Think you've got what it takes to outsmart the Hack Smarter Security team? They claim to be unbeatable, and now it's your chance to prove them wrong. Dive into their web server, find the hidden flags, and show the world your elite hacking skills. Good luck, and may the best hacker win!

But beware, this won't be a walk in the digital park. Hack Smarter Security has fortified the server against common attacks and their password policy requires passwords that have not been breached (they check it against the rockyou.txt wordlist - that's how 'cool' they are). The hacking gauntlet has been thrown, and it's time to elevate your game. Remember, only the most ingenious will rise to the top. 

May your code be swift, your exploits flawless, and victory yours!

Make sure you wait a full 5 minutes after you start the machine before scanning or doing any enumeration. This will make sure all the services have started.

IP Address: 10.10.206.48

First, let's try accessing the server's application at port 80.

Here under the #contact page, we see a username being displayed to us.

Other than that, there is no information that is useful to us.

Now, since there is no useful output from the Port 80 web application, let's try to access the application at Port 8080.

Here, we see an error saying 404 - Not Found, which means that the index pages or any of the related pages are not found, now, for this, let's fuzz for files.

Here we get some directories present in the server, but not much of an use to us.

after some time, looking back the PORT 80 application, I notice the reference of Silverpeas, which happened to be an application for contacting people.

I tried accessing the silverpease application in the port 80 application, but then failed, but, we could get a login page in the port 8080 page.

Here, we are greeted with the login Page of silverpease, we might have found the username as scr1ptkiddy, but we are supposed to find the password to this username.

And according to the challenge description, they have disallowed any passwords that have been breached, which means that we can't find any passwords from the rockyou.txt file.

So, to get some passwords, let' use cewl tool to generate some password using the contents of the Port 80 web application.

Now, using this wordlist, let's try to crack the password of the web application using ffuf

And Here we get the password:

With this password, let's try to log into the application.

Once loggedin to the application, we see no useful information to go forward, so, let's look for a public exploit for this application's service.
Reading through this blog post: Silverpeas App: Multiple CVEs leading to File Read on Server we find a suitable exploit to perform, to read all the messages of the user.

So, let's access the page. http://silver_platter.thm:8080/silverpeas/RSILVERMAIL/jsp/ReadMessage.jsp?ID=1

And Here we go!!!! With just a few ID's we get the required message!!!!!!!

Using this username and password, let's login into the ssh service.

AND WE LOGIN!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Here can find the flag.

Now, after a bit of deep recon on the file system and finding nothing out of order for to look at, we know that we have a user called tyler

And by running the id command, we see that our present user is a part of the adm group, let's see the files which are a part of this group.

Here we see that we have access to most of the log log files

while looking at all the log files, we see an interesting file part of the log, where we see a password of the root user to a docker run by tyler

Now, let's try this password to the tyler user.

Now, since the tyler user is a part of the sudo group, we can now shift to the root user.

Username: scr1ptkiddy
Password: adipiscing