#room-hints | TryHackMe | Page 32

white salmon Jun 11, 2020, 12:35 AM

#

||find / -type f -name "4bcbe*" 2>/dev/null what does this mean? when you type find / it is searching the whole system -type f: this means that the type is file and not a directory for directory you want to put -type d. -name "4bcbe*" this means that there is 4bcbe in the name but it continues so you put * 2>/dev/null this sends everything that is not what you are looking for to the /dev/null (look at the /dev/null as an blackhole. you send something and it doesn't come back)|| @worn cloud

#

I am on Peak-Hill right now. I have encoded the binary file to hex and then back to ascii. This is the file that I have. I'm not sure what to do with it now. Do I have to put it through one more encode/decode? :/

📎 hexdecode.txt

#

Still looks like garbage to me.

worn cloud Jun 11, 2020, 12:49 AM

#

@white salmon I read the question again and i have to find a file that contains a string that stats with "4bcbe".

📎 SPOILER_Captura_de_Pantalla_2020-06-10_a_las_6.39.30_p._m..png

#

||grep -Ril "4bcbe"|| / is not working for me 😦

white salmon Jun 11, 2020, 12:52 AM

#

ahahaahah

#

thats sad 😂

viral mason Jun 11, 2020, 1:02 AM

#

can anybody nudge me on stage 5's virtual host on CTF 100?

stuck fractal Jun 11, 2020, 1:03 AM

#

@white salmon nearly, elf

median compass Jun 11, 2020, 1:03 AM

#

did you find the hidden data in 10.jpg @viral mason? maybe look at that again?

stuck fractal Jun 11, 2020, 1:03 AM

#

The 2>/dev/null only redirects errors

viral mason Jun 11, 2020, 1:04 AM

#

ohhhh right. @median compass

median compass Jun 11, 2020, 1:04 AM

#

happy hunting

viral mason Jun 11, 2020, 1:05 AM

#

thanks man

white salmon Jun 11, 2020, 1:05 AM

#

yes its putting errors to /dev/null (which is nothing i think? ) @stuck fractal

stuck fractal Jun 11, 2020, 1:08 AM

#

Yep, but the way you explained it implies that that part of the command was ignoring things you're not looking for

#

Which isn't right

twilit swallow Jun 11, 2020, 1:41 AM

#

does anyone know how to open this

#

📎 unknown.png

wooden mist Jun 11, 2020, 1:42 AM

#

file?

twilit swallow Jun 11, 2020, 1:43 AM

#

yeah i get this when i try

#

📎 unknown.png

#

when I use sudo i get this

#

📎 unknown.png

lyric steeple Jun 11, 2020, 1:45 AM

#

has anyone done priv esc for mindgames and can share a hint?

wooden mist Jun 11, 2020, 1:47 AM

#

@twilit swallow file <filename>

twilit swallow Jun 11, 2020, 1:47 AM

#

ok ill try

#

📎 unknown.png

wooden mist Jun 11, 2020, 1:47 AM

#

well, now you know what it is

twilit swallow Jun 11, 2020, 1:51 AM

#

is there something i need to install

wooden mist Jun 11, 2020, 1:52 AM

#

no, it's ASCII text

#

meaning it's a text file

twilit swallow Jun 11, 2020, 1:58 AM

#

wooow

#

so I could of vi <name of file> this entire time

#

🤦

#

thanks for the help

viral mason Jun 11, 2020, 2:13 AM

#

can you guys please tell me that what should i do with this port knocking order at the end of stage 5 on ctf 100? my brain kinda stopped..

wooden mist Jun 11, 2020, 2:15 AM

#

you can't use it on stage5 right?

#

(I don't remember my whole playthrough)

viral mason Jun 11, 2020, 2:16 AM

#

what do you mean?

wooden mist Jun 11, 2020, 2:16 AM

#

oh wait, port knocking order

viral mason Jun 11, 2020, 2:16 AM

#

i thought it might be ascii but probably it's not

#

yeah the one with 2x3 pairs of chars

wooden mist Jun 11, 2020, 2:17 AM

#

||you got numbers from the respective sites, each 2 char pair corresponds to a specific site||

viral mason Jun 11, 2020, 2:18 AM

#

ohhh

#

now i see

#

thanks man o/

white salmon Jun 11, 2020, 2:46 AM

#

hi all , privesc on mindgames involve reversing or pwning ? thanks

white salmon Jun 11, 2020, 3:20 AM

#

Hi there,

#

Just doing the Peak-Hill room

#

But I'm not able to unpickle the creds file.

#

I have already to decoded it to ascii.

#

But unpickling it gives this error.

wooden mist Jun 11, 2020, 3:22 AM

#

where'd you decode the binary

white salmon Jun 11, 2020, 3:23 AM

#

Binary to hex website.

#

and then hex to ascii

wooden mist Jun 11, 2020, 3:23 AM

#

did you just copy the ascii to a file?

white salmon Jun 11, 2020, 3:23 AM

#

No I saved it.

#

I has all the non-printable characters in it.

wooden mist Jun 11, 2020, 3:24 AM

#

🤔

#

what's the error?

white salmon Jun 11, 2020, 3:24 AM

#

Give me a moment.

wooden mist Jun 11, 2020, 3:26 AM

#

i'd suggest decoding it on a different site (cyberchef maybe), downloading the output and trying again

white salmon Jun 11, 2020, 3:26 AM

#

Here is the file that I'm trying to unpicle.

📎 hexdecode.txt

wooden mist Jun 11, 2020, 3:27 AM

#

oh

#

pls stop using python2

#

use python3

white salmon Jun 11, 2020, 3:29 AM

#

Ok, I'll try with python3

#

Maybe I need to carve out a pickle?

#

Maybe the real pickle is hidden within the file?

wooden mist Jun 11, 2020, 3:32 AM

#

that should've worked afaik

white salmon Jun 11, 2020, 3:33 AM

#

🤔

wooden mist Jun 11, 2020, 3:34 AM

#

i'd suggest decoding it on a different site (cyberchef maybe), downloading the output and trying again

#

seems like not all non-printable chars got through from what i see

white salmon Jun 11, 2020, 3:36 AM

#

I'll try and decode with cyberchef

wooden mist Jun 11, 2020, 3:36 AM

#

pls remove, no spoilers

#

tbh also remove the prev file and the code kekw

stuck fractal Jun 11, 2020, 3:37 AM

#

@white salmon no reversing or binary exploitation (buffer overflow etc) in mind games

white salmon Jun 11, 2020, 3:38 AM

#

@wooden mist done

wooden mist Jun 11, 2020, 3:39 AM

#

try decoding again on cyberchef and downloading the input, that should return a valid file

white salmon Jun 11, 2020, 3:43 AM

#

Just downloaded. Unpickling now.

#

||oddrabbit@Wild-Dog-Pro:~/Documents/tryhackme/peak-hill/foothold$ python3
Python 3.8.2 (default, Apr 27 2020, 15:53:34)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
import pickle
file_handler = open("hexdecode.txt", "rb")
print(file_handler)
<_io.BufferedReader name='hexdecode.txt'>
pickle.load(file_handler)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
_pickle.UnpicklingError: invalid load key, '\xc2'.
data = pickle.load(file_handler)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
_pickle.UnpicklingError: invalid load key, '\xc2'.
||

#

Ok there's the output after downloading from cyberchef

wooden mist Jun 11, 2020, 3:50 AM

#

you sure that's the one you downloaded?

#

I just did this and it works perfectly

white salmon Jun 11, 2020, 3:51 AM

#

Really you were able to depickle it?

wooden mist Jun 11, 2020, 3:51 AM

#

yes

#

without a problem

white salmon Jun 11, 2020, 3:52 AM

#

That's weird.

#

Let me try again.

#

Which one did you upload?

#

Did you upload the creds or the decodehex file?

wooden mist Jun 11, 2020, 3:55 AM

#

creds

white salmon Jun 11, 2020, 3:56 AM

#

Ah uploaded the hexdecode.

#

Must have corrupted it somehow.

#

Maybe missed a charcter

#

Awesome, deserialized it successfully.

#

It's a list.

#

Thanks very much for your help. @wooden mist

wooden mist Jun 11, 2020, 4:02 AM

#

👍

hasty slate Jun 11, 2020, 4:12 AM

#

if you are copying the ASCII from cyberchef or some site I don't think it would work. Copy the hex, use unhexilify in python or use xxd to make the txt file. Then load it. also there is an option to load strings as well. not only file.

white salmon Jun 11, 2020, 4:29 AM

#

No, I downloaded the file.

#

didn't copy and paste.

#

I'm thinking that I must have missed a character when copying the cred file from my machine to the website.

nova meteor Jun 11, 2020, 4:38 AM

#

anyone got a couple hints for Linux challenge

shrewd verge Jun 11, 2020, 5:22 AM

#

is there hint for room jurassic park?

#

well i did get the table name/databases.. somehow the users table lead to hole.. with column username:password

shrewd verge Jun 11, 2020, 5:39 AM

#

any1 can pm?

#

ah.. wrong query

void plinth Jun 11, 2020, 6:19 AM

#

||does priv escalation from hatter -> root has anything to do with cronjobs? (wonderland)||

rancid crystal Jun 11, 2020, 6:24 AM

#

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Linux - Privilege Escalation.md

GitHub

swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

void plinth Jun 11, 2020, 6:39 AM

#

@rancid crystal Thanks. Got root. 🙂

white salmon Jun 11, 2020, 6:50 AM

#

any help on breaking forget password mechanism

rancid crystal Jun 11, 2020, 6:59 AM

#

@white salmon for what?

mild eagle Jun 11, 2020, 7:22 AM

#

after you have debugged something with r2 ("hitting a breakpoint") how do you restart the program if you want to run it againg inside r2 ?

echo thunder Jun 11, 2020, 7:38 AM

#

can anyone give me a hint on python playground? I arrived at the page were the credential are but I can't figure it how to convert that string to the actual password

white salmon Jun 11, 2020, 7:52 AM

#

@white salmon for what?
@rancid crystal Owasp Juice shop

wraith marsh Jun 11, 2020, 8:48 AM

#

can anyone give me a hint on python playground? I arrived at the page were the credential are but I can't figure it how to convert that string to the actual password
@echo thunder RE it

whole valley Jun 11, 2020, 9:46 AM

#

Anybody got a hint for the last linux challenge? Im guessing i need to change to root user or use chmod but permission is always denied.

steady stratus Jun 11, 2020, 10:05 AM

#

Look for interesting log files 🙂

oblique cliff Jun 11, 2020, 10:08 AM

#

Jeez @steady stratus why are you up so early what time zone are you in

steady stratus Jun 11, 2020, 10:09 AM

#

I’m in BST (:

#

It’s 11am but I get up really early anyways for work rota’s and things

oblique cliff Jun 11, 2020, 10:10 AM

#

Oh I take it back then it’s 6 am here 👀

steady stratus Jun 11, 2020, 10:10 AM

#

Ahahha - I should be asking you then! 😛

oblique cliff Jun 11, 2020, 10:12 AM

#

I’m torn between two answers:
1 I’m asking myself the same thing
2 i sensed people needed my help so I was awoken by their silent calls from discord

steady stratus Jun 11, 2020, 10:12 AM

#

Ah yes, those calls huh

oblique cliff Jun 11, 2020, 10:12 AM

#

They’re quite loud to the trained ear

steady stratus Jun 11, 2020, 10:13 AM

#

Certainly a word for it 😂😂😂

#

Got anything exciting lined up today?

oblique cliff Jun 11, 2020, 10:13 AM

#

Just work as per usual

#

I decided actually to not do any hacking today and instead finish charting out 6 songs on bass that I’ve been putting off

#

You?

steady stratus Jun 11, 2020, 10:17 AM

#

Ah nicee - been playing long? That’s kinda rad

#

Nothing exciting for me, in the middle of moving house so just doing odds and sods around the house ^^

oblique cliff Jun 11, 2020, 10:22 AM

#

For about a year

#

Oh cool! Kinda a bad time to be moving?

