Official Love Discussion

C:\Users\Administrator\Desktop>whoami
whoami
nt authority\system

Rooted. One shell script worked better than the other two for stability. Was a fun box, figuring out the user part was frustrating because of where it is - like literally right there.

Type your comment> @foalma321 said:

Type your comment> @joeldejo said:

Is there anyone having issues with the shell? Every time I am getting a shell and the box will be unreachable. I know how to escalate, after many attempts to run the priv checks, but the user shell is unstable.

There are a multitude of ways to get a decent shell, the easiest is create a php msfvenom payload for a meterpreter session then upgrade it to a decent one or just a decent php shell that will work on a multitude of systems there a mini one on Github that’s very good.DM me if you need more info.
![Foalma321] (https://www.hackthebox.eu/badge/image/74636)

I managed to get the SYSTEM, I was using a mini one, which worked well but the problem was sometimes I have to wait for a long time to receive a response, I thought the shell was broken but later I figured out it was not broken it will take time. msfvenom raw PHP shell was not successful for me.

Type your comment> @joeldejo said:

Type your comment> @foalma321 said:

Type your comment> @joeldejo said:

Is there anyone having issues with the shell? Every time I am getting a shell and the box will be unreachable. I know how to escalate, after many attempts to run the priv checks, but the user shell is unstable.

There are a multitude of ways to get a decent shell, the easiest is create a php msfvenom payload for a meterpreter session then upgrade it to a decent one or just a decent php shell that will work on a multitude of systems there a mini one on Github that’s very good.DM me if you need more info.
![Foalma321] (https://www.hackthebox.eu/badge/image/74636)

I managed to get the SYSTEM, I was using a mini one, which worked well but the problem was sometimes I have to wait for a long time to receive a response, I thought the shell was broken but later I figured out it was not broken it will take time. msfvenom raw PHP shell was not successful for me.

Nice one. I used a php/meterpreter/reverse_tcp one and upgraded to a decent met shell once on the box or a php/download_exec one to install a msfvenom created exe.
![Foalma321] (https://www.hackthebox.eu/badge/image/74636)

I cant seem to get the s*******n w**e to load no matter what. Reset the machine, vpn, can ping it no prob, reran nmap numerous times to clarify I wasn’t missing some l337 speak or something dumb, to no avail… Hs is configured correctly and all as well. perhaps something obvious I’m missing? I’m all ears. Well, I have a body too but I am willing to hear suggestions. };-|]

Can anyone help me with the foothold ? . I’m kinda stuck

I can’t seem to access this machine anymore and the Release Arena machine has changed. The ip address is now 10.10.10.239 . Does this mean I need to buy a subscription in order to continue to work on it?

@cutterslim said:
I can’t seem to access this machine anymore and the Release Arena machine has changed. The ip address is now 10.10.10.239 . Does this mean I need to buy a subscription in order to continue to work on it?

you need to choose the right VPN package

Type your comment> @Doncrek said:

@cutterslim said:
I can’t seem to access this machine anymore and the Release Arena machine has changed. The ip address is now 10.10.10.239 . Does this mean I need to buy a subscription in order to continue to work on it?

you need to choose the right VPN package

I switched to a lab vpn, got a different ip address and still can’t reach 10.10.10.239. Is there a different vpn package I should be using?

@cutterslim said:
Type your comment> @Doncrek said:

@cutterslim said:
I can’t seem to access this machine anymore and the Release Arena machine has changed. The ip address is now 10.10.10.239 . Does this mean I need to buy a subscription in order to continue to work on it?

you need to choose the right VPN package

I switched to a lab vpn, got a different ip address and still can’t reach 10.10.10.239. Is there a different vpn package I should be using?

yes it’s lab VPN , are you sure you’re connected to the VPN ? check ifconfig tun0 ?

@quangvo said:
Can anyone help me with the foothold ? . I’m kinda stuck

reach me out so I can give you some nudges

Type your comment> @Doncrek said:

@cutterslim said:
Type your comment> @Doncrek said:

@cutterslim said:
I can’t seem to access this machine anymore and the Release Arena machine has changed. The ip address is now 10.10.10.239 . Does this mean I need to buy a subscription in order to continue to work on it?

you need to choose the right VPN package

I switched to a lab vpn, got a different ip address and still can’t reach 10.10.10.239. Is there a different vpn package I should be using?

yes it’s lab VPN , are you sure you’re connected to the VPN ? check ifconfig tun0 ?

nevermind, i restarted kali machine, and now i can reach Love again

Finally got system!
Some of the things that should work, didn’t work sometimes.

