Carrier

s1gnal

User wasn't that difficult, same with initial shell. Looking for root now...

opt1kz

I just started poking at it, so I'm still enumerating and working on user. Is the serial number thing a dead end? Edit: It is not a dead end. Just had to enumerate more.

TazWake

Still no root - given how quickly people have been dropping user, the escalation must be a nightmare.

stonepresto

can confirm, is a headache. the environment is obvious and pretty cool, but personally I do not know anything when it comes to stuff like this. I think the same goes for a lot of people on HtB, hence the lack of root.

AuxSarge

@opt1kz said:
I just started poking at it, so I'm still enumerating and working on user. Is the serial number thing a dead end? Edit: It is not a dead end. Just had to enumerate more.

Thank you for this. I have been scratching my head for too many minutes.

opt1kz

@stonepresto said:
can confirm, is a headache. the environment is obvious and pretty cool, but personally I do not know anything when it comes to stuff like this. I think the same goes for a lot of people on HtB, hence the lack of root.

Pretty much this. After getting user and poking around/enumerating a bit, I have no idea where to even start. So many things to investigate and so many things that are probably rabbit holes...

MrR3boot

@opt1kz said:
I just started poking at it, so I'm still enumerating and working on user. Is the serial number thing a dead end? Edit: It is not a dead end. Just had to enumerate more.

Stuck at this point.

Edit: Got it

s1gnal

Remember that snowscan is a troll, many dead ends after user.txt

Cobaas

@opt1kz said:
I just started poking at it, so I'm still enumerating and working on user. Is the serial number thing a dead end? Edit: It is not a dead end. Just had to enumerate more.

still at this point

EDIT: Got it

taytay

struggling to even get user. any help would be appreciated thanks

0xlc

@taytay said:
struggling to even get user. any help would be appreciated thanks

did you find the doc? it seems we need to get default user/pwd from the chasiss but enumerating with common tools and wordlists didn't work out for me

taytay

@0xlc said:

@taytay said:
struggling to even get user. any help would be appreciated thanks

did you find the doc? it seems we need to get default user/pwd from the chasiss but enumerating with common tools and wordlists didn't work out for me

I have found a few documents yes, still not able to find any chassis that it refers to. i'll pm you.

ryz0rg

@taytay said:

@0xlc said:

@taytay said:
struggling to even get user. any help would be appreciated thanks

did you find the doc? it seems we need to get default user/pwd from the chasiss but enumerating with common tools and wordlists didn't work out for me

I have found a few documents yes, still not able to find any chassis that it refers to. i'll pm you.

same boat

taytay

@ryz0rg said:

@taytay said:

@0xlc said:

@taytay said:
struggling to even get user. any help would be appreciated thanks

did you find the doc? it seems we need to get default user/pwd from the chasiss but enumerating with common tools and wordlists didn't work out for me

I have found a few documents yes, still not able to find any chassis that it refers to. i'll pm you.

same boat

join the club lol

beginner2010

Documents is the key for getting user. Back to basics. Start from port scan again but not only tcp.

0xlc

@beginner2010 said:
Documents is the key for getting user. Back to basics. Start from port scan again but not only tcp.

ye just found it thanks

Cobaas

For anyone stuck on the initial foothold - remember that TCP isn't the only way to transmit data

For anyone stuck on the Priv Esc - i'm in the same boat as you....

jreeves

I have no idea where to go after getting access to the admin console

0xlc

i got rce but no shell yet, i can just ping myself from the box haha

ryz0rg

Got user. Time for some root.

sabonawa

getting user is not difficult.
still no clue about privesc!

Kykli

Anyone else have/had trouble to get s******k working? Gives "Timeout: No response", command syntax should be correct.

TheScaryDoor

@jreeves said:
I have no idea where to go after getting access to the admin console

Same. Frustrating. People are saying it is easy though. Think brain, think!

alacerda

Weird. Because I am already root but i just can find user flag. PS.: I didnt privesc I am already root

Underworld

I like these themed/realistic challenges. Yey

s1gnal

@alacerda said:
Weird. Because I am already root but i just can find user flag. PS.: I didnt privesc I am already root

Probably because there are multiple challenges after that shell ?

Seepckoa

I have RCE

fjv

Privesc was a pain in the ass. Here's a hint: on the web page pay attention at what you read even if it looks funny or silly at the first sight, maybe because it could be something useful later on

Vex20k

I seem to be stuck on this already.. I only have the following.

• Found the docs
• Found 2 other ports

sakyb

*Spoiler Removed - Arrexel*

jreeves

@sakyb said:
Anyone one help me in user..
I found doc folder and also got 161.. what to do after???

enumerate port 161 Spoiler Removed - Arrexel