#

Or is it easier with the whole pandemic deal?

whole valley Jun 11, 2020, 10:23 AM

#

Look for interesting log files 🙂
@steady stratus Was that aimed at me?

steady stratus Jun 11, 2020, 10:24 AM

#

ah yes - sorry @whole valley (:

mild eagle Jun 11, 2020, 12:50 PM

#

Need some a hint to wonderlandr ||Got the executeable and gonna use r2 to alter it i can see in one of the string the are running /bin/echo if i want to alter another string how do then write it so the execuable doesn't output as a string" iie. simply prints out /bin/echo xxxxx||

spiral stag Jun 11, 2020, 12:57 PM

#

@mild eagle think about what you might be able to control...

#

no need to alter the executable itself

ripe hedge Jun 11, 2020, 1:10 PM

#

no hints on rooting mindgames yet, eh?

spiral stag Jun 11, 2020, 1:10 PM

#

only headaches

#

although i know where the root flag is

#

||/root/root.txt||

ripe hedge Jun 11, 2020, 1:12 PM

#

yeah well, that was given

spiral stag Jun 11, 2020, 1:12 PM

#

xD

#

the obvious hint

ripe hedge Jun 11, 2020, 1:13 PM

#

I just saw an odd capability and a couple odd suid programs, but I can't seem to exploit that

spiral stag Jun 11, 2020, 1:13 PM

#

yea, tried those aswell

ripe hedge Jun 11, 2020, 1:13 PM

#

so it's probably nothing

#

well, I hit a dead end anyways

spiral stag Jun 11, 2020, 1:14 PM

#

https://tenor.com/view/pokemon-ditto-same-feeling-is-mutual-iagree-gif-4483001

Tenor

ditto

▶ Play video

potent vale Jun 11, 2020, 1:15 PM

#

James mentioned that he didn't include any rabbit holes in that one. So the odd capability must mean something, right? 🤔

ripe hedge Jun 11, 2020, 1:23 PM

#

probably

#

only 2 roots so far if the scoreboard is accurate

inland onyx Jun 11, 2020, 1:33 PM

#

(That upvote was a hint btw)

potent vale Jun 11, 2020, 1:35 PM

#

JB's screenshot with the ||modified uid || also hints in that direction

wraith marsh Jun 11, 2020, 1:35 PM

#

😳

potent vale Jun 11, 2020, 1:36 PM

#

The plot thickens

ripe hedge Jun 11, 2020, 1:55 PM

#

oh hmm

#

the ||capa|| is probably what we need, but how the hell can we exploit that... not the easiest binary to exploit

hasty slate Jun 11, 2020, 2:03 PM

#

maybe it is like the ||lighweight htb box(from researching)|| but cannot do anything 😦

inland onyx Jun 11, 2020, 2:04 PM

#

No, it's really not the easiest one to exploit

#

As I said yesterday, I would have needed the writeup when I tested it if James hadn't dropped a brief hint earlier

mild eagle Jun 11, 2020, 2:08 PM

#

@spiral stag thank you for the hint i Think i Can go On from here.

spiral stag Jun 11, 2020, 2:09 PM

#

gl!

lusty wigeon Jun 11, 2020, 2:12 PM

#

Who said you need to "exploit" it?

ripe hedge Jun 11, 2020, 2:14 PM

#

exploit in the abuse it sense

#

trying to figure out how to use it to run code but that might be the wrong way of thinking about it

dull marlin Jun 11, 2020, 2:16 PM

#

Does someone finished the new "https://tryhackme.com/room/rpburpsuite" room? I'm stuck at the shortcut question. #4 "Take a look at the actions, which shortcut allows us to forward the request to Repeater?" The solution is displayed at the Action Button- Context menu in burp but my submit is wrong: "....+R"

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

#

If this is not the right channel, sorry. 8/

loud oracle Jun 11, 2020, 2:18 PM

#

check the hint

dull marlin Jun 11, 2020, 2:18 PM

#

This bad little button 😛 ?

loud oracle Jun 11, 2020, 2:18 PM

#

not bad, but yes

dull marlin Jun 11, 2020, 2:19 PM

#

Thank you.

supple thicket Jun 11, 2020, 2:20 PM

#

What port is for the web server?{Anthem}

steady stratus Jun 11, 2020, 2:21 PM

#

Enumerate using nmap 🙂

supple thicket Jun 11, 2020, 2:21 PM

#

thanks but which ip

steady stratus Jun 11, 2020, 2:21 PM

#

The anthem instance

#

Enumerating and discovering what ports & services are running is an essential step in pentesting

#

https://tryhackme.com/room/rpnmap

TryHackMe

TryHackMe | RP: Nmap

Part of the Red Primer series, intro to scanning.

supple thicket Jun 11, 2020, 2:22 PM

#

@steady stratus Thanks brother

steady stratus Jun 11, 2020, 2:22 PM

#

have fun!

supple thicket Jun 11, 2020, 2:23 PM

#

brother its free or paid

steady stratus Jun 11, 2020, 2:23 PM

#

rpnmap is free ^^

supple thicket Jun 11, 2020, 2:25 PM

#

ok bro

white salmon Jun 11, 2020, 4:09 PM

#

I feel like i am in a self-inflicted rabbit hole on escalation for mindgames 😦

#

i THINK i know the path forward... that or its completely wrong aand have looked into this for 6 hours now 😦

ripe hedge Jun 11, 2020, 4:18 PM

#

welcome to the club

#

is there a CVE attached to your rabbit hole?

#

we're probably stuck at the same place

white salmon Jun 11, 2020, 4:19 PM

#

no

ripe hedge Jun 11, 2020, 4:19 PM

#

or not

white salmon Jun 11, 2020, 4:34 PM

#

hydra, DM?

golden niche Jun 11, 2020, 4:38 PM

#

hey everyone

#

can anyone help me about a problem?

tidal sedge Jun 11, 2020, 4:39 PM

#

Don't ask to ask, just ask.

clever bane Jun 11, 2020, 4:41 PM

#

Can anymore give me a clue regarding the pickle Rick game

#

Idk where to log on to Rick's computer

#

I think I know the username and password but where do I enter them?

#

Please ping me when u answer

gaunt herald Jun 11, 2020, 4:50 PM

#

https://tryhackme.com/room/bpnetworking
and maybe
https://tryhackme.com/room/introtonetworking

clever bane Jun 11, 2020, 4:51 PM

#

I am attempting this puzzle now...I need to know if there is any way I can just enter the username and password and get into Rick's computer

gaunt herald Jun 11, 2020, 4:53 PM

#

There is... by learning how internet works, more or less.

clever bane Jun 11, 2020, 4:53 PM

#

Ok..so u mean this puzzle isn't for my level?

#

Then I'll just terminate it and learn the other stuff

#

Thx for letting me know

glossy basin Jun 11, 2020, 4:55 PM

#

@gaunt herald i think your respone was irrelevant. here we help with rooms

#

@clever bane the username and password are used for SSH connection

#

that what you usually aim for - gain remote access

clever bane Jun 11, 2020, 4:56 PM

#

Ohh that made more sense

#

So..the IP is the machine IP that was deployed?

gaunt herald Jun 11, 2020, 4:56 PM

#

Understood!

glossy basin Jun 11, 2020, 4:56 PM

#

exactly

#

IP of the machine

clever bane Jun 11, 2020, 4:56 PM

#

Ok

glossy basin Jun 11, 2020, 4:57 PM

#

@gaunt herald don't get me wrong, you didn't do anything bad or so but this channel is for room helping

clever bane Jun 11, 2020, 4:57 PM

#

U think banner grabbing the IP with a different terminal a good idea

#

So that u know the OS

#

And can locate the password folder

glossy basin Jun 11, 2020, 4:58 PM

#

maybe 🤷‍♂️

#

also, if you ever stuck you can easily check writeups for guidance

clever bane Jun 11, 2020, 4:58 PM

#

Is it possible to banner grab yourself? XD

#

Like our own IP?

glossy basin Jun 11, 2020, 4:59 PM

#

not sure

clever bane Jun 11, 2020, 4:59 PM

#

If that doesn't work...
Doing an OS scan should...

glossy basin Jun 11, 2020, 4:59 PM

#

yeah

clever bane Jun 11, 2020, 5:00 PM

#

And then u can locate the password folder and then give him his password

glossy basin Jun 11, 2020, 5:00 PM

#

banner grabbing is not that important for THM but OS nmap scan is important

clever bane Jun 11, 2020, 5:00 PM

#

Ok gotcha

#

I prefer banner grab as it's passive...but here I guess it's fine to try an os scan

glossy basin Jun 11, 2020, 5:01 PM

#

good luck

#

😄

ripe hedge Jun 11, 2020, 5:02 PM

#

@white salmon sure

glacial remnant Jun 11, 2020, 5:31 PM

#

What Binary do I need to run on room1 task21 "Binary - shiba2" I think I'm halfway trough the task, I just don't know what to run to get the password

sharp sage Jun 11, 2020, 5:51 PM

#

room lfi basic ---task3 ques 6th can any body tell me the what to do in that ques.....i get bit confused in that

oblique cliff Jun 11, 2020, 5:59 PM

#

@glacial remnant it walks you through what things you need to run, try rereading the prompts

glacial remnant Jun 11, 2020, 6:01 PM

#

@oblique cliff It doesn't specify what Binary needs running

📎 unknown.png

oblique cliff Jun 11, 2020, 6:02 PM

#

Binary - shiba2

#

So probably run the shiba2 binary

glacial remnant Jun 11, 2020, 6:06 PM

#

@oblique cliff Thank you so much! I really don't know why I didn't think of that

oblique cliff Jun 11, 2020, 6:06 PM

#

No problem 🙂

white salmon Jun 11, 2020, 6:11 PM

#

Hey umm

#

Can I ask for a help

#

For Alfred ?

light dew Jun 11, 2020, 6:18 PM

#

hey any hint for the privesec in the Mindgames room!

#

I got the user.txt but am stuck since!

ripe hedge Jun 11, 2020, 6:22 PM

#

Welcome to the club

#

Embargo on hints for 2 days or so

light dew Jun 11, 2020, 6:22 PM

#

embargo?

ripe hedge Jun 11, 2020, 6:23 PM

#

Only 3 people have rooted the box, and they aren't talking

#

Well notwithstanding the testers/reviewers

light dew Jun 11, 2020, 6:24 PM

#

lol

potent vale Jun 11, 2020, 6:25 PM

#

I hope they don't help until after nahamcon. I'm out of ideas for now 😄

#

There was a small hint given a few hours ago @light dew ||apparently the unusual capability setting is relevant||

remote gate Jun 11, 2020, 6:32 PM

#

in ctf100.. am i supposed to use the port knocking sequence from stage 5 for stage 6? or am i missing something? doesn't seem to work. tried all iterations

light dew Jun 11, 2020, 6:33 PM

#

There was a small hint given a few hours ago @light dew ||apparently the unusual capability setting is relevant||
@potent vale Thanks, I will look into it!

hasty slate Jun 11, 2020, 6:46 PM

#

Mindgames is the perfect example to remind you that you SHOULD TAKE A BREAK!

oblique cliff Jun 11, 2020, 6:52 PM

#

@white salmon ask away my man no need to ask if you can

burnt cosmos Jun 11, 2020, 7:06 PM

#

@hasty slate I've been trying to figure out how to get onto the box for the past half an hour and i already feel out of ideas!

hasty slate Jun 11, 2020, 7:07 PM

#

ha ha .. I believe getting into the box is the easiest part.. after that it's kinda tricky.. and impossible if you are tired.

ripe hedge Jun 11, 2020, 7:11 PM

#

@stuck fractal you, sir, are an evil evil person

📎 unknown.png

#

there is a rabbit hole though, contrary to earlier statements

obtuse osprey Jun 11, 2020, 7:13 PM

#

hello, im currently attempting the Gatekeeper Room and so far i've scanned the open ports. I have managed to ||download gatekeeper.exe|| from ||the share USERS|| with the ||smbclient|| command but now im so clueless as to what i should do. I dont know if this has anything to do with ||reverse-engineering|| but if it does i don't know much about it. Could someone point me in the right direction??? Am i supposed to examine it with something??? im so lost?

runic dune Jun 11, 2020, 7:13 PM

#

How do I block out my text so I can give a basic mindgames hint?

ripe hedge Jun 11, 2020, 7:13 PM

#

still kicking myself for not seeing it earlier

runic dune Jun 11, 2020, 7:14 PM

#

Just pm me if you are stuck at the beginning and stuck on enumerating if you want a hint for mindgames

burnt cosmos Jun 11, 2020, 7:14 PM

#

Use three pipes

#

But the boxes explicitly asks you not to share hints etc

ripe hedge Jun 11, 2020, 7:20 PM

#

||spoiler tags are like this||

stuck fractal Jun 11, 2020, 7:21 PM

#

@ripe hedge I didn't put a rabbit hole in there, so it's one that you've manufactured. DM me how you rooted it

ripe hedge Jun 11, 2020, 7:22 PM

#

@stuck fractal you blocked DMs, probably a good idea

stuck fractal Jun 11, 2020, 7:22 PM

#

@ripe hedge add me first

#

I'm on vacation from helping people, that's all

ripe hedge Jun 11, 2020, 7:23 PM

#

I know

#

you need a break

hasty slate Jun 11, 2020, 7:42 PM

#

still kicking myself for not seeing it earlier
@ripe hedge same XD

zinc oyster Jun 11, 2020, 8:07 PM

#

I'm trying the mrrobot ctf and on the second flag. || I've got a username from the dic (removing dupes) and I'm currently enumerating it again for a password but I've been waiting for quite a while... is this a dead end? ||

dusky urchin Jun 11, 2020, 8:23 PM

#

@zinc oyster Nope

zinc oyster Jun 11, 2020, 8:24 PM

#

Thanks, I found one of the tools seems way faster than the others so instead of an hour or so of wait it might just be some minutes more

mild eagle Jun 11, 2020, 8:26 PM

#

splunk room only missing question 21 in task 2 any one has an hint ?

hasty slate Jun 11, 2020, 8:32 PM

#

@zinc oyster not a dead end BUT u missed some trivial thing on your previous steps.

#

||which couldve cut down the cracking to none||

oblique cliff Jun 11, 2020, 8:37 PM

#

@zinc oyster || make the dict only unique words ||

#

@obtuse osprey || you’re one the right track that you have to reverse engineer it! I’d recommend the x86/63 room and then the bof1 room to get an idea of how to do that. After that I’d watch a walkthrough of an actual BoF cuz it’s pretty systematic and the only way to learn it is to see one ||

zinc oyster Jun 11, 2020, 8:49 PM

#

I got into the machine now thanks for the help

zinc oyster Jun 11, 2020, 9:09 PM

#

I had no idea the || metasploit rpc user/password enumeration and the hydra way was about 10-50x slower than wpscan || lesson well learned

nocturne vault Jun 11, 2020, 9:28 PM

#

um, privesc on mindgames, i feel like i'm deep in a rabbit hole

#

a break might be a good idea 🤔

ripe hedge Jun 11, 2020, 9:31 PM

#

take a break

hasty slate Jun 11, 2020, 9:40 PM

#

Take a break.

eternal wadi Jun 11, 2020, 9:43 PM

#

haha

nocturne vault Jun 11, 2020, 9:43 PM

#

🇧 🇷 🇪 🇦 🇰

#

🇹 🇦 🇰 🇪 ℹ️ 🇹

eternal wadi Jun 11, 2020, 10:28 PM

#

mind games 🤯

white salmon Jun 11, 2020, 10:33 PM

#

Why is it that a ping sweep with fping and nmap may give you a different number of alive hosts

#

Don't they do the same thing? Send ICMP packets?

lyric steeple Jun 11, 2020, 10:36 PM

#

is o*l is a right direction for PE in mindgame room? Looks like it have suid bit set ? Thank you in advance ?

potent vale Jun 11, 2020, 10:44 PM

#

@lyric steeple There are no (intended) rabbit holes in this room, so if you find something highly unusual it should be useful. That was also confirmed as a hint a few hours ago. Use the search or scroll up in this channel to read about it.

lyric steeple Jun 11, 2020, 10:44 PM

#

Thank you @potent vale

potent vale Jun 11, 2020, 10:45 PM

#

And with a few hours I mean like 9. I spent way too much time on that today 😩

lyric steeple Jun 11, 2020, 10:47 PM

#

@potent vale seem I found it but the reverse shell will not bring with root privileges. You mentioned it was not work for you and suddenly it starts. Will Try to figure out why. Thanks again

ripe hedge Jun 11, 2020, 10:49 PM

#

yeah it was a doozy

potent vale Jun 11, 2020, 10:50 PM

#

Good luck. I think I tried the same what you seem to be doing at the moment. You'll get there eventually.

ripe hedge Jun 11, 2020, 10:51 PM

#

yeah I tried that angle a few different ways as well

lyric steeple Jun 11, 2020, 10:51 PM

#

@potent vale thanks

lyric steeple Jun 11, 2020, 11:11 PM

#

finally got root on mindgames

#

ufffff

eternal wadi Jun 11, 2020, 11:14 PM

#

congratz haha i still struggling T_T

lyric steeple Jun 11, 2020, 11:16 PM

#

@eternal wadi if you find a door just try understand why your payload does not give you a root. What is missed? 🙂 Good luck.

eternal wadi Jun 11, 2020, 11:22 PM

#

Thank you! I will try again

white salmon Jun 11, 2020, 11:49 PM

#

hour 20somethign of my struggles with this esc. so close... just need to sort out that last little bit ... yet htat last little bit is the hardest part

bitter shadow Jun 12, 2020, 12:20 AM

#

any hints on the wonderland machine? I'm currently ||hatter|| and I'm just completely lost

white salmon Jun 12, 2020, 12:24 AM

#

look at how the various files you have access to work...

#

i don't wanna give too much of a crazy nudge and get yelled at

#

Def worth while to look at absolutes though

bitter shadow Jun 12, 2020, 12:25 AM

#

hmm, thanks

lyric steeple Jun 12, 2020, 12:40 AM

#

any hints on the wonderland machine? I'm currently ||hatter|| and I'm just completely lost
@bitter shadow I did wonderland after mindgames and becouse of mindgames i got root quite fast. LinPeas should help you with this machine.

white salmon Jun 12, 2020, 12:53 AM

#

any hints on mindgames privesc? I think it's something with the ca********** of the s***** file but can't figure it out

lyric steeple Jun 12, 2020, 1:02 AM

#

@white salmon run linpeas and try to find something which is unusual. It is a bit tricky to find it and also a bit tricky to use it to get root. First find a door, next check what you need to find a key. Another hint: Why the binary can help you with privilege escalation and why it is not on the list when you trying to find it. Hope it helps

white salmon Jun 12, 2020, 1:03 AM

#

@lyric steeple thanks man i think i know what you mean i'll take a break and try it in a bit

viral mason Jun 12, 2020, 1:07 AM

#

i need to ask someone about ||bind|| part on privesc for mindgames real quick, who can help?

lyric steeple Jun 12, 2020, 1:09 AM

#

@lyric steeple
@white salmon

#

@white salmon good luck

#

@viral mason enumerate more

viral mason Jun 12, 2020, 1:10 AM

#

wow, how couldn't i think of that

runic dune Jun 12, 2020, 1:52 AM

#

@viral mason still need help?

viral mason Jun 12, 2020, 1:53 AM

#

kinda @runic dune, can i pm?

runic dune Jun 12, 2020, 1:53 AM

#

yeah

atomic shuttle Jun 12, 2020, 4:35 AM

#

yeah
@runic dune can i pm you? stuck on mindgames priv esc

merry oyster Jun 12, 2020, 5:33 AM

#

hey i'm just starting and i tried to access shiba1@{machine_ip} and it says access denied because of my public key. any help would be appreciated 🙂

📎 hint.PNG

zinc oyster Jun 12, 2020, 5:46 AM

#

@merry oyster are you connected to the VPN?

merry oyster Jun 12, 2020, 5:48 AM

#

yea open vpn. i checked my Network Information and my Internal Virtual IP Address is connected

zinc oyster Jun 12, 2020, 5:50 AM

#

I did the room not long ago. Perhaps you have some ssh configuration that demands the use of public keys? Google how to override that

#

Maybe that works

merry oyster Jun 12, 2020, 5:51 AM

#

okay i'll look into it.

wet imp Jun 12, 2020, 6:03 AM

#

I literally just did that challenge and it worked for me. Maybe restart?

