#room-hints | TryHackMe | Page 33

white salmon Jun 13, 2020, 6:03 PM

#

i tried every possible directory

spiral stag Jun 13, 2020, 6:04 PM

#

did you look in ||/root||

white salmon Jun 13, 2020, 6:04 PM

#

yes

#

there is nothing

#

maybe someone deleted it?

#

i have no idea

spiral stag Jun 13, 2020, 6:05 PM

#

then try to restart the box maybe

#

it should be there

white salmon Jun 13, 2020, 6:05 PM

#

Just got on, what room?

#

python_playground

#

ok im restarting it

#

@spiral stag no man still no file

spiral stag Jun 13, 2020, 6:11 PM

#

what user are you?

#

on the box?

white salmon Jun 13, 2020, 6:13 PM

#

i'm connected as connor on the website

#

but i can read every file like /etc/shadow so i don't know why i cant find user.txt

spiral stag Jun 13, 2020, 6:13 PM

#

:3

#

you need to get a shell on the system

white salmon Jun 13, 2020, 6:14 PM

#

thought there was no need since every import comes with an error 😛

#

ok then i'll try to get a shell

spiral stag Jun 13, 2020, 6:14 PM

#

good luck 🙂

white salmon Jun 13, 2020, 6:15 PM

#

thanks man

#

ok got a shell that was easy 😛

spiral stag Jun 13, 2020, 6:22 PM

#

:3

white salmon Jun 13, 2020, 6:24 PM

#

so i got user access in wonderland but might use a hint on moving forward, can't seem to move or replace that interesting file in home dir

#

read the python file carefully every line matters 😉

#

ok thanks

oblique cliff Jun 13, 2020, 6:35 PM

#

@eternal brook try with backslashes: \\\\ip\\share

white salmon Jun 13, 2020, 6:36 PM

#

doesn't make much sense still...

crystal aurora Jun 13, 2020, 6:37 PM

#

Which image shows a legit web-page? "anybody ?"

white salmon Jun 13, 2020, 6:41 PM

#

@spiral stag i've found 2 flags any help with the privilege escalation?

#

i hate poems lol

#

Can any1 help me off-topic with a python script?

#

I've been googling for hours without success..

#

Index out of range at ' url = ... '.

📎 Dirby_Issue.png

#

Trynna Make a fuzzer.

#

you need to read from the file first

#

also you don't need to loop throught the file content every time

#

>>> with open('/usr/share/wordlists/dirb/common.txt','r') as f:
...     print(f)
... 
<_io.TextIOWrapper name='/usr/share/wordlists/dirb/common.txt' mode='r' encoding='UTF-8'>

#

what is the TextIOWrapper..?

tranquil dagger Jun 13, 2020, 6:55 PM

#

The file object returned from the call to open()

#

https://docs.python.org/3/library/functions.html#open

white salmon Jun 13, 2020, 6:58 PM

#

📎 Dirby_Issue.png

#

📎 Dirby_TextIO.png

#

I'm probably not getting it...

#

I already made a request handler, that will actually be a part of the fuzzer.

#

github.com/Kurisutii/Webby.

#

And that works perfectly, it was done in like 1 hour but this one is weird..

#

you need to read the file, something like wordlist.read()

#

hm...

#

I tought that it was cool making ya own tools, but it's so frustratiingggggg!

eternal brook Jun 13, 2020, 7:09 PM

#

@eternal brook try with backslashes: \\\\ip\\share
@oblique cliff i tried it still doest work i tried various combination both the slashes the passwaord including the space without includeing the space[password: ()s{A&2Z=F^n_E.B'] it is not working...some of my commands

#

smbclient ////10.10.145.12//milesdyson

#

smbclient \\10.10.145.12\milesdyson

#

tried double slash too but still not logging in

oblique cliff Jun 13, 2020, 7:19 PM

#

Gotta cover your answer man. Post them as spoilers so you don’t ruin it for others

#

And it’s not working cuz you’re trying to log into the share as anonymous and using the password as the workgroup password

#

You need to log into the share as a specific user and then use the password for that user

#

@eternal brook

white salmon Jun 13, 2020, 7:21 PM

#

Guys!

#

At the Basic PenTest room, what do I use to brute the user-names?

eternal brook Jun 13, 2020, 7:24 PM

#

ok i'm new to discord can someone tell how to hide spoiler?

carmine scroll Jun 13, 2020, 7:24 PM

#

In network services > exploiting smb > Task 8. I have downloaded the private key file and trying to do ssh -i "john cactus"@ip address but it doesn't work. Can someone give hint on this one

eternal brook Jun 13, 2020, 7:26 PM

#

the syntax is probably wrong i suppose

#

@carmine scroll

white salmon Jun 13, 2020, 7:27 PM

#

man, is his username john cactus?

eternal brook Jun 13, 2020, 7:27 PM

#

also you dont need -i i think

carmine scroll Jun 13, 2020, 7:27 PM

#

sorry the ssh -i <key file> "john cactus"@ipaddress

eternal brook Jun 13, 2020, 7:28 PM

#

try diff username

white salmon Jun 13, 2020, 7:28 PM

#

i use 'ssh user@host'.

carmine scroll Jun 13, 2020, 7:29 PM

#

I have tried john cactus, james and john

white salmon Jun 13, 2020, 7:30 PM

#

are u sure about username?

carmine scroll Jun 13, 2020, 7:32 PM

#

i have tried three usernames which I got from the file present there

eternal brook Jun 13, 2020, 7:32 PM

#

you are using the wrong username

#

also if you using -i make sure you have the right file

carmine ledge Jun 13, 2020, 7:33 PM

#

Actually i'm trying the nmap room and it says to find the OS running on the deployed machine
I tried nmap -O <ip of machine> and it gives many OS with different versions but stll it is giving wrong answer. Pls help.

oblique cliff Jun 13, 2020, 7:34 PM

#

@eternal brook || on both sides

white salmon Jun 13, 2020, 7:34 PM

#

use -T5 -O

oblique cliff Jun 13, 2020, 7:34 PM

#

@carmine ledge read the whole output and it’ll be in there somewhere

white salmon Jun 13, 2020, 7:35 PM

#

@carmine ledge -T5 -Pn

#

Try stuff.

oblique cliff Jun 13, 2020, 7:35 PM

#

@carmine scroll the username you’re using is wrong then, look around or take better educated guesses what it might be

carmine ledge Jun 13, 2020, 7:36 PM

#

@white salmon yep I've done nmap -O -Pn <ip>

white salmon Jun 13, 2020, 7:40 PM

#

How do I find SMB usernames with enum4linux?

carmine ledge Jun 13, 2020, 7:43 PM

#

@white salmon hey bro i have share the output with u. Can u pls tell what is wrong with it ?

eternal brook Jun 13, 2020, 7:48 PM

#

@oblique cliff thanks man i got the smb share with ||smbclient //10.10.145.12/milesdyson -U milesdyson|| but can you tell why it was not working without that i spent my evening getting this just wanted to know why it works now ?

#

is it because earlier i was logging in as anonymous?

#

and now the user

oblique cliff Jun 13, 2020, 7:49 PM

#

Yes. -U indicates the user you want to log in with to the smb share

#

If you don’t specify it it tries to log in anonymously

#

@white salmon use the man page for enum4linux and research it

white salmon Jun 13, 2020, 7:51 PM

#

I used -a but it ran into internal errors.

eternal brook Jun 13, 2020, 7:51 PM

#

damm it took my evening to get this 😂 anyways thanks for you help @oblique cliff

#

your

oblique cliff Jun 13, 2020, 7:52 PM

#

That’s how you learn homie it’s not an evening wasted, I bet you’ll now never forget that 🙂

eternal brook Jun 13, 2020, 7:52 PM

#

ofcourse maynnn thanks alott

oblique cliff Jun 13, 2020, 7:53 PM

#

@white salmon that doesn’t specify usernames. Look through the man page and google it I have faith in you to figure that out

white salmon Jun 13, 2020, 7:53 PM

#

yes, but I need to find the usernames, I know them from @alpine kelp videos, but I wanna find them on my own.

#

I did the same thing but enum has internal problems...

steady stratus Jun 13, 2020, 7:54 PM

#

Gj for keeping on at it @eternal brook and it might be an evening wasted tonight, but In the long run you’ll save a lot of time as @oblique cliff suggested (:

white salmon Jun 13, 2020, 7:54 PM

#

And the LazyAdmin Room machine crashes all the timeeeee.

#

And the EternalBlue keeps failing no matter what I try.

#

Only some of them work..

eternal brook Jun 13, 2020, 7:57 PM

#

@steady stratus thanks mate it always feels really good when you find the solution on your own instead of looking for direct answers 🙂

oblique cliff Jun 13, 2020, 7:57 PM

#

@white salmon so try a different tool

steady stratus Jun 13, 2020, 7:59 PM

#

For sure @eternal brook 👍

white salmon Jun 13, 2020, 9:07 PM

#

Guys, @white salmon I made it work, but It only gives 404's.

#

📎 Dirby_404.png

tranquil dagger Jun 13, 2020, 9:30 PM

#

status_code is an integer, not a string.

white salmon Jun 13, 2020, 9:49 PM

#

try printing wordlist to see if it actually has the data you need

#

@white salmon

eternal brook Jun 13, 2020, 10:12 PM

#

any hints for priv esc on skynet......i saw ||cronjob /home/milesdyson/backups/backup.sh || running as root but i do not have write permissions on the file mentioned is this the right path?

