#offensive-pentesting-path | TryHackMe | Page 6

final vault Mar 15, 2020, 6:07 PM

#

He's the most British Brit in here

fleet wedge Mar 15, 2020, 6:07 PM

#

He really is

alpine peak Mar 15, 2020, 6:07 PM

#

I like the british accent

spark iron Mar 15, 2020, 6:08 PM

#

He's the most British Brit in here
@final vault I do drink an unhealthy amount of tea

#

aii thanks
@lilac frost No worries - I am hoping to have a lot of the rooms covered by videos soon.

final vault Mar 15, 2020, 6:10 PM

#

^

fleet wedge Mar 15, 2020, 6:10 PM

#

Sounds interesting

alpine peak Mar 15, 2020, 6:10 PM

#

Ashu wasn't really british I don't think

spark iron Mar 15, 2020, 6:11 PM

#

Yeah, he is from Kenya:)

#

So you remembered correctly.

#

brb got dinner:)

alpine peak Mar 15, 2020, 6:12 PM

#

That's interesting GWseremePeepoThink

spark iron Mar 15, 2020, 6:12 PM

#

Uh-oh, i've given key OSINT info about him now

#

@hasty sentinel delete your digital footprint quick my dude

alpine peak Mar 15, 2020, 6:12 PM

#

He is a public figure now

fleet wedge Mar 15, 2020, 6:12 PM

#

Do you intend to have it similar to the writeup system @spark iron

#

People can submit videos to room owners and they can approve or decline

spark iron Mar 15, 2020, 6:13 PM

#

brb^will answer in a sec

alpine peak Mar 15, 2020, 6:13 PM

#

He has tea to drink

fleet wedge Mar 15, 2020, 6:13 PM

#

He better have atleast 2 sugar cubes

topaz yoke Mar 15, 2020, 6:36 PM

#

lmao @spark iron

#

@alpine peak ah shucks, thanks xD

fathom rapids Mar 15, 2020, 7:15 PM

#

anyone can give me an hint on escalate skynet?

#

stuck from 3 days

alpine peak Mar 15, 2020, 7:21 PM

#

@fathom rapids DM

thorn patio Mar 16, 2020, 1:17 AM

#

anbody give me a hint on Steel mountain to escalate

thorn patio Mar 16, 2020, 1:54 AM

#

i can onyl getting a shell for some time , can get a shell every time in Steel mountain

#

getting shell may be LUCK for me

#

LOL

glass saddle Mar 16, 2020, 5:20 AM

#

anyone else having problems with kerberoasting in the powershell room/

fierce birch Mar 16, 2020, 3:15 PM

#

@thorn patio https://cwe.mitre.org/data/definitions/428.html

CWE - CWE-428: Unquoted Search Path or Element (4.0) ...

Common Weakness Enumeration (CWE) is a list of software weaknesses.

#

This actually helped me gain understanding on how the escalation works on Steel Mountain.

thorn patio Mar 16, 2020, 7:28 PM

#

okay thanks @fierce birch

#

.

honest jackal Mar 16, 2020, 7:45 PM

#

hello all i am looking for a walkthrough box for active directory i was told there was one but had to be retired for some issues....is it live again ?

desert bloom Mar 17, 2020, 1:13 AM

#

Alfred moves like an old man 😬

chrome valve Mar 17, 2020, 1:15 AM

#

Are you subscribed?

desert bloom Mar 17, 2020, 1:19 AM

#

I am 🙂 Just took a while for pages to load and for the Jenkins build to run long enough to get what I needed.

chrome valve Mar 17, 2020, 1:20 AM

#

Huh. Interesting. You should have more resources if you're subscribed

desert bloom Mar 17, 2020, 1:24 AM

#

It's performing better now

desert bloom Mar 17, 2020, 1:55 AM

#

Alfred done...I might actually be learning something 😆

#

Seriously, though, good lab and it pays to take notes on all the rooms right before it b/c you definitely build on stuff covered in those.

flint tiger Mar 17, 2020, 3:41 AM

#

@thorn patio hey did you figure out the hackpark task 4 question 4?

thorn patio Mar 17, 2020, 3:54 AM

#

nope

#

that is the only i was pending from till date @rotund carbon , i have compelted all in that BOX : Hackpark

flint tiger Mar 17, 2020, 3:57 AM

#

ya same here, i have looked through the logs using event_manager.rb but really not sure what i am looking for

dawn narwhal Mar 17, 2020, 10:51 AM

#

just ordered my oscp yesterday.. ain't nothing better to do than this during the quarantine lol

terse herald Mar 17, 2020, 10:56 AM

#

Good luck with it! @dawn narwhal May as well make something productive out of it all 🙂

final vault Mar 17, 2020, 11:07 AM

#

When do you officially start pwk? I imagine three weeks right

#

Anyway good luck!

thorn patio Mar 17, 2020, 11:25 AM

#

Good luck @dawn narwhal

#

meetoo @flint tiger

honest jackal Mar 17, 2020, 11:29 AM

#

hello all i am looking for a walkthrough box for active directory i was told there was one but had to be retired for some issues....is it live again ?
@honest jackal @everyone ?

dawn narwhal Mar 17, 2020, 3:34 PM

#

Thanks guys! I start on sunday night

#

was surprised by how quick but not gonna complain

smoky thorn Mar 17, 2020, 4:00 PM

#

@keen iris do you have an answer for @honest jackal

keen iris Mar 17, 2020, 4:02 PM

#

Uh, attacktive directory is still gone

topaz yoke Mar 17, 2020, 4:29 PM

#

@crimson flame

crimson flame Mar 17, 2020, 4:38 PM

#

leaving for Georgia soon.

#

desktop is coming with

#

it'll be worked on as soon as I have a bit

final vault Mar 17, 2020, 4:41 PM

#

@crimson flame Less anime VR and more box dev?

crimson flame Mar 17, 2020, 4:41 PM

#

possibly

terse herald Mar 17, 2020, 4:41 PM

#

no promises

small falcon Mar 18, 2020, 8:40 AM

#

hi.. wanted to sign up the oscp path... do they provide some kind of tutorial or was it just 'boxes' for you 'hack'?

bronze zenith Mar 18, 2020, 8:49 AM

#

at the beginning there are boxes with guided walkthrough on how to hack them, additionally every box has a write-up which can help you

#

if you are an absolute beginner, first do "Learn Linux" and "RP: Nmap" rooms and you'll be ready to go!

small falcon Mar 18, 2020, 8:52 AM

#

thanks swafox..appreciate your advice

bronze zenith Mar 18, 2020, 9:07 AM

#

u'r welcome!

twilit warren Mar 18, 2020, 12:25 PM

#

@fleet wedge hey

fleet wedge Mar 18, 2020, 12:31 PM

#

@dawn narwhal exactly what I’m doing 😃 perfect excuse to stay at home and study

twilit warren Mar 18, 2020, 12:33 PM

#

@fleet wedge did you get the task 4 question 4 on hackpark btw?

fleet wedge Mar 18, 2020, 12:33 PM

#

Check my PM

twilit warren Mar 18, 2020, 12:34 PM

#

i will have to message you again because this account is not registeree iwith an email

#

registered*

#

so it doesnt save message conversations

fleet wedge Mar 18, 2020, 12:34 PM

#

tryhackme was down yesterday , so ... no , not yet

twilit warren Mar 18, 2020, 12:34 PM

#

oh ok

fleet wedge Mar 18, 2020, 12:35 PM

#

Was working on legacy, a hack the box machine . I will shift gears towards tryhackme later today

#

I also got my new OSCP material so I’ve started reading it before my lab starts

twilit warren Mar 18, 2020, 12:36 PM

#

got ya

#

thats cool, i just started going over the material

fleet wedge Mar 18, 2020, 12:38 PM

#

OSCP material ?

twilit warren Mar 18, 2020, 12:50 PM

#

Ya, Im trying to get into pen testing .. I have a Cell and Molecular Biology degree/background; so I decided to sign up for the course, I already read over 1200 pages on the subject and bought a few more books and some udemy courses.

fleet wedge Mar 18, 2020, 12:59 PM

#

Cool. Welcome aboard. When does your PWK start ?

#

Did you order the new OffSec material or old one ?

twilit warren Mar 18, 2020, 1:04 PM

#

the new i started last saturday

#

and thanks!

fleet wedge Mar 18, 2020, 2:21 PM

#

Best wishes, mine will start this Friday

#

I wish I've seen tryhackme before, this platform has been instrumental to me in catching new concepts

twilit warren Mar 18, 2020, 2:53 PM

#

yes it has been helpful; I will continue to work on these after I do my labs.

tough veldt Mar 18, 2020, 3:19 PM

#

Hi, is anyone can help me run hashcat? my machine too old cannot execute hashcat

#

i got the hash file

fleet wedge Mar 18, 2020, 3:20 PM

#

What do you mean @tough veldt

#

It's too old?

topaz ledge Mar 18, 2020, 3:21 PM

#

i think he means old and slow

tough veldt Mar 18, 2020, 3:21 PM

#

📎 unknown.png

topaz ledge Mar 18, 2020, 3:21 PM

#

oh.

tough veldt Mar 18, 2020, 3:21 PM

#

old machine

fleet wedge Mar 18, 2020, 3:21 PM

#

You can try john

tough veldt Mar 18, 2020, 3:22 PM

#

my machine old and slow

#

if somebody have faster speed maybe can help me crack

#

using rockyou.txt

fleet wedge Mar 18, 2020, 3:23 PM

#

We can't give you answers

tough veldt Mar 18, 2020, 3:23 PM

#

ok

fleet wedge Mar 18, 2020, 3:24 PM

#

There are alternative tools though

#

Such as john

#

That you may be able to use instead of hashcat

topaz ledge Mar 18, 2020, 3:25 PM

#

I think that was the first tool I ever used way before I got really interested in pentesting

fleet wedge Mar 18, 2020, 3:25 PM

#

John?

topaz ledge Mar 18, 2020, 3:25 PM

#

yeah

fleet wedge Mar 18, 2020, 3:25 PM

#

Neat

#

I have a fondness for it

#

I like it better than hashcat

topaz ledge Mar 18, 2020, 3:25 PM

#

cracked my friend's windows password from a liveboot usb after he locked himself out of it

#

It was more for funsies than for any actual practical purposes

terse herald Mar 18, 2020, 5:07 PM

#

lmao gosh that gives me a flash back to when I worked before Uni. A former IT Contractor for a place who were utter shite refused to change the whole domain credentials and everything once we took over - so we had to hiren's like 40 windows machines & servers

barren jolt Mar 18, 2020, 8:38 PM

#

cracked my friend's windows password from a liveboot usb after he locked himself out of it
@topaz ledge

Hirens Boot CD has tools for that

topaz ledge Mar 18, 2020, 8:38 PM

#

Did that exist in 2007?

fleet wedge Mar 18, 2020, 8:51 PM

#

Probably actually

#

Hirens bootcd has been around for as l can remember

eager wind Mar 18, 2020, 8:53 PM

#

if not there were other tools

#

i remember using trinity rescue kit back in those days

hoary hazel Mar 18, 2020, 9:18 PM

#

anyone working on the hackpark room?

topaz ledge Mar 18, 2020, 9:19 PM

#

yes, i hear it mentioned a lot

hoary hazel Mar 18, 2020, 9:19 PM

#

ive deployed th vm but cant ping the VM, im connected to the VPN

#

wondering if anyone else having same issues

topaz ledge Mar 18, 2020, 9:20 PM

#

you've done some other room before this, yes?

hoary hazel Mar 18, 2020, 9:20 PM

#

yes

topaz ledge Mar 18, 2020, 9:20 PM

#

just checking :p

hoary hazel Mar 18, 2020, 9:20 PM

#

lol

topaz ledge Mar 18, 2020, 9:20 PM

#

you never know, honestly. Even real clever people can have lapses of reasoning

#

heck, especially real clever people

hoary hazel Mar 18, 2020, 9:21 PM

#

i thought as its windows box maybe taking a while to boot up - but im sat here for over 10 mins now

topaz ledge Mar 18, 2020, 9:21 PM

#

maybe it just doesn't respond to ping?