#

the vm

merry oyster Jun 12, 2020, 6:14 AM

#

yea I have been looking to no avail i restarted the vm and it asked me to say yes to the key and then said denied again

#

📎 hint.PNG

wet imp Jun 12, 2020, 6:31 AM

#

Or PuTTy?

hasty slate Jun 12, 2020, 7:17 AM

#

Mindgames has this very weird But very simple privesc .. any normal enum script like linpeas or linenum should point out the weird things

white salmon Jun 12, 2020, 7:24 AM

#

Hi guys, I am still on Peak-Hill but I just can't' understand the last program that we have to exploit. Not sure what input I should put in to that program to gain code execution.

hasty slate Jun 12, 2020, 7:34 AM

#

What does wheat farm grow?
or what does corn farm grow?

white salmon Jun 12, 2020, 7:35 AM

#

wheat and corn?

hasty slate Jun 12, 2020, 7:35 AM

#

ya exactly

#

so what does that farm grow?

white salmon Jun 12, 2020, 7:36 AM

#

food?

#

lol

#

idk

hasty slate Jun 12, 2020, 7:36 AM

#

lol X farm grows X

atomic shuttle Jun 12, 2020, 7:49 AM

#

Mindgames has this very weird But very simple privesc .. any normal enum script like linpeas or linenum should point out the weird things
@hasty slate still stuck. Been googling for hours now

hasty slate Jun 12, 2020, 7:54 AM

#

maybe the first result(or the site we all go to for information regarding binary) u got was all u needed.

burnt cosmos Jun 12, 2020, 8:10 AM

#

All of these people have made it onto the machine, yet i'm still trying to work that out lmao

potent vale Jun 12, 2020, 8:23 AM

#

@burnt cosmos You're pre-flag1? I guess we can give hints for that one by now.

hasty slate Jun 12, 2020, 8:24 AM

#

yeah go and decode the fibonacci text

#

u'll figure it out

potent vale Jun 12, 2020, 8:24 AM

#

Btw I was PMed by multiple people over night who solved it minutes later. Someone seems to be giving huge hints privately.

burnt cosmos Jun 12, 2020, 8:27 AM

#

The bit I'm stuck on at the minute is figuring what it's encoded in, at first i thought ||morse code|| but there's too many characters for it to work

hasty slate Jun 12, 2020, 8:28 AM

#

maybe ctf100 can help you out with that.

burnt cosmos Jun 12, 2020, 8:28 AM

#

👍

#

I'll take a look at that room before continuing

hasty slate Jun 12, 2020, 8:29 AM

#

yeah.. u'll get it pretty fast tho .. cheers

#

or did u solve year of the rabbit?

#

@burnt cosmos

burnt cosmos Jun 12, 2020, 8:31 AM

#

I haven't done Year of the Rabbit yet either

hasty slate Jun 12, 2020, 8:31 AM

#

maybe u can check that out too.. it is shorter

burnt cosmos Jun 12, 2020, 8:32 AM

#

Alright great, ty for the help :D

ripe hedge Jun 12, 2020, 9:15 AM

#

you have to know the encoding to recognize it...

#

but it's a well-known obfuscation

burnt cosmos Jun 12, 2020, 9:56 AM

#

Working my way through Stage 4 of CTF 100, when ||extracting everything from 4.jpg ||, anything within the "Moreflag", all the files are empty but show as downloaded. Any tips for fixing it??

bitter shadow Jun 12, 2020, 10:23 AM

#

@bitter shadow I did wonderland after mindgames and becouse of mindgames i got root quite fast. LinPeas should help you with this machine.
@lyric steeple yea I just went to sleep last night

#

lol

hasty slate Jun 12, 2020, 10:25 AM

#

@burnt cosmos it was in stage 1 itself tho

burnt cosmos Jun 12, 2020, 10:25 AM

#

Yeah i went back and realised it, i got really into it though. Starting to make progress on Mindgames though

hasty slate Jun 12, 2020, 10:26 AM

#

lol nice

slender umbra Jun 12, 2020, 10:33 AM

#

hey i wanted help regarding the room jack-of-all-trades i can't really get anything out of it i scanned it using nmap and got ports ||22|| and ||80|| but ||22|| is ||http|| and another one is ||ssh|| so can't really open in web ,need help

hasty slate Jun 12, 2020, 10:34 AM

#

yes

#

so open port ||22 in firefox||.. u have to change setting in ||about:config||.. google

slender umbra Jun 12, 2020, 10:36 AM

#

okay i will check how to do it, thank you so much

tidal sedge Jun 12, 2020, 10:39 AM

#

Working my way through Stage 4 of CTF 100, when ||extracting everything from 4.jpg ||, anything within the "Moreflag", all the files are empty but show as downloaded. Any tips for fixing it??
@burnt cosmos You skipped a step, do that step and you'll get the files.

burnt cosmos Jun 12, 2020, 10:40 AM

#

@tidal sedge I've downloaded all the files onto my system, I'll go back and have a look at it later

white salmon Jun 12, 2020, 10:41 AM

#

Off to a other day of that privesc. Let's see how many more times I can type in the same things today

dense marlin Jun 12, 2020, 10:42 AM

#

hey there anyone mind giving me some nudge for wonderland? im stucked after following the rabbit. found a hidden paragraph in the source code but cant really figure it out what's that poem mean. Did some google search on it too and im lost now

tidal sedge Jun 12, 2020, 10:43 AM

#

@dense marlin After following the rabbit, check the ||source code||

dense marlin Jun 12, 2020, 10:46 AM

#

@tidal sedge i'm not sure about that, i've did some research on the ||crocodile|| poem for past few hrs and cant really find out how to improve it's tail

tidal sedge Jun 12, 2020, 10:46 AM

#

||Focus on the rabbit.||

hasty slate Jun 12, 2020, 10:46 AM

#

||poem is irrelevant||

dense marlin Jun 12, 2020, 10:47 AM

#

i'll try and see thanks for the nudge

eternal brook Jun 12, 2020, 10:58 AM

#

What is the name of the abnormal service running?

#

hackPark box

burnt cosmos Jun 12, 2020, 10:58 AM

#

Run an nmap scan

eternal brook Jun 12, 2020, 10:58 AM

#

i tried looking in Program files (x86)

burnt cosmos Jun 12, 2020, 10:58 AM

#

Oh wait

#

nvm ignore me lol

eternal brook Jun 12, 2020, 10:59 AM

#

tried this SysSch***

#

np mate

#

it's TASK 4 ques 3

burnt cosmos Jun 12, 2020, 11:03 AM

#

@eternal brook It's going to be a process that's running, have you tried running something like winPeas?

eternal brook Jun 12, 2020, 11:04 AM

#

yes i ran that...

#

i know the processs its'mess***.exe

#

but cant get the answer to abnormal service running

burnt cosmos Jun 12, 2020, 11:06 AM

#

If you know the binary you need to exploit, then you know the abnormal service running

#

Think about how you got to where you are

eternal brook Jun 12, 2020, 11:07 AM

#

its Sche*****?

#

sys**** Sche***** i guess but it's not aceptiing that ans the hint also point that way

#

points

teal sapphire Jun 12, 2020, 11:16 AM

#

Ack im stuck on hatter, and none of the previous hints has helped.

desert bramble Jun 12, 2020, 11:31 AM

#

Hi just doing the RPBurpsuite and im stuck an a question. I have been reading through loads of burpsuite documentation and the Bit-level analysis tab on burp ad i cant seem to find what 5 letter word the rooms is after?

📎 unknown.png

stuck kernel Jun 12, 2020, 11:44 AM

#

@desert bramble it begins with a "T"

desert bramble Jun 12, 2020, 11:46 AM

#

ok thank you ill see what i can find

eternal brook Jun 12, 2020, 11:56 AM

#

What is the name of the abnormal service running?

#

stuck at this question frm hack park

#

saw the tasklist too

graceful parcel Jun 12, 2020, 11:56 AM

#

Hey all, new here but need some help
[Lateral Thinking] Which layer of the TCP/IP model will traceroute run on by default?

eternal brook Jun 12, 2020, 11:57 AM

#

been half hour i got root user but stuck at this ques.....

#

@graceful parcel read the information given in task or try seeing the wireshark packect you'll find out

#

packet*

graceful parcel Jun 12, 2020, 11:59 AM

#

ok, and for your question i think you can run a command as root to find out

leaden crystal Jun 12, 2020, 11:59 AM

#

hello

eternal brook Jun 12, 2020, 12:00 PM

#

I'm already gthe administrator ran tasklist cant find anything that matches the solution length

graceful parcel Jun 12, 2020, 12:01 PM

#

I have tried all seven layers in a ditch attempt but none have worked

eternal brook Jun 12, 2020, 12:04 PM

#

it introductry networking room right?

graceful parcel Jun 12, 2020, 12:05 PM

#

yes

eternal brook Jun 12, 2020, 12:06 PM

#

the answer is from the model only

graceful parcel Jun 12, 2020, 12:06 PM

#

ok got it

eternal brook Jun 12, 2020, 12:06 PM

#

try giving ans from the tcp model

#

not osi

graceful parcel Jun 12, 2020, 12:08 PM

#

thank you.

eternal brook Jun 12, 2020, 12:11 PM

#

np 🙂

tame carbon Jun 12, 2020, 12:19 PM

#

Hi! I am new to tryHackMe, I am stuck on a question where I need to scan the box using nmap. But to scan where should I get the IP address of the box 😦

eternal brook Jun 12, 2020, 12:20 PM

#

deploy the machine

tame carbon Jun 12, 2020, 12:20 PM

#

I am using openvpn

eternal brook Jun 12, 2020, 12:20 PM

#

look at top right corner of the task

#

ohh

#

browser version of kali?