#

i also found a || config file with root password || but cant login with it anywhere neither on site nor with ssh

oblique cliff Jun 13, 2020, 10:15 PM

#

@eternal brook if the credentials are a dead end check out what that Cronjob is doing

eternal brook Jun 13, 2020, 10:17 PM

#

i read that file i do not have write permissions on either files

#

if i cant write on those files how I'll escalate🤔

oblique cliff Jun 13, 2020, 10:19 PM

#

Well, what’s the file doing

eternal brook Jun 13, 2020, 10:21 PM

#

something ||tar cf /home/milesdyson/backups/backup.tgz *|| reading about tar cf what it does

oblique cliff Jun 13, 2020, 10:22 PM

#

Then you’re on the right track so keep on researching 🙂

eternal brook Jun 13, 2020, 10:37 PM

#

it's creating a gzip archive for with the name backup.tgz ||* || stands for wildcard does it mean it's creating backup for everything on the system as ||root||? i tried creating some files did not get root probably i'm thinking shitty i suppose😂

#

@oblique cliff

oblique cliff Jun 13, 2020, 10:42 PM

#

Research everything in that file

#

It’s running as root so chances are you’re supposed to exploit it

#

A specific word in your previous response is very important to how you can exploit it

eternal brook Jun 13, 2020, 10:48 PM

#

ohk just noticed the cd command ill try something there

eternal brook Jun 13, 2020, 11:19 PM

#

ok i know i can create some file and run them as root in html folder but i cant really get way to execute this process

#

i made a rev shell

#

it's not executing

glass swan Jun 13, 2020, 11:20 PM

#

Hello to all of you im new here

eternal brook Jun 13, 2020, 11:20 PM

#

hey

paper shore Jun 14, 2020, 2:23 AM

#

hello Friends can someone help me i try to analise a cookie in the burp room with the sequencer but i can pass of this error

#

📎 Screenshot_20200613-210143.png

#

when i press Start Live Capture

wet sorrel Jun 14, 2020, 2:39 AM

#

Hey if anyone has done BP: Networking I am having some trouble with task 1 number 8, 9, 10. I have completed everything else but I can't seem to solve these questions and have been trying to figure it out for hours.

oblique cliff Jun 14, 2020, 2:43 AM

#

@wet sorrel https://en.m.wikipedia.org/wiki/Broadcast_address

Broadcast address

A broadcast address is a network address at which all devices connected to a multiple-access communications network are enabled to receive datagrams, which comprise UDP and TCP/IP packets, for instance. A message sent to a broadcast address may be received by all network-attac...

#

Read up on that. And then with that knowledge try a bit of googling for the other 2

wet sorrel Jun 14, 2020, 2:44 AM

#

Ok thank you

opal hornet Jun 14, 2020, 4:44 AM

#

guys what is the key 3 in CC: Steganography

#

how can i find it

obsidian cradle Jun 14, 2020, 4:48 AM

#

i havent done that room im sorry

crystal aurora Jun 14, 2020, 5:58 AM

#

@opal hornet its a2lsbHNob3Q

opal hornet Jun 14, 2020, 5:59 AM

#

i founded bro

#

thank you

white salmon Jun 14, 2020, 6:52 AM

#

@white salmon I did, I retested, I believe the req.status_code doesn't want to change.

white salmon Jun 14, 2020, 7:22 AM

#

@white salmon Is the EternalBlue room broken?

tidal sedge Jun 14, 2020, 7:23 AM

#

Blue is not broken.

white salmon Jun 14, 2020, 7:23 AM

#

I've been trying since yesterday to get to exploit the machine.

#

haha

#

Well ya see

#

EternalBlue itself is a very finicky exploit

#

it may just not work sometimes

#

talked to CMNatic and could't get it..

#

I knoooowwww, I'm just annoyed.

#

Kuri

#

You seem like a smart guy

#

yes?

#

Thanks

#

So I recommend you step back for like 30 minutes, and take a break 😁. Being annoyed in general is a bad mindset for this kind of work

#

We'll be here when you come back, I don't sleep anyway ;-;

#

Yea, also did that yesterday 🙂 still kinda feel bad it won't let me exploit it :).

#

EternalBlue is just like that sometimes, Reset and pray seems like the best strategy, you can also try various github POC's

#

And the LazyAdmin room machine keeps crashing random.

#

That one, I got nothing

#

I'll browse github for exploits on it.

#

It's creator is likely here though

#

Good luck 😁

tidal sedge Jun 14, 2020, 7:27 AM

#

@white salmon Which os are you trying to hack from? 🤔

white salmon Jun 14, 2020, 7:27 AM

#

I'm on Ubuntu 20.05

#

04*.

tidal sedge Jun 14, 2020, 7:28 AM

#

Try downloading a kali/parrot/blackarch vm, because there might be an issue with your metasploit installation.
You could also use PoC's on GitHub.

white salmon Jun 14, 2020, 7:28 AM

#

I configured it myself for hacking, I find it easier to fix issues for.

#

I tried in a Kali VM.

#

Not working either,

#

I also use Ubuntu 20.04

tidal sedge Jun 14, 2020, 7:28 AM

#

Try using PoC's from GitHub.

white salmon Jun 14, 2020, 7:29 AM

#

I am , as we speak.

#

Also tried changing payloads.

#

Used https generic and meterpreter..

keen reef Jun 14, 2020, 7:37 AM

#

Hey, I'm in Vulnaversity. Just about to hit the GoBuster but, in my Kali, I don't have the wordlist directory under /usr/share/

#

Is there one that'll suffice for this exercise?

white salmon Jun 14, 2020, 7:37 AM

#

Go on github.

#

Search for dirbuster.

#

It has like 30 wordlists there.

tidal sedge Jun 14, 2020, 7:38 AM

#

@keen reef What kali version are you using? I'm pretty sure kali has that directory by default, you could also use seclists(https://github.com/danielmiessler/SecLists).

keen reef Jun 14, 2020, 7:39 AM

#

I'm on 2019.4?

#

It has like 30 wordlists there.
@white salmon

Seen, thank you

white salmon Jun 14, 2020, 7:40 AM

#

@tidal sedge

tidal sedge Jun 14, 2020, 7:40 AM

#

What?

white salmon Jun 14, 2020, 7:41 AM

#

For the payload on LHOST should I use my Private adress or the VPN one?

tidal sedge Jun 14, 2020, 7:41 AM

#

You should use the address provided by the THM vpn.

white salmon Jun 14, 2020, 7:41 AM

#

Ok.

#

Hope it'll work.

#

I re-ran it with meterpreter reverse tcp .

#

I did it!

#

YES!

tidal sedge Jun 14, 2020, 7:42 AM

#

🥳

white salmon Jun 14, 2020, 7:43 AM

#

with metasploit.

#

🙂

keen reef Jun 14, 2020, 7:51 AM

#

Ran GoBuster with all the word lists from dirbuster but couldn't reveal the directory that has the upload form page

#

Any ideas for a more fitting word list?

white salmon Jun 14, 2020, 7:51 AM

#

Hmm.

#

What wordlist did u use?

#

On LazyAdmin the Common one is fine, but you might need the Big.txt one.

keen reef Jun 14, 2020, 7:53 AM

#

I tried
/big.txt
/common.txt
/small.txt
/vulns/apache.txt
/vluns/test.txt

#

And a few others, just in case but, I'd have though they be the main ones

white salmon Jun 14, 2020, 7:54 AM

#

oh..

#

Try something else, other things.

keen reef Jun 14, 2020, 7:54 AM

#

Ah, the common one was there!

white salmon Jun 14, 2020, 7:54 AM

#

@tidal sedge Issue after issuee!

keen reef Jun 14, 2020, 7:54 AM

#

I just expected to see "upload" or something

#

Was internal 🙄

tidal sedge Jun 14, 2020, 7:55 AM

#

@white salmon What?

white salmon Jun 14, 2020, 7:55 AM

#

📎 Metasploit_Rex.png

#

Probably gonna go in a VM cause I'm pissed.

tidal sedge Jun 14, 2020, 7:56 AM

#

Looks like an issue with your metasploit installation.

white salmon Jun 14, 2020, 7:56 AM

#

yes!

tidal sedge Jun 14, 2020, 7:56 AM

#

Don't use Ubuntu 🤷

white salmon Jun 14, 2020, 7:57 AM

#

Yep.

#

I realise, Kali is only good because the tools are completely working.

#

Soo, I'll go and figure out how to fix 100 wi-fi issues and another 100 on nvidia drivers. NotLikeThis

#

cri

#

@tidal sedge one question. If I connect OpenVPN in Ubuntu, will it be connected in my VM? And what adapter whould I use to be sure? Bridged?

tidal sedge Jun 14, 2020, 8:06 AM

#

No

#

Run the vpn on your vm.

white salmon Jun 14, 2020, 8:06 AM

#

ok.

#

UPDATE!

#

The issue is with metasploit itself.

#

The current version is bugged.

#

@tidal sedge

#

You guys think Ubuntu 18.04 has less pentest tool bugs than 20.04 because it's older?

#

Im thinking of downgrading

crystal aurora Jun 14, 2020, 9:25 AM

#

I'm stuck in BioHazard, Who is STARS BRAVO TEAM LEADER ? Anyone?

ripe hedge Jun 14, 2020, 12:08 PM

#

google it?

white salmon Jun 14, 2020, 12:11 PM

#

guys i can't exploit it from yesterday. Do you have any tip for flag3 aka privilege escalation on python_playground?

wraith marsh Jun 14, 2020, 12:31 PM

#

Yeah, When you got flag1, if you enumerated that part of the box you should have seen a connection. explore that.

white salmon Jun 14, 2020, 12:32 PM

#

ok thanks

#

@wraith marsh how can i enumerate that web with python when it does not even let me import modules? :/

wraith marsh Jun 14, 2020, 12:44 PM

#

Maybe it does allow them? maybe theres other ways of getting it to work 😉

white salmon Jun 14, 2020, 12:46 PM

#

hmmmmmm

#

ooookkk....

stuck kernel Jun 14, 2020, 1:19 PM

#

hi guys, im on Network Services Task 4 #8 - I was able to download the RSA key, i chmod to 600 like the instructions say, but now im struggling how to log in with the key and get the smb.txt flag. Any help would be appreciated

wraith marsh Jun 14, 2020, 1:24 PM

#

Have you got the correct username?

stuck kernel Jun 14, 2020, 1:25 PM

#

yeah, i think i got the correct one when i did the enum4linux

wraith marsh Jun 14, 2020, 1:27 PM

#

Show me the command you're using but please use sploiler tags with || either side of the command

stuck kernel Jun 14, 2020, 1:28 PM

#

smbclient //10.10.174.4/profiles -U ||cactus|| -p 139

#

im confused with the key though, like how i use it or do i need to decode it first

wraith marsh Jun 14, 2020, 1:29 PM

#

oh, you use that to login with SSH, its an SSH key 😉

stuck kernel Jun 14, 2020, 1:34 PM

#

rightttttt ok cheers... so now its asking for a password. I havent used SSH much. surely i dont just paste the entire key in haha

wraith marsh Jun 14, 2020, 1:36 PM

#

No no, theres a switch for SSH to use the id_rsa, I'll let you figure it out, if you need help googling "SSH login with id_rsa" or in the terminal man ssh will lead you in the correct direction 🙂

#

If you do some research and are still stuck just ping me again and I'll see if I can help a bit more 🙂

stuck kernel Jun 14, 2020, 1:37 PM

#

nice one mate. i'll dive into it a little further and try and work it out. 😃

#

got it haha that was fairly easy, just needed pointing in the right direction 😄

round patio Jun 14, 2020, 2:40 PM

#

Does anyone know how isolate human readable text within a c compiled file

wraith marsh Jun 14, 2020, 2:40 PM

#

strings?

round patio Jun 14, 2020, 2:41 PM

#

nvm

#

https://tryhackme.com/room/linuxctf task 4 # 7 i need command flags to find a specific character count also starts with a specific string of letters

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

oblique cliff Jun 14, 2020, 2:56 PM

#

@round patio look into regex's as well as using the find command with the grep command

round patio Jun 14, 2020, 2:56 PM

#

regex?

oblique cliff Jun 14, 2020, 2:56 PM

#

yes

round patio Jun 14, 2020, 2:57 PM

#

regex isn't a command allowed on the device by administrator

oblique cliff Jun 14, 2020, 2:57 PM

#

Anyone have hints for Ignite privesc? || I ran Linpeas and LinEnum and there was no interesting SUID files or anything else that I could see. The version of Ubuntu the machine is running isn't vulnerable to an exploit I found, out of other ideas||

solemn smelt Jun 14, 2020, 2:58 PM

#

regex isnt a command its a regular expression used within commands

oblique cliff Jun 14, 2020, 2:58 PM

#

@round patio not the command regex. How to use regex to search for something

tidal sedge Jun 14, 2020, 2:59 PM

#

@oblique cliff Check for config database files 😉

oblique cliff Jun 14, 2020, 2:59 PM

#

thanks 🙂

round patio Jun 14, 2020, 3:00 PM

#

alright because ive tried find -name flag26* | grep 4bceb

#

but all are permission denied and can't find the place

#

and 2>/dev/null/ doesn't clear it

oblique cliff Jun 14, 2020, 3:01 PM

#

they didnt say the name of the flag was going to be flag26

#

and thats cuz you need to redirect the errors for both the find command and the grep command if youre going to pipe it

round patio Jun 14, 2020, 3:02 PM

#

well it tells me /dev/null isn;t a dir

solemn smelt Jun 14, 2020, 3:02 PM

#

because its not

#

thats the whole point

round patio Jun 14, 2020, 3:04 PM

#

alright

#

sorry im asking a lot of questions

#

im trying to not have an ego with it

oblique cliff Jun 14, 2020, 3:04 PM

#

@tidal sedge ugh || sql database creds, i suck with this time to look up how to use mysql lol|| can you tell me if thats the right track so i dont waste my time tripping over my own feet?

#

@round patio dont be sorry, we all start somewhere

solemn smelt Jun 14, 2020, 3:04 PM

#

@oblique cliff yes youre on the right path

oblique cliff Jun 14, 2020, 3:04 PM

#

thanks

tidal sedge Jun 14, 2020, 3:05 PM

#

@oblique cliff Just look who the creds are for 😄

oblique cliff Jun 14, 2020, 3:05 PM

#

ahhhhh i think i know what to do @tidal sedge

round patio Jun 14, 2020, 3:07 PM

#

so would i do the find / -name flag26* to find it and then use grep -rnw /path/ -e (letters)

oblique cliff Jun 14, 2020, 3:10 PM

#

you would do that if you know the file is called flag26......

#

but you dont know that

round patio Jun 14, 2020, 3:10 PM

#

so i got sent this find / -xdev -type f -print0 2>/dev/null | xargs -0 grep -E '^[a-z0–9]{32}$' 2>/dev/null

#

but i don't know what it does

oblique cliff Jun 14, 2020, 3:14 PM

#

so research each of the flags and commands and try to learn it 🙂

#

if you have questions ask, but try to research it first

round patio Jun 14, 2020, 3:15 PM

#

Ive been trying for an hour

#

and im getting frustrated

#

so idk what to do

oblique cliff Jun 14, 2020, 3:18 PM

#

take a break

#

and come back when youre not frustrated

#

then research

#

youre not gonna learn too much if youre frustrated

round patio Jun 14, 2020, 3:20 PM

#

ye so i gotta research regular statements

oblique cliff Jun 14, 2020, 3:49 PM

#

@tidal sedge so im pretty sure ive seen this privesc before, but i found one using ||raptor, but that one doesnt work since mysql has secure file priv turned on. I saw you could turn it off by changing the my.cnf file but i cant write to that so i dont think i can get the raptor exploit working|| is it something else? I thought when i saw this type of privesc before i used a different method but i cant for the life of me remember how

tidal sedge Jun 14, 2020, 3:49 PM

#

You are very much over complicating things.

#

The privesc is very simple.

#

@oblique cliff Have you ever heard of ||password reuse|| 😄

oblique cliff Jun 14, 2020, 3:51 PM

#

i havent looked at that spoiler but i got it right when you said youre overcomplicating things

#

thank you very much for the help 😄

#

disappointed, i shouldve looked for ||config files|| and then ||password reuse|| immediately after discovering that first part

#

ahhh maaan, that was outputted in linpeas too if i had only looked closer. bummer

patent token Jun 14, 2020, 4:06 PM

#

Ater you've seen it as a possibility once, every time you get a www-data user you'll always go there first. 😛

oblique cliff Jun 14, 2020, 4:07 PM

#

true! worth banging my head the last couple hours 😄

patent token Jun 14, 2020, 4:08 PM

#

If there's a config file, it's there for a reason in labs usually. 🙂

oblique cliff Jun 14, 2020, 4:12 PM

#

Noted. I thought they were always generated automatically so I didn’t pay much attention to it

limber quarry Jun 14, 2020, 4:17 PM

#

Anyone have hints for flag 2 on mindgames?

tidal sedge Jun 14, 2020, 4:18 PM

#

The best hint I can give you is

#

try harder

limber quarry Jun 14, 2020, 4:19 PM

#

😂 Nice hint haha

#

I'll try harder

white salmon Jun 14, 2020, 5:07 PM

#

@tidal sedge Any hints on Vulnversity last flag? I escalated from PHP Shell to Full User Shell, But no password nothing.

#

And the '/bin/systemctl' looks weird, like it's corupted

spiral stag Jun 14, 2020, 5:08 PM

#

https://gtfobins.github.io/

white salmon Jun 14, 2020, 5:15 PM

#

Ohhhhhhh, thanks!

potent vale Jun 14, 2020, 5:34 PM

#

How is Carpe Diem tagged with graphql when ||error connecting to|| kekw

nova meteor Jun 14, 2020, 5:37 PM

#

https://tryhackme.com/room/reverseengineering having trouble understanding crackme3, this section:

TryHackMe

TryHackMe | Reverse Engineering

This room focuses on teaching the basics of assembly through reverse engineering

#

mov -0x28(%rbp),%eax
cltq
movzbl -0x20(%rbp,%rax,1),%edx
mov -0x28(%rbp),%eax
cltq
movzbl -0x23(%rbp,%rax,1),%eax
cmp %al,%dl

tidal sedge Jun 14, 2020, 5:40 PM

#

Wait, is that AT & T syntax? 👀

nova meteor Jun 14, 2020, 5:46 PM

#

youre right, im a noob for posting unfavorable syntax, how dare i

tidal sedge Jun 14, 2020, 5:47 PM

#

Nah, I think Ashu uses AT & T syntax so the whole room is probably in AT & T.

nova meteor Jun 14, 2020, 5:49 PM

#

so i understand cltq converts to a quad word, and i think movzbl loads a byte 0x20 (to most signifigant?) and im guessing pads the rest 0 bytes

#

id like to step thru and check registers but too noob to know what im doing, guess i should just give up or try harder

white salmon Jun 14, 2020, 6:05 PM

#

Is LazyAdmin broken?

#

I literally followed the walkthrough to make sure and it doesn't wanna escalate.

#

I followed 2 writeups to make sure.

spiral stag Jun 14, 2020, 6:06 PM

#

i just did the room

#

no problems

white salmon Jun 14, 2020, 6:06 PM

#

Hmm...

spiral stag Jun 14, 2020, 6:07 PM

#

didin't use a walkthrough tho

white salmon Jun 14, 2020, 6:07 PM

#

I dunno, maybe the write-up is broken.

#

Whatever.

#

The EternalBlue runs into issues because of latest metasploit update.

inland onyx Jun 14, 2020, 6:08 PM

#

LazyAdmin

#

Is, uh... Linux...

#

IIRC

spiral stag Jun 14, 2020, 6:09 PM

#

it is

inland onyx Jun 14, 2020, 6:09 PM

#

So, no EternalBlue...

tidal sedge Jun 14, 2020, 6:09 PM

#

@inland onyx They were having issues with Blue earlier.

inland onyx Jun 14, 2020, 6:09 PM

#

Ah, I see

white salmon Jun 14, 2020, 6:16 PM

#

Some rooms are harder than they say they are.

#

How did you guys get this good?

spiral stag Jun 14, 2020, 6:19 PM

#

im not this good...

#

im that good 🙂

obsidian cradle Jun 14, 2020, 6:20 PM

#

how to find return address from gdb ;_;

spiral stag Jun 14, 2020, 6:21 PM

#

jmp esp?

#

or what?

obsidian cradle Jun 14, 2020, 6:21 PM

#

i think im looking for esp??

#

tryna learn some bof :3

spiral stag Jun 14, 2020, 6:22 PM

#

https://gist.github.com/rkubik/b96c23bd8ed58333de37f2b8cd052c30

Gist

GDB cheat sheet

GDB cheat sheet. GitHub Gist: instantly share code, notes, and snippets.

obsidian cradle Jun 14, 2020, 6:22 PM

#

u da best

#

<3

spiral stag Jun 14, 2020, 6:22 PM

#

https://github.com/scwuaptx/Pwngdb

GitHub

scwuaptx/Pwngdb

gdb for pwn. Contribute to scwuaptx/Pwngdb development by creating an account on GitHub.

#

makes it somewhat better imo

tidal sedge Jun 14, 2020, 6:23 PM

#

tryna learn some bof :3
@obsidian cradle If you are interested in buffer overflows LiveOverflow has a playlist on his YouTube channel.

obsidian cradle Jun 14, 2020, 6:23 PM

#

awesome thank you! i will for sure check it out @tidal sedge

#

so im doing binex task 3, it says ||Step 5: Read the stack or register RSP to find a suitable return address.||

#

so|| RSP is return address|| to use for my payload or no?

spiral stag Jun 14, 2020, 6:29 PM

#

are you familiar with the stack?

obsidian cradle Jun 14, 2020, 6:30 PM

#

not one bit

spiral stag Jun 14, 2020, 6:30 PM

#

:3

#

I would recommend learning that first

#

https://www.youtube.com/watch?v=1S0aBV-Waeo

YouTube

Computerphile

Buffer Overflow Attack - Computerphile

Making yourself the all-powerful "Root" super-user on a computer using a buffer overflow attack. Assistant Professor Dr Mike Pound details how it's done.

The Stack: https://youtu.be/7ha78yWRDlE
Botnets: https://youtu.be/UVFmC178_Vs
The Golden Key: iPhone Encryption: https://...

▶ Play video

obsidian cradle Jun 14, 2020, 6:30 PM

#

the stack

spiral stag Jun 14, 2020, 6:31 PM

#

how assembler works in general

#

it's quite a steep learning curve

#

but so rewarding when that first bof works

#

there are some rooms for that as well

#

https://tryhackme.com/room/reverseengineering

TryHackMe

TryHackMe | Reverse Engineering

This room focuses on teaching the basics of assembly through reverse engineering

#

https://tryhackme.com/room/introtox8664

TryHackMe

TryHackMe | Intro to x86-64

This room teaches the basics of x86-64 assembly language

obsidian cradle Jun 14, 2020, 6:32 PM

#

i wil master bof by the end of today

spiral stag Jun 14, 2020, 6:33 PM

#

FAmous last words

obsidian cradle Jun 14, 2020, 6:33 PM

#

dies

spiral stag Jun 14, 2020, 6:33 PM

#

lol

obsidian cradle Jun 14, 2020, 6:33 PM

#

thank you though, will be doing big brain learning today

spiral stag Jun 14, 2020, 6:34 PM

#

have fuin!

obsidian cradle Jun 14, 2020, 6:34 PM

#

❤️

eternal brook Jun 14, 2020, 7:37 PM

#

hey i was just trying Daily Bugle i got admin login page so i tried using ||sqlmap|| but it does not show the page vulnerable

#

i tried increasing the level

wooden mist Jun 14, 2020, 7:37 PM

#

sqlmap is known for not working too well on that room

#

try looking for dedicated scripts that are related to that room

eternal brook Jun 14, 2020, 7:40 PM

#

like look for a scanning script for daily bugle

#

or an alternative of sqlmap

wooden mist Jun 14, 2020, 7:41 PM

#

not really an alternative to sqlmap but a tool for sqli

eternal brook Jun 14, 2020, 7:53 PM

#

does zap detect sqli?

obsidian cradle Jun 14, 2020, 8:55 PM

#

@eternal brook did you still need help

patent token Jun 14, 2020, 9:24 PM

#

ZAP detects basic vulnerabilities. It's by no means a robust vuln scanner though. It's more looking for service banners with known vulnerabilities.

eternal brook Jun 14, 2020, 11:51 PM

#

I'll give the machine a try tommrow couldn't find something that @wooden mist asked to look for.....had some shitty online assignments to be submitted 😂

#

Thanks @obsidian cradle I'll ask if I'm still stuck tommrow

#

Thanks @patent token appreciate it

white salmon Jun 15, 2020, 5:38 AM

#

hey

#

I have a question

#

I have to setup the VPN connection inside of my virtual machine

#

correct?

#

I mean the machine I will be using

#

which happens to be a virtual machine

ashen heron Jun 15, 2020, 5:46 AM

#

yes download your vpn config file from thm in your virtual machine, and sudo openvpn yourvpnconfigfilename.ovpn ( itll be in your downloads directory )

#

@white salmon

white salmon Jun 15, 2020, 5:47 AM

#

alright thanks

white salmon Jun 15, 2020, 8:10 AM

#

Just finished Ice on my own, huh!

#

Oh and there's a bug on the Basic Pentesting, latest enum4linux version has issues finding users on SMB.

#

And metasploit on EternalBlue has bugs, latest version.

indigo ridge Jun 15, 2020, 8:33 AM

#

hey.. I need some hint on mindgame... whats the use of that server.. it just listening on some ports .. how do I make any request?

potent vale Jun 15, 2020, 8:35 AM

#

It's listening on Port 80 @indigo ridge

indigo ridge Jun 15, 2020, 8:36 AM

#

yeah.. I noticed.. also I can change the port by -p but.. there is nothing I could get from the browser

white salmon Jun 15, 2020, 8:36 AM

#

Any tips on Ignite?

#

I got the dashboard CMS creds.

#

Now what?

#

I'm trying to fuzz the upload form to upload a reverse shell with PHP but it ain't working.

potent vale Jun 15, 2020, 8:39 AM

#

Can you access the website @indigo ridge ?

#

Because that's all you need

indigo ridge Jun 15, 2020, 8:40 AM

#

Ive got the first flag.. I just need to escalate

#

Can you access the website @indigo ridge ?
@potent vale yes..

potent vale Jun 15, 2020, 8:41 AM

#

Did you enumerate the server?

indigo ridge Jun 15, 2020, 8:41 AM

#

i just jumped to get the reverse shell.. and then got first flag

potent vale Jun 15, 2020, 8:42 AM

#

So you're looking for a privilege escalation. Have you found an approach for that?

indigo ridge Jun 15, 2020, 8:43 AM

#

yep I think there is two weird thing.. which I got from linpeas

tidal sedge Jun 15, 2020, 8:46 AM

#

This is #room-hints we prefer to keep this chat spoiler free and only provide hints here, if you need more help then I suggest #room-help.

white salmon Jun 15, 2020, 8:47 AM

#

@potent vale @tidal sedge any tips on Ignite?

#

I'm stuck, I just bruted the creds for the admin page.

indigo ridge Jun 15, 2020, 8:47 AM

#

This is #room-hints we prefer to keep this chat spoiler free and we only provide hints here, if you need more help then I suggest #room-help.
@tidal sedge yes sure .

white salmon Jun 15, 2020, 8:47 AM

#

Now I got them, but idk what 2 do.

potent vale Jun 15, 2020, 8:49 AM

#

@white salmon You need to find ||an exploit for the CMS.||

white salmon Jun 15, 2020, 8:50 AM

#

I did, but I don't get how 2 exploit over reads...

tidal sedge Jun 15, 2020, 8:50 AM

#

I'm stuck, I just bruted the creds for the admin page.
@white salmon That's a rabbit hole, if I remember correctly.

white salmon Jun 15, 2020, 8:50 AM

#

I tried to fuzz the admin page uploads.

#

To upload and get a php shell.

tidal sedge Jun 15, 2020, 8:51 AM

#

That's a rabbit hole.

white salmon Jun 15, 2020, 8:51 AM

#

Damnn..

#

I'l go look for exploits.

#

But how do I use it? CVE-2018-16763?

light mulch Jun 15, 2020, 8:54 AM

#

Hi! I am doing webbappsec 101, on task 4 question 4 they ask "What is the username of a logged on user?" i looked at all the upload pictures and just guessed the correct answer. How should i have gotten the username of a logged on user? any hints/tips?

white salmon Jun 15, 2020, 8:55 AM

#

@tidal sedge https://github.com/SalimAlk/CVE-2018-16763- maybe helps?

GitHub

SalimAlk/CVE-2018-16763-

Fuel-Cms Rce Exploit (Single,Mass) Version: 1.4.2 - SalimAlk/CVE-2018-16763-

tidal sedge Jun 15, 2020, 8:57 AM

#

That will work.

white salmon Jun 15, 2020, 8:57 AM

#

It doesn't.

#

I tried..

crystal aurora Jun 15, 2020, 8:57 AM

#

is anyone getting trouble to acces Plethora CTF?

tidal sedge Jun 15, 2020, 8:58 AM

#

@white salmon And what error does it return?

white salmon Jun 15, 2020, 8:58 AM

#

requests errror, i forgot, i just deleted the repo

#

i have requests installed but it has errors the script..

tidal sedge Jun 15, 2020, 8:59 AM

#

That exploit works, you need to run it with python 2.

#

If not, mirror the exploit from searchsploit.

white salmon Jun 15, 2020, 9:03 AM

#

Ok.

#

Installed requests for py2.

#

@tidal sedge worked! now that do I do? 'if I do id it gives me that I am in www-data

#

If I do sudo -l it says system

#

Same for cs

#

cd*

#

Ls works fine

#

Same for touch

tidal sedge Jun 15, 2020, 9:22 AM

#

@white salmon Get a more stable shell, and then privesc from there.

white salmon Jun 15, 2020, 9:23 AM

#

how?

#

Using php?

#

Ohhhh.

#

I know, wait.

#

I got it!

#

First flag.

white salmon Jun 15, 2020, 10:43 AM

#

@urban ember What room you need help on?

urban ember Jun 15, 2020, 10:46 AM

#

The room is Linux challenges

#

📎 unknown.png

#

from learning pathways

white salmon Jun 15, 2020, 10:53 AM

#

Oh

#

I'm not subbed

glossy basin Jun 15, 2020, 10:57 AM

#

I can help, what's up?

#

@urban ember what's your question

urban ember Jun 15, 2020, 10:57 AM

#

im brand new to cybersec (decent experience with linux)

ive looked around a lot and cant find a particular flag "Can you find information about the system, such as the kernel version etc.

Find flag 15."

i have used things from uname -a or -r
checked things like /proc/version
used dmesg | grep Linux
dmesg | grep Kernal

any hints or help would be great

glossy basin Jun 15, 2020, 10:58 AM

#

system info is found in a release file in /etc directory

#

||cat /etc/*release|| <- if you are stuck

carmine ledge Jun 15, 2020, 10:59 AM

#

I'm using gobuster to detect the directory that has an upload form page so any idea which wordlist I should try if I'm on Kali??

glossy basin Jun 15, 2020, 11:00 AM

#

/dirb/big.txt should be fine

#

or /dirbuster/directory-list-2.3-medium

white salmon Jun 15, 2020, 11:00 AM

#

dirb <LINK> -R I use it all the time.

urban ember Jun 15, 2020, 11:04 AM

#

Thanks alot Swafox, found flag 15 more specifically in lsb-release
Appreciate the help man ❤️

glossy basin Jun 15, 2020, 11:11 AM

#

anytime 😄

white salmon Jun 15, 2020, 11:32 AM

#

Help

#

help

#

On the SimpleCTF room

#

I scanned target for vulns

#

CVE:CVE-2007-6750 is slowloris

#

it's vulnerable

#

but the thm room says wrong

tidal sedge Jun 15, 2020, 11:33 AM

#

Stop tagging people and just ask your question here, someone will help you.

glossy basin Jun 15, 2020, 11:33 AM

#

slowloris is a DoS vulnerability

#

and for obvious reasons it's not the one used for exploitations

white salmon Jun 15, 2020, 11:34 AM

#

plus, it's got anonymous ftp login

#

that's wrong too it says

glossy basin Jun 15, 2020, 11:34 AM

#

it's not a vuln

#

bad configuration

white salmon Jun 15, 2020, 11:34 AM

#

hmm

glossy basin Jun 15, 2020, 11:34 AM

#

try harder

white salmon Jun 15, 2020, 11:34 AM

#

how am I supposed to scan it then?

glossy basin Jun 15, 2020, 11:34 AM

#

nmap NSE scan

#

or CVE scan

#

or research about things the server is running; also their versions

eternal brook Jun 15, 2020, 12:00 PM

#

im still not able to find a script for sqli in dailybugle room do i need to write one on my own?

#

I'm trying to write one but i dont i think i have that programming skills rn to write on rn

white salmon Jun 15, 2020, 12:03 PM

#

Google it HARDER.

#

My tactic, works 99% like Sanytol Disinfectant.

glossy basin Jun 15, 2020, 12:04 PM

#

@eternal brook yeah you need to make your own

#

or take something similar as basis

eternal brook Jun 15, 2020, 12:05 PM

#

damm i think then i need to practice some coding first

white salmon Jun 15, 2020, 12:07 PM

#

😦

mild eagle Jun 15, 2020, 12:14 PM

#

in room HackPark I'm trying to crack the password using hydra but can figure out what is wrong with this ||hydra -V -I -l pennywise -P /usr/share/wordlists/rockyou.txt BOX-IP-GOES-HERE http-post-form "/Account/login.aspx:__VIEWSTATE=%2B9GQc0USxXlLq5vp9BVnaK%2FPFKWRRkzvGMkysqWtjAKbFZ%2FkeJiuB8vUVjeeohvrRHwf6K8ZGO4xg18cOKTcRMmHmiEMRZYE4IELBChZvpCx8F0L8MRtlzu2RDTPAvYdYedei6he1KBWweuaga7ETxfClWA88cPEOy%2BP2TLg8vsXifZO&__EVENTVALIDATION=P9Rbfaut5BQEScx5LttvnVHVdtfgdcsKFkjS5tzH6FJeGwhZyB1bQ2XAGOv%2Fxp%2B1VmUT%2FKm8qwzaKRtFBF8UNdMudvVaqkDguneh4EGDK2sDqRAk5KwzjI82t28Q%2F9%2Fm32vJh0OI%2BGrKJ9f6V32c36oqTmpEaJu%2B1SO%2FVBuIoURlJ3Eo&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login failed"||

rancid crystal Jun 15, 2020, 12:19 PM

#

@mild eagle using -l twice?

white salmon Jun 15, 2020, 12:20 PM

#

🙂

#

Just finished SimpleCTF yee

mild eagle Jun 15, 2020, 12:21 PM

#

@rancid crystal one is "I" the other is L in lowercase 🙂

#

first one is capital i

burnt cosmos Jun 15, 2020, 12:23 PM

#

@mild eagle Shouldn't need to use capital I, apart from that your request looks okay, maybe do some more research into possible usernames

mild eagle Jun 15, 2020, 12:24 PM

#

@burnt cosmos tnx tnx the -I is only skip waiting in sessions 🙂

white salmon Jun 15, 2020, 12:24 PM

#

use -V -I after rockyou before ip

true widget Jun 15, 2020, 12:24 PM

#

How can I check available shells on a system?

white salmon Jun 15, 2020, 12:25 PM

#

worked 4 me few times

true widget Jun 15, 2020, 12:26 PM

#

Can anyone help?

mild eagle Jun 15, 2020, 12:28 PM

#

@burnt cosmos tnx got it 🙂

spiral stag Jun 15, 2020, 12:29 PM

#

@true widget cat /etc/shells

true widget Jun 15, 2020, 12:30 PM

#

@spiral stag thanks man!

wraith tapir Jun 15, 2020, 1:02 PM

#

any hints for "Break Out The Cage" cipher??

#

Tried making script for cesar and rot13 and loop them around

#

but no luck

quiet stump Jun 15, 2020, 1:08 PM

#

@wraith tapir is that for root?

wraith tapir Jun 15, 2020, 1:09 PM

#

no no the initial cipher

quiet stump Jun 15, 2020, 1:11 PM

#

Ahhhh you have to use some other bit of info and you'll find it

low shuttle Jun 15, 2020, 1:11 PM

#

I tried decoding cipher. Looks like I got a format of the encoded text, but could not get what I should do now.

wraith tapir Jun 15, 2020, 1:11 PM

#

thanks thanks

spiral stag Jun 15, 2020, 1:12 PM

#

that last one got me stumped again

#

#nevergettingroot

wooden mist Jun 15, 2020, 1:13 PM

#

~~there is another route~~

quiet stump Jun 15, 2020, 1:13 PM

#

Enumeration is key

spiral stag Jun 15, 2020, 1:13 PM

#

feels like im hitting a wall here

low shuttle Jun 15, 2020, 1:13 PM

#

Magna, any nudge on the audio?

#

.mp3

quiet stump Jun 15, 2020, 1:16 PM

#

Read the room tags

#

😉

warm schooner Jun 15, 2020, 1:16 PM

#

Any hints for the cipher on new cage room? Can't see it

quiet stump Jun 15, 2020, 1:17 PM

#

French man

low shuttle Jun 15, 2020, 1:17 PM

#

Python, mail

#

I am confused tbh.

#

😅

tidal sedge Jun 15, 2020, 1:22 PM

#

French man
@quiet stump I still haven't started the box(got sidetracked into doing HTB) but I think I know what the cipher is 🤔

warm schooner Jun 15, 2020, 1:24 PM

#

@quiet stump could I DM for a hint plz?

quiet stump Jun 15, 2020, 1:24 PM

#

Go for it

true prairie Jun 15, 2020, 1:25 PM

#

Any hints for the cipher on new cage room? Can't see it
@warm schooner I need help too.. Can't figure it out at all

crisp wigeon Jun 15, 2020, 1:25 PM

#

Hi @Magna need to extract from .mp3 ? Any hint

quiet stump Jun 15, 2020, 1:26 PM

#

Room tags 🙂

#

and enumeration

#

both key

solid patrol Jun 15, 2020, 1:53 PM

#

any hint how to go from weston to cage in escape the cage room?

wooden mist Jun 15, 2020, 1:56 PM

#

investigate the quotes ;)

spiral stag Jun 15, 2020, 2:05 PM

#

@quiet stump eyyyy got it 😄

#

im guessing the 2nd way 😛

quiet stump Jun 15, 2020, 2:05 PM

#

GratZ 🙂

wooden mist Jun 15, 2020, 2:05 PM

#

nice

spiral stag Jun 15, 2020, 2:06 PM

#

still would like to know the intended way if someone wants to help 🙂

wooden mist Jun 15, 2020, 2:06 PM

#

you can DM me if you want

grand rune Jun 15, 2020, 2:16 PM

#

I'm on Basic Pentesting (https://tryhackme.com/room/basicpentestingjt), I need to bruteforce a password but don't get the protocol in which to do it. I tried ||ssh|| but it keeps failing with ||protocol error||

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

oblique cliff Jun 15, 2020, 2:28 PM

#

@grand rune if its not ||ssh|| then try to take ||clues from the messages on the site with what other service is open from your scan||

spiral stag Jun 15, 2020, 2:29 PM

#

anyone willing to give me a nudge on mindgames root?

#

been stuck on that for too long now

potent vale Jun 15, 2020, 2:31 PM

#

Where are you stuck?

spiral stag Jun 15, 2020, 2:32 PM

#

finding a way to get root 🙂

#

i found the odd config

#

but no idea how to exploit

potent vale Jun 15, 2020, 2:32 PM

#

You can PM me if you want. Probably too spoilery to give hints here

spiral stag Jun 15, 2020, 2:33 PM

#

thanks!

white salmon Jun 15, 2020, 2:48 PM

#

So im doing the Mr robot ctf, and im on the second key. i run this john robot.hash --wordlist.dic --format=Raw-MD5
i get the pswd (ABCDEFGHIJKLMNOPQRSTUVWXYZ), i run su robot on the rev. shell i got

#

But its 'incorrect'

grand rune Jun 15, 2020, 2:55 PM

#

@oblique cliff thanks for the hint, I actually failed because of ||wrong username||

oblique cliff Jun 15, 2020, 2:55 PM

#

@grand rune no problem, was it actually ||smb|| or ||ssh|| i decided to do that room after you asked that question ^^

grand rune Jun 15, 2020, 2:56 PM

#

It was ||ssh||, ||smb didnt recognise usernames|| and || I already had done stuff with smb ||

#

also the latter failed with the good ||username||

oblique cliff Jun 15, 2020, 2:59 PM

#

gotcha, thanks for the hints 🙂

white salmon Jun 15, 2020, 3:05 PM

#

Hi @quiet stump need to extract from .mp3 ? Any hint
@crisp wigeon audacity and special filter to extract text from .mp3.

burnt cosmos Jun 15, 2020, 3:05 PM

#

This first cipher on cage is causing me all sorts of issues god damn, any idea how many times it needs to be decrypted? Or is that too much of a hint at this stage?

quiet stump Jun 15, 2020, 3:05 PM

#

Shhhhhhhhhh

#

hints not spoilers mah man

oblique cliff Jun 15, 2020, 3:05 PM

#

@grand rune what wordlist did you use for this? cuz the || cybersec top 1000 list isnt getting anything||

grand rune Jun 15, 2020, 3:06 PM

#

||rockyou.txt||

#

it takes a while but it's there

oblique cliff Jun 15, 2020, 3:06 PM

#

bummer i was hoping to not use that

#

alright thanks

tidal sedge Jun 15, 2020, 3:06 PM

#

Let's keep this chat spoiler free, as this is #room-hints if you need further help I suggest moving over to #room-help.

bold scroll Jun 15, 2020, 3:06 PM

#

Anybody did "Break the cage.1" new room?

grand rune Jun 15, 2020, 3:06 PM

#

yeah you're right

carmine scroll Jun 15, 2020, 3:07 PM

#

I am stuck at Network services> exploiting SMB > Task 8 (connecting through ssh). I have downloaded the file and changed the permission to 600. I have tried usernames as "john", "James", root, and "john cactus" but no success.

solid patrol Jun 15, 2020, 3:09 PM

#

did u specify id_rsa in ssh

carmine scroll Jun 15, 2020, 3:09 PM

#

"ssh -i id_rsa"

#

I tried this

cloud zephyr Jun 15, 2020, 3:10 PM

#

@carmine scroll notice that your -i is the id that you created

oblique cliff Jun 15, 2020, 3:11 PM

#

@carmine scroll double check the usernames youve tried. there are a couple from your short list that i would add

cloud zephyr Jun 15, 2020, 3:11 PM

#

i mean, if your ssh is "aa", it should be smth like "ssh -i aa"

orchid bobcat Jun 15, 2020, 3:11 PM

#

Check the user names you have tried

carmine scroll Jun 15, 2020, 3:12 PM

#

Will I get the username on the machine or random tries?

oblique cliff Jun 15, 2020, 3:12 PM

#

youre very close with the names youve guessed. guess a few more

orchid bobcat Jun 15, 2020, 3:12 PM

#

try variants of his name,

white salmon Jun 15, 2020, 3:14 PM

#

So im doing the Mr robot ctf, and im on the second key. i run this john robot.hash --wordlist.dic --format=Raw-MD5
i get the pswd (||ABCDEFGHIJKLMNOPQRSTUVWXYZ||), i run su robot on the rev. shell i got
[5:48 PM]
But its 'incorrect'

oblique cliff Jun 15, 2020, 3:15 PM

#

are you sure thats the password you got?

#

also, please post answers as spoilers (or not at all)

white salmon Jun 15, 2020, 3:16 PM

#

yes, oh ok my bad

oblique cliff Jun 15, 2020, 3:16 PM

#

double check thats the password you got 🙂

white salmon Jun 15, 2020, 3:17 PM

#

root@kali:~# john /root/Desktop/robot.hash --wordlist=fsocity.dic --format=Raw-MD5
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2020-06-15 14:09) 0g/s 14301Kp/s 14301Kc/s 14301KC/s 8output..||ABCDEFGHIJKLMNOPQRSTUVWXYZ||

#

check username 🙂

carmine scroll Jun 15, 2020, 3:19 PM

#

@oblique cliff @orchid bobcat will I get the username on the machine itself because I have tried some variants of his name John.c, jc, jcactus, johnc. j.cactus, johncactuspolo etc

white salmon Jun 15, 2020, 3:20 PM

#

its literally ||robot||

oblique cliff Jun 15, 2020, 3:20 PM

#

@white salmon use || crackstation instead to decrypt the password and see what you get||

white salmon Jun 15, 2020, 3:20 PM

#

ok

oblique cliff Jun 15, 2020, 3:21 PM

#

@carmine scroll whats the difference between the usernames you guessed ||James|| and ||john||?

#

@grand rune oh my goodness ||how deep does this go, im 4000 deep into rockyou||

white salmon Jun 15, 2020, 3:22 PM

#

||abcdefghijklmnopqrstuvwxyz|| same result, wait i think its because of the capitalization LOL

grand rune Jun 15, 2020, 3:22 PM

#

@oblique cliff ~15min for me

white salmon Jun 15, 2020, 3:22 PM

#

thanks bob

grand rune Jun 15, 2020, 3:22 PM

#

it finds it

carmine scroll Jun 15, 2020, 3:23 PM

#

thankyou @oblique cliff 😄

oblique cliff Jun 15, 2020, 3:26 PM

#

......

#

@grand rune my machine just expired at 4000 in lol

#

time to start over

grand rune Jun 15, 2020, 3:27 PM

#

I think ||hydra has a restore point||

#

lets get this to #room-help, we're leaking too much

white salmon Jun 15, 2020, 3:28 PM

#

What three letter abbreviation is the technical term for the "wifi code/password/passphrase"?

#

I'm so dumb I can't figure it out.

#

Help.

grand rune Jun 15, 2020, 3:28 PM

#

||PSK|| i guess?

white salmon Jun 15, 2020, 3:29 PM

#

❤️

#

I'm on a room completing spree rn.

#

🙂

#

Yeeeet!

warm schooner Jun 15, 2020, 3:45 PM

#

@proven bridge, any hints for Carpe? Trying to read into the download but not getting anywhere 😦

white salmon Jun 15, 2020, 3:45 PM

#

I need another hint

#

📎 unknown.png

oblique cliff Jun 15, 2020, 3:46 PM

#

@white salmon still mr robot?

white salmon Jun 15, 2020, 3:47 PM

#

Oh sorry nah im done with that, its the Burp Suite walkthrough.

oblique cliff Jun 15, 2020, 3:48 PM

#

read the blurb in that task

#

closely

white salmon Jun 15, 2020, 4:00 PM

#

still cant figure it out

#

at this point i feel like its a bug

#

@bitter shadow you got any hints ?

#

ping please, thx

bitter shadow Jun 15, 2020, 4:05 PM

#

sorry I'm kinda busy rn

oblique cliff Jun 15, 2020, 4:06 PM

#

its not a bug

#

read ||the blurb from the task, the answer is in there||

covert basalt Jun 15, 2020, 4:07 PM

#

anyone available for hint on break the cage

#

the cipher part

quiet stump Jun 15, 2020, 4:07 PM

#

Plenty of hints for that room if u scroll up 🙂

white salmon Jun 15, 2020, 4:09 PM

#

its not a bug
@oblique cliff issa joke....

#

read ||the blurb from the task, the answer is in there||
where is that im new to tryhackme

oblique cliff Jun 15, 2020, 4:11 PM

#

scroll up and to the paragraph youre supposed to read before the questions

wraith marsh Jun 15, 2020, 4:40 PM

#

@proven bridge, any hints for Carpe? Trying to read into the download but not getting anywhere 😦
@warm schooner I can’t give you any hints but you should have seen the message on the room that says the download section isnt part of the ctf

white salmon Jun 15, 2020, 4:43 PM

#

still cant figure it out

#

please just hint

#

@white salmon it's in the text, read it again

lusty wigeon Jun 15, 2020, 5:12 PM

#

@wraith marsh then wth am i suppose to do with these ||keys||

proven bridge Jun 15, 2020, 5:12 PM

#

@proven bridge, any hints for Carpe? Trying to read into the download but not getting anywhere 😦
@warm schooner the download is only required at the last step of the challenge.

lusty wigeon Jun 15, 2020, 5:12 PM

#

@proven bridge do you mind if i dm for a sanity check on carpe diem ?

proven bridge Jun 15, 2020, 5:12 PM

#

Other hint, no reverse shells required.

#

Sure @lusty wigeon

warm schooner Jun 15, 2020, 5:14 PM

#

👀 duly noted

white salmon Jun 15, 2020, 6:10 PM

#

A third predominant address type is typically reserved for the router, what is the name of this address type?

#

WTF?

#

I've been looking for an hour now.

#

Any of you guys wanna help?

#

whats is your router ip named in ipconfig

#

wym?

white quartz Jun 15, 2020, 6:25 PM

#

How can I scan a box with namp with vpn?

white salmon Jun 15, 2020, 6:26 PM

#

What do ya wanna scan>

white quartz Jun 15, 2020, 6:26 PM

#

a box in tryhackme (for example king of the hill)

white salmon Jun 15, 2020, 6:27 PM

#

ok.

#

nmap <ip>

oblique cliff Jun 15, 2020, 6:27 PM

#

you need to be connected to the vpn

#

and then nmap {ip}

white quartz Jun 15, 2020, 6:27 PM

#

ok

#

but nmap closes the byme

white salmon Jun 15, 2020, 6:27 PM

#

what?

white quartz Jun 15, 2020, 6:27 PM

#

*by me

white salmon Jun 15, 2020, 6:27 PM

#

why>

oblique cliff Jun 15, 2020, 6:28 PM

#

nmap closes the by me

#

what does that mean

white quartz Jun 15, 2020, 6:28 PM

#

📎 unknown.png

teal belfry Jun 15, 2020, 6:29 PM

#

any hint for room break out the cage?

oblique cliff Jun 15, 2020, 6:29 PM

#

so then if youre on the vpn you can nmap 10.10.198.245 @white quartz

white quartz Jun 15, 2020, 6:30 PM

#

ok it works thanks

white salmon Jun 15, 2020, 6:31 PM

#

just wait a few minutes to make sure the box is completely deployed/booted

#

@oblique cliff not in the blob, I'm crying😫

eternal brook Jun 15, 2020, 6:39 PM

#

hey this question is quite basic how do i know whether a machine has network file system that is shared...like is it somewhere given in nmap scan or we have to always check for using mount?

white salmon Jun 15, 2020, 6:40 PM

#

you mean Samba>

#

?

eternal brook Jun 15, 2020, 6:40 PM

#

if someone could clarify

#

i suppose samba is for communication bw linux and windows

#

and we can point out samba/smb by seeing 139 and 445 open

#

but what about NFS how do i get to know they exist

#

or is the same thing?

steady stratus Jun 15, 2020, 6:42 PM

#

Samba uses the SMB protocol for file sharing 🙂

#

NFS is file sharing too - but it doesn't use or work with SMB it's purely TCP & UDP

eternal brook Jun 15, 2020, 6:43 PM

#

wasnt smb used earlier to communicate only bw windows and windows?🤔

#

then samba came for linux🤔

steady stratus Jun 15, 2020, 6:44 PM

#

I believe NFS uses 111

eternal brook Jun 15, 2020, 6:44 PM

#

that rcp i think

white salmon Jun 15, 2020, 6:44 PM

#

use enum4linux -a <IP>.

steady stratus Jun 15, 2020, 6:45 PM

#

SMB is across both platforms - the software that uses SMB may not be

eternal brook Jun 15, 2020, 6:45 PM

#

so when i see 111 open i should check for mounted folders right

white salmon Jun 15, 2020, 6:45 PM

#

You'll see all things SMB related.

eternal brook Jun 15, 2020, 6:45 PM

#

yea i know that

white salmon Jun 15, 2020, 6:45 PM

#

@steady stratus Hello, look at the rank ❤️ finally 🙂

#

smbclient is also usefull

#

+1

eternal brook Jun 15, 2020, 6:45 PM

#

smb not the issue

#

nfs is

white salmon Jun 15, 2020, 6:45 PM

#

emun4linux is an old old script

eternal brook Jun 15, 2020, 6:45 PM

#

getting kinda confuse

steady stratus Jun 15, 2020, 6:46 PM

#

Port mappings are a good indicator however they can't confirm for you. Don't assume a service corresponds to the port it is using

white salmon Jun 15, 2020, 6:46 PM

#

https://linuxize.com/post/how-to-mount-an-nfs-share-in-linux/

How to Mount an NFS Share in Linux

NFS is a distributed file system protocol that allows you to share remote directories over a network. In this tutorial, we will show you how to manually and automatically mount an NFS share on Linux systems.

steady stratus Jun 15, 2020, 6:46 PM

#

e.g. the default port for web servers is 80 but that's just a standard - you can anything on that

eternal brook Jun 15, 2020, 6:47 PM

#

so you're saying it's good practice to check for mounted folder?

white salmon Jun 15, 2020, 6:47 PM

#

with showmount you can see all shares on the target

eternal brook Jun 15, 2020, 6:48 PM

#

smb too?

#

well that's great

#

thanks for the tip 🙂

white salmon Jun 15, 2020, 6:49 PM

#

YES!

teal belfry Jun 15, 2020, 6:50 PM

#

anyone will help me?

white salmon Jun 15, 2020, 6:50 PM

#

just ask

teal belfry Jun 15, 2020, 6:50 PM

#

in room : break out the cage! just a hint..

white salmon Jun 15, 2020, 6:51 PM

#

enum

teal belfry Jun 15, 2020, 6:51 PM

#

bro i did enumeration...........

#

and i dont know why dirbuster isnt working on that web..

white salmon Jun 15, 2020, 6:54 PM

#

dirb http:/...../ -R

dapper mauve Jun 15, 2020, 6:54 PM

#

wrestling with break out the cage - finally (slowly) getting there. 🙂

white salmon Jun 15, 2020, 6:54 PM

#

If it has FTP, use enum4linux -a IP

tidal sedge Jun 15, 2020, 6:54 PM

#

I believe NFS uses 111
@steady stratus What? Doesn't NFS use port 2049?(ignore )

eternal brook Jun 15, 2020, 6:55 PM

#

yeaaa

#

just noticed the scan again

#

it has 2049 open

#

@tidal sedge

white salmon Jun 15, 2020, 6:56 PM

#

2049 NFS, 99% of the time.

tidal sedge Jun 15, 2020, 6:57 PM

#

Hmm, no, looks like NFS uses both port 111 and 2049.

eternal brook Jun 15, 2020, 6:57 PM

#

111 is also open though

tidal sedge Jun 15, 2020, 6:58 PM

#

Yeah, it uses both ports.

teal belfry Jun 15, 2020, 6:59 PM

#

@white salmon its not working..

white salmon Jun 15, 2020, 7:06 PM

#

use a bigger wordlist

upper heath Jun 15, 2020, 7:27 PM

#

any hint for cage -> root on Cage

quiet stump Jun 15, 2020, 7:30 PM

#

Very similar to inital

dapper mauve Jun 15, 2020, 7:38 PM

#

Break from the cage....got a word out the thing....not sure what to do with it yet. Hanging the mouse up for the evening. Fresh eyes in the morning.

quiet stump Jun 15, 2020, 7:41 PM

#

Best thing 🙂 best not to overthink

solid patrol Jun 15, 2020, 7:42 PM

#

magna is there more than 2 ways of gaing root on your machine

quiet stump Jun 15, 2020, 7:44 PM

#

There is more than 1, yes

median compass Jun 15, 2020, 7:53 PM

#

ok, that's not how the spoiler tags work then...

glossy basin Jun 15, 2020, 7:54 PM

#

you need to do || spoiler ||

#

fix it please

quiet stump Jun 15, 2020, 7:54 PM

#

Spoilers mate blimey!

#

Can u remove please

#

ta

glossy basin Jun 15, 2020, 7:54 PM

#

removed

#

I guess giving spoilers for fresh rooms isn't good

median compass Jun 15, 2020, 7:54 PM

#

i was fixing! sorry about that

glossy basin Jun 15, 2020, 7:54 PM

#

it's fine it's fine

#

just ask your question without your results

quiet stump Jun 15, 2020, 7:55 PM

#

Tbf the box in it's majority is enum and the same throughout with a bit of python for good luck

#

That's as far as I'll go with hints/help

median compass Jun 15, 2020, 7:56 PM

#

I'm just slow today, took way longer than it should to make progress! i'll stick at it

quiet stump Jun 15, 2020, 7:56 PM

#

Good lad 🙂 u'll kick urself when u get it

median compass Jun 15, 2020, 7:56 PM

#

lol, usually do 🙂

torn mural Jun 15, 2020, 8:29 PM

#

@quiet stump Thanks for the room, it was fun!

quiet stump Jun 15, 2020, 8:29 PM

#

Anytime buddy 🙂 glad u enjoyed it

median compass Jun 15, 2020, 8:33 PM

#

phew, got it, thanks @quiet stump, great room!

#

not sure i'd tag it as easy though 🙂 of course I think Carpe needs a level above hard though lol

quiet stump Jun 15, 2020, 8:35 PM

#

Thanks mate 🙂 we'll see what u think of my medium difficulty 1 coming up 😉

indigo ridge Jun 15, 2020, 8:36 PM

#

hey hint for cipher of cage

median compass Jun 15, 2020, 8:36 PM

#

can i ask you a quick q by pm before I put it away @quiet stump, curious if my route was the route

quiet stump Jun 15, 2020, 8:37 PM

#

Go for it 🙂

wraith marsh Jun 15, 2020, 8:38 PM

#

Can I slide back in Magna, just wanna check my path was the intended 🙂

wispy bloom Jun 15, 2020, 9:24 PM

#

Ice room
||Task 4 - Step 10 Now that we've set our session number, further options will be revealed in the options menu. We'll have to set one more as our listener IP isn't correct. What is the name of this option?||

#

📎 SPOILER_unknown.png

#

Am I missing something here? I don't see the additional options

#

I know what the answer is for that flag... but still doesn't explain why that option is for this particular exploit isn't there. And of course, I can't set it if it isn't an option

wispy bloom Jun 15, 2020, 9:44 PM

#

Nevermind. I figured it out. ||I reentered the meterpreter session, backed out to the exploit module and it shows up correctly now.||

oblique cliff Jun 15, 2020, 9:47 PM

#

@wispy bloom You’ll find That happens often in Metasploit. ||So you usually have to set the listening stuff a few times before it actually works ||

wispy bloom Jun 15, 2020, 9:47 PM

#

@oblique cliff Good to know. Thank you 👍

low venture Jun 15, 2020, 9:51 PM

#

any cipher hints for breaking the cage?

sick coyote Jun 15, 2020, 9:56 PM

#

It might be something French

low venture Jun 15, 2020, 10:05 PM

#

@sick coyote never heard of this cipher; I appreciate it. One more for the tool box.

sick coyote Jun 15, 2020, 10:07 PM

#

@low venture I dont know if you know this toolset, but I think it contains most of the decodings: https://gchq.github.io/CyberChef/

CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

low venture Jun 15, 2020, 10:09 PM

#

@sick coyote I appreciate it

toxic scarab Jun 15, 2020, 10:15 PM

#

break out the cage was a bit rougher than i expected. I'm certain I didn't follow the intended path, so I look forward to seeing some writeups to see how others did it

low venture Jun 15, 2020, 10:49 PM

#

@toxic scarab any hints on getting into cage user?

white salmon Jun 15, 2020, 10:54 PM

#

did you go trough 'CC: Steganography' ?

lyric steeple Jun 16, 2020, 12:50 AM

#

any cipher hints for breaking the cage?
@low venture the cipher needs a key. First step is to find a key.

low venture Jun 16, 2020, 12:51 AM

#

@lyric steeple I was able to past the cipher, thankfully. Logged into the machine, now I'm trying to figure out how to escalate.

lyric steeple Jun 16, 2020, 12:52 AM

#

@low venture good luck 🙂

#

any hints for carpe diem ? Found some interesting data but have no idea how to move forward

halcyon lodge Jun 16, 2020, 1:00 AM

#

Anyone can give a hint to escalate to user cage?

toxic scarab Jun 16, 2020, 3:10 AM

#

@low venture just keep beating your head against the wall ||hey, where are all those movie quotes coming from?!?||

low venture Jun 16, 2020, 3:11 AM

#

@toxic scarab I did come across that; still beating my head against the wall, haha

halcyon lodge Jun 16, 2020, 3:14 AM

#

@toxic scarab bless your soul! That gave me an idea.

dull comet Jun 16, 2020, 3:45 AM

#

im on hacking powershell task 4 question 11.. Search for all files containing API_KEY? anyone have an idea what this is asking for?

white salmon Jun 16, 2020, 3:50 AM

#

@wispy bloom what is the name of your font from that picture?

wispy bloom Jun 16, 2020, 3:51 AM

#

It’s a code tag

#

‘ subject ‘

#

Without spaces

#

Back tics though not single quotes.

#

I’m on Mobile

oblique cliff Jun 16, 2020, 3:58 AM

#

@dull comet it’s telling you to search through all the files on the machine for a file that contains the word API_KEY in it

desert helm Jun 16, 2020, 5:44 AM

#

I am doing the strings from malware series and i can't find the answer of the first question "what is the name of the account that had the passcode of 12345678 in the intellin account disscussed above"?can somebody give me a hint?

foggy bone Jun 16, 2020, 6:11 AM

#

Can someone please help me with Break Out The Cage? I’m having some difficulty with privilege escalation. ||I tried replacing the .quotes file with some text and piping in another command but that didn’t work. E.G. FLAG | ls -lah /home/cage||

white salmon Jun 16, 2020, 6:14 AM

#

📎 OpenSSL_Issue_TryHackMe_VPN.png

gritty spire Jun 16, 2020, 6:14 AM

#

I need help with the room Break Out The Cage. I have got access to the machine, spawned a reverse shell and got the first flag. I have the second cipher text. How should I proceed further ?

white salmon Jun 16, 2020, 6:15 AM

#

What's happening to my VPN?

spiral stag Jun 16, 2020, 6:15 AM

#

it exited due to a fatal error

white salmon Jun 16, 2020, 6:15 AM

#

Yes, I know.

#

How do I fix it? I tried regenerating,

#

and switching servers.

spiral stag Jun 16, 2020, 6:16 AM

#

safe the ovpn file in /etc/openvpn

white salmon Jun 16, 2020, 6:16 AM

#

Switched server again nvm.

spiral stag Jun 16, 2020, 6:16 AM

#

ok

white salmon Jun 16, 2020, 6:16 AM

#

Worked somehow. 🙂

foggy bone Jun 16, 2020, 6:35 AM

#

@gritty spire DM me. I was able to figure it out

white salmon Jun 16, 2020, 7:21 AM

#

Tips on the cipher key on break the cage?

spiral stag Jun 16, 2020, 7:22 AM

#

@white salmon some french guy

white salmon Jun 16, 2020, 7:23 AM

#

I KNOW

#

what key?

#

how do I get it?

spiral stag Jun 16, 2020, 7:23 AM

#

google.it

white salmon Jun 16, 2020, 7:23 AM

#

the cipher key?

#

it's a variable.

spiral stag Jun 16, 2020, 7:23 AM

#

enumerate the machine

white salmon Jun 16, 2020, 7:23 AM

#

did that

spiral stag Jun 16, 2020, 7:24 AM

#

you should have found some interesting stuff

white salmon Jun 16, 2020, 7:25 AM

#

I have, but i'm tsill trying

spiral stag Jun 16, 2020, 7:26 AM

#

what files have you found sofar?

white salmon Jun 16, 2020, 7:31 AM

#

i got the exploit for priv escalation

#

how do I set spioiler?

spiral stag Jun 16, 2020, 7:32 AM

#

||spoiler||

white salmon Jun 16, 2020, 7:32 AM

#

|| I used dirb, i got file hash from the FTP, i got scripts and contracts, and privesc vulnerrability.||

#

|| i know the hash is base64 -> vigenere ||

#

||i'm now running hydra on ssh and dirb on server and trying to get a shell||

spiral stag Jun 16, 2020, 7:34 AM

#

no need to bruteforce

white salmon Jun 16, 2020, 7:34 AM

#

ok

spiral stag Jun 16, 2020, 7:34 AM

#

if you decipher

white salmon Jun 16, 2020, 7:35 AM

#

It all makes sense

#

|| get pass -> ssh -> exploit -> root -> end ||

wooden mist Jun 16, 2020, 7:36 AM

#

The killchain is a tad bit longer

spiral stag Jun 16, 2020, 7:41 AM

#

pls don't post answers here

#

and for which key?

white salmon Jun 16, 2020, 7:42 AM

#

||vigenere||

spiral stag Jun 16, 2020, 7:42 AM

#

for what user?

white salmon Jun 16, 2020, 7:42 AM

#

WHAT?

#

|| i got the key for the 2nd cipher||

placid drift Jun 16, 2020, 8:03 AM

#

i hate vim, any hints ?

📎 unknown.png

white salmon Jun 16, 2020, 8:15 AM

#

@placid drift you hate vim?

placid drift Jun 16, 2020, 8:15 AM

#

kinda

white salmon Jun 16, 2020, 8:15 AM

#

you are such a smart person.

#

nano > vim.

jade bolt Jun 16, 2020, 8:23 AM

#

hi y'all, im a bit stuck, im doing break out of the cage. I got a file with some sort of encoding (i think) and now im stuck :/ CyberChef can't make anything out of it. Any hints?

white salmon Jun 16, 2020, 8:34 AM

#

Yes, google.

#

Google the encryption type.

hasty slate Jun 16, 2020, 8:41 AM

#

i always try to see a text and check if it is english or not(spaces, words, sentences, exclamation, questionmark, fullstop etc give u hints). And if it is english then it has to be some kind of substitution cipher. use any online cipher detector.. and then if it is keyed cipher use a solver. honestly most of the time u don't even need to know the key the solver will detect it.

quiet stump Jun 16, 2020, 8:54 AM

#

Try and learn what something is before throwing it into an automated tool.

carmine scroll Jun 16, 2020, 9:10 AM

#

did someone tried break out the cage? I am stuck after getting the directories. I have some encoded data from ftp but that is of no use for now anywhere. Can someone give a hint to move forward?

rancid crystal Jun 16, 2020, 9:11 AM

#

@carmine scroll you got weston password?

quiet stump Jun 16, 2020, 9:11 AM

#

Enum enum

rancid crystal Jun 16, 2020, 9:11 AM

#

^

#

More like stego stego(As the room tag suggests)

white salmon Jun 16, 2020, 9:13 AM

#

did someone tried break out the cage? I am stuck after getting the directories. I have some encoded data from ftp but that is of no use for now anywhere. Can someone give a hint to move forward?
@carmine scroll decode the weird thingy text.

carmine scroll Jun 16, 2020, 9:13 AM

#

i tried base64 decoder but I don't think it is b64

jade bolt Jun 16, 2020, 9:15 AM

#

I think it is base64 with something else, after basse64 it looked very much like the content was there but the words are not words

quiet stump Jun 16, 2020, 9:15 AM

#

https://tenor.com/view/oui-french-yes-gif-15070937

Tenor

jade bolt Jun 16, 2020, 9:16 AM

#

but thats where im stuck hahahaha

carmine scroll Jun 16, 2020, 9:16 AM

#

yes

#

@jade bolt

jade bolt Jun 16, 2020, 9:18 AM

#

When you decode it it looks like there are numbers on the left ||one. two. three. four. five.||

rancid crystal Jun 16, 2020, 9:18 AM

#

Magna throwing gif hints

jade bolt Jun 16, 2020, 9:19 AM

#

yeah i got it 😄 but there are loads of options

rancid crystal Jun 16, 2020, 9:19 AM

#

not really 😛 I also started it yesterday and that gif hint got me into the machine. will try again to privesc today

#