For System: read carefully the output of your favorite enumeration script and you’ll find the misconfiguration ;). Next step us easy.

Someone was able to get system with the predefined module from the famous framework?

Finally rooted. Thks to you nudges on this page… DM if you are stuck :slight_smile:

@gullon said:
Finally got system!
Some of the things that should work, didn’t work sometimes.

For System: read carefully the output of your favorite enumeration script and you’ll find the misconfiguration ;). Next step us easy.

Someone was able to get system with the predefined module from the famous framework?

Yes, but it took me more time than without the framework.

Would greatly appreciate any help. Have been stuck on a dead end for three hours or so now, finally gave up.
I’m on the hidden URL. Can see the possibility to upload a reverse shell. I’ve tried to upload a PHP shell - no access, the code is only echoed out. Tried an EXE shell - seems to do something, but no matter what type of shell I try it always echoes some binary data with the error " This program cannot be run in DOS mode". Have tried every possible shell from the known framework and some other ones. No success.

Other than that hidden URL, there seem to be one hundred and one attack vectors, but couldn’t find anything on that. The shell upload one is my best bet so far, but can’t get it to work.

/edit: I’m dumb. The DOS mode message belongs to the EXE header. Therefore, the script simply echoes the whole EXE binary back to me. Still no idea how I would get a shell from that site though. Might be on the completely wrong path (and probably am).

Type your comment> @spaaze said:

Would greatly appreciate any help. Have been stuck on a dead end for three hours or so now, finally gave up.
I’m on the hidden URL. Can see the possibility to upload a reverse shell. I’ve tried to upload a PHP shell - no access, the code is only echoed out. Tried an EXE shell - seems to do something, but no matter what type of shell I try it always echoes some binary data with the error " This program cannot be run in DOS mode". Have tried every possible shell from the known framework and some other ones. No success.

Other than that hidden URL, there seem to be one hundred and one attack vectors, but couldn’t find anything on that. The shell upload one is my best bet so far, but can’t get it to work.

/edit: I’m dumb. The DOS mode message belongs to the EXE header. Therefore, the script simply echoes the whole EXE binary back to me. Still no idea how I would get a shell from that site though. Might be on the completely wrong path (and probably am).

I am struggling on this one aswell…

Type your comment> @chbale said:

Type your comment> @spaaze said:

(Quote)
I am struggling on this one aswell…

Have you considered trying url instead of uploading a file and see what it does… then use that to ur advantage? ?

Type your comment> @spaaze said:

Would greatly appreciate any help. Have been stuck on a dead end for three hours or so now, finally gave up.
I’m on the hidden URL. Can see the possibility to upload a reverse shell. I’ve tried to upload a PHP shell - no access, the code is only echoed out. Tried an EXE shell - seems to do something, but no matter what type of shell I try it always echoes some binary data with the error " This program cannot be run in DOS mode". Have tried every possible shell from the known framework and some other ones. No success.

Other than that hidden URL, there seem to be one hundred and one attack vectors, but couldn’t find anything on that. The shell upload one is my best bet so far, but can’t get it to work.

/edit: I’m dumb. The DOS mode message belongs to the EXE header. Therefore, the script simply echoes the whole EXE binary back to me. Still no idea how I would get a shell from that site though. Might be on the completely wrong path (and probably am).

Think “locally” about things you currently cannot see.

Finally got system…this being my first machine to learn on, I did not find it easy. I would describe easy (at least for a beginner) a machine that has less rabbit holes to run down (to limit time sinks).

User: I had a few nudges. Unsure how long I’d have spent banging my head going after the wrong thing without these nudges. Things finally clicked, but for the wrong reasons, I was able to view the server access log, and I could see what other pen testers were doing that made me think of how to get my payload over to get that 1st shell

Root: spent too many hours going yet another rabbit hole (went after exploit that requires another windows machine to mount attack). When I finally ran my enumeration script on the victim machine, it gave me a wall of text, and the misconfiguration part was near the top so I kept missing it (realized I should have redirected output to a file for easier reading). I finally got the misconfig message by stopping scroll while the script ran.

Not an easy machine to learn on, but thankful for all the nudges that saved me hours of going down rabbit holes (i still spent a good 3-4 hrs a day since this machine came online). I learned a lot, but would not recommend this to a beginner unless said beginner is resilient to frustration (i feed off frustration).