#

by choice I mean

spark iron Mar 18, 2020, 9:21 PM

#

^^

hoary hazel Mar 18, 2020, 9:21 PM

#

cant even nmap

topaz ledge Mar 18, 2020, 9:22 PM

#

I haven't done that room yet :) Still got a backlog of tools to learn

hoary hazel Mar 18, 2020, 9:22 PM

#

hmm ok this is a clever box lol - i can telnet to port 80

#

so box is up

topaz ledge Mar 18, 2020, 9:23 PM

#

god, telnet. You will never become irrelevant.

hoary hazel Mar 18, 2020, 9:23 PM

#

haha

bronze zenith Mar 18, 2020, 9:28 PM

#

@hoary hazel use -Pn flag for nmap and try scanning again

#

windows machines require no ping flag in order to scan them

chrome valve Mar 18, 2020, 9:46 PM

#

Windows boxes -- by default -- do not respond to ping requests. This includes Steel Mountain, Hackpark and Alfred. To get around it, use the -Pn switch in nmap.

#

@keen iris could you please pin that?

#

I'm going to learn bot dev, just to add it to the bot

keen iris Mar 18, 2020, 9:47 PM

#

chrome valve Windows boxes -- by default -- do not respond to ping requests. This includes St...

#

I'm already adding the web server ting to it eventually

chrome valve Mar 18, 2020, 9:47 PM

#

We need that "common" issues page we asked for

#

Then we could just use the bot to link that

topaz ledge Mar 18, 2020, 9:48 PM

#

!common windows ping

#

something like that

final vault Mar 18, 2020, 9:48 PM

#

@chrome valve gotta say it's because of the vpn restricting it

chrome valve Mar 18, 2020, 9:49 PM

#

According to some people anyway @final vault... 😁

fleet wedge Mar 18, 2020, 9:49 PM

#

Many penetration testers maintain

hoary hazel Mar 18, 2020, 9:49 PM

#

thanks @bronze zenith thats what i ended up doing

chrome valve Mar 18, 2020, 9:49 PM

#

Mhm @topaz ledge. We've asked for a "Common Issues" page on the website. Hopefully we can just get a !common command into the bot that'll link to that

topaz ledge Mar 18, 2020, 9:50 PM

#

or even !faq

fleet wedge Mar 18, 2020, 9:50 PM

#

@jovial pawn

chrome valve Mar 18, 2020, 9:51 PM

#

We've already got an faq

#

Just doesn't cover this kinda stuff 😁

topaz ledge Mar 18, 2020, 9:51 PM

#

but is it a bot? :D

chrome valve Mar 18, 2020, 9:51 PM

#

We were after more of a Wiki kinda thing for CMs and Mods to add to

fleet wedge Mar 18, 2020, 9:51 PM

#

skidys actually making it

#

it'll be under docs.tryhackme.com

chrome valve Mar 18, 2020, 9:51 PM

#

Lovely

#

Thank. Goodness

fleet wedge Mar 18, 2020, 9:51 PM

#

Likely the seconds it's ready horshark will add a command

chrome valve Mar 18, 2020, 9:53 PM

#

Ugh. Node.js though

#

Please tell me there'll be an easier way to add issues xD

topaz ledge Mar 18, 2020, 9:53 PM

#

you used ~~regex~~ node.js - now you have two problems

hoary hazel Mar 18, 2020, 10:07 PM

#

@bronze zenith is it normal for hydra to return 16 pasword matches for hackpark but none of them work lol

chrome valve Mar 18, 2020, 10:08 PM

#

No. That happens when the command isn't right

#

Usually the F: bit at the end

#

That's 16 threads returning false positives

hoary hazel Mar 18, 2020, 10:13 PM

#

thnks @chrome valve will check my command and retry

chrome valve Mar 18, 2020, 10:13 PM

#

No problem!

fleet wedge Mar 18, 2020, 10:49 PM

#

Managed to get a password for hackpark via Hydra. But the obtained password does not work. Has someone seen that issue before?

#

Tried above, which I am covering to avoid spoilers, but credentials do not work.

📎 unknown.png

#

Thank you for that

#

Have you ran hydra again

#

And confirmed that's the output

#

Yes sir

#

It's possible that it's a hydra bug

#

I see

#

do you suggest updating hydra or Kali?

#

Or you mistyped your hydra command

#

can I post my hydra command here? if you don't mind?

#

or will be considered a spoiler?

#

You can dm it to me

#

ok

hoary hazel Mar 18, 2020, 11:05 PM

#

@fleet wedge im facing the same issue on the same task lol

fleet wedge Mar 18, 2020, 11:06 PM

#

Honestly hydra is weird in general as well as hackparks instability

#

If you believe that you have the right command you should reset the box

hoary hazel Mar 18, 2020, 11:07 PM

#

i did rest it and this time i got 1 valid password matched but when i try to login it fails and the answer is wrong

#

so im stumped lol

fleet wedge Mar 18, 2020, 11:07 PM

#

So you've run the same command after you reset the machine and got a different result

hoary hazel Mar 18, 2020, 11:07 PM

#

yup

fleet wedge Mar 18, 2020, 11:07 PM

#

same here

#

Sounds like hackpark lol

#

could be a cookie problem?

#

It's hard to recommend a fix as the box is just incredibly unstable

hoary hazel Mar 18, 2020, 11:08 PM

#

@fleet wedge let me DM you my command and see if it matches

fleet wedge Mar 18, 2020, 11:18 PM

#

Hey guys stuck on hackpark #3 Ran PS and cannot figure out what the answer is, any advice?

chrome valve Mar 18, 2020, 11:18 PM

#

Literally just doing that rn @fleet wedge

#

If no one else gets back to you, I'll give you a shout when I get it working

fleet wedge Mar 18, 2020, 11:19 PM

#

@chrome valve My machine keeps dying as well, least I have envything so far jotted down

#

and thank you

chrome valve Mar 18, 2020, 11:19 PM

#

Yeah, we've just been discussing that

#

It's not the most stable of boxes

fleet wedge Mar 18, 2020, 11:20 PM

#

I reckon I might monitor a fresh one, see if cpu and memory start going weird

chrome valve Mar 18, 2020, 11:20 PM

#

Nice idea

fleet wedge Mar 18, 2020, 11:21 PM

#

Always seem to happen near the 1 hour mark

#

Yep SublimeSol has same issue

#

we were discussing

hoary hazel Mar 18, 2020, 11:28 PM

#

@fleet wedge did you get Task2 hydra working? cos myself and SQLMantra are having issues 0 lol

fleet wedge Mar 18, 2020, 11:29 PM

#

is it possible to do task3 then without task2?

#

Yeah did that quite fast

#

and no

hoary hazel Mar 18, 2020, 11:29 PM

#

im sure my command is right and im getting one password match but it fails

fleet wedge Mar 18, 2020, 11:29 PM

#

@fleet wedge PM me, please

chrome valve Mar 18, 2020, 11:34 PM

#

@hoary hazel if you're still struggling with that, DM me with the command you're using

fleet wedge Mar 18, 2020, 11:36 PM

#

Just been trying to show the way to find the data

fleet wedge Mar 19, 2020, 12:20 AM

#

I am 100% sure hackpark is broken, just tried every running service in 4.4 and none of them work

#

@fleet wedgeyou are 100% correct

#

Hackpark is incredibly unstable

#

Burn it

chrome valve Mar 19, 2020, 12:21 AM

#

Hackpark is very unstable

burnt agate Mar 19, 2020, 12:21 AM

#

pls sponsor me

chrome valve Mar 19, 2020, 12:21 AM

#

Finding exactly the same thing r/ service

burnt agate Mar 19, 2020, 12:21 AM

#

i need oscp

#

my bribe wasnt enough

fleet wedge Mar 19, 2020, 12:21 AM

#

I will sponser you

#

6 fredos

burnt agate Mar 19, 2020, 12:22 AM

#

lol

#

no joke

chrome valve Mar 19, 2020, 12:22 AM

#

i need oscp
@burnt agate Don't we all

burnt agate Mar 19, 2020, 12:22 AM

#

i need a sponsor

#

i tried to bribe offsec with £500

#

apparently it wasn't enough

chrome valve Mar 19, 2020, 12:23 AM

#

...

#

You're serious, aren't you

burnt agate Mar 19, 2020, 12:23 AM

#

yes

fleet wedge Mar 19, 2020, 12:23 AM

#

Lmaoooooo

burnt agate Mar 19, 2020, 12:23 AM

#

you know the bribe email dont you?

#

im not kidding

fleet wedge Mar 19, 2020, 12:23 AM

#

Here's half of your oscp price let me take the test

burnt agate Mar 19, 2020, 12:24 AM

#

nonono

#

its a bribe

#

so i can pay them to take the course

#

you see?

fleet wedge Mar 19, 2020, 12:24 AM

#

Ah

burnt agate Mar 19, 2020, 12:24 AM

#

they just wont take me

fleet wedge Mar 19, 2020, 12:25 AM

#

With the greatest respect, that's very interesting 😀

burnt agate Mar 19, 2020, 12:25 AM

#

ill do it when im 18 if nothing works out

hasty sentinel Mar 19, 2020, 1:01 AM

#

I'll update the hackpark write up tomorrow to make it more clear :))

#

Are people having issues with the privesc?

chrome valve Mar 19, 2020, 1:02 AM

#

The box itself is really unstable @hasty sentinel

#

Just played it (mostly) through earlier

#

Didn't get any of the "services not starting" that others have been getting

#

But it does like crashing randomly

fleet wedge Mar 19, 2020, 1:07 AM

#

@hasty sentinel yeah it's not that the box is hard per se

#

It's that it often doesn't work

#

Which leads to constant repeated questions that no one can really answer besides telling them "just reset and try again"

hasty sentinel Mar 19, 2020, 1:10 AM

#

Vulnerable windows boxes don't have the best stability :((

fleet wedge Mar 19, 2020, 1:10 AM

#

I know :((

hasty sentinel Mar 19, 2020, 1:10 AM

#

Would have too look into it more

fleet wedge Mar 19, 2020, 1:10 AM

#

But this box in particular just seems extra unstable

final vault Mar 19, 2020, 1:12 AM

#

Vulnerable windows boxes don't have the best stability :((
@hasty sentinel If that's the case how come the windows on htb don't seem to be unstable?

#

Not trying to sound like a dick, more interested if there's a reason

fleet wedge Mar 19, 2020, 1:12 AM

#

It's likely htb boxes have more resources allocated

chrome valve Mar 19, 2020, 1:12 AM

#

Yeah, generally speaking Windows boxes are more stable than this

#

on THM, that is

#

Retro, for example, doesn't have the same kinda issues

fleet wedge Mar 19, 2020, 1:12 AM

#

But barring that hackpark is a rarity

#

No other box on the site seems to be as unstable

chrome valve Mar 19, 2020, 1:12 AM

#

Hackpark just seems like it wants to crash

fleet wedge Mar 19, 2020, 1:13 AM

#

So I'm not willing to fully blame Windows

#

Who created it

#

Perhaps we could ask them to check the config and fix the vm if necessary

spark iron Mar 19, 2020, 1:13 AM

#

Is it just HackPark that seems to have loads of issues (Windows wise)?

fleet wedge Mar 19, 2020, 1:14 AM

#

Other windows boxes occasionally have issues

#

But hackpark is in a league of it's own

#

hackpark seems to crash just before the hour mark

final vault Mar 19, 2020, 1:14 AM

#

hackpark is like the ill dog that should be taken out back and put down

spark iron Mar 19, 2020, 1:14 AM

#

If its just HackPark, as Ashu said, he can look into it.

chrome valve Mar 19, 2020, 1:14 AM

#

Poor dog...

