#room-hints | TryHackMe | Page 34

white salmon Jun 16, 2020, 12:44 PM

#

lel

#

kurisuti help me pls

#

?.

#

It takes very long because you crack in a VM!

#

ups...

#

🙂

indigo ridge Jun 16, 2020, 12:52 PM

#

Looking for help on Mindgames Priv Esc 😄
I don't know if I am missing something obvious but wow 😐
@mental osprey mee too need help

rigid rose Jun 16, 2020, 1:05 PM

#

||must_practice_corrupt_file.mp3|| it's rabbit hole? 🤔

white salmon Jun 16, 2020, 1:06 PM

#

try harder

#

eventulally i will figure out the context structure to make this do what i want it to do on cage. know the path to cage, justneed to ... um... break it in a way i want to break it to do the thing i want it to do ... sometimes easy boxes make you feel really stupid when you can't make simple python do what you want it to do 😦

#

You can.

#

It's easy.

#

try harder

jade bolt Jun 16, 2020, 1:20 PM

#

Do i need to find cage's info trough weston?

wooden mist Jun 16, 2020, 1:22 PM

#

not really "info" per se

jade bolt Jun 16, 2020, 1:22 PM

#

i mean the ||id_rsa||

wooden mist Jun 16, 2020, 1:23 PM

#

I think you can grab that

rigid rose Jun 16, 2020, 1:24 PM

#

@jade bolt you need privesc from weston to cage to get 2 flag

jade bolt Jun 16, 2020, 1:25 PM

#

yeah i knew that but still thank you for helpiing!

rigid rose Jun 16, 2020, 1:27 PM

#

I'm stuck between cage and root 🙂

white salmon Jun 16, 2020, 1:37 PM

#

Keep looking!

#

It's there man..

stoic jewel Jun 16, 2020, 1:46 PM

#

Hi Guys I Nedd A Hint Of Mr Robot Room CTF, The Second Flag

teal belfry Jun 16, 2020, 1:50 PM

#

@white salmon the hint for break out the cage didnt worked for me..

#

im still stucked

white salmon Jun 16, 2020, 1:50 PM

#

What hint?

#

🙂

teal belfry Jun 16, 2020, 1:50 PM

#

enum

white salmon Jun 16, 2020, 1:50 PM

#

I did not say enum.

hasty slate Jun 16, 2020, 1:51 PM

#

which user are u currently @teal belfry

teal belfry Jun 16, 2020, 1:51 PM

#

lol i didnt got the password yet..

hasty slate Jun 16, 2020, 1:53 PM

#

oh so u are in the first question? so did u try to explore all the ports and see if anything is in them?

teal belfry Jun 16, 2020, 1:53 PM

#

ftp server just but how to get into that...

hasty slate Jun 16, 2020, 1:53 PM

#

google

stoic jewel Jun 16, 2020, 1:54 PM

#

what about me 🙂 I'm not concerned 😦

hasty slate Jun 16, 2020, 1:54 PM

#

google ftp enumeration.

#

@stoic jewel u in the box?

#

for mr robot?

stoic jewel Jun 16, 2020, 1:56 PM

#

@hasty slate yeah

white salmon Jun 16, 2020, 1:56 PM

#

@teal belfry man..

hasty slate Jun 16, 2020, 1:56 PM

#

so did u ran any enumeration checklist?

white salmon Jun 16, 2020, 1:56 PM

#

use metasploit.

hasty slate Jun 16, 2020, 1:57 PM

#

@white salmon doesn't need it.

white salmon Jun 16, 2020, 1:57 PM

#

i did it the classic way but eh.

jade bolt Jun 16, 2020, 1:57 PM

#

but there is a much easier way

hasty slate Jun 16, 2020, 1:58 PM

#

maybe check for files that u can read :/

jade bolt Jun 16, 2020, 1:58 PM

#

There's this hacker group that can enter everything

stoic jewel Jun 16, 2020, 1:59 PM

#

@hasty slate I did it this is for the first flag, I treid with wp-scan but there is nothing

white salmon Jun 16, 2020, 1:59 PM

#

they can help you. anon..

#

cannot say the name.

#

they will bomb my house.

#

shh...

#

🙂

#

🙂

jade bolt Jun 16, 2020, 1:59 PM

#

yup, pretty similar face tho

hasty slate Jun 16, 2020, 2:00 PM

#

so u said u are in the box, that means u are not @stoic jewel .. u are at the ||wp|| stage?

solemn smelt Jun 16, 2020, 2:00 PM

#

This doesn’t seem like the right place for this

white salmon Jun 16, 2020, 2:00 PM

#

they are a little worse than fsociety.

#

the guys with the weird white long masks.

hasty slate Jun 16, 2020, 2:00 PM

#

use #general maybe?

jade bolt Jun 16, 2020, 2:00 PM

#

@solemn smelt huh? this is a hint for @teal belfry

white salmon Jun 16, 2020, 2:00 PM

#

we are giving him anon ftp login hints.

hasty slate Jun 16, 2020, 2:00 PM

#

😐 damn that's convoluted lol

stoic jewel Jun 16, 2020, 2:01 PM

#

@hasty slate soory I missed it I'm not yet

solemn smelt Jun 16, 2020, 2:01 PM

#

? I don’t see how but ok

jade bolt Jun 16, 2020, 2:01 PM

#

can i dm you?

white salmon Jun 16, 2020, 2:01 PM

#

CHECK FOR ANONYMOUS LOGIN FFS @teal belfry

jade bolt Jun 16, 2020, 2:01 PM

#

uhm

#

thats a way

white salmon Jun 16, 2020, 2:01 PM

#

god, some people never use their brains..

hasty slate Jun 16, 2020, 2:03 PM

#

wow chill @white salmon lol .. also @stoic jewel u can consult the writeups as well..

stoic jewel Jun 16, 2020, 2:04 PM

#

@hasty slate I think this is a not a good idea right now

hasty slate Jun 16, 2020, 2:04 PM

#

checking writeups?

jade bolt Jun 16, 2020, 2:04 PM

#

why not?

hasty slate Jun 16, 2020, 2:05 PM

#

yeah.. i mean u learn from writeups.. if u are stuck then u need to first learn.. then use that knowledge in the next box

teal belfry Jun 16, 2020, 2:07 PM

#

@hasty slate i got the file with pass

#

n figured out it is a combo of base64 and something

#

is it right?

jade bolt Jun 16, 2020, 2:09 PM

#

on the right track yeah

hasty slate Jun 16, 2020, 2:09 PM

#

^

#

i already gave a hint in this channel or the community help.. maybe that will help u..

jade bolt Jun 16, 2020, 2:10 PM

#

a lot of people have given a hint haha i got it because of them

teal belfry Jun 16, 2020, 2:10 PM

#

lol it would have scrolled millions upwards

hasty slate Jun 16, 2020, 2:10 PM

#

or maybe serach from: <username>

#

lol

jade bolt Jun 16, 2020, 2:11 PM

#

kurisuti said something at 11:20

hasty slate Jun 16, 2020, 2:13 PM

#

and mine was at 2:11 IST here

jade bolt Jun 16, 2020, 2:15 PM

#

im low key still stuck as weston, and a linpeas scan hasn't given me anything big

hasty slate Jun 16, 2020, 2:16 PM

#

@jade bolt check what files u can read/write

analog fiber Jun 16, 2020, 2:17 PM

#

anyone familiar with pwntools?

#

doing the buffer overflow room and would appreciate some guidance

jade bolt Jun 16, 2020, 2:18 PM

#

@hasty slate can i DM you?

hasty slate Jun 16, 2020, 2:18 PM

#

sure

white salmon Jun 16, 2020, 2:20 PM

#

welcome to the party @jade bolt ... know what to do , just literally can't string what i want to do together 😦

jade bolt Jun 16, 2020, 2:20 PM

#

yup

rancid crystal Jun 16, 2020, 2:20 PM

#

talking about Cage room?

jade bolt Jun 16, 2020, 2:20 PM

#

yup

white salmon Jun 16, 2020, 2:20 PM

#

tired of working inside a parenthetical call commands

rancid crystal Jun 16, 2020, 2:21 PM

#

got weston password?

white salmon Jun 16, 2020, 2:22 PM

#

me, yes... been playign with coding languages, specifically tryign to get the thing to do what i want it to do.

rigid rose Jun 16, 2020, 2:22 PM

#

@jade bolt you do not mind the appearance of broadcast messages in pts? find where they come from - it's the way to Cage.

jade bolt Jun 16, 2020, 2:22 PM

#

yes i do and i have altered them

#

but

#

yeah

#

i will find a way!

#

omg :/

hasty slate Jun 16, 2020, 2:25 PM

#

pfft that wasn't a hint.. that should be in #room-help lol

jade bolt Jun 16, 2020, 2:26 PM

#

but i got it thanks 😉

slender umbra Jun 16, 2020, 2:33 PM

#

hie can someone help me with cc pentesting [Task 4] [Section 2 - Web Enumeration] - gobuster i tried the dir search but there isn't any hidden file i found even after doing search from medium list

jade bolt Jun 16, 2020, 2:34 PM

#

what wordlist do you use?

slender umbra Jun 16, 2020, 2:34 PM

#

medium existing in dirb in kali

#

i even used small and common

#

but no luck

rose root Jun 16, 2020, 2:34 PM

#

Hi, I need some hint for dogcat room. Is there RFI vuln?

hasty slate Jun 16, 2020, 2:40 PM

#

@rose root no.. it's the other FI

rose root Jun 16, 2020, 2:44 PM

#

@hasty slate thx

tidal sedge Jun 16, 2020, 2:51 PM

#

@slender umbra Run the gobuster on the root directory.

slender umbra Jun 16, 2020, 2:54 PM

#

i'm running it on the root directory

tidal sedge Jun 16, 2020, 2:59 PM

#

Of the webserver

toxic scarab Jun 16, 2020, 3:00 PM

#

@slender umbra are you searching for the right extension for the hidden file?

slender umbra Jun 16, 2020, 3:03 PM

#

okay i got it thank you so much for help @tidal sedge @jade bolt @toxic scarab

vernal spruce Jun 16, 2020, 3:10 PM

#

Can anyone dm me for a nudge on the foothold for Iron Corp? (dont wanna share spoilers 😄 )

wintry crescent Jun 16, 2020, 3:17 PM

#

hey people , can someone give me a hint about what to do after decoding the first cipher?

rancid crystal Jun 16, 2020, 3:21 PM

#

Enumrate harder ^

wintry crescent Jun 16, 2020, 3:22 PM

#

|| the website ? ||

dapper mauve Jun 16, 2020, 3:34 PM

#

cage - I can make it work locally.....just doesnt seem to work on the box. Huurrrrrumph.

jade bolt Jun 16, 2020, 3:39 PM

#

@wintry crescent what room are you doing?

wintry crescent Jun 16, 2020, 3:39 PM

#

cage

jade bolt Jun 16, 2020, 3:40 PM

#

maybe eat som baguette and drink some wine and take a break it will com to you

wintry crescent Jun 16, 2020, 3:42 PM

#

I actually decoded the text but i have no idea how to get the password tho

dense marlin Jun 16, 2020, 3:57 PM

#

hey there guys can i get some nudge for Break out the cage root path? now i've read ||the email and i found a weird text that's i think it's a ciphertext for root password||

#

i've tried the ||common cipher breaker like caesar, vigenere, substitution, railfence|| but doesnt get any text that looks like a password

#

just wanted to know am i on the right path?

jade bolt Jun 16, 2020, 4:02 PM

#

@wintry crescent i can only give you hints, if you really want help we need to go to #room-help

dapper mauve Jun 16, 2020, 4:09 PM

#

cage...break out.....whatever - Finally got the thing to do what I wanted it to. That took far far far too long trying to be far far far too clever 🙂

hasty slate Jun 16, 2020, 4:11 PM

#

@dense marlin use spoiler tags

toxic scarab Jun 16, 2020, 4:11 PM

#

@dapper mauve did you finish? i'd be interested in knowing how you managed to get root. I don't think my path was the standard one.

#

@dapper mauve dm me if you feel like sharing

hasty slate Jun 16, 2020, 4:12 PM

#

there are atleast 2 paths that i am aware of

toxic scarab Jun 16, 2020, 4:13 PM

#

i gave up after finding one

atomic shuttle Jun 16, 2020, 4:15 PM

#

can i dm you, stuck at getting root @hasty slate

hasty slate Jun 16, 2020, 4:16 PM

#

sure

jade bolt Jun 16, 2020, 4:16 PM

#

I think everybosy is stuck at getting root hahahaha

toxic scarab Jun 16, 2020, 4:19 PM

#

@hasty slate ok if I DM you?

hasty slate Jun 16, 2020, 4:19 PM

#

sure

dense marlin Jun 16, 2020, 4:31 PM

#

@hasty slate mind i dm you for nudge for break out the cage?

hasty slate Jun 16, 2020, 4:31 PM

#

sure

rancid crystal Jun 16, 2020, 4:38 PM

#

Too many DMs 😄

#

imma ping you when i try to do this room 😄

hasty slate Jun 16, 2020, 4:39 PM

#

lol no xD

#

sure :-p

dapper mauve Jun 16, 2020, 4:40 PM

#

Break out...Cage.....Done! Think I did the intended path. Spent ages over complicating it in the middle but actually turned out relatively straight forward (once you google the syntax of the command you're already using)....Great room!! 🙂

hasty slate Jun 16, 2020, 4:40 PM

#

hmm that means most probably u didn't do the intended path lol

covert basalt Jun 16, 2020, 4:44 PM

#

just wondering what was the intended part for root in cage ;|| creation or decryption ||

rancid crystal Jun 16, 2020, 4:46 PM

#

there are two ways to root it

covert basalt Jun 16, 2020, 4:46 PM

#

is that a question or statement

hasty slate Jun 16, 2020, 4:48 PM

#

there are two ways to root it.

covert basalt Jun 16, 2020, 4:50 PM

#

don't mind @rancid crystal didn't understand your point at first instance

quiet stump Jun 16, 2020, 4:51 PM

#

Hints not spoilers der bois

hasty slate Jun 16, 2020, 4:52 PM

#

sorry sensei

rancid crystal Jun 16, 2020, 4:52 PM

#

don't mind @rancid crystal didn't understand your point at first instance
@covert basalt uhh about what?

covert basalt Jun 16, 2020, 4:53 PM

#

there are two ways to root it
@rancid crystal .

rancid crystal Jun 16, 2020, 4:53 PM

#

there are two ways to get root in it as @hasty slate some where above here. havent rooted it myself just read that here

covert basalt Jun 16, 2020, 4:54 PM

#

@hasty slate did that binary ||bees|| came handy?

hasty slate Jun 16, 2020, 4:55 PM

#

check the first lines of that output :-p

indigo ridge Jun 16, 2020, 5:22 PM

#

cage

quiet stump Jun 16, 2020, 5:23 PM

#

All hints for Cage are in here @indigo ridge, scroll up

rigid rose Jun 16, 2020, 5:24 PM

#

@quiet stump thx for great box! 😏 liked it 😉

quiet stump Jun 16, 2020, 5:24 PM

#

Thank you 🙂 means a lot to see everybody enjoying the box.

rigid rose Jun 16, 2020, 5:24 PM

#

password saddened me 😕

stoic jewel Jun 16, 2020, 5:40 PM

#

@hasty slate logged in wp

#

what is the next step 🙂

toxic scarab Jun 16, 2020, 5:51 PM

#

@quiet stump thanks for the box - frustratingly fun. Plans for cage.2? I need to know who the master is!!

trim haven Jun 16, 2020, 6:01 PM

#

@toxic scarab you should go to #522158404614225920

carmine scroll Jun 16, 2020, 6:13 PM

#

stuck with breakoutthecage. After getting the ssh access. Do i need to privesc for both the flags?

sick coyote Jun 16, 2020, 6:19 PM

#

Anyone got a hint for flag 74 of CTF 100?

carmine scroll Jun 16, 2020, 6:21 PM

#

ok

quiet stump Jun 16, 2020, 6:54 PM

#

@toxic scarab Thank you 🙂 not currently, working on a room atm, maybe after 😉

obsidian cradle Jun 16, 2020, 6:56 PM

#

anyone here finish breakoutthecage?

#

i just need root

quiet stump Jun 16, 2020, 6:57 PM

#

Dude

#

delete that now

obsidian cradle Jun 16, 2020, 6:57 PM

#

xD

quiet stump Jun 16, 2020, 6:57 PM

#

ty

obsidian cradle Jun 16, 2020, 6:57 PM

#

i have 2 flags

quiet stump Jun 16, 2020, 6:57 PM

#

strong spoiler mah friend

obsidian cradle Jun 16, 2020, 6:58 PM

#

i didnt even use the string for anything

#

?? i found westons password another way ig

#

i already exploited that

#

need root

#

i have found the gibberish string that sean wrote down

#

cage, from sean*

#

rot13?

#

well cause i been trying decode this damn string for an hour

#

xD deciphering is one of my weakpoints

#

if cyberchef dont do it its allll bad for me

#

hmm something criminal maybe

halcyon lodge Jun 16, 2020, 7:08 PM

#

Took longer than expected but it was a good room. @quiet stump, great room. I look forward to the next one.

quiet stump Jun 16, 2020, 7:08 PM

#

@halcyon lodge Easily to overthink it 🙂 glad u enjoyed it

obsidian cradle Jun 16, 2020, 7:11 PM

#

i hate it here

#

does it have to do with the movie

stuck kernel Jun 16, 2020, 7:15 PM

#

Im doing the intro the python room. its got to decoding the file and decoding it to get the flag... im completely lost and dont even know where to begin.

oblique cliff Jun 16, 2020, 7:17 PM

#

look into python decoding

#

if you know how its encoded you can get more specific with your search

chilly canopy Jun 16, 2020, 7:18 PM

#

I'm trying to get going with the Break Out The Cage room but at the moment I'm kind of stuck.
I've been busy for a while now but nothing seems to get me any further.
Does anyone have a hint.

quiet stump Jun 16, 2020, 7:19 PM

#

Tons of hints for Cage in here 🙂 have a search

stuck kernel Jun 16, 2020, 7:21 PM

#

@oblique cliff been reading some of the documentation but tbh it doesn't help. im still as lost as i was when i started aha

oblique cliff Jun 16, 2020, 7:21 PM

#

do you know how its encoded @stuck kernel ?

stuck kernel Jun 16, 2020, 7:24 PM

#

@oblique cliff yeah, 5 times encoded using base64, 5 time encoded using base 32, 5times encoded using base 16

oblique cliff Jun 16, 2020, 7:24 PM

#

https://docs.python.org/2/library/base64.html#base64.b64decode @stuck kernel

#

seems pretty relevant

#

im sure theres similar stuff for the other two as well

stuck kernel Jun 16, 2020, 7:26 PM

#

ive read through that, doesn't make any sense to me

chilly canopy Jun 16, 2020, 7:28 PM

#

Tons of hints for Cage in here 🙂 have a search
@quiet stump I've read through it but I must be overthinking something. I have no clue where to go from all the things I already did

obsidian cradle Jun 16, 2020, 7:33 PM

#

:3

#

nothing 😛

#

just trying to exploit it another way

stuck kernel Jun 16, 2020, 7:43 PM

#

@oblique cliff have you done this intro to python flag. im so lost, i cant find anything online that comes close to helping..im sure when it works im probably going to slap myself in the face lol

oblique cliff Jun 16, 2020, 7:44 PM

#

have you tried using the stuff from the documentation i sent?

stuck kernel Jun 16, 2020, 7:45 PM

#

this is what ive got. i dont even know if im on the right tracks tbh

📎 unknown.png

white salmon Jun 16, 2020, 7:50 PM

#

i quit. i have gone through just about every iteration i can on this to escape chars and inject code. i can't google anymore. i made it work on a local copy of the script using the text i put into a modded file, but when it comes to game time no dice. and that isn't even apprently the worst part of the box yet. I have done some boxes in my day but this easy box is well.. lets just say i have some words i woudl use that aren't very friendly to type right now

obsidian cradle Jun 16, 2020, 7:50 PM

#

you need to take a break

#

frustration makes it more difficult

chilly canopy Jun 16, 2020, 7:51 PM

#

I have the same feeling. Not sure where to look anymore

obsidian cradle Jun 16, 2020, 7:51 PM

#

are you stuck on break the cage?

#

@chilly canopy

white salmon Jun 16, 2020, 7:51 PM

#

yo tresh you can send me a pm... maybe just maybe i can get you 99% there

#

and you can get the last 1%

chilly canopy Jun 16, 2020, 7:51 PM

#

are you stuck on break the cage?
@obsidian cradle Yes totally stuck

obsidian cradle Jun 16, 2020, 7:52 PM

#

stuck on root?

chilly canopy Jun 16, 2020, 7:52 PM

#

No on even the first question. I know it's humiliating.....

obsidian cradle Jun 16, 2020, 7:52 PM

#

not humiliating!! its a challenge

white salmon Jun 16, 2020, 7:53 PM

#

that one is not too bad. a bunch of people up there said some stuff about some french dudes and wine and bagueetes and stuff

obsidian cradle Jun 16, 2020, 7:53 PM

#

what steps have you taken to look for the password?

white salmon Jun 16, 2020, 8:08 PM

#

yams can i pm you. i legit need someon to tell me how this can run as an exact copy and provide 2 different results

#

actually anyone for that matter that has 2 mins to spare

obsidian cradle Jun 16, 2020, 8:10 PM

#

about what

#

?

white salmon Jun 16, 2020, 8:10 PM

#

the spamming walls

#

want to show two screen caps and can't explain

obsidian cradle Jun 16, 2020, 8:10 PM

#

sure pm

jade bolt Jun 16, 2020, 8:23 PM

#

hi, im in the room ignite, and i have access to www-data, after a linpeas i found a file with 99% PE but i dont know what to do, can anyone point me in a direcvtion?

toxic scarab Jun 16, 2020, 8:28 PM

#

@white salmon did you find your answer?

obsidian cradle Jun 16, 2020, 8:30 PM

#

@toxic scarab did you root break the cage?

toxic scarab Jun 16, 2020, 8:30 PM

#

yes

jade bolt Jun 16, 2020, 8:30 PM

#

hi, im in the room ignite, and i have access to www-data, after a linpeas i found a file with 99% PE but i dont know what to do, can anyone point me in a direcvtion?
@jade bolt anyone?

obsidian cradle Jun 16, 2020, 8:31 PM

#

i have everything i need besides the brainpower!! any hints?? everyone said emails and what not, your same answer?

jade bolt Jun 16, 2020, 8:31 PM

#

yes, everything you need is in that directory

toxic scarab Jun 16, 2020, 8:32 PM

#

you are cage now?

obsidian cradle Jun 16, 2020, 8:32 PM

#

i am not the user cage, no, but i have access to his directory

hasty slate Jun 16, 2020, 8:32 PM

#

lol @obsidian cradle there are crazy amounts of hints in this channel

#

just scroll

obsidian cradle Jun 16, 2020, 8:32 PM

#

trust i read them all

#

i am stupid or something

#

i literally dk

hasty slate Jun 16, 2020, 8:33 PM

#

lol i mean this has been going for 1-2 days.. so there are literally 10-20hints here

obsidian cradle Jun 16, 2020, 8:33 PM

#

ive read the emails over and over

hasty slate Jun 16, 2020, 8:33 PM

#

check from where the emails are being sent

#

u are in weston right?

obsidian cradle Jun 16, 2020, 8:34 PM

#

wdym in weston

#

i have westons password, ssh'd as weston, and have complete access to /home/cage/*

hasty slate Jun 16, 2020, 8:36 PM

#

yea so check from where the emails are being generated

obsidian cradle Jun 16, 2020, 8:36 PM

#

i am passed that part

#

you mean the broadcasts using wall, right?

jade bolt Jun 16, 2020, 8:37 PM

#

what user are you?

obsidian cradle Jun 16, 2020, 8:37 PM

#

weston

#

i never logged in as cage but i have access to all his files

#

so i have the user flag already, i just need to get root

jade bolt Jun 16, 2020, 8:38 PM

#

i get that

upper heath Jun 16, 2020, 8:38 PM

#

if you have access to his files then you have everything you need to get root

jade bolt Jun 16, 2020, 8:38 PM

#

exact

obsidian cradle Jun 16, 2020, 8:38 PM

#

right, this is what im tryna tell yall

oblique cliff Jun 16, 2020, 8:38 PM

#

@jade bolt is sql on the box?

jade bolt Jun 16, 2020, 8:38 PM

#

nope

obsidian cradle Jun 16, 2020, 8:39 PM

#

i have access to everything i just dont understand what i am missing

upper heath Jun 16, 2020, 8:39 PM

#

read the emails

obsidian cradle Jun 16, 2020, 8:39 PM

#

I DDIDIDIDIDID

jade bolt Jun 16, 2020, 8:40 PM

#

look some more haha

oblique cliff Jun 16, 2020, 8:41 PM

#

you sure @jade bolt ?

toxic scarab Jun 16, 2020, 8:41 PM

#

@obsidian cradle DM me

jade bolt Jun 16, 2020, 8:41 PM

#

when i do sql as www-data i get not found

oblique cliff Jun 16, 2020, 8:43 PM

#

mysql?

jade bolt Jun 16, 2020, 8:44 PM

#

omg xD

#

im stupid

#

yes there is sql

#

can i privesc with sql?

solemn smelt Jun 16, 2020, 8:45 PM

#

??

oblique cliff Jun 16, 2020, 8:48 PM

#

possibly. There may also be ||config files for the sql database that you might wanna check out||

median compass Jun 16, 2020, 8:53 PM

#

Anyone around who's done CTF Collection Vol2? I fancied brushing up some of my ctf type skills but i'm stuck on 2 where i'm sure i've got the answer but i'm either making a dumb mistake or there's some odd trick to it (or the box is broken but lets be honest, probably the first option!) It's flags 15 & 20 if you have a clue for me

jade bolt Jun 16, 2020, 8:59 PM

#

gottem

dull palm Jun 16, 2020, 9:03 PM

#

Hi yall, I am stuck. The Cod Caper, can not run LinEnum on target, i scp the file over to target/tmp but i get denied when i try to run it. if i try to copy it, also denied

sick coyote Jun 16, 2020, 9:12 PM

#

@dull palm did you try using python server + wget within the box itself?

oblique cliff Jun 16, 2020, 9:13 PM

#

he already got it onto the machine i believe @sick coyote

sick coyote Jun 16, 2020, 9:14 PM

#

ah my bad

toxic scarab Jun 16, 2020, 9:19 PM

#

@dull palm did you make it executable?

dull palm Jun 16, 2020, 9:20 PM

#

yes and the perm are messed up --x--x--x

#

i will re copy it and try chmod again, Thanks yall

wispy bloom Jun 16, 2020, 9:28 PM

#

soooooooooo anyone have a hint about the ||bcrypt|| task in Crack the hash other than waiting until tomorrow for hashcat to compare hashes to passwords in rockyou? CyberChef does NOT like that hash.

oblique cliff Jun 16, 2020, 9:39 PM

#

yea just wait till tomorrow

median compass Jun 16, 2020, 9:40 PM

#

that's 1.4 is it @wispy bloom ?

wispy bloom Jun 16, 2020, 9:41 PM

#

Sigh - I might cheat and grep all the characters from rockyou that match the length of the flag just to save time

#

@median compass yes

median compass Jun 16, 2020, 9:42 PM

#

yeah, i cracked that one by letting it run over night

wispy bloom Jun 16, 2020, 9:42 PM

#

welp - I'll try my grep first. Gotta be faster

median compass Jun 16, 2020, 9:44 PM

#

the plus side of letting your GPU crank all night is a lovely warm office in the morning... 🙂

wispy bloom Jun 16, 2020, 9:45 PM

#

oh god I'm in the SW USA - I don't need help with that at all

median compass Jun 16, 2020, 9:45 PM

#

lol fair enough

#

grep and be happy

torn mural Jun 16, 2020, 9:53 PM

#

can anyone give a nudge on ctf 100 task #7

#

@sick coyote If I remember right, you should be able to root the box, then go back and find flag 74

steel fiber Jun 17, 2020, 12:33 AM

#

guys, i ahve a doubt about how privilege scalation works. Why attacking the files belonging to adm escalates privileges? how the computer interprets that? thanks in advance

solemn smelt Jun 17, 2020, 12:34 AM

#

what do you mean by attacking files

#

If youre changing a file that runs as an administrator youre running the commands that you put inside of that file however as the administrator so for example if you have a reverse shell inside of a file that runs as an administrator then the reverse shell inherits the permissions of the administrator

steel fiber Jun 17, 2020, 12:41 AM

#

ohh, so the revershel script runs inside any kind of file system right? thats why i first need the exploit and then the shell? sorry i am so new at this.

solemn smelt Jun 17, 2020, 12:43 AM

#

theres so many different ways to priv esc and abuse the file system its just something youre going to eventually pick up if you want to learn my I would check out the rooms linux priv esc and windows priv esc arena however if youre new that may be a bit much to begin with

steel fiber Jun 17, 2020, 12:44 AM

#

thanks buddy. Is there any section oh machines that u would recommends me start with?

solemn smelt Jun 17, 2020, 12:44 AM

#

if youre a beginner learn linux is a good place to start

#

its not going to be any exploits or anything but it will give you good knowledge to start with

toxic scarab Jun 17, 2020, 12:45 AM

#

https://tryhackme.com/room/zthlinux

TryHackMe

TryHackMe | Learn Linux

A guided room designed to teach you the Linux basics!

steel fiber Jun 17, 2020, 12:46 AM

#

thans very much!

halcyon lodge Jun 17, 2020, 1:02 AM

#

I have a question about mind games. Is anyone willing to give a hand. Need to verify something regarding root.

toxic scarab Jun 17, 2020, 1:07 AM

#

@halcyon lodge I might be able to help - DM me if you want

halcyon lodge Jun 17, 2020, 1:14 AM

#

@toxic scarab, thanks for reaching out. I’m dm’ing you right now.

fervent plover Jun 17, 2020, 1:39 AM

#

anyone done with advent of cyber?

#

anyone know how to do Task 9 question 4 ? im stuck for 2 hours lol

viral mason Jun 17, 2020, 2:34 AM

#

@fervent plover check writeups

woeful frigate Jun 17, 2020, 2:55 AM

#

HI ALL
Network Services Room
[Task 6] Enumerating Telnet
#6 Based on the title returned to us, what do we think this port could be used for?
#7 Who could it belong to? Gathering possible usernames is an important step in enumeration.

what can I do more than ?

📎 unknown.png

fervent plover Jun 17, 2020, 2:58 AM

#

ty

woeful frigate Jun 17, 2020, 3:00 AM

#

ty?

oblique cliff Jun 17, 2020, 3:02 AM

#

How long has the box been up?

#

Give it a few minutes I don’t think its spun up quite yet

woeful frigate Jun 17, 2020, 3:06 AM

#

40 minutes more or less..

#

I work around only because i know is telnet (for the room) so i try to login and i find the answers.

oblique cliff Jun 17, 2020, 3:10 AM

#

Weird. Try to reboot it? I think the service showed up for me

fervent plover Jun 17, 2020, 3:11 AM

#

I mean ty for @viral mason

woeful frigate Jun 17, 2020, 3:13 AM

#

@oblique cliff is it possible a different version of nmap?

oblique cliff Jun 17, 2020, 3:17 AM

#

Doubtful @woeful frigate

peak patrol Jun 17, 2020, 6:04 AM

#

eny one here ?

#

https://tenor.com/view/crazy-insane-stewie-family-guy-finals-gif-5655336

Tenor

#

sup

#

can you help with that problem

#

k

#

how do i do that i forgot

#

in kali

#

bye

true prairie Jun 17, 2020, 9:59 AM

#

Can anyone help me with the cage room? Don't want to spoil too so anyone I can DM real quick? 🙂

thorny nest Jun 17, 2020, 10:32 AM

#

Need hint for rooting cage. Finally got user but seems I’m too tired to think properly.

dapper mauve Jun 17, 2020, 10:35 AM

#

I'd say its easier that getting Cage. Enum, enum!! 🙂

indigo ridge Jun 17, 2020, 10:59 AM

#

I'd say its easier that getting Cage. Enum, enum!! 🙂
@dapper mauve I found the location of broadcast but what should I do..

wooden mist Jun 17, 2020, 11:04 AM

#

well, check out the broadcast source, maybe there is a way you can make it execute your own code?

indigo ridge Jun 17, 2020, 11:06 AM

#

yes I have checked it I tried some command injection

dapper mauve Jun 17, 2020, 11:11 AM

#

Have a look what command it is running to achieve what its doing and where its getting its input....hard to give a hint without spoilers...you're very close though.

indigo ridge Jun 17, 2020, 11:37 AM

#

yep I understand what you are saying because I am just trying that its just that my command is not running.. i think I can't escape the previous command..

Have a look what command it is running to achieve what its doing and where its getting its input....hard to give a hint without spoilers...you're very close though.
@dapper mauve

#

Have a look what command it is running to achieve what its doing and where its getting its input....hard to give a hint without spoilers...you're very close though.
@dapper mauve if you don't mind I would like to dm you.

quiet stump Jun 17, 2020, 11:45 AM

#

You're really overthinking it

#

Take a step back

#

Then go back in with a fresh head and re-read it

vague parrot Jun 17, 2020, 11:50 AM

#

hello im new to ctf i wanna decrypt some code which looks like bas64 encoded but when i decrypt it dosent looks like what i want

#

can i share the encrypted code?

