#room-hints | TryHackMe | Page 26

ashen plover May 16, 2020, 5:34 PM

#

^^

white salmon May 16, 2020, 5:38 PM

#

haha found it 🙂

blazing turtle May 16, 2020, 5:55 PM

#

that box annoyed me so much with the admin name... i was googleing anthem, the cms, post authors...

#

and then when i saw the thing, i didn't even need google 😦

past night May 16, 2020, 5:56 PM

#

haha, i'm sorry

dusky vigil May 16, 2020, 5:56 PM

#

Was a nice little thing to have in there. If I hadn't watched Gotham I wouldn't of got that at all

blazing turtle May 16, 2020, 5:57 PM

#

it was fun when it wasn't annoying, so you did a good job

#

i knew it from a movie

past night May 16, 2020, 5:58 PM

#

the accountant @blazing turtle

blazing turtle May 16, 2020, 5:59 PM

#

yeah, great movie

past night May 16, 2020, 5:59 PM

#

^^

white salmon May 16, 2020, 6:20 PM

#

I found the name in || a config file on the box ||

pine ermine May 16, 2020, 6:22 PM

#

It's very obvious, it may seem like you can't do anything with in there but you can
@dusky vigil Soooo even though I can see a hidden dir with file, I can't open it. But you say you can somehow view the content of that file?

steady stratus May 16, 2020, 6:23 PM

#

Indeed you can 🙂

pine ermine May 16, 2020, 6:23 PM

#

Hmmm, okay 🙂

#

try

white salmon May 16, 2020, 6:24 PM

#

I'm still trying Tempus Fugit Durius, got on the box

steady stratus May 16, 2020, 6:25 PM

#

Once you find the file it’ll be fairly intuitive as to what you need to do to open it @pine ermine

dusky vigil May 16, 2020, 6:25 PM

#

@dusky vigil Soooo even though I can see a hidden dir with file, I can't open it. But you say you can somehow view the content of that file?
@pine ermine think of misconfigurations

white salmon May 16, 2020, 6:27 PM

#

do I do a docker thing?

#

i got the first flag

spring ember May 16, 2020, 6:43 PM

#

I've rooted Anthem but cannot for the life of me find flag 4. I might be blind

#

^ Scratch that, got it. Very sneaky

dusky vigil May 16, 2020, 6:44 PM

#

ah yes flag four

#

you probably over looked it, it's similar to one of the previous

spring ember May 16, 2020, 6:45 PM

#

I definitely did. just found it 🙂 Fun room!

marble dagger May 16, 2020, 6:52 PM

#

anyone wanna hint me with anthem task 3.3? I'm tunnelvisioned it seems. I'm looking for hidden, but still can't see it ...

dusky vigil May 16, 2020, 6:53 PM

#

You've likely overlooked it

#

You'll see something that sticks out which may have a misconfiguration

marble dagger May 16, 2020, 6:57 PM

#

I looked at so many dirs and files. I just can't see it. maybe I just don't get the "most obvious location" thing 😦

spring ember May 16, 2020, 6:58 PM

#

It definitely stands out, you'll know when you see

pine ermine May 16, 2020, 7:02 PM

#

Thanks also, @dusky vigil @steady stratus - I really should brush up on Windows. Somehow I keep skipping those boxes

steady stratus May 16, 2020, 7:03 PM

#

It’s very easy to skip to Z rather then going through A->B->C for sure 🙂

dusky vigil May 16, 2020, 7:04 PM

#

I looked at so many dirs and files. I just can't see it. maybe I just don't get the "most obvious location" thing 😦
@marble dagger remember it's hidden

marble dagger May 16, 2020, 7:06 PM

#

@dusky vigil yeah I ricked that option. and looked into those dirs. but maybe not hard enough

steady stratus May 16, 2020, 7:06 PM

#

You might be looking too hard

dusky vigil May 16, 2020, 7:06 PM

#

Try avoid over complicating it

marble dagger May 16, 2020, 7:07 PM

#

yeah I tend to overcomplicate things 😄

dusky vigil May 16, 2020, 7:07 PM

#

It's easily done

past night May 16, 2020, 7:11 PM

#

like you've done it on stream

#

kekw

#

you can't imagine how much fun i had

zinc plume May 16, 2020, 7:11 PM

#

wich wordlist should i use for gobuster (vulvuniversity)

dusky vigil May 16, 2020, 7:11 PM

#

I've been known to overcomplicate boxes

stuck fractal May 16, 2020, 7:13 PM

#

@zinc plume dirb common, dirb big, dirbuster lists

#

Try a few

#

Shorter first

zinc plume May 16, 2020, 7:14 PM

#

aight was going straight to rockyou

stuck fractal May 16, 2020, 7:14 PM

#

@zinc plume Rockyou is not a directory wordlist

#

It's a password wordlist

#

passwords are very different to directory names

dusky vigil May 16, 2020, 7:15 PM

#

SecLists/Discovery/Web-Content/big.txt is also really good

zinc plume May 16, 2020, 7:15 PM

#

man it hurts how much time i wasted

stuck fractal May 16, 2020, 7:15 PM

#

SecLists is also really good
FTFY

steady stratus May 16, 2020, 7:17 PM

#

Time learning isn’t time wasted

zinc plume May 16, 2020, 7:18 PM

#

Well thats true

steady stratus May 16, 2020, 7:18 PM

#

🙂

zinc plume May 16, 2020, 7:18 PM

#

i just wished i knew this site earlier

steady stratus May 16, 2020, 7:19 PM

#

Aye hehe. Glad you’re enjoying the content!

zinc plume May 16, 2020, 7:20 PM

#

hell yeah i joined yesterday

steady stratus May 16, 2020, 7:20 PM

#

Sweet - welcome! There’s plenty of free content to keep you busy at the very least 🙂

marsh violet May 16, 2020, 7:26 PM

#

Regarding Anthem box. On Task 1 - #8 it's asking for email address of the admin. I have one address but doesn't work. I've tried also using other things to find it but can't seem to find the right one

#

there is only one address that is on the blog for the CV

#

could I get some hints from you peeps to find it?

short sphinx May 16, 2020, 7:30 PM

#

@marsh violet check the hint button

white salmon May 16, 2020, 7:30 PM

#

https://tenor.com/view/sad-walk-of-shame-shame-shameful-head-down-gif-5548725

Tenor

#

i didn;t find it either so I hydra it with a custom wordlist

marble dagger May 16, 2020, 7:34 PM

#

and i'm also ashamed bc I'm still stuck on finding that "hidden" file on anthem. only a small hint maybe? I know it maybe hard without giving too much away

white salmon May 16, 2020, 7:34 PM

#

you can search discord history

spring ember May 16, 2020, 7:35 PM

#

@marble dagger start from the top

steady stratus May 16, 2020, 7:36 PM

#

Start from the top ^ and take the given hint from the room quite literally :>

marsh violet May 16, 2020, 7:37 PM

#

@short sphinx I don't really like doing that

marble dagger May 16, 2020, 7:38 PM

#

@spring ember @steady stratus searching history here was the first thing I did actually 🙂 but well I'm slow. and yes I did start from the top. but one "obvious" thing I can't seem to be able to access

spring ember May 16, 2020, 7:39 PM

#

@marsh violet What's the pattern for the address?

steady stratus May 16, 2020, 7:39 PM

#

Well try and get access to it @marble dagger 🙂

marsh violet May 16, 2020, 7:39 PM

#

forget what I said. I'm a f*cking idiot

spring ember May 16, 2020, 7:39 PM

#

🙂

#

@marble dagger can you let yourself in?

marsh violet May 16, 2020, 7:39 PM

#

it was right in front of me this hole time. Just saying, question #7

marble dagger May 16, 2020, 7:42 PM

#

@spring ember with the password i don't have yet ... I just not used to windows boxes ... maybe I should try tomorrow again

spring ember May 16, 2020, 7:44 PM

#

@marble dagger might be super easy when you come back with fresh eyes but you can do what you need with your current account

#

Think about why you might not be able to access that file?

marble dagger May 16, 2020, 7:47 PM

#

@spring ember well I think I can't access it because it is owned by admin ... oh and now the vm died on me ... again. maybe thats a sign I should stop 😄

#

WOW ... I got it ... should have looked at the permissions earlier ... damn 😄

spring ember May 16, 2020, 7:55 PM

#

ayyyy

#

Congrats! 🥳

quiet musk May 16, 2020, 7:58 PM

#

Was going to say, if anyone is struggling with the "The Impossible Challenge". Big hint, The answer is literally on the room page and requires no bruteforcing.
@proven bridge

Can I DM you with a question?

inland onyx May 16, 2020, 8:58 PM

#

@quiet musk What's the question?

quiet musk May 16, 2020, 9:25 PM

#

Is the room graphic part of the challenge?

light galleon May 16, 2020, 9:31 PM

#

ok @white salmon may i get one hint thats gonna point me in a right direction 😄

stuck fractal May 16, 2020, 9:31 PM

#

Look for files belonging to each and every user

#

One of them has something suspicious

#

Use find

light galleon May 16, 2020, 9:32 PM

#

just did that hahahah

#

ok thanks

arctic kiln May 16, 2020, 9:35 PM

#

how can i find the first flag

#

of Anthem VM

short sphinx May 16, 2020, 9:38 PM

#

@arctic kiln must be there, somewhere in the website

#

do you find the others?

proven bridge May 16, 2020, 9:41 PM

#

@proven bridge

Can I DM you with a question?
@quiet musk Of course

light galleon May 16, 2020, 9:51 PM

#

@stuck fractal numbers from 1-1000? 😄

stuck fractal May 16, 2020, 9:52 PM

#

Not that one

light galleon May 16, 2020, 9:52 PM

#

kk

#

its irelevant?

stuck fractal May 16, 2020, 9:54 PM

#

I think so

light galleon May 16, 2020, 9:59 PM

#

@stuck fractal i made this it will maybe help me find it 🤷‍♂️

📎 unknown.png

#

📎 unknown.png

#

its better now

arctic kiln May 16, 2020, 10:07 PM

#

@short sphinx yes i find the others expect the first flag

zinc plume May 16, 2020, 10:12 PM

#

Why wont it run, what am i doing wrong?

📎 robot.PNG

stuck fractal May 16, 2020, 10:13 PM

#

@zinc plume You put an asterisk for the login name

zinc plume May 16, 2020, 10:13 PM

#

yeah bc i found this

📎 221.PNG

#

i thought it is the username

#

for /login

stuck fractal May 16, 2020, 10:15 PM

#

user-agent is a browser thing

zinc plume May 16, 2020, 10:15 PM

#

ohh i thought its a username

#

okay thx

short sphinx May 16, 2020, 10:17 PM

#

@arctic kiln you will find it in the same way, maybe check for THM while loking for it

zinc plume May 16, 2020, 10:17 PM

#

but what am i supposed to do with the file fsocity.txt? Isnt it a passwordlist?

stuck fractal May 16, 2020, 10:17 PM

#

It could be

#

but you'd need a username or list of usernames

zinc plume May 16, 2020, 10:18 PM

#

okay

light galleon May 16, 2020, 10:20 PM

#

@stuck fractal Update : i got the password for the noot account but i think thats a false update 😄

stuck fractal May 16, 2020, 10:20 PM

#

Maybe the new users have more power

light galleon May 16, 2020, 10:20 PM

#

hmm yes

#

nope

#

sadly

stuck fractal May 16, 2020, 10:22 PM

#

Hmm, what about listing sudo permissions?

#

sudo -l

#

Good command to learn

light galleon May 16, 2020, 10:22 PM

#

yea did that

#

📎 unknown.png

#

i like just typed su noot

#

and like guessed the password to be noot

stuck fractal May 16, 2020, 10:23 PM

#

Well, maybe there's other users

light galleon May 16, 2020, 10:23 PM

#

ill try to find the password for the nootnoot acount

stuck fractal May 16, 2020, 10:23 PM

#

Keep looking for files

light galleon May 16, 2020, 10:23 PM

#

on it chief 😄

#

📎 unknown.png

#

im on the right track

zinc plume May 16, 2020, 10:29 PM

#

i have found ||ZWxsaW900kVSMjgtMDY1mgo=|| thats not a key tho, is it decrypted or what am i should i do?

steady stratus May 16, 2020, 10:30 PM

#

It’s encoded @zinc plume

#

Investigate what that = at the end could mean 🙂

cloud perch May 16, 2020, 10:31 PM

#

Has anyone done the new room anthem

inland onyx May 16, 2020, 10:32 PM

#

Plenty of people -- best just asking

cloud perch May 16, 2020, 10:32 PM

#

I'm stuck on task 7 what's the administrator name can you give me a hint besides Google

inland onyx May 16, 2020, 10:33 PM

#

There are three tasks?

#

Oh

#

Task 1

#

Question 7

cloud perch May 16, 2020, 10:33 PM

#

Yup

inland onyx May 16, 2020, 10:33 PM

#

Yeah, use what you're given on the site. It's a "social engineering" style one. You've got to extrapolate from the data you've been given

cloud perch May 16, 2020, 10:35 PM

#

I'm so confused sorry I've been up all night working and once I got home I decided to study up on this

zinc plume May 16, 2020, 10:35 PM

#

Investigate what that = at the end could mean 🙂
@steady stratus i have no idea i only found Base64

inland onyx May 16, 2020, 10:35 PM

#

@cloud perch The administrator's name is not on the website. You've got to use what you've been given to guess what it might be -- same with the email

#

You know that he's got a poem dedicated to him -- there's a name related to that poem

sinful garden May 16, 2020, 10:36 PM

#

It's not directly on the website

steady stratus May 16, 2020, 10:36 PM

#

That’s right - whether or not it’s of any value you’ll have to figure out @zinc plume

zinc plume May 16, 2020, 10:37 PM

#

aight

steady stratus May 16, 2020, 10:37 PM

#

The = or == is padding and is a really good way of identifying base64 (although not all base64 encoded strings have padding)

cloud perch May 16, 2020, 10:39 PM

#

Got it thanks poem I new something was funny about that poem

steady stratus May 16, 2020, 10:40 PM

#

Nice one!

past night May 16, 2020, 10:40 PM

#

hehe

#

i love to see people struggle

cloud perch May 16, 2020, 10:41 PM

#

It's funny cause I checked everything I spent an hour trying to figure it out. The funny thing about it is when I first started on this room and saw that poem. I said to my self that this poem might come in handy but totally forgot about it.

#

@past night it's the only way we learn right?

#

Lol

zinc plume May 16, 2020, 10:58 PM

#

does it matter if im using Hydra and the text "Username" isnt in the usernamebox , or do i have to use user_login?

#

bc when i run hydra i get like 20 pws

stuck fractal May 16, 2020, 10:58 PM

#

I don't understand what you're asking and hydra is like second nature to me

#

You're probably getting 16

#

And that means it can't detect the failures correctly

zinc plume May 16, 2020, 10:59 PM

#

yeah i kinda tought so too but i put F (for false) as F=incorrect so it should work

stuck fractal May 16, 2020, 11:00 PM

#

That doesn't mean it can pick up that it's wrong

zinc plume May 16, 2020, 11:00 PM

#

also im getting the error that the pw is incorrect

#

oh okay

#

so should i use ERROR as F= ?

📎 Unbenanntadwda.PNG

stuck fractal May 16, 2020, 11:01 PM

#

https://redteamtutorials.com/2018/10/25/hydra-brute-force-https/

Red Team Tutorials

Hydra - Brute Force HTTP(S)

zinc plume May 16, 2020, 11:02 PM

#

okay thank you

wooden mist May 16, 2020, 11:10 PM

#

anyone here did the very secure protocol chall on hackback2? not sure if I understand the task well
The hashed PSK is 32 bytes. No password file has strings this long. If you find a password file(rockyou.txt), make sure the minimum length is 32 bytes(do this by copying the same string until it is 32 bytes).
this tells me that the PSK hash is 32 bytes but not sure if i need to repeat the string until it's 32 bytes too thonk

light galleon May 16, 2020, 11:28 PM

#

@stuck fractal you here 😄

stuck fractal May 16, 2020, 11:28 PM

#

👋

light galleon May 16, 2020, 11:28 PM

#

ok im stuck like i went thru every file

#

cant find it

#

hint

#

pls

stuck fractal May 16, 2020, 11:28 PM

#

One of the users has a file that should have interesting content

#

username:password is a defacto standard in infosec

light galleon May 16, 2020, 11:29 PM

#

ok but its not in the /proc files right?

#

username:password is a defacto standard in infosec
@stuck fractal ^^

stuck fractal May 16, 2020, 11:29 PM

#

/proc is for internal stuff

light galleon May 16, 2020, 11:30 PM

#

so its not there right?

stuck fractal May 16, 2020, 11:30 PM

#

find / -user userNameGoesHere 2>/dev/null

light galleon May 16, 2020, 11:30 PM

#

ok so i am trying to find a file thats owned by someone and that file has username:password

stuck fractal May 16, 2020, 11:31 PM

#

All files are owned by someone

#

even if that someone is nobody

light galleon May 16, 2020, 11:31 PM

#

yea but by someone i mean like one of the users

#

what does 2>/dev/null do

#

wait how do you do that other kind of formating

#

on discord

stuck fractal May 16, 2020, 11:32 PM

#

backticks

#

2 is standard error

#

> is a redirection operator

#

/dev/null is THE VOID

#

Basically, send all error messages to the void

upper solar May 16, 2020, 11:32 PM

#

Hello everyone

light galleon May 16, 2020, 11:33 PM

#

oh ok tnx

cloud perch May 16, 2020, 11:47 PM

#

Damn stuck again on anthom

#

I've never messed with this type of cms

inland onyx May 16, 2020, 11:48 PM

#

You don't need to touch the CMS

final lark May 16, 2020, 11:48 PM

#

@cloud perch What happened?

#

@inland onyx Yea

past night May 16, 2020, 11:49 PM

#

nah, only if you want to see how it feels using that CMS

#

but you got nothing hidden behind it

cloud perch May 16, 2020, 11:50 PM

#

@final lark trying to figure out how to get into the server. I try doing rdesktop with the same creds as the admin. No luck.

final lark May 16, 2020, 11:50 PM

#

@cloud perch You can DM me & we can discuss more

viral mason May 17, 2020, 12:06 AM

#

any tips on racetrack bank on transacting an huge amount of golds? i've been trying to manipulate the request as ||?success=Success!|| , at the end i get ||Success!|| but nothing happens. am i in correct way?

inland onyx May 17, 2020, 12:07 AM

#

No

#

Clue is in the title

viral mason May 17, 2020, 12:07 AM

#

So does it related with directly purchasing the gold?

inland onyx May 17, 2020, 12:08 AM

#

Nope

viral mason May 17, 2020, 12:08 AM

#

Ok i guess i need to enumerate more, thx Muirland ❤️

wraith marsh May 17, 2020, 12:11 AM

#

it’s probably more about knowing the attack, like Muir said the title is a big clue.

viral mason May 17, 2020, 12:13 AM

#

@inland onyx @wraith marsh ||race condition|| maybe 👀

wraith marsh May 17, 2020, 12:20 AM

#

If you get stuck, owasp is your friend.

viral mason May 17, 2020, 12:23 AM

#

thanks @wraith marsh

stuck fractal May 17, 2020, 12:30 AM

#

No spoilers

light galleon May 17, 2020, 12:30 AM

#

i tagged it as a spoiler

#

didnt i?

stuck fractal May 17, 2020, 12:31 AM

#

Still

#

Don't post passwords etc

cloud perch May 17, 2020, 12:47 AM

#

Done with athem thanks for the hint guys

viral mason May 17, 2020, 1:39 AM

#

i think getting shell could be harder along with this frustrating gold step.. @wraith marsh

vestal igloo May 17, 2020, 1:48 AM

#

With Daily Bugle I got a reverse shell as ||apache|| is there something I can do with that or should I find another way in?

inland onyx May 17, 2020, 1:50 AM

#

Yeah, keep enumerating @vestal igloo -- that shell is the way forward

vestal igloo May 17, 2020, 1:50 AM

#

thanks

cloud perch May 17, 2020, 2:22 AM

#

@vestal igloo yeah that box was a little hard for me at first

#

@vestal igloo if you need a hint I'll give you one

wicked sluice May 17, 2020, 3:53 AM

#

hi can i get a hint on task 3 for the anthem box im having issues figureing out what the username and password to login into the remote desktop can anyone point me in the right direction i think i over looked something but for the life of me i dont know what it is

short sphinx May 17, 2020, 3:58 AM

#

@wicked sluice use the info you get so far

wicked sluice May 17, 2020, 3:59 AM

#

ok i must be over thinking it lol

short sphinx May 17, 2020, 4:00 AM

#

try some logins with the info you get from the other task

wicked sluice May 17, 2020, 4:01 AM

#

ok ty @short sphinx

short sphinx May 17, 2020, 4:02 AM

#

it help thinking what credentials someone will assign for these people

tribal ginkgo May 17, 2020, 4:24 AM

#

stuck at anthem flag 4

#

i think i inspected all the pages

obtuse charm May 17, 2020, 4:28 AM

#

@tribal ginkgo Did you look at pages which aren't for humans? If you know what i mean.

#

Can anyone give me a nudge on flag 7(name of admin) of Anthem? i crawled the website, but couldn't find anything, Using dirbuster gives me false positives,

tribal ginkgo May 17, 2020, 4:35 AM

#

read the blogs

obtuse charm May 17, 2020, 4:36 AM

#

did read them, tried both author names

shy sinew May 17, 2020, 4:36 AM

#

I have the key file but I'm not able to login through ssh ??

📎 JPEG_20200517_100532.jpg

tribal ginkgo May 17, 2020, 4:37 AM

#

@obtuse charm content of the blog

shy sinew May 17, 2020, 4:40 AM

#

What can be the username for ssh login ??

obtuse charm May 17, 2020, 4:41 AM

#

@tribal ginkgo thanks, got it

shy sinew May 17, 2020, 4:41 AM

#

Network services room

#

Anyone upthere ??

vestal cedar May 17, 2020, 4:58 AM

#

hi any hints for this for hackpark

#

📎 unknown.png

#

i tried running ps on meterpreter but seems i dont get an answer

shy sinew May 17, 2020, 5:11 AM

#

Run PS command

tribal ginkgo May 17, 2020, 5:11 AM

#

anthem spot the flag-> flag4 any hints

#

don't know which file i missed

shy sinew May 17, 2020, 5:11 AM

#

See source code of all the pages

#

I have the key file but I'm not able to login through ssh ??
@shy sinew anyone help ??

tribal ginkgo May 17, 2020, 5:15 AM

#

thanks don't know how i missed it before

#

anthem - rdp , I am using the credentials used to login to cms, but not working

obtuse charm May 17, 2020, 6:02 AM

#

cms is hosted on a domain, rdp is not, does that make sense?

burnt cosmos May 17, 2020, 6:16 AM

#

@tribal ginkgo Flag4 is similar to another flag you already have, and you already have the RDP login, just don't over-complicate it

obtuse charm May 17, 2020, 6:29 AM

#

I have user.txt of anthem, but unable to find anything that could help me go further

#

Any hints , I've enumerated pretty much all interesting folders including the hidden files and folders

blazing turtle May 17, 2020, 6:33 AM

#

the thing you're looking for is located in a very obviously named folder

obtuse charm May 17, 2020, 6:43 AM

#

Should i limit myself to inetpub or search other parts of disk?

tardy beacon May 17, 2020, 6:52 AM

#

Hey guys.

