All I seem to be able to succeed at is getting into the magento admin interface… any hints on what exploit gets me shell?
Can anyone give me a heads up on PrivEsc?
Type your comment> @bipolarmorgan said:
All I seem to be able to succeed at is getting into the magento admin interface… any hints on what exploit gets me shell?
I have the same problem. But I’ve read most of the way through this entire thread, and apparently, there are two ways. One sounds like a certain kind of amphibian, and the other way is easier–there is apparently an exploit available. I personally don’t know where to find it, though.
can someone give me any hints on how to start with this one? i am fairly new . do i nee to like figure out the site itself and the hidden contents?
Having trouble accessing admin panel… do you use openssh exploit on the admin panel with metasploit (If so getting false positives). sorry noob here
managed to get past the admin panel after a google search . can’t seem to understand where to get access to user
hey guys, i get the adimn panel, but the exploit that i am using isn’t working, its the same one of some other peoples, can some one pm me, needing help, have another way?
Great box, although the resets make it a bit harder than it really is. Stuck at user for ages, got root in no time. Shout-out @ch4p for creating it. PM for hints, I will respond ASAP.
can somebody give me any hints for root in PM?
Wits end trying to pop this box, popped admin however nothing that i throw at it works. What am I doing wrong?
got user. anyone needing a nudge on getting user pm me. Having trouble working out how to get root, please pm with a nudge, i have run LE*.sh but not sure what to do next.
Edit: NVM just got root, learnt so much with this box, what a rush when you finally get it
Hi all. Help me please.
I created my user, logged in under him. I created my shell.php page in CMS, but the php code does not work, but only opens and displays as text. What do you need to create under your account?
Please tell me how to upload a jpeg / gif file?
Very crowded and laggy box, urgh! I got the user, but the root needs more time to research, which is NOT F***ING POSSIBLE when some shortsighted guys keep resetting it every 3 minutes and you need 2.999 to get the shell! Very frustrating!
Hey y’alls!!! So many post so I can’t find exactly what I am looking for so, making a new post on the same thread to avoid new Swagshop thread post…
I’ve been doing this for days to no end of the rabbit tunnel seeing the light.
I initially did the searchsploit methyod to get python and download the python file, then modify it in my case… now after I got to modifying the xml file to upload… then perform reverse shell… the site no longer works when I captured the username/passwd… I was able to access the admin account but after a few hours later, it kept saying the username/passwd is not valid… looks like the box is either broken or someone changed it. Since I was stuck… I tried another method such as gobuster, below…
I am having a brainfart moment and am stuck after using gobuster v3.0.1 with new commands… . after I executed the gobuster. I have the txt files… being a noob, I tried researching; unfortunately found nothing to help me next step…
Any hints, ideas that I can get the necessary data to help me get privesc? After I get that, I can dig up the user/txt and root.txt flags, otherwise, I’m trapped in the dark… 
@Ir0nGe3ks It doesn’t sound like you’re on the right track. Why are you relying on capturing passwords?
Type your comment> @borari said:
@Ir0nGe3ks It doesn’t sound like you’re on the right track. Why are you relying on capturing passwords?
I access the admin profile account… and thought of going into the magento manager but nothing to see here… When I ran Gobuster… everything worked from there… not sure what else to look at… def not on the right path…
Hey so I got access to the magento admin page. But when I am going to “m****** *****t n” for uploading it is redirecting me to /ner , But there is no page/dir like it and that is why it’s showing me 404 , is this expected?
Sorry for my bad english,
Type your comment> @pwsecspirit said:
Hey so I got access to the magento admin page. But when I am going to “m****** *****t n” for uploading it is redirecting me to /ner , But there is no page/dir like it and that is why it’s showing me 404 , is this expected?
Sorry for my bad english,
I read from another post saying that it has been removed because of instability issues for years…
Type your comment> @Ir0nGe3ks said:
Type your comment> @pwsecspirit said:
Hey so I got access to the magento admin page. But when I am going to “m****** *****t n” for uploading it is redirecting me to /ner , But there is no page/dir like it and that is why it’s showing me 404 , is this expected?
Sorry for my bad english,
I read from another post saying that it has been removed because of instability issues for years…
So there is other method for uploading my file?