#room-hints | TryHackMe | Page 18

stuck fractal Apr 3, 2020, 5:31 PM

#

I really like that question

#

It's very humbling

#

Helps remind you that it's very easy to overthink

thin valley Apr 3, 2020, 5:32 PM

#

very true! it played with my mind and my search engine for about an hour

#

then I came here

merry sonnet Apr 3, 2020, 7:31 PM

#

anyone here do Jack? need help on privesc

tidal sedge Apr 3, 2020, 7:46 PM

#

@merry sonnet If you still need help you can pm me

tight summit Apr 3, 2020, 10:04 PM

#

huhu can someone give a hint about how to find the flag in the learn linux basic task43 bonus challenge?

stuck fractal Apr 3, 2020, 10:32 PM

#

Look for files belonging to every user

cloud kestrel Apr 3, 2020, 10:37 PM

#

Which room should I prefer for metasploit

Rp: metasploit. Or ice

inland onyx Apr 3, 2020, 10:38 PM

#

...

#

Also wrong chat @cloud kestrel 😄

#

Try #general

random berry Apr 3, 2020, 11:38 PM

#

Hi All, I was wondering if anyone had a problem with Nessus room

#

Regarding the questions about versions PHP and Apacehe

signal perch Apr 4, 2020, 3:38 AM

#

@random berry i did , but if I remember I double check with dirbuster "received tab" and got the right answer from there , again if I remember well

#

I mean Zap *

keen lintel Apr 4, 2020, 4:03 AM

#

Hey I am in gohostcat
Yep I just got the entry point in ghostcat
There are something like pgp private key in my home directory I cannot bruteforce the phrase
And seems nothing in another user's home directory
Don't know how I can move horizontal to another account

tidal sedge Apr 4, 2020, 4:14 AM

#

@keen lintel Use ||gpg2john|| to get a hash then crack it

keen lintel Apr 4, 2020, 4:17 AM

#

I have tried I using rockyou.txt but do not get the key
However I will try it again , thanks for your help

split flume Apr 4, 2020, 6:36 AM

#

Search for the key in keyserver and then add it to your machine and then decrypt the txt file.

ripe needle Apr 4, 2020, 8:32 AM

#

hey everyone, i have a question regarding to CC: Pen Testing room

odd void Apr 4, 2020, 8:32 AM

#

ask away

white salmon Apr 4, 2020, 8:33 AM

#

Salve

ripe needle Apr 4, 2020, 8:33 AM

#

in taske 18 section 6 for sqlmap

white salmon Apr 4, 2020, 8:33 AM

#

Are the tables empty?

ripe needle Apr 4, 2020, 8:33 AM

#

i entered the website but i am not sure what to write to see the tables

white salmon Apr 4, 2020, 8:33 AM

#

Oh

#

Use sqlmap

ripe needle Apr 4, 2020, 8:34 AM

#

i tried but nothing or maybe im using it wrong

white salmon Apr 4, 2020, 8:34 AM

#

Send a screenshot pls

ripe needle Apr 4, 2020, 8:34 AM

#

sqlmap -u <ip> -p the parametr which is i dont no --technique

#

sqlmap -u <ip> -p the parametr which is i dont no --technique=U

white salmon Apr 4, 2020, 8:35 AM

#

The parameter is what gets sent

#

You can use.multiple different methods to figure it out

ripe needle Apr 4, 2020, 8:35 AM

#

im not sure what to type in the field msg:

white salmon Apr 4, 2020, 8:35 AM

#

Just use sqlmap

#

With msg as the param

#

To make sure that's right

#

You can view the html and look at the name

#

Use burp

#

Lots of things you can doo

ripe needle Apr 4, 2020, 8:37 AM

#

i tried but no luck

white salmon Apr 4, 2020, 8:37 AM

#

You can also use --forms

#

It's in the sqlmap help page

ripe needle Apr 4, 2020, 8:39 AM

#

Edit POST data [default: msg=] (Warning: blank fields detected):

#

i did
sqlmap -u 10.10.222.26 -p msgg --technique=U --forms

white salmon Apr 4, 2020, 8:40 AM

#

No

#

If you use --forms you don't need to specify param

ripe needle Apr 4, 2020, 8:45 AM

#

this correct ?

📎 Screenshot_from_2020-04-04_04-44-44.png

#

I used sqlmap -u 10.10.222.26 --forms

white salmon Apr 4, 2020, 8:48 AM

#

Yeah

#

Now dump the db

ripe needle Apr 4, 2020, 8:56 AM

#

im not sure how to use the command to dump it but can you refer me to some website that explains it

#

i watched a youtube video was doing it by using mysql

white salmon Apr 4, 2020, 9:00 AM

#

sqlmap --help

ripe needle Apr 4, 2020, 9:00 AM

#

sure thank you 🙂

#

i did it by using --dump

#

thank you so much @white salmon

white salmon Apr 4, 2020, 9:12 AM

#

<3

wise valley Apr 4, 2020, 10:04 AM

#

📎 unknown.png

#

Have a passphrase file doesnt want a passphrase am I missing something here or

#

Rooms tomghost ask if I need to elaborate more

tidal sedge Apr 4, 2020, 10:05 AM

#

@wise valley You need to import the key

wise valley Apr 4, 2020, 10:05 AM

#

hm thanks

#

@tidal sedge Thanks, that was it no idea how I didnt understand that lol

inland onyx Apr 4, 2020, 11:12 AM

#

@wise valley I would suggest going and reading about it then. Understanding that it worked is a lot less important than understanding the process.

split flume Apr 4, 2020, 11:37 AM

#

@wise valley import the key from the server like pgp.mit.edu and then try to decrypt

wise valley Apr 4, 2020, 12:24 PM

#

@inland onyx yes I understand that

inland onyx Apr 4, 2020, 12:24 PM

#

Glad to hear it 🙂

wise valley Apr 4, 2020, 12:34 PM

#

I just get this one tracks mindset and its fricks me up

lone gale Apr 4, 2020, 12:50 PM

#

Can someone point me in a better direction for the CC: Pentesting (https://tryhackme.com/room/ccpentesting) room? I have read the writeup and it didn't help.

stuck fractal Apr 4, 2020, 12:50 PM

#

For which part?

lone gale Apr 4, 2020, 12:51 PM

#

Task 4, #14

stuck fractal Apr 4, 2020, 12:52 PM

#

@lone gale The writeup is for the exam

lone gale Apr 4, 2020, 12:52 PM

#

Ohh

stuck fractal Apr 4, 2020, 12:52 PM

#

Try extension .xxa and extension xxa

lone gale Apr 4, 2020, 12:53 PM

#

I have, and tried all the results

#

nothing worked

icy heath Apr 4, 2020, 12:53 PM

#

hello guys, i need a hint with this https://tryhackme.com/room/metasploit

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

#

the command about webcam_list

lone gale Apr 4, 2020, 12:54 PM

#

Oh wait, i ran it outside of the "secret" directory, and found more files!

icy heath Apr 4, 2020, 12:54 PM

#

meterpreter says it's unknown

stuck fractal Apr 4, 2020, 1:05 PM

#

It's a part of Post @icy heath

icy heath Apr 4, 2020, 1:10 PM

#

ok, i'll trying understanding more about post

stuck fractal Apr 4, 2020, 1:14 PM

#

metasploit post, more specifically

icy heath Apr 4, 2020, 1:18 PM

#

this error is because i'm doing something wrong, right?

📎 Screenshot_from_2020-04-04_15-14-42.png

stuck fractal Apr 4, 2020, 1:20 PM

#

nope I think that's metasploit being broken

#

IDK if we found a fix

icy heath Apr 4, 2020, 1:22 PM

#

so the webcam_list is depended on migrating to another session

#

or because it's broken it's not working

polar crescent Apr 4, 2020, 3:43 PM

#

umm..I am tryng to solve the "lord of the root" ctf..stuck on the 6th ques..Which method is it?

north moat Apr 4, 2020, 6:04 PM

#

what mean of "
How do we start entering text into our new Vim document?"

#

i don't undetstand

stuck fractal Apr 4, 2020, 6:05 PM

#

You're over thinking it

#

Once you're in insert mode, how do you get text in there?

hollow holly Apr 4, 2020, 6:07 PM

#

Hey everyone! Hoper everything is fantastic :)
I'm having a little bit of trouble with the TASK 21 on LearnLinux Room

#

can somebody give me a hint?

#

for some reason I can't run the shiba2 binary

#

and can't echo the $test1234 also

stuck fractal Apr 4, 2020, 6:09 PM

#

Can't?

hollow holly Apr 4, 2020, 6:09 PM

#

w8 let me try this again, I think I got it

#

yes I couldnt dont know why

#

im gonna try again

#

once again, i mean

stuck fractal Apr 4, 2020, 6:10 PM

#

just saying can't isn't very helpful

hollow holly Apr 4, 2020, 6:10 PM

#

yeah sorry ninja

#

let me just try one more time
if I cant, ill let you know, but this time, with a little bit more details xD

past palm Apr 4, 2020, 6:11 PM

#

@hollow holly check that you did all of the previous steps correctly. That's usually what causes me to get tripped up on stuff

hollow holly Apr 4, 2020, 6:15 PM

#

shiba2@nootnoot:~$ ./shiba2
when i do this, I get no output

north moat Apr 4, 2020, 6:15 PM

#

@stuck fractal by typing i don't undetstand what mean 😦

stuck fractal Apr 4, 2020, 6:15 PM

#

@north moat How do you get text into the vim document that you have open

north moat Apr 4, 2020, 6:15 PM

#

with i

stuck fractal Apr 4, 2020, 6:16 PM

#

That's entering insert mode

#

Once you're in that mode, how do you get text in there?