#

Yeah, it's just Hackpark

fleet wedge Mar 19, 2020, 1:14 AM

#

That would be great @spark iron

#

I think it needs putting down

spark iron Mar 19, 2020, 1:14 AM

#

But if lots of other Windows machines are being crappy

fleet wedge Mar 19, 2020, 1:14 AM

#

But if possible

spark iron Mar 19, 2020, 1:14 AM

#

Needs looking into

fleet wedge Mar 19, 2020, 1:14 AM

#

Could we private hackpark until then

chrome valve Mar 19, 2020, 1:15 AM

#

Generally speaking Windows are Ok Skidy. Hackpark is just a pain though

fleet wedge Mar 19, 2020, 1:15 AM

#

We cant really do our jobs helping people with that box

chrome valve Mar 19, 2020, 1:15 AM

#

It also seems to be what we're getting 90% of the time in rooms-help. The advice is invariably "reset it -- it's broken"

fleet wedge Mar 19, 2020, 1:15 AM

#

Because 99% of the time it's just that the box doesn't work

chrome valve Mar 19, 2020, 1:15 AM

#

I had it crash irreparably three times on me doing it earlier

fleet wedge Mar 19, 2020, 1:15 AM

#

Btw are the question boxes case sensative

chrome valve Mar 19, 2020, 1:16 AM

#

So I'd agree with Pars -- can we private it for the time being?

fleet wedge Mar 19, 2020, 1:16 AM

#

There is answer tolerance @fleet wedge

#

as none of the services actually come us as correct

#

So it's loose on case sensitivity

chrome valve Mar 19, 2020, 1:16 AM

#

Ah, sorry @fleet wedge -- meant to get back to you on that one

#

Yeah, I think that's another bug tbh

fleet wedge Mar 19, 2020, 1:16 AM

#

No that's a feature

#

Answer tolerance is intended

#

Lol, I was begining to think I was going insane

alpine peak Mar 19, 2020, 1:17 AM

#

The clown was a hint

chrome valve Mar 19, 2020, 1:17 AM

#

@fleet wedge -- as in, the service doesn't seem to be showing up..

#

Like the webserver itself earlier

fleet wedge Mar 19, 2020, 1:17 AM

#

@chrome valve oh then that might be a bug

#

I can send my services if that helps

chrome valve Mar 19, 2020, 1:17 AM

#

Yeah, go for it @fleet wedge

#

I'll compare them to mine

fleet wedge Mar 19, 2020, 1:18 AM

#

I thought you were talking about the physical thm questions

chrome valve Mar 19, 2020, 1:18 AM

#

Ah, fair enough 😁

hasty sentinel Mar 19, 2020, 1:18 AM

#

Yeh not quite sure what's wrong with HackPark but will investigate

fleet wedge Mar 19, 2020, 1:20 AM

#

📎 metasploit-ps.txt

#

That was ran from a metasploit shell

chrome valve Mar 19, 2020, 1:21 AM

#

@alpine peak can you confirm if the correct one is in there?

fleet wedge Mar 19, 2020, 1:21 AM

#

They are all the running

#

I will find my enum_services

alpine peak Mar 19, 2020, 1:22 AM

#

yep, I see the vulnerable service in that .txt

fleet wedge Mar 19, 2020, 1:22 AM

#

Well I copied and pasted everysingle one after taking a guess

#

.Exe stood out

alpine peak Mar 19, 2020, 1:23 AM

#

Seems to be some misconception on what the intended privesc is

fleet wedge Mar 19, 2020, 1:23 AM

#

Wasnt I looking for *.exe

spark iron Mar 19, 2020, 1:25 AM

#

I've increased HackParks resources, it was actually had little resources

#

So I gave it double what it had

#

As @alpine peak pointed out

chrome valve Mar 19, 2020, 1:25 AM

#

I have a funny feeling that might fix the problem

#

Thanks Skidy

fleet wedge Mar 19, 2020, 1:26 AM

#

@alpine peak Have I missed the point to the question

alpine peak Mar 19, 2020, 1:26 AM

#

I'm not aware of the questions, I just make the machine

fleet wedge Mar 19, 2020, 1:27 AM

#

Shall I show you the question and hint

alpine peak Mar 19, 2020, 1:28 AM

#

Yea, send it to me, because I can't see it

fleet wedge Mar 19, 2020, 1:28 AM

#

Q:What is the name of the abnormal service running? H:Check in the "C:\Program Files (x86)" directory and go from there. Remember, you can use meterpreter to check all running processes on the machine. Answer format: *************.

#

****.

#

Its removing my stars lol

#

16 start dot 3 start

chrome valve Mar 19, 2020, 1:31 AM

#

****************.***

alpine peak Mar 19, 2020, 1:31 AM

#

I see, I can't give out the answer to that without permission from an admin

#

The .txt someone sent. the vulnerable process is there

fleet wedge Mar 19, 2020, 1:32 AM

#

I dont need an answer. I was under the impression that it was one of them .exe as the answer to the question, but none of them work in the answer box

#

🙂

alpine peak Mar 19, 2020, 1:36 AM

#

I'm unaware of all that you tried for the question, The answer to it could possibly be answered viewing the logs of the service rather than whats running at that specific second

fleet wedge Mar 19, 2020, 1:37 AM

#

okay thank you, will try later 🙂

fleet wedge Mar 19, 2020, 2:16 AM

#

The thing isnt listed, but somthing thats running it is right?

alpine peak Mar 19, 2020, 3:01 AM

#

@fleet wedge Just be aware of what is normal to run on windows server compared to what you see, 3rd party services are more likely to not be there for no reason

#

Its not a easy machine, it requires good enumeration and understanding of what is happening

fleet wedge Mar 19, 2020, 3:02 AM

#

Okay thank you, see with Linux I am in my ballpark, windows not so much. But its all important

alpine peak Mar 19, 2020, 3:02 AM

#

I completely understand, my Achilles' heel is also windows

fleet wedge Mar 19, 2020, 3:03 AM

#

I wouldnt mind if windows wasnt so terrible. Else where ive just about to start learning about Active Directory

alpine peak Mar 19, 2020, 3:04 AM

#

What works for me is to get familiar with setting up a domain network in your own lab, and try hacking it yourself

fleet wedge Mar 19, 2020, 3:05 AM

#

Thats exactly what I have done gns3, windows server 2019 and enterprise windows 10

alpine peak Mar 19, 2020, 3:05 AM

#

GNS3 is perfect for that

fleet wedge Mar 19, 2020, 3:06 AM

#

I have my own VM server but I couldnt help getting a subscribtion to this site, I love how its layed out, very good ui and boxes

#

It must cost alot to run tho

#

Have you tried gensec?

alpine peak Mar 19, 2020, 3:07 AM

#

Yea, computing power will always cost money, That's why lab options are nice like THM, HTB, VHL, PWK etc

#

grsec?

fleet wedge Mar 19, 2020, 3:08 AM

#

gensec, it randomly builds ctf boxes

alpine peak Mar 19, 2020, 3:08 AM

#

goes against my rules

fleet wedge Mar 19, 2020, 3:08 AM

#

SecGen even

#

What do you mean?

alpine peak Mar 19, 2020, 3:09 AM

#

idk lol, I just like setting stuff up on my own because I learn more about the service like that

fleet wedge Mar 19, 2020, 3:10 AM

#

Fair enough, I think its more for when you want to suprise yourself. I use them with my flat mate when I do CTF nights

alpine peak Mar 19, 2020, 3:10 AM

#

Yea, that's why i'm considering trying out VHL

fleet wedge Mar 19, 2020, 3:10 AM

#

VHL? Virtual Hack Lab?

alpine peak Mar 19, 2020, 3:10 AM

#

yea

#

Its cheap for a month, so why not

fleet wedge Mar 19, 2020, 3:11 AM

#

93 euro?

alpine peak Mar 19, 2020, 3:11 AM

#

99 USD

#

I only need a month

#

coronavirus prevents me from doing anything else

fleet wedge Mar 19, 2020, 3:11 AM

#

See im poor as hell, below th euk poverty line

#

Im in isolation atm

alpine peak Mar 19, 2020, 3:12 AM

#

We all are pretty much

#

perfect time to spend time on a lab

fleet wedge Mar 19, 2020, 3:12 AM

#

Where you based?

alpine peak Mar 19, 2020, 3:12 AM

#

USA

fleet wedge Mar 19, 2020, 3:12 AM

#

Its scary how its gone from nothing to everywhere locking down

alpine peak Mar 19, 2020, 3:13 AM

#

Once the media gets bored, it will all be over

fleet wedge Mar 19, 2020, 3:13 AM

#

Just waiting for the Zombies now lol

#

For the UK its less then that, our health care is crippled, the extra strain will indirectly kill loads more

alpine peak Mar 19, 2020, 3:14 AM

#

Its actually better in theory to get the virus early so your body can build immunity, this is the same logic that vaccines follow

fleet wedge Mar 19, 2020, 3:14 AM

#

Yeah definatly, tbh I bet you guys have gotten loads of signups from countries in lockdowns

alpine peak Mar 19, 2020, 3:15 AM

#

I don't watch the news anymore so I have no idea

fleet wedge Mar 19, 2020, 3:16 AM

#

I like to read it tbh, I dont belive it all but sometimes there is interesting stuff. Can I make a request for a box btw. Something space themed would be amazing

alpine peak Mar 19, 2020, 3:17 AM

#

I did that, its called spacejam

#

its about the great michael jordan and bugs bunny

fleet wedge Mar 19, 2020, 3:25 AM

#

I rember that film

#

That was awesome tbh

#

Im guessing you guys spin up on the cloud

alpine peak Mar 19, 2020, 3:26 AM

#

If the box theme is ridiculous, than I probably made it haha

fleet wedge Mar 19, 2020, 3:26 AM

#

The Mr robot one look good

alpine peak Mar 19, 2020, 3:26 AM

#

which one

#

Iv made 2 mr robot themed ones

fleet wedge Mar 19, 2020, 3:26 AM

#

OSCP one The mountain one

alpine peak Mar 19, 2020, 3:27 AM

#

Steel mountain yea, it was windows which means it wasn't fun to make

fleet wedge Mar 19, 2020, 3:28 AM

#

Tbh I recokn windows overall is more easy to hack, just because windwos server is mostly gui and defaults. admins spamming the next button

#

You know when the IT guy give the printer domain he isnt qualified

alpine peak Mar 19, 2020, 3:28 AM

#

Its so bad that its not easy to make a box with

#

Because it requires more testing and it takes more resources

#

I know for a fact a vulnerability works with Linux but with windows I get paranoid and I have to hack it 3 times

fleet wedge Mar 19, 2020, 3:30 AM

#

Are you building then exporting as a vdmk?

alpine peak Mar 19, 2020, 3:31 AM

#

Yea, but with windows its not that simple because sometimes for a privesc, you have to autologin for a specific vuln to work as planned, and set service schedules with a specific permission to not allow system privs on initial

#

So many windows services love running with system privs, and that would make it to easy

fleet wedge Mar 19, 2020, 3:32 AM

#

Lol, its like windows loves being hacked

alpine peak Mar 19, 2020, 3:32 AM

#

Some services really really don't like running with anything besides system

#

Yea, windows in theory is easier to hack once you understand lateral movement

fleet wedge Mar 19, 2020, 3:35 AM

#

Process to process

alpine peak Mar 19, 2020, 3:35 AM

#

The NSA also pointed out a major flaw in windows that still exist today

fleet wedge Mar 19, 2020, 3:35 AM

#

What would that be? IPV6 flooding?

alpine peak Mar 19, 2020, 3:36 AM

#

eternal blue

fleet wedge Mar 19, 2020, 3:36 AM

#

I thought that was leaked from them

alpine peak Mar 19, 2020, 3:36 AM

#

It was, but NSA still discovered it

fleet wedge Mar 19, 2020, 3:36 AM

#

Tbh its always worrying, eveything is vulnerable if you look hard enough

alpine peak Mar 19, 2020, 3:37 AM

#

Its sketchy that NSA would not tell anyone

fleet wedge Mar 19, 2020, 3:37 AM

#

They need to get in somehow

#

I woudlnt give up a golden key if I needed it

alpine peak Mar 19, 2020, 3:37 AM

#

sniper in the closet

fleet wedge Mar 19, 2020, 3:38 AM

#

Samba is a mess tbh, I reckon there is so much more we dont know

alpine peak Mar 19, 2020, 3:38 AM

#

Its SMB, Samba is just a linux implementation of SMB

fleet wedge Mar 19, 2020, 3:38 AM

#

Lol, sorry I use linux to much by the sounds of it

alpine peak Mar 19, 2020, 3:39 AM

#

Its ok, now you know

fleet wedge Mar 19, 2020, 3:40 AM

#

So do you do this kinda thing for a living

alpine peak Mar 19, 2020, 3:40 AM

#

No, i'm a young kid

fleet wedge Mar 19, 2020, 3:41 AM

#

nice.