#

btw Magna big fan

quiet stump Jun 17, 2020, 11:51 AM

#

Don't share the code here no, look how its formatted, especially if u were in France. Haha thanks buddy 🙂

#

There's a ton of hints for Cage in here, if ur uber uber uber uber stuck and you'll fully burnt out there is a guide on the site too.

vague parrot Jun 17, 2020, 11:53 AM

#

im dumb to understand what u said master @quiet stump

potent vale Jun 17, 2020, 12:03 PM

#

Hey @proven bridge Can I PM you about carpe diem? I'd like to know if one of my ideas for flag2 is the right direction. Both get me nowhere right now 😄

echo thunder Jun 17, 2020, 12:05 PM

#

can anyone help me with a hint on break out the cage room?

#

I managed to decode the root password from the email

#

but is not workling when trying to connect as root

tidal sedge Jun 17, 2020, 12:06 PM

#

Try switching to root using su -?

echo thunder Jun 17, 2020, 12:12 PM

#

can I ping you

#

?

tidal sedge Jun 17, 2020, 12:13 PM

#

No.

echo thunder Jun 17, 2020, 12:16 PM

#

thanks malware

#

@tidal sedge thank you

lusty wigeon Jun 17, 2020, 12:19 PM

#

@potent vale did you able to get anything outta ||leaked ip||?

potent vale Jun 17, 2020, 12:20 PM

#

@lusty wigeon No and I try to get something from ||.10|| but apparently ||CORS is an issue.||

lusty wigeon Jun 17, 2020, 12:21 PM

#

yea same. i kind a gave up that room 😅

warm schooner Jun 17, 2020, 1:01 PM

#

@vague parrot You can DM me if you need that much help. UwU..
@white salmon can I DM as well? I still can't figure out the password... Decoding is fine

vague parrot Jun 17, 2020, 1:02 PM

#

Dm nighthawk or me

warm schooner Jun 17, 2020, 1:03 PM

#

Cheers

#

@vague parrot, sent friend req as I have DM's turned off

#

Yay I wasn't being an idiot, stupid clipboard messed up and decoded 1/3 of the password

#

@warm schooner Sure mate!
@white salmon Cheers, not needed anymore 🙂

#

Yeah, all good. Issue with VM, I have a fresh VM now and no issue

fluid dagger Jun 17, 2020, 1:35 PM

#

Hi everyone, I have a question regarding the exploit of the machine for "RP: PS Empire" room. As I'm completing the questions (Task 5 - #9), I'm trying to get the credentials of the remote computer. But when I set the module on powershell/credentials/mimikatz/lsadump, even if I set the agent name, and run the module, I didn't get any credential. Do you have an idea why ?

patent token Jun 17, 2020, 1:51 PM

#

I don't think I actually ran the module. Empire is wonky nowadays, so I just answered the question and moved on.

proven bridge Jun 17, 2020, 2:12 PM

#

Hey @proven bridge Can I PM you about carpe diem? I'd like to know if one of my ideas for flag2 is the right direction. Both get me nowhere right now 😄
@potent vale Sure!

echo thunder Jun 17, 2020, 2:45 PM

#

anyone can give little hint on carpe diem 1? in order to start

proven bridge Jun 17, 2020, 2:53 PM

#

Yeah, @echo thunder XHR in 🍪 for localstorage

#

base64 encoded

echo thunder Jun 17, 2020, 2:53 PM

#

opk thank you

rose moss Jun 17, 2020, 3:04 PM

#

good evening guys

#

can somebody please give me a hint on the admin password on Anthem

inland onyx Jun 17, 2020, 3:05 PM

#

Enumerate the webpages

rose moss Jun 17, 2020, 3:05 PM

#

I looked everywhere, yet I don't seem to know where to look

#

I'll do that

#

thanks

inland onyx Jun 17, 2020, 3:05 PM

#

🙂

rose moss Jun 17, 2020, 3:09 PM

#

@inland onyx I tried to use pydump7 to get a hashdump then crack it offline

#

no chance with deffender

#

I tried to get a reverse shell with a meterpreter,

#

no chance as well

inland onyx Jun 17, 2020, 3:09 PM

#

Oh, Admin password -- sorry, misread that

#

You're already RDP'd in

rose moss Jun 17, 2020, 3:10 PM

#

yeah

inland onyx Jun 17, 2020, 3:10 PM

#

The password is in plaintext, somewhere hidden on the machine

#

It's not buried down in system files either -- should be relatively easy to find if you keep your eyes open and look through the user files

rose moss Jun 17, 2020, 3:11 PM

#

i'll try again

carmine scroll Jun 17, 2020, 4:55 PM

#

Task#5 in blue machine says if exploit doesn't work, you can try to reboot the machine and run the exploit but how can i reboot the machine because it will give option of terminate only

eternal brook Jun 17, 2020, 4:55 PM

#

hey i am on rp burp suite room the sequencer part i run 10k requests but cannot see any results in summary and i cannot click on analyse now

#

i chose the right req which had set cookie on response

oblique cliff Jun 17, 2020, 4:57 PM

#

@carmine scroll terminate and redeploy is rebooting

#

@eternal brook try it again? If you were able to analyze it there should be a summary. Did you pause it?

eternal brook Jun 17, 2020, 4:58 PM

#

i did it again first time burp hanged

#

this time i cannot click on analyse now

#

i paused it too

oblique cliff Jun 17, 2020, 5:01 PM

#

In #room-help can you post a pic of what’s happening

eternal brook Jun 17, 2020, 5:02 PM

#

Ohk thanks

white salmon Jun 17, 2020, 5:57 PM

#

im having trouble with "Learn linux" task 21

#

anyone willing to help?

#

[Task 21] Binary - shiba2

This challenge is pretty simple. The binary is checking to see if the environment variable "test1234" exists, and if it's set equal to the current $USER environment variable.
#1

What is shiba3's password

oblique cliff Jun 17, 2020, 6:01 PM

#

damn thats quite a hint

white salmon Jun 17, 2020, 6:01 PM

#

been there done that

#

doesnt create a new binary

oblique cliff Jun 17, 2020, 6:02 PM

#

its not supposed to create a binary

#

read what its telling you to do

white salmon Jun 17, 2020, 6:02 PM

#

export test1234=$USER

#

?

#

ik

#

im sorry

steady stratus Jun 17, 2020, 6:03 PM

#

Very well @white salmon

#

A) Let's stop bashing and B) All for help & hints but giving answers isn't productive for anything

rancid crystal Jun 17, 2020, 6:03 PM

#

@white salmon not to tell answers but try helping them to think of the answers?

white salmon Jun 17, 2020, 6:04 PM

#

bash: ./shiba2: No such file or directory

steady stratus Jun 17, 2020, 6:04 PM

#

Also, let's not use that word please @white salmon

white salmon Jun 17, 2020, 6:04 PM

#

srr

oblique cliff Jun 17, 2020, 6:04 PM

#

@white salmon no worries man we were all there at some point dont feel bad

rancid crystal Jun 17, 2020, 6:04 PM

#

check in which directory you are right now. you must be in shiba1 foler and runningg shiba2 binary

steady stratus Jun 17, 2020, 6:04 PM

#

For sure (:

oblique cliff Jun 17, 2020, 6:04 PM

#

@white salmon calm thyself

#

if youre going crazy then stop reading the channel

steady stratus Jun 17, 2020, 6:05 PM

#

Indeed before someone steps you away

rancid crystal Jun 17, 2020, 6:06 PM

#

Many people make mistake in this room that they dont realize they are in shiba1 folder and move along the tasks. if you are going to run shiba2 binary you should be in shiba2 folder.

white salmon Jun 17, 2020, 6:06 PM

#

ohhhh

#

that explains a lot

#

thanks guys (:

steady stratus Jun 17, 2020, 6:08 PM

#

have fun (:

lone pivot Jun 17, 2020, 6:19 PM

#

@steady stratus you are great

mystic moss Jun 17, 2020, 6:28 PM

#

Can anybody give a hint where to look for the flag in room "Post-exploitation basics". I checked every folder in the Users section, but could not find anything related to be a flag.

steady stratus Jun 17, 2020, 6:28 PM

#

v wholesome but random @lone pivot :3

slender vigil Jun 17, 2020, 7:16 PM

#

can anybody give me a hint to priv. escalate ssh of "break the cage out" room

quiet stump Jun 17, 2020, 7:16 PM

#

@slender vigil Have a scroll up, plenty of tips 🙂

#

It's very similar to intial

white salmon Jun 17, 2020, 7:18 PM

#

||"2"||

white salmon Jun 17, 2020, 8:52 PM

#

once again im here asking for your support

#

Linux walkthrough, task 33

#

The first step is actually finding the binary, I'm not heartless though, so I'll give you the name of the binary. The name of the binary is shiba4.The first step is actually finding the binary, I'm not heartless though, so I'll give you the name of the binary. The name of the binary is shiba4.

#

how does one search for binaries...

#

i know that its "find"

real plinth Jun 17, 2020, 8:53 PM

#

hi guys i have a problem in pickle rick, can somebody give me a hint pls

toxic scarab Jun 17, 2020, 8:54 PM

#

@white salmon one of the tasks right before that showed how to search for files

real plinth Jun 17, 2020, 8:54 PM

#

at private or something

#

i have logged in the page, but i dont know how can i read files

white salmon Jun 17, 2020, 8:58 PM

#

@toxic scarab did a bit more reading and found it. Ty (:

toxic scarab Jun 17, 2020, 9:06 PM

#

@white salmon one thing that this room doesn't cover is the use of 2>. when using find and/or grep, you will sometimes end up with a lot of permission errors that you want to ignore. so find / -name somefile will list a LOT of permission denied results. if you did find / -name somefile 2>/dev/null instead, it would take the stderr output (which is that '2' in that line) and send it to /dev/null (basically garbage) instead of to the screen

real plinth Jun 17, 2020, 9:22 PM

#

what's the final rick ingredient 😦

oblique cliff Jun 17, 2020, 9:29 PM

#

think about where your command execution is @real plinth

#

@white salmon if you complete the room thefindcommand thatll be very useful 🙂

real plinth Jun 17, 2020, 9:42 PM

#

@oblique cliff i found a way to do it

#

hehehehe

oblique cliff Jun 17, 2020, 9:44 PM

#

sweet!

white salmon Jun 17, 2020, 10:07 PM

#

wondering why HaskHell is a medium

fast swan Jun 17, 2020, 10:10 PM

#

Doing haskell now and getting internal server error when uploading files, even when it's a haskell file. Is this meant to happen or should I restart the machine?

oblique cliff Jun 17, 2020, 10:10 PM

#

Meant to happen

#

Your files are wrong @fast swan

rotund furnace Jun 17, 2020, 10:10 PM

#

@white salmon because it's too easy or too hard?

white salmon Jun 17, 2020, 10:10 PM

#

easy

oblique cliff Jun 17, 2020, 10:10 PM

#

Cuz it’s harder than easy and easier than hard @white salmon

fast swan Jun 17, 2020, 10:10 PM

#

Sweet! cheers, will get back to it then

wooden mist Jun 17, 2020, 10:12 PM

#

i wouldn't count that box as easy but not exactly medium either, the initial foothold is a bit obscure - that's what makes it harder from an easy box

white salmon Jun 17, 2020, 10:12 PM

#

maybe I dit it "wrong"?