#

It's a verb

north moat Apr 4, 2020, 6:17 PM

#

exactly i don't understand what mean of get text

#

get text mean search ?

stuck fractal Apr 4, 2020, 6:21 PM

#

How do you put text in there? @north moat

#

How do you write in it

hollow holly Apr 4, 2020, 6:24 PM

#

@stuck fractal i'm doing ./shiba2

#

and I get no output

#

also, i've done echo $test1234, and the variable doesn't exist...

stuck fractal Apr 4, 2020, 6:25 PM

#

You need to create the variable

hollow holly Apr 4, 2020, 6:27 PM

#

yes already did

#

but I get permission denied

#

to cat the file

#

i did the export "valiable"=$USER

#

run the bin

#

and I got

#

cat: directory/example/example: permission denied

white salmon Apr 4, 2020, 6:28 PM

#

Huh

#

That binary doesn't use cat at all

hollow holly Apr 4, 2020, 6:29 PM

#

I think I screwed the machine lol

white salmon Apr 4, 2020, 6:29 PM

#

Send ss

hollow holly Apr 4, 2020, 6:29 PM

#

here?!

white salmon Apr 4, 2020, 6:30 PM

#

Ye

hollow holly Apr 4, 2020, 6:30 PM

#

📎 unknown.png

white salmon Apr 4, 2020, 6:30 PM

#

Uh

#

Could you upload it so discord posts it

hollow holly Apr 4, 2020, 6:31 PM

#

📎 Screenshot_1.png

#

wtf

stuck fractal Apr 4, 2020, 6:31 PM

#

@white salmon I think discord image embeds are dieing rn

inland onyx Apr 4, 2020, 6:31 PM

#

Oh good, it's not just me

white salmon Apr 4, 2020, 6:32 PM

#

📎 ry7p9auf2iq41.jpg

hollow holly Apr 4, 2020, 6:32 PM

#

Ill copy the commands

#

shiba2@nootnoot:~$ export test1234=$USER
shiba2@nootnoot:~$ echo $USER
shiba2
shiba2@nootnoot:~$ ./shiba2
cat: /etc/shiba/shiba3: Permission denied
shiba2@nootnoot:~$

white salmon Apr 4, 2020, 6:32 PM

#

Oh

#

The suid broke somehow

hollow holly Apr 4, 2020, 6:33 PM

#

so, do I turn the machine down and back up?

white salmon Apr 4, 2020, 6:33 PM

#

Yeah

hollow holly Apr 4, 2020, 6:33 PM

#

ok, thank you so much man! 😄

white salmon Apr 4, 2020, 6:33 PM

#

😁

dense brook Apr 4, 2020, 6:58 PM

#

hack park - the answer i have for what OS version, doesn't match the ***** stars. Anyone else had this problem?

#

its the *. that doesn't make sense

warm schooner Apr 4, 2020, 7:00 PM

#

I did, it depends where you get the version from

#

You can run it from meterpreter or run it within the reverse shell

dense brook Apr 4, 2020, 7:00 PM

#

tired systeminfo, sysinfo in meterpreter and also windows exploit su

#

none of them match

warm schooner Apr 4, 2020, 7:00 PM

#

I used sysinfo from meterpreter and it worked

dense brook Apr 4, 2020, 7:01 PM

#

there's a star star dot star part which matches none of them

warm schooner Apr 4, 2020, 7:07 PM

#

@dense brook, DM me the version you are getting and I'll try to help you

autumn sky Apr 4, 2020, 8:39 PM

#

in hack park... task 4 , #3 what the hell is abnormal service???

#

haha poked randomly and found it

hearty zodiac Apr 4, 2020, 11:00 PM

#

any hint for skynet question-3

true slate Apr 4, 2020, 11:01 PM

#

@hearty zodiac don't let it become self aware

hearty zodiac Apr 4, 2020, 11:01 PM

#

any small hint ??

true slate Apr 4, 2020, 11:02 PM

#

@hearty zodiac if I had one I'd give it to you but just wanted to poke fun at you. What's the question about?

#

Like what's it asking?

hearty zodiac Apr 4, 2020, 11:04 PM

#

:-), its about skynet quetion-3, which service to exploit, the samba share are readonly. and cant get shell. so just understand i looking for right thing.

true slate Apr 4, 2020, 11:05 PM

#

Can you get access to an account that allows chmod?

#

If I read that correctly, otherwise I might just not understand what it is asking .

hearty zodiac Apr 4, 2020, 11:06 PM

#

its samba share, and the 2 pass are not working for shell.

true slate Apr 4, 2020, 11:08 PM

#

Hm idk

white salmon Apr 4, 2020, 11:31 PM

#

hey guys

#

having trouble w avengers room

#

not sure what to do put with the sql injection

inland onyx Apr 4, 2020, 11:31 PM

#

What have you tried so far?

white salmon Apr 4, 2020, 11:33 PM

#

' 1=1

#

' 1=1

#

1=1--

#

i tried the whole statement given

#

nothin worls

#

works*

last nova Apr 4, 2020, 11:34 PM

#

'OR '1'='1

#

that'd be saying PASSWORD' or true

#

then the statement closes

river falcon Apr 4, 2020, 11:35 PM

#

I'd recommend taking a look at this: https://portswigger.net/web-security/sql-injection if you wanna learn SQLi better. Portswigger is a real cool platform for learning web. By the creators of Burpsuite.

last nova Apr 4, 2020, 11:36 PM

#

is a really good resource for web attacks, can confirm

white salmon Apr 4, 2020, 11:49 PM

#

sweret thanks ill check it out

scarlet saffron Apr 5, 2020, 12:29 AM

#

nothin will scan it

stuck fractal Apr 5, 2020, 12:29 AM

#

QR code needs contrast

white salmon Apr 5, 2020, 12:29 AM

#

It probably is

#

Stego veritas that shit @scarlet saffron

scarlet saffron Apr 5, 2020, 12:29 AM

#

ah ive been using sonic visualizer to get this outta the sound

odd void Apr 5, 2020, 12:29 AM

#

oi

#

bad mod

white salmon Apr 5, 2020, 12:29 AM

#

Excoos me

scarlet saffron Apr 5, 2020, 12:29 AM

#

pars is my daddy its ok

#

parsy good mod 🙂

stuck fractal Apr 5, 2020, 12:30 AM

#

Yep it works

scarlet saffron Apr 5, 2020, 12:30 AM

#

@stuck fractal also thanks man, ima try to edit the image or somethin

stuck fractal Apr 5, 2020, 12:30 AM

#

I played with it in image editing software

#

Is this for a THM room?

scarlet saffron Apr 5, 2020, 12:31 AM

#

ah cool, good, yep its for musical stego

stuck fractal Apr 5, 2020, 12:31 AM

#

Ah

#

plz delet image

#

mild spoiler

white salmon Apr 5, 2020, 12:31 AM

#

I never doubted you for a second @scarlet saffron

scarlet saffron Apr 5, 2020, 12:31 AM

#

OH MB

#

HAHA thx sweety <333 👨‍❤️‍💋‍👨 @white salmon

#

ur classic sentence XD

#

~~when u actually do doubt me~~

#

jk jk

#

@stuck fractal u on Win or Lin? i usually just use online tools cuz less hastle since im on lin

stuck fractal Apr 5, 2020, 12:33 AM

#

GIMP will do it

#

I just prefer Paint.NET

#

Pars was right tho

#

Stegoveritas

scarlet saffron Apr 5, 2020, 12:34 AM

#

tru tru, i used paint.net only on windows, never got into GIMP even after the full switch 😅

#

ok sweet i think i have it

#

literally just been trying to do it via samsung QR reader XD

stuck fractal Apr 5, 2020, 12:35 AM

#

QR codes need a lot of contrast

scarlet saffron Apr 5, 2020, 12:45 AM

#

gosh i aint gettin a good setting

#

that black at the bottom left is overtaking the whole part when upping the darn contrast

#

GOT IT

#

thanks man ❤️

ripe needle Apr 5, 2020, 3:03 AM

#

hey guys I have a question about smbmap and smbclient i have done all the tasks but get stuck in this question > Given the username "admin", the password "password", and the ip "10.10.10.10", how would you run ipconfig on that machine

stuck fractal Apr 5, 2020, 3:04 AM

#

How would you run IP config

#

Not how would you SMBMap it.

#

Look at smbclient, the man page and the help page

#

SMBMap is for enumeration, smbclient is for actually interacting

ripe needle Apr 5, 2020, 3:05 AM

#

i did looked

#

but i will look again

#

both have the same Question

stuck fractal Apr 5, 2020, 3:05 AM

#

huh?

ripe needle Apr 5, 2020, 3:06 AM

#

Given the username "admin", the password "password", and the ip "10.10.10.10", how would you run ipconfig on that machine

#

this one for smbmap

#

How do you run the command "ipconfig" on the target machine > smbclient

stuck fractal Apr 5, 2020, 3:06 AM

#

What room?

ripe needle Apr 5, 2020, 3:06 AM

#

cc:pentesting

stuck fractal Apr 5, 2020, 3:07 AM

#

Ok, well look at the man pages and help for both of them

ripe needle Apr 5, 2020, 3:08 AM

#

📎 Screenshot_from_2020-04-04_23-08-10.png

#

if you look at the last 3 things it says it

stuck fractal Apr 5, 2020, 3:09 AM

#

It says what?

ripe needle Apr 5, 2020, 3:09 AM

#

it says i should do
smbmap -u jsmith -p password1 -d workgroup -H 192.168.0.1

stuck fractal Apr 5, 2020, 3:09 AM

#

Does it?

#

Or are you perhaps misreading it

#

They are just example commands

#

Not instructions

ripe needle Apr 5, 2020, 3:10 AM

#

but admin has 6 charecter

#

true

#

i change what i need to change

#

i mean the ip - pass - user

stuck fractal Apr 5, 2020, 3:10 AM

#

yea, and the example commands aren't for running ipconfig on the target machine

ripe needle Apr 5, 2020, 3:10 AM

#

got you

stuck fractal Apr 5, 2020, 3:10 AM

#

Look at the man pages

#

I can 100% promise you it's in there

ripe needle Apr 5, 2020, 3:11 AM

#

thank you i will do ❤️

dull comet Apr 5, 2020, 4:21 AM

#

anyone competed harkpark

#

im stuck

white salmon Apr 5, 2020, 5:05 AM

#

I completed it @dull comet

north moat Apr 5, 2020, 5:46 AM

#

How do we start entering text into our new Vim document?

i still don't understand !

