#room-hints | TryHackMe | Page 27

humble mountain May 20, 2020, 9:02 AM

#

stuck at the privesc to root

spark monolith May 20, 2020, 10:39 AM

#

Is anybody facing an issue in getting a reverse shell in Anonymous v6 CTF?

#

the commands are taking alot of time to work

#

please help if anyone has a better way to do it

tidal sedge May 20, 2020, 10:41 AM

#

@spark monolith I didn't face any issue

#

@spark monolith Don't pm me again without permission.

spark monolith May 20, 2020, 10:45 AM

#

@tidal sedge sure

steady stratus May 20, 2020, 10:48 AM

#

If you look at the log file, you'll see an entry for every 5 minutes

#

You should infer from it that something happens every 5 minutes 🙂

spark monolith May 20, 2020, 10:50 AM

#

i have got the reverse shell but it's taking a lot of time to respond this is due to the cleaning of log files every 5 mins?

steady stratus May 20, 2020, 10:50 AM

#

If the reverse shell has executed then it will persist

#

Any input lag will be your connection

spark monolith May 20, 2020, 10:51 AM

#

oh okay thanks @steady stratus

steady stratus May 20, 2020, 10:51 AM

#

You can always ping the machine to verify any drastic latency

tardy python May 20, 2020, 11:28 AM

#

any hints on root of Anonymous?

humble mountain May 20, 2020, 11:30 AM

#

@tardy python what cron jobs do?

tardy python May 20, 2020, 11:31 AM

#

i dont see any crons of root

signal needle May 20, 2020, 11:39 AM

#

Have you ran automated scripts yet? Linenum,LinPEAS?

#

They pretty much tell you the answer

dense marlin May 20, 2020, 11:46 AM

#

any hints on root of Anonymous?
@tardy python linEnum can tell you something interesting for the escalation.

viscid mason May 20, 2020, 12:09 PM

#

any hints on root of Anonymous?
@tardy python

check for some "ID" i think u can easily "SU" that VM. that was an easy room. just basic PrivEsc knowledge needed!

echo thunder May 20, 2020, 1:16 PM

#

anyone can give a hint for lord of the root task 2 question 6?

atomic ether May 20, 2020, 3:18 PM

#

Hi all, I'm on task 7 of the Ice room. They say that you should be able to to use the c code from exploit-db to do the same thing but no matter what i run or install i can't seem to get it to compile successfully. Has anyone else achieved this? Can you let me know if there is an issue with the code i need to correct or if it's an issue with my compiler configuration? I don't have any c background so trying to avoid debugging the script itself unless i know for certain that's the issue. Many thanks.

white salmon May 20, 2020, 3:21 PM

#

aaa any hints on unreadable thing in peak hill the ||encoded thing or whatever||

wooden mist May 20, 2020, 3:25 PM

#

the task description is a bit of a hint ;)

white salmon May 20, 2020, 3:27 PM

#

okay good sir thank you very muchy

potent quail May 20, 2020, 3:32 PM

#

I’m also on that room. I worked out what to do but it didn’t work so o feel I did it wrong somehow. I get an error suggesting about a MARK but I couldn’t fix it. Unsure what I need to do

#

@wooden mist mind if I shoot you a quick message please to see if I’m on the right track?

frail ferry May 20, 2020, 3:40 PM

#

are you sure the word was mark? if yes, please explain what you did in DM

potent quail May 20, 2020, 3:51 PM

#

@frail ferry that was an error I got. Not a clue or anything.

frail ferry May 20, 2020, 3:53 PM

#

but doing what? (DM to avoid spoils)

white salmon May 20, 2020, 3:54 PM

#

Any hints for Anthem room, rdp credentials ?

frail ferry May 20, 2020, 3:55 PM

#

you will have every information you need if you replied to #1 -> #7

white salmon May 20, 2020, 4:18 PM

#

Hello, I dont want to spoil anything but if someone can help with gatekeeper that would be great, i have a shell and working on root yet i have a question on it. Thanks

primal linden May 20, 2020, 4:25 PM

#

anthem room i need 1-7

stuck fractal May 20, 2020, 4:26 PM

#

...that's all of it

primal linden May 20, 2020, 4:26 PM

#

what

scenic harness May 20, 2020, 4:27 PM

#

Hi, Im working through the Intro to x86-64. I'm stuck on the task 4. I was able to see the variable on memory but it does not match the answer. I got all the other flags except for the first one.

primal linden May 20, 2020, 4:27 PM

#

@stuck fractal is that for me?

stuck fractal May 20, 2020, 4:27 PM

#

@primal linden 1 to 7 is like either all or most of the room

primal linden May 20, 2020, 4:27 PM

#

i dont get it

#

anthem room

stuck fractal May 20, 2020, 4:28 PM

#

@primal linden There's 8 questions in task 1

#

You asked for help with questions 1 through 7

primal linden May 20, 2020, 4:29 PM

#

i ened 7

#

need*

#

hint to get administrator

#

name

stuck fractal May 20, 2020, 4:30 PM

#

There's a famous poem that's incomplete.

#

T1Q7 would be a much clearer way of asking

primal linden May 20, 2020, 4:31 PM

#

i got his first name

white salmon May 20, 2020, 4:31 PM

#

@primal linden for admin name, google the poem.

primal linden May 20, 2020, 4:32 PM

#

ty guys

#

got it

patent token May 20, 2020, 4:49 PM

#

Hey VV. I'm the creator. My recommendation is to enumerate harder. 🙂

white salmon May 20, 2020, 4:50 PM

#

Thanks i will try winPEAS again

patent token May 20, 2020, 4:52 PM

#

I would enumerate a different way.

#

The challenge is meant to make you look passed your typical enumeration tools.

#

I'm streaming it in 8 minutes if you're interested. No pressure if you want to try on your own. Check out #thm-community-media for more info.

white salmon May 20, 2020, 4:57 PM

#

Rooted Anthem Room ❤️

#

hints for getting user/pass for anthem room? (i logged into umbraco but i dont think thats where i'm supposed to be >_>)

frail ferry May 20, 2020, 5:04 PM

#

rdp credentials?

viscid mason May 20, 2020, 5:04 PM

#

actually, that's exactly where u suppose to be, but there is nothing much about what u trying to find.

and... since now, everything u found is the ANSWER of what u looking for

white salmon May 20, 2020, 5:10 PM

#

Alright, I figured it out. Thx for the help 😄

viscid mason May 20, 2020, 5:30 PM

#

Elf, why not use "internet" and a cute "cat" on peak hill

white salmon May 20, 2020, 5:31 PM

#

I alredy did use both multiple times

viscid mason May 20, 2020, 5:31 PM

#

nc?

wooden mist May 20, 2020, 5:32 PM

#

@viscid mason using it is only useful when you got through the first part, not sure if elf got through it yet

viscid mason May 20, 2020, 5:33 PM

#

🤔 YEah! 😛 any hints from ur side szymex73?

white salmon May 20, 2020, 5:33 PM

#

nope im stuck in decoding the wierd stuff

viscid mason May 20, 2020, 5:33 PM

#

try harder Elf! 😛

white salmon May 20, 2020, 5:33 PM

#

im doing it

wooden mist May 20, 2020, 5:34 PM

#

look at the image in the description Kappa

elfin owl May 20, 2020, 5:35 PM

#

Any hints on the first part? I am pretty certain about what to do with the weird part, but I am stuck enumerating things... well I am currently looking for things I have not enumerated yet.

wooden mist May 20, 2020, 5:35 PM

#

there's one obvious thing that you should've picked up on a portscan

white salmon May 20, 2020, 5:36 PM

#

Any hints on (what I'm assuming is) the last part? Is there a specific thing I should look up? I'm regretting skipping python classes at college

gilded badge May 20, 2020, 6:12 PM

#

I think I'm on the same part that you are @white salmon. You ever figure it out?

white salmon May 20, 2020, 6:15 PM

#

Yea it's the same idea that is used earlier in the room. Don't wanna go to deep into details

gilded badge May 20, 2020, 6:15 PM

#

Gotcha

wanton sonnet May 20, 2020, 6:41 PM

#

Hey for peak_hill it asks me to grow something any hints on that?

jade bolt May 20, 2020, 6:41 PM

#

||total guess but look at the first 3 letters of the room?||

#

Hi, in anthem Taks 1 question 7, the hint says consult the oracle. but i can't seem to find the answer to the question, can anybody point me in a direction?

normal totem May 20, 2020, 6:49 PM

#

Hey guys

#

i need some help at the network service room

#

at the last question form task 10, where i need to get the ftp.txt file, i get the error that i have no permission to get it

#

although i logged in the ftp as mike

glossy basin May 20, 2020, 6:51 PM

#

Hi, in anthem Taks 1 question 7, the hint says consult the oracle. but i can't seem to find the answer to the question, can anybody point me in a direction?
oracle means google in this case :)

jade bolt May 20, 2020, 6:51 PM

#

yeah i got that far haha

normal totem May 20, 2020, 6:53 PM

#

anyone did that room?

#

network services

#

https://gyazo.com/dbe8bb967a8685667f04b82093d1e3c7

Gyazo

stuck fractal May 20, 2020, 6:55 PM

#

@normal totem Permission denied locally

glossy basin May 20, 2020, 6:56 PM

#

exit /wordlists directory

#

and ftp from somewhere else

jade bolt May 20, 2020, 6:57 PM

#

@glossy basin can you guide me a lietel biet in the direction you pointed me :S

normal totem May 20, 2020, 6:58 PM

#

Thank you guys

#

didnt realize the pwd influences this

tidal sedge May 20, 2020, 6:59 PM

#

didnt realize the pwd influences this
@normal totem You do know that pwd stands for print working directory?

normal totem May 20, 2020, 6:59 PM

#

wow

#

i thought its present

#

my bad

stuck fractal May 20, 2020, 7:00 PM

#

📎 unknown.png

normal totem May 20, 2020, 7:00 PM

#

yup

white salmon May 20, 2020, 7:06 PM

#

does nc require sudo for reverse shell 🤔

tidal sedge May 20, 2020, 7:07 PM

#

@white salmon Depends on the port you're using

white salmon May 20, 2020, 7:07 PM

#

how so?

tidal sedge May 20, 2020, 7:07 PM

#

The first 1024 ports require sudo

white salmon May 20, 2020, 7:08 PM

#

huh. thx for the info

jaunty ember May 20, 2020, 8:38 PM

#

do I need to specifically look at the one port in Peak Hill for a way in?

austere aspen May 20, 2020, 8:39 PM

#

||ssh_pass||

blazing turtle May 20, 2020, 8:50 PM

#

@jaunty ember at some point, yes

digital iris May 20, 2020, 9:10 PM

#

anyone available for a little nudge on peakhill ? ||i have the all the ssh_user and ssh_pass things and i tried a bruteforce with all of this and also with a username i found (on ssh), but feel like i'm missing something - probably to do with that other port asking for a username/password||

#

i meant to put that in spoiler tags not that hahaha

sweet relic May 20, 2020, 9:12 PM

#

can someone help my with anonymous v6? I edited ||clean.sh|| on the ||ftp-server|| but either i did something wrong or ||the script doesn't get executed by a cronjob||. am i missing something?

solid sphinx May 20, 2020, 9:13 PM

#

@sweet relic What did you add to the script?

wooden mist May 20, 2020, 9:14 PM

#

@digital iris in what form do you have ssh_user/pass?

sweet relic May 20, 2020, 9:15 PM

#

cat whoami > whoami
i wanted to test for execution firs

#

correction: whoami > whoami

digital iris May 20, 2020, 9:16 PM

#

@wooden mist so it had like ssh_userRandomCharacters and ssh_passRandomCharacters so i tried them like that and i also tried stripping the ssh_user and ssh_pass off it but that didn't work either

stuck fractal May 20, 2020, 9:17 PM

#

@sweet relic You did something wrong.

#

Did it the lose execute bit?

wooden mist May 20, 2020, 9:18 PM

#

but in what form do you have it? do you have it as a file or a ||deserialized array||?

solid sphinx May 20, 2020, 9:18 PM

#

Would he need to put the full filepath?

sweet relic May 20, 2020, 9:18 PM

#

@stuck fractal Ooooh...of course it did 🤦‍♂️

stuck fractal May 20, 2020, 9:18 PM

#

@solid sphinx For what?

#

@sweet relic Don't delete the file. put with the same name

digital iris May 20, 2020, 9:19 PM

#

as a file

sweet relic May 20, 2020, 9:19 PM

#

@stuck fractal thank you 🙂

solid sphinx May 20, 2020, 9:22 PM

#

nevermind

compact locust May 20, 2020, 9:51 PM

#

can i have a hint lmao

steady stratus May 20, 2020, 9:51 PM

#

Dude

compact locust May 20, 2020, 9:51 PM

#

oh sorry

steady stratus May 20, 2020, 9:51 PM

#

I literally just asked you not to post answers

compact locust May 20, 2020, 9:52 PM

#

had the asnwer

#

yeah sorry

#

https://gyazo.com/7ce4911b56de3e9eaa018a8015316e77

Gyazo

#

hint?

stuck fractal May 20, 2020, 9:52 PM

#

man ls

steady stratus May 20, 2020, 9:52 PM

#

man is really really wonderful

compact locust May 20, 2020, 9:53 PM

#

i cant find it

stuck fractal May 20, 2020, 9:53 PM

#

Also, a google search would have worked

#

ls long list format flag

#

Learn to do some research, rule 13

compact locust May 20, 2020, 10:06 PM

#

https://gyazo.com/f012bf18da255dee13b346b07fe95301

Gyazo

#

what kinda shell?

sinful garden May 20, 2020, 10:06 PM

#

Have you tried googling it before asking here?

compact locust May 20, 2020, 10:06 PM

#

idk exactly what to google

sinful garden May 20, 2020, 10:07 PM

#

There is no point in doing the room if youre asking us all of the questions

compact locust May 20, 2020, 10:07 PM

#

kk

stuck fractal May 20, 2020, 10:07 PM

#

@compact locust It's specifically for su

compact locust May 20, 2020, 10:07 PM

#

what is?

#

the shell?

stuck fractal May 20, 2020, 10:07 PM

#

The question

#

It's talking about su

compact locust May 20, 2020, 10:07 PM

#

yeah

stuck fractal May 20, 2020, 10:07 PM

#

man su

#

learn to use the man pages

compact locust May 20, 2020, 10:08 PM

#

yeah i saw that

#

but like

#

whats a shell

#

that was my question

inland onyx May 20, 2020, 10:08 PM

#

google_it

#

That

#

Is also a google question

verbal wedge May 20, 2020, 10:25 PM

#

@compact locust sup

compact locust May 20, 2020, 10:25 PM

#

What is the value of the home environment variable

#

ive googled

#

ive lookd

#

i cant find it

verbal wedge May 20, 2020, 10:25 PM

#

Dolla sign

compact locust May 20, 2020, 10:25 PM

#

no like

verbal wedge May 20, 2020, 10:25 PM

#

I think

compact locust May 20, 2020, 10:26 PM

#

/----/------

#

this is the format

stuck fractal May 20, 2020, 10:26 PM

#

Read the $ Task

verbal wedge May 20, 2020, 10:26 PM

#

Ahhh

stuck fractal May 20, 2020, 10:26 PM

#

Learn how to view variables

compact locust May 20, 2020, 10:26 PM

#

i have

verbal wedge May 20, 2020, 10:26 PM

#

Oh lol yeah

#

I got it

compact locust May 20, 2020, 10:26 PM

#

im 100% certain of the answer

#

but it says its incorrect

stuck fractal May 20, 2020, 10:26 PM

#

@compact locust You haven't if you can't find the value of that thing

compact locust May 20, 2020, 10:26 PM

#

let me dm it to you

stuck fractal May 20, 2020, 10:26 PM

#

Did you switch user when you were told to?

#

No

#

Don't DM me

compact locust May 20, 2020, 10:27 PM

#

ok i found it

verbal wedge May 20, 2020, 10:27 PM

#

There ya go

white salmon May 20, 2020, 10:32 PM

#

Just checked myself and found it on the first page that was highlighted by Google.

#

Oh wait, you found it.

#

Nvm

verbal wedge May 20, 2020, 10:35 PM

#

Yeah I did too

sweet relic May 20, 2020, 10:36 PM

#

@verbal wedge your new machine is cracking my head 😄

verbal wedge May 20, 2020, 10:36 PM

#

You got this

#

I'm an idiot and made it so you got it

white salmon May 20, 2020, 10:37 PM

#

What's your box @verbal wedge

verbal wedge May 20, 2020, 10:37 PM

#

Anon

austere aspen May 20, 2020, 10:37 PM

#

Easy box

verbal wedge May 20, 2020, 10:38 PM

#

Yeah relatively

cunning cloud May 20, 2020, 10:40 PM

#

Nudge? getting cve for simple ctf?

white salmon May 20, 2020, 10:40 PM

#

I'll give it a bash when a get a free sec.

#

Might be a little too much for my level at the minute.

sharp mason May 20, 2020, 10:49 PM

#

anyone know what this is doing in python? myvar = "A" * 0xA00 If I print it, it's a bunch of "A" chars, not sure what it's doing. I'm used to seeing lines like "A" * 100 to quickly create a var w/ 100 'A' chars but haven't seen the like of the first one before

glacial ember May 20, 2020, 10:51 PM

#

hey anyone has a hint for me I'm stuck in flag75 "ctf 100"

stark pelican May 20, 2020, 11:00 PM

#

@sharp mason 0xA00 is hexadecimal for 2560, so myvar would be equal to 2560 "A"s

sharp mason May 20, 2020, 11:00 PM

#

ahh, thanks @stark pelican

graceful sun May 21, 2020, 2:51 AM

#

am i on the right track ? i got into the panel for umbraco on the ANTHEM box am i sopposed to look around there for creds for R** or do i need to somehow spawn a shell then get creds that way??

remote gate May 21, 2020, 2:54 AM

#

@graceful sun look at your nmap scan again and see where you can use those creds

graceful sun May 21, 2020, 2:54 AM

#

i got it already lol my bad guys

remote gate May 21, 2020, 2:54 AM

#

No worries

graceful sun May 21, 2020, 2:54 AM

#

thank you!

tardy python May 21, 2020, 5:29 AM

#

any hints on The Impossible Challenge ?

viscid bramble May 21, 2020, 5:46 AM

#

Any hints on Peak Hill? I'm stuck at a string with a bunch of ssh_pass/ssh_user

pine orbit May 21, 2020, 6:04 AM

#

^ ditto

viscid bramble May 21, 2020, 6:05 AM

#

I feel like there is more hidden in there

pine orbit May 21, 2020, 6:05 AM

#

join vc, were discussing it

pine orbit May 21, 2020, 7:06 AM

#

anyone awake that could provide a hint for pickhill?

blazing turtle May 21, 2020, 7:08 AM

#

only if you mean peakhill

pine orbit May 21, 2020, 7:09 AM

#

^

#

yes

#

i blame it on being tired :/

blazing turtle May 21, 2020, 7:10 AM

#

where are you stuck at?

pine orbit May 21, 2020, 7:12 AM

#

|| have found the .creds file in ftp and know it is pickled, unsure if i should decode it from binary first before trying to unpickle it, and either way, cant figure the right command to unpickle it correctly, guessing it involves setting the protocol.. been at this for 3 hours now ||

wooden mist May 21, 2020, 7:12 AM

#

not really a command, it's better if you write a script to decode it :)

stuck fractal May 21, 2020, 7:13 AM

#

@pine orbit I haven't done the box, but I can tell you that ||pickle reads/writes in binary data rather than plaintext||

pine orbit May 21, 2020, 7:13 AM

#

thats what i meant 🙂

viscid mason May 21, 2020, 7:14 AM

#

that's also I was thinking Ninja! 😸

wooden mist May 21, 2020, 7:14 AM

#

if you're not sure if you should decode the 1/0 before passing it to the decoder then why not try it with/without decoding the 1/0 prior to decoding the data itself

#

it will tell you if there's something wrong :)

pine orbit May 21, 2020, 7:15 AM

#

i have tried it both ways, @wooden mist mind if i dm you about it so were not flooding this channel (ill send you some of the decoding things ive tried)

wooden mist May 21, 2020, 7:16 AM

#

flooding the channel isn't a problem but this would probably go to #room-help though

sinful garden May 21, 2020, 8:04 AM

#

Can anyone give me a hint on peak hill ||i've unpickled the data, and ordered the user and pass in the right order, but what am i supposed to do now. I've tried the creds on ftp ssh and the 7321 port but they dont work||

wooden mist May 21, 2020, 8:05 AM

#

ssh

#

if they don't work then you did something wrong

sinful garden May 21, 2020, 8:05 AM

#

🤔

sinful garden May 21, 2020, 8:21 AM

#

Ah i found the bug in my python script

#

Thannks 😄

stuck fractal May 21, 2020, 10:02 AM

#

Peak hill, I have a password but I don't got a username

#

wait nvm

#

am dumb

#

cancel

glacial ember May 21, 2020, 10:13 AM

#

hey anyone has any hint for me I'm stuck on flag75 "ctf 100"

glossy basin May 21, 2020, 10:16 AM

#

Peak hill, I have a password but I don't got a username
https://youtu.be/53zkBvL4ZB4

YouTube

LiveOverflow

How (not) to ask a technical question

I try to answer every question I get. Unfortunately a lot of them are extremely low effort and waste my time. I love to help, but please put some work into your question.

-=[ 🔴 Stuff I use ]=-

→ Microphone:* https://geni.us/ntg3b
→ Graphics tablet:* https://geni.us/wacom-int...

▶ Play video

#

I had to do it 😄

white salmon May 21, 2020, 10:17 AM

#

hello im in need of help once again i did get creds and now i don't know what to do with them

glossy basin May 21, 2020, 10:18 AM

#

use them for ssh

white salmon May 21, 2020, 10:18 AM

#

i did

#

come watch stream

glossy basin May 21, 2020, 10:18 AM

#

i can't

white salmon May 21, 2020, 10:18 AM

#

okay

glossy basin May 21, 2020, 10:18 AM

#

https://github.com/rocky/python-decompile3

GitHub

rocky/python-decompile3

Python decompiler for 3.7+. Stripped down from uncompyle6 so we can refactor and fix up some long-standing problems - rocky/python-decompile3

#

this might help

stark pelican May 21, 2020, 10:18 AM

#

pickhill is reallly one hell of a room, isnt it?

white salmon May 21, 2020, 10:19 AM

#

it truly is

glossy basin May 21, 2020, 10:19 AM

#

nah

#

it's a great room

#

just takes time

white salmon May 21, 2020, 10:19 AM

#

wdym decompile

wanton gate May 21, 2020, 10:34 AM

#

@tardy python

check for some "ID" i think u can easily "SU" that VM. that was an easy room. just basic PrivEsc knowledge needed!
@viscid mason how do you exploit somthing without sudo password.

stuck fractal May 21, 2020, 10:34 AM

#

There are privilege escalations that don't involve sudo.

wanton gate May 21, 2020, 10:36 AM

#

i ran linpeas and got somthing seem exploitable. try with SUID env but no success...

#

any hint?

stuck fractal May 21, 2020, 10:47 AM

#

@wanton gate There's caveats for GTFOBins

viscid mason May 21, 2020, 10:56 AM

#

@viscid mason how do you exploit somthing without sudo password.
@wanton gate

that's the main role of PRIVILAGE Escalation. when u don't have password or anything, and u just go on wild and figure out things, I already gave u hint for this specific thing, u just need to figure out!

tardy python May 21, 2020, 10:58 AM

#

how do you exploit somthing without sudo password.
@wanton gate just test your things without sudo

wanton gate May 21, 2020, 11:00 AM

#

thanks for your help. ❤️

white salmon May 21, 2020, 11:07 AM

#

any hints on privesc?

blazing turtle May 21, 2020, 11:08 AM

#

for peak hill? it's a pickle farm, grow some pickles obviously

viscid mason May 21, 2020, 11:09 AM

#

base64

blazing turtle May 21, 2020, 11:09 AM

#

base64 pickles best pickles

wooden mist May 21, 2020, 11:09 AM

#

pickled base64 Keepo

viscid mason May 21, 2020, 11:16 AM

#

try gib farm a base64

white salmon May 21, 2020, 11:16 AM

#

what is that xD

tardy python May 21, 2020, 11:17 AM

#

base64 a thingy xD

viscid mason May 21, 2020, 11:17 AM

#

try to give base64 input to that python file

#

OMG!

#

why u search words that r not "..."

#

what is he doing 😹

white salmon May 21, 2020, 11:18 AM

#

xD

#

i don't know

#

yah i tried

viscid mason May 21, 2020, 11:19 AM

#

think bro think

white salmon May 21, 2020, 11:19 AM

#

see

#

i tried xD

wooden mist May 21, 2020, 11:20 AM

#

:|

viscid mason May 21, 2020, 11:21 AM

#

😐

stark pelican May 21, 2020, 11:21 AM

#

;-;

white salmon May 21, 2020, 11:22 AM

#

i legit don't have control over this

viscid mason May 21, 2020, 11:23 AM

#

python + pickle + base64 + os + /bin/bash = root!

white salmon May 21, 2020, 11:24 AM

#

smh

wooden mist May 21, 2020, 11:25 AM

#

python + pickle + base64 + magic = root

white salmon May 21, 2020, 11:26 AM

#

iii still don't understand

#

what am i missing 😦

stuck fractal May 21, 2020, 11:31 AM

#

@white salmon Get a nice shell first

#

Makes it easier

white salmon May 21, 2020, 11:31 AM

#

yah im trying to do that now

#

cuz this is really bad

viscid mason May 21, 2020, 11:31 AM

#

+1

stark pelican May 21, 2020, 11:32 AM

#

step 1: get user flag
step 2: get root flag

it isnt that hard

#

XD

white salmon May 21, 2020, 11:33 AM

#

x D

#

@stark pelican it took me almost 1 day to get that user 😄

stark pelican May 21, 2020, 11:41 AM

#

yikes

wispy verge May 21, 2020, 12:53 PM

#

hello, i have question about owasp juice shop

#

i read an article about it and writer solved broken auth part %50 guess

faint trail May 21, 2020, 12:54 PM

#

Finally done Peak Hill, I was making so many little mistakes

wispy verge May 21, 2020, 12:54 PM

#

%50 techincal

faint trail May 21, 2020, 12:54 PM

#

Always trying to overcomplicate things

white salmon May 21, 2020, 12:55 PM

#

aaaa hint pls

tidal sedge May 21, 2020, 12:55 PM

#

try harder

faint trail May 21, 2020, 12:56 PM

#

Feel free to PM, I wont give too much away though!

hollow gazelle May 21, 2020, 1:00 PM

#

can anyone please help me with flag 1 and 4 of anthem

blazing turtle May 21, 2020, 1:02 PM

#

use the source, luke

faint trail May 21, 2020, 1:23 PM

#

Want to start HackPark but don't want to spoil the 1337 users :p

📎 unknown.png

wooden mist May 21, 2020, 1:26 PM

#

hard decision to make

#

at least we have proof it was achieved DogKek

faint trail May 21, 2020, 1:32 PM

#

I can't live with being the one to ruin it, so I've chose another box :p

tranquil dagger May 21, 2020, 1:35 PM

#

📎 unknown.png

#

Now join, @faint trail

stuck fractal May 21, 2020, 1:36 PM

#

Someone needs to.

cyan token May 21, 2020, 1:40 PM

#

@hollow gazelle Try writing a Python script that finds the flags for you. Atleast that's what I did. Regex + beautiful soup.

#

Or just CTRL+F your way through lol

north moat May 21, 2020, 3:32 PM

#

@faint trail should i decode-something in Peak Hill

sick sun May 21, 2020, 3:42 PM

#

anyone done Peak rooms

#

need hint for decode some creds

blazing turtle May 21, 2020, 3:56 PM

#

@sick sun the first ones?

sick sun May 21, 2020, 3:58 PM

#

@blazing turtle ?

blazing turtle May 21, 2020, 3:58 PM

#

are you asking about decoding the first set of creds you can get?

sick sun May 21, 2020, 4:06 PM

#

@blazing turtle yes right man

#

can i DM you ?

blazing turtle May 21, 2020, 4:06 PM

#

sure

viscid bramble May 21, 2020, 4:09 PM

#

Any hints on Peak Hill? ||I've broken out of the CMD shell and have access as dill on the box, not sure how to interact or reverse this binary in /opt||

stuck fractal May 21, 2020, 4:09 PM

#

@viscid bramble ls -lah in the dir, see what's up with it

#

Maybe try... running it?

viscid bramble May 21, 2020, 4:12 PM

#

I have done both, I don't know how to grow

sick sun May 21, 2020, 5:36 PM

#

Anyone give me a hint how to decode from binary string

#

Peak hill room

tidal sedge May 21, 2020, 5:36 PM

#

@sick sun You're going to have to provide more information, is this for a THM room? If so which one? Which task and question?

stuck fractal May 21, 2020, 5:37 PM

#

Before initial shell, Peak Hill

tidal sedge May 21, 2020, 5:37 PM

#

Ah, I haven't done that one, through I've heard good things about the box

stuck fractal May 21, 2020, 5:38 PM

#

@sick sun The room page is full of hints

nocturne vault May 21, 2020, 6:10 PM

#

nice room this pickleboi was, but frustrating at times

white salmon May 21, 2020, 7:52 PM

#

hi could someone help me with the admin hidden password for Anthem room?

dusky vigil May 21, 2020, 8:13 PM

#

You've likely already overlooked it

#

Think how systems may have misconfigured permissions

white salmon May 21, 2020, 8:26 PM

#

@dusky vigil i found it thanks for your help

velvet flint May 21, 2020, 9:35 PM

#

Anyone able to give nudge on how to escalate from www-data to jjamesonon Daily Bugle ?

patent token May 21, 2020, 9:36 PM

#

Sure. Check the directory you initially land in in your shell for www-data. Investigate those files.

velvet flint May 21, 2020, 9:36 PM

#

ty

patent token May 21, 2020, 9:37 PM

#

Welcome.

velvet flint May 21, 2020, 9:48 PM

#

Got root now ^^

white salmon May 21, 2020, 9:54 PM

#

hello can i have a hint on inoculation

#

aa yk small lil hint

wooden mist May 21, 2020, 9:55 PM

#

no

white salmon May 21, 2020, 9:55 PM

#

😦

wooden mist May 21, 2020, 9:55 PM

#

it's a hard room for a reason

white salmon May 21, 2020, 9:55 PM

#

ok no hints

stuck fractal May 21, 2020, 9:55 PM

#

dogekek

white salmon May 21, 2020, 9:55 PM

#

but small

#

litlle

#

😦

wooden mist May 21, 2020, 9:56 PM

#

there is one hint from the room's creator hidden deeeeeeep in one of the channels history on this discord

#

it can help but idk if you're on that stage yet Keepo

white salmon May 21, 2020, 9:57 PM

#

aaa no hints

frozen osprey May 21, 2020, 10:05 PM

#

What critical file has had its permissions changed to allow some users to write to it?

#

how to check?

#

i was already in etC/passwd

stuck fractal May 21, 2020, 10:05 PM

#

wat

onyx wadi May 21, 2020, 10:05 PM

#

i

#

don't understand

stuck fractal May 21, 2020, 10:06 PM

#

@onyx wadi ?

old root May 21, 2020, 10:06 PM

#

Hi all!

frozen osprey May 21, 2020, 10:06 PM

#

Here

📎 Bildschirmfoto_2020-05-22_um_00.06.30.png

stuck fractal May 21, 2020, 10:06 PM

#

i was already in etC/passwd
@frozen osprey wat

old root May 21, 2020, 10:07 PM

#

Can anyone give me a hint at task 43 of 'Learn Linux' room?

frozen osprey May 21, 2020, 10:07 PM

#

i did

onyx wadi May 21, 2020, 10:07 PM

#

don't mind me james

frozen osprey May 21, 2020, 10:07 PM

#

thanks got the resolution

onyx wadi May 21, 2020, 10:08 PM

#

priv esc

stuck fractal May 21, 2020, 10:08 PM

#

@old root Look for files belonging to each and every user.

old root May 21, 2020, 10:08 PM

#

Thank you!

old root May 21, 2020, 10:52 PM

#

any other hint? I think i'm stuck

cinder bluff May 21, 2020, 11:42 PM

#

anyone help for blogengine ?

stuck fractal May 21, 2020, 11:43 PM

#

@cinder bluff What room?

