room-hints

[leaden quartz]

It's says perform an aggressive scan, what flag isn't set under port 80

?

[indigo ridge]

I need some hint on the room Gatekeeper.. portscan revealed something.. but what is that?

I connected to the ||elite|| port.. through telnet..

[echo thunder]

anyone completed dave blog room? I need help on root flag

[trim haven]

#room-help

[echo thunder]

Who needs help on Jeff can PM me

[brittle rock]

For Advent of Cyber - Day 15 (metasploit) it seems like the flag should be in a very obvious place: flag-dir yet meterpreter says it is empty, even when searching for hidden files

Am I overlooking something very obvious

[white salmon]

@brittle rock, I haven't done any of that room but maybe you can see if the filename has weird non-printable characters with python?

[brittle rock]

It's a directory

sorry

should have made that more clear

[white salmon]

But you said that flag-dir might contain the flag right?

[brittle rock]

Well, the name would suggest it at least

I'm currently in a docker environment

and judging by the order of questions it looks like the flag should be inside of it

[white salmon]

Yeah.

Hm

It's probably on the host machine then.

[brittle rock]

Well, I thought that

but you can find some ssh-creds in the docker environment

and THM asks for the ssh password after the first flag

so I assumed it would be in the docker environment at least

[white salmon]

And you have done a 'ls -l' on that directory?

or 'ls -l -a'

[patent token]

Or ls -la

[white salmon]

or ls -al

or ll -a

[brittle rock]

alright got it

I think that must have been a distraction

I tried using the command find but it wasn't on the meterpreter

so I spawned a shell

[white salmon]

Nice.

[brittle rock]

then ran find / 2>/dev/null | grep "flag"

But thanks for all the help!

[white salmon]

I tried. 🙂

[brittle rock]

Well I didn't really give you anything to go off haha

cheers for the sanity check 🙂

[white salmon]

Yeah, it's hard without a screen share.

[solid patrol]

any hint on jeff, i enumurated ||admin|| and ||src code|| but wasnt able to find anything useful?

[hasty slate]

enumerate all with extensions.

[solid patrol]

tnx

[mild eagle]

try different wordlist to enum with... if you dont find anything usefull

[sharp moat]

Is there any good rooms to practice pivoting? I couldn’t find any room that has pivoting techniques! :/

[trim haven]

#general

[midnight monolith]

@sharp moat
https://tryhackme.com/room/borderlands

[keen willow]

Jeff i can ||upload ftp|| but dont knw what to do with it, i know i am inside ||docker|| and need to escape from here. But may be i am not yet ready , shall i look for any perticular ||CVE|| like ||CVE-2019-5736|| or giveup ?

[potent vale]

@keen willow ||look for a common linux privesc, for example in the PayloadAllTheThings cheat sheet||

It's blind though, so trial and error. You cannot know that it works before it works

[keen willow]

It's blind though, so trial and error. You cannot know that it works before it works
@potent vale
Hope!! you just ignite the spark again.

[severe wave]

Does anyone know why flag2 from Jigsaw2 is not accepted by the validator? Yes, I removed flag2{ and }

[blazing ruin]

Does anyone know the login for the machine for the tmux room?

[dull river]

Hi, cant solve this question, already download the report but stuck from 4 hours, can you help me on that (Download the report attached to this task. What is the only critical issue?)
web application security room
task 13 question1

[solemn smelt]

@blazing ruin there is no need to login in to the deployed machine the room only wants you to run scans against it

[blazing ruin]

Looking at question 1) First things first, let's go ahead and install tmux. This can be done on Ubuntu/Kali with the command: apt-get install tmuxit is implied that I have my own machine?

[solemn smelt]

yes that is run on your own machine

[blazing ruin]

ok great! tbanks!

[icy bridge]

Hi guys. I am at burpsuite and I am supposed to send to sequencer the set cookie header. I let it run until 27000 tokens, but it shows zero live capture and I can't analyze the result because it is zero...help?

Btw it is a live capture for owasp juice shop

Nevermind, I got it :)

Thanks anyway

[jade bolt]

can anyone give a hint on OWASP Juice shop? I am at the injection but can't seem to find out the right injection

[stuck fractal]

@jade bolt there's a bunch of different types of injections

[swift violet]

@jade bolt have you gone through the burp suite rooms?

@jade bolt there's a task in one of the burp suite rooms that can help you with that

[jade bolt]

Ah thank you!

will be looking into it!

[white salmon]

I want to access the root.txt but I don't have the permissions for it (pictures)... The perms don't work even with sudo.
Need help :c
Room: Learn Linux
Task: #43

[fallen jolt]

@white salmon if you do sudo -l you can check if you have sudo priv. and to do what. that might be different on all the accounts 🙂 and look if any of the accounts have a file you have overlooked

[white salmon]

So, I tried su shiba1 and switched to every user 1 by 1 and typed sudo -l but I always get the same message : Sorry, user shiba1 may not run sudo on nootnoot..
I tried to /root/root.txt on each user but again, I get the same type of message : bash: /root/root.txt: Permission denied

[stuck fractal]

Only root can read that file

Root is the administrator user

[white salmon]

I don't really get what I'm supposed to do! :c

[stuck fractal]

There's one user on the box that has permissions to use sudo to run commands as root

[white salmon]

Yes, but I give the password when they ask me for it

ahh

[stuck fractal]

That doesn't mean you can run commands as root with sudo

otherwise hacking would be super super easy

[white salmon]

su root

[stuck fractal]

That would log you in as root, if you had root's password

On ubuntu, root doesn't have a password set by default

[white salmon]

ahhh ok

[unkempt tinsel]

@white salmon think of root as a admin user with full system permissions

[white salmon]

Ok, I need to access the root.txt file... but in order to do that, I'd have to log in as root but I need the pass!...

[stuck fractal]

Nope.

Sudo allows you to run commands as another user

Typically root

There's one user on the box that has permissions to use sudo to run commands as root
@stuck fractal

[unkempt tinsel]

Well typically superusers

[stuck fractal]

Typically root.

[unkempt tinsel]

dependant on the sudoers file

[white salmon]

Oh, so should I use something like find or grep to find the root.txt file?

[stuck fractal]

Stop complicating this @unkempt tinsel

@white salmon You know where it is.

[white salmon]

I don't :c

[stuck fractal]

You're told

/root/root.txt

[white salmon]

But I guess I have to search

[stuck fractal]

No

[white salmon]

yess

but

[stuck fractal]

You're told the full file path

[unkempt tinsel]

if you want to find a file go too /

[stuck fractal]

You can't read it without being the root user

[white salmon]

Yes

Permission denied

[unkempt tinsel]

then type sudo find . -name root.txt

[stuck fractal]

@unkempt tinsel Hey, can I ask if you're trying to help to give a) good advice and b) not complicate things if someone else is already helping

You're making this really difficult

[unkempt tinsel]

sorry bro

[stuck fractal]

Not your bro

@white salmon So, you need a user that has sudo as root permissions

There is one user on the box that has those

[white salmon]

There is one user on the box that has those
@stuck fractal Which box 🤔

[stuck fractal]

The Learn Linux VM

[white salmon]

Or do you mean, one of the 4 userrs?

[stuck fractal]

There's more than just the shibas on that box

[white salmon]

hmm

I have to find those

[stuck fractal]

And also find a way to gain access to those users

[white salmon]

So, this is supposed to be a challenge... I see

[stuck fractal]

Bonus Challenge yes

[tulip hawk]

i am not able to execute the shiba binary 😦

[trim haven]

Have you followed the instructions

[tulip hawk]

sorry, england is not my mother tongue

so i may have a hard time understaning everything

[trim haven]

I'm presuming you're on learn linux?

[tulip hawk]

yes, that is correct

[trim haven]

Task?

[tulip hawk]

21

ohhhh, i managed to get it

[trim haven]

Have you set the environment-

Make sure to keep trying ;)

[stuck fractal]

Don't post answers.

[tulip hawk]

sorry bro

[stuck fractal]

Again, not your bro.

[tulip hawk]

sorry pal

[stuck fractal]

Not your pal either.

[tulip hawk]

ok acquaintance

[stuck fractal]

There is no need to refer to that at all. So don't.

[tulip hawk]

i'm sorry if i have made you upset

[trim haven]

Sinner just move on.

[white salmon]

Since I'm in room "Learn Linux" too, for the Bonus Task, does it have something to do with task #36? Since I can see the creator creates some supermod user. I figured maybe it could have something to do with that

[stuck fractal]

Nope.

[trim haven]

Jaammess you're not giving me time to thinkkkk

[stuck fractal]

I mean it's a yes or a no

[white salmon]

hmm

[trim haven]

I'm trying to come up with an excuse but I got nada

[white salmon]

I can't figure out which user it can be, except shiba1,2,3,4!

[trim haven]

How about

You try them all :D

[white salmon]

I did :cc

[trim haven]

Try harder

[white salmon]

None of them has the permission

ahh ok...

[stuck fractal]

Maybe there are more users than just those 4.

[white salmon]

I would directly think of shiba5

but since I get the same No passwd entry for user 'shiba5' or shiba99 or shiba1000 :c

I don't know if it is shiba

[trim haven]

maybe you need to look for something else before the user

[white salmon]

hmm

Finish this room off! What is the root.txt flagWhat is the meaning of "flag" here?

[digital iris]

it's just ctf terminology, user.txt and root.txt are referred to as flags to get

[white salmon]

Ok, well thanks for the help. I'll try again tomorrow with a fresh mind

[silk dagger]

Hey all, for hackpark, i assume rockyou.txt is the word list to use?

