#offensive-pentesting-path | TryHackMe | Page 10

valid tundra Jul 14, 2020, 5:18 PM

#

so in "real life" we'd have to wait for the backup job to happen

dense root Jul 14, 2020, 5:24 PM

#

Yep! In the box too you have to wait for the job to happen

valid tundra Jul 14, 2020, 5:25 PM

#

ok thank you, it's clear now

dense root Jul 14, 2020, 5:27 PM

#

Any time 🙂

ruby tulip Jul 15, 2020, 1:47 PM

#

So in this Lord of the root box, after i got the "hidden service" port, it's supposed to have some "user credentials" on there

#

https://pastebin.com/ywVFUVz4

Pastebin

sdasdadas - Pastebin.com

#

this is what i've enumerated so far, and i'm running a nikto scan

#

i've looked into /images directory and downloaded and ran steghide with no passphrase on them

#

anything else im missing?

dense root Jul 15, 2020, 1:50 PM

#

have you gone out to the website and tried visiting some other directories?

ruby tulip Jul 15, 2020, 1:50 PM

#

the index is blank with a single image on it

dense root Jul 15, 2020, 1:51 PM

#

did you look anywhere else besides the index?

ruby tulip Jul 15, 2020, 1:51 PM

#

in the /images

dense root Jul 15, 2020, 1:51 PM

#

anywhere else?

ruby tulip Jul 15, 2020, 1:51 PM

#

the /server-status returns 403 forbidden

dense root Jul 15, 2020, 1:53 PM

#

how about a common directory that maybe has a login page or something

ruby tulip Jul 15, 2020, 1:53 PM

#

well i only know the directories

#

that gobuster returned and there are only 3

dense root Jul 15, 2020, 1:53 PM

#

mmk, so maybe try one that gobuster didnt return?

#

gobuster isnt omniscient

ruby tulip Jul 15, 2020, 1:54 PM

#

okay imma run /usr/share/dirb/wordlists/big.txt then come back

dense root Jul 15, 2020, 1:54 PM

#

you dont need to directory bust more

#

just do some manual enumeration

#

on random directories

ruby tulip Jul 15, 2020, 1:55 PM

#

how should i do that

#

type /admin /login /stuff?

#

that's what you mean?

dense root Jul 15, 2020, 1:55 PM

#

try it and see what happens

#

it is a lord of the rings theme

#

maybe try something LOTR related

ruby tulip Jul 15, 2020, 1:58 PM

#

well

#

there's a picture that shows insted of a 404 error

#

in the source code there's a flag

#

or something

dense root Jul 15, 2020, 1:59 PM

#

sounds like progress to me 🙂

ruby tulip Jul 15, 2020, 1:59 PM

#

yea it's base64 and after decoding that

#

haha

#

you know how the base64 has the == at the end

#

they used it to make it look like this = closer! and that's also a flag

#

thats funny

#

brb

ruby tulip Jul 15, 2020, 2:32 PM

#

okay pwned

#

@dense root can you explain me what this is talking about "what's the method to exploit the system for privilege escalation"

#

i've exploited the kernel since it was outdate

#

but this is looking for a specific answer like Kernel explotigin or stuff like that isn't right

wet sierra Jul 15, 2020, 2:34 PM

#

It’s more of general term for the type of exploit

#

if you actually look at the source code you can tell what it is

dense root Jul 15, 2020, 2:35 PM

#

^, i think they also actually intended people to exploit it a different way through ||those binaries|| @wet sierra

ruby tulip Jul 15, 2020, 2:36 PM

#

yea

#

they have also a buffer overflow

#

in there

#

let me check that see if that works

#

📎 unknown.png

#

lmao

dense root Jul 15, 2020, 2:37 PM

#

😄

ruby tulip Jul 15, 2020, 2:37 PM

#

that was the answer

dense root Jul 15, 2020, 2:37 PM

#

yea, i think that was the intended path

ruby tulip Jul 15, 2020, 2:37 PM

#

yea

#

i don't know buffer overflow

#

i need to study that

#

im so affraid of it tho

dense root Jul 15, 2020, 2:37 PM

#

lol nothing to be afraid of

ruby tulip Jul 15, 2020, 2:39 PM

#

god i hate oracle virtualbox so much

#

it blocks when i click stuff

#

it starts to bug after 2h of using

covert scarab Jul 15, 2020, 4:18 PM

#

Maybe it’s your install. Nothing occurred for me and I use it for hours at a time.

valid tundra Jul 15, 2020, 8:46 PM

#

my virtualbox is working very fine

haughty isle Jul 16, 2020, 2:07 PM

#

Anyone in mood to help?

#

If you have access to a sysadmin (sa) account on mssql but realize it's running as "nt service\mssqlserver". Is there a way to elevate the privs if bind/reverse shelling is not an option?

noble glacier Jul 16, 2020, 2:15 PM

#

@haughty isle Have you tried something like xp_cmdshell? Maybe create a new user through it 🤔

#

Enumerate the db using msf too while you're at it

haughty isle Jul 16, 2020, 2:16 PM

#

Yes, however the nt service\mssqlserver account runs in lower privs at the system level

noble glacier Jul 16, 2020, 2:16 PM

#

Enumerate the db using msf

haughty isle Jul 16, 2020, 2:17 PM

#

I have full access to sysadmin(sa) account already

noble glacier Jul 16, 2020, 2:17 PM

#

Still, make sure to enum the db

#

Through, may I ask what machine this is? I don't believe this is a THM machine? Is it one from HTB?

haughty isle Jul 16, 2020, 2:22 PM

#

No mate, am on a live client engagement

#

Gained access via fortissl vpn. There is limited traffic on the internal LAN and both bind/reverse shell can't work. The MSSQL server is my only foothold ATM. However it's very restricted since it's running as nt service\mssqlserver and not nt system

smoky blaze Jul 16, 2020, 3:53 PM

#

why the name change from OSCP to Offensive Pentesting?

keen iris Jul 16, 2020, 3:55 PM

#

Because it doesn't focus on oscp

#

Because there are more certs

frigid socket Jul 18, 2020, 12:52 PM

#

Hello, is there anyone on Learning Path following the web fundamentals Path that could give me a hand on an issue I’m facing with the Authenticate Room Task 4? Is this the right room for help 1st of all?

dense root Jul 18, 2020, 12:55 PM

#

This is for the offensive pentesting path

#

You can ask over in room help/hints 🙂

frigid socket Jul 18, 2020, 3:57 PM

#

got you, thank you sir

cosmic veldt Jul 18, 2020, 8:29 PM

#

Hello all, I’m in the openvpn room, from access page it’s showing that I’m connecting to the network but I’m not able to access the machine that I have deployed in task 6
any idea what’s the issue?

keen iris Jul 18, 2020, 8:29 PM

#

#site-support you're not actually connected properly

cosmic veldt Jul 18, 2020, 8:38 PM

#

@keen iris it’s showing connected and I get response when I ping the this IP

📎 image0.jpg

keen iris Jul 18, 2020, 8:39 PM

#

That's pinging your machine from your machine

#

Which tends to work

#

Move to #site-support

#

Don't trust the access page

#

Ever.

cosmic veldt Jul 18, 2020, 8:39 PM

#

okay then, thanks @keen iris

haughty isle Jul 19, 2020, 2:15 PM

#

Is there a way i recursively download file via xp_cmdshell in mssql?

dense root Jul 19, 2020, 2:20 PM

#

Google knows

haughty isle Jul 19, 2020, 2:35 PM

#

Coming here is a sign that can't find anything from him

dense root Jul 19, 2020, 2:51 PM

#

https://stackoverflow.com/questions/9624600/sql-code-to-download-a-file-from-an-ftp

Stack Overflow

SQL code to download a file from an FTP

Does anyone have a way I can download a file from an FTP using SQL Server 2008 (don't want to use SSIS)?

Is there a better way to do this than using SQL?

haughty isle Jul 19, 2020, 2:59 PM

#

That's from an ftp server.......what am looking for is via xp_cmdshell local to remote with no option for running a webserver from the mssql server

dense root Jul 19, 2020, 3:00 PM

#

🤷

#

i got nothin else then

#

sorry

noble glacier Jul 19, 2020, 3:01 PM

#

Upload nc.exe and transfer files using it? 🤔

rancid vine Jul 19, 2020, 4:00 PM

#

What room does this pertain to?

noble glacier Jul 19, 2020, 4:24 PM

#

It's not a room, I don't think any of the rooms have something like xp_cmdshell,
Yeah, they told me earlier it was a pentest engagement 🤷

haughty isle Jul 20, 2020, 11:31 AM

#

Yes.... it's a pentest engagement

topaz yoke Jul 20, 2020, 1:45 PM

#

We don't offer advice on items outside of TryHackMe, let alone pentest engagements. You can ask elsewhere for that

#

@haughty isle

haughty isle Jul 20, 2020, 4:53 PM

#

Noted

#

If i get the time i would love to build a box with similar challenges. If anyone is to apply knowledge from THM in real life engagements they will quickly notice that a lot changes. However the knowledge one gains from such is invaluable.

twilit field Jul 24, 2020, 7:51 PM

#

which one i should choose to improve network pentest skills?

wet kernel Jul 25, 2020, 3:25 AM

#

I really don't think you need to take a networking certification for your pen testing needs

wet sierra Jul 25, 2020, 3:34 AM

#

he’s not talking about certs I think he’s either talking about rooms or paths and Id have to disagree with that statement as a lot of networking certs can be very useful for penetration testing

wet kernel Jul 25, 2020, 4:09 AM

#

I thought this was career channel and yeah they are useful but not necessary to get started at the beginner stage

twilit field Jul 25, 2020, 4:41 AM

#

sorry I didn't say it clearly. I'm looking for rooms in tryhackme that focuses more on network pentest

tawdry wharf Jul 25, 2020, 7:14 AM

#

Im connecting to VPN but i cant seem to ping Jenkins in the offensive path

#

any idea why?

rancid vine Jul 25, 2020, 7:23 AM

#

Did you read the description for the machine?

wet kernel Jul 25, 2020, 7:24 AM

#

https://i.imgur.com/3B231J4.png

Imgur

tawdry wharf Jul 25, 2020, 7:58 AM

#

So is that the reason why i cant even nmap?

covert scarab Jul 25, 2020, 8:03 AM

#

No you should still be able to use nmap

wet kernel Jul 25, 2020, 8:14 AM

#

nmap tells you what you need to do if the machine doesn't respond to pings

rancid vine Jul 25, 2020, 1:12 PM

#

If you haven't figured it out yet, try using the -Pn flag.

sinful willow Jul 25, 2020, 8:22 PM

#

evening all 🙂

midnight birch Jul 26, 2020, 5:12 AM

#

Can anyone answer a question regarding the Brainpan-1 room? There's a note on the "Offensive Pentesting" path which says "This room has been locked until flags are implemented." It doesn't seem like the room is locked, because I was able to join it and deploy a box and get pretty far into it, but based on my results (it's true there don't seem to be any flags), I'm wondering if the room can actually be completed? I guess my confusion stems from there seeming to be more challenges/stages in the actual box than there are associated tasks on the room's page.

dense root Jul 26, 2020, 11:45 AM

#

@midnight birch that’s correct you can still do the box it just doesn’t have flags

#

Just pretend it does and you’ll be fine 🙂

midnight birch Jul 26, 2020, 2:57 PM

#

Great, thanks. It seemed to be going in a confusing direction and I got worried I was putting my efforts into a WIP kind of situation. 🙂

dense root Jul 26, 2020, 3:00 PM

#

if you ask some questions, i can help you if you want

#

the box still has the normal foothold/privesc type deal, it just is lacking flags to prove youve done it

midnight birch Jul 26, 2020, 3:52 PM

#

I don't feel stymied yet. I hadn't been paying close enough attention so what I thought was going to be a privesc to root was instead to a non-root account, I assume there's just more steps from there that I need to take

dense root Jul 26, 2020, 3:53 PM

#

so you already successfully completed the BoF, right?

midnight birch Jul 26, 2020, 3:53 PM

#

yeah and then similar BoF on the setuid binary

#

or maybe that's not even the direction to go in, idk. it stuck out to me so I went for it 😄

dense root Jul 26, 2020, 3:53 PM

#

you dont need to do a BoF on the binary

#

just look at what it does

midnight birch Jul 26, 2020, 3:54 PM

#

do you mind if I PM you

dense root Jul 26, 2020, 3:55 PM

#

sure

valid sandal Jul 27, 2020, 3:00 PM

#

how do I update my level manually?

covert scarab Jul 27, 2020, 3:01 PM

#

!verify dm to the bot

fallen herald Jul 27, 2020, 8:05 PM

#

is the intro x86 room helpful for learning buffer overflow techniques?

keen iris Jul 27, 2020, 8:06 PM

#

It's designed for RE IIRC

#

RE is a part of BoF, learning assembly and how functions work

#

Calling conventions etc

fleet wedge Jul 27, 2020, 8:13 PM

#

Yeah, it helps a lot to understand Assembly/how machines work if you want to learn BOF

#

Technically introx86 could teach you assembly, but only as far as you're willing to research into it

#

Just know though, RE and Assembly is not for the faint of heart.

