cyber-security-101-path

[thorn patio]

This beginner-friendly path aims to give a solid introduction to the different areas in Computer Security. This path covers the fundamental concepts and applications in the following:

➡️ Computer networking and cryptography
➡️ MS Windows, Active Directory, and Linux basics
➡️ Offensive security tools and system exploitation
➡️ Defensive security solutions and tools
➡️ Cyber security careers

[thorn patio]

🥳

[young heath]

hello, thanks for this 🙂

[strong skiff]

🏎️ 🔥

[torpid yoke]

quick question concerning the prize ticket system. If we have already completed a room in the learning path do we still earn tickets for the room?

[tulip linden]

If it's going on past events, you'll be allowed to reset the room once to re-enter answers to win tickets for room completion.

[torpid yoke]

great thanks!

[olive fog]

Gave +1 Rep to @tulip linden (current: #1 - 2891)

[thorn patio]

Yes it will. 😎

[torpid yoke]

👍

[lunar willow]

Do i need a subscription for this

[thorn patio]

Only for the subscriber only rooms in the path. 🙂

[young heath]

I keep getting "$5 swag voucher" and "Laptop" tickets but checking my "tickets" tab in my profile shows other tickets

[gusty jackal]

We're working on it 🙂

[young heath]

oh great!

[vale forge]

hey i have question

[torpid yoke]

Where's the link to the learning path gentlemen?

[vale forge]

.

[dark narwhal]

Hey a quick question

Is Cybersecurity 101 learning path replacing the Complete Beginner path?

[west mauve]

https://tryhackme.com/paths

[wicked otter]

can someone confirm if they done Nmap: The Basics task 3 question 1 (if is wrong or I am just confused)

[tulip linden]

Is the the TCP answer?

[wicked otter]

number of ports

[tulip linden]

Yes, I've already escalated to staff.

[wicked otter]

thanks for a moment I also run rustscan!!! to confirm

[shell beacon]

I second this question, I'm working on PreSecurity right now and want to know whether to still do Complete Beginner afterwards

[gusty jackal]

They are being merged

[dark narwhal]

Then can we just simply skip the Complete Beginner and do the Cybersecurity 101 path?

Would the learning outcome be the same?

[gusty jackal]

Rooms from both paths have been merged into this including new ones added

[dark narwhal]

I couldn't find some room in it including these

[gusty jackal]

Not all rooms from each path will be in there

[dark narwhal]

Got it, thank you

[olive fog]

Gave +1 Rep to @gusty jackal (current: #52 - 156)

[torpid yoke]

how did you got dark themed

[dark narwhal]

I am using the Dark Reader extension in Firefox

[torpid yoke]

cooollll i am going to try it

right now

[torpid yoke]

Thankss

[dark narwhal]

Yea it's really useful

[dark narwhal]

It's my pleasure

[compact wing]

got a question suppose u win 1 month premium voucher, and u already on a yearly subscription how does that work? does it extend it?

or can u redeem it later on after the event?

[swift depot]

Premium vouchers remain valid until you redeem them, so you could wait for your yearly sub to expire, then redeem the voucher.
You can't combine a voucher with a subscription, nor can you combine two vouchers.

[compact wing]

thanks

[olive fog]

Gave +1 Rep to @swift depot (current: #43 - 193)

[left lion]

what about rooms you already had completed in the path? do you get tickets for those

[torpid yoke]

Reset those rooms you have completed and then complete it again to recieve a ticket if you are not a subscriber or in case you are a subscriber you will get 2

[left lion]

sadge ok

[torpid yoke]

I recently completed the rooms that I had previously finished and was rewarded with 6 tickets.

[left lion]

an how long is the ticket event for?

[torpid yoke]

14 days

[left lion]

cool

so to maximize tickets you wanna clear the entire path in 14 days or is there a limit to how many you can earn?

[left lion]

Interesting

ty

[torpid yoke]

To know more about the event i will paste a link below

[tulip linden]

Staff are looking in to an issue with the path right now, please don't submit links

[torpid yoke]

Greetings!

[torpid yoke]

sure

[left lion]

is there an estimated timeline till the complete beginner path gets completely merged or depreciated?

[left lion]

if you get this title then does it replace the one you have now from your level or is there a tab where you can choose if you want to display it or not

[torpid yoke]

I am sorry, I have no idea

[torpid yoke]

😮

[cold osprey]

TICKET EVENT TICKET EVENT TICKET EVENT

[fallow cradle]

For ticket related questions, please use the #1297938128207872060 channel.
For questions related to the path or rooms, feel free to use this channel 🙂

[cold osprey]

test test test

it replaces your current one at a reverify on this discord

and instantly on tryhackme website

if you are 0xD god on the site this will replace it and lock you out of the advanced channels for the duration of the event

[left lion]

i didnt even know there were advanced channels

[magic rapids]

Discord: What are the advanced channels?

Article Link

https://help.tryhackme.com/en/articles/8671900-discord-what-are-the-advanced-channels

Oct 21, 2024, 5:47 PM

[weary charm]

hello, I need a little help in the Windows Command Line room. by question What is the OS version of the Windows VM? in the os system it says as follows 10.0.20348 N/A Build 20348, but it still gives me the wrong answer. What am I not doing well?

[wicked otter]

version will display when you login using ssh

[fluid kayak]

omg, that's the first time that i won something lol. (t-shirt)
i got so excited that i just instantly went and bought it xD

[urban sage]

promotion part is compulsory for new cybersecuirty path 101?

[left lion]

ngl having to reenter these answers after resetting the progress on rooms already cleared to get tickets is pretty tedious. Def something I hope changes in the future

[feral rivet]

has anyone worked on the Vulnerability Scanner Overview room?

When working on the task 5 question, the ip that was scanned using OpenVAS is 10.10.154.44 but it says that my answer is incorrect

so im confused where am i going wrong

[dusky patio]

what if the free rooms are already done?

[meager venture]

windowspowershell room, task 3 "How would you retrieve a list of commands that start with the verb Remove?": why || Get-Command -Verb Remove || is not a valid answer ?

[round smelt]

How many hours of content roughly so I can plan accordingly

[mental forum]

has anyone done https://tryhackme.com/r/room/flarevmarsenaloftools

idk what i am missing with question What is the IP address to which the process cobaltstrike.exe is connecting?

[hallow spoke]

Has anyone done the CAPA room I have some issues with question 3 in task 6, the answer mask doesn't fit the question?

the rulename referenced in the question also has incorrect repo link in the task text?

[thorn patio]

Did you read the hint?

[mental forum]

i read the hint but it is for the other question that hint. I put the IP address from the hint but keeps telling me wrong. Analysing it with procmon and process explorer too both showing exact same IP but room says it's wrong

[quaint plover]

You should add * at the end
And maybe use -name instead of verb

[thorn patio]

Did you defang the IP address?

[mental forum]

I'll have to give it a try

[thorn patio]

That's what the CyberChef url is for, it will do it for you.

[meager venture]

thank you @quaint plover 🙂

[olive fog]

Gave +1 Rep to @quaint plover (current: #1510 - 2)

[crimson silo]

please help me out here someone
Cyber Security 101>Command Line>Windows PowerShel
What do we call the advanced approach used to develop PowerShell?

[quaint plover]

Hint: It's written in second paragraph answer starting with O

[crimson silo]

Thanks

[torpid yoke]

Hey guys, I need a nudge plz in "CAPA: The Basics":
"Dissecting CAPA Results Part 4: Capability"
"Which TLN or Top-Level Namespace includes the Capability or rule name run PowerShell expression?"

cant find the answer 😦

[torpid yoke]

i use Microsoft.PowerShell.Utility

[robust plank]

Anyone Solved this?

This Room May Have Bug!!

[torpid yoke]

I didnt have any problem with it

[robust plank]

Lab (Web) Isn't Working As Expected!!
Port 8080,8081,8082 Down And Port 80 Returns Error!!

[torpid yoke]

worked on port 8080.. maybe try to restart the machine

[robust plank]

Same!!

[whole sail]

Can anyone please answer this: Is completed rooms available after premium subscription over?

[robust plank]

Nope

[whole sail]

Ok Thanks for answer.

[spiral cobalt]

did anyone complete the "Networking Secure Protocols" room last challenge?
the machine is slow and lagging Af

[robust plank]

yes

[reef compass]

looks like i keep getting streaks over and over

[spiral cobalt]

same here 😅

[spiral cobalt]

restarted the machine.. that fixed it. 🙂

[reef compass]

seems like a anti-cheese method - since I got one when it took me a while to fill out all of my previous answers for a prior completion of one of the courses

I'll update when I get through redo-ing networks since it is one of the longer ones I completed prior to the challenge starting

daddy needs a new lappy gosh darnit

though I have been studying for like 9+ hours. Kinda banged my head against the wall with the active directory challenges
It re-ignited my fiery disdain for coding questions and math questions alike --- those darn boxes always want the most specific things in them when it comes to what code "works"

[rapid root]

You sure that's the target VM, and not the AttackBox IP?
Because that error message shown would be typical for that

[reef compass]

did you try https://IPADRRESS

I had a similar issue when doing the OpenVAS one

[robust plank]

Yeah Pretty Sure!!

[rapid root]

You have the machine still up and/or can provide me with an IP where that same happens?

[heavy geyser]

Whoever thought of creating this pathway really deserves a raise

It's so great! Like I always felt something was missing when I jumped from beginner to Jr. Penetration Tester Pathway

This totally adds up all the missing pieces

Especially the rooms with each of the shell

[robust plank]

Now, Fixed!!

So Bad!!

[low glacier]

hi all, this is the Windows powershell room, im having issues with Task 3 q1. ive tried Get-Command -Verb Remove but that doesnt seem to work. have i confused it with something? if so can someone provide a hint please? thank you! 🙂

[languid cradle]

sameee here man i was like wtf is this bs

[woeful jungle]

Try to use a wildcard character , you need to search for the commands that START WITH "Remove"

You're not searching for a Verb here , you're searching for a name of the command that starts with Remove

[robust plank]

||-Name||

[low glacier]

ahhhh

i seee

[low glacier]

yep i see where i got confused

thank you!

[bold kestrel]

This is the room flarevmarsenaloftools

the ip address format

seems wrong here

[river raven]

Can anyone help me with this question

Which TLN or Top-Level Namespace includes the Capability or rule name run PowerShell expression?

[woeful jungle]

Try to defang the IP

[reef compass]

https://tryhackme.com/r/room/publickeycrypto
~user not in sudoers unable to decrypt~
Nvm sudo is not needed

[hallow spoke]

sorry was that a hint? Per my research there are no five word TLNs meaning there's some inconvenience either in the question or in the expected answer

room: CAPA: The basics

the question sounds:
Which TLN or Top-Level Namespace includes the Capability or rule name run PowerShell expression?

[hallow spoke]

import the .key file not the gpg file? happened to me so just guessing
I don't think you need sudo for that

[reef compass]

nah, sudo is just not needed in my case - thanks for the assist though, been a while since I messed with gpg

[olive fog]

Gave +1 Rep to @hallow spoke (current: #2293 - 1)

[reef compass]

2/3 defcon and 2/3 lappy oml

[bold kestrel]

ah totally forget it could be the case, thanks

[olive fog]

Gave +1 Rep to @woeful jungle (current: #163 - 45)

[low glacier]

Ayyy almost there

I've got 1/3 lappy so far

[reef compass]

HashingBasics - not enough allocatable memory?

[radiant helm]

Try it in your local VM, it worked in my machine

[reef compass]

Cool machine, Imma just use john - 'john the ripper'

[low glacier]

am i missing something? surely this is correct no?

[languid cradle]

its not Sort-Object look again 🙂 you are also missing one other thing -******* instead of length

[low glacier]

sighh i got it 😂

the little things man

[languid cradle]

yea i just finished it cause of your previous comment :p so I feel your pain

[low glacier]

yeah i did all the other q and left this one till the end

powershell is one interesting tool

[languid cradle]

for sure, i normally write in python so i was confused AF

[low glacier]

considering i use a windows host laptop. yet never played with powershell

normally its just linux bash with virtual machines haha

[low glacier]

have you done the linux one? i cant seem to find the pword to get root

[radiant helm]

Enter the password of user

[low glacier]

oh whoops mb i skipped that 😂

[languid cradle]

I did finish it but i sorta cheated, i was getting angry with the script so I used grep instead :p

[low glacier]

oh lol. im still tryna find the flag

[languid cradle]

yea if you get mad enough, you can use sudo grep ******** -r and youll find the file :p

im pretty sure its what the script does

[turbid scaffold]

what is the right

[low glacier]

.

[low glacier]

check this hint ^

[turbid scaffold]

great!

[frozen rune]

Bruh for the linux shells room i have no idea what the script is doing ngl, did the lazy thing since ur root and just grep -R'd it directly lol

[languid cradle]

yea pretty much same i felt like i was wasting my time with the script

[violet orchid]

The point of the question was to learn how the script worked :p

[languid cradle]

i did and i made it better taking 1 line of code instead of like 25 ;p

[tiny swan]

pls help me on the room: Investigating Windows
What IP does the system connect to when it first starts?

[cyan prawn]

until when can these tickets be collected?

[vale forge]

anyone completed the path

[heavy hound]

good morning everyone, happy crusade

[languid cradle]

https://tenor.com/view/borat-borat-very-nice-verynice-thumbs-up-gif-25080066

[prime blade]

I can't figure out how to get sqlmap to work in the last challenge of SQLMap: The Basics room

[balmy token]

is Capa Task 6 Q3 even doable? i've been searching for the answer for quite some time and i have also seen some people having a hard time figuring it out

[distant smelt]

Did they double the prize yet

[placid gull]

Web Application Basics

Task 10

Make a POST request to /api/user/2 and update the country of Bob from UK to US. What is the flag?

Note: Use all lowercase characters for any parameter that is required.

Can't figure this one out 😅

[distant smelt]

Did you add country parameter to the end of the api?

[placid gull]

yes tried mans things like just having country=us

[distant smelt]

with the question mark?

/api/user/2?country=us

[placid gull]

HTTP/1.1 404 Not Found

the answer will be so simple but i dont get it

[mortal berry]

You should make get requests to api/users after you run a post request to check what it has done. Bear in mind the hint is talking about the case of parameter (not necessarily the value 🤔)

[torpid yoke]

Welcome to joining the grindset buddy

[mortal berry]

That would be a get request. This needs to be a post. @placid gull is very close…

[gusty jackal]

click the settings wheel
next to the go button for the URL
and save parameters

[placid gull]

nope not getting it. dont even know whats my mistake
saved many different variations

[mortal berry]

Pay attention to the lowercase/uppercase…

Particularly in the value field…

[placid gull]

Note: Use all lowercase characters for any parameter that is required.

[mortal berry]

Yeah maybe that’s a bit misleading (read that as the parameter being the ‘key’)

[heavy hound]

user/2 is bob, i didnt needed to add the user entry

just country worked

[placid gull]

didnt work for me lol

[heavy hound]

👀

[placid gull]

i set it many times just to country us

[mortal berry]

Right look at exactly what it’s asking for in the country value

[mortal berry]

This is the last question I have in the path 🥴 no idea…

[placid gull]

WTF

UPPERCASE

[mortal berry]

I figured it out but it’s totally wrong

[stone vale]

Humor at the highest level (the powershell room):

"While the traditional Windows CLI uses separate commands to create and manage different items like directories and files, PowerShell simplifies this process by providing a single set of cmdlets to handle the creation and management of both files and directories."

"PS C:\Users\captain\Documents> New-Item -Path ".\captain-cabin\captain-wardrobe" -ItemType "Directory""

simplifies lol

[placid gull]

Note: Use all lowercase characters for any parameter that is required.

this is so missleading lol

or i understand it wrong

[dark narwhal]

I redeemed the Cyber Crusader prize but it's not shown in my profile

Will it appear eventually?

[mortal berry]

Yeah ‘country’ is the parameter; I got confused on the same thing earlier for some reason

[placid gull]

verify again with your discord token or it will automatically update every 24h

[placid gull]

i was sitting on it for 30 min

[mortal berry]

Ignored so much work today 🫣

[rose salmon]

I too finished it

[balmy token]

this must be so annoying...

[reef compass]

I am on 52% rn

Though I did start about 13hr ago with breaks and reasonable excursions

[mortal berry]

The answer is word for word within task 6 but it’s not the right answer to the question…definitely possible to find though

[balmy token]

thx very much man, cheers!

ill figure it out

[vale forge]

any staff

how to redeem gift

[stone vale]

Just click the vouchers

[rose salmon]

you guys know which new room was added

[vale forge]

@gusty jackal hello can i message you privately

in dm

[gusty jackal]

Sure

[vale forge]

check

@gusty jackal

[delicate badge]

#!/bin/bash

Defining the directory to search our flag

directory="/var/log "

Defining the flag to search

flag="thm-flag01-script "

echo "Flag search in directory: $directory in progress..."

