Official RouterSpace Discussion

HTB Content Machines
46

Rooted!
Nice box :wink:

  • Foothold: obvious
  • User: make the obtained file to talk. I used a.b
 but it worked only once installed with snap
  • Root: for some reason, it took me a while; I don’t understand why my linpeas did not gave me the path right away


Enjoy htb!

2 Likes
47

So I’m not sure that many people know this but 
 hopefully this isn’t marked as a spoiler 

Android Studio has a built in emulator that works on all platforms. Whenever its emulated, you can also use adb to overwrite files, install apps, or do anything you want.

Also 
 the connection issue could be related to DNS :wink:

Hope this helps someone!

1 Like
48

I can easily get the user, but I can’t get the shell, any tips?

1 Like
49

Maybe there are some connections restrictions. Use what you know that can surely work

1 Like
50

Having trouble connecting, showing me “Unable to connect to server!” error despite being able to open the web and ping the address, tried switching emulators but no luck. any clue on what’s wrong?

Thanks.

2 Likes
51

Follow these instructions to get anbox working on Debian or ParrotOS Pwnbox

4 Likes
52

This is not a easy box, this must stop !

Pls real qualify machines

2 Likes
53

This is very weird


  • I am using a android sdk emulator, the app runs;
  • i did set up MitmProxy, all traffic from the android web browser is caught;
  • I can ping the HTB Machine and open the RouterSpace.htb link on the emulator
  • Using Frida to bypass CERT Pinning, everything seems to be in place;

I get “Unable to Connect to Server” while clicking on “Check Status” :frowning:

2 Likes
54

All I can say is that the SDK version used to load the emulator definitively matters! I was having a hard time to intercept the request from the a**, but after changing the SDK version (and just that), Burp got it immediately.

4 Likes
56

I realized that just now after noticing people using Anbox that has officialy available versions up to 8.1 only, but thank you very much for the tip!! Giving you respect on htb :sunglasses:

It seems the app isn’t making a secure request, so cert pinning isn’t even needed. Earlier versions do not approve of this behaviour. It would be awesome if the author exported the app with certificate pinning, as every modern app does so
 Frida would be needed here.

3 Likes
57

installed anbox, still can’t manage to get the app to connect. ip address and web are still accessible from the device tho, so far i’ve tried genymotion and android studio with no luck :confused:

1 Like
58
  • Add routerspace.htb to your /etc/hosts.
  • There’s no need to do SSL pinning bypass thing, capturing the request is straightforward.
  • Virtualbox bridged adapter will work.
  • set up burp to listen on all interfaces.
59

Like a lot of other people on here I can get the app to run in an emulator (Android Studio) but it won’t connect to the server (unable to connet to server). However from a browser within the emulator I can connect to the server via both IP address and routerspace.htb name. If anyone has come across this and solved it, a nudge would be appreciated. I have noticed IPv6 DNS queries flying around but I don’t think that’s the problem (I hope).

3 Likes
60

This is a very nice box to play with. :smiley:

  • FOOTHOLD: Obvious. Play with your .apk, see what’s going on.

  • USER: Reverse shells not working? Check who you are, try to write to that special file inside the special hidden directory in p**l’s home.

  • ROOT: Recent CVE. “What’s the magic word to get what you want?”:smiley:

2 Likes
61

Hey there, i had the same issue, it took me a while for using an emulator.

For those using the emulator, with the web browser working properly, but still getting the “Unable to connect to server!” do this (Not needed if using a network bridge on virtualbox):

./adb root
./adb remount
./adb pull /system/etc/hosts
nano hosts

→ add line to file:

10.10.11.148 routerspace.htb

Finally:

./adb push ./hosts /system/etc/hosts

If you use an emulator it won’t use the /etc/hosts from host, and if like me you use dnsmasq, you’ll notice you have to disable dnsmasq .

If this worked, please give me a little respect on my htb profile :sunglasses:

62

It would be much cooler if the author used cert pinning.

63

Hey there, see my response to rx80, if you try with the emulator.

If the tip worked, please give me a little respect on my htb profile :sunglasses: . Thanks!

64

if it weren’t your hints I would be smashing my head on the wall
 thank you man! kudos for the hints! #rooted

66

plz give some nudges for root

67

Classic enumeration tools should point you in the right directions