Remote

HTB Content Machines
21

Type your comment> @VbScrub said:

can anyone confirm if the N** file sharing port is meant to be open or not (port number starts with 20) ?

When I did my initial port scan it was open, but since then doing further port scans it is not showing up and attempting to interact with it gives nothing but time outs. Wondering if this only showed in the initial scan due to something someone else was doing on the machine or if its actually meant to be there but is down for some reason at the moment…

I’m almost positive it’s meant to be open

22

Which file am I supposed to find in this many files? Can someone please give me a little hint?

23

Rooted. Easy, but fun box. Lose a lot of time finding the right payload in the first step… Been stupid. After, Root is 10 minutes formality… on VIP box :wink: PM for Nudge

24

@kimleepark said:
Which file am I supposed to find in this many files? Can someone please give me a little hint?

Think about what you’re looking for - credentials. Do some googling about what file contains those for this CMS

25

Type your comment> @kimleepark said:

Which file am I supposed to find in this many files? Can someone please give me a little hint?

use find and point attention to the files it returns. one of them is very specific

26

Thanks all. I got the user.

27

That Exploit PoC is a bit hard to understand.

28

Really cool box, enjoyed both parts, the initial foothold and the priv esc

For user:

  • It is similar in a certain way to other two services that are running in the machine
  • Which version is running?

For root:

  • Search for a list of windows privilege scalation, try everything or try smart, anyway, both will give you what you want
29

not so sure whats going on while i get access via burp the minute i translate that to code it hangs the minute itry to reauth using browser it never reconnects for like 10 -20 minutes

if i copy the valid command to curl from burp it takes 11-17 seconds than will work in browser but yet i can never hit stage3 url of the poc even after heavily modifying it can anyone give me some insight what im doing wrong after logging in via burp i get a dict of info via successful username and pass but that’s as far as i can get the other dir is a redirect and never seems to get me anywhere /***tall dir is redirect am i lost?

30

I cannot find any kind of creds… I tried many files and googling. But google suggest database which i don’t have access to. This machine is driving me insane! Its suppose to be easy and I can’t even go one step further… Any help would be appreciated…

31

Spoiler Removed

32

Spoiler Removed

33

heyy…can someone please give me a initial foot hold… i have done the nmapand dirbuster

34

im struggling to see anything with the files

35

can anyone help me with opening that s*f file ?

36

Type your comment> @deathflash1411 said:

can anyone help me with opening that s*f file ?
anything will do

37

So I’ve managed to get code execution and can transfer files but nothing more. Not sure where I’m going wrong here. Would anyone be willing to pm a nudge?

38

Type your comment> @deathflash1411 said:

can anyone help me with opening that s*f file ?

strings

39

got a password “r3*********n” but dont know how to use it. :frowning:

40

Type your comment> @calamaris said:

This m***t **s is so luggy, my terminals stuck

Yeah even an ls command is taking ages!