#room-help

1 messages · Page 5 of 1

gleaming oxide
# 
* Host target.thm:80 was resolved.
* IPv6: (none)
* IPv4: 10.66.157.134
*   Trying 10.66.157.134:80...
* Established connection to target.thm (10.66.157.134 port 80) from 192.168.<REDACTED> port 40596 
* using HTTP/1.x
> GET / HTTP/1.1
> Host: target.thm
> User-Agent: curl/8.19.0
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 404 Not Found
< Server: nginx/1.18.0 (Ubuntu)
< Date: Sat, 23 May 2026 14:38:12 GMT
< Content-Type: text/html
< Content-Length: 306
< Connection: keep-alive
< ETag: "69f52157-132"
< 
<!DOCTYPE html>
<html>
<head><title>404 Not Found</title></head>
<body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server. If you entered the URL manually, please check your spelling and try again.</p>
<p>Please go back to the <a href="/">homepage</a> and try again.</p>
</body>
</html>
* Connection #0 to host target.thm:80 left intact
primal pollen
#

the nginx is alive.. so the / home page dont exist probably.. do u try enumeration for check ? its like the host is on another path .. like /login , /index.php etc...

#

i havent done this room yet

#

try gobuster or ffuf

empty mesa
#

Hello, i'm new here and just started my cybersecurity journey though i have a basic knowledge but i still consider myself a notice. I hope i am welcomed here. Thank you!

gleaming oxide
primal pollen
#

Letme try

weak monolith
#

hello everyone, im currently in the Cyber Security 101 course and im learning windows powershell basics, im unable to get the IP address of the target machine, please help

gleaming oxide
gleaming oxide
primal pollen
gleaming oxide
karmic spoke
#

@smoky grail I'm struggling with the reverse shell, How did you get it ?

#

I got the Shell too but whoami /priv is not working

#

Maybe I'll try it again in Attackbox since Kali is not working

#

I got rid of it too but still stuck 😭

#

@smoky grail Wait actually is it possible to get the results of whoami /priv with just using the ASPX Web Shell or is Reverse Shell mandatory ?

primal pollen
primal pollen
gleaming oxide
#

ah, might be that I'm not using the IP explicitly 😵

primal pollen
#

yah i have the same problem when he try resolv, so i try with directly ip

gleaming oxide
#

That was it - TYVM @primal pollen for the help 🙇‍♂️

hollow bloom
#

hello i need hit to solve Support room i got the password of login page user: specialadmin@support.thm password:snoopy

karmic spoke
#

@smoky grail I did it finally, I just completed the room (Really got exhausted today) 😭

gleaming oxide
random fossil
hollow bloom
primal pollen
#

nice ^^ its cz the server is using a vhost and configuration header is waiting to request header with IP
when u send
curl -v target.thm
the server get
Host: target.thm:80

but he waiting for a Host: 10.67.164.250:80
nginx can behave differently depending on the Host header.

using IP hits the default nginx site/app, so using target.thm hits another vhost

#

sorry my english

primal pollen
hybrid mist
#

sure is

slim bison
clear siren
#

Okey I get you

#

@orchid rover oh okey I get you

random fossil
leaden cave
#

Room: AD: Authenticated Enumeration

I accessed bloodhound website, uploaded the zip file and now I get "Unable to connect" error when I try to access the website again.

shadow heron
#

whatsup guys

#

i m new in cybersecurity

#

and i need a friend that help me to understand it.

weak monolith
karmic spoke
shadow heron
shadow heron
shadow heron
gleaming oxide
chrome herald
#

News Room – JUMP

Hi, I’m working on a machine exposing only FTP (vsFTPd 3.0.5) and SSH. Anonymous login is enabled and there is a world-writable incoming/ directory (777) with a README saying: “Files are processed automatically on arrival”. There are also uploads/ and archive/ directories.

We tested:

  • uploads with multiple formats (.txt, .csv, .py, .php),
  • traversal attempts (../../../),
  • sensitive file discovery,
  • Telnet/STAT/FEAT/SITE enumeration,
  • Nmap/NSE scans,
  • SSH access attempts,
  • monitoring directories before/after uploads.

However, no observable behavior occurs:

  • files are never moved,
  • no logs/output,
  • no visible execution,
  • no additional services detected.

The FTP is chrooted and looks fairly hardened. It feels like there is some hidden sync/pipeline logic, but we cannot trigger or observe anything meaningful. If anyone sees a logical angle we may be missing, I’d appreciate the help.

soft raft
gleaming oxide
hybrid mist
frosty jacinth
#

Hi, did anyone here finish the room “Support”
It’s in Jr pentester > web application vulnerabilities II

chrome herald
#

thank you

half drum
#

I’m on Guided Pentest: Infrastructure : Task 4 trying to get a reverse shell. I was able to use metasploit to connect but am not geeting the reverse shell at all

msf exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
[] Started reverse TCP handler on 0.0.0.0:4444
[] 10.49.129.58:6667 - Running automatic check ("set AutoCheck false" to disable)
[] 10.49.129.58:6667 - Connected to 10.49.129.58:6667
[] 10.49.129.58:6667 - Trying to register a new IRC user: katrice
[+] 10.49.129.58:6667 - The target appears to be vulnerable. UnrealIRCd detected after registration
[] 10.49.129.58:6667 - Connected to 10.49.129.58:6667
[] 10.49.129.58:6667 - Sending IRC backdoor command
[*] Exploit completed, but no session was created.

I have trie to set LHOST to TUN0 as well as 0.0.0.0 could it be that vpn issue or am missing something?

