Netmon

The passwords are definitely getting changed. I couldn’t get in with the correct creds the first time I tried, and while I was poking around, it kicked me out and wouldn’t let me back in till I reverted. I don’t think people are intentionally doing it, I am guessing that the “password reset” is rendering the correct one useless once it is clicked.

and I am on VIP

about creds, read some reddit page.

I slapped myself in my face with a big C++ book…
For creds: ENUMERATE. ENUMERATE MORE. ENUMERATE

then it’s straight forward to gain access and priv esc :slight_smile:

Getting creds is very easy if you are focusing on right think, simple grep should get you the password

Maybe i’m overlooking something, finding the user.txt was easy but im unable to login to the web page. I cannot find the credentials, looked online and the credentials i found there don’t work.

I already know what I have to do when i’m logged on… Any tips on finding the creds?

Getting stuck after first user. I tried different methods over different ports but nothing…
Any hint? No bruteforce.
Thanks anyway

Rooted
but i face lots of problem in rooting every minute people reset the machine and changing the password
guys please stop resetting the box .

Very nice box. You really do need to think like a user to get in.
Getting the root flag can be fairly easy if you research the features of the system. No need to exploit any Windows features. Basically read the docs.

I’ve got the User, I’ve no idea what creds people are guessing for the web login though and I’ve spent a couple of hours exploring via FTP but failed to find any creds written down anywhere, even with the more thorough approach to listing contents. Can somebody PM me a nudge please? Thank you!

Do not change the password
Do not use Brute Force
Do not restart the box

The stability of the box is brainfuck xD

@19Rich said:

I’ve got the User, I’ve no idea what creds people are guessing for the web login though and I’ve spent a couple of hours exploring via FTP but failed to find any creds written down anywhere, even with the more thorough approach to listing contents. Can somebody PM me a nudge please? Thank you!

Cheers for the hints - I had the right details, just needed to kick the box to get them working :frowning: I know what I’ve got to do for the next step, give me a week and I might actually work out how to do it too! :-/

Type your comment> @19Rich said:

@19Rich said:

I’ve got the User, I’ve no idea what creds people are guessing for the web login though and I’ve spent a couple of hours exploring via FTP but failed to find any creds written down anywhere, even with the more thorough approach to listing contents. Can somebody PM me a nudge please? Thank you!

Cheers for the hints - I had the right details, just needed to kick the box to get them working :frowning: I know what I’ve got to do for the next step, give me a week and I might actually work out how to do it too! :-/

Similar sitiation as @19Rich. I have explored all conf file, unsucessfulls web login to get root access.

Can somebody could give me some hint by PM ?

Best regards

User is very simple and direct.

Please stop changing the default password… mkay thx

I just have to post something. OK. I kinda get why PPL are resetting PWD or reverting box. Can I just say think about it before you revert, yes if you did the most obvious way to get flag it’s probably the best/only option. but for all those resetting the password you are idiots, yes I mean that! read the htb rules for machine submission, if this was something needed to get root then box wouldn’t be alllowed!!

I asked for help a few times on this box, didn’t need it. It was all down to PPL resetting PWD or reverting box. so to help (as I like to): initial foothold is mega simple (no help there), that’ll get you user flag. next step keep enumerating, what application did you find, what version is it, are there any known vulnerabilities??? (yes there are!!). read the stuff you find about exploits, could there be anything you can do different to what you see online? another option maybe? play around.
Finally: DO NOT RESET PWD. if you see an error, what other things can you try?
DO NOT REVERT/RESET BOX unless you have to!!!

OK maybe I feel a little bad after those posts: Where else would you expect a NOOB to start other than a 20 point box! but you would also hope that those NOOBS would look at forum like I do when I am stuck, so if you are such a NOOB or a complete idiot experienced person changing PWD (lol) please read the comments!!

Very nice and easy box. Good one to start with if you are new! :slight_smile:

well…

To prevent the confusion I gained by reading the comments. No one is changing the password as suggested. :slight_smile: