Official MetaTwo Discussion

HTB Content Machines
1

Official discussion thread for MetaTwo. Please do not post any spoilers or big hints.

3 Likes
2

Good luck everyone I wish I could join today by hacking this machine :slight_smile:

3 Likes
3

Rooted! Very nice machine!

2 Likes
4

:musical_note: Another Root here, entertaining with new things.

Any questions DM !! :grinning:

5

how to login with pgp key

6

Usered! Because I don’t root!

7

I have the password for the passpie account and I am still getting permission denied on extracting r***.passpie if someone could dm me that would be super helpful

8

I made it :smile: I do not think this was an “easy priv esc”

9

An excellent easy rating machine. :smiley:
For anyone stuck feel free to PM.

10

Any hint how to start or where should we exactly look. I am beginner so it would be very helpful if I get a hint. Currently I am beating around the bush. I found a login page made of wordpress. And trying to brute force it.

11

same here aswell. Have you had any luck yet?

12

Great machine. I learned a lot. PM me if you need help

13

Bruteforce is the wrong way. Check the plugins using WPScan/Burpsuite.

1 Like
14

I did that but didn’t ring any bell

15

check burp response for plugin details

16

You found a login page?? I haven’t found anything, I found an ftp port, which I can’t connect to, an ssh, which I don’t think I can connect to, and an http port, which I tried visiting and it doesnt go to anything.

17

add the ip to and the site metapress.htb to your host list etc/hosts

18

Okay, I will try that, thanks

1 Like
19

Hello Guys,
Somehow I can’t get any further. I already found out which FTP server the machine uses (ProFTPD) and tried to hack it without success, after that I tried something with the openssh server, which of course didn’t work either. Then I ran nmap scan again and I think I found a directory to http port “http://metapress.htb/wp-admin/”. I already added metapress.htb with the IP in the /etc/hosts file and I tried to use the tools wpscan, gobuster and dirb, all except dirb give me an error code (“timeout or The url supplied ‘http://metapress.htb/’ seems to be down”) and dirb finds nothing.

Can someone please help me?.

21

Hello, I found the plugin’s vuln and I did the SQLi tests via curl, now I’m running sqlmap , it already brought me the database but I can’t access the column, it’s giving me an error in sqlmap , could you give me a hint where proceed?[quote=“jad2121, post:12, topic:266820, full:true”]
Great machine. I learned a lot. PM me if you need