[androidhacker1337]

Initial Foothold:

Decompile the .apk file and look through its files, you will find an admin JWT token and 1 subdomain in /res/xml/network_security_config.xml. Go to that subdomain and enter the JWT you just found there and utilize the read logs api to read shirohige id_rsa and get on the box!

Root Priv Esc:

For root priv esc, you'll find hashes in ~/projects/mywallet/Instant-Api/mywallet/instance/instant.db, crack them and you'll get a hit on shirohige password (shirohige:estrella) then looking at /opt you'll find /opt/backups/Solar-PuTTY/sessions-backup.dat you need to decrypt it and retrieve passwords from it using https://github.com/VoidSec/SolarPuttyDecrypt (You'll need a windows machine). Run this command and you'll find root password .\SolarPuttyDecrypt.exe .\sessions-backup.dat estrella

Root password: 12**24nzC!r0c%q12

Hidden Content

You must register or login to view this content.

[androidhacker1337]

This is the best solution try it BUMP

[mothertaster]

i can't find the xml folder