[oblique cliff]

If a wordlist is required for anything for that room, yes @silk dagger

[toxic scarab]

any hints for where to start for flag2 of Ra?

[random grail]

On same place where you found flag1 @toxic scarab there are some other files there

[toxic scarab]

@random grail thanks. i'll keep looking there

there's just so much stuff on this box it's hard to know where to start

[random grail]

You saw other files there?

[toxic scarab]

yeah

[random grail]

Google it

And you will find something interesting

[toxic scarab]

i've already been down that road a bit, but can't get anything to work the way I'm thinking it should. I'll just try harder

think i got something finally. thanks for the hint

[brittle rock]

Could I get a hint for Advent of Cyber - Day 13, the privesc. I think it involved the hhupd file which is left out, but I've spent a while on it, and people suggested that google chrome should be a present application, when it isn't on the RDP service.

[final mortar]

Could I get a hint for Advent of Cyber - Day 13, the privesc. I think it involved the hhupd file which is left out, but I've spent a while on it, and people suggested that google chrome should be a present application, when it isn't on the RDP service.
@brittle rock Has your IE stored some browsing history ?

[brittle rock]

Yup, I looked into the vulnerability

But from everything I saw, it needs chrome at least?

[white salmon]

On ubuntu, root doesn't have a password set by default
@stuck fractal I tried leaving the password blank when they asked me for it, it says su: Authentication failure. I also tried random passwords like "admin", "password", etc...
Is my objective to log onto root, right now?

Sorry for the mention, figured since you already know my problem you could help me

[white salmon]

Agent sudo room, second flag. I don't know how to continue, but i discovered ||server-status|| site

[keen willow]

its getting hard on jeff, one thing i need (i guess?) do i need to do something in ||ftp|| or in ||docker|| ? please dont say both 😦

[rain oasis]

You need to do something in || ftp ||

[white salmon]

You need to do something in || ftp ||
@rain oasis I know thanks you

i didn't read the ||user-agent part||

[rain oasis]

that was a response to @keen willow 😛

[white salmon]

xdxdxdxdxdxdxdxd

[stone blade]

guys

is anyone on Intro to x86-64 room?

I have a doubt and would like to be cleared

[stuck fractal]

Don't ask to ask, just ask

[stone blade]

huh?

[trim haven]

Ask your question..

[stone blade]

thanks

so as you can see here, at the 1st breakPoint we can see that it will jump if great or igual to that specific address after comparing if var_4 with eax

by comparing it, my compiler simply jumped to the address which is right

because: var_4 is equal to 4 and eax is equal to 3

but in the room it says it shouldnt jump, I dont understand why it shouldnt

i'm confused

the order is to compare the var_4h to eax and not eax to var_4h

[stuck fractal]

Look at the jge instruction

[rain oasis]

I think your confusion comes from reading the cmpl operands backwards. It checks if eax >= var_4, which as you said, it isnt.

[white salmon]

@stuck fractal I tried leaving the password blank when they asked me for it, it says su: Authentication failure. I also tried random passwords like "admin", "password", etc...
Is my objective to log onto root, right now?
@white salmon Don’t know if you missed my message :c

(Again, sorry for the mention, U really need help)

[stuck fractal]

@white salmon it's not just me that can help.

I believe I've told you before, by default root doesn't have a password set so you can't log in with su from a different user.

I've given you all the information I'm willing to give you

[stone blade]

Look at the jge instruction
@stuck fractal yes it says to jump if cmpl values are greater or equal...

but shouldnt that be if var_4h >= eax instead?

[white salmon]

Oh okkk, so I need to set a new password!

[rain oasis]

@stone blade If it were Intel syntax, yes, but in AT&T syntax (which r2 uses by default) the operand order is reversed

[stuck fractal]

@white salmon no

You can't do that

[stone blade]

@stone blade If it were Intel syntax, yes, but in AT&T syntax (which r2 uses by default) the operand order is reversed
@rain oasis Now I got more confused... I know:

AT&T:instruction = source + destination
Intel: instruction = destination + source

right?

[rain oasis]

yes

[stone blade]

then its the way i'm reading it now

[white salmon]

I don't really get it, I'm supposed to log in with root user so i can access root.txt so I assume I need to su root. When I do that, it's asking me for a password... I don't get what I need to do.

[stone blade]

so its comparing if var_4h is greater or iqual to eax which has 3 as value.

then its the way i'm reading it now
@stone blade

and its right, right?

[rain oasis]

well, you said eax == 3 and var_4 == 4, right? so in that case it's checking if 3 > 4

[stuck fractal]

@white salmon you need to get root permissions.

The room has told you how you can do that

I've told you how you can do that.