Defining for loop to iterate over all the files with .log extension in the defined directory

for file in "$directory "/*.log; do

Check if the file contains the flag

if grep -q "$flag" "$file"; then

Print the filename

echo "Flag found in: $(basename "$file")"
fi
done

Flag search in directory: /var/log in progress...
grep: /var/log /.log: No such file or directory
root@magic rapids:/home/user# ./flag_hunt.sh
Flag search in directory: /var/log in progress...
grep: /var/log /.log: No such file or directory
root@magic rapids:/home/user# cd /var/log
root@magic rapids:/var/log# ./flag_hunt.sh
bash: ./flag_hunt.sh: No such file or directory
root@magic rapids:/var/log#

guys idk how to solve this

[rose salmon]

Anyone wanna trade 1 month premium voucher for 10 euro swag voucher?

[whole sail]

I was actually got 12 month subscription 3 times but it took only 2 times?

[delicate badge]

guys whats this pls

[languid cradle]

you need to run it as sudo i believe that is the only thing youll need to change. password is user@magic rapids if you dont remember

[delicate badge]

it worked

but im dealing with that now

[languid cradle]

I havent worked on that one yet, if your question is still up when i work on it tonight ill let you know 🙂

[spiral trail]

The answer is quite literally in the alert, on the first page when you click on the "View Site" button

[delicate badge]

Port Scanning Activity Detected

yeah still

didnt work

[spiral trail]

So what is the activity in this sentence? 😉 Keep in mind the amount of *** you see in the answer line

[delicate badge]

yeah solved it

i was just using the wrong grammar

lmaoo

[torpid yoke]

Hey guys, I need a nudge plz in "CAPA: The Basics":
"Dissecting CAPA Results Part 4: Capability"
"Which TLN or Top-Level Namespace includes the Capability or rule name run PowerShell expression?"

[balmy token]

look for 5 word sentence on the page, tables more exactly :). btw the answer has nothing to do with the question, ive also struggled to do it

[torpid yoke]

Thanks!

[golden gust]

👀 This isn't the best phrasing for the question. Will have it adjusted.

[torpid yoke]

Hello everyone, I am guessing, there is an bug in the 1st question's answer of Cybersecurity 101 -> Command Line -> Windows Powershell. If someone stucked with question, please tell me, then i will report a bug.

[uncut tulip]

what was the question?

[torpid yoke]

How would you retrieve a list of commands that starts with the verb Remove? [For the sake of this question, avoid the use of quotes (" or ') in your answer]

[uncut tulip]

do you mean it should be -verb instead of -name?

[torpid yoke]

I dont want to write an answer here, can i write you privately?

[uncut tulip]

sure

[cold osprey]

you still not found anyone??? if yes shadow can do the trade

[torpid yoke]

I'm in Aus, and with our exchange rate, a 10 quid and 20 quid swag voucher is around a $50 amazon gift voucher (assuming USD?) if I fill in that last 20quid portion i'd be willing to swap those maybe so I can get more books

although it's just throwing me cyber crusader and 10 pound swag vouchers each time now recently so dunno my chances

[torpid yoke]

Ok, i have sent

[quaint plover]

the flag wont appear after doing this

Web hacking > Web Application Basics

[placid gull]

Look a bit up

😂

[quaint plover]

I also wanna trade
shipping fees for me is like 20$

[cold osprey]

oh.... wow shadow is tired or they are reading things wrong for other reasons

thought they wanted 10gbp voucher for 1 month premium voucher

as shadow got the 10gbp voucher

[torpid yoke]

I am speechless

[cold osprey]

yeah that happens a lot

[torpid yoke]

😅

[topaz tusk]

Can Anyone Help me??
Question : How would you retrieve a list of commands that start with the verb Remove? [for the sake of this question, avoid the use of quotes (" or ') in your answer]
Room Name : Windows PowerShell

[quaint plover]

thanks haha

[olive fog]

Gave +1 Rep to @placid gull (current: #2295 - 1)

[spiral trail]

I'm not gonna give you the answer, just that you can find the most important part of the answer under the "Basic Cmdlets" paragraph.

[topaz tusk]

Thanks for the hint.

[olive fog]

Gave +1 Rep to @spiral trail (current: #2295 - 1)

[brazen crown]

I think I am going mad. I am on the Windows Powershell Module, question (How would you retrieve the items in the current directory with size greater than 100? [for the sake of this question, avoid the use of quotes (" or ') in your answer]). I am positive I have the correct answer and it works fine but it's still incorrect.

[torpid yoke]

Same question issue here

[prime blade]

does anyone have the solution to the mysqlmap room final task questions? I can't get it to work

[brazen crown]

I have sent you a message to see if we are on the same page

[quaint plover]

Send me the answer youre trying to paste there

[frozen rune]

When I scanned the ip with openvas it only returns with a medium lol and its asking for a high severity wut

[reef compass]

retry the scan or reset the machine
it took me hours to get through this one

[spiral trail]

Just open the file on the desktop. And to be sure, you ran it on the machine OpenVAS is running on?

[frozen rune]

yeah

Oh theres a report file already..

Lmao, the task said the scan would be slow so I assumed we had to scan the given ip

My bad

[spiral trail]

Exactly ^_^

[rough magnet]

Did you manage to get any where with this question? Been stuck on this for over 20minutes now

[brazen crown]

Yes.

[rough magnet]

any hints? 😄

[brazen crown]

Send me a message and I'll give you a hint

[patent field]

Hi
Anyone did this room before ⁠room-help FlareVM: Arsenal of Tools
https://tryhackme.com/r/room/flarevmarsenaloftools
I'm stuck in this question.
Q: What is the IP address to which the process cobaltstrike.exe is connecting?

[uncut tulip]

https://tryhackme.com/r/room/networkingsecureprotocols
One of the packets contains login credentials. What password did the user submit?

how can i filter the results to find the password?

[thin prism]

where does this new path fit into the path order?

[sacred pelican]

Came to ask the same. I'm currently working through Complete Beginner after doing Pre Security and Intro to Cyber Security. Should I skip Complete Beginner and just do 101?

[spiral trail]

The 101 path has a few more and new rooms, in the end I'd suggest to do them all in order to get a decent basic understanding of all subjects. And possibly you'll also find the subject you're more interested in than anything else, so you can explore the route you can follow later

[placid gull]

Finish it. I find it very useful you will see why when your are doing it.

[hollow inlet]

This was a funny question

Also there is a small correction in the POC for moniker exploit

How to report that

[sacred pelican]

Would you suggest I finish Complete Beginner first, then do the 101?

[placid gull]

Yes 100%

[karmic moth]

Why are some people only trying to speedrun the rooms for the rewards ? What I men in speedrunning is searching answers on the internet without studying the topic first.

I mainly care to understand the topic, take some notes and rewards are the secondary thing

[sacred pelican]

This is how I see it. I've used write-ups before when I get really stuck, but I research why and how I got stuck.

[elfin sandal]

Trade Offer:

We have the following swag items available for trade due to high delivery costs exceeding their value:

€10 Swag Vouchers (4 pieces)
Basketball Cap Voucher (1 piece)
T-Shirt Vouchers (2 pieces)

We are looking to exchange these items for monthly premium subscription. If anyone is interested, please DM me!

[turbid scaffold]

Moniker Link (CVE-2024-21413) task 3 What type of hash is captured once the hyperlink in the email has been clicked? ....

i don't know

[spiral trail]

The answer is litterally in the text above it 😉

[karmic moth]

This is my first kind of event, so I don't know if events like this were in the future, but it would be beneficial to introduce some day limit, to motivate people to understand these rooms and topics

[reef compass]

Is FlareVMarsenal broken or has anyone found out what's going on with task 4 question 6
I'm guessing it is broken like the other networking module

[turbid scaffold]

not right

year that right!!

[heavy hound]

Can i ask a question about CAPAbasics room ?
I'm stuck task 6, 3rd question - Answer looks obvious but it wont work

[turbid scaffold]

[heavy hound]

nvm:)

[ivory cave]

I'm stuck on this as well

[reef compass]

Known issue... wait did you get it?

[heavy hound]

no, i realized everyone talked about it on discord

i was just looking for answers, is it bugged ?

[rough magnet]

https://tryhackme.com/r/room/linuxshells

Task 6: Practical

Im loosing my mind with this part

Im on the Root Account, and if i do ls i can see hunt.sh
I can't do anything with this

It says use what i learnt in task 2
If i do grep hunt.sh
It doesnt show anything
Cant cat to see if there is anything in there 😢

Any tips or advice?

[reef compass]

which one?

also cd into the directory given in the instructions, you should find something there

[rough magnet]

im in that directory, it says the script will help find the document (answer to the question) But says i need to change the script but i cant do anything with the script

[reef compass]

so you did sudo su and became root and then traversed the directory to /var/log

did you try listing all of the items in your current directory?

[rough magnet]

Sweet, thats got it, Thank you 🙂

[solid coral]

isn't the script supposed to do that ?

