Got a bit stuck, anyone can give a nudge? got the access to dashboard, ffuf’ed pretty much every page.
google the dashboards for vuln
Anyone needs help? Please ping me.
any hint or help with root?
Identify what looks strange - something which is not usually present in the root directories. Any crontabs etc.
1 Like
Guys, I seem to have the same problem on every machine, I don’t want to spoil anything but could someone help me find a solution, its related to databases.
1 Like
any One with enough hints
Which stage?
Is port 8084 supposed to time out when probing it from inside the server? I’ve forwarded the port and nmap shows it’s now open, but I can’t get anything out of it (curl, nc, browser, etc.)
1 Like
You can send me a message.
just got root flag, am so confused, no privEsc needed, i almost didnt try to check the root flag, usually permission denied!!! 
Hello everyone,
PWNED
This is my first machine I was able to do successfully all the way to root.txt without any hint/nudges.
I started this machine on Saturday evening and got root.txt by Tuesday evening. I previously had a lot of help from forums on some machines so I will try to help someone and not reveal anything much.
Foothold: I am not going to say something very abstract but just note down top 7 or 8 things that come up in your mind when you think about hacking and its going to be one of them 100% I guarantee.
For root: Running linpeas didn’t helped me much. I just opened the YouTube video from TCM about linux privesc and then started to do everything line by line as by linpeas and video and got root.txt. Nothing very crazy.
Overall seems like an easy box as I was able to do it but still happy for it to be the first box I did 
3 Likes
Try different options if using some tool or custom script then you can debug.
Am I missing something or thepass from de DB is the same of the system user marcus?
Rooted! Thank you @Ashishgupta for your insights!
1 Like
Spoiler!
Login failed: Unauthorized in Duplicati. I do everything according to the instructions from the Medium. Tried all possible options.
Please help!
yep , finaly the —hex option did the job
1 Like
This was really fun, I learned a whole lot!
Hi any nudge for user? i’ve found the other login page but i couldn’t find the DB creds
did anyone had a problem with empty main flag folder?