red-team-capstone-challenge

[slender verge]

I get local admin and then no idea 😁

[mental owl]

@trim beacon I've got a bit of a technical issue with the last few objectives, that happened after a reset in the middle of a transaction- can I DM you please?

[cerulean wraith]

and yeah the cms dieing on the web sever has blocked shadow from trying that path so far

[trim beacon]

Yeah, @rocky python gave me a fix for it on stream which will be implemented before B2B. October does not respect its config when you disable account lockout. However, by now you should know what my favourite password is and it should not be too hard 😉

[trim beacon]

Did you reset your SWIFT progress and start again from flag 17?

[mental owl]

It says I have an active check, so I try to remove the verification attempt with 'Z', then I get an invalid data error message. If I try to re-check 17 I get Invalid data, please try again
Expecting value: line 1 column 1 (char 0)

[cerulean wraith]

uh oh

[trim beacon]

Let me do a force reset, two seconds

[cerulean wraith]

also sneaky no hints option for none busniess users

[trim beacon]

There was no active attempt on your account. However I've removed flag 17 for you, so you can try to just continue from there

For my own check, just which subnet are you in?

[mental owl]

119

Basically I was in the middle of trying last night, then the network got reset. When I got back to where I was just now, it thought I had an active SWIFT check going

[trim beacon]

Quickly check if you can do flag 17 now? Just want to see if it is fully flushed

[mental owl]

On it

[fiery sinew]

So... I have tried going from ROOTDC to BANKDC using psexec: cp PsExec64.exe \\bankdc.bank.thereserve.loc\C$\windows\temp\ Error message. Not gonna lie, it starts getting discouraging

[trim beacon]

Why are you trying to copy psexec to BANKDC? Just use PSexec on ROOTDC?

[stiff oracle]

C:\Windows\system32>net user chris27
User name chris27
Full Name
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never

Password last set 2023/06/01 16:28:19
Password expires 2023/07/13 16:28:19
Password changeable 2023/06/02 16:28:19
Password required Yes
User may change password Yes

Workstations allowed All
Logon script
User profile
Home directory
Last logon Never

Logon hours allowed All

Local Group Memberships *Remote Desktop Users
Global Group memberships *Enterprise Admins *Domain Admins
*Domain Users
The command completed successfully.

[fiery sinew]

I'm not very smart. .\PsExec64.exe \\bankdc.bank.thereserve.loc -s cmd.exe?

[stiff oracle]

hi why cant i remote into the root dc iv set up a account but no luck saying i am not able to remotely desktop any help pls

[viscid frost]

Do you have a connection from your machine? More precisely, I mean that e.g. from the VPN server (as proxy) you might not be able to connect to ROOTDC or BANK.

[mental owl]

@trim beacon ok the verification for 17 worked - (sorry to whoever is fighting with me over RDP :p)

[cerulean wraith]

make your own accounts... unless that is not really possible with the swift transfers come to think of it

ah multi step download and upload to get files onto the DC

[serene sedge]

Finally had enough free time to finish this network, it was a very fun learning experience (all though frustrating at times 😂 )! @trim beacon thank you so much for this amazing network and giving us all this opportunity to give it a try before it is B2B exclusive!

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

This is going to again be one of soap box speech messages that I type out once and pin.

We are currently seeing quite a number of users struggling with goal execution. We are also seeing some incredibly wild and noisy techniques being used here for goal execution. Users seem to be hell bent on using RDP for this when more stealthy and covert techniques exist. On a real engagement, good luck with the blue team when you start randomly kicking actual employees out of their active sessions.

As mentioned before, the two hardest parts of this challenge is the start, and the end. Goal execution is meant to be hard. It is meant to show you that there is an incredibly massive skill difference between "pwning the domain" and actually showing business impact on a red team engagement. This is why this challenge is not a CTF. It is not a boot-to-root challenge. It is meant to simulate what you might get out there in the real world.

With that being said, I'm more than happy for users to help each other here, but do understand that staff might not be providing more help for this portion. This is the point where you need to apply what you have learned to be able to execute on that goal.

A technical note: If the network resets in the middle of your progress between flag 17 - 20, you will have to start again from flag 17. Authenticate to e-citizen, press option 2, and then the option for reset flag progress.

What staff will help you with:

• Flag submissions for the goal execution phase if it gets bricked and does not reset
• Celebrations for finally getting to flag 20

[trim beacon]

Perfect, if flag 17 works and the network does not receive a reset, you should be good now all the way to the end

[mental owl]

Awesome, thanks!

[trim beacon]

I think it is mentioned in one of the emails and also in the room wording, once you can see the SWIFT website, like actually browse to it, you should start the Verify SWIFT access flag, which is flag 17. By starting this flag, Trimento will create two SWIFT accounts for you

[trim beacon]

Glad you could get it done! Congrats! 🎉

[trim beacon]

Should work if your kerberos tickets are good

[cerulean wraith]

so by that logic you should probably not be kicked off rdp as you are using your own accounts

or well if you use your own accounts all the way basically

[viscid frost]

I think the problem is the deadline (just 4 days to go). Thus, people basically just kick in the front door to get the flags done. But I understand the point and still try to improve my path to SWIFT.

[trim beacon]

Windows has an RDP limit on all machines that don't have an RDP license installed. RDP licenses are incredibly expensive, so in real organisations these are only reserved for jump hosts. Normal hosts do not have RDP licenses, meaning the second a third user auth's to a machine, it will kick someone out. Even worse, on Win10, RDP, even as a different account, based on configuration will put the laptop in a locked state, meaning the employee using the laptop would immediately notice. This is why we wait until the dead of night and using keylogging techniques to verify that a user has logged off for the day before we would even think of opening an RDP session on a real engagement

[cerulean wraith]

aaah makes sense... shadow has not messed with this enough to know all the nuance yet

[trim beacon]

Honestly at this point the challenge is getting swatted to be honest. However, if you use stealth techniques, even if they kick the front door open, it will not affect your journey. For example, if you were to use a combination of SSH and WMI, you can do this entire challenge without opening RDP once

[cerulean wraith]

wmi as in evil winrm????

because shadow had trouble figuring out how to create the files with the right encoding for the flags on there

[viscid frost]

This is interesting. ||So far, I got to ROOTDC without RDP (and got the ROOT\administrator hash) but I think at this point one needs a new proxy. My hope was, that I could work my way to BANKDC by DC sync'ing and pass-the-hash (from CORPDC proxy). Only think I doubt that I can manage the SWIFT transaction without RDP||

[slender verge]

I avoided some of the RDP inception, but I don't know how one would complete the goal itself without it...

will we get to see some writeups before the network transitions to b2b?

[trim beacon]

Can I interest you in my religion called reverse dynamic SSH proxies? 🙂

Which might I add, is covered incredibly well by our very own @tall sorrel in his network: https://tryhackme.com/room/lateralmovementandpivoting - Which is part of the Red Team learning pathway 🙂

[trim beacon]

Trust me, 100% possible without opening a single RDP window 🙂

[serene sedge]

U could use powershell
echo "string" | Set-Content file.txt

[trim beacon]

The top three reports will be converted into writeup blog posts that will be published on our website

[slender verge]

oh I'm sure, it's just that I personally don't know how

[trim beacon]

Either use command prompt instead of powershell or use what @serene sedge sent

[viscid frost]

I will give it a try. I was honestly surprised to see that ssh is available on Windows 🙂

[cerulean wraith]

ah thanks @serene sedge

[brittle badge]

Gave +1 Rep to @serene sedge

[trim beacon]

Welcome to the modern age. Now comes standard with Windows Servers

No clue why Windows thought it would be a good idea though 😂

[cerulean wraith]

well shadow is probably gonna complete it using the stupid path of using rdp

because not feeling up to figuring out all the stuff needed to do it rdp less

[trim beacon]

Go for it! Good luck in the RDP force logout arena!

https://giphy.com/gifs/tZCkL6BsL2AAo

[cerulean wraith]

thanks gonna keep trying

so far there seems to have only been a single other user on this subnet that has grabbed flags from the corpdc

[drowsy plank]

anyone had issues when authenticating to the e-citizen seems my password doesn't work anymore

[pseudo parrot]

Windows does Windows.

[mental owl]

Complete! Thanks @trim beacon for an awesome experience

[brittle badge]

Gave +1 Rep to @trim beacon

[cerulean wraith]

not problem authenticating but it was dead slow yesterday for shadow

it took over 3 mins to get logged in with the creds

[drowsy plank]

it's like that for like 2hours now

[trim beacon]

Congrats! 🎉

[cerulean wraith]

and rootdc pwned enough to get the flags

[trim beacon]

Make sure to do some form of persistence so you don't have to follow that exploit path again. Simplest would be to DC Sync the root domain. That way even if the network resets you can jump directly back into that position

[cerulean wraith]

??? goobly gook shadow not undestand most of that message ???

[trim beacon]

Have you dumped the credentials from CORPDC using something like mimikatz or secretsdump?

[cerulean wraith]

yeah

first secretsdump... used mimikatz to do a golden ticket for access to files and folders on rootdc

[trim beacon]

So now even if the network resets, you still have the NTLM hash for the [e-mail] account right?

[cerulean wraith]

used evil winrm to get into corpdc and add a new domain admin user

[cerulean wraith]

yuups

assuming it does not change

which shadow dunno if it would but hope it does not ¯_(ツ)_/¯

[trim beacon]

Okay, now you have gotten access to the root domain, thereserve.loc. Why not dump credentials from this domain so you don't have to do the golden ticket attack again?

If you dump the hash for [e-mail], you will never have to do these steps again, can directly start there next time the network resets

[cerulean wraith]

ah

[trim beacon]

This is called persistence techniques. Meaning even if the blue team kicks you out (or the network resets) you have another way in

[cerulean wraith]

dunno how to do that considering shadows way of access to root dc is using the golden ticket and powershell but probably explained in tyler R:s vod hopefully

considering he also had to deal with network resets

[trim beacon]

You're golden ticket is on Corpdc right? Just run mimikatz in the window that you have created the golden ticket and tell it to dump credentials from thereserve.loc instead of Corp.thereserve.loc

[cerulean wraith]

yuups golden ticket on corpdc .... time to look up mimikatz syntax

;-; why is it so hard to find stuff sometimes

almost feeling like asking for the mimikatz command here because shadow is so bad with mimikatz

meep it time to keep watching tyler to see him do it

[trim beacon]

Check the AD persistence network room. Check persistence through credentials. Syntax is given there

[cerulean wraith]

thanks am03bam

thought it was in one of those network rooms but did not know which

hmm errors

[stone crypt]

Why cant I join the network? It just redirects me to room page that says you need 7 day streak, but I am a subscriber...

[fervent sail]

You still need the streak nonetheless

[stone crypt]

alright thanks for the info

[torpid ore]

a 7 day streak and sub is required

[thin dome]

I’m about to get my 90 day streak yeeee haw

[weary pecan]

oh boy..... I finally made it ! That was a thing ! many many many thanks to @trim beacon That was was a really great challenge! So wide, so wild! so many many ways to explore! many thanks to @trim beacon, for this challenge and his experience sharing ❤️ This is really a thing

[brittle badge]

Gave +1 Rep to @trim beacon

[thin dome]

I hate to sound dumb but how do you give rep on discord . I’m older than dirt and don’t know my way around social media

[cerulean wraith]

@quaint knot second part of stream number 7 seems to be missing with ciritical info on how you got access into rootdc... is the fottage lost or do you have it saved???

[thin dome]

That wasn’t on there

O got a work around though

[cerulean wraith]

someone pings you or quotes you with a mesage that includes the word thanks or thank you or ty or +rep

[brittle badge]

Gave +1 Rep to @thin dome

[thin dome]

Cool

@cerulean wraith I just sent you a dm. Can help with rootdc

[cerulean wraith]

not really as some critical data seems to be lost from the guide shadow used

[thin dome]

It’s not lost , just had to figure it out by myself because it’s not on where you are looking

[cerulean wraith]

lost because the video by tyler is missing a huge chunk not lost that it is impossible to do

[thin dome]

It’s not on Tyler’s Vid. The part you are looking for

[cerulean wraith]

*?????

now you are confussing hsadow

oooh you did not need help but offered help

[warped grail]

with the golden ticket you can do everything. upload implants/dll, start/stop/create services etc.

[cerulean wraith]

well does not look like it ¯_(ツ)_/¯

[thin dome]

I DMd you

[cerulean wraith]

yeah just checked it hornruna

[eager elm]

Guys, am I the only one experiencing issues to connect?

Feels like it worked a couple of minutes and now the servers are not responding

for example even the vpn login page does not give me any feedback on submit anymore

• vote reset 🙂

so sad i'll not make it until end of availability as it looks like :

:\

[cerulean wraith]

+rep @thin dome

[brittle badge]

Gave +1 Rep to @thin dome

[cerulean wraith]

and there we go... the first time the network reset on shadow causing them to get kicked out

meeping moops

[eager elm]

Does it refer to my issue not getting feedback from servers? like vpn one hanging in submit?

[heavy crag]

1st time only? consider yourself very fortunate!

[eager elm]

last nights already have been too short 😬 I'll take a nap.
When will the time end to be able to finish the capstone challenge?

hopefully another 12h 😉

[cerulean wraith]

played subnet roulette a lot to find the few working and not to competitive subnets

[thin dome]

Says it’s 3 days and 13 hours right now

[thin dome]

Try another subnet , press leave the room and then look it up again and join again . Find one that works

And, after a reset , it takes a little to get back up and running . I had that issue once but I waited and it started working again

[cerulean wraith]

yeah

shadow has a decent written quick guide to get back into corpdc

[thin dome]

Y’all can make it

I’ll help however I can

[cerulean wraith]

yuup

just gotta sleep between this last attempt and the next

[thin dome]

I didn’t sleep hardly at all lol . I was so obsessed with getting it cause I had already started it . Felt like I bit off more than I could chew but once I start something I like to finish. It really was an eye opener for me and helped understand things better .

[cerulean wraith]

yeah true

shadow just knows there are limits to their attention and provess in hacking if they keep going for to long

[cerulean wraith]

well could be because shadow did not stay to long and just did step by step quickly to get some new flags quickly

[fiery sinew]

DONE. great challenge @trim beacon !

[cerulean wraith]

nice good job mousse

[fiery sinew]

Thank you 🥹

[brittle badge]

Gave +1 Rep to @cerulean wraith

[cerulean wraith]

you beat shadow too

[slender verge]

Thanks for the hint here, I got in 🙂

[brittle badge]

Gave +1 Rep to @trim beacon

[thin dome]

I still cant get the rep thing figured out. Im a fuckin looser

Now Ive been stuck on this for 30 minutes

[slender verge]

when you reply to someone like this and your message contains the words "thank you" or "thanks" or "ty", or tagging then with "+rep" is how it works

[thin dome]

Thanks . Ill try it but doesnt mean Ill get it. Sometimes I overhtink think things and end up in the weeds, hence why it took so long to do the challenge

[brittle badge]

Gave +1 Rep to @slender verge

[thin dome]

Looks Like I just did it through robocop

[slender verge]

there you go!

[thin dome]

thanks @slender verge

didnt work that time. I guess there is a timeout

[cerulean wraith]

it is limited to once every 5 mins

i.e you can't give out thanks to multiple people unless you wait 5 mins

so yeah timeout

[thin dome]

thanks @cerulean wraith

yeah. didnt work

guess ill get back on scylla and blackbird.py. trying to get an old friends phone number. Its fun to play around with OSINT tools

[stark hemlock]

Finally got persistence on ROOTDC. I used my firewall hole-punching and portproxy trick to point the first DC to the ROOTDC. I had to combine it with a AMSI bypass + Disable AV + Add User

[thin dome]

Let’s see where that goes

[thin dome]

Good job

[stark hemlock]

Do you want me to give a example as a tip?

[stiff oracle]

got to last flag and network reset is there a way to get back to where i was or do i have to do it all again

[slender verge]

you have to get flags 17-20 in one go so you'd have to reset your progress on that

[thin dome]

No

The last 20 flags are all on bank.Corp

My bad

The last 4 flags are all on bank.corp

I don’t know where you are so I don’t know what you mean . Once you get to bank.Corp you got access to flags 9-20

[thin dome]

Like @slender verge said , for the last 4 flags , you gotta have a one shot cause if it gets reset then you gotta start over on the progress for the last 4 flags

[stark hemlock]

Damn. Network is about to reset :(. I'm gonna work on my classes

[slender verge]

At this point you should have enough information to be back at BANKDC in no time

[lucid bay]

nvm, silly me. I was trying to ping under proxychains

[thin dome]

Still here if someone needs some help

[trim beacon]

Congrats on completing it! 🎉

[trim beacon]

Congrats on completing it! 🎉

[fiery sinew]

Thank you! That was awesome

[brittle badge]

Gave +1 Rep to @trim beacon

[dreamy comet]

i think it's depend on the pivoting method and metasploit been working fine for me so far but on the root and bank domain it is getting more unstable by second (for me) so i change it to chisel and it's a bit slower it's much more stable and everything from burp to evil-winrm been working fine for me

also sorry for the late response

[fringe yoke]

I just can't figure out how to use proxychains correctly.. it has always worked for me but now just doesn't:
i breached one of the 'outer' hosts and have ssh access to it as root, so i ssh -D 9050 root@hostname
then i would update my /etc/proxychains.conf with socks4 127.0.0.1 9050
and do proxychains nmap target -Pn etc.
but it seems like it doesn't use proxychains at all, since i don't have that line where proxychains shows me the forwarding through the tunnel [proxychains] Strict chain ... 127.0.0.1:90590 ... target:port ... Ok
i also don't get an error from proxychains, it just seems like traffic is routed through my "own" routes.
do i have to remove the route to 10.200.X.0/24 from my routing table to force traffic through proxychains? I thought this would be enforced with strict_chainin proxychains.conf already?

tested on the THM AttackBox with proxychains 3.1

[dreamy comet]

i 100% can't get the proxychains on both thm machine to work for me, so i would recommend that you use your machine and i always use proxychains4 with the quiet tag so no idea about the verbose thing and in the config file you should use socks5 not 4 and comment out the strict_chain + use dynamic_chain (the last one i don't think matter)

[fringe yoke]

alright, will test that, thanks a lot!

[brittle badge]

Gave +1 Rep to @dreamy comet

[lucid bay]

Thank you, no idea why cmd and notepad not working

[brittle badge]

Gave +1 Rep to @dull kestrel

[dull kestrel]

If using evil winrm it defaults to Powershell

[trim beacon]

Use the -sT flag. -Pn might be lying to you

[lucid bay]

from this line [proxychains] Strict chain ... 127.0.0.1:90590 ... target:port ... Ok It seems you have a typo? It should be 127.0.0.1:9050. And I personally use the socks5. I didn't use the -Pn default nmap works fine.

[fringe yoke]

thanks @trim beacon and @lucid bay , as @dreamy comet pointed ot the problem are the THM boxes (AttackBox as well as Kali). proxychains just doesn't work correctly on those. Used my own one and bÄm, works as intended

[brittle badge]

Gave +1 Rep to @trim beacon

[fringe yoke]

y u no giev Baturu thx?!?!

[lucid bay]

Cheers mate, glad you sorted it out

[hidden galleon]

I'll do it! Thanks Baturu for being helpful 🙂

[brittle badge]

Gave +1 Rep to @lucid bay

[hidden galleon]

Bot only counts rep once per message 😅

[untold galleon]

are your vpn working?

i can't access the network

[dreamy comet]

hi @hidden galleon could i dm you or any staff? the e-Citizen portal seem to be broken on flag 19 for me

[fringe yoke]

resetting 121 now, really? just golden ticketed my way to dc...

[dreamy comet]

i mean if you do it on linux you can keep using can ticket even after a reset

[fringe yoke]

yep sure but the initial access has to be done again, which is ok tho, i need a break anyway

[trim beacon]

If a network reset happened between you getting flags 17 - 20, you will have to reset your SWIFT progress (Authenticate to e-citizen, press option 2, then reset SWIFT progress). Then start again from flag 17

You have to get these flags in a single go

[stiff oracle]

so thats why i CANT GET IN

[dreamy comet]

so that apply to the Invalid data, please try again Expecting value: line 1 column 1 (char 0) error?

[trim beacon]

Most likely yes

[dreamy comet]

so after the reset do i need to get all of the flag from 1 to 19? or will i start at the 17 flag?

also option 3 Reset SWIFT progress right? my brain is frieded and i really don't want to re-do 19 flag

@trim beacon 🤣

[trim beacon]

Jsut from flag 17

[dreamy comet]

yea same error

[trim beacon]

That is fine, it does a full flush. So now try to get flag 17

[dreamy comet]

beside the 10x Permanently added everything seem to be working fine and in the get flag part of this it still show true for flag 17 and 18 so i just assumed the reset didn't work because of the error

[stiff oracle]

am on flag 18 again and am not receiving the Transaction in my capturer access account

[trim beacon]

Give it a go. It if gives an issue still, I'll do a full reset from my side

[trim beacon]

Did you refresh the page? If e-citizen says it has been created, it will be there

[stiff oracle]

will try thanks

there is still nothing coming through

[trim beacon]

Best to use an incognito browser to flush all cookies

[stiff oracle]

ok thanks its working now

[slender verge]

I'm quite confident the hashes don't change, yet before I was able to use both psexec and evil-winrm to log into corpdc and now neither of those are working

[normal spire]

someone might have changed the hashes?

also, keep in mind if the password expired you can't use the hash anymore :/

[slender verge]

huh, does the password expire on this network

[slender verge]

thank you, you were right, hash is different now

[brittle badge]

Gave +1 Rep to @normal spire

[normal spire]

yeah some of the machines have expired Administrator hashes

you can check with net user <user> under password expiry

[trim beacon]

The AD Administrator hash is one that cannot expire, even if it shows an expiry time. This account is used to recover AD when all else fails, thus this account bypassed expiry rules

[cerulean wraith]

sigh now the meeping vpn host is lagging again

when passing the hash with evil-winrm is it the nt part or the lm part or the whole ntlm???

[slender verge]

in that case someone changed the password?

[cerulean wraith]

darn unstable internet connections is horrible during this

[trim beacon]

More than likely. But there are t0 accounts as well you can use to at least get you back to CORPDC. Would be very unlikely that someone changed all passwords for all accounts

[trim beacon]

Should be the nt part IIRC

[cerulean wraith]

thanks... that should probably mean shadow could get a evil-winrm shell on rootdc then

[brittle badge]

Gave +1 Rep to @trim beacon

[normal spire]

ah sorry i meant more of the wrk and server hosts

[normal spire]

careful because would need another pivot to access rootdc from your attackbox unless you're attacking from corpdc

unless it was just being dumb or something

[trim beacon]

Yeah those def can expire!

[normal spire]

they expired in like march haha

[trim beacon]

Yeah I think that is when they were migrated to AD, which means no longer in use

[cerulean wraith]

really??? think shadows pivot point has access to rootdc but not 100% sure

[dreamy comet]

yo @trim beacon different issue now, after i login to the destination account and transfer some funds to the source account i think i should get a pin in my mailbox but i didn't (this is the second time i have reset and try this)

[stiff oracle]

Finally completed the challenge bin mad at it since it went live got to last flag last night the network reset done it today in less then a few hours. Iv learned why note taking is so important Iv learnt a lot in a sort time great room and many thanks to the people that don’t no they helped me out and to the people that do thanks a bunch happy cracking

[normal spire]

iirc only corpdc can access rootdc

[cerulean wraith]

okay then.... guess that won't work as easily for shadow then

[normal spire]

i just psexec’d from corpdc

[cerulean wraith]

also internet keeps cutting out and back in all the time right now....

[normal spire]

but like from corpdc not from my attack box

[cerulean wraith]

can't keep hacking if internet goes poof every 1-5 mins

[trim beacon]

Your pin is sent in the verification email for flag 17

[dreamy comet]

same pin? but that one give me an network error when used?

[trim beacon]

That pin should be active, but if not give me your subnet and I'll pull the pin for you

[trim beacon]

Congrats on completing it!

[dreamy comet]

sure my subnet is .103.

[trim beacon]

Give me two seconds

[trim beacon]

3777 is the one on record

[trim beacon]

Wait no, 6425

Read one of the dummy transactions

But why does your account have two transactions? I think you might have done something wrong for verification. There you only be one transaction, I can see two. One for 10 mil, one for $2

Try to verify the transaction and hopefully verification works, but there should only be one transactoins

[dreamy comet]

oh jesus christ i have to confirm the 10 mil one, my brain is completely dead so the instructions is confusing to say the least

[trim beacon]

Did you get it confirmed?

[dreamy comet]

yes but still

i think this is because the 2 transaction i make (also did flip the account still same error)

[trim beacon]

Might want to read those boxes carefully, what are they asking for?

[dreamy comet]

yeah i have brain damage

[cerulean wraith]

and shadow has massive fomo because their internet is being whacky and annoying right now

[trim beacon]

So while we are on the last days of the challenge being for subscribers, will share that I am sad that no one seems to have found the non-malicious way of getting root on VPN. (Will delete again when it goes B2B)

If you look at the sudo -l output, you actually have two things you can run as sudo without a passwd:

• /home/ubuntu/openvpn-createuser.sh
• /bin/cp

A quick ls -al /home/ubuntu/ will show you the openvpn-createuser.sh file.

So to privesc, you simply

1. cp /home/ubuntu/openvpn-createuser.sh /tmp/openvpn-createuser.sh
2. Create a backup of the file so you can replace it when done
3. Rewrite the file to simply run /bin/bash
4. sudo /bin/cp /tmp/openvpn-createuser.sh /home/ubuntu/openvpn-createuser.sh
5. sudo /home/ubuntu/openvpn-createuser.sh

And you are root, once you neatly deploy your persistence, you just replace the openvpn-createuser.sh with the backup you stored and no harm done to the box.

What makes me sad is, that doing it this way means you take into context why this misconfiguration took place. Essentially, in order for the web server to generate and transfer user VPN profiles, an admin gave those two permissions. If the admin just actually took the time to update the openvpn-createuser.sh file to already copy the VPN file, this privilege escalation vector would not be possible.

So while tools like GTFObins can help you privesc, sometimes just thinking about the context of the misconfiguration can help you not only understand what happened (which means you can provide better recommendations to the client), but also privesc is a much safer way.

[pseudo parrot]

And which machine is this on. 😛

[trim beacon]

Literally said the machine name in the first sentence 😂

[pseudo parrot]

I know.

I'm winding you up. 😄

[trim beacon]

Honestly, all that went through my head was these damn users don't read nothin' 😂 Good wind up

[pseudo parrot]

I knew it would,

It reminded me of our conversation where you said it's going slow to us savages who don't read, will

E-Citizen, that is.

[trim beacon]

Yep, and even then we still increased the speed of the text of e-citizen cause users got frustrated. Just can't win here! But overall overexceeded my expectations of the number of users who would complete the challenge. Currently standing at 117

[heavy crag]

Luv it! must admit I only saw the /bin/cp only. Now I gotta go back to to see it for myself! I still like your MSF tactic to root better, but see how this one is much more helpful (for the customer). But what advantage am I missing being root on VPN anyway? Other than PoC and trolling others? It doesnt seem to prevent you from getting to .52 with just ubuntu user as a base. Genuinely curious!

[cerulean wraith]

sooo just copying the contents of the .ssh/authorized_keys and then adding your own and adding back all the old ones is not a good exploit path for root on VPN????

[trim beacon]

It is the main fact that you don't have a really clean way of connecting to the host as www-data. Like you can't really drop an SSH key for example for this user. Other than that, no need to actually get root, which is why there is no flag for it

[trim beacon]

I'm not saying it is a bad path, all I'm saying is that it doesn't take into context why this misconfiguration happened

[cerulean wraith]

ah fair enoughs

[heavy crag]

yeah as a tester doing right by the customer is the ultimate goal!

[cerulean wraith]

shadow just liked having a stable ssh connection for root/sudo access as it seems safer

[trim beacon]

More than that, I can promise you as the client I would be getting reports telling me to remove /bin/cp from the list. Which sure, you are not wrong, but that doesn't help me as the client right? Cause I need it? But understanding why I made the misconfiguration, you can tell me to update the .sh script to already copy the file for me to the right location, thereby eliminating the need for the misconfigured privilege to exist

[clear badger]

Did anyone get the ||GPO misuse from Server2 to CORP?||

[trim beacon]

Indeed yes, think I actually even got a writeup for this path which was super cool! They used an awesome tool for it!

[cerulean wraith]

neat... gonna have a field day with reading all the write ups if we get access to them

[clear badger]

Nice! I was wondering about that one, glad that was found

[trim beacon]

Busy grading them now. The top three ones will be published as blog posts

[pseudo parrot]

It's an exciting weekend for THM.

[trim beacon]

Hopefully just an exciting Friday evening, I got other stuff to worry about this weekend 😂 Have about three writeups left to QA

[dusky stratus]

when this challenge expires?

[cerulean wraith]

on monday

[dusky stratus]

monday 23:59?

[cerulean wraith]

in 2 days and 17 hours

[dusky stratus]

Thanks

[cerulean wraith]

first task of the network has a countdown timer that you can check

it does not state the time zone for when access expires though

[pseudo parrot]

Won't matter.

The timer will count down.

I'd suspect it's 12PM Monday UK time.

[hidden galleon]

12PM BST is correct!

[cerulean wraith]

thanks @hidden galleon

[brittle badge]

Gave +1 Rep to @hidden galleon

[gleaming bough]

anyone can help me with pivoting

meterpreter and chisel

both are not working

[slender verge]

What's not working exactly?

Like which command are you running that doesn't work

[gleaming bough]

every cmd like nmap remina nslookup

i dont know what i am doinf wrong

[slender verge]

For nmap you need the -sT flag

If that doesn't work I recommend giving as much detail as you can so we can help debug

[gleaming bough]

okay i know what was problem

[slender verge]

What was it?

[gleaming bough]

i am stupid

thx @slender verge

[brittle badge]

Gave +1 Rep to @slender verge

[slender verge]

You're welcome

[cerulean wraith]

would you even say that corvids are smarter then you???

[slate hill]

Finally, Thank you @trim beacon for such an amazing challange. Loved it!!

[brittle badge]

Gave +1 Rep to @trim beacon

[cerulean wraith]

nice a person that is not using rdp

[unkempt saddle]

Is anyone on the .119 network? everything was fine until 10 minutes ago and now it seems like nothing is reachable including web/vpn

[dusty hamlet]

Yes, I am having the same problem. All hosts are unreachable

[cerulean wraith]

hit reset

or play subnet roulette

[dusty hamlet]

You mean leave room and re-join?

[cerulean wraith]

yuup to get a new subnet to try and hack

it is like a roulette wheel spin and that is why shadow is calling it that

[unkempt saddle]

Thank you.

[brittle badge]

Gave +1 Rep to @cerulean wraith

[glacial hornet]

Thank you @trim beacon it really was an incredible network!

[brittle badge]

Gave +1 Rep to @trim beacon

[digital plaza]

congrats, is that color 27? How did you get the green so dark XD

[slender verge]

I tried hard to do it the no-RDP way, but I don't have the knowledge for that yet

[heavy crag]

is it fair to say if you brute force the admin password successfully with Burp on the October page and it wont log you in (page just flashes and redirects to logon page again) that site is broken? I'm kinda getting used to all the brokeness but wonder how on earth this bank gets any business done??

[slender verge]

I would guess so, you should be able to log in just fine

[heavy crag]

and the plot thickens.... must be a timeout (600 sec?) when too many login attempts

[slender verge]

oh yeah, currently it times out after like 5 attemps and locks you out for 15 minutes

if you've got the password, set a timer and try to log in in 15 min

[heavy crag]

900 sec then- --so you're saying there's a chance? 🥁

[slender verge]

I'm saying there's a chance 😁

[heavy crag]

well this admin is going in my report for password policy violation - I hope I don't have to explain impact any further than a screenshot of me loggin in

[slender verge]

technically not a violation of the policy 😁 it doesn't want at least one capital letter

[heavy crag]

touche! its a poor password policy -sorry admin

[slender verge]

it really is

[heavy crag]

unless the admin setup the policy?? seeing how broken this bank is, anything is possible. Nothing like 600+ Red Teamers poking around it all at once... what could go wrong??

[quaint knot]

In their defense, I have seen in real assessment where the password check is only on the client-side. I could literally capture the password change request with BurpSuite and set the password to "t" and it has worked more times than you'd believe 😂

[heavy crag]

oh wow! scary thats a real thing in 2023. also recommend along with just suspending account for 15min, rate-limit the attack (time-out) so Turbo cant continue bruteforcing after the 5th attempt - that would make any attacker cry

15 min up and I'm in!

[quaint knot]

So another interesting thing you're experience, which can happen in the real world, is when an account is locked due to invalid login attempts, you can essentially DoS an account by setting a script that continually logs into it. There's not really a way around that -- you could do an IP Block but BurpSuite has an extension (developed by my company - Rhino Security Labs) - called IP Rotate which will rotate your IP through AWS gateways that are spun up so you can bypass IP Blocks.

That being said, for one assessment for a security company, I could DoS the account by locking the account which would be great if I was attacking the org. They would not be able to log into their SIEM software to prevent the attack, because I could set a script that continually attempts to log into the account, therefore locking them out of their security platform!

(Enforcing a CAPTCHA after 5 or so invalid login attempts is a really good security measure -- as long as the CAPTCHA is securely implemented. Once again, I've seen CAPTCHAs that show up, but literally aren't enforced. You can keep bruteforcing and just pretend the CAPTCHA isn't there!)

[trim beacon]

Congrats on completing it! Love the powershell sessions you got there! Pivots to the extreme!

[trim beacon]

Congrats on completing it!

[trim beacon]

Account lockout kicking your butt here 😅

[heavy crag]

it had me for 15min, yes! lol

[trim beacon]

Glad you got it sorted!

[dreamy comet]

just wanna say thanks a lot to @broken nest for helping me debug my ticket and also a big thanks to @trim beacon for making this awesome lab, i finally finish the damn thing and i have severe brain damage https://tryhackme.com/mr.tom/badges/redteamcapstone

[brittle badge]

Gave +1 Rep to @broken nest

[cosmic cobalt]

Hello, after connecting to vpn , I’m getting 172. X.x.x network instead of 10.200.x.x…Can anyone advise what needs to be done

[lucid bay]

The "ovpn file way" is not stable as hell. I have it fixed eventually. But for root the DC, I need to do all the other way.
To sum up, it's not worth at all to fix it.

Just root the VPNServer and start from there. You won't lose any progress you made so far. It's faster and more stable

[cosmic cobalt]

Thanks @lucid bay …let me see if it works

[brittle badge]

Gave +1 Rep to @lucid bay

[trim beacon]

Congrats for completing it!

[glacial hornet]

Hi i add the issue several times and used this help: #red-team-capstone-challenge message:
"Hello, yesterday I had issues connecting to the internal network so I did: sudo ip route add 10.200.116.21 dev tun0
sudo ip route add 10.200.116.22 dev tun0"

[lucid bay]

The network is broken?

@dire folio Hi there, is there anyone also facing connection issue?

[quasi badge]

Hi ya, I just started the room and have enumerated all the machines I can reach to, but haven't got much interesting stuff

could anyone give me a hand ?

[slow garnet]

I am having trouble getting a reverse shell , on 10.200.116.12 shows connection failed trying to connect to 10.0.2.15, which I am not using. Any ideas would be much apreciated.

Timsu, have you been able to get access to any machine?

[slow garnet]

Timsu, have you been able to get access to any machine?

[quasi badge]

I was able to access initial machines and 10.200.117.21 yesterday

But after the reset, it turns into 172.x.x.21 instead and not able to access it anymore

[stone crypt]

I think it was supposed to close today and only be available to business users.

[dull kestrel]

if you are using the vpn config files and it gives you 172 you will have to manually add the correct routes

[cerulean wraith]

nope it closes on the 5th

[stone crypt]

Oh yeah, I thought It was the 6th today

[cerulean wraith]

nah we only on the 3rd

[slender verge]

There's a countdown timer in the first task

[slate hill]

I played with RGB codes a little bit.

[slate hill]

The "G" in RGB is 161, change it to "100" and you will get this green.

[low crypt]

A friend is doing this and I’ve heard nothing but complaints from them on people resetting the lab every half an hour. Like no kidding. They are having a good time on this but seriously?! Why are people resetting so often 😦

I can see this being so frustrating

[cerulean wraith]

somehow shadow only got reset nuked once

but yeah that nuke came right when shadow was about to do the final major pivots so it hurt a lot

[clear badger]

A lot of it is, “step is not working, time to reset” instead of proper debugging or trying another path

[lucid bay]

Hey everyone, seeking help. I stuck on the ROOTDC. I'm on a psexec shell. Can't run mimikatz since there is AV and couldn't create a new user.

[slender verge]

Tell them to get on a different subnet, might help with some luck

[lucid bay]

Finally, get a new user with full privilege on ROOTDC. But the ROOTDC and BANKDC are all rdp closed. It that right or network issue?

PORT     STATE  SERVICE       REASON
3389/tcp closed ms-wbt-server conn-refused

[slender verge]

Must be a network issue, should be able to RDP onto them just fine

[lucid bay]

Thank you, wasting hours to do those

[brittle badge]

Gave +1 Rep to @slender verge

[rancid mantle]

I'm having trouble authenticating on the vpn panel (10.200.x.12) with the email [e-mail] and password Password1@. Has anyone had this problem?

[drowsy osprey]

Anyone willing to give me a hint on why do I can perform command injection with ping in the vpn server and I cant use a wget or a curl?

[lucid bay]

&& & ; | try fuzz those chars before your injection command. And command injection lead to RCE, you won't need wget or curl

[lucid bay]

Maybe I'm wrong. The network restarted.

3389 seems opened to the internal servers, like I can telnet inside the DC. But won't open through VPN which outside of the firewall

[slender verge]

where are you trying to reach it from? vpn server?

[lucid bay]

Yeah, I was initially tried to reach ROOTDC 3389 from the VPNServer

[slender verge]

oh I understand now, that's not going to work, you have to be on CORPDC for that

from there you can get to both ROOTDC and BANKDC

[lucid bay]

true, Thanks. I'm lazy to do another pivoting. I'll just use the CORPDC rdp session to do those tho

unless somewhere blocked me

[slender verge]

yeah, that should work just fine

[twilit solstice]

hii . i found valid email and password but unable to login ,

[pseudo parrot]

Maybe they login elsewhere.

[lucid bay]

There is one guy patched the DCSync of CORPDC to stop other users get in?

proxychains impacket-secretsdump corp.thereserve.loc/svcBackups:'q9xxxx'@$IP
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] DLL init: proxychains-ng 4.16
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[proxychains] Strict chain  ...  127.0.0.1:1085  ...  10.200.x.102:445  ...  OK
[-] RemoteOperations failed: SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
[*] Cleaning up... 

I hope they stop messing up with other players. It's very fast to get 4 votes already

[slim elm]

Hey can anyone help me i am unable to RDP into wrk1

[twilit solstice]

yeah. i use these cred in other site. yesterday they worked perfectly now it's not working

[gleaming bough]

YES i am not able to get shell back to corpdc

network reset crashed it all

[slim elm]

/timeout:60000 fix

[gleaming bough]

any help on connecting corpdc

i had a evil-winrm connection

but after network reset not able to connect

[twilit solstice]

probaly password hash is changed

[lucid bay]

if you have evil-winrm connection and can't rdp, try reset password to get in.

if you lost evil-winrm connection, try do exactly what you got the NTLM hash in the first place again.

If none of them worked, vote for reset, and leave the room wait 1-2 minutes and rejoin another subnet.

I'm so stuck after getting PsExec shell on ROOTDC. Should I just stop working on ROOTDC? Just attack BANKDC directly from CORPDC?

Nothing work for ROOTDC, DCsync attack for admin hash, neither creating a new AD domain user

[hexed whale]

Anyone mind quickly helping me to get an enterprise admin setup, got my golden ticket on rootdc

[lucid bay]

I have a misc::cmd Psexec shell after the golden ticket. But completely stuck there for a whole day.

[gleaming bough]

right now same here

struck on rootdc

[hexed whale]

Found a cheeky exploit. If still struggling dm me

@trim beacon I'll tell ya what. This is one damn good network

[hexed whale]

Whoever just booted me off corpdc on .119, WHY

@trim beacon new challenge:

RDP Fight on .119 for CORPDC

[gleaming bough]

did you get to bank dc

[hexed whale]

Indeed, Im making the SWIFT

[gleaming bough]

mind telling me

[hexed whale]

[12:42:55:293] [4106:4111] [INFO][com.freerdp.core] - ERRINFO_DISCONNECTED_BY_OTHER_CONNECTION (0x00000005):Another user connected to the server, forcing the disconnection of the current connection.

Sure am happy to help when I finally get access restored.

[gleaming bough]

you settled the fight

[hexed whale]

@trim beacon GG Well Played.

[gleaming bough]

anyone got to bank dc after root

[white summit]

Change password for administrator with psexec from golden ticket attack.... net user Administrator newpassword then rdp with thereserve/Administrator and new password.

I'm so glad i spent all day and night Saturday for the network challenge and was alone for hours in the subnet. hehe

[gleaming bough]

i think it is not working

i have tried the invoke smbexec way too

but it is showing worong creds

i think i have extracted wrong hash value for administrator

[hexed whale]

If you have a golden ticket there is another way.

[gleaming bough]

which way

@hexed whale

[hexed whale]

Whats one tool that is installed on ALL active directory gui servers?

(By Microsoft ^)

[gleaming bough]

rdp

[white summit]

I told you the way above

[hexed whale]

Not that one. Its under ADMINISTRATIVE Tools in start menu 😉

[hexed whale]

https://tenor.com/view/yoda-there-is-another-star-wars-jedi-gif-5140031

[white summit]

There is 6000 ways

[gleaming bough]

for rdp one

i have replicated your way too but it is showing wrong cred

[white summit]

@gleaming bough once i got onto rootdc with golden ticket. (Shell with PsExec.exe)... changed the administrator password for ROOTDC, then rdp into ROOTDC with the new creds.. created a domain admin user for BankDC. Rdp into BankDC.

[gleaming bough]

can i dm you

[white summit]

To correctly rdp into rootdc use thereserve\Administrator

Yes sure

[covert swallow]

Finally did it. Great network

Thank you for creating such a wonderful network 🙂

@trim beacon Thank you

[brittle badge]

Gave +1 Rep to @trim beacon

[tall imp]

https://assets.tryhackme.com/room-badges/9d8415815853b369d24f62fea5809747.png 🎉

[iron forge]

Thank you for the challenge @trim beacon . Already compromised the network several days ago, but the path to compromise bank domain is unintended since it cannot be replicated after the network reset ^_^. However, today i know the path to the bank domain via the intended path after several trial and error

[brittle badge]

Gave +1 Rep to @trim beacon

[gleaming bough]

Wow its finally completed @trim beacon thanks for this tough challenge

[brittle badge]

Gave +1 Rep to @trim beacon

[gleaming bough]

https://assets.tryhackme.com/room-badges/2ce50b855dc156d926c2809cd95cc92c.png

[drowsy osprey]

Really guys, I'm having a hard time enjoying this since I stopped working on the lab yesterday because the VPN server was not responding and now when I get back someone changed the configuration on the VPN server and the VPN file is not downloaded anymore and the OS injection can't be exploited...

[iron forge]

vote for network reset

[drowsy osprey]

i only have 2 votes, now I need to wait more 3 hours to give 1 vote per hour

[pseudo parrot]

You'll need to state your subnet.

They're all different, and you might be asking 5 people to reset their network who don't need it.

And that won't benefit you.

[drowsy osprey]

.52 network

[iron forge]

since tomorrow is the last day access for individual users, everyone is in a hurry to compromise the network, wish you all the best @drowsy osprey

[drowsy osprey]

Thanks for the motivation @iron forge

[brittle badge]

Gave +1 Rep to @iron forge

[trim beacon]

Glad you ar liking it!

[trim beacon]

Lol, you could always just pivot so you don't have to fight for RDP control

[trim beacon]

Congrats on completing it!

[trim beacon]

Congrats on completing it!! 🎉

[trim beacon]

You can do it! Believe in you!

[trim beacon]

Congrats on completing it! 🎉

[tall imp]

Thank you very much @trim beacon, I didn't think I woukld be able to because of time constraints, but then I got so close and had a good session today to finish it. Great network! 🙂

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

Thanks for the nice feedback! Glad you could get it done in time!

[brittle badge]

Gave +1 Rep to @tall imp

[slender verge]

I finally managed to get as far as here without any RPDing, but I still have no idea how I would access the website this way... does anyone have any tips?

[trim beacon]

Host's have SSH right? Why don't you do a reverse dynamic SSH proxy? Open SSH server on your kali, then from the host ssh -R 8081 kali@<your kali tun ip>. Then port 8081 will now be on your kali host ready for proxychaining 🙂

[slender verge]

Thank you! I did ssh proxy my way there, what's one more 😁

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

Exactly! And this is a nice reverse one, so a bit of a change for once

[drowsy osprey]

Why would anyone delete /etc/passwd file? I'm just getting trolled by someone...Network uptime 1 hour...
sudo: unknown uid 33: who are you?

Can someone reset .52 lab?

[lucid bay]

Thanks, I will try it again. when I tried a couple of times before, the user under PsExec is corp\administrator. You can’t RDP to root with a CORPDC user.

[brittle badge]

Gave +1 Rep to @white summit

[white summit]

Rdp to bank dc with the created admin instead

[slow garnet]

Can anyone help me with this issue, The DNS operation timed out after 3.005955934524536 seconds, on my Kali vm the resolver is inactive.

That is in Bloodhond.py

[hexed whale]

Thanks dude! Loved it, wish I could do it again

[brittle badge]

Gave +1 Rep to @trim beacon

[cerulean wraith]

add --dns-tcp to your command at the end

assuming you are using proxy chains udp has trouble

[slow garnet]

Thank you shadow, but I have that already , proxychains ./bloodhound.py -d c10.200.116.11 -u laura.wood -p "Password1@" -c all -ns 10.200.116.11 --dns-tcp

some of output

[proxychains] Strict chain ... 127.0.0.1:9050 ... 10.200.116.102:53 ... OK
[proxychains] Strict chain ... 127.0.0.1:9050 ... 10.200.116.102:53 ... OK

[drowsy osprey]

I'm like you @slow garnet , I can use proxychains to nmap, smbclient and reach the dc but I'm unable to launch my bloodhound against it since I'm always receiving timeout.
The resolution lifetime expired after 3.103 seconds: Server 10.200.52.102 TCP port 53 answered The DNS operation timed out. Any hints guys?

[cerulean wraith]

proxychains -q ./bloodhound.py -d corp.thereserve.loc -u laura.wood -p "Password1@" -c all -ns 10.200.subnet.102 --dns-tcp
is the exact command shadow used and it worked fine for shadow

[drowsy osprey]

Yeah, it doesnt work for me

[forest plinth]

I can't wait to see the list of winners.

[lucid bay]

Thank you all, rooted!!

[brittle badge]

Gave +1 Rep to @white summit

[stark hemlock]

I am having trouble getting the last flag to work. I don't understand, the capturer has no transactions, it just disappeared. Fix. delete flags 18 and 19 and redo them before submitting 20.

Oh wait. I guess the PIN part wasn't needed. Thanks for the lab!

[drowsy osprey]

@trim beacon if I can see the Transactions capturer view should I be able to see the dummy transaction or it means I'm getting closer to it?

[trim beacon]

Should be yes, best to use an incognito tab just to make sure cookies are not screwing with your output that you are seeing

[drowsy osprey]

I can immediately see it after changing "something" but no transactions appear. If I change "something else" I simply lose also access to the dashboard data. Am I missing something?

Now my password is wrong, something on your end or should I redo everything?

[trim beacon]

Nope, you are going to have to figure this one out. SWIFT is isolated, so it is the one system that users cannot tamper with through means such as altering the passwords

If your session token is not correct, you will not be able to see transactions. If you are in a browser, you can use Ctrl + Shift + C to pull up the network debugger. That will show you why transactions are not being loaded with most cases it being that your token is not valid. To fix that, you need to authenticate. Again, I suggest an incognito browser so old tokens don't screw you over

[drowsy osprey]

ok, how can I remove the flag 17?

I got it sorry

[trim beacon]

A SWIFT reset should do the trick for you

[drowsy osprey]

Thanks @trim beacon

[brittle badge]

Gave +1 Rep to @trim beacon

[white summit]

Use DNSchef hak5 video on proxychains dnschef and bloodhound

[white summit]

https://www.youtube.com/watch?v=4ydjpSSKQ8g

[drowsy osprey]

Thanks @white summit but after all it was not necessary.

[brittle badge]

Gave +1 Rep to @white summit

[drowsy osprey]

All rooted! Thanks @trim beacon for the challenge, please release more of this in the future!

[brittle badge]

Gave +1 Rep to @trim beacon

[civic mountain]

@trim beacon hi, can u help me, I'm done mistake at want to submit flag 20, im already approved wrong transactions, bcs i not see my id transactions i just approved wrong id transactions, after that i just noticed my transactions is not yet submit PIN, I think after submit the pin then my id transactions in approver account, how can i reset this process?

[granite valve]

u need to reset swift process ; i.e and redo from flag 17 @civic mountain

login to ssh --> then 2 [ authenticate ] --> then reset the swift process [ 3 ]

u good to go then

[civic mountain]

thx bro, i'll try

[brittle badge]

Gave +1 Rep to @granite valve

[granite valve]

when's the top writeups comming out ? ; eager to know new techniques.

[pseudo parrot]

Soon™️

[granite valve]

cool !

[slender verge]

Timer is ticking down, thanks again @trim beacon for this amazing network, happy to have had the opportunity to try it out!

[brittle badge]

Gave +1 Rep to @trim beacon

[forest plinth]

Can this be claimed by the person who has paid the wp? But I don't seem to see the coupon

[pseudo parrot]

You'll get it E-mailed to you.

All winners will be contacted via E-mail if you've won.

[forest plinth]

okay, thank。

[austere oriole]

I took a medium hoodie, don't even know if it would fit

[muted compass]

Where will the reports of the winners be published? i really want to read them

[pseudo parrot]

On the blog soon™️

[tardy sage]

I have submited a write up, but don't receive an email?

[hidden galleon]

All will be sent, no worries - emails are in progress 🙂

[tardy sage]

Okay thank you

[brittle badge]

Gave +1 Rep to @hidden galleon

[hexed whale]

My mini report was… 7 pages. Admittedly I didn’t fledge it out as well as I could have and didn’t find many exploits. If I had business access I’d go back and see how many other paths I can find

[slender verge]

Just out of pure curiosity, could we see the final stats?

[trim beacon]

• 1000+ room joins (don't know actual total since we kick users each week)
• 805 profiles registered on e-citizen
• 317 users submitted at least one flag
• 3922 flags submitted in total
• 160 room completions

Overall a bit higher on completion rate that I initially thought we would achieve but still awesome!

[slender verge]

Awesome indeed! Everyone tried hard

[fervent sail]

Yeah 160 completions is quite a lot. It was a fantastic network though so I am not too surprised. Thanks again am03bam4n for making it!

[thick atlas]

Really enjoyed doing this, so much better than a typical ctf! Learned so much in a short amount of time. Huge thanks to @trim beacon and the rest of THM for putting it all together!

[brittle badge]

Gave +1 Rep to @trim beacon

[trim beacon]

Thanks you for the feedback!

[brittle badge]

Gave +1 Rep to @fervent sail

[trim beacon]

Indeed! Time to get building on the next challenge! 😉

[trim beacon]

Thank you for the feedback!

[slender verge]

Can't wait, whatever you come up with will be great

[clear badger]

A Red Team Capstone type challenge with a nice SIEM to thwart off attackers? 😁

[slender verge]

Are we allowed to post write-ups/walkthroughs on our blog? As far as I get, things won't be the same on the B2B side

[trim beacon]

Yeah, some automated blue teaming there to kick out the baddies!

[trim beacon]

I think that will be fine, since we are rotating all flag values. But perhaps since it is a winning writeup maybe coincide your release with the THM blog post?

[slender verge]

Of course, no problem, I have to take the time to polish things more anyway as I tried to explore other paths

[trim beacon]

Sounds good! We are just finalising everything for the shift and then the blog posts are next on the todo list

[slender verge]

Awesome, looking forward to reading some write-ups and learning even more

[cerulean wraith]

what about the e-citizen hints??? do you not need to finish that first????

[lucid bay]

Can we use this channel to share the writeups and/or notes to each other? I have fully documented GitHub repo for it. I'd also like to see alternative exploitation methods from other players.

[trim beacon]

haha I'll see how I feel and then maybe slowly add hints. But with the blog post releases that at least gives some hints as well!

[trim beacon]

Again, happy with this, my ask is just that we wait slightly for the blog posts to go out first, then can share discussions here as well

[lucid bay]

Thanks

[brittle badge]

Gave +1 Rep to @trim beacon

[tardy sage]

Maybe you send the email to the wrong email address, but I've already not received an email 😆

[hidden galleon]

I'll follow up 😄 We're using emails attached to your thm account

[south mirage]

So should all emails already be sent out? Because if yes, I also did not receive an email yet :D

[hidden galleon]

We're on it!

[hidden galleon]

Can you dm me? Just had confirmation we've tried to contact you & got no response until now.

[hidden galleon]

All missing runner-up emails will be done ASAP!

The 2 million thing is keeping the marketing team busy, sorry for the delay 🙏

[tardy sage]

No problem. The 2 million users thing is important so take the time you need.

[slender verge]

Same here - no email, but I figured you all are busy when 2M announcement came out, which congratulations!

Ah, there it is, thank you! 😁

[frosty bluff]

Hello! I have just reached out to all runners-up. Please check your emails 😎

[slender verge]

Thank you!

[brittle badge]

Gave +1 Rep to @tribal condor

[forest plinth]

I received it, too. Thank you.

[brittle badge]

Gave +1 Rep to @tribal condor

[graceful bolt]

Also received it, thanks a ton!

[valid orchid]

Thank you!!! 😊

[brittle badge]

Gave +1 Rep to @tribal condor

[tardy sage]

Thank you again. Does everbody get the same?

[brittle badge]

Gave +1 Rep to @tribal condor

[frosty bluff]

Yes, every runner-up will receive the same 😎

[covert swallow]

Hi yo. Just wana ask. We will not be able to access this network anymore right? Its now only for business subscription?

[slender verge]

Yes, it will show you that if you try to access it

[covert swallow]

Alrighty. Thank you. Great thing i had it completed prior. 😀

[shy iris]

Damn i missed this room 😭

[cerulean wraith]

same

[shy iris]

Any thoughts on making this room open for all again ?

[cerulean wraith]

the cost is to high... they made it open for everyone for as long as they could

[shy iris]

Oooh ok, thank you for the info

[brittle badge]

Gave +1 Rep to @cerulean wraith

[cerulean wraith]

no problem

am03bam4n has stated that he would like to make the badge acuireable again later down the line if possible

[shy iris]

Wow nice to hear

[trim beacon]

First writeup is up: https://tryhackme.com/resources/blog/azkraths-red-team-capstone-write-up

Congrats again @viral yew ! 🎉 🎉 🎉 🎉

[pseudo parrot]

Oh man, looking at this write up (which was well done) I can see where I went wrong. Good job I still have access to the room

[cerulean wraith]

wait whaaaa

[pseudo parrot]

I'll DM you?

[cerulean wraith]

nah rather not step into that minefield.....

[pseudo parrot]

Lol, it's legit

[cerulean wraith]

yeah okay then send a dm if you want

gonna be on and off a bit anyways

[cerulean wraith]

send a dm if you want then... shadow just got spooked that you somehow got access and therefor breaking thm rules

[fervent sail]

Oh sweet the first report, glad to check these out and improve my own reports by learning from them.

[hexed whale]

Ik @quaint knot has set up a 'business group' where put put £40 a month in (£400 a year) and they get a business plan as a group of 5. I would be tempted if I had the money so thats probably how hes got access still.

[fervent sail]

Looks like the second place report is up on the blog, nice

[pseudo parrot]

Incorrect.

[hexed whale]

Fair enough, thought it were a potential Avenue

[quaint knot]

I did set up a business group for Hack Smarter -- my brand for streaming and teaching -- but it's full. I'm hoping to show off some of the business features in upcoming streams 🙂

[muted folio]

How can i subscribe to capstone?

[cerulean wraith]

you can't really do this anymore unless you have a business account

[muted folio]

Thank you i don't have account business

[brittle badge]

Gave +1 Rep to @cerulean wraith

[random helm]

How can you do the capstone project? Been apart of THM for a month now

[cerulean wraith]

oh sorry to tell you that you are to late as the event for this network ended... the only way to do it nowadays is if you have a business account with tryhackme

[random helm]

Gotcha. That sucks. 😦 I wanted something like that so really test my skills

[pseudo parrot]

Wreath, Holo and Throwback are networks, not like this one was, but it's still networks.

[slow shadow]

✅

[pseudo parrot]

@red yarrow

[round raptor]

Is there any report made in

How someone was able to compromise AD just by getting onto their network

Meaning got the AD control and did all AD enumeration without being an AD user

[pseudo parrot]

Is this for homework?

[round raptor]

Yes

[pseudo parrot]

We don't help with homework

[round raptor]

Bro homework meaning I am doing this for my company
Ethically

[pseudo parrot]

You should ask your supervisor or line manager for help then, not out source it to discord?

[vale pewter]

I thought the red team capstone challenge was meant only for enterprise customers, and never went back to actually check it.

was browsing through the library today and I don't believe what I saw, so just asking for confirmation here, is the red team capstone challenge accessible to VIP users?

[pseudo parrot]

If its there, its there

But cc @lyric stream or @red yarrow for awareness.

[vale pewter]

@lyric stream @red yarrow - Am I seeing the right thing here? 😅

[lyric stream]

Yes it is. 🙂

[pseudo parrot]

@hollow yoke

[vale pewter]

@lyric stream just one more question, do you plan on keeping it available for the VIP users or that might change in the upcoming future.

[hollow yoke]

👋 Sorry didnt notice I had alerts muted

[pseudo parrot]

Oh its alright!

[restive plaza]

Heya all, I posted in room help too but thought maybe you all might have a thought also....I'm doing the data exfiltration room, on task7 (ICMP efil) but cannot get the data to the listener in metasploit...any idea what I might be doing wrong? https://tryhackme.com/room/dataxexfilt

[cerulean hawk]

Is it still available for vip users ?

[pseudo parrot]

Yes 😄

[cerulean hawk]

I guess I need to subscribe first to be able to see it

[pseudo parrot]

Yeah, maybe.

Thank link is on this chanel.

[cerulean wraith]

it is still not on the main learning page but if you search for it on the learning search page it shows up

[pseudo parrot]

I'm sure it is.

[pseudo parrot]

Nah, not there, I found it somewhere else.

[cerulean wraith]

yeah that is basically what shadow was saying

it is not on that list but it is in the searchable rooms list

[pseudo parrot]

Is there now.

[junior wigeon]

Hello, is there an admin to whom I can write in DM? I may have a problem with the e-Citizen portal

[solar niche]

Hello I just have 2 questions is this the same challenge that was launched earlier and how long will this lab be available for premium users ??

[pseudo parrot]

What's up?

Not admin, but I may be able to help

[junior wigeon]

Can i DM pls?

[pseudo parrot]

Sure

[pseudo parrot]

Yes

[frosty bluff]

Hello!
I'm not sure if your question has been answered already by the wonderful @pseudo parrot, but yes, this is the challenge that we released a year ago. We only had this open to individuals for one month, and then switched over to B2B users only.
However, it's now back for premium users (and back for good! 😉)

[solar niche]

Thank you so much 😊👍🏻

[cerulean wraith]

???? it was not when shadow checked.....

[pseudo parrot]

Was added today RE E-mail.

[cerulean wraith]

aah

[plucky whale]

MailAddr: [e-mail]
IP Range: 10.200.X.0/24

These details are now active. As you can see, we have already purchased a domain for domain squatting to be used for phishing.
Once you discover the webmail server, you can use these details to authenticate and recover additional project information from your mailbox.
Once you have performed actions to compromise the network, please authenticate to e-Citizen in order to provide an update to the government. If your update is sufficient, you will be awarded a flag to indicate progress.

“How can i access this email. I have already breached the perimeter but am am not able to access webmail “

[cerulean wraith]

using thunderbird or another email client and loggin in and having the /etc/hosts file setup correctly

[prime ivy]

I was using the AttackBox and it crashed. I tried reseting my progress and leaving the room. It still says my THM username is registered. Is there anyway to reset this or reset the password.

[hidden galleon]

@trim beacon can you see the above^?

[pseudo parrot]

Will authenticate not work?

Or did you not write down the credential details?

[trim beacon]

We do not have a mechanism to reset password. This would require an out of band system to ensure secure resets which isn't available.

There is a warning that you need to make sure to save your credentials since they won't be displayed again.

However, you do have the option to create a new account and use that. So an account different than your username in THM, which will be fine

[plucky whale]

Can anyone share stmp and imap setting for corp.th3reserve.loc

[prime ivy]

I didn't write down the details. I saved them on the attack box. Not thinking lol.

[ruby roost]

Hi @pseudo parrot what do you want me to send a screenshot of ?

[pseudo parrot]

What you're having an issue with 🙂

[ruby roost]

So I am trying to regester as said in the information but I don't get connected

[pseudo parrot]

You don't need to hide your ip, infact, it will be better if you show it 🙂

[ruby roost]

oks

It is the same subnet the machines are in right ?

[pseudo parrot]

What's your IP here?

[ruby roost]

it is 10.200.17.13

[pseudo parrot]

Yeah. right ip.

Can you ping it?

10.200.17.250 ?

[ruby roost]

sooo I should be able to connect right ?

No I am unable to ping any of the machines

[pseudo parrot]

you should be able to yeah

[ruby roost]

So it is a VPN issue ?

[pseudo parrot]

250 is the VPN server.

@trim beacon

sorry for the ping, can you help out?

[ruby roost]

ah oks

soo what shall I do or check I am a bit confused

[pseudo parrot]

I've pinged one of the best people who maybe able to help.

[ruby roost]

Thank you

[brittle badge]

Gave +1 Rep to @pseudo parrot (current: #2 - 1929)

[trim beacon]

You are trying to connect to the wrong IP? If you have 10.200.103 in your diagram, your connection should be to 10.200.103.250, not 10.200.17.250?

Ah I see that was @pseudo parrot's IP

[pseudo parrot]

^

Yeah, they're having the issue 😄

[trim beacon]

Are you on the attackbox or your own machine? If you can't ping it, it means your VPN is not connected. You need to check out why your VPN is not connecting. So if attackbox, there are certain steps there, if your own machine, check what's happening there when you run the VPN file

[mossy jetty]

Hi, is anyone experiencing problems with the internal ovpn? Mine keeps doing a soft,connection-reset. (changed the IP already 😉 )

[ruby roost]

I’m trying to connect with my own machine, but any suggestion how I can check what’s wrong with the VPN file?

[trim beacon]

Would suggest starting to provide the output to us here so we can see what is happening? But also reading the output will help?

[ruby roost]

Will do, having some WiFi issues so might send it in the morning if it doesn’t work

Thank you 😊

[trim beacon]

This is a little bit of a thing for you to figure out. You can read up a bit on why this can happen, but also maybe think about (and play around with) how your THM VPN works and what policy a company might have in place to prevent larger compromises if a VPN profile is leaked

[pseudo parrot]

This was a neat part!

[frosty bluff]

I'm confused how this works... I have initial creds and logon (I would say "breaching permiter", and possibly "breaching AD" are both done)... but I haven't seen a flag to input yet

am I not as far as I think?

[pseudo parrot]

Check your E-mails.

[frosty bluff]

huh

[pseudo parrot]

When you signed up to the E-citizen portal, it created an E-mail address for you.

Log in to it.

[frosty bluff]

oh okay yeah I need to log in to the web mail.. I see now in the brief

let me just fuzz the endpoint and I'll get right on that lmao

there is no emails other than scope of engagement @pseudo parrot ..

[trim beacon]

Maybe you should read the entire brief. Including the portion on how you get flags

I am going to provide this information again and then pin it. The last point, about reading and understanding the project brief, is incredibly important. The room simulates a red team engagement. The most important part of such a real-world engagement, it understanding the actual "rules of engagement". This is the thin line that makes your actions as a red teamer legal. Not following this, you are not a red teamer, but a malicious hacker. Please read the instructions before you just start.

Most Important to Remember to Conquer this Capstone Challenge

1. This is a practice exercise for Red Teaming, not a Capture the Flag game. Your CTF skills alone will not be sufficient to complete the challenge.

2. The exercise tests the skills you learned in the Red Teaming Learning Path. We recommend completing at least 80% of this path before attempting the challenge. If you get stuck, go back to the path, as it covers the techniques you need.

3. There are different ways to complete this exercise. If you have trouble with a specific attack, try different approaches and avenues.

4. Carefully read Task 2 "Project Brief", as it contains crucial information you will need to complete the challenge.

[mossy jetty]

Thank you for the reply

[brittle badge]

Gave +1 Rep to @trim beacon (current: #28 - 269)

[vagrant siren]

Hi, I can' log into the vpn website with the SMTP creds, not sure if that's intended or a bug?

[plucky whale]

Hi 👋, anyone know how to tackle this error” FATAL ERROR: No supported authentication methods available (server sent: publickey,keyboard-interactive)”

While pscp attempt

[trim beacon]

Check the domain of your credentials. They aren't valid credentials for your target. You have to breach the perimeter yourself

[trim beacon]

Please provide more verbose information in order for members here to provide with assistance or potential hints

[ruby roost]

Hi, I am providing you with the OVPN output as you asked.

[trim beacon]

You can see the mismatch in the network information you provided us (10.200.17.13) and the route being pushed:
net_route_v4_add: 10.200.116.0/24 via 10.50.113.1 dev [NULL] table 0 metric 1000

My suggestion would be that you regenerate your VPN profile

[ruby roost]

I have already done that 2-3 times but the result ends up to be the same !

[trim beacon]

Not sure what to tell you. You can see that your VPN profile does not match the network IPs you provided us. My only other suggestion would be to leave the room and then rejoin. Regen your VPN profile then again and connect. Make sure there is a match between the route being pushed and what you see in your network diagram. If these two don't match, you won't have luck. If that does not work I can refer it to the support team to see what is happening. But have never experienced a VPN server generating a profile different than the network you have joined.

[ruby roost]

Let me try it out again and will let you know how it goes

[trim beacon]

Also, if the issue persists, I will need an actual image of your network diagram together with the VPN profile file that was pushed to raise it to support.

[ruby roost]

Shall I DM those to you ?

[ruby roost]

hey I remember I faced this issue before too and had sent you the details in the DM can you check your DM's

you had solved it with another file that time

[mossy jetty]

I appreciate the reply yesterday. I did change more than just the ip and tested different user combinations. The push_reply gave me invalid ip's two days ago. The network restarted, it gave me valid internal ip's (but I wasnt connected to the internal). And today it's back to giving me these invalid ip's: PUSH: Received control message: 'PUSH_REPLY,route 10.2001.21 255.255.255.255,route 10.2001.22 255.255.255.255 If this is intentional, I apologise for taking up your time

[trim beacon]

I can't see the message in my DMs? Not sure what is happening there?

[ruby roost]

Will just DM you again

[trim beacon]

No stress with asking questions! It is part of what you need to figure out there yourself. Again, routes might have updated after there was a legacy VPN profile left there. So what can you do here

[plucky whale]

pscp laura.wood@10.200.7.21:/users/laura.wood/Downloads/20240206214108_BloodHound.zip ~/Documents

[vagrant siren]

I know, but the credentials I got (using bf) aren't working for the VPN website, and are working for the webmail platform

[pseudo parrot]

I wonder what they were used for 👀

[vagrant siren]

and I'm not talking about the creds given by the ssh server, I'm using bruteforced credentials

[pseudo parrot]

I know what Creds you're talking about

[vagrant siren]

aren't they supposed to be used to connect to the vpn platform?

[pseudo parrot]

Can you tell me the username you brute-forced?

[vagrant siren]

there's laura.wood and mohammad.ahmed

[pseudo parrot]

Yeah.

Those looks like a they're set up for something.

😉 Keep looking

[vagrant siren]

https://tenor.com/view/random-tuesday-phishing-phish-scam-alert-cyber-security-gif-22993437

[mossy jetty]

Leaving the room and joining again solved it for me

[trim beacon]

Do some research on what this error message means: "No supported authentication methods available (server sent: publickey,keyboard-interactive)"

[trim beacon]

Review the syntax of how you are providing the username and password. Remember different authentication methods needs different syntax

[teal sedge]

Folks, help me out here.
What is the difference between room https://tryhackme.com/room/redteamcapstonechallenge and ~~https://tryhackme.com/room/redteamcapstonechallengerX ~~? The network diagram is clearly not working on the second one...

Ah, when I clone the room to make an assignment it breaks the diagram.

[lyric stream]

Hello, cloning a Network room will not work currently. 🙂

[vagrant siren]

I tried just specifying the username (e.g just laura.wood), using @corp.thereserve.loc and @corp.th3reserve.loc for the email domain and url encoding the fields

[trim beacon]

This won't work, as it uses a different authentication mechanism. The specific mechanism is covered in the AD rooms and has a different syntax that is required. Also, trying for @corp.th3reserve.loc won't work as this isn't the organisation's domain. The @corp.th3reserve.loc is one provided by the organisation for domain squatting purposes, as mentioned in the project brief. To understand more about domain squatting and its use, please see the red team learning path

[vagrant siren]

ok, also is there a problem with the VPN or the room itself right now? I can't ping any machine

I tried leaving and joining a few times

can't ping with attackbox either

[trim beacon]

Doing this you are making the issue worse. As mentioned to another user in this channel, when you leave the room and rejoin, there is a good chance that your VPN profile is invalidated even if it shows a connection. Use the same methodology and help provided in all of the other AD networks for debugging your connections. This is a challenge, and similar to an actual red team, you will be expected to figure some stuff out

[vagrant siren]

Fixed. And for my problem with the reserve VPN website, I was doing everything correctly since the very beginning but for some reasons you can't login on the root webpage, you have to do it in /index.php 🫠

[floral ferry]

I can't see the Capstone adapter when using the attackbox. Is it only on my end?

[pseudo parrot]

Can you screenshot?

[floral ferry]

@pseudo parrot
I guess the network is already up and running, but no Capstone adapter.
I started "Breaching Active Directory" network just for testing.

[pseudo parrot]

Is your network running?

[plucky whale]

Network state running , but unable to any devices including VPN x.12

[frosty bluff]

I have done capstone, but re-doing for writeup and the vpn fire obtained from the webapp is adding these routes:

rather than the 10.200.X.21 and 22

fixed with adding my own route in kali but... doesn't seem like expected behaviour

[hollow ember]

Any chance I can get a sanity check on the initial access? Think I'm probably making things harder than they have to be

[pseudo parrot]

Can you use spoiler?

Or do you need to dm?

[hollow ember]

I can spoiler, I just wasn't sure about the rules for it

||I'm trying to start with the website (not attempted anything to do with he mail yet), and found the cache in /storage, a database.php file I can't download, the code in /artisan, found it's running php 7.2.24 on ubuntu 18.04.17, and has zend 2.3.0. Not been able to do much with the todolist, but I could send a phish to that email address? Somewhat stumped on how to proceed from here, and I'm not convinced snooping around those file systems is doing anything besides waste my time||

I have a 2200 word file of everything I've attempted so far lmao

Writing down everything

[pseudo parrot]

||there is steps to take to access the Web page, there is a clue hidden, but in plain sight that you might have overlooked||

[hollow ember]

||I know there's ssh on port 22, and I have the standard password list, so I could try a password spray attack on that?||

[pseudo parrot]

Something even simpler.

[hollow ember]

Alright, definatly been overcomplicating it then

||OSINT on the developers, or is that still overcomplicating?||

[pseudo parrot]

Osint isn't.

[hollow ember]

Isn;t overcomplicating, or isn't needed here?

[pseudo parrot]

Overcomplicating 😉

[hollow ember]

Right, thanks 🙂

[hollow ember]

||I'm once again lost. Done loads of enum, got a list of emails, and a proposed list of passwords based on the defaults, but no luck with anything. Trying to use both lists for the email s erver to no avail||

Got over 1000 passwords in that list, was hopeful one would work lol

May be using ||hydra|| wrong? I'm running ||hydra -L USERNAMES -P PASSWORDS mail.thereserve.loc smtp|| where ||10.200.103.11 mail.thereserve.loc is in my /etc/hosts||

[pseudo parrot]

What's your password policy?

And usernames?

[hollow ember]

Usernames: ||[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]
[e-mail]||

Passwords

[hollow ember]

If you don't wanna download the file from a stranger on the internet, the policy was to ||append a number and one of the special chars to the end of each password, so JustSomepassword1%, JustComePassword%1, JustSomePaswsword2% etc||

[pseudo parrot]

Are you only using % ?

[hollow ember]

No

All special chars

In the brief anyway

[pseudo parrot]

Yeah, im gonna see your list.

[hollow ember]

I pinky promise there's no malware

[pseudo parrot]

Lol, I specalise in Malware 😛

[pseudo parrot]

Yeah, the password is in your list.

[hollow ember]

Hmm, I wonder why my command no worky then

I think everything is in order?

Unless I need to logout of my account beforehand?

[pseudo parrot]

Nope.

[hollow ember]

Huh, so I have the username, password and correct IP, and it's still failing? Could it be a network issue?

ran it again as a sanity check, 0 combos still

[pseudo parrot]

I'm trying to find my notes.

[pseudo parrot]

You're going to kick yourself.

[hollow ember]

dear me

What did I do

lmfao

[pseudo parrot]

Can you spot what you've done wrong?

[hollow ember]

I dont have the [25][smtp] line?

[pseudo parrot]

Nope.

Something more obvious.

[hollow ember]

pass

[pseudo parrot]

I've hopefully made it more obvious.

[hollow ember]

my emails have corp.x.loc

OH

ffs

[pseudo parrot]

You're getting closer 😛

[hollow ember]

haha

(╯°□°)╯︵ ┻━┻

my email isn't the same domain, is it haha

e not 3

Alright, give it 10m for hydra to run again

[pseudo parrot]

Shouldn't take that long, I can't remember, it's been while.

[hollow ember]

Always slow in attackbox

Should probably just be using my kali VM, can save states then

[pseudo parrot]

Especially on user and password lists.

[hollow ember]

Niceeeee, I got a bite

Thanks haha

Inbox is empty tho

could still be useful

[pseudo parrot]

Perhaps it's not the inbox the login gives, that you would be interested in 😉

[hollow ember]

Yeah, will look at the VPN and ssh creds

scrap that on the ssh

Need a key

[pseudo parrot]

I'll leave you to work this one for a bit, if you *get * really stuck I can hint.

[hollow ember]

Cheers 🙂

Is there a flag for what I did?

[pseudo parrot]

Not yet.

You might get one (or 3) when you log in to something.

[hollow ember]

I'm gonna leave it there for today, been at it for about 6 hours

My typing fingers are tired 😄

[pseudo parrot]

Take note of the accounts you have

[hollow ember]

Yeah, I have 2600 words already

And it's just the 1 email account thus far

It's quite difficult I think, compared to the standard boot2root's

May have to do throwback again, as I took no notes last time haha

[fervent sail]

The Throwback network was retired a little while ago

[hollow ember]

Oh, well i guess I'm not doing that again then

[pseudo parrot]

This is the capstone project you should be attempting after the Red Team path.

ie

All the skills and techiniques needed for this. are taught in that path

[hollow ember]

Yeah, I've done lots of prep for this

It's still a challenge though

Which is good

I enjoy a challenge

[pseudo parrot]

This certainly is

And there is over 300 attack paths.

[languid zodiac]

||the two users whose email creds I found with hydra are not working on the vpn machine (10.200.X.12). Am I wrong to assume that the creds should be usable here to get the vpn for the internal network?||

[pseudo parrot]

The creds and VPN are related and you're so close.

You actually do this all the time if you use a vm 😉

[languid zodiac]

||Does it have to do with changing the ovpn file found in /vpn? I noticed the "Issuer: CN=changeme" and "Subject: CN=temp4" lines look ripe for changing||

[left rune]

since someone reset our room, the openvpn server in the environment is kicking out wrong addresses... making it impossible to do the legwork on wrk1 wrk2...

can someone please look at this?

The network was nothing but stable... why did folks reset it 😦

workaround:
sudo route add x.x.x.21/32 dev tun0

[languid zodiac]

Thanks man!

[brittle badge]

Gave +1 Rep to @left rune (current: #1993 - 1)

[cerulean wraith]

It is not impossible... There is a huge amount of paths to get in and do everything

[pseudo parrot]

Maybe that's intenional...

[left rune]

@cerulean wraith yeah, that might be true... but once you setup your entire c2 pivoting chain using sliver... you rather stick to the plan

mind you - it happened after th reset...

[cerulean wraith]

counterpoint: if you do this kinda work for a company and just stick to a single approach and tell them they are unhackable you are doing a poor job

[left rune]

wow - who got on your bad side today.... I think I am done talking to you

[cerulean wraith]

oh sorry

was not meant to come out harsh and unforgiving

after all this network is emulating a real life senario to the T

[left rune]

if that would be the case there would have been a proper EDR and not windows defender...

[cerulean wraith]

you say that but a lot of companies still only rely on microsoft products

[left rune]

not my customers

[cerulean wraith]

fair enoughs

[clear ember]

Is the server down?

[pseudo parrot]

Running for me.

[clear ember]

can't ping any machine

[cerulean wraith]

most of the machines on this network are windows machines... which generally don't respond to ping.... though the dc:s might but those are behind the firewall

[clear ember]

I've been working on it until yesterday and everything was right. I'm trying to ping the vpn, web or webmail machines and none of them works.

[cerulean wraith]

ah

well try for network reset or make sure the network is running

you can do this by refreshing the tryhackme network page

[clear ember]

I've already done all of them.

[floral ferry]

I've got a problem with the VPN machine

waiting for reset

[clear ember]

As you can see the output of the connection is: net_route_v4_add: 10.200.103.0/24 via 10.50.99.1 and there should be access to the machines.

[clear ember]

Only one 1+

Now waiting for the network to start over

It's late for me now so, I'll try tomorrow

Now it's working.👍

[floral ferry]

good for you

i'll wait for the reset or perform one myself in an hour

[stable sleet]

question. im doing the redteam pathway. will we be using everything we learn such as building pass lists and such

[pseudo parrot]

Yes

[cerulean wraith]

can't garantue it but basically yes... you will most likely have uses for everything on the red teaming path for this network room

[stable sleet]

Dang imma go thru this many times before I hit this challenge

[clear ember]

Any help with evolution? I cannot authenticate with hte password that was given on the e-Citizen platform.

[pseudo parrot]

Authenticate?

What are you doing?

[cerulean wraith]

evolution is a mail client app scrubz

they are probably trying to access their email for retriving flags and/or phishing the users on the network

[pseudo parrot]

Oh.

Just use the web browser

[clear ember]

There's not any webpage to access.

[pseudo parrot]

Oh there is 😉

[clear ember]

sure?

I've enumerate all posible ways and something must be forgotten

[pseudo parrot]

100%

I've used it.

[pseudo parrot]

It's not forgotten, you just haven't enumerated.

[clear ember]

well I'll try again

[pseudo parrot]

Don't be scared to ask for help. 🙂

[cerulean wraith]

help is allowed now

it was not during competition period

[clear ember]

vhosts?

[cerulean wraith]

probably

[clear ember]

I can't access vpn server port 1194

[pseudo parrot]

Restart the network

[twilit sable]

Hey hey, I've been stuck on this box for a while, so I'm just looking for a sanity check (no hints please)

How long did it take you guys to find the first exploit giving any sort of RCE?

[cerulean wraith]

quite a while

[cerulean wraith]

if you are very stuck and have not not finished the red team path yet going back and finishing that will help tons

[twilit sable]

I've finished it already

I've finished about 600 rooms so far

but my windows skills are still lacking ;-;

[twilit sable]

I've been stuck for 12 or so hours

[cerulean wraith]

luckly not all of the machines outside the firewall are windows

[twilit sable]

yep yep, there's 2 linux I've found

and 2 windows

[cerulean wraith]

well keep trying different things to get in.... eventually you might find your foothold

[twilit sable]

but I'm mostly looking for estimates of how long it took to get the first flag for people

thanks thanks :)

[twilit sable]

just to see if I'm really missing something

[cerulean wraith]

it took shadow about 3 days to get the first flag on this

though shadow has still not completed the red teaming path

[twilit sable]

Thanks thanks :)

[clear ember]

Web server with issues?

[clear ember]

Anyone to reset the network?

[cerulean wraith]

which subnet???

[clear ember]

It's already done

[clear ember]

Why am I getting "net_route_v4_add: 172.32.5.21/32" instead of 10.200.113.21/32?

[cerulean wraith]

because reasons

[clear ember]

what reasons? According to the "Out of scope" section: Attacking any hosts outside of the provided subnet range. Once you have completed the questions below, your subnet will be displayed in the network diagram. This 10.200.X.0/24 network is the only in-scope network for this challenge.

[cerulean wraith]

shadow thougth it was a bug for a while but seems as it is semi intended and depends on how the vpn server runs

[clear ember]

I'm upset of this challenge. Everyday there's some issue. I'm thinking about give it up.

[cerulean wraith]

well there is a ton of different paths to get through all of it

but can understand the annoyances