[rain oasis]

@stone blade In AT&T syntax, a cmpl compares the second operand to the first, not the first to the second (that Intel syntax)

Which is rather confusing 😛

[stone blade]

@stone blade In AT&T syntax, a cmpl compares the second operand to the first, not the first to the second (that Intel syntax)
@rain oasis oh now its really confusing

yah u are right its confusing since its AT&T and not Intel, Intel compares operands like this and not AT&T

[rain oasis]

you can get r2 to use intel syntax if you prefer it, or just keep in mind that the operands are reversed. Either way, that's why the jge isn't jumping.

[white salmon]

The room has told you how you can do that
I'm sorry if I don't get it...

[stuck fractal]

You're still asking for hints. I've given hints. You can get someone else to give you different hints if you want, but I don't want to give any more hints

[white salmon]

Fine, I just don't get your hints yet

[stuck fractal]

Read back over the task covering sudo

[stone blade]

you can get r2 to use intel syntax if you prefer it, or just keep in mind that the operands are reversed. Either way, that's why the jge isn't jumping.
@rain oasis but thats the problem, its jumping to the address pointed if var_4 is greater than eax which i think its right, but room says it shouldnt, thats what´s confusing me hahaha

[rain oasis]

according to your screenshot it isnt

[stone blade]

wait

[dire axle]

any hints on how to search for a file in meterpreter. 'search' and 'find' wont work 😦

[oblique cliff]

google

or help as james said earlier

[dire axle]

help doesnt have anything

[oblique cliff]

google will have something

[stone blade]

@rain oasis check here

ive set 2 breakpoints

check here

its working as it should, ´jge´ compared if var_4h(4) is >= than eax (3), which is, then it going straight to the address pointed at the jge and program exits

[rain oasis]

No, it doesnt.

[rain oasis]

your second breakpoint is one instruction BEFORE the jge destination

[stone blade]

but, room says it souldnt jump

[rain oasis]

if jge jumped, you wouldn't hit the second breakpoint, and the program would exit

[stone blade]

check last screenshot

[rain oasis]

Yes, i see you've paused the program at 0x...18

if jge jumped, it would've gone from 0x...12 to 0x...1a, never reaching 0x...18 in the first place

[stone blade]

yes yes now makes sense to me

now what am I not seeing here?

[rain oasis]

the room says jge shouldn't jump, right? And according to your screenshots, it is doing exactly that, not jumping. So.. works as intended?

[stone blade]

yes you were right

gosh it makes super sense now

let me redo this again

this is amazing I did it again and could understand better now

@rain oasis U are The Man

[slender umbra]

hi can someone give me hint regarding room jack i have found ||Usernames from wpscan and i think brute forcing will not work as hint given in the task itself no to user tools. I tried going through the given hint too but no luck ||

[keen willow]

You need to do something in || ftp ||
@rain oasis i thought, i ||upload|| a ||php-rev-shell|| on ||ftp|| and would trigger by ||jeff.thm|| but all i found is ||/files|| folder on ||ftp|| which doesn't mapped to anywhere.

[keen willow]

am i lost ?

[mild eagle]

@keen willow have you done the cmess room i Think you would get some good pointers from that room or you could try something similar 🙂

[keen willow]

@keen willow have you done the cmess room i Think you would get some good pointers from that room or you could try something similar 🙂
@mild eagle alright, cmess here i come.

hi can someone give me hint regarding room jack i have found ||Usernames from wpscan and i think brute forcing will not work as hint given in the task itself no to user tools. I tried going through the given hint too but no luck ||
@slender umbra you partially misunderstood the hint.

[stone blade]

I'm kinda struggling on answering the questions here:

What is the value of var_8h before the popq and ret instructions?

I've checked the value of var_8h by issuing the command ||px @rbp-0x8|| and the output shows offset 0 as 08 and when I go to answer the the 1st question as 08 it says its not right

any hint?

[stuck fractal]

0x8 isn't the value

[stone blade]

so by incrementing 5 into var_8h which was 3 turns into 8

[stuck fractal]

Endianess and variable size

[stone blade]

pardon?

[stuck fractal]

Endianess: Which way you read bytes

Variable size: The number of bits/bytes that the variable is

[stone blade]

confused

[stuck fractal]

Then I recommend doing some reading

[stone blade]

what I mean is not getting your explanation

[stuck fractal]

It's not an explanation

It's a hint

You're in the hints channel

[stone blade]

yes I got it

I'll try my best here

thanks

[thorn plume]

trying to do the "Steel Mountain" room, for task 2.3 we need to get the user flag, i tried to cat the flag, but the first 2 characters aren't shown, simply show up as the icon for unsupported character. Can anyone give a hint as to how I could make it readable? 🙂

[keen willow]

download file and open it locally.

