@x00byte said:
This machine should worth more than 20 points it got me nuts but finally rooted thanks to @N30C0UNT and @zdravich for answering my doubts!!
Anytime. Help was the only way I got through this one.
Got root. I had some gaps in knowledge so it took quite a while. The whole box is very CTF like and not anything that would happen on a real-life setup.
My tips:
For user:
I found out that it is good to use multiple dirbusting apps, I used gobuster at the start and it did not find what I needed. Quite a bit of research is needed to get to the point where you can grab the user flag. This thread contains sufficient information to start with, google is your friend as always.
For root:
Read the links in the thread and it’s a good idea to do the exercises in those links. For the actual exploit you need to find the thing that does not change and from there you can move up. I strongly advise setting up a local development box with the same OS.
I can see now why the box is only 20 points if you know your overflows it will be relatively simple. If anything I mentioned is a spoiler please remove!
I think the “Difficulty” column relates to the level of difficulty a little more But I get what you’re saying
I agree with both of you.
I think a lot of people new to HTB will try to start with this box because “its only 20 points, how hard can it be” and it is marked 5/10 (I thought it started out lower than that) with a lot of “easy” votes.
However, judging by the comments on this thread, questions I’ve been asked and the fact it took me nearly two days to get the first bit of code translation, I wouldn’t recommend this to new people. It isn’t a bad box, but there is a lot of it which is far from intuitive and not exactly what you’d expect from trying to own a box.
I think the “Difficulty” column relates to the level of difficulty a little more But I get what you’re saying
I agree with both of you.
I think a lot of people new to HTB will try to start with this box because “its only 20 points, how hard can it be” and it is marked 5/10 (I thought it started out lower than that) with a lot of “easy” votes.
However, judging by the comments on this thread, questions I’ve been asked and the fact it took me nearly two days to get the first bit of code translation, I wouldn’t recommend this to new people. It isn’t a bad box, but there is a lot of it which is far from intuitive and not exactly what you’d expect from trying to own a box.
Yeah I agree, I would definitely send them to something like Jerry over this box to start out with