Official Noter Discussion

HTB Content Machines
51

I found that creating furniture in a certain location was problematic due to the furniture being removed after a time :wink:

Maybe try another location.

1 Like
52

Thanks, that’s helped me to get root. Just neeeded to see that from a different point of you.

Thanks :smiley:

53

You are very welcome!

54

Hey guys, I already have found the code, and I have analyzed it. The problem is when I try to expo** a note, I get a “Internal Server Error”. I have already reset the machine a couple of times and nothing changes.

55

Nvm I already got user

56

i found the X** but im stuck on how to e*****t it can anyone help?

57

just to make sure, the X** is in B********p****7 right?

58

Found 2 users. Are there other users ?

Don’t lose time. Users are case-insensitive.

EDIT : found another password in config file. Don’t know where to use yet.
NOTICE : the most effective method to brute force users is to use a web enum tool with a wordlist of forged tokens.

1 Like
59

Most mediums tend to lean toward hard, but this medium was really quick and straightforward! Feel free to pm me if you get stuck

1 Like
60

you can find the valid user with zero bruteforce, it was the second thing I tried

1 Like
61

Finally got this working. Got me like 2 hours.
As for Foothold there is one particular thing suspicious in the machine. Simply google decoded value and you’ll be good.
The most time-consuming part for me was looking for right user. After all I had to brute-force it, but application makes it possible to check if a user exists. I could not guess it manually.
Then just RTFM. :slight_smile:

User/root - I am not sure if I did it right way, because during entire test, I wasn’t able to login or to get user shell. I directly got root shell with one trick with no privilege escalation needed. Anyone did it similar way?

62

Can someone pls give me a hint for root? I think I’m missing something but not sure what. Tried all the usual privesc routes for linux but haven’t found anything interesting

63

UUuuuuuuhhhhggggg… The privesc is just… not… working. Found a 2006-era privesc that falls flat about 4 or so steps in (at the last minute it throws a ‘you can’t write here’ or ‘access that right now’). Have tried putting the exploit in a couple of places that the user account can write to, scoured the source for other exotic location ideas, and still rewarded with a middle finger. Giving up for the day. Hoping that when I come back to it next training day the server will be in a better mood. I see others historically have had issues, so I see it as a shruggable moment.

64

Stuck on privexec. Any hint? Tried some exploit but nothing

65

Found user. Now going for root.

66

try looking at the web source code and seeing what you can do with some hardcoded stuff in there

67

This was a fun box. I like the how it’s obvious early on what your goal is, but it’s an obscure enough case that it took a second for me to figure out how to implement it. Root was fairly straightforward. Great box!

68

On rooting. What’s the catch with that backup script? How it is executed? :thinking:

Well…

Rooted. Thanks, @NyanNyanKoneko, for help :clap:

69

same situation & find builtin user. That’s it.
The e***** function is weird & broken. However, I didn’t get source code at this point.
Any Advice? thanks!

[Updated] solved. Clue is enough then. Thanks

70

rooted:

If anyone needs a tip just send a DM