Official Sightless Discussion

HTB Content Machines
198

I found root creds in keepass, is that a rabbit hole?

199

This was a very peculiar experience indeed.

200

If the entry point is from the ( sqlpad) it’s just the starting line :wink:

201

Has anyone encountered an ECONNREFUSED error while exploiting the CVE? I tried using a public RCE exploit I found on GitHub, which generates a shell, but when I attempt to execute it myself using Burp, I keep receiving an ECONNREFUSED error

1 Like
202

Yep it’s normal you have to adapt the payload

203

alleged f***** entry point but i cant for the life of me find an admin panel, only a notice that the domain isnt configured. did somebody vandalize or am i missing something?

204

Please tell me how to forward ports from the machine. I do ssh -L port_form_me:localhost:port_machine user@ip but it doesn’t work.

205

For exemple :

ssh -L 9999:localhost:8080 user@domain.htb

→ add bla.domain.htb at the end of 127.0…1 on /etc/hosts on your working machine

→ go to your navigator web

http://bla.domain.htb:9999/

It’s a basic setup for ssh tunneling

You can also use tool like chisel or ligolo For easy setup like this or more complex structure

206

Thanks, I will definitely try it today

207

This is where I am at. I have root in container and a cracked pass from shadow but cannot for the life of me figure out the next step to escape.

208

That’s the point you don’t need to escape, you’ve the credentials just use them :wink:

The answer is in the nmap scan you’ve done at start….

209

I know what I need to do in the admin panel(D-T-s) but I don’t know which ports to add.

210

Has anyone fixed the “Domain not configured”?

211

I am stuck after getting the rev shell, any tips where I should go next? I tried linpeas but I cant find anything, nothing in the home directory only a dir called “m******” and the root is empty, am I in the right place? Did I overlook something, help :,)

212

you did, re read this discussion then re read your linpeas result, the hint was given multiple times

1 Like
213

Found it just now, I should’ve paid more attention

1 Like
214

Work out what type of hash it is that might?

215

i got an intial access but it turned out to be a whale jail which won’t let me do much.
In its shadows however, i found something i fed the cat with (it liked just r** not m**, maybe i’m missing the correct recipie) and another thing which could be used with the pad. Using the pad i found some more i could feed the cat with.
none of those led to an open door on the 2 ports starting with “2”.
Reading through the previous messages one could assume for more ports somewhere…
I really need a nudge to carry on. thanks

216

replying to my self: turns out john sees things a cat doesn’t
image

217

The root part is not that easy for a easy box, but here we go