#

@cinder bluff Please respect Rule 1. Don't DM people without making sure it's OK first.

#

Additionally, this is for help with THM rooms.

patent token May 22, 2020, 12:28 AM

#

HackPark uses blogengine right?

stuck fractal May 22, 2020, 12:30 AM

#

@patent token They DM'd me unsolicited, then told me it wasn't a THM room, got angry at me for asking them to please follow rule 1, and then left.

patent token May 22, 2020, 12:31 AM

#

Oh ok. Understood.

graceful sun May 22, 2020, 12:53 AM

#

hey so where do i find the admin password do i wanna be looking into RDP for it ? like in files maybe? i did a winpeas didnt get much still looking lol any hints

patent token May 22, 2020, 12:54 AM

#

Can you please share a good deal more information about that please?

#

What room, task, etc.

hollow bay May 22, 2020, 1:08 AM

#

Ok, I feel sorta stupid but I can't figure out the last question in the Linux room (task 43)

#

I think I'm on the right track for what the vulnerability is

#

but I'm not sure how to escalate with it

stuck fractal May 22, 2020, 1:09 AM

#

@hollow bay It's not really a vulnerability

#

This isn't a traditional box

old root May 22, 2020, 1:09 AM

#

Hey @hollow bay try to look for files belong to each and every user

hollow bay May 22, 2020, 1:10 AM

#

Am I correct in noticing the || files with the SUID bit ||?

#

And somehow changing one of those since I can write to them?

#

Or am I way overcomplicating this

old root May 22, 2020, 1:11 AM

#

It's way more simple than that

stuck fractal May 22, 2020, 1:12 AM

#

@hollow bay For reference, if you write to a SUID file then it loses it's SUID bit

hollow bay May 22, 2020, 1:12 AM

#

@stuck fractal Yeah I learned that the hard way by trying to cat a shell script and > into the file

stuck fractal May 22, 2020, 1:13 AM

#

Look for files belonging to each and every user

#

Investigate suspicious ones

graceful sun May 22, 2020, 1:53 AM

#

it is the anthem room task 3 Q 3 looking for the admin PW

graceful sun May 22, 2020, 3:42 AM

#

nvm found the file

cloud perch May 22, 2020, 7:19 AM

#

yo i need help with Obscure Web Vulns has anyone completed it?

glossy basin May 22, 2020, 7:30 AM

#

@cloud perch don't ask to ask, just ask

cloud perch May 22, 2020, 7:34 AM

#

im stuck on task 9. "what parameter allows us to generate a poc(acttual exploit)" for csrf

glossy basin May 22, 2020, 7:35 AM

#

have you read the tool's help page?

#

type xsrfprobe -h and you'll find it

cloud perch May 22, 2020, 8:00 AM

#

thanks

indigo ridge May 22, 2020, 8:17 AM

#

hello everyone, I am doing this room Anthem(https://tryhackme.com/room/anthem) I cannot find the admin password in the windows machine.. can someone provide me some hint please.

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

glossy basin May 22, 2020, 8:19 AM

#

@indigo ridge https://varvy.com/robottxt.html

The robots.txt file explained and illustrated

An in depth and illustrated guide to how the robots.txt file works and what it should say.

#

read this ^

#

i hope you get the idea

indigo ridge May 22, 2020, 8:20 AM

#

@indigo ridge https://varvy.com/robottxt.html
@glossy basin I am asking about the windows administrator password.. I have got that domain admin password.. and I am in the RDP

The robots.txt file explained and illustrated

An in depth and illustrated guide to how the robots.txt file works and what it should say.

#

last second task in the room

glossy basin May 22, 2020, 8:34 AM

#

oh

#

you better specify the task next time

indigo ridge May 22, 2020, 8:35 AM

#

sure

glossy basin May 22, 2020, 8:35 AM

#

so, did you do anything about the hint in the task?

#

'it is hidden'

indigo ridge May 22, 2020, 8:35 AM

#

yeah.. I tried show all the folders and files with folder options

glossy basin May 22, 2020, 8:35 AM

#

great

indigo ridge May 22, 2020, 8:36 AM

#

I found some backup folder but I cant's access them

glossy basin May 22, 2020, 8:36 AM

#

you can access the folder, but i guess you couldn't read the file

#

right?

indigo ridge May 22, 2020, 8:36 AM

#

yes

glossy basin May 22, 2020, 8:36 AM

#

my hint would be to look into file permissions :)

#

I guess you'll find your way around now

indigo ridge May 22, 2020, 8:37 AM

#

okay thanks!

cloud perch May 22, 2020, 9:16 AM

#

did you check the robots.txt

#

@indigo ridge the hint is in the poem

#

@indigo ridge pm me

indigo ridge May 22, 2020, 9:25 AM

#

okay thanks!
@indigo ridge
@indigo ridge the hint is in the poem
@cloud perch I got it.. Thankyou very much

#

It was permissions skidy

white salmon May 22, 2020, 9:56 AM

#

aaa small little hint

#

for Inoculation

past night May 22, 2020, 11:28 AM

#

no

north moat May 22, 2020, 12:21 PM

#

Room Network Services TASK 7 # 11 still not receive ping respond

quiet musk May 22, 2020, 12:21 PM

#

For Gatekeeper, is digging into ||gatekeeper.exe via strings|| worth my time or am I missing another way in? I've tried ||uploading my own executables via SMB on the User share|| but am not getting a hit on my listener...

north moat May 22, 2020, 12:22 PM

#

is it bug ?

vernal ridge May 22, 2020, 12:33 PM

#

I have some doubts on authenticating the RDB in Anthem box, can i get some help?

patent token May 22, 2020, 12:34 PM

#

M3talhead, there is only one way on to that machine. Uploading to the SMB isn't it unfortunately. It's a nice try though. 😊

past night May 22, 2020, 12:44 PM

#

@vernal ridge if you've done the previous tasks you should already have the credentials, read the questions carefully

vernal ridge May 22, 2020, 12:49 PM

#

yeah i did , but the creds didnt work!

past night May 22, 2020, 12:51 PM

#

they do

#

you just didn't read the first question from task 3

vernal ridge May 22, 2020, 12:58 PM

#

i did read, but dint get it , can i pm, i dont wana be a spoiler

past night May 22, 2020, 12:59 PM

#

feel free to say it over here between ||

oblique shuttle May 22, 2020, 1:00 PM

#

hi all.. any chance of a clue for "Linux Challenges 5.4" - Using SCP, FileZilla or another FTP client download flag32.mp3 to reveal flag 32.?? I've SCP'd the file locally but now stuck!

past night May 22, 2020, 1:01 PM

#

what does .mp3 imply

vernal ridge May 22, 2020, 1:02 PM

#

||i used umbraco exploit to access the machine, but i couldnt find any creds to enumerate, but everyone said abt RDP to access the machine, but the creds i used to complete task 1, but i didnt got any access to RDP||

past night May 22, 2020, 1:02 PM

#

there is no exploit for you to run

tidal sedge May 22, 2020, 1:02 PM

#

Umbraco exploit?

#

^

#

Exactly

past night May 22, 2020, 1:02 PM

#

you already have the credentials to access the machine

vernal ridge May 22, 2020, 1:02 PM

#

Umbraco exploit?
@tidal sedge yeah!

tidal sedge May 22, 2020, 1:03 PM

#

And did the exploit work?

oblique shuttle May 22, 2020, 1:03 PM

#

what does .mp3 imply
@past night So I tried playing it but nothing...

vernal ridge May 22, 2020, 1:03 PM

#

i got less prev shell using it

tidal sedge May 22, 2020, 1:03 PM

#

@past night Fix 🙂

past night May 22, 2020, 1:03 PM

#

fix what lol

tidal sedge May 22, 2020, 1:03 PM

#

Seems like they found an exploit

past night May 22, 2020, 1:03 PM

#

what exploit

tidal sedge May 22, 2020, 1:03 PM

#

🤷

#

Ask them

past night May 22, 2020, 1:04 PM

#

7.12 shouldn't work

vernal ridge May 22, 2020, 1:04 PM

#

it gives only less prev shell

past night May 22, 2020, 1:04 PM

#

mind sharing a link

#

you made me curious

vernal ridge May 22, 2020, 1:04 PM

#

https://www.exploit-db.com/exploits/46153, this one!

tidal sedge May 22, 2020, 1:05 PM

#

That's an authenticated exploit

past night May 22, 2020, 1:05 PM

#

hmm, that's unintended

#

it shouldn't be picking it up

tidal sedge May 22, 2020, 1:05 PM

#

That means you already have the creds

vernal ridge May 22, 2020, 1:05 PM

#

hmm, that's unintended
@past night 😢

past night May 22, 2020, 1:06 PM

#

it's nothing to do with exploiting a vulnerability

#

you are overcomplicating it

vernal ridge May 22, 2020, 1:06 PM

#

That means you already have the creds
@tidal sedge yeah! for umbraco , not for RDP

past night May 22, 2020, 1:06 PM

#

📎 unknown.png

#

read this

tidal sedge May 22, 2020, 1:07 PM

#

@vernal ridge Have you ever heard of ||password reuse 🙄||

vernal ridge May 22, 2020, 1:07 PM

#

i dint type any domain name

past night May 22, 2020, 1:07 PM

#

are you getting the ding ding ding?

vernal ridge May 22, 2020, 1:07 PM

#

no dude!

past night May 22, 2020, 1:07 PM

#

lol. read what malware said

vernal ridge May 22, 2020, 1:07 PM

#

@vernal ridge Have you ever heard of ||password reuse 🙄||
@tidal sedge i know, also i am compelled to use the only creds i got

past night May 22, 2020, 1:07 PM

#

what does domain mean to you

#

also, if it's after an hour the machine might've closed itself down (it's a bug)

vernal ridge May 22, 2020, 1:09 PM

#

whenever i was asked to login using RDP, it asked a user , password and domain, i left the domain unfilled

#

also, if it's after an hour the machine might've closed itself down (it's a bug)
@past night 👀

past night May 22, 2020, 1:09 PM

#

that's not what it means

vernal ridge May 22, 2020, 1:10 PM

#

oh

#

OHH, got it buddies

#

please fix the exploit ||the exploit gives me a low privilege, and also gives me chance to look what is the user name,jzt now everything ring a bell on what i saw when i got a shell ||

steady stratus May 22, 2020, 1:21 PM

#

Mhm it's pretty interesting you got an exploit - it's unintentional in the sense that I don't think it needs to be fixed?

