›

Ghoul

MinatoTWMinatoTW
in Machines
Eat or be eaten ☠️

Hack The Box

Don't let the box pwn you!!

Tagged:
«13456789

Comments

  • xdaem00nxdaem00n

    its time to become a ghoul

    death

  • rlfonsecarlfonseca

    i can smell the blood

  • 0x42420x4242

    "Respect to whom respect is due."
    Twitter: https://twitter.com/0x4242 | Web: http://0x4242.net
  • n1z4mn1z4m
    edited May 7

    nice box

    N1Z4M B1N MUH4MM3D

    hu hu hu
    Security researcher From God's own country

  • MinatoTWMinatoTW
    edited May 4

    waddup? 1000 -7 ?

    Hack The Box

    Don't let the box pwn you!!

  • farbsfarbs

    Think I found the source of the RCE... But how do I change the "type" to access it... That is the question :)


    Hack The Box
    defarbs.com - "Let me just quote the late, great Colonel Sanders, who said, 'I'm too drunk... to taste this chicken.'”

  • EmmaSammsEmmaSamms

    Type your comment> @Farbs said:

    Think I found the source of the RCE... But how do I change the "type" to access it... That is the question :)

    ive done that, it does nothing as far as i know

  • Ranger11dangerRanger11danger

    Type your comment> @EmmaSamms said:

    Type your comment> @Farbs said:

    Think I found the source of the RCE... But how do I change the "type" to access it... That is the question :)

    ive done that, it does nothing as far as i know

    are you talking about bypassing the upload restrictions?

  • DrragonnDrragonn

    Do we have to bruteforce to get credentials?

  • EmmaSammsEmmaSamms

    Type your comment> @Collins19008 said:

    Type your comment> @EmmaSamms said:

    Type your comment> @Farbs said:

    Think I found the source of the RCE... But how do I change the "type" to access it... That is the question :)

    ive done that, it does nothing as far as i know

    are you talking about bypassing the upload restrictions?

    yes

  • lyaklyak

    Any hint on where the uploads go? I'm able to bypass the restrictions - or at least it says so

  • farbsfarbs

    I've managed to "bypass" the restrictions, but trying to find out where the files "go" after that... I think I'm uploading what I have to in order to get a shell, but not sure where to access it once it "disappears"...


    Hack The Box
    defarbs.com - "Let me just quote the late, great Colonel Sanders, who said, 'I'm too drunk... to taste this chicken.'”

  • dev17dev17
    edited May 4

    Found it..:D

  • farbsfarbs

    I also found the s*****.php file, but not exactly sure what I'm supposed to be getting out of it.


    Hack The Box
    defarbs.com - "Let me just quote the late, great Colonel Sanders, who said, 'I'm too drunk... to taste this chicken.'”

  • dividebyzer0dividebyzer0
    edited May 4

    @dev17 https://imgur.com/a/RBbTwKy

    dividebyzer0

  • Ranger11dangerRanger11danger

    am i going to have to have some knowledge on this show ie character names in order to get creds?

  • TiliaTilia

    I hope this is not going to require to watch the anime in order to guess the credentials.

  • Ranger11dangerRanger11danger

    Type your comment> @ambi said:

    I hope this is not going to require to watch the anime in order to guess the credentials.

    haha thats what i was worried about...

  • TiliaTilia

    Type your comment> @Collins19008 said:

    Type your comment> @ambi said:

    I hope this is not going to require to watch the anime in order to guess the credentials.

    haha thats what i was worried about...

    I curious... but this all seems like that. The box's author's left a movie about that anime like it's supposed to provide us some imagination about how to guess credentials, so... I don't know honestly. The machine is very focused on the movie.

  • Ranger11dangerRanger11danger

    i also found s*****.php, not sure what its getting at...

  • MinatoTWMinatoTW

    No need to watch anything for the box :p

    Hack The Box

    Don't let the box pwn you!!

  • wabafetwabafet

    Type your comment> @MinatoTW said:

    No need to watch anything for the box :p

    where are my file uploads landing is that a rabbit hole for the secret art site

  • morph3morph3
    edited May 5

    Another +12 hour box ?

    morph3

  • 0x42420x4242

    I don't know what I'm overlooking but where is this upload thing? Can't find anything...

    "Respect to whom respect is due."
    Twitter: https://twitter.com/0x4242 | Web: http://0x4242.net
  • MisterBert0niMisterBert0ni
    edited May 5

    Hoping it is not related to anime...

    HTB | Root-Me | PentestIT | OSCP | Social

    image

  • xSilv4rxSilv4r
    edited May 5

    bruteforcing needed for **in.*** ?

    EDIT: nevermind

  • xSilv4rxSilv4r

    Type your comment> @dev17 said:

    Found it..:D

    any hint on the uploads path pls

  • CiccioPasCiccioPas

    Look which files u can upload in that form

  • MinatoTWMinatoTW
    Please ignore anything found in /var/tmp . Thanks!

    Hack The Box

    Don't let the box pwn you!!

  • chivatochivato

    Type your comment> @MinatoTW said:

    Please ignore anything found in /var/tmp . Thanks!

    LOOOOOOOOOOOOOOOOOL cough cough

    OSCP | TMHC CTF

Sign In to comment.