[asjflajsfflkjslajf]

someone could share ssh admin

I have the SSH credentials, but you are better off working out how to get them, you aren't far away

[s0jnik]

I have setup the bitwarden extensions for elwin.jones in firefox and have the pin to open it.
I see the Username and the PAssword and i see TOTP Codes renewing every 30 seconds.
I have edited my /etc/hosts to point on `10.8.0.1` for `git.corporate.htb`

When i try to login, i get an error that the passcode is incorrect.
What can be the rootcause?

[EverPalestine]

Hello, i need some help. I am already right in Front of it. I am trying to connect to Proxmox. I can the the login. I am trying to add the "PVEAuthCookie" with a value generated in this Script:


Can somebody tell me what ia am doing wrong? Adding the Cookie doesnt helps bypassing the login, is my logic generating the Token Wrong? Do you have any other hints? Thanks already!

Proxmox cannot be accessed with the token you sent.
But you can do the following:
1- Change the password of any user as long as it is not sysadmin, so it is appropriate to change the password of a user in the engineering group. With users in the engineer group you can exploit docker and be root in the container.
2- Then you mount the file system -> mount.nfs 10.8.0.1:/ /tmp/yourdir/ -r -o nolock
3- In the directory you just created, access the folder of a sysadmin user and obtain the id_rsa key.
4- Being sysadmin you can exploit proxmox.

I already managed to get to sysadmin on 10.9.0.4 through forging JWT cookie for an engineer employee and escalate to root on the machine (using Docker Alpine) mount mentioned in the forums only thing that I’m stuck at the moment is exploiting promox from here to get to the root @ 10.8.0.1 machine. Please DM me if you have solution or any insightful tips pass this point

[babbaxdobbax]

i'm stuck on bitwarden
the pin extract from data.json is 0239
now?
self hosted in bitwarden? how?

[game95]

Hi everyone, I'm stuck at the root. Can someone help me or provide a hint? Alternatively, if you're interested in trading the writeup for the Mist room, feel free to DM me

[TREXNEGRO]

Does anyone have a brief summary with clear steps??
Or the VPN to download?

[ARhOmOuTEd]

Hello, i need some help. I am already right in Front of it. I am trying to connect to Proxmox. I can the the login. I am trying to add the "PVEAuthCookie" with a value generated in this Script:


Can somebody tell me what ia am doing wrong? Adding the Cookie doesnt helps bypassing the login, is my logic generating the Token Wrong? Do you have any other hints? Thanks already!

Proxmox cannot be accessed with the token you sent.
But you can do the following:
1- Change the password of any user as long as it is not sysadmin, so it is appropriate to change the password of a user in the engineering group. With users in the engineer group you can exploit docker and be root in the container.
2- Then you mount the file system -> mount.nfs 10.8.0.1:/ /tmp/yourdir/ -r -o nolock
3- In the directory you just created, access the folder of a sysadmin user and obtain the id_rsa key.
4- Being sysadmin you can exploit proxmox.

I already managed to get to sysadmin on 10.9.0.4 through forging JWT cookie for an engineer employee and escalate to root on the machine (using Docker Alpine) mount mentioned in the forums only thing that I’m stuck at the moment is exploiting promox from here to get to the root @ 10.8.0.1 machine. Please DM me if you have solution or any insightful tips pass this point

Hi,

how can I change the password of an member of the engineering group?

[ARhOmOuTEd]

To summarise my progress, I manage to get user.txt and all these user credentials:

elwin.jones@corporate-workstation-04:~$ id elwin.jones
uid=5021(elwin.jones) gid=5021(elwin.jones) groups=5021(elwin.jones),503(it)
elwin.jones@corporate-workstation-04:~$ id laurie.casper
uid=5041(laurie.casper) gid=5041(laurie.casper) groups=5041(laurie.casper),504(consultant)
elwin.jones@corporate-workstation-04:~$ id nya.little
uid=5055(nya.little) gid=5055(nya.little) groups=5055(nya.little),504(consultant)
elwin.jones@corporate-workstation-04:~$ id brody.wiza
uid=5068(brody.wiza) gid=5068(brody.wiza) groups=5068(brody.wiza),504(consultant)

Now I am stuck at git.corporate.htb after elwin.jones gitea login thru bitwarden (firefox extension).

I know I have to target proxmon through these steps: engineer grp user > mount nfs > sysadmin id_rsa after reading through the discussion here but how can I do that? Pretty sure writable LDAP permissions have been removed.

# engineer, Groups, corporate.htb
dn: cn=engineer,ou=Groups,dc=corporate,dc=htb
gidNumber: 502
objectClass: top
objectClass: posixGroup
cn: engineer
memberUid: ward.pfannerstill
memberUid: kian.rodriguez
memberUid: gideon.daugherty
memberUid: gayle.graham
memberUid: dylan.schumm
memberUid: richie.cormier
memberUid: marge.frami
memberUid: abbigail.halvorson
memberUid: arch.ryan
memberUid: cathryn.weissnat

Finally Rooted! I was so dumb, a hint for those who are still stuck, do not bother on modifying LDAP.

Can someone give me a hint, how to target the engineer grp user.

[ARhOmOuTEd]

Hi, I'm stuck on corporate.htb. 

Can someone help me, how to get from elwin.jones to sysadmin?

Thx

[mycatdante]

Hi, I'm stuck on corporate.htb. 

Can someone help me, how to get from elwin.jones to sysadmin?

Thx

It takes too many words to answer this question...
There's writeup out there though, maybe you can PM the author to ask the password
https://4xura.com/ctf/htb/htb-writeup-corporate/