[marco1337]

thanks for this bro, the credits are really worth it

[B00by]

thanks for sharing. I unlocked this content after i solved the box to find out some questions ...
In nearly all groups we can read the Password for user wao. My question is what's the right way to get the password from wao.

Maybe someone can explain this. Thx in advanced

[Shoseathe]

Great writeup! Seems too easy for a insane box though. Thanks for the share and the fair two points price.

[whitedevilkali]

thanks for sharing. I unlocked this content after i solved the box to find out some questions ...
In nearly all groups we can read the Password for user wao. My question is what's the right way to get the password from wao.

Maybe someone can explain this. Thx in advanced

thanks for apprcission
ok listen
after getting the rev shell through bio you see all the users also you see web dir in that powershell
in that web you obseverve

this

custom_prompt> cd .. custom_prompt> custom_prompt> pwd Path ---- C:\ custom_prompt> dir     Directory: C:\ Mode                LastWriteTime        Length Name                                                                  ----                -------------        ------ ----                                                                  d-----        11/5/2022  11:58 AM              PerfLogs                                                              d-r---      10/16/2024  9:13 AM              Program Files                                                        d-----        2/15/2024  1:04 PM              Program Files (x86)                                                  d-----        2/12/2024  5:25 PM              tmp                                                                  d-r---        3/2/2024  2:39 PM                Users                                                                d-----        2/25/2024  4:42 PM              Web                                                                  d-----      10/16/2024  10:24 AM            Windows  custom_prompt> cd Users custom_prompt> dir     Directory: C:\Users Mode                LastWriteTime        Length Name ----                -------------        ------ ---- d-----      10/18/2024  11:20 AM                Administrator d-----        3/2/2024  2:39 PM                Choco.L d-----        2/12/2024  6:19 PM                John.D d-----        2/28/2024  1:17 PM                Nya.R d-r---        2/12/2024  2:29 PM                Public d-----        9/13/2024  2:31 AM                Rose.L d-----        9/14/2024  9:36 AM                WAO

custom_prompt> cd .. custom_prompt> cd web custom_prompt> dir     Directory: C:\web Mode                LastWriteTime        Length Name                                                                  ----                -------------        ------ ----                                                                  d-----        2/25/2024  4:53 PM                DB Backups                                                            d-----        2/12/2024  4:54 PM                nginx-1.24.0                                                          d-----      10/29/2024  2:03 PM                University

custom_prompt> cd "DB Backups" custom_prompt> dir     Directory: C:\web\DB Backups Mode                LastWriteTime        Length Name                                                                  ----                -------------        ------ ----                                                                  -a----        1/25/2023  12:03 AM          24215 DB-Backup-2023-01-25.zip                                              -a----        2/25/2023  12:03 AM          24215 DB-Backup-2023-02-25.zip                                              -a----        3/25/2023  12:03 AM          24215 DB-Backup-2023-03-25.zip                                              -a----        4/25/2023  12:04 AM          24215 DB-Backup-2023-04-25.zip                                              -a----        5/25/2023  12:04 AM          24215 DB-Backup-2023-05-25.zip                                              -a----        6/25/2023  12:04 AM          24215 DB-Backup-2023-06-25.zip                                              -a----        7/25/2023  12:04 AM          24215 DB-Backup-2023-07-25.zip                                              -a----        8/25/2023  12:04 AM          24215 DB-Backup-2023-08-25.zip                                              -a----        9/25/2023  12:05 AM          24215 DB-Backup-2023-09-25.zip                                              -a----      10/25/2023  12:05 AM          24215 DB-Backup-2023-10-25.zip                                              -a----      11/25/2023  12:05 AM          24215 DB-Backup-2023-11-25.zip                                              -a----      12/25/2023  12:05 AM          24215 DB-Backup-2023-12-25.zip                                              -a----        1/25/2024  12:06 AM          24215 DB-Backup-2024-01-25.zip                                              -a----        2/25/2024  12:06 AM          24215 DB-Backup-2024-02-25.zip                                              -a----        3/25/2024  12:07 AM          24215 DB-Backup-2024-03-25.zip                                              -a----        4/25/2024  12:07 AM          24215 DB-Backup-2024-04-25.zip                                              -a----      10/14/2024  9:35 AM            386 db-backup-automator.ps1

Here WE HAVE SOME FILE HER CALLED db-backup-automator.ps1

custom_prompt> cat db-backup-automator.ps1 $sourcePath = "C:\Web\University\db.sqlite3" $destinationPath = "C:\Web\DB Backups\" $7zExePath = "C:\Program Files\7-Zip\7z.exe" $zipFileName = "DB-Backup-$(Get-Date -Format 'yyyy-MM-dd').zip" $zipFilePath = Join-Path -Path $destinationPath -ChildPath $zipFileName $7zCommand = "& `"$7zExePath`" a `"$zipFilePath`" `"$sourcePath`" -p'WebAO1337'" Invoke-Expression -Command $7zCommand

Here we have some password that refers to some zip file so already we have access to users so i tried that same password to all the users so it works for user wao
i hope you got it

happy learning
and once again thanks❤️

[hernandex]

Thank you very much.

[B00by]

thanks for apprcission
ok listen
after getting the rev shell through bio you see all the users also you see web dir in that powershell
in that web you obseverve

~snip~

Thank you for the detailed and good explanation. I really appreciate it!

[whitedevilkali]

thanks for apprcission
ok listen
after getting the rev shell through bio you see all the users also you see web dir in that powershell
in that web you obseverve

~snip~

Thank you for the detailed and good explanation. I really appreciate it!

give Reputation  if it was helped you

[xianling88]

Thank you for sharing this.

---

I think the machine will be patched. I don't think the scenario is that simple for an insane machine.

It has been going like this for a while, and not yet patched, so I started to wonder if this is the right path and the others are all rabbit holes to begin with that is also why this is called an insane machine? Also, maybe simply the author is not aware of this potato thing yet and eventually will be patched then, just I haven't seen any so called intended path around yet.

[VrxWqpKiQ7LSpX]

Thanks for that writeup, but I need to first earn some credits. What a dumb way to earn them. This is so f booooring the write a long ass comment......

[alexbobarszismyname]

Thanks! Can't wait to take a look. This box has my mind warped.