Thanks everyone for the Hints.
USER:
- If anyone needs user assistance you can DM me. I cant really say without giving to much away in a post.
1 Like
(Advanced) enumeration can take really long here if you just brute-force, but e.g. SecLists has something that can vastly reduce the number of requests you need.
1 Like
Working on root, I can see the priv esc vector but could use some help on crafting the payload. Someone DM me?
Suffice to say this was far from my favorite box, but its done.
5 Likes
Privesc wasn’t that difficult.
If you can just read the flag but still want to get a shell, you can try Metasploit.
Thanks @joher for the Ffuf hint. Made the whole scanning a lot easier.
3 Likes
What Wordlist Should be used? I have tired SO MANY
3 Likes
Interesting, there’s 2 ways to enumerate the initial foothold.
1 Like
2 ways, or just multiple tools doing roughly the same thing? I’ve talked to folks that have used intruder in burp and ffuf, but they both were used to more or less do the same thing
3 Likes
yes ffuf and burp can do the same type of enum but ffuf is 10x faster (or you must to have the burp suite
pro )
1 Like
I have uploaded a python file to get a shell but when I open the file on the browser it downloaded instead of execute the file ! I am thinking I should find a way to upload it to different file to be excused!
Am I looking on the right spot?!
What a pain of a box for easy lol. Rooted.
Roots not to bad youll know what to do pretty quickly.
DM me for a nudge or assistance. Ill try to help as much as I can without giving to much away.
3 Likes
rough…
oh after got root flag with helping hints i was trying to get rev shell as root …
For those who are interesting it also possible to get it by just add an e******* command within the Poc
pretty good one… thanks also for helping hint
Very nice and easy box, kudos to the author. If anyone get stuck feel free to PM me.
1 Like
A bit of a scuffle, but possible (wouldn’t say the box is “Easy”). For the user part, either a good wordlist, educated guessing or a lucky guess are required.
Privesc was not that hard, even though a bit of research is required.
DM for hints (I won’t spoil anything relevant, just giving hints 
)
Wow user was tricky, DM if you need a nudge:)
1 Like
Hello!
I’m kinda stumped - do I fuzz subdirs and vhosts? Or the “upload” part is the intended way?
Any hint is appreciated, ty in advance 