#

it should probably be the same

tame carbon Jun 12, 2020, 12:22 PM

#

oh got it, thanks:)

bitter shadow Jun 12, 2020, 12:37 PM

#

umm, any hints on how to get root on MindGames....?

ripe hedge Jun 12, 2020, 12:38 PM

#

research

#

^_^;

bitter shadow Jun 12, 2020, 12:38 PM

#

umm, did you do it?

ripe hedge Jun 12, 2020, 12:38 PM

#

@bitter shadow dm me to show me where you're at

#

yup

slender umbra Jun 12, 2020, 1:03 PM

#

hi, im at room jack-of-all-trades im currently stuck at a ||jacks password list|| i tried different decoding at ||cyberchef|| but i was unable to decode it can someone help

sharp sage Jun 12, 2020, 1:04 PM

#

hlo....anyone help me in lfi basic room

#

task 3 ques 7

ripe hedge Jun 12, 2020, 1:05 PM

#

use what you did earlier

#

you got Q6, right?

sharp sage Jun 12, 2020, 1:05 PM

#

yes

ripe hedge Jun 12, 2020, 1:05 PM

#

same thing, different command

sharp sage Jun 12, 2020, 1:05 PM

#

can i dm?

white salmon Jun 12, 2020, 1:29 PM

#

Can I get some help on the Linux room?

#

If there is anyone willing to help a noob.

#

Nevermind, got it. 🙂

merry lodge Jun 12, 2020, 1:41 PM

#

hi, what is the typeof hash?
UEsDBAoACQAAAHZxzFBErFMkHwAAABMAAAAJABwAY3JlZHMudHh0VVQJAAMPf+NeD3/jXnV4CwAB
BAAAAAAEAAAAAIi0kLlrUTLl8MGzgkF3SBA8xSLb4lP6W1t17+l0EtJQSwcIRKxTJB8AAAATAAAA
UEsBAh4DCgAJAAAAdnHMUESsUyQfAAAAEwAAAAkAGAAAAAAAAQAAAKSBAAAAAGNyZWRzLnR4dFVU
BQADD3/jXnV4CwABBAAAAAAEAAAAAFBLBQYAAAAAAQABAE8AAAByAAAAAAA=

ripe hedge Jun 12, 2020, 1:45 PM

#

probably not a hash 🙂

#

hashes tend to be a fixed size, but also what he said

steady stratus Jun 12, 2020, 1:46 PM

#

Definitely not a hash - there's encoding systems that use = as padding. It's a really big giveaway as to what encoding it is 🙂

merry lodge Jun 12, 2020, 1:48 PM

#

thanks friends, so how to solve. do you have any idea? 🙂

steady stratus Jun 12, 2020, 1:49 PM

#

Google what encoding systems uses an equals ||(as padding)||

merry lodge Jun 12, 2020, 1:51 PM

#

thank you so much @steady stratus

white salmon Jun 12, 2020, 1:52 PM

#

base64.

hasty slate Jun 12, 2020, 1:53 PM

#

@slender umbra what u mean decode? it's a list 😐 use hydra or some tool to bruteforce

white salmon Jun 12, 2020, 1:53 PM

#

PK
� ��vqPDS$�� creds.txtUT �^^ux��kQ2AwH<"S[[utPKDS$��PK
� ��vqPDS$�� creds.txtUT�^ux��PK��O��r��

#

this is the output of base64.

#

creds.txt.

#

look into that.

ripe hedge Jun 12, 2020, 1:55 PM

#

the header is more telling

white salmon Jun 12, 2020, 1:55 PM

#

hmmm..

median compass Jun 12, 2020, 2:09 PM

#

@slender umbra I remember that one, it looks like one long string but switch instead to the source-code view and look at it then

hasty slate Jun 12, 2020, 2:20 PM

#

aaah yeah. u don't have to decode it. use it as-is

slender umbra Jun 12, 2020, 2:21 PM

#

@hasty slate thanks it helped

sick sun Jun 12, 2020, 2:43 PM

#

Need help privs esc on mindgames

spiral stag Jun 12, 2020, 2:43 PM

#

we all do 😒

sick sun Jun 12, 2020, 2:43 PM

#

@spiral stag ?

potent vale Jun 12, 2020, 2:44 PM

#

||There's a suspicious capability ||which is a confirmed hint.

spiral stag Jun 12, 2020, 2:44 PM

#

i've been starring at that one for 2 days now

sick sun Jun 12, 2020, 2:45 PM

#

Strange files on ||server.service||

potent vale Jun 12, 2020, 2:46 PM

#

I don't know how James planned the end of his 2 day embargo. Surely a better hint will be public soon.

spiral stag Jun 12, 2020, 2:47 PM

#

im going to feel so stupid when he does

sick sun Jun 12, 2020, 2:47 PM

#

@spiral stag mindgames ?

spiral stag Jun 12, 2020, 2:47 PM

#

its going to be something obvious

#

yea

sick sun Jun 12, 2020, 2:48 PM

#

Level insane in privileges escalation 😁

potent vale Jun 12, 2020, 2:49 PM

#

It's simpler than some approaches you had if you worked on this for two days

#

Actually not much harder than most "standard" privescs on THM. It's just like it was designed to make the usual approach fail.

spiral stag Jun 12, 2020, 2:51 PM

#

yea, i usually overthink stuff

#

danmit

#

ffs

#

you rooted it @potent vale ?

potent vale Jun 12, 2020, 2:53 PM

#

Yes. You can also PM me with your currebt idea if you're totally stuck @spiral stag

spiral stag Jun 12, 2020, 2:53 PM

#

thnx!

white salmon Jun 12, 2020, 3:11 PM

#

When do rank update here from the website?

steady stratus Jun 12, 2020, 3:12 PM

#

You have to update it manually by re-dming the bot with your token @white salmon

#

It's manual for now, but will be automatic in the near future

white salmon Jun 12, 2020, 3:12 PM

#

Ok thanks!

sharp moth Jun 12, 2020, 3:44 PM

#

hello.im trying to complete the room "Learn Linux" and im stuck at last task.Bonus Challenge - The True Ending.Can anybody give me a hint ?

white salmon Jun 12, 2020, 3:48 PM

#

Heey!

#

I can, it's actually pretty easy.

#

Try to look for the files that each users have access to.

sharp moth Jun 12, 2020, 3:49 PM

#

ok.i will try this. thx 😄

white salmon Jun 12, 2020, 3:49 PM

#

If you need a write-up there is one on the top of the room page.

fallen sedge Jun 12, 2020, 3:53 PM

#

hi everybody. Somebody here for the CC: Ghidra. I'm stuck at task 4, the second question. I have all the other but can't find this one. Thank you!!!

placid drift Jun 12, 2020, 4:05 PM

#

hello guys, im a bit stuck doing "agent sudo"

#

📎 unknown.png

#

im currently trying to complete "steg password" task

white salmon Jun 12, 2020, 4:08 PM

#

Explain a little what's going on there please.

ripe hedge Jun 12, 2020, 4:11 PM

#

oh that one

placid drift Jun 12, 2020, 4:11 PM

#

i used binwalk to extract the image

#

which outputs a zip

#

extracted the inside with john

ripe hedge Jun 12, 2020, 4:14 PM

#

sounds about right

white salmon Jun 12, 2020, 4:14 PM

#

ok.

#

and what's in there?

#

that text

#

?

placid drift Jun 12, 2020, 4:14 PM

#

the pass

#

for the zip file

white salmon Jun 12, 2020, 4:15 PM

#

hnmm...

ripe hedge Jun 12, 2020, 4:15 PM

#

ah

#

there's stuff that can crack those

white salmon Jun 12, 2020, 4:15 PM

#

sooo, how r u gonna crack it?

placid drift Jun 12, 2020, 4:15 PM

#

oh wait

ripe hedge Jun 12, 2020, 4:15 PM

#

I think john can

white salmon Jun 12, 2020, 4:15 PM

#

use hashcat maybe.. if you have a good gpu.

placid drift Jun 12, 2020, 4:17 PM

#

i figured it out, thanks

#

try harder

white salmon Jun 12, 2020, 4:17 PM

#

nice!

solar sage Jun 12, 2020, 5:12 PM

#

Any hint about Mindgames?

tidal sedge Jun 12, 2020, 5:13 PM

#

try harder 😉

solar sage Jun 12, 2020, 5:14 PM

#

tru

grim belfry Jun 12, 2020, 5:15 PM

#

cri

bitter shadow Jun 12, 2020, 6:13 PM

#

any robots around here?

#

https://tryhackme.com/room/ctfcollectionvol1

TryHackMe

TryHackMe | CTF collection Vol.1

Sharpening up your CTF skill with the collection. The first volume is designed for beginner.

#

task 17

#

literally can't hear a thing

#

Any hint about Mindgames?
@solar sage yeaaaa goodluck

white salmon Jun 12, 2020, 8:37 PM

#

Carpe Diem supposed to be the weekly challenge?

tranquil dagger Jun 12, 2020, 8:38 PM

#

Wondering the same thing, since I don't see anything on /releases

white salmon Jun 12, 2020, 8:40 PM

#

me neither

#

i would ping aadmin /mod but don't wanna get yelled at

inland onyx Jun 12, 2020, 8:41 PM

#

@normal peak Carpe Diem meant to be on releases?

normal peak Jun 12, 2020, 8:42 PM

#

@normal peak Carpe Diem meant to be on releases?
@inland onyx I didn't release the machine today

white salmon Jun 12, 2020, 8:42 PM

#

also been 2 days.... looking for someone who wants to put up that sweet sweet writeup for mindgames 😄 (or just talk me through what the heck i am missing on the esk)

normal peak Jun 12, 2020, 8:42 PM

#

@tacit roost will know more about it:)

inland onyx Jun 12, 2020, 8:42 PM

#

Ahh, fair enough 😄

#

Is that not automatic?

tacit roost Jun 12, 2020, 8:42 PM

#

Didn't add it to releases

#

Will add it shortly

#

Auto release coming next week :))

sacred lynx Jun 12, 2020, 11:32 PM

#

anyone for carp diem ?

inland onyx Jun 12, 2020, 11:37 PM

#

@sacred lynx top tip: it's uncommon for anyone to give hints for really new boxes. Best waiting a few days until the competition has died down.

sacred lynx Jun 12, 2020, 11:38 PM

#

now just weirdo behavior .. just want to confirm

white salmon Jun 13, 2020, 12:37 AM

#

||dcode.fr has a bad text2bf|| took me some time to realize

sacred lynx Jun 13, 2020, 1:05 AM

#

@inland onyx Figured out .. fresh mashin will help 😉

shrewd verge Jun 13, 2020, 2:47 AM

#

any recommended subs domain fuzzer? for cmess room

#

ermmm need better wordlist.. i will try first

patent token Jun 13, 2020, 3:19 AM

#

wfuzz works well enough.

shrewd verge Jun 13, 2020, 5:10 AM

#

yea i used wfuzz.. been using gobuster but something wrong

white salmon Jun 13, 2020, 8:02 AM

#

Hi!