#

Really? I would have never known tbh

alpine peak Mar 19, 2020, 3:41 AM

#

Yea, everyone thinks i'm old

fleet wedge Mar 19, 2020, 3:42 AM

#

Explains why you dont wantch the news lol

alpine peak Mar 19, 2020, 3:42 AM

#

I used to

#

I just don't believe anything they say

fleet wedge Mar 19, 2020, 3:43 AM

#

You get told only what you need to hear tbh

alpine peak Mar 19, 2020, 3:44 AM

#

I just don't think media people are qualified to tell me anything

#

wrong chat for this

fleet wedge Mar 19, 2020, 3:46 AM

#

Yeah, we went way off topic

kind aspen Mar 19, 2020, 4:03 AM

#

Can somebody help me on HackPark?

fleet wedge Mar 19, 2020, 4:04 AM

#

@kind aspen What part

kind aspen Mar 19, 2020, 4:05 AM

#

Hydra bruteforcing. I seem to get a list of false positives.

fleet wedge Mar 19, 2020, 4:05 AM

#

Your sending the wrong info, how did you guesss what to send

kind aspen Mar 19, 2020, 4:06 AM

#

What am I doing wrong?

#

Hydra is spitting out too many passwords.

fleet wedge Mar 19, 2020, 4:06 AM

#

False positives

kind aspen Mar 19, 2020, 4:06 AM

#

Yes, FPs.

fleet wedge Mar 19, 2020, 4:06 AM

#

Do you know how to use burpsuite

kind aspen Mar 19, 2020, 4:06 AM

#

Yes, I do. Well, now that you're telling me ... not 100%.

fleet wedge Mar 19, 2020, 4:07 AM

#

use the proxy to see what is being sent, copy that 100% replacing the username and password

#

and then add the :Login part afterwards

kind aspen Mar 19, 2020, 4:07 AM

#

I got the "Username" and "Password" fields.

#

Can I PM you?

fleet wedge Mar 19, 2020, 4:08 AM

#

Yeah of course

fleet wedge Mar 19, 2020, 12:00 PM

#

Ok , morning all

#

Ready to take a nice breakfast and “kill” hackpark. I hope it doesn’t die on me again 🤦🏻‍♂️

topaz ledge Mar 19, 2020, 12:04 PM

#

better to break fast than slow and painful

terse herald Mar 19, 2020, 12:19 PM

#

gl with it @fleet wedge it's a room that requires a lot of patience, but you'll get there!!

fleet wedge Mar 19, 2020, 12:31 PM

#

@alpine peak I tried VHL. It’s a great platform . Sadly, I couldn’t maximize my time there to personal issues , but I would definitely give it a try and I recommend it. We have a nice VHL discord for it as well, in case you’re interested. We have been running it for a year now . I may do one more again once my PWK ends .

alpine peak Mar 19, 2020, 12:35 PM

#

@fleet wedge You work for VHL?

fleet wedge Mar 19, 2020, 12:35 PM

#

Nope 😃

#

I’m a former HP DBA and Windows Admin

#

Getting into cyber security now .

alpine peak Mar 19, 2020, 12:36 PM

#

Awsome 🙂

#

Does VHL have a lot of windows?

fleet wedge Mar 19, 2020, 12:36 PM

#

I do NOT sell VHL stuff neither I have no affiliation with them

#

It has a few windows but like I said , I was able to hack only 4 there. My mom is an old lady and she got sick and I had to leave US for a while

#

Internet in South America is slow and not common plus I was worried about her so I barely used it .

alpine peak Mar 19, 2020, 12:37 PM

#

Well hopefully you get more free time 🙂

umbral dagger Mar 19, 2020, 12:52 PM

#

Hi folks, any pointers on #1 of Task 4 on Hackpark? Specifically uploading my file using the current netcat session.

A Google of transferring files via netcat seem to show that I have to run netcat on both systems, whereas here the connection from the target is initiated by an exploit. So not sure how to I'd run it on the target

Tried hosting a simpleHTTP server and grabbing the file using certutils and BITs but to no avail. Thanks

alpine peak Mar 19, 2020, 1:06 PM

#

powershell

fleet wedge Mar 19, 2020, 1:26 PM

#

Hi folks, any pointers on #1 of Task 4 on Hackpark? Specifically uploading my file using the current netcat session.

A Google of transferring files via netcat seem to show that I have to run netcat on both systems, whereas here the connection from the target is initiated by an exploit. So not sure how to I'd run it on the target

Tried hosting a simpleHTTP server and grabbing the file using certutils and BITs but to no avail. Thanks
@umbral dagger you have already uploaded once, why not again 😉

umbral dagger Mar 19, 2020, 1:30 PM

#

@alpine peak I'll have a look. Did ponder that but didn't think it would run from that cli, thanks

alpine peak Mar 19, 2020, 1:31 PM

#

powershell is powerful

umbral dagger Mar 19, 2020, 1:31 PM

#

@fleet wedge did try that but couldn't find where it placed it lol

fleet wedge Mar 19, 2020, 1:31 PM

#

Have a snoop around

umbral dagger Mar 19, 2020, 1:32 PM

#

I probably need new glasses lol thanks

umbral dagger Mar 19, 2020, 2:42 PM

#

Sorted. Thanks guys

fleet wedge Mar 19, 2020, 5:51 PM

#

Doing hackpark again, lets see if the increase of reources has sorted it

fleet wedge Mar 19, 2020, 6:45 PM

#

Machine died again at 1 hour mark

#

Going to move away from this machine as the constent resets are very annoying

#

I mean have you been extending the countdown @fleet wedge

#

I had 1 hour left, I always press extend at the start

#

it was 1 h 5 mins remaining

#

Machine is "online" but unresponsive and kills all shells

topaz ledge Mar 19, 2020, 6:52 PM

#

and it's not cause you hacked it RealGoodTM?

fleet wedge Mar 19, 2020, 6:55 PM

#

Nah it's prbly cuz of hackpark

topaz ledge Mar 19, 2020, 6:56 PM

#

You keep saying that, and yet it keeps staying up :p

hasty sentinel Mar 19, 2020, 7:03 PM

#

will be sending an update on HackPark later today :))

topaz ledge Mar 19, 2020, 7:04 PM

#

just don't make it worse. That's always how my panic patches turn out >.>

shell yarrow Mar 19, 2020, 8:59 PM

#

anyone have any luck testing brainstorm locally?

#

cant even get the application to run on a windows 7 vm

hasty sentinel Mar 19, 2020, 10:45 PM

#

just been testing hackpark

#

and the performance has been fairly okay for me

#

is anyone still have issues with the performance?

#

I've also seen people make comments about the privesc method on there - are people comfortable with it or do questions need to be amended to make it more clear?

fleet wedge Mar 19, 2020, 11:01 PM

#

I am wondering if the problem is arising with the more time options

#

Does it actually give more time?

#

If you like im free later to run a couple of runs and see if there is any problems, check the cpu and ram usage

hasty sentinel Mar 19, 2020, 11:33 PM

#

ah do you mean extending the expiry time of the VM?

fleet wedge Mar 19, 2020, 11:34 PM

#

Yeah. I always extend my VMS right at the start, but hackpark always dies just before 1 hour

hasty sentinel Mar 19, 2020, 11:36 PM

#

we'll be pushing a new fix for the expiry over the next few days (latest)

fleet wedge Mar 19, 2020, 11:37 PM

#

Okay 🙂

hasty sentinel Mar 19, 2020, 11:37 PM

#

that should fix the problem 🙂

umbral dagger Mar 20, 2020, 5:04 AM

#

I found Hackpark dying on me a fair few times yesterday before the 1hr mark

graceful junco Mar 20, 2020, 5:09 AM

#

Yoooo

jovial plinth Mar 20, 2020, 9:06 AM

#

@hasty sentinel introduce me to hackpart please.thanks

smoky thorn Mar 20, 2020, 9:18 AM

#

?

bronze zenith Mar 20, 2020, 9:30 AM

#

?

jagged socket Mar 20, 2020, 9:32 AM

#

?

topaz ledge Mar 20, 2020, 9:37 AM

#

?

topaz yoke Mar 20, 2020, 1:58 PM

#

?

digital sonnet Mar 20, 2020, 5:08 PM

#

Hey, in Brainstorm, I was barely able to get nmap to run. I see the anon smb share but cannot access it for some reason?

#

smbclient -L \\\\10.10.117.154\\ -p 21

#

Connection to 10.10.117.154 failed (Error NT_STATUS_IO_TIMEOUT)

terse herald Mar 20, 2020, 5:12 PM

#

Are you able to telnet to it? @digital sonnet I haven't completed the room myself but that'd be the next thing I'd test

digital sonnet Mar 20, 2020, 5:13 PM

#

@terse herald no reply to ping or telnet

#

nmap did work though

terse herald Mar 20, 2020, 5:14 PM

#

Wait NT_STATUS that'll be a Windows box

digital sonnet Mar 20, 2020, 5:14 PM

#

Yes it is.

terse herald Mar 20, 2020, 5:15 PM

#

That'll explain the ping and telnet

#

Sorry buddy! Haven't got around to that one yet. Hopefully someone whose active has...?

digital sonnet Mar 20, 2020, 5:20 PM

#

Oh I got it. I'm just dumb tbh. Trying to access a ftp server as an smb share.

terse herald Mar 20, 2020, 5:21 PM

#

Ah! I was wondering why you were specifying port 21, but thought maybe the box creator put samba on that as a little trick 😂

#

good stuff!

proper pond Mar 21, 2020, 8:09 AM

#

HI, been doing Alfred but cant seem to find root.txt on the system. Am I missing something?

robust loom Mar 21, 2020, 12:15 PM

#

did you search for it?

proper pond Mar 22, 2020, 7:12 AM

#

Yes I did. I am NT Auth, used the meterpreter "search" and spawned a cmd.exe and tried dir /s. Restarted the machine and tried it all again but with the same result. I mean they even tell you where to look in the questions but can't find it.

chrome valve Mar 22, 2020, 10:36 AM

#

@proper pond from memory you might need to migrate to a different process. Even if your current process is technically System, not all processes have the same privileges.

digital sonnet Mar 22, 2020, 11:50 AM

#

Hey I need some help with brainpan, I have written the exploit but can't get a shell

#

can I dm anyone?

digital sonnet Mar 22, 2020, 12:05 PM

#

the program kind of quits when I run the exploit

proper pond Mar 22, 2020, 12:43 PM

#

@chrome valve Thank you very much. I really forgot to migrate. facepalm

chrome valve Mar 22, 2020, 12:43 PM

#

Np 😄

hoary hazel Mar 22, 2020, 3:57 PM

#

guys anyone having issues with steel moutain box? I was just about to privesc it and now although showing up on THM browser, i cant seem to do anything on the box, cant telnet into 8080 or nething, just runnning nmap again but seems like box is down
i think this time to get some lunch lol -

hoary hazel Mar 22, 2020, 4:39 PM

#

hi Guys, on steel mountain, Im trying to load powershell_shell but i gett getting :

#

Error running command powershell_shell: ArgumentError wrong number of arguments (given 4, expected 5)

spark iron Mar 22, 2020, 9:31 PM

#

how many arguments are you passing in?

cold kraken Mar 22, 2020, 10:29 PM

#

@hoary hazel i think you are missing an argument

hoary hazel Mar 22, 2020, 10:46 PM

#

according to the example the command was powershell_shell:

fleet wedge Mar 23, 2020, 12:50 PM

#

for those who did mrrobot ctf , any idea why ssh port is shown with open ports on nmap results even if it's closed ?

sonic loom Mar 23, 2020, 5:42 PM

#

With a connect scan ?

glass saddle Mar 24, 2020, 5:07 AM

#

anyone who has completed brainstorm please give me some help...i rooted the bof box on the oscp but i still can't fuzz this thing correctly....not sure what im supposed to be doing

glass saddle Mar 24, 2020, 5:54 AM

#

ok...i had to do it in a windows vm...

