red-teaming-path

[frigid forum]

🥳

[pseudo mist]

[frigid forum]

For Ticket Event related inquiries, please use the #1017019049181450291 channel (in the Support section).

[lethal creek]

Hey! I need some help with setting up the page at Gophish. I cant get the html code to work 😦

[potent crest]

Hi all . Im at Red Team Fundamentals, Red Team OPSEC Room.

I quite lost/confused even after reading the hint for task 7. What do they mean four question ? Arent there 5 ?

okay, i geddit 😂 now i know why there's 4 question.

[obtuse bone]

I signed into Discord this morning about the same exact question! Admins, I think you need to re-word this one...

[royal void]

oh wow they now include some network rooms on paths.....

[tropic ginkgo]

i hate this question

[white wharf]

Wtf are "White Cards"

Can't find a reference anywhere or I'm just a bad googler

[white prairie]

I mean AD is a fundamental element to most red teams. And a network is the best way to learn AD 🙂

[royal void]

true

[potent crest]

hahahah so its not me

because i was so lost at the question. and yeah i think that task question have to re-structure abit

[brisk path]

“red team white cards” comes with plenty of references

[white wharf]

Yep, bad googler. Thank you so much

[thin iris]

Gave +1 Rep to @brisk path

[royal void]

white team red cards not so much

[frigid forum]

A good example of a white card is in the case a threat simulation calls for the use of 0day vulnerabilities. In most cases there are none available to a red team, so the use of it is simulated (as if it was used) in a particular attack scenario.

[marble knot]

Lol yeah the content has been really good but that question was beyond confusing. I just bruteforced the answers and still they don't make sense to me what they are asking for

[thick pelican]

In the Intro to C2 room on Task 6 I am only able to get the NTLM hash of the Administrator user and not Ted

Any ideas as to why this is happening

I'm in a Meterpreter shell and can get the other hash and flags fine

I used the 'Registry Method' to get it to work

Using 'hashdump' in a meterpreter shell like normal didn't work for me

[thick pelican]

This is the only question that I need to complete the room 😢

[rose cedar]

can someone help me at this quesstion?

is not |||spear phisinh|||

?

[thick pelican]

heres some proof i guess

[royal void]

nope check the navigator... there is another thingy

[royal void]

shadow recommends you check the hint and check navigator too

[royal void]

have you opened a shell as ted and then ran hashdump??? or using meterpreter and kiwi

[celest vessel]

also, make sure to scroll enough! everything related is highlighted so it should be doable to find it 🙂

[languid surge]

am i the only one having trouble on Task 7 in "Red Team Threat Intel"? I cant seem to find the correct answers/order

[sly ibex]

am i doing something wrong or is there a bug in Post Compromise - Enumeration task 3

it says the version number is incorrect

nvm i forgot to do ssh lmao

[celest vessel]

You found it already?

[languid surge]

na sadly not

[celest vessel]

It is pretty "simple"

Use the Att&ck navigator

Search for APT41

And then match the TTPs to the chain

if that's the one where you are stuck at least

[languid surge]

Yeah im already on the "map" of APT41 on Att&ack and tried to search for the Words in the Hint but i only managed to find 3 of them in APT41 and if i just fill out the other 2 it says something is wrong

[celest vessel]

in the top bar you see the different categories

those categories match the table

[languid surge]

yes exactly thats how i found the 3 words but i cant find the others

[celest vessel]

If you have all APT41 highlighted you should have multiple options to be honest

[celest vessel]

You got it @languid surge :p

[languid surge]

not yet ...5/6 now and the lolbas thing is missing ... Hope i got more luck tomorrow 🥲

[celest vessel]

can I DM you?

[languid surge]

sure

[peak prism]

Hi, I'm trying out this new path and I can't understand what's wrong with this crunch 5 5 -t 'THM@!' -o tryhackme.txtas an answer to the password attack room in task 4

I ran it locally and it does what is expected

[royal void]

it is asking you to use the one for generic symbols to be used not just those 2 specific ones

[hollow knoll]

I am lost with one instruction on this room: https://tryhackme.com/room/redteamthreatintel

To use the ATT&CK Navigator: navigate to the groups summary page, next to "Techniques Used," navigate to "ATT&CK Navigator Layers," from the dropdown navigate to "view." An ATT&CK Navigator layer should have opened with the selected group's TTPs highlighted in a new tab.

[royal void]

@ - lower case alpha characters

, - upper case alpha characters

% - numeric characters

^ - special characters including space

[hollow knoll]

Referring to: https://mitre-attack.github.io/attack-navigator/

Where do I find the "groups summary page"?

[royal void]

first you go here: https://attack.mitre.org/

then you click groups

then search for the group name using ctrl + f

then check a bit down the page under the box and there is a button for opening navigator

[hollow knoll]

It's a bit confusingly phrased when the hyperlink in the sentence before this one reads "ATT&CK Navigator" and points to https://mitre-attack.github.io/attack-navigator/.

Thanks for clarification.

[royal void]

no problem.... hopefully you can answer the questions now

[hollow knoll]

Yup I am unstuck now 🙂

[peak prism]

Understood! I didn't get the question right. I'll try to generate it using special characters

[manic shadow]

Hello

Can I get some help :)

My last final question and yes I did Google but 😅

[nimble seal]

It is in the text above 😉

[manic shadow]

Ahh

Still not found

[nimble seal]

Have you tried ctrl+f to search the answer ?
I cannot give a better hint than suggesting you to read the paragraphs above once again

[pseudo mist]

Look for ||Operators are also expected to||. It's in that sentence

[snow lantern]

should be a fun weekend ahead with this new path 🙂 but its kinda double edge sword by having some of these rooms done already in regards to the getting the tickets

[snow lantern]

def aint resetting all the AD rooms haha

[manic shadow]

omggg i got it

i should of used the number 3 insted of three

oh my dayysss

i love u Robert

[snow lantern]

the asterisks are there 🙂

[pseudo mist]

the answer format (number of stars in the box) is an important thing

[manic shadow]

thanks so much

[pseudo mist]

I know what you mean... Luckily i haven't had time to do all of the AD rooms

[snow lantern]

they are all great but too much time to go through again

[formal yoke]

Anyone having a difficult time finding the answer to the LOLBAS question in Task 7 - Creating a threat intel driven campaign?

[pseudo mist]

which room?

[formal yoke]

red teaming - red team threat intel

[pseudo mist]

Have you looked in the MITRE link?

[nimble seal]

I had some difficulties too, but I searched on the web

[formal yoke]

Yes, I may just be searching the wrong material gonna go at it for a bit for before moving on

[formal yoke]

I could not find a direct answer or a push in the right direction, might have to take a break and revisit it

[pseudo mist]

You're looking for ||Technique T1105 in there|| . Knowledge of https://lolbas-project.github.io/#/download can also give you an idea of what you're looking for in the future

(very useful website)

[formal yoke]

Gonna use your spoiler as a last resort, I've looked on github for a few minutes. I'll look deeper. Your input and advice is greatly appreciated

[formal yoke]

Got it! Thanks!

[thin iris]

Gave +1 Rep to @pseudo mist

[jade flume]

Hey friends I have been battling with this for hours I’m not really sure what they ask us to do, can someone please give me some sort of idea

Number 1

[final lotus]

I can't enter the room at the moment but I think you need to enter the technique names as per the table in the top of the screen shot

try using those and put them in the correct order

[jade flume]

Thanks friends I figured it out

[final lotus]

great 😄

[glossy sandal]

So shadow recommended this order. After what pathway should I start doing red teaming path?
#pre-security-legacy-path 
#974406074444685322 
#junior-pentester-path 
#pentest-plus-path
#web-fundamentals-path 
#offensive-pentesting-path 
#791764435991658556

[jade flume]

Hello friends please can someone take a second to explain what we are suppose to be doing here ? Just find it so hard to understand what the question is

Would appreciate as much hint I could get thanks

[nimble seal]

You have to associate "Knowing that their company..." to "Assess risk" (4), "This will depend on the company and the blue team" to "Apply appropriate countermeasures"(5) and so on
But it doesn't make sense to me honestly

[thorny marlin]

Typo on OPSEC page @elder olive

[rough owl]

Anyone else having issues with GoPhish constantly spinning?

[muted rapids]

yeap having the same issue :/ the infinite loading of death

[rough owl]

ok just checking. I was excited to use that tool too lol

[muted rapids]

samee! it looks really cool ^^

[rough owl]

I just went ahead and downloaded the installation to my linux machine.

[potent crest]

forget about the hint, the hint was quite confusing.

look at the answer field , the first 2 number they give u is the right answer. so 1st bullet falls under RISK (4) and 2nd bullet falls under COUNTERMEASURE (5).

so you are left with Critical Information - (1), Threats - (2) and Vulnerabilities - (3).

So when reading the bullet point number 3, which number (1,2 or 3) do you think it falls to ?

something like that .

[potent crest]

yeah i agree. i really like the content they give for this one. so far i been learning a lot about red teaming engagement so far. anw i tried to bruteforce and it didnt work 😂 maybe i do it wrongly. took a coffee/smoke break and got a lightbulb from it. thats how i clear that question 😂

[agile yoke]

Can someone help me with this question in Room Enumeration Task 5- DNS question 1 , I use Dig to carry out a domain transfer, but it not return the flag ? any hint for this task, Tks all.

[robust skiff]

which room?

[wide parcel]

Hello, hope all are enjoying it

[agile yoke]

learning path Red-Teaming - Post Compromise - Room Enumeration- task 5- DNS

[robust skiff]

you need to use the right dns server

if you stuck, just read the task again

[fickle halo]

Just started the red teaming path

[gray hawk]

Trying to understand this, if armitage does not listen on loopback, then why does the example bind the port to the loopback address?

Intro to C2 room

[elfin saffron]

Can i get hint for these questions?

[potent crest]

Say you already set up teamserver on port 55553 on your C2 server, which is on 192.168.0.44. You can now use another unix machine (lets say 192.168.0.100) to access that armitage server that you set up by port forwarding.

The full command is 'ssh -L 55553:127.0.0.1:55553 root@192.168.0.44'

• Means: I want to Port forward port 55553 from 192.168.0.44 to my localhost which is 127.0.0.1 on port 55553.

So now, when you open another terminal in 192.168.0.100 and run ss -tulpn, you see that now u have access to your armitage server on your localhost 55553.

Feel free to correct me if im wrong. im always open to improve myself 🥳

[potent crest]

Look at the Mitre Attack Website on APT 41, there's a few way on how they transfer files.
Look for 'messages' in that page too for the 2nd question.

[tropic ginkgo]

Guys, I've been stuck on this question. Evading logging and monitoring lab for the past two hours.Please help me.

[gray hawk]

@potent crest I think I get it: the admin sets up the command shown in the example, but another team member would use the syntax you wrote in your example.

[potent crest]

Yes sir ! You can try it tho to understand better with hands-on ! 🥳

[pseudo mist]

If you have a look at Task 7, what kind of GPO logging is common? (If you're having trouble with this kind of thing i definitely suggest going back through the task/tasks and re-reading bits 🙂

[pseudo mist]

I'd recommend looking at the MITRE link. there's also a hint at #red-teaming-path message

[gray hawk]

will do!

[void cedar]

Hey guys, I am following along the "Intro to C2" room and i am trying to run armitage on my own laptop. I've started the teamserver and I've connected successfully, but when i try to start a listener in the armitage I am given an error in the console that says "Timed out while executing 'use exploit/multi/handler' last read = {data=, busy=false, prompt msf6 > }; current prompt msf6' " After that i am presented with two or three errors of the same kind. Does anybody have an idea how can i fix this. Thank you in advance.

[pseudo mist]

My guess would be connection issues. what OS are you using, and have you set up the VPN and tried to ping/scan the host?

[void cedar]

I am using Kali Linux 2022.3 . And no I've not started the vpn, yet, because I didn't think it was necessary to be connected to the THM server

[pseudo mist]

aren't you trying to exploit the VM in the room? I may be wrong as I ahven't done that room, but that's normally how our rooms work.

[void cedar]

I've not yet reached that part😄 . There is a task before it just to set armitage

[twilit quail]

Hello guys, maybe someone can explain about John the Ripper "Single-Extra rule", how to use it? Password Attacks room

[void cedar]

BTW I've decided to skip this step and go onto the next one. Surprisingly enough i was met with the same exact error but with a different listener 🥲

[forest cradle]

need some help with runtime detection task 6

I keep getting error

[sand arch]

In the Password Attacks section, part 4, question 2. I ran the crunch command in terminal to generate the list to produce what it wants, but it's not accepting it as the answer. Am I doing something wrong?

[twilit quail]

you made a mistake

[sand arch]

Gotcha .... any advice on where I messed up?

[twilit quail]

in Crunch command

[lean heron]

im stuck (not in a washing machine) but at the obfuscating challenge-8.exe

obfuscation principles

[pseudo mist]

That one made me laugh, what are you having trouble with?

[lean heron]

getting the flag

like getting rid of meaningfull identifiers

i dont understand maybe my brain is broken

[pseudo mist]

Walk me through what you're doing, how you've obfuscated, what you do to compile and anything you do after compilation (hint hint)

[lean heron]

so

i took the snip like they tell to do

i look and i think removed MFID

compile with mingw

to challenge-8.cpp to challenge-8.exe

nm + strip

and send it

wrong as it seems to be

so i retake the snip

and im lost

i dont know wtf im a doing

[pseudo mist]

So, you might want to chuck in some code flow and logic stuff, that does nothing except obfuscate, have you renamed variables, split up strings etc?

[lean heron]

NO

OK THANKS

I KNEW IT

no i didnt know

mayber im not obfuscating enough

@pseudo mist can you explain to me in a voice chat ?

[pseudo mist]

Sure, I'll head down ther now

[jade flume]

Hello friends I’m trying to solve the C2 room task 4 but each time I try to set up the machine using the preparing our environment instruction provided after the first start that have to do with starting postgresql…

When I try to run msfdb —use-defaults delete

I get an error is there anything I’m missing help mate

[potent crest]

@jade flume are u using ur kali or tryhackme ?

try to run sudo teamserver <your ip> <secret>

[jade flume]

I try to use my machine but have problems with the installation so I switch back

To attack box

I have to try this and see if it worlds thanks my man

[lean heron]

i now understand why you said that it will be more hard after the obfucations principles

im stuck on downloading the file because WD delete it

and i cannot download it from the web it said access denied

🤣

[pseudo mist]

oh, yuuuup, use SCP via openVPN directly into a machine that Windows Defender can't see (or set an exclusion for a folder, like there's the exclusion in the VM)

[lean heron]

sorry i just woke up im fucked up

i didnt thought about that

[royal void]

you almost have the correct command.... just 1 letter/character is wrong.... and it is in the ||THM^!|| part

[sand arch]

I appreciate the follow up, I was able to figure it out

[night tinsel]

Also struggling with finding the answer to the first one. Second one can easily be found with CTRL+F-ing the appropriate ATT&CK page

[royal void]

https://tryhackme.com/room/opsec task 7.... question 1.... shadow is super stuck.... any hints???

[royal void]

did you check the: https://lolbas-project.github.io/#/download website robert linked to???

[pseudo mist]

definitely helps to have the background knowledge for that one

[royal void]

or google/duckduckgo kung fu powers

searching for APT41 lolbas gives a few results

[pseudo mist]

Oh... That... The first bulletpoint is a risk (so 4), the second bullet point is a countermeasure (so 5), the third is a... We're looking at getting this re-designed

[royal void]

yeah understood what the first 2 was based on the hint and that the answer box kinda states it

just all the other combos after seem to not work even when shadow thinks they are right

so they just left and decided to do command and control instead

after watching a video about cheese to calm down

[pseudo mist]

I can send you a DM, but it's basically gonna be the answers, as that isn't an easy one to explain

[royal void]

if you want to you can do that.... shadow would not mind.... better then trying all the combinations through brute force

+rep @pseudo mist

[thin iris]

Gave +1 Rep to @pseudo mist

[lusty galleon]

When you do the --rules in john and run it what is the syntax to out put that to a file?

[pseudo mist]

if you run man john it should tell you, or maybe john -h?

[lusty galleon]

I am not seeing it in either one

[royal void]

--stdout

then | tee blah.password.list.txt

[lusty galleon]

Thank you! I totally forgot about | tee, but I just used > list.txt and it worked also. Thanks again.

[thin iris]

Gave +1 Rep to @royal void

[royal void]

no problem

and yeah remembering the stdout parameter/option/flag to output is kinda tricky

though you can grep for it

[lusty galleon]

Well, I read that and was trying it but I was obviously using it wrong lol.

[tropic ginkgo]

thanks

[thin iris]

Gave +1 Rep to @pseudo mist

[dense trellis]

I see, so many guys got red teamer titles

[tulip igloo]

anyone had any issues so far in the "Phishing" room with the GoPhish machine just getting hung with a loading animation? (not nginx error) have already tried clearing cache/history and multiple web browsers as well as re-deploy of the machine. loading animation is on every page

[rustic dock]

on the obfuscation task 7 Arbitrary Control Flow Patterns, the sample code doesn't compile because of a syntax error with case.
The line is
" for y in case_1:
match swVar: <<--
case 1:"
"
and the error basically says invalid syntax. I tried other versions but it didn't work.

I ended up changing to an if elif and got the flag but IDK if there is something obviously wrong

[agile yoke]

same issue, i cannot add new profile , loading animation all page

[rustic dock]

I had that issue yesterday. I honestly can't remember if I used open vpn and a browser page or if I pressed the view in full screen arrow. Probably open vpn.

[tropic ginkgo]

On Evading Logging and Monitoring Lab I got this error. I am on the final stage.I did all the steps 5 times.but didn't understand. I have been doing this for four hours now.

[lusty galleon]

can I dm someone about password attacks task 9? I don't want to post any spoilers.

[opaque iron]

What am I even supposed to do here? I have no clue

The hint is also very confusing to me

Room -> https://tryhackme.com/room/opsec ; Task 7

[lusty galleon]

They want you to put them in order. They give you the first 2 numbers so you have to figure out which number comes next. Make sure you put spaces in between each number.

