Official Sandworm Discussion

This is being talked about in this thread multiple times - including the solution to be honest. So go through it again, look closely what applies to you and you’ll figure it out.

Have you read your exploit? What should it print out? Can you get around that not being printed?

2 Likes

Ever had to stabilize a shell?

You can now run X in another terminal to obtain a shell where Y should grant you a root shell.

Something wrong with this step, can anyone help me ?

which part of message i can control on signature verification ?

1 Like

Thanks for the nudges @HelloThere @duja446

First competitive machine. Learned a huge deal, a bit too difficult for my comfort zone, but had alot of fun!! Esp priv esc. Kudos @C4rm3l0

2 Likes

Do we need to find priavte key to verify with pgp public key?
Its giving format error every time

No, btw if you need help feel free to dm me

I got user which was not too bad…
i’ve moved to the other user that can execute things with more rights…

Here the thing this flamable exploit is really driving me crazy…
I run it but it just never produced the last message stating it’s sucessful… what am i missing?

any help would be great. Also, if anyone need help with user i am here to assist!

dm me, this form is massive and way too long

figured it out thanks [snunk1](Profile - snunk1 - Hack The Box :: Forums for the fast reply

For this exercise, you’ll need to sign some text. A signing operation requires a private key. The text is signed by the private key and the signature is verified by a public key.

You’ll need to create a private/public keypair for this box. There are different software that can help with this.

If you need a hand feel free to DM :slight_smile:

Being a noob and also pretty tired, I lost quite some time on the last step.
@nytaros’s comment was helpful. Sometimes you just have to think about the basic stuff.

Oh my dear. I have access to both low level users. I know the flamable exploit (ok there are 2 listed in the exploit db - maybe I’m stuck with the wrong one - idk). I know where to implant that exploit - it even gets triggered but without success. The last step is failing and I don’t have a clue why.
Has someone have a hint for me where to have a look?

Have you already escaped from the jail?

I have a free low level user and the one which is in jail. Do I need to free him before I can even use the flamable exploit? Thought that would be a single step.
Update: Ok, both low level users are free now - the flamable exploit still doesn’t work - at least not out of the box
Update: If two exploits aren’t working maybe a third one will

Ok, you’re haveing the same problem i had, maybe the exp its running correctly but you can’t see it

dm me for nudges

I have got the shell with a**. However, I can not find the way to the next? Can anyone hint me? :slight_smile:

I have check /home directory and web directory through, but nothing found :sweat_smile: Do I miss anything?

Look again this time more thoroughly

To fix this, it is best to delete all keys (public+secret) and start over with 1 key. Took me about an hour to figure that out :frowning:

1 Like
gpg -k
gpg --sign --armor --local-user 0x<keyID>

or

gpg -k
gpg --delete-secret-keys <keyID> 
gpg --delete-key <keyID>