i dont get it, any hint more?
How i can escape the final docker and be root in the machine some hints
No need to “escape”, just look around. There’s 2 ways to priv esc, 1 is intended and the other isnt 
(From Docker container)
I think I have looked everywhere except at the right thing! xD
Can you correct my course a little?
For intended path there’s a very noticable folder in root (/) directory in docker, you’ll need to look into it. (Specifically *.br files)
For unintended it’s a very common file for users (also in docker)
Hello please I have a problem. The malicious zip is uploaded successfully but I always receive this error.
GET request to http://shop.trickster.htb/themes/next/reverse_shell.php: 403
Ensure the zip file contains reverse_shell.php
Yeah, it contains. I will like to know if the requested link is correct
try not to unzip , modify then zip , zip does ignore .htaccess i guess , instead double click on the zip file and modify the reverse_shell.php with your ip port and the PoC will work
1 Like
I am in the docker container but I can’t find a way to root
does the datastore directory have something that will help me or should I look somewhere else
Yes, datastore contains the intended path
any hints of what should I do
check history = root@ae5c137aa8ef:/app# history
then you can come back to james@trickster:~$ su root
Password: (you will find it)
root@trickster:/home/james# ls -la
datastore has backups files compressed with brotli, decompress and you’ll get the passwd for adam, get shell as adam and exploit prusaslicer for root.
is there any point for dumping the .git directory? I can’t find a use for it…
You need to dump the git directory in order to find the admin path.
I cant find a hash in any of the files in these directories.
I have the admin path, but others are saying that they found a hash from the dumped .git files. I cant find anything like that. I was able to navigate to the admin dashboard login page, but I am stuck here.
you have to consider others may have no idea what they’re talking about
1 Like
Any hints for PrusaSlicer?
Is it the CVE-2023-47268? And is there an existing config file i can edit or should create a new directory for the Metadata?