[h2m0nRe-d0b1e]

tomHands have a lot of passwords, but nothing worked c':

try again, tips: see passwd

[nenandjabhata]

I am trying to fuzz but not getting a good answer using my command:
└─# ffuf -u http://drive.htb/FUZZ/getFileDetail/ -w 3-digit.txt -fs 1542,0

there some functional unReserve, after press button u can see some private files "Select files to unReserve :" , but no can see content their
tips: press Reserve after upload u file and get correctly url for fuzz

Tried but same, i also used burp intruder to do it. but same, can you explain with steps please?

[h2m0nRe-d0b1e]

I am trying to fuzz but not getting a good answer using my command:
└─# ffuf -u http://drive.htb/FUZZ/getFileDetail/ -w 3-digit.txt -fs 1542,0

there some functional unReserve, after press button u can see some private files "Select files to unReserve :" , but no can see content their
tips: press Reserve after upload u file and get correctly url for fuzz

Tried but same, i also used burp intruder to do it. but same, can you explain with steps please?

did u create login and upload file?

[nenandjabhata]

I am trying to fuzz but not getting a good answer using my command:
└─# ffuf -u http://drive.htb/FUZZ/getFileDetail/ -w 3-digit.txt -fs 1542,0

there some functional unReserve, after press button u can see some private files "Select files to unReserve :" , but no can see content their
tips: press Reserve after upload u file and get correctly url for fuzz

Tried but same, i also used burp intruder to do it. but same, can you explain with steps please?

did u create login and upload file?

Yes. i have uploaded a file and reserved it. Now i was trying to FUZZ 3 digit number here : http://drive.htb/FUZZ/getFileDetail/.

[h2m0nRe-d0b1e]

I am trying to fuzz but not getting a good answer using my command:
└─# ffuf -u http://drive.htb/FUZZ/getFileDetail/ -w 3-digit.txt -fs 1542,0

there some functional unReserve, after press button u can see some private files "Select files to unReserve :" , but no can see content their
tips: press Reserve after upload u file and get correctly url for fuzz

Tried but same, i also used burp intruder to do it. but same, can you explain with steps please?

did u create login and upload file?

Yes. i have uploaded a file and reserved it. Now i was trying to FUZZ 3 digit number here : http://drive.htb/FUZZ/getFileDetail/.

see another url when Reserve self-file, and him fuzz (not getFileDetail)

[bololohaha]

i found a Message contains back*** but i cant find the that directory i need to use fuff ？ how can i do next？

You found just one of a few messages you need. Try to enumerate the missing ones, and it will be easy.

[D347H]

is option 5 from the CLI the correct path to root, or this is just another loophole?

 which creds have you use on cli?

[bololohaha]

is option 5 from the CLI the correct path to root, or this is just another loophole?

 which creds have you use on cli?

You can RE it, or just use strings :v

[peRd1]

is option 5 from the CLI the correct path to root, or this is just another loophole?

Yes. I'd say yes, I still didn't finish the box. There seem to be at least 2 ways to root the box. 
Either via binary exploitation (BOF or something but I see somehow need to get past the stack smashing checks, I was thinking about ret to libc approach but couldn't get it done yet.), or via the help of loading some external library and sql statements. Regardless, the CLI binary's function 5 needs to get abused to its tears, where I am stumped pretty much......

As for the user and foothold. Read previous posts. Find out how to read other files. FUZZ for valid entries where it gives unauthorized but files exists, etc. Then you will see how to actually read those files that exist. After that step foothold is right away. Then moving laterally to a different user. After shell, on the server you will find some zips of sqlite db backups - which will contain pwd hashes! You need to get into the gitea that is filtered (seen from nmap scan RIGHT??). Port fwd that once you have foothold obviously. In the gitea once logged you will see right away the archive password. Unzip and his is how you find sql hashes. Crack them. Be smart. Use tools appropriately. Check all backups since not every credential will work but you'll get the user. And done.

[nenandjabhata]

is option 5 from the CLI the correct path to root, or this is just another loophole?

Yes. I'd say yes, I still didn't finish the box. There seem to be at least 2 ways to root the box. 
Either via binary exploitation (BOF or something but I see somehow need to get past the stack smashing checks, I was thinking about ret to libc approach but couldn't get it done yet.), or via the help of loading some external library and sql statements. Regardless, the CLI binary's function 5 needs to get abused to its tears, where I am stumped pretty much......

As for the user and foothold. Read previous posts. Find out how to read other files. FUZZ for valid entries where it gives unauthorized but files exists, etc. Then you will see how to actually read those files that exist. After that step foothold is right away. Then moving laterally to a different user. After shell, on the server you will find some zips of sqlite db backups - which will contain pwd hashes! You need to get into the gitea that is filtered (seen from nmap scan RIGHT??). Port fwd that once you have foothold obviously. In the gitea once logged you will see right away the archive password. Unzip and his is how you find sql hashes. Crack them. Be smart. Use tools appropriately. Check all backups since not every credential will work but you'll get the user. And done.

I am trying to crack hashes using John Because my hashcat not work, Please can you suggest any tools