Official Stocker Discussion

HTB Content Machines
22

Got into the app and got stuck, any help?

23

this may be useful :wink:

#!/usr/bin/env node
ā€˜use strictā€™;

const fs = require(ā€˜fsā€™);
const path = require(ā€˜pathā€™);
const output = fs.readFileSync(path.join(__dirname, ā€˜outputā€™), ā€˜utf8ā€™);
console.log(output);

24

This was a fun box, the web part had a similar bypass to another HTB machine. Do standard web enum and If you have wappalyzer you can see what framework is being used, then you can google to know what language the backend DB uses, to then do the bypass.

Test functionality of the app (intercept traffic in burp), and see that something that you can control (via burp) gets ā€œreflectedā€ in an output. This output can also be passed to exiftool to see what made it. Using this look for some form of code attack on generating this form of output.

Root is pretty straight forward, see what you can do, and how to privesc with that from a common bin site. (There is a trick needed here, which is commonly used in web attacks but works well in this scenario as well)

4 Likes
25

:package: Ā”Ā” Rooted !! :package:

If you need help, write me a message and I will be happy to help you. :grin:

1 Like
26

ROOTED!

So satisfying.

1 Like
27

Did you get the shell?

28

I got the creds and connected via ssh. The way to root then was really simpleā€¦

1 Like
29

Rooted. :melting_face:
Very good machine with an interesting vulnerability.
User:

  • Sometimes it happens that developers test the code elsewhere.
  • Do you think SQL is there? No. No SQL.
  • Just like that, not a payload works. What needs to be changed?
  • Look carefully at the fields passed to the application, maybe you can insert some kind of frame?
  • You should already know the username. The password remains. What files can it be in?

Root:

  • The path to the file to be executed is not always straight, sometimes you have to go forward and go back to get to another place.
1 Like
30

Little hint for enumeration : VHost enumeration
Little hint for login page : NoSQL sure, but in which form ?

31

So satisfying!

Thank you for the forum discussion got so much insight!! Got stuck during bypass the login page cause stupid mistake!! if stuck in bypass the login page donā€™t forget to check the content-type header

1 Like
32

Iā€™m able to spot the subdomain using ffuf but it isnt showing up with gobuster. Anyone know if Iā€™m missing a piece as I want to know if the tool is still viable

33

Yes, gobuster is still viable. However, in the latest versions you need to add the --append-domain switch with vhost enumeration.

1 Like
34

Rooted! Hints provided above were helpful. Used chatGPT to get from user to root.

2 Likes
35

Rooted! To get the root for this one you gotta shoot for the star!

36

I could not connect to the site, the server doesnā€™t even reply to my pings and shows no open ports. Iā€™m using OpenVPN, can someone help me?

37

A lot of resets happening.

38

Hi

You can not connect to which site: to the HTB MAIN site or the one in the STOCKER challenge ? if it is the stockerā€™site I can help ohterwise bro check HTB FAQā€™s.

39

Come on guys CHAT GPT are you serious ! what a hacker you will do ask CHAT GPT to hack the NSA see if it can lol I doubt about that haha

40

there is 2 open ports and the server in question is ON and respond properly you should connect normaly to the site otherwise add the IP address in: subl /etc/hosts then refresh the page and it works ! I suggest you to start by another challenge if you do not know that just saying you have to learn how to walk before running :stuck_out_tongue_winking_eye:

41

Itā€™s the one in the Stocker challenge