#

what a frustration

final vault Mar 24, 2020, 5:58 AM

#

It's always a good rule of thumb to have a linux and windows vm

glass saddle Mar 24, 2020, 7:06 AM

#

well i was initially trying to do it on my windows host...but firewalls and whatnot....its pretty locked down. anyways...rooted and good box once i spun up a vmware win10 instance to debug it on....

round drum Mar 24, 2020, 9:37 AM

#

Can anyone help me on hackpark? What is the name of the abnormal service running? I can't find the solution.

final vault Mar 24, 2020, 9:38 AM

#

||windowsscheduler.exe||

round drum Mar 24, 2020, 9:38 AM

#

Thanks so much

#

How were you able to find the solution?

final vault Mar 24, 2020, 9:40 AM

#

if you run ps and check logs you see ||Message.exe|| is being started and stopped every minute due to the scheduler

#

Always an interesting service to check logs for when you see it running

round drum Mar 24, 2020, 9:41 AM

#

Exactly, I found that one, but I couldn't find the scheduler

final vault Mar 24, 2020, 9:41 AM

#

ps shows it as WScheduler

#

or something similar

round drum Mar 24, 2020, 9:43 AM

#

But how were you able to find out this name? ||windowsscheduler.exe||

final vault Mar 24, 2020, 9:43 AM

#

program files

#

wscheduler is just an abbreviation

round drum Mar 24, 2020, 9:44 AM

#

Ok, thanks so much. I always tried the abbreviation, so I got pretty frustrated

topaz ledge Mar 24, 2020, 5:09 PM

#

You already got an answer, mate. Please don't spam

smoky thorn Mar 24, 2020, 5:09 PM

#

check #room-hints i replied over there

shell yarrow Mar 24, 2020, 5:10 PM

#

sorry i realized i was in the wrong room last second

abstract aspen Mar 24, 2020, 5:59 PM

#

Hi

#

I want join oscp

robust loom Mar 24, 2020, 6:00 PM

#

then join it 😉

maiden mason Mar 24, 2020, 6:02 PM

#

Could someone give me a DM about this one because it's bugging the hell out of me; Task 4 #3; 'What is the name of the abnormal service running?' I've gotten both user and root flags, but cannot find the answer to this question. *************.

#

Oh... HackPark...

glass saddle Mar 24, 2020, 7:07 PM

#

@maiden mason the answer you seek is like 12 posts above your question man 🙂 look first

topaz ledge Mar 24, 2020, 7:08 PM

#

the answer you seek
Don't forget to stroke your beard, Wiseman :p

vale parcel Mar 25, 2020, 12:22 AM

#

do u think its better to make lot of rooms before get into oscp path ?
Or is it progressive and i can take it rigth now ?

topaz ledge Mar 25, 2020, 12:24 AM

#

Have you done the primer path?

vale parcel Mar 25, 2020, 12:25 AM

#

not yet. It's better to do it before ?

topaz ledge Mar 25, 2020, 12:25 AM

#

primer :)

#

though there are rooms related to the path that are good to take during that

vale parcel Mar 25, 2020, 12:26 AM

#

with primer series, i'll be able to make hackthebox more easily ? and oscp is the next path to take ?

topaz ledge Mar 25, 2020, 12:27 AM

#

All learning you do here's gonna make any other target easier ;)

vale parcel Mar 25, 2020, 12:27 AM

#

ok. Thank you. I'll take primer series tomorrow

topaz ledge Mar 25, 2020, 12:28 AM

#

Cheers

crude spoke Mar 25, 2020, 5:17 AM

#

hello guys, somebody can help me doing alfred room? i was stuck on meterpreter shell. i didnt get connection back to my handler

stark hornet Mar 25, 2020, 2:30 PM

#

Hi Guys, I am on the BrainStorm of this OSCP path and have stuck on it for quite long time. 1. The Nmap yielded 3 ports but I "brute-forced" the answer and the answer is some other number instead, I tried to use different scan but other than this 3 no luck. Are rest of those ports the result of the BoF part? 2. I have managed to get the executable and trying to run it on Win7 32 bit VM but noting pop up. and also on Kali using DosBox and failed to load too. Shall I jump straight to the overflow part?

alpine peak Mar 25, 2020, 7:39 PM

#

@stark hornet You're overcomplicating the machine, download the exe and dll, debug using immunity debugger or whatever you want to use, and develop an exploit for it, run the exploit on the target machine after its working on your win7 VM.

#

ASLR and DEP is not a issue with this BOF, its made to be simple

stark hornet Mar 25, 2020, 8:27 PM

#

@alpine peak thank you for your advice. I have moved to the BOF part and trying to get the script working. will check back the port after I got the first shell.

digital sonnet Mar 26, 2020, 7:26 AM

#

Hey guys what should be the next step after completing the oscp path before I purchase lab time?

alpine peak Mar 26, 2020, 9:41 AM

#

@digital sonnet Do a lot of windows machines

humble barn Mar 26, 2020, 10:10 AM

#

How confident do you feel after completing OSCP path @digital sonnet?

digital sonnet Mar 26, 2020, 10:17 AM

#

Pretty confident with most tools and completed all the brainpans.

#

windows machines I'm not sure, still have to complete hackerpark

alpine peak Mar 26, 2020, 10:21 AM

#

@digital sonnet offsec loves windows machines, so once you finish hackpark, I recommend doing tj null's HTB windows list

final vault Mar 26, 2020, 10:39 AM

#

Yeah they get a rock on for windows

alpine peak Mar 26, 2020, 10:39 AM

#

For good reason, real life pentesting is mostly windows from what i'm told

smoky thorn Mar 26, 2020, 11:07 AM

#

^

#

a lot of corporate environment use windows as it's easier to use and more common and friendlier plus the administration of it it's fairly easy

alpine peak Mar 26, 2020, 11:08 AM

#

Active Directory

#

cloud DMZ is where linux lives

smoky thorn Mar 26, 2020, 11:50 AM

#

agreed

fleet wedge Mar 26, 2020, 3:39 PM

#

Hi all, in the game zone room, everything works fine EXCEPT the final step: metasploit says "Exploit completed, but no session was created", though authentication succeeded and payload was delivered. I've exchausted all my options - does anyone care to give me a hint? Thanks...

digital sonnet Mar 26, 2020, 3:55 PM

#

The same thing happened to me i just rebooted the box and it worked

fleet wedge Mar 26, 2020, 3:56 PM

#

check the lhost option, the same thing happened to me when i gave localhost value to that option instead of my 10.10....local address

fleet wedge Mar 26, 2020, 4:13 PM

#

can I post a screenshot or is that not allowed?

topaz ledge Mar 26, 2020, 4:14 PM

#

You can post screenshots, just no spoilers

#

and, erh, try not to dox yourself :p

fleet wedge Mar 26, 2020, 4:18 PM

#

Okay, here I go (redacted)

topaz ledge Mar 26, 2020, 4:19 PM

#

Well then.

fleet wedge Mar 26, 2020, 4:20 PM

#

📎 2020-03-26_16-18.png

#

Are these settings correct? I tried 'localhost' for LHOST too, but same result...

topaz ledge Mar 26, 2020, 4:21 PM

#

RHOST looks wrong. It's supposed to be the target -- the Remote HOST

fleet wedge Mar 26, 2020, 4:22 PM

#

Really? I found a write-up where RHOST was set to localhost...

topaz ledge Mar 26, 2020, 4:22 PM

#

And LHOST should be your listening machine, as seen by the target -- so not localhost

fleet wedge Mar 26, 2020, 4:23 PM

#

RPORT is localhost here, because the webmin tunneled out to the attacking machine

#

i would suggest you to try to change the payload

#

That LHOST IP is my listening machine (and is my localhost). I'm apparently getting dumber by the minute...

topaz ledge Mar 26, 2020, 4:25 PM

#

I assume you mean RHOST, @fleet wedge :)

#

If so, got it!

fleet wedge Mar 26, 2020, 4:25 PM

#

@topaz ledge yes you are right:)

topaz ledge Mar 26, 2020, 4:25 PM

#

neat

terse herald Mar 26, 2020, 4:30 PM

#

nice job!

fleet wedge Mar 26, 2020, 4:31 PM

#

Still the same result, tried all teh combinations...

topaz ledge Mar 26, 2020, 4:31 PM

#

Except the one that works :p Well, I don't know what it is then

fleet wedge Mar 26, 2020, 4:48 PM

#

Original settings were correct (RHOST localhost) and LHOST set to IP of localhost...

📎 ohyeah.png

topaz ledge Mar 26, 2020, 4:49 PM

#

yeah, to the remote machine, your localhost won't be their localhost ;)

fleet wedge Mar 26, 2020, 4:50 PM

#

Anyway, thanks for all the help, I was stuck for several hours...

topaz ledge Mar 26, 2020, 4:50 PM

#

Sometimes it's helpful just to write it all out :)

icy oxide Mar 27, 2020, 5:02 PM

#

Hey guys I'm thinking of doing the OSCP path in preparation for my OSCP exam, I'm 1 week away from finishing my lab time and I wanna keep practicing before I schedule my exam, looking for general tips and advice 😄

final vault Mar 27, 2020, 5:05 PM

#

@icy oxide The oscp is good, but only if you ignore all of the notes about using metasploit

vagrant dagger Mar 27, 2020, 7:17 PM

#

@icy oxide im studying for my second exam attempt for the oscp, my labs just finished and im using the learning path

#

definitely a good refresher, plus learned a couple of tricks

wicked remnant Mar 27, 2020, 8:32 PM

#

Hello!! I’m preparing to start taking the OSCP 4/18/2020. Is there any information on what is in this OSCP-path? How long will it take to work through the path?

#

Trying to get a little more information before deciding to subscribe.

icy oxide Mar 27, 2020, 9:34 PM

#

@final vault yeah I plan on practicing without metasploit until I pass my exam

hoary hazel Mar 27, 2020, 10:05 PM

#

@icy oxide sorry but prob a silly q, what are the alternatives to learn without metasploit until passing the exam? Im planning to enroll for OSCP studying soon ..

alpine peak Mar 27, 2020, 10:15 PM

#

@hoary hazel Learn to read and understand code instead of running it

smoky thorn Mar 27, 2020, 10:15 PM

#

^

hoary hazel Mar 27, 2020, 10:16 PM

#

@alpine peak ok thanks for the tip👍

icy oxide Mar 28, 2020, 1:38 AM

#

@hoary hazel Well by writing manual exploits or using public exploits, and basically running everything manually, essentially doing what metasploit does automatically for you, but manually. So at the beginning of the course you won't learn metasploit off the bat, first they teach fundamentals before they teach you about exploit frameworks and you're not allowed to use these frameworks during the exam.

It will make your exploits take longer, and things will be far more rigorous, but you'll learn things in-depth that you would've likely not learnt otherwise.

#

Sorry for the late reply lol

hoary hazel Mar 28, 2020, 2:07 AM

#

Hi @icy oxide thanks for the reply and advice. Is that covered in the PWK? Either way, is there a resource i could learn the above prior to starting oscp? Currently im doing most exploits using metasploit and it seems from your reply, a better way to learn is manually, that way i will hv a better appreciation and knowledge of the exploits.

#

@icy oxide no worries about the late reply

icy oxide Mar 28, 2020, 2:21 AM

#

@hoary hazel Yes it's most of what the PWK is comprised of, most of the course materials are comprised of manual methodology for specific attack vectors, along with certain fundamental theory on different computer architectures, operating systems, etc. And of course there is a focus on teaching you how to manually enumerate.

What I can say is that to really make use of the time spent on the OSCP labs is to be prepared for them, and I think the best way to do that is to practice on the low cost/free lab environments before you start the course, so you don't study under pressure and are able to take in everything and really develop your workflow, I wish I would've spent more time practicing on Hackthebox or even Tryhackme. QQ

calm brook Mar 28, 2020, 9:41 AM

#

Keep in mind though that OSCP is not about teaching you fancy exploits to run, it's about identifying and carrying out many attacks in a short amount of time. You will be tested in your ability to enumerate and research more so than your ability to (re)write exploits.

