Official discussion thread for Timing. Please do not post any spoilers or big hints.
1 Like
Hi there,
Any hint to start because scanning did not reveal anything exploitable, fuzzing neither (nor bruteforcing…).
Maybe i’m missing something under my eyes (or tired maybe 
)…
thx guys
Paying close attention to http status codes while fuzzing for other pages may reveal something that doesn’t require authentication. Go from there.
Thx, in fact i was stucked cause of a bad dictionary…sad 
Hi,
Is Timing machine working right now?
I’ve spent a few days wornking on it when it was a realease machine. The problem is that the machine was moved to regular lab and I’m not able to connect anymore.
Yes, I’ve checked if openvpn is working properly and using the correct vpn file config for connecting to labs instead of realease area.
Some ideas?
Thansk.
download vpn file from classic htb and use the ip 10.10.11.135. I had the same issue and this worked for me dont know why.
Thanks,
10.10.11.135 this host is working using new lab openvpn config file. The IP that is shown in the webapp when the machine is launched is wrong (10.129.122.38)
Hi there,
Same problem for me…
Till yesterday evening, was working on the machine and then, around 20:00 (UTC+1), Out of Order…
I remembered i already had this before.
The Timing machine is migrating from Arena to “normal”.
Then, as my machine was started, it remains in an ambiguous state till it would be shutdown by HTB after the idle time.
Moreover, the Search machine wich is in release got the same private IP and i cannot stop it nor start the Timing machine migrated in the standard lab !
It sounds crazy i know but already experimented that with an arena release …
Ok, this day, all returned to normal, and works
cat user.txt → done 
It’s either me becoming slower and slower or HTB box rating becoming harder and harder ^^
Took me 2 full evenings to get to user !
It’s a nice box so far… so onto root now
Edit: …and rooted!
Root part was fun and pretty straight forward
thx @irogir ; it was a nice box
as always, pm if stucked, but please provide “precise enough” info before asking so I don’t spoil
Hi all,
Rooted. If you need some help, just tell me for hint.
gg wp
1 Like
Sheesh, I’m having some trouble getting foothold. Fuzzing inputs, scanning with dictionaries, all bunk so far. Maybe its the wordlist I’m trying to use
1 Like
Alright, I liked this box, but it also annoyed me so I’m going to share a bit:
USER.TXT
The main page gives a clue on the type of attacks that should be tried on this machine… It is in fact a very basic vuln, but it’s a little hard to figure out. I used a popular directory/file finder to find the injection point. The results might seem benign, but pay attention of the status/size of results (as mentioned previously in this thread). I’m sure you’ll find right file using a common list. Secondly, I used a simple BASH loop and a popular list to find potential injection parameter vulns. The server will give clear indication once you found something that it thinks is suspicious. Once there you can google for well known techniques. If you did your attack correctly you should be able to get a glimpse of stuff on the filesystem.
Next you’ll have to DO A LOT enumeration. This is the portion that took me hours and hours since I did it very slowly. DO A LOT enumeration. Read a famous file to get a username that you can use. DO A LOT enumeration. It’s possible to guess creds using with the username. DO A LOT enumeration. Once creds are guessed, log-in and change your permissions. DO A LOT enumeration. Send an attack file to the victim… I wasn’t able to get a rev shell (which was odd considering the RCE ability) so I slowly looked through practically the whole file system. DO A LOT enumeration. You’ll eventually find a file that you can bring back to your attack machine. DO A LOT enumeration on the file(s) to reveal some juicy information.
ROOT.TXT
Do your normal assessment of priv esc for HTB machines. Notice a file that you can run as root. Check the file permissions associate with files created when running that program. The file permissions were a clue for me. Think timing.
2 Likes
Not so much enumeration.
No enumeration. it is the first thing to check using this type of vuln.
Simple guess. common mistake.
Just login and explore, try everything, observe output and make change.
first leak the source codes to how the uploaded filename is composited, then upload RCE shell and get the url. this is the critical part, related to the machine title. (out-going traffic blocked)
use a common automation tool to find the file for you. (upload the script first)
noticing the hidden folder, it is obvious where to look for hidden info.
2 Likes
For root, i don’t think it is releated to timing.
you can CREATE file as …
1 Like
Hey i am looking at the response codes from dirbuster they don’t seem to be interesting all i am getting is 2- 200 OK responses from image and login.php and a bunch of 301 302 and 403. what should i be looking for?
(Status: 200) [Size: 0]
what is this type of page used for? how to make it output anything? keep enumeration.
image.php looks interesting but I don’t know what to do with it. I tried upload files using curl but they dont seem to be uploaded
PLEASE HELP
Try fuzzing parameters, you’ll get an error message when you’re on the right track
1 Like
bro which wordlist did you use…?