about a version that allows you to read local files (LFI) that’s not accessible by “user:pass” normally. play with the script and remember directory of fuzzing the forwarded port. !!got r00t.
1 Like
My hint for this box is to remember that pocs often needs a tweak to work properly.
You don’t have to run an exact copy of the environment if you can find out what part makes it vulnerable, copying a function to your own test script works too. You might find an issue you didn’t expect with a payload.
1 Like
This is the real answer for why the “exploits” aren’t working for root. It seems there are multiple versions of exploits out there, such as some python ones, which don’t actually send the path as-is; they normalize the path.
Rooted. Very straightforward machine:
- foothold: you can find exploits online
- user: enumerate
- root: double check your ports and files/directories
Rooted. Nice easy machine.
Hello, I have a genuine question, how would I know what other payload to use in case the default python reverse shell doesn’t work, although I managed to get the user flag I feel like without reading the forum I wouldn’t have been able to.So what’s the catch, can someone explain a thought process or maybe a different view of it?
1 Like
You could just brute force the request with a list of paylaods, but you could’ve also just used normal commands with netcat to send back the responses to enumerate for the ssh creds.
1 Like
hello thx for the tip the reverse shell worked but when trying uname -r i got a generic linux response
Rooted the machine.
nice one.
thanks for all the tips