Obscurity

Well done @clubby789 thank you a lot, I have enjoyed your box … keep good work.

Rooted.

manage to get user the old fashioned way…never managed to solve the crypto…I would really appreciate if someone could send me a PM to explain to me on how to solve it the crypto

I am in the last step for root

I asked my friend john and he gave me what i wanted. But when i use that, i am not getting into the place where i want to go.

Am i doing anything wrong?

Edit:
Nvm, figured it out. :smiley: :smiley:

Rooted, PM me if y’all need a nudge or two

Type your comment> @Krocko said:

manage to get user the old fashioned way…never managed to solve the crypto…I would really appreciate if someone could send me a PM to explain to me on how to solve it the crypto

Can you share de answer whit me too plz ?

Looking for a nudge on RCE. Can someone PM and I’ll tell you how far I’ve gotten?

tried dirb, gobuster, dirbuster nothing seems to work, any hint?

Really fun and easy box if you love coding.
You can PM me if y’all need a nudge

Working on reversing the encryption.

wow, first box where I got root shell before I got the user flag. Might not be the intended way (skipped crypto) but oh well, rooted.

is burp needed after finding a py file?

Yesterday 3 hours ı couldn’t not catch the root flag but I got it in half an hour today.
I have to learn to look right…

Type your comment> @sau123 said:

is burp needed after finding a py file?

Nope! I’d recommend you to use a fuzzing tool like ffuf GitHub - ffuf/ffuf: Fast web fuzzer written in Go

If you know python and a bit of linux its not too hard. Aside from that pretty cool box.
Ps: Feel free to PM me if you’re stuck.

Really enjoyed this box… tests your code auditing/understanding and was able to flex some dev muscles. Root complete! PM for nuggets.

O M G
I’ve been running on this thing for 3 days and finally rooted.
The hardest part for me was the user and I ended up writing my own code for reversing (read here somewhere that this is not necessary but I’m not sure how).
For root - I wrote some more bad to “steal” the output before it’s gone, and then I used Mr. J to help. Really hope this was the intended way.

Tips:
Foothold - pay close attention to the notes left on the landing page. I didn’t use dirb or anything of that sort… it’s pretty straight forward.

User - well, I’ll repeat someone above with a bit more context: you have f(x)*k = t you have t and f(x). Now you have to reverse the math…

Root - You can do stuff when someone else’s code is asleep

Also, regarding foothold and this box - it very much lives up to its name!!!
All this obscurity led me to chasing ghosts of LFI for hours. Took all that time to figure out is impossible with most file extensions.

Another thingy - did anyone get a shell before the user? is that even possible? I tried for hours and gave up.

guys, im stuck at the beginning, I appreciate your help… how to enumerate this box? I tried gobuster, dirbuster and ffuf… couldn’t lead to anything …

Rooted! This box got me to hacker rank :smiley:
While I really spend a loooong time on getting the inital foothold right (and, as I must confess, got annoyed by it more than once :sweat_smile: ), I thoroughly enjoyed the user part! Thanks to the creator @clubby789 and shoutout to @abhizer , @anak1n and especially @burntnoodle for helping me sort out my semicolons, double and single quotes :wink: