Official Health Discussion

HTB Content Machines
1

Official discussion thread for Health. Please do not post any spoilers or big hints.

2

im stuck on foothold. Never dealt with webhooks #_#

2 Likes
3

me too bro :confused: I think the c**kies are including something interesting which I can’t understand :frowning: I’m just focusing on them because I can’t see anything else interesting.

1 Like
4

am seeing the traffic on tcpdump from the form field, maybe there is something there?

5

Just to be clear – creating a webhook doesn’t work for anyone else, right? I get no server response at all after submitting. Not sure if I need a new instance…

6

Testing the webhook works.

7

Some of these easy boxes man…

1 Like
8

how did you read the response?

9

You mean the POST request? Just catch it with a webserver that can handle POST requests.

10

For some reason using a VPN on my host machine was totally breaking the HTB instance. I can now see the callback and the page loads normally. What a pain…

11

any clue on the foothold?

12

I have found the attack vector but it doesn’t look I can do much with it

13

I think we are stuck at the same place. We found a way to look at home, but there isn’t much there. I think what we are looking at is really old, so possibly vulnerable. Haven’t gotten anything to work though.

14

The vulnerable service is obvious but none of my payloads work. Trying to do it without looking seems fruitless because it appears she hasn’t committed to anything… So I’m trying the other way- I’m sure it’s an encoding error but I’m running out of ideas…

Edit: It just occurred to me that you could also do it all backwards… whoa. Nah.

15

Any hints?

16

DM me

17

Got root! Everyone shed a tear for the prospective hackers who assume this box is entry level and fail at the foothold.

1 Like
19

Guys, I just figured out the initial access. This is NOT an easy box. I would rate the initial access vector as Very Hard or Insane… Hint: The deleted comment above mine by popeye109 helped me a lot, but I had already figured out how the “monitoring” service behaves.

So, if you can’t figure it out, just move on to another box and wait for the walkthrough. I wouldn’t waste too much time on this.

20

Any hint on privesc?

21

Any hint on the initial foothold