any clue on the foothold?
1 Like
People usually give hints after 24 hours have passed
It’s not 24h. It’s way less. In my country it was released at 21h, and now it’s 16:54h, so it’s 20h~
Guys, Is that //download, //view, /***/delete are directory or it is passing as a some sort of command? delete looks sus for me?
Ok I found the LFI.
Hint: look at the machine name and If you have any problems try encoding.
6 Likes
I have identified that the “d” endpoint behaves abnormally under certain conditions, but I don’t know if it will be a foothold.
Anyone working on root?
it can help with enumeration
Got user?
How is this a medium machine???
Nothing is working for me right now 
If anyone has any nudges for the right path ?? Whatever I tried already doesn’t feel like giving me something useful.
Yeah, got a shell as another user, but it looks like a rabbit hole.
1 Like
anything for user?
Can I dm someone for root?
Not a medium machine. User first blood took like 12 hours lol.
I’ve finally pwned that machine! 
Thanks to 4m1n3 and @Timsu for helping me out, and to the creator of the machine for that awesome box!
In terms of number of required steps it is a medium machine indeed, but finding the right way is pretty hard.
- Some hints for user: enumerate the website, some filtering bypass techniques may be handy. After that study the code, think on the things that you control, and the way forward becomes clear.
- Root: enumerate the machine, executing the code as someone else is not hard, but to move forward you will need some more googling and enumeration to do. I’ve crashed the machine several times while exploring stuff and wasted time becase of that, so be careful as you may need to reset the machine in such cases.
1 Like
It has been 5 hours after analyzing the code, I think I read each file at least 10-15 times by paying LOTS of attention to req.session, req.body and whatever param I might control. The ONLY thing that I could think about is IF something happens when I pass an array to the places where req.session values are used. Maybe I can achieve something similar to a NoSQL Injection but I have NO F****** CLUE 
I even wrote a Python script that automates the WHOLE website because I was (I mean, AM) going crazy, I even added the functionality to UPLOAD files because I was completely lost
4 Likes
where did you get the code from? any hints on that ?
Well, you are almost there.
Btw imo root is about the same difficulty as the user
1 Like
Can confirm root difficulty. Definitely higher than a medium.
2 Likes
Feel free to DM and I can help you out here.
3 Likes