Possibly Related Threads…

mazafaka555 · Jul 26, 2024, 08:27 AM

second flag is a binary exploitation (pwn challenge). good luck Big Grin

mazafaka555 · Aug 01, 2024, 04:30 AM

(Aug 01, 2024, 12:58 AM)mmkz Wrote: Flag 2 exploit code...

Bro.. at least charge more credits for this.. what are faka you doing??

JonathanC0mradeJames · Aug 03, 2024, 08:20 AM

I am sharing the flags in this thread. https://breachforums.bf/Thread-Solar-Wri...#pid734297

If you want full writeup, DM me. Trading it for reputation!

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Reputation System Rules 5.1) You are not allowed to ask for, buy, sell, or trade reputation (You may ask after a deal is made, only exception)

mhsoraa · (This post was last modified: Aug 05, 2024, 08:59 AM by mhsoraa.)

Anyone can help me with a hint on flag 3's Phar deserialization?

monkeyNo1 · Aug 05, 2024, 11:30 AM

curl and wget not work, only this:

scp -P 2222 -i private.key /my_path/linpeas.sh backup_adm@10.13.38.23:/usr/home/backup_adm/linpeas.sh

I tried to use ligolo-ng to check other ip adresses but it's impossible to execute binary file on victim.
If you'll get 3rd flag PLS share

mhsoraa · (This post was last modified: Aug 05, 2024, 12:00 PM by mhsoraa.)

(Aug 05, 2024, 11:30 AM)monkeyNo1 Wrote: curl and wget not work, only this:

scp -P 2222 -i private.key /my_path/linpeas.sh backup_adm@10.13.38.23:/usr/home/backup_adm/linpeas.sh
I tried to use ligolo-ng to check other ip adresses but it's impossible to execute binary file on victim.
If you'll get 3rd flag PLS share

Based on leaked flag...

SOLAR{...snipped..._phar-fetched}

Flag 3 is about Phar deserialization attack.

Flag 3:

Hidden Content

You must register or login to view this content.

We need writeup or hint on Flag 3's Phar deserialization attack in order to proceed further on next flags...

tupaya_p1zd4 · Aug 06, 2024, 09:49 PM

(Aug 03, 2024, 08:20 AM)JonathanC0mradeJames Wrote: I am sharing the flags in this thread. http://breachedmw4otc2lhx7nqe4wyxfhpvy32...#pid734297

If you want full writeup, DM me. Trading it for reputation!

Please share Mister !
I will give you a reputation and my virginity Blush

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

mhsoraa · (This post was last modified: Aug 08, 2024, 03:33 PM by mhsoraa.)

(Aug 08, 2024, 12:22 PM)654321123 Wrote:
(Aug 08, 2024, 09:27 AM)mmkz Wrote:
(Aug 08, 2024, 04:37 AM)654321123 Wrote: where is the location of this app running from /backups/neptune/usr/local/www ??
i can't find it anywhere

What is the app you are trying to find?

php app for internal fileserver. suppose to be running on neptune jail

backup_adm@jupiter:~ % ll /backups/neptune/usr/local/www/apache24/ total 20 -rw-r--r-- 1 root wheel 48 May 18 2021 .htpasswd drwxr-xr-x 2 root www 4 Jan 29 2020 cgi-bin/ drwxrwxr-x 2 root www 3 Mar 3 2021 data/ drwxr-xr-x 3 root www 22 Jan 29 2020 error/ drwxr-xr-x 3 root www 3 Mar 3 2021 fileserver/ drwxr-xr-x 3 root www 179 Jan 29 2020 icons/ drwxrwxr-x 2 root www 2 Mar 5 2022 tmpfiles/ backup_adm@jupiter:~ % ll /backups/neptune/usr/local/www/apache24/fileserver/upload/ total 37 -rw-r--r-- 1 root www 5505 Mar 3 2021 admin.php drwxr-xr-x 2 root www 3 Feb 15 2020 api/ -rw-r--r-- 1 root www 930 Mar 3 2021 approve.php drwxr-xr-x 2 root www 7 Feb 14 2020 classes/ drwxr-xr-x 2 root www 4 Feb 20 2020 css/ -rw-r--r-- 1 root www 688 Feb 20 2020 download.php -rw-r--r-- 1 root www 4695 Mar 3 2021 index.php -rw-r--r-- 1 root www 358 Mar 2 2021 init.php drwxr-xr-x 2 root www 5 Mar 2 2021 settings/ -rw-r--r-- 1 root www 280 Mar 3 2021 upload.php backup_adm@jupiter:~ %

i think it is behind fileserver binary and we need to pop a proper shell to access it. i found everything on outer jails and such, except this app.
inner jails aren't directly accessible.

php app...

❯ nc 10.13.38.23 33333

Username: ...snipped...

Password: ...snipped...

Fetching index...

<!DOCTYPE html>

<html lang="en">

<title>FileServer Upload</title>

...snipped...

File (q to quit): admin.php    <=== php app here

Fetching file...

<!DOCTYPE html>

<html lang="en">

<title>FileServer Admin</title>

...snipped...

MrBlue · Oct 24, 2024, 12:22 PM

Hi, could someone please help me with BOF? How did you guys do it?

weakdaw22 · Oct 30, 2024, 04:00 PM

1st flag please

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] CPTS 12 FLAGS	pulsebreaker	72	2,177	57 minutes ago Last Post: coolguyaroundyou
	[FREE] HackTheBox Academy - CAPE Path Study	Techtom	43	4,217	1 hour ago Last Post: codexUltron
	[FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags	Techtom	24	2,744	1 hour ago Last Post: codexUltron
	[FREE] HackTheBox Dante - complete writeup written by Tamarisk	Tamarisk	603	92,366	8 hours ago Last Post: 0xnany
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	374	93,326	9 hours ago Last Post: 0xnany