[muted rapids]

been stuck on the DIY sandbox evasion challenge for about 4 hours lmao... Everytime I run my c++ script it does this, can't seem to figure out why

[marble knot]

Yeah it didn't make sense to me either. I just brute forced it because it gives you the first 2 numbers... so just put the other numbers in every order you can lol

[royal void]

want the answers???

or will you just brute force it like everyone else???

[muted rapids]

just realised I need to wait -_-

[crude burrow]

Had the same problem while I was connected using OpenVPN. If someone has this problem try connecting to the site using the attack box, it solved it for me

[dry snow]

need to arrange them in order

[agile yoke]

tks , using attack box , it solved

[tropic ginkgo]

Anyone already finished on Win10Office2016-Installed under Weaponization? I would like to know if you guys used the rdp to run the scripts? and where did you input the code?

-- answered my own questions

[marble knot]

I have had this VM running for about 15 minutes but it's just stuck on the spinning wheel of death. If I click "New Profile" or anything else - nothing happens. I have closed and re-opened as well as signed out and back in. Is this a common issue? I'll just try to reboot the VM in a little bit if it doesn't start working.

[agile yoke]

access link on Attackbox, it's OK

[open reef]

what happens after the 3 day access on the Breaching Active Directory room, do i just lose access to it forever?

[white prairie]

You can just join again. We do that to flush inactive users from the network to save resources

[open reef]

ok thanks a lot

[thin iris]

Gave +1 Rep to @white prairie

[winged isle]

None of the valid combinations work though

[pseudo mist]

Are you making sure they have spaces? I went through that yesterday and it worked. I agree that it isn't easy, but they do work.

[winged isle]

Had the spaces, but used enter to submit, which didn't work. After clicking submit button explicitley it did work, finished room, thx for your help

[thin iris]

Gave +1 Rep to @pseudo mist

[tropic ginkgo]

I got the flag in a different way but it says it's wrong.

[celest vessel]

I believe I sometimes struggle understanding the question correctly 😅

like this one: "What is the crunch command to generate a list containing THM@! and output to a filed named tryhackme.txt?" 😂

I literally spent half an hour on this question, the learning curve is present

[pseudo mist]

not all of those 1's should be 1's

[celest vessel]

How can I fix this issue on a Kali Linux machine?

this is for the dictionary attack on the hashfile

and where to run it then? :/

I am running Kali inside Virtualbox

the solution seems to be more simple by just assigning more RAM to the Kali machine

it takes a couple of seconds when you assign 8GB RAM to the VM 😄

[tight granite]

Hello fam, just started my red teaming path ! Any tip or suggestion for someone starting from almost 0

[pseudo mist]

If you're brand new the #junior-pentester-path might be suitable, it's aimed more towards beginners 🙂

[tight granite]

I’m subscribed to the website so looking for the best courses to start with

Gonna def check that

[celest vessel]

I would personally also recommend the complete beginner path

it contains lots of interesting basic concepts

[iron saffron]

true

[celest vessel]

because I am personally a bit surprised by the No prior knowledge for the read teaming path

if you dont know Linux commands it will be a difficult one

as well as understanding other basics

but again, this is my personal opinion

[primal basin]

It is recommended to complete the jr penetration tester path before red teaming

[feral sage]

I would also suggest do use the 'Easy' pathways first. (Pre security, Complete beginner, introduction to cybersecurity). Then proceed with the jr pentration tester OR the red team path.

[tight granite]

I appreciate ! Thanks

[thin iris]

Gave +1 Rep to @feral sage

Gave +1 Rep to @tight granite

[celest vessel]

I didnt get a rep 😢

[primal basin]

Into to c2 room, need help with armitage, I can't get meterpreter shell, i used metasploit for the same exercise and it was flawless, but the task says to use armitage.
I can use exploits i get direct shell , and can't run commands like hashdump, i tried using the post/windows/gather/hashdump module , i get incompatible shell type

[ornate hull]

What is the crunch command to generate a list containing THM@! and output to a filed named tryhackme.txt? can help me out

[potent crest]

@ornate hull the option is "3 letter word + special characters"

[ornate hull]

Thank you mate i got it i just tried in my kali machine

[thin iris]

Gave +1 Rep to @potent crest

[potent crest]

nice one sir !

[ornate hull]

i am doing it wrong

crunch 5 5 -t TMH^! -o tryhackme.txt

[pseudo mist]

You need to put THM(and symbols) bit in double Quotes, and that ! can also be any other special symbol.

[potent crest]

@ornate hull very close, replace the exclamation mark with something similar there

[potent crest]

^

[ornate hull]

crunch 5 5 -t "TMH"^ -o tryhackme.txt

[pseudo mist]

yeah, there's some flexibility on the answer as there's a regex to check if it's "right", but 3 characters out will defo be over 🙂

[pseudo mist]

the quotes should be around the symbol bit too

so crunch 5 5 -t ||"THM^^"|| -o tryhackme.txt

[ornate hull]

thank you

[potent crest]

yeah i realise that ! i think i did submit a single quote around it but fail. When i submit without the quote it work, but after reloading then i see they included the double quote already.

it was a rollercoaster ride for awhile 😂

[ornate hull]

sorry i was trying with TMH not THM

[potent crest]

trymehack doesnt work bro 😂 but honest mistake down there haha

[tulip pulsar]

Once you have the cmd.exe shell, you’ll need to escalate that shell to a meterpreter shell

[pseudo mist]

my bad 😄

[celest vessel]

aaah man, I am gonna be so mad if the password crack is wrong 😂

128 tries/min and there are 50k passwords to be tested

[pseudo mist]

https://tenor.com/view/confused-what-really-no-words-huh-gif-4487358

[celest vessel]

it is the online password room

[potent crest]

which task ?

[celest vessel]

or I am making an mistake 😅

[potent crest]

ahh im 4 task away from it

hahahah

[celest vessel]

task 8, the one where you need to make a rule-based dictionary

[pseudo mist]

as a rule of thumb, thm rooms shouldn't need bruteforce of longer than approx 5 minutes

[celest vessel]

tbh I followed the steps, made a list clinic.lst as said, make the dictonary adding 2 numbers + a symbol

[pseudo mist]

and that made 50k passwords? seems excessive. I may be wrong though

[celest vessel]

well .. I did use like 6 different symbols since the symbol itself wasn't shown

[pseudo mist]

just use crunch with the ^ symbol 😄

[celest vessel]

it still gives you a lot of options I believe 😛

[pseudo mist]

Hmmm, i see the hint is pointing you at john rules, so i may be wrong with crunch, but i'd probs stick to just the 4 used in the demo in Task 6

[celest vessel]

yes

I narrowed it down a bit to 20k options

ok, got it 😄

[pseudo mist]

that's a start 😄 I'll wait for someone who's done the room to chime in

[celest vessel]

cool exercise to be honest 😄

[brave sinew]

stuck at this point as well 😄 Did you manage the smtp password? I always get "[ERROR] SMTP LOGIN AUTH, either this auth is disabled or server is not using auth: 454 4.7.0 Temporary authentication failure: Connection lost to authentication server" This is not normal, right?

[celest vessel]

yes I got it

well it is normal

because you don't have the password yet

maybe your list is not well populated

Did you make a rule-based dictionary changing the john.conf @brave sinew

[brave sinew]

ah, this is basically the message for "wrong password"? for me the message sounded more like " hey your AUTH method will not work at all"

Then we have to wait some more decades. this is slow. (i used mentalist to generate a wordlist)

[celest vessel]

well to be fair

if you have the right dictionary

you should have it in less than a minute

[lusty galleon]

^agreed. Once you have the right dictionary it takes about .03 seconds to crack

[pseudo mist]

glad to hear it 😄

[lean heron]

https://tryhackme.com/room/signatureevasion

task 7 i dont understand shit 😭

how can i encode manually to set my host my port and the runshell

[brave sinew]

confused My wordlist from task 7 has 105 entries. the rules multiply it with 200. and i test ~100/min.

[pseudo mist]

If you're Trying to post a screenshot, you'll need to verify

!docs verify

[wind bone]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[buoyant fog]

ahah ye

I'll do it

ty

[lusty galleon]

So I got stuck on this for a while also. I kept changing my rule and building out different password lists until I got it. My final pass list was only about 20 words.

I don't know how much of a hint or bump you want or I am aloud to give on here.

[buoyant fog]

So, as I said, I’m doing Active Directory Basics, at Task 4 where we have to found the flag on Sophie’s desktop. When I’m trying to Connect to sophie account I get this :

[brave sinew]

ahh wait. I think I missunderstood the task. Thanks, will try a bit more 🙂

[buoyant fog]

Have I done something wrong ? ^^

[pseudo mist]

Are you connecting from the attackbox/your own VM, or from the windows machine in the task (this one probs won't work)?

[buoyant fog]

windows machine

[unique quiver]

First exit out of Phillip rdp^

[buoyant fog]

oh ye I'll try that

[pseudo mist]

The in-browser machine counts as a RDP session, so connect from another machine

[buoyant fog]

ty 🙂

it works, thx

Have a nice day all !

[feral sage]

I'm currently in the Network Evasion -> Firewalls room. Stuck at task 7. I'm not pretty sure how to setup the port tunnel, someone has some hint? (pm also possible)

[valid flax]

in "Introduction to Windows API", Task 7 q "What type of method is used to reference the API call to obtain a struct?"
I can't find answer to this? Is the answer available in the Task 4 content or I have to read MS docs to find the answer.

[pseudo mist]

It is available in the task 4 content, the shortened version of it is highlighted as code, but it's towards the end of the sentence.

(and yes i feel like i'm writing riddles trying no to give it away entirely 😄 )

[primal basin]

O thanks

[thin iris]

Gave +1 Rep to @tulip pulsar

[celest vessel]

did it work already?

[vernal jetty]

Not all rooms are free right?

[pseudo mist]

Correct, About 80% of rooms on THM are free, but that percentage may not be representative of a path.

[brave sinew]

YES :). Just wanted to say I reduced the wordlist to likely passwords and it didn't help, but my larger WL finally suceeded. Didn't expect this password to be the solution 😄

2 more passwords to go in this room

[celest vessel]

yes I am working on the last one 😄

[potent crest]

Task 9 for Password Attacks Room.

Any hint for the year and special characters ? 😂 I already tried 2021 and 2022 with !@#$ as special character. Am i missing something here ?

[celest vessel]

I need to start task9 😂

🥳

[potent crest]

@celest vessel lets go

[celest vessel]

you found it?

[potent crest]

still trying

ahh i actually got, just that it didnt stop when found the password

i fixed it

hahahaha

[long robin]

yall im in sandbox evasion room and unable to compile cpp files, all it displays is "attach". how are we supposed to compile it? im trying to compile a sleeper file into exe

[celest vessel]

did you make a list then @potent crest ?

[potent crest]

yes

i make a list as the hint suggested

• manage to play with some rules i learn in that room too.

[celest vessel]

hmm 500 tries, no hits

[potent crest]

shdnt be more than 200

How u craft ur password list ?

[celest vessel]

with john

[potent crest]

okayokay

just share u problem here later if u are still stuck

[celest vessel]

got it, something with capital and non capital letters 😂

[potent crest]

yes

😂

[celest vessel]

going to take a break 😄

[long robin]

fixed it

[ornate hull]

i need help or a hint in rule based the last one

"S[Word]NN

[potent crest]

@ornate hull - @pseudo mist assist you by giving the spoilers already

[ornate hull]

@potent crest I will figure it out

[potent crest]

https://discordapp.com/channels/521382216299839518/1017053384441868418/1017779778876624936

[signal warren]

does any one completed sand box room
dm me plse

plse helpppppppppppppppppppppppppppppppppppppp

[potent crest]

Task 5 - Phishing Room, is the website lagging ?

[iron saffron]

More people are getting on so could be the case

[tropic ginkgo]

I require help with task 7, flag 14. Can anyone assist me?

[echo ore]

There's a lot of questions already solved in #999008613102260275 🙂 If you can't find a solution to your problem, just drop a line there and I'll help

[grizzled viper]

Hi, i need help in understanding what i need to do in a Task, dont whant any answer but my english is not the best and i have not figured out what i need to answer in the web page.

Its in Red Team Threat intel - Task 7, the web site

[wanton nacelle]

Check out the hint!

[grizzled viper]

Thank you, i think i overthinked it

[thin iris]

Gave +1 Rep to @wanton nacelle

[wanton nacelle]

Happy to help!

[manic shadow]

@jade flume hello

I just saw this and can u help me with those 3 questions, the picture is kinda blurry

[ornate hull]

open the APT41 page and read it thoroughly

[manic shadow]

okay 2 done , still stuck at this tho

[ornate hull]

@manic shadow it in APT 41 software table

[manic shadow]

This ?

[ornate hull]

@manic shadow Yes the

[manic shadow]

Alright if this is the right page to search in...

I seem to not be able to figure it out

[ornate hull]

@manic shadow it the ||ASPXSpy||

[manic shadow]

Thanks , I appreciate the help

[thin iris]

Gave +1 Rep to @ornate hull

[ornate hull]

@manic shadow Anytime mate

[brave sinew]

still missing the two http-form password attacks 😄 😦 So many options what rules to apply.

[celest vessel]

haha

are you still working on that one? 😄

I found the http to be a bit more simple

[brave sinew]

had a break with other things to do, but basically, yes 😦

[celest vessel]

I get you, I also took a break 😄

[brave sinew]

is the password format given in smtp task valid for the website = all passwords or just for this specific smtp password?

[lean heron]

even with the walkthrough it says false i dont understand

[lean heron]

22 WSAConnect 22WSAConnect False 58 WSASocketA 58WSASocketA False True 5A WSAStartup 5AWSAStartup False True A5 htons A5htons False

[celest vessel]

only for the specific smtp

[dreamy glacier]

Hi, can anyone assist pls to explain an answer in the Red Team Threat Intel Room Task 5 TTP Mapping question "How many Command and Control techniques are employed by Carbanak?" I got the answer by a process of elimination but in the mitre-attack data there are 16 C2 techniques listed - can't work out how the answer is determined. Many thanks

[native berry]

Not all of these 16 that are available are selected in the navigator

[royal void]

if you scroll up and down some of the boxes are highlighted in blue....

[dreamy glacier]

Thanks for the quick response. The penny just dropped for me as I was doing task 7. Appreciate the help.

[thin iris]

Gave +1 Rep to @native berry

[royal void]

ooh nice you figured out how it works

[dreamy glacier]

Thanks @royal void appreciate the help.

[royal void]

only 1 rep point giveaway every 5 mins... but yeah no problem

[native berry]

• @royal void

[thin iris]

Gave +1 Rep to @royal void

[native berry]

Always worried about the rep 😄

[royal void]

¯_(ツ)_/¯

[obsidian patrol]

Evening all

[molten summit]

Dropping something for people to find when searching. The GoPhish task in Phishing will spin. However, on your VPN system, go to the site https[://]YOUR.LAB.IP:443. It should load.

Doing the above will allow for completion of the task just fine. Happy hunting!

[obsidian patrol]

Thx answered my question before I even asked. Lol

[fresh harness]

Red Team Theat Intel --> Creating a Threat Intel Driven Campaign --> Kill chain site has 6 answer options instead of 7

Did anyone else answer those answer those questions?

[obsidian patrol]

@fresh harness start with weaponization

[molten summit]

I'm sure I did. Is that the one with the flow chart that you fill in the blanks for?

[obsidian patrol]

2-7 in kill chain

[molten summit]

The iconography is infuriating.

[fresh harness]

I did but it says, At least one of your answers is incorrect.

But thanks

[molten summit]

Just as a general tip, it's subtle, but you will find a red line under the ones you have wrong.

[obsidian patrol]

@fresh harness That question drove me crazy

[molten summit]

Ahh, you're supposed to look at the APT in the question and put down a technique they use into the correct blank.

[obsidian patrol]

@fresh harness hit hint tab

[molten summit]

So, if they use Scheduled Tasks for persistence, the answer would be Scheduled Tasks.

[fresh harness]

I see. Thanks.

[thin iris]

Gave +1 Rep to @molten summit

[jade flume]

Hello mate, I’m having problem with weaponization room, task 5 I have been able to make the calculator pop up but I’m trying to chain it with a reverse shell like it was instructed so I generated a payload with msfvenom but the issue is after getting the output and Saving it in Microsoft I could not open it I get an error, so I have few questions that I could appreciate anyone that could help me with it, do I have to save the file as document1 or doc to make it work and again do I have to include the extra payload in the document or just output of msfvenom only

[molten summit]

Just the output of msfvenom, I believe.
Also, there is one thing to change in the msfvenom output of the VBA script that they mention. Don't miss that!

[jade flume]

Just the output starting the #EndIf statement right ?

From ***

[molten summit]

From #If Vba7 Then
.....to....
End Sub

The last End Sub

[jade flume]

I get compile error mate

That’s from me trying to run it

To make sure it’s working from saving tho

Does that matter atall ?

Or do I just save and see if it works

[molten summit]

I'd say put what you get from msfvenom into the macro, nothing else in there. Save and re-open the doc.

[jade flume]

Thanks man

[molten summit]

Feel free to make multiple docs for each of those steps, like one that just starts cmd, and another doc that starts calc, and another with your reverse shell.

[jade flume]

Bingoooo

We are innn

Respect @molten summit

[molten summit]

And I think as a bonus, once you get meterpreter to connect and get a session, look up how to download files from c:\users\...page, and save your docs to your local system! 😄

Just note that you need two slashes for that command....Discord doesn't like that, though. C:\ \users\ ....

[jade flume]

Yes right I get the point you the man respect

[molten summit]

good luck!

[jade flume]

It work already thanks man

[obsidian patrol]

Doesn't work on port 443

[jade flume]

Weaponization room is one of the sleekest room I have ever done in my life

😍😩

[molten summit]

Be sure to use https.

[jade flume]

You mean for a real life sceneries ?

[molten summit]

Well, I mean yeah it's generally good advice, I suppose.

[ornate hull]

can any help me in password attacks on task 8 rule based event

[jade flume]

How do we do that ? Can I use python still ?

[jade flume]

I’m yet to do it mate I should be on it now

[ornate hull]

@jade flume done mate

[jade flume]

https://makendy-piton.medium.com/how-to-use-https-on-localhost-linux-87b1f10771e6

find this article it should be useful for others so I thought I could share…

[lusty galleon]

Anyone available for help on Windows Local Persistence Flag 17?