[heavy hound]

do you know how can i retreive it ?

[reef compass]

I'd post a picture for the task but I am afraid I will not be validating

[solid coral]

Ok let's start from the beginning, are you able to edit the script ?

[reef compass]

Re-read then entire Linux Shells tasks very slowly and keenly - I am no longer answering questions

[solid coral]

huh

[rough magnet]

i didnt use the script in the end, i just went to the directory and it was ovbs which file it was referring to......

[solid coral]

I grepped it but I still don't understand the script part

[rough magnet]

Same the Grep part didnt work for me at all

[warm spoke]

Yes

But most users just want to rush through it for the loot so they don’t take the time to really learn

[solid coral]

grep in the /var/log

[torpid yoke]

hi everyone

i have a problem in the active directory basics section in task 3, could anyone help me?

[solid coral]

oh my god I just got the Script part

there aren't two files, it's ONE with a space in the name

[spiral trail]

Posasibly, what is the problem/question?

[solid coral]

yeeaa it was a stupid mistake, I now see that the script name has a space in there

[rose salmon]

Anyone wanna trade your 1 month voucher for a 10 euro swag voucher?

[torpid yoke]

i tried to look for the answers to the firstbtwo question but i'm afraid i'm looking in the wrong way and i'm stuck

[solid coral]

You need to read Machines and Security Groups sections carefully

[autumn elk]

https://tryhackme.com/r/room/networkingconcepts

On a WiFi, within what will an IP packet be encapsulated?

[distant smelt]

Frame

[autumn elk]

i had data frame from reason thanks

[torpid yoke]

thank you very much

[olive fog]

Gave +1 Rep to @solid coral (current: #695 - 6)

[coarse sleet]

how did the gobuster room

who*

[ivory cave]

They now changed this to be the "defanged" ip, and that worked

[blazing hornet]

i did

[coarse sleet]

can you help me with the js file

[blazing hornet]

Yea it took me very long to get it

[misty python]

If I reset my progress will I receive more ticktes?

[coarse sleet]

yes

no

im joking

its not

[blazing hornet]

with gobuster you get 3 more links, you have to scan those as well

[coarse sleet]

yes i got one with /secret

[misty python]

I had already done half of the stuff before it's release 😓

[tall bay]

Can someone help me

It's been an hour

And can't find the answer

[blazing hornet]

did you scan that?

[coarse sleet]

yeh but you can reset those rooms and then you get the tickets i did it like that

[coarse sleet]

yes but i got no file with .js

[misty python]

oh okay Will try then

[coarse sleet]

same

[blazing hornet]

you get 3 links right? add those to the gobuster command

1 by 1

[tall bay]

Oh

so /secret/.....

?

[blazing hornet]

yes

[tall bay]

Oh ok

[coarse sleet]

i found it man thank you

[olive fog]

Gave +1 Rep to @blazing hornet (current: #2300 - 1)

[tall bay]

Got it thanks man

[olive fog]

Gave +1 Rep to @blazing hornet (current: #1517 - 2)

[elfin sandal]

same here! my scan is still going on... : (

[olive fog]

Can't give that much (max 1)

[tall bay]

@elfin sandal

[ivory cave]

Make sure you're specifically looking for files ending with ".js". There's a specific flag to do this

[tall bay]

-x .js

[river raven]

also need help on it

[elfin sandal]

gobuster dir -u http://10.10.139.187/secret/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .js

i'm trying with this and still didn't found any .js file !

[elfin sandal]

am i doing something wrong here?

[ivory cave]

It uses the defanged IP address

[wicked otter]

try use domain name as stated on the question

[elfin sandal]

but that isn't a valid domain!

[wicked otter]

read Task 2 Environment and Setup

it show how to setup DNS

[blazing hornet]

You need to add 1 of the 3 links you get from this command to this command. like this:
http://10.10.139.187/secret/extra

[tawdry gull]

I can't continue the path because linux part 2 room is paid...

[heavy nexus]

You have to use www.offensivetools.thm

[blazing hornet]

I didn't have to

[heavy nexus]

But it was clearly stated in question

[ivory cave]

Whoooooooooooo!

[elfin sandal]

thanks man! it has worked.

[olive fog]

Gave +1 Rep to @blazing hornet (current: #1143 - 3)

[torn thorn]

did you got any big prizes ?

[torn thorn]

congrats amazing work

[rose salmon]

I have a question. When did the path geot released? Has it been 45 hours since it's release actually?

I too got the same amount of time LMAO

@fallow cradle There is a bug with the certificate "Time to complete".

[civic tartan]

Haha i took months with complete beginner path and cert says i only took 16 hours.

[vocal matrix]

No, it’s acumulated amount of time of average time to complete a room

[torn thorn]

Same thing

[rose salmon]

I did not get you.

[civic tartan]

the path was released less than 45hours ago.

[torn thorn]

I think it is at least 70 hours me to complete it

[vocal matrix]

Every room has average time to complete at the top like 45 minutes, 60 minutes etc… So after you finish a path you get a sum of every room

[inner rapids]

Did anyone buy it at 25% off?

[rose salmon]

But it hasn't been 45 hours sice the beginning right?

[vocal matrix]

Nope, i believe it’s gonna be 23h since beginning

[civic tartan]

He means its the accumulated time thats on top of the room. Not the actual time it took you.

45 hours and 13 minutes kinda weird amount tho

[rose salmon]

Gotcha. But it is not a good calculation right?

[obsidian ravine]

"How would you retrieve the items in the current directory with size greater than 100?" Tip: size is Length

[ocean holly]

anyone has gotten the laptop?

[rapid parcel]

I got all the small prizes... and teased for all the big prizes.

[civic tartan]

I got 2 tickets for all prizes. Still got plenty of rooms left, but i got feeling its gonna be all streak freezes from now.

[rapid parcel]

That's all I got last night into this morning. Cyber Crusader and Freezes

[rapid parcel]

What do you think the answer should be?

[civic tartan]

Haha ye. I do have €10 voucher.

[ocean holly]

Yes I got the Cyber crusader freezes and the £10voucher

but still plenty of rooms left

[obsidian ravine]

I know what the correct answer is, I just wrote a hint.

[rapid parcel]

Oh ok, lol

[half merlin]

Anyone up to the powershell room? It seemed to not require a box, then suddenly has a question regarding the target machine. But what's the target machine?

See the last two questions for Task 6: https://tryhackme.com/r/room/windowspowershell

[obsidian ravine]

Above in the chat, users asked questions and no one has answered them yet

[rapid parcel]

Section 3 for PowerShell has the target machine in it.

"Powershell Basics"

[half merlin]

D'oh! Thanks I see the button now.

[timber oyster]

is there a weird typo for the SOC analyst fundamentals for answering the alert triage and reporting question

shouldn't it be SOC analyst level 1?

i feel like I'm missing an extra character

[delicate badge]

Delete whatever you wrote, Copy and paste the word "SOC analyst level 1" from the lesson and paste it into the answer bar"

[rugged flume]

you are missing the ( ) between Level 1 I guess

[delicate badge]

yeah and spaces

its better to copy from the paragraph in the lesson

[rugged flume]

yeah

[timber oyster]

ty lmao

[vocal linden]

Can anyone help me ?
In powershell room, How would you retrieve the items in the current directory with size greater than 100? [for the sake of this question, avoid the use of quotes (" or ') in your answer] ?

[rapid parcel]

#cyber-security-101-path message

[vocal linden]

😦

[proud valley]

Get-ChildItem | Where-Object -Property Length -gt 100

[vocal linden]

I wasn't using property in my answer xd

[delicate badge]

BOYS

[civic tartan]

sup ?

[carmine wagon]

damn

need help

blocked since 1h

on the same shit

need help only one time 😦

i feel so dumb

[heavy hound]

[civic tartan]

better just ask your question in 1 message. which room/task/question and what have you already tried?

[carmine wagon]

the third question of the gobuster the basics task 4

tried all the things

gobuster with the -x .js

a lot of worlidsts

and steel nothing

will scanning the direcotry

[civic tartan]

Try to type it all in 1 (maybe 2) messages, this is considered spam.

[carmine wagon]

the third question of the gobuster the basics task 4
tried all the things
gobuster with the -x .js

a lot of worlidsts
and steel nothing
will scanning the direcotry

[delicate badge]

?

[carmine wagon]

?

[snow meadow]

Hi Guys I am stuck on this questiont from Task 6 of the Capabasics room.
The question about " Which TLN or Top-level Namespace includes the capability or rule name run Powershell expression"

[heavy hound]

#subs-room-help message

[snow meadow]

it says "no access

[heavy hound]

#room-help message

its bugged

[snow meadow]

thanks a lot

[hallow spoke]

indeed doable

[prime blade]

yes

[sharp creek]

linux fundimentals part 3, task 6, question 2 "When will the crontab on the deployed instance run?"