#

However your thoughts are welcome @past night ^^

past night May 22, 2020, 1:43 PM

#

i need to check that @steady stratus

#

i haven't completed my room yet kekw

quiet musk May 22, 2020, 1:50 PM

#

M3talhead, there is only one way on to that machine. Uploading to the SMB isn't it unfortunately. It's a nice try though. 😊
@patent token That being the case, is the vulnerable dialect the way in then? It was the first thing I thought of after I got a full enumeration. I'm familiar with ||the MS17_010 family of exploits||, but none are landing ||(even though NSE output indicated that SMBv1 is default)||. If this is a rabbit hole, it's a good one...

patent token May 22, 2020, 1:51 PM

#

There are no kernel exploits. The executable you found is the answer. It associates with a port running on the machine.

#

That said, this portion is somewhat advanced and requires knowledge in that type of exploitation.

quiet musk May 22, 2020, 1:54 PM

#

Right. The right enumeration returns a lot of information about that port. I can see in strings where the executable makes the call to that port as well. I'll dig deeper in the exe.

past night May 22, 2020, 1:56 PM

#

@vernal ridge not sure how you got the exploit working, lol:

📎 unknown.png

vernal ridge May 22, 2020, 1:57 PM

#

wait !

past night May 22, 2020, 1:58 PM

#

the exploit it for 7.12.4 and the website is running 7.15.4

vernal ridge May 22, 2020, 2:00 PM

#

actually the right execution made it work

patent token May 22, 2020, 2:00 PM

#

M3talhead, you won’t glean much information from that outside of a link I didn’t know existed.

#

The secret isn’t inside the executable, it’s what you do to it.

past night May 22, 2020, 2:01 PM

#

oh shoot

#

yeah, just checked the services and it actually runs

vernal ridge May 22, 2020, 2:07 PM

#

yeah it doess

#

and you can see the who are user(s)

quiet musk May 22, 2020, 2:08 PM

#

M3talhead, you won’t glean much information from that outside of a link I didn’t know existed.
@patent token Thanks! I just fired up the debugger and was about to deepdive. lol

past night May 22, 2020, 2:11 PM

#

yeah i consider the impact is minimal so it should be fine @vernal ridge so i'll leave it as it is

vernal ridge May 22, 2020, 2:12 PM

#

kinda yes!

past night May 22, 2020, 2:12 PM

#

i'll let people struggle with it haha

vernal ridge May 22, 2020, 2:12 PM

#

😆

quiet musk May 22, 2020, 2:40 PM

#

@patent token ...when you say it's what you "do" to the file, you're not talking about modifying it offline and replacing it, right? Just asking for clarification since you mentioned in a previous reply that uploading isn't the way in. It's probably something stupid simple, I'm just overthinking it.

patent token May 22, 2020, 2:42 PM

#

||it’s a buffer overflow exploitation||

quiet musk May 22, 2020, 2:45 PM

#

Nice rabbit hole! I noticed the ||\VBOXSVR\dostackbufferoverflowgood...|| in strings and the debugger but was going for the low hanging fruit first.

patent token May 22, 2020, 2:52 PM

#

Not supposed to be a rabbit hole. 😛 I didn't make the path completely obvious, but there is truly ONLY one way onto the machine, and one way to escalate privileges.

white salmon May 22, 2020, 3:35 PM

#

Hi everyone, Room "Network Services" Task4/#8 "Now, use the information you have already gathered to work out the username of the account. Then, use the service and key to log-in to the server" > I have no clue on how to get John Cactus' password to ssh into the server.... any hints ? Did I miss something ?

stuck fractal May 22, 2020, 3:35 PM

#

@white salmon Do you know about SSH keys?

white salmon May 22, 2020, 3:36 PM

#

yes I got both of them

#

they are in .ssh

stuck fractal May 22, 2020, 3:36 PM

#

Do you know what they do though?

white salmon May 22, 2020, 3:36 PM

#

I think...i mean I tought

#

I have the id_rsa

stuck fractal May 22, 2020, 3:36 PM

#

Explain to me what you think

white salmon May 22, 2020, 3:37 PM

#

I have both John's public and private

#

I need the private to authenticate myself when I ssh

#

but I need a password right ?

stuck fractal May 22, 2020, 3:37 PM

#

Ok, so why are you asking how to get the password?

#

No

#

The SSH key authenticates you.

white salmon May 22, 2020, 3:38 PM

#

OK i have done something wrong then

stuck fractal May 22, 2020, 3:38 PM

#

Yep.

white salmon May 22, 2020, 3:38 PM

#

do you agree that sometimes you need a password to ssh no?

stuck fractal May 22, 2020, 3:38 PM

#

SSH keys can be passphrase protected

#

And you don't always have keys

white salmon May 22, 2020, 3:39 PM

#

right

stuck fractal May 22, 2020, 3:39 PM

#

There's a lot of ways you can authenticate to SSH

#

Username and password is one
Username and RSA key is another

white salmon May 22, 2020, 3:39 PM

#

I'm confused with the password vs passphrase

stuck fractal May 22, 2020, 3:39 PM

#

passphrase is for the RSA key

#

This key doesn't have it

#

A passphrase is for the cryptography. They're meant to be longer than a password.

white salmon May 22, 2020, 3:39 PM

#

right...and I always use RSA

#

that's why I am used to looking for a pass

stuck fractal May 22, 2020, 3:40 PM

#

That doesn't make sense

white salmon May 22, 2020, 3:41 PM

#

Ok I will rtfm. I think i am confused

#

thanks for your help

stuck fractal May 22, 2020, 3:41 PM

#

@white salmon You don't need a password to authenticate with an id_rsa

#

If you're being asked for a password, you're doing something wrong

#

If there's a big box that says permissions too open, make sure to actually read that and fix it

white salmon May 22, 2020, 3:42 PM

#

ok

#

@white salmon You don't need a password to authenticate with an id_rsa
@stuck fractal thanks to you I just discovered "ssh-add" > i was always asked for my passphrase when I was ssh-ing to my server, now I am not anymore 👍

stuck fractal May 22, 2020, 3:50 PM

#

@white salmon Passphrase is for the key

#

It just decrypts the key

#

Password is for the server

white salmon May 22, 2020, 3:51 PM

#

Yeah I know, but I think i never really paid attention to the difference between passphrase and password, and now I do

white salmon May 22, 2020, 4:26 PM

#

I think I have identified a potential issue : the "id_rsa.pub" file is understood as a Microsoft Publisher file

#

therefore it doesn't find the public key and asks for a password. It is what I understood from the verbose mide

#

mode

inland onyx May 22, 2020, 4:26 PM

#

Ignore me, wrong channel, wrong topic 😆

white salmon May 22, 2020, 4:27 PM

#

no probs

quiet musk May 22, 2020, 4:50 PM

#

Not supposed to be a rabbit hole. 😛 I didn't make the path completely obvious, but there is truly ONLY one way onto the machine, and one way to escalate privileges.
@patent token Good job regardless...😆... I've gotten to the point where I can abuse and connect to the exe when it's hosted on the local machine, but when I swap the local IP in the exploit for the target IP, the target doesn't connect. Have you had this happen before? Same exploit, same listener.

#

I can DM screenshots if that helps...

patent token May 22, 2020, 4:51 PM

#

So, there's one tiny detail you're probably missing in your dump.

#

||https://www.twitch.tv/videos/626720054||

Twitch

Let's Hack! @realtryhackme Gatekeeper! (For real this time)

TheMayor11 - Science & Technology - Twitch

▶ Play video

#

If you need help on that specific part.

#

You'll have to scroll forward to that point though.

quiet musk May 22, 2020, 4:56 PM

#

God I'm an idiot...

stuck fractal May 22, 2020, 4:57 PM

#

@white salmon Nope

#

id_rsa.pub is the public key

#

You authenticate to the server with the private key

night rivet May 22, 2020, 5:23 PM

#

is binex broken?

wraith marsh May 22, 2020, 5:26 PM

#

is binex broken?
@night rivet I done it 2 weeks ago with no issue.

stuck fractal May 22, 2020, 5:26 PM

#

@wraith marsh Task 8 onwards is an excessive step

wraith marsh May 22, 2020, 5:27 PM

#

@wraith marsh Task 8 onwards is an excessive step
@stuck fractal I thought he was talking about the room called binex, my bad

stuck fractal May 22, 2020, 5:27 PM

#

Oh wait

#

@night rivet I might be wrong

wraith marsh May 22, 2020, 5:28 PM

#

The room called “binex” works perfectly fine if that’s what he’s on about

tidal sedge May 22, 2020, 5:29 PM

#

If I remember correctly bof1 is the one that's broken(still doable but not suitable for beginners) 🤔

wraith marsh May 22, 2020, 5:30 PM

#

Yeah, someone posted a write up for bof1. It looks like You have to rewrite the shell code.

silent wasp May 22, 2020, 5:39 PM

#

Need help for this for order only for room ccpentesting task 20 subtask 9
I have all i need to create a command i tested command and command work but when i submit the flag its say is not good but i know its is. Anyone that can help me DM only. I will supply my command and i just wont to tell if i am missing anything or its parameter positioning

stuck fractal May 22, 2020, 5:40 PM

#

Ask for help here.

#

Ask your question.

#

It doesn't sound like it needs to be DMs

tidal sedge May 22, 2020, 5:40 PM

#

@silent wasp No one is going to dm, if you want help from the community then ask here.

silent wasp May 22, 2020, 5:40 PM

#

OK

#

Given the username "admin", the password "password", and the ip "10.10.10.10", how would you run ipconfig on that machine
this is my answer and its not good but it is.
smbmap -u 'admin' -p 'password' -H 10.10.10.10 -x ipconfig

stuck fractal May 22, 2020, 5:41 PM

#

Change your quote type.

#

Question uses double quotes

#

So you should too

silent wasp May 22, 2020, 5:42 PM

#

omg

tribal ginkgo May 22, 2020, 6:04 PM

#

guys stuck at unix varient with $6$ , any hints

inland onyx May 22, 2020, 6:06 PM

#

@tribal ginkgo Those questions are specifically designed to be easily Google-able, so Rule 13: Keep trying 🙂

#

(If you get really stuck, try looking for example hashes for hash crackers)

tribal ginkgo May 22, 2020, 6:08 PM

#

i get that $6$ is for sha512 kind , that we can configure

#

do i need to find the varient that comes with this default

#

i guess i got it https://www.akkadia.org/drepper/SHA-crypt.txt

#

@inland onyx thanks

quiet musk May 22, 2020, 6:53 PM

#

@patent token Wow...that was a brutal room. I admit that I broke down and had to follow your spoiler to get past the BOF detail I missed. Was chugging right along with normal privec stuff too...right up until I needed to use the last tool to get creds (I was staring at the objects I received, not knowing what I'm supposed to do next with them). Back to the video and it all clicked.

Thanks for a great room!

patent token May 22, 2020, 6:55 PM

#

Thanks for the words! Glad you got it done. 🙂

#

Was it that one tiny detail that got it fixed for you M3talhead?

quiet musk May 22, 2020, 7:05 PM

#

To get the callback, yes. I forgot about the payload path that was being used during testing. Was still using it when I was ready to hit the target.

After that, it was relatively smooth sailing until it came time to extract the final creds from the 4 loot artifacts. Might have gotten through it on my own with a little more time researching tools, but I was getting antsy and running out of time.

patent token May 22, 2020, 7:10 PM

#

Hehe. Well, it doesn't matter if it's pretty or not. You got it done. Congratulations!

#

If you did it using the automated process, try doing it manually this time. 😉

#

If you want more of a challenge with those creds.

#

There's another way to collect them.

quiet musk May 22, 2020, 7:16 PM

#

I was starting down the ||NT.dat|| rabbit hole and spent a good hour trying to pull out usable info before I saw your note about going back to the exe. It definitely got me out of my comfort zone and forced me to A) fix things that I'd been avoiding {Wine .dll errors} on Kali, B) re-introducing myself to ruby, and C) getting "outside" native Kali tools.

patent token May 22, 2020, 7:18 PM

#

Not actually meant to be any rabbit holes on the machine honestly.

quiet musk May 22, 2020, 7:18 PM

#

I actually started my callback attempts using raw methods before it became apparent that my conversations were not going to go anywhere.

#

Though when that wasn't working, I did jump back into MSF and run the usuals for that target.

#

It was around that time you mentioned that creating uploads was not the ECP.

patent token May 22, 2020, 7:23 PM

#

Here's the most important question. Were you able to learn anything from it?

quiet musk May 22, 2020, 7:28 PM

#

Without a doubt.

patent token May 22, 2020, 7:32 PM

#

🙂

light dew May 22, 2020, 7:49 PM

#

Hey any hints about flag1 and flag4 in the anthem box?

white salmon May 22, 2020, 8:05 PM

#

@light dew Funny you ask as I've just completed that box.

light dew May 22, 2020, 8:07 PM

#

It's so f******** slow

white salmon May 22, 2020, 8:10 PM

#

Have you inspected the page in through detail?

#

As that's what I'd be doing.

#

😉

light dew May 22, 2020, 8:11 PM

#

I am doing the final part

white salmon May 22, 2020, 8:11 PM

#

Oh I thought you said you were doing flags?

light dew May 22, 2020, 8:12 PM

#

got a headache opening everything

#

that's why I am here for!

white salmon May 22, 2020, 8:12 PM

#

The final part isn't the flags? Do you need assistance with the flags or the getting into the box?

light dew May 22, 2020, 8:12 PM

#

Flags

#

i am in the box

#

looking for things

white salmon May 22, 2020, 8:14 PM

#

Well user should be easy enough if your inside the box.

warm hemlock May 22, 2020, 8:18 PM

#

Guys any help on the Peak Hill machine, im close to root flag I think
I just need a nudge on the right way
im enumerating the file in opt

stuck fractal May 22, 2020, 8:18 PM

#

Find out what it does

warm hemlock May 22, 2020, 8:18 PM

#

what it does is it requires an input in base64

#

and I have supplied it with all the possbile input even making a python script, but I get that it can't be grown on the peak fill farm

#

I googled peak hill farm, and I dont want to travel there 😂

stuck fractal May 22, 2020, 8:19 PM

#

Peak hill is a pun on pickle

#

The box has a theme

warm hemlock May 22, 2020, 8:22 PM

#

I know that its something related to the python module PICKLE, we have done it in the very first step

#

but this peak_hill_farm file isn't doing any good, idk what to do im lost at it

stuck fractal May 22, 2020, 8:23 PM

#

You're in hints

#

Look at the python documentation for pickle

#

Like, the first page

ashen laurel May 22, 2020, 8:28 PM

#

im doing linux challenges, and on flag 32 you're supposed to ftp a file but it keeps refusing to connect, any hints please? :/

sweet relic May 22, 2020, 8:55 PM

#

I'm on HackPark right now. Got a shell, got System but I'm too stupid to find the abnormal service. Any hints, please? 🙂

#

I don't want to be spoonfed
I ran ||ps and searched the output with regex [a-zA-Z0-9\\]{16}\.[a-zA-Z]{3} to match the answer pattern.|| But still no success 😦

white salmon May 22, 2020, 9:27 PM

#

can someone give me a hint about which wordlist to use on Lian_Yu i got the first two flags

warm hemlock May 22, 2020, 9:37 PM

#

Ok so i am very close to the root

#

@stuck fractal thanks for the helps

#

but I have just one last thing

#

and i cannot figure it out at all

stuck fractal May 22, 2020, 9:37 PM

#

Can't cat the flag?

warm hemlock May 22, 2020, 9:37 PM

#

i figured out the pickle payload

#

i cant get the flag

stuck fractal May 22, 2020, 9:37 PM

#

John made it hard.

warm hemlock May 22, 2020, 9:37 PM

#

I tried running the netcat

stuck fractal May 22, 2020, 9:37 PM

#

cat all files in the dir

warm hemlock May 22, 2020, 9:37 PM

#

i did

stuck fractal May 22, 2020, 9:37 PM

#

Wait do you have a root shell?

warm hemlock May 22, 2020, 9:37 PM

#

i did cat thee root.txt

#

no

#

i dont have the rootshell

stuck fractal May 22, 2020, 9:37 PM

#

Get a root shell.

warm hemlock May 22, 2020, 9:38 PM

#

so what I did was instead of using netcat to get a reverse shell on my machine

#

what I did was, i just did ls -la /root/ in the payload

#

and i can see the contents of the root directory, but I cannot cat it out

stuck fractal May 22, 2020, 9:38 PM

#

Get a root shell.

warm hemlock May 22, 2020, 9:38 PM

#

and I have done so many things with netcat but I cannot get a connection back

stuck fractal May 22, 2020, 9:38 PM

#

Don't use netcat

#

You're interacting with a command line program already

warm hemlock May 22, 2020, 9:39 PM

#

so i just get the shell using the payload in python ?

#

maybe sudo su - ?

stuck fractal May 22, 2020, 9:39 PM

#

No

#

It's running as root

warm hemlock May 22, 2020, 9:39 PM

#

yes it is

#

and i also tried sudo su -

#

and im in the root shell

#

but i cannot cat the root.txt

#

its weird file

stuck fractal May 22, 2020, 9:40 PM

#

You won't be able to cat it

warm hemlock May 22, 2020, 9:40 PM

#

yes idk why

stuck fractal May 22, 2020, 9:40 PM

#

John put dodgy characters in the filename

#

So you can't address the file name

warm hemlock May 22, 2020, 9:40 PM

#

exactly ive been enumerating that

#

and im stuck like what should I do ?

stuck fractal May 22, 2020, 9:40 PM

#

...

#

cat all the files

warm hemlock May 22, 2020, 9:41 PM

#

OMG

#

im so stupid

#

@stuck fractal Thank you

#

I JUST COMPLETED

wispy verge May 22, 2020, 10:48 PM

#

hello, may i take a help to solve python challenge?

inland onyx May 22, 2020, 10:49 PM

#

Don't ask to ask, just ask 🙂

stuck fractal May 22, 2020, 10:50 PM

#

@wispy verge Are you looking for help or hints?

wispy verge May 22, 2020, 10:50 PM

#

help

stuck fractal May 22, 2020, 10:50 PM

#

#room-help

wispy verge May 22, 2020, 10:51 PM

#

oki doki sorry

stuck fractal May 22, 2020, 10:52 PM

#

Lian yu, tried gobuster with dirb big and dirbuster medium and found a hidden page but nothing that matches what I'm looking for or gives me more info. And hints?

oblique dagger May 22, 2020, 11:04 PM

#

I'm in the same boat James is in.. any little tid bit would be greatly appreciated

stuck fractal May 22, 2020, 11:07 PM

#

ATM i'm just combining all the info I found

#

And getting nothing

oblique dagger May 22, 2020, 11:09 PM

#

I'm in the same boat... I found the webpage and I believe I can post something to it but not sure if I'm on the right track..

stuck fractal May 22, 2020, 11:11 PM

#

You're further along than me

#

I found the main page, and one other

#

I aint finding anything

graceful sun May 22, 2020, 11:21 PM

#

im suck at a point in the new box Lian_Yu i have the ticket and i was forsure thinking it was a ||youtube|| ext but cant figure out wth to do with it i tried burp couldent find any fields that looked like it could be put im just really stuck lol

stuck fractal May 22, 2020, 11:22 PM

#

I found something!

oblique dagger May 22, 2020, 11:23 PM

#

Nice!

stuck fractal May 22, 2020, 11:25 PM

#

I found the dir with the numbers

#

So

#

Let's continue forever

oblique dagger May 22, 2020, 11:25 PM

#

That's where I'm at.

white salmon May 22, 2020, 11:30 PM

#

@graceful sun pls a hint on how to get the .ticket

oblique dagger May 22, 2020, 11:36 PM

#

How did you find the ticket?

#

I'm at that site

stuck fractal May 22, 2020, 11:36 PM

#

I continued to gobust

#

Forever

#

Eternal gobusting

oblique dagger May 22, 2020, 11:36 PM

#

Fair enough.. letting her run even longer lol

graceful sun May 22, 2020, 11:41 PM

#

do same thing you did to get to the first page that was hidden but add something @white salmon

#

if someone wants to PM me they can also

white salmon May 22, 2020, 11:42 PM

#

at this point i might download new wordlists

stuck fractal May 22, 2020, 11:46 PM

#

@white salmon Dirbuster medium

white salmon May 22, 2020, 11:46 PM

#

i dont have that

#

i have big and common

oblique dagger May 22, 2020, 11:46 PM

#

Are you on Kali?

white salmon May 22, 2020, 11:46 PM

#

i try now

#

no

oblique dagger May 22, 2020, 11:46 PM

#

Ah

stuck fractal May 22, 2020, 11:46 PM

#

Get the wordlists

white salmon May 22, 2020, 11:46 PM

#

im on arch

#

i thought big contained all the medium ones

graceful sun May 22, 2020, 11:49 PM

#

is it too early for me to be asking questions on Lian_Yu

stuck fractal May 22, 2020, 11:49 PM

#

Dirb wordlists aren't the same as dirbuster wordlists

#

@graceful sun You can always ask, you just might not get an answer

graceful sun May 22, 2020, 11:50 PM

#

im suck at a point in the new box Lian_Yu i have the ticket and i was forsure thinking it was a ||youtube|| ext but cant figure out wth to do with it i tried burp couldent find any fields that looked like it could be put im just really stuck

stuck fractal May 22, 2020, 11:50 PM

#

You have the ticket?

#

You don't have to send anything to the server

white salmon May 22, 2020, 11:53 PM

#

found the ticket with the medium list

stuck fractal May 22, 2020, 11:53 PM

#

Again, IDK how people are finding tickets

#

I found the page with the vid

#

From there, I found the creds with some more gobuster

graceful sun May 22, 2020, 11:54 PM

#

wait your working on the box right now as well?

#

yes i have the ticket

#

nvm i found some help , thanks yall

oblique dagger May 22, 2020, 11:59 PM

#

I feel like I'm overlooking something so simple.

stuck fractal May 23, 2020, 12:01 AM

#

@oblique dagger ||A . in front of something related to computers has two meanings. Either a hidden file, or a file extension. Gobuster can do extensions||

oblique dagger May 23, 2020, 12:01 AM

#

Gosh dangit.. I knew i was overlooking something.. lol thank you

stuck fractal May 23, 2020, 12:04 AM

#

Got user

#

Got root

robust nymph May 23, 2020, 12:35 AM

#

I'm hitting a wall on Task 3 in anthem, I feel like I'm running out of places to look for the RDP login, could I get a nudge in the right direction? I don't want a spoiler by any means

ruby chasm May 23, 2020, 12:36 AM

#

Anyone here tried the gatekeeper buffer overflow yet? I feel like I'm getting close but they have some memory protection stuff to work around

stuck fractal May 23, 2020, 12:36 AM

#

ASLR?

ruby chasm May 23, 2020, 12:36 AM

#

SEH i think

stuck fractal May 23, 2020, 12:40 AM

#

I mean I found a few articles about bypassing SEH

ruby chasm May 23, 2020, 12:40 AM

#

yeah same. i think i'll get it 🙂 learning a lot

past night May 23, 2020, 12:42 AM

#

@robust nymph you already have the details. Read task3 q1 carefully

oblique dagger May 23, 2020, 12:44 AM

#

@stuck fractal I've ran the medium wordlist on all three directories you find in the beginning with the ext but I still haven't gotten anything. Am I allowed to post my command here if I put it in a spoiler?

stuck fractal May 23, 2020, 12:45 AM

#

403 doesn't mean you got a folder

oblique dagger May 23, 2020, 12:45 AM

#

..

#

thanks..

#

facepalm

stuck fractal May 23, 2020, 12:45 AM

#

@oblique dagger https://en.wikipedia.org/wiki/HTTP_403

HTTP 403

HTTP 403 is a HTTP status code meaning access to the requested resource is forbidden for some reason. The server understood the request, but will not fulfill it due to client-related issues. IIS defines non standard "sub-status" error codes that provide a more specific reason ...

robust nymph May 23, 2020, 12:46 AM

#

@past night Okay, so it's from the creds I have, maybe I just have to modify it to work as a username?

white salmon May 23, 2020, 12:47 AM

#

@stuck fractal I've ran the medium wordlist on all three directories you find in the beginning with the ext but I still haven't gotten anything. Am I allowed to post my command here if I put it in a spoiler?
@oblique dagger dm if you need help with gobuster

stuck fractal May 23, 2020, 12:47 AM

#

oof third hand ping

white salmon May 23, 2020, 12:47 AM

#

i wasted 3 hours using the wrong wordlists

stuck fractal May 23, 2020, 12:47 AM

#

Dirbuster 2.3 medium works fine

white salmon May 23, 2020, 12:47 AM

#

yep

oblique dagger May 23, 2020, 12:49 AM

#

Thanks, with that little hint I was able to find the file I needed for the password. Much appreciated

robust nymph May 23, 2020, 12:56 AM

#

In Task3 q1 is it suggesting RDP is not the way to go? I'm thinking I just don't understand domains and RDP enough

stuck fractal May 23, 2020, 12:58 AM

#

@robust nymph Ignore domains unless you're doing AD stuff

#

If you log in to a machine that is part of a domain, you need to use DomainNameHere\UserNameHere as your username

#

It's just saying don't worry about doing that

#

Username = username

robust nymph May 23, 2020, 12:59 AM

#

Ahh okay that makes sense, but brings me back to my original wall now lol

inland onyx May 23, 2020, 12:59 AM

#

For that question, it also means drop the domain from the email address

#

So rather than logging in with <user>@<domain>

#

You'd log in with <user>

robust nymph May 23, 2020, 1:00 AM

#

Ohhhhh okay, so I'm probably just trying to login with the wrong user. Thank you both of you

scenic bolt May 23, 2020, 1:20 AM

#

Hello, i'm new to this site. Currently on the Learn Linux room, i'm stuck on the true ending task where i have to access the root/root.txt where i dont have the permission to.

I have tried to look for accessible file which has contains password as its name, find nothing useful here
I have tried to look for file contains root, find nothing useful too.
Tried to access the etc/shadow/ and etc/sudoers but apparently no permission to that too.
Tried to chmod the root folder, but still no good (have no permission)

Anybody could give me a hint on what might be to do?

Thanks!

stuck fractal May 23, 2020, 1:20 AM

#

@scenic bolt Look for files belonging to each and every user

scenic bolt May 23, 2020, 1:21 AM

#

Got it! Let me try out that one

robust nymph May 23, 2020, 1:27 AM

#

Man... Idk if I was trying it totally wrong before. But after a fresh reset of the box the creds I failed with before worked like a charm. Finally RDP'd into the box

#

Sorry if thats out of place, just happy to finally get it lol

jolly mantle May 23, 2020, 1:49 AM

#

hey, i got the ticket on lian yu and i tried all the bases (even with rots) to decode it with no success.. any hint?

stuck fractal May 23, 2020, 1:50 AM

#

@jolly mantle You didn't try all the bases then

grand pivot May 23, 2020, 1:50 AM

#

hello everyone

#

can you give me a hint for the new box lian_yu?

#

i cant find the directory for the first flag

#

i found one directory but is not what the flag needs

oblique dagger May 23, 2020, 1:52 AM

#

Hey James, I got the password, I'm in FTP and would I be on the right track if I needed to look at the files inside my users home folder? Am I on the right track?

viral mason May 23, 2020, 1:52 AM

#

gobuster in luan_yi is a bit pain in the ass i guess

jolly mantle May 23, 2020, 1:53 AM

#

@jolly mantle You didn't try all the bases then
@stuck fractal i will try again.. as far im concerned ive tried base[32,58,62,64,85]

stuck fractal May 23, 2020, 1:53 AM

#

@jolly mantle DM me

jolly mantle May 23, 2020, 1:53 AM

#

ok

stuck fractal May 23, 2020, 1:53 AM

#

@oblique dagger There's a few files, grab all the non default ones. Look for hidden as well

oblique dagger May 23, 2020, 1:53 AM

#

Ok cool I did. So I jsut need to keep attempting. Thank you

grand pivot May 23, 2020, 1:54 AM

#

@viral mason ok, so i keep enumerating with gobuster

#

i guess

stuck fractal May 23, 2020, 1:54 AM

#

@grand pivot directories can have other directories inside them

viral mason May 23, 2020, 1:55 AM

#

@stuck fractal @grand pivot got something from medium in reaaaaaal white

grand pivot May 23, 2020, 1:55 AM

#

i find the code word if thats what you mea

#

n

viral mason May 23, 2020, 1:55 AM

#

yeah

#

😄

grand pivot May 23, 2020, 1:55 AM

#

but i guess is not useful yet

stuck fractal May 23, 2020, 1:55 AM

#

It comes in very handy

grand pivot May 23, 2020, 1:55 AM

#

i need the... numbers?

viral mason May 23, 2020, 1:56 AM

#

yup, we need numbers

stuck fractal May 23, 2020, 1:56 AM

#

gobust the things you found

viral mason May 23, 2020, 1:56 AM

#

progress %44 on medium lol

stuck fractal May 23, 2020, 1:56 AM

#

Don't stop at 1 level

grand pivot May 23, 2020, 1:56 AM

#

ok

#

thaks!

viral mason May 23, 2020, 1:56 AM

#

@stuck fractal what do you mean

grand pivot May 23, 2020, 1:56 AM

#

that i have to be recursive

viral mason May 23, 2020, 1:56 AM

#

im not sure what i should understand from here lol

stuck fractal May 23, 2020, 1:57 AM

#

@viral mason https://tryhackme.com/games/koth for example

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

#

/games contains /koth

#

Gobuster would find games

viral mason May 23, 2020, 1:57 AM

#

yeah i got that

#

oohhhhhh

stuck fractal May 23, 2020, 1:57 AM

#

/koth would be a second command in gobuster

viral mason May 23, 2020, 1:57 AM

#

now we are on track

#

yeah

#

thanks james let me try it

#

im a bit sleepy i didnt understand at first sorry lol

#

yup, found it @grand pivot

grand pivot May 23, 2020, 2:01 AM

#

yeah! me too

robust nymph May 23, 2020, 2:07 AM

#

So I'm on the machine now, I'm lost trying to find the Admin password, I found ||/backup/restore.txt|| but do not have access, I turned on hidden files. Is it a file I'm looking for? or more of a privesc route?

vernal ridge May 23, 2020, 2:07 AM

#

Am stuck on the crackme2(task 7 of Intro To x86-64), any help would be appreciate

verbal wedge May 23, 2020, 2:08 AM

#

@white salmon nootnoot

#

I need a hint for the flag

viral mason May 23, 2020, 2:09 AM

#

@verbal wedge here's the hint: https://www.youtube.com/watch?v=a4VvRWTD3Ok&

stuck fractal May 23, 2020, 2:10 AM

#

@white salmon ^

#

@verbal wedge What box?

verbal wedge May 23, 2020, 2:10 AM

#

nootnoot not the password

#

can confirm

#

Learn Linux

stuck fractal May 23, 2020, 2:10 AM

#

no tag creator

#

just try harder

verbal wedge May 23, 2020, 2:10 AM

#

no tag creator?

