About CHEWBACCA host

This site is best viewed in a modern browser with JavaScript enabled.

admin

Hello community !

We understand some of you were having issues with CHEWBACCA and we decided to lower the bar just a little and the password shouldn't be that hard to brute force now

Please let us know if you are still running into any issues !

max

hi! i'm working on this machine for days now...i think i'm missing something simple here. I found several SQL injections (some of them are not the reported ones), and I found a couple of XSS as well. I was able to grab all the databases even read some files (but the apparmor kicks in on several files, I could grab the passwd but the /etc/shells I could not). Now i'm stuck, i just don't know what to do next, i cannot reach RCE.

Can you give me a little nudge?

thanks!

max

jimbo

I too have spent ages on this one now and run out of ideas. The hint says "From a brute force to SSH session" so I have found and used one published SQLi exploit, however for me the database enumeration fails after collecting partial information (multiple HTTP error codes, bad request), so gave up on that.
Then I turned my attention to bruting the password in the login page, that I was able to get and then log into the service.
However if I try to use this password to SSH in, having tried with various users, I am not successful.
So my question is what am I missing?

rustyxerdrum

jimbo
Hi Jimbo,

You try to this https://packetstormsecurity.com/files/135585/UliCMS-9.8.1-SQL-Injection.html?
How long the bruting pass length?

Thanks
Bye
Rusty

jimbo

Thanks Rusty,
I had been using the SQLi from the link you mentioned.
So I have the application password hash out of the database the length is 129 chars, but as mention already I know this password and have been able to login to the application with it, from brute forcing a different way.
I have now also managed to get the hashes for the database passwords, for which one I have cracked (password length 4 characters).
When I try to SSH with either of the 2 passwords neither work.

admin

jimbo Try to explore functionalities inside the admin dashboard and see if you can find a way to upload a backdoor to the server and have it executed

jimbo

I got there in the end, hard work though.

admin

jimbo Nice !

l0zi0

Hi, I have problems with the word list. I don t manage to find the right one. Any hints? Thx

admin

l0zi0 Please email us instead, we don't want to ruin it for anyone else the password is common though.

l0zi0

OK. sorry for it. Which one is the right email address?
Btw, I believe not that common if rockyou with rules doesn't crack it

admin

l0zi0 Yes indeed, the password is inside "rockyou.txt" but have you bypassed the security mechanism that blocks you after several failed retries? also, the fact that the hosts are reset every 1 hour and each reset takes few minutes to complete .

The email is: support@practicalpentestlabs.com