Official Sea Discussion

HTB Content Machines
113

Having a many attackers on the machine is curse and a blessing. The look at what the exploit is trying to do.

114

no this machine is not easy

1 Like
115

Can someone please share some hint instead of saying they got the foothold and that it is easy.

1 Like
120

I feel like Iā€™m very close, but I canā€™t for the life of me figure out where my script gets uploaded to.

122

maybe a form

123

Rooted! Took me a while

124

I am really trapped in this machine may be need help now every time I tried to get sh3ll from website it does not work??
Any hint?

125

try to get cookies and not a shell, then perform manual rce if you canā€™t get rce

4 Likes
126

ok, i will try it

127

Is there a way I can completely reset this seasonal machine? The issue is that even after resets, the exploit endpoint still remains there. My assumption is that it should clear by itselfā€¦I am not sure if any other player triggered the exploit and I merely used it for foothold!!!

PS: Can someone please try and check if the machine resets to default clean slate after switching VPN/resetting?

For me the box does not reset to a clean default state - How can I fix this? Please help.

128

Okay the machine is easy because we do not have to exploit anything for foothold ā†’ Everything is already there. We just need to call it. The software is built and shipped with exploit LOL
This does not really makes sense - what a rabbit hole this is.

2 Likes
129

Is the machine working properly?
I get some responses from the XSS but if i try to request for example /test from my server, it dosenā€™t work and i still recive responses only for /

130

@insomnia 's hint above about the cookies is what got me in there

2 Likes
131

Rooted. From my point of view, the root is ā€œVery Easyā€. However I did not get root access to the machine, just read a flag.

UPDATE : after reading a source file, get root access too.

132

the dirā€™s are all in the html sourceā€¦ remember some OSā€™s are case sensitive too!

133

Hi, can i dm someone about the foothold? Im stuck with the cookie stealing.

134

Wow :rofl:. It is true. The reverse shell is already in a box after restarting.

1 Like
140

got root, thanks @Ashishgupta and @SouLXIX for reminding me that Iā€™m an idiot :slight_smile: kidding, thanks guys

2 Likes
141

if you did what I did in the same way you can do a lot more, just tweak the payload

1 Like
142

It might be necessary to reset the box so that you may submit forms successfully.

1 Like