[jade flume]

I’m yet to get to that mate would have love to help

[lusty galleon]

No worries man it is kicking my a$$ right now.

[jade flume]

I need help mate password attack, task 4 I inputted, crunch 5 5 -t THM@! -o tryhackme.txt as the answer but it won’t allow so I change it to 7 7 THM@!%% but the problem persist is there anything I’m missing here

[jade flume]

Damn I can only imagine my man lol this is hacking for us

[hot drum]

Try cyberchef, if you’re having problem

I had the same issue

[lusty galleon]

You almost have it, everything is good with the 5 5 command except one thing. So go back and read there is a certain character you can use for "special characters". Then think about what you use to combine a string?

Sorry trying to give help without spoilers is not my strongest ability lol.

[ornate hull]

Task 9 in password attack season + year + special characters I am doing anything wrong

[winged briar]

Oooof

[celest vessel]

You have it?

Otherwise I might give a small tip

[winged isle]

Cannot get armitage running in room INtro to C2 Task 4. I am getting following error message when launching armitage:
Exception in thread "main" java.awt.AWTError: Can't connect to X11 window server using ':0.0' as the value of the DISPLAY variable.

I am running kali 2022.1 on a VMware Fusion on a mac m1

[queen badge]

Can sb helps me in the "Windows Local Persistence" Room flag13? Tried everything but didn't work

[charred vortex]

Hello, anyone having trouble with the Phishing room? I cannot get the GoPhishing to load properly. In dashboard the loading animation keeps on playing and I can't create any new profile/campaign

[ripe basin]

Hi,
I am stuck at Task 8 (Using MSSQL as a Backdoor) of Windows Local Persistence.
Does anyone know where should "evilscript.ps1" be located? At attacker or active machine? Thanks

[jade flume]

I think it should be the active machine

Hey mate I’m having problem understanding task 8 question, password attack room, what word list were they referring too when they said clinic.lst

Someone help

[ripe basin]

Noted & thanks

[thin iris]

Gave +1 Rep to @jade flume

[naive lily]

It is referencing the password list you create in Task 7 from clinic.thmredteam.com

[jade flume]

Damn thanks I get it now🫡

[thin iris]

Gave +1 Rep to @naive lily

[naive lily]

Did you get the hydra one done? Or stuck on smtp?

[jade flume]

I’m having issue generating the word list but I’m use too using hydra for brute forcing all sort of network services that should not be a probs on its own atall

[naive lily]

Task 7 gives you the exact command to generate the base wordlist. Task 6 answer is how you should modify that base wordlist to answer Task 8

Task 7 + Task 6 = Task 8

[tropic ginkgo]

I need help with task 2 on Signature Evasion lab. How can I split DD or split because Windows doesn't support these commands?
Port 22 is closed. How can I scp the shell.exe?

[jade flume]

Maybe setup a web server then you use powershell -c wget “http://yourIP:port/file_to_get

[tropic ginkgo]

how can I start a web-server on windows machine?

[primal basin]

Im on the phishing room, and the gophish website just skips spinning, not responding

[jade flume]

If you are trying to send from windows then it’s better to use pscp directory to file you are trying to send user@ip/directory_you_are_trying to_send_too

[tough basin]

.

[crystal sandal]

Maybe I'm missing something about how this documentation is written, but why is the date range labelled "engagement dates" not the answer for "engagement end", preferring instead the date listed for "post exploitation and persistence" (also why does this phase fall outside the engagement period?)

Red Team Engagements, task 7

[nocturne stump]

https://tryhackme.com/room/passwordattacks
task 8 question 2
i keep getting this error message
"/etc/john/john.conf" E212: Cannot open file for writing

[celest vessel]

Did you open the file with sudo?

@nocturne stump

[nocturne stump]

tired it with and without same error

[celest vessel]

Thats weird, is the file existing?

You def need root access to edit that file

[nocturne stump]

the folder does not exist /etc/john

[celest vessel]

Then you have found the issue

Try to reinstall john?

[nocturne stump]

tried to reinstall john now

trying

[celest vessel]

Ok 👍

[nocturne stump]

Thanks pope

[celest vessel]

No problem!

[nocturne stump]

thanks @celest vessel

[thin iris]

Gave +1 Rep to @celest vessel

[jade flume]

Try to change from command to windows powershell

Sorry for the late response

[nocturne stump]

am i doing this wrong?

[nocturne stump]

i sorted it

[crystal sandal]

Is there somewhere to post general feedback, just so it doesn't get buried?

The style of questions of the "view site" sections in this path so far are pretty confusing at best, this is a particular offender.

[molten summit]

Oh man, those questions were awful.

Just awful.

[celest vessel]

yes a lot of people struggled on those 😆

[crystal sandal]

It's not even clear what exactly it's asking

I would also like someone to acknowledge my previous question, if it is indeed an error

[celest vessel]

you have to match each response to one of those topics

each number is only to be used once

[molten summit]

It's probably a typo.

I mean, assumed it was.

[tropic ginkgo]

I tried in both cmd and powershell.

[molten summit]

Those questions could be slightly useful if it would pause after you get the right answer, so you can try to decipher wtf it's the right answer.

But as they are, that was a step back, learning-wise.

[crystal sandal]

Or make some kind of matching interface

[molten summit]

or just do each one at a time

[crystal sandal]

Instead of typing in a string to match statements together with no feedback, with poorly worded instructions

[crystal sandal]

This works, but I'm guessing there's a reason they departed from this being used in every other path

[celest vessel]

I believe a lot of people bruteforced the answers

to be fair, I also found it to be a very weird thing 🤔

[molten summit]

The first one or two I did, because I had no idea what was going on. Then when I tuned in, it still made no sense.

So yeah, I bruteforced them all and moved on.

[crystal sandal]

People understanding the content but not being able to answer the question seems like a worse alternative

people who bruteforce are still going to find the answer, or a guide

[celest vessel]

I am not sure what you mean but given that the first two digits are already shown, filling in the last three wasn't a hard thing to do

and a lot of people already posted comments about that section

[vast quest]

It's being redisgned.

[crystal sandal]

Scratching my head over this bit, didn't even realise it says "Coutermeasures"

*Covenant by Ryan Cobb is the last free C2 Framework we will be covering *
The section about sliver is after the section on Covenant, which is also free unless it's in the wrong section

[primal basin]

Has anyone completed the phishing room

[molten summit]

I am positive someone has, yeah

[celest vessel]

I am working on that one as we speak

[royal void]

yes what is your question???

[primal basin]

Task 5 using, go phish the website doesn't work none of the buttons work, I'm supposed to create a new profile

[molten summit]

For the GoPhish portal, don't use the public address/link. On your VPN system, go to the site https[://]YOUR.LAB.IP:443. It should load.

[royal void]

reload the web page.... after waiting a few mins for it to start up.... then it should work

[royal void]

the public link worked for shadow after letting it start up for 5-10 mins

[molten summit]

You have the patience of a creature of the night. 🙂

[royal void]

heh yeah that is a skill shadow developed when downloading games in their kid years..... steam game downloads on old dsl modems were slow as molases

[primal basin]

This worked thanks

[thin iris]

Gave +1 Rep to @molten summit

[primal basin]

Just tried it again, the public link still doesn't work

[royal void]

okay then.... guess it might be slow or buggy

[celest vessel]

I didn't encounter any issue with the website (opened in Kali while being connected over the VPN)

[molten summit]

I sort of suspect it the js may be referencing something on a private address, and if you stay fully remote it just spins until a possible timeout. I didn't bother to check too hard since I'm not THM QA. 🙂

[royal void]

oh yeah.... shadow had to disable some firefox extensions for it to work correctly

[molten summit]

ahh that's an even better idea probably.

[royal void]

mainly dark reader as everything else shadow has disabled for tryhackme domains by default

[devout kernel]

I am having trouble with this question been over the task and don't see the answer in there (What setting name that allows you to modify the Host header in a Meterpreter payload?)

[molten summit]

Google can probably fill in any blanks the room material has left out.

[royal void]

msfvenom -p windows/meterpreter/reverse_http --list-options
then read through the options and you should find it

[pure thorn]

am I the only one that ran into a brick wall in password attacks > online password attacks?

prolly took like 2 hours to get the http flag

still got nothing on the other 3

is the dictionary built with the "rule" [symbol][dictionary word][0-9][0-9] supposed to be ~500K words?

[mortal sparrow]

if anyone could help out that would be awesome, I'm not understanding where to find the Access Types?

[lean heron]

read it

just read and you will find

[mortal sparrow]

oh damn, I see it. I've been doing this too long today haha

[naive lily]

Which specific service on task 8 are u stuck on?

[pure thorn]

Was all of them

Had multiple sessions running for hours against burgess and pittman

Wound up finding the other with a lateral move from another task

Ftp was just available in browser, don’t think that was intended

[molten summit]

sort of, I believe browsers try to use an anonymous login silently.

or something like that.

[solar coral]

Anyone run into the issue of the Weaponization - Visual Basic for Application where the document is closing when attempting to reverse shell?

When doing all the other listed steps it works for loading Calc, opening the popups, etc, but copying and pasting the VBA script from msfvenom it closes before a reverse shell can open

[molten summit]

Did you catch that you needed to change one thing in the msfvenom output? Not sure that would cause closing behavior or not.

[solar coral]

Yeah, I even tested both in Excel and Word, both just crash out

I thought it was just a bad script made a new macro and it still loads, then crashes

[molten summit]

Only the msfvenom output is in the macro, yeah?

If so, you could maybe try to regenerate that, though I bet you already did.

[solar coral]

yeah I even attempted it in attackbox instead of my kali VM and it still crashed

[solar coral]

Already attempted both in Attackbox and my personal KaliVM

[molten summit]

boo 🙂

beyond that maybe recheck ports and IP addresses, but, even a bad connection shouldn't close the doc.

[solar coral]

I get a semi connection using nc -lvp 4444 and it connects but doesn't connect to meterpeter

[molten summit]

you're in metasploit to upgrade to meterpreter, correct?

[solar coral]

yeah

[molten summit]

or rather catch it and do the dance that is. hmmm

[solar coral]

it doesn't crash word when I use nc to listen but when I use MSFConsole after verifying a connection using NC and manually start the exploit it crashes word/excel

[molten summit]

does it crash pretty quickly or does it take a few minutes?

[solar coral]

It takes about 1-2 minutes before it crashes

[molten summit]

but not enough to get a meterpreter through and do any commands?

[solar coral]

nope, going to try the kali optomized to see if it is an issue as I recently updated my metasploit framework

but if it works in the kali instance on THM but not attackbox that is strange

[molten summit]

I wish you luck, I have no other ideas. Mine worked pretty well with kali 2022.03 defaults. I think the only thing that deviated from the instructions would be after successful connection and doing a run post/windows/manage/migrate to keep it up.

[winged apex]

@molten summithave you finished the active directory basics redteam room?

[solar coral]

Looks to be an issue with MSF6

[winged apex]

im stuck on https://tryhackme.com/room/winadbasics task 6 . i cant find the network share used to distribute GPOs to domain machines.
ive done all the gpo configuration and updated it and rdped like it asked. ive checked all over the gpo settings for it

[molten summit]

It's in the task materials/text.

[molten summit]

hmm well that's a bummer, but also nice to get an explanation.

[solar coral]

also no idea why/how? but it still crashes word as well even with msf5 but I'm actually able to get a connection but not to meterpeter in msfconsole unlike before

[winged apex]

i overcomplicated it @molten summit

[molten summit]

It's all good, I bet you learned a bunch. 🙂

[solar coral]

So I'm able to get a command shell session but after running any command it kills word 🙃

I had to respawn the machine to fix it, guessing it was a bad connection or something

[ornate hull]

Could help

[celest vessel]

?

[ornate hull]

Password attack task 9

[celest vessel]

what do you want to know

[winged isle]

I need another hint for room Password Attacks, Task 4:
This is my solution, but it's wrong:
crunch 5 5 -t "THM@!" -o tryhackme.txt

[celest vessel]

There is a special characther you can use to generalize symbols

@winged isle

[zinc atlas]

Exploiting Active Directory
Task 5 Exploiting AD Users

I recommend introducing some script that automatically picks up the process we need to migrate to.
Someone messed up that process and I can't go any further.
In the list of processes it does not exist, and this is the only process that allows you to perform the task, that is, to use the keylogger.

CANNOT COMPLETE TASK without resetting machine

[winged isle]

thx that helped

[thin iris]

Gave +1 Rep to @celest vessel

[zinc atlas]

In the instructions we have written to take over the process C:Windows\explorer.exe, which is running with the permissions of THMSERVER1.local.
In the attached window, you can see that there is no process running as this user

[zinc quiver]

Red Team Threat Intel Task 7:

Open the provided ATT&CK Navigator layer and identify matched TTPs to the cyber kill chain. Once TTPs are identified, map them to the cyber kill chain in the static site. To complete the challenge, you must submit one technique name per kill chain section.

a bit ambiguous, I can't really solved without checking the hint as a tried with other technique combinations and didn't work ... could someone explain bit further? Thanks in advance!

[royal void]

anyone else having this kinda error on the windows local presistence room???

[royal void]

it is asking you to choose the blue boxes from the navigator page and fill in the answers for the different steps... the correct answers when you click the submit answer button will have a grey line under them instead of a red line

[warped lion]

Can anyone help me with the passwords attack room? task 8 and 9 are kicking my butt and i am having trouble creating a username list and getting the attack to actually work

[celest vessel]

Can you tell us where exactly you are stuck?

[obtuse bone]

no one did! LOL - they want you to order the steps and give you the first two. then another scenario pops up. very confusing wording

[royal void]

oh sure.... you can use a wordlist for both passwords and usernames for task 9

and for task 8 it is kinda straight forward if you know how to use hydra.... and the first question on that is as simple as remembering that some people forget to disable a default account on ftp

if you need more specific answers then that you would need to provide some more info

[zealous wind]

Something doesn't add up in the Password Attacks room in task 4. The crunch answer input expects crunch 5 5 -t "7 chars" -o tryhackme.txt but the min-max values for the generated passwords in limited to 5

must say its confusing

[royal void]

2 of those chars are " i.e quotes..... so they don't really count

[zealous wind]

Quotes? where? generate a list containing THM@! i read it as THM[a-z]!

which is 5 chars, am i missing anything?

[royal void]

you surround the "thm@!" with quotes as what you are generating is going to include spaces and therefor be bleghg for terminal stuffs

also that was just an example the real answer uses only symbols and not the a-z thingy

[zealous wind]

if THM@! is just an example and the answer is only symbols, then the only thing i can come up with is crunch 5 5 -t ,,,^^ -o tryhackme.txt, which will give you three upper case chars and two symbols combination, but that also gives me a wrong answer.

[zealous wind]

also tried crunch 5 5 -t ",,,^^" and also "THM^^" not the right answers

any nudge to the right direction would be appreciated, i must be missing something simple here

HA! got it 🙂

[royal void]

The second one you did there should have been the right answer

[zealous wind]

yeah, i figured it out! thx 🙂

[royal void]

No problem

[warped lion]

@royal void i got the first task just fine lol. It's mainly the other questions in task 8. i am confused on the hydra syntax, and having trouble brute forcing that login-get webpage

[royal void]

small hint: ||hydra -l phillips -P clinic.lst 10.10.48.200 http-get-form||

@warped lion ⬆️

if you missed the hint

[manic shadow]

Keep it up guys , if I get stuck in any room ,hopefully I'll find it here without asking : )

[warped lion]

so i figured out the syntax and got that question, thanks

but when i try to brute force smtp, this is what i get: "[ERROR] SMTP LOGIN AUTH, either this auth is disabled or server is not using auth: 454 4.7.0 Temporary authentication failure: Connection lost to authentication server"

and this is my syntax: hydra -l pittman -P clinic.lst 10.10.30.14 smtp

and ive tried other ways besides that syntax and still get the same error. Has anyone ran into a similar issue?

@royal void Thank you

[thin iris]

Gave +1 Rep to @royal void

[royal void]

the tickets are then rewarded... just check your tickets in the profile page and you will see what you got

you can get duplicates when you already have 3 of the same type

[royal void]

your command is slightly wrong... you need to include the full email address for that ones... i.e [e-mail]

not that shadow knows... better luck in #1017019049181450291 probably.... maybe just maybe #site-bugs could also help

[warped lion]

@royal void how did u go about generating the rule based dictionary for that pittman question?

ive been trying john and will generate like 8000 words but i cant get it to save/overwrite the wordlist

[royal void]

john blah blah wordlist and rule --stdout | tee newwordlistthingy

[warped lion]

https://tenor.com/view/tired-struggle-gif-10628444

[royal void]

well you are getting there slowly but surely

it is also okay to take a break and come back later

[warped lion]

lol, ive tried doing it but the file crashes and gets locked in john.rec

[royal void]

huh

!docs verify

[wind bone]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[royal void]

can you follow the instructions in that link and post a screenshot of the error

[royal void]

if you run just john what does it tell you its version is???

[warped lion]

1.9.0

[royal void]

nothing about jumbo???

[warped lion]

1.9.0-jumbo-1+bleeding-51f7f3dcd

[royal void]

huh

weird then

just do a rm /opt/john/john.rec and try the command again... maybe

be careful with the rm command though

as it can and will sometimes delete files you need

if your path is wrong for example

[devout kernel]

Thanks for the advice

[thin iris]

Gave +1 Rep to @royal void

[royal void]

oh no problem.... took you long enough to reply.... hope it made you solve the question

[devout kernel]

It helped a lot. now just working on the machine Task. doing the Intro to C2

[warped lion]

@royal void is my syntax pretty on point?

[royal void]

yes except shadow defined the rule before the wordlist

but don't think that should affect it a lot

[celest vessel]

shadow, sometimes I wonder if you are some AI speaking for shadow herself 😄

[royal void]

hehe nah just using third person to refer to themselves like always

[warped lion]

well thanks @royal void for oyur help, i guess ill just wait and see if anyone else can figure it out and try again a different time

[thin iris]

Gave +1 Rep to @royal void

[royal void]

or we can do this @warped lion :

that is what it generated for shadow as the wordlist using the best64 rule

[lusty galleon]

Can someone help with Lateral Movement and Pivoting? I've tried connecting through my own vm and the attackbox and cannot get access.

[royal void]

not done that yet so sadly shadow can't help

[devout kernel]

Trying to break the hashes but get this error Hash '/root/Desktop/Tools/wordlists/hashes.hash': Token length exception. This is the command I am running hashcat --force -a 0 -m 0 /root/Desktop/Tools/wordlists/hashes.hash /root/Desktop/Tools/wordlists/rockyou.txt -r /root/Desktop/combinator.rule

[royal void]

your hashes.hash files hash is incorrect as it is either missing something or has to much of something that should not be there

[devout kernel]

This is what's in the the hash file aad3b435b51404eeaad3b435b51404ee:c156d5d108721c5626a6a054d6e0943c
aad3b435b51404eeaad3b435b51404ee:7639497cca10a2ee9b87712e3384539d
aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
aad3b435b51404eeaad3b435b51404ee:2e2618f266da8867e5664425c1309a5c

do I need the ::: at the end

[royal void]

yeah probably

[red tangle]

tell me did we all can get all the prizes or who get first it's his?

[devout kernel]

Hashdump gave me the answer and I didn't even see it

all that is left is getting the flags

[red tangle]

go for it

you can do it

[royal void]

some prices are in unlimited supply while some are first come first serve

better explained in the tickets room

[red tangle]

i see then no point to go forward pineapple already taken

thanks

[elfin tulip]

!docs verify

[wind bone]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[elfin tulip]

will the tickets no longer be useful if the voucher is already redeemed by someone

?

[royal void]

if all of the available prices of that catogery is gone shadow would assume so

[elfin tulip]

😢 okay!

[ripe basin]

Hi,
I am at Performing an LDAP Pass-back & connected with my Kali VPN connected, while setup LDAP server, there's no selection on LDAP database (MDB) but it go next options ie "ensure the database is not removed when purged"
And I am unable to connect to LDAP server.

What could be the issue here?

[worthy shuttle]

Anyone want join to solve a room together ? Signature Evasion

[zealous wind]

hmmmm.......in Task 8 im running the brute force attack against the HTTP server and i get the User Pass pair from hydra, but when i use it in the login page in the browser i get login failed error

[zealous wind]

if I'm taking the -f switch, I'm getting the same 16 passwords for both users. I tried it with the custom list generated from the custom rule and the "clean" list, and both provide the same 16 passwords for both users. non of them work

what am i missing here?

[primal basin]

16 user passwords correct means your syntax is wrong

[zealous wind]

hydra -l [user] -P [path to password list] 10.10.131.145 http-get "/login-get/index.php:username:^USER^&password=^PASS^:S=logout.php" -f

that is the syntax im using

[primal basin]

Incorrect passwords show s=logout.php ?

[celest vessel]

how can you get 16 user passwords when you need to brute force only one account?

[zealous wind]

exactly

[celest vessel]

should it not be http-get-form instead of http-get

[zealous wind]

well, when you try the wrong creds you get Login Failed! message may using F=Login Failed! ?

[zealous wind]

i get 16 legit passwords, doesn't make sense

[primal basin]

Hydra supports both http-form-get and http-get

[primal basin]

I'm asking if that's you error message you get from a failed login attempt, that has to be correct also

[zealous wind]

im getting 16 successful user pass pairs from hydra but non works, not sure what im missing here 🙂

how can a user has 16 working passwords?

[mystic sage]

they dont, your syntax is likely wrong

[celest vessel]

ah yes, I also see the mistake in the synthax

[zealous wind]

any pointer on what part of the syntax?

[celest vessel]

have a look at where you specify username

[primal basin]

When you command is wrong hydra shows that, it's a flawed error message, it happens to me too, like the other guy said cross-check what you wrote

[mystic sage]

i suspect S=logout.php is what's wrong here

but not sure

[primal basin]

That's why i asked ,if that's the message for incorrect login attempts

[mystic sage]

google is also your friend, hydra can take a bunch of different things for success/failure

[mystic sage]

ahh i see!

[celest vessel]

Did you found it already @zealous wind ?

[spiral forge]

Someone help please, I can't complete this task it keeps loading for a very very long time 😪😪

[primal basin]

Don't use the public ip, use the machineip:443

The website is broken

Sorry port 443

[spiral forge]

Got this message 😪

[potent crest]

try typing : https://10.10.15.223

[primal basin]

Https://

[spiral forge]

Thanks

[zenith sonnet]

oh yea i see the error too

[celest vessel]

We wanted to let him search for it :p

[zealous wind]

i also tired hardcoding the user instead of ^USER^ didnt work either. but i keep looking 🙂

[mystic sage]

if you setup proxychains you can make the request go to burp & inspect it to make sure it's doing exactly what you want

really handy for troubleshooting tools

[celest vessel]

Did you read what dix said?

ah he changed his comment 😄

you should not hardcode the ^USER^ part

it is something with username: which is not correct

[zealous wind]

ok

ill have another look

[zealous lark]

In the "Windows Privilege Escalation" room, the section about abusing SeBackup/SeRestore privileges is a little bit confusing (at least for me). It says that in order for the exploit to work the user must have the SeBackup/SeRestore privileges...then it shows a screenshot with a result of "whoami /priv" that clearly shows that the current user does NOT have these privileges...

I checked on the machine and despite the user THMBackup being part of the "Backup Operators" group, it does not have these privileges...but the exploit works anyway

[wind bone]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[zealous wind]

is it something to do with the url parms maybe http://10.10.156.124/login-get/index.php?username=user&password=Password

[zealous lark]

This is the screenshot in the topic. "SeBackupPrivilege" and "SeRestorePrivilege" are both set to "Disabled"

what does it mean?

Ok, got it: if it's listed, the user has that privilege, the "State" column is relevant to the current process only

A little bit of explanation in the topic itself could be useful, in my opinion

will do. I agree, it's not a bug, just a little bit counterintuitive

[zealous wind]

so for the first user i got the following command: hydra -l phillips -P ./pass.txt 10.10.156.124 http-get-form "/login-get/index.php:username=^USER^&password=^PASS^:S=logout.php" -f which works, i got the right pass word.
for the 2nd user burgess u changes the method to http-post-form and the url to "/login-post/index.php" and using the custom list with the custom john rule which is Az"[0-9][0-9]"^[!@#$%^&*()/]

hydra comes up empty here 😤

should be the same other then changing the HTTP method and the uri

[marsh birch]

Hi! I've started this path and I'm having problems in the room https://tryhackme.com/room/redteamthreatintel with this question: "What signed binary did Carbanak use for defense evasion?"

I've used the ATTACK Navigator and I've also read the Kaspersky report about this APT but the answer I think is, it isn't. Someone could help me?

[zealous wind]

its a built-in windows binary used to execute code

[marsh birch]

Thanks for your help @zealous wind. As the ATTACK shows, I've only have one option with this hint but It isn't correct... I don't know if I can tell you my answer

[thin iris]

Gave +1 Rep to @zealous wind

[marsh birch]

I've tried with .exe and without it

[zealous wind]

think of what windows binaries in C:\Windows\System32 you have that can be used to execute malicious code

[marsh birch]

I also saw that this APT injects code in another built-in binary, but this isn't the answer neither

[marsh birch]

Exactly, my two options are in the ATTACK and below this path

[zealous wind]

The answer is not in the carbank att&ck page

not in the software part anyways

[marsh birch]

Ok, good hint. I also read https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf but I think doesn't have the answer anyway

[calm gyro]

Can I dm someone to explain me the crunch command task?😅

[native berry]

Why can't you do it here?

[calm gyro]

I just do not wanted to spam, I know that were already a lot of talks on this topic

[zealous wind]

the options are all symbols 😉

omit the -o to see how the output looks like that will also help you out

[calm gyro]

First of all I did not understand from the task, how the output should look like? Which characters should be in the final output and which are special characters

[zealous wind]

THM something something

[native berry]

Talking about a room task is not considered spam

[opaque iron]

I'm setting up armitage in my local machine using the instructions in "Intro to C2" module under section "Setting up a C2 framework"

Lastly, we must initialize the Database so that Metasploit can use it. It's important to note that you cannot be the root user when attempting to initialize the Metasploit Database. On the AttackBox, you must use the Ubuntu user.

This instruction is given in THM but I am unable to start msfdb as normal user as you can see above

What do I do?

[primal basin]

Sudo msfdb init

[zealous wind]

If anyone can DM me about the last part of task 8 I'd appreciate it!

[native berry]

You should include what room you are evening talking about

[zealous wind]

Password attacks.....sorry about that

[native berry]

Doing that room right now, if I'm past task 8 and you haven't gotten an answer until then, I might be able to help

[potent crest]

@zealous wind what problem are u facing for that task ?

[zealous wind]

so for the first user i got the following command: hydra -l phillips -P ./pass.txt 10.10.156.124 http-get-form "/login-get/index.php:username=^USER^&password=^PASS^:S=logout.php" -f which works, i got the right pass word.
for the 2nd user burgess u changes the method to http-post-form and the url to "/login-post/index.php" and using the custom list with the custom john rule which is Az"[0-9][0-9]"^[!@#$%^&*()/]

hydra comes back empty

[potent crest]

task 8 last question is not using custom rule

u must use single-extra rule from john

[zealous wind]

sorry but i thought the custom rule == single-extra

what is single-extra rule then>

[potent crest]

hm u can say its like a inbuilt wordlist of rules that we can use

so task 6 u learn on how to craft ur own rule

if u run the command to see all the rules, like this:

so when the hint tell me to use "John's Single-Extra Rule", i take it as use john in built rule, not the custom rule which i created.

i also have the habit to double press my tab key to see if i miss out anything and for auto completion, doing so i stumble upon the rules like this

first tab after typing "sin" to see if the rules is valid. If it autocomplete, means its valid.

double tap the tab button and it tells me that i have 2 option to use.

so from there u play around with it and look at the stdout or the file (if u save all ur output to a file) and see what the rules does ! 🙂

[calm gyro]

So should be a list which contains words like: THMa!, THMb!, THMc! ?

Or should contain this one: "THM@!". Because is confusing to say what is the command to generate a list of one string. If we say a list that means we have more words.

[potent crest]

@calm gyro what task are u doing again on password attacks ?

task 4 is it ?

[latent grotto]

Getting a PostgreSQL error when trying to run teamserver on Armitage

[potent crest]

@latent grotto have u try this ?

https://discordapp.com/channels/521382216299839518/1017053384441868418/1018839545938194473

[latent grotto]

yea, i ran everything with root privileges

db works fine on msfconsole but it wont connect with teamserver

[zealous wind]

so i created the clinic.lst then i used john to extend the list john --workdlist=clinic.lst --rules=Single-Extra --stdout > list.txt

[potent crest]

whats the command u running on ? @latent grotto

[zealous wind]

now im using list.txt in hydra

[potent crest]

yes

[zealous wind]

see what happens 🙂

[calm gyro]

Looking through old discussions here on the channel, I found the answer. And is still unclear for me.
||The answer how is in the task is not correct because you need 6 characters, not 5. And why do you need 2 '^' to get the symbol '@' ? Because the ^^ will add 2 symbols for you.||
The whole problem is that I did not understand what should be the final output?

[latent grotto]

./teamserver <IP> <Password>

[zealous wind]

pehwww.....finally worked 🙂

thanks for anyone who helped out!

[potent crest]

@calm gyro the final output should be THM@!

THM@! = 5 characters

^ = means it will run special characters including space

if u include 2 of these ^, means 2 special character will run

THM@! = 3 letters + 2 special characters = 5 characters

Does that make sense to you ?

[zealous wind]

but the input expects 7 chars that what threw me into a loop initially

[calm gyro]

Yeah... now all is clear. But the correct pattern as the question says is not ||"THM^^"||, it is ||"THM^^!"|| 😂

[potent crest]

@calm gyro hm im curious, why the exclaimation mark at the end ?

[calm gyro]

I don't know this is why I am asking too 😂 This is the correct answer to pass the question

[potent crest]

if u include the exclamation mark means is 6 characters

[calm gyro]

Ok... I have no more words🫠 Anyway, thank you for the help, it really helped me to understand 😄

[thin iris]

Gave +1 Rep to @weak ice

[potent crest]

hm im not sure why, it work on my kali .

[thin iris]

Gave +1 Rep to @potent crest

[potent crest]

thanks @weak ice 💯

[thin iris]

Gave +1 Rep to @weak ice

[calm gyro]

What is that?

[twin dagger]

what is rep btw

new here

[potent crest]

i remember someone say all the answers to the question have some like regex checking or sort of, now that u mention that way

[twin dagger]

haven't used reddit lol

[calm gyro]

So is not counted somewhere?

[twin dagger]

is it something like more you active the more points you get?

ok! get it!

[latent grotto]

what msf ver are you using?

[twin dagger]

thanks! @weak ice and @calm gyro

[thin iris]

Gave +1 Rep to @weak ice

[latent grotto]

did u use this command apt install -y default-jdk

[potent crest]

no i didnt

oh i think i how i did it was install armitage thru apt

i didnt clone anyhting

so i didnt clone anything or run any script, just install armitage straight from apt and run it

[latent grotto]

i see

[formal dew]

"What would the syntax you would use to create a rule to produce the following: "S[Word]NN where N is Number and S is a symbol of !@?" passowrd attacks room task 6

i couldn't find the answer

[copper talon]

I've been waiting around 20 minutes for the gophish emails to be opened in the Phishing section of red team learning. would you say i probably put something in incorrectly, or has anyone else waited quite a while on it?

[potent crest]

@copper talon do this: https://<targetIP>

[zenith sonnet]

mine had the data received after less than 2 mins

[copper talon]

thanks for the replies, i'll recheck my configurations

[zenith sonnet]

maybe you weren't convincing enough 😄

[celest vessel]

I also had data in less than 2minutes

I think it even took 1 minute or so 😄

[copper talon]

yup, i just had the wrong protocol set in the link. thanks all

[thin iris]

Gave +1 Rep to @zenith sonnet

[sand arch]

Anyone here able to give me a little help using Detect it Easy in the Windows Internals room?

[sand arch]

NEVERMIND, i was trying to read the notepad.exe that is in the DiE folder, instead of the Windows notepad.exe file

[formal yoke]

Is it normal to get multiples of "red teamer" tickets after you redeem it?

[celest vessel]

I believe so, also had this yesterday

[sand arch]

Yeah it's random what tickets you get, i appears, I've gotten multiples of the Red Teamer ones after unlocking it

[unkempt hemlock]

Room: Password Attacks
Task: 8
Question: How do I get the flag in the first question?

Upon running hydra -l ftp -P list.txt ftp://10.10.166.77 I have the output as shown. What should I do next?

Assuming it's talking about using some sort of default credentials, I'm lost.

ftp
open
IP

Yeah, but I require a "Name" and a "Password"... that is where I'm lost on.

the question said no brute forcing... so i seem to be missing something in plain sight?

[shadow quartz]

@unkempt hemlock are you familiar with anonymous login for ftp?

[celest vessel]

now you have given the ultimate tip 😄

[unkempt hemlock]

Nope :/

[celest vessel]

I remember on one of the first trainings on Tryhackme, they said google is your friend

[shadow quartz]

Give that a google

[unkempt hemlock]

I'm really sorry if I seem too lazy, or not looking in the right direction. :(

[celest vessel]

A lot of times you need to do some additional research as well, also you would be surprised by the amount of stuf you can find on google

like default user and pass for cctv systems (it is just one example)

the same goes for ftp servers, that's why the question is "without brute-forcing", to enforce you to search for it - on google 😄

[unkempt hemlock]

Thank you so much! :')

[thin iris]

Gave +1 Rep to @shadow quartz

[unkempt hemlock]

I need to get better... much better... perhaps even switch from DuckDuckGo to Google xD

Thank you so much for the help.

[celest vessel]

well, we all have to learn, the same counts for me

[unkempt hemlock]

I'll try and get better at researching. :)

[celest vessel]

did you do the basic cybersecurity training? It is really good

and I have spent more than the hours they say on this training 🙈

[unkempt hemlock]

Yeah, slacked off after my Jr Pentester. Forgot a bunch of fundamentals.

[celest vessel]

you can always pick it up again 😄

[unique rain]

Hello pips !
I don't understand the first question in the signature room evasion :

To the nearest kibibyte, what is the first detected byte?

which value do I need to put ?
It is in byte or kibibyte ?

as I understand the question i need to give the value that I found in byte in kibibytes

[calm gyro]

Hello, how can I save the output from the custom rule made by John, in a file?

[royal void]

well the --stdout will print the passwords to standard out in the terminal.... from there the default tool to pipe that data to, to make a file is tee... so like john --rules=blah --wordlist=/path/to/wordlist --stdout | tee new-wordlist.txt

[calm gyro]

Oh thank you. I didn't know about the tee and with > did not work.

[thin iris]

Gave +1 Rep to @royal void

[royal void]

tees manpage ==

NAME
tee - read from standard input and write to standard output and files

i.e its intended purpose is just for this

[calm gyro]

Hello, me again😅 Can somebody help me with this one?

[zealous wind]

add the :S=logout.php at the end of the linw

i think that will fix it for you

[calm gyro]

Ah, so hydra will check the correct credentials by response. Yeah, make sense, let me try

[royal void]

yeah for the http hydra methods it needs something to check for on success or failure to know if it got in or not

[zealous wind]

@calm gyro don't forget to add the -f after that to tell hydra to stop processing once a user pass pair was found

[tropic ginkgo]

All my tickets was deleted ☹️

[vast quest]

It's a bug staff are looking in to it.

[tropic ginkgo]

Oh!

[calm gyro]

I see I do not have any parameter for the error message. Should work fine with :F=?

[tropic ginkgo]

I got my 3rd ticket to get the $20 swag and then everything was deleted 😔

[royal void]

well either or.... you can use either :F= or :S= for it to know if it failed or succeeded

[tropic ginkgo]

But I got the t shirt before

[royal void]

nice..... shadow got a hat

[tropic ginkgo]

@royal void niceeee

[royal void]

the hat is somewhere in sweden right now so yeah it is getting closer

[calm gyro]

Still doesn't work

I tried either with: :F F= :F=

[royal void]

hydra -l phillips -P clinic.lst 10.10.48.200 http-get-form "/login-get/index.php:username=^USER^&password=^PASS^:S=logout.php" -f

worked for shadow

of course change the ip