#

You probably will give up- and that's kinda normal. Don't be afraid to ask questions if you get stuck or become clueless!

fallen herald Jul 27, 2020, 8:23 PM

#

@fleet wedge funny u mention that cus i just gave up on the if statements task lol. ill have to revist when i have some more patience to research 😞 still pretty ignorant with assembly

fleet wedge Jul 27, 2020, 8:26 PM

#

Haha, told ya

#

Feel free to ask questions in #room-help if you need a bit of pushing

crimson jungle Jul 27, 2020, 8:32 PM

#

My internet was out today what did I miss I am not sure which room I should have signed up for

keen iris Jul 27, 2020, 8:34 PM

#

??

#

For the bootcamp?

crimson jungle Jul 27, 2020, 8:34 PM

#

Yes that’s correct

keen iris Jul 27, 2020, 8:35 PM

#

@chrome valve can you follow that up?

chrome valve Jul 27, 2020, 8:36 PM

#

@crimson jungle Do you have a link to the TryHackCIT discord server?

#

The resources that were used are all in there

#

(Including a full recording)

fleet wedge Jul 27, 2020, 8:36 PM

#

Also, if you go to the TryHackCIT twitch, the VOD of today's broadcast is still there

crimson jungle Jul 27, 2020, 8:37 PM

#

I think I am on the sever right now if I’m not mistaken

chrome valve Jul 27, 2020, 8:37 PM

#

You're in the TryHackMe discord server

#

There's a separate one for the event

crimson jungle Jul 27, 2020, 8:38 PM

#

Where would I find it

chrome valve Jul 27, 2020, 8:38 PM

#

I can message you a link if you'd like?

crimson jungle Jul 27, 2020, 8:39 PM

#

That would be nice

chrome valve Jul 27, 2020, 8:40 PM

#

There you go 🙂

crimson jungle Jul 27, 2020, 8:40 PM

#

I can’t see the link

#

I think I found it

elfin lagoon Jul 28, 2020, 7:57 AM

#

Hi,

I am on my second attempt to gain root on Kenobi and either missing a step or the box isn't playing ball!

I have identified the SUID as /usr/bin/menu

Used echo, chmod, and exported the PATH:

echo /bin/sh > curl | chmod 777 curl | export PATH=/tmp:$PATH

Now this should give me root? Instead this does not escalate my privs.

I think may be I am not understanding the $PATH correctly should this be something personal to my machine? (like kenobi's ip)

fleet wedge Jul 28, 2020, 8:01 AM

#

No, the /tmp:$PATH appends /tmp to the rest of the original $PATH

#

so /tmp will be a part of $PATH

#

I'm not familiar with Kenobi but you probably have to do something with the menu file

elfin lagoon Jul 28, 2020, 8:05 AM

#

Ok thanks, so the export PATH=/tmp:$PATH is adding /bin/sh to the path of the user (kenobi not root) allowing root privs?

Currently:

📎 unknown.png

#

This is the stage I believe it should be escalated

dense root Jul 28, 2020, 11:33 AM

#

Look at where you put curl and then look at what you’re adding to the path

#

Is your curl on the path you’ve added?

#

@elfin lagoon

elfin lagoon Jul 28, 2020, 11:53 AM

#

ill fire it up again, so should the be something like PATH=/kenobi:$PATH

#

Great thank you manage to see where i was going wrong, as i suspected didnt fully understand the PATH=/<PWD>:$PATH

#

Thank you both for replies 🙂 wont ping you as not sure if that will annoy you ha

fierce kettle Jul 28, 2020, 12:38 PM

#

Question on retro box , can t login with xfreerdp /u:wade /p:farzaval /v:10.10.16.176 ( gives cert error, and does not work when click Yes , on msrdp i gat similar error

📎 unknown.png

dense root Jul 28, 2020, 12:46 PM

#

@elfin lagoon you can always ping me. Glad you got it figured out, do you understand what’s going on better now?

#

@fierce kettle double check your credentials

fierce kettle Jul 28, 2020, 12:47 PM

#

http://10.10.38.234/retro/wp-admin/theme-editor.php?file=404.php&theme=twentyseventeen reverse shell is working fine on retro ( the credentials i use are wade / parzival and working there fine )

dense root Jul 28, 2020, 12:48 PM

#

Look at your rdp command now. Specifically the password you tried to use

noble glacier Jul 28, 2020, 12:51 PM

#

Try using something like remmina 🤔

elfin lagoon Jul 28, 2020, 12:53 PM

#

I think so, earlier in the walkthrough i made a dir called kenobiNFS and not /mnt/kenobiNFS so this confused me a little.

But for this section by exporting the path of /bin/sh to kenobi PWD then running the command /usr/bin/menu they system uses /usr/bin/menu privileges? Prob not a good description but ball parkish

dense root Jul 28, 2020, 12:56 PM

#

Yes, it basically uses the privileges given to menu. Which I’m this case menu has the SUID bit set so it’s running as root. And since menu is calling curl, menu runs curl as root

#

But it’s not calling the absolute path and so you prepended that path with your own curl

#

So then it ran your curl from menu with the SUID, so it ran as root

#

@elfin lagoon

elfin lagoon Jul 28, 2020, 12:58 PM

#

ah ok, which explains why it wasnt working originally as i was pretending to be someone without root privs

dense root Jul 28, 2020, 12:59 PM

#

No it wasn’t working originally because the path you were prepending didn’t have your curl in it

#

So it was still calling the original curl

#

You made curl in the users home directory and then you add /tmp to the path

#

So it looked in tmp, found nothing and moved on to the regular path

elfin lagoon Jul 28, 2020, 1:02 PM

#

right im with you, hmm on the successful attempt i used
echo /bin/sh > curl chmod 777 curl export PATH=/home/kenobi:$PATH

So now curl can be found in kenobi's path?

dense root Jul 28, 2020, 1:06 PM

#

It depends where you executed that echo command

#

If you did it in /home/kenobi then yes

elfin lagoon Jul 28, 2020, 1:09 PM

#

Great makes more sense now, thanks again!

dense root Jul 28, 2020, 1:11 PM

#

Any time

fleet wedge Jul 28, 2020, 3:00 PM

#

I am redoing VulnUniversity and getting a weird result on the burp fuzzing part

#

It says "success" for .phtml extension but also says "not allowed". Any ideas?

#

📎 unknown.png

#

📎 unknown.png

#

What does the request look like?

#

It looks like you've set up multiple payload positions

#

so the first one of "Not Allowed" probably put the .phtml in the wrong place.

#

hmm, YOu may be right

#

let me try again

#

It helps to clear all payload positions, then just manually add in the weird looking $ symbols where the file-name is

#

That did the trick!

#

Thanks for the quick reply and for the advice.

#

No problem!

fleet wedge Jul 29, 2020, 12:02 AM

#

can someone please give me a nudge with Vulnversity priv escalation?

#

I don't really know what should I do with the SUID

dense root Jul 29, 2020, 12:07 AM

#

Have you done the common Linux privesc room?

fleet wedge Jul 29, 2020, 12:16 AM

#

was looking for a more straight answer about this particular box

#

No, I can take a look later, but would like to get a nudge on this one 1st

rancid vine Jul 29, 2020, 12:38 AM

#

Have you looked at a writeup for the room?

fleet wedge Jul 29, 2020, 12:49 AM

#

Thanks for reply. I watched the video and it was not clear. He basically uses the exploit to read the flag but does not escalate priv to root

rancid vine Jul 29, 2020, 1:56 AM

#

https://gtfobins.github.io/gtfobins/systemctl/

#

Might check that out as well.

fierce kettle Jul 29, 2020, 9:28 AM

#

@dense root can you confirm that parzival is the wrong rdp password for wade at retro, because i still can wp-login.php as that user, but rdp,xfreerdp and remmina all fail on connecting with a credssp error.

wet kernel Jul 29, 2020, 11:38 AM

#

Unless the room broke in last couple weeks, that password is right

dense root Jul 29, 2020, 12:10 PM

#

Can you show the exact command you’re using

#

@fierce kettle

fierce kettle Jul 29, 2020, 1:47 PM

#

@dense root i think the problem is on box https://support.microsoft.com/en-us/help/4295591/credssp-encryption-oracle-remediation-error-when-to-rdp-to-azure-vm , this is the error

📎 unknown.png

dense root Jul 29, 2020, 1:52 PM

#

Can you try xfreerdp and show the exact syntax you’re using please?

fierce kettle Jul 29, 2020, 1:54 PM

#

i have solved it thanks for trying to help .. the solution is at https://www.netwoven.com/2018/05/15/solved-credssp-encryption-oracle-remediation/

Netwoven

Priyam Ghosh

[Solved] CredSSP Encryption Oracle Remediation | Netwoven

A remote code execution vulnerability exists in the Credential Security Support Provider protocol (CredSSP). An attacker who successfully exploited this vulnerability could relay user [···]

dense root Jul 29, 2020, 2:11 PM

#

@fierce kettle it worked for me anyway

📎 unknown.png

#

i think you were using the wrong credentials

fierce kettle Jul 29, 2020, 7:12 PM

#

Nope credssp-encryption-oracle-remediation/ was the solution for me on retro

dense root Jul 29, 2020, 7:13 PM

#

That’s a local VM problem then is all I’m saying

#

The box is working fine

fleet wedge Jul 30, 2020, 3:55 PM

#

anyone done Lord of the root?

noble glacier Jul 30, 2020, 3:55 PM

#

Yes

dense root Jul 30, 2020, 3:55 PM

#

just ask your question 🙂

fleet wedge Jul 30, 2020, 3:56 PM

#

okay cool : D

#

well

#

need a little push for root

#

i see this file script, it doesnt give me any output whatsoever apart from:

./file <input strings> if you run it by itself

#

but giviing it /etc/passwd or any gibberish gives blank outputs

#

ran ltrace and strace to see if i see anything but it just looks like the actual "file" binary

dense root Jul 30, 2020, 3:58 PM

#

@noble glacier doesnt that take a little RE if you choose to go down that path?

noble glacier Jul 30, 2020, 3:58 PM

#

Pwn to be precise.

fleet wedge Jul 30, 2020, 3:59 PM

#

oh if theres multiple ways and this one is RE - im definitely looking for the other method lool

noble glacier Jul 30, 2020, 3:59 PM

#

If you are just starting out with pwn I don't recommend doing it.

fleet wedge Jul 30, 2020, 3:59 PM

#

I will never touch RE for many years to come

dense root Jul 30, 2020, 3:59 PM

#

you should give it a shot

fleet wedge Jul 30, 2020, 3:59 PM

#

il look for another route, this one stuck out like a sore thumb due to the SECRET folder

dense root Jul 30, 2020, 3:59 PM

#

not on that box, but just in general

noble glacier Jul 30, 2020, 4:00 PM

#

RE and pwn are very important

fleet wedge Jul 30, 2020, 4:00 PM

#

lol nah true you're right - definitely want to learn it at a basic level at least but not anytime soon 🙂

#

thank u guys for clarification

undone jacinth Jul 31, 2020, 12:42 AM

#

did new OSCP get rid of bonus from completing lab report

real sandal Jul 31, 2020, 12:44 AM

#

No

hardy wing Jul 31, 2020, 7:06 AM

#

does any1 know if lord of the root got locked indefinitely or is just down for some kind of maintenance?

keen iris Jul 31, 2020, 7:09 AM

#

It's been removed, at least for now, probably forever. Rooms don't have maintenance, you don't share instances so there's nothing to do maintenance on

hardy wing Jul 31, 2020, 7:12 AM

#

oh ok, I though maybe the kernel vuln is getting patched that RE is the only way to root it