#

when i go to vim , with i enter to Insert mode and start typing what it mean

white salmon Apr 5, 2020, 5:55 AM

#

@north moat you answered your own question

#

You just don't realize it

north moat Apr 5, 2020, 5:57 AM

#

@white salmon Hmm ! it's really bad question i really stuck on it

white salmon Apr 5, 2020, 5:57 AM

#

Yeah that question is pretty dumb

#

But think about it

#

When you enter text into a document

#

What are you doing

#

It's very litteral

north moat Apr 5, 2020, 5:59 AM

#

ahh Done ! it's Really Dump :)) @white salmon

pseudo ermine Apr 5, 2020, 6:56 AM

#

Anybody got a tip for the way of thinking for linux challenge flag26? I found the other flags and eventually I did look at the write-up for flag26 but I don't get the reasoning behind it

north moat Apr 5, 2020, 7:18 AM

#

If a password hash starts with $6$, what format is it (Unix variant)? , format = type ?

ripe needle Apr 5, 2020, 7:20 AM

#

try using hashid

#

i think it will tells you if am not wrong

north moat Apr 5, 2020, 7:20 AM

#

i found the type of hash , but my answer seems wrong

split flume Apr 5, 2020, 9:13 AM

#

Sha512

#

Try hashcat using mode 1800

pseudo ermine Apr 5, 2020, 10:10 AM

#

Yeah you need to add a suffix to it

#

Keep googeling and you’ll find it. Don’t know if I’m allowed to give a better hint ;-p

modern plank Apr 5, 2020, 2:19 PM

#

I'm stuck in room BP: Volatility on the last question where do i find which malware the sample is infected with?

compact sky Apr 5, 2020, 2:37 PM

#

you and me both, i cant find any information on vt/ha

modern plank Apr 5, 2020, 2:55 PM

#

jep

white salmon Apr 5, 2020, 3:13 PM

#

hey guys can anyone help me with routing?

white salmon Apr 5, 2020, 4:15 PM

#

anyone got tip for inoculation ?

north moat Apr 5, 2020, 5:00 PM

#

i can't get metasploit shell in https://tryhackme.com/room/ccpentesting

TryHackMe

TryHackMe | CC: Pen Testing

A crash course on various topics in penetration testing

#

is something wrong on machine ?

stuck fractal Apr 5, 2020, 5:00 PM

#

What's happening or not happening?

north moat Apr 5, 2020, 5:00 PM

#

[*] Configuring Automatic (Unix In-Memory) target
[*] Sending cmd/unix/reverse_perl command payload
[*] Exploit completed, but no session was created.```

stuck fractal Apr 5, 2020, 5:00 PM

#

Can I get you to read this: https://discordapp.com/channels/521382216299839518/522158539129618453/694551215039578172

#

your LHOST is wrong for definite

north moat Apr 5, 2020, 5:01 PM

#

its okey

#

im using Local kali

stuck fractal Apr 5, 2020, 5:02 PM

#

The tryhackme kali?

north moat Apr 5, 2020, 5:02 PM

#

yes

stuck fractal Apr 5, 2020, 5:02 PM

#

Then you might be doing something else wrong

#

Still, the guide I posted

#

What task and question?

north moat Apr 5, 2020, 5:02 PM

#

Task 10 Question 1 .... 10

#

after i run exploit i got [*] Started reverse TCP handler on 10.10.51.242:4444 [-] Exploit aborted due to failure: not-vulnerable: Set ForceExploit to override [*] Exploit completed, but no session was created.

#

i also did set ForceExploito override

stuck fractal Apr 5, 2020, 5:04 PM

#

Sounds like something is set wrong

#

Did you deploy the right machine?

north moat Apr 5, 2020, 5:04 PM

#

and try again but not work

#

sure

#

im deploy machine in TASK 3

stuck fractal Apr 5, 2020, 5:05 PM

#

There's no machine in task 3

north moat Apr 5, 2020, 5:06 PM

#

where is this task Machine ?

#

maybe i run wrong machine 🙂

stuck fractal Apr 5, 2020, 5:06 PM

#

Task 10, deploy button

north moat Apr 5, 2020, 5:07 PM

#

oh its first time i saw different deploy on task , sorry 🙂

nimble onyx Apr 5, 2020, 6:15 PM

#

I'm doing the webgramming room and am stuck on the third task, enum

#

I wrote a simple script that looks like this

#

import string
import requests
from itertools import combinations
from itertools import permutations
import time
import re


url = "http://<machine ip>:1339/enumerate?help="

pattern = re.compile(r'\s+')
t0 = time.time()
i=1
while True:
    for ele in permutations(string.ascii_letters+"_-", i):
        boop = re.sub(pattern, "", ''.join(ele)).strip()
        r = requests.get(url + boop)
        print(r.status_code, boop)
        if r.status_code == 200:
            print(url+boop)
            break
    i+=1

#

is this the right idea?

hollow holly Apr 5, 2020, 10:41 PM

#

hey guys, hope everything is good!
my terminal is freezing too many times and I'm not able to right anything on it
so I have to close it and make an ssh connection and start all over again

#

did this ever happened to you guys?

#

you at least, frequently

#

im running the last kali version, 2020.1b

white salmon Apr 5, 2020, 11:18 PM

#

Locally or thm?

#

@hollow holly

green prism Apr 6, 2020, 1:04 AM

#

how do i approach day 10 of advent cyber?

#

has ssh/22, http apache tomcat/coyote JSP engine 1.1 (which is vulnerable) and rpcbind

stuck fractal Apr 6, 2020, 1:07 AM

#

Read the supporting material

green prism Apr 6, 2020, 1:10 AM

#

alrighty

#

really should have read it cause i skipped it

#

thought it wouldn't be necessary

white salmon Apr 6, 2020, 2:18 AM

#

so uh
im stuck
can someone give me some hints(without breaking rules)
im at [Task 13] [Day 8] SUID Shenanigans
just gotten in

ripe needle Apr 6, 2020, 8:29 AM

#

hey guys I have a question about LFI Basics
how can i run uname -r

#

i did like that but i can see any pass or users

glossy basin Apr 6, 2020, 8:31 AM

#

@ripe needle what stage are you on?

#

have you gotten the /etc/passwd ?

prisma blade Apr 6, 2020, 8:33 AM

#

the credit card ?

#

im in task 3 question 6

glossy basin Apr 6, 2020, 8:34 AM

#

@prisma blade i was asking Aloo

#

or did you change an account?

prisma blade Apr 6, 2020, 8:37 AM

#

if that what you mean

glossy basin Apr 6, 2020, 8:38 AM

#

so you can't run uname -r ?

prisma blade Apr 6, 2020, 8:38 AM

#

how can i do it

#

i did like http://<IP>/lfi/lfi.php?page=/var/log/apache2/access.log&lfi=

#

i did view page source

glossy basin Apr 6, 2020, 8:39 AM

#

you have to put the command right after the link

prisma blade Apr 6, 2020, 8:39 AM

#

yes

#

i did http://<IP>/lfi/lfi.php?page=/var/log/apache2/access.log&lfi=uname -r

glossy basin Apr 6, 2020, 8:42 AM

#

you need to replace the space between uname and -r with a %20, i think

#

you can't just leave it like a space there

prisma blade Apr 6, 2020, 8:42 AM

#

ah i will try

#

thank you

ripe needle Apr 6, 2020, 8:50 AM

#

i doesnt show any user or pass

#

it*

white salmon Apr 6, 2020, 9:30 AM

#

Why %25 (-> '%') ? Shouldn't it be %20 (-> ' ')?

ripe needle Apr 6, 2020, 9:32 AM

#

you mean i use '' after uname-r

glossy basin Apr 6, 2020, 9:34 AM

#

no

#

you use %25 in between uname and -r

#

but it's supposed to be %20

ripe needle Apr 6, 2020, 9:35 AM

#

i did 20 but i cant see anything

inland onyx Apr 6, 2020, 11:09 AM

#

@ripe needle @prisma blade are you one person switching between two accounts? If so, why?

prisma blade Apr 6, 2020, 11:10 AM

#

no just one account i just changed my email

#

and im not sure how to get my old user or why changed

inland onyx Apr 6, 2020, 11:12 AM

#

Aloo and aloo11ca appear to be entirely different accounts?

prisma blade Apr 6, 2020, 11:12 AM

#

no same account

#

i want to delete this one

inland onyx Apr 6, 2020, 11:14 AM

#

That's in your Discord settings under "My Account"

prisma blade Apr 6, 2020, 11:16 AM

#

i change it

#

not sure why i cant see my old msgs

inland onyx Apr 6, 2020, 11:21 AM

#

What do you mean?

prisma blade Apr 6, 2020, 12:08 PM

#

nvm 🙂

empty nimbus Apr 6, 2020, 2:33 PM

#

Hi everyone, is this the right channel to ask for help on rooms ?

pseudo ermine Apr 6, 2020, 2:37 PM

#

Yes 😃

tidal sedge Apr 6, 2020, 2:43 PM

#

@empty nimbus If you want a hint then ask here otherwise ask in #room-help

empty nimbus Apr 6, 2020, 3:29 PM

#

I'm having trouble with the Learn Linux room, I'm at the last section (where you have to find the flag in /root/root.txt). I actually have a little bit of experience with Linux privesc (I did a few easy HTB boxes) but I'm stuck here

#

If I'm correct, there are 4 users to which you can connect (shiba1-4) but none of them has sudo privileges

hallow niche Apr 6, 2020, 3:41 PM

#

@empty nimbus try seeing what the users have access to

frozen night Apr 6, 2020, 3:47 PM

#

"What flag do you use to set the BSSID to monitor?" can anyone answer this please

last nova Apr 6, 2020, 3:57 PM

#

im guessing you're doing a wireless room -- id tske a look at airodumps man pages

wheat hollow Apr 6, 2020, 6:39 PM

#

Nudge for ignite please

#

priv esc

#

I know that there are write ups

#

But I don't want to get spoiled

white salmon Apr 6, 2020, 7:03 PM

#

Hello 🙂 I am stucked on the BP: Volatility room on the last Question, where i have to name the malware.. i uploaded the dll's but i only get answers what dont fit in. Answer is 6 chars long. i saw that many here had the same question but it never get answered? can someone help me out?

compact sky Apr 6, 2020, 7:04 PM

#

what i can say is look deeper on the evidence osint-wise

white salmon Apr 6, 2020, 7:05 PM

#

allright thx, i give it a shot 🙂

compact sky Apr 6, 2020, 7:06 PM

#

and dont be afraid to try things not mentioned in the class

white salmon Apr 6, 2020, 7:30 PM

#

I give up 😄 i cant find anything new on Virustotal or hybrid.

#

Perhaps the Question is misleading?
What malware has our sample been infected with? You can find this in the results of VirusTotal and Hybrid Anaylsis.
Results shows very less info, except you register to Virustotal or Hybrid. or am i looking in the wrong direction here at all?

compact sky Apr 6, 2020, 7:35 PM

#

dont get tunnel-vision in one track.
my mistake was to read to hard into how the question was formulated.

wet shore Apr 6, 2020, 7:45 PM

#

Hi fellas. I need hint for linux challenges flag 26

#

It only says "Locate and retrieve flag 26." nothing else

fair marsh Apr 7, 2020, 5:56 AM

#

Hello guys! I am a beginner. Can you recommend me where to study penetration testing?

glossy basin Apr 7, 2020, 6:43 AM

#

@fair marsh
Start from learning linux, https://tryhackme.com/room/zthlinux <- can help you with that
Then learn NMAP here: https://tryhackme.com/room/rpnmap
And continue with this: https://tryhackme.com/room/vulnversity

peak girder Apr 7, 2020, 7:35 AM

#

@wet shore (sorry a littlebit late) you'll need to find it .... go nuts, and try and use regex (you should know what these flags look like now)

white salmon Apr 7, 2020, 7:48 AM

#

Can anyone help I'm just going through the 'intro to curl' but I'm stuck on making a POST request to ctf/post with the body 'flag_please"? I have terminal open and I'm typing curl -X POST --data <"flag_please"> <server IP>:<port>/ctf/post is that correct or am I way off?

peak girder Apr 7, 2020, 7:52 AM

#

@white salmon maybe include headers?

white salmon Apr 7, 2020, 7:53 AM

#

Thanks for the heads up! 😄

peak girder Apr 7, 2020, 7:54 AM

#

@white salmon well I'm not quite sure if that helps as I've not done that room yet... But I do use curl 😛

white salmon Apr 7, 2020, 7:56 AM

#

Hmm

peak girder Apr 7, 2020, 7:56 AM

#

@white salmon curl normally adds this header to your request when POSTing: content-type application/x-www-form-urlencoded but if it's not urlencoded (like JSON for example) it wouldn't work

white salmon Apr 7, 2020, 7:56 AM

#

I've done all the other questions it's just this one that's kicking my ass for some reason, think I need more coffee.

peak girder Apr 7, 2020, 7:58 AM

#

can you share wich room (and task) exactly? I'll try and have a look 🙂

white salmon Apr 7, 2020, 7:59 AM

#

I've just figured it out.

