Official MetaTwo Discussion

HTB Content Machines
25

Find with your eyes.

26

Really nice box, as always I seem to have an issue with release arena boxes when connecting via release arena OpenVPN. The website on 80 does not load. It only seems to work with pwnbox which is what I used. (Seems to be an issue that others are facing as well, based on some of the comments above)

Initially spent a lot of time brute forcing, since the thing that I needed to do did not show when I used the common scanner for this type of site. Play around with what you can do on the site and then google that function for any potential issues. From there its finding more site issues to get more information to take user.

Root was interesting as I havenā€™t seen that before.

27

Any hint for root ?

28

Iā€™m still trying to get a footholdā€¦ Iā€™ve managed to make it up to using the blind *** injection to get files off the serverā€¦ but not really sure where to go from there? Iā€™ve found a user from /etc/passwd and thatā€™s about it.

Am I looking for a config file somewhere?

EDIT: Nevermind, got root XD

29

Nice easy box! DM me on discord (n3hal#1527) if you need a hint!

30

If you use the scan tool WPScan for wordpress but found nothing to use, you could check for vunerable plugins only with some paramters.

31

Nice box ! Now I have to submit the flags but itā€™s not working for both.

32

Hello. I can read some files on server (ex. /etc/passwd). But i cant read id_rsa or any flagā€¦ What is I need for a reverse shell?

34

Iā€™m stuck on the same place :cry:

35

PM me if you wish, good luck!

36

PM me for helpif you wish, good luck!

1 Like
37

Finally got root. Excellent machine!

A few hints:
USER:

  • Look at the installed plugins. Maybe in some kind there is sqli.
  • When you get into the admin panel, look at your capabilities. Maybe you can download something like XXE. Check the versions for CVE.
  • What is the juiciest file in wordpress?
    ROOT:
  • Take a close look at the directories of the available user. You will need the skill of using encryption utilities and even john. itā€™s easy and interesting.

I also want to say thank you @PwnerSec for his patience despite the time difference.

3 Likes
38

Got arbitrary file read via XXE but FTP kinda donā€™t allow to write data while logged as metapress.htb, and Iā€™m kinda stuck because of that, any hints :smiley: ?

Edit: Nvm this mailer is configured :smiley:

39

The hints on this forum are not helpful at all. I can tell you that burpsuite allowed me to connect to the website. Editing the hosts file did not do anything for me. If you use burpsuite and intercept the request, you might find something useful

40

got root

41

Need help? pm me

42

So as this is a Wordpress website, by instinct I checked to see if there was an admin dashboard. There is, and so I suspect this will be the foothold, but from here Iā€™m a bit stuck. dirb reveals many subdirectories but they all need authentication, a few others on here have mentioned searching for vulnerable plugins, but I donā€™t know how to find what plugins the web server is using

Any advice?

43

maybe thereā€™s some utility that will scan wordpress?

44

Try using WPScan or look at request interception in Burp - it also becomes clear which plugins work there.

45

I am trying to understand my current working directory to get the juicy WP file and then potentially get access to the MySQL DB. However, I am legit stuck in this step and I have no clue how to go forward.