Possibly Related Threads…

samfisher010 · (This post was last modified: Jan 07, 2024, 12:57 AM by samfisher010.)

so the cap_setuid=eip is a rabbit hole ?doesn't seems to work tho

peRd1 · Jan 07, 2024, 12:59 AM

(Jan 07, 2024, 12:37 AM)tororo123 Wrote:
(Jan 07, 2024, 12:29 AM)Miranda0315 Wrote: /opt/ofbiz/runtime/tmp/AdminUserLoginData.xml
Hi I find current password in here with SHA encrypted
I don't know how to decrypt it, and not sure if it's the right way

Its not possible to decrypt it without knowing the SALT

we know the salt.

but we also need to figure out what apache ofbiz hashcrypt does first ...

samfisher010 · Jan 07, 2024, 01:02 AM

(Jan 07, 2024, 12:59 AM)peRd1 Wrote:
(Jan 07, 2024, 12:37 AM)tororo123 Wrote:
(Jan 07, 2024, 12:29 AM)Miranda0315 Wrote: /opt/ofbiz/runtime/tmp/AdminUserLoginData.xml
Hi I find current password in here with SHA encrypted
I don't know how to decrypt it, and not sure if it's the right way

Its not possible to decrypt it without knowing the SALT
we know the salt.

but we also need to figure out what apache ofbiz hashcrypt does first ...

yoo that path doesn't exist in my machine
/opt/ofbiz/runtime/tmp/AdminUserLoginData.xml

artifice · (This post was last modified: Jan 07, 2024, 01:09 AM by artifice.)

(Jan 07, 2024, 01:02 AM)samfisher010 Wrote:
(Jan 07, 2024, 12:59 AM)peRd1 Wrote:
(Jan 07, 2024, 12:37 AM)tororo123 Wrote:
(Jan 07, 2024, 12:29 AM)Miranda0315 Wrote: /opt/ofbiz/runtime/tmp/AdminUserLoginData.xml
Hi I find current password in here with SHA encrypted
I don't know how to decrypt it, and not sure if it's the right way

Its not possible to decrypt it without knowing the SALT
we know the salt.

but we also need to figure out what apache ofbiz hashcrypt does first ...

yoo that path doesn't exist in my machine
/opt/ofbiz/runtime/tmp/AdminUserLoginData.xml

try find / -iname AdminUserLoginData.xml 2>/dev/null mine was in a different folder

samfisher010 · Jan 07, 2024, 01:17 AM

(Jan 07, 2024, 12:59 AM)peRd1 Wrote:
(Jan 07, 2024, 12:37 AM)tororo123 Wrote:
(Jan 07, 2024, 12:29 AM)Miranda0315 Wrote: /opt/ofbiz/runtime/tmp/AdminUserLoginData.xml
Hi I find current password in here with SHA encrypted
I don't know how to decrypt it, and not sure if it's the right way

Its not possible to decrypt it without knowing the SALT
we know the salt.

but we also need to figure out what apache ofbiz hashcrypt does first ...

https://nightlies.apache.org/ofbiz/stabl...Crypt.html

chillywilly · Jan 07, 2024, 01:44 AM

rooted \0/

rorotet · Jan 07, 2024, 01:45 AM

(Jan 07, 2024, 01:44 AM)chillywilly Wrote: rooted \0/

drop a hint pls :)

chillywilly · Jan 07, 2024, 01:46 AM

derby .dat

shadow0exe13 · Jan 07, 2024, 01:49 AM

(Jan 07, 2024, 01:46 AM)chillywilly Wrote: derby .dat

if u dont mind can u tell how did u think of it
feeling stupid not goona lie

arilea_blackspear · Jan 07, 2024, 01:55 AM

derby is the DBMS used, my guess is the admin hash in one of the DAT files, crack it then login through the web portal, see whats interesting and go from there. Im too lazy to do anything rn lol.

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	457	121,787	23 minutes ago Last Post: jiqmug
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	166	34,845	2 hours ago Last Post: meomeothantai
	CC,CVV,VBV,NON VBV ,DUMPS ,FULLZ,BANK LOGS (FULL INFO) BEST LINKABLES @RICKBUTLER	Ballerwailer4G	0	75	6 hours ago Last Post: Ballerwailer4G
	[FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags	Techtom	110	14,313	11 hours ago Last Post: Kazahk
	[FREE] HackTheBox All Cheatsheets	Tamarisk	85	11,298	11 hours ago Last Post: Kazahk