#

||should prof be world readable?||

wooden mist Jun 17, 2020, 10:13 PM

#

intended

rotund furnace Jun 17, 2020, 10:15 PM

#

the trinary difficulty system doesnt really lend itself to nuance, so i set it to medium for the reason mentioned above

white salmon Jun 17, 2020, 10:19 PM

#

can I dm my write up?

rotund furnace Jun 17, 2020, 10:19 PM

#

For sure

white salmon Jun 17, 2020, 10:29 PM

#

anyway I like the box

#

thanks!

fast swan Jun 17, 2020, 10:31 PM

#

I'm in, cheers for the hints @oblique cliff

oblique cliff Jun 17, 2020, 10:47 PM

#

Ofc

#

@rotund furnace I was just gonna submit write up through thm, any purpose of doing it through dm?

wooden mist Jun 17, 2020, 10:50 PM

#

You'd dm it just for the author to check it

#

To get it on the site submit it there

oblique cliff Jun 17, 2020, 10:54 PM

#

Gotcha

rotund furnace Jun 17, 2020, 10:55 PM

#

yeah you can DM it to me if you want but what he said

woven mirage Jun 17, 2020, 10:56 PM

#

Hey guys does anyone know if i need to write any haskell code in the haskhell room?

oblique cliff Jun 17, 2020, 10:59 PM

#

Box just came out. Might wanna wait a bit before asking any question 😅

woven mirage Jun 17, 2020, 10:59 PM

#

ok

halcyon lodge Jun 18, 2020, 4:36 AM

#

Is there anyone I can dm about Haskhell. I need to verify something?

livid perch Jun 18, 2020, 5:42 AM

#

still playing around with that room still have a little idea but not much

atomic shuttle Jun 18, 2020, 7:04 AM

#

can i pm anyone on haskhell, jus to make sure i did the intended way

tranquil dagger Jun 18, 2020, 7:09 AM

#

Sure @atomic shuttle

warm schooner Jun 18, 2020, 7:41 AM

#

@wooden mist, what wordlist did you use for HaskHell?

#

Have used big.txt and 2.3-medium

#

Found the actual upload page but can't find the dir they are stored in

wooden mist Jun 18, 2020, 7:42 AM

#

raft-large-directories

mint roost Jun 18, 2020, 8:01 AM

#

Hey guys, Can someone give me a hint for the bonus challange in the Linux learn room ? 🙂

#

It is this one 🙂

📎 unknown.png

#

I know where the folder is located, but i have no root access on the machine (I think it is the challenge to get there). So if someone finished this room can give me a little hint where i can find the roots password ? 🙂 because all of the shibas does not have root permissons

spiral stag Jun 18, 2020, 8:05 AM

#

You can always check the writeup if you're stcuk

#

📎 unknown.png

warm schooner Jun 18, 2020, 8:06 AM

#

raft-large-directories
@wooden mist I always forget to use seclists

spiral stag Jun 18, 2020, 8:06 AM

#

dont we all

wooden mist Jun 18, 2020, 8:08 AM

#

I stick with raft lists because they usually get what I need and are much smaller then the others

warm schooner Jun 18, 2020, 8:08 AM

#

Still can't find where the asset files are kept lmao

#

I stick with raft lists because they usually get what I need and are much smaller then the others
@wooden mist Will keep that in mind

mint roost Jun 18, 2020, 8:12 AM

#

@spiral stag Thank you !

rose moss Jun 18, 2020, 8:16 AM

#

Good morning guys, hope you're alright, yesterday I was a bit stuck with ||Anthem|| in the privesc section, and my idea was to hashdump with ||pydump7|| yet it kept getting caught with windows defender, I tried also to get a ||meterpreter|| in order to use a ||privesc suggester|| yet it caught again. I was thinking about this situation, how does one make his ||payload|| undetectable ? using Shikata Ga Nai ? Any good ideas are welcome, especially practical ones 😉

warm schooner Jun 18, 2020, 8:21 AM

#

Did you try meterpreter ||hashdump|| rather than ||pydump7||?

burnt cosmos Jun 18, 2020, 8:21 AM

#

@rose moss Everything you need to privesc is already on the computer

glossy basin Jun 18, 2020, 8:21 AM

#

Anthem is a ctf room

#

there's no privesc

#

(technically there is but it's not an exploit or anything like that)

#

Check the write-ups if you are stuck

#

||https://swafox.com/anthem/||

rose moss Jun 18, 2020, 8:28 AM

#

@warm schooner Sorry body I did not understand

#

I uploaded pydump7 on the webserver, then got it in RDP, however impossible to use it

#

deffender blocks it

#

also when I did the same thing with a payload, I could see that I get no reverse shell

#

cause deffender blocks the meterpreter

#

I could see it in its log

#

@glossy basin I did not think that ||changing premission of the file would work||, so I though more of tying to really hashdump the passwords

glossy basin Jun 18, 2020, 8:32 AM

#

alright

rose moss Jun 18, 2020, 8:33 AM

#

Any way, what do you think about Shikata Ga Nai ?

glossy basin Jun 18, 2020, 8:47 AM

#

haven't tried it 🤷‍♂️

rose moss Jun 18, 2020, 8:55 AM

#

I'll dig deeper into it, I'm trying to get Anthem differently and that defender is in the way, I'll figure something out

glossy basin Jun 18, 2020, 8:58 AM

#

good luck!

#

you can make a writeup if you get it differently!! would be interesting to read

thorny nest Jun 18, 2020, 10:13 AM

#

Anyone got hints for root on haskhell?

true widget Jun 18, 2020, 10:32 AM

#

anyone got hints for root at break the cage??

indigo ridge Jun 18, 2020, 10:42 AM

#

anyone got hints for root at break the cage??
@true widget check the cage directory

true widget Jun 18, 2020, 10:43 AM

#

i dont have the permissions

#

I havent figured out the password for cage yet

#

@indigo ridge

indigo ridge Jun 18, 2020, 10:44 AM

#

then you have to look around the directries and find the broadcast messages location

true widget Jun 18, 2020, 10:45 AM

#

then you have to look around the directries and find the broadcast messages location
@indigo ridge okk I ll try

#

Do it has something to do with cronjob?

indigo ridge Jun 18, 2020, 10:47 AM

#

go ahead you are going good

#

help for Haskhell: do I need to use haskell lang in it..?

true widget Jun 18, 2020, 10:54 AM

#

go ahead you are going good
@indigo ridge I navigated to /etc/crontabs/

#

which one to exploit?

indigo ridge Jun 18, 2020, 11:30 AM

#

@indigo ridge I navigated to /etc/crontabs/
@true widget did you check the permissions for crontabs?

steady stratus Jun 18, 2020, 11:30 AM

#

What looks interesting?

#

(rhetorical question)

indigo ridge Jun 18, 2020, 11:31 AM

#

crontabs are just meant to run the jobs..

which one to exploit?
@true widget

true widget Jun 18, 2020, 11:37 AM

#

@indigo ridge I have read permissions

#

upon doing sudo -l I found that I can run /usr/bin/bees/ as root

indigo ridge Jun 18, 2020, 11:39 AM

#

i can just say that.. keep searching there must be something interesting.. and don't forget to use 'ls -la' it helps

true widget Jun 18, 2020, 11:43 AM

#

okk I lltry

stoic jewel Jun 18, 2020, 11:58 AM

#

Hi hackers, Hoping you are doing well I'm stuck with this challange any hint how to exploit that

#

This is from Wonderland Room

📎 Screenshot_from_2020-06-18_12-58-00.png

white salmon Jun 18, 2020, 12:00 PM

#

And you can run python as rabbit.

#

Do you have rabbit user's password?

stoic jewel Jun 18, 2020, 12:00 PM

#

nope

#

I'm in alice

tidal sedge Jun 18, 2020, 12:02 PM

#

@white salmon That is incorrect, read the output of sudo command more carefully, they can not run the command as root, rather they can run it as the ||rabbit|| user.

stoic jewel Jun 18, 2020, 12:02 PM

#

@tidal sedge yeah That's true

white salmon Jun 18, 2020, 12:02 PM

#

Misread, my bad.

#

Try using it to escalate ro rabbit .

#

How can you alter that script?

stoic jewel Jun 18, 2020, 12:03 PM

#

@tidal sedge when I exploit that I'll get into rabbit user

#

@white salmon yeah that's what I'm trying to do

tidal sedge Jun 18, 2020, 12:03 PM

#

@stoic jewel Indeed, now go exploit it.

white salmon Jun 18, 2020, 12:04 PM

#

It is similar to the Break Out Of The Cage room.

stoic jewel Jun 18, 2020, 12:04 PM

#

@tidal sedge this is why I'm here 🙂 to get some hints

#

that script has not write perm

tidal sedge Jun 18, 2020, 12:06 PM

#

||You don't need to write to it.||

stoic jewel Jun 18, 2020, 12:09 PM

#

not enough yet 😦

potent vale Jun 18, 2020, 12:09 PM

#

It would be highly convenient to be able to run ||arbitrary code as the user you want to escalate to||.

halcyon lodge Jun 18, 2020, 1:05 PM

#

Can I ask dm someone question about Haskhell? I want to make sure I’m on the right track.

solid patrol Jun 18, 2020, 1:10 PM

#

yea sure

potent vale Jun 18, 2020, 1:13 PM

#

@stoic jewel Rule #1, you can ask here anytime

stoic jewel Jun 18, 2020, 1:13 PM

#

sure, it's about privilege escalation

#

with that script

potent vale Jun 18, 2020, 1:15 PM

#

Sure thing. What's the question?

tidal sedge Jun 18, 2020, 1:23 PM

#

@stoic jewel Please respect rule 1 in #rules.

stoic jewel Jun 18, 2020, 1:25 PM

#

Sorry i missed it

white salmon Jun 18, 2020, 1:28 PM

#

@steady stratus well, I'll be back once I downgrade Kali. See ya.

steady stratus Jun 18, 2020, 1:29 PM

#

👍 gl with it

white salmon Jun 18, 2020, 1:29 PM

#

Thanks bud!

stoic jewel Jun 18, 2020, 1:33 PM

#

pass it 😉

#

now it's time for BOF

oblique cliff Jun 18, 2020, 1:56 PM

#

sure

eternal brook Jun 18, 2020, 2:12 PM

#

hey can somehelp with a hash it has 6 = in the end

#

someone

#

i tried googling no help..

solemn smelt Jun 18, 2020, 2:13 PM

#

If it has 6 = that doesn’t sound like a hash to me

eternal brook Jun 18, 2020, 2:14 PM

#

i'm new to crpto i dont know what we say that..maybe encoding...

solemn smelt Jun 18, 2020, 2:14 PM

#

have you tossed it into cyberchef and see what it thinks

eternal brook Jun 18, 2020, 2:15 PM

#

dont we need to give it an operation first?

