Official Visual Discussion

can someone help me get nt \ local service, i know what i have to do but i dont know how

if you know what you have to do, there is only one way you can do itā€¦

Thereā€™s nothing we can doā€¦ -napoleon

actually this box is an easy oneā€¦ but when it comes to windows, HTB rates boxes a little bit higher than it should beā€¦

hi everyone,
what i am doing wrong?

shoud i paste http://myip:8000/repo into submit or http://myip:8000/repo.git ?

i got an error The repository doesnā€™t contain a .sln file or the URL submitted is invalid.
Screenshot 2023-10-05 at 12.44.30 p.m.

thanks

3 Likes

DM me

1 Like

Execute this from your ā€˜fakerepoā€™ directory:

cd .git && git --bare update-server-info; cd ..

When providing the url, use: http://myip:8000/repo/.git/

6 Likes

For those of you that are stuck on strange errors during the privesc, even though you are certain that you have it right - consider what reverse shell you are using.

I was running commands through pwncat and nc, but it did not work. But when I used ā€œexecuteā€ option within very famous exploitation framework, it worked like a charm. I received what I was missing. When one way does not work, maybe some other might.

2 Likes

This is a very frustrating machine. Initial foothold is impossible for me, but I guess it is a medium and I am a noob!

1 Like

All I gotta say is enjoy this box - thought it was a very cool box and learned a lot from it

3 Likes

Thank you box creator for the fun start to the new season and the lessons learned on this machine!

Stuck on PESC since last 12 hours, can someone help me ?

hi, everyone
could u suggest how to read root.txt from nt authority\local service ?

i am not a windows guy)

Similarly, I have been stuck on privilege escalation for a while.

This is the first time I have attempted privilege escalation, so any help/tips/tutorials/advice would be much appreciated!

I got a bit late to the party so iā€™m still catching up.
Could use a small tip in the right direction on setting a foothold.

Iā€™m all good setting the git repo over http, but iā€™m struggling with the dotnet project. Not sure the reverse shell payload should go into the .sln file or into the .csproj file. And if i need to encode the ā€œ$ā€ characters (as test building the project locally fails if i keep the ā€œ$ā€ characters on it. Also, When i send the url to the server, i get that it does not find the .sln file, but it is 100% there (if i clone locally everything works).

I have the same probleme , i donā€™t know if the reverse shell must be in the .sln file or in an other one.

Stuck at the exact same point sadly.

This should help to understand how .sln and .**proj works.

Then you can search about events in msbuild.
I am not an expert, but if need any more clue about this first steps you can dm me.

Thanks :slight_smile: However, I am using csproj; or is that why itā€™s failing?

Getting the reverse shell was not that hard, I used gogs but now Iā€™m stuck on privesc. I doubt if Iā€™m trying very hard than whatā€™s actually required. Itā€™s been 9 hours and I canā€™t find anything. Can someone please help me in DM. Thanks