Official SneakyMailer Discussion

Yesterday I completed this machine. My feelings about this one is a bit mixed. Altogether the machine is above medium or medium based machines are getting harder then earlier, because of the complexity. The first path of the user was quickly solvable and I like these interactive machines but when you have at least 3 passwords, things are getting complex. You need to think out of the box a bit, and that’s why I liked this machine (even though I hit my head on the wall when realized it).

If you know the specific script language internals you are good to go and this machine will be easy especially the root path. But if you’re not that type of person, you will have some hard time like I had. That part was frustrating and also the language has some annoying restricts/features (e.g. ’ vs ").

My hints (if there is a spoiler, pls remove it):

User: check your notes and try to find some relationship between the open services and the @-s on the site. You need some fishing rods and some cats to catch that fish :slight_smile:
After that do some basic enumeration in the service (also check your notes and use google). The brainfuck part is coming; some hosts contains more h***s in it. You can guess or brute it, it’s up to you. Once you find it, you will understand how to get in. Just do what you wanted to do first on FT, but you couldn’t trigger it.

ShellZ: you don’t need to stick with the service user, just change to the other one you got earlier. Then you need to understand how things are going. Check the running processes, and you will get a clue, how should you get that user. Once you found out, you need a little GoogleFu how trick this internal service to get what you want. I think this is the hardest part. Yes, you need to upload something but it’s not the uploaded package what gives you the shell, so do not overcomplicate this.

Root: strongly related to the previous service. Basic privilege enumeration and GTFOBins will bring you the joy.

Thanks @sulcud for this machine, I learned a brand new thing what I didn’t find in other machines earlier.