@thorn plume

[thorn plume]

don't know how I didn't think of that

thanks haha

[keen willow]

don't know how I didn't think of that
@thorn plume i am drinking coffee

[keen willow]

@rain oasis i am getting download ||login.php|| on jeff on ||http://jeff.com/admin/login.php|| instead of randering, is it okay ?

[rain oasis]

That file is a ||rabbit hole||

[keen willow]

That file is a ||rabbit hole||
@rain oasis whenever i think its climax, i come to know there's more mystery left. i try to transport something from it.

[dry pelican]

anyone doing jigsaw2 because im having some issues with the box

[reef carbon]

noob here, need some help with Common Linux Priv. Esc. how do I see what cron is running? I tried crontab -l, but it doesnt have the info i need

[stuck fractal]

There are several crontabs

Recently, they switched to seperate crontabs for each user sot hat you don't have to be root to add a cron job

/etc/crontab is the system wide crontab, it's only meant to be writable for root.

[reef carbon]

ok, I've gone through the various /etc/crons. Can't see what I need anywhere

The hint is that it's on the user's desktop

durp

got it

Over thinked it. Thanks for helping @stuck fractal

[white salmon]

Actaully, it's funny cron got brought up. I'm currently on Day 25 of the Advent room (Cronjob Privilege Escalation), and I was having trouble figuring out which element of crontab is exploitable. There isn't much to go on for the problem definition text, and everything that's in the actual crontab isn't suseptable to the two attacks I've found, namely: Custom Script Overwriting and Wildcard Injection. Any clues?? Thanks in advance!

UPDATE: the GTFOBin entry for run-parts didn't seem to do the trick either.

[stuck fractal]

You can't read the crontab that you'd need to

But you can read ||the thing that crontab runs|| and maybe exploit that

[white salmon]

Hmmm.... yeah, that was the path I was wandering recently. Still coming up empty, but at least I know I'm in the right area, thanks!!

[pallid bough]

Could someone help me out with xss room task 3 #3. I did inspect element and in the console tab I wrote alert(document.cookie). but it isn't correct. could someone give me a hint of what I need to do?

[stuck fractal]

That is not XSS

[pallid bough]

I'm not sure what to do. the question is "Create an alert popup box appear on the page with your document cookies." Edit: I get it!! thanks @stuck fractal

[stuck fractal]

You need to do that via XSS

Not via inspect element

[patent token]

Task 3 covers how to do a basic XSS

[white salmon]

DEBRIEFING: I figured out ||which script I needed to edit|| for my problem, but I only knew ||that script was getting triggered by cron|| because it is part of problem I was working on. However, I have no idea how I was supposed to find out initially ||that script was getting triggered ||when I would be enumerating an actual target because, even as root, ||the crontab is the default on everything. No special script added.|| This reminds me of a similar problem I had with a previous Advent challenge where you have to ||XSS the admin's cookie. The admin never seemed to log on!|| Still looking for an answer there. But anyway, I got through this one, haha. Thanks, y'all! (I hope I used the censoring better!)

[stuck fractal]

https://github.com/DominicBreuker/pspy

[jagged current]

Hey guys I am stuck on the icecast room. for task number 8 it ask which task is being run on port 8000 and the nmap scan says its http-alt, but when I type that in the task says the answer is incorrect.

[stuck fractal]

@vital raptor ask here

@jagged current port numbers don't directly map to service names. You can run any service on any port. Nmap service version detection can be enabled using a flag. That might help you.

[trim frigate]

hello ! this sounds like a silly question i know, but I was going through the burp suite room on tryhackme and on question 1 on task 13 it asks "Download the report attached to this task. What is the only critical issue?" I downloaded the report and read through it and found the issue, but I cant get the answer for the question.

[stuck fractal]

Copy and paste it exactly as it appears as a heading @trim frigate

Exactly as it is on the doc

[trim frigate]

ah i got it! thanks :)

[white salmon]

Can i ask hint for jeff room?

[sharp sage]

i was doing wonderland room.......i got the ssh key ..and now login to ssh....but can't get how to escalate to root now......i have a python file in that

[stuck fractal]

@sharp sage there are no SSH keys.

[sharp sage]

sry ssh credentials of alice....

[stuck fractal]

Have you done any enumeration at all?

Do some ultra basic privesc enumeration.

[white salmon]

sry ssh credentials of alice....
@sharp sage i have writeup for that room, do you want to see?

[stuck fractal]

They're all on the room now

[sharp sage]

@white salmon i escalate from user alice to user rabbit......now i'm not gettting how to move further......

[stuck fractal]

Enumerate!

[white salmon]

Hey can someone help me with jeff room?

[wraith tapir]

yeah go ahead

[keen willow]

@white salmon i escalate from user alice to user rabbit......now i'm not gettting how to move further......
@sharp sage you might want something for refreshment.

[gusty remnant]

I run kali on my vm in my laptop should i need rasberry pi 4 🤔

[stuck fractal]

Wrong channel.

[gusty remnant]

So which channel should I go with??

[stuck fractal]

#general. This channel is for hints on rooms.

[gusty remnant]

Thank you

[stone blade]

guys anyone doing Task6 crackme 1 Intro to x86-64 room?

I need some hints

[devout palm]

So I'm having trouble enumerating jeff. I'm presuming I'm supposed to find an interesting file served or the ||wordpress|| installation, but can't seem to find either, and have tried every conceivable interesting extension I can think of together with directory-list-2.3-medium.txt

[keen willow]

@stone blade go on.

@devout palm what tool you are using?

[devout palm]

@keen willow gobuster

[keen willow]

@keen willow gobuster
@devout palm gobuster does a lot of other tasks too. you might wanna check them out.

[devout palm]

@keen willow Aight, thx

@keen willow lol, now I feel stupid

[stone blade]

@stone blade go on.
@keen willow finding the password is kinda hard to me

I've set the breakpoints but its kinda confused lol

[keen willow]

I've set the breakpoints but its kinda confused lol
@stone blade you might wanna look for different approach to see whats inside address, instead of the one given in task.

[white salmon]

If I can run apache2 as sudo how can I escalate my priveleges to root

Server version: Apache/2.2.16 (Debian)

I tried exploring apache2 -help and explored some commands but I can't really get any of them running

keep getting this error "apache2: bad user name ${APACHE_RUN_USER}"

[tidal sedge]

You can read system files if I remember correctly

[stone blade]

@stone blade you might wanna look for different approach to see whats inside address, instead of the one given in task.
@keen willow I'll watch some videos then

[devout palm]

@white salmon Well, if the sudo allows you to run Apache as root, what would be the implications of that?

[white salmon]

Can I run php code

And execute code?

[devout palm]

@white salmon First step ought to get it running, judging from your error message it interprets ${APACHE_RUN_USER} literally and doesn't expand the variable to a specific user.

And yes, Apache is often configured with php module to serve php scripts

You can either run ||apachectl -M|| to give you information whether the php module is installed, or you can check the ||httpd.conf / main configuration file|| for included modules

[white salmon]

I get that part. But I am not able to use the apache2 command in terminal

"-D name : define a name for use in <IfDefine name> directives"

this is confusing

[devout palm]

Can you please provide exactly what command you're using and what room and task you're on?

[white salmon]

ye I'll show

I'm trying like "apache2 -D root -X" to play around with the options of it but can't get them working.

Deleted the hint cuz idk how to add spoiler tag

[devout palm]

@white salmon Not knowing which room you're on or what the intended solution is, spontaneously I see two options:
Either you ||try to override a setting that drops the webserver to a lower privileged user||
or
||start a webserver with your own configuration file||

You put two pipe | around the thing you want to spoiler-mark, as such: ||spoiler||

[white salmon]

@devout palm thank you I'm trying that

[final mortar]

@white salmon what room is this may I Ask

[white salmon]

@final mortar https://tryhackme.com/room/linuxprivesc

Task6

[final mortar]

You figured it out ig ?

[white salmon]

I did not I moved ahead completing it than I'll try this with the hints mahriman gave but my problem is I am not able to do what the hint says like explore all the options in that service. Like can't get the correct syntax to run the apache2 commands

[devout palm]

@white salmon There's a switch to override specific configuration values in the config file via the command line. Try to find that switch and what configuration directives you want to override. There's also a switch to supply your own configuration file if you prefer to use that instead.

Do note that I haven't done that room so I'm just guessing on what needs to be done. Normally Apache would be compiled not to allow it to be run as root I believe...

[white salmon]

@devout palm thank you very I'm trying

[keen willow]

@white salmon There's a switch to override specific configuration values in the config file via the command line. Try to find that switch and what configuration directives you want to override. There's also a switch to supply your own configuration file if you prefer to use that instead.

Do note that I haven't done that room so I'm just guessing on what needs to be done. Normally Apache would be compiled not to allow it to be run as root I believe...
@devout palm Apache has to run as root initially in order to bind to port 80. If you don't run it as root initially then you cannot bind to port 80. If you want to bind to some port above 1024 then yes, you can. to more specific Apache always needs to start as root, then it uses setuid to switch to user context of specified user in httpd.conf. Without root (uid = 0) you can not create listening socket on privileged ports (below 1024)

[devout palm]

@keen willow You're right, I was referring to allowing the child processes run as root

Also there's ways to allow non-privileged users to bind to lower ports 🙂

but in this case I was talking about ||-DBIG_SECURITY_HOLE||

[keen willow]

but in this case I was talking about ||-DBIG_SECURITY_HOLE||
@devout palm looks like i jumped in between without scrolling up 👀 , sorry guys, go on.

[devout palm]

no problemo 🙂

[keen willow]

any nudge on jeff, i am still stck on ||http://jeff.thm/admin/login.php|| after getting ||www-data shell and ftp credentials||

[wooden mist]

@keen willow this is a fake file. enumerate the network

[rain oasis]

@keen willow If you're really stuck, scroll up to ||July 3rd in this channel|| for a big hint

[wraith marsh]

@keen willow See what you can do with the creds. Most of the stuff on jeff.thm/* I left there by accident and just went with it. I originally had a much harder idea to get the creds involving auditing/reversing & coding some assembly but decided against it 😛

[obsidian canopy]

Hey, i'm having trouble on one part of the Burp Suite lesson. Could someone help maybe?

[oblique cliff]

just ask your question and if someone can they will @obsidian canopy

[obsidian canopy]

Okay.. It seems pretty simple, and I don't know why i can't find it, but i'm looking for a 'Set-Cookie' header, and i've gone through almost every single request without finding one lol.

[rain oasis]

The Set-Cookie header is only sent in responses, not requests

[buoyant grove]

Hi , in Jeff room I did an allports scan and didn't get ftp to show , how am I gonna enumerate that ?

[oblique cliff]

did you google exactly what you have highlighted? @wet imp https://stackoverflow.com/questions/55381711/msfconsole-pop-out-an-error-bundler-faild-to-load-cannot-load-such-file-b

[wet imp]

I did and read that It looks like I had to remove sudo. Thanks

[oblique cliff]

np

[keen willow]

@keen willow If you're really stuck, scroll up to ||July 3rd in this channel|| for a big hint
@rain oasis i managed to ||upload shell to ftp but searching for how to trigger it.||

@keen willow See what you can do with the creds. Most of the stuff on jeff.thm/* I left there by accident and just went with it. I originally had a much harder idea to get the creds involving auditing/reversing & coding some assembly but decided against it 😛
@wraith marsh yeah i managed to ||upload shell to ftp but unable to trigger it, also , i guess i will get reverse shell inside docker if i upload my shell code on ftp and some how manage to trigger. is that correct ?||

[desert mica]

I'm doing the metasploit room and im on the use ps to show services. Then I'm supposed to name the spool service and i dont know what they mean or what service is the spool service

[stuck fractal]

windows what is the spool service into google

[desert mica]

Thanks im so stupid

[mild eagle]

@keen willow try the cmess room it has a similar feel idea

[stuck fractal]

You just need to learn to google

It's a skill like any other

Don't know what something is? Look it up

add keywords to refine your search

[desert mica]

Like i just read the the service is named spooler and its display name is Print Spooler

[keen willow]

@keen willow try the cmess room it has a similar feel idea
@mild eagle you meant after ||ftp||, correct ?

[stuck fractal]

Like i just read the the service is named spooler and its display name is Print Spooler
@desert mica Keep going.

Research doesn't end after the first article.

[mild eagle]

@keen willow yes the escalation in cmess might be useful in Jeff

[keen willow]

@keen willow yes the escalation in cmess might be useful in Jeff
@mild eagle well, someone suggested me that yesterday, so i did cmess today, but it looks like when i come to jeff, myy mind got bufferoberflowed.

[mild eagle]

@mild eagle well, someone suggested me that yesterday, so i did cmess today, but it looks like when i come to jeff, myy mind got bufferoberflowed.
@keen willow Might be me how did you escalate in cmess

[keen willow]

@keen willow Might be me how did you escalate in cmess
@mild eagle ||wildcard inj.|| ?

[mild eagle]

@mild eagle ||wildcard inj.|| ?
@keen willow then try that...

[keen willow]

@keen willow then try that...
@mild eagle i thought abt that, but one thing stopped me, i upload || wildcard inj. To ftp || and open a listner on || docker|| ? If yes then i wud need || ip of docker for reverse shell || and then i stopped ?

[rain oasis]

@keen willow You can quite easily find ||the ip of the docker container||, but you don't really need to. ||Why should the listener have to be in the docker container?||.

[devout palm]

ugh... jeff... 😄

I feel like I'm missing something crucial

[keen willow]

@keen willow You can quite easily find ||the ip of the docker container||, but you don't really need to. ||Why should the listener have to be in the docker container?||.
@rain oasis just realised that, things got messed up in my mind, needed a push. Will try and get bavk if needed. Thank @mild eagle and @rain oasis again.

I feel like I'm missing something crucial
@devout palm how far have you come ?

[devout palm]

@keen willow ||managed to identify and upload to the files directory but have not idea where it is||

[keen willow]

@keen willow ||managed to identify and upload to the files directory but have not idea where it is||
@devout palm lol, find me, you can see me right beside you.