#

at least i downloaded the binaries yesterday and can further try to exploit them

wet kernel Jul 31, 2020, 7:30 AM

#

It's been removed, at least for now, probably forever. Rooms don't have maintenance, you don't share instances so there's nothing to do maintenance on
whaaaaat. I was just about it start is sometime soon

keen iris Jul 31, 2020, 7:30 AM

#

It's still available on VulnHub afaik

noble glacier Jul 31, 2020, 7:30 AM

#

https://www.vulnhub.com/entry/lord-of-the-root-101,129/

Lord Of The Root: 1.0.1

wet kernel Jul 31, 2020, 7:31 AM

#

awesome

brave shuttle Jul 31, 2020, 5:22 PM

#

Is that before or after mordor?

true spoke Jul 31, 2020, 9:57 PM

#

Hello can anyone please tell me what does 38 hours signify in offensive pentesting learning path and is this path for OSCP preparation?

keen iris Jul 31, 2020, 9:57 PM

#

38 hours is the approximate time that the path will take

#

And no, it's not specifically for OSCP preparation. It's designed to be versatile and apply to a number of different certs.

true spoke Jul 31, 2020, 9:58 PM

#

Ohkay thank you very much👍:thumbsup:

brittle escarp Aug 1, 2020, 12:30 AM

#

Hello everyone

#

I'm new here

dense root Aug 1, 2020, 12:59 AM

#

Hi! Head on over to #general if you just wanna talk 🙂

#

If you have a specific room related question then for a hint head over to #room-hints for help #room-help

#

Or if the box is on this path then feel free to ask here

dire robin Aug 1, 2020, 2:58 PM

#

📎 unknown.png

#

Um following this guides after doing fg

#

when i press enter twice it shows ^M^M

covert scarab Aug 1, 2020, 2:59 PM

#

I’m presuming this it to stabilise your shell?

dire robin Aug 1, 2020, 2:59 PM

#

Yes

#

The shell gets borken and i gotta open new one everytime

covert scarab Aug 1, 2020, 3:01 PM

#

Possibly you can stabilise that way

#

Have you tried any other stabilisation methods to see if they work?

dire robin Aug 1, 2020, 3:02 PM

#

um i see ippsec and many other doing in this way tried but happens 😶

rancid vine Aug 1, 2020, 3:02 PM

#

I always have bad luck with those.

#

Just usually go with as much functionality as I can get with a regular command shell.

dire robin Aug 1, 2020, 3:03 PM

#

yeah but i tend to control c 😅

covert scarab Aug 1, 2020, 3:03 PM

#

There’s actually tons of ways to stabilise

#

Because sometimes you’re unable to

rancid vine Aug 1, 2020, 3:03 PM

#

If I can't get SSH I usually just go with whatever I have.

dire robin Aug 1, 2020, 3:03 PM

#

um can you link me some because if i see most of the people doing this way

#

if there's a better way

covert scarab Aug 1, 2020, 3:05 PM

#

Okay so

dire robin Aug 1, 2020, 3:08 PM

#

yeah i m waiting 🙃

covert scarab Aug 1, 2020, 3:09 PM

#

You’ll have to give me a few minutes can’t remember the link for the life of me 😂

rancid vine Aug 1, 2020, 3:10 PM

#

https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/

ropnop blog

Upgrading Simple Shells to Fully Interactive TTYs

Catching a reverse shell over netcat is great…until you accidentally Ctrl-C and lose it. These techniques let you upgrade your shell to a proper TTY

#

Might try stty raw -echo rather than -ech0 like in your notes.

dire robin Aug 1, 2020, 3:10 PM

#

i followed this only

#

used that-echoonly

rancid vine Aug 1, 2020, 3:12 PM

#

There are only so many ways to do it.

#

I've never had much luck with them in a way that wasn't completely annoying in my terminal.

dire robin Aug 1, 2020, 3:12 PM

#

me too

#

now after fg is bork again

covert scarab Aug 1, 2020, 3:13 PM

#

Yeah I literally can’t find the link 😂

dire robin Aug 1, 2020, 3:14 PM

#

^M^M again on pressing enter twice as said in article

covert scarab Aug 1, 2020, 3:14 PM

#

Give me an hour once I’m home I’ll @ you and link it

dire robin Aug 1, 2020, 3:14 PM

#

👍

covert scarab Aug 1, 2020, 3:50 PM

#

This took forever to find, I couldn’t remember which website it was haha.

https://netsec.ws/?p=337

All of these are ways to get that initial /bin/bash shell. To follow it up, background the session with CTRL + Z type stty raw -echo then foreground the session and type export TERM=xterm which will then get you all the functionality. As you may have written down

@dire robin

#

(Make sure when foregrounding the session you hit enter a few times to get the prompt back)

dense root Aug 1, 2020, 3:55 PM

#

yea, the full commands to run as @covert scarab said. @dire robin

📎 unknown.png

covert scarab Aug 1, 2020, 3:56 PM

#

You foregrounded 2x?

dense root Aug 1, 2020, 3:56 PM

#

you have to

covert scarab Aug 1, 2020, 3:56 PM

#

No??

dense root Aug 1, 2020, 3:56 PM

#

si

covert scarab Aug 1, 2020, 3:56 PM

#

I only foreground once then you hit enter twice and the prompt will load

dense root Aug 1, 2020, 3:56 PM

#

oh i guess the second foreground is me just hitting enter then haha

covert scarab Aug 1, 2020, 3:57 PM

#

Haha

tropic quartz Aug 1, 2020, 6:50 PM

#

fg
Enter
Enter
Enter(one more for good measure)

covert scarab Aug 1, 2020, 6:51 PM

#

Unless you’re me and you press it about 8 times

midnight blade Aug 1, 2020, 6:52 PM

#

~~unless you're me and don't stabilize it at all~~ Kappa

covert scarab Aug 1, 2020, 6:53 PM

#

Depends on how the day is

#

Lately I’m too lazy to stabilise I just do with what I got

tropic quartz Aug 1, 2020, 6:54 PM

#

Sometimes i avoid that whole thing because once session is dead, that window becomes a headache if stty -echoed

#

Lol

dense root Aug 1, 2020, 9:06 PM

#

I mean, you can just close that session and open another one

#

its well worth it imo, cuz you get a fully interactive shell and can just close it when you're done

tropic quartz Aug 2, 2020, 1:38 AM

#

Hoarder here

keen iris Aug 2, 2020, 7:51 AM

#

@slate reef No invite links.

pulsar shale Aug 4, 2020, 5:58 PM

#

lol why is the first part of the path marked as incomplete

#

📎 unknown.png

dense root Aug 4, 2020, 6:03 PM

#

Cuz new questions got added to those rooms

#

Go in and complete the new questions

keen iris Aug 4, 2020, 6:08 PM

#

@spark iron when you're back, probably worth removing the kali room and pointing them to my-machine instead?

spark iron Aug 4, 2020, 6:09 PM

#

Yess good idea:))

pulsar shale Aug 4, 2020, 6:14 PM

#

alright thanks all

#

@keen iris what is your machine? is it better to use than the in browser kali one

noble glacier Aug 4, 2020, 6:18 PM

#

https://tryhackme.com/my-machine

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

keen iris Aug 4, 2020, 6:21 PM

#

my-machine is the replacement for the kali room

#

It is the in browser kali

dense root Aug 4, 2020, 6:35 PM

#

Skidy also remove the access page connected rowwwwwwww

noble glacier Aug 4, 2020, 6:36 PM

#

blobno I think Skidy added a disclaimer, probably hasn't pushed the code yet 🤔

keen iris Aug 4, 2020, 6:54 PM

#

I can confirm the change was made in dev

toxic mirage Aug 4, 2020, 7:11 PM

#

Hi Everyone!
I have started solving CTF 1 month ago from different platforms, apart from that I have good knowledge in Web Application Testing. Now I am preparing for OSCP.
I am thinking to go for tryhackme subscription for Offensive Pentesting Path.
I need some guidance here

rancid vine Aug 4, 2020, 7:13 PM

#

Generally speaking, the pathway is good for preparing.

#

I think the platform in general is worth the subscription cost if you can afford it. I benefitted greatly from it.

toxic mirage Aug 4, 2020, 7:15 PM

#

Thanks a lot. Sure I want to try this site.

fallen herald Aug 5, 2020, 2:13 AM

#

are any of these rooms windows machines? im trying to make a list but dont wanna spoil anything from a writeup

peak hill
pepega
year of the rabbit
boilerctf
cmess
if not can anyone suggest some non buffer overflow windows machines? ive done blueprint, hackpark, ice, blaster, anthem, AD, corp, blue, steel mountain, alfred so far

dense root Aug 5, 2020, 2:16 AM

#

#general

#

But to answer your question I haven’t done pepega or boiler

#

But I think the other 3 are Linux

#

Don’t entirely remember

mighty jay Aug 5, 2020, 3:32 AM

#

So I’m doing the offensive path but had to do the burp part real quick. I’m doing burp suite and I get to a step that states “with the burp proxy on submit feedback. Once this is done find the post request in your http history in burp and send it to repeater”

#

Where is the submit feedback option for burpsuite?

keen iris Aug 5, 2020, 3:32 AM

#

Submit feedback in the webapp

mighty jay Aug 5, 2020, 3:47 AM

#

Thanks. It didn’t seem clear to me. Maybe it means I need to head to bed 😂

keen iris Aug 5, 2020, 3:47 AM

#

I really recommend sleep

#

Sleep deprivation is very bad

rancid vine Aug 5, 2020, 3:53 AM

#

Slickmmarek a new Windows room is coming on the 20th. I know it's a couple weeks away

keen iris Aug 5, 2020, 3:54 AM

#

21st for yours?

rancid vine Aug 5, 2020, 4:01 AM

#

One of those

dense root Aug 5, 2020, 11:44 AM

#

I really recommend sleep
@keen iris ironic

loud badger Aug 5, 2020, 5:25 PM

#

Sleep is good

gentle blaze Aug 5, 2020, 5:25 PM

#

Sleep ? What is this thing ?

keen iris Aug 5, 2020, 5:25 PM

#

ironic
@dense root I sleep 8-10 hours a night

noble glacier Aug 5, 2020, 5:26 PM

#

😴

dense root Aug 5, 2020, 5:26 PM

#

@dense root I sleep 8-10 hours a day
@keen iris

#

FTFY

keen iris Aug 5, 2020, 5:26 PM

#

I mean, per 24 hour span

#

It's night somewhere

dense root Aug 5, 2020, 5:27 PM

#

I used to get 9 hours of sleep a night

#

Then I got dog

#

Now 7-8

noble glacier Aug 5, 2020, 5:27 PM

#

🐱

silk oyster Aug 6, 2020, 8:05 PM

#

HI i'm a beginner in this domain, I need help !

dense root Aug 6, 2020, 8:05 PM

#

read channel descriptions please 🙂

#

head over to #general

silk oyster Aug 6, 2020, 8:06 PM

#

Thank you very much !

#

read channel descriptions please 🙂
@dense root Want to be my friend ?

dense root Aug 6, 2020, 8:09 PM

#

i like friends, so yea ill be your virtual friend. But still please head over to #general

silk oyster Aug 6, 2020, 8:11 PM

#

i like friends, so yea ill be your virtual friend. But still please head over to #general
@dense root Okay I understood

#

i like friends, so yea ill be your virtual friend. But still please head over to #general
@dense root Please accept my friend request !

#

🙂

dense root Aug 6, 2020, 8:16 PM

#

blobno

#

@noble glacier assist with your blob no plz

noble glacier Aug 6, 2020, 8:39 PM

#

blobno

silk oyster Aug 6, 2020, 10:14 PM

#

@noble glacier assist with your blob no plz
@dense root What is blob ?

keen iris Aug 6, 2020, 10:14 PM

#

#general

silk oyster Aug 6, 2020, 10:14 PM

#

You are not so cool !

#

#general
@keen iris Okay I did it !

#

#general
@keen iris Please accept my friend request !

covert scarab Aug 6, 2020, 10:18 PM

#

I doubt James will accept you if you keep going against his instructions of moving to General.

silk oyster Aug 6, 2020, 10:23 PM

#

Okey I obey right now !

marble ivy Aug 7, 2020, 10:41 AM

#

Doing the Skynet room. Worked out great till I tried to escalate, anyone I can talk with so as not to spoil things?

#

hmm.. ofc the moment I say this...

