[DoesntMatter123456]

Almost 25 hours away from the release of 5th Machine of Season 4, Savage Lands on Hack The Box

https://app.hackthebox.com/machines/586

Use this thread, for helping others and sharing knowledge. All the best

---

One of the machine creator is 'ctrlzero' ,who also created another insane machine 'Coder'. So expect the unexpected!

[ktirebb]

very good

[U2t5d2lu]

http://demo.skyfall.htb/login

[Art10n]

http://demo.skyfall.htb/metrics
http://demo.skyfall.htb/billing
http://demo.skyfall.htb/beta
http://demo.skyfall.htb/files

---

http://demo.skyfall.htb/metrics
http://demo.skyfall.htb/billing
http://demo.skyfall.htb/beta
http://demo.skyfall.htb/files

Cookie decoded : flask-unsign

{'_fresh': True, 
  '_id': '1c26577c0e4ec6afcf478aca7923069824db76ff0e5075f97569c948773ba0e7b58b90481e6f15d06d527ad8aa52e375cc27f0fbf6582e8045d8d75353327a12', 
  '_user_id': '1', 
  'csrf_token': 'aa237d20d7e1ebe1c8f2722ccf76d77b24fbbe00'}

[CodeAssassin]

Add a file, Open two pages on the /files page.

Delete an item from one page, try to delete the item from the other page, (or rename) (not sure whats vuln) but get

S3 operation failed; code: NoSuchKey, message: Object does not exist, resource: /guest/index.html, request_id: 17B07275B0A1733E, host_id: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, bucket_name: guest, object_name: index.html

[chillywilly]

vue to a kill ...

[Blackoofconsequently]

vue to a kill ...

Vue isnt used anywhere I can see.

[chillywilly]

vue to a kill ...

Vue isnt used anywhere I can see.

most likely a bot checking feedback

[DoesntMatter123456]

You can login at: http://demo.skyfall.htb/login with guest:guest

[intersteller2038]

Anyone has the root hash?