#

It's the Web Fundamentals room and it's the mini CTF.

#

-d was required.

peak girder Apr 7, 2020, 8:01 AM

#

instead of --data? ah

#

well 🎉 @white salmon

#

sure thing 😉

white salmon Apr 7, 2020, 8:03 AM

#

So happy now, it's been bugging me for a couple of days, just shows you researching on google really does work 😛

#

And asking in here too 😛

peak girder Apr 7, 2020, 8:05 AM

#

you couldn't find it with --help?

#

I usually check there first then google and then just hit up random commands in https://explainshell.com/ <-- really good tool for checking commands from other people 😉

explainshell.com - match command-line arguments to their help text

match command-line arguments to their help text

white salmon Apr 7, 2020, 8:06 AM

#

I did try but lack of coffee and the fact it was pissing me off probably made me just lose focus and not look properly.

#

Thanks for the link I'll give it a whirl.

peak girder Apr 7, 2020, 8:06 AM

#

I know that feeling 😦

#

It's a great page if you are looking at tutorials and people just paste commands like it's nothing (and they expect you to know what it does), I use it for work sometimes when I have to reverse engineer someone else's bash scripts or when I'm looking in someones history 😉 😛

#

(esp good for getting to know the sed awk commands that we all charish and love. Pretty good way to make oneliners but awful in readability)

white salmon Apr 7, 2020, 8:11 AM

#

Nice one!

lime needle Apr 7, 2020, 8:15 AM

#

Hey anyone doin new machine

white salmon Apr 7, 2020, 8:17 AM

#

I'm not.

#

Same

#

Over here just nooting

patent jacinth Apr 7, 2020, 8:24 AM

#

Hey guys, looking at the task from this one https://tryhackme.com/room/introtopython. It says that the text was encoded 5 times by base 16, 32 and 64. Does that mean it has to be decoded that many times to return to the flag? I've not spent much time with base64, so I'm finding it quite tough. @dusky vigil any tips, brah

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

tidal sedge Apr 7, 2020, 8:25 AM

#

Yes, that means it has to be decoded in each base 5 times.

patent jacinth Apr 7, 2020, 8:41 AM

#

right, I'm gonna have to read the base64 docs again, there must be an argument rather than looping through

stark glen Apr 7, 2020, 12:21 PM

#

Hello guys

#

Who has completed (Linux Challenges)???

white salmon Apr 7, 2020, 2:45 PM

#

I'm just starting them.

dense vine Apr 7, 2020, 5:42 PM

#

In skynet, am I supposed to break into the CMS in order to exploit the vuln I found? Just curious

merry sonnet Apr 7, 2020, 6:39 PM

#

anyone have issues with "joker" on task#18 the alias was there and then now it isn't showing up anymore

stuck fractal Apr 7, 2020, 6:55 PM

#

@merry sonnet Yes, you just have to re-exploit and hope that it works

merry sonnet Apr 7, 2020, 6:57 PM

#

@stuck fractal so just keep re-deploying it until I can get further

stuck fractal Apr 7, 2020, 6:59 PM

#

Yeah it's a pain

#

I tried on like 3 seperate occasions before I got it to work

merry sonnet Apr 7, 2020, 6:59 PM

#

ok ill keep at it, thanks for the heads up

ornate narwhal Apr 7, 2020, 7:33 PM

#

im so confused by this question, and by hint as well 😄 I'm root, i know there is no requirments to run vi, but i cant seem to find the answer.

📎 unknown.png

#

Hint is : no password

white salmon Apr 7, 2020, 7:34 PM

#

@ornate narwhal what does sudo -l say

#

Where it says you can run vi with no requirements

ornate narwhal Apr 7, 2020, 7:35 PM

#

📎 unknown.png

dusky vigil Apr 7, 2020, 7:37 PM

#

there you go

#

It literally tells ya mate, research what (ALL : ALL) ALL Within /etc/sudoers means

white salmon Apr 7, 2020, 7:37 PM

#

The hint is no password

#

What does sudo -l say about commands you can execute without a password

#

Research that

ornate narwhal Apr 7, 2020, 7:39 PM

#

on it

#

got it.. need to get used to those shord words in linux

#

thanks

lime junco Apr 8, 2020, 12:12 AM

#

I'm pretty sure find the flag for "Basic Steganography" room question 3. but it doesn't accept flag. Anybody confirm my flag?

#

I look at the write ups and my flag is true. I think, there is some problem about room "Basic Steganography" question 3.

cedar path Apr 8, 2020, 2:13 AM

#

Yo so I'm on the learn Linux room, task 21. I am very, very lost.

#

please help im about to punch a hole in my monitor

inland onyx Apr 8, 2020, 2:16 AM

#

Are you after a hint, or help @cedar path?

cedar path Apr 8, 2020, 2:16 AM

#

a hint! please!

inland onyx Apr 8, 2020, 2:17 AM

#

The task is wordy. Split into direct tasks:

1) Create an environment variable called test1234 and set it to the value of the USER variable
1) Run the binary

#

That help?

cedar path Apr 8, 2020, 2:17 AM

#

OH I HAVE TO CREATE IT

inland onyx Apr 8, 2020, 2:18 AM

#

Mhm

cedar path Apr 8, 2020, 2:18 AM

#

"The binary is checking to see if the environment variable "test1234" exists"

#

what does this mean then? in english

inland onyx Apr 8, 2020, 2:18 AM

#

It's checking to see if it exists. In other words, right now it does not exist -- you have to create it for the binary to find it

cedar path Apr 8, 2020, 2:19 AM

#

Yeah but what is "it"

#

Like, okay.

inland onyx Apr 8, 2020, 2:20 AM

#

The environment variable test1234

cedar path Apr 8, 2020, 2:20 AM

#

I think I'm confused as to what "The Binary" is

inland onyx Apr 8, 2020, 2:21 AM

#

shiba2

#

A binary is an executable file -- like .exe files on windows

cedar path Apr 8, 2020, 2:21 AM

#

right

inland onyx Apr 8, 2020, 2:21 AM

#

It's compiled code -- a program that does something

cedar path Apr 8, 2020, 2:21 AM

#

shiba2 is a user

inland onyx Apr 8, 2020, 2:21 AM

#

shiba2 is also the name of the user, yes

cedar path Apr 8, 2020, 2:21 AM

#

oh f that's not confusing at all

#

it's like having two kids named 'bob'

#

ok let me try again, thank you

inland onyx Apr 8, 2020, 2:22 AM

#

@white salmon -- room foodback for yah ^^

#

Np 😄

dense vine Apr 8, 2020, 2:27 AM

#

Anyone do skynet?

cedar path Apr 8, 2020, 2:32 AM

#

@inland onyx you are a God thank you sir

#

also, what would have happened if i ran this bin file if I hadn't met the conditions described? If i hadn't made those environment variables?

inland onyx Apr 8, 2020, 2:33 AM

#

It would segfault

#

In the other challenges it wouldn't really matter -- it just wouldn't do anything

#

In this one it would be trying to access memory that doesn't exist

#

So it would give you a segmentation fault error

cedar path Apr 8, 2020, 2:34 AM

#

bless

#

ok

#

thank you, flowers are in the mail i hope you like tulips

inland onyx Apr 8, 2020, 2:35 AM

#

😆

steady stratus Apr 8, 2020, 2:36 AM

#

I heard he loves them

inland onyx Apr 8, 2020, 2:37 AM

#

Haha -- I'm more a fan of Lilies myself, but 🤷‍♂️

cedar path Apr 8, 2020, 2:37 AM

#

lilies smell fantastic

inland onyx Apr 8, 2020, 2:38 AM

#

📎 iu.png

cedar path Apr 8, 2020, 2:38 AM

#

That reminds me, I need to pick up some easter lilies for my grandmother. hopefully they didn't get the rona, too

dense vine Apr 8, 2020, 2:44 AM

#

Sicki fired it out

true gazelle Apr 8, 2020, 1:29 PM

#

hey there im at Learn Linux room , i need hint with task nym 18

#

num*

glossy basin Apr 8, 2020, 1:29 PM

#

let me see

#

task 18

true gazelle Apr 8, 2020, 1:29 PM

#

thank you Swafox

glossy basin Apr 8, 2020, 1:29 PM

#

yes, what question are you on?

true gazelle Apr 8, 2020, 1:30 PM

#

i got the # question , but on the other one wich says "What is the value of the home environment variable

"\

glossy basin Apr 8, 2020, 1:30 PM

#

so you are on Q1?

true gazelle Apr 8, 2020, 1:30 PM

#

im on #2

glossy basin Apr 8, 2020, 1:31 PM

#

so you have to read the value of home varuable

#

$HOME is the varuable

true gazelle Apr 8, 2020, 1:32 PM

#

echo $HOME

#

value of the home environment variable

#

nether $HOME or echo fits

glossy basin Apr 8, 2020, 1:33 PM

#

cat $HOME to be exact

#

you want to read it

#

yup, but the question is asking for the value of home varuable

#

so like, what's inside of it

#

not the command you use

true gazelle Apr 8, 2020, 1:35 PM

#

cat $HOME to be exact

cat $HOME to be exact
@glossy basin I GOT IT!!
thanks man!

glossy basin Apr 8, 2020, 1:37 PM

#

good :) u'r welcome

unkempt skiff Apr 8, 2020, 2:04 PM

#

Hey!

I'm on the room https://tryhackme.com/room/ccpentesting at Task 18.
It ask me to dump the database so i used sqlmap like i always do (Command used: ||sqlmap -u [url] --forms --dump||) and i should retrieve the flag... and all i got i some ||<blank>|| value where it should (i guess) have the flag needed for the last question. (So as stupid as i am, i answer with ||<blank>|| and well, bad answer, i'm not surprised)
Well, seeing i have some blank value and i don't know what to do with them, i take 4 hour to dump-all (Command used: ||sqlmap -u [url] --forms --dump-all|| the database aaaaaand still ||<blank>|| values on the non-sys table (all sys table are filled)... I noticed some weird types for columns (like type "||a||") (can provide screenshots if necessary, i tried to hide as much as possible answers or hint not asked by someone)
Does someone know if its a bug? If not a bug, can i have a hint on what to do / flags i may have forget? Thanks 🙂

TryHackMe

TryHackMe | CC: Pen Testing

A crash course on various topics in penetration testing

novel jackal Apr 8, 2020, 2:52 PM

#

Hi !

