Sep 04, 2023, 02:24 PM
Foothold
- Identified what is running bts?, now all you're missing is the right wordlist. Since it's an easy machine you know where to look for
- Does the cookie value reminds you of something?
- Logged in ?, there is a vulnerable parameter which is really obvious, burp and google is plenty.
- You can enter a command without spaces, also for shell, you can actually download the payload somewhere and execute it
User
- Use Pspy and the large file given to you contains exactly what you need in plaintext.
- Which file in linux system gives you a list of all usernames?
- SSH
Root
- What is the first thing you do normally when you do ssh with a pass.
- GTFOBINS.
- Identified what is running bts?, now all you're missing is the right wordlist. Since it's an easy machine you know where to look for
- Does the cookie value reminds you of something?
- Logged in ?, there is a vulnerable parameter which is really obvious, burp and google is plenty.
- You can enter a command without spaces, also for shell, you can actually download the payload somewhere and execute it
User
- Use Pspy and the large file given to you contains exactly what you need in plaintext.
- Which file in linux system gives you a list of all usernames?
- SSH
Root
- What is the first thing you do normally when you do ssh with a pass.
- GTFOBINS.