#

I am solving SSTI challenge from zthobscurewebvulns, I got root but there isn't any flag.🤔

burnt cosmos May 17, 2020, 6:54 AM

#

@obtuse charm What you are looking for is hidden

obtuse charm May 17, 2020, 6:56 AM

#

@burnt cosmos I'm looking for hidden files and folders as well, but nothing till now,

#

Maybe I'm enumerating the wrong directory

#

Currently enumerating the entire sg user folder

sweet relic May 17, 2020, 7:07 AM

#

hey guys. is there a python module like exiftool?

glossy basin May 17, 2020, 7:17 AM

#

@sweet relic https://smarnach.github.io/pyexiftool/

sweet relic May 17, 2020, 7:18 AM

#

thanks. i got it

vast moth May 17, 2020, 7:33 AM

#

Check the meta data of webpages

anthem spot the flag-> flag4 any hints
@tribal ginkgo

#

search for poems "Born on a Monday,
Christened on Tuesday,
Married on Wednesday,
Took ill on Thursday,
Grew worse on Friday,
Died on Saturday,
Buried on Sunday." on the internet
Can anyone give me a nudge on flag 7(name of admin) of Anthem? i crawled the website, but couldn't find anything, Using dirbuster gives me false positives,
@obtuse charm

burnt cosmos May 17, 2020, 7:39 AM

#

@obtuse charm What you're looking for is in plain sight, when you find the file you may have to do something else with it

burnt garden May 17, 2020, 8:04 AM

#

On 25 Days of Christmas, Day 8 -~~ Privesc~~ hacking is super new to me, ||I managed to get a bash shell worked out that 'find' is controlled by igor using the assist doc. But I'm not really sure where to go from here, actually interacting with shadow is still denied||

#

Scratch that, got it, I should've just ||skipped gaining user and just opening the .txt||

white salmon May 17, 2020, 8:29 AM

#

Good morning everyone. When I try to execute the Rejetto exploit on Steel Mountain room, it says "Exploit completed, but no session was created".

white salmon May 17, 2020, 11:47 AM

#

Hey guys. I am new in this field and started going pratical. And i tried to do the cmess machine. So everything was going well. Discovered the admin password and tried a upload a reverse php shell from pentest monkey. But whenever I started listening connection in my Hacker machine. It couldn't connect i am stuck here

#

I put the correct lhost and lport

#

But netcat listening on other side doesn't get incoming connections

#

I think something is wrong with my netcat. I don't know the correct settings. I guess vm is blocking my incoming connection. I run in Bridge mode. Can someone please help me regarding this

#

I couldn't figure out

limpid vine May 17, 2020, 11:57 AM

#

Hey guys I'm in need of a bit of help I'm doing a smbclient task and I've figured it out however there is one question I have no idea about
here is a screen shot https://gyazo.com/0bbed124e70f2a0c2454021f5dba4368

Gyazo

burnt cosmos May 17, 2020, 11:59 AM

#

@limpid vine Have a look on the file system you end up in

#

You should find the remaining answer there

limpid vine May 17, 2020, 12:00 PM

#

you just end up in / dir

#

and I think I have the username but I don't know the correct way to format the answer.

shy sinew May 17, 2020, 12:48 PM

#

@limpid vine can u pls help me in ques no. 8 ssh login I'm unable to login using -ssh -i key file username@ip

#

But I don't knkw the usrname

#

*know

patent token May 17, 2020, 12:54 PM

#

I'd refer back to question #4 if I were you.

shy sinew May 17, 2020, 12:58 PM

#

I tried the same but it's asking password and @limpid vine managed to get the ques 8 without the ques. 4

fresh kelp May 17, 2020, 1:11 PM

#

Hi would anyone be able to help me with the Tony the Tiger room?

#

In particular trying to get the shell

tidal sedge May 17, 2020, 1:13 PM

#

@fresh kelp Just ask the question, don't ask to ask

glossy basin May 17, 2020, 1:13 PM

#

@fresh kelp just use the exploit given in the materials

#

read about the CVE also

#

so you get the usage idea

#

you can always check the writeup to see how it's done

fresh kelp May 17, 2020, 1:14 PM

#

I’ve had issue with the exploit in the task so I decided to use the jexboss.git repo

#

When running it I get the message “successfully deployed code”

#

But then it error outs and I get a attribute error

#

“None type” object has no attribute “groups”

tidal sedge May 17, 2020, 1:15 PM

#

@fresh kelp What issues did you have with the first exploit?

glossy basin May 17, 2020, 1:15 PM

#

can you also screenshot? i can't reproduce any error

steady stratus May 17, 2020, 1:16 PM

#

the jexboss issue sounds like a python version issue - not totally sure with that exploit technique

#

But aye a screenshot would be useful 🙂

fresh kelp May 17, 2020, 1:21 PM

#

I’m getting an error about “argument —proto: invalid choice: ‘http://10.10.16.227:8080’

tidal sedge May 17, 2020, 1:21 PM

#

@fresh kelp A screenshot would be helpful...

fresh kelp May 17, 2020, 1:22 PM

#

One sec I’m on my phone trying to log in into my laptop

steady stratus May 17, 2020, 1:24 PM

#

The output of that tells you what’s wrong

fresh kelp May 17, 2020, 1:24 PM

#

📎 Screenshot_from_2020-05-17_14-23-49.png

steady stratus May 17, 2020, 1:28 PM

#

Look at the syntax it’s expecting

glossy basin May 17, 2020, 1:46 PM

#

^

sinful plaza May 17, 2020, 1:51 PM

#

Hello can any one give hint on the anthem room rdp username

inland onyx May 17, 2020, 1:53 PM

#

@sinful plaza Lateral thinking. Use the stuff on the website to piece it together

sinful plaza May 17, 2020, 1:55 PM

#

ok @inland onyx thanks

fresh kelp May 17, 2020, 2:00 PM

#

Thanks for the help guys, I guess I was just looking at it all wrong. Took a break and saw my mistake

patent token May 17, 2020, 2:15 PM

#

Is this Tony the Tiger?

tidal sedge May 17, 2020, 2:15 PM

#

Looks like it

patent token May 17, 2020, 2:15 PM

#

I don't remember using all of that extra stuff in my command.

zinc plume May 17, 2020, 2:49 PM

#

(MrRobot)Im insite the Wordpress account as elliot, whats the next step do i have to interact with the pictures or switch to the other account bound to alliots account? (mich05654 her bio is another key?)

dusty pebble May 17, 2020, 3:12 PM

#

Try to get a shell from there

wooden plover May 17, 2020, 3:34 PM

#

check for wordpress exploits

#

Don't go for OSINT! It will be a rabbit hole

#

Mr.robot was an easy room

#

don't wander a lot

white salmon May 17, 2020, 5:05 PM

#


# script.sh count port delay 

function main()
{   
   if [[ -z "$1" || -z "$2" ]]; then
      echo "Not all parameters specified"
      exit 1
   fi

   count=$1; shift
   port=$1; shift
   delay=

   if [[ -z "$1" ]]; then
      delay=$1
      shift
   fi

   for i in $(seq 1 $count); do
      echo "Iter: $i"

      nc -lvp $port &
      pid=$!
      sleep $delay
      kill $pid

      if [[ $i -eq $count-1 ]]; then
         nc -lvp $port
      fi
   done
}

main $@ ```

stuck fractal May 17, 2020, 5:05 PM

#

#room-help since you're not asking for a hint please.

white salmon May 17, 2020, 6:38 PM

#

Anonymous: I have all the files from 2 services but still can't find any user specific information. Any hint as to what to do from here?

proven bridge May 17, 2020, 6:45 PM

#

Anonymous: I have all the files from 2 services but still can't find any user specific information. Any hint as to what to do from here?
@white salmon In one of those services there's a bash script that runs, it appears to be on a cron.

#

What should you do?

white salmon May 17, 2020, 7:34 PM

#

I've tried now to edit the script, configure how it affects the log file, and still the same result. Any chance you can link a resource that could help?

verbal wedge May 17, 2020, 8:02 PM

#

Why would you configure how it affects the log file?

#

It's a shell script that's running off a Cron job.

white salmon May 17, 2020, 8:03 PM

#

@verbal wedge i tried overwriting the script but it doesn't seem to be running

verbal wedge May 17, 2020, 8:03 PM

#

You can do whatever you want to it

#

What did you replace it with

#

Like what's the script

white salmon May 17, 2020, 8:03 PM

#

nc connecting back to me

verbal wedge May 17, 2020, 8:03 PM

#

Yeah there's a reason for that

#

There's another shell that will work

#

And it's not nc

white salmon May 17, 2020, 8:04 PM

#

hm ok thanks

verbal wedge May 17, 2020, 8:04 PM

#

Good luck!

white salmon May 17, 2020, 8:13 PM

#

Hello community ! 🙂 I have a question. I am at the challenge in the "Intro to Python" room. Challenge gave me a text file named "encodedflag.txt". This is a multiple encoded file with base64, base32, and base16. I decoded the first time with base64 the given file. It gives me an output like this ->

b'\xdf}\xf7\xdf}\xf7\xdf}\xf7\xdf}\xf8\xdf}\xf7\xdf}\xf8\xdf}\xf7\xdf.......'

But I cannot decode this string by base64. How can i do that ? Anybody could you give me a hint ?

stuck fractal May 17, 2020, 8:13 PM

#

Those are raw bytes. Implies you're doing something wrong

viral mason May 17, 2020, 8:17 PM

#

so neither ||nc|| nor|| python rev-shells|| are working on this script @verbal wedge

stuck fractal May 17, 2020, 8:18 PM

#

@viral mason Remember, python won't be installed on most ubuntu 1804 boxes

#

It'll be python3

#

And nc -e rarely works

viral mason May 17, 2020, 8:18 PM

#

shit i didnt think of python3

stuck fractal May 17, 2020, 8:18 PM

#

In summary

#

try harder

verbal wedge May 17, 2020, 8:19 PM

#

There's others you haven't tried too

viral mason May 17, 2020, 8:19 PM

#

let me try and i'll hit you in 5 mins because of the cron ¯_(ツ)_/¯

verbal wedge May 17, 2020, 8:19 PM

#

Lol I should change that haha

viral mason May 17, 2020, 8:19 PM

#

please man

#

please change it

white salmon May 17, 2020, 8:24 PM

#

Those are raw bytes. Implies you're doing something wrong
@stuck fractal
I got what i am doing wrong 🙂 Thank you 🙂

wraith marsh May 17, 2020, 8:34 PM

#

shit i didnt think of python3
@viral mason did you try bash ? 🧐 worked for me

viral mason May 17, 2020, 8:34 PM

#

tried but i guess i did something wrong @wraith marsh

#

i guess i have to try another bash

south apex May 17, 2020, 8:40 PM

#

I'm doing VulnUniversity but I'm a little confuse towards the end.
So, first, why should /bin/systemctl have stood out? Looking at the permissions on the other files around it look similar, is it simply because it's known to be able to be exploited for priv escalation?
Second, I'm pretty unsure what to do from here. I've never done a priv escalation before, so I don't really know what I should be doing. Do I use gtfobins? Usually to make a script on a remote session I'd use nano but that seems to be blocked, so I'm as little unsure what I should be doing

stuck fractal May 17, 2020, 8:42 PM

#

@south apex You don't have nano because you're in a reverse shell

#

nano needs a proper shell, you can't even use the arrow keys

south apex May 17, 2020, 8:43 PM

#

I see, I'd noticed the lack of bash history but didn't attribute it to that.

white salmon May 17, 2020, 8:44 PM

#

systemctl runs with higher privilieges and it can be used to run arbitrary commands in a way

south apex May 17, 2020, 8:45 PM

#

Okay so it is just something I need to know is easier to use to run arbitrary commands.

#

Thank you

stuck fractal May 17, 2020, 8:46 PM

#

@south apex Yes use GTFOBins

south apex May 17, 2020, 8:52 PM

#

Thank you

viral mason May 17, 2020, 9:10 PM

#

i really was a dumbass, i got the shell @verbal wedge

hasty cobalt May 17, 2020, 9:18 PM

#

unsure if this is the right room for this. Has anyone done the Shodan.io box? I have 2 tasks that I am unable to complete and im convinced its due to a change on shodan

south apex May 17, 2020, 9:20 PM

#

I'm pretty lost still. How do I Get the exploit onto the box using a reverse shell?

stuck fractal May 17, 2020, 9:20 PM

#

@south apex The exploit is a systemd service file, you can create a file.

#

And put content into it

#

If you can't, I'd recommend doing this room https://tryhackme.com/room/zthlinux

TryHackMe

TryHackMe | Learn Linux

A guided room designed to teach you the Linux basics!

south apex May 17, 2020, 9:22 PM

#

I have a modifed systemd service that should give me a reversed shell with root, just unsure how to write the file without access to nano. Thank you for the direction to check. I'll follow through that since I'm not seeing how to make the file

stuck fractal May 17, 2020, 9:22 PM

#

@south apex You can echo into a file

#

echo "string \> with \> multiple \> lines"

#

The shell will add the > when you don't close the quotes

south apex May 17, 2020, 9:25 PM

#

I see thank you

quiet musk May 17, 2020, 9:29 PM

#

@stuck fractal Can I DM you?

stuck fractal May 17, 2020, 9:29 PM

#

@quiet musk Why?

novel topaz May 17, 2020, 9:34 PM

#

Hey guys

#

I was an doing anonymous room

#

Is their any hints to get user.txt ?

south apex May 17, 2020, 9:45 PM

#

I managed to get root. Thank you @stuck fractal
That's an awesome feeling.

viral mason May 17, 2020, 9:51 PM

#

@wraith marsh is pe related with vim.basic?

#

or should i go for that ||cron which is executed by root||

wraith marsh May 17, 2020, 9:54 PM

#

@wraith marsh is pe related with vim.basic?
@viral mason I found 3 ways to priv esc. there’s a much simpler way. Which happens to be the intended way

viral mason May 17, 2020, 9:55 PM

#

hmm

verbal wedge May 17, 2020, 10:03 PM

#

It's about to be only 2

#

Jb had a very unintended way lol

#

So I'm patching it haha

#

There isn't a Cron executed by root that im aware of

#

The Cron that's running the clean.sh is executed by namelessone

#

Root privesc is much simpler

#

No

#

Good on you for finding that

wraith marsh May 17, 2020, 10:07 PM

#

Removed just in case, 😂

verbal wedge May 17, 2020, 10:09 PM

#

Do you have an article for they other method?

#

I don't get it

viral mason May 17, 2020, 10:09 PM

#

There isn't a Cron executed by root that im aware of
@verbal wedge i saw in pspy lol

#

uid was 0

wraith marsh May 17, 2020, 10:10 PM

#

Yes, give me a minutes I’ll grab it and DM you if that’s okay?

verbal wedge May 17, 2020, 10:10 PM

#

Aye

viral mason May 17, 2020, 10:10 PM

#

Jb had a very unintended way lol
@verbal wedge free pentesting service lol

#

Root privesc is much simpler
@verbal wedge yea took a break i'll look on it

cloud perch May 17, 2020, 10:14 PM

#

my new thumbnail for the new video coming what ya guys think yay or nah

📎 Untitled.jpg

viral mason May 17, 2020, 10:15 PM

#

Seems nice dude

stuck fractal May 17, 2020, 10:15 PM

#

@cloud perch Wrong chat?

viral mason May 17, 2020, 10:48 PM

#

@verbal wedge can i pm?

verbal wedge May 17, 2020, 10:49 PM

#

Aye but response may be delayed

#

trying to work out dinner

viral mason May 17, 2020, 10:49 PM

#

okk

white salmon May 17, 2020, 10:59 PM

#

hey 0x you got root?

woeful tide May 17, 2020, 11:05 PM

#

Now I'm curious what the unintended way is

ashen plover May 17, 2020, 11:27 PM

#

^^

viral mason May 17, 2020, 11:50 PM

#

Now I'm curious what the unintended way is
@woeful tide its.. a little bit tricky

white salmon May 18, 2020, 12:27 AM

#

do I really need to wait an hour in Anonymous?

stuck fractal May 18, 2020, 12:27 AM

#

Probably not

#

||The thing is every 5mins||

restive kestrel May 18, 2020, 12:29 AM

#

to anyone who has done the room anonymous

#

does privesc have to do with ||f||

viral mason May 18, 2020, 12:30 AM

#

do I really need to wait an hour in Anonymous?
@white salmon its on ||each x5s and x0s||

white salmon May 18, 2020, 12:30 AM

#

yeah I see it now

viral mason May 18, 2020, 12:30 AM

#

does privesc have to do with ||f||
@restive kestrel what's f?

restive kestrel May 18, 2020, 12:31 AM

#

ok nvm then if you don't recall f HAHA

viral mason May 18, 2020, 12:31 AM

#

😄

#

yeah I see it now
@white salmon its a bit painful to wait that one

white salmon May 18, 2020, 12:32 AM

#

it lost its +x somehow, fixed it

final lark May 18, 2020, 12:39 AM

#

Whoever solved the box "Anonymous". How much would you rate it outta 10?

viral mason May 18, 2020, 12:39 AM

#

@final lark 9/10 fun, 4.5-5/10 difficulty

final lark May 18, 2020, 12:40 AM

#

Okay great !

#

I'll also solve it today

restive kestrel May 18, 2020, 12:40 AM

#

ooh just finished the room, i think it's relatively easy

viral mason May 18, 2020, 12:40 AM

#

good luck with that!

white salmon May 18, 2020, 12:40 AM

#

as nike says, just do it

sharp mason May 18, 2020, 12:40 AM

#

I'm doing the first lvl buffer overflow room(bof1). I'm trying to see what's happening in the code execution using gdb. The guide talks about looking at the values of registers like esp and ebp but when I look at the registers in gdb using the 'inspect registers' command all I see are registers that start with 'r'. Anyone know how I can view the esp edp registers?

viral mason May 18, 2020, 12:41 AM

#

@restive kestrel yeah easy for a guy who is relatively experienced but medium for general as it stated in the box itself

restive kestrel May 18, 2020, 12:41 AM

#

well if i can finish it i'd say it's easy HAHA

stuck fractal May 18, 2020, 12:42 AM

#

@sharp mason ...you're not on ARM are you?

#

https://en.wikibooks.org/wiki/X86_Assembly/X86_Architecture#General-purpose_registers_(64-bit_naming_conventions)

X86 Architecture

#

Oh, you're only seeing the general purpose registers

#

https://stackoverflow.com/questions/5429137/how-to-print-register-values-in-gdb

Stack Overflow

How to print register values in GDB?

How do I print the value of %eax and %ebp?

(gdb) p $eax
$1 = void

sharp mason May 18, 2020, 12:47 AM

#

@stuck fractal thanks, I guess I need to specify the eax or esp etc registers I want to see. for whatever reason, all the guides I've found are showing the 'e*' registers by default when they run inspect registers

stuck fractal May 18, 2020, 12:47 AM

#

@sharp mason those are the common ones

sharp mason May 18, 2020, 12:47 AM

#

I need to read up on general vs common register types

stuck fractal May 18, 2020, 12:48 AM

#

Common isn't a special word here

#

Common just means frequently used

sharp mason May 18, 2020, 12:49 AM

#

gotcha

#

so I found there's also a gdb command info all-registers

#

surprised that the output still doesn't include any of the 'e*' registers that I'm looking for

stuck fractal May 18, 2020, 12:50 AM

#

@sharp mason Hang on, you know x86 prefixes right?

sharp mason May 18, 2020, 12:50 AM

#

the stack pointer and stack frame seem important, I think I'm missing something

#

I do not

stuck fractal May 18, 2020, 12:51 AM

#

Is it showing you RSP?

sharp mason May 18, 2020, 12:51 AM

#

yes

stuck fractal May 18, 2020, 12:51 AM

#

📎 unknown.png

sharp mason May 18, 2020, 12:51 AM

#

is that equivalent to esp?

stuck fractal May 18, 2020, 12:51 AM

#

RSP is 64bit ESP

#

RAX is 64bit EAX

sharp mason May 18, 2020, 12:51 AM

#

ohhhhh

stuck fractal May 18, 2020, 12:52 AM

#

AX is 16bit EAX/RAX

sharp mason May 18, 2020, 12:52 AM

#

that's what I'm missing! Thanks @stuck fractal

stuck fractal May 18, 2020, 12:52 AM

#

x86 is a mess.

sharp mason May 18, 2020, 12:52 AM

#

lol, understood

white salmon May 18, 2020, 1:20 AM

#

On anonymous room, ||idk what rev shell should i use, if i put like 3-4 line after line, one should execute and others should interupt anything, right? ||

late patio May 18, 2020, 1:21 AM

#

@white salmon If you find the correct reverse shell it will work.

white salmon May 18, 2020, 1:22 AM

#

as i thought, thanks

late patio May 18, 2020, 1:22 AM

#

No problem.

white salmon May 18, 2020, 1:35 AM

#

finally got anonymous, took me way to long

#

didn't even got root shell

patent token May 18, 2020, 2:24 AM

#

I'm stuck on Root on Anonymous if anyone can lend a hand. I have a shell and the user flag. I've been looking at linpeas and other things, including the crontab. Not seeing anything specific.

ashen plover May 18, 2020, 2:25 AM

#

@patent token for anonymous?

patent token May 18, 2020, 2:25 AM

#

Yea, just realized I missed saying the room.

ashen plover May 18, 2020, 2:25 AM

#

in your linpeas you should see something that will show you what you need to do

patent token May 18, 2020, 2:26 AM

#

Ok. I'll take another look. I know I poked at it earlier and what I saw then doesn't exist now due to a patch I think.

stuck fractal May 18, 2020, 2:26 AM

#

vim suid was fixed

#

That was an unintended

ashen plover May 18, 2020, 2:27 AM

#

Yea but some other things should stand out

final lark May 18, 2020, 2:28 AM

#

@ashen plover Hey, Can I DM you?

ashen plover May 18, 2020, 2:29 AM

#

@final lark sure

patent token May 18, 2020, 2:29 AM

#

||for instance, I see I'm in the sudo group, but naturally can't do much due to not knowing the user password.

