Haystack

Is there any exploit to become k****a user…i found one exploit which is RCE which is not working…

Those who are stuck at going banana, you need to look at a certain config file and see why the *F* exploit you are using is not working (it can only be ran from a certain place, you already have the tool on the machine to do it) :wink:

i have k***a. but i have problem to edit/make .c
any hint???

curl: (52) Empty reply from server

why??? does not work and others do not. for LFI

If anyone needs a nudge with user feel free to send a pm :smile:

Can some kind soul nudge me in the right direction on root? I can see the ki***a but cant figure out how to pivot to that user. Dunno could be blind. Anyway any hints would be greatly appreciated.

I think I’m really close to root… Can someone PM me to discuss?
Edit: Nevermind, I got it! Feel free to PM me for help!

Hi, think found what need for root. Found soemthing that looks like it link were i can write now, Can someone OM me to discuss

Someone up for discussing the final part to root? I’ve tried so many things, it got triggered, but even simple tests aren’t executed.

nice steganography

can anyone PM on haystack root hint?

hi I get an error in the apis parameter. can someone please tell me , am i on the right way?

Would appreciate a hint on the syntax for the final step to root :smile:

Edit:

Got Rooooooot :wink:

Rooted with a helpful nudge from @v0yager who saved me from my grokking nightmare.

For people stuck on changing user (paramater errors):

  • Google K***** config file and read the documentation. You can find the file easily and should then understand why it’s not working from where you are trying it.
  • When you curl from the right place make sure you wrap the url in ' (as posted above). This will stop the apis paramater error.

I’m slow on replying to PMs currently but happy to help.

Hi, can someone help on the privesc part for root. I actually need someone to verify something for me if possible. Of course, a nudge would also be appreciated

@Meeryr thanks for your help

Is there supposed to be an actual image file on the homepage? For me, there is nothing displayed at all. When I go to the source code and follow the link, then download the image, it’s just an empty .jpg with 0 bytes. Is that supposed to be the case or is a reset in order?

Type your comment> @TimW94 said:

Is there supposed to be an actual image file on the homepage? For me, there is nothing displayed at all. When I go to the source code and follow the link, then download the image, it’s just an empty .jpg with 0 bytes. Is that supposed to be the case or is a reset in order?

there should be an image. although it is not needed for the box.

it does give a great HINT

Need some help with user priv upgrade to K.

when i speak to K i keep getting “empty reply from server”

to my knowledge i am doing everything correctly and have also spoken to some people in this forum and cannot find the problem.

if anyone has any ideas please PM me.

Finally rooted this one as well. I have really mixed feelings about this box. I’m a new user here (and this is the 4th user and 3rd root I got, sooooo yeah, pretty noob). But on the previous boxes I felt that “this could have been a real box that somebody just misconfigured/not updated/etc…” , not this one. I was stuck on the final step to root because who in their righ mind would put anything like that in the l******* config??

Hello there,
How do I dump the data from ElasticSearch DB?
I am stuck as I’ve tried installing “Kibana” as I’ve seen in some videos its used as an API to interact with ElasticSearch I guess.
I tried searching “10.10.10.115:9200/_search” and it provided me with a bunch of information. What do I need to do now?
Any help is appreciated.
Thank You!