[hellme]

The web application has a vulnerability that allows for uploading tar archives. The exploit works by uploading specially crafted tar files that contain symlinks pointing to session files on the server. By predicting future session IDs through timestamp hashes and overwriting them with fake admin session data, 

However, I'm unable to retrieve the admin session ID. Could there be any specific factors or protections preventing this step from succeeding?

[sdksdk]

We were discussing this challenge on another thread. If you want to understand this further I recommend you visit it. (Search for Desire HTB on the forum)

If not here you go.

Link: https://defuse.ca/b/kdNBXbUv Password: DesiresHTB

The times depends on your location and so on. I first did a ping to the server eg:

PING 94.237.53.146 (94.237.53.146) 56(84) bytes of data.
64 bytes from 94.237.53.146: icmp_seq=1 ttl=56 time=35.3 ms

The more accurate the times between easier will be to achieve it, but keep running ping some time util you can get the average time then craft the command like this.

-u http://94.237.53.146:44659 --brute --start 0.035 --end 0.050 --step 0.001 -d 2

It should work and keep trying until the all attempts are failed or the flag is retrieved.

[rathultimate]

That one did not work for me , im just wondering what went wrong