It's not accepting any answer? ||It runs every 12 hours, but it's not accepting anything related to that?||

[civic tartan]

It's not every 12 hours. The answer can be found at the bottom of the crontab file.

|| include the special character ||

[sharp creek]

||ok well, every 12th hour. That's the only cron I've seen mentioned is 0 */12 * * * ? Which unless sites are wrong, and the backup cronjob for my minercaft server is also wrong, that's midnight/midday - every 12/12th hour 😅||

[civic tartan]

Are you looking at the crontab file on the attached machine?

[sharp creek]

Yes

it was empty until I added the mentioned cronjob

[civic tartan]

😅

[civic tartan]

It is not empty (shouldn't be) and you don't have to add it yourself.

[sharp creek]

on the ssh?

[civic tartan]

Use crontab -e

[sharp creek]

Yeah the only thing in there is 0 */12 * * * cp -R /home/cmnatic/Documents /var/backups/ which I added (except for the comments but, they're comments lol)

[civic tartan]

The answer is/was on the very last line of the file. You don't have to edit anything.

[sharp creek]

in the comments?

[civic tartan]

No.

Ignore the hint.

Its kinda misleading.

[sharp creek]

this is the entire file

[civic tartan]

What's the ip of the machine?

[civic tartan]

Nice. Win anything big?

[sharp creek]

it's the target machine's IP

[civic tartan]

Which is?

[sharp creek]

Is that info that should be shared? 🤔

[robust plank]

no

[civic tartan]

Yes, its only the target machine. I want to check if i can find it.

[sharp creek]

10.10.235.69

[civic tartan]

I think maybe you deleted the line with the answer.

probably best to restart the VM

[sharp creek]

all I did was just paste into a new line 😅

[civic tartan]

idk what happened. the answer was not where its supposed to be. You dont have to paste anything in, just open it and check the very last line.

[sharp creek]

||@reboot /var/opt/processes.sh? 🙃 ||

that was not there for sure the first time around 😭

now to play the game of what answer is it wanting lmao

[civic tartan]

only the first part.

[sharp creek]

oh it wants the actual command aaa

[sharp creek]

Thank you!

[olive fog]

Gave +1 Rep to @civic tartan (current: #33 - 247)

[torpid yoke]

Just finish!! Nice one , got a free 🧢 💪

[rich glen]

Hey

Do they ship the prizes automatically when redeemed?

[little spire]

In the nmap room task 3 question 1, is it bugged? I have ran three separate scans and I'm getting the same out of ports open, which is not the correct answer.

[burnt atlas]

is there any problem with question 3 in task 6 in CAPA: The basics room? yes or no?

Because I tried so many times, and I think there must be a mistake, or maybe I am wrong? Just I have to know is there any mistake or not ?

[rose salmon]

no

I finished entire path

Think Think

[burnt atlas]

Thank you.

[olive fog]

Gave +1 Rep to @rose salmon (current: #2309 - 1)

[snow meadow]

did anyone had any issues with the imphash answer for the "cobaltstrike.exe" file for task4 in the FlareVM room?

i have the right imphash but its says the answer is incorrect?

Am I suppose to get the imphash for a different file

[snow meadow]

it shows in the image of that task as well the ip address, but you have to put into a defang mode, so use cyberchef for it or you can manually defangt it

[polar sigil]

Is there any way to get more tickets? I completed all the free rooms but can't complete the rest without a subscription

[thorn patio]

DM me your answer and I'll compare it.

[thorn patio]

Task 2 in https://tryhackme.com/r/room/trywinme explains how to get more tickets.

[snow meadow]

Hi thanks,
But I found the answer apparently I was “sigcheck -h filepath” command to get the imphash , which gave a different hash value

[olive fog]

Gave +1 Rep to @thorn patio (current: #16 - 484)

[snow meadow]

But then I use pestudio and found the hash and it worked

Thanks though

[hallow quest]

why "Get-Command -Verb Remove" isn't correct for this How would you retrieve a list of commands that start with the verb Remove? this is in windows powershell room

[languid cradle]

we arent looking for -Verb and we want Remove as the beginning

Can anyone give me a hand with the Tcpdump: The Basics Task4 question 2 here is my command: tcpdump -r traffic.pcap -s 0 "length > 15000"
The issue is I am not getting the ip for the host only the receiver.

[torpid yoke]

https://www.youtube.com/watch?v=tVbPMHMxTqE my video is a bit awkward and terrible but i gave it a go and hopefully I get some extra tickets from the submission (y)

[timber sundial]

Why it takes so long to get the file with .js extension 😔

[echo otter]

Add /secret at the end of url

[timber sundial]

I see 😂

[echo otter]

Yes the 3rd question was to enumerate that directory further

[timber sundial]

It says all the parameter do not appear to be injectable. Any tips

[stuck lake]

I’m finding this as well. Is the answer to this task wrong?

[little spire]

Try "tcpdump -n greater 15000 -r <pcap_goes_here.pcap>"

[topaz tusk]

can you help me with this question : Which TLN or Top-Level Namespace includes the Capability or rule name run PowerShell expression?
Room Name : CAPA: The Basics

[languid cradle]

Thank you so much I was stuck on that

[olive fog]

Gave +1 Rep to @little spire (current: #1147 - 3)

[topaz tusk]

@little spire bro can you help me please?

[little spire]

You're welcome! 👻

[little spire]

I can do my best.

[topaz tusk]

Can you help me to find this answer?

[little spire]

I haven't done that one yet, let me boot it up real quick and look.

[topaz tusk]

Thanks for your time.

[olive fog]

Gave +1 Rep to @little spire (current: #932 - 4)

[little spire]

I'm confused as well, it asks for the top level namespace, which is 'load-code' but that answer is not correct. I'm going to look some more.

[wicked otter]

This is wrong question, all of us just guess it to finish the room looking for 5 words "reference anti-VM strings targeting VMWare" it was reported but still not fixed, yet, I do not see why everyone need to spend much time when answer is wrong, so I giving the answer here, hope moderator do not delete my message.

[little spire]

Thanks! Great YouTube by the way, nice to see you in the Discord as well!

[olive fog]

Gave +1 Rep to @wicked otter (current: #209 - 31)

[topaz tusk]

Thanks I literally stuck for more then 1 hours and Also I am a subscriber.

[olive fog]

Gave +1 Rep to @wicked otter (current: #205 - 32)

[left cosmos]

Network secure protocol

Last answer

[hallow spoke]

i would :D

[left cosmos]

..

[languid cradle]

check the hint

[wicked otter]

check the hint, it already give you where to look

[hallow spoke]

starting thinking that was intentional trick after all

[hallow spoke]

what task is it?

[left cosmos]

Wireshark

[languid cradle]

the hint litterally gives you the answer if you open the packet

[languid cradle]

check dm i showed you what you are looking for... not the answer but pretty much there

[patent field]

Windows PowerShell

[languid cradle]

is there a question?

[timber sundial]

Anybody knows how to solve this

[wicked otter]

I will chck it again, but fast way to solve t his capture the request with Burp then use sqlmap -r file.txt etc will work (I will check later why original command do not work)

Just finished the path, no luck, I think I need to make a video to get extra ticket!!!

[minor crown]

use this command sqlmap -u "http://ip/ai/includes/user_login?email=test&password=test" -D ai --tables --level=5

[patent field]

Yes,
This one
Q, What do we call the advanced approach used to develop PowerShell?
https://tryhackme.com/r/room/windowspowershell

[languid cradle]

answers is in the first paragraph: PowerShell is....., which means

[wicked otter]

this work, I think his command did not work as he did not put URL between "" , from screenshot you can see error -D command not found , so add "" to work

[patent field]

For this room https://tryhackme.com/r/room/gobusterthebasics

Q, Enumerate the directories of www.offensivetools.thm. Which directory catches your attention?

I'm trying to access the website, but it makes me unable to connect to

I'm using this command gobuster dir -u "https://www.offensivetools.thm" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

[wicked otter]

did you finish task 2 where you setup DNS?

[slender creek]

Anyone finished Incident Response Fundamentals? hard stuck on task6 2nd question

[tribal kernel]

guys if you need help in rooms i suggest typing in #room-help or looking for your question in the search since alot of questions get asked multiple times

[floral herald]

anyone got defcon?

[tulip linden]

This channel is fine for support on rooms that are in the path, please leave decisions like this to moderators.

[tribal kernel]

im just giving advice

becuz

i think people there will respond faster then here

but fine mr scrubz

and where am i making a decision

[tulip linden]

Advising people to use another channel like they're doing something wrong by asking in here.

It's a shame I'm recording my screen and caught that...