#

I think I may have found a typo

#

lol yep

#

nevermind 😄

carmine wagon Aug 8, 2020, 8:25 PM

#

anyone pls help me
Hackpark - Task 4 Question 2
nothing from sysinfo fits in answer form. maybe a little hint available for input formatting? thanks in advance

dense root Aug 8, 2020, 8:28 PM

#

Did you run the enumeration scripts?

carmine wagon Aug 8, 2020, 8:29 PM

#

yes, windows-exploit-suggester

#

oh, maybe it's not enough

dense root Aug 8, 2020, 8:36 PM

#

Should be

#

Did you look at the information you passed to exploit suggester?

carmine wagon Aug 8, 2020, 8:39 PM

#

sure, 'OS Version' doesn't fit in answer form

dense root Aug 8, 2020, 8:50 PM

#

What does it say for that?

carmine wagon Aug 9, 2020, 9:32 AM

#

it says :
OS Version: x.3.xx00 N/A Build xx00

ornate flax Aug 9, 2020, 9:34 AM

#

Can someone help me with Retro? I am in privesc but the exploit doesn’t seem to work

wet kernel Aug 9, 2020, 9:49 AM

#

Sure @ornate flax Ask your question in #room-help

past basin Aug 10, 2020, 6:16 PM

#

hi

rancid vine Aug 10, 2020, 6:22 PM

#

@keen iris

noble glacier Aug 10, 2020, 6:22 PM

#

👀

keen iris Aug 10, 2020, 6:23 PM

#

@past basin Please don't post flags.

noble glacier Aug 10, 2020, 6:24 PM

#

@past basin Where did you find that room? It was made private if I recall 🤔

past basin Aug 10, 2020, 6:25 PM

#

sorry

#

i joined through tryhackme

noble glacier Aug 10, 2020, 6:26 PM

#

It doesn't show up on hacktivities👀

keen iris Aug 10, 2020, 6:26 PM

#

...is there any other way to join?

mighty jay Aug 10, 2020, 8:02 PM

#

So I am doing the burp suite room. I am on task 10. It states to click around till you get a request header that includes “set-cookie”. I’ve clicked on everything and didn’t see this type of request under the proxy/http history tab

keen iris Aug 10, 2020, 8:08 PM

#

You need to be looking at responses

#

Set-Cookie is a header set in responses, not requests

mighty jay Aug 10, 2020, 10:10 PM

#

Thank you for the help.

median spade Aug 11, 2020, 1:00 AM

#

hi

rancid vine Aug 11, 2020, 1:01 AM

#

Hello shub. Do you have a question about a room in the Offensive Pentesting path?

median spade Aug 11, 2020, 1:02 AM

#

need help related to
OSCP Buffer Overflow Prep

rancid vine Aug 11, 2020, 1:02 AM

#

Please be specific about which Room task, and your question in the future when asking. 🙂

#

Also, keep in mind that it's a brand new room, and we may not have an answer yet..

#

That said, what is the issue you're having?

median spade Aug 11, 2020, 1:04 AM

#

its about the room "oscp buffer overflow prep" in overflow1 its about the bad characters

rancid vine Aug 11, 2020, 1:04 AM

#

Ok. What about them?

median spade Aug 11, 2020, 1:04 AM

#

i have checked twice

#

its wrong

rancid vine Aug 11, 2020, 1:04 AM

#

What is wrong?

median spade Aug 11, 2020, 1:04 AM

#

the bad characters i am getting are not the flags

#

i mean to say ans

#

can i tell you the bad characters i am getting ?

#

just want to verify i am wrong to right

#

i am new

rancid vine Aug 11, 2020, 1:09 AM

#

Can you take a screenshot of the dump?

#

I can take a look, otherwise I have to spawn the machine and do it myself.

median spade Aug 11, 2020, 1:09 AM

#

yes just a min

#

📎 Capture.PNG

rancid vine Aug 11, 2020, 1:12 AM

#

Can you take a screenshot of the dump, not the way the room has you do it?

#

You will have to right click on ESP in the Registers in Immunity Debugger, and select Follow in Dump.

median spade Aug 11, 2020, 1:14 AM

#

yes

rancid vine Aug 11, 2020, 1:16 AM

#

Ok, I figured it out with the above.

#

I really don't like that method.

#

Whatever the room has you doing with that mona module, it spits out a correct bad character, and an incorrect one. The hint says that bad characters affect the next byte as well, so the tool responds with the correct bad character, followed by one that isn't bad.

#

So in this case, the correct answer is \x00\x07\x2e\xa0

\x00 is always considered a bad character. The next three are correct, while the ones that come after each one respectively are incorrect.

median spade Aug 11, 2020, 1:19 AM

#

📎 unknown.png

#

ok got it

#

i was considering all 7 bad characters

rancid vine Aug 11, 2020, 1:20 AM

#

I don't like that way. I would consider both of them bad characters.

median spade Aug 11, 2020, 1:20 AM

#

thaks

#

y i did the same

#

ya

#

but in dump 07 and 08 ?

#

is 0A and 0D

#

ok iwill try thanks

rancid vine Aug 11, 2020, 1:35 AM

#

So I had to use all of those bad characters in order to get the payload to work and get a shell.

#

That said, it worked without the entire string of bad charactres as well.

long vector Aug 11, 2020, 5:10 PM

#

trying to do Daily Bugle, and I download and run joomblah.py to try and get credentials and I run into this error, any tips?

📎 unknown.png

#

I'm downloading the same file everyone else in on write ups and videos...

dense root Aug 11, 2020, 5:11 PM

#

#room-help message

#

@long vector

long vector Aug 11, 2020, 5:12 PM

#

@dense root oh my gosh thank you!

dense root Aug 11, 2020, 5:12 PM

#

Oh my lawdy you’re welcome 😉

wild quest Aug 11, 2020, 6:29 PM

#

Hi, can someone recommend the next path after Complete Beginner? Can we start with Offensive Pentesting?

dense root Aug 11, 2020, 6:33 PM

#

you can 🙂

#

it depends what you wanna do

#

but this path isnt a bad place to go 😄

wild quest Aug 11, 2020, 6:50 PM

#

Just wanted to know if there are some other rooms recommended before I start with this path

keen iris Aug 11, 2020, 6:51 PM

#

I'd do the primer rooms tbh

#

At least the red primer

wild quest Aug 11, 2020, 6:52 PM

#

ok. thanks

arctic raptor Aug 12, 2020, 7:19 AM

#

Hi, Im doing "Kenobi" Room.

I have queries on the privilege escalation portion. Why is it that when "/usr/bin/menu" was run, it will look for the curl binary we created in the tmp folder ? Shouldn't it look for menu binary instead? Can anyone help me understand me the logic behind this ?

covert scarab Aug 12, 2020, 7:36 AM

#

When you run /usr/bin/menu it gives three options. I’m sure that two of those options use curl to get information that you have requested by selecting a number.

All this is done as root so what you are doing is creating a file named curl with your netcat reverse shell in it. When you run the /usr/bin/menu file a second time, the file is finding your fake “curl” binary and is running whatever is inside as root. This then sends you the reverse shell for privilege escalation.

@arctic raptor

arctic raptor Aug 12, 2020, 7:40 AM

#

When you run /usr/bin/menu it gives three options. I’m sure that two of those options use curl to get information that you have requested by selecting a number.

All this is done as root so what you are doing is creating a file named curl with your netcat reverse shell in it. When you run the /usr/bin/menu file a second time, the file is finding your fake “curl” binary and is running whatever is inside as root. This then sends you the reverse shell for privilege escalation.

@arctic raptor
@covert scarab Many thanks for the clear explanation. I appreciate it very much. :))

bright oxide Aug 13, 2020, 3:14 AM

#

Rooms path to OSCP? Guys? There's some recommendation? I have this one

📎 unknown.png

keen iris Aug 13, 2020, 3:15 AM

#

Have you checked the Offensive Pentesting Path?

rancid vine Aug 13, 2020, 3:17 AM

#

📎 oscp_prep_list.png

#

Bunch of stuff on there for THM, and what helped me.

#

Alfred isn't on my list, but it's a good one.

I have a couple rooms coming in the near future as well geared specifically for eCPPT/OSCP prep. And Tib3rius just released a BoF room.

keen iris Aug 13, 2020, 3:19 AM

#

@bright oxide I'd recommend Tib and TCM's privesc rooms, as walkthroughs

rancid vine Aug 13, 2020, 3:19 AM

#

Definitely.

bright oxide Aug 13, 2020, 3:22 AM

#

Nice!!! Thank you guys! 🙂

rancid vine Aug 13, 2020, 3:23 AM

#

Welcome. Best of luck. 🙂

bright oxide Aug 13, 2020, 3:23 AM

#

Have you checked the Offensive Pentesting Path?
@keen iris Not really, but it's one of my goals 🙂

#

@rancid vine what means VHL, vulnhub?

dense root Aug 13, 2020, 3:36 AM

#

Virtual hacking lands

keen iris Aug 13, 2020, 3:36 AM

#

Virtual Hacking Labs

rancid vine Aug 13, 2020, 3:36 AM

#

virtual hacking land. Love it.

keen iris Aug 13, 2020, 3:37 AM

#

Virtual Hacking Land seems like a cool place TBH

dense root Aug 13, 2020, 3:37 AM

#

I’ll put it back for yalls satisfaction

#

Jeez phone autocorrec

bright oxide Aug 13, 2020, 3:38 AM

#

Oh wow I didn't know that place

#

thank you then 🙂

dense root Aug 13, 2020, 3:38 AM

#

Yes it’s a great land

bright oxide Aug 13, 2020, 3:38 AM

#

A little expensive 😅

rancid vine Aug 13, 2020, 3:38 AM

#

It is. But if you can afford it it is worth it.

bright oxide Aug 13, 2020, 3:38 AM

#

Compared to THM or HTB

sterile peak Aug 13, 2020, 6:04 AM

#

anyone have issues with Retro? Tried coming in from two different VPNs, nmap finding no open ports (even with -p-). Resorted to looking at a writeup, open ports should of shown up from the basic initial nmap scan.

#

n/m let the box sit for about 15 mins, could get to it then.

keen iris Aug 13, 2020, 6:12 AM

#

What do you mean by two different VPNs?

#

@sterile peak There's only one VPN you can use. It needs to be the tryhackme VPN.

wet kernel Aug 13, 2020, 6:24 AM

#

I think he means different configs

sterile peak Aug 13, 2020, 6:27 AM

#

Yea, can come in via us vpn, or europe. I find some boxes just don't work right, so you have to try both.

#

So far retro has just been an unstable pos.

keen iris Aug 13, 2020, 6:28 AM

#

That's not something that other people struggle with, now that the VPN routing issue is fixed. Retro isn't reported to be unstable, other than potentially dying after an hour like other windows machines sometimes do

#

I'd recommend running the troubleshooting script

sterile peak Aug 13, 2020, 6:32 AM

#

@keen iris Apologies for the ignorance. What/where can I find that script?

#

n/m, just pulled the source code from github. That's a bit of "am I an idiot".

fallen herald Aug 13, 2020, 8:01 AM

#

does anyone else keep a list evaluating comfort level for each OSCP objective? its really helping me pinpoint my weak areas

frank pewter Aug 14, 2020, 7:28 PM

#

So, I've worked my way through the 8 default rooms. I've then moved on to the Learning Path entitled "Offensive Pentesting" and I was doing great until I hit Gatekeeper.

Having taken this path, I was particularly alarmed that I was at a TOTAL loss on how to approach the room once I had the executable. I mean, literally, a dead stop.

Is this worrying, or should I simply divert at this stage to another learning path? (The path does warn that if you're struggling with "basic reverse engineering concepts" then you ought to divert, but I'm so blind I don't even know if that's my issue.)

Grateful for any help.

keen iris Aug 14, 2020, 7:28 PM

#

It's a buffer overflow

frank pewter Aug 14, 2020, 7:29 PM

#

Right. So, my learning path so far has taken me nowhere near this. Just a little concerned, that's all. Is the sensible thing to do to divert my learning at this stage?

keen iris Aug 14, 2020, 7:29 PM

#

To go learn buffer overflow in order to complete a buffer overflow? Sounds sensible to me

frank pewter Aug 14, 2020, 7:30 PM

#

Yeah, fair enough. I was just wondering whether or not it was expected knowledge given the path I'd already taken. My question was more of a sanity check than anything. Cheers!

rancid vine Aug 14, 2020, 8:39 PM

#

You can use my writeup for the room as well.

trail aspen Aug 16, 2020, 12:05 PM

#

Linux privesc: This one looks up scanned SUIDs in gtfobins. https://github.com/Anon-Exploiter/SUID3NUM

If anyone knows other time-savers for the privesc checklist, please share. 🙂

GitHub

Anon-Exploiter/SUID3NUM

A standalone python script which utilizes python's built-in modules to enumerate SUID binaries, separate default binaries from custom binaries, cross-match those with bins in GTFO Bin&#...

noble glacier Aug 16, 2020, 1:51 PM

#

It has an auto-pwn flag if I recall, wouldn't recommend it for OSCP, might disqualify you since, tools that automatically pwn aren't allowed
Through you could simply not use the flag, why risk it? 🤔
Through this is now the offensive pentesting path so 🤷

rancid vine Aug 16, 2020, 1:55 PM

#

That is -e I believe.