The more programming experience you have though, the easier a time you will also have in the off chance that you need to translate a metasploit module into another language.
@hoary hazel

hoary hazel Mar 28, 2020, 10:41 AM

#

Thanks @icy oxide & @calm brook

scenic glen Mar 28, 2020, 11:11 AM

#

In vulnversity there is the second to last question what user was running the webserver. Maybe I don't understand the question right. Why is it not www-data

#

uid=33(www-data) gid=33(www-data) groups=33(www-data)```

topaz ledge Mar 28, 2020, 11:21 AM

#

@scenic glen I reported it in #site-bugs a little earlier as i'm fairly certain it is one

scenic glen Mar 28, 2020, 12:58 PM

#

I managed to get the root flag but when i was logged in as root
mesg: ttyname failed: Inappropriate ioctl for device

#

Is this common or did I messed something up? I did not have a proper prompt

#

Also the reverse shell drove me mad with not able to backspace. Why is that. And is it fixable?

#

This was on vuulnersity

honest jackal Mar 30, 2020, 1:24 PM

#

hello all anyone did hackaprk without msfcosole

#

?

#

hackparck*

split vector Mar 30, 2020, 1:41 PM

#

I did but used it at the end, but still may be able to help @honest jackal

#

What are you trying to accomplish?

honest jackal Mar 30, 2020, 1:41 PM

#

can i dm you ?

split vector Mar 30, 2020, 1:42 PM

#

If you think it’s needed!

fleet wedge Mar 30, 2020, 2:32 PM

#

MOrning / evening all

#

I am redoing "vulnersity", did not take proper notes 1st time.

#

Now I am getting this error when using intruder in order to validate which extensions are valid or not:

#

"embedded browser initialization failed" < --- this is on Burp, the results tab, response>render

#

while I can technically validate or see response using "raw" tab, I want to understand why this is happening and how this can be solved.

cold kraken Mar 30, 2020, 2:53 PM

#

@honest jackal i also completed hack park without msf

mystic forge Mar 30, 2020, 9:36 PM

#

Hi, anyone here could point me to the right direction? Room: Steel Mountaint
Take a look at the other web server. What file server is running?

It doesn't accept any format

topaz ledge Mar 30, 2020, 9:55 PM

#

@mystic forge What input are you giving it?

mystic forge Mar 30, 2020, 9:56 PM

#

doesnt help

#

not sure if its the right answer

topaz ledge Mar 30, 2020, 9:57 PM

#

Ah, yes, that one. You're not wrong, but you're also not entirely right. Give it a closer look

mystic forge Mar 30, 2020, 9:57 PM

#

ok thank you will take a look

#

Ok, found it

topaz ledge Mar 30, 2020, 10:09 PM

#

Nice!

fleet wedge Mar 30, 2020, 10:14 PM

#

Ohh well ... I guess I’ll have to accept no responses to my above question as a possible bug on burp

#

Moving on , I guess ...

topaz ledge Mar 30, 2020, 10:15 PM

#

Have you tried OWASP ZAP? It's much easier than Burp

fleet wedge Mar 30, 2020, 10:55 PM

#

Hmm, not really , but I can take a look. Thanks for the advice

scenic glen Mar 31, 2020, 5:43 PM

#

I hope the exam is not as hard as the hackpark room.

final vault Mar 31, 2020, 5:44 PM

#

@scenic glen Hackpark isn't that difficult

maiden aurora Mar 31, 2020, 5:44 PM

#

Isn't hackpark ranked medium on THM?

final vault Mar 31, 2020, 5:44 PM

#

As someone who is currently doing pwk in preparation for my oscp. Hackpark would be a 25 points room

scenic glen Mar 31, 2020, 5:45 PM

#

I found it hard. Especially since the escalation point was not always obvious.

final vault Mar 31, 2020, 5:45 PM

#

Kinda was tho

scenic glen Mar 31, 2020, 5:45 PM

#

I assume there were other ways to elevate privileges

final vault Mar 31, 2020, 5:45 PM

#

If you saw wschedule, you'd know to look at logs

#

logs would show that || Message.exe || was restarting every minute

#

so you could replace with shell

maiden aurora Mar 31, 2020, 5:46 PM

#

May give HackPark a look tomorrow

final vault Mar 31, 2020, 5:46 PM

#

It's a really good room tbh

scenic glen Mar 31, 2020, 5:46 PM

#

I assumed there was an exploit in that directly

final vault Mar 31, 2020, 5:46 PM

#

you can replace message.exe

#

😂

#

That is the exploit. It is the scheduled service

scenic glen Mar 31, 2020, 5:47 PM

#

Noted for future reference

#

Gonna take a long brake. o/

final vault Mar 31, 2020, 5:47 PM

#

I'll update hackpark in the coming days to include a manual exploit

#

so you don't have to use meterpreter

torpid geyser Mar 31, 2020, 5:48 PM

#

do other people also have issues with getting that last shell from message?

#

it crashes after few minutes when i do that and i have to redeploy and start all over it drives me crazy

alpine peak Mar 31, 2020, 6:11 PM

#

hackpark can be done without ever using metasploit

#

Actually, all OSCP path machines can be done without metasploit

#

so idk why you would add a manual exploit if its already manual

spark iron Mar 31, 2020, 6:14 PM

#

@final vault is adding new tasks to rooms, so its clear those rooms can be completed without using metasploit

alpine peak Mar 31, 2020, 6:15 PM

#

The official writeup didn't even use metasploit

#

powershell with nishang is all anyone needs

spark iron Mar 31, 2020, 6:15 PM

#

Some did I think?

alpine peak Mar 31, 2020, 6:16 PM

#

Its just dangerous to be modifying a windows machine after its been working, because it could break

#

Linux is different

final vault Mar 31, 2020, 6:21 PM

#

I've done the room without metasploit however, when you developed the rooms. You seemed to include metasploit as your go to @alpine peak

#

Please note I'm just trying to improve it and won't be modifying any of the rooms directly just the tasks on the site

spark iron Mar 31, 2020, 6:21 PM

#

^ That was most likely me or ashu

#

Zayotic makes the machines + writeup, we then made it into a room

#

I will take the hit for that, even though I knew about the Metasploit 1 use rule, I still included it to use Metasploit as: we released rooms before making the pathway, so wanted to make it "beginner friendly".

alpine peak Mar 31, 2020, 6:22 PM

#

Ok good, because Windows is so unpredictable, I thought you were actually changing the machine itself

final vault Mar 31, 2020, 6:23 PM

#

oh no the machines are good

#

As someone who did them without metasploit I enjoyed them highly

alpine peak Mar 31, 2020, 6:23 PM

#

The OSCP only allows metasploit to be used once, I misunderstood because I thought the goal was to prepare for the exam, so I never recommended metasploit for those machines

final vault Mar 31, 2020, 6:24 PM

#

Yeah I wouldn't touch the machines as whenever I seem to attempt windows box dev it just falls over 😂 I'm starting to think I'm cursed

alpine peak Mar 31, 2020, 6:25 PM

#

Only with Windows machines I would not recommend that, because Its so unstable

terse herald Mar 31, 2020, 9:50 PM

#

windows do be windows

devout kite Mar 31, 2020, 11:38 PM

#

https://www.youtube.com/watch?v=F_xBuLZ2WEE

YouTube

Julio Ureña

HackTheBox - Online Meetup RedTeamRD (Español)

Tendremos un invitado especial, @dplastico https://twitter.com/dplastico OSCP,OSCE, quien nos hablará de AV Bypass, PE Backdoors.

▶ Play video

keen iris Apr 1, 2020, 4:41 AM

#

I'd recommend someone hooks @final vault up with the original, msf free, writeups for the boxes then ( @spark iron )

final vault Apr 1, 2020, 4:58 AM

#

I have them

#

I think

spark iron Apr 1, 2020, 9:21 AM

#

Yeah, the ones I gave you are the writeups from the boxes.

honest jackal Apr 1, 2020, 10:53 AM

#

Just finished my exam I have a doubt I rooted one 25 point machine à 20 point machine and a 10 point machine and got user on the 2 others. Is that enough to pass?

bronze zenith Apr 1, 2020, 10:58 AM

#

you'll see in a closest future 🙂 in OSCP there's no exact passing score

honest jackal Apr 1, 2020, 10:58 AM

#

They say 70 right?

rotund rivet Apr 1, 2020, 2:33 PM

#

Do you guys have any advices or resources for windows privilege escalation?

honest jackal Apr 1, 2020, 2:38 PM

#

Do you guys have any advices or resources for windows privilege escalation?
@rotund rivet do all the boxes that are available on the internet. Experience is key. Do not rely on kernel exploits as they boxes regularly patched.

#

their* boxes

sonic loom Apr 1, 2020, 3:38 PM

#

Even for Windows ? :o)

honest jackal Apr 1, 2020, 3:55 PM

#

Even for Windows ? :o)
@sonic loom yup

keen iris Apr 2, 2020, 12:57 AM

#

@rotund rivet There's more windows privesc content coming

rotund rivet Apr 2, 2020, 9:41 AM

#

Can we view the "OSCP Path" content before enrolling?

#

@rotund rivet do all the boxes that are available on the internet. Experience is key. Do not rely on kernel exploits as they boxes regularly patched.
@honest jackal Thanks 🙂

honest jackal Apr 2, 2020, 11:15 AM

#

Just sent the report fingers crossed now NotLikeThis

fleet wedge Apr 2, 2020, 11:22 AM

#

Anyone here done VirtualHackingLabs as prep for PWK? I am doing VHL now and so far really like it. The people on it's discord definitely seem to think it's great prep, but I'm wondering how it really compares to something like THM's OSCP-path

scenic glen Apr 2, 2020, 12:37 PM

#

THM is 10$ per month. I wouldn't pay 100 for VHL. And I did learned A LOT

scarlet veldt Apr 2, 2020, 4:01 PM

#

@devout kite Quien es ese?

tiny geode Apr 2, 2020, 5:12 PM

#

@fleet wedge Ive been doing VHL however I learn terribly from PDFs so watching walkthroughs and doing boxes like on THM/HTB is working better for me

fleet wedge Apr 2, 2020, 5:13 PM

#

@tiny geode gotcha, yea I've had to take pretty good notes to really remember the material

tiny geode Apr 2, 2020, 5:13 PM

#

I took a ton of notes too

#

But at the end of the day it still didn't really go in and I struggled in the labs a bit

#

So I'm going back to my original plan of doing Ippsec walkthroughs for every retired HTB machine and the OSCP path here

scarlet veldt Apr 2, 2020, 5:30 PM

#

Yeah me too

fleet wedge Apr 2, 2020, 9:40 PM

#

Is this path worth it?

final vault Apr 2, 2020, 10:13 PM

#

The path is great, I'm currently in the process of adding non-metasploit/meterpreter tasks to each of the rooms

#

Is this path worth it?
@fleet wedge If you fancy challenging yourself try doing it without the tasks 😄

cold kraken Apr 3, 2020, 2:46 AM

#

I'm really enjoying the path, I failed a while back and this is just what I need to refresh and get back into that mindset.

fallen herald Apr 4, 2020, 4:36 AM

#

Has anyone done the skynet room? Burp intruder is not returning an abnormal length to indicate the correct password for milesdyson. Anyone have this problem?

scenic glen Apr 4, 2020, 9:05 AM

#

@fallen herald are you trying to brute force your way into the account? You might want to try a different approach

icy oxide Apr 4, 2020, 5:42 PM

#

Question: What are the downsides to using my own Kali VM on the tryhackme labs?

fleet wedge Apr 4, 2020, 5:49 PM

#

There aren't really any

#

Tryhackmes vm is just more convenient

icy oxide Apr 4, 2020, 5:52 PM

#

Cool, thank you!

terse herald Apr 4, 2020, 6:24 PM

#

It's just non-persistent is all 🙂 but you don't need to connect via vpn etc

young gust Apr 4, 2020, 6:31 PM

#

Can we install tools and use it on the web?

chrome valve Apr 4, 2020, 6:32 PM

#

As in, can you download new tools and use them against real world targets?...

#

Bear in mind the legally dubious nature of that

young gust Apr 4, 2020, 6:37 PM

#

I believe it’s ok to download tools that help you complete the lab with less work, right?

chrome valve Apr 4, 2020, 6:38 PM

#

Correct. You can download whatever you want, provided you're using them on TryHackMe machines, for their intended purpose

young gust Apr 4, 2020, 6:39 PM

#

That’s what I’m looking for. Thank you

fleet wedge Apr 4, 2020, 8:04 PM

#

Don't do anything illegal

#

Or the greatest ban hammer of all will come upon you

#

The ban hammer of the law!

