Wall

Someone could please send some hints in PM how to twinker the python script?

I need a hint for the repair of the exploit please.

Hi guys, is there someone who can tell me how I can get the credentials for C******** ?
I already used Hydra for bruteforcing, I tried bypassing, I tried the default credentials of the service.

I’m stuck here for a while.

Edit: I have found the password manually!

I hate when all of you talk about how easy the privesc is because that means I sit here and never figure it out and feel dumb.

Guys I need help please!
is that normal that when I enter the right credentials into c****** login page , it just simply shows me the access “Forbidden page”?

Hello fellow hackers!
What did everyone use to get creds for c******** ? BurpSuite takes forever, and Hydra comes back with false positives. If anyone has any resources, please pm me! Thank you!
Happy hacking!

I cracked the credentials for the c******n login page but I have no idea what to do next .
Can someone give me some hints please?

Type your comment> @c1cada said:

cracked the c**********, now python CVE not working… tested, using right ip and port , the script says it is triggering succesfully, but nothing is hitting my listener any ideas?

Same. I just keep editing, launching, checking listener to see a blinking cursor… repeat ad nauseum. Back to editing :slight_smile:

when running the exploit script unmodified under the ad*** account I get “You don’t have permission to access /c*******/main.get.*** on this server.” Same if I go in and manually try to edit the poller config. Is the correct path to modify the command in the script to bypass whatever filter they have in place that stops you from entering raw commands? Or is there another route to take to take using the A*I?

I am having trouble finding the credentials. I have tried numerous efforts by brute forcing with hydra, but it seems csrf is preventing me from doing so. Others have been able to discover the credentials without brute forcing the login and I would like to know what they are doing to find the creds manually.

Edit: I was able to brute force the creds thanks to a very useful post on the forums here.

Not sure what I’m missing here but I can’t see any c*** page. The teacher hint isn’t clicking with me either.

What is the valid form?

x.php:u…
/:u…

Check valid parameters in burp

Completely lost on bruteforcing credentials; can someone nudge? Thanks!

i got www shell
how to esclate to user sh*** and root?
help needed

Edited : i got the user but i can’t make the exploit work , lol :neutral:

WARNING!

hydra 9.0 not working with password=^PASS^

compile 9.1-dev

try restart machine

Could use a nudge for the CVE, none of my payloads seem to be catching my listener. tried various methods and encoding

I have same problem