#

Never heard of the tool until now. Kind of neat.

trail aspen Aug 16, 2020, 2:13 PM

#

It has an auto-pwn flag if I recall, wouldn't recommend it for OSCP, might disqualify you since, tools that automatically pwn aren't allowed
@noble glacier Good point. I just do this as a hobby though. 🙂

rancid vine Aug 16, 2020, 2:13 PM

#

The real world doesn't care if you auto pwn things.

#

Just the try harder parrot.

smoky stratus Aug 16, 2020, 5:53 PM

#

hi

near ginkgo Aug 16, 2020, 7:36 PM

#

Lol

shadow zealot Aug 16, 2020, 8:48 PM

#

s

lament nacelle Aug 17, 2020, 9:40 AM

#

taking the PATH now. prepare for oscp.

#

wanna ask a question about how long it will take to get the certificate? generally speaking

fleet wedge Aug 17, 2020, 9:55 AM

#

It all depends on you. You can buy 30 days lab access or 90 days lab access.

#

Or 60

lament nacelle Aug 17, 2020, 10:02 AM

#

sorry didn't make it clear

#

i meant the time before buying the PWK entry.

#

the time spent on THM or htb

#

100hrs, 200hrs?

flat linden Aug 17, 2020, 11:37 AM

#

hard to say, it all depends on your initial skill level. I have not taken the OSCP myself but have close friends which have both succeeded and failed and they are very clear that it is all about how well you structure your routines and if are good at spotting rabbitholes and go on.

#

I would definitively try to get to a level where you can nail 2-3 boxes on HTB on a daily basis before going for the OSCP. On that path remember that there are some really good pentest certs out there which benefit your path greatly.

potent belfry Aug 17, 2020, 11:39 AM

#

I did 99% of OSCP and spent a good amount of time. I'd say around 120 hours maybe? I started from a good understanding.

#

I'd suggest trying something like eJPT first to make sure you've got your chops up. If you're confident and blasting THM medium/hard rooms and can do the same on HTB (maybe just medium boxes on there). Maybe u could go straight to OSCP

real sandal Aug 17, 2020, 1:43 PM

#

Hard to give an hour count, everyone comes into PWK with a different background/understanding even if they may have sunk the same amount of hours specifically prepping for OSCP.

Just go through the prepping resources like the offensive pentesting path, checking the PWK syllabus every now and then to see how comfortable you are with some of the topics.

You also don't have to understand everything in the syllabus to sign up (it's an entry-level course designed to teach you that stuff after all). ie: watch out for overprepping

rancid vine Aug 17, 2020, 1:55 PM

#

I spent around three months preparing, but I took a different path and not the Offensive Security way. I didn't utilize the PWK or their lab environment, and instead chose to use a ton of TryHackMe, Virtual Hacking Labs, and CSL.

toxic mirage Aug 17, 2020, 3:34 PM

#

Why in Offensive Pentesting Path there are so many windows machines and very few linux machine?

keen iris Aug 17, 2020, 3:34 PM

#

Because typically Windows is harder for people

toxic mirage Aug 17, 2020, 3:36 PM

#

That's true for sure. When I started in the path, solvings windows machine feels to be hard and as I went on it kept getting easier and interesting too.

rancid vine Aug 17, 2020, 3:51 PM

#

We have another Linux machine coming this week.

#

Should actually be two being added to the path.

idle cloak Aug 17, 2020, 4:44 PM

#

@toxic mirage Real environments are about 90% windows anyways, and most of that being AD focused too.

north snow Aug 17, 2020, 6:07 PM

#

That depends though. What about corporate environments? Doesn’t Linux see more usage there? Especially for servers? Or is it overwhelmingly Windows dominated?

lament nacelle Aug 18, 2020, 7:21 AM

#

cool, thanks guys

gusty pine Aug 18, 2020, 7:28 AM

#

I work at a massive company and most of our servers are linux, just sayin'

#

windows is mostly used for end user computing (desktops...)

fleet wedge Aug 18, 2020, 10:54 AM

#

Excellent guys. TryHackMe just upgraded the Offensive Pentesting Path with some more content and tasks.

rancid vine Aug 18, 2020, 12:01 PM

#

Shh, it's a secret. 😛

fleet wedge Aug 18, 2020, 12:09 PM

#

I just realized an hour ago while training hahaha

rancid vine Aug 18, 2020, 12:23 PM

#

I've been working with Skidy to revamp and update the path. Two additional rooms that release this Friday will also be added.

spring thicket Aug 18, 2020, 2:32 PM

#

for the OSCP prep BOF room. I'm trying to get the "oscp" program to move onto the second buffer overflow, but it never changes. I nc to the host and type "OVERFLOW2 test" but it remains on overflow 1's offset. What am I doing wrong?

near ginkgo Aug 18, 2020, 10:31 PM

#

Nice. You just finished the OSCP too didn’t you Mayor?

rancid vine Aug 18, 2020, 11:05 PM

#

Yea about a month ago.

fleet wedge Aug 18, 2020, 11:12 PM

#

Is there a new machine on this path?

rancid vine Aug 18, 2020, 11:15 PM

#

There are a couple, and more to come later this week.

near ginkgo Aug 18, 2020, 11:28 PM

#

I'm prepping for OSCP. Testing in December. Signed up woefully unprepared man.

#

THM is helping a lot though. Dunno if I'll pass on the first try, but it is what it is. I'll learn something from it either way.

rancid vine Aug 18, 2020, 11:30 PM

#

Check the pinned messages for my prep list.

#

https://medium.com/cybersecpadawan/10-tips-for-success-on-your-oscp-exam-413db4e2ed1b

Medium

10 Tips for Success on Your OSCP Exam

Go beyond the try harder parrot

#

I also wrote that as well if you want to check it out.

covert scarab Aug 18, 2020, 11:31 PM

#

And remember, don't force yourself into it. Take your time and do it when you're ready!

near ginkgo Aug 18, 2020, 11:32 PM

#

Thank you

#

Appreciate the article. Its a good read.

rancid vine Aug 18, 2020, 11:37 PM

#

Thanks 🙂

lament nacelle Aug 19, 2020, 6:58 AM

#

good article, thanks for sharing

lament nacelle Aug 19, 2020, 8:02 AM

#

currently preparing with VirtualBox. is it necessary switch to VMware player for future exam? 👀

near ginkgo Aug 19, 2020, 10:34 AM

#

No I don’t believe so. They won’t provide tech support if you are using virtual box.

#

But you can use it. I intend on using it.

hasty flume Aug 20, 2020, 9:45 PM

#

for Steel Mountain, I have everything complete except the question "What Powershell -c Command could we run to manually find out the service name". Its extremely vague and I have googled the hell out of it, any leads?..

keen iris Aug 20, 2020, 9:46 PM

#

You need a powershell verb that will get services

hasty flume Aug 20, 2020, 9:46 PM

#

Get-Service cmdlet

#

but its format answer is *********** ** *************

#

well that didnt work ^ but it needs more tahn that, I have googled so hard and nothing really answers this super vague question.

keen iris Aug 20, 2020, 9:48 PM

#

it says powershell -c command

#

How would you run that cmdlet with powershell -c

hasty flume Aug 20, 2020, 9:49 PM

#

Zero Idea.

#

99% done with this box but I have googled so hard for this last question and I dont find a good way to find this answer out

keen iris Aug 20, 2020, 9:50 PM

#

*Format is "powershell -c "command here"*

#

...

#

get-Service has to be ran from powershell, won't work from CMD

#

So you're running it with powershell -c

#

I disagree, but OK

sterile elk Aug 22, 2020, 11:03 AM

#

How to decrypt BCRYPT password?

covert scarab Aug 22, 2020, 11:17 AM

#

I believe hashcat has a feature https://hashcat.net/wiki/doku.php?id=example_hashes

rancid vine Aug 22, 2020, 11:18 AM

#

So does john the ripper

idle cloak Aug 22, 2020, 5:18 PM

#

@sterile elk Just FYI, bcrypt is a hard password hash to crack (NOT decrypt, different meanings, you can’t decrypt a hash). The hashing algorithm is slow, making it take longer to attempt each iteration when cracking.

keen iris Aug 22, 2020, 5:20 PM

#

It can be quite fast with a low round count

#

But it's designed to be about the same speed on CPUs or GPUs so that it's harder to crack

idle cloak Aug 22, 2020, 5:21 PM

#

@keen iris good point 👍

keen iris Aug 22, 2020, 5:22 PM

#

~~There's a nice room on this, made by a great content creator. I think his name is "NinjaJc01" or something~~

noble glacier Aug 22, 2020, 5:22 PM

#

👀

lament nacelle Aug 22, 2020, 10:16 PM

#

about the Game Zone room in oscp path. It feel some of the tools already been banned like SQLmap

rancid vine Aug 22, 2020, 10:21 PM

#

Offensive Pentesting isn't just an OSCP prep path.

#

That's why tools like SQLmap are used and permitted. 🙂

lament nacelle Aug 22, 2020, 10:24 PM

#

good to know, thanks

#

although, hope there is a path for oscp only. that'll make it easier 🍻

keen iris Aug 22, 2020, 10:26 PM

#

You can always choose to follow the restrictions

lament nacelle Aug 22, 2020, 10:27 PM

#

yeah, but that'll take you more time for recognize which tool is restricted

rancid vine Aug 22, 2020, 10:27 PM

#

Most of the rooms give you the opportunity to do it both with and without metasploit.

keen iris Aug 22, 2020, 10:28 PM

#

yeah, but that'll take you more time for recognize which tool is restricted
@lament nacelle you should get familiar with the list mow

#

Not a long list

real sandal Aug 22, 2020, 10:29 PM

#

It's easy to understand which tools you can't use in the exam and you can prevent yourself from using in the offensive path: commercial vuln scanners (Nessus), auto exploit tools (sqlmap), metasploit (besides multihandler)

#

Probably good practice to not touch them by accident too 😉

rancid vine Aug 22, 2020, 10:29 PM

#

I just revamped the path so that it's more up to date and aligned a bit more with some of those things. Two brand new rooms that I made, Relevant and Internal, will be added to the path very soon as well.

#

But as Ninja said, it's really a good idea for you find those restrictions and base your plan of action on them.

lament nacelle Aug 22, 2020, 10:31 PM

#

thank you guys, i'll find a list

rancid vine Aug 22, 2020, 10:32 PM

#

https://www.offensive-security.com/offsec/pwk-oscp-faq/

PWK & OSCP Frequently Asked Questions | Offensive Security

#

https://support.offensive-security.com/oscp-exam-guide/#exam-restrictions

fleet nest Aug 23, 2020, 12:03 PM

#

Helloa, Can anybody recommend me an preperation path for ECCPT?

I have heard there are some differences between OSCP and ECCPT. For example the Pivoting part.

wet sierra Aug 23, 2020, 1:31 PM

#

I think the offensive path is a good place to start after that moving onto a course like Throwback will teach more advanced techniques and methodology. I would then complete boxes from tjnulls list and practice your report writing with the boxes as you complete

rancid vine Aug 23, 2020, 1:51 PM

#

It's the Mayor Null list now 😛

📎 mayornull_list.jpg

fleet nest Aug 23, 2020, 2:04 PM

#

Hey I did'nt knew Tjnull's path was updated nice!

#

Thnx !

#

📎 if6ub51md8h51.png

#

found a little more updated version 🙂

wet sierra Aug 23, 2020, 3:43 PM

#

There's so many lists and crap out there I don't even know anymore

rancid vine Aug 23, 2020, 3:45 PM

#

Well, it wasn't until I started reviewing OSCP that THM was added to the list. 🙂 So it's been diversified beyond the TJNull HTB stuff. Which I think is vital to learning.

fleet nest Aug 23, 2020, 4:48 PM

#

Agreed. The truth imo is people have to find out for them self what suits them the best. Platform, learning style etc.

fiery stump Aug 23, 2020, 8:39 PM

#

any order for thoses path or it's from top to bottow , left to right ?

rancid vine Aug 23, 2020, 8:40 PM

#

I only did the VHL, TryHackMe and CyberSecLabs stuff.