#

oh

viral mason May 23, 2020, 2:11 AM

#

@stuck fractal any nudge for ftp username?

stuck fractal May 23, 2020, 2:11 AM

#

Don't tag the room creator because you're struggling

#

@viral mason Codeword should have been codename IMO

viral mason May 23, 2020, 2:12 AM

#

let me search further

white salmon May 23, 2020, 2:15 AM

#

What did para do

#

@stuck fractal

stuck fractal May 23, 2020, 2:15 AM

#

@white salmon the YouTube link. Open it.

viral mason May 23, 2020, 2:16 AM

#

LOL

#

everybody loves noot noot

verbal wedge May 23, 2020, 2:19 AM

#

[*] ret020 Cron jobs....................................................... yes!                     
---                                                                                                               
/etc/crontab:SHELL=/bin/sh

#

This looks suspicious

scenic bolt May 23, 2020, 2:19 AM

#

@scenic bolt Look for files belonging to each and every user
@stuck fractal Thanks for the advice, solved it!

white salmon May 23, 2020, 2:19 AM

#

I've watched that compilation too many times

stuck fractal May 23, 2020, 2:20 AM

#

@verbal wedge you're not going to get root on learn linux with linenum or linpeas

white salmon May 23, 2020, 2:20 AM

#

I mean

#

He theoretically could

verbal wedge May 23, 2020, 2:22 AM

#

yeah im stuck

viral mason May 23, 2020, 2:22 AM

#

@stuck fractal thx james got it

white salmon May 23, 2020, 2:24 AM

#

hello pls hint at ||hiden|| in room madness

viral mason May 23, 2020, 2:25 AM

#

@white salmon you mean the one with secret?

white salmon May 23, 2020, 2:25 AM

#

yah

stuck fractal May 23, 2020, 2:26 AM

#

@white salmon that was fast.

viral mason May 23, 2020, 2:26 AM

#

um after ||checking the source code, you can see that it's between 0-99||

#

then, you can either do basic python scripting

#

or manually try it

vernal ridge May 23, 2020, 2:26 AM

#

Can anyone help with the last task in INTRO TO x86-64

viral mason May 23, 2020, 2:26 AM

#

but i suggest you to do the scripting, it can teach you something if you dont know it

#

even you know it, it would be a nice practice on get requests

verbal wedge May 23, 2020, 2:27 AM

#

Yep I'm stuck on getting the flag here for Learn Linux

viral mason May 23, 2020, 2:28 AM

#

optional really did a great job with madness btw

#

i really liked that room but by the same time i really said you crazy .... when the rot thing happened lol

#

@verbal wedge i want to help but i dont remember what i did on that one

verbal wedge May 23, 2020, 2:29 AM

#

im really stuck

stuck fractal May 23, 2020, 2:29 AM

#

@verbal wedge which part?

verbal wedge May 23, 2020, 2:29 AM

#

getting the flag lol

viral mason May 23, 2020, 2:30 AM

#

dude

#

check muir's writeup

#

there's a writeup for that one

stuck fractal May 23, 2020, 2:31 AM

#

@verbal wedge look for files belonging to each and every user

white salmon May 23, 2020, 2:33 AM

#

so uh im stuck... i got the thing and now idk what to do with it .. hint ?

stuck fractal May 23, 2020, 2:35 AM

#

@white salmon ask questions better jeez

white salmon May 23, 2020, 2:37 AM

#

its done 😂

patent token May 23, 2020, 2:39 AM

#

Saw a question a little bit ago about Gatekeeper. There are no ASLR memory protections in place on that machine/challenge.

#

If you're seeing that, you're doing something wrong.

stuck fractal May 23, 2020, 2:42 AM

#

@ruby chasm

#

No. But wrong channel. @viral mason

viral mason May 23, 2020, 2:50 AM

#

oh shoot i forgot i was on community-hints

#

sorry

inland onyx May 23, 2020, 2:50 AM

#

He's not banned. Looks like he left though

viral mason May 23, 2020, 2:50 AM

#

thanks @inland onyx

woven pumice May 23, 2020, 3:35 AM

#

could you give me a hint for the box [Lian_yu]
I got password for ssh, but I can't find the username...

stuck fractal May 23, 2020, 3:35 AM

#

@woven pumice there's a hidden file on FTP with a short story

#

A few potential usernames in there

#

ls -a to list hidden files works in FTP as well

woven pumice May 23, 2020, 3:36 AM

#

@stuck fractal thanx! i didn't search hidden one

#

I'll try it!

stuck fractal May 23, 2020, 3:36 AM

#

You should always look for hidden files

white salmon May 23, 2020, 4:09 AM

#

Hi guys! What kind of hint could you give me for the room : Wgel CTF

#

I already have the ssh key

#

But can't connect to it. The ssh2john tell me there isn't any password

#

I'm sure I miss something else

solemn smelt May 23, 2020, 4:36 AM

#

thats good that means the ssh key doesnt need one just use it to ssh into the machine now

white salmon May 23, 2020, 4:57 AM

#

I tried

#

But it asks me for a password

#

I used the flag -i to specify the id_rsa file

#

@solemn smelt

📎 unknown.png

#

As you can see on this capture

solemn smelt May 23, 2020, 5:04 AM

#

I believe you may have to change the premissions of the id_rsa

white salmon May 23, 2020, 5:05 AM

#

I did it too, set it to 600

solemn smelt May 23, 2020, 5:07 AM

#

oh you have to specify the user youre trying to ssh as

#

if you dont know I would suggest further enumeration

white salmon May 23, 2020, 5:08 AM

#

Ok, that's what I thought, I miss information

#

I'll continue to search for something like this

shut whale May 23, 2020, 7:27 AM

#

help with a flag in learning linux, i swear i have the answer but its not accepting it.

#

task 12 im switching shells to shiba2 but the password that was correct in task11 will not work.

left salmon May 23, 2020, 7:39 AM

#

"environment variable"

#

su automatically connects you to su (with the password)

#

try typing ls

#

and you'll see shiba2

#

@shut whale

shut whale May 23, 2020, 7:55 AM

#

but im doing su -s shiba2

#

and it asks for shiba2 pass

regal vessel May 23, 2020, 7:55 AM

#

hello everyone,can you give me a hint for the new box lian_yu?
i cant find the file name with SSH password.

shut whale May 23, 2020, 7:56 AM

#

i got the pass from ./shiba2 but it says its wrong

north moat May 23, 2020, 8:39 AM

#

@regal vessel did you do stegh to find SSH ?

spice harness May 23, 2020, 8:52 AM

#

any hints on "CC: Radare2" room on the_final_exam binery

marble dagger May 23, 2020, 9:21 AM

#

need a hint on lian_yu for finding the SSH password. I can see the hidden files and got the pictures but I can't seem to get anything out of it. tried steghide, but I don't have the passphrase. any hints?

neon acorn May 23, 2020, 9:32 AM

#

@marble dagger maybe you can guess or brute that passphrase

indigo ridge May 23, 2020, 9:35 AM

#

Please.. need some hints on task 2 of https://tryhackme.com/room/lianyu I tried with dirb but nothing came out

TryHackMe

TryHackMe | Lian_Yu

A beginner level security challenge

north moat May 23, 2020, 9:42 AM

#

@neon acorn means Stegh not help to find ssh ?

indigo ridge May 23, 2020, 9:44 AM

#

need a hint on lian_yu for finding the SSH password. I can see the hidden files and got the pictures but I can't seem to get anything out of it. tried steghide, but I don't have the passphrase. any hints?
@marble dagger hey.. if you are doing the same room can you tell me something about the 2nd task..

sinful plaza May 23, 2020, 9:45 AM

#

Please.. need some hints on task 2 of https://tryhackme.com/room/lianyu I tried with dirb but nothing came out
@indigo ridge use gobuster

TryHackMe

TryHackMe | Lian_Yu

A beginner level security challenge

glossy basin May 23, 2020, 9:45 AM

#

it's not the tool problem

#

try different wordlists

sinful plaza May 23, 2020, 9:45 AM

#

medium you know

north moat May 23, 2020, 9:45 AM

#

@sinful plaza Stegh help us to find SSH ?

sinful plaza May 23, 2020, 9:46 AM

#

@sinful plaza Stegh help us to find SSH ?
@north moat which task are u stuck??

north moat May 23, 2020, 9:46 AM

#

#5

sinful plaza May 23, 2020, 9:46 AM

#

it's not the tool problem
@glossy basin medium is the way forward lol

marble dagger May 23, 2020, 9:46 AM

#

@indigo ridge did you try dirbuster or gobuster?

glossy basin May 23, 2020, 9:47 AM

#

yeah, i know

sinful plaza May 23, 2020, 9:47 AM

#

#5
@north moat found images already???

#

im also on LianYU - for some reason the ||Leave_me_alone.png doesnt open...|| i think that may have something in but binwalk doesnt find anything file magic number
@potent quail

past night May 23, 2020, 9:49 AM

#

remove the spoilers

#

talking to @potent quail

sinful plaza May 23, 2020, 9:49 AM

#

remove the spoilers
@past night sorry done

potent quail May 23, 2020, 9:49 AM

#

ah sorry

past night May 23, 2020, 9:50 AM

#

yeah, it's fully related to the answer

potent quail May 23, 2020, 9:50 AM

#

ah ok

regal vessel May 23, 2020, 9:54 AM

#

yeah, it's fully related to the answer
@past night I modified the file header of the image file, but only a little content is displayed, is this normal?

north moat May 23, 2020, 9:54 AM

#

@sinful plaza i fix that file , its Mp4 but not play anything

sinful plaza May 23, 2020, 9:55 AM

#

@sinful plaza i fix that file , its Mp4 but not play anything
@north moat not mp4 it a image

regal vessel May 23, 2020, 9:55 AM

#

is png right?

@north moat not mp4 it a image
@sinful plaza

north moat May 23, 2020, 9:55 AM

#

yes , but i mean inside that png .

sinful plaza May 23, 2020, 9:56 AM

#

yes , but i mean inside that png .
@north moat ||go after jpg||

#

is png right?
@sinful plaza
@regal vessel ||go after jpg||

north moat May 23, 2020, 9:57 AM

#

can i dm ?

sinful plaza May 23, 2020, 9:58 AM

#

sure bro

potent quail May 23, 2020, 10:00 AM

#

mind if i DM quick please?

north moat May 23, 2020, 10:02 AM

#

sure Dm Me @potent quail

white salmon May 23, 2020, 10:04 AM

#

Do you know guys what a type of problem is it?

📎 Przechwytywanie.PNG

grand pasture May 23, 2020, 10:14 AM

#

I dont know any file extensions that have 6 characters

#

So im not sure what to search with the dirb

warm schooner May 23, 2020, 10:14 AM

#

You don't need dirb to find the extension, simple enumeration of a webpage will help you find the filetype

grand pasture May 23, 2020, 10:15 AM

#

Oh i tried that but it was taking ahes

#

So i found task 1 and 2

warm schooner May 23, 2020, 10:15 AM

#

For the file type, you only need fuzzing and inspect element

grand pasture May 23, 2020, 10:15 AM

#

Ahh ok thanks

#

And I'm not sure what the code word is helpful for yet, but maybe it will be later lol

warm schooner May 23, 2020, 10:16 AM

#

That will come in later, I think for Q5

grand pasture May 23, 2020, 10:16 AM

#

Ah ok thanks

#

First time doing a medium level room aswell

#

Abit of a challenge so i thought y not lol

north moat May 23, 2020, 10:17 AM

#

im done Lian_Yu Room

grand pasture May 23, 2020, 10:17 AM

#

Oh dam everyone too quick

viscid mason May 23, 2020, 10:17 AM

#

yeah! ❤️ community!

warm schooner May 23, 2020, 10:17 AM

#

First time doing a medium level room aswell
@grand pasture It's ranked as an easy room

grand pasture May 23, 2020, 10:18 AM

#

Oh,? I thought the thingy was orange rather then green

#

Oh no if its supposed to be easy then I think im not supposed to be stuck lol

#

@warm schooner What wordlist should i use with dirbuster to find the file? Because it's been going for a while and its still not found it 😣

warm schooner May 23, 2020, 10:31 AM

#

I used 2.3 medium

grand pasture May 23, 2020, 10:32 AM

#

Ok I was using small

warm schooner May 23, 2020, 10:32 AM

#

The wordlist shouldn't matter too much as you're looking for numbers

grand pasture May 23, 2020, 10:32 AM

#

Numbers?

#

Oh