Official Schooled Discussion

I think I must to put my m***n profile url in this field.

@UVision said:

Type your comment> @TGRHavoc said:

(Quote)
Yeah, I found an interesting field on my profile account, I think this is the right place to put the “thing”. Should I create an account on m****n** website ?

You shouldn’t have to create any other accounts… Maybe just try your thing?

Type your comment> @TGRHavoc said:

You shouldn’t have to create any other accounts… Maybe just try your thing?

Just realize what I can place into this field, I will try it:)

Found an hash but can’t crack. Is this the right path for getting user j***e?

Edit: managed to crack with j was using h**c*t. Got user.

Just got RCE, any hint for user ? I found my*** creds, but no my*** seems to be running on that box.

Edit : just found what I need.

Rooted nice box!

Foothold: Enumeration is crucial. Don’t overlook different kind of enumeration, eventually you’ll land in the right place. Read carefully all messages so you can “steal” the opportunity to to something evil. With the help of Google you’ll understand what to do to go further.
User: Enumeration (not necessarily with classical tools), dig well from the starting point and go grab what you need.
Root: Enumeration on permissions, was not so hard but I liked.

Thanks for the box!

Rooted, very fun box;)

PM me to get some hints.

Just Finished the Box. If help needed just send me a message. :slight_smile:

I’ve found m****e but unsure where to go from here, could anyone please give me a nudge in the right direction?

Type your comment> @stonecreek said:

I’ve found m****e but unsure where to go from here, could anyone please give me a nudge in the right direction?

You must to get a teacher account. Find a teacher online, and try to steal his account with a well know vuln (not a cve). :wink:

@UVision said:

You must to get a teacher account. Find a teacher online, and try to steal his account with a well know vuln (not a cve). :wink:

Got root! Thanks for the nudge :slight_smile:

Awesome :wink:

finished the box, if anybody needs help just pm me

Rooted the box!!

Experience
Great box which requires you to use a lot of different skills. Found the box to be very realistic, banged my head a few times against the wall. Definitely recommend this box, 5/5

Foothold
Enumeration is key. Proper enumeration is more than just running tools; ask yourself: what is this box, what is it designed to do, and where would you find that? The box forces you to look at it from a realistic perspective.

User
The path towards user is a lot of fun and requires multiple steps. Again, enumeration is key: The box itself gives some good pointers; you will miss them if you’re approaching this from a pure technical perspective.

Root
I made root 3mins after user. Too easy for my taste, but realistic nonetheless.

Warning
When researching the attack towards user, I stumbled upon a document that someone wrote with a title that describes exactly what I tried to do. This is a spoiler; someone wrote an article using this box. It’s a mini write-up and a big spoiler. You can recognize the document very quickly by looking at the IP addresses and screenshots. If learning is what you want; do yourself a favor and click that website away. Disrespect towards user 0…et - you nearly ruined my fun.

Rooted. Quite a few steps to user but good box! Root was borderline trivial.

Hi I need some hint on the box, I am stucked at foothold, can’t get the rshell, I can’t make the RCE work.

Type your comment> @Niotop said:

Hi I need some hint on the box, I am stucked at foothold, can’t get the rshell, I can’t make the RCE work.

Were you able to get t*****r account? If so, look up for an exploit. Hint: there is a poc on youtube

HI -
So, I saw that the author stats for schooled put weight on enumeration. And everyone in the forum seems to be saying that I can get to teacher by enumeration.
I have like 3500 distinct URLs on the site from enumeration.
Not one of them helps me figure out how to login as Manuel or any teacher for that matter.
I have enrolled the the math class but I just dont know how to get teacher creds since Manuel Phillips is not a real person that is going to read their messages.

I think I figured out the correct thing to do, i should have known based on the available class to to enroll in.