I've tried /usr/bin/env, but again, no sudo no bueno.||

stuck fractal May 18, 2020, 2:30 AM

#

I'm gonna have to try this box

patent token May 18, 2020, 2:30 AM

#

I'm not a fan of CTF's, so the struggle is very much real.

inland onyx May 18, 2020, 2:30 AM

#

@patent token You're in the right place there

#

With the command you tried

ashen plover May 18, 2020, 2:30 AM

#

@patent token take a look at what you have and i would take look at GTFObins if your unsure of something

inland onyx May 18, 2020, 2:30 AM

#

^^

patent token May 18, 2020, 2:31 AM

#

I just keep getting requests for passwords.

#

¯_(ツ)_/¯

inland onyx May 18, 2020, 2:31 AM

#

Don't sudo it then 😆

patent token May 18, 2020, 2:31 AM

#

I just get the same user

#

I've tried this

inland onyx May 18, 2020, 2:31 AM

#

What command are you trying?

#

||/usr/bin/env /bin/sh||?

patent token May 18, 2020, 2:32 AM

#

That one as well

#

Thought I clicked spoiler.

inland onyx May 18, 2020, 2:32 AM

#

Ah, yep. You're missing a switch

#

That will work

patent token May 18, 2020, 2:32 AM

#

Ok one sec

ashen plover May 18, 2020, 2:33 AM

#

https://gtfobins.github.io/

patent token May 18, 2020, 2:33 AM

#

I'm there.

ashen plover May 18, 2020, 2:33 AM

#

type in what you wanna look up and see what they have done

patent token May 18, 2020, 2:33 AM

#

||Just tried -p with no luck. I've tried -i as well.||

restive kestrel May 18, 2020, 2:33 AM

#

skip the first line

patent token May 18, 2020, 2:34 AM

#

I'm not sure what that means. I'm only using one line commands

restive kestrel May 18, 2020, 2:34 AM

#

r u looking at sudo or suid?

patent token May 18, 2020, 2:34 AM

#

lame. I can view the file with the command but can't escalate.

restive kestrel May 18, 2020, 2:34 AM

#

worked for me tho

inland onyx May 18, 2020, 2:34 AM

#

@patent token ||REDACTED -- NO ANSWERS ||

#

Try that

patent token May 18, 2020, 2:35 AM

#

That gives me the same user

#

||Using env cat/root/root.txt gave me the hash.||

restive kestrel May 18, 2020, 2:35 AM

#

u could always try to escalate another way via the lxd group

patent token May 18, 2020, 2:35 AM

#

Seems like I should be able to do more than just that.

inland onyx May 18, 2020, 2:35 AM

#

Curious. I just tried it on my own computer with the same conditions set

#

Worked for me

#

I know other people have managed it on that box

ashen plover May 18, 2020, 2:36 AM

#

i had same issue once i reset my box it worked

#

but i was getting some major lag on that box so could have just not taken the command?

patent token May 18, 2020, 2:36 AM

#

Guess I need to pay better attention

inland onyx May 18, 2020, 2:36 AM

#

Hehe, that looks like a root shell to me 😁

patent token May 18, 2020, 2:37 AM

#

Been sitting here root for 5 minutes. 😐

#

L2lookpassedthefirstUID

inland onyx May 18, 2020, 2:37 AM

#

🤣

patent token May 18, 2020, 2:37 AM

#

I don't CTF

inland onyx May 18, 2020, 2:37 AM

#

whoami, then id

#

Best combination

ashen plover May 18, 2020, 2:37 AM

#

lmao

patent token May 18, 2020, 2:37 AM

#

I've been root since before I asked for help.

inland onyx May 18, 2020, 2:37 AM

#

Followed by python -c 'import pty;pty.spawn("/bin/bash")

patent token May 18, 2020, 2:37 AM

#

...

inland onyx May 18, 2020, 2:37 AM

#

As an added bonus

patent token May 18, 2020, 2:38 AM

#

Community Mentor too.

#

😐

#

Fired!

#

Thanks for the help everyone. ❤️

ashen plover May 18, 2020, 2:39 AM

#

i usually go with whoami, upgrade shell then sudo -l as my first three but id is also a good one

patent token May 18, 2020, 2:40 AM

#

I'm gonna get smoked on Linux when I take OSCP I guess.

#

¯_(ツ)_/¯

ashen plover May 18, 2020, 2:40 AM

#

nah

#

its not bad

patent token May 18, 2020, 2:40 AM

#

I'm an eCPPT. So I already have an actual pentesting certification. Just need to git gud at CTF

ashen plover May 18, 2020, 2:40 AM

#

OSCP is not really CTF

#

it is in the sense of your gathering flags

stuck fractal May 18, 2020, 2:41 AM

#

I've heard the opposite

ashen plover May 18, 2020, 2:41 AM

#

they updated this year

stuck fractal May 18, 2020, 2:41 AM

#

I've heard from people who've taken it recently that it's very CTF

patent token May 18, 2020, 2:41 AM

#

Yea me too. I've never heard anything about it being anything close to lifelike.

ashen plover May 18, 2020, 2:41 AM

#

actually have AD stuff in it now

stuck fractal May 18, 2020, 2:41 AM

#

@ashen plover Nope

#

PWK has AD stuff

patent token May 18, 2020, 2:41 AM

#

I have the materials. They completely lack context because it doesn't directly relate to labs.

stuck fractal May 18, 2020, 2:41 AM

#

The exam does not.

ashen plover May 18, 2020, 2:41 AM

#

well yea im not talking about the exam

patent token May 18, 2020, 2:41 AM

#

It's just 800 pages of examples you can't practice.

stuck fractal May 18, 2020, 2:41 AM

#

Then you're talking about PWK

patent token May 18, 2020, 2:42 AM

#

Yea, PWK is not OSCP.

#

Or so I'm told.

#

¯_(ツ)_/¯

ashen plover May 18, 2020, 2:43 AM

#

semantics.

#

the exam is slightly more CTF with certain things for sure. The course itself is okay

#

but I mean i dont take cert to take an exam so thats why I say OSCP is also PWK but sure you could argue both ways

#

The worst part about the exam is the proctors IMO they love bugging you during the test 😛 ruined my flow so many times

patent token May 18, 2020, 2:45 AM

#

Anyways. Prolly should keep this channel for #room-hints. I've hijacked it enough. 🙂

summer wave May 18, 2020, 3:34 AM

#

Any hint for Anthem username for connecting through RDP

#

https://tenor.com/view/please-cat-pretty-please-gif-10675419

Tenor

patent token May 18, 2020, 3:40 AM

#

You have the username already. 🙂

summer wave May 18, 2020, 3:46 AM

#

but it doesn't work 😫

patent token May 18, 2020, 3:47 AM

#

Need a bit more information about than what you've offered honestly. But if you are on Task 3 and answered ALL of the questions before that, I promise you that you have the username and password already.

summer wave May 18, 2020, 5:16 AM

#

got it 😋

warm schooner May 18, 2020, 6:44 AM

#

Any initial access hints for anonymous? on the ftp server, can edit and upload files but can't figure out how to get a rev shell

unborn spade May 18, 2020, 7:03 AM

#

Ah yes. Love bash scripting.

echo thunder May 18, 2020, 8:44 AM

#

anthem

#

sorry

humble mountain May 18, 2020, 8:48 AM

#

how i can find the name of the Administrator on anthem chall :/? i got no idea

final lark May 18, 2020, 8:51 AM

#

@humble mountain What was the thing mentioned about admin on the website?

tribal ginkgo May 18, 2020, 9:09 AM

#

@humble mountain read the blogs

humble mountain May 18, 2020, 9:12 AM

#

i found it, thanks @tribal ginkgo @final lark

desert bramble May 18, 2020, 9:31 AM

#

Hi sorry to be a bother, but im struggling on this question a bit. Could anyone give me a hint on where to look.

📎 unknown.png

#

this is common linux priv esc *

#

This is what i think it is based on the question but its doesnt match the amount of chars Echo /bin/bash > ls

#

But then the name of the executable is script so i must be well wrong

dusty pebble May 18, 2020, 9:35 AM

#

you have two "chars" missing

final lark May 18, 2020, 9:36 AM

#

@humble mountain That's Great!

desert bramble May 18, 2020, 9:44 AM

#

you have two "chars" missing
@dusty pebble thank you so much! i thought those were just in the example i didnt know i needed them for the command!!!

dusty pebble May 18, 2020, 9:56 AM

#

You're welcome, you will have to use quotes in a lot of commands

burnt cosmos May 18, 2020, 10:25 AM

#

Working my way through the Shodan room and it's asking for the 3rd most popular country for MySQL servers in Google's ASN. A quick search reveals it should be ||Hong Kong (HK)|| but it doesn't seem to work. Any ideas?

past night May 18, 2020, 10:25 AM

#

the room needs updating i think

echo thunder May 18, 2020, 10:34 AM

#

anyone can give me a hint on how to find first flag on anthem challenge

#

?

woven pumice May 18, 2020, 10:48 AM

#

@echo thunder you need to check the html source code

echo thunder May 18, 2020, 10:48 AM

#

I have checked

#

I saw the flag

#

also on the other page get it

#

if looked on all the pages

#

tags,search, etc

burnt cosmos May 18, 2020, 10:48 AM

#

Look through the website

#

You'll find all of them just by inspect the website

dusty pebble May 18, 2020, 10:50 AM

#

i'm probably blind but i can't find it too, i have all the others flags except the first one

woven pumice May 18, 2020, 10:53 AM

#

/archive/-------------/
check meta tag

summer wave May 18, 2020, 11:10 AM

#

Any hint for admin password on Anthem

final lark May 18, 2020, 11:11 AM

#

Hint says it is hidden. Therefore, see the hidden files. @summer wave

#

Don't go deep. It's easily accessible. Most obvious location & name.

summer wave May 18, 2020, 11:21 AM

#

@final lark its been a day, i tried everything

dusty pebble May 18, 2020, 11:23 AM

#

@woven pumice this is the 4th right ? Or i'm really missing something

#

@summer wave What have you done yet ? (spoil your response)

summer wave May 18, 2020, 11:27 AM

#

@dusty pebble run gobuster and try to visit every page flag is in meta tag.

tribal ginkgo May 18, 2020, 11:29 AM

#

@dusty pebble which one exactly are you stuck on

dusty pebble May 18, 2020, 11:32 AM

#

@tribal ginkgo Just the first flag, i've done the rest of the box. I'm probably blind, i'll take a rest will gob is running as suggested and it should be good after 😁

tribal ginkgo May 18, 2020, 11:33 AM

#

😆 its in meta tags

dusty pebble May 18, 2020, 11:34 AM

#

Yup, it's probably in front of me x)

summer wave May 18, 2020, 11:36 AM

#

@dusty pebble i m stuck on admin password i tried every hidden files stuff

tribal ginkgo May 18, 2020, 11:36 AM

#

@dusty pebble search for pattern in source i

#

@summer wave that's a good one

#

😅

dusty pebble May 18, 2020, 11:37 AM

#

@summer wave not every obviously, you're on the right way, you've probably found the file, just search how to read it

final lark May 18, 2020, 11:38 AM

#

@umbral flint Try going to properties.

