Rooted.
I don’t think I would’ve been able to do it without a few subtle but well directed nudges.
I think the main thing that dissuaded me from the right path was how abysmally slow this box was, and how often things would reset. Whether it was intentional rate limiting or just a really poor setup, it made enumeration and discovery so unbearably boring and unnecessarily difficult. I can see why so many people have dropped the box while still only in the process of enumeration.
Privesc on this box was legitimately the only fun part of the process, it was different and it was really interesting.
The only real advice i can give you for this box is to:
Not only 1. take the name of the box to heart but 2. act as if this was a real website, what attacks would you actually use against a production server to bypass authorization? I found portswigger’s learning materials regarding authorization / authentication to be really helpful on this box in particular. Also, search up every version of software you find, whether that be in the source code or traffic headers.
I got a user, and see the possible escalation path. When I test run the script on some payload (just to check what it does), it says: “Could not load dynamic library 'libcudart.so.11.0”. Is it expected?
I spent most part of my day creating a script, so I thought I wasn’t going to be able to solve this machine until tomorrow because of the previous comments, but in fact I could even faster than my previous ones
Getting root was a funny thing, I never expected that to make my privesc work, it had to be as sussier as possible
If anyone happens to need help with this one, you can surely call me, R is always here
Finished this box at last. A big thanks to @shadowtree for the hint on getting the foothold!
Getting the root flag was very easy though.
If anyone needs a nudge feel free to PM me
finally rooted that ■■■■■■ box
First part is very annoying, but when you get the tricks it’s simple !
the hardest part was the ssh login (I know it shouldn’t) before I realise some bizarre procedures with letters…
second box where I had a very useful help from @lim8en1 ! after “interface”
root was much more quicker and easier
