Craft

HTB Content Machines
441

EDITED:
ROOTED

I got user on craft and stuck on it.
can’t get the root.
i found v**** service but can’t figure out how to use it to gain root access.

442

Rooted it
DM for any help

For faster response ping me on discord

whiteheart#9724

443

Just rooted,
hints:

— user:

  • Follow the obvious path
  • You are!? time to read some production code
  • login in the wanted service
    — User
  • That second repo is useful in other way
  • documentation
444

■■■ such a satisfying box and so similar to setup’s I’ve worked on irl

In the initial foothold, I couldn’t craft a rev shell that worked so I got drunk and went ■■■■ it, creating my own version using the commands I knew worked. Never done anything like that b4, which was fun.

The user was quite easy but I had a bit of a ‘doh’ moment when I realised my script was limited to 1 result (facepalm). Then look around in places you may have been before with the details you find here. No brute needed.

Root was pretty easy too. RTFM for that thing you found on the last step.

Oh and the theme made me scream for joy when I found it

445

Rooted ,DM if u need help :slight_smile:

446

Got user and root. For root read the documentation and apply it to the obvious .sh file and construct your own command based on the two. Shout out to @nirodha42 who helped me with my obvious stupid mistake with the db to get the additional users.

447

Rooted. Really fun box! Got stuck on the initial shell but finally got it. Root was all about reading the manual as others have said, I had never heard of the service before but figured it out rather quick.

Pm for hints.

448

So after three days I was able to get shell thanks to hevr and the many others who helped. Now onward and upwards and more days and days of struggling of figuring out whats next on the menu of pain.

449

Is it worth trying to exploit CVE-**-4? I was thinking in getting a reverse shell with g hs.

450

done 1x24 hours. insane box. great job for the author
rooted already. user.txt and root.txt owned
the hardest part on this box is finding the hash for me

need help ? PM me :smiley:

451

I can’t believe I spent so much time working on the payload to gain the initial foothold! My reverse shell kept closing and closing again. It was because I was calling a binary the system obviously didn’t have installed. Too much overthinking…

452

Can anybody help me?
I got access to gogs with correct user, found some rsa keys, i believe i can get SSH access with them, but even using * ssh - **** - id user @ host i can’t connect using ssh -i id-rsa .pub user @ host

ps: i’m having problems: sign_and_send_pubkey: signing failed: agent refused operation

am i on the right path?

453

Type your comment> @emp1 said:

Can anybody help me?
I got access to gogs with correct user, found some rsa keys, i believe i can get SSH access with them, but even using * ssh - **** - id user @ host i can’t connect using ssh -i id-rsa .pub user @ host

ps: i’m having problems: sign_and_send_pubkey: signing failed: agent refused operation

am i on the right path?

try to not using extension for the rsa :smiley:

454

can user d****h do regular ssh?

455

Hey l33ts

On top of previous question i want to ask is login to ssh required to get reverse shell? Or does finding d****h user helps in getting into ssh? There is some ssh information avaliable after login, but im not sure if this can be used in any way.

Thanks for tips in advance!

456

I have looked at the python, and understand how to call the api but need help escaping the commands. Where can I learn how to escape my input properly?

*Got foothold, ty

457

Please, any hint for start and enumeration

458

any nudge to escape from jail?

459

Is there still anyone on this machine?

460

removed