#

I didn't do any HTB or Vulnhub.

#

I also didn't use the PWK labs.

modest hatch Aug 23, 2020, 8:59 PM

#

passed both VHL cert it was excellent 🙂 tryharder Labs

rancid vine Aug 23, 2020, 9:00 PM

#

Yea I really enjoyed VHL

modest hatch Aug 23, 2020, 9:01 PM

#

🙂 Yeah was fun.

#

here to do the tryhackme Path. 😉

vernal timber Aug 23, 2020, 10:53 PM

#

anybody did overflow 7? wanted to chat a bit about it

dense root Aug 23, 2020, 11:38 PM

#

Is this specific to that overflow or a general bof question?

#

If the latter I can help

#

If the former I haven’t done that specific one yet

carmine wagon Aug 24, 2020, 7:02 PM

#

in OSCP BOF Prep - OVERFLOW5: bad_chars form doesn't accept right answer (it's right because I got reverse-shell using them)
maybe there is some bug here?

dense root Aug 24, 2020, 7:12 PM

#

You can put extra bad chars when creating your reverse shell payload and it’ll still work

#

It doesn’t necessarily mean they’re all bad

carmine wagon Aug 24, 2020, 7:17 PM

#

understand, thanks

grand bone Aug 25, 2020, 4:57 PM

#

Hey 🙂 Where did some of you guys found a pre-compiled version of 'PrintSpoofer.exe'? Can't find it anywhere and compiling it by myself gives me some errors

rancid vine Aug 25, 2020, 4:57 PM

#

https://github.com/dievus

GitHub

dievus - Overview

Also known as the Mayor. dievus has 38 repositories available. Follow their code on GitHub.

#

I have it in there.

grand bone Aug 25, 2020, 4:58 PM

#

Thank you very much 👍

rancid vine Aug 25, 2020, 4:59 PM

#

🙂

surreal holly Aug 26, 2020, 3:16 AM

#

In SMB what is IPC$ share? On net it shows it used for RPC . I have connected to IPC$ share but how to make RPC from there? Any body can explain. Thank you

dense root Aug 26, 2020, 3:17 AM

#

You just asked this in the TCM discord and someone was kind enough to answer you

#

Please check their response

fleet wedge Aug 26, 2020, 6:21 AM

#

The relevant room was one for the books! I was able to download the binary from mayors Github and find the flags but hit a wall trying to learn how to compile the exploit on my kali box and other exploits such as juicy potato. Can an exploit like PrintSpoofer (https://github.com/itm4n/PrintSpoofer/tree/master/PrintSpoofer) be compiled using Kali or is an Windows environment required? I read through a few guides and attempted to compile using different tools such mingw32, wine, and g++ but continue to receive the same error below.
PrintSpoofer.cpp:3:10: fatal error: Windows.h: No such file or directory
3 | #include <Windows.h>
| ^~~~~~~~~~~
compilation terminated.

midnight blade Aug 26, 2020, 6:52 AM

#

it probably requires windows-only libraries/headers which probably aren't distributed because legal reason but i might be wrong

willow sand Aug 26, 2020, 3:34 PM

#

Hi all, I am stuck on privesc in Internal - if anyone could give me a nudge, I'd be very grateful

dense root Aug 26, 2020, 3:48 PM

#

heya, what have you discovered or tried so far? @willow sand

#

oh on internal, jk i havent done that, you can still answer that and someone who has done it can answer you

rancid vine Aug 26, 2020, 3:50 PM

#

Can DM me for help if you’d like.

fleet wedge Aug 26, 2020, 5:54 PM

#

Senpai, have you tried using wpscan to Fingerprinting the version

rancid vine Aug 26, 2020, 6:03 PM

#

We got it sorted out. It's not something wpscan could assist with.

fleet wedge Aug 26, 2020, 6:17 PM

#

sounds good

shell yarrow Aug 26, 2020, 9:31 PM

#

Anyone got a sec regarding Relative?

#

PE

rancid vine Aug 26, 2020, 9:31 PM

#

Relevant?

#

Sure.

shell yarrow Aug 26, 2020, 9:31 PM

#

Relevant sorry

#

So i was able to build the package in visual studio on a Win10 64 bit box, and it works flawlessly, but the binary doesnt appear to like the Server 2016 :/... Is there a trick to compile this bad boy?

#

when i say doesnt like i mean it doesnt do any thing 😮

#

tried both x86 and x64. maybe im missing something

#

Im referring to the Impersonate PE vector

#

I take back the questions. Im going to build it in a 2016 env... Didnt realize the evaluation OS exists. Try this again

rancid vine Aug 26, 2020, 9:43 PM

#

You can grab it in my repos here https://github.com/dievus

GitHub

dievus - Overview

Also known as the Mayor. dievus has 38 repositories available. Follow their code on GitHub.

shell yarrow Aug 26, 2020, 9:46 PM

#

check check. Appreciate it. Im going to figure out how to compile this anyway. Thanks!

carmine wagon Aug 27, 2020, 7:42 PM

#

guys, is brainstorm room still unstable and broken?
i got my exploit working on local, but not on remote machine

dense root Aug 27, 2020, 7:42 PM

#

yes

#

sometimes it works, sometimes it doesnt

#

just try it a bunch of times if it doesnt work reboot the box, if it doesnt work chalk it up to the box being borked

carmine wagon Aug 27, 2020, 7:43 PM

#

thanks, i'll try

#

ROOTED, finally 🙂

#

after 5-10 reboots

dense root Aug 27, 2020, 8:41 PM

#

woot!

viral scroll Aug 28, 2020, 5:41 AM

#

@rancid vine Is Threader3000 supposed to find the high port on the 'Relevant' box ?

midnight blade Aug 28, 2020, 6:06 AM

#

@viral scroll it should since it loops through all ports

cosmic sandal Aug 29, 2020, 2:20 AM

#

Anyone use a stand alone version of incognito - or does it only work through meterpreter?

rancid vine Aug 29, 2020, 2:23 AM

#

You can use the executable version.

cosmic sandal Aug 29, 2020, 2:27 AM

#

https://github.com/FSecureLABS/incognito the binary got removed or I can't find it. So I downloaded the files from github but when I opened it in visual studio it found nothing to compile.

GitHub

FSecureLABS/incognito

One Token To Rule Them All https://labs.mwrinfosecurity.com/blog/incognito-v2-0-released/ - FSecureLABS/incognito

rancid vine Aug 29, 2020, 2:34 AM

#

https://github.com/milkdevil/incognito2

GitHub

milkdevil/incognito2

Contribute to milkdevil/incognito2 development by creating an account on GitHub.

#

Might work

cosmic sandal Aug 29, 2020, 2:45 AM

#

ok thanks! will try that

visual delta Aug 29, 2020, 2:31 PM

#

is there a way to reset the completed learning paths?

dense root Aug 29, 2020, 2:41 PM

#

not at the moment

modest hatch Aug 29, 2020, 9:11 PM

#

Got 3month Gift Card for this One 🙂

ashen notch Aug 31, 2020, 3:11 AM

#

off-topic question: is llmnr poisoning allowed in oscp exam?

midnight blade Aug 31, 2020, 3:15 AM

#

You cannot use any of the following on the exam:

Spoofing (IP, ARP, DNS, NBNS, etc)
Commercial tools or services (Metasploit Pro, Burp Pro, etc.)
Automatic exploitation tools (e.g. db_autopwn, browser_autopwn, SQLmap, SQLninja etc.)
Mass vulnerability scanners (e.g. Nessus, NeXpose, OpenVAS, Canvas, Core Impact, SAINT, etc.)
Features in other tools that utilize either forbidden or restricted exam limitations

i think llmnr falls under the first one

keen pulsar Aug 31, 2020, 5:12 AM

#

I think this is the right place to ask but, if it isn't, sorry, I'm new to the server. So, i've just started looking into some web penetration testing and I have a question: What is the difference beetween a directory bruteforce, a dns bruteforce and a vhost bruteforce. I used to use dirbuster in my attempts but i switched to gobuster recently and i saw these new things in the help menu. I'm afraid of forgeting to look for something during recon since I didn't even know there was a distinction between dns,directory and vhost bruteforce. Thanks in advance

keen iris Aug 31, 2020, 5:18 AM

#

Do you know what a VHOST is?

#

Do you know what DNS is?

#

Do you understand the concept of directories on a webserver?

#

Those are questions you should find answers to. Learn the absolute basics about those topics, then the difference should be very clear to you.

keen pulsar Aug 31, 2020, 5:21 AM

#

I thought I had a grasp of DNS but reading this made me think maybe I don't kkkk, okok I gonna look it up and find the magic

fleet wedge Aug 31, 2020, 12:19 PM

#

can you guys recommend me some good courses/sites/thm boxes about buffer overflow? thanks in advance

dense root Aug 31, 2020, 12:29 PM

#

Brainpan, brainstorm, gatekeeper, Buffer overflow prep @fleet wedge

real sandal Aug 31, 2020, 12:29 PM

#

https://vulp3cula.gitbook.io/hackers-grimoire/exploitation/buffer-overflow

Buffer overflow

rancid vine Aug 31, 2020, 12:47 PM

#

The Offensive Pentesting path has several of these.

coarse swan Aug 31, 2020, 4:56 PM

#

The Buffer Overflow Prep room really helped me out on BOFs, I completed that room the other day and have since completed Brainpan, Gatekeeper, and Brainstorm. Would highly recommend it.

proper tangle Aug 31, 2020, 5:41 PM

#

I'm trying steel mountain. Both metasploit and python exploits doesn't work. Is there any I can reach out?

rancid vine Aug 31, 2020, 8:46 PM

#

Someone ghost pinging me?

hexed solstice Aug 31, 2020, 9:08 PM

#

speaking of the offensive pentesting path buffer overflow lab, the first one... is anyone running into an issue with the first fuzzing script?

carmine wagon Sep 1, 2020, 5:08 AM

#

@hexed solstice what kind of issue?
as for me it was an issue with Python version I used to execute script. It should be just python not python3.

hexed solstice Sep 1, 2020, 5:09 AM

#

i didn't check to see if python 1 was installed, but running just python still had the issue

#

it would immediately hit the excpetion

keen iris Sep 1, 2020, 5:09 AM

#

*python2

#

Not python 1

hexed solstice Sep 1, 2020, 5:10 AM

#

i didn't check which version, but running python or python3 didn't work. It hit the overflow string and failed, it ended up being a type error. I had to convert it to bytes

#

bobloblaaw helped me

carmine wagon Sep 1, 2020, 5:13 AM

#

blobfingerguns

#

There was a beautiful VOD on twitch by room creator, but it was deleted, today I cant find it :(
It helped me a lot week ago

hexed solstice Sep 1, 2020, 5:21 AM

#

ah, that's alright.

dense root Sep 2, 2020, 4:41 PM

#

#general or #thm-community-media

#

@shy stone

noble glacier Sep 2, 2020, 4:45 PM

#

@dense root How does that even go in #thm-community-media? dark

dense root Sep 2, 2020, 4:45 PM

#

🤷‍♂️

noble glacier Sep 2, 2020, 4:45 PM

#

Streams, videos, blog posts, etc of TryHackMe content

dense root Sep 2, 2020, 4:49 PM

#

man idk

noble glacier Sep 2, 2020, 4:49 PM

#

darkchamp

fleet wedge Sep 2, 2020, 4:52 PM

#

I did

#

It

#

I survived class on a book I didn't read

noble glacier Sep 2, 2020, 4:52 PM

#

#general 👀

fleet wedge Sep 2, 2020, 4:52 PM

#

Oh

#

I thought this was general

noble glacier Sep 2, 2020, 4:52 PM

#

darkchamp

fleet wedge Sep 2, 2020, 4:52 PM

#

!rule 15

frank troutBOT Sep 2, 2020, 4:52 PM

#

Rule 15: Please leave any disciplinary measures to the discord staff (Trial Mods, Mods, and Admins). This is also known as no 'mini-modding'. If something is happening, please just let the staff know and we can take care of it <3

noble glacier Sep 2, 2020, 4:52 PM

#

😛

fleet wedge Sep 2, 2020, 4:52 PM

#

Let me dicipline myself smh

#

Very bad @fleet wedge go to #general

dense root Sep 2, 2020, 4:55 PM

#

lmao

rancid vine Sep 2, 2020, 6:05 PM

#

Nothing EC-Council should ever be equated to pentesting.

viral scroll Sep 2, 2020, 6:46 PM

#

Anyone having trouble downloading JuicyPotato?

