Obscurity

is burp needed after finding a py file?

Yesterday 3 hours ı couldn’t not catch the root flag but I got it in half an hour today.
I have to learn to look right…

Type your comment> @sau123 said:

is burp needed after finding a py file?

Nope! I’d recommend you to use a fuzzing tool like ffuf GitHub - ffuf/ffuf: Fast web fuzzer written in Go

If you know python and a bit of linux its not too hard. Aside from that pretty cool box.
Ps: Feel free to PM me if you’re stuck.

Really enjoyed this box… tests your code auditing/understanding and was able to flex some dev muscles. Root complete! PM for nuggets.

O M G
I’ve been running on this thing for 3 days and finally rooted.
The hardest part for me was the user and I ended up writing my own code for reversing (read here somewhere that this is not necessary but I’m not sure how).
For root - I wrote some more bad to “steal” the output before it’s gone, and then I used Mr. J to help. Really hope this was the intended way.

Tips:
Foothold - pay close attention to the notes left on the landing page. I didn’t use dirb or anything of that sort… it’s pretty straight forward.

User - well, I’ll repeat someone above with a bit more context: you have f(x)*k = t you have t and f(x). Now you have to reverse the math…

Root - You can do stuff when someone else’s code is asleep

Also, regarding foothold and this box - it very much lives up to its name!!!
All this obscurity led me to chasing ghosts of LFI for hours. Took all that time to figure out is impossible with most file extensions.

Another thingy - did anyone get a shell before the user? is that even possible? I tried for hours and gave up.

guys, im stuck at the beginning, I appreciate your help… how to enumerate this box? I tried gobuster, dirbuster and ffuf… couldn’t lead to anything …

Rooted! This box got me to hacker rank :smiley:
While I really spend a loooong time on getting the inital foothold right (and, as I must confess, got annoyed by it more than once :sweat_smile: ), I thoroughly enjoyed the user part! Thanks to the creator @clubby789 and shoutout to @abhizer , @anak1n and especially @burntnoodle for helping me sort out my semicolons, double and single quotes :wink:

Can somebody tell me what version of python (2 or 3) is used on the “0bscura” server ?

I started this box last night and it was driving me crazy, I knew what to look for (you should already know it by going through this thread and the website), but I couldn’t find it, tried Dirbuster with all the wordlists with no success until it clicked. So, here is what I recommend:

Initial foothold: use Dirbuster URL fuzz instead of Standard start point.

just rooted! my privesc was not the fanciest tho, I’d love to hear how others approached it :smile:

root@obscure:~# id
uid=0(root) gid=0(root) groups=0(root)
root@obscure:~# 

Hello,
I’m new to python and need some help… I got the server code and want to test against it executing it in my box. I need some help to trace how the code gets executed. I try to run it from command line and it returns with no error nor answer, and does not stand as a server (executing in the background and listening on a tcp port) and no output!
Seems like if the code just defines the classes but there is not a “main” function which launches and stays running! Someone to help creating this “main” function?

@101pipers you can do it that way or you can make it easier on yourself and launch interactive python as all you need to test locally are 3 lines of code already within the script.

Thanks @clubby789 :slight_smile: I enjoyed the machine very much ^^

Hello, I’m having some problems with the SSS.py file.
I actually understood that the vuln is in that ex** function however I’m not able to exploit it.

Someone can give me a nudge?

Just rooted.

It’s indeed a great box to test your problem-solving skills.

Initial foothold is as basic as typical enumerations, but getting to user and root is the whole point of this box.

Feel free to PM me if you require any help on user and root.
Happy to help :slight_smile:
Hack The Box

I started local server with SSS.py, but I do not get any response. I use urllib when sending payload and all I get is
requests.exceptions.ConnectionError: (‘Connection aborted.’, BadStatusLine(‘No status line received - the server has closed the connection’,))
even for simple request of index.html
I know that server script runs, because I can print what happens during request handling, I just do not get any response. I think I copied folder structure correctly, so at least I should get 400 or 404 page. Anyone care to nudge me in right direction?

Nevermind, problem was with my Python version and urllib.parse.unqoute.

Rooted. First time for me doing any RCE and foothold was absolutely brutal. Thanks @Zaitchev for all the help, or I wouldn’t have figured it out. User was easier and root came pretty quickly. I need to work on my python and study up in SQL injection.

Can’t figure out how to reverse the crypt process. I have the pieces running through my head but don’t know how to modify/trick the script into giving me what I need.

Any nudge is greatly appreciated.