Posts: 77 Threads: 0 Joined: N/A August 16, 2022 at 11:12 AM Any write up or resources to escabe this machine ? Posts: 21 Threads: 0 Joined: N/A August 17, 2022 at 2:32 PM You have partial walkt here bro: breached.to/Thread-HTB-Scanned Posts: 77 Threads: 0 Joined: N/A August 18, 2022 at 7:48 AM (August 17, 2022, 02:32 PM)hackthebnow Wrote: You have partial walkt here bro: breached.to/Thread-HTB-Scanned i want more details or resource to understand it Posts: 21 Threads: 0 Joined: N/A August 31, 2022 at 1:48 PM For the foothold, I would advise to recreate the env locally. If you read the source, you can see that something is kept open during the execution of the child process.
It becomes apparent if you run the sandbox locally and freeze the process. When you found it, think about what you can do as user in this jail (not so much, but there are still some caps you have) and how you might exploit it on the real box (advice : DON’T be lazy, there are no better way). Posts: 77 Threads: 0 Joined: N/A August 31, 2022 at 4:46 PM (August 31, 2022, 01:48 PM)hackthebnow Wrote: For the foothold, I would advise to recreate the env locally. If you read the source, you can see that something is kept open during the execution of the child process.
It becomes apparent if you run the sandbox locally and freeze the process. When you found it, think about what you can do as user in this jail (not so much, but there are still some caps you have) and how you might exploit it on the real box (advice : DON’T be lazy, there are no better way). I did all of this and and escaped the jail but i can't extract the hash from dashboard Posts: 16 Threads: 0 Joined: N/A August 31, 2022 at 5:07 PM (August 16, 2022, 11:12 AM)Test1337 Wrote: Any write up or resources to escabe this machine ? pm for detailed writeup Posts: 77 Threads: 0 Joined: N/A August 31, 2022 at 9:21 PM (August 31, 2022, 05:07 PM)never_fade Wrote: (August 16, 2022, 11:12 AM)Test1337 Wrote: Any write up or resources to escabe this machine ?
pm for detailed writeup i don't have money sorry x0 Posts: 22 Threads: 0 Joined: N/A September 1, 2022 at 6:39 AM (August 31, 2022, 04:46 PM)Test1337 Wrote: (August 31, 2022, 01:48 PM)hackthebnow Wrote: For the foothold, I would advise to recreate the env locally. If you read the source, you can see that something is kept open during the execution of the child process.
It becomes apparent if you run the sandbox locally and freeze the process. When you found it, think about what you can do as user in this jail (not so much, but there are still some caps you have) and how you might exploit it on the real box (advice : DON’T be lazy, there are no better way).
I did all of this and and escaped the jail but i can't extract the hash from dashboard read malscanner.db, locate the hash md5$salt$hexdigest, then leak each byte via write. write(1, buf, byte_to_leak), which is reported in order under Low Priority Syscalls Posts: 77 Threads: 0 Joined: N/A September 1, 2022 at 11:03 PM (September 1, 2022, 06:39 AM)technic Wrote: (August 31, 2022, 04:46 PM)Test1337 Wrote: (August 31, 2022, 01:48 PM)hackthebnow Wrote: For the foothold, I would advise to recreate the env locally. If you read the source, you can see that something is kept open during the execution of the child process.
It becomes apparent if you run the sandbox locally and freeze the process. When you found it, think about what you can do as user in this jail (not so much, but there are still some caps you have) and how you might exploit it on the real box (advice : DON’T be lazy, there are no better way).
I did all of this and and escaped the jail but i can't extract the hash from dashboard
read malscanner.db, locate the hash md5$salt$hexdigest, then leak each byte via write.
write(1, buf, byte_to_leak), which is reported in order under Low Priority Syscalls Can I pm you? Posts: 22 Threads: 0 Joined: N/A September 1, 2022 at 11:13 PM (September 1, 2022, 11:03 PM)Test1337 Wrote: (September 1, 2022, 06:39 AM)technic Wrote: (August 31, 2022, 04:46 PM)Test1337 Wrote: (August 31, 2022, 01:48 PM)hackthebnow Wrote: For the foothold, I would advise to recreate the env locally. If you read the source, you can see that something is kept open during the execution of the child process.
It becomes apparent if you run the sandbox locally and freeze the process. When you found it, think about what you can do as user in this jail (not so much, but there are still some caps you have) and how you might exploit it on the real box (advice : DON’T be lazy, there are no better way).
I did all of this and and escaped the jail but i can't extract the hash from dashboard
read malscanner.db, locate the hash md5$salt$hexdigest, then leak each byte via write.
write(1, buf, byte_to_leak), which is reported in order under Low Priority Syscalls
Can I pm you? Sure. |