past night May 18, 2020, 11:40 AM

#

i am still curious why people overcomplicate it

steady stratus May 18, 2020, 11:40 AM

#

^

#

It's unintentionally a hard box ahah

dusty pebble May 18, 2020, 11:41 AM

#

I feel so dumb, i've seen it 50 times, i was sure i already used it

steady stratus May 18, 2020, 11:41 AM

#

I mean it's still good irrespective don't get me wrong

#

people just make it harder :^)

past night May 18, 2020, 11:42 AM

#

should i put a disclaimer @steady stratus ? Like, do not overcomplicate it?

dusty pebble May 18, 2020, 11:42 AM

#

Yup, right, i've spend few hours on this box, and now that i've finished it, i just make it a lot harder than it was, good box btw !

past night May 18, 2020, 11:42 AM

#

thank you ❤️

#

much appreciated

dusty pebble May 18, 2020, 11:42 AM

#

@past night Definitely x)

past night May 18, 2020, 11:43 AM

#

i mean

tribal ginkgo May 18, 2020, 11:43 AM

#

@dusty pebble right about that

steady stratus May 18, 2020, 11:43 AM

#

Mhm I'm not sure, it seems like people get it eventually. Not quite sure how you can word it without spoling

past night May 18, 2020, 11:44 AM

#

yeah, that folder name kekw

#

also

#

why do people look on linux for backups folders

#

but not on windows

steady stratus May 18, 2020, 11:45 AM

#

I think they're taking the other meaning of "hidden" rather then the technical term for it

past night May 18, 2020, 11:45 AM

#

looooool

steady stratus May 18, 2020, 11:45 AM

#

But you can't really rewrite that other then using hidden 😛

past night May 18, 2020, 11:45 AM

#

📎 English-is-weird-It-can-be-understood-through-toug.png

steady stratus May 18, 2020, 11:45 AM

#

Ahahaahahah!

signal needle May 18, 2020, 11:46 AM

#

Quick question on Anthem, is the foothold obtained via Umbraco LFI? Or is a password attack required?

past night May 18, 2020, 11:46 AM

#

none

wraith marsh May 18, 2020, 11:46 AM

#

Neither

signal needle May 18, 2020, 11:46 AM

#

:/

wraith marsh May 18, 2020, 11:46 AM

#

Take a closer look at the open ports

#

one will stand out

signal needle May 18, 2020, 11:46 AM

#

Will do, thanks

past night May 18, 2020, 11:47 AM

#

i've read about the umbraco lfi, but didn't get how to actually make it work

signal needle May 18, 2020, 11:47 AM

#

Yeah I wasnt having any luck with it, put it that way 😂

past night May 18, 2020, 11:48 AM

#

it's a diffeent version though

#

i think the current website is running on 7.xx latest version at the time the room was created

#

which is defo nowhere close the 7.15 lfi

white salmon May 18, 2020, 12:14 PM

#

how do u get the admin name? there's a real anthem.com site is it related?

final lark May 18, 2020, 12:14 PM

#

@white salmon No it is not related to that.

#

Just see what is mentioned about admin on the target machine.

white salmon May 18, 2020, 12:16 PM

#

lol ok got it

#

can't find the first flag even tho i got the others...

final lark May 18, 2020, 12:19 PM

#

@white salmon Hint says to see the source code. Simple. Just search in the source code of every page.

#

I really mean it. "Every Page"

dusty pebble May 18, 2020, 12:19 PM

#

Aha, same as me, just pay attention 😁

final lark May 18, 2020, 12:20 PM

#

@white salmon Attention. That's it

white salmon May 18, 2020, 12:24 PM

#

do i need to fuzz it?

final lark May 18, 2020, 12:25 PM

#

@white salmon No no, Just search for the flag in the Source Code.

steady stratus May 18, 2020, 12:25 PM

#

^

final lark May 18, 2020, 12:25 PM

#

Look INTO Source Code!

white salmon May 18, 2020, 12:25 PM

#

i read it whole lol

steady stratus May 18, 2020, 12:26 PM

#

Read it again

white salmon May 18, 2020, 12:27 PM

#

lol wtf

final lark May 18, 2020, 12:27 PM

#

@white salmon What is the format of Flag?

white salmon May 18, 2020, 12:27 PM

#

it's the same as others THM{

#

found it

final lark May 18, 2020, 12:27 PM

#

Then just search for it.

#

😉

#

Suppose you are searching for a word in Notepad. How can you find a specific word?

warm schooner May 18, 2020, 12:28 PM

#

@past night yes...

📎 unknown.png

white salmon May 18, 2020, 12:29 PM

#

well now i gotta guess the credentials for the box, i guess

dusty pebble May 18, 2020, 12:30 PM

#

@white salmon Nope, don't guess, it's in plaintext somewhere

summer wave May 18, 2020, 12:31 PM

#

@past night Finally done the Anthem, seriously that hidden thing got me confused. Nice box BTW.

steady stratus May 18, 2020, 12:31 PM

#

Nice one!

tribal ginkgo May 18, 2020, 12:32 PM

#

@summer wave that hidden thing was good

final lark May 18, 2020, 12:33 PM

#

@summer wave Great Work! 🙂

echo thunder May 18, 2020, 12:43 PM

#

can anyone give me a hint on how to get root on Anonymous challenge

#

?

white salmon May 18, 2020, 12:50 PM

#

check what has high privilieges?

#

Still web or rdp?

echo thunder May 18, 2020, 12:56 PM

#

I've done it thru nc

dusty pebble May 18, 2020, 12:57 PM

#

enum scripts will give you a good hint

echo thunder May 18, 2020, 12:57 PM

#

I use linepeas but I don't know exactly where to look

dusty pebble May 18, 2020, 12:59 PM

#

i think i used linpeas too, and linpeas is telling you that is interesting, then just search for this and u will be good

echo thunder May 18, 2020, 1:00 PM

#

it is regarding that CVE

#

?

dusty pebble May 18, 2020, 1:00 PM

#

No CVE

echo thunder May 18, 2020, 1:01 PM

#

it is on pkexec

white salmon May 18, 2020, 1:01 PM

#

you gotta try them out i guess

dusty pebble May 18, 2020, 1:01 PM

#

gtfobins 👍

white salmon May 18, 2020, 1:07 PM

#

on anthem tho is it through web or rdp?

dusty pebble May 18, 2020, 1:07 PM

#

rdp

white salmon May 18, 2020, 1:08 PM

#

hm ok thanks

#

cuz i got the web admin to login

#

oh i got it

final lark May 18, 2020, 1:18 PM

#

Great @white salmon

white salmon May 18, 2020, 1:19 PM

#

now need to find them hidden files

final lark May 18, 2020, 1:20 PM

#

Good Luck

white salmon May 18, 2020, 1:23 PM

#

hm access denied

final lark May 18, 2020, 1:30 PM

#

@white salmon Keep Trying!

white salmon May 18, 2020, 1:33 PM

#

do we need to escalate privileges before finding the password?

final lark May 18, 2020, 1:37 PM

#

@white salmon You cannot escalate privileges until, you find the password

signal needle May 18, 2020, 1:37 PM

#

Finished Anthem @past night. Fun box!

white salmon May 18, 2020, 1:43 PM

#

what am i looking for tho? i found a txt file which might be interesting and although the file owner is the current user i cant open it

stuck fractal May 18, 2020, 1:44 PM

#

Play with it until you can

past night May 18, 2020, 1:57 PM

#

cheers @signal needle ❤️

signal needle May 18, 2020, 2:10 PM

#

You got any more Windows boxes in progress? 😊

past night May 18, 2020, 2:16 PM

#

3 currently. 2 are part of a walkthrough

left birch May 18, 2020, 2:42 PM

#

hey guys, im stuck on anonymous. Enumerated all the shares, found the interesting script, but dont rly know what to do with it from here on out. Any1 finished it already and could give me a push in the right direction? 😄

signal needle May 18, 2020, 2:43 PM

#

@past night Awesome, definitely need more Windows boxes. I’d like to see more AD related as well with the latest attacks etc.

austere aspen May 18, 2020, 2:43 PM

#

dont give hints

signal needle May 18, 2020, 2:44 PM

#

There’s a applocker box on THM which is quite interesting. More of those type of boxes would be good.

white salmon May 18, 2020, 2:46 PM

#

@austere aspen this is literally a hints channel

steady stratus May 18, 2020, 2:46 PM

#

#room-ideas

stuck fractal May 18, 2020, 2:56 PM

#

@left birch there's some logs there, have a look.

past night May 18, 2020, 2:56 PM

#

yeah, there is stuff going on but i got some priorities in life for now @signal needle ( UNI ASSIGNMENT IS A HECK) to be done in the next few days, after that i'll crack on

left birch May 18, 2020, 2:57 PM

#

yeee I salvaged this 1 log on the share, but i either dont know what i can do with them or idk haha

stuck fractal May 18, 2020, 2:57 PM

#

The logs give you some info about the script

white salmon May 18, 2020, 2:57 PM

#

so i need some hints on how to read a file which the user is owner but access is denied on anthem, or am i looking in the wrong place?

#

tried to get more permission on powershell but no luck

left birch May 18, 2020, 2:58 PM

#

yee i went through the ||clean.sh|| script but ther isnt too much i can do with it or im missing smth

dusty pebble May 18, 2020, 2:58 PM

#

@white salmon dont over complicate it, you're on the right way

stuck fractal May 18, 2020, 2:58 PM

#

@left birch find out what's happening.

white salmon May 18, 2020, 2:59 PM

#

wym overcomplicating?

left birch May 18, 2020, 2:59 PM

#

i did haha but how can i use a script which i cant rly execute on demand to my advantage

dusty pebble May 18, 2020, 2:59 PM

#

You can open it without powershell or some weird stuff

final lark May 18, 2020, 3:00 PM

#

@white salmon You dont need anything special. Just browse in and out of directories

#

Find the right file. Done!

dusty pebble May 18, 2020, 3:00 PM

#

@left birch Actually, you can, it's the goal 😁

unborn spade May 18, 2020, 3:00 PM

#

nice room @verbal wedge Enjoyed it.

white salmon May 18, 2020, 3:00 PM

#

i really can't tried already with notepad, type, cat, path traversal..

verbal wedge May 18, 2020, 3:00 PM

#

Thank you!

dusty pebble May 18, 2020, 3:00 PM

#

@white salmon It's over complicate too ^^

final lark May 18, 2020, 3:01 PM

#

@white salmon DM me for more help if you are stressed out.

stuck fractal May 18, 2020, 3:01 PM

#

@left birch the log files have entries every 5mins. That implies is being automatically ran right?

left birch May 18, 2020, 3:06 PM

#

the log does not change with me

#

like "last edited"

dry pelican May 18, 2020, 3:09 PM

#

im in the last part of ANTHEM any hints how to finde the admin username.

solemn smelt May 18, 2020, 3:12 PM

#

@signal needle the problem is a lot of ad attacks require networks so that limits us a bit until networks come out and then ad hasn’t changed a whole lot in terms of attacks because sys admins still don’t know how to secure their dcs so the same attacks work there should be plenty of windows content getting pushed out soon though

white salmon May 18, 2020, 3:12 PM

#

check for hidden secrets @dry pelican

dry pelican May 18, 2020, 3:18 PM

#

@white salmon hmm im trying for like 45 minutes first parts are quit easy but this one im kindda clueless, still thank you for the help

white salmon May 18, 2020, 3:23 PM

#

try to find hidden stuff with the command prompt, you can try dumping them all or going one by one

dry pelican May 18, 2020, 3:29 PM

#

u mean on the remote machine or main cause i have not yet connected the machine

stuck fractal May 18, 2020, 3:32 PM

#

Get a shell!