[tribal kernel]

so missclicks cant happen?

[tulip linden]

They can, however you were typing when I said that.

There is no need for the attitude, all I asked was to leave such advice to the mods, advising to use a different channel when they're using a channel that can be used for that is a light form of mini-modding.

[tribal kernel]

sure bud

wont do it next time

[wicked otter]

its related email, threat was in the attachment

[slender creek]

Yep i know but couldn’t get the answer right

I tried everything

I get the first word but couldn’t find the 2nd

Nvm i found it haha

Idk why it didn’t work first time

[torpid yoke]

Djalil I have seen your YouTube channel!

that is the only way I recognized you here tbh

XD

good to see you here as well

[safe jacinth]

hello i am stuck in the room FlareVM: Arsenal of Tools - task 4 it is impossible to validate the imphashe of cobaltstrike.exe someone have alredy complete this room ?

[vale forge]

.

[safe jacinth]

i tryed all the hashes i found and nothing is it just me ?

[shadow wing]

Do you guys think it's still possible to get the amazon voucher?

[safe jacinth]

everything is gone

[shadow wing]

Uff, I'm busting my ass to get the last ticket for Amazon

[safe jacinth]

can you help with room FlareVM: Arsenal of Tools - task 4 ?

[shadow wing]

Not there yet

[coarse sleet]

how did <ou find it

i dont see it

[safe jacinth]

ok thanks :p

[olive fog]

Gave +1 Rep to @shadow wing (current: #1526 - 2)

[golden gust]

yup, still vouchers left.

[coarse sleet]

thanks

[olive fog]

Gave +1 Rep to @golden gust (current: #2314 - 1)

[plucky kite]

hi guys

[sudden carbon]

I have the same screen. 👀 🤣

[wicked otter]

Yes tryHackMe is palying Halloween with us!!

[sudden carbon]

hahaha

[little spire]

Same, I still have a few rooms left but have been consistently pulling freeze and crusader since yesterday morning.

[sudden carbon]

Thank Djalil, few videos of you let me finish a few "I'm-stuck-what's-the-next-step" machines where I was stuck and couldn't go further.

[olive fog]

Gave +1 Rep to @wicked otter (current: #200 - 33)

[sudden carbon]

Oh lol

[wicked otter]

which quesiton on task 4

[wicked otter]

open it with pestudio you will see the Imphash value

[sudden carbon]

Where's pestudio located on that machine?

Silly my I dind't opened the whole screen on tab. I saw it on desktop.

[wicked otter]

both desktop and task bar

[sudden carbon]

Yeah under the tool I only had visible

[hasty scroll]

Is there anyone on that can help me with the WindowsPowershell room, task 8

[hollow pewter]

yes

[hasty scroll]

Actually I just finished it. I figured it out, lol

I was missing the pretext

Thank you though

[gentle shoal]

When is this over?

[safe jacinth]

yes but the field was empty at 16.00 now it is good ...

[dark venture]

Weird! Sqlmap is not working. It'is saying "email does not seem to be injectable". Though, I used the right syntax

Can someone help with the last task of sqlmap room ?

[wicked otter]

do not forget to put url between "" (also can you share your syntax)

[dark venture]

sqlmap -u http://ip_address/ai/includes/user_login?email=test&password=test --dbs --level=5

[wicked otter]

use sqlmap -u "http://ip_address/ai/includes/user_login?email=test&password=test" --dbs --level=5

[hasty scroll]

I am in the Linux Shells room and not quite understanding task 6. I am in the /var/log directory and am not seeing their flag thm-flag01-script

[dark venture]

I don't know why I haven't though about it😅. Thanks Djalil

[olive fog]

Gave +1 Rep to @wicked otter (current: #198 - 34)

[wicked otter]

If I remember correctly script search inside the .log files, so flag is on file and not it is a file by itself, I will check later, but if you run script correctly it will tell you where

[hasty scroll]

Isn't working

partially not working

[warm spoke]

This has now been added to the room in task 4

The use of single quotes, assuming users will read it

[wicked otter]

change for loop line to: for file in "$directory"/*.log; do

also grep command can give you the answer too

[safe jacinth]

hey i just finish the learning path but no more ticket for the defcon just streak freeze 😭 is it done ?

[hasty scroll]

I figured it out. There was another set of quotes that I needed to put information into, but thank you for your input.

[olive fog]

Gave +1 Rep to @wicked otter (current: #196 - 35)

[violet orchid]

it would probably be good to tell them why that works instead of just giving them the answer

[versed granite]

I have question regarding Windows Powershell first question. Why only one way to get the result counts as correct answer?

[hasty scroll]

not finding the answer anywhere.

nvm, I found it

[hasty scroll]

Why is it not working? I have terminated and restarted the target machine a couple of times. Cybersecurity 101, Networking Concepts room

task 7

[lavish trellis]

you seem to be missing the hostname part as a second line after the GET line

[hasty scroll]

ok I will try that

[lavish trellis]

sorry Host, not hostname

[hasty scroll]

thank you, I got it

[olive fog]

Gave +1 Rep to @lavish trellis (current: #30 - 288)

[plucky kite]

hi guys

[echo finch]

I have problems when I try connect room Power Shell

[plucky kite]

when i use the USB drive kali go out enyone know the reason please ?

[echo finch]

I have problems whit the room Windows Power Shell. I try connect but they machine don't respond to a ping

[civic tartan]

just ping? because windows generally does not respond to ICMP.

[echo finch]

Yes, but when I try to connec when they credentials i don't have a response

[civic tartan]

are you using attackbox or own VM with openVPN connection?

[echo finch]

I try whit attackbox, but right now I connect whit VPN and i work
Thanks

[olive fog]

Gave +1 Rep to @civic tartan (current: #32 - 251)

[crimson silo]

What PowerShell command would you use to display the content of the "C:\Users" directory? [for the sake of this question, avoid the use of quotes (" or ') in your answer]

[hollow pewter]

Hey

[crimson silo]

yes

[hollow pewter]

hint:

[crimson silo]

Get-Content

[hollow pewter]

no

[quaint plover]

before one was correct

[hollow pewter]

correctly

[crimson silo]

Get-ChildItem

[hollow pewter]

closer to the goal

[dim fox]

did the rooms stop giving monthly points?

[quaint plover]

Where are you stuck

[hollow pewter]

I uploaded shell, but i lost connection if you see in picture

[quaint plover]

Always losing connection?

maybe restart both Atkbox and target

[hollow pewter]

i try

[mellow quail]

hello.. just want to confirm if free users will not able to complete all the rooms?

i am now on the windows powershell room and not able to join because it is premium room.. (sad)

[civic tartan]

Correct. About 60% of content is free.

[dense hatch]

Can someone explain how to do Remote desktop in the Active directory room? I have the attack box and windows server machine up and running.

[brazen blade]

you can just search for "remote desktop" on the attack box

[dense hatch]

that doesn't really help. The attack box showed .yml files and a .cs file

[brazen blade]

huh?

Share a screenshot please

you'll need to do

[magic rapids]

@dense hatch

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Oct 24, 2024, 1:18 AM

[brazen blade]

should look like this

[glad ivy]

gotta question regarding this. When running the script, I am getting access denied like?? did that happen to anyone?

[brazen blade]

which script?

[glad ivy]

The powershell script that is need to reset the password for Sophie

[brazen blade]

share a screenshot please

[glad ivy]

idk why i am unable to attach screenshots🥲

[magic rapids]

@glad ivy

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Oct 24, 2024, 1:27 AM

[brazen blade]

After you did that, you can share screenshots

[glad ivy]

it gave me unknown integration🥲

[brazen blade]

huh? did you copy your token correctly?

[dense hatch]

I need to access Sophie's account via remote desktop. the windows server machine is not connected to a network. The attack box in this room is Linux based.

[brazen blade]

ignore the network icon

and in your screenshot its a windows machine (which its supposed to be)

so inside that just click on the bottom left windows icon and search for remote desktop

[dense hatch]

ok so now I am trying to sign in with Phil's account before resetting Sophie's.

[brazen blade]

you need to connect to the network first

The Computer is supposed to be thm.local

also before switching into phils, did you do task 4?

(The Permissions for Phil)

[dense hatch]

Do I have to? I am done with this room except for that question because I have not been able to figure out the remote desktop.

get me in to the remote desktop and I can do the rest

[glad ivy]

yes i did. attempted multiple times

[brazen blade]

you can send me a dm with the image

[brazen blade]

well

you have to change the permissions for phil first

so that you afterwards can (as phil) modify the password of sophie

[dense hatch]

got it. that's easy. Help me with the remote desktop please. I am ready to pull my hair out, because to me it hasn't been explained very well.

[brazen blade]

it states:

Now let's use Phillip's account to try and reset Sophie's password. Here are Phillip's credentials for you to log in via RDP:```

[brazen blade]

did you enter thm.local

as the Computer

[glad ivy]

the fast way to this would be simply change the password manually in AD for sophie

[brazen blade]

well there isn't supposed to be a fast way

its a learning path

and knowing how to use RDP is one of that or is included in the learning and shouldn't be skipped

Especially since so much is AD related

[glad ivy]

I spent literally 2 days trying to figure it out so i was like okay doing the way ik but i agree with you on this😅

[brazen blade]

Where exactly did you struggle?

[dense hatch]

when I set up the computer as THM.local I get to this screen. I entered the provided password and it gives me an error.

[brazen blade]

Where are you getting ADBASCIS from?

Read the "Note" below the Username and Password for phillip

[glad ivy]

It did not let me. Threw an error message saying "usually because you don't share a server with the recipient or the recipient"

[brazen blade]

try again

[dense hatch]

it auto populated the adbasics. I am assuming it came from the windows server VM.

[brazen blade]

yea ignore that, read the task

[glad ivy]

ummm no luck

[brazen blade]

you might need change your privacy settings

cuz I cant dm you either

nor can I add you (you can add me tho)

[dense hatch]

@brazen blade @brazen blade OK I got in. Is there a room that specific to RDP? I went through the windows rooms already. This is the last one from that path.

[brazen blade]

Where you further can learn RDP or?

[dense hatch]

yes

for me this was an unnecessary headache.

I tried to see if there was another room for it, but found nothing.

[brazen blade]

Well

RDP is quite simple

You have a Domain/IP in this case thm.local - see it as the "network" you're connecting on

And from there you simply have to enter the username/password

[dense hatch]

OK I guess my malfunction was the room makes it sound like I was supposed to use the Linux machine toin order to do RDP.

[brazen blade]

Im not sure where you're getting the Linux machine from

seems to me like an old machine?

for another room that you might have forgotten to terminate?

[gleaming violet]

Does anyone have problem with Hash in Command Line - PowerShell - Task7? I fouund a hash of the file but it do not want to "Submit" it. I dont know what to do

[dense hatch]

There are two machines in this room. The one in the windows domain task, opens windows server. The attack box button up top, opens a Linux machine.

[brazen blade]

ah

I dont think you were supposed to open the attackbox lmao

[dense hatch]

Yeah I get that now.

[languid cradle]

For the "Shells Overview" Task 2 where the heck do I find the answers I got the first one but the other two dont seem to be in the shell overview portion

nvm only the middle one can I not get

[brazen blade]

You mean at "Shell Overview/What is a Shell?"

What process involves using a compromised system as a launching pad to attack other machines in the network? ?

Its in the text

[languid cradle]

yea that one I have tried so many possible answers

[brazen blade]

Reread the last bulletpoint again

[languid cradle]

thanks i feel stupid, i used so many other words that mean that 😖

[brazen blade]

no worries

[glad ivy]

can someone tell me where this "Show Split View" button is? Split-Screen View isn't working for some reason

[brazen blade]

When you start the attack box it opens on the right side of the browser

if you closed it by accident, you can access it via the Show Split View button (only available if its not open)

[glad ivy]

for some reason, i don't have as yours

[brazen blade]

you didnt start the attack box yet

you only started the target

press "Start AttackBox" on the top left

AttackBox: Your "Hacking" Machine (Kali)

Target Machine: The Target you're attacking (hence the target lmao)

[glad ivy]

omggg

[brazen blade]

for example if you wanna uise your own Kali Machine, you don't need an AttackBox. Just a openVPN Connection

[glad ivy]

ahh I have trying to find it everywhere else except that. it's been a long night lol

[torpid yoke]

good morning everyone

[lavish trellis]

this message seems to be relevant to your situation:
#room-help message

[placid gull]

Cyber Security 101
Command Line
Windows PowerShell

Task 3
How would you retrieve a list of commands that start with the verb Remove? [for the sake of this question, avoid the use of quotes (" or ') in your answer]

Can anyone explain to me why the answer is not Get-Command -verb Remove ?

Maybe i don’t t understand the Question because English is not my native language but this doesn’t make sense to me. I got the answer by searching here in the discord.
Because when i run Get-Command -verb Remove in the attack box i get a list but running Get-Command -N**e Remove i get what you see in the screenshot 🙂

[lavish trellis]

I found this explanation interesting:
#subs-room-help message
adding a screenshot of that message as not all users would have access to that sub-only channel:

[placid gull]

I think that the Question should be asked in a different way if you look at https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-command?view=powershell-7.4 and scroll down to compare -Name and -Verb

How would you retrieve a list of commands that start ONLY with the specified name Remove?

this would clarify the difference I guess

[brazen blade]

well the issue here is

that you see "the verb Remove" as "-verb" which it isn't

it literally just says the verb remove

no syntax of -verb is mentioned

[placid gull]

And that’s confusing for someone who has English not as his native language. Especially as a beginner

[twilit lodge]

@fallow cradle why my instance was terminated?

this is the first time it happend with me

[stark jay]

Windows PowerShell task 3

I cant connect with Remmina.

It starts to connect and then goes into credentials again.

Did someone have the same issue?

[lavish trellis]

you have selected ssh in the top left box? by default, remmina starts with RDP selected
check screenshot, using THM AttackBox

[young heath]

I find this so weird. Why were people told to ssh using remmina?

you can simply use ssh user@ip and log in

remmina is good for rdp and that's it

[lavish trellis]

what about VNC?

[warm spoke]

This is because some of the characters when using PowerShell are not easily readable due to the font configuration and colors

So it was to make it easier, especially to those who may have a visual disability and make it more accessible

[young heath]

I personally had no issues with doing ssh directly. Idk what you mean

[clever salmon]

For me, whenever I type in -example, it blanks out. That's during when I used SSH

[young heath]

interesting, was this on your own machine or the attackbox?

[clever salmon]

Attackbox

Terminal was fine. Just the remote instance

[young heath]

oh okay, I did it from my own machine maybe that's why I didn't face any issues

[warm spoke]

So we always tackle it from the perspective of the AttackBox, this is because that’s the only machine we can control

This is also because not everyone can afford a setup to have VMs

[young heath]

oh I see what you mean. it makes sense now 🙂

[warm spoke]

The only exception to this are community challenges

[junior parcel]

Has anyone had any issues with the win fundamentals part I? I have the answer correct for what is the account description but the system keeps telling me I am wrong. I X referenced a few walkthroughs after going crazy and they have the same answer I got. it's a bit frustrating because I completed the rest of the room.

[lavish trellis]

avoid copy/pasting, type the answer manually

[junior parcel]

I did that

[quaint plover]

Can you type in half answer here

the one which you got

[junior parcel]

account is

[quaint plover]

Nope wrong

[junior parcel]

interesting

[quaint plover]

You can search in web like
"How to check account description in windows"

[quaint plover]

Just to be clear task 6 right?

[junior parcel]

yes last question

[lavish trellis]

have you looked at the GIF of task 6, copied here

[junior parcel]

I tried that too

opened the users, checked guest and answer is wrong as per THM

[lavish trellis]

the account description relates to the user you found at question 1 of that task
which user did you find there?
please give your answer between double pipes, || like this ||, so as not to reveal answers

[junior parcel]

||tryhackmebilly||

[lavish trellis]

so that is correct
when you did lsurmgr.msc, you came to this screen, right?

[junior parcel]

Got it I was concentrating on the guest account not the user previously mentioned. TY @lavish trellis

[olive fog]

Gave +1 Rep to @lavish trellis (current: #30 - 292)

[molten hare]

@warm spoke Hi there! - not sure where this should go but wanted to provide positive content feedback on the new SQLMAP: The Basics room:

[warm spoke]

I’ll pass it along, thanks!

[olive fog]

Gave +1 Rep to @molten hare (current: #319 - 17)

[lilac merlin]

Hoping someone can help. When doing the 'Hashing Basics' module. On task 6 when running hashcat I have got the "not enough allocated disk space" error on 3 different devices. any suggestions?

[brazen blade]

I would suggest ssh'ing into the machine from a kalivm

nvm

I would suggest doing it on your own machine, just copy the hashes

[lilac merlin]

thank you so much!

[brazen blade]

no worries, if you need further help let me know

[left lion]

Pretty sure the answer to this question could easily be interpreted as Layer 5, but tryhackme is recognizing the right answer as layer 4. Even asked chat gpt to see if im crazy and it originally said layer 5 as well. I def understand why layer 4 is considered correct, but the wording could be a bit better - "Which layer is responsible for connecting one application to another" This was from Task 2 in networking concepts room

[brazen blade]

Layer 4 is UDP/TCP hence Layer4 is correct

[left lion]

yea after some more research I understand it now, but the task literally says "The session layer is responsible for establishing, maintaining, and synchronising communication between applications". Whereas, for layer 4 it describes it as "enabling" communication

when you think "establishing" communication between applications in that wording it seems like what the question is refering to

or idk ik some other people were confused by it as well, but yea a deeper understanding clears it up either way. A newbie reading that task and then trying to answer the question based on what the task taught can easily get tripped up is all

[brazen blade]

it is worded suboptimal

but cybersec is rarely spoonfeeding

[fervent cedar]

Heya! Thanks for the content!

Found some broken URLs in the various rooms:

• https://tryhackme.com/r/room/offensivesecurityintro [Task 3] -> https://tryhackme.com/jr/defensivesecuritysa
• https://tryhackme.com/r/room/defensivesecurityintro (task 1) -> https://tryhackme.com/r/room/introtooffensivesecurity

Also I think there may have been some intended rowspan tags that got lost in https://tryhackme.com/r/room/networkingconcepts (Task 3)

[stark jay]

I did change to ssh.

I will try it again later. Maybe it was temporary isssue

[hasty scroll]

Networking Secure Protocols is the room . I tried unsigned and unauthorized and I don't see the answer in the task and can't find it when I Google it. Task 2

[molten hare]

typo?

[hasty scroll]

No, I figured it out.

The answer is below the pic.

in the task, that is

[echo finch]

I have a question in the room Web Application Basics I try to change the country off Bob but I'dont find the solution I try whit
https://tryhackme.com/api/user/Bob/Country/Germany

[woeful jungle]

Can you provide a screenshot ?

[molten hare]

you must use parameter fields in the Gear menu (upper right)

[echo finch]

Sorry but I can´t send screenshot buy I send my request

POST api/user/2 HTTP/1.1

Host: tryhackme.com

User-Agent: Mozilla/5.0 Firefox/87.0

Content-Length: 9

Country=US

[woeful jungle]

lowercase c

country=US

[echo finch]

You have saved my life, just because of the tiny

[woeful jungle]

You're doing good, keep going 😉

[modern hound]

I really need to start remembering to redo the rooms I've already done when a new path is created... I always miss out on the good stuff by not doing those. 😅

[hasty ice]

Hi, Is it always so slow with SQLMap? I'm doing DB listing and it's going letter by letter... Letter every... 15 seconds? 🤣 retrieved: p... pe... per.... (After 3 minutes) perforamnce_schema

retrievied: p... ph... php...
🤣

[woeful jungle]

it shouldn't be unless you're using Timed attack

You probably haven't skipped it

[hasty ice]

Okay, will do some research and start again. 😄 Thank you!

[olive fog]

Gave +1 Rep to @woeful jungle (current: #117 - 63)

[woeful jungle]

Sometimes when sqlmap finds an attack vector , it will ask you something along the lines of " Parameter <name> is vulnerable . Would you like to skip testing for other parameters " . If you just press enter , it assumes No as a default and will continue to probe the parameter for every possible attack . At one point it will do Timed attack which is slow like in your example 😂 .

[hasty ice]

Yeah I tried to set it like they told in the "Important note" but I guess I didn't. 😄 This is good news 🤣

[quaint plover]

I literally waited like 25 minutes just to find out the password was|| 12345678|| -_-

[woeful jungle]

😂

[hasty ice]

I was searching how to speed this up for 25 minutes, restarting again and again with different flags... 😛 Now it's going! 🏇

[raw crest]

can someone help with linux fundamental lab3 task 6 : crontab solution , where cronetab show 0 5 * * 1 tar -zcf /var/backup/home.tgz/home which means every monday 5 it automatically backup .

[tawdry gull]

nice I completed all the rooms I can do for free and only got day freezes and or smth

[lavish trellis]

I cannot find that command tar -zcf /var/backup/home.tgz/home in Linux Fundamentals 3/Task 6
Could you please provide a screenshot?
For that, you have to verify with Discord using the link below
Sorry: found it
In the screenshot, consider that lines starting with the # character are comments, i. e. they are not operational
In other words, you should concentrate on the line(s) not starting with the # character
As to the syntax of the cron command, I can never remember how that works, hence I go to Crontab Guru: https://crontab.guru/#0_5_*_*_1

[magic rapids]

@raw crest

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Oct 25, 2024, 1:18 PM

[raw crest]

i got did it..!! thanks bud

[grand current]

hello everyone, anyone know why i can't upload file over here?

[magic rapids]

@grand current

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Oct 25, 2024, 1:46 PM

[lavish trellis]

use the link above this message to verify with Discord, after that you can upload files

[grand current]

Ok, thank you so much

[glacial dock]

So I'd like to use my Kali VM with the tryhackme labs, is this possible? The reason being is because my attackbox is pretty slow

[civic tartan]

Yes, have a look here:
https://tryhackme.com/r/room/openvpn

[raw crest]

can someone help me with silly question not getting done of windows fundamental part1 task-3 last question about icons in notifcation area , i tried every possible combination but none gave rigth answer ...so frustated rn ....

[lavish trellis]

it is easier if you use the Full Screen button: that way the THM cloud bubble is not in the way

[lavish trellis]

also:

• your mouse has probably got more than 1 button
• from whatever you see, you just need 2 words

[raw crest]

can u just tell me what it is ..done that too..seem no difference ig

[lavish trellis]

check screenshot: I prefer not to go beyond that

[raw crest]

thanks...just frustated mind cannot do simple thing

[sharp ferry]

Hey. Can someone give me a hint on Task5 on Tcpdump: The Basics please? I think I am doing something wrong.

[torpid yoke]

sure which part

[sharp ferry]

Am i suppossed to look at the pics for the answer? The pcap mentioned is not on the VM. The question is What is the MAC address of the host that sent an ARP request? I have tried both Mac addresses in the pics and they do not work.

[timber oyster]

why tf did it take you 25 mins

it took me like 4

[lavish trellis]

the answer is indeed in the PCAP file on the target VM as /home/user/traffic.pcap

[sharp ferry]

Thank you @lavish trellis I was being dumb, got it now. 🙂

[olive fog]

Gave +1 Rep to @lavish trellis (current: #29 - 293)

[hasty scroll]

Networking Secure Protocols Task 8. I am not finding the flag and I have started over twice

[brazen blade]

look 2 lines above what you marked

small hint: flags usually start with THM

[hasty scroll]

Ahhhh....I need to click on that information to display it, thank you

I am still learning Wireshark

[brazen blade]

No worries, its a complex and overwhelming tool

[hasty scroll]

how do I clear this off my screen? It was visiting a website on a task and I don't know how to get it off my screen

[hasty scroll]

but one I plan on learning, lol

[pliant grail]

click the little minimize at the bottom left

next to Networking Secure Protocols

[hasty scroll]

that only minimizes it though, it doesn't get rid of it. If I open another machine, it will show up again

[brazen blade]

Everyone starts small 🙂

[pliant grail]

You should see a terminate button on your screen somewhere if thats the case

[hasty scroll]

Definitely lots of baby steps, LOL

[pliant grail]

check right at the top

[brazen blade]

it shouldn't actually

[brazen blade]

its no machine

[pliant grail]

Yeah my thoughts exactly - minimize should just close it

[hasty scroll]

But it showed up on the machine when I opened the machine. But I am done with this room so maybe it won't show up again

[brazen blade]

shjould be roomspecific as well

and you can just swap to the machine at the bottom as well

[pliant grail]

Yup! Good luck c:

[hasty scroll]

it went away

But oh goodie, now it's the WireShark room, LOL

[pliant grail]

Fun!

[hasty scroll]

I am enjoying learning this stuff

[pliant grail]

It is quite fun, I find it addictive as well lol

But! Its bed time for me, goodluck and enjoy the rooms!!

[hasty scroll]

WireShark: The Basics task 4, can't find the artists name

Not quite sure what I am missing on this question ieither

[rose salmon]

I think the answer is in the screenshot

[brazen blade]

remember when I said

look above the line you marked

Ima say that again

[hasty scroll]

it actually sends you to a different packet

[hasty scroll]

You referring to the first or second question

[brazen blade]

regarding "not quire sure what i am missing on this question either"

regarding your first, you probably need to drag the bottom left window a bit to the right to see all contents

[hasty scroll]

it actually sends you to a different packet. I am looking for the MD5 hash now but am not seeing it

[brazen blade]

did you export the package bytes?

[hasty scroll]

I did and they are encrypted

I am gonna eat dinner and come back

[brazen blade]

that was wireshark basics right? So I can spin that room up

[hasty scroll]

yes, it's the basics

I am starting the machine up again