Is the Blind XSS for the Froxlor service a rabbit hole or what am I missing? I’ve tried with different injections and cannot find a way to make it work 
Please someone can help I’m stuck
I’m still stuck at user. I still don’t get it. I try to ssh with the etc sh**** cred. but I can’t login. Or do I have to do things from inside the whale it self? Thanks in Advance
It works now, the hash is different, I think someone changed the pass yesterday or something. Thanks anyway
Hello guys, I have the user shell and I get the credentials for froxlor admin panel, now I am totally stucked inside that panel, I don’t know how should I trigger the PE.
Any usefull hint?
Sightless pwned.
did ya find a way around it
hello am stuck at the froxlor login page can ya give me a hint or something?
but how can you get the creds of the froxlor login page give me a hint or something please
i cant crack the user hash, can u give a hint ?
Hi, I found the subdomain s***** and the Github PoC, but I don’t know how to adapt the payload for revshell. Can anyone give a hint? 
Guys! Help! This is what I’m getting when I try to access the hidden website on my local computer:
Domain not configured
This domain requires configuration via the f*****r server management panel, as it is currently not assigned to any customer.
Please ask your provider/hoster if you have any questions.
THX!!
cant find a wordlist to hashcrack, can someone help?
Hi, I’m stuck on the first reverse shell. Does anyone have any hints ?
same for me…
For me, rockyou.txt was completely sufficient
Getting the same error
So i am beating my head against a wall here. I have user flag and now stuck. Perhaps an elementary education in CDP? Any help would be appreciated.
perhaps its a domain issue. hosts, etc.
Do you have the hash? How does the hash start? With $6$...? Then it is a sha512crypt. Or starts with $5$...? Then it is a sha256crypt. Or is it a MD5-hash? You can detect it with hashid or hash-identifier. If you have found the hash-type, you can use hashcat with the correct hash-mode and the rockyou.txt wordlist. And so you can crack it.
already got user by ssh, any tip for root?