#

I'm on the EternalBlue room, the exploit keeps failing ,what am I supposed to do, I tried restarting the machine.

wraith marsh Jun 13, 2020, 8:10 AM

#

Make sure the ip/port is correct, your vpn is working fine and you’re using the correct exploit for external blue otherwise it could just be eternalblue being eternal blue in which chase just keep trying,

steady stratus Jun 13, 2020, 8:10 AM

#

this ^

white salmon Jun 13, 2020, 8:10 AM

#

Then I suppose It's the eternal blue being weird..

wraith marsh Jun 13, 2020, 8:11 AM

#

Eternal blue is unreliable. Just reset the box and try again 🙂

white salmon Jun 13, 2020, 8:11 AM

#

I restared the machine again, now I'm rescanning to make sure everything's fine.

steady stratus Jun 13, 2020, 8:12 AM

#

👍 it's a windows box so give it closer towards 5 minutes before sending the payload too

wraith marsh Jun 13, 2020, 8:12 AM

#

Also there’s a few different exploits in Metasploit for eternal blue make sure you’ve selected the correct one

white salmon Jun 13, 2020, 8:12 AM

#

Yep. The first time I waited like 15 mins.

#

I have, JB.

steady stratus Jun 13, 2020, 8:16 AM

#

Let's give it a quick go again

#

Is it just not executing or are you not getting a reverse shell?

white salmon Jun 13, 2020, 8:17 AM

#

I did like 5 seconds ago, when 'triggering free of corrupted buffer' it fails.

#

It is not successfully executing , it fails at that point.

#

📎 EternalBlue_TryHackMe.png

#

It's the second restart...

glossy basin Jun 13, 2020, 8:19 AM

#

try again

#

took me 5 times to get it back in the days

white salmon Jun 13, 2020, 8:19 AM

#

😦

glossy basin Jun 13, 2020, 8:19 AM

#

it's not TryHackMe's fault actually

#

the thing is unstable by itself

steady stratus Jun 13, 2020, 8:20 AM

#

It's really 50/50

white salmon Jun 13, 2020, 8:20 AM

#

it's not TryHackMe's fault actually
@glossy basin Yea, I know..

wraith marsh Jun 13, 2020, 8:20 AM

#

Although it’s definitely unstable, the only time I’ve ever gotten a fail is when I tried popping a meter-Peter shell kekw

glossy basin Jun 13, 2020, 8:20 AM

#

It's really 50/50
fair enough

#

can we fix it? i don't think we can actually

#

Dark would have done it already

steady stratus Jun 13, 2020, 8:21 AM

#

Nah

white salmon Jun 13, 2020, 8:21 AM

#

I saw that @alpine kelp video on EternalBlue, also took him some time.

steady stratus Jun 13, 2020, 8:21 AM

#

It's with how the exploit works

glossy basin Jun 13, 2020, 8:21 AM

#

yeah

steady stratus Jun 13, 2020, 8:21 AM

#

or doesn't I guess kekw

wraith marsh Jun 13, 2020, 8:21 AM

#

kekw

white salmon Jun 13, 2020, 8:21 AM

#

oof

sweet socket Jun 13, 2020, 8:21 AM

#

@white salmon whenever ol eternal blue isnt wanting to play nice, i just close metasploit and relaunch it and i feel i have better luck with it

white salmon Jun 13, 2020, 8:21 AM

#

@sweet socket I'll try that.

sweet socket Jun 13, 2020, 8:21 AM

#

i may just be dumb and wasting more time doing it but i havent had to try more than twice doing it

white salmon Jun 13, 2020, 8:22 AM

#

I mean, I know how to do it, but it's annoying

sweet socket Jun 13, 2020, 8:22 AM

#

its so much fun seeing that "C:(L)Users\ " prompt pop up though

#

i think the hack came from the NSA too or at least was based off an NSA hack that was leaked/sold online

white salmon Jun 13, 2020, 8:24 AM

#

NotLikeThis

#

I was so disappointed by the Mr.Robot ending.

#

They ruined the show in 2 episodes.

sweet socket Jun 13, 2020, 8:25 AM

#

i still havent even finished season 2

white salmon Jun 13, 2020, 8:25 AM

#

Oh, then you'll love it until the end.

#

The show literally got me 'OH WOW THIS IS SO REALISTIC!'.

#

'HE DOESN'T HAVE A HACKER THEME AND A MATRIX SCREEEN WWOOOOOOW'.

sweet socket Jun 13, 2020, 8:26 AM

#

im a bit more partial to the movie 'Hackers', this scene is much more accurate than anything in mr.robot

#

https://www.youtube.com/watch?v=IiX09kiodfs

YouTube

reconelement

Hackers - OTV Battle

Dade Murphy (Jonny Lee Miller) fights with "Acid Burn" over OTV programming.

▶ Play video

#

pls no ban me if we cant post dumb videos in here

steady stratus Jun 13, 2020, 8:27 AM

#

It's okay as long as they're a) PG-13 and b) in #general (:

white salmon Jun 13, 2020, 8:27 AM

#

btw, the exploit is still failing after every thing I redid.

steady stratus Jun 13, 2020, 8:27 AM

#

Hackers is sick though

white salmon Jun 13, 2020, 8:27 AM

#

The most realistic is Hacker 2016.

#

With that carder kid.

steady stratus Jun 13, 2020, 8:27 AM

#

I'm just trying and I've done it three times in a row with the THM Kali (not able to use mine atm)

white salmon Jun 13, 2020, 8:28 AM

#

Oh.

#

Damn.

#

I keeps failing...

steady stratus Jun 13, 2020, 8:28 AM

#

I have an idea hang on

#

I take it you're not subscribed given your role (or lack of I guess)?

white salmon Jun 13, 2020, 8:28 AM

#

No. I'm Not.

#

I want to, but I'll probably subscribe later, when i feel like It will be necessary.

steady stratus Jun 13, 2020, 8:29 AM

#

okies ty

#

of course (: plenty of free content too

white salmon Jun 13, 2020, 8:29 AM

#

Exactly.

sweet socket Jun 13, 2020, 8:29 AM

#

can i get an elevated role here if im subbed?

steady stratus Jun 13, 2020, 8:30 AM

#

DM the bot with your discord token from your THM profile in the "Other" tab @sweet socket

#

It'll sync your THM profile w/ your Discord

sweet socket Jun 13, 2020, 8:30 AM

#

thx m8, saving people like me from reading the instructions everywhere

white salmon Jun 13, 2020, 8:31 AM

#

Stupid exploit, I'll try later..

steady stratus Jun 13, 2020, 8:31 AM

#

Mhm yeah I can do it okay on my non-sub @white salmon I can only suggest confirming settings (which looked right)

#

Try this too

#

!multivpn

proud scarabBOT Jun 13, 2020, 8:31 AM

#

TryHackMe

• Step 1

Type ps aux | grep openvpn into your terminal and press enter

• Step 2

If there's more than one line (and the second doesn't have "grep" in it), do the following steps

• Step 3

Type killall openvpn into your terminal and press enter

• Step 4

Start the VPN with sudo openvpn <path-to-config>

white salmon Jun 13, 2020, 8:32 AM

#

Ok, gotta go, thanks for the tips.

steady stratus Jun 13, 2020, 8:32 AM

#

👍 hopefully it works next time around

teal hull Jun 13, 2020, 8:40 AM

#

hey guys i'm stuck on Blue Room at Task 4 #2

#

i dont know how to crack it

#

some1 can help me?

white salmon Jun 13, 2020, 8:55 AM

#

rooted mindgames, very good box, kudos to @stuck fractal

teal hull Jun 13, 2020, 8:56 AM

#

@steady stratus can u help me?

spiral stag Jun 13, 2020, 8:57 AM

#

@teal hull just ask the question, no need to ping people

teal hull Jun 13, 2020, 8:57 AM

#

hey guys i'm stuck on Blue Room at Task 4 #2
i dont know how to crack it
some1 can help me?

spiral stag Jun 13, 2020, 8:57 AM

#

what is the issue?

teal hull Jun 13, 2020, 8:58 AM

#

i dont know how to crack it

spiral stag Jun 13, 2020, 8:59 AM

#

do you know about password crackers?

teal hull Jun 13, 2020, 8:59 AM

#

???

#

man i'm not idiot i know that i can hack it but i dont know how to hack

spiral stag Jun 13, 2020, 8:59 AM

#

so task 1 is done?

#

you have the hashes

teal hull Jun 13, 2020, 9:00 AM

#

yes

spiral stag Jun 13, 2020, 9:00 AM

#

google hashdump meterpreter

#

our friend john should be able to help 😉

teal hull Jun 13, 2020, 9:04 AM

#

@spiral stag the hint of the task is: use ur rockyou.txt file

spiral stag Jun 13, 2020, 9:05 AM

#

yes

#

kali should come with that wordlist

teal hull Jun 13, 2020, 9:05 AM

#

i got it

#

i got that file

#

@spiral stag it says: No password hashes loaded (see FAQ)

#

wait

spiral stag Jun 13, 2020, 9:14 AM

#

:3

teal hull Jun 13, 2020, 9:15 AM

#

now i got problem with the directory

#

😠

#

why this doesn't work?

#

/home/ricky/Scaricati/psw

spiral stag Jun 13, 2020, 9:17 AM

#

“¯_(ツ)_/¯“

#

you copied the hashes into the psw file?

teal hull Jun 13, 2020, 9:18 AM

#

yes

#

i think

#

🤔

#

i've pasted them now

#

but i got error

#

it says: File or Directory not existing

spiral stag Jun 13, 2020, 9:21 AM

#

then you are missing something somewhere

#

are you using kali?

teal hull Jun 13, 2020, 9:22 AM

#

yes

#

now osrry

#

wait

#

i did an error

#

lmao

#

f

#

i did an error

#

i says go to the download

#

and now desktop

#

f

#

thx

spiral stag Jun 13, 2020, 9:25 AM

#

:3

teal hull Jun 13, 2020, 9:37 AM

#

guys i need help i'm on the blue room task 5 i need to find 3 flags but i don't know where to start, i've searched but nothing

#

@spiral stag can u help me?

spiral stag Jun 13, 2020, 9:43 AM

#

you are admin on the machine?

teal hull Jun 13, 2020, 9:43 AM

#

yes

spiral stag Jun 13, 2020, 9:43 AM

#

then start looking at documents :3

teal hull Jun 13, 2020, 9:43 AM

#

.doc?

teal hull Jun 13, 2020, 10:46 AM

#

then start looking at documents :3
@spiral stag i've tried but i got nothing

white salmon Jun 13, 2020, 10:55 AM

#

do 'man john'.

#

check that manual if you don't know how to use john.

teal hull Jun 13, 2020, 10:55 AM

#

taling with me?

white salmon Jun 13, 2020, 10:55 AM

#

Yes!

teal hull Jun 13, 2020, 10:56 AM

#

in meterpreter?

white salmon Jun 13, 2020, 10:56 AM

#

In Your terminal!