dry pelican May 18, 2020, 3:48 PM

#

yes so i tried that and i got an error. im sorry im being quite annoying now thank you so much for the help ill just keep trying.

white salmon May 18, 2020, 3:49 PM

#

if you have user credentials try to login

humble mountain May 18, 2020, 3:52 PM

#

anyone doing anonymous chall? im stuck at the number 5 :/, what should i do? already tried the smb share but only found some cutty pics

final lark May 18, 2020, 3:52 PM

#

Anonymous room? @humble mountain

humble mountain May 18, 2020, 3:52 PM

#

@final lark yes

austere aspen May 18, 2020, 3:52 PM

#

Use pipe

stuck fractal May 18, 2020, 3:52 PM

#

@humble mountain You fell down the rabbit hole

humble mountain May 18, 2020, 3:53 PM

#

what is that means :/ @stuck fractal

final lark May 18, 2020, 3:53 PM

#

@humble mountain You are not going the correct way

stuck fractal May 18, 2020, 3:53 PM

#

A rabbit hole is something you will spend time looking at, and it won't get you anywhere

humble mountain May 18, 2020, 3:53 PM

#

ahhh okay, thats why haha

stuck fractal May 18, 2020, 3:54 PM

#

From Alice in wonderland, ||when she falls down the rabbit hole into wonderland||

#

Spoiling a book that's over 100 years old there

final lark May 18, 2020, 3:54 PM

#

😭

spark monolith May 18, 2020, 4:05 PM

#

I am currently solving Anthem , though I have completed the first two tasks but i am not able to find the password for the admin to rdp on the machine. can anyone help?

white salmon May 18, 2020, 4:06 PM

#

try rdp with other passwords

spark monolith May 18, 2020, 4:07 PM

#

as in the other flags that have been collected? @white salmon

white salmon May 18, 2020, 4:07 PM

#

maybe you can login with a lower privilege user other than admin

final lark May 18, 2020, 4:07 PM

#

😉

#

@spark monolith Try the possible password you found.

spark monolith May 18, 2020, 4:09 PM

#

okay thanks @final lark @white salmon

humble mountain May 18, 2020, 4:10 PM

#

@final lark i found 3 files, what should i do next with that files :/

stuck fractal May 18, 2020, 4:11 PM

#

Work out what they are

#

Why they're there

final lark May 18, 2020, 4:11 PM

#

@humble mountain Figure out what's going on with them.

humble mountain May 18, 2020, 4:11 PM

#

okay lemme try

humble mountain May 18, 2020, 4:34 PM

#

@final lark @stuck fractal straight into privesc by putting some revshell?

stuck fractal May 18, 2020, 4:34 PM

#

wat

#

||Cron doesn't always run tasks as root|| @humble mountain

#

Try things before you ask. @humble mountain

night rivet May 18, 2020, 4:51 PM

#

is 4th question in xss room task 3 bugged? cant seem to get it

#

nvm, I got it lol

zinc plume May 18, 2020, 5:28 PM

#

need some help with RP: Nmap. "What about 'very verbose' (A personal favorite)" where can i find the solution in nmap -h?

stuck fractal May 18, 2020, 5:28 PM

#

man nmap

zinc plume May 18, 2020, 5:29 PM

#

what is the difference between nmap -h and man nmap?

tidal sedge May 18, 2020, 5:30 PM

#

@zinc plume man nmap contains a lot more detail.

stuck fractal May 18, 2020, 5:30 PM

#

man is a seperate program

zinc plume May 18, 2020, 5:30 PM

#

alright thanks

night rivet May 18, 2020, 5:38 PM

#

man = short for manual

white salmon May 18, 2020, 6:56 PM

#

any hints for pentesting crash course ctf?

#

been running ffuf on /secret/ but nothing comes out

night rivet May 18, 2020, 7:09 PM

#

not sure if I remember right, but try extensions also

#

and dont focus on a single wordlist and go with that always, try different ones

white salmon May 18, 2020, 7:22 PM

#

.php .php3 .php5 .php7 .html .xhtml .json .asp .aspx are these anough?

stuck fractal May 18, 2020, 7:25 PM

#

txt?

white salmon May 18, 2020, 7:25 PM

#

right...

#

it's gonna be a txt for sure

#

maybe i should deploy the machine again after it expired right

stuck fractal May 18, 2020, 7:31 PM

#

That'd help

quiet musk May 18, 2020, 9:29 PM

#

Just finished Anonymous. Was way overthinking it. Got down what I though was an obvious path but was just a rabbit hole. Fun room.

simple schooner May 18, 2020, 9:31 PM

#

can somebody give me a hint for priv esc on tomghost ?

inland onyx May 18, 2020, 9:34 PM

#

Read up on PGP keys

simple schooner May 18, 2020, 9:35 PM

#

tnx ... so im looking in the right direction

#

tried john ... but no sucess so far

inland onyx May 18, 2020, 9:37 PM

#

John will do it

simple schooner May 18, 2020, 9:45 PM

#

tried another wordlist ... et voila

#

thanks

stuck fractal May 18, 2020, 9:48 PM

#

@simple schooner rockyou > others for most of THM

#

Especially if you're cracking a hash

simple schooner May 18, 2020, 9:49 PM

#

thats the one that worked for me 😉

white salmon May 18, 2020, 10:06 PM

#

rockyou for ssh as well?

stuck fractal May 18, 2020, 10:06 PM

#

@white salmon Only if you're meant to brute your way in

#

Isn't very common

white salmon May 18, 2020, 10:07 PM

#

yea

white salmon May 19, 2020, 12:23 AM

#

any hint on anonymous privesc task? Im out of ideas, where should I look?

inland onyx May 19, 2020, 12:25 AM

#

GTFO

vestal igloo May 19, 2020, 12:25 AM

#

bins

#

any hints for UltraTech's database task I'm lost even with the hint

arctic frigate May 19, 2020, 1:21 AM

#

Hey guys, doing the nessus room.
Completed all questions except the directory containing example documents. There is nothing related to this on nessus scan output. Also used dirbuster, no success.
Need a hint please

crimson helm May 19, 2020, 1:28 AM

#

Need some help on lfi basics task 3 question 5, I don't know where to put commands

verbal wedge May 19, 2020, 3:09 AM

#

@quiet musk glad you liked it!

solemn smelt May 19, 2020, 4:10 AM

#

@arctic frigate web app scan I believe?

#

@crimson helm whatever you put in quotations to get command output put that after your directory traversal then an equal sign your command goes there

marble dagger May 19, 2020, 4:39 AM

#

anyone here that already got ctf collection vol2? I'm stuck at easter 15. the hash is the same, but I still can't see the answer. any hints?

high hamlet May 19, 2020, 5:31 AM

#

anyone able to do day 11 of Advent of Cyber? Having issues getting my FTP connection to server to work. Getting issue when issuing commands. Tried to research issue and fix but no luck. Errors im getting are: 500 Illegal Port command and ftp: bind: Address already in use

signal needle May 19, 2020, 7:14 AM

#

@verbal wedge Just finished Anonymous, really good box especially the privesc.

final lark May 19, 2020, 7:14 AM

#

@signal needle Well Done!

arctic frigate May 19, 2020, 9:03 AM

#

@arctic frigate web app scan I believe?
@solemn smelt

Yeah I did that using nessus, didn't find anything related to this question

humble mountain May 19, 2020, 9:27 AM

#

@final lark @stuck fractal thanks for your help, finally figured it out :>

final lark May 19, 2020, 9:28 AM

#

@humble mountain Glad I was able to help 🙂

verbal wedge May 19, 2020, 10:49 AM

#

@signal needle thank you!!

spark monolith May 19, 2020, 11:43 AM

#

Is rockyou.txt the correct wordlist for bruteforcing wordpress login in Jack CTF ?

#

or there is any other recommended wordlist which is more compact?

tidal sedge May 19, 2020, 12:00 PM

#

@spark monolith Rockyou is not the correct wordlist 🙂

spark monolith May 19, 2020, 12:02 PM

#

any hints? @tidal sedge

tidal sedge May 19, 2020, 12:02 PM

#

The wordlist that you need is installed by default on Kali

spark monolith May 19, 2020, 12:12 PM

#

got it thanks @tidal sedge

vapid crown May 19, 2020, 12:33 PM

#

Any hint anthem root please?

dusty pebble May 19, 2020, 12:40 PM

#

Did you found the hidden directory ?

dry pelican May 19, 2020, 12:47 PM

#

@dusty pebble hey im trying since yesterday to find the admin username but got nothing

dusty pebble May 19, 2020, 12:49 PM

#

@dry pelican It's on the website, you will need the help of google 😉

dry pelican May 19, 2020, 12:51 PM

#

on the web app what i closed that and started using maltigo and im so close to using social engineering lol.

dusty pebble May 19, 2020, 12:52 PM

#

Don't overcomplicate it, there is a post for the admin, just pay attention to it and ask to google 😉

spark monolith May 19, 2020, 12:53 PM

#

@vapid crown search for the hidden directory

dry pelican May 19, 2020, 12:54 PM

#

thats the username i have it since yesterday i think can i send it to u in private please

dusty pebble May 19, 2020, 12:54 PM

#

Yup 😉

indigo ridge May 19, 2020, 2:42 PM

#

Daily Buggle room. How to escalate priviledge to root wiith gitfobins.. I can't understand. please help me.

patent token May 19, 2020, 2:59 PM

#

Did you search for the appropriate one?

white salmon May 19, 2020, 3:07 PM

#

can anyone help with sqlmap for the OWASP Juice Shop i really want to understand how to use sqlmap to solve this puzzle..

sharp mason May 19, 2020, 3:23 PM

#

I'm stuck on the bof1 Buffer Overflow room, task 8. This is the task where you are supposed to successfully get a shell by overflowing the buffer. I've tried running the example code they have provided but running it just gets a segmentation fault. I'm thinking maybe I need to provide a different memory address than the one that they have provided. I have the program attached inside gdb and I've been testing with different fuzzing strings etc but I can't seem to figure out what address that I'm looking for. The info I'm reading all references EIP as the instruction pointer that I'm trying to overwrite but the closest thing I see in gdb is RIP which is maybe the x86_64 equivalent?

stuck fractal May 19, 2020, 3:24 PM

#

@sharp mason Yeah, this is the prefixes again

#

E is 32bit, R is 64bit

#

You can access 32bit registers from a 64bit program, it's the same register

sharp mason May 19, 2020, 3:24 PM

#

right, so the odd thing is that I can't get the value of RIP to change

stuck fractal May 19, 2020, 3:24 PM

#

Task 8 is a HUGE step up in difficulty

sharp mason May 19, 2020, 3:27 PM

#

so, even if I feed 5k "A" chars as input, I can't get the value of RIP to change gdb --args buffer-overflow $(python -c "print('A' * 5000)")

stuck fractal May 19, 2020, 3:27 PM

#

I'm not a BoF guy, I just know some x86 assembly

#

People have a lot of trouble with it

sharp mason May 19, 2020, 3:28 PM

#

I think maybe I'm missing something, this is supposed to be the easiest bof room

stuck fractal May 19, 2020, 3:28 PM

#

Not task 8 and 9

sharp mason May 19, 2020, 3:31 PM

#

any hints on what I'm missing regarding how to control RIP?