#

I'm currently resolving the cod caper but I have a problem : I'm stuck at the step where we are to decrypt the guy's password :

#

||ssh2john : pingu.hash has no password !||

#

Is the ||id_rsa file|| in the ||/home/pingu/.ssh directory|| the expected thing?

#

Or do I have to look at somewhere else ?

unkempt skiff Apr 8, 2020, 2:58 PM

#

You may "find" something else 😉

novel jackal Apr 8, 2020, 2:58 PM

#

yup i ran the find command but nothing show up even with ||find -user pingu||

mystic prairie Apr 8, 2020, 2:59 PM

#

Can we use a different VPN for the rooms?

novel jackal Apr 8, 2020, 2:59 PM

#

(if i understood, it is the expected command)

unkempt skiff Apr 8, 2020, 2:59 PM

#

Not exactly

inland onyx Apr 8, 2020, 2:59 PM

#

@novel jackal it might not be that user...
Try all of them -- even the "fake" ones

novel jackal Apr 8, 2020, 2:59 PM

#

oh i got it

#

thx guys ❤️

white fern Apr 8, 2020, 3:02 PM

#

has anyone done the cod caper machine?
I am having some troubles and I could really use some help

unkempt skiff Apr 8, 2020, 3:02 PM

#

What is the problem ?

white fern Apr 8, 2020, 3:02 PM

#

so it asks me for an ssh password

#

I could find some rsa keys on the machine

late patio Apr 8, 2020, 3:03 PM

#

@white fern Please post in one room. Read what each room is for.

white fern Apr 8, 2020, 3:03 PM

#

@late patio my b

true gazelle Apr 8, 2020, 4:16 PM

#

how do you guys black things out like this

yup i ran the find command but nothing show up even with ||find -user pingu||
@novel jackal

novel jackal Apr 8, 2020, 4:17 PM

#

With 4 | chars

true gazelle Apr 8, 2020, 4:17 PM

#

test||||

#

||||test||||

novel jackal Apr 8, 2020, 4:17 PM

#

And you write the content between 2 |

true gazelle Apr 8, 2020, 4:17 PM

#

got it

novel jackal Apr 8, 2020, 4:17 PM

#

^^

true gazelle Apr 8, 2020, 4:17 PM

#

another thing if i may

#

im at Linux Walk Through

#

TAst num 24

#

task number 24*

#

q #1

#

the answer is not 461? what exactly are they expecting?

#

||460|| i got it by myself this time ^^

novel jackal Apr 8, 2020, 4:24 PM

#

I don't know i didn't do it :)

#

U may want to mask off the key values u put on Ur messages to avoid spoil ^^

true gazelle Apr 8, 2020, 4:42 PM

#

https://imgur.com/aOLEKfB.png

Imgur

Screenshot

topaz snow Apr 8, 2020, 4:45 PM

#

hi, i'm stuck doing the hydra challenge, i can't find molly password either web or ssh after going trought the all rockyou passlist is there any writeup or hint for this one other then the "If you've tried more than 30 passwords from RockYou.txt, you are doing something wrong!" ?

stuck fractal Apr 8, 2020, 4:46 PM

#

The standalone hydra room or the christmas one?

topaz snow Apr 8, 2020, 4:46 PM

#

the standalone one

stuck fractal Apr 8, 2020, 4:47 PM

#

I got a guide that I keep linking people for that room and other rooms with Hydra

#

Normally, if you're not getting the right password it means your syntax is wrong

#

Are you getting 16 or so "correct" passwords and then hydra exits?

topaz snow Apr 8, 2020, 4:49 PM

#

i'm not getting any correct password ? hydra just go throught all the password in the passlist and nothing is correct

stuck fractal Apr 8, 2020, 4:49 PM

#

https://redteamtutorials.com/2018/10/25/hydra-brute-force-https/

Red Team Tutorials

Hydra - Brute Force HTTP(S)

topaz snow Apr 8, 2020, 5:00 PM

#

yep doesn't get me any further i'm still stuck, and i don't have any idea on how to fix it

novel jackal Apr 8, 2020, 5:02 PM

#

Be sure the box is up

#

Or deploy a new one

#

@true gazelle

topaz snow Apr 8, 2020, 5:04 PM

#

"hydra -l molly -P rockyou.txt 10.10.169.223 http-post-form "/login:Username=^USER^&Password=^PASS^:F=incorrect" -V " is the command that i'm using even correct ?

novel jackal Apr 8, 2020, 5:08 PM

#

You should use Hydra-GTK but at the first glance, nothing seems horrible out there

topaz snow Apr 8, 2020, 5:11 PM

#

hydra-gtk ?

#

there is the wizard but it doesn't get me any further

stuck fractal Apr 8, 2020, 5:15 PM

#

@topaz snow F=inforrect seems wrong?

