Last Active


  • I tried to poison the user agent tag with some php RCE code but it did not work. Is there another trick I am missing?
  • Tried inserting sqli payloads into what might be vulnerable parameters on the messaging app, but I'm getting nothing. Does anyone have an article that teaches us about the source code we are supposed to be looking at? Or any nudge how to trigger sai…
  • Rooted using p****. I've seen this technique used on other boxes with Linux but I never thought to do this on Windows. Had some curve balls that helped me learn. PM for hints if you need it. User: Enum the web app and Google for the exploit Root: …
  • Total newb question: I cannot find p**** on the victim box to initiate the p*** f*****. Is it something I have to keep digging to find the proper directory or should I find a way to upload it from Kali?
  • I am trying to turn the fake shell into a real shell. I am reading the exploit from the db. Am I supposed to do the exploit manually thru burp suite to get a browser shell? I do not understand where to inject the malicious stuff, could someone give …
  • I accessed the file system, i found what i think are a validation key / decryption key in one file and usernames in another file. Tried to john the keys but I got nothing. Are those keys the hashes or am I way off?
  • rooted. This was a fair mix between CTF like and just plain ol misconfigurations. Learned a bit about lua, command execution and a unique form of privesc that you really have to google for to find. PM for hints if you like.
  • So far I found the 2 ports open after doing an all ports scan. Directory busting got me nothing, I saw the clue on the web server. But I do not see anywhere to upload the web shell. Can someone give me a nudge as how to get to a spot to upload?
  • Rooted. Holy crap. That is NOT an easy box. This is more like a Windows Forensics CTF box with rabbit holes, coding, decrypting, crying, navigating new services you're not familiar with, and enumeration. I did it all on Linux. PM me if you need hel…
  • Working on root, never done this kind of investigating before. I found the .exe, xml and empty file, I found the high numbered port that we can telnet to. Which file do I decompile and what's the recommended tool for this? Anyone have a link or reso…
  • I have both Sec+ and CISSP. I would say skip the Sec+ and go for CISSP. CISSP has everything Sec+ has and more. CISSP is a beast in its own right, you have to learn the rules in ISC2's reality. Think like a high level boss in terms of how to defend …
  • I've tried two different online compilers. I keep getting the error message "'Utils' is not declared. It may be inaccessible due to its protection level." Google doesn't provide a solution. Is there something extra I need to put in the cod…
  • When I execute the script in an online compiler, where do I place RU_Config.xml? Do I create another window in the online compiler and paste in the username and encrypted password? Or if I did this in visual studio, do I just have the xml file in th…
  • Spoiler Removed
  • Rooted. Root takes a little playing around with to get it. PM if you need help.
  • Rooted. PM if you need help. This box makes you focus on searching thru the file system
  • Rooted. PM if you need help. Foothold requires some enumeration in the file system, then after that the steps are similar to openadmin
  • Rooted. Very CTF like box. Feel free to PM for help. Enum all directories with different directory enum tools to find some creds use this: https://medium.com/dev-bits/a-guide-for-adding-jwt-token-based-authentication-to-your-single-page-node…
    in Luke Comment by squirrelpizza July 2019
  • I got only one set of creds from a directory, can someone give me a nudge on how to get the other set of creds? I think the previous comments said to get the other creds thru poking around on the high ports?
    in Luke Comment by squirrelpizza June 2019
  • (Quote) Python3 -c ‘import pty;pty.spawn(“/bin/bash”);’ Ctrl Z to foreground stty raw -echo fg Enter twice
  • Rooted. I know everyone was saying this was easy but I guess this shows how much of a newb I am. Learning from videos is one thing but actually applying it is another. For user: Find the right python script, after you get to the next step, then fin…

Howdy, Stranger!

Click here to create an account.