[nonofyabusiness]

when i wear my yellow rainjacket in the storm people try to hail me as a cab.

cat /etc/shadow
root:$y$j9T$pJW9XfkWvA4ozHorBy1kA1$MMNByIaVVdq4YrIpvYDEIfckbiKog11HxKcxJkAZLcA:19709:0:99999:7:::
daemon:*:19668:0:99999:7:::
bin:*:19668:0:99999:7:::
sys:*:19668:0:99999:7:::
sync:*:19668:0:99999:7:::
games:*:19668:0:99999:7:::
man:*:19668:0:99999:7:::
lp:*:19668:0:99999:7:::
mail:*:19668:0:99999:7:::
news:*:19668:0:99999:7:::
uucp:*:19668:0:99999:7:::
proxy:*:19668:0:99999:7:::
www-data:*:19668:0:99999:7:::
backup:*:19668:0:99999:7:::
list:*:19668:0:99999:7:::
irc:*:19668:0:99999:7:::
gnats:*:19668:0:99999:7:::
nobody:*:19668:0:99999:7:::
_apt:*:19668:0:99999:7:::
systemd-network:*:19668:0:99999:7:::
systemd-resolve:*:19668:0:99999:7:::
messagebus:*:19668:0:99999:7:::
systemd-timesync:*:19668:0:99999:7:::
sshd:*:19668:0:99999:7:::
systemd-coredump:!*:19668::::::
ofbiz:$y$j9T$0io/BiTgsGfXITtrQxine1$0PO2rHmI9H46z/uQszVpMm1V7UTYvB5lVh8.Vcx/Nt/:19709:0:99999:7:::
_laurel:!:19711::::::

btw i didnt hack this i had to show my tits for it.

For what the passwd file...

[chemry]

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

[chillywilly]

its not a straight crack, look how its implemented and reverse that to get the hash and salt

https://github.com/apache/ofbiz/blob/tru...Crypt.java

[chemry]

its not a straight crack, look how its implemented and reverse that to get the hash and salt

https://github.com/apache/ofbiz/blob/tru...Crypt.java

thanks for the comment, I just found it out right when you posted. Bro this is definitely not a easy one

[Xerion]

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

Please share path

[chemry]

For people, this link is more spoiler but helps
https://commons.apache.org/proper/common...ng-byte:A-

---

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

Please share path

For reading DB, check the tool

ij

---

Actually, `strings` might be enough

[Xerion]

For people, this link is more spoiler but helps
https://commons.apache.org/proper/common...ng-byte:A-

---

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

Please share path

For reading DB, check the tool

ij

---

Actually, `strings` might be enough

Thanks,
I can't figure out where dirby db is located please be humble I'm kinda new 

[St4rry]

got user


anyone get something for root ?

I'm not sure but...

ofbiz@bizness:~/l$ getcap -r / 2>/dev/null
/usr/bin/ping cap_net_raw=ep
/home/ofbiz/l/python3 cap_setuid=eip

not vulnerable

btw did you manage to get a good shell ? mine breaks after 2 minutes it's soooo annoying

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl+Z
stty raw -echo; fg

[chemry]

For people, this link is more spoiler but helps
https://commons.apache.org/proper/common...ng-byte:A-

---

I do got a SHA password from these derby dat files, but its weird to crack..

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

Please share path

Its just under a sub-directory of `/opt/ofbiz`. Practice your enumeration technique there. (Basically just ls, cd, lol)

For reading DB, check the tool

ij

---

Actually, `strings` might be enough

Thanks,
I can't figure out where dirby db is located please be humble I'm kinda new 

[nonofyabusiness]

I just cat the whole seg0 dir, saved to a file opened in nano , ctrl f and tnered pass