https://osiriz.dev/tags/boot2root/Recent content in boot2root on OsirizHugo -- gohugo.ioen-usSun, 06 Apr 2025 15:00:00 +0200https://osiriz.dev/posts/2025/04/ddc-2025-regionals-intranet-madness/Sun, 06 Apr 2025 15:00:00 +0200https://osiriz.dev/posts/2025/04/ddc-2025-regionals-intranet-madness/Challenge Description Danish (Original) Blækspruttespillene er i gang. De har sat en kommunikationsplatform op til deltagerne, og deltagerne yapper løs. Login med bruger: 456 og password: password, eller opret din egen bruger for at deltage! intranetmadness.hkn:8090 English (Chatgpt) The squid games are underway. They have set up a communication platform for the participants, and the participants are chatting away. Log in with username: 456 and password: password, or create your own account to participate!https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/We are given the following url: http://toolbox.hkn Visiting the site we see that it is a toolbox of network diagnostic tools. If we look at the ping tool we can see that we are able to run other bash commands by separating them with a ;: We sadly cant just read the flag: We can see that this is because it is owned by root and only root has read permissions: So lets upload a revshell so then try and privesc from there.https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/We are told that we can login over ssh at crontab.hkn using the username:password pair doomguy:doomguysEcReTpAsSwOrD, and to run tail -f read.sh.log. Logging in we are also told that crontab is running /etc/read.sh. So lets check the crontab, checking in /etc/cron.d/ we find execute-cron containing the line: * * * * * /etc/read.sh >> /home/doomguy/read.sh.log So the /etc/read.sh script is run every minute, lets check the permissions on the script:https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/We are given the website campfire-stories.hkn which looks like this: We can write the beginning of a story and the AI will continue it for us. Looking at robots.txt we get: # https://www.robotstxt.org/robotstxt.html # Maybe we should not train on company data? # Could our ftp credentials be leaked by the AI? # Probably not a problem. Nobody writes stories about ftp anyway # datacenter.campfire-stories.hkn should still be safe right? User-agent: * Disallow: / Allow: /$ Allow: /share/* Allow: /images/* Allow: /static/* Which seems to suggest that the AI bot can leak the ftp credentials, so let’s try: Convert Z3B0OTAwMA== from base64 gives us gpt9000, so lets login to datacenter.