#

😂 😂

fallen herald Apr 4, 2020, 9:30 PM

#

@scenic glen yes. I have tried Hydra as well but it returns with 16 valid passwords. I couldn't find the PHP cookie in firefox which is the supposed workaround. Burp should just be showing the abnormal packet length

scenic glen Apr 4, 2020, 9:46 PM

#

@scenic glen yes. I have tried Hydra as well but it returns with 16 valid passwords. I couldn't find the PHP cookie in firefox which is the supposed workaround. Burp should just be showing the abnormal packet length
@fallen herald For hydra you can display debug data to see the data returned. You can see why you get 16 valid passwords. But at which question are you?

final vault Apr 4, 2020, 9:53 PM

#

To stream a couple OSCP path boxes

#

that is the question

honest jackal Apr 4, 2020, 11:53 PM

#

I passed guys 😍😍😍😍😍

toxic temple Apr 4, 2020, 11:54 PM

#

gzzzz

final vault Apr 5, 2020, 1:07 AM

#

Congrats!

fleet wedge Apr 5, 2020, 1:07 AM

#

@honest jackal I never doubted you for a single second

chrome valve Apr 5, 2020, 1:07 AM

#

@honest jackal Ey!!

honest jackal Apr 5, 2020, 1:41 AM

#

Thx for the nice words I will not miss shouting out TryHackMe when I share my badge u guys rock tru pepehands

fallen herald Apr 5, 2020, 2:04 AM

#

@fallen herald For hydra you can display debug data to see the data returned. You can see why you get 16 valid passwords. But at which question are you?
@scenic glen I'm still at the first. I just took a guess and figured the first would be his password, which worked but I want to make sure brute forcing the website actually works. IRL I wouldnt just be able to guess

#

@scenic glen I'm just gonna retry Burp and see if that works. Finding the PHPSESSID for hydra was too much of a headache

#

*trying to find

marsh current Apr 5, 2020, 2:32 AM

#

Any doing the hackpark box?

marsh current Apr 5, 2020, 2:47 AM

#

got it nvm

marsh current Apr 5, 2020, 4:21 AM

#

anyone recently completed hackpark??

scenic glen Apr 5, 2020, 5:40 AM

#

I did

stuck prairie Apr 5, 2020, 7:53 AM

#

anyone recently completed hackpark??
@marsh current Yah

chrome imp Apr 5, 2020, 9:25 AM

#

I passed guys 😍😍😍😍😍
@honest jackal Congrats!!! big respect! any tips?

honest jackal Apr 5, 2020, 9:57 AM

#

@honest jackal Congrats!!! big respect! any tips?
@chrome imp break all the boxes that people call OSCP like. I think experience is key. You must exploit a lot of services and take notes. I think if you do that, getting a foothold on all the machines should be a piece of cake. As for privesc DO NOT RELY ON KERNEL EXPLOITS and scripts such as Sherlock, Watson, windows exploit suggester. You can run them sure, but don't expect the solution coming from there. Last but not least, sleep!

chrome imp Apr 5, 2020, 10:02 AM

#

@honest jackal and how much time did it take to get the answer back?

honest jackal Apr 5, 2020, 10:02 AM

#

3 days

chrome imp Apr 5, 2020, 10:03 AM

#

Cool!! congrats this is really cool.

chrome valve Apr 5, 2020, 12:37 PM

#

@honest jackal given you the OSCP role. Sorry, completely forgot last night 😄

rotund rivet Apr 5, 2020, 3:14 PM

#

📎 Screenshot_1.png

#

how can i complete this room?

smoky thorn Apr 5, 2020, 3:22 PM

#

you don't @rotund rivet . it's a placeholder for now. it will be filled in with more info soon

rotund rivet Apr 5, 2020, 3:22 PM

#

Ok thanks

smoky thorn Apr 5, 2020, 3:23 PM

#

anytime

spark iron Apr 7, 2020, 12:10 AM

#

https://twitter.com/dievu5/status/1247303142141825025?s=19

Joe Helle (@dievu5)

Hitting the OSCP boxes because a $10 a month subscription teaches it better than my $1400 PWK. https://t.co/T2fiz0Uhr3 #tryhackme #ctf #hacking via @realtryhackme

waxen sparrow Apr 7, 2020, 12:35 AM

#

wow gr8

#

I love tryhackme

#

because of this

rich ingot Apr 7, 2020, 8:22 PM

#

I just signed up for OSCP. Can you take the exams as many times as you'd like?

bronze zenith Apr 7, 2020, 8:44 PM

#

i think yeah, but they probably won’t allow you to do a lot in a short period of time

#

and it’s better not to think about retaking at all ;) aim for the win at the first try

rich ingot Apr 7, 2020, 8:56 PM

#

yeah thats true, good advice

final vault Apr 7, 2020, 8:56 PM

#

Fail once it’s 4 weeks wait time

#

Twice, eight weeks

#

Three, 12

rich ingot Apr 7, 2020, 8:57 PM

#

oh interesting.

final vault Apr 7, 2020, 8:57 PM

#

Tldr don’t fail

rich ingot Apr 7, 2020, 8:57 PM

#

lol

final vault Apr 7, 2020, 8:57 PM

#

Study the material to a T. If you struggle understanding one part. Give it more attention

rich ingot Apr 7, 2020, 8:57 PM

#

can't wait.

#

I just discovered discord too (man I feel like an old man), can't wait to begin this journey! 🙂

celest locust Apr 7, 2020, 10:59 PM

#

i feel like the final privesc on the skynet box was just so obscure

#

like i would have never got that

#

ever lol

#

had never seen it before

rich ingot Apr 7, 2020, 11:10 PM

#

@celest locust - nice handle. can't wait to watch the new season

celest locust Apr 7, 2020, 11:11 PM

#

@rich ingot thank-you sir! It's a great show. New season is brill 😄

grizzled spade Apr 8, 2020, 3:11 AM

#

How good is the oscp path, in your opinion? does it prepare you well for what's ahead?

subtle verge Apr 8, 2020, 5:54 AM

#

@celest locust A decent linux privesc script would have pointed it out

#

pretty sure pspy would have also

noble glacier Apr 8, 2020, 5:58 AM

#

@celest locust Nah, it's a pretty common privesc.

subtle verge Apr 8, 2020, 5:58 AM

#

All about enumeration and knowing what to look for

noble glacier Apr 8, 2020, 5:59 AM

#

^

subtle verge Apr 8, 2020, 6:05 AM

#

@grizzled spade From my experience, yes the path does reflect the OSCP related concepts that you may or may not face

final vault Apr 8, 2020, 6:45 AM

#

Out of interest, anyone had any issues connecting to their personal clients in pwk? Can't seem to get into my windows client

celest locust Apr 8, 2020, 8:47 AM

#

@subtle verge @noble glacier for sure - ty

coral snow Apr 8, 2020, 7:38 PM

#

Hi!

I am having some trouble with steel mountain. The port it asks for in Task 2 is not open. It doesn't show up when I run nmap, and if I target the port directly it says it is closed.

minor jasper Apr 8, 2020, 7:39 PM

#

use -Pn

coral snow Apr 8, 2020, 7:39 PM

#

Ah, it doesn't respond to ping

#

It even says so.. My bad. Thanks for the quick response

minor jasper Apr 8, 2020, 7:40 PM

#

you are welcome

coral snow Apr 8, 2020, 8:02 PM

#

Wondering about the answer to a specific task, I guess I shouldn't do that here. Could someone who knows the answer question to #2 in task 2 on steel mountain, PM me? Not sure I understand the question correctly,

coral snow Apr 8, 2020, 8:20 PM

#

It asks for the file server name, but presents an answer format that doesn't match anything found.

#

Ok, figured it out. Really misleading and unecessary question.

final vault Apr 8, 2020, 9:53 PM

#

Streaming the oscp path now if anyone wants to ask questions

candid pier Apr 8, 2020, 9:55 PM

#

great

final vault Apr 9, 2020, 7:31 AM

#

Steel Mountain has been updated to include a non-metasploit task. This goes over manually exploiting the vulnerable application and also additional ways of discovering the privilege escalation path

brave bolt Apr 9, 2020, 8:24 AM

#

nice 🙂 looking forward to it!

coral snow Apr 9, 2020, 1:50 PM

#

Cool, was this done today?

odd zinc Apr 9, 2020, 1:52 PM

#

@final vault nice literally doing that machine now 😄

coral snow Apr 9, 2020, 2:02 PM

#

Ah, task 4. Very nice

drowsy kelp Apr 9, 2020, 6:19 PM

#

hi anyone try lord of ring machine without sql map

odd zinc Apr 9, 2020, 6:40 PM

#

hackpark - I've tried what I think is every service / exe I can see running/in program files, and none of them work - what am I missing 😄

jovial lynx Apr 9, 2020, 6:50 PM

#

@odd zinc I'm having the same issue!

odd zinc Apr 9, 2020, 6:52 PM

#

I noticed on the forum there's a lot of people also having an issue 😦

#

I have tried all sorts of combinations

brave bolt Apr 9, 2020, 6:54 PM

#

ah that one.

final vault Apr 9, 2020, 6:54 PM

#

It makes sense you just have to know what to look for kinda thing

brave bolt Apr 9, 2020, 6:54 PM

#

yeah you have to approach it from another view.

final vault Apr 9, 2020, 6:54 PM

#

powershell -c "Get-Service"

jovial lynx Apr 9, 2020, 6:54 PM

#

so is it asking about services or processes?

odd zinc Apr 9, 2020, 8:53 PM

#

Finally got it, thanks @final vault

jovial lynx Apr 9, 2020, 9:02 PM

#

@odd zinc Would you be able to give me a nudge in the right direction? You can DM me if you want.

jovial lynx Apr 9, 2020, 9:19 PM

#

@odd zinc Thank you! The question is very misleading...

thorn patio Apr 10, 2020, 5:00 AM

#

Hey hi

#

can i get help in Steelmountain , i have founded the exploit and changed all socks information , but i cant get a shell , and in the exploit itself it tells to try

📎 unknown.png

odd zinc Apr 10, 2020, 6:28 AM

#

Have you setup a local webserver with nc.exe in it's root path?

thorn patio Apr 10, 2020, 11:31 AM

#

hmnn yes

#

the file is not getting and receving from me

coral snow Apr 10, 2020, 7:28 PM

#

Anyone know when Alfred will get the non-metasploit approach?

#

Also, having the task there as a placeholder is somewhat annoying as you are unable to get 100% progress.

rancid vine Apr 10, 2020, 7:36 PM

#

Hey everyone! Is someone available that could nudge me a bit on the non-Metasploit, powershell exploitation on Steel Mountain please? I have access to the machine manually, just struggling to figure out the Powershell stuff. Thanks!

odd zinc Apr 10, 2020, 7:36 PM

#

🙂 it's frustrating that it's not showing as ticked off huh

minor jasper Apr 10, 2020, 9:20 PM

#

hi

#

i solved lord of the root machine but i can not find task2x6 answer

#

i got root flag but i can not find task 2x6's answer

#

could anyone help me?

coral snow Apr 10, 2020, 10:27 PM

#

HackPark. Is the password found in rockyou? I am not finding it, and wondering if I am running hydra with the wrong parameters.

final vault Apr 10, 2020, 10:34 PM

#

You're running wrong params

#

if you haven't hit it

coral snow Apr 10, 2020, 11:14 PM

#

Got it right this time, thanks

thorn patio Apr 11, 2020, 4:05 AM

#

hi how can i complete this , task in https://tryhackme.com/room/alfred

📎 unknown.png

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

broken helm Apr 11, 2020, 4:35 AM

#

@thorn patio you can't yet. It is being updated.

thorn patio Apr 11, 2020, 4:35 AM

#

but not yet updated still now

broken helm Apr 11, 2020, 4:36 AM

#

@thorn patio No. He is updating all of the oscp rooms to use both with and without metasploit.

thorn patio Apr 11, 2020, 4:36 AM

#

Oh , nice to hear that

thin walrus Apr 11, 2020, 4:41 AM

#

Great that was my suggestion before

#

Now they listen

#

When this expect to finish ?

broken helm Apr 11, 2020, 4:56 AM

#

@thin walrus He's working on them now..some have been updated if I'm not mistaken.

jagged stirrup Apr 11, 2020, 6:19 AM

#

@thorn patio you can't it's been updated 🙂

thorn patio Apr 11, 2020, 6:59 AM

#

oh okay @jagged stirrup

minor jasper Apr 11, 2020, 8:34 AM

#

hi

#

i solvedhackpark machine and i got root flag but i can not find Task4x3(What is the name of the abnormal service running?)'s answer

#

📎 flag.png

odd zinc Apr 11, 2020, 8:57 AM

#

if you got the answers you should know, try ending the service name with .exe or .svc

fleet wedge Apr 11, 2020, 9:12 AM

#

any oscp (2020) holder? please share your exam experience ( blog post/ video)

minor jasper Apr 11, 2020, 9:43 AM

#

@odd zinc i feel like stuppid, still can't find.which cmd command should i use?

