Official Passage Discussion

HTB Content Machines
#171

@0xR3tr0z said:

Is their a tool that can automate this enumeration process?

Not that I know of, but if you found yourself doing this a lot it might be worth creating one.

You can possibly script it with some bash.

I have tried to zip the interesting directory and copied it to my machine and I’ve been using grep with a certain ‘rocking’ wordlist hinted in this thread but so far the only thing I’ve managed to achieve is freezing my vm due to the grep errors because of unescaped characters in the wordlist. Am I on the right path or am I digging in the completely wrong direction?

You might have pulled down too much data but you are definitely in the right area. I don’t think running grep with a wordlist will get you what you need.

#172

Thanks @ChefByzen, I enjoyed this machine a lot. Just right amount of CVE, guessing and enumeration.

Hints:
Foothold - check what is used and how old it is. Do it by hand if sploit fails.
User1 - search for interesting files, find interesting pattern. Maybe ask chef if he can help you.
User2 - check how can you login with that username. What would you use if you are User1?
Root - you are going places. Google if you are already famous?

#173

Rooted !
Took me about 2hours on how to get the bus hhhhhh

#174

Hey guys! I need a hint. So i have a ww-dta shell, got decrypted creds to pl and nv but i can’t drop to theirs accounts because w*-d*ta shell don’t take input, like su and ssh requires a key file. I should enumerate next too?

#175

@MillyBilligan said:

Hey guys! I need a hint. So i have a ww-dta shell, got decrypted creds to ************* but i can’t drop to theirs accounts because w**-d*ta shell don’t take input, like su and ssh requires a key file. I should enumerate next too?

Have you tried getting a better shell?

#176

Rooted. Happy to take PMs but I may not check often.

#177

Type your comment> @MillyBilligan said:

Hey guys! I need a hint. So i have a ww-dta shell, got decrypted creds to pl and nv but i can’t drop to theirs accounts because w*-d*ta shell don’t take input, like su and ssh requires a key file. I should enumerate next too?

How did you decrypt the creds of n*v,
I was only able to decrypt pl’s creds.

#178

Could someone give me a hint? I found the /CeN*/ L**** p*** and now i don’t know what to do with it, I barely found it almost by accident without the dirbuster

#179

Type your comment> @Limpskinz said:

Could someone give me a hint? I found the /CeN*/ L**** p*** and now i don’t know what to do with it, I barely found it almost by accident without the dirbuster

There is no need of dirbuster to get the shell. Just read everything on the webpage and use google.

#180

Type your comment> @gs4l said:

Type your comment> @Limpskinz said:

Could someone give me a hint? I found the /CeN*/ L**** p*** and now i don’t know what to do with it, I barely found it almost by accident without the dirbuster

There is no need of dirbuster to get the shell. Just read everything on the webpage and use google.

after some googling i found an et and after running it i’m in a sl in www-data with a suspicious file named ex*** and a lot of .php files, am i on the right track?

#181

Type your comment> @TazWake said:

@PapyrusTheGuru said:

No idea how to get user.txt, I feel like I’ve looked around everywhere, can someone point me to the right direction? thank you.

Its difficult to answer this because the simplest non-spoiler answer is to enumerate. Look in the files and folders. Make sure you know what you’ve found and dont assume because something looks like a random string of characters that it isn’t useful.

But there’s a lot of data to work through. Unfortunately, this is realistic - you might do a pentest and land on a box which has 30 user’s documents and you have to go through terabytes of tedious stuff to see if they’ve left credentials out.

The main thing I can say is dont go too far from where your shell lands. Look at the files. If its encoded, decode it. If its hashed try to crack it. etc.

Understood, nonetheless thank you so much! I appreciate whatever help I can get :slight_smile:

#182

Type your comment> @TazWake said:

@MillyBilligan said:

Hey guys! I need a hint. So i have a ww-dta shell, got decrypted creds to ************* but i can’t drop to theirs accounts because w**-d*ta shell don’t take input, like su and ssh requires a key file. I should enumerate next too?

Have you tried getting a better shell?

Yea, i tried to upgrade shell but nothing…I should search a file on machine that can help me?

#183

@MillyBilligan said:

Yea, i tried to upgrade shell but nothing…I should search a file on machine that can help me?

It might be better to try and work out why the upgrade isn’t working. I dont think there is anything else on the machine which would be useful.

#184

I’ve got both user but now I am stuck at root. I’ve found the relevant article but I am not sure what to do after it, as far as I understand the exploit helps make r*** owned files, but I am not sure how I should be using it (considering the fact that I’ve logged as User2 but I don’t have the password so I can’t use sudo either).

A nudge would be much appreciated.

#185

Type your comment> @0xR3tr0z said:

I’ve got both user but now I am stuck at root. I’ve found the relevant article but I am not sure what to do after it, as far as I understand the exploit helps make r*** owned files, but I am not sure how I should be using it (considering the fact that I’ve logged as User2 but I don’t have the password so I can’t use sudo either).

A nudge would be much appreciated.

You don’t need to use sudo, just stay at home make sure to liste all files, you will see something interesting !

#186

STOP RESETTING THE MACHINE.
THE RESET BUTTON IT’S NOT A “PRESS ME I’M A FUNNY BUTTON”

#187

Type your comment> @PinguBlasfemo said:

STOP RESETTING THE MACHINE.
THE RESET BUTTON IT’S NOT A “PRESS ME I’M A FUNNY BUTTON”

Check the shoutbox to cancel unnecessary resets in your VPN pool.

#188

Type your comment> @TazWake said:

@Shides said:

Currently I’m stucked on root :neutral: any hint is appreciated :lol:
until now I really enjoyed the machine, one of my favourite.

Enumerate. Look for something which has certain settings that you can use to your advantage.

Finally rooted!

Thank you for your reply man.

(AFAIC, I think that hints like “stay home” are confusing)

#189

Type your comment> @0xR3tr0z said:

I’ve got both user but now I am stuck at root. I’ve found the relevant article but I am not sure what to do after it, as far as I understand the exploit helps make r*** owned files, but I am not sure how I should be using it (considering the fact that I’ve logged as User2 but I don’t have the password so I can’t use sudo either).

A nudge would be much appreciated.

Read the exploit docs, think of how else it can be used. Get creative, there are at least 3 ways to do it.

#190

Spoiler Removed