Official Sea Discussion

HTB Content Machines
272

Check the exploit in detail, make it understand how it works, you will get the shell.

273

Finally got root, ■■■ didn’t need to port forwarding, just think about the most classic command to escalate

274

hahaha i’m with you, man

277

finally got it down it was easy when i took a step back to analyze :slight_smile: Message for nudges!

278

congrats, buddy

279

For initial access - I’m curious as to why the rev shell theme was already present on this box. Was the contact form that allowed a call back just a distraction? In real life, would this be a case of a dev leaving a back door?

1 Like
280

wondering the same thing, is this kinda a trap where it would be activated by a dev or whats the deal here.

281

This is a nightmare of a machine.

  1. The something which is hidden inside a theme, literally the theme? I would never expected that unless I read all the comments on this discussion.
  2. The something says that it will upload and then it will execute something but it does half the job and I took its word for it that yeah it must be doing what it says but its not :')
  3. Rooting(priv esc) was much less pain than the first nmap scan to sqlmap the password field combined cause I can’t get the foothold.

If you are feeling you can’t solve an easy machine without hints. You are not alone :slight_smile:

5 Likes
282

maybe the “real” case will be that you find a rev shell that someone already added using that exploit. Because that rev shell is added using the exploit, is not something for dev

1 Like
283

Maybe im just dumb, but what im not understanding is how the exploit is triggered. I can only assume that someone logging into the admin page can trigger it, either that or im drastically missing something.

EDIT: When the box is reset the page is already on the system… prehaps were supposed to leech off the page on the server?

284

any nudge on getting root

285

It is already there HTB/Author missed validation or clean up scripts. It should not have been there - that is why even if you reset the box, it will always be there.
HTB will patch this box once season is over.

1 Like
286

Hello you all,

I solved the box also. Pretty hard for the foothold.

I did you guys find the hashtype ? I found it on this discussion but I can’t find a tool that works for me.

Thanks

287

XD
image

1 Like
288

Its really a hard one for me

1 Like
289

hashid show the correct hashtype, and then just grep from hashcat -h

290

Very easy one, indeed.

1 Like
291

Once i got the software running it was smooth sailing

292

That was an unintentional way :frowning:

293

There is a way to exploit, the rev shell was placed by mistake.

2 Likes