i belive you need exploit the binary. but you need another file. l******_s*****
i am in the same point
1 Like
I think that the payload must be sent via upload file. At this point activator process Will be injected with arbitrary comands and do something. But what to do? 
think about your target. what do you want at this stage?
Reverse Shell? I think iām missing an important step. Hints appreciated
whatās missing?
1 Like
Been doing this for a few hours now and finally got to the point where I am so close to foothold/user. But something is driving me insane. Leaked the sā¦ from /pā¦/ā¦/mā¦ but the offset to ābaseā keeps changing been trying to offset both from start end end of sā¦ but nothing seems to be stable. ASā¦ should not be doing that orā¦?
Hii i am trying to do this box i have got lf*
with the help of
wfuzz
i have got
index.php default.html
b*.html and
act****_li***e
.php and i can also read files like /etc/passwd but dont know what to do from here any hint ??
1 Like
Just dropped a shell as www-data. I would be interested to hear the solutions from others? As my exploit seems a little āhackyā, would be interesting to know if there was a better way
Medium they sayā¦ 
1 Like
haha! Iāve been thinking the same this whole week
Ok, Iām stuck on this one for a couple of days now.
I have limited read access: some config files, the /p*** folder, logs.
The logs seem to be a dead end. Tried to inject them, but the code wonāt be executed. I guess because it is not a true āincludeā.
The key to understanding what is happening to the upload file and the ability to access / execute something over there is probably the /p*** folder. But I have been guessing, enumerating, brute forcing subfolders and files with no result.
Am I looking in the right spot?
Thx.
thx! Iāve tried this earlier with no results. But I probably did something wrong. Now I went through all the #'s again and I think Iāve got the one I was looking for.
I didnāt think it will require toā¦ because it was medium rated.
Really we meant to do so?
You are on the right track. How can you enum processes using /p***?
There is a numeric subfolder for every process.
You need to try all the possible numbers to see if there is a subfolder present. If so, that folder contains a lot of information on that process.
Thatās one wayā¦but there is a simpler way imo. Read carefully the documentation about /p****.
ok, I wasnāt aware of a simpeler method. Curious to know what it is. Although iterating through all the idās is also only one command, when using the proper tool of course.
What a ride !!! It was a very nice box, I learnt a great deal!
However, I deeply disagree with the medium rating of this boxā¦ and I donāt know why for the last year, all the boxes are rated lower than they should? I donāt really see the point? Or is it me that becoming slower over the years ā¦ which is also possible 
Here are some few hints:
Foothold to shell
- itās been leaked on the forum already ā dirbuster to find a page then look at what this page calls then Lā¦ to find a particular process
- find the process and the program that goes along
- make it get us a shell [thatās the hard part!]
Lateral: shell to user
- very easy, just look around to see some files are regularly written somewhere
- exploit it
Root
- fun root privesc
- donāt need any linpeas, just work with what you have in front of you when you get user
- google around the bin you donāt recognize and read the content of every file
10 Likes
Any tips or things you could recommend I look into? I think I have all the required info but canāt pull it all together to get a shell.
hello 
What info do you have yet, so I donāt spoil?