#

i found it!

fleet wedge Apr 11, 2020, 11:03 AM

#

eh god one day i will get to that path

gritty jungle Apr 11, 2020, 11:49 AM

#

Hello, I have a question about of Intro to x86-64 room questions. I'm trying analyse if2 executable(ELF) file with r2. When I want see rbp-0x8 value before popq opcode. R2 returned 60 but I was type 60 in input tcm system doesn't accept that. Where I mistake?

#

📎 unknown.png

chrome valve Apr 11, 2020, 12:30 PM

#

@gritty jungle chances are that it's in hex

gritty jungle Apr 11, 2020, 12:30 PM

#

ov sh.. 😄

#

When I tried,I'm encounter an same error.

#

Oh. Okey. I understood.

#

Ty. @chrome valve

chrome valve Apr 11, 2020, 12:36 PM

#

Np

thorn patio Apr 11, 2020, 1:30 PM

#

Hi i need a help in skynet i have found the perfect password but not working

scenic glen Apr 11, 2020, 3:24 PM

#

@thorn patio Maybe the password is for another service?

thorn patio Apr 11, 2020, 3:43 PM

#

nope i hope it is same

#

can i pm u , beacuse it may reveal

#

more things

#

@scenic glen

minor jasper Apr 11, 2020, 4:48 PM

#

@thorn patio you can pm me

steep lotus Apr 12, 2020, 12:14 AM

#

Hey there guys... Christian Gabriel here!

thorn patio Apr 12, 2020, 11:21 AM

#

hi @steep lotus

steep lotus Apr 12, 2020, 11:24 AM

#

So here's the deal...I'm struggling a bit on linux and windows priv esc in general. I've looked at both the linenum script...tried running it but I just don't understand which vectors are used for privilege escalation... anyone got any learning advice or techniques?

bronze zenith Apr 12, 2020, 11:46 AM

#

@steep lotus you can do this room: https://tryhackme.com/room/commonlinuxprivesc

It gives a good insight on linux priv escalation

steep lotus Apr 12, 2020, 11:48 AM

#

Awesome. Thank you. Got any rooms for windows priv esc??

chrome valve Apr 12, 2020, 11:49 AM

#

They're in the making 🙂

fleet wedge Apr 12, 2020, 1:43 PM

#

So I finished Kenobi last night. Can someone explain what exactly we did on the privesc? I'm a little fuzzy on what exactly when changed with curl and $PATH to make ../menu do something different
Feel free to dm me if anyone wants to

chrome valve Apr 12, 2020, 1:50 PM

#

@fleet wedge From memory that's a path manipulation

#

So there'll have been a binary that was executing something using a relative path (presumably the menu binary, calling curl from what you were saying)?

cobalt turret Apr 12, 2020, 6:12 PM

#

Hi I have just started Mr.Robot machine. I am struggling with question 2 in task 2 section. I couldn't find other running file server. Feel free to dm me if anyone helps to me

Edit: I solved 🙂

lilac frost Apr 13, 2020, 12:28 AM

#

Batu naber @cobalt turret

scenic glen Apr 13, 2020, 9:04 AM

#

Hmm. Why did I find brainpan1 room so easy?

#

Possibly there was nothing new in there. But I don't find it hard. I would say medium

#

I would also put a flag in there 😄

alpine peak Apr 13, 2020, 9:19 AM

#

@scenic glen Most people skip the 2nd privesc method

abstract crystal Apr 13, 2020, 9:20 AM

#

hello. in vulnversity room when i upload the phtml file and call it from web i get WARNING: Failed to daemonise. This is quite common and not fatal. Connection timed out (110)

#

has anybody seen or a solution?

scenic glen Apr 13, 2020, 11:51 AM

#

@alpine peak I elevated via the custom user script. What is the second one ? 😄

jagged stirrup Apr 13, 2020, 1:10 PM

#

hey OSCP have Reverse Eng. also? in OSCP path there are 2 machines brainstorm and Brainpan1

scenic glen Apr 13, 2020, 1:17 PM

#

I think so 🙂

#

https://www.offensive-security.com/documentation/penetration-testing-with-kali.pdf

#

It's in the curriculum

final vault Apr 13, 2020, 1:40 PM

#

Oscp doesn’t include any reverse engineering unless you deem buffer overflow re

jagged stirrup Apr 13, 2020, 1:41 PM

#

yea that's what am thinking

#

my weakness is reverse eng. that's why am thinking

final vault Apr 13, 2020, 1:42 PM

#

The path is to help people prepare for oscp

#

As oscp doesn’t include it. It’s very unlikely it will ever have any

jagged stirrup Apr 13, 2020, 1:43 PM

#

yes path is very useful I really feel I have some more knowledge, I do HTB before and trying something new and it is great )

scenic glen Apr 13, 2020, 1:56 PM

#

I thought reverese engineering means bof

#

So it't another thing

#

sorry

thorn patio Apr 13, 2020, 4:02 PM

#

hey hi

#

can anybody help me in the skynet R*I

graceful junco Apr 14, 2020, 5:51 AM

#

Anyone working on oscp labs

jagged stirrup Apr 14, 2020, 6:07 AM

#

am working on oscp path

thorn patio Apr 14, 2020, 6:53 AM

#

ye mee to working in OSCP Labs

jagged stirrup Apr 14, 2020, 7:48 AM

#

can anyone suggest any material for buffer overflow tutorial?

scenic glen Apr 14, 2020, 8:38 AM

#

Me three 🙂

#

I started with Penetration Testing A hands on intro book.

cobalt turret Apr 14, 2020, 9:43 AM

#

Is there anybody who finished Steel Mountain room? If anyone, could contact me via dm. I have a question.

fleet wedge Apr 14, 2020, 1:49 PM

#

how do i solve daily bugle

#

the python exploit is not working

#

can i get some help

fleet wedge Apr 14, 2020, 2:10 PM

#

anybody online?

bronze zenith Apr 14, 2020, 2:10 PM

#

check the writeup

fleet wedge Apr 14, 2020, 2:10 PM

#

ya i checked it

#

te exploit isnt working

bronze zenith Apr 14, 2020, 2:11 PM

#

okay let me check

fleet wedge Apr 14, 2020, 2:11 PM

#

sure

bronze zenith Apr 14, 2020, 2:11 PM

#

i did it recently

#

https://github.com/Tuhinshubhra/CMSeeK
this one works fine

#

with python3 and sudo though

fleet wedge Apr 14, 2020, 2:13 PM

#

this works

#

but the sqli one

#

doesnt

#

joomblah one

bronze zenith Apr 14, 2020, 2:13 PM

#

i used sqlmap there :)

fleet wedge Apr 14, 2020, 2:13 PM

#

thats y

bronze zenith Apr 14, 2020, 2:13 PM

#

and everyone in writeups used it

fleet wedge Apr 14, 2020, 2:13 PM

#

ya but its oscp

#

u cant use sqlmap

bronze zenith Apr 14, 2020, 2:15 PM

#

https://github.com/JohnDoeDC/dailybugle/blob/master/README.md
i think this one gives you the OSCP approach

fleet wedge Apr 14, 2020, 2:15 PM

#

i am telling u

#

the exploit doesnt work

#

ya that too

#

maybe its just me iguess

#

but the password is showing 'n'

#

when i use that

toxic night Apr 15, 2020, 12:10 AM

#

hi, guys.. I have a question about steelmountain

#

[Task3-3] Why make a file naming A****ed.exe and How to know that File name on the script?
How to replace the original service binary?
Does anyone know?

toxic night Apr 15, 2020, 2:10 AM

#

Oh, I found the answer. ...I will share this
https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae

Medium

Windows Privilege Escalation — Part 1 (Unquoted Service Path)

Prerequisites

coral snow Apr 15, 2020, 8:49 AM

#

Currently looking at HackPark. In task #4 it says you can upload the payload using the current netcat session. How does that work? I thought you had to have netcat for windows installed on the machine and explicitly start it.

coral snow Apr 15, 2020, 9:20 AM

#

I might be reading it wrong. Maybe the tip isn't hinting at using netcat itself, but utilizing any method of transferring files possible.

gritty hollow Apr 15, 2020, 1:55 PM

#

Busy with HackPark - anyone available to check something for me on my hydra brute force as I think I am not seeing the obvious?

gritty hollow Apr 15, 2020, 3:14 PM

#

@coral snow have you managed to get the file uploaded?

maiden vapor Apr 15, 2020, 5:40 PM

#

am I crazy or does the hackpark cve question not match the cve that applies to the exercise?

coral snow Apr 15, 2020, 6:28 PM

#

@gritty hollow Yes, after a couple of tries. Thanks. A bit hard when the shell gives no feedback.

coral snow Apr 15, 2020, 6:52 PM

#

HackPark.. How would I go about finding the abnormal service? Not sure what to look for. Then again, I am confirming my finds by pasting them into the answers boxes on the hackpark website.

coral snow Apr 15, 2020, 7:08 PM

#

Which seems unreliable.

hazy ruin Apr 15, 2020, 10:54 PM

#

From the OSCP path, https://tryhackme.com/room/steelmountain Task4 ........... ( access target without MSF ) . Managed to get a shell back listener by doing exploit on rejetto HFS , python <target IP> port:8080 getting a shell in C:\Users\bill . Then according to the task we have to find the service that we can restart which is AdvancedSystemCareService9 , path ...............\Advanced SystemCare\ASCService.exe we have to do payload with msfvenom which I did and gave it the name ASCService.exe in order to restart the AdvancedSystemCareService9 and then this .exe would be running according to me . when I copied the .exe file to the current folder and restarted the service I got a message saying : The file or Directory is corrupted and unreadable .. I then tried to change my .exe file as per Task#3 we can see the TryHackMe named the file Advanced.exe , which I don't really understand because the .exe specify from the path from the windows machine ends up by ASCService.exe Anyway I did another payload anyway with that name and even if the service restarts properly, im not getting any higher privilege. I'm still the same user bill I was thinking then maybe I should put a listener on my port# that I specified in my msfvenom payload but still no answer. I feel kinda stuck here .. any help ?

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

lament osprey Apr 15, 2020, 10:59 PM

#

anyone have issues with Blue/Windows machine?

final vault Apr 15, 2020, 10:59 PM

#

@hazy ruin you don’t understand the exploit

#

It’s unquoted path meaning the exploit has to be advanced.exe

lament osprey Apr 15, 2020, 11:00 PM

#

📎 Capture.JPG

#

rebooted a few times but every time exploit wont run

hazy ruin Apr 15, 2020, 11:01 PM

#

@final vault okay I see, but I did with Advanced.exe . when I restart the service I get nothing

#

Guess I'll try again then

opal mortar Apr 15, 2020, 11:47 PM

#

hey, i'm unable to connect to the vulnversity webserver on my browser, using mozilla.

#

i can ping it with nmap though

#

i can't find port 80 in my nmap scan, however

sacred barn Apr 15, 2020, 11:51 PM

#

@opal mortar You need to figure out [Task 2] Question #7. don't post the answer here

opal mortar Apr 15, 2020, 11:52 PM

#

thanks

split vector Apr 16, 2020, 1:50 AM

#

@lament osprey Sometimes it works if you type exploit -j and then wait.