#

also, ` will let you do code formatting, like this

#

```language
Code here ``` will do syntax highlighting

topaz snow Apr 8, 2020, 5:19 PM

#

ok thanks

#

and how f=incorrect is rong as

#

this is what pop-up when you enter a wrong pass

📎 thm.png

#

so idk

📎 thm2.png

stuck fractal Apr 8, 2020, 5:27 PM

#

@topaz snow the F is part of the string it's looking for

#

If "F=incorrect" doesn't appear in the response, then it won't match

topaz snow Apr 8, 2020, 5:28 PM

#

Oh i see

#

I'm dumb

humble siren Apr 8, 2020, 6:04 PM

#

Hello guys, i'm trying to perform the last task of the last day of Advent of Cyber.
I actually already managed to get the root.txt but i would like to complete the exploit according to the the CVE-2018-17246.
The exploit is based on being able to upload a file (a .js rev-shell) and then execute it.
However i can't find a way to upload a file, where should i look?

lone abyss Apr 8, 2020, 6:38 PM

#

can someone help me here

#

📎 help.PNG

stuck fractal Apr 8, 2020, 6:39 PM

#

@lone abyss It's a technique once you've breached a system

lone abyss Apr 8, 2020, 6:39 PM

#

I feel like I know the answer but idk

#

I tried directory traversal too

stuck fractal Apr 8, 2020, 6:43 PM

#

It's not that

#

It's once you've got a shell really

topaz snow Apr 8, 2020, 7:06 PM

#

hydra -l molly -P rockyou.txt 10.10.169.223 http-post-form "/login:Username=^USER^&Password=^PASS^:incorrect -V @stuck fractal something like this would work ?

stuck fractal Apr 8, 2020, 7:07 PM

#

Try it

topaz snow Apr 8, 2020, 7:08 PM

#

it has been running for the past 2 min still nothing

#

and more then 10k pass test so the fact the hint is telling me that if it goes for more then 30 pass i'm doing something wrong so i'm doing something wrong but idk what

stuck fractal Apr 8, 2020, 7:10 PM

#

@topaz snow Christmas or standalone?

#

Oh standalone

topaz snow Apr 8, 2020, 7:10 PM

#

yep standalone

stuck fractal Apr 8, 2020, 7:11 PM

#

uhh lemme check that room

stone meadow Apr 8, 2020, 7:16 PM

#

i am stuck on bof1 room, could someone help me?

stuck fractal Apr 8, 2020, 7:18 PM

#

I'm still not sure if anyone actually has completed that

#

BoF specialists are rare here

stone meadow Apr 8, 2020, 7:19 PM

#

i just register this site, which channel should i ask?

stuck fractal Apr 8, 2020, 7:19 PM

#

@topaz snow Taking a look now

#

@stone meadow Just saying you might not get any help when you ask, in order to help, people need to know the topic or the room well

stone meadow Apr 8, 2020, 7:20 PM

#

yes sure

topaz snow Apr 8, 2020, 7:21 PM

#

@stuck fractal no need to rush i've been stuck in this room for the past 3h i can wait xD

stuck fractal Apr 8, 2020, 7:21 PM

#

@topaz snow The parameters might be case sensitive

topaz snow Apr 8, 2020, 7:23 PM

#

idk what that mean i don't have the best english

stuck fractal Apr 8, 2020, 7:24 PM

#

@topaz snow You also missed a closing quote mark

#

So case is A vs a

#

Capital letter vs regular

#

Upper case is A

topaz snow Apr 8, 2020, 7:24 PM

#

oh ok gonna try other itération then

stuck fractal Apr 8, 2020, 7:24 PM

#

Your command is so close to being correct

#

Yeah so the case does matter, and you need the closing "

topaz snow Apr 8, 2020, 7:25 PM

#

and i ran the command with closing quote just didn't copy it for some reason

stuck fractal Apr 8, 2020, 7:26 PM

#

The closing quote shouldn't include -V

#

incorrect" -V, not incorrect -V"

#

Otherwise it will look on the page for "incorrect -V" and never find it, so assume all passwords are right

topaz snow Apr 8, 2020, 7:27 PM

#

hydra -l molly -P rockyou.txt 10.10.121.186 http-post-form "/login:username=^USER^&password=^PASS^:incorrect" -V like that ?

stuck fractal Apr 8, 2020, 7:28 PM

#

If the path to rockyou is correct there, that's almost exactly what I got working

topaz snow Apr 8, 2020, 7:29 PM

#

the path to rockyou is correct, it's the almost that's going to make me go insane xD

stuck fractal Apr 8, 2020, 7:30 PM

#

I mean I had the path different

#

That was the only difference

#

I copied and pasted your command, changed the wordlist path and fixed the quotes and case and it worked

topaz snow Apr 8, 2020, 7:33 PM

#

it finally worked just the 27k pass

stuck fractal Apr 8, 2020, 7:33 PM

#

Weird

#

Wasn't that bad for me

topaz snow Apr 8, 2020, 7:33 PM

#

so the hint is kinda missleading or i have a weird rockyou passlist

stuck fractal Apr 8, 2020, 7:33 PM

#

Kali has rockyou predownloaded in /usr/share/wordlists

#

Although you may have to extract it

topaz snow Apr 8, 2020, 7:34 PM

#

i'm on arch so i downloaded everything on my own

stuck fractal Apr 8, 2020, 7:36 PM

#

ahh

#

From naive-hashcat?

#

(For rockyou?)

topaz snow Apr 8, 2020, 7:36 PM

#

anyway thanks a lot @stuck fractal ,and i'm gonna write a writeup when i'm done with the ssh flag, so other people don't get stuck on it for as long as i did

stuck fractal Apr 8, 2020, 7:37 PM

#

It shouldn't be 27k in unless it's the christmas one

#

That was a mad distance through

topaz snow Apr 8, 2020, 7:38 PM

#

nop it was one i got at the time my school did a small ctf for fun

stuck fractal Apr 8, 2020, 7:39 PM

#

@topaz snow Dm me head -n 30 rockyou.txt and I'll tell you if it's the same order

true gazelle Apr 9, 2020, 5:26 AM

#

hello to everyone!

#

im at Learn Linux Task 31

#

#1 : How do you find files that have specific permissions?

#

can anyone give me a hine please

stuck fractal Apr 9, 2020, 5:28 AM

#

@true gazelle man find

true gazelle Apr 9, 2020, 5:36 AM

#

i`ve allready read the whole page

#

ive even used ||/|| to look for keywords

#

ive also tried ||perm|| without any hit

stuck fractal Apr 9, 2020, 5:39 AM

#

@true gazelle it's a flag, so - at the start

true gazelle Apr 9, 2020, 5:40 AM

#

Oh

true gazelle Apr 9, 2020, 6:50 AM

#

so im at Linux Challenge now , Task2 #4

#

"Flag 4 is located where cron jobs are created."

#

i tried ||find / -user cron|| but it replies me that there is no such user

#

find: ‘cron’ is not the name of a known user

vestal igloo Apr 9, 2020, 6:52 AM

#

cron isn't a user

dusky vigil Apr 9, 2020, 6:54 AM

#

@true gazelle As it's clear you haven't. How about google what a cron is

#

That will clear up a lot of your questiuons

true gazelle Apr 9, 2020, 6:55 AM

#

yeah just started to read about it

dusky vigil Apr 9, 2020, 6:55 AM

#

Google before you ask questions in the future

vestal igloo Apr 9, 2020, 6:57 AM

#

good luck

true gazelle Apr 9, 2020, 7:15 AM

#

thank you guys , after googling i`m still kinda stuck

#

i`ve benn inside ||/var/spool/cron|| no result , i have also visited ||/etc/cron|| without any thing out of the normal

#

no flags in both , or have i missed anything?

#

if checked all the daily,hourly and the others too

dusky vigil Apr 9, 2020, 7:35 AM

#

there are multiple areas crons are stored

#

e.g. ||/etc/crontab||

#

It's quite a misleading task and could be in a number of places

true gazelle Apr 9, 2020, 7:36 AM

#

It's quite a misleading task and could be in a number of places
@dusky vigil allrighty i will explore

white salmon Apr 9, 2020, 7:54 AM

#

Hi all,anyone a hint in frequency analysis challenge from Crypto Funhouse?

true gazelle Apr 9, 2020, 8:37 AM

#

there are multiple areas crons are stored
@dusky vigil can i ask why ||crontab(5) sucks|| ?

#

is this suppose to be another hint?

past night Apr 9, 2020, 8:41 AM

#

just

#

try harder

azure nova Apr 9, 2020, 8:46 AM

#

Is the SQLi room incomplete? I don't see any tasks or questions there.

true gazelle Apr 9, 2020, 8:49 AM

#

ive been in both ||/usr/local sbin & bin|| folders without any find ||(ls -la)|| @dusky vigil am i close?

glossy basin Apr 9, 2020, 8:49 AM

#

@azure nova it's a playground

#

proper SQLi room will be coming in the closest future

white salmon Apr 9, 2020, 9:45 AM

#

I'm currently doing the 'hashcat' room and I'm stuck when trying the bcrypt task (task 1 question 4). I've tried the command 'hashcat -m 3200 <hash> --force' am I missing something?

unkempt skiff Apr 9, 2020, 9:54 AM

#

You should specify an attack mode

white salmon Apr 9, 2020, 10:06 AM

#

Thank you @unkempt skiff

true gazelle Apr 9, 2020, 11:00 AM

#

So im on the Linux Challenge Task 2 q#4 ,

ive been in both ||/usr/local sbin & bin|| folders without any find ||(ls -la)|| @dusky vigil am i close?
@true gazelle

#

what am i missing

#

hints please

dusky vigil Apr 9, 2020, 11:00 AM

#

try harder

#

here

#

https://tryhackme.com/room/introtoresearch

TryHackMe

TryHackMe | Introductory Researching

A brief introduction to research skills for pentesting.

#

Might be worth doing this box before you continue

true gazelle Apr 9, 2020, 11:01 AM

#

Might be worth doing this box before you continue
@dusky vigil will do

#

thank you!

white salmon Apr 9, 2020, 11:31 AM

#

try harder
@dusky vigil try harder mindset

dusky vigil Apr 9, 2020, 11:32 AM

#

Very much so, there's a time and a place for asking questions. Usually once you have exhausted all routes of independent research

white salmon Apr 9, 2020, 11:32 AM

#

and there is no endto those routes

dusky vigil Apr 9, 2020, 11:33 AM

#

Nah sometimes there are ends

white salmon Apr 9, 2020, 11:33 AM

#

so far linux boxes are the easiest I guess, since retro pissed me off

dusky vigil Apr 9, 2020, 11:33 AM

#

^^

#

If it means anything Dark, the guy who created that box. Did it on stream a couple nights ago and couldn't do the priv esc

#

😂

white salmon Apr 9, 2020, 11:34 AM

#

Nah sometimes there are ends
@dusky vigil yeah

#

If it means anything Dark, the guy who created that box. Did it on stream a couple nights ago and couldn't do the priv esc
@dusky vigil i was there and oh god it was like bang bang bang

#

it motivated me though

#

if the pro stuck its something normal then

white salmon Apr 9, 2020, 11:53 AM

#

When I try to do "search server/socks4a in rpmetasploit it kept giving me an error saying I needed to give a directory or something

north moat Apr 9, 2020, 12:38 PM

#

in room Crack the hash , Task1 #5 , password not include in rockyou is it okey ?

snow flume Apr 9, 2020, 12:59 PM

#

Can you help me with some hints for last challange in the Learn Linux Room?

#

i have to get the flag from /root/root.txt

#

i have to get what is inside the root.txt file?

vestal igloo Apr 9, 2020, 1:03 PM

#

yes

snow flume Apr 9, 2020, 1:04 PM

#

i opened the file with nano and it is empty

#

yeah

#

it is empty because i don't have the permision to root

#

i can't get past the need of permision

true gazelle Apr 9, 2020, 3:23 PM

#

try harder
@dusky vigil does the answer inside this? if [ -x /usr/share/mdadm/checkarray ] && [ $(date +%d) -le 7 ]; then /usr/share/mdadm/checkarray --cron --all --idle --quiet; fi
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

#

the date of today is 9th so it runs at 00:57 on every Sunday,

white salmon Apr 9, 2020, 3:37 PM

#

Did you ask Google about it ?

static kiln Apr 9, 2020, 3:38 PM

#

I had no idea what cron jobs were prior to this, and I remember this one being a pain to do research on.

#

Just keep at it.

true gazelle Apr 9, 2020, 3:39 PM

#

Just keep at it.
@static kiln thank you for cheering me up

#

i hope my answers rellays here

#

https://opensource.com/article/17/11/how-use-cron-linux

Opensource.com

How to use cron in Linux

No time for commands? Scheduling tasks with cron means programs can run but you don't have to stay up late.

static kiln Apr 9, 2020, 3:40 PM

#

If I recall, there are multiple areas cron jobs are stored, but one main one.

#

That's what made it a pain, for me at least.