#

everytime I download it from github it results in zero bytes being downloaded

#

Im assuming it's a firewall/AV, but im in my VM, could my host AV be affecting the DL?

#

got around the problem

grizzled silo Sep 3, 2020, 1:29 PM

#

hi

#

i need help

#

how can get start oscp path?

rancid vine Sep 3, 2020, 1:29 PM

#

It isn't a OSCP path, however it would certainly help with that exam.

#

The Offensive Pentesting path on the platform requires a subscription. Do you have a subscription to TryHackMe?

grizzled silo Sep 3, 2020, 1:36 PM

#

yes sir

#

i have subscription

dense root Sep 3, 2020, 1:39 PM

#

So then you can enroll in the offensive pen testing path and follow the room order given 🙂

grizzled silo Sep 3, 2020, 1:41 PM

#

yes

#

i trying 25%

#

i have no idea next

#

step

dense root Sep 3, 2020, 1:44 PM

#

Keep going on the path?

sacred depot Sep 3, 2020, 8:36 PM

#

So, i am not sure if that room fits for my question but as the paths are somewhat guided(?) i thought that i can try ask my beginner question here.
Just trying to wrap my way around reverse shells. I get the concept but... aren't these quite dangerous for the 'attacker' himself? Like, i guess someone could do a reverse-reverse shell (with NAT drawbacks and stuff)? Thats probably a thing i dont want to have in a KotH room?

covert scarab Sep 3, 2020, 8:36 PM

#

I'm sure there's rules against doing that in Koth

sacred depot Sep 3, 2020, 8:37 PM

#

Jeah, i guess so, but just wondering, the thing is a thing, right? 😄

#

Could be a thread in the wild as a honeypot too?

covert scarab Sep 3, 2020, 8:37 PM

#

I mean I know you can mess with other shells but I'm not 200% sure. I'll do some research and get back to you on that

sacred depot Sep 3, 2020, 8:38 PM

#

Thanks! Probably don't even need to mess with the shell but maybe just the active connection?

covert scarab Sep 3, 2020, 8:40 PM

#

I mean, for them to spawn a reverse shell they would most likely need execution of some sort, having the active connection may be useless. Only top of that the attacker would probably use some sort of encrypted connection so getting a reverse connection (if possible) may be a tough one.

sacred depot Sep 3, 2020, 9:27 PM

#

Hmm, i see - going to look that up though. Netcat is unencrypted and used pretty often for that so i guess that would make it possible to just write to the connection file? Interessting stuff anyway

keen iris Sep 3, 2020, 9:33 PM

#

@sacred depot you're just listening for a raw TCP connection, an attacker won't be able to run commands on that

#

They can write to your listener sure

#

But no RCE

sacred depot Sep 5, 2020, 7:32 PM

#

@keen iris Thanks for the info!

fleet wedge Sep 5, 2020, 11:06 PM

#

watch out with tcp scanning guys ur ip will be reported very fast on abuseip web....u can use a vpn but still haha

#

oow tcp connection

#

ooowwww oke heheh

rancid vine Sep 5, 2020, 11:20 PM

#

huh?

twin granite Sep 5, 2020, 11:30 PM

#

^

#

Dont go around scanning random stuff on the internet

real sandal Sep 6, 2020, 3:35 AM

#

Masscan go brrrr

mint pilot Sep 6, 2020, 4:41 PM

#

scan 8.8.8.8 'for fun'

rancid vine Sep 6, 2020, 5:09 PM

#

nooooooo

normal saddle Sep 6, 2020, 6:08 PM

#

i have a question, i'm working on Steel Mountain, and are stuck on the final step to become root, my reverse shell is not keeping a stable connection for some reason, i've tried a few variants on my payload and ports and nothing is working. I get a connection, but it immediately fails

keen iris Sep 6, 2020, 6:41 PM

#

What payload?

normal saddle Sep 6, 2020, 6:43 PM

#

msfvenom windows/shell/reverse_tcp

keen iris Sep 6, 2020, 6:43 PM

#

And how are you listening for it? @normal saddle

normal saddle Sep 6, 2020, 6:44 PM

#

nc -lvnp

keen iris Sep 6, 2020, 6:44 PM

#

Try using multi handler with the payload set correctly

rancid vine Sep 6, 2020, 6:47 PM

#

Command shell works as well. But may want to consider an unstaged payload if the staged one isn't working.

keen iris Sep 6, 2020, 6:47 PM

#

You need a multi/handler listener for staged shells for sure

rancid vine Sep 6, 2020, 6:47 PM

#

Good habit to get in to, as well as checking for differences in architecture.

#

You can use Netcat with unstaged payloads.

normal saddle Sep 6, 2020, 6:59 PM

#

unstagged payload worked, thank you

fleet wedge Sep 7, 2020, 1:06 AM

#

anyone experienced this error with gatekeeper binary when opening with immunity? I can open chatserver from thm brainstorm room without errors

📎 gatekeeper.png

#

also used this method in additon to mget via share to transfer file . Same error

📎 gatekeeper-walkthrough.png

dense root Sep 7, 2020, 1:11 AM

#

https://www.sevenlayers.com/index.php/348-tryhackme-gatekeeper-walkthrough

TryHackMe Gatekeeper Walkthrough

The description states:

#

@fleet wedge

#

He says how to fix it

fleet wedge Sep 7, 2020, 1:12 AM

#

@dense root thanks man , that helps

dense root Sep 7, 2020, 1:14 AM

#

No problem 🙂

rancid vine Sep 7, 2020, 1:16 AM

#

Yep, this is a Visual C issue. Glad you got it sorted.

fleet wedge Sep 7, 2020, 1:38 AM

#

problem resolved!

rancid vine Sep 8, 2020, 2:20 PM

#

@terse herald

terse herald Sep 8, 2020, 2:21 PM

#

Absolutely not. @fleet wedge

#

!rule 9

frank troutBOT Sep 8, 2020, 2:22 PM

#

Rule 9: No discussion of illegal topics or actions.

terse herald Sep 8, 2020, 2:22 PM

#

We do not care for that sort of attitude nor mindset here.

#

Banned.

rancid vine Sep 8, 2020, 2:26 PM

#

Well that escalated quickly.

fleet wedge Sep 8, 2020, 11:53 PM

#

ah I missed the banned convo

crimson flame Sep 9, 2020, 6:56 AM

#

@inner lake Again, final warning. Do not post random discord invite links.

noble glacier Sep 9, 2020, 6:59 AM

#

@bronze zenith Looks like spooky warned them here as well, guess it's 3 invite links now

bronze zenith Sep 9, 2020, 7:00 AM

#

Ban

#

Done

uneven shadow Sep 11, 2020, 7:21 AM

#

I need a sub to access the other offsec path room 😂 those free room are interesting which i learn a lot

bright oxide Sep 11, 2020, 3:27 PM

#

Hi guys do you think that done this Offensive path and eCCPT is enough to begin the OSCP certification? and if is enough, how many months of lab you would buy?

terse perch Sep 11, 2020, 3:27 PM

#

I would also do VHL labs

bright oxide Sep 11, 2020, 3:27 PM

#

I know that this could be more personal but in General

#

I would also do VHL labs
@terse perch is this really necessary or better HTB labs?

terse perch Sep 11, 2020, 3:29 PM

#

Yes, it is more inline with the PWK/OSCP environment....and there is a really great discord community for it. @rancid vine had recommended it a couple months back, so I gave it a try...and it is definitely worth the $99 for a month.

rancid vine Sep 11, 2020, 3:29 PM

#

VHL is leaps and bounds better than HTB

#

But it's also more expensive.

#

This path and the eCPPT are a good start. I wouldn't expect to get much better prepared using the PWK labs and manual.

Best way to prepare for that exam, at least in my opinion, is to immerse yourself in as many practical environments as you can. HTB isn't that. So you're left with THM, CyberSecLabs, and VHL.

terse perch Sep 11, 2020, 3:31 PM

#

I am half way through VHL...and I wish I had done it so much earlier in my OSCP process...I have the OSCP scheduled for October 2nd...so I am trying to get through VHL as fast as possible

rancid vine Sep 11, 2020, 3:32 PM

#

Hindsight suggests I should have wasted a month's worth of money on PWK rather than 3, and just spent 45 days before hand doing VHL.

#

Would have saved money in the long run.

terse perch Sep 11, 2020, 4:11 PM

#

FWIW...I still highly recommend HTB. I think it is important to get exposure to as many scenarios as possible. Going through Ippsec's videos early on for as many videos as possible was really important for me.

bright oxide Sep 11, 2020, 7:01 PM

#

Maybe I take a look to the VHL for a month and try to approach it all that I can

soft shuttle Sep 11, 2020, 8:38 PM

#

What is VHL labs ?

#

Hi folks

#

I haved failed in my first attempt in OSCP certification

keen iris Sep 11, 2020, 8:40 PM

#

A different company with real world focused labs

soft shuttle Sep 11, 2020, 8:41 PM

#

Even doing the interally Offensive pentesting

#

I have failed, I think, because now the exam test much more misconfiguration on Services/Apps

#

And I was focused on CVE searching

#

What kind of rooms You recommend

#

?

keen iris Sep 11, 2020, 8:43 PM

#

OSCP, from what I hear, also tests CTF skills 👀

#

But mayor's guide is real good

rancid vine Sep 11, 2020, 8:43 PM

#

Sorry to hear about the failure. Oftentimes people get really lucky with easier boxes, or really hard boxes that are next to impossible to solve.

keen iris Sep 11, 2020, 8:44 PM

#

Sorry to hear about the failure. Oftentimes people get really lucky with easier boxes, or really hard boxes that are next to impossible to solve.
I'm still convinced the RNG is a conspiracy to get more money out of people via retakes

rancid vine Sep 11, 2020, 8:44 PM

#

Exam is 80% or more enumeration, 19% time management, and 1% actual exploitation.

#

I agree Ninja. Or some off the wall poor way to grab user metrics.

soft shuttle Sep 11, 2020, 8:48 PM

#

Thanks about the condolences folks

#

hahahaha

rancid vine Sep 11, 2020, 8:48 PM

#

snhbyt3, my best advice is to immerse yourself in as many labs as you possibly can.

soft shuttle Sep 11, 2020, 8:48 PM

#

is very sad failure after many days of study

rancid vine Sep 11, 2020, 8:48 PM

#

Stay practical for the most part. TryHackMe and CyberSecLabs do a good job of that.

#

VirtualHackingLabs is good if you can afford it.

soft shuttle Sep 11, 2020, 8:50 PM

#

But what kind of rooms

#

of Try Hack Me

#

you recommend ?

keen iris Sep 11, 2020, 8:50 PM

#

The path is good

soft shuttle Sep 11, 2020, 8:50 PM

#

I cant spend more money

#

retake is very expensive for me

rancid vine Sep 11, 2020, 8:51 PM

#

The 10 a month for the THM sub is worth it to get access to the path I think. I helped revamp it recently and bring in some more practical labs.

soft shuttle Sep 11, 2020, 8:51 PM

#

But I have finished the path

#

Now I am stucked in continus learning

#

*continuous

rancid vine Sep 11, 2020, 8:59 PM

#

📎 oscp_prep_list.png

#

That was my prep list. Didn't mess with the pwk labs

soft shuttle Sep 11, 2020, 9:09 PM

#

Thanks BRO !!!

uneven shadow Sep 12, 2020, 11:11 AM

#

Yeah i did vhl labs too

bright oxide Sep 14, 2020, 10:43 AM

#

Finished Offensive Path it was very useful!

rough osprey Sep 14, 2020, 12:32 PM

#

did not know about vhl labs and cyberseclabs, i guess i will give them a try too 🙂

visual shell Sep 14, 2020, 6:48 PM

#

VHL looks good but pretty expensive

#

Do people use Attackbox or Kali linux on THM?

keen iris Sep 14, 2020, 6:48 PM

#

my own VM

visual shell Sep 14, 2020, 6:51 PM

#

Oh i was wondering if you could do that

#

Ive got kali on WSL2 so might try that, wont always lose my settings that way

keen iris Sep 14, 2020, 6:52 PM

#

Run the VPN directly in WSL2

#

Seeing as WSL2 is a VM

bright oxide Sep 15, 2020, 1:36 PM

#

and what do you think about this? https://www.offensive-security.com/labs/individual/?utm_source=hs_email&utm_medium=email&utm_campaign=proving grounds individual&utm_content=pg_launch

