Root!
Type your comment> @0xstain said:
do i must crack the hash for get user?
Hashcat may work with correct module mentioning.
Rooted! Nice to have an easier box this week - thanks to @ChefByzen.
Rooted in the end after stepping over the clue a few times. Thanks @gs4l for the nudge. Itās a nice box @ChefByzen
Initial foothold : Google
User1 : Look around
User2 : Look around
root : Corona time, catch a bus and get back home; don;t come out #staysafe
Rooted
If anyone need a hint, PM
got the hash from co**.php but canāt crack it . Any nudges?
Type your comment> @maskop9 said:
Initial foothold : Google
User1 : Look around
User2 : Look around
root : Corona time, catch a bus and get back home; don;t come out #staysafe
Rooted, thanks to this comment.
Certainly on the easier side of medium boxes. The best part is that all the steps are quite logical with no guess work involved. Props to the creator @ChefByzen for that.
All the hints have already been given in this thread. But if you still need a nudge, feel free to pm.
Type your comment> @sparkla said:
@CarbonDPG said:
Iām not the owner of the box (obviously), but F2B can be configured to detect (and ban) directory brute forcing.Thanks for clarifying. Didnāt know that. How does it work? F2B works with āJailsā when banning failed logins, I never looked under the hood how itās actually doing this.
Fundamentally, F2B is just a log parser. Create a new definition and scan for specific regex in the apache logs. Github link below to detect weblogins for example. Though in this case, youāre not scanning for POST requests in /login, youāre scanning for excessive POST or GET requests to any page. Add the new definition to the jail config, restart the F2B service and bobās you uncle.
Alternatively, tear apart Chefās F2B config files once youāve pwned the box. Found out how heās implemented it himself, the more you know!
@LegendHacker said:
got the hash from co**.php but canāt crack it . Any nudges?
Wrong file, right area but search deeper.
Spoiler Removed
Initial foothold can be done without MSF . FYI
Type your comment> @solid5n4k3 said:
Initial foothold can be done without MSF . FYI
I couldnāt make the module work so did it manual way.
Spoiler Removed
Spoiler Removed
This was a really nice machine @ChefByzen thanks for your efforts! Feel free to get in touch if youāre stuck, Iāll try and nudge if you let me know what youāve tried!
got user 2 but stuck now ! found ib⦠but what i need do ?
nice machine.
foothold is pure fun. I wasted A LOT of time getting a grip on it only because of my dumb reluctance to consider uppoer and lower caseā¦But once you get it, itās a snap.
User1: you are a few slashes from the goldmine.
User2: Yes, it is that easy!
Root: i admit i just took the lazy way to get the flag. but once you are able to do that, getting a root shell is trivialā¦
Rooted. Very nice machine.
IMHO in some points it is more āeasyā than āmediumā.
PM me if you need hints.
@ChefByzen: thanks for this box
Got second user, Iām pretty sure Iām home where I need to be. Iām having trouble with my keys and my rings. Solved a problem by including a dash and a cross, but now I just get no answer. How can I ādisplayā what I want ? How do I catch the bus ?