Official Ouija Discussion

HTB Content Machines
34

Pwned! Thanks to @ahmedmegjxdno, @7H31NTR00D3R, @thetempentest, @jecpr636, @matus.
Learned a lot of things with user. Root was tiring :tired_face:

1 Like
36

im a little lost can someone help me understand the vulnerability. i believe it has to do with the apache version but i cant find anything on it that has a POC

37

It was certainly one of the hardest boxes of this year. There are not so many rabbit holes, so if you think you found something that probably is the way to go. Perhaps this is the only reason why it isn’t rated as “insane” since it could be a serious contender. The user rated difficulties do not lie. The user path isn’t straightforward and can be gruesome needing some serious research, time, and patience. It is long and tedious. What to do for rooting is pretty clear, doesn’t need that much enumeration - you can pretty much easily find out what’s on the box. But nevertheless this does not mean you can finish it right away. No way. Think of it as a challenge disguised into a box. Yeah, so this means it surely is useful setting up a local lab environment before working live. Use the right tools to aid you in this journey.

1 Like
38

I don’t know why people are ranking this box low.
It was actually very interesting.
Was stuck on user for a while, and I know I wouldn’t root this if it wasn’t for the community leaving some artifacts.
Very well made box all in all, learnt a ton from it.
Need to up my game on reversing.
Enjoyed it immensely, thank you @1354

5 Likes
39

Rooted!
Very challenging and interesting box for me!
A tip for user: don’t forget to have some tea, which is very helpful.

40

If anyone is willing to help with root, It would be appreciated I know what the vulnerability is but I’m just having trouble executing the exploit.

41

The box has low rating but I really like it. The thing with path with shell code and webshell beeing file and content was nice, great stuff :exploding_head:

42

Hello!!! Im a beginner to this. and Im still try this can you help me to do it. I need aguide

43

Rooted! Holy nuts, this was insane. The foothold and user were very interesting, I learned a new technique there. But man, the root was hard, and not in the way I’d have hoped - more because there’s a rabbit hole that turned out not to be the exploit vector. Big thanks to @JimShoes for the redirection!

Hints for user:

  • Not much here. If you’re not sure, just sit down for a while. Drink some tea, maybe you’ll find something useful. Alternatively, look deeper into the page, it’ll spill the tea real quick.

  • Now you know the site’s true form. I never recommend trying to sneak stuff past airport security, but a similar concept comes into play with the site here. (REMEMBER: HTTP uses \r\n, not \n.)

  • Ralph Merkle and Ivan DamgĂ„rd send their regards, and their disappointment towards whoever made the webapp in question. The origin has all the information needed to carry out this attack.

Hints for root:

  • Something’s off about the index. Good thing the privescable app tells a little too much about itself.

  • Bring it home and set it up exactly as seen on the target. You’re gonna need to do some fuzzing and debugging, and trust me, you don’t want to do it on the target - unless you’re okay with polluting the app’s root.

  • App behaving weird when you give it too little? Ignore it. Here we like it big. (This threw me off quite a bit.)

You can PM me if you really need help, but make sure you have absolutely no clue where to go next first.

2 Likes
45

Glad to help!

46

Finally got user :space_invader: