Stratosphere

HTB Content Machines
1

No forum for this one, might as well make it.

I have done enumeration, and I found an exploit, but I can’t find the exploit name. Can someone pm me and help me?

Thanks,

Raj Baweja

2

What do you mean you found the exploit but not the name? PM me the details.

3

Any thoughts on Priv Esc? i see the thing and know i have to use it, but not sure how…

4

Never mind…

5

gaaaah been banging my head against a brick wall for a while now and need a clue :frowning: enumerated to death (usual methods). There is a really obvious exploit that jumps out at you…I have tried this a number of different ways…sploit module, python scripts, manual exploit with no luck. Is this a major red herring?

6

I am in the same position atm, tried exploit but i won’t work and cannot find another attack vector.

7

I found a username and password, which supposed to login to management Web based GUI , but it doesn’t work and I have no clue what prevents my login! Please PM me if anyone get what I mean and wanna give some clue.

8

So Ive done enumeration and all the paths that i took ended up being deadends. Can I DM someone for some pointers.

9

Don’t overlook your enumeration… Sometimes I will overlook stuff that is right in front of me.

10

Still stuck despite a squllion wordlists thrown at it and reviewing contents of every page and contents and an nmap of every port. On the plus side I know a lot more about the Stratosphere :). Can someone provide a clue? Am I wasting my time with wordlists or trying to brute force a particular login?

11

same issue, use dirbuster, try to bruteforce login use default credential but still stuck ;(

12

i too am in the same boat as many of you, have nmap full, have gobusted etc. burp suited it and msfconsoled it, seen a few potential exploits tried msf exploit tried python scripts and a nmap scripts … none of them seem to work…

I feel i am missing something, is this one of those “specific” wordlists type of thing again?

13

you need more “action” gogogo

14

HelloWorld make some Action please :wink:

15

Spoiler Removed - Arrexel

16

can i have some hint for privs esc? Spoiler Removed - Arrexel

17

Spoiler Removed

18

@Elephant7oast said:
Am I wasting my time trying to bruteforce the login? I have tried almost everything, a small nudge would be great :]

lights camera ( .ACTION )

19

Hello! wanted to ask about the tomcat credentials.
I’ve exploited the thing and got RCE, but I have no way to scale to a full shell since the tomcat creds are not working, and they are from the conf file… :confused:

Am I missing something? Thanks

20

Can someone take pity on me and tell me what the heck I’m going wrong trying to get a shell