Type your comment> @LoRKa said:
i want mangos Amigo, but after enumerate by hours and getting lost in rabbit holes, i think i need a hint.
did you find anything im just like you
Type your comment> @LoRKa said:
i want mangos Amigo, but after enumerate by hours and getting lost in rabbit holes, i think i need a hint.
did you find anything im just like you
Initial foothold is really annoying…
Type your comment> @skullkiddo said:
Initial foothold is really annoying…
LOL yeah
Removed spoiler-ish stuff + nvm @naveen1729, apparently I don’t know how that command works lol, way too tired, thanks
Spoiler Removed
– edit: removing question, might as well replace with some hints
user: enum everything and once you’re stuck look for apps/backends that could run on the box that match so well with the box’s name. Then use one of the things you found during enum to interact with it (you don’t need to actually know the stuff’s syntax, just google) and enumerate users and their passwords.
It’s pretty infeasible to do without writing a script on your own. It gets irritating even like so. The web server seems to be very picky about the requests it accepts, you need to mimic a captured request very closely, all headers and all…
root: pretty generic, enum, exploit with a single command
stuck on login page, can’t order mango. gobuster not finding much on all domains/ports
Type your comment> @zkvo said:
stuck on login page, can’t order mango. gobuster not finding much on all domains/ports
im also stuck, dont tell me it’s another guess-the-pass machine
Type your comment> @peek said:
Type your comment> @zkvo said:
stuck on login page, can’t order mango. gobuster not finding much on all domains/ports
im also stuck, dont tell me it’s another guess-the-pass machine
it’s guess-the-backend machine but at least it’s kinda easy-ish. After that there’s no guessing involved
Rooted. Fun box!
User:
Once you find the login page, consider the name of the box. This will allow you to get some creds. You will likely need to write your own script. You don’t need to guess.
Root:
gtfobins
.
Rooted! Fun box! Big thanks to @rowra for helping me work round my very poor internet connection.
User: The box name is helpful in two ways. Consider your normal route, and change something. There’s some rabbitholes.
Root: Not hard, basic enumeration and gtfobins
Spoiler Removed
Spoiler Removed
Spoiler Removed
Enum
now stuck…
Spoiler Removed
Just realize “DAD” is NOT “DOD”, DOD means “Department of Defense”
I’m at the point where I’ll need some time to write the extraction script, but no guessing was involved so far, just had to enumerate carefully.
edit: got user so far awesome box, now onto root…
They just started farming, what do we suppose to do? start planting? I can see only two information can be extracted as of now.