white salmon Apr 9, 2020, 3:40 PM

#

you're not supposed to create a cron

static kiln Apr 9, 2020, 3:40 PM

#

No, you're supposed to find one.

true gazelle Apr 9, 2020, 3:41 PM

#

does the answer inside this? if [ -x /usr/share/mdadm/checkarray ] && [ $(date +%d) -le 7 ]; then /usr/share/mdadm/checkarray --cron --all --idle --quiet; fi

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@true gazelle according to this formula?

#

No, you're supposed to find one.
@static kiln ^^ ?

dusky vigil Apr 9, 2020, 3:42 PM

#

Right I'm gunna politely ask you stop pinging me, as I've had like 5 pings in under an hour

static kiln Apr 9, 2020, 3:42 PM

#

I have very little idea what any of that means, but I remember when I found the right spot it kind of popped out.

true gazelle Apr 9, 2020, 3:42 PM

#

i didnt know i was doing it im sorry optional

white salmon Apr 9, 2020, 3:43 PM

#

@true gazelle PM if you want

static kiln Apr 9, 2020, 3:44 PM

#

There are files that store cron jobs. I opened them in vim and nano until I found one that looked viable.

#

That's all.

true gazelle Apr 9, 2020, 3:44 PM

#

There are files that store cron jobs. I opened them in vim and nano until I found one that looked viable.
cat wont work here? becuse im reading with cat

static kiln Apr 9, 2020, 3:45 PM

#

It should yes, but I found opening it like a text file and then closing it when I was satisfied better. Probably just personal preference.

#

Also helped get a bit more familiar with vim, which I imagine is probably a "better now than later" sort of thing.

#

It seems to be the main text editor on Linux systems.

true gazelle Apr 9, 2020, 3:47 PM

#

ill keep looking , thank you all

static kiln Apr 9, 2020, 3:48 PM

#

Best of luck. Once you really feel stuck I'll try to offer a better hint without totally giving it away.

true gazelle Apr 9, 2020, 3:48 PM

#

Much appreciated!

static kiln Apr 9, 2020, 3:49 PM

#

But like optional said, Try Harder.

#

If you're unaware, they're not just being a meanie. That's an OSCP thing.

#

https://www.offensive-security.com/offsec/say-try-harder/

Offensive Security Say – Try Harder! | Offensive Security

true gazelle Apr 9, 2020, 3:49 PM

#

If you're unaware, he's not just being a meanie. That's an OSCP thing.
@static kiln i dream to become one 🙂 i have much of respect to them , just walking thru beginners path hehe

white salmon Apr 9, 2020, 4:05 PM

#

when i try to do the zthlinux and connect, it just says connection timed out

static kiln Apr 9, 2020, 4:06 PM

#

@white salmon Screenshots please.

white salmon Apr 9, 2020, 4:10 PM

#

im using powershell because im using windows

📎 unknown.png

nimble onyx Apr 9, 2020, 4:53 PM

#

I'm doing the common linuxprivsec room, and I can't become root from user 7

#

I did everything in task 2 correctly I think and am executing ||echo new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:/root:/bin/bash >> /etc/passwd|| to append that to /etc/passwd

#

but then I su new and enter 123 as my password and it gives me an auth failuer

static kiln Apr 9, 2020, 4:55 PM

#

Are you on the VPN @white salmon

untold nest Apr 9, 2020, 4:55 PM

#

Happy to be part of the tryhackme community, at work at the moment BUT AFTER. Can't wait excited haha 😁 Have a great day everyone!

white salmon Apr 9, 2020, 4:56 PM

#

fixed it thx

#

you too!

static kiln Apr 9, 2020, 4:56 PM

#

May I ask the problem, out of curiosity?

white salmon Apr 9, 2020, 4:57 PM

#

well, the room said I needed to install putty and I thought I needed to install it on windows (outside the vbox) so wasnt connected to the vpn as i am in vbox

#

(im a noob 🙂 )

static kiln Apr 9, 2020, 4:57 PM

#

Ah, no worries. Yeah, if you're on vbox I'd recommend you get a Kali image.

#

It'll help. A lot.

white salmon Apr 9, 2020, 4:58 PM

#

have a kali image just didnt know i could do that on kali

#

but now i do ^^

static kiln Apr 9, 2020, 4:59 PM

#

These tests are designed with the web-based Kali VM they have in mind.

#

So, everything should work on them I'd think.

white salmon Apr 9, 2020, 5:00 PM

#

yup thank you

#

@nimble onyx I think your command is missing a segment

nimble onyx Apr 9, 2020, 5:01 PM

#

@white salmon is it echo new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash >> /etc/passwd

white salmon Apr 9, 2020, 5:02 PM

#

@nimble onyx Looks better. Still missing 2 little things

nimble onyx Apr 9, 2020, 5:02 PM

#

hmm

#

I'm not sure

stuck fractal Apr 9, 2020, 5:02 PM

#

Wait, I think I see it

nimble onyx Apr 9, 2020, 5:02 PM

#

the previous question to "Verify" the command worked with jus that

#

idk

#

can u give me a hint?

white salmon Apr 9, 2020, 5:03 PM

#

"2 little things" is a hint 🙂

nimble onyx Apr 9, 2020, 5:03 PM

#

fair enough

#

I'll figure it out

#

thanks!

nimble onyx Apr 9, 2020, 5:22 PM

#

@white salmon wait, I got it to work by adding new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash directly to the end of /etc/passwd via nano

#

but when I echoed it in and used >> it didn't work

#

can ue explain why?

bitter crane Apr 9, 2020, 5:26 PM

#

did you sudo in both cases?

tidal sedge Apr 9, 2020, 5:26 PM

#

What command did you use with echo? Did it have sudo in the beginning? We can't help you if you don't provide more information

nimble onyx Apr 9, 2020, 5:27 PM

#

sorry

#

so, I ran echo "new:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash" >> /etc/passwd I didn't have sudo but I did have write privs and that did not work

#

then I edited /etc/passwd with nano, coppied the exact some thing, and it works

fiery juniper Apr 9, 2020, 5:32 PM

#

Any issues with the crontab room under common linux privesc? Says command not found

stuck fractal Apr 9, 2020, 5:32 PM

#

No

#

The room is common linux privesc btw, the task is crontab

#

It works fine

#

What command are you getting command now found for?

fiery juniper Apr 9, 2020, 5:34 PM

#

I ran msfveom -p and the rest of the command as indicated in the instructions as user4

stuck fractal Apr 9, 2020, 5:35 PM

#

Ok, think

#

What systems have metasploit installed?

#

Where don't you want to install metasploit?

#

You don't want to install metasploit on the target

fiery juniper Apr 9, 2020, 5:55 PM

#

I am an idiot...I took it literally going through directions. I am good to go

#

Thanks

white salmon Apr 9, 2020, 6:27 PM

#

@nimble onyx my hint was about the missing quotes :)

#

You ran the echo command without them at the beginning

nimble onyx Apr 9, 2020, 6:28 PM

#

ohhh lmao

keen tinsel Apr 9, 2020, 7:09 PM

#

according to "learn linux" room, How do you specify which shell is used when you login? what does it mean "which shell" ?

flint mica Apr 9, 2020, 7:10 PM

#

Hint: it is specified in a specific file.

keen tinsel Apr 9, 2020, 7:20 PM

#

according to the question and answer format of 2 chars. I guess its about the '@' symbol

#

but I think I didnt understand the question

white salmon Apr 9, 2020, 7:21 PM

#

which task is it?

keen tinsel Apr 9, 2020, 7:21 PM

#

12 - su

#

@white salmon

stuck fractal Apr 9, 2020, 7:23 PM

#

@keen tinsel it's referring to Su

#

How do you tell su what shell to use

#

@fiery juniper wrong quotes, delete answer

#

Also helps if you specify the room

keen tinsel Apr 9, 2020, 7:25 PM

#

@stuck fractal The thing that I dont know what it means what shell. Isn''t only one shell? I know that su user let you change the user but what is shell?

stuck fractal Apr 9, 2020, 7:25 PM

#

Rule 13

#

Google

#

what is a shell linux

keen tinsel Apr 9, 2020, 7:25 PM

#

you right... brb

white salmon Apr 9, 2020, 7:28 PM

#

@keen tinsel hey man sup

keen tinsel Apr 9, 2020, 7:30 PM

#

@white salmon found it

white salmon Apr 9, 2020, 7:30 PM

#

oh nice :)

lime junco Apr 9, 2020, 8:42 PM

#

Im doing http brute force with Hydra, page is redirecting to exactly same page whether login is successful or not.(Then real profile page.)

#

How can I differentiate the success or failure situations using hydra

#

Any idea?

stuck fractal Apr 9, 2020, 8:43 PM

#

I mean, capture a failed login request

#

See the response directly

lime junco Apr 9, 2020, 8:45 PM

#

Do u mean look at the responses via burp or sth else?

stuck fractal Apr 9, 2020, 8:47 PM

#

Or devtools

#

Is this for a room?

lime junco Apr 9, 2020, 8:47 PM

#

Yes

stuck fractal Apr 9, 2020, 8:48 PM

#

Which room?

lime junco Apr 9, 2020, 8:48 PM

#

Symfonos 6

#

Probably, this isnt the right way

stuck fractal Apr 9, 2020, 8:48 PM

#

o I can't help you then

lime junco Apr 9, 2020, 8:48 PM

#

just want to try

stuck fractal Apr 9, 2020, 8:48 PM

#

I haven't done it yet

lime junco Apr 9, 2020, 8:49 PM

#

thanks : )

white salmon Apr 9, 2020, 8:54 PM

#

in learn linux, task 33 i dont know how to find the binary, keeps saying permission denied

lime junco Apr 9, 2020, 8:54 PM

#

Check your current user rights

#

what can user do?

stuck fractal Apr 9, 2020, 8:55 PM

#

The find command is useful

white salmon Apr 9, 2020, 8:55 PM

#

yes im using find btw

stuck fractal Apr 9, 2020, 8:58 PM

#

You'll get permission denied unless you suppress that

vague reef Apr 9, 2020, 8:59 PM

#

It's possible to sift through the denied messages though. Anything where you have access kind of stands out.

lime junco Apr 9, 2020, 9:02 PM

#

ohh sorry, I mixed the questions

what can user do?
@lime junco

white salmon Apr 9, 2020, 9:07 PM

#

thank you found the solution

worn wren Apr 9, 2020, 9:40 PM

#

any body have same problem with ping restart on VPN ?

📎 VPN_problem.png

stuck fractal Apr 9, 2020, 9:41 PM

#

!multivpn

proud scarabBOT Apr 9, 2020, 9:41 PM

#

TryHackMe

• Step 1

Type ps aux | grep openvpn into your terminal and press enter

• Step 2

If there's more than one line (and the second doesn't have "grep" in it), do the following steps

• Step 3

Type killall openvpn into your terminal and press enter

• Step 4

Start the VPN with sudo openvpn <path-to-config>

worn wren Apr 9, 2020, 9:48 PM

#

thanks for help

keen tinsel Apr 9, 2020, 10:27 PM

#

||learn-linux SPOILER
hi guys, Im on the last task to see the root.txt content. I found on nootnoot a file called .sudo_as_admin_successfull. is it supposed to help me somehow?||

stuck fractal Apr 9, 2020, 10:27 PM

#

No

#

Keep looking

#

And use || around your message to mark it as a spoiler

#

2 on each side

keen tinsel Apr 9, 2020, 10:30 PM

#

cool thanks

#

@stuck fractal if Im taking a file of root owner with editing for everyone and chane it into script. will it run as root or as the user that ran the script?

stuck fractal Apr 9, 2020, 10:34 PM

#

I'll give you 2 guesses @keen tinsel

keen tinsel Apr 9, 2020, 10:34 PM

#

as the user that ran it

stuck fractal Apr 9, 2020, 10:35 PM

#

First guess, nice

#

There's one condition where it'd run as the owner

#

And another where it'd run as the group

keen tinsel Apr 9, 2020, 10:43 PM

#

@stuck fractal
|| I found that shiba2 file is by root and with all permissions. so I tried to override it with something like cat /root/root.txt but I got permission denied. Any idea why? you said something about where it would run as a owner..... ok I will google about it ||

stuck fractal Apr 9, 2020, 10:44 PM

#

That's not useful here

#

Blindly changing files won't help you either

keen tinsel Apr 9, 2020, 10:45 PM

#

why? if it could print out the content of the file because the script is of root user

inland onyx Apr 9, 2020, 10:45 PM

#

When you write to a file that has SUID, it loses that SUID

keen tinsel Apr 9, 2020, 10:46 PM

#

got you

stuck fractal Apr 9, 2020, 10:47 PM

#

It's also not the right strategy for rooting a box