#

i just started it today sorry if i am asking dumb ques

solemn smelt Jun 18, 2020, 2:17 PM

#

cyberchef can guess sometimes it’s not able to but most of the time it can there is a little magic wand right in between the input and output in cyberchef that will appear if cyberchef can guess what it is if you click it then it will automatically pull everything you need

eternal brook Jun 18, 2020, 2:19 PM

#

yea i see a magic operation that right?

solemn smelt Jun 18, 2020, 2:20 PM

#

yes

eternal brook Jun 18, 2020, 2:20 PM

#

in favourties

solemn smelt Jun 18, 2020, 2:21 PM

#

no there is no operation for it you just input your text and it will show up on it’s own if possible

eternal brook Jun 18, 2020, 2:22 PM

#

it does not show recipe😫

still lily Jun 18, 2020, 2:22 PM

#

i need help with the Blue room metasploit

#

When I exploit, it keeps on failing

solemn smelt Jun 18, 2020, 2:23 PM

#

then that means it can’t identify it you can either use an encryption identifier or play around with base encoding because generally = is a base encoding

#

@still lily what is your lhost set as

still lily Jun 18, 2020, 2:24 PM

#

4446

eternal brook Jun 18, 2020, 2:25 PM

#

alright thanks

#

@still lily lhost not lport

still lily Jun 18, 2020, 2:26 PM

#

oh sorry. How do I check? Im kinda new to this. Thanks for the help

solemn smelt Jun 18, 2020, 2:26 PM

#

options

still lily Jun 18, 2020, 2:27 PM

#

it is set to my private ip address

eternal brook Jun 18, 2020, 2:28 PM

#

change it to your vpn address

#

the tun0 address

#

check it using ifconfig

still lily Jun 18, 2020, 2:29 PM

#

ohhhh... thanks. I am going to try that.

queen verge Jun 18, 2020, 2:33 PM

#

Hey guys i am stuck in a task

📎 unknown.png

still lily Jun 18, 2020, 2:33 PM

#

sorry it failed again

#

Errno::ECONNRESET: Connection reset by peer

queen verge Jun 18, 2020, 2:34 PM

#

unable to execute the payload using msfvenom

solemn smelt Jun 18, 2020, 2:34 PM

#

that means you stopped it I believe @still lily

oblique cliff Jun 18, 2020, 2:34 PM

#

@queen verge you just showed us the payload. you havent said or shown what youve tried to do and what happened when you do it

still lily Jun 18, 2020, 2:35 PM

#

I didn't kill it though...

solemn smelt Jun 18, 2020, 2:35 PM

#

you have to put the payload on the victim machine

#

@still lily it’s s finicky exploit just run It again

still lily Jun 18, 2020, 2:35 PM

#

ok

queen verge Jun 18, 2020, 2:35 PM

#

@oblique cliff I have managed to telnet into the target machine anonmosly

solemn smelt Jun 18, 2020, 2:35 PM

#

did you put the payload on the machine yet

queen verge Jun 18, 2020, 2:35 PM

#

As per room instructions it says to execute the msfvenom payload

#

I dont understand how am i going to put that payload and why is it even asking to execute the msfvenom on my local machine

solemn smelt Jun 18, 2020, 2:36 PM

#

what room is this because that’s a really odd payload choice

queen verge Jun 18, 2020, 2:37 PM

#

Its Network Services in absolute begineers path

still lily Jun 18, 2020, 2:38 PM

#

The exploit is failing again. Even though I have my LHOST set to my vpn ip address.

solemn smelt Jun 18, 2020, 2:38 PM

#

did you set the rhost right

still lily Jun 18, 2020, 2:39 PM

#

yes

#

It is the ip address given to me from the deployed machine

oblique cliff Jun 18, 2020, 2:39 PM

#

@queen verge could you should us how youre running the command over in #room-help

queen verge Jun 18, 2020, 2:40 PM

#

@oblique cliff ok

solemn smelt Jun 18, 2020, 2:43 PM

#

just let it chill run it again and don’t stop it if it fails again twice either look at a writeup and check all of your settings or reset the machine

still lily Jun 18, 2020, 2:43 PM

#

ok

obsidian kettle Jun 18, 2020, 3:14 PM

#

Hint for CC:Ghidra task 4.2?

white salmon Jun 18, 2020, 4:23 PM

#

hey, i'm doing the basic pentesting room but i'm having trouble completing step 5: getting the username. i know the hint says ||that i could/should use samba to find a username, but I have no familiarity with samba. I saw that there are two open ports for it, but not sure how i could use those to my advantage||

oblique cliff Jun 18, 2020, 4:26 PM

#

https://www.samba.org/samba/docs/current/man-html/smbclient.1.html @white salmon

white salmon Jun 18, 2020, 4:28 PM

#

see i've found that and even tried connecting, but i'm not sure how i can find the usernames from it

eternal brook Jun 18, 2020, 4:28 PM

#

||Ebgngr zr 13 cynprf!|| got this hash hash identifier says it is bifid i tried using bifid on cyberchef not no result it is asking a keword i think

stuck fractal Jun 18, 2020, 4:29 PM

#

That's not a hash.

eternal brook Jun 18, 2020, 4:29 PM

#

cipher

#

?

stuck fractal Jun 18, 2020, 4:30 PM

#

Don't assume it's a hash when you can't read it

#

Try some basic things

eternal brook Jun 18, 2020, 4:31 PM

#

is it those traditional ciphers ||caesar|| or ||subsition||?

stuck fractal Jun 18, 2020, 4:31 PM

#

Have you considered trying things before asking for help?

#

You can try every possible caesar cipher key manually in like 3s

#

It's called ROT in cyberchef.

eternal brook Jun 18, 2020, 4:33 PM

#

i just started learning it today sorry i asked..

#

i'll take care next time

stuck fractal Jun 18, 2020, 4:34 PM

#

Ask for a hint when you've run out of things to try

#

Not before you've tried things.

eternal brook Jun 18, 2020, 4:34 PM

#

yea i did not know it is called rot in cyberchef

stuck fractal Jun 18, 2020, 4:35 PM

#

There are other tools you could have used for caesar ciphers

white salmon Jun 18, 2020, 4:46 PM

#

see i've found that and even tried connecting, but i'm not sure how i can find the usernames from it
@white salmon enumerate samba server ||nmap||

stuck fractal Jun 18, 2020, 4:47 PM

#

You should be beyond nmap here

#

The automated enumeration doesn't always work

#

Try some manual enumeration

white salmon Jun 18, 2020, 4:47 PM

#

just to get a overview of what it is

#

Try cipher identifiers.

#

i am, and by very carefully scrolling in a writeup i found that i could use ||enum4linux||, but i'd love to learn more about manual enumeration, is there any suggested reading on it (telling me to google is perfectly ok too)

#

That one is not a hash. @white salmon

#

@white salmon Metasploit has manual modules you can use.

#

That one is not a hash. @white salmon
@white salmon ||monoalphabetic|| is a cipher

stuck fractal Jun 18, 2020, 4:48 PM

#

@white salmon connect to the share, browse the files

white salmon Jun 18, 2020, 4:49 PM

#

Its just not as simple as it seems @white salmon

#

Sorry, confused you with @eternal brook .

#

NP

#

how am i able to connect to the share if i dont have the username/password for it?

#

Enumerate it.

#

Look for public shares.

#

Like ones named 'anonymous'.

#

They are similar to the FTP ones.

#

oh hehe i did spot that and noted it down 😅

#

yeah... enumerate

#

Try checking that out! @white salmon

stuck fractal Jun 18, 2020, 4:50 PM

#

'Anonymous' can get you in to a lot of shares

#

As a username

#

Not a share name

white salmon Jun 18, 2020, 4:51 PM

#

neat, good to know

#

@white salmon 👍 .

empty osprey Jun 18, 2020, 5:42 PM

#

Hi guys, can someone help me? I'm at Steel Mountain room, I did the upload of PowerUp.ps1 file, but, I can't execute it, I tried with (.\PowerUp.ps1) and (./PowerUp.ps1)

stuck fractal Jun 18, 2020, 5:44 PM

#

You don't want to execute it, you want to load it probably

#

Also, "can't execute it" is far too vague

#

Be less vague and we can help better

empty osprey Jun 18, 2020, 5:45 PM

#

the task tell to execute it

#

"To execute this using Meterpreter, I will type load powershell into meterpreter. Then I will enter powershell by entering powershell_shell:"

#

📎 unknown.png

stuck fractal Jun 18, 2020, 5:47 PM

#

Ok, notice what it's doing

#

It's loading it

#

. .\

#

Dot space

empty osprey Jun 18, 2020, 5:48 PM

#

Yap, I tried too

stuck fractal Jun 18, 2020, 5:48 PM

#

Then you need to show us what's going wrong or what's not happening

#

Otherwise we can't help

#

We don't know what you're doing, and we don't know what's not happening or what is happening

empty osprey Jun 18, 2020, 5:51 PM

#

I'm receiving a error

#

📎 unknown.png

stuck fractal Jun 18, 2020, 5:52 PM

#

You didn't download the script

#

You downloaded the github webpage

empty osprey Jun 18, 2020, 5:52 PM

#

yes, I did

stuck fractal Jun 18, 2020, 5:52 PM

#

You need to wget the raw.github not the webpage

#

No, you downloaded the webpage

#

I've seen this before, I can see what you've done wrong

empty osprey Jun 18, 2020, 5:52 PM

#

uaheuh

#

sorry, you're right

stuck fractal Jun 18, 2020, 5:54 PM

#

Now, if you'd just posted the screenshot to start with, it would have taken about half the time

empty osprey Jun 18, 2020, 5:55 PM

#

Ok, I'm sorry and very thanks

final yew Jun 18, 2020, 7:21 PM

#

Hey Guys, so I'm working on RP: PS Empire room and for some reason I can't figure out the answer to this question:
#7 In addition to changing our browser profile, we can change what our server appears as. What option can we set to change this?

When I look at what options I have I don't think mines is showing the correct options. I was just wondering if maybe it was because the room is outdated or something.

📎 unknown.png

stuck fractal Jun 18, 2020, 7:24 PM

#

It's 'Headers' from that image

#

But the room is outdated as empire keeps changing

#

Dark is fixing it soon

final yew Jun 18, 2020, 7:25 PM

#

That's what I first figured but Headers isn't the answer

#

Do you know what the answer is from the old PSEmpire?

ripe hedge Jun 18, 2020, 7:48 PM

#

That one was annoying

#

Look it up in the writeup

final yew Jun 18, 2020, 7:52 PM

#

Will do. That's the only one that I'm missing.

📎 unknown.png

#

doomersir

stoic jewel Jun 18, 2020, 7:52 PM

#

I'm wondering I'm in the second privilege escalation with no flag yet, any hints here (WonderLand Room)

📎 Screenshot_from_2020-06-18_20-50-47.png

potent vale Jun 18, 2020, 7:57 PM

#

@stoic jewel The hint on THM is very useful. But if you don't find the flag at the moment you will stumble over it eventually.

stuck fractal Jun 18, 2020, 7:58 PM

#

@stoic jewel You can get the user flag from alice.

white salmon Jun 18, 2020, 8:05 PM

#

can anyone give me a small nudge on year of the rabbit

ripe hedge Jun 18, 2020, 8:05 PM

#

yup

#

think about Wonderland a bit 🙂

#

@white salmon gotta be a bit more precise there

white salmon Jun 18, 2020, 8:06 PM

#

I am trying to intercept the request via burp, but am not able to get the ||intermediate directory||

#

I'm in the linux room doing a little review, but I can not seem to find the shiba4.bin file, can anyone help?(cmd i have been using: find . -name shiba4.bin)

ripe hedge Jun 18, 2020, 8:07 PM

#

what's your pwd?

#

it's probably not in the /home

stuck fractal Jun 18, 2020, 8:07 PM

#

@white salmon It's not a .bin

#

File extensions aren't real

ripe hedge Jun 18, 2020, 8:07 PM

#

also that

stuck fractal Jun 18, 2020, 8:07 PM

#

Windows cares, linux sees files for what they truly are

white salmon Jun 18, 2020, 8:07 PM

#

thank you

stoic jewel Jun 18, 2020, 8:08 PM

#

@stuck fractal I belive that the user.txt is in tryhackme home dir

stuck fractal Jun 18, 2020, 8:09 PM

#

@stoic jewel You're wrong.

#

The user flag can be accessed from Alice, or any other user with a shell

#

You need to find it though.

#

But find won't work

#

So you need to think

white salmon Jun 18, 2020, 8:10 PM

#

@ripe hedge can I dm you about year of the rabbit, I fear I might give some major spoilers here

ripe hedge Jun 18, 2020, 8:11 PM

#

haven't done that one

#

just that you should actually ask the question, instead of asking to ask

#

@stoic jewel the tryhackme directory is basically out of bounds

#

think about how Wonderland works, and I mean the Lewis Carroll version

#

I though that flag was the cutest part of that room

stoic jewel Jun 18, 2020, 8:13 PM

#

Wow I'll do my best rigth now

ripe hedge Jun 18, 2020, 8:14 PM

#

the hint is the location of the root flag

#

😉

stoic jewel Jun 18, 2020, 8:26 PM

#

@ripe hedge Lol This can't be happen bro, but why !!!!

ripe hedge Jun 18, 2020, 8:26 PM

#

eh?

stoic jewel Jun 18, 2020, 8:27 PM

#

@ripe hedge I'm going to get the bonus 😉

#

with hatter user

ripe hedge Jun 18, 2020, 8:28 PM

#

glhfdd

stoic jewel Jun 18, 2020, 8:31 PM

#

I've never come in a situation like that with no permission 😦

white salmon Jun 18, 2020, 8:36 PM

#

any hints as to the linux room root flag?

ripe hedge Jun 18, 2020, 8:37 PM

#

enumerate harder

white salmon Jun 18, 2020, 8:40 PM

#

like the env variables or?

ripe hedge Jun 18, 2020, 8:49 PM

#

files

white salmon Jun 18, 2020, 8:50 PM

#

ahh thank you

stoic jewel Jun 18, 2020, 9:18 PM

#

@ripe hedge just a question (from rabbit to root, or from rabbit to hatter then root !!)

ripe hedge Jun 18, 2020, 9:18 PM

#

hmm?

#

can't root from rabbit that I know of

dim cedar Jun 18, 2020, 9:20 PM

#

hashcat --username --show -a 0 -m 1000 /root/Desktop/hash.txt /usr/share/wordlists/rockyou.txt For some reason I cant get hashcat to work. Its starting to drive me up a wall. can someone just take a peak at this

#

dammit and the room expired

#

or the VM

ripe hedge Jun 18, 2020, 9:21 PM

#

the --username and --show options seem out of place

stoic jewel Jun 18, 2020, 9:21 PM

#

@dim cedar Try JTR

patent token Jun 18, 2020, 9:22 PM

#

Or simply use the correct syntax.

ripe hedge Jun 18, 2020, 9:22 PM

#

🙂

dim cedar Jun 18, 2020, 9:22 PM

#

Is this not the right syntax?

patent token Jun 18, 2020, 9:22 PM

#

Just try hashcat -a 0 -m 1000 /root/Deskthop/hash.txt /usr/share/wordlists/rockyou.txt

stuck fractal Jun 18, 2020, 9:22 PM

#

--show won't crack it

#

--show is once it's cracked

dim cedar Jun 18, 2020, 9:23 PM

#

huh ok thank you

ripe hedge Jun 18, 2020, 9:23 PM

#

or read the console output

#

it'll generally tell you

patent token Jun 18, 2020, 9:23 PM

#

I usually get that my hash is incorrect, and then I scream, pout, and do it in John instead.

ripe hedge Jun 18, 2020, 9:23 PM

#

^_^;

patent token Jun 18, 2020, 9:24 PM

#

Right Ninja? 😛

stuck fractal Jun 18, 2020, 9:24 PM

#

John in VMs

#

Hashcat on GPUs

ripe hedge Jun 18, 2020, 9:27 PM

#

^

#

that

#

apparently WSL2 will get GPU support soonish 🙂

stuck fractal Jun 18, 2020, 9:28 PM

#

Ye but WSL2 is a VM

ripe hedge Jun 18, 2020, 9:30 PM

#

yes

stuck fractal Jun 18, 2020, 9:31 PM

#

It means hyperv and ew

ripe hedge Jun 18, 2020, 9:31 PM

#

¯_(ツ)_/¯

unborn bough Jun 18, 2020, 10:28 PM

#

Hey just started on the box "blaster" and i found the username on the hidden dir but i cant seem to find the passwd.

#

The hint said that i should look for the comments on the hidden dir but i cant seem to find any

#

Could i get a bump here?

patent token Jun 18, 2020, 10:29 PM

#

Will take a bit of OSINT/creative thinking.

#

If you found the username, something on that page has some reference to something else. Search for what that something else is, along with the username you have.

#

It's mildly cryptic, but if you try for a bit and can't figure it out yet, I'll drop a bigger hint. 🙂

unborn bough Jun 18, 2020, 10:30 PM

#

thanks!

dim cedar Jun 18, 2020, 10:31 PM

#

Well just finished blue

#

harder than I thought it would be mainly due to me not understanding syntax but overall 👍

unborn bough Jun 18, 2020, 10:33 PM

#

@patent token Found it!

#

Interesting way of finding it

#

But got reminded since i watched the movie mentioned!

patent token Jun 18, 2020, 10:33 PM

#

🙂

unborn bough Jun 18, 2020, 10:55 PM

#

Hey so when i run rdesktop with the username passwd and ip i get this error

#

Autoselecting keyboard map 'en-us' from locale
Core(warning): Certificate received from server is NOT trusted by this system, an exception has been added by the user to trust this specific certificate.
Failed to initialize NLA, do you have correct Kerberos TGT initialized ?
Failed to connect, CredSSP required by server (check if server has disabled old TLS versions, if yes use -V option).

patent token Jun 18, 2020, 10:57 PM

#

Try xfreerdp instead.

#

Probably need to apt install it

unborn bough Jun 18, 2020, 10:57 PM

#

Thanks!

#

Got this error now

#

xfreerdp /u:xxxx /p:xxxxxxxx /v:xx.xx.xxx.xx

[01:00:26:540] [5397:5398] [INFO][com.freerdp.client.common.cmdline] - loading channelEx cliprdr
[01:00:26:944] [5397:5398] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_LOGON_FAILURE [0x00020014]
[01:00:26:944] [5397:5398] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[01:00:26:944] [5397:5398] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

wispy bloom Jun 18, 2020, 11:04 PM

#

Try --enableNla

#

or --no-nla

#

it doesn't like the network level authentication

unborn bough Jun 18, 2020, 11:06 PM

#

nah i didn't work

#

xfreerdp --no-nla /u:wxxxxxx /p:xxxx /v:xx.xx.xxx.xx

wispy bloom Jun 18, 2020, 11:09 PM

#

hmmm without turning on debug logging I can't be sure honestly

#

https://github.com/FreeRDP/FreeRDP/issues/2334

GitHub

Logging · Issue #2334 · FreeRDP/FreeRDP

Hello, Where can we find the logs for the FreeRDP connection? If our connection drops I'm hoping the logs will help determine why. Thank you.

#

Alternatively, because the NLA is probably looking for a Windows host remote connection, you could whip up a windows VM and connect via that method after downloading OpenVPN client

#

May save you some time

unborn bough Jun 18, 2020, 11:14 PM

#

yea, no im to lazy to do that

wispy bloom Jun 18, 2020, 11:14 PM

#

Haha I mean - bust your ass troubleshooting linux -> windows NLA connections or whip up a VM

#

NLA can be a rabbithole

stuck fractal Jun 18, 2020, 11:15 PM

#

IIRC remina works well

white salmon Jun 18, 2020, 11:15 PM

#

remmina is a good RDP client

unborn bough Jun 18, 2020, 11:16 PM

#

@wispy bloom i dont think its a rabbit hole since the box is "blaster" and there are only 2 ports open

#

80 and 3389

wispy bloom Jun 18, 2020, 11:16 PM

#

No no - I mean getting NLA to play nice with an RDP linux connection

#

It's annoying

#

Try what the gurus are saying. Remina or whatever it's called. I haven't used that one before

unborn bough Jun 18, 2020, 11:17 PM

#

ill try remina

wispy bloom Jun 18, 2020, 11:17 PM

#

good luck

unborn bough Jun 18, 2020, 11:18 PM

#

looks like i got remina working!

wispy bloom Jun 18, 2020, 11:18 PM

#

psh no kidding. I'll have to add that one to my vm then

unborn bough Jun 18, 2020, 11:19 PM

#

aaaand it crashed

wispy bloom Jun 18, 2020, 11:20 PM

#

😦

unborn bough Jun 18, 2020, 11:20 PM

#

still got user.txt

#

but with remina u get the windows ui

#

and its a pretty clean interface

#

yea i could get like 2 mins of time before it crashed

#

so now i have to restart

noble tinsel Jun 18, 2020, 11:25 PM

#

can anyone help with blueprint please? trying to get a shell with this command, it connects but immediately drops the connection. would this be the correct php code to open a nc connection? I commented out the echo line because I assumed that was the reason why.

📎 unknown.png

#

i tried to include <?php $cmd=$_GET['cmd']; system($cmd);?> but it returns an error saying system is disabled.

stuck fractal Jun 18, 2020, 11:27 PM

#

Then you can't use system()

noble tinsel Jun 18, 2020, 11:27 PM

#

what about the nc line @stuck fractal

stuck fractal Jun 18, 2020, 11:27 PM

#

wat

noble tinsel Jun 18, 2020, 11:28 PM

#

the picture above that. I'm trying to open a socket to connect to but it drops immediately after connecting

stuck fractal Jun 18, 2020, 11:28 PM

#

No idea

unborn bough Jun 18, 2020, 11:40 PM

#

im having issues finding how to find search history on internet explorer

#

WHO TF USES INTERNET EXPLORER

wispy bloom Jun 18, 2020, 11:44 PM

#

lol oh you'd be surprised

stoic jewel Jun 18, 2020, 11:47 PM

#

@ripe hedge owned

stuck fractal Jun 18, 2020, 11:48 PM

#

*rooted

noble tinsel Jun 18, 2020, 11:55 PM

#

i tried to include <?php $cmd=$_GET['cmd']; system($cmd);?> but it returns an error saying system is disabled.
@noble tinsel for anyone doing blueprint this php command worked for me ||<?php echo shell_exec($_GET["cmd"]); ?>||

stoic jewel Jun 19, 2020, 12:03 AM

#

yeah

bright steeple Jun 19, 2020, 1:41 AM

#

can someone give me the syntax on how to copy and paste the pay to telnet session?

📎 Capture.JPG

stuck fractal Jun 19, 2020, 1:43 AM

#

Select the output from msfvenom

#

copy it

#

type .RUN into telnet

#

Then paste it, then press enter

#

@bright steeple enough?

bright steeple Jun 19, 2020, 1:45 AM

#

@stuck fractal yah thanks

#

maybe i missed typed a letter on first try

#

oh yah i typed @ when its 0 hahah

stoic jewel Jun 19, 2020, 2:04 AM

#

Why !!! can anyone explain to me!!

📎 Screenshot_from_2020-06-19_03-02-25.png

stuck fractal Jun 19, 2020, 2:06 AM

#

@stoic jewel you get more points if you are the first to answer a question.

#

You were not the first.

stoic jewel Jun 19, 2020, 2:07 AM

#

Emmm even if it was my first try !!

stuck fractal Jun 19, 2020, 2:08 AM

#

Yes.

#

Doesn't matter how many times you try

#

Szymex was the first person to answer, and therefore gets the bonus points

stoic jewel Jun 19, 2020, 2:09 AM

#

yeah that makes some sense

lusty wigeon Jun 19, 2020, 8:11 AM

#

bookface ||ftp|| password, don't wanna wait 887:14h 🙄

white salmon Jun 19, 2020, 8:54 AM

#

can anyone suggest me how do I look for the LSB executable code???

safe kiln Jun 19, 2020, 11:11 AM

#

Trying to complete the challenge at the end of into to python any hints to what i am doing wrong

📎 Screenshot_2020-06-19_12-07-01.png

solid patrol Jun 19, 2020, 11:12 AM

#

it should base 16 decode not 14

#

and try to see how for loops work

safe kiln Jun 19, 2020, 11:19 AM

#

good catch on the base 16 must have missed typed fixed that still getting a error name 'base64' is not defined thanks will go back and go over loops

solid patrol Jun 19, 2020, 11:21 AM

#

that error is probably because u have space between base64. and b32decode

warm schooner Jun 19, 2020, 11:23 AM

#

Trying to complete the challenge at the end of into to python any hints to what i am doing wrong
@safe kiln

Base16
Base32
Base65

You also have spaces between your base64 import and your function call, i.e base64. b64decode()

inland onyx Jun 19, 2020, 11:27 AM

#

You're also using a separate output for each set of decoding

#

Decode the same object throughout

safe kiln Jun 19, 2020, 11:31 AM

#

@safe kiln
Base16
Base32
Base65
You also have spaces between your base64 import and your function call, i.e base64. b64decode()
@warm schooner

📎 Screenshot_2020-06-19_12-25-47.png

solid patrol Jun 19, 2020, 11:32 AM

#

it still wont work

#

bc data2 will always be one decoding of data1

#

and your loop will only go through operation 4

#

for i in range(0,4)

#

i will be 0,1,2,3

true widget Jun 19, 2020, 11:35 AM

#

i m solving common linux privesc room.I m stuck at exploiting path variable challenge.Can anyone help me>

#

i m solving common linux privesc room.I m stuck at exploiting path variable challenge.Can anyone help me?

solid patrol Jun 19, 2020, 11:36 AM

#

sure

#

what steps did u do?

true widget Jun 19, 2020, 11:37 AM

#

i m stuck in #4

📎 hm.png

#

@solid patrol

#

we have to imitate ls right?

solid patrol Jun 19, 2020, 11:39 AM

#

yea

true widget Jun 19, 2020, 11:40 AM

#

and path is bin/bash

solid patrol Jun 19, 2020, 11:41 AM

#

u need to put some command that will spawn shell into ls

true widget Jun 19, 2020, 11:41 AM

#

is it ||echo "bin/bash/" > ls||

solid patrol Jun 19, 2020, 11:42 AM

#

yes but syntax is wrong

true widget Jun 19, 2020, 11:42 AM

#

okk I ll try

#

i tried|| echo "/bin/bash/" > ls ||.lts still wrong.

#

it worked

#

finally

true widget Jun 19, 2020, 12:04 PM

#

@solid patrol where to use /bin/ls?

steady stratus Jun 19, 2020, 12:04 PM

#

Ask your question without posting answers please

solid patrol Jun 19, 2020, 12:04 PM

#

when

true widget Jun 19, 2020, 12:04 PM

#

but when did I post answers?

steady stratus Jun 19, 2020, 12:05 PM

#

In your screenshot

solid patrol Jun 19, 2020, 12:05 PM

#

when u execute just ls

true widget Jun 19, 2020, 12:05 PM

#

In your screenshot
@steady stratus pardon I didnt realised.

solid patrol Jun 19, 2020, 12:05 PM

#

u should be able to get root

true widget Jun 19, 2020, 12:05 PM

#

u should be able to get root
@solid patrol okk i ll try

#

u should be able to get root
@solid patrol I couldnt get root

solid patrol Jun 19, 2020, 12:13 PM

#

what is your output of cmd 'which ls'

true widget Jun 19, 2020, 12:14 PM

#

||/bin/ls||

solid patrol Jun 19, 2020, 12:14 PM

#

so u didnt exploit path variable correct

true widget Jun 19, 2020, 12:16 PM

#

i did|| export PATH=/tmp:$PATH||

solid patrol Jun 19, 2020, 12:17 PM

#

and did u put your ls that u created in tmp

true widget Jun 19, 2020, 12:18 PM

#

put it where?

solid patrol Jun 19, 2020, 12:18 PM

#

in /tmp directory

true widget Jun 19, 2020, 12:21 PM

#

i did echo ||"bin/bash" > ls||

#

then|| chmod +x ls||

solid patrol Jun 19, 2020, 12:21 PM

#

u whant to change ls commnad so that when u use it it will spawn shell

#

with bin/bash u want spawn shell

true widget Jun 19, 2020, 12:45 PM

#

u whant to change ls commnad so that when u use it it will spawn shell
@solid patrol where should I use ||/bin/ls|| in home directory of user5?

solid patrol Jun 19, 2020, 12:46 PM

#

u need to us ls command that u created

#

to esclate privlages

#

just put directory in which u created ls command into path variable like in instutcion in task

#

and then which ls should give you directory in which u created ls

#

and from that just use ls

#

and u will get root

unborn bough Jun 19, 2020, 12:53 PM

#

Hey so a question about Blaster. I have gotten into the machine using the tool "Remmina" but i cant seem to find the CVE. I have opened internet explorer on the box and looked in the search history but theres nothing there.

#

Could i get a bump here?

solid patrol Jun 19, 2020, 12:54 PM

#

try saved page

unborn bough Jun 19, 2020, 12:54 PM

#

thanks!

true widget Jun 19, 2020, 12:56 PM

#

@solid patrol can i dm you?

solid patrol Jun 19, 2020, 12:56 PM

#

yea

unborn bough Jun 19, 2020, 12:59 PM

#

@solid patrol i cant find the "saved page"

solid patrol Jun 19, 2020, 1:00 PM

#

it should be in bookmarked pages

#

i think its on google chrom on machine

unborn bough Jun 19, 2020, 1:01 PM

#

nah internet exporer

#

@solid patrol theres nothing in the bookmarked pages

solid patrol Jun 19, 2020, 1:07 PM

#

let me just boot machine

unborn bough Jun 19, 2020, 1:07 PM

#

k

#

@solid patrol u booted it?

solid patrol Jun 19, 2020, 1:19 PM

#

yea

#

i booted it

#

but it isnt in history

#

and shoud be there

unborn bough Jun 19, 2020, 1:19 PM

#

yea

solid patrol Jun 19, 2020, 1:19 PM

#

even hint say to look in history

unborn bough Jun 19, 2020, 1:19 PM

#

yea ik

#

so what should i do ?

solid patrol Jun 19, 2020, 1:22 PM

#

give me a sec to boot retro room

steady stratus Jun 19, 2020, 1:22 PM

#

I think it's possibly in Internet Explorer from my memory?

solid patrol Jun 19, 2020, 1:22 PM

#

to see if u can get it from there

unborn bough Jun 19, 2020, 1:24 PM

#

@steady stratus it should be there

#

but it is not

lusty wigeon Jun 19, 2020, 1:26 PM

#

Uh-oh! You have had your machine deployed for too long.
well congrats, you have an impossible room there 😅

📎 unknown.png

solid patrol Jun 19, 2020, 1:27 PM

#

@unborn bough u can get it from retro room

unborn bough Jun 19, 2020, 1:28 PM

#

oh

lusty wigeon Jun 19, 2020, 1:28 PM

#

can someone give me the ||ftp password for jerry|| in bookface so i can do this bugged room ?

steady stratus Jun 19, 2020, 1:29 PM

#

It's not bugged

lusty wigeon Jun 19, 2020, 1:29 PM

#

it is just search the discord 😄

steady stratus Jun 19, 2020, 1:29 PM

#

If your bruteforce is taking a maximum of 10 minutes (the developer guidelines are maximum 5) but let hardware / network factor in too

unborn bough Jun 19, 2020, 1:29 PM

#

@solid patrol this one? https://tryhackme.com/room/retrohttps://tryhackme.com/room/retro

#

https://tryhackme.com/room/retro

TryHackMe

TryHackMe | Retro

New high score!

solid patrol Jun 19, 2020, 1:30 PM

#

yea

lusty wigeon Jun 19, 2020, 1:30 PM

#

@steady stratus bookface is older than that policy

steady stratus Jun 19, 2020, 1:30 PM

#

Ah you're right

#

my apologies

#

just checked

unborn bough Jun 19, 2020, 1:30 PM

#

its rated hard

solid patrol Jun 19, 2020, 1:30 PM

#

blaster is just walkthrou of retro

unborn bough Jun 19, 2020, 1:30 PM

#

im pretty new to this website so im not too sure on the diffuculty scale

#

have done HTB earlier tho

steady stratus Jun 19, 2020, 1:32 PM

#

Having a look, people have used the ||fasttrack ||wordlist have you had any luck with that? @lusty wigeon

solid patrol Jun 19, 2020, 1:32 PM

#

i will check now to see if it is in that list

lusty wigeon Jun 19, 2020, 1:32 PM

#

yea i saw the writeup but seems that was before it got updated

steady stratus Jun 19, 2020, 1:32 PM

#

Okay neat I'm just giving a whirl myself but that'll be much quicker I can imagine

#

thanks S1n

solid patrol Jun 19, 2020, 1:33 PM

#

no it is not in that word list

patent token Jun 19, 2020, 1:33 PM

#

I'm trying it as well.

solid patrol Jun 19, 2020, 1:33 PM

#

if u use hint of flag1 u will see password

lusty wigeon Jun 19, 2020, 1:34 PM

#

really ? i was doing hackback2019 version. hint is only "nmap+ftp" there

solid patrol Jun 19, 2020, 1:35 PM

#

in bookface room hint for flag1 contains password for jerry

steady stratus Jun 19, 2020, 1:35 PM

#

Mhm interesting, I wonder what wordlist has that. TIL

solid patrol Jun 19, 2020, 1:35 PM

#

didnt try hackback2019 so for that it may be diffrent password

steady stratus Jun 19, 2020, 1:36 PM

#

Ah got it

solid patrol Jun 19, 2020, 1:36 PM

#

i think it is in rockyou.txt just around line 10M+

steady stratus Jun 19, 2020, 1:37 PM

#

Yea it's quite a way down