thank U for is box !
Lol so of course the msf exploit isn’t working for Wn… is there a way to manually exploit the Se P*e U****e? I’m logged in as Mt.
EDIT
Never mind it started working… still would be interested to learn the manual exploit though if anyone knows it PM me
Trying (and failing) to exploit AUTH via r***s to gain initial foothold but I keep getting permission denied when trying to change the directory for the s_ _ keys part of that process. Bashing head against keyboard now…suggestions on what i’m missing here would be greatly appreciated
I was able to get a s**** using the r***s user but after that I am stuck. I also figured out the user I should jump to. I thought that the key could be ****.rb files but no luck.
Any hints on that?
@Arrow said:
I was able to get a s**** using the r***s user but after that I am stuck. I also figured out the user I should jump to. I thought that the key could be ****.rb files but no luck.
Any hints on that?
Enumerate the filesystem. Find something that really shouldn’t have been backed up. Copy it to your local system, crack it and use it to switch into the user you need to be.
Then you have valid credentials.
id
uid=0(root) gid=0(root) groups=0(root)
Feel free to ask if u want some hints abt this old box.
Get the cookbook and you will get it done.
Got root! This box really isn’t as hard as it seems, though it took me some time. Tips for user: just enumerate for everything that seems valuable; when you find something, don’t think too concretely, but rather try everything you can. I didn’t even realize until after the fact that I could have submitted root before user… DM for help.
Anyone on discord that I can talk with about R***s? Something is not clicking with me.
Thanks
id
uid=0(root) gid=0(root) groups=0(root)
Yeah.
Cool, just rooted this box. Use part was the most difficult. In the first place i couldn’t find any thing useful on the box. After hours of searching I have find this file. Root was the most easy root ever. I certainly enjoyed this box! Need an nudge? DM me
Type your comment> @KernelPanicATD said:
Rooted! fun box, learned a ton.
Foothold: the target service can be broken in multiple ways, if one way isn’t working then try and find another. Some methods are easier than others.
User: Just beacuse you don’t have the flag doesn’t mean you didn’t own user.
root: Don’t overcomplicate this one, everything’s in front of you. No need to do anything fancy.
pm for nudges
This hint on user flag made it all completely click for me, thanks!
hey i tried to copy my S** key using set command but got error
“(error) READONLY You can’t write against a read only slave.”
so what i have to do? trying to connect again from internal R*****-C** into localhost?
good box, Easier than i thought. Was overthinking it at first, the connections kept cutting out.
initial foothold:
the *-cli is all you need, it is really easy to put something on, you’ll find it all in the forums
user:
just enumerate and something will stand out, something that shouldn’t necessarily be there. Then move laterally to the other user.
Root:
CVE
@dojoku said:
hey i tried to copy my S** key using set command but got error
“(error) READONLY You can’t write against a read only slave.”so what i have to do? trying to connect again from internal R*****-C** into localhost?
I’ve never seen that error so I am not 100% sure but it implies you are writing to something which doesn’t allow you to write to it.
Recheck the locations you are specifying and make sure you think they are valid for this box.
Type your comment> @TazWake said:
@dojoku said:
hey i tried to copy my S** key using set command but got error
“(error) READONLY You can’t write against a read only slave.”so what i have to do? trying to connect again from internal R*****-C** into localhost?
I’ve never seen that error so I am not 100% sure but it implies you are writing to something which doesn’t allow you to write to it.
Recheck the locations you are specifying and make sure you think they are valid for this box.
after reset the machine, the problem is gone.
This machine taught me some new concepts. I quite enjoyed it.
User was significantly harder for me then Root in my opinion. However I had never done this exploit method.
I will say, for those having issues…identify what is different…and then Ippsec basically outlines how to get foothold on another box. Use Ippsec.rocks…seriously.
got the root,
~~but im not sure this is the intended way. ~~
~~Because i got SUPER shell before LOW level shell. ~~
~~if anybody have another way using different path, i’m appreciate if you pm me. ~~
i think i need to learn it.
anyway thx to @TazWake @Arrow for the nudge
*My Bad, i didnt try basic priv escallation, so actually USER shell is the first step then rise to ROOT shell.
Rooted, and the root part was pretty easy and straightforward. In user part on the other hand are places, where overthinkers can waste a lot of time. As I did. Still enjoyed it a lot!