Proving Grounds Play and Practice | Offensive Security

#

🙂

wet sierra Sep 15, 2020, 2:06 PM

#

This is not necessarily the place for that however I have not heard a lot of good things about it the only thing I could see being a redeeming factor for it is retired oscp boxes

bright oxide Sep 15, 2020, 3:22 PM

#

You're right

#

Yes, I guess that the best factor it's the retired machines

#

thx for your answer

devout plinth Sep 15, 2020, 5:36 PM

#

Hi there, someone would help me to understand a "feature" of hydra 🙂 ?

keen iris Sep 15, 2020, 5:41 PM

#

Sure, ask away

#

I like to think my hydra knowledge is good

devout plinth Sep 15, 2020, 6:06 PM

#

I did the room "Terminator" and did succeed to find the required login / password

#

However, when I try to bruteforce (with the correct login and a short list containing the correct password), I do not suceed to find the correct login / password

#

I think I might use an incorrect syntax or there is a bug. But i did read the documentation and did some research without any success

#

@keen iris do you want some screenshot / details ?

keen iris Sep 15, 2020, 6:08 PM

#

Oh sorry I didn't see this

#

The Skynet room?

devout plinth Sep 15, 2020, 6:08 PM

#

yup

keen iris Sep 15, 2020, 6:10 PM

#

Can I see your command? For squirrel mail, people normally send the data to the wrong place

#

I can link you to a convo on it from the other day if that's the issue

devout plinth Sep 15, 2020, 6:11 PM

#

📎 unknown.png

#

I see 2 verbore "redirect" which IMO correspond to the correct password

keen iris Sep 15, 2020, 6:12 PM

#

Probably your success condition

#

I'd change it to a failure condition, because that tends to work better

devout plinth Sep 15, 2020, 6:13 PM

#

I did try different conditions

#

📎 unknown.png

#

with same results

#

I'm a bit perplex

keen iris Sep 15, 2020, 6:17 PM

#

Can I see your captured request real quick?

devout plinth Sep 15, 2020, 6:17 PM

#

though burp ?

keen iris Sep 15, 2020, 6:17 PM

#

Or browser devtools

devout plinth Sep 15, 2020, 6:18 PM

#

a failed request ?

#

📎 unknown.png

devout plinth Sep 15, 2020, 6:40 PM

#

is that enough @keen iris ?

keen iris Sep 15, 2020, 6:42 PM

#

Yeah I'm puzzled

devout plinth Sep 15, 2020, 6:43 PM

#

My syntax is kinda correct !?

keen iris Sep 15, 2020, 6:43 PM

#

It looks it

#

I'd honestly try fuzzing with Zap instead

devout plinth Sep 15, 2020, 6:43 PM

#

I did RTFM and tried different syntaxes without success

keen iris Sep 15, 2020, 6:43 PM

#

Hydra is... weird for web

devout plinth Sep 15, 2020, 6:43 PM

#

Oh! good to know

#

It is indeed not the first time i have troubble with hydra in web

#

Thanks for the help anyway 😉 didn't knew Zap, will learn this new tool

keen iris Sep 15, 2020, 6:46 PM

#

There's a room on it

devout plinth Sep 15, 2020, 6:48 PM

#

Yeah just saw it

#

another rabbit hole to jump in 😄

opaque violet Sep 16, 2020, 5:29 AM

#

Can anyone please point me in a direction where I can effectively learn how to use msf. Am having challenges figuring out which exploit to use and payload. Thank you

crimson flame Sep 16, 2020, 5:30 AM

#

https://www.offensive-security.com/metasploit-unleashed/

Metasploit Unleashed | Offensive Security

#

https://tryhackme.com/room/rpmetasploit

TryHackMe

TryHackMe | Metasploit

Learn to use Metasploit, a tool to probe and exploit vulnerabilities on networks and servers.

opaque violet Sep 16, 2020, 5:39 AM

#

Thank you very much

devout plinth Sep 16, 2020, 11:22 AM

#

Hi, someon would mind explain me something for OWASP-ZAP ?

rancid vine Sep 16, 2020, 11:25 AM

#

Can try.

devout plinth Sep 16, 2020, 11:25 AM

#

📎 unknown.png

#

I launched a forced browse, i move in different menues

#

and the scan dissappear

#

I know it's still running thanks to the information above, but when I select the tab no results are showed aynmore

#

I would like to follow the scan but don't know where it went

rancid vine Sep 16, 2020, 11:28 AM

#

Try pressing the play button?

devout plinth Sep 16, 2020, 11:33 AM

#

Hmmm. scan finished apprently, I launched a second one.
Explored differents site in the context menu. The scan disappear and re appear normally. 😕

#

Maybe I stumbled into some bug, or a more realistic explanation is that i don't know how to properly use the tool yet 🙂 thanks for your help @rancid vine

rancid vine Sep 16, 2020, 11:38 AM

#

You’re welcome.

weary pecan Sep 17, 2020, 11:27 AM

#

yoo

#

wats good

#

im new

#

but why all the wiki links ded??

covert scarab Sep 17, 2020, 11:28 AM

#

?

weary pecan Sep 17, 2020, 11:28 AM

#

the hidden wiki lol

covert scarab Sep 17, 2020, 11:29 AM

#

You're going to need to be more specific.

weary pecan Sep 17, 2020, 11:29 AM

#

the hidden wiki?

#

the dark web

covert scarab Sep 17, 2020, 11:29 AM

#

What hidden wiki

weary pecan Sep 17, 2020, 11:29 AM

#

lol

#

you ever used tor before?

covert scarab Sep 17, 2020, 11:29 AM

#

If you've come here to ask about the dark web you're in the wrong place

#

@grim pendant

weary pecan Sep 17, 2020, 11:30 AM

#

shit yh sorry

#

where do i ask?

#

im new

covert scarab Sep 17, 2020, 11:30 AM

#

Go ask people who use the dark web.............................

weary pecan Sep 17, 2020, 11:30 AM

#

ok srry

dense root Sep 17, 2020, 11:56 AM

#

Cuz a lot of them are illegal so people take them down. They’re not all removed you’re just looking in the wrong places @weary pecan

weary pecan Sep 17, 2020, 11:58 AM

#

this never happened before this much tho

dense root Sep 17, 2020, 11:59 AM

#

Idk what to tell you I have no authority over the dark web lol I’m just answering your question

coral badge Sep 17, 2020, 3:30 PM

#

How can u get invited in ElearnSecurity for pentest student

rancid vine Sep 17, 2020, 3:32 PM

#

That's not really a question for this channel. Best to ask that sort of thing in #general. But you can find the link here. https://www.ethicalhacker.net/

coral badge Sep 17, 2020, 3:54 PM

#

ok thanks mayor

#

@rancid vine Im in, thank you very much

solid edge Sep 18, 2020, 8:00 PM

#

Hey, just got the subsciption, and want to get started on a pentesting path. On the thm subreddit I found this path that bee posted. Which one would u recommend I take, the one on site, or the one from bee?

#

📎 image0.png

covert scarab Sep 18, 2020, 8:02 PM

#

@grim pendant

solid edge Sep 18, 2020, 8:02 PM

#

https://blog.tryhackme.com/going-from-zero-to-hero/ this is the post he made about it in case the writing is too small on the picture

TryHackMe Blog

A Guide to go from Zero to Hero

Hackers,

By now it is clear to both free members and subscribers, that TryHackMe has a
daunting amount of content. From rooms, to write-ups, to video walkthroughs it
can be difficult for new (and even seasoned) hackers to know where to start.
Speaking with members of my team ...

keen iris Sep 18, 2020, 8:02 PM

#

That's still the old zero to hero

#

That wasn't bee's post

covert scarab Sep 18, 2020, 8:02 PM

#

Yeah I’m sure bee just linked it

solid edge Sep 18, 2020, 8:02 PM

#

Ah I see

#

So the default pentesting path on thm is more updated?

covert scarab Sep 18, 2020, 8:03 PM

#

Yes definitely

solid edge Sep 18, 2020, 8:03 PM

#

ok cool, thank you

covert scarab Sep 18, 2020, 8:03 PM

#

I’ll try making an updated one if I get time and throw it on the subreddit

solid edge Sep 18, 2020, 8:04 PM

#

sounds good. Ill get working on the one on site. Thank you for the help.

grim pendant Sep 18, 2020, 9:13 PM

#

Yes for sure!

#

The paths from sub are better than anything I could make

#

Since they feature better rooms and are kept more up to date

#

I’m posting an article soon for a free path for people, but in the article i talk about how subscribing is better than anything i could make too 😛

somber coral Sep 20, 2020, 11:04 PM

#

i need an analsyis/ network admin/ reverse engineer / digatial forenses help
like i installed an obvious do not install this will fuck ur shit up malwared out hacked new high end video game title and didnt do anything to it for about 6 months, when my laptop was getting to where it could have hurt its hardware and started to look at everything
and its been a nightmare
like ive done resets across multiple devices so many times
like i have the most crazy looking .pcap files
other wifi's in the area have duplicates running in the range of my pc
its fucked
like this has got to be some real deal hardcore pwnage
like im so pwned. my router login page is now gone. i discoverd that it had custom java script loaded into and has 3 wifi ids acossiated with it

#

sorry for the spam i love you all! ive spent a year trying to figure this out

mint pilot Sep 20, 2020, 11:34 PM

#

Wrong place but you need to wipe everything clean

devout plinth Sep 21, 2020, 6:15 PM

#

Is someone else having issue with the last kali update ? (in Virtualbox)

hardy copper Sep 22, 2020, 5:59 AM

#

I am struggling too

modest hatch Sep 22, 2020, 9:59 PM

#

anyone having this same issue ?

📎 unknown.png

#

Is someone else having issue with the last kali update ? (in Virtualbox)
@devout plinth Nope i don't

grave lion Sep 22, 2020, 10:01 PM

#

check #announcements

modest hatch Sep 22, 2020, 10:03 PM

#

aiit thanks mate

feral thorn Sep 23, 2020, 8:59 AM

#

anyone having this same issue ?
@modest hatch yes I had the same issue too

modest hatch Sep 24, 2020, 2:40 PM

#

Yeah

soft island Sep 24, 2020, 3:51 PM

#

i think tryhackme is under a botnet attack

grave lion Sep 24, 2020, 3:52 PM

#

What makes you think that because they're definitely not

merry sable Sep 24, 2020, 8:02 PM

#

Just a query
The IP address doesn't redirect to the website
any ideas why?

#

@grave lion can you look into it?

grave lion Sep 24, 2020, 8:04 PM

#

I'm not a mod and #site-support is the place to ask for any THM related technical issues

merry sable Sep 24, 2020, 8:05 PM

#

@grave lion Nothing related to THM just asking

grave lion Sep 24, 2020, 8:06 PM

#

Wait what are you trying to connect to?

merry sable Sep 24, 2020, 8:07 PM

#

just a website

keen iris Sep 24, 2020, 8:13 PM

#

Welp that sounds sketch

#

Also wat

merry sable Sep 24, 2020, 8:13 PM

#

Nevermind

fleet wedge Sep 26, 2020, 2:20 PM

#

80% certain Kernal wasn't on VPN lmao

merry crater Sep 27, 2020, 8:15 PM

#

Good afternoon everyone. I'm on the buffer overflow prep section and I'm struggling with the syntax on the bad characters in mona. The instructions advise to update the !mona bytearray with the list of characters, however I can't figure out proper syntax for more than 1 bad character at a time. Can anyone advise?

#

And I might have just figured it out.

ashen hornet Sep 27, 2020, 10:32 PM

#

And I might have just figured it out.
@merry crater Backslash.

sullen delta Sep 28, 2020, 10:22 AM

#

Good afternoon everyone. I'm on the buffer overflow prep section and I'm struggling with the syntax on the bad characters in mona. The instructions advise to update the !mona bytearray with the list of characters, however I can't figure out proper syntax for more than 1 bad character at a time. Can anyone advise?
@merry crater just add the remaining bad chars in quotes "\x00\x07\x08....so on"

zenith moth Sep 28, 2020, 12:23 PM

#

what OS are you guys using?

#

i'm thinking of switching form kali to Arch

rancid vine Sep 28, 2020, 12:30 PM

#

Kali

zenith moth Sep 28, 2020, 12:39 PM

#

aight

covert scarab Sep 28, 2020, 12:44 PM

#

I use Manjaro which is an Arch based distro but there’s no harm in checking out different systems to see which one you like best

toxic ravine Sep 28, 2020, 3:05 PM

#

i use ubuntu before, then install the tools that i only need

covert scarab Sep 28, 2020, 3:07 PM

#

I didn't like Ubuntu's interface so I used Xubuntu