#

do you use linux on your computer?

teal hull Jun 13, 2020, 10:57 AM

#

kali

white salmon Jun 13, 2020, 10:57 AM

#

good!

#

open terminal, type 'man john'.

teal hull Jun 13, 2020, 10:57 AM

#

ok wait i gotta go

white salmon Jun 13, 2020, 10:57 AM

#

and you will see the manual for John.

teal hull Jun 13, 2020, 10:57 AM

#

se u asap

white salmon Jun 13, 2020, 10:57 AM

#

ok.

#

I'm working on The Blue room too, but I'm having issues with the exploit.

#

@steady stratus Btw, still having those stupid issues...

#

It's still failing.

#

Stupid EternalBlue ain't working.

#

📎 EternalBlue_TryHackMe.png

eternal brook Jun 13, 2020, 11:18 AM

#

hey I'm on skynet I got a log.txt file with a list of password i tried brute forcing it with username miles

#

but got a lsit of valid password that aint logging in with

white salmon Jun 13, 2020, 11:19 AM

#

3 Restarts of the machine, and msfupdate.

#

try decrypting again,

#

could be 2x ecrypted.

#

or you got the wrong encryption. (very less likely.).

eternal brook Jun 13, 2020, 11:20 AM

#

its plain text

#

the log file

white salmon Jun 13, 2020, 11:20 AM

#

can you send a screenshot?

eternal brook Jun 13, 2020, 11:24 AM

#

📎 Screenshot_from_2020-06-13_16-51-37.png

#

📎 Screenshot_from_2020-06-13_16-54-31.png

#

this the log file i found from smb

#

tried brute forcing with username mile and it returned these many pass .....but whne i tried to login it did not work

gaunt herald Jun 13, 2020, 11:26 AM

#

Look at what url it's attacking, I've got the same problem on other room
Maybe the hydra room could help a bit
Sorry, Swafox. I've helped once more in the hints channel (I'll ensure next time won't happen) :)

eternal brook Jun 13, 2020, 11:29 AM

#

ok thanks mate i check it

teal hull Jun 13, 2020, 11:31 AM

#

I'm working on The Blue room too, but I'm having issues with the exploit.
@white salmon where is the problem

white salmon Jun 13, 2020, 11:32 AM

#

I sent a screenshot.

teal hull Jun 13, 2020, 11:32 AM

#

re send

white salmon Jun 13, 2020, 11:32 AM

#

📎 EternalBlue_TryHackMe.png

teal hull Jun 13, 2020, 11:33 AM

#

did u fill up everything

#

in show options

#

the RHOST

#

and stuffs

#

r u connected to the vpn

#

?

#

@white salmon

gaunt herald Jun 13, 2020, 11:35 AM

#

He could nmap the machine so yeah

white salmon Jun 13, 2020, 11:35 AM

#

yes!

#

That's why I send also the nmap scan so you can see!

teal hull Jun 13, 2020, 11:36 AM

#

type sessions

#

in mfsconsole

#

and check if he creted session

#

no he dont

#

@white salmon db_nmap it

#

and then load the exploit and set stuffs

white salmon Jun 13, 2020, 11:37 AM

#

I did!

#

Can't you see in the screenshot..? 😫

#

It connects to target!

#

But the exploit fails at a point.

teal hull Jun 13, 2020, 11:38 AM

#

mmm

#

i got fails too

#

i've just waited

#

the machine still on?

white salmon Jun 13, 2020, 11:40 AM

#

yep.

teal hull Jun 13, 2020, 11:41 AM

#

have u tried change exploit?

white salmon Jun 13, 2020, 11:42 AM

#

what else should I use?

#

the windows 8 version?

teal hull Jun 13, 2020, 11:42 AM

#

let me check

white salmon Jun 13, 2020, 11:44 AM

#

The Win8 one is not working.

teal hull Jun 13, 2020, 11:44 AM

#

normal

#

its a wind 7

white salmon Jun 13, 2020, 11:45 AM

#

Sooo, I'll just quit it..

teal hull Jun 13, 2020, 11:45 AM

#

exploit/windows/smb/ms17_010_eternalblue did u tried this one?

#

@white salmon

white salmon Jun 13, 2020, 11:46 AM

#

that's what I'm using man!

#

ohh... goddd...

#

@steady stratus still not working...

teal hull Jun 13, 2020, 11:47 AM

#

payload/generic/shell_reverse_tcp i've got this payload on try with this

white salmon Jun 13, 2020, 11:47 AM

#

...

teal hull Jun 13, 2020, 11:47 AM

#

i don't think this will change

wraith marsh Jun 13, 2020, 11:47 AM

#

@white salmon I will have ago at it myself now see if It works, send me a picture of your msf options

white salmon Jun 13, 2020, 11:47 AM

#

I need to exploit the machine using 'exploit/windows/smb/ms17_010_eternalblue '/

#

📎 EternalBlue_Metasploit.png

teal hull Jun 13, 2020, 11:50 AM

#

try to unload the payload

wraith marsh Jun 13, 2020, 11:51 AM

#

don't use meterpreter payload

#

I could never get a shell with it

#

try setting the payload to generic/shell_reverse_tcp

#

that's what it is default, and I just popped a shell first attempt with it.

teal hull Jun 13, 2020, 11:53 AM

#

@wraith marsh can u help me? i got problem in the blue room task 5

#

i dont know where to start

white salmon Jun 13, 2020, 11:53 AM

#

I hit run. Brb.

wraith marsh Jun 13, 2020, 11:53 AM

#

@teal hull Did you check the hint?

teal hull Jun 13, 2020, 11:54 AM

#

yes but i don't understand it

#

my first time idk where to put hands on

wraith marsh Jun 13, 2020, 11:54 AM

#

which flag?

#

flag1?

teal hull Jun 13, 2020, 11:54 AM

#

yes

wraith marsh Jun 13, 2020, 11:54 AM

#

Okay, so the hint is can you C it?

#

Where would you find C on a windows machine 😉

teal hull Jun 13, 2020, 11:55 AM

#

main disk?

white salmon Jun 13, 2020, 11:55 AM

#

yep.

#

@wraith marsh exploit still not working.

#

Failing at the same step.

wraith marsh Jun 13, 2020, 11:56 AM

#

Did you try resetting the box?

white salmon Jun 13, 2020, 11:56 AM

#

Even with your reverse_tcp.

#

3 times.

wraith marsh Jun 13, 2020, 11:56 AM

#

and then do it again with generic reverse tcp

white salmon Jun 13, 2020, 11:57 AM

#

Restarting now.

#

Exploiting again now.

#

Still failing...

#

I'm so angryyy...

teal hull Jun 13, 2020, 12:02 PM

#

@wraith marsh i found the 1st and 2nd flags, but i'm checking manually

white salmon Jun 13, 2020, 12:04 PM

#

Just new to TryHackMe and I run into these stupid issues.

teal hull Jun 13, 2020, 12:04 PM

#

oww

#

i find all of THEM

white salmon Jun 13, 2020, 12:04 PM

#

nice!

teal hull Jun 13, 2020, 12:04 PM

#

freaking retarted i'm

white salmon Jun 13, 2020, 12:05 PM

#

I'll make a Kali VM and try over there again,

#

oh..

teal hull Jun 13, 2020, 12:05 PM

#

@white salmon wait 5-10 minuts and try again

white salmon Jun 13, 2020, 12:05 PM

#

Yea..

teal hull Jun 13, 2020, 12:05 PM

#

or

#

terminate and restart the machine

white salmon Jun 13, 2020, 12:06 PM

#

Yey, the fifth time.

wraith marsh Jun 13, 2020, 12:06 PM

#

Still not working?

white salmon Jun 13, 2020, 12:06 PM

#

Nope...

wraith marsh Jun 13, 2020, 12:06 PM

#

Hmm

teal hull Jun 13, 2020, 12:06 PM

#

terminate and restart the machine
@teal hull did u tried this?

white salmon Jun 13, 2020, 12:07 PM

#

5 times.

teal hull Jun 13, 2020, 12:07 PM

#

do u got anydesk

#

?

white salmon Jun 13, 2020, 12:08 PM

#

?

#

what?

teal hull Jun 13, 2020, 12:08 PM

#

anydesk is a software like teamviewer

white salmon Jun 13, 2020, 12:08 PM

#

ok, and?

#

you want me to give u teamviewer access?

#

hahah.

#

nice one...

teal hull Jun 13, 2020, 12:09 PM

#

no non on

#

i want to help u

#

cause for me work

#

and not for u

#

did u change the ip when restart the machine?

white salmon Jun 13, 2020, 12:10 PM

#

Yessssssssssssss!

#

I didd.

teal hull Jun 13, 2020, 12:11 PM

#

restarte ur pc.. 😂

white salmon Jun 13, 2020, 12:15 PM

#

Believe it or not, I did.

teal hull Jun 13, 2020, 12:21 PM

#

@wraith marsh i found the flags but how to open it?

white salmon Jun 13, 2020, 12:23 PM

#

I'm in a Kali VM exploiting Again...

#

Nope

#

Not working..

#

Been trying since this morning..

#

https://www.youtube.com/watch?v=IiX09kiodfs
@sweet socket favorite part of that scene is when he types "mess with thebest die like the rest" yet he types it at like ... 3 words per minute.. actually the whole thing he types at like 3 words a minute

YouTube

reconelement

Hackers - OTV Battle

Dade Murphy (Jonny Lee Miller) fights with "Acid Burn" over OTV programming.

▶ Play video

woven sentinel Jun 13, 2020, 2:03 PM

#

Hi did anyone tried the Volatility room? Can't seem to find the type of malware in the report.

white salmon Jun 13, 2020, 2:05 PM

#

Damn I love that reference.

#

You a fan of Breaking Bad too?

lean vector Jun 13, 2020, 2:25 PM

#

Hey, guys. Can someone give me a small nudge about Wonderland? Can I privesc from rabbit to hatter without knowledge of reverse engineering and low level exploitation?

inland onyx Jun 13, 2020, 2:30 PM

#

You can, yes

#

Look closely at what the script is actually doing

#

strings is enough to exploit it -- no advanced RE required

white salmon Jun 13, 2020, 2:54 PM

#

Can I get a quick tip on LazyAdmin Room?

inland onyx Jun 13, 2020, 2:54 PM

#

Best just asking 🙂

white salmon Jun 13, 2020, 2:55 PM

#

?

inland onyx Jun 13, 2020, 2:55 PM

#

As in, what exactly are you stuck with

white salmon Jun 13, 2020, 2:59 PM

#

Oh I just started and I'm a little confused where to start..

buoyant hatch Jun 13, 2020, 2:59 PM

#

hy guys. any hint for ignite room 🙂 i am noob on PE.

white salmon Jun 13, 2020, 3:00 PM

#

Rn I'm running hydra and dirb on the IP.

buoyant hatch Jun 13, 2020, 3:00 PM

#

hy i have done lazyadmin, where are you stuck?

white salmon Jun 13, 2020, 3:01 PM

#

nmap says it's down..

