[osamy7593]

guys i found selenuim grid on local 4444

---

we have now creds adam:adam gray

bootleg port scan  shows ftp is running on 172.21.0.1


dev_acc@intuition:~$ nc -zv 172.21.0.1 1-65535 2>&1 | grep -v refused
Connection to 172.21.0.1 21 port [tcp/ftp] succeeded!
Connection to 172.21.0.1 22 port [tcp/ssh] succeeded!
Connection to 172.21.0.1 80 port [tcp/http] succeeded

I had selenium up for a while and don't know what to do there sooo hopefully that proves more  interesting?

selenuuim is running on 4444 127.0.0.1 .. i used chisel for port farwarding i get a web page
 but i'm stuck ... on kali --> ./chisel server  7777 --reverse | on ssh --> ./chisel client 10.10.x.x:7777 R:4444:127.0.0.1:4444

[asdfplayer]

Anyone figured what to do with lopez user, how to get the auth_key for the json file? can't seem to brute force the md5 hash in the runner2 file

how do u become lopez ? any hint

---

Anyone figured what to do with lopez user, how to get the auth_key for the json file? can't seem to brute force the md5 hash in the runner2 file

check run_tests.sh you will get a pattern
can u provide the way to become lopez

[maggi]

guys i found selenuim grid on local 4444

---

we have now creds adam:adam gray

bootleg port scan  shows ftp is running on 172.21.0.1


dev_acc@intuition:~$ nc -zv 172.21.0.1 1-65535 2>&1 | grep -v refused
Connection to 172.21.0.1 21 port [tcp/ftp] succeeded!
Connection to 172.21.0.1 22 port [tcp/ssh] succeeded!
Connection to 172.21.0.1 80 port [tcp/http] succeeded

I had selenium up for a while and don't know what to do there sooo hopefully that proves more  interesting?

selenuuim is running on 4444 127.0.0.1 .. i used chisel for port farwarding i get a web page
 but i'm stuck ... on kali --> ./chisel server  7777 --reverse | on ssh --> ./chisel client 10.10.x.x:7777 R:4444:127.0.0.1:4444

I used ssh instead of chisel because I had a key, 
I am stuck on dev_acct and am looking around in runner.c so gears are starting to click but the engine isn't quite turning over

[asdfplayer]

vnc

ssh -L localhost:7900:172.21.0.4:7900 dev_acc@10.10.11.15 -i ~/.ssh/id_rsa_devacc -N

---

i wanna break out dev_acc : ) suggest hints ?

[asdfplayer]

check logs all of them

where do you find run_tests.sh?

ftp adam:adam grey@127.0.0.1
cd backup
cd runner1
get runner1
get runner1.c
ger runner_tests.sh
bye

cat runner_tests.sh
u will find the part of test key and you just need to mask the remain part and crack it with hashcat

please give me a hint how to break dev_acc : )

[osamy7593]

guys this is the auth key : UHI75GHINKOP but now what to do

[medo5120]

For everyone asking about how to get the files from FTP:
              ftp://ftp_admin:u3jai8y71s2@ftp.local/
Then just put the file you want after the /
              ftp://ftp_admin:u3jai8y71s2@ftp.local/{private_key}

but how do you enumerate the files? through the pdf page it's impossible afaik

[maggi]

vnc

ssh -L localhost:7900:172.21.0.4:7900 dev_acc@10.10.11.15 -i ~/.ssh/id_rsa_devacc  -N

---

i wanna break out dev_acc : ) suggest hints ?

ohhh thats looks like a hit of gold dust if I can find the pass

[mur]

This machine is insane, anyone got root? Im stuck with runner2

[osamy7593]

vnc

ssh -L localhost:7900:172.21.0.4:7900 dev_acc@10.10.11.15 -i ~/.ssh/id_rsa_devacc  -N

---

i wanna break out dev_acc : ) suggest hints ?

ohhh thats looks like a hit of gold dust if I can find the pass

bro we can use chisel for port forward