#

Bunch of tracks left behind

inland onyx Apr 9, 2020, 10:47 PM

#

^

bitter crane Apr 9, 2020, 10:48 PM

#

v

keen tinsel Apr 9, 2020, 11:08 PM

#

@stuck fractal

I don't have too many tools. It is the only idea the comes to my mind to get an access to the root files -> using that file. This is the way? this file is the right way? or I missing something?

stuck fractal Apr 9, 2020, 11:08 PM

#

@keen tinsel You don't need any tools beyond the find command

keen tinsel Apr 9, 2020, 11:08 PM

#

ok

white salmon Apr 9, 2020, 11:08 PM

#

which task is it?

#

33?

stuck fractal Apr 9, 2020, 11:09 PM

#

34

white salmon Apr 9, 2020, 11:11 PM

#

34 is pretty easy

stuck fractal Apr 9, 2020, 11:11 PM

#

Oh, wait

#

43

#

No posting answers

white salmon Apr 9, 2020, 11:12 PM

#

i mean it was the task where you needed to just click i read it

#

but sry

#

that last one was a bit hard, at least for me

keen tinsel Apr 9, 2020, 11:23 PM

#

@stuck fractal
||is my direction right? looking for files owned by the root on home directory. found 2 files:
ll
shiba2||

stuck fractal Apr 9, 2020, 11:24 PM

#

No?

white salmon Apr 9, 2020, 11:24 PM

#

nop

stuck fractal Apr 9, 2020, 11:24 PM

#

Look for files belonging to each user.

white salmon Apr 9, 2020, 11:29 PM

#

well actually what you found its useful i think @keen tinsel

keen tinsel Apr 9, 2020, 11:29 PM

#

||the shiba2?||

inland onyx Apr 9, 2020, 11:30 PM

#

Not for escalation it ain't...

white salmon Apr 9, 2020, 11:31 PM

#

well yes but its interesting

keen tinsel Apr 9, 2020, 11:51 PM

#

Ive tried but I couldn't find something that seems useful for me. I mean according to the learn linux step, the only strategies I can think of is like you said. using find to look for suspicious files, but most of the directores are denied. I've tried to look for files with names like "passwords" etc and even found a directory which contains passwords for all the shiba users but I already have it. mmm kind of lost

#

I mean, to be able to look in a root directory I should gain the root password right? because in this level I haven't learnt something else

stuck fractal Apr 9, 2020, 11:56 PM

#

You need to be root

#

There's a few ways to get there

solid sphinx Apr 10, 2020, 12:14 AM

#

I'm assuming new boxes (rabbit) don't get hints yet?

stuck fractal Apr 10, 2020, 12:15 AM

#

@inland onyx might be generous

#

@solid sphinx But i'll give you a hint, it starts out VERY ctf

solid sphinx Apr 10, 2020, 12:15 AM

#

I got that part... I'm further...

stuck fractal Apr 10, 2020, 12:15 AM

#

Got user?

#

Pretty straightforward from there

solid sphinx Apr 10, 2020, 12:16 AM

#

name yes...

stuck fractal Apr 10, 2020, 12:16 AM

#

Getting user = getting access as a user

#

Not getting a username

white salmon Apr 10, 2020, 12:16 AM

#

Am I missing something with gobuster, I'm trying to run a scan using the following command: gobuster -u http://<target IP> -w <location of wordlist> and I'm receiving unknown shorthand flag -u?

stuck fractal Apr 10, 2020, 12:16 AM

#

ye

solid sphinx Apr 10, 2020, 12:17 AM

#

right, I know, I have creds but...

stuck fractal Apr 10, 2020, 12:17 AM

#

@white salmon gobuster dir for bruting directories

white salmon Apr 10, 2020, 12:17 AM

#

Ah, thank you @stuck fractal

solid sphinx Apr 10, 2020, 12:18 AM

#

sorry, trying to be vague without being too vague

white salmon Apr 10, 2020, 12:18 AM

#

"if a password hash starts with $6$, what format is it (unix variant)?"

#

i cant find that lol

inland onyx Apr 10, 2020, 12:19 AM

#

@solid sphinx DM -- I might be willing to give you a nudge

stuck fractal Apr 10, 2020, 12:23 AM

#

@white salmon That's the research room, it's easy to find with some targetted googling

inland onyx Apr 10, 2020, 12:24 AM

#

That room is one I can say with absolute assurance that every question falls under Rule 13

#

That's literally the point 😁

white salmon Apr 10, 2020, 12:25 AM

#

are you talking to me muirland?

inland onyx Apr 10, 2020, 12:26 AM

#

Mhm

white salmon Apr 10, 2020, 12:27 AM

#

finally got it lol

keen tinsel Apr 10, 2020, 12:50 AM

#

😩

#

@white salmon
Have you got to 43?

inland onyx Apr 10, 2020, 12:54 AM

#

@keen tinsel we would usually keep these out of the hints channel, but I think this has escalated into help...

#

!writeup zthlinux

proud scarabBOT Apr 10, 2020, 12:54 AM

#

TryHackMe

Learn Linux

http://tryhackme.com/room/zthlinux

By: MuirlandOracle

https://muirlandoracle.co.uk/2020/03/10/learn-linux-write-up/

keen tinsel Apr 10, 2020, 12:56 AM

#

thanks bro

white salmon Apr 10, 2020, 1:04 AM

#

@keen tinsel yes

#

I answered a bit late sry

#

Did you make it?

stuck fractal Apr 10, 2020, 1:06 AM

#

Muirland made that writeup

#

Paradox made the room

white salmon Apr 10, 2020, 1:06 AM

#

I meant if he could do it with that >.<

ashen fox Apr 10, 2020, 1:09 AM

#

I'm losing my mind trying to find the ssh pass on madness. hints anyone?

keen tinsel Apr 10, 2020, 1:09 AM

#

very helpful I wish I knew the 2>>/dev/null before

inland onyx Apr 10, 2020, 1:10 AM

#

@ashen fox Remember that optional is a massive troll with the Bedlam series. Think completely out of the box

broken kestrel Apr 10, 2020, 1:27 AM

#

Hi guys. I think I'm running low on IQ points going through the Google Dorking Task # 2 lol.

#

Should I stick to the information provided from the lesson or am I suppose to use google?

inland onyx Apr 10, 2020, 1:28 AM

#

Google in a room about Google Dorking does sound rather apt, wouldn't you say?

pine basin Apr 10, 2020, 1:28 AM

#

I'm having some trouble with yearoftherabbit, can someone maybe give me a nudge on the || core dump file || part?

broken kestrel Apr 10, 2020, 1:29 AM

#

Felt like I would be cheating for some reason lol

inland onyx Apr 10, 2020, 1:29 AM

#

@pine basin Literally no one better to answer that than me

#

...and I have absolutely no idea what you're talking about 😆

#

DM me with what you're trying?

pine basin Apr 10, 2020, 1:29 AM

#

Sure

inland onyx Apr 10, 2020, 1:29 AM

#

@broken kestrel Nah, Google is your friend. Google everything and anything you don't understand

#

It's the only way to move forward in this industry

broken kestrel Apr 10, 2020, 1:30 AM

#

Thanks, I'm getting the answers now :p

#

IKR!

#

I was reading the text provided like 10 times lol. Came to the point where I tried any word in the lesson that fit the answer length (not ashamed)

#

Good Times

static kiln Apr 10, 2020, 2:52 AM

#

Scripting is by far taking the most time for me, thus far.

lone abyss Apr 10, 2020, 6:06 AM

#

uhh help on steel mountain

#

📎 unknown.png

#

nvm could do it with netcat

viral crane Apr 10, 2020, 6:09 AM

#

tried to run it again? / use another reverse shell code

#

Oh

#

well

#

got the same issue earlier.. had to change and retry to get it working

lone abyss Apr 10, 2020, 6:09 AM

#

yeah, thanks anyways

#

oof

true gazelle Apr 10, 2020, 6:17 AM

#

hey everyone , so im at the OWASP Juice Shop [Task 4] , how exactly can i implement sql injection ?
i`ve read the whole page from w3s but noting applies on the machine , should i just go on or find somting?
this is the w3s i took my new sql injec. knowlage :
https://www.w3schools.com/sql/sql_injection.asp

#

i`ve tried to enter a few sql commands at the search bar , and where the login inputs are , does anything is suppose to show up?

static kiln Apr 10, 2020, 7:11 AM

#

@true gazelle Define SQL commands.

#

As in, what have you tried entering?

true gazelle Apr 10, 2020, 7:12 AM

#

As in, what have you tried entering?
" OR ""=" , and more like (uName = getRequestString("username");
uPass = getRequestString("userpassword");

sql = 'SELECT * FROM Users WHERE Name ="' + uName + '" AND Pass ="' + uPass + '"')

static kiln Apr 10, 2020, 7:12 AM

#

Do you have any background with SQL prior or is that just snippets from online sources?

true gazelle Apr 10, 2020, 7:13 AM

#

i have no background in sql .

static kiln Apr 10, 2020, 7:14 AM

#

Gotcha, so, the general idea of SQLi is to use SQL syntax on unsanitized input fields to trick the system into running arbitrary SQL, or more often, add additional conditionals.

true gazelle Apr 10, 2020, 7:14 AM

#

im watching Hackersploit doing this machine rn ,or should i go into some room (lol)

static kiln Apr 10, 2020, 7:14 AM

#

So for a user or password field, you might want to inject something that will always return true

true gazelle Apr 10, 2020, 7:14 AM

#

such as " OR ""="?

#

or
SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""

static kiln Apr 10, 2020, 7:16 AM

#

I suppose, I'm not sure what flavor that is as typically for SQL flavors I'm used to strings are surrounded by single ticks

#

But if it does what it looks like it's doing

#

Another common condition to try and inject is OR 1=1

#

So, we often start a SQL injection with whatever that SQL flavor uses for strings, because if the input isn't sanitized it will close off the string it's currently looking for, and you can go ahead and add arbitrary code

#

Then, it's typical to throw in -- at the end, as that's pretty standard syntax for commenting

#

So it would comment out anything that would usually come afterward on that line.

past night Apr 10, 2020, 11:49 AM

#

is there something i'm obviously missing in regards to the year of the rabbit?

pine basin Apr 10, 2020, 11:55 AM

#

Same, can't find anthing to get root..

past night Apr 10, 2020, 11:58 AM

#

knowing Boris i expect there is something obvious easy to overlook

pine basin Apr 10, 2020, 12:05 PM

#

I don't even know what I'm looking for, I have 0 leads :(

past night Apr 10, 2020, 12:09 PM

#

i'm just all over the place lol

white salmon Apr 10, 2020, 12:27 PM

#

mmm same here, got rick rolled twice, but got nothing

warm sierra Apr 10, 2020, 12:36 PM

#

can someone tell me how do i get the password for questin 2 of Artic Forum from 25DOC ?

past night Apr 10, 2020, 1:10 PM

#

@inland onyx any chance we can grab a hint off you

#

@viral crane mind providing us with a hint :c

viral crane Apr 10, 2020, 1:15 PM

#

👀

past night Apr 10, 2020, 1:15 PM

#

last part of rabbit

viral crane Apr 10, 2020, 1:15 PM

#

priv escalation?

past night Apr 10, 2020, 1:15 PM

#

i literally have 5 h since i started working on it

#

yeah

#

got 2nd user

#

any pointers are welcomed xD

viral crane Apr 10, 2020, 1:18 PM

#

Search for a program version that may be interesting, this might not help you, but it's all I need to say

young sundial Apr 10, 2020, 1:18 PM

#

Can any one help in solving investigating windows task

past night Apr 10, 2020, 1:18 PM

#

hmm, i think i get it

#

need to confirm

viral crane Apr 10, 2020, 1:19 PM

#

I am not gonna confirm anything else its already a big hint

#

😛

true gazelle Apr 10, 2020, 1:32 PM

#

hey there to every one
im at Linux Challenge Task 2 #5 "Find and retrieve flag 5."

i tried to run||find -name flag/5 | grep flag|| but i get alot of Perm problems ... any hints please?

dusty pebble Apr 10, 2020, 1:42 PM

#

@true gazelle https://askubuntu.com/questions/350208/what-does-2-dev-null-mean 😉

Ask Ubuntu

What does 2>/dev/null mean?

I would like a brief explanation of the following command line:

grep -i 'abc' content 2>/dev/null

#

Also your find command don’t have the good syntax

inland onyx Apr 10, 2020, 1:52 PM

#

@viral crane uh, can you DM me with your privesc?

past night Apr 10, 2020, 2:14 PM

#

damn lol, i'm still stuck

#

yell_cat

viral crane Apr 10, 2020, 2:19 PM

#

catmeme

past night Apr 10, 2020, 2:21 PM

#

something a tad less cryptic that doesn't return me a list of 100+ services?