Official Shoppy Discussion

HTB Content Machines
75

if you already got the hash from the login page, decode it and do enumerate subdomains

76

It’s the enumeration part that I can’t seem to get to work.
I know what the subdomain is, but when I use gobuster vhost or ffuf I can’t get any result, except when I put the subdomain in the /etc/hosts file - then I get a result

77

you need to put the shoppy.htb and the ip address first on the /etc/hosts before doing enumeration

78

I have shoppy.htb in the host file - but it doesn’t work.
When I put .shoppy.htb in the hosts file, it works, but I am not supposed to have that in the host file because I shouldn’t know it yet :slight_smile:

79

Okay, I’m definitely stuck for 3 hours on the login part.
Can I PM someone because I’m about to give up.

Followed lots of docs available on the internet about the subject, nothing work, did I miss something ?

80

You are welcome to pm me :slight_smile:

1 Like
81

ITT: Nobody knows N#S##i

Even after reading the source code, I get why it would work in theory, but I can’t even find documentation about the way this operator is written.

Classic case of how can I find the answer if I don’t even know the question…
Also shows how poorly this technique/vector is documented and understood in comparison to the other well-established vector.

If any Expert cares to explain why the payload works, please DM me.

edit: as usual, 30 seconds after posting I found the answer :slight_smile:
Now it makes sense why the string is interpreted and allows other language “tokens”/operators.
I guess I’m the “expert” now, DM me if you need to know why the bypass payload works.

2 Likes
82

Ey, sorry for the delayed answer.

I used a list called “bitquark-subdomains-top100000.txt” It comes with SecList and it usr/share/wordlist/SecLists/Discovery/DNS.
Since then, i use this one and it always works.

83

Got the user flag by logging in as j****r via ssh, but it doesn’t seem to work. Why?
Update: Rooted. The root flag doesn’t work neither. : (

84

Same bruh

85

I use this one as well - still no result.
Only when I put the subdomain in the hosts file it works

86

Well…
Now, after multiple attempts I got it to work by switching my vpn and using ffuf :slight_smile:

87

it used:
gobuster vhost -w /path/to/bitquarkslist.txt -u shoppy.htb
and
ffuf -u http://shoppy.htb -w /path/to/bitquarkslist.txt -H “Host: FUZZ.shoppy.htb”

Hope it works!

89

Guys help me. My gobuster vhost doesnt work. i know excatly what the subdomain is so i created a file only exists it. and finds only if i addthe full url in the wordlist( [email protected]) but doesnt find subdomain alone?? helpp

gobuster vhost -u shoppy.htb -w ./list.txt

90

mine doesnt find help me pls

only finds if i manually give the full path xxx.shoppy.htb

can’t find just xxx as subdomain :((

gobuster vhost -w /usr/share/wordlists/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u shoppy.htb

91

mmmm mine works both:
-u http://shoppy.htb
and -u shoppy.htb

Have you echo “IP shoppy.htb” > tee -a /etc/hosts?

i dont know what can it be

92

I don’t know why but the mat****** subdomain login page won’t load for me any clues are appreciated please

1 Like
93

I don’t know the problem with gobuster but i was able to find the subdomain with fuff tool command for subdomain enum fuff -w wordlist -u domain_name -H “http://FUZZ.domain_name”

94

Rooted! :japanese_ogre:

Definitely it’s all about enumeration. Using Seclists it’s more than enough to crack the machine (at least for the user level).

PM if someone needs help :slight_smile:

95

have you updated your hosts file?

10.10.11.180 shoppy.htb mat*******.shoppy.htb