Unattended

Type your comment> @FlameOfIgnis said:

Too bad if you dont enjoy getting output in the form of 1 character every 25 seconds.

This is painful :frowning: and I don’t even know if it’s a rabbit hole or not.

@mprox i have looked around and around, and only one listening to me was the old watchmaker.
I have named myself to get a shiny mirror, but i dont know how to use that.

I have seen someone references to the towns mailman, but i cant see him anywhere.

I have seen the past talks of the vendors, but yet they arent here.

I feel like there is a brick wall between me and the machine that i cant get over.

Also congratz on still being the only person with user!

Type your comment> @FlameOfIgnis said:

@mprox i have looked around and around, and only one listening to me was the old watchmaker.
I have named myself to get a shiny mirror, but i dont know how to use that.

I have seen someone references to the towns mailman, but i cant see him anywhere.

I have seen the past talks of the vendors, but yet they arent here.

I feel like there is a brick wall between me and the machine that i cant get over

This wouldnt make sense to anyone until you get to that brick wall and you are trying to get pass it, neither does “watchmaker” @mprox . How you guys come up with stuffs like this shocks me. Thank you, I had a small laugh and slight breather from been pissed off at this box.

@Malone5923 glad if i can put a smile on anyone’s face after being frustrated at this box.

I also tried to knock the wall down with the old mailman, but i guess that wasnt meant to be since i failed.

Also @mprox blind watchmaker was honestly so clever though, i was amazed and inspired.

congratulations @mprox

He did not even let anyone else get a user before he gets the root fb, what a champ

yea this box seems a little hard for 30 pts

Yeah, this box has waay to many steps for 30 pts, I feel. But I really liked it. Some clever techniques throughout, and very interesting presentation… but I don’t want to spoil anything right now. Good luck people, I’ll get some sleep!

Im Lolled, the thing I ignored the most turned out to be useful

I’ve had a lot of comments on “Blind Watchmaker”… some people got the hint, but many thought it was just misdirection. It was just a concealed way to talk about the slow technique that many already found.

The “blind watchmaker” has a brother… the “blind sign painter”. The watchmaker really takes his time, so he works pretty slowly. Maybe ask his brother, if you can find him

Type your comment> @mprox said:

I’ve had a lot of comments on “Blind Watchmaker”… some people got the hint, but many thought it was just misdirection. It was just a concealed way to talk about the slow technique that many already found.

The “blind watchmaker” has a brother… the “blind sign painter”. The watchmaker really takes his time, so he works pretty slowly. Maybe ask his brother, if you can find him

sorry, i don’t get the hint :slight_smile:
i’m also on NSF, i’d really like to hear your feedback.
thanks, and 'grats for the double blood

nested has a meaning :wink:

And u can get lfi with it :stuck_out_tongue:

@guly said:
sorry, i don’t get the hint :slight_smile:

Nevermind. That’s exactly the reason i’ve stopped looking at forum even when exhausted all ideas. People come here to see some constructive and useful information. Messages like rooted, nice box, learned alot or it lagz so much... just annoying, but misleading or ambiguous hints only slows down your progress, which i believe even worse than fat trolling.

Seriously, i’ve rooted this box and that “watchmacker” and “sign painter” tales make no sense to me. I don’t even get what phase it should apply to (initial, user, root)?

Anyhow, about getting user:
Pretty standard box, generic enumerations should be enought. It’s not a guessbox at all.
I assume alot of people would blindly leak everything they can, and then don’t know what to do with it. Better try to understand how exactly it’s implemented, that should give new ideas and vectors of attack.

privesc:
Pay attention to things you have access to after you pop a shell and as was already noticed

@Malone5923 said:
they got hacked recently.
keep that in mind.

Yeah

Type your comment> @lolwut said:

Seriously, i’ve rooted this box and that “watchmacker” and “sign painter” tales make no sense to me. I don’t even get what phase it should apply to (initial, user, root)?

I got the hint, havn’t had a chance to look yet, but I understand what he is trying to say. If the first method found is painfully slow, there may be another…

Yeah, sounds like @0PT1MUS got it. @lolwut it might make sense if you’re at the right step - it’s pretty difficult to be more precise without outright giving it away

I can’t get the blind watchmaker to work. Don’t know what I’m doing wrong. Can someone give me a nudge?

Anyhow, about getting user:
Pretty standard box, generic enumerations should be enought. It’s not a guessbox at all.
I assume alot of people would blindly leak everything they can, and then don’t know what to do with it. Better try to understand how exactly it’s implemented, that should give new ideas and vectors of attack.

Comments like this make me laugh. It’s totally normal in the real world for boxes to have multiple index documents, files named as hashes, etc, right? As it turns out, the useful vulnerability isn’t super weird, but in general the box is not very real world.

@deviate said:
Comments like this make me laugh. It’s totally normal in the real world for boxes to have multiple index documents, files named as hashes, etc, right? As it turns out, the useful vulnerability isn’t super weird, but in general the box is not very real world.

Missing index for web servers is not rare in the real world, especially when there’s multiple frontend-backend proxying. In case of this box i think it’s not indended but most likely has been forgotten by box creator. Doubt that this is even a matter of discuss, cause it literally takes half a second to overcome.

I agree that those kind of filenames are pure made-up, but since you don’t need to “guess” them it doesn’t make absolutely no difference. It’s not that kind of box where you dirbusting 50M+ dictionary to find rabbit hole or some esoteric language b-■■■■.