#

but the apache web works.

#

and now I'm running hydra on ssh and dirb on apache.

#

but they also say it's down.

buoyant hatch Jun 13, 2020, 3:02 PM

#

is your vpn working?

white salmon Jun 13, 2020, 3:02 PM

#

yep.

#

maybe your machine terminated and 1 hour has passed?

#

nope.

#

the apache web works.

#

nmap with -Pn works.

#

but hydra and dirb nope.

buoyant hatch Jun 13, 2020, 3:03 PM

#

@inland onyx may can help

#

I need help in Ignite 😦

white salmon Jun 13, 2020, 3:09 PM

#

@buoyant hatch where are you stuck?

#

Still says it's downn....

buoyant hatch Jun 13, 2020, 3:10 PM

#

I am noob on PE, so idk how to get root access there. Can you give me hint for that?

#

I already got user flag

white salmon Jun 13, 2020, 3:13 PM

#

Oh.

#

Escalate privilages.

#

do 'sudo -l'.

#

to see what you can do.

#

as a user.

#

and go from there.

#

search in files you will probably find something interestring

buoyant hatch Jun 13, 2020, 3:13 PM

#

@white salmon try restarting your room

white salmon Jun 13, 2020, 3:13 PM

#

also check out Linux Privesc Playground.

buoyant hatch Jun 13, 2020, 3:13 PM

#

sudo -l is empty haha

#

sure

white salmon Jun 13, 2020, 3:14 PM

#

@white salmon try restarting your room
@buoyant hatch It's ok now.

plush estuary Jun 13, 2020, 3:14 PM

#

PE is basically just doing recon as a user instead of no user

white salmon Jun 13, 2020, 3:14 PM

#

if it is empty check files.

buoyant hatch Jun 13, 2020, 3:14 PM

#

@plush estuary Thanks 🙂

white salmon Jun 13, 2020, 3:14 PM

#

use find and grep to see all the files you have access to.

buoyant hatch Jun 13, 2020, 3:14 PM

#

@white salmon Thanks Myan

plush estuary Jun 13, 2020, 3:15 PM

#

My tip is to find out-of date software and misconfigured binary

white salmon Jun 13, 2020, 3:15 PM

#

I like The Linux Privesc Playground Room, it has like 80 ways to escalate.

#

wtf is that carpe-diem room? Congrats on the guy that made it

#

the stupid target machine on LazyAdmin keeps crashing.....

eternal brook Jun 13, 2020, 3:22 PM

#

any hints for hidden directory in skynet

#

cant find anything that matches answers using dirbuster

white salmon Jun 13, 2020, 3:23 PM

#

gobuster also check.

eternal brook Jun 13, 2020, 3:24 PM

#

it not syuirrelmail right?

white salmon Jun 13, 2020, 3:24 PM

#

also use your brain, I mean check for words on the website that might be the names.

eternal brook Jun 13, 2020, 3:24 PM

#

i tried gobuster too

white salmon Jun 13, 2020, 3:24 PM

#

There was the HackThisSite Level 11 Basic.

#

That had the name Elton on the website.

eternal brook Jun 13, 2020, 3:25 PM

#

i have done hackthissite ill refer

#

thnaks

white salmon Jun 13, 2020, 3:25 PM

#

And you had to do like http://8.8.8.8/e/l/t/o/n/.

eternal brook Jun 13, 2020, 3:25 PM

#

ohhhhh

#

thanks mate

white salmon Jun 13, 2020, 3:27 PM

#

You got it?

eternal brook Jun 13, 2020, 3:27 PM

#

trying

white salmon Jun 13, 2020, 3:28 PM

#

You gave me an idea, rn I'm making my own dirbuster,

#

sooo.. yep.

#

I already made a request handler in python.

buoyant hatch Jun 13, 2020, 3:28 PM

#

Thanks Guys, I am done with that room

white salmon Jun 13, 2020, 3:28 PM

#

so like now I go for dirb.

#

@buoyant hatch how did you escalate?

buoyant hatch Jun 13, 2020, 3:30 PM

#

there was a file which gave me credential of root

white salmon Jun 13, 2020, 3:31 PM

#

oh, so easy.

buoyant hatch Jun 13, 2020, 3:31 PM

#

Lesson: Never ignore any text LMAO

white salmon Jun 13, 2020, 3:31 PM

#

also check out that Linux Privesc Room.

#

@buoyant hatch yea lol :).

buoyant hatch Jun 13, 2020, 3:31 PM

#

sure bro

burnt cosmos Jun 13, 2020, 3:31 PM

#

^^^^

white salmon Jun 13, 2020, 3:32 PM

#

I found 3 ways to leak the flag.

buoyant hatch Jun 13, 2020, 3:32 PM

#

cool

#

you doing Lazyadmin?

white salmon Jun 13, 2020, 3:32 PM

#

The machine is unstable.

#

I'm working on a directory buster in python.

#

I like making my own tools, it's cool.

tidal sedge Jun 13, 2020, 3:33 PM

#

blobhuh

white salmon Jun 13, 2020, 3:34 PM

#

?

obsidian cradle Jun 13, 2020, 4:40 PM

#

have been putting off daily bugle for awhile because i am not a fan of SQLi, but went to do it and tried using ||the joomblah.py script|| but it errors out (issue posted on github but not fixed). anyone have an idea on how long ||sqlmap|| will take to || enumerate the db||??

eternal brook Jun 13, 2020, 4:52 PM

#

Password: )s{A&2Z=F^n_E.B` i think password is encrypted can anyone tell how to decrypt it

#

any hints

white salmon Jun 13, 2020, 4:55 PM

#

have you tried to use it as it is?

eternal brook Jun 13, 2020, 4:55 PM

#

it did not work

#

i tried

#

it clearly says this is the password so i think it might be encrpyted

white salmon Jun 13, 2020, 4:56 PM

#

what room is that from?

eternal brook Jun 13, 2020, 4:56 PM

#

skynet

#

from the mail

#

smb password

trim arch Jun 13, 2020, 4:56 PM

#

That looks right. You should delete that line.

white salmon Jun 13, 2020, 4:57 PM

#

saves password *

trim arch Jun 13, 2020, 4:57 PM

#

lol

#

It isn't encrypted

#

You probably aren't using the correct username

eternal brook Jun 13, 2020, 4:58 PM

#

milesdyson is the only possible samba share available

#

i tried that pass on it only

#

i also found a binary file has it something to with this?

oblique cliff Jun 13, 2020, 5:08 PM

#

@eternal brook that password is not encrypted

#

@obsidian cradle try using the other python version. The script works for me. Sqlmap if doing time based sqli takes about an hour for me

#

On that room

#

@eternal brook you’re just getting the username wrong or using the password somewhere incorrectly. But that password is definitely correct

obsidian cradle Jun 13, 2020, 5:11 PM

#

@obsidian cradle try using the other python version. The script works for me. Sqlmap if doing time based sqli takes about an hour for me
@oblique cliff what do you mean other python version?

#

i tried with python 3.8/3.7/3.5

oblique cliff Jun 13, 2020, 5:11 PM

#

So try with python 2

obsidian cradle Jun 13, 2020, 5:11 PM

#

its not written in python2

oblique cliff Jun 13, 2020, 5:13 PM

#

What’s the error you’re getting?

obsidian cradle Jun 13, 2020, 5:13 PM

#

traceback and type error

#

File "joomblah.py", line 186, in
sys.exit(main("http://IP:8080/joomla"))
File "joomblah.py", line 183, in main
pwn_joomla_again(options)
File "joomblah.py", line 147, in pwn_joomla_again
tables = extract_joomla_tables(options, sess, token)
File "joomblah.py", line 74, in extract_joomla_tables
result = joomla_370_sqli_extract(options, sess, token, "TABLE_NAME", "FROM information_schema.tables WHERE TABLE_NAME LIKE 0x257573657273 LIMIT " + str(offset) + ",1" )
File "joomblah.py", line 46, in joomla_370_sqli_extract
result += value
TypeError: can only concatenate str (not "bytes") to str```

#

thats not my error btw thats pulledd from github

#

but it is the same thing pre much

oblique cliff Jun 13, 2020, 5:14 PM

#

Can you humor me and try it with python 2

trim arch Jun 13, 2020, 5:15 PM

#

It worked with python 2 for me

obsidian cradle Jun 13, 2020, 5:15 PM

#

hmm maybe something wrong w my brain gimme sec

eternal brook Jun 13, 2020, 5:35 PM

#

smbclient //10.10.112.151/milesdyson im using this to login i also tried ssh but its not working @oblique cliff

#

it says access denied

trim arch Jun 13, 2020, 5:40 PM

#

2 tips....man page and delete or obfuscate spoilers

#

Where is @minor bough discord channel? The room says "DM me in my discord channel" but I don't see a dark discord channel.

minor bough Jun 13, 2020, 5:42 PM

#

Which room?

trim arch Jun 13, 2020, 5:44 PM

#

CTF100

minor bough Jun 13, 2020, 5:45 PM

#

I'm not responsible for that room, I believe it was created Deskel

trim arch Jun 13, 2020, 5:45 PM

#

Opps, sorry

minor bough Jun 13, 2020, 5:45 PM

#

I have no clue with regards to his discord channel

#

all good

wooden mist Jun 13, 2020, 5:45 PM

#

probably meant private messages

minor bough Jun 13, 2020, 5:45 PM

#

Yeah

#

Deskel isn't active much anymore so it's going to be hard to get ahold of them

trim arch Jun 13, 2020, 5:45 PM

#

Oh yeah, my bad. For some reason, I thought it was your creation.

minor bough Jun 13, 2020, 5:46 PM

#

No worries

wooden mist Jun 13, 2020, 5:46 PM

#

If you need any help just ask here or in #room-help as Deskel went offline few months back

trim arch Jun 13, 2020, 5:47 PM

#

Ok, will do. Thanks!

white salmon Jun 13, 2020, 5:57 PM

#

any hint for python_playground after i login? i have no idea what to do :/

spiral stag Jun 13, 2020, 5:59 PM

#

what flag?

#

@white salmon

white salmon Jun 13, 2020, 6:00 PM

#

the first one

#

i can see that i can read every file in the system but i can't find any flag

spiral stag Jun 13, 2020, 6:01 PM

#

there should be a user.txt

white salmon Jun 13, 2020, 6:02 PM

#

nothing man

#

dont know where that file is