red-team-capstone-challenge

[fading timber]

Thanks, i do it

[brittle badge]

Gave +1 Rep to @serene sedge

[fading timber]

👍

👍

[fiery sinew]

hello guys,

I am confused, I have gotten my hands on the ||corpUsername.vpn|| file, after putting my vpn address it seems I can access the internal network. As I read the data:
2023-05-27 18:06:03 net_route_v4_add: 172.32.5.21/32 via 12.100.1.1 dev [NULL] table 0 metric 1000 2023-05-27 18:06:03 net_route_v4_add: 172.32.5.22/32 via 12.100.1.1 dev [NULL] table 0 metric 1000 .

It seems to me I should be able to enumerate this two ips, though I can't nmap them.

Am I missing something obvious?

Edit: It seems it is needed to add sudo ip route add 10.200.XXX.21 dev tun0 right?

Edit of edit: It works!

[trim beacon]

Absolute, which is same as any other red team engagement. But if you are smart about it, you start to script up your attack. Rather than doing it manually, write a python or shell script to do that staging for you. Means within a minute you are back where you were. So good exercise in automated your staging as well.

Personally I'm a massive fan of writing python stagers. You can even create a template for yourself that will perform all the steps required to for example deploy a malicious key and configure a proxy pivot for you

[dawn zinc]

can I Dm one of the mods I think I stumbled over something unusual might also be my inexperience very unclear to me but makes me a bit uneasy

[sterile elk]

another reset

zzzzz

[trim beacon]

You can DM me if you want to

[forest dune]

Hello world.
Beginner here. Trying to execute Get-ADGroup on the CORPDC and query group info from the ROOTDC, but it tells me that the server is down... Am I missing something here ? Thx 🙂

[slow garnet]

Can anyone suggest my next step, I am getting an error when trying to setup email for this challange , on evolution. I am not able to authenticate password that was given on the e-Citizen platform.

[forest dune]

@slow garnet DM

[stark hemlock]

You have to add the routes, either by using the ip route command the others mentioned above to the tun0 interface, or do it the way I did, I rewrote the config file and added three lines. One to not ask the server for the bogus routes, and two more to route to the correct machines.

[fiery sinew]

thank you buddy!

[brittle badge]

Gave +1 Rep to @stark hemlock

[stark hemlock]

👍

[cerulean wraith]

soon only a week left

[heavy crag]

How many users are allowed at once? Is there a typical limit in an Office AD environment in real life?

The number of users allowed on a Windows Active Directory (AD) server at once is not strictly defined by the AD server itself. Instead, it depends on various factors such as the server's hardware capacity, network infrastructure, and the configuration of the server and associated resources.

Windows AD servers are designed to handle a large number of simultaneous user connections. The exact number of concurrent users that can be supported depends on factors such as the server's processor, memory, disk I/O, and network bandwidth. Adequate server resources, including CPU, RAM, and network capacity, should be provisioned to handle the expected workload.

Additionally, the number of users that can connect to a Windows AD server simultaneously can be influenced by other factors such as the server's Active Directory configuration, domain controllers, network infrastructure, and the applications and services running on the server.

It's important to ensure that the server infrastructure is properly sized and scaled to handle the expected user load. Performance testing and capacity planning can help determine the optimal configuration and capacity for an AD server based on specific requirements and expected usage patterns. --OpenChatGPT

[sterile elk]

anyone can give me a hint on why I'm getting errors trying to start a service?

[stark hemlock]

My spearphishing custom loader does work! But... the box that downloaded from me doesn't allow ingress traffic, I breached that box before. RIP.

[ornate torrent]

Hello,
I am confused about this custom e-mail address I get from this e-citizen server. In the description, it says we somehow have to find the mailserver. There is a mailserver directly accessible. Is this the one or is it the one from thereserve or do they use the same? (authentication against this server did not work) I don't understand why I should have to "find" the mailserver hosting my own address.

[iron forge]

you can use the email to login to web email, to receive email for flag, also to claim the flag

[pseudo parrot]

If you've found the one on .13

Your credentials should work to log in.

[brave pebble]

hi i'm having a bit problem with the internal vpn. it just keeps resetting itself which it didn't previously. do i have to change anything in the corpUername.ovpn file?

[forest plinth]

emmm, although this may not be useful, but I can tell you that this error has no effect, and you can still access the openvpn intranet normally

[fiery sinew]

Hello, yesterday I had issues connecting to the internal network so I did: sudo ip route add 10.200.116.21 dev tun0 sudo ip route add 10.200.116.22 dev tun0

Everything went fine, and I could nmap these adresses, however today ovpn keeps restarting:

...
2023-05-28 09:56:22 net_addr_v4_add: 12.100.1.9/24 dev tun0 2023-05-28 09:56:22 net_route_v4_add: 172.32.5.21/32 via 12.100.1.1 dev [NULL] table 0 metric 1000 2023-05-28 09:56:22 net_route_v4_add: 172.32.5.22/32 via 12.100.1.1 dev [NULL] table 0 metric 1000
...
2023-05-28 09:56:22 Initialization Sequence Completed 2023-05-28 09:56:22 Connection reset, restarting [0] 2023-05-28 09:56:22 SIGUSR1[soft,connection-reset] received, process restarting 2023-05-28 09:56:22 Restart pause, 1 second(s)
...

Thank you

[sterile elk]

is windows defender activated domain wise? yesterday I could upload tools with no issue on WRK1 and today I get the tools deleted

[brave pebble]

but somehow the ports are filtered i did use ip route add and added those ip's before and got a scan but now everything is unaccessible i can't rdp into the machines in any way

[brave pebble]

having the same issue

[forest plinth]

You need to continue enumerating

[brave pebble]

is there any other way to get access to the machines using the credentials that i've found?

[forest plinth]

I believe you, like me, ignored the mailbox of function

[sterile elk]

what's wrong with this? is defender activated by default on WRK1? or did someone activate it for trolling?

like I literally could upload tools yesterday after a reset

[forest plinth]

I believe it was turned on by default, but someone turned it off. So you can upload tools

[sterile elk]

so all I did yesterday was fake then

great

I got up to domain admin on CORPDC

now I cannot upload chisel to pivot

[forest plinth]

If you have permission, of course, you can also turn it off

[fiery sinew]

Finding a fix?

[brave pebble]

nah still stuck

[sterile elk]

can't get admin now on WRK1 lol

fuck my life

[forest plinth]

you can bypass

[sterile elk]

not sure how

[brave pebble]

i found a fix

[fiery sinew]

yes?

[brave pebble]

go the the vpn portal

and use the mail and password you got and log in

below that you have an option to submit

[forest plinth]

https://github.com/Flangvik/ObfuscatedSharpCollection/tree/main/NetFramework_4.7_Any

[brave pebble]

that'll give a specific user vpn config

[sterile elk]

that's nice! going to give it a try

thanks 😄

[forest plinth]

and burp suite？ you can try

[brave pebble]

thanks man it works now

[brittle badge]

Gave +1 Rep to @forest plinth

[sterile elk]

still detected when ran

oh man...

[brave pebble]

got RDP

[fiery sinew]

i sent you a pm 🙂

[forest plinth]

In fact, like you, I fought against WinDefender from the beginning, until I gave up and went another way. There is no such horrible antivirus software on Linux

[sterile elk]

there has to be a way to do this T.T

I had all the kill chain up to domain admin on CORPDC

16 hours straight yesterday

[forest plinth]

If you have an account of DA group or a hash of administrator, you can consider logging in to wrk1 and turning off WinDenfer

[gleaming bough]

can you tell me how to fix the internal vpn

the internal vpn is restarting constantly

[weary flicker]

I just bypassed the login screen by typing " in the username field

Then I downloaded a working VPN file from the page afterward

[gleaming bough]

i have downloaded the vpn file but it is giving me ||172.32.5.21/32|| and|| 172.32.5.22/32|| ip address

how to get proper ip allocation ?

[viscid frost]

I think you can search the chat for many answers since this is probably one of the most asked questions (I was at that point too but found another way in)

[gleaming bough]

yes thanks@brave pebble @weary flicker

[sterile elk]

can someone give me a nudge on how to be able to reach ROOTDC network wise? I tried using ligolo-ng but the agent cannot reach my tun0 IP

having a network meltdown on my head rn lol

[vivid trail]

I am having a similar issue with connecting to the corp VPN - yesterday it was receiving routes to 10.200.x.21/32, 10.200.x.22/32, but today it is getting 172.32.5.21/32 and 172.32.5.22/32 - neither of which can be reached by RDP, or pinged.. or anything else.

I had logged into the VPN server with one of the names I got from ||password enumeration of smtp|| and received new stable .ovpn files, which are stable, but give the erroneous IP route - this is true for multiple different .ovpn files, including the original corpUser.ovpn

[slender verge]

It's an easy fix, you can look in this channel, people have posted the solution many times now

[vivid trail]

ah - thnks

[tardy sage]

My problem is, that I have submitted the access to SWIFT flag yesterday and I got credentials there and do a transaction and only submitted this from one capturer. Today I am on a different machine and I can't login with this credentials

Is there a way to receive new credetials and a pin code

@slender verge @forest plinth do you now a way to do that?

[slender verge]

I'm up to that part myself, so I don't know for sure, but I think you just have to use e-citizen to reset your swift progress

[tardy sage]

But how can I do this?

I think there is no description

[slender verge]

Log in to the e-citizen portal, authenticate, verify past compromises, reset swift progress

[tardy sage]

Okay I will try this

Thank you it worked

[slender verge]

great 🙂

[tardy sage]

I finished the room and I want to say THANK YOU to everyone who answers my questions 💪

[sterile elk]

someone broke the mail server?

[cerulean wraith]

if they did they might have broken some of the rules of the engagement

[sterile elk]

nah, another reset

now I cannot return to where I was, awesome!

cannot access to CORPDC somehow with socks proxy, when I could before

[slender verge]

are you documenting your steps?

also after a reset, allow for 10-15 minutes for everything to get up and running again

[cerulean wraith]

shadow feels terrible because they don't feel in a good enough mental state to do this but also having as lot of Fear Of Missing Out

specifically on the badge

[slender verge]

if you're up to it, you'll have plenty of time to get it once the competition ends and write-ups can be published

[cerulean wraith]

well some write ups are already public but yeah

[slender verge]

they are?

[cerulean wraith]

for example @quaint knot write up in video format is public thank you so much for that

[brittle badge]

Gave +1 Rep to @quaint knot

[cerulean wraith]

obviously the flags are not provided in the write ups

[slender verge]

ah yes, Tyler, you're right

[cerulean wraith]

also good meeping mooping tyler... you leaked the first flag

[slender verge]

oh no, he did?

[cerulean wraith]

yeah....

am03bam4n told him to hide the flags after the first one got leaked and he seems to have oblidged

not watched all the vods yet so dunno if he accidentally leaked any more

[slender verge]

I guess it happens when you're streaming with no prep

[cerulean wraith]

yeah

[slender verge]

but basically am03bam4n was right when he said initial access was one of the hard parts, it actually gets easier after, if you've done the AD networks in particular

[sterile elk]

I'm not getting the flag for ROOTDC on my mail

:S

[slender verge]

you can get it from the e-citizen portal too if the email gets delayed

[sterile elk]

I reseted it and did it again and no mail is coming

oh yeah?

[slender verge]

just go to verify past compromises, and then you can chose to get the flag value for the things you've compromised

[sterile elk]

thanks man

tomorrow I'll continue with the 2nd part of the lab

maybe I'll finish in time 😄

[slender verge]

you can do it!

[quaint knot]

Ha yeah.... I don't think I leaked more, but definitely difficult when streaming live and working through it for the first time!

[cerulean wraith]

we all do mistakes

the important thing is to learn from them

[trim beacon]

IRL the limit is 2, unless the host is a jump host. Which is why you want to rely on tooling that does not take an active session, allowing you to move a lot more silently

[trim beacon]

ChatGPT is full of s**t. There is an actual limit on RDP and it is two. Any more and you need an RDP license, which is incredibly expensive and only allocated to select jump hosts. There is no limit on NETLOGON user connections, but there is a limit of two on interactive logons

[trim beacon]

AV should be on all hosts. Might have been another user disabling it. However defender does re-enable itself after a couple of minutes

[trim beacon]

There are five different ways you can breach the perimeter. If one method fails for you, as suggested, enumerate to find another way

[cerulean wraith]

if you got a cred combination that would work over rdp is evil-winrm able to use it????

and does that support multiple users using it at the same time???

probably should read the man page

[trim beacon]

Reset your SWIFT progress once you are ready to perform the steps again. You have to get Flag 17 - 20 in one go, since you need your SWIFT accounts for all 4 flags. You can reset progress by using option 2 of E-citizen

[trim beacon]

The fun part is, if a user just copies the flag into their room, we can see it since their profile won't match on e-citizen. So we can ban the user. This feature will be used in B2B to verify users actually perform the steps and don't just copy paste flags. Also, all flags will be rotated in their values, meaning you can't copy from a video stream at least

[cerulean wraith]

guess you can ban shadow then

[trim beacon]

You have to restore your email access before you submit the flag. However, if you forget, use Option 2 on e-citizen to just view the flag there

[cerulean wraith]

blame shadows testing nature to try and see if said flag worked

[trim beacon]

We decided against banning any normal users, especially since we were able to ensure that streams only leaked one out of the 20 flags. Was more to just make sure the competition was fair

[cerulean wraith]

thanks for that

[brittle badge]

Gave +1 Rep to @trim beacon

[tardy sage]

The Thing is, that Tyler leaked more than one flag. In one Situation he is scrolling up and there were about 4-5 flags

[tardy sage]

But you see it, so it doesn’t really matter

[cerulean wraith]

looking at the write ups shadow has found they dunno if they can even follow along or have to bodge a combination of them to get the results

still wondering what methods you can use to spawn a shell with windows login creds that is not tied to rdp so that multiple users can be on at the same time

think evil-winrm is one but not sure

[stiff oracle]

Stuck at rootdc can’t get pass av got any ideas pls

[tardy sage]

Yes this is one method

[trim beacon]

Use native windows tools like Sysinternals? So either PSRemote or PSExec?

[trim beacon]

Also, if you are at DC, you can also just simply create an exclusion folder for your malware using admin privs?

[trim beacon]

Yeah, doesn't matter for now and will be rotated again before room goes B2B. even 5 flags isn't a train smash honestly

[cerulean wraith]

nice

[stiff oracle]

Ok thanks am03bam4n will try some of what you mentioned am on the rootdc though PSExec bin watching Tyler vids but got stuck at the rootdc

[tardy sage]

Do you know how many write ups are already writen? Because I don’t know, if there is a chance to win, when I write a WriteUp now

[cerulean wraith]

shadow has so far found 2 public written write ups by using search engines

then there is the vods by tyler

dunno if @heady monolith and @meager ginkgo vod are accessable but seems those would be on twitch in that instance

[tardy sage]

I thought of WriteUps that are for the WriteUp Challenge

[cerulean wraith]

aaah

about those shadow dunno

the ones shadow has found are not that good in that regard

[trim beacon]

There have been X number of writeups. But X is not yet larger than Y number of prizes 😉 So still a change if you submit. Remember that we assess the writeups, so even if you submit later than others, if your is better than others, you can still win a larger prize. And then if you don't win the first three prizes, there are still runner up prizes

[tardy sage]

Okay 👌

[broken kestrel]

Algebra remains useful even after school

[tardy sage]

Can I do the WriteUp in GitHub, because I don‘t have Word License, so I can‘t convert a Word document to a PDF

[broken nest]

Hi @trim beacon , out of curiosity may we see the first 20 to own the lab as you did post it before?

[trim beacon]

That will be fine, might lose a point for formatting. You could always just use Google's docs to convert to PDF once done?

[trim beacon]

Yeah give me a second to query it

[trim beacon]

I have to splice two logs together to get the ordered list currently. I can print the list of those that completed it with the single log, but need to splice both to get it ordered. Will do that closer to the end of it when the competition closes

[cerulean wraith]

go go go gobusters

[sterile elk]

Completed the lab! Thanks a lot @trim beacon, work like this deserve all the praise it can get, hopefully you keep making awesome labs like this 😄

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

But here is the list of the 77 users who have completed it thus far:

| username | Flag Submission Count |
+----------+-----------------------+
| 0x       |                    20 |
| ac       |                    20 |
| al       |                    20 |
| al       |                    20 |
| Al       |                    20 |
| Aq       |                    20 |
| az       |                    20 |
| Bl       |                    20 |
| bo       |                    20 |
| co       |                    20 |
| Cy       |                    20 |
| cy       |                    20 |
| d4       |                    20 |
| Da       |                    20 |
| da       |                    20 |
| de       |                    20 |
| de       |                    20 |
| di       |                    20 |
| El       |                    20 |
| ep       |                    20 |
| ff       |                    20 |
| ga       |                    20 |
| ga       |                    20 |
| gp       |                    20 |
| ha       |                    20 |
| he       |                    20 |
| He       |                    20 |
| Hi       |                    20 |
| ho       |                    20 |
| hu       |                    20 |
| Ig       |                    20 |
| Ja       |                    20 |
| jc       |                    20 |
| Je       |                    20 |
| jo       |                    20 |
| JP       |                    20 |
| Ke       |                    20 |
| Ke       |                    20 |
| le       |                    20 |
| m0       |                    20 |
| ma       |                    20 |
| Ma       |                    20 |
| mb       |                    20 |
| me       |                    20 |
| Mm       |                    20 |
| ms       |                    20 |
| n4       |                    20 |
| Ne       |                    20 |
| ni       |                    20 |
| Ni       |                    20 |
| of       |                    20 |
| PK       |                    20 |
| Pr       |                    20 |
| ps       |                    20 |
| Qx       |                    20 |
| r0       |                    20 |
| Ra       |                    20 |
| ra       |                    20 |
| ro       |                    20 |
| ro       |                    20 |
| Sc       |                    20 |
| Se       |                    20 |
| se       |                    20 |
| Sh       |                    20 |
| si       |                    20 |
| So       |                    20 |
| Su       |                    20 |
| Sy       |                    20 |
| Te       |                    20 |
| ur       |                    20 |
| ut       |                    20 |
| vu       |                    20 |
| Wi       |                    20 |
| WM       |                    20 |
| Wo       |                    20 |
| z3       |                    20 |
| Z3       |                    20 |
+----------+-----------------------+

[cerulean wraith]

wait someone with sh in their username has done it that is not shadow????

imposter

[sterile elk]

yayy I'm on that list

[trim beacon]

Congrats on completing it!

[trim beacon]

Might be sheldon 😉

[sterile elk]

Thank you very much, great training for my upcoming CRTO

[tardy sage]

Me to PK 😅

[trim beacon]

Awesome feedback thanks!

[brittle badge]

Gave +1 Rep to @sterile elk

[broken nest]

Much appreciated , then we shall wait for the competition to end to review the standings!

[tardy sage]

Okay I will try this, because now I started writing in ONENOTE

[broken nest]

Shadow should have finished that lab already

[cerulean wraith]

hahahahaaaaa nope not done yet

[broken nest]

We got the zoomies!

[cerulean wraith]

what was the command in sublime text to enable multiple cursors so that you can do text clean up again????

[broken nest]

ctrl+shift+alt simultaneously

[cerulean wraith]

thanks

[slender verge]

Yeah, that one can work, also if you have your own Windows VM, I believe runas is used for injecting credentials like that?

[tardy sage]

I will copy this to GitHub and then I will covert it. (I am new at this theme with WriteUps)

[cerulean wraith]

and there we go an username list

now to try and find where the john config is to mangle some passwords

[cerulean wraith]

oh.... oh noes the network is resetting so nothing works right now

[slender verge]

Yeah, the resets get annoying very fast

Takes about 10-15 minutes for everything to get up and running again

[cerulean wraith]

yeah shadow thought they had typos because everything just stopped but apparently it was a network reset

[heavy crag]

haha! Thanks for cutting thru the BS - AI aint smart enough to take our jobs yet! Not by a long shot!

[brittle badge]

Gave +1 Rep to @trim beacon

[cerulean wraith]

@trim beacon if you typo your username when registering with e-citizen what happens???

[cerulean wraith]

oh my goodness i have to many chisels
Tyler R

made shadow laugh

[eager wharf]

@trim beacon We've got an issue i think on the verification bot checking CORPDC's set of evidence

Warning: Permanently added '10.200.116.102' (ECDSA) to the list of known hosts.
THMSetup@10.200.116.102: Permission denied (publickey,keyboard-interactive).

Could not recover the verification file, hence flag could not be verified

can't check for the file if it doesn't connect to the thing in the first place :(

[cerulean wraith]

oooh yeah that looks like a bug

[eager wharf]

don't think anything wrong happens, e-citizen takes any names

doesn't have to be your thm name

i used "ghost" as an abbreviation of mine and have been progressing thru it fine

if you typo'd though, you can create another account with the right name no prob

[cerulean wraith]

yeah don't think shadow typoed it just thought it was an interesting question

[eager wharf]

i see, yeah

hope the bug gets fixed soon, i'm panicking myself while lookin at the 7 day left counter

think a server reset would fix it or nah?

i hate those as much as the next person but if its a publickey issue maybe thatd do it

[cerulean wraith]

¯_(ツ)_/¯

[stark hemlock]

Whoever was talking about how the Windows systems are getting tougher with Defender, or something about Defender turning itself back on. I have been using payloads that employ process memory hiding, specifically a C++ module-stomped shellcode runner with XDR unhooks that runs Havoc C2 with Ekko Sleep Obfuscation. I watched Defender detect it in a rare instance as it goes through it's +/-RWX & RC4 Reencrypt Loop but fail to remove the payload. You can find shellcode runner templates on iredteam.

I'm just exploring different attack paths right now since I wasn't able to get persistent access or escalate privileges yet. But I want to try another method, a payload using Guard Pages. As well as targeting the VPN box since that seems to be a priority to maintain persistent access to the AD network.

I also saw someone spearphish one of the owned email accounts two days ago. You missed a line in your loader method, but yes, at least two of the emails will "click" and run it.

[cerulean wraith]

shadow thinks they know 1 of the users that run email stuff

[stark hemlock]

📧

[cerulean wraith]

probably not taking that path anyways

[stark hemlock]

It’s really tough. There is a ____ that prevents the loader from successfully downloading the payload for a specific box. But they did click it. And a specific loader from a known TA in a specific file format does work

Another email will kindly send you back a reply.

[eager wharf]

im running into problem after problem at this point, i'm shutting down for today

ROOTDC is unreachable for some reason, and now the checker's not working for CORPDC flags either

hitting reset and signing off for the day sadly

[cerulean wraith]

somehow can't login to the vpn server using valid creds... welp poop

@trim beacon ```
2023-05-29 01:14:27 PUSH: Received control message: 'PUSH_REPLY,route 10.2001.21 255.255.255.255,route 10.2001.22 255.255.255.255,route-metric 1000,route-gateway 12.100.1.1,topology subnet,ping 5,ping-restart 120,ifconfig 12.100.1.9 255.255.255.0,peer-id 0'
2023-05-29 01:14:27 Options error: route parameter network/IP '10.2001.21' must be a valid address
2023-05-29 01:14:27 Options error: route parameter network/IP '10.2001.22' must be a valid address

sooo this is not intended right???

ips with 2001 does not exist

or at least not in ipv4

[thin dome]

How to create a Windows Defender AV Exclusion Folder using cmd; not powershell, over psexec connections. For some reason, cmd gets stuck and powershell responds with alot of fumbled garbage

[cerulean wraith]

sounds like something you could search online or ask chatgpt

[thin dome]

I have

[cerulean wraith]

though in a real life environment do not give critical data to chat gpt

[thin dome]

Ive even tweaked it different ways from multiple sources. Ive just hit a wall with it. Nothing I have tried works.

[cerulean wraith]

¯_(ツ)_/¯

[thin dome]

Its a mess.

[cerulean wraith]

yeah noticed that kinda

gonna try and switch subnet because this current one is broken in multiple ways and waiting for the other users on there to not screw it up after a reset did not feel worth it

[dreamy comet]

anyone got a method for dumping hash or bypass the AV on ROOTDC? creating a new user would be the easiest but also would be a big no no for other player and on any type of shared lab like this

[cerulean wraith]

time to read the rules of the engagement and see if we are allowed to create new users on dc

[thin dome]

Its not the network or hosts on my end. Im just doing something wrong and cant figure it out right now

[cerulean wraith]

tom seems you are allowed to actually create new accounts on the target machines

though yeah could make the challenge easier for others if you set a super simple password

[dreamy comet]

if there is a rule about this it's seem like i'm blind 🤣

[cerulean wraith]

Using any attack methods to complete the goal of performing the transaction between the provided accounts.

[dreamy comet]

plus create confusion for other of i don't make the username obvious

[cerulean wraith]

well you could always make the username your tryhackme username or discord username

it is in the project briefing

it tells you what is in scope and out of scope

suggest you re read it if you need to

[dreamy comet]

yeah but because i got an admin user on that DC dumping the hash and login via the local admin hash will be the cleanest though

[cerulean wraith]

fair enough

have you tried other shell versions like evil-winrm or things like it

[dreamy comet]

of course but even with an admin user i logged to the ROOTDC i still can't dump the hash by hand or by some obfuscated version of tool like mimikatz

[cerulean wraith]

well win defender is running on there

[dreamy comet]

plus can't run bloodhound because i'm the corp/admin user not a local admin

[cerulean wraith]

and as an admin user there should be a few ways to kill it

[dreamy comet]

i also try to kill the AV as nt system but either way it's just bricked my shell

who tf changed the admin user password on CORPDC ?? (on the .89 network)

[cerulean wraith]

also is shadow the first person to make a thunderbird profile for the emails instead of evolution or whatever everyone else uses

???

[dawn zinc]

I don't remeber correctly but is it normal that the .21/22 machines don't have internet access?

[cerulean wraith]

would assume yes

in a real life senario they probably would have internet access but to make it more secure and not have vuln machines open to the internet that people could use for bad stuff generally tryhackme target machines don't have internet acces

and this is also behind a vpn so yeah

[slender verge]

None of the machines have internet access

[dawn zinc]

yeah I thought so but I wasn't sure thanks 😄

[lime jewel]

Failed to log in using valid credentials in the VPN portal, Is anyone having the same issue? I have logged in previously with those credentials but now it's not working

[heavy crag]

ime, mostly likely someone has changed those passwords, only solution is find other path or leave and join another subnet

[trim beacon]

It is definitely not bad, it just always surprises me when it is wrong with how much confidence it gives its wrong answer 😅

[trim beacon]

You can either register a new profile of just keep using the one with the typo. Won't be any difference really

[trim beacon]

If THMSetup's key gets denied, it means someone modified the SSH files like they should have. This is one of the very very rare cases where a reset is the actual answer to the problem

[trim beacon]

Since most users choose this breaching path, which seems to be the easiest one, we made the conscious decision not to fix the config being pushed down. So take a look at the error, think about what it is trying to do, and then how you can correct it. I'll give one more hint, just because a VPN server pushes down certain routes, does not mean that's the only routes it can route traffic for.

[trim beacon]

If you use proxychains, you can establish a double pivot and then use secretsdump to do this yourself. Or you can simply create a shadow copy of the ntds.dit file and then use mimikatz offline to read the file and dump hashes

[dreamy comet]

the only thing i haven't try is secretsdump, because i have a shell on rootdc (both from the corpdc and my machine) i did try to make a local copy of the sam file and dump the hash locally but i got some type of access denied

[trim beacon]

So on DCs you won't find the AD creds in SAM. You need to volume shadow copy the ntds.dit file. You also can't perform normal copy since the database is in active use. Also, you need the highest machine privileges possible, so can't use even Admin, has to be SYSTEM. Honestly setting up a pivot with proxychains and running secretsdump is easier in my opinion

[dreamy comet]

oh yeah secretsdump is the bester way and i'm giving it a try as soon as my network no long bricked and i did try to make a shadow copy the ntds.dit and got i think the same type of access denied error and i use the reg thing to copy the sam file plus i only need to local admin cred on that machine after that i can use evil winrm to get a better shell

[trim beacon]

Are you using admin or SYSTEM for the copy? Cause you will need to be SYSTEM for those copies. Easiest is to use something like pxexec.exe /s to get a system shell to perform the copies. But again, secretsdump might just be easier

[dreamy comet]

oh wait yeah i think i got system when doing both of those dump

using pxexec for system

[trim beacon]

That should technically allow you to bypass the Access Denied issue

[dreamy comet]

yea i know but at least that method didn't kill my shell

[trim beacon]

PSexec is part of sysinternals, so the tooling should not flag as AV at all, making it quite nice for these types of things

[dreamy comet]

my network is up i'll send some screenshot for you to see what i mean also yep the only not nice thing about that is i keep losing my PsExec64.exe file so every time i need to use it i have to download a new one 🤣

@trim beacon sorry for the long wait but this is what i mean

i did try this method to kill the AV, dump the ntds file and the sam / system file but nothing work but i got my pivot up and a golden ticket on my kali i'll try secretsdump

[trim beacon]

So I do think that is AV blocking you from straight up copying SAM 😂 But it should allow you to make a Volume Shadow Copy of ntds.dit since that is an acceptable procedure. But I would also not just do it remotely but actually first spawn a psexec shell and then do it, so the actual command you are trying to run, like VSC, does not run over the network

[trim beacon]

Secretsdump should work good for you!

[dreamy comet]

i forgot that AV could block that 🤣 and that's a psexec shell on the rootdc or you mean i need a shell with impacket-psexec?

[trim beacon]

psexec shell should work fine

[dreamy comet]

yea in that screenshot i was in a psexec shell

[trim beacon]

Yes, but you are running the command remotely. Drop into a psexec shell, so just vanilla cmd.exe and then from there try to VSC ntds.dit

[dreamy comet]

oh

[trim beacon]

-s cmd /c "ref save hklm\sam C:\" runs the reg save command remotely, which is double malicious. Honestly better to just drop into a shell first and take things from there

Also, the reg save might be failing since remote registry reads might be disabled. So again, better to just do it locally. Will also help you to better understand the error you are getting instead of just simply shell exit with code 1

[cursive cypress]

just pwned bankdc!

[dreamy comet]

@trim beacon sorry to bother but my dumb ass forgot where i put my secretsdump note and i can't find anything about dumping the hash with the golden ticket but i have to go now so while you are here can you send the syntax? thanks in advance (you can dm if it's too much spoiler)

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

You need to load the ticket into memory. One second for link

[trim beacon]

Check attack path 3: https://kylemistele.medium.com/impacket-deep-dives-vol-2-attacking-kerberos-922e8cdd472a

Image here is wrong, instead of doing that a second time, you do `EXPORT KRB5CCNAME=/full/path/to/ccache/file

[dreamy comet]

ok i'm back and i did found that blog plus i know how to work with ticket i just don't know secretsdump command or i'm just dumb

[broken nest]

@dreamy comet You can DM if you still need help with that

[brave pebble]

hi i needed some help with the vpn portal

its not taking in the credentials i had used to login previously

i literally logged in using the credentials found in the mail server yesterday but now its now taking those

is there any fix?

[pseudo parrot]

Which credentials are you using? feel free to dm.

[fading timber]

After i validate my first flag, network is disconnected and i can not continue. How to do vpn persistent ? I am French.

[thin dome]

The admin folders are gone from workstation 1 and 2 in the bank domain in my network. So you can’t save the file to Users\Administartor

[broken nest]

Just create a folder by yourself?

[brave pebble]

can anyone help me with this?

[hexed whale]

Whoever’s just revealed the directory on the VPN Server (*.12)… why?

(117 Subnet)

[granite valve]

alot of users might be there in ur network who are bruteforcing directories and what not in vpn server .

the fix can be : wait for reset ; or find another path ; or change the lab's subnet !

[brave pebble]

Sorry I'm a novice here but could you kindly tell me how to change subnet of the lab?

[granite valve]

everyone's a noobie at the start ; nevermind just grind

[granite valve]

leave the room for couple of minutes ; join again then u might be in another subnet

[brave pebble]

oh i did notice that

my initial subnet was 118 then it changed into 121

still the problem didn't get fixed

[granite valve]

then change it again ; if dont wanna go another route !

[brave pebble]

ok i think I'll do that thanks for the help 🙂

appreciate it

[granite valve]

😈 🦾

can dm ; if still got trouble !

[brave pebble]

sure i will 😊

[granite valve]

GOLDEN CERTS ARE THE BEST 😎

[brave pebble]

hey alpha i dmed you

[eager wharf]

lo, how exactly do we go about getting the logins for the bank capturers/approvers?

i've just changed the AD password of a capturer and logged in via RDP, swift config file says the latest AD password should be the SWIFT login but the login's not working

does it take a short while to sync or something of the sorts?

[iron forge]

think about "Where is my password will be stored on my laptop?"

[eager wharf]

search for a sensitive password file? maybe, got it

[granite valve]

yo guys ; can anyone reset the .116 network ??

[eager wharf]

that unironically helped, thank you

yes i'll hit the reset once im done

please notyetnotyetnotyet

[hexed whale]

Anyone on .117 mind resetting?

The VPN server seems to be broken rn

[eager wharf]

116 here*

[granite valve]

do it ! just reset it ! 😂

[eager wharf]

man, its been reset

:(

i was about to get my final flag, damn

now i'm going to be going through a chain of RDPs again but at least it should be marginally easier

[granite valve]

that's the regarding pain among other resets !

[eager wharf]

yeah, i'm probably not alone

i guess stuff like this won't be a problem once its closed access and for the business peeps only since it wasnt meant to be en-masse given to the public

[hexed whale]

Anyone else on .116 subnet unable to ping e-citizen (Left and rejoined room)

[eager wharf]

well, yes because the server's getting reset here on 116

i think

[hexed whale]

In my attack box via THM web I can ping?

[eager wharf]

though i just pinged it and its alive

ah

strange

i think its an issue with your vpn then, try reconfiguring it if youre using ovpn

[hexed whale]

|| Ready to verify? [Y/X/Z]: Y
Warning: Permanently added '10.200.116.12' (ECDSA) to the list of known hosts.
ubuntu@10.200.116.12: Permission denied (publickey).

Could not recover the verification file, hence flag could not be verified

Once you have performed the steps, please enter Y to verify your access.
If you wish to fully exit verification and try again please, please enter X.
If you wish to remove this verification attempt, please enter Z
Ready to verify? [Y/X/Z]: ||

@trim beacon ?

? No Im trying to get perimeter breach flag

[granite valve]

oh ; how u writing ur file / flag ?

if u used powershell its fucked up . ; so use cmd or rdp

[hexed whale]

DM

[serene sedge]

I guess someone messed up the SSH service! but u can try to get further into the network and use a different endpoint to verify this flag 🙂
Alternatively you could swap subnets and retry there?

[hexed whale]

Probably me when I priv esc'd knowing my luck LOL! Will be attempting over networks

[slender verge]

@trim beacon I am retracing my steps so I can do a write-up, may I ask you if something is intended or a bug currently?

[trim beacon]

See message here: #red-team-capstone-challenge message

However you can just further compromise the estate and come back to this flag on a different host

[trim beacon]

Sure you can send through

[hexed whale]

Thanks dude 💖

[brittle badge]

Gave +1 Rep to @trim beacon

[slender verge]

thank you 🙂

[brittle badge]

Gave +1 Rep to @trim beacon

[eager wharf]

hey, anyone here able to help me with doing the final flag?

how exactly do i go about all of that process, where's the flag email and am i supposed to send any transactions?

i've got everything i need and i've done all the other flags

got the capturer's and approver's email, my own set of two emails and access to the website

how exactly do i prove all of this stuff, and what's the "SWIFT Access flag email", is that just the current email i have?

[iron forge]

do claim flag and follow the step by step

i mean ssh to e-citizen and do like you do when claiming flag, it's a sequential process, from flag 17-20, so take note of everything. if you did not get the email in the Flag 17 process, i think you can reset the swift flag and repeat the step

[eager wharf]

nvm, think i got it

yeah, of course

i just missed where my pin was in the emails i got

ended up restarting it like 5 times

[iron forge]

did you verify if your email is created?

[eager wharf]

yeah, of course

it's been done now, got the last flag

i didn't look at the email properly, mindlessly claimed flags, turns out the pin was on that first SWIFT email

[iron forge]

coool

[eager wharf]

ye

great machine overall, that was a blast

[bold finch]

**Hi, everyone! **
Sorry if anyone ask it before, but I have really troubles.
I configured ||corpUsername.ovpn|| file to remote ||10.200.X.12 1194||, but when trying to connect it always restarts every 5 seconds. This happened after I add ||sudo ip route add 10.200.X.21 dev tun0||. I don't know, maybe it has something to do with that.
Please help with this, I thank you in advance.

[clear badger]

I don’t know that route. There are like at least 3 other easier ways to make your way through the network. I would focus on finding those.

[brave pebble]

you have to make your own custom vpn file to get into the internal server

you can do that through the vpn portal but first find out how to access it then make any vpn files you want

[dull kestrel]

If the route has been added correctly, ip a should show you the ips and you can just try nmap the other machines

[hexed whale]

Anyone able to quickly help me pivot into the machine cause my proxychains and that seems to be busted?

(explain what Im doing wrong ^)

[brave pebble]

I still had trouble even after that then used the vpn portal to manually generate a custom vpn file for me with the credentials that i had found during enumeration

[dull kestrel]

This works too

But sometimes those generated vpn files can also send invalid ips

[brave pebble]

but now the problem I'm facing is that the freakin vpn portal doesn't accept the credentials 🙂 i got a reverse shell through that yesterday but now nothing works 🙂

[granite valve]

DM

[bold finch]

LoL, don't know why, but I can't login to VPN request portal, although everything was fine before

[bold finch]

My credentials are correct.

[dull kestrel]

If network resets then your persistence is removed 😂
and if some one else can also rewrite the ssh keys

[brave pebble]

someone already did that actually but luckily @granite valve took the trouble and guided me through this mess :' )

[cerulean wraith]

think someone kept breaking the vpn server multiple times on shadows last subnet because it always failed logins with correct credentials

[brave pebble]

so that's why the creds didn't work

[cerulean wraith]

¯_(ツ)_/¯

could also be intentional breaking by itself to make it more realistic by am03bam4n

[granite valve]

then , shadow could find another way in . from .13 [ web ]

its easier than shadow thinks

[cerulean wraith]

well probably

found the admin thingy thingy on web in the past

vpn works now so can finally login there if shadow wants

also easy auto generated personal vpn file

[granite valve]

cool ; happy hunting !

[cerulean wraith]

oh lol forgot to verify the email again to access it again

[pseudo parrot]

Oh, so you got a flag?

[cerulean wraith]

nope but got the rules of engagement message in there

ah nice and easy setup

[pseudo parrot]

Ah, you logged to the mail server that way.

[cerulean wraith]

yeah a thunderbird profile

and /etc/hosts

[brave pebble]

is the vpn portal working again?

[cerulean wraith]

dunno how working it is but seems it is working enough on shadows subnet

[brave pebble]

oh ok

[cerulean wraith]

Once you have performed the steps, please enter Y to verify your access.
If you wish to fully exit verification and try again please, please enter X.
If you wish to remove this verification attempt, please enter Z
Ready to verify? [Y/X/Z]: Y
Warning: Permanently added '10.200.116.12' (ECDSA) to the list of known hosts.
ubuntu@10.200.116.12: Permission denied (publickey).

Could not recover the verification file, hence flag could not be verified

Once you have performed the steps, please enter Y to verify your access.
If you wish to fully exit verification and try again please, please enter X.
If you wish to remove this verification attempt, please enter Z

;-;

@trim beacon soo how do shadow get their flag now????

because that error on e-citizen does not look like it is user fixable

[smoky breach]

clear

[cerulean wraith]

nice good job @smoky breach

and got a sudo user on the vpn box with access to all commands without password run as sudo

oh wait shadow might understand why e-citizen fails

someone removed what e-citizen needed to work to gain a ssh session

[granite valve]

from where u tryin'' get the flag ?

[cerulean wraith]

VPN host

[granite valve]

powershell is fucked up ; u might wanna use cmd or rdp

[cerulean wraith]

the problem seems to be someone nuked the authorized_keys for the public key that e-citizen uses to verify

[granite valve]

oh ; then --> its time for some pivot !

[granite valve]

does this looks same as yours ?

[cerulean wraith]

yeah probably

[granite valve]

https://tenor.com/view/emmy-amy-poehler-peace-out-peace-sign-peace-gif-13956226

[cerulean wraith]

oooh haha

yeah shadow and connor are apparently on the same subnet too

@hexed whale ello neighboor red teamer

assuming connor@parrot is their hacking machine from their addition to the authorized_keys file

also seems the vpn files this vpn host is generating are broken and don't actually currently give access to the internal stuff.. but could use the vpn host as a jump host

just gotta setup proxychains

eugh tired now so dunno if shadow feels up to it

[hexed whale]

.119?

[cerulean wraith]

huh nope .116

but there was a authorized_keys public key with connor@parrot

[hexed whale]

That was me earlier lmao, couldnt get the internal vpn generator to work so hopped off that subnet

[cerulean wraith]

haha

[hexed whale]

Im smashing my head against a wall trying to get into corpdc tho...

||┌─[connor@parrot]─[~/Documents/THM/Red_Team_Capstone]
└──╼ $~/Tools/local/BloodHound.py/bloodhound.py -d corp.thereserve.loc -u svcScanning -p "Password1!" -ns 10.200.119.102 --dns-tcp -c all
INFO: Found AD domain: corp.thereserve.loc
Traceback (most recent call last):
File "/home/connor/Tools/local/BloodHound.py/bloodhound.py", line 5, in <module>
bloodhound.main()
File "/home/connor/Tools/local/BloodHound.py/bloodhound/init.py", line 303, in main
ad.dns_resolve(domain=args.domain, options=args)
File "/home/connor/Tools/local/BloodHound.py/bloodhound/ad/domain.py", line 666, in dns_resolve
q = self.dnsresolver.query(query.replace('pdc','gc'), 'SRV', tcp=self.dns_tcp)
File "/usr/lib/python3/dist-packages/dns/resolver.py", line 1089, in query
return self.resolve(qname, rdtype, rdclass, tcp, source,
File "/usr/lib/python3/dist-packages/dns/resolver.py", line 1043, in resolve
timeout = self._compute_timeout(start, lifetime)
File "/usr/lib/python3/dist-packages/dns/resolver.py", line 950, in _compute_timeout
raise Timeout(timeout=duration)
dns.exception.Timeout: The DNS operation timed out after 3.2024636268615723 seconds||

[cerulean wraith]

timed out after PI seconds

[hexed whale]

indeed but why?

[cerulean wraith]

¯_(ツ)_/¯

anyways time to play subnet roulette again

[trim beacon]

You keep compromising the network, then you will get access to machines like WRK1 and WRK2, where you will be able to submit the first three flags in one go

[hexed whale]

When your in ||svcscanning|| but still needs to get the first three flags cause stupid

[cerulean wraith]

should still be able to get them as that user shadow would belive connor

[trim beacon]

Not sure how your connection is working, but I don't see that you are using proxychains? So how are you connected to the network?

[normal spire]

setup dnschef

[hexed whale]

sshuttle

[normal spire]

https://www.youtube.com/watch?v=4ydjpSSKQ8g

[hexed whale]

See DMs

[hexed whale]

Trying to do it under 'Server1' hostname but nothng 😦

[normal spire]

need wrk1/2

[cerulean wraith]

welp shadow lost track on where they were on tyler r:s vods

time to watch part 4 because it feels like that is where shadow kinda left off

[fervent sail]

I've got a couple questions when it comes to a red team report, not sure if this is the place to ask it, but since it is for this room I will put it here. #1 Is more information better or should I try and keep it concise? For example when transferring a file to a machine should I just say "I transfered mimikatz to x" and then continue on with me running it and exploiting a system or should I actually show me hosting up the file, using wget, making the file executable, etc? #2 For a red team report would you list all of the vulnerability findings and their fixes like you would for a pentest report, or should my report only focus on the goal execution?

[cerulean wraith]

shadow would go for stupid simple explainations including all the steps but trying to show impact ¯_(ツ)_/¯

though shadow is not certified or actually a pentester or red teamer so no experience in report writing

[trim beacon]

See last point of the criteria for submissions: Clear and concise explanation of technical concepts and processes. So make sure to talk about the technical details, but keep it concise and to the point.

Red team reports do not list all vulnerabilities. That would be a penetration test report. Red team reports have what is called the compromise story. It explains how the final goal was achieved and along the way makes note to the misconfiguration that allowed this to happen. Then are the end you can talk about recommendations, which looks at overall what went wrong and what will be the tiny fixes that will make the most impactful change to the security posture. I'll give you a hint, it isn't the usernames that are the problem....

[fervent sail]

Thanks a ton for the information

[brittle badge]

Gave +1 Rep to @trim beacon

[cerulean wraith]

YAY first 3 flags gotten

sorry who ever it was shadow killed a rdp session for

swapped to another account shadow had creds for to avoid interfering

@trim beacon if you got a new private internal vpn file... and the network resets or restarts... will it still work afterwards???? could test but not gonna force a reset for it

[slender verge]

The files still work, yeah

[cerulean wraith]

thanks for that confirmation @slender verge

[brittle badge]

Gave +1 Rep to @slender verge

[slender verge]

If you have to change subnets too

[cerulean wraith]

hmmm 3 valid cred pairs... 2 of which are help desk employees

feels good

[normal spire]

congrats

[cerulean wraith]

those are email subject lines

[clear badger]

Good stuff @cerulean wraith

[cerulean wraith]

now to either relax or to go watch more of tyler R:s videos to get further

guess that if the network resets and shadow regens the email with the verify email e-citizen options all of these emails will pop in there again

but not sure on that either

[pseudo parrot]

Take the flags to be on the safe side. Lol

[cerulean wraith]

already made a flags.txt file in the ctf/red-team-capstone folder

now to stall submitting one until tomorrow to use it as the streak upper

[slender verge]

can confirm, the email client will repopulate once you authenticate and verify email again

[cerulean wraith]

thanks again for sanity checking shadows things

[brittle badge]

Gave +1 Rep to @slender verge

[slender verge]

no problem, rooting for you to get that badge

[cerulean wraith]

yeah that is the end goal... for now it is chillax with tyler R:s vods

[slender verge]

sounds like a good time

[cerulean wraith]

yuups

[dawn zinc]

idk if you guys from the staff can log check but my attack boxes crashed quite often I had 2 moments today when the Boxes just froze and connection got lost. It wasn't a reset and the timer still hat 1h+ left. The problem is everything is gone and I have to do it all over again... I had it happen many times before and it's incredibly frustrating to have to start all over again and it was basically for nothing.

[cerulean wraith]

would recommend your own kali linux vm instead of the attackbox for this network but you do you

dunno how much staff can help with attackbox stuff though

[dawn zinc]

yeah I agree but the reason why I am a big fan of THM (vs. HTB) is because I can run the attackbox. I can run the attackbox on my business laptop and take part while traveling. and also do quick learnings without having to have my kali vm with me or 2 laptops

[cerulean wraith]

ah then note taking and setting up a quick path to exploit using said notes is your best bet

but attackbox shut itself down after 1 hour if you do not extend the attackbox

and it has a max uptime of around 6 hours

[dawn zinc]

that's what I do because I am aware that there is an expiration but the reason I am mentioning it is because those stats didn't apply and then it becomes tedious. The 1h definitely doesn't apply for this room but I also don't know what the maximum is in this room. I just know it was random. today it was once like 4h in and once after maybe an hour

[cerulean wraith]

aaaah well you share the subnet with multiple people

they can force resets.... said resets will kick you out

[dawn zinc]

like I said, I understand the mechanic it'S not the reason

[cerulean wraith]

okay then

guess it is up to @trim beacon to check in on this then

[dawn zinc]

i still appreciate allthe work that went into this room and that it was open to the community and your help and everyone elses. I just want to point it out as a potential client aswell

[heavy crag]

anyone on the .89 that can Extend it please?? I am almost to SWIFT time and out of extensions

Thank you!!!

[cerulean wraith]

yuup on that... gonna try

apparently shadow can not extend it either.... sorry @heavy crag

[heavy crag]

its fixed- some one did! caution AV is tight in the BANK side so careful with your commands in psexec or similar- it will kick you out of your shell- amazing!

[cerulean wraith]

well if you got some good permissions there you should be able to disable AV temporarily at minimum

think am0 talked about there being scripts to auto re enable AV

[stark hemlock]

If you are running out of time and you are in a bricked subnet, you can leave and rejoin a room in a new subnet without maintaining streaks. Finally the creds worked! Subnet 10.200.121.XX was bricked for days

[cerulean wraith]

ooh yeah that one

was on that for about 3 hours

shadow has played subnet roulette multiple times over now

[heavy crag]

yes- the struggle is real

[cerulean wraith]

finally got a working internal vpn file that is private to shadow themselves

and 3 credential pairs

and knowledge of how to get administrator on a perimiter host

gotta learn proxychains and ssh portforwarding for the rest

[stark hemlock]

Yeah I just rooted the VPN box, created a dynamic proxy with SSH, and once I actually root these boxes, I’ll drop a relay back to myself through the VPN box so I won’t need the VPN profiles

[heavy crag]

can anyone help me solve this riddle? why am I not authorized to RDP in to BANK? I am part of Enterprise Admins, DA, AV turned off, inside a folder with AV Exclusion setup. I'm in PsExec64 shell with the system flag, confirmed NT/Authority

[cerulean wraith]

because RDP permission is not included in most of those

you should be able to add RDP permission though

[thin dome]

I made it finally . If your RDP gets stuck or you rdp into a host and it takes you to another active rdp session instead , you can see each session using cmd with the following commands qwinsta username And rwinsta session id# to reset the connection. Had to do this a few times and it works like a charm

[thin dome]

Did that to me a couple times but I eventually got through. It will work. Your username should be BANK\darkf in the rdp gui

[heavy crag]

I have tried multiple combos, BANK\darkf, \BANK\darkf, BANK.thereserve.loc\darkf ,etc same result is login failure

no luv with PsExec either

[eager wharf]

Yeahh, there's something weird up with psexec

Kept having a similar issue

Its definitely BANK\name for it by the way

[heavy crag]

maybe learning MSF with proxychains would be easier after all?

[eager wharf]

Dunno if this might be the thing by the way, but which domain did you add the user on?

[heavy crag]

every server I land on -lol. so far CORPDC, ROOTDC, BANKDC. all are DA or EA where avail

[eager wharf]

So you used the RootDC to make the account on Bank's?

[heavy crag]

from CORPDC I remoted into ROOTDC with psexec /s -- still trying to even connect to BANKDC- rn im just plain confused

[eager wharf]

Surprised you got there, it failed to psexec for me dozens of times for no reason

Foolproof way that I ended up doing which is more reliable than the rest

why make any accounts at all?

[heavy crag]

ok to be clear - I am on ROOTDC now.

[eager wharf]

Alright, nice

Can you rdp there as well or nay?

Made a user you can do that with?

[eager wharf]

I just ended up laterally moving through the preexisting administrator accounts

[heavy crag]

my darkF user has EA,DA and Remote Desktop local

[eager wharf]

By resetting their passwords to something predictable and RDPing

[heavy crag]

im simply outta knowledge

[eager wharf]

Yeahh. I'm lost as well

Try rdp through your thereserve\darkf account?

From rootdc that is

You have to launch all of these from said rootdc to get into the bankdc, don't think its in corpdc's scope

[heavy crag]

thanks man -- im gonna take a break thanks for your help!

[eager wharf]

anytime, fren

[cerulean wraith]

perfect time for break as the network is resetting

[eager wharf]

this whole thing definitely aint a pushover. i'll be helping out a bit for the last few days if i have time

[cerulean wraith]

6 and a half days lefft

[eager wharf]

i do hope someone out there documents all the different ways you can pentest it though, there's so many entrypoints i havent tried out and probably wont for my own sake

[cerulean wraith]

all you red team users better run better run quicker then our business creation
shadow 2023-05-30

[eager wharf]

since jesus christ this is probably the first time i've had 15 terminal windows and 3 rdp sessions open at once

[cerulean wraith]

well if you wanna do this after they close it down guess you should apply for a business license

[lucid bay]

Why does it show to me 5 days?

Besides, I completely lost the access after 5 days?

[cerulean wraith]

that is before it kicks you out of the room to free up subnet space

none of your answers and progress will be lost

but you will have to rejoin the room

[lucid bay]

oh, I see. Thank you

[cerulean wraith]

no problem

it is how all the network rooms work

[lucid bay]

I can continue this room once I joined it

[cerulean wraith]

as the subnets are shared between users it helps keep costs low

[cerulean wraith]

yuups

[eager wharf]

yeahh, i learnt that eventually

the first network room that i joined was HoloLive, and I thought the countdown was going to lock me out lmao

i ended up rushing through the entire thing in the 6 days of access i had

and this room i ended up rushing in less time due to that old habit too

3ish days

[cerulean wraith]

well in this case the rushing will help as this room is not staying open to the public for that much longer

[eager wharf]

yeah, this one was the real deal. thankfully got it done, heh

still take breaks though, peeps. unhealthy not to

probably wasn't the best on my mind to sell my soul for the past 3 days because i came in a little late and ended up hitting at it for 5+hrs/day

[hoary cobalt]

for some reason, after I ran /bin/cp to try and read a file ( shell ovpn), I got this error after running simple commands (was there an update in security?): ls: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.33' not found (required by /home/ubuntu/libcrypto.so.3) ls: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.34' not found (required by /home/ubuntu/libcrypto.so.3)

[slender verge]

Huh, I've been trying to retrace every step for a proper write-up and it's honestly looking like I never actually managed to bypass AV, someone else must have been disabling it on my host 🥲

[stark hemlock]

If you have been getting utf-8 codec cannot decode byte errors when reading your flags, make the username.txt file locally on Linux and run unix2dos on it so it uses Windows' default text format UTF16

[sweet patrol]

or just use cmd

cmd /c "echo my-guid > c:\windows\temp\username.txt"

[sweet patrol]

i disabled it whenever i got to admin just so i could use mimikatz for looting 🙂 probably should have turned it back on when done

seemed mean though

[warm island]

Hey can i get the 'RedTeamer' title if i complete this challegen?

[slender verge]

I did that once or twice, mostly just created exclusion folders

[slender verge]

No, that was from a different event

[warm island]

Im all about this Title

maaaaan

Thx for answering

[slender verge]

There's a badge when you complete it

[slate hill]

I am also getting 172.32.X.21/22 instead of 10.200.X.21/22. I can manually add the route and access 10.200.X.21/22 but wonder why i am getting 172.x.x.x and not 10.x.x.x. Does anyone know? is this an issue with capstone network?

[stark hemlock]

You have to change the openvpn config file to not pull routes from the VPN server. And then add two more lines pointing directly to the boxes. 3-5 lines.

[heavy crag]

deliberately broken ovpn to make the path harder to encourage people to explore the 4 other paths or learn how to modify the script- choice is yours;)

[stark hemlock]

There is also a No-VPN Method that I was trying out before the network reset. I’m going to finish the rest tomorrow, hopefully I can rejoin the room. The No-VPN Method uses relays on Linux and Windows netsh via firewall hole-punching and proxying shells between each subnet.

[trim beacon]

Mmm, I'm not fully sure? I think it might work since the client cert should check out? I see others have confirmed that it does work

[trim beacon]

Remember that BANK PCs automatically work with the BANK domain. If you want to auth with an EA account, make sure to specify the correct domain .So that will be thereserve.loc\darkF in the username field when you auth

[trim beacon]

You can verify the Domain of the account by looking for the OU of the account

[eager wharf]

If you could, would you be able to give me a full rundown of how/which tools used from entry all the way to bank? I'd be really interested to know how you can proxychain multiple connections and do so on windows too

[trim beacon]

Pop me a DM and I'll send you three videos I create for this

[granite valve]

yo man @trim beacon ; whats the issue with network stopped

its 3rd time today ;

it says it stops after no one's using ; but am on that network

[granite valve]

i would also like to know that.

[trim beacon]

It stops after the time runs out. If you extend the time then it will continue again

[granite valve]

sorry to say that but it had time ;

[eager wharf]

I can't seem to be able to, Discord's telling me I don't share a server with you or you have that option off. I'll go ahead turn my restrictions down and you can shoot me the DM if possible?

Man by the way, you make some amazing rooms. Props to you, probably my favourite thm dev

Would love to see those vids though, absolutely

[trim beacon]

You need to verify your profile first

!docs verify

[granite ember]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[trim beacon]

Will respond in DMs in a bit

[trim beacon]

You will then probably have to chat at #site-support for them to review what is happening with the connection

[granite valve]

sure ; lets give it last shot !

[eager wharf]

Ah, makes sense. I'll probably go ahead do that sometime for future ref

[undone night]

hello im new here anyone help me?

[jade bloom]

Hello

Hey anyone can help me in stuck getting connection from rootdc with my attacker machine i should pivot right? If yes I have tried plink it showing " no supported authentication methods available (server sent : public key, keyboard -interactive)

[forest plinth]

It should be the biggest regret that 《Red Teamer》 title was not given in this challenge.

[pseudo parrot]

Nah, I prefer Red Teamer being part of the event.

[gleaming bough]

anyone having problem connecting with mysql server in vpn

[cerulean wraith]

make sure your password and username are the right upper and lower case letters

[gleaming bough]

funny now vpn portal is not working

[cerulean wraith]

uh oh

someone might have bricked it then

or it just did it itself

if you are on the .89 subnet the VPN host might be a bit slow as shadow is spamming it with packages for nmap

oooh now the vpn host is broken as it gives the wrong routes again

[cerulean wraith]

welp poop someone broke the vpn host completely... it no longer accepts the input to start a rev shell

and shadow don't recall what the backend was on the web host

[fiery sinew]

Hello everybody, I'm trying to access the vpn portal, I have the username and password, for some reason it keeps loading without delivering. My ovpn works.

[cerulean wraith]

do you have burp's intercept proxy turned on???

[fiery sinew]

nope!

i type 10.200.xxx.12 and everything is fine, I put username and password, and nothing

[cerulean wraith]

guess someone might have broken your vpn host too

seems to happen often

[fiery sinew]

Is there a fix to that? I'd love to finish the mission

[cerulean wraith]

well the reset button on the room page.... or find another path in

most would state to find another path in

[fiery sinew]

That sucks

[cerulean wraith]

yeah.....

hence why some people play subnet roulette

i.e leave the network room for 3-15 mins... rejoin... download your first open vpn config file again... try again

this will get you a new subnet

some times those are equally broken sometimes they work

it is a bit of roulette after all

[fiery sinew]

glad because I regenerated, and it still doesn't work lol

[broken nest]

If you were reconnecting to newly generated vpn file , make sure to restart the firefox when trying to access the vpn website

When you ask for the next .vpn file there.

[fiery sinew]

victory! Thanks for the tip

[jade bloom]

Hey does anyone know how to create a domain user on root dc ?

Used net user not working

Used new-aduser -name and pass enabled

[cerulean wraith]

nice got a meterpreter shell on VPN host now

[hoary cobalt]

nice, i might try that way in a bit due to current manual complications

[cerulean wraith]

first metasploit proxychains set up

[stark hemlock]

I just got a email saying the Red Team Capstone ends on June 5th? I thought it ends tomorrow?

[cerulean wraith]

the competition ends tomorrow the access to the network ends on the 5th

i.e for first to get all 20 flags and best writeup stuff ends tomorrow

if you are after the badge you have until the 5th

[stark hemlock]

Hmm I think I am too late to win the competition 🤣 So far I got to ROOTDC. And right now upgrading my Linux distros. I think once I get access again I am going to backtrack and make my own VPN profiles so my relay-to-relay method can be sent back to my attacking machine more reliably.

I have been using ssh based dynamic socks proxies for my initial breaches. I never had any luck with the reliability of Metasploit's socks4a server but maybe things changed?

[pseudo parrot]

The three fastest have been taken, still a reward for a really great writeup.

Not sure about the other runners up prizes.

[stark hemlock]

Yeah I have been having issues getting the VPN server to work as a relay since that was what I wanted all along Meterpreter Reverse Portfwd <- DC1 Relay <- DC2 Relay <- DC3 Relay <-> Vault.

[cerulean wraith]

YAY bloodhound collection thingy finally worked for shadow

[sonic goblet]

Getting to the app finally then having the network break on you is... heartbreaking I cannot imagine that on a real assessment. So glad I am experiencing it now 😄

[hexed whale]

Random question, do you lot know if the rewards (hoodie) is for all completionists or for the top X

[thin dome]

Just gotta keep going . I’m probably the most noob of all the noobs . I stayed on it for almost three days straight and got it

[hexed whale]

Ah fair enough, doubt I’m gonna have my report available in time but it’s fineeee I’ve had great fun so far

[cerulean wraith]

YAY 4th credential pair found

[hexed whale]

Woo! Well done

[cerulean wraith]

thanks connor

[hexed whale]

Any time

[cerulean wraith]

this is a service acoucnts creds too so not a normal user

[gleaming bough]

any better alternatives to set up pivoting as ssh -D is not supporting and chisel is not giving proper results

[cerulean wraith]

proxychains using meterpreter

also known as using metasploit

dunno if it is better but it is an alternative

[hexed whale]

Defo better than Sshuttle imo with what I’ve been dealing

[cerulean wraith]

¯_(ツ)_/¯

has been mostly stable for shadow.... so far it has only dropped the thingy 3 times due to meterpreter dying for some reason

[hexed whale]

I couldn’t get meterpreter proxychains to work although got sent some guides by @trim beacon to try so will retry.

[cerulean wraith]

tier 1 foothold and tier 1 admin achieved

huge win

[heady monolith]

My VODs are all available for like 60 days, unless I didn't read a rule somewhere, I wasn't aware that flags were supposed to be kept hidden. Kinda hard to stream and keep flags hidden tbh.

[cerulean wraith]

no problem as am0 stated there is an easy way to check if someone got the flags legit using e-citizen

or at least shadow thinks it will not be a problem

[heady monolith]

Yeah plus once the room goes business only rotating the flags would solve the issue I guess.

[thin dome]

After completing the challenge I went and got a bottle (spoken in the most English accent for bottle like bottel) of rum . Now I can’t see anything and fat finger everything . Is there any help for this

[clear badger]

At the end of the day, we can’t fully stop people from sharing flags. So those who copy and paste are only cheating themselves. I wouldn’t worry about it too much 🙂

[thin dome]

I don’t know if that’s possible actually but if it is then yes , they only cheated themselves . This was supposed to be the capstone of the redteam path . Honestly , I followed Tyler’s path but it was really hard for me . But it helped me understand the whole red team path better and think about maybe things I could have done differently and come to the same goal. I was on this for over a week and for the last part : DCCORP, ROOTDC, and then BANKDC for three days almost on end with hardly any sleep . It’s the understanding of what you are doing that really helps . I had to google through so much stuff and I can’t even really remember the past week at all to be honest . I sit in a dark ass room and hack. That’s all I do. I don’t Work. I spend all of my day hacking . But yes , there are probably people that copy flags and paste for a badge . Who Cares . All that matters is that YOU get it . And UNDERSTAND it .

I payed 16,000 to go through a school through ISRAEL to learn how to hack when I could have payed 14 a month and went through tryhackme and done it way cheaper than what I did . Everything is on google . If you have a will there’s a way . I promise you that

And this was hands down the absolute best learning experience I’ve had in a long fuckin time . The man that created this network is absolutely fuckin awesome and he knew what he was doing . Things don’t work on some subnets , ok, we’ll figure out another way in or go to another subnet . There are alot of ways to complete this challenge and I exploited one that I didn’t think was known about and I wanted to get it done before it was possibly patched because this isn’t a CTF like was stated earlier . Blue Team can come and mess up everything for you. So treat it more as an engagement instead of a CTF

[thin dome]

For example : if you want to know how to add users to a domain then google it or chatgtp it . AI isn’t all that bad

If you wanna know how to mimikatz ( well based on the version you downloaded ) then chatgpt that shit

You can get errors then you gotta start googling and trying different things

Everything will not work the way you seen someone else do it . I can verify that

The network isn’t the problem . Instead of resetting ; which I have done a few times honestly or switching to a different subnet , really look at what you are doing

It isn’t the network

This is as about as real as you are gonna get on any platform

[thin dome]

I kind of wished I wouldn’t have competed it now . This was the thing that really kept me going for the past week . I’m sad . Going back to regular stuff. I wish you all well

[graceful bolt]

Glad to hear you like it too ^^ I had a similar experience of spending a ton of time and feeling a little lost now. Going to rest and get back to studying I think

[thin dome]

I really thought I would come in ass end of this whole thing . I’m triple noob . But I really wanted to explore it and learn what I could

And really , it doesn’t matter :at least for me , where you finish. It’s the whole process of learning . That’s the only reason I did it

[sweet patrol]

i really recommend this room if anyone goes for OSEP in future by the way. it has a similar feel

hopefully THM creates a non-business way to access it in future for those who missed it

[lucid bay]

Thanks mate, your comments really helped me. I think I did it right.

pull-filter ignore "route 172."
route 10.200.x.21 255.255.255.255 12.100.1.1
route 10.200.x.22 255.255.255.255 12.100.1.1

Although, does the 3389 rdp have closed to force people to explore other paths?

Open 10.200.x.21:22
Open 10.200.x.21:135
Open 10.200.x.21:139
Open 10.200.x.21:445
Open 10.200.x.21:5001
Open 10.200.x.21:5985

[brittle badge]

Gave +1 Rep to @stark hemlock

[stark hemlock]

❤️

I do not recall RDP being closed in my subnet

[lucid bay]

yeah, just finish running a full nmap. It's open

[hoary cobalt]

(lol) me: sipping some ramen noodles noticing a pattern where ssh keeps securing itself everytime i run into an issue with home directory being absent

[lucid bay]

RDP not working for me, anyone faced the same?

[hoary cobalt]

try a few times, and you should be able to get it. Ive done about 17 tries before successfully getting rdp

[lucid bay]

17 tries, OMG. Are they setting up it on purpose?

[hoary cobalt]

either that or there just a buzz of people logging in through rdp forcing it to disconnect and us to try and try or disconnect and reconnect like an IT guy restarting a computer

lol

all i can say is, i run into more misconfigurations than contructive thoughts on my end

[slender verge]

try with xfreerdp instead

[lucid bay]

yeah, that's my go to. Didn't work then I did remmina

[slender verge]

strange, it was the other way for me

[lucid bay]

@slender verge Did you do the via domain name or just user name? xfreerdp /u:[e-mail] /p:"Password1@" /v:$IP?

[16:13:33:138] [23854:23855] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[16:13:33:138] [23854:23855] [WARN][com.freerdp.crypto] - CN = WRK1.corp.thereserve.loc
[16:13:42:191] [23854:23855] [ERROR][com.freerdp.core.connection] - Timeout waiting for activation
[16:13:42:199] [23854:23854] [ERROR][com.freerdp.core] - freerdp_abort_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_CANCELLED [0x0002000B]

Remmina shows the disconnect signal received. Disconnect signal received on RemminaProtocolWidget

[slender verge]

for xfreerdp it's just the username

[lucid bay]

Tried about 30ish times. No luck

[slender verge]

yikes, maybe someone changed the password

[lucid bay]

Thanks mate. Voted mine to reset

[slender verge]

good, you can also leave the room, wait 5-10 minutes, and join again to get on a different subnet

[lucid bay]

Joined another subnet. Now the internal VPN starts infinite loop. What’s happening for the network.

[hoary cobalt]

been there. a lot of configuration is next.

[trim beacon]

Hi all, final day for writeup submissions! Get those reports in if you want to be in the running for a prize! Winners will be announced on the 5th!

[rapid sigil]

Oh my goodness! Been trying to get this RDP to work for days now. Switched to xfreerdp from Remina and added /timeout:30000

Worked first time. lol.

[cursive cypress]

My subnet was reset just as I was beginning to access the swift login. I guess that’s my queue for sleepy time

[dull kestrel]

The username is [e-mail]

[forest plinth]

how many wp have been submitted so far？@trim beacon

[fringe yoke]

could you solve the infinite vpn loop with configuration? and if what did you do?

[lucid bay]

Thanks, will try it after I fix the vpn again.

[brittle badge]

Gave +1 Rep to @rapid sigil

[lucid bay]

Tried to add data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC didn't work out.
Update the vpn during the limited time of room is a bad call. The sink cost for me is too high to make me move on other paths.

I want it done and move on next. Or simply remove the ovpn file, then people won't fall in first place.

[hexed whale]

Do I submit a write up/report all the way to ||svcScanning|| 😂

[undone oak]

try using a windows machine . I can not connect on Kali but can connect on a windows machine

[lucid bay]

Thank you will try it. Now I’m facing another round of infinite restart vpn issues

[brittle badge]

Gave +1 Rep to @undone oak

[granite valve]

dm ; i can share u tips to stop that glitch!

[maiden parcel]

When is this challenge going to be business exclusive?

[granite valve]

prob. after 5th hune

[hexed whale]

When your on SERVER1 rdping into WRK1 cause the VPN Generator is scuffed.

[normal spire]

btw you can add timeout bc sometimes xfreerdp dies: /timeout:10000

[hexed whale]

@trim beacon I'm getting issues with utf-8 decoding. When trying for flags ❤️

[cerulean wraith]

eeew someone removed the ability to use pubkey sign in on the vpn host

time to play another round of subnet roulette then

[hexed whale]

Ouch

[fervent sail]

Make sure your mail box is repopulated (if you changed subnets) and make sure you are using cmd to make the txt files, it doesn't work well if you use powershell

[cerulean wraith]

yeah ouch is appropiate as there is no way to fix the pubkey option being disabled that shadow knows of

[hexed whale]

I found a bypass, instead of using evil-winrm I'm rdping into the server box then using that to RDP into the other boxes.

[cerulean wraith]

unless you can restart services with only arbitrary file read and write access

[hexed whale]

fuuuuuu I got booted out my proxychains

[fiery sinew]

Hello everybody,

I'm on the machine 102. So I try getting on bankdc, for that I do the following:

||New-ADGroup -Name "Enterprise Admins"

Add-ADGroupMember -Identity "Enterprise Admins" -Member username

Once I try using the RDP from 102 to 101 I'm notified that I can't remote login so I do this:

Add-ADGroupMember -Identity "Remote Desktop Users" -Members username||

I still have the same error message!

[cerulean wraith]

oh??? wonder if there is a limit to what ports proxychains can use on the target machine

[hexed whale]

I believe you need to get access to the rootdc first ❤️

[cerulean wraith]

and back onto server1

writing a short quick guide helps a meep ton

also why does everyone use the old ssh-rsa format for their ssh keys???

[hexed whale]

SSh-keygen default I think

[weary pecan]

Hey ^^ using the e-citizen, I m trying to get flag 18, but the e-citizen tool only say: "Invalid data, please try again
Expecting value: line 1 column 1 (char 0)" ^^' any issue with the tool ?

[cerulean wraith]

just to be nice shadow reads the authorized_keys file and puts back any other peoples public keys in there after over writing it just so that everyone can play

[fiery sinew]

Hi connor, ok but I do, as I did this:

||``PS C:\users\administrator\desktop> .\PsExec64.exe \rootdc.thereserve.loc cmd

PsExec v2.42 - Execute processes remotely
Copyright (C) 2001-2023 Mark Russinovich
Sysinternals - www.sysinternals.com

Microsoft Windows [Version 10.0.17763.3287]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>hostname
ROOTDC``||

[hexed whale]

Try running those commands on that device.

[fiery sinew]

C:\Windows\system32>net user Administrator password123! /domain

same issue 😢 😢 😢

[hexed whale]

Weird.

Im not at that point, setting up an enterprise admin personally.

[weary pecan]

Here, if you r on 102 (corpdc), you can't New-Group "enterprise admins", since this group is on forest's root

[fiery sinew]

Hello, if you don't mind, I sent you a pm

[weary pecan]

ok ^^

[cerulean wraith]

haha someone killed the web server on this subnet

can't get to the site to meet the team

don't matter much as shadow has another route in but yeah

[dawn zinc]

What am I missing if I can login to the e-citizen portal but can’t ping any other server?

[fervent sail]

The e-citizen portal is just for flags and setting up the email it is not a part of the challenge otherwise. If you have your VPN setup you should be able to talk to the web server, vpn server, and mail server for the network. Those three machines are where the capstone starts. It should also be noted that windows machines do not normally respond to pings by default

[cerulean wraith]

nmap -p 3389 -vv $IP -Pn

to check if most machines are running

because most have rdp port open

obviously you should need routing and pivoting to get into most of the internal stuff

[heavy crag]

Hi - took this same path but was using the psexec.exe /s flag (system)- encountered exactly what you did, somehow got down to .52 with RDP and a messy combo of re-running mimikatz to dcsync each time, while adding a new admin on every server I landed on, I used MSF with proxchains as base --- so convoluted it makes my head spin even as i type this. When my MSF session finally died (5hrs straight) - I tried to get back - that's when I noticed someone had burned down the network below me and reset was 4/5.

[dawn zinc]

I now got a new machine because I am traveling and can’t have another freeze kill after 6h etc. the problem is I can’t even ping the Webserver or reach it via Firefox

[hexed whale]

Time to call it a night. I wasnt going for competition anyways

@trim beacon great network dude ❤️ Loving it

[fervent sail]

Did you try to regenerate and redownload your VPN file?

[dawn zinc]

Do I only need the one one the access page? Yes right?

[fervent sail]

Yeah that is right

[hexed whale]

Can you ping: 10.200.[SUBNET].12?

If so your vpn is all good ❤️

[dawn zinc]

Nope

That‘s exactly why I loved the online version so much it was just no hassle and problems (except for the kill after 6h) 😂

[fervent sail]

Well I would try to regenerate your VPN file if you haven't already, also make sure you are running it with sudo. If none of that works then you can try this troubleshooting script https://github.com/tryhackme/openvpn-troubleshooting

[cerulean wraith]

oh boy the hashes are flowing

[dawn zinc]

Regenerated the vpn, also using sudo

I will try that

😂 nice the script said something went wrong ask for assistance on them discord 😄

[fervent sail]

lol

oh boy

hmm, well you can try running "killall openvpn" and then start up your VPN again to make sure that you only have one instance running

[thin dome]

If anyone needs some help , I’m here . Barely . Downed almost a whole half gallon of rum last night and dying right now

[dawn zinc]

Thanks I‘ll find the answer somehow I guess just my time is running out as I have to travel sadly 😄 but oh well

[brittle badge]

Gave +1 Rep to @fervent sail

[fervent sail]

That's a shame, wish I could have helped more

[heavy crag]

the other thing I notice is changing the admin password on CORPDC seems to be a lot easier path to achieve final goal (even though it is extremely inconsiderate to other players, and a path I avoided)- I wonder why that is- Even creating a new user with admin privs that matches all the groups (basically create an admin clone) does not seem to "equal" the ease that an original admin has.

[fiery sinew]

I need help buddy

can I send you a pm?

[thin dome]

Yes

[slim elm]

When I tried connecting to corpuname.ovpn then initially it's ip was 10.200.[].21 but now this time ip change to 172.32.5.21 is it right

And when I checked if it is up or not using nmap it's not working

[trim beacon]

Quite a number, but still some prizes available!

[trim beacon]

Use CMD instead of powershell to create flag files

[trim beacon]

Glad you are enjoying it! Seems like you made really good progress!

[valid orchid]

Hey @trim beacon,
the challenge almost ends and I want to thank you so much for this experience you gave us here. In the chat and with this challenge!
I wasn't prepared for it, and still have to finish the Red Teaming Path, but thanks to @quaint knot I was able to complete it before it goes B2B. But four days left to look for other paths.
Finished a writeup, hope it is not too bad. Keep up the good work! Thank you very much!!!

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

Glad you liked it and thanks for the feedback! Good luck exploring additional paths! We will be reviewing those writeups soon as the deadline for submission is tonight 🙂

[brittle badge]

Gave +1 Rep to @valid orchid

[hexed whale]

Will be doing my write up, once I’ve completed the goal. So 🥲

[hexed whale]

Thanks dude 💖 Loving it so much and it’s great practice with AD

[brittle badge]

Gave +1 Rep to @trim beacon

[pseudo parrot]

Release the t shirt designs! 😀

[weary pecan]

Do any one know this issue with e-citizen ? ^^

[obtuse mantle]

So ive got to the point I have a secure connection to the inside of the network but when rdping into 21/22 after the last reset I cant seem to connect to them using remmina. not able to get to rdp 31/32 either,. Any thoughts, or it it a similar issue to the vpn where if someones already in you have to wait till its clear?

[dawn zinc]

Try ip route add [ip] dev tun0

anyone know how to fix the error MTU value failed at 1000, aborting MTU check error when using the thm-troubleshoot script?

[obtuse mantle]

thanks it seemed to work

[brittle badge]

Gave +1 Rep to @dawn zinc

[cerulean wraith]

that usually means something along your network is utterly bonkers

[dawn zinc]

I feel like throwing my laptop out the window 🪟

[dawn zinc]

💩

[hoary cobalt]

Best way to configure that is to delete that VPN then configure a new fresh vpn and try again. Think of it as going down to the bone of the issue and seeing if it needs to be restarted

[hoary cobalt]

the lengthy way for this is 'sudo openvpn --config [path]-configuration-name.ovpn --data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC' and i actually have article I made on it but it works a lot better when you just completetly redownload. If you have more issues, its your computers default configuration or connection issues

[hoary cobalt]

best way is to (delete) rm that current .ovpn file then reinstall the ovpn. If you have routing problems, just refer to changing the routes and creating a no pull request in the .ovpn file through either nano or mousepad

from my experience so far

[cerulean wraith]

meep it something is lagging or crashing shadows ssh sessions over 3 subnets... guess it is time to relax with a gamer live stream and try again tomorrow

after all shadow needs a bit of a break anyways

was about to add users to corpdc for domain admin

[hoary cobalt]

that sucks, but at least you start thinking of refining new ideas while you take a break

[cerulean wraith]

yuups

all the last 7 subnets shadow has tried has broken web machines too so could not try the alternative pivot route shadow wanna try

because accessing the web cms backend sounded like a fun time

[frank mountain]

Woop, finally done, so proud. Thank @trim beacon for this wonderful experience !

[brittle badge]

Gave +1 Rep to @trim beacon

[hoary cobalt]

I made a user called simp for shell, yet the shell isnt simping for me lol

[lyric stream]

Rename it to Keats, recite his wonderful poem "On receiving a curious shell", and it should work. 😄

[hoary cobalt]

Im going to be honest, I cant tell if thats a joke or legit at this point. Ive been having shell problems on every technique ive used according to my knowledge where keep getting || sudo: unknown uid 33: who are you? || lol

[lyric stream]

Sorry to hear that, it was meant as a joke about John Keats. That's a real poem by the way. 😄

[hoary cobalt]

Understood lol, i dabbled a bit in poetry in the past so I was like, yeah sure, lets try this. All in all, my main problem is I wont sleep until I solve a problem and its counterproductive lol

[cerulean wraith]

you need a bonk to sleep???

[lyric stream]

Someone might have messed with the /etc/passwd file.

[hoary cobalt]

if so, ive been hitting a brick wall the whole time. The first time I got shell, I got in (after numerous vpn and bash not working) and began looking around and after an hour or so of trying to manually try to get privilege access. || I found out that it allows my favorite language ( best langauge ever from my perspective) and saw that i could create a server on my host machine so I sent peas on over to analyse the shell. I found a few CVEs but settled on one that took a little time to do research on and transcribe a bit over to my language but when I ran it..I was partially successful so I tried an old way this was the results too: www-data@ip-10-200-XXX-XX:/tmp$ ls -la /etc/passwd
-rw-r--r-- 1 simp root 60 May 31 19:25 /etc/passwd
www-data@ip-10-200-XXX-XX:/tmp$ cat /etc/passwd
simp:$1$simp$fz71rbG.h9c1qy1XKtsC6:0:0:root:/root:/bin/bash
www-data@ip-10-200-XXX-XX:/tmp$ su simp
su: Cannot determine your user name.
www-data@ip-10-200-XXX-XX:/tmp$ sudo simp
sudo: unknown uid 33: who are you?
www-data@ip-10-200-XXX-XX:/tmp$ ||

[lyric stream]

Your user account probably got disabled when you edited the passwd file without sudo privileges.

[hoary cobalt]

interesting that would make sense. What would you recommend I should do next, surface level wise?

[cerulean wraith]

on the vpn host there already is a user with full sudo access without password

shadow tends to just add their ssh key to that users authorized_keys file

and ey presto

shadow also reads said file before doing that so that they can add back all the other users ssh keys into there after

to play nice so to speak

[hoary cobalt]

interesting, I tried that myself with the keys file and the response i got from the shell was: (only the end of what I ran) | sudo tee -a "$LFILE"g5XVMh
sudo: unknown uid 33: who are you?
So i may be disabled as timtaylor pointed out

[forest plinth]

🥳🥳🥳

[dawn zinc]

can I send you a dm?

[hoary cobalt]

yea, sure, any help is appreicated

[cerulean wraith]

yeah sounds like something is bricked in either /etc/shadow or /etc/passwd

[hoary cobalt]

yep, i think im 100% disabled to be honest. In that case, im out of the game since I gotta put time down

[cerulean wraith]

hit the reset button..... or play subnet roulette

[lucid bay]

Thank you, will try it

[brittle badge]

Gave +1 Rep to @hoary cobalt

[hoary cobalt]

lol, will do, I did reset it once already for this problem yet it still lingered which was weird. as for subnet, here we go again lol

[cerulean wraith]

well avoid editing mission critical files

[hoary cobalt]

will do, or try 00 -- its weird how i can add but cant remove, but adding is like a sudo priv

ill figure something out

[heavy crag]

heres any easy one: how to solve intermittent copy paste function in THM attackbox. it went from working every 3rd time to not workig at all. I'm even using the
"roll out" style built in clipboard feature- it populates it but does not transfer it to the terminal or anywhere for that matter. NVM - the 30th time is the trick - FML. I could do this all day! think of how good I will be at it? shift-control-c | shift-control-v x 30 === amazing hacking skillz!

[slender verge]

Anybody manage to get in through the CMS? I spent hours looking up CVEs and got nowhere

[heavy crag]

word on the street is you brute force the login with room password list as your rule base

[slender verge]

Really? You can just brute-force the CMS?

[heavy crag]

just like mail

[slender verge]

I thought it'd be some known exploit instead

[heavy crag]

did you finish and exploring new paths? I got to .52 and ran out of .... everything

[slender verge]

Yeah, I finished it and I'm throwing other things at it to see what sticks

[heavy crag]

well i could use a lifelife DM?

[slender verge]

Sure, let me know what you're trying

[lucid bay]

Finally, got the rdp connected. I didn't even need the data-ciphers. Just about rejoing network and redownloading the capstone ovpn files more than 5 times. then working

[lucid bay]

nice, it stops working again. Have to do re-dowload&connect all over again

[stark hemlock]

Forgot to mention that if you can make a excluded folder as admin using Set-MpPreference, you can drop a Microsoft Cabinet file that you can make using the gcab command to drop all of your tools on the box.

I did hear that Microsoft is going to support more archive formats without requiring WinRAR to open like… a 7z file

[crude flame]

Anyone getting a 1359 error when trying to add a user via net user? Or anyone know how to fix it?

[dreamy comet]

anyone familiar with secretsdump syntax? i'm trying to dump the local hash of the bankdc using the administrator hash from the rootdc and i can get it to work fairly easy with crackmapexec but i can't get it to work with secretsdump

[dreamy comet]

same hash and user, syntax look fine but still? 😢

[granite valve]

why ur domain name is ROOT when u tryin' dump/login in BANK ?

havent done this way ; but u might wanna 'FQDN/ROOTDC\USER'@IP

cause admin's hash from both are differnet ?

[granite valve]

disable the antivirus temporily .

[dreamy comet]

FQDN of what? also i use ROOTDC FQDN not ROOT

[south mirage]

Only the domain should be needed here. So just THERESERVE.LOC/Administrator@10.200.89.101 for the impacket command

[dreamy comet]

oh make sense let me give that try

[dreamy comet]

thanks a lot, you are a life saver i have been debugging this is another guy for so Fing long

[brittle badge]

Gave +1 Rep to @south mirage

[crude flame]

When I use ||Set-MPPreference -disablerealtimemonitoring $true|| it just freezes the cmd prompt. Any ideas on how else to do it?

[weary pecan]

had the same issue... solved (I guess) when using an elevated psexec session

[weary pecan]

in a psexec session, or evil-winrm, or in RDP ?

[crude flame]

PsExec session

[weary pecan]

never seen that ... can you do (get-mppreference).DisableRealtimeMonitoring ?

instead of disabling AV, it's also possible to only add an exclusion folder

Hey 👋 I'm stuck near the end with the e-citizen tool to validate flags, can some staff help please ?

Selection:18
Checking swift capture
Warning: Permanently added '10.200.118.201' (ECDSA) to the list of known hosts.

Invalid data, please try again
Expecting value: line 1 column 1 (char 0)
Please select which flag you would like to submit proof for:

So I can't get the action to perform to get the flag, or validate ... just stuck
Thanks for your help 🙏

[trim beacon]

If the network reset, you will need to start from flag 17 again. Auth to e-citizen, press option 2, then reset SWIFT progress and start again

[stiff oracle]

Any help pls am stuck on the corpdc am on the server but can’t rdp in to rootdc am getting user account not authorised for remote login how can I authorise my account for remote login thanks

[drowsy plank]

hi , i have an issue with my mailbox with the correct configurations (i did repopulate it because of the network reset )

[weary pecan]

Thx, got the idea 👍

[weary pecan]

I have a few minutes ... wish a DM to check and get a few hints ?

[weary pecan]

most of times, when I have an issue with my mailbox, I use the e-citizen tool and do [3] Verify email access. Most of times it's due to a network reset. hope it helps

[drowsy plank]

i actually did that and i still have incorrect user/password

nvm it seems working now , it just took more time

[weary pecan]

strange... repopulate can take a little time if you have many flags... I do not really use the mailbox because of these additionnal steps on network resets... I mostly use the e-citizen tool to get the flag back

[crude flame]

Ah I got it working finally! Wasn't using the -s option for PsExec

[drowsy plank]

yeah it takes more than to repopulate , it's working ine now , thanks

[brittle badge]

Gave +1 Rep to @weary pecan

[weary pecan]

yeah! 👏 elevated psexec makes wonders ^^

[hexed whale]

I’m thinking of setting up a local admin acc in rootdc (Got Golden Ticket) then using that to navigate my way down to the swift platform

[hexed whale]

Casually writing my report rn even though I haven’t completed the goal cause my VM decided it wasn’t gonna play nice (I have two, one on my local network and one in the cloud).

[weary pecan]

A local admin on rootdc would be only on that host (local), and would not allow you to go anywhere else ... better thinking in ActiveDirectory, and forest

[civic mountain]

How u can manage proxychain winrm to bankdc with that hashes bro?i tried with that hash but i got denied, do you know what is my problem? Proxychains winrm for me only work maximum at corpdc, won't in rootdc or bankdc, denied.

[hexed whale]

Could you not then add a domain user with rdp and set it to enterprise admin?

[weary pecan]

You should try 🙂 but don't forget to add the (super) user in the domain, so that he can be known by hosts in the forest/domain

[weary pecan]

I can give a few hints in DM to avoid spoiling too much

[hexed whale]

If you wouldn’t mind 💖

[weary pecan]

its ok ^^

[fiery sinew]

Hello guys and girls, I'm super annoyed. Got the ROOTDC access, create a user with a password and the enterprise admins access:

``PS C:\users\username\desktop> .\PsExec64.exe \rootdc.thereserve.loc -s cmd.exe
...

C:\Windows\system32>whoami
nt authority\system

C:\Windows\system32>hostname
ROOTDC

C:\Windows\system32>net user username password123! /add /domain
The command completed successfully.

C:\Windows\system32>net group "Enterprise Admins" username /add /domain

Global Group memberships *Enterprise Admins *Domain Users
The command completed successfully.

C:\Windows\system32>net group "Domain Admins" username /add /domain
The command completed successfully.
``

Then I try RDP on 102 as follow:

I put the ip 10.200.xxx.101.

username: username
password: Password123!

I am met everytime with the message : "The connection was denied because the user account is not authorized for remote login."

WTF is wrong with my stuff?

[trim beacon]

might be that net user automatically creates the account as a disabled account? run net user username /domain to verify if the account is enabled?

[fiery sinew]

Account active Yes

[south mirage]

Can you authenticate to the remote host via another method? Like SMB or WInRM? If yes, then maybe your account also needs to be in the "Remote Desktop Users" group to log in via RDP

[fiery sinew]

proxychains -q evil-winrm -u username -p 'Password123!' -i 10.200.113.101

Error: An error of type Errno::ECONNREFUSED happened, message is Connection refused - Connection refused - connect(2) for "10.200.113.101" port 5985 (10.200.113.101:5985)

Error: Exiting with code 1

Also PS C:\Windows\system32> PS C:\Windows\system32> net group "Remote Desktop Users" username /add /domain e ru Rmt eko sr"Bbo ad/oanThe group name could not be found.

I even checked by opening secpol.msc>local policies>user rights assignment>allow log on through remote desktop services

and added my username

[south mirage]

Is the proxy configured correctly? Like can you reach other ports on 101 via proxychains (445 or 3389)?

Regarding the group, I wrote the group name from memory. Maybe the name is slightly different, but should be something similar at least.
Although I am not 100% sure if it will work if you add your user to the RDP group on the root domain and then access a machine on the child domain. I would have to look into that again to be sure.

To avoid the proxy problems you could try using Enter-PSSession from the windows host you are on instead of evil-winrm through socks

[fiery sinew]

My proxy is correctly set, though, the mentioned ports are closed.
I used a metasploit path, multi handler => socks_proxy => autoroute etc

[trim beacon]

Where did you create the account? In the ROOT domain or just the BANK domain?

[fiery sinew]

I have created the account in the ROOT domain

PS C:\users\username> net localgroup "Remote Desktop Users"
Alias name Remote Desktop Users
Comment Members in this group are granted the right to logon remotely

Members

---

BANK\a.barker
BANK\a.turner
BANK\Administrator
username

[trim beacon]

I would consider maybe creating it in the BANK domain instead

You are trying to now use an EA account, protections will apply to ensure you don't spray EA creds. For example, can only do kerberos, not NTLM auth. So you may not use the IP, have to use the hostname

[hexed whale]

Could he not use corpdc > RDP to rootdc > RDP to bank dc?

[south mirage]

I don't remember right now how it was set up in this lab, but depending on where your proxy is running from, you might not be able to reach the BANKDC over the proxy, if it is running on for example the vpn host.
I think the BANKDC was only reachable from the ROOTDC, so you would have to start your meterpreter session there for the socks to go through.
At least if the FW rules are as I remeber :D

[trim beacon]

The question is not using RDP or not, and the path, it is around the account specifically. Accounts that are privileged have specific protections applied to them in AD. So you need to be aware of this and then either disable those protections, or use a lower privileged account

[hexed whale]

Ah makes sense. Didn’t know whether that was an option.

[trim beacon]

I am met everytime with the message : "The connection was denied because the user account is not authorized for remote login." - This message here tells me that the RDP connection is being established, but the account protections are then kicking in

[south mirage]

Oh yeah definitely. My answer was only about the proxychains error with evil-winrm.

The RDP error is definitely something else

[fiery sinew]

they are protecting cause I know too much... ok sorry. I'm kinda confused. To be clear, I got to rootdc first getting in CORPDC with remmina and then got a psexec. It is a valid path right ?

[hexed whale]

@fiery sinew do you have any other accounts you can RDP in with

[fiery sinew]

RDP in bank ?

[trim beacon]

Path is 100% valid yes. Now you just need to figure out best way to move to BANK, which can be RDP, or other means as well

[slender verge]

can we actually get to CORPDC from .21 and .22?

[eager elm]

Hey Folks!

Just a quick question: I'm inside the network and feeel like good on the way - but I missed flag 4 (Flag-4: Administrative access to Corporate Division Tier 2 Infrastructure).
Can someone give me a hint to which machine i correlates? I got flag 3 (not sure: the ubuntu user on VPN server, right? And I got several flags behind concerning the first DC.
But flag 4 is missing and I cannot find it 😕

[dull kestrel]

Tier 2 is either WRK1 or WRK2

[eager elm]

ahhh 🤭 this option I totalley ignored

thx mate

[cerulean wraith]

@trim beacon ```
Warning: Permanently added '10.200.118.102' (ECDSA) to the list of known hosts.

Could not recover the verification file, hence flag could not be verified

for admin on corp 0 infra

oh wait never mind

forgot that windows hides file extensions by default

[trim beacon]

100% yes. CORPDC is their DC, so they have to be able to see the DC to allow auth

[trim beacon]

Glad you got it sorted. Only when it says key denied is there an issue with it

[cerulean wraith]

the swag stuff that got handed out as prices for the winnners won't be available in the swag store right??? @trim beacon

[trim beacon]

So there will be a generic one on offer for a limited time only. Runner ups for the writeups will receive a voucher to get that one for free. But the customised ones are one of a kind with only four of each being printed forever (the fourth one is mine 🙂 )

[cerulean wraith]

ooh nice gonna try and buy one of those generic ones

@quaint knot thanks again for your awesome walkthrough streams... the struggle learning is real

[brittle badge]

Gave +1 Rep to @quaint knot

[slender verge]

alright, good to know, I'll have to see what I can do about that

the CMS lockout is horrific 🥲

[cerulean wraith]

yeah pivoting from the workstation machines is possible and relatively easy