[cavour13]

path it's /uploads/images/name.php  i was able to bypass the image extension check but i think we have to phar it or it's simpler?

[sqad]

On the machine, as dash, any hints on how to pivot to xander?

[pwn1]

xender and dash is straight forward

[mrhi]

On the machine, as dash, any hints on how to pivot to xander?

The password is somewhere in dash home directory.

[sqad]

On the machine, as dash, any hints on how to pivot to xander?

The password is somewhere in dash home directory.

Legit saw that file, tried to read it didnt work and moved along even tho google said that was the file to store it.

---

guys all u need to make .php run .. from BurpSuite just convert content type from images/jpeg to file/php

after that u gonna get it here --> http://admin.usage.htb/uploads/images/<filename>

---

Rooted

ln -r -s ...

how bro

use burpsuite repeater, keep upload image and convert into .PHP ext then try to trigger revshell on upload/images/your.php URL, if encounter expired or file not found, restart from burpsuite captured step again

bro i know i get a shell as dash but now how to root it

as xander user:
Wildcards Spare tricks | HackTricks | HackTricks

This useful with sudo -l?

[pwn1]

On the machine, as dash, any hints on how to pivot to xander?

The password is somewhere in dash home directory.

Legit saw that file, tried to read it didnt work and moved along even tho google said that was the file to store it.

---

guys all u need to make .php run .. from BurpSuite just convert content type from images/jpeg to file/php

after that u gonna get it here --> http://admin.usage.htb/uploads/images/<filename>

---

how bro

use burpsuite repeater, keep upload image and convert into .PHP ext then try to trigger revshell on upload/images/your.php URL, if encounter expired or file not found, restart from burpsuite captured step again

bro i know i get a shell as dash but now how to root it

as xander user:
Wildcards Spare tricks | HackTricks | HackTricks

This useful with sudo -l?

rooted

---

overview:

1.forget password vuln to sql injection (use sqlmap)

2. crack the admin hash(browfish) and login

3. file upload(bypass) ---> rce (avatar upload section)

4. get a reverse shell as use dash and get a user flag

5.  check for hidden files and get xander password and login via ssh

6.  with root use this one https://book.hacktricks.xyz/linux-harden...are-tricks u have to read it carefull and u will understand it

7. run the sudo -l and then proceed as sudo binary_usage and u get root flag

[sqad]

On the machine, as dash, any hints on how to pivot to xander?

The password is somewhere in dash home directory.

Legit saw that file, tried to read it didnt work and moved along even tho google said that was the file to store it.

---

use burpsuite repeater, keep upload image and convert into .PHP ext then try to trigger revshell on upload/images/your.php URL, if encounter expired or file not found, restart from burpsuite captured step again

bro i know i get a shell as dash but now how to root it

as xander user:
Wildcards Spare tricks | HackTricks | HackTricks

This useful with sudo -l?

rooted

---

overview:

1.forget password vuln to sql injection (use sqlmap)

2. crack the admin hash(browfish) and login

3. file upload(bypass) ---> rce (avatar upload section)

4. get a reverse shell as use dash and get a user flag

5.  check for hidden files and get xander password and login via ssh

6.  with root use this one https://book.hacktricks.xyz/linux-harden...are-tricks u have to read it carefull and u will understand it

7. run the sudo -l and then proceed as sudo binary_usage and u get root flag

I think I know which one you are talking about just struggling to get it to work now

---

On the machine, as dash, any hints on how to pivot to xander?

The password is somewhere in dash home directory.

Legit saw that file, tried to read it didnt work and moved along even tho google said that was the file to store it.

---

use burpsuite repeater, keep upload image and convert into .PHP ext then try to trigger revshell on upload/images/your.php URL, if encounter expired or file not found, restart from burpsuite captured step again

bro i know i get a shell as dash but now how to root it

as xander user:
Wildcards Spare tricks | HackTricks | HackTricks

This useful with sudo -l?

rooted

---

overview:

1.forget password vuln to sql injection (use sqlmap)

2. crack the admin hash(browfish) and login

3. file upload(bypass) ---> rce (avatar upload section)

4. get a reverse shell as use dash and get a user flag

5.  check for hidden files and get xander password and login via ssh

6.  with root use this one https://book.hacktricks.xyz/linux-harden...are-tricks u have to read it carefull and u will understand it

7. run the sudo -l and then proceed as sudo binary_usage and u get root flag

got the exploit to work found .ssh key but that is completly broken for some reason

[membizhomeless]

anyway we can get a shell as root? already rooted the box but wondering if i can get a shell as root instead of just reading files
tried to read /etc/shadow but no success

EDIT: you can just read /root/.ssh/id_rsa

[Kurovoid]

I'm so sad, I can't find the xander pw

[membizhomeless]

I'm so sad, I can't find the xander pw

nigga just check the files on dash home directory