[RedBlock]

One more box to enjoy
This one is gonna be medium box.
Author's github repo:
https://github.com/FisMatHack

1. user.txt

ssh [email=axel@10.10.XX.XX]axel@10.10.XX.XX[/email]
pass: aNdZwgC4tI9gnVXv_e3Q


2. root.txt
axel@cat:~$ su root 

pass: IKw75eR0MR7CMIxhH0

[PrinceTaksaka]

Intersting mate thx

[ShitWhiffler]

One more box to enjoy
This one is gonna be medium box.
Author's github repo:
https://github.com/FisMatHack

BackDropCMS does have an authenticated RCE, so I wonder if that'll be the topic for initial access combined with that repo in his GitHub. Just in case anyone wants to have it on hand: https://www.exploit-db.com/exploits/52021

[RedBlock]

One more box to enjoy
This one is gonna be medium box.
Author's github repo:
https://github.com/FisMatHack

BackDropCMS does have an authenticated RCE, so I wonder if that'll be the topic for initial access combined with that repo in his GitHub. Just in case anyone wants to have it on hand: https://www.exploit-db.com/exploits/52021

Yeah it might be the way, let's see.

[saul]

One more box to enjoy
This one is gonna be medium box.
Author's github repo:
https://github.com/FisMatHack

Thanks for sharing friend!

[RedBlock]

Time to start!!!!

[oahofat]

cat admin.php
<?php
session_start();

include 'config.php';

// Check if the user is logged in
if (!isset($_SESSION['username']) || $_SESSION['username'] !== 'axel') {
    header("Location: /join.php");
    exit();
}

[maggi]

http://cat.htb/.git/config

its forbidden but you can still use git dumper

[Globules]

axel2017@gmail.com
axel

backup emeil for google account : axe••••••@hotmail.fr

[0xdaniii]

cat admin.php
<?php
session_start();

include 'config.php';

// Check if the user is logged in
if (!isset($_SESSION['username']) || $_SESSION['username'] !== 'axel') {
    header("Location: /join.php");
    exit();
}

how you got this