Problem solved

so basically reverse shell connection was actively dropped by firewall via an ICMP “administratively filtered” rule. i used wireshark and found that ICMP Destination unreachable (Communication administratively filtered). and the solution was to assign ttun0 to the trusted with firewall-cmd --zone=trusted --change-interface=tun0 gosh that took me a whole day lol 💔

half mountain
#

is there anyone on here that can help me with the caido: the basics room

timid harness
#

Is there anyone that has completed the new room Silent Monitor?

hybrid mist
karmic spoke
drowsy quail
#

@half drum use the metasplot in Attackbox (it has msf6), our's one is msf and it doesn't have interact module as payload

rigid vapor
#

who can help me?i meet some trouble about tryhackme.why i cant download the .ovpn file ,and always show VPN ssm file not found

stark oriole
robust mural
#

Metasploit: Payload Generation there is no SMB port

#

after restart it worked

junior whale
#

hello people out there!! i'm new to this Discord channel!! i was facing problem in doing the TryHackMe cybersecurity tasks especially task 5 reset password and fuzzing! can someone help me with that one pls!!

robust mural
#

On the actual target, your payload will be executed automatically after you upload it to the SMB share. ?? when?

rigid vapor
#

yes

#

indeed

robust mural
#

omg this RAG LLM sucks

#

knows anybody how to execute the shell.exe in this metasploit capstone

rigid vapor
#

is there evryone is hacker?

drowsy sun
#

Hey everyone i am Scott.I’m so thrilled to join this server and I would love to do great things

drowsy quail
#

Anyhelp to escalate from svcadmin to system in Windows Jump room

primal pollen
worthy goblet
#

hello

#

i want room help

#

im in my pre security learning path in "extending your network" room in the "firewall task", The question asks "what layers of of the OSI model do firewalls operate at?" it is supposed to be answered in the number form and 3 dashes are given "_ _ _" . Now i asked for hint, searched the entire internet, even saw the video of this room and the correct answer is layer 3 and 4 but it is not accepting also it asks for 3 layers even though the hint itself only gives 2 layers(3 and 4)

woven oar
#

Hello Everyone

azure iron
#

hey yall so i was doing the greenholt phishing room on thm and looked up the owner for 192.119.71.157 , and found it to be HostPapa , but when i submitted the answer it was wrong so i found an old video online solving the room and the ip had an older name for the owner , so it got updated , am i wrong or did they just not update the room?

lime musk
#

Hey! I'm from milky way.

feral knot
#

No way im from solar system

cold flower
rotund hollyBOT
#

Gave +1 Rep to @azure iron (current: #3779 - 1)

azure iron
knotty parrot
#

Hello everyone!👋

crude marlin
#

Dark web ka koi grup hekya

gleaming oxide
gleaming oxide
austere pond
#

hey, anyone here know how to remove full remote access hacks SOS

exotic peak
#

Hey all,
I'm trying to figure out the third flag in room "Jump".
I am aware of this ||healthcheck.timer|| and ||healthcheck.service|| , but the timer seems broken or not being triggered by the ||monitor_user||.
Anyway, I changed the contents of the ||/opt/dev/bin/ps|| to get a ||shell|| but again nothing happened because of the above.
Any help or confirmation is appreciated. Mostly, trying to see if I'm on the right path or if others having the same issue with this room.
Thanks!

half drum
half drum
soft raft
exotic peak
# soft raft You are on the right path and I struggled a lot with this myself. Did you modify...

Thanks for the reply!
Yeah, I think I did (I made a lot of changes, I'm pretty sure I did ||755|| on that file and all the parent dirs). Although, what I saw in the ||systemctl status|| were ||Active: active (elapsed)|| and ||Trigger: n/a|| and couldn't verify the ||healthcheck|| is running with ||ps or pspy64||.
But, I'm gonna redeploy and test again to make sure. Probably I'm missing something obvious.

rotund hollyBOT
#

Gave +1 Rep to @soft raft (current: #3779 - 1)

soft raft
deft carbon
#

hey guys im stuck on this qn , i dont see anything on packet 39765..and how do i get file name and use the md5sum to get the hash? nevermind i found the answer

Screenshot_2026-05-24_194007.png
fluid quiver
#

Has anyone done the Forward room yet?

deft carbon
hybrid mist
# exotic peak Hey all, I'm trying to figure out the third flag in room "[Jump](https://tryhack...

was working on this yesterday. got stuck on 3rd flag as well lol. i also noticed a certain custom log file in the main directory where logs are usually stored. reading said log file also makes me believe the path forward is PATH highjacking, but couldnt get anything to be triggered by the monitor_user.

Ran pspy for a while and never saw anything being triggered by monitor_user either that would help me see how to trigger something

real crystal
#

Hey everyone!
I'm working on the Time-Based Blind SQLi section of sqli room (task-9 challenge, level 4) and ran into something weird.
When I use a basic SLEEP payload it works fine and delays by 2 seconds:

?referrer=tryhackme.com' UNION SELECT SLEEP(2),1 ;--

But as soon as I add FROM information_schema.columns, it just loads forever (even without the where clause):

?referrer=tryhackme.com' UNION SELECT SLEEP(2),2 FROM information_schema.columns WHERE table_schema LIKE database() ;--

Could someone explain this to me? thanks

exotic peak
primal pollen
plucky stirrup
#

I am looking for the password, typical flag style in these packets within wireshark. I have followed the directions as they are stated and am not finding the password. What am I doing Wrong? Last question in the networking secure protocol room.

Screenshot_2026-05-24_125250.png Screenshot_2026-05-24_125257.png Screenshot_2026-05-24_191621.png
fallow turret
#

heyy, i just got a question about dead drop room, is the web server dropping after a revshell or no ?
cuz it's the case for me, and i cant make any progress