asdfsd
root question: used kp2jon to extract the hash, didnt care about the pictures.
I didnt think that I need to use Steghide etc. to do the Stenography at first, however, after I used the rockyou dict to try the GPU exhausting task, it failed.
what am I missing? thanks a lot!
Type your comment> @garnettk said:
root question: used kp2jon to extract the hash, didnt care about the pictures.
I didnt think that I need to use Steghide etc. to do the Stenography at first, however, after I used the rockyou dict to try the GPU exhausting task, it failed.what am I missing? thanks a lot!
The pictures
can anyone help me with master password for kee**** . i tried bruteforcing for hours but i didnāt get anything. please help me
For how long we should try to crack the hash of KP !! Running for ages with no luck, any suggestion.
Iām thinking of try to elevate to root using different approach if possible.
Type your comment> @azeroth said:
can anyone help me with master password for kee**** . i tried bruteforcing for hours but i didnāt get anything. please help me
When you extract the hash donāt forget the 6 files you have to add them, then the master key will be obtained quickly.
Type your comment> @Z0d said:
For how long we should try to crack the hash of KP !! Running for ages with no luck, any suggestion.
Iām thinking of try to elevate to root using different approach if possible.
Got it!
If anyone has any hints on how to get to root, feel free to message me. I have all of the files. I have run j and H****** on the password file as well as steg bf to try and get the info out of the other files and canāt seem to get anywhere.
Guys any nudges on Binary exploitation of Safe- User? n00b BOF skills
Anyone willing to look over what I have been doing for BOF to give a hint where I might be going wrong for getting user.txt, been trying to get it to work for 6+ hours nowā¦
How do you guys download the .k**x file from the system?
Type your comment> @FailWhale said:
How do you guys download the .k**x file from the system?
There is more than one way to connect to (and copy from) a machine. If you donāt know the password, but can write to the userās directory, itās usually quite possible to authorize your access another way.
Spoiler Removed
It seems the address for the string Iād like to use for sm call to get a shell keeps changing (inside of lbc). Any tips on how to access that string during runtime? I can access the upe and execute it fine, since that addr doesnāt change, just the strings in l*bc keep moving around.
@Z0d said:
Type your comment> @azeroth said:can anyone help me with master password for kee**** . i tried bruteforcing for hours but i didnāt get anything. please help me
When you extract the hash donāt forget the 6 files you have to add them, then the master key will be obtained quickly.
I only included one of the picture as the key file, is it the correct way?
Type your comment> @garnettk said:
@Z0d said:
Type your comment> @azeroth said:can anyone help me with master password for kee**** . i tried bruteforcing for hours but i didnāt get anything. please help me
When you extract the hash donāt forget the 6 files you have to add them, then the master key will be obtained quickly.
I only included one of the picture as the key file, is it the correct way?
Each picture when extract with KP gave you a different hash.
Type your comment> @3lg470 said:
It seems the address for the string Iād like to use for sm call to get a shell keeps changing (inside of lbc). Any tips on how to access that string during runtime? I can access the upe and execute it fine, since that addr doesnāt change, just the strings in l*bc keep moving around.
Donāt try to guess the position of a string in a library the version of which you canāt even know (and hence also not where you find the string in it).
Type your comment> @BT1483 said:
Type your comment> @3lg470 said:
It seems the address for the string Iād like to use for sm call to get a shell keeps changing (inside of lbc). Any tips on how to access that string during runtime? I can access the upe and execute it fine, since that addr doesnāt change, just the strings in l*bc keep moving around.
Donāt try to guess the position of a string in a library the version of which you canāt even know (and hence also not where you find the string in it).
That actually makes a lot of sense, now that you say it, LOL. I did give up on that path. I was able to get what I need into another place (R9) but now trying to figure out how to get that into the s****m call. Of course, I also can put it all over the stack, but not sure how to get a pointer to one of those spots into RDI.
Is that more on the right track?