Official Runner Discussion

HTB Content Machines
55

Okay bro got it.

56

Finally pwned, follow the clues above for user flag and create a container exploiting a vul to root flag.
Send me a message if you need help

1 Like
58

Iā€™ve sent you a message!

59

what do you say with that

61

Hello guys, hope youā€™re all fine.
I began working on Runner but got stuck at enumeration with gobuster.
I read about gobuster in vhost mode, despite several scans and DNS and vhost, no results. I then read that a personalized wordlist would be consistent here but I donā€™t understand what to base it on, no conclusive results in the little enumeration that we can do, and no additional information on the web server. A little hint or an explanation on wordlist customization?

62

If you have the Seclist wordlists, check out some of the DNS wordlists
Seclists > Discovery > DNS > pick a couple to scan with if you get nothing on your first scan. I checked a couple and they have what you need.

It would be good to go back with CEWL afterwards, if only to get familiar with the tool.

63

Thanks Iā€™ve a little question, I know what I have to found and itā€™s in some of these wordlists, but gobuster donā€™t find them, I tested in vhost mode and in dns mode, but i tried to increase threads because itā€™s very long, it can be a problem for findings ?
Ty

64

I used gobuster vhost too. Try adding the --append-domain flag and I went at 50 threads -t 50. gobuster vhost -u http://example.com/ -w wordlist.txt --no-error -t 50 --append-domain
You could also try with one of these if you canā€™t get vhost to work:

There are probably other ways to search but I used gobuster vhost with a seclist dns wordlist. Youā€™ll get it if your persistent.

2 Likes
65

Hmm. Please DM me about this and show me the command youā€™re using.
When I did this part, the scan only took a minute or two - so there might be something wrong. Get in touch and Iā€™ll try to help clarify

1 Like
66

Thanks ! Got it, big thanks for your help. Going trough now.

1 Like
67

Thank you thatā€™s ok Iā€™ll be fine Iā€™m learning, I added --append-domains and it work, I search about and understood. Thank you.

70

how can i find password for matthew can someone help .?

71

i was able to retrieve matthew password , but it seem not working currently , try to find out another way

73

Can someone help me with the root?

75

Fun box. Foothold wasnā€™t too bad (just do some research once you find the page) but it took me a while to find what I needed for user, didnā€™t check the right places. Not sure about root thoughā€¦ LinPEAS doesnā€™t seem to have found much of interest, and Iā€™ve not seen any interesting files.

76

You prob need to re look at what ā€œLinPEASā€ gave you. Look properly. And maybe letter-by-letter.

77

can anybody nudge me for the foothold ? is there anything to do the tc version ?

1 Like
78

is d***** a rabbit hole?

79

Hello Guys,
I tried to upload some tools but theyā€™ve been deleted immediately.
Did you have the same problem?

Thank regard

80

Hello guys, Iā€™m stuck trying to get the root flag. I believe Iā€™m very close, but Iā€™m missing something. Iā€™ve already created a c********, but I canā€™t access it through d*****. When I try to connect, I keep getting ā€˜permission deniedā€™.