#

in all the other examples I've seen for entry lvl bof, the teqnique is to fuzz until you can find the offset required to get data into the EIP/RIP

#

something is keeping the RIP from being overwritten

stuck fractal May 19, 2020, 3:33 PM

#

I haven't learnt BoF yet so I got nothing

sick sun May 19, 2020, 3:38 PM

#

Anyone done anonymous rooms ? Need hint privs esc

stuck fractal May 19, 2020, 3:39 PM

#

gtfobins

solemn smelt May 19, 2020, 3:42 PM

#

@sharp mason I don’t have a subscription so I haven’t done the room/ look at it however you’re right in saying you should find the offset maybe look for bad characters?

sick sun May 19, 2020, 3:43 PM

#

But i didnt got creds user

sharp mason May 19, 2020, 3:43 PM

#

@solemn smelt the part I'm stuck on is that I can't find the offset b/c I can't overwrite the RIP

#

seems like no matter how many chars I throw at the program, RIP never changes. I've tried up to 50k 'A' chars

solemn smelt May 19, 2020, 3:46 PM

#

Ohhhh that’s your problem I’m not sure how the room has you do it but I always use a pattern create as the offset

sick sun May 19, 2020, 3:47 PM

#

@stuck fractal if i run gtfo without sudo i just got user again

stuck fractal May 19, 2020, 3:47 PM

#

You need to understand the vuln @sick sun

sharp mason May 19, 2020, 3:51 PM

#

@solemn smelt same, but you can't find the part of the pattern to find the offset unless the EIP/RIP gets overwritten

solemn smelt May 19, 2020, 3:52 PM

#

no you overwrite the eip after you find the offset unless the room has you do it some other way I’ve never heard of

#

How are you going to know where to overwrite the eip if you don’t know where the eip even is? That what finding the offset is doing

sharp mason May 19, 2020, 3:53 PM

#

true, but if you can't overwrite the EIP, you don't know where the offset it is

wraith marsh May 19, 2020, 3:54 PM

#

Are you doing Bof1? If so, RIP wont overwrite with just A's

sharp mason May 19, 2020, 3:54 PM

#

yes, I'm doing Bof1

wraith marsh May 19, 2020, 3:55 PM

#

Okay,so to overwrite RIP, the address needs to be in a specific range

sharp mason May 19, 2020, 3:55 PM

#

why won't A's overwrite, are they bad chars here?

wraith marsh May 19, 2020, 3:55 PM

#

Because for 64bit the address of RIP needs to be in a specific range

#

google: "x64 buffer overflow"

#

theres a good article on medium that explains it

sharp mason May 19, 2020, 3:56 PM

#

willdo

#

thx

wraith marsh May 19, 2020, 3:56 PM

#

np

sick sun May 19, 2020, 4:13 PM

#

@stuck fractal im stuck on priva esc

stuck fractal May 19, 2020, 4:13 PM

#

Yes.

#

You need to understand the vuln

#

And understand how to use it

#

Do some research

acoustic glen May 19, 2020, 4:14 PM

#

Hey, I could use some help with the anthem box.
I just can't find the name of the administrator and I have no idea what the hint is trying to tell me

inland onyx May 19, 2020, 4:14 PM

#

Use the information on the site to piece it together @acoustic glen

#

That question (and the next one) are all about lateral thinking

sick sun May 19, 2020, 4:20 PM

#

@stuck fractal easy man hahahha

stuck fractal May 19, 2020, 4:20 PM

#

huh?

echo thunder May 19, 2020, 4:41 PM

#

any hint on how to find the password for the admin on anthem. I found a hidden directory in C:\ but the file can be opened only by the administrator

wraith marsh May 19, 2020, 4:44 PM

#

but the file can be opened only by the administrator
@echo thunder You sure?

fleet flume May 19, 2020, 4:44 PM

#

Hey! I'm pretty beginner to InfoSec and am having a little trouble with the Blue room.

I've got the explot set up to run, i'm setting the RHOSTS value to be the target IP, but I am getting "exploit success, but no session started" error message. I've tried resetting the room a few times with no luck. I've even followed a guide to see where I'm going wrong, but can't seem to find anything. Any help is appreciated 🙂

echo thunder May 19, 2020, 4:44 PM

#

yes

#

can I PM you

#

?

wraith marsh May 19, 2020, 4:45 PM

#

I'd prefer not. My hint was enough.

steady stratus May 19, 2020, 4:47 PM

#

I fully agree ^^

fleet flume May 19, 2020, 4:48 PM

#

Also, RE me, im brand new to the discord so not sure if this is the right place to post the above message cause it's not quite a hint I'm asking for, so if there's a better channel please let me know

echo thunder May 19, 2020, 4:48 PM

#

the txt file is readable only by admin and the ||.dat ||one is readeable also by me

solemn smelt May 19, 2020, 4:49 PM

#

@fleet flume that’s just eternal blue being eternal blue you just gotta do it a couple time

fleet flume May 19, 2020, 4:49 PM

#

Thanks, @solemn smelt , ill bombard it a few more times and if I'm not successful ill come back 😂

solemn smelt May 19, 2020, 4:52 PM

#

If that doesn’t work some things that will prevent an exploit from working are the target you have set the default may not always work, and changing between a staged and non staged payload however I don’t believe any of those need to be change for it to work on blue

fleet flume May 19, 2020, 4:55 PM

#

I noticed there are a few variants of eternal blue within metasploit, will others also work on this machine and should I try them if the first one asked for by the room isnt working?

stuck fractal May 19, 2020, 4:55 PM

#

Nope.

solemn smelt May 19, 2020, 4:55 PM

#

there’s only really two

#

But no the one that the room says to use should work just fine

fleet flume May 19, 2020, 4:56 PM

#

hmmm, okay. will keep digging. thanks both

echo thunder May 19, 2020, 5:01 PM

#

finally figure it out for antehm

#

anthem

#

it was the most stupid thing

steady stratus May 19, 2020, 5:49 PM

#

Very easy to overcomplicate

final lark May 19, 2020, 5:56 PM

#

Anyone solving New box "Gatekeeper"?

patent token May 19, 2020, 6:27 PM

#

One person has made it beyond the first task which just requires starting the machine up.

marsh violet May 19, 2020, 6:39 PM

#

I'm stuck and have no where to go....

#

Any hints for Gatekeeper?

patent token May 19, 2020, 6:40 PM

#

🙂

sinful garden May 19, 2020, 6:40 PM

#

Might be a lil soon for hints

patent token May 19, 2020, 6:42 PM

#

The gate is only half the battle.

dense marlin May 19, 2020, 6:58 PM

#

hi there can i get some hint for THM: anthem task 1: #4, i tried to crawl the pages with burpsuite, but i cant managed to find the .txt file

stuck fractal May 19, 2020, 6:59 PM

#

@dense marlin Burp spidering etc is only going to pick up stuff that's linked

dense marlin May 19, 2020, 6:59 PM

#

so it's not linked you mean?

stuck fractal May 19, 2020, 7:00 PM

#

I don't know

dense marlin May 19, 2020, 7:00 PM

#

the question did mentioned possible password in one of the pages web crawlers check for

#

i thought it might be linked

stuck fractal May 19, 2020, 7:00 PM

#

Nah

#

There are files that exist

#

That Google etc checks for when crawling

tidal sedge May 19, 2020, 7:00 PM

#

@dense marlin Robots are nice don't you agree?

dense marlin May 19, 2020, 7:00 PM

#

i do checked the robots too @tidal sedge

tidal sedge May 19, 2020, 7:01 PM

#

It's there if I remember correctly

dense marlin May 19, 2020, 7:01 PM

#

@stuck fractal so you mean the file might be out of the scope? like it might be outside of the machine ip?

#

like google github those link?

stuck fractal May 19, 2020, 7:02 PM

#

@dense marlin No

#

Spidering etc only looks at pages that are linked somewhere

dense marlin May 19, 2020, 7:02 PM

#

ok i tried to perform fuzzing on the robots

stuck fractal May 19, 2020, 7:02 PM

#

what no

tidal sedge May 19, 2020, 7:02 PM

#

🤦

stuck fractal May 19, 2020, 7:03 PM

#

||robots.txt|| is a file that real crawlers will look for to tell them what they can and can't crawl

dense marlin May 19, 2020, 7:03 PM

#

yea i mean the directories in robtos

#

*robots

#

fuzzing for files that might be potential contain in the directories that specified in robots

stuck fractal May 19, 2020, 7:04 PM

#

what

#

fuzzing for files that might be potential contain in the directories that specified in robots
@dense marlin This makes no sense.

dense marlin May 19, 2020, 7:05 PM

#

sometimes some user might store their file in those directory like /config/password.txt or something else that's why they dont want you to crawl these directory?

#

ok my bad

#

i cant believe that im watching the exact answer for 2 hrs

#

i've overthink the whole thing

#

@stuck fractal @tidal sedge thanks for the hint

upper solar May 19, 2020, 7:15 PM

#

hey everyone can anybody help me in Anthem room task 1-7

dense marlin May 19, 2020, 8:49 PM

#

hey there can anyone give me some nudge for anthem rdp login? i've tried different format of username for the first and last name that gathered with the password that found. the credential works when i login into the CMS but it seems that the credential for the rdp is different so i tried several type of username format for with the credential found. Im kinda lost right now

past night May 19, 2020, 8:50 PM

#

read the task

#

i can't put stuff in BOLD otherwise i would ruin the fun

dense marlin May 19, 2020, 8:51 PM

#

actually i've read it
sorry bout it but i dont really understand it

torn mural May 19, 2020, 9:03 PM

#

Gatekeeper, am I on the right track?

patent token May 19, 2020, 9:06 PM

#

Not sure what you mean

#

Should definitely ask your question more specifically please.

torn mural May 19, 2020, 9:07 PM

#

Being the Cryptic keeper since it is such a new room

patent token May 19, 2020, 9:08 PM

#

Not at all

#

Happy to help being as I created it

#

But I would expect me to gatekeep it a bit. 🙂

torn mural May 19, 2020, 9:08 PM

#

Oh cool, mind if I pm you?

#

anywho, I noticed how leet this challenge was and wondered if a buffer overflow was in order

patent token May 19, 2020, 9:21 PM

#

So, I recommend poking at it a bit and see what you get. If you've enumerated you may find something that you can use and test.

dense marlin May 20, 2020, 5:02 AM

#

@past night my bad, i've literally overthink lots of stuff in ur room. Found the credential for rdp

tender bluff May 20, 2020, 6:15 AM

#

I have a question that I want to check with you uys
guys*
I've just started the "Common Linux Privesc" room and it mentions downloading the Linenum shell which I did. the questions in the sections doesn't say anything about actually transferring it and using it on the machine so I just want to confirm that That is what I am supposed to do in order to answer the questions or if it's not something I'm supposed to do?
the instructions aren't terribly cleat
clear*

#

woops, wrong room 😦

#

apologies

vapid zenith May 20, 2020, 7:15 AM

#

how to find admin of anthem room in web site analysis task

echo thunder May 20, 2020, 7:21 AM

#

Hi @vapid zenith

#

PM me

#

and I will be glad to help you

past night May 20, 2020, 7:38 AM

#

@dense marlin yup, we know. i told this at least 20 times about not complicating stuff

vapid zenith May 20, 2020, 8:08 AM

#

@echo thunder come in inbox bro

#

I found a restore file in anthem room but cant access it

#

how to check that

past night May 20, 2020, 8:54 AM

#

Google Windows file permissions

echo thunder May 20, 2020, 9:00 AM

#

anyone finished the gatekeeper room

#

?