[devout palm]

rofl

I've tried locating my file on jeff.thm but can't seen to find it in any of the directories i've previously enumerated, so now i'm trying to figure out if there could be any directory that would be exposed in any kind of way or if it would be possible to do some kind of nullbyte termination or something. My head hurts.

[rain oasis]

They're not exposed, you need to do something else

See the messages above (between Warmup and maximusprime) for a hint

[twilit swallow]

hey could someone help understand something. Not sure what I am doing wrong.

[devout palm]

@rain oasis alright thanks, then i'm all out of ideas 🙂

@twilit swallow what is it that you have trouble understanding?

[twilit swallow]

I'm following along with the write up for the year of the fox room.

and guide is using something called socat binary to get a shell on the machine

i followed is example but my didn't seem to work. I think it has something to do with my directories being different or I just did it completely wrong.

his*

[rain oasis]

What did you try and what went wrong?

[sinful garden]

I followed the steps from the writeup aswell, and it worked for me. Whats not working?

[twilit swallow]

not sure i dont get a shell or anything just a message within burp

maybe I put the wrong IP address?

[rain oasis]

We can't really help unless you give us some more information. Maybe show a screenshot of what you tried?

[twilit swallow]

also my text is green does that have a play in anything?

[brittle rock]

Asking about HackBack Task 10 (Bookface), trying to get some info at the start, so bruteforcing the ftp login with the user "jerry", can I get a sanity check, and if so how long the bruteforce attack should take

It's been running for about 2 hours now

[stuck fractal]

A literal age

[rain oasis]

@twilit swallow Did you also have the ||web server set up to serve socat|| and a ||socat listener to catch the reverse shell||?

[rain oasis]

Notice how the python server isn't showing any file being requested?

[stuck fractal]

that IP address doesn't seem right

10.0 isn't a VPN server

[twilit swallow]

should I be using tun0 or eht0

[rain oasis]

tun0

always

[twilit swallow]

Let me try

changed it but nothing happened

[stuck fractal]

The IP address appears in your payload twice

[twilit swallow]

maybe I have my files mixed up?

[rain oasis]

did it try to download socat?

(i.e. did your python server show a GET request?)

[twilit swallow]

no get request

and yes I did downloaded the file

[stuck fractal]

Read carefully

[rain oasis]

Alright, double check the syntax, you have a typo

[stuck fractal]

it not I

[twilit swallow]

roger checking my syntax

[brittle rock]

You mind me following up about the HackBack question?

[stuck fractal]

You mind me following up about the HackBack question?
@brittle rock I did

A literal age

[brittle rock]

Oh sorry, must've missed it

as in

it takes

so long to run

[stuck fractal]

Forever.

Have you tried fasttrack?

[brittle rock]

Yup

No luck with that at least

I'm onto rockyou now

ah

Forever.

is there something else I would be missing

I was thinking ||port knocking|| but I need to know the specific order I guess

[stuck fractal]

I mean it just takes a very long time

[brittle rock]

but it's possible?

ugh

[stuck fractal]

Yes

[brittle rock]

I tried with fast track

but that was only 250 words

so doubt it would be that

are you allowed to give me a rough hint, say it's 500k+ or something?

[stuck fractal]

I mean, I don't know where it is

I just know that it used to be easy, and it was changed later on

[brittle rock]

why

[stuck fractal]

No one knows

The new rule is 5 mins of brute force MAX

[brittle rock]

oh

so there must be another way then

huh

Alright, well thanks I guess

[stuck fractal]

I mean

No

The new rule

Bookface predates that rule.

[brittle rock]

...

Is there a challenge author I can message

[stuck fractal]

Complain to dark 😉

[brittle rock]

I don't mind letting bruteforce run for a couple of hours, but with the box resetting every hour

makes it pretty impossible to do it overnight

I don't wanna bring the wrath of Dark upon me

[stuck fractal]

It doesn't reset every hour.

[brittle rock]

Is that for VIPs though?

[stuck fractal]

No

Anyone can extend their VM

[trim haven]

Don’t sleep

[brittle rock]

Well, you have to extend it every hour

[stuck fractal]

Extend.

[brittle rock]

and I have not ascended to the level of no sleep yet.

sorry

[stuck fractal]

Not refresh

[brittle rock]

*extend

yes

[trim haven]

If you wake up of a morning and put it on, come back every 55 minutes to extend the time

[brittle rock]

still, say it is deep in rockyou, could take longer than a day

my wifi is quite slow.

[stuck fractal]

No but seriously

Talk to dark

[rain oasis]

You know the brute-force is optional right?

[stuck fractal]

Your wifi speed won't factor into it

You know the brute-force is optional right?
@rain oasis In bookface?

[rain oasis]

check the hint for flag 1

[trim haven]

if it’s deep into rock you, start half way

[stuck fractal]

Read harder

still, say it is deep in rockyou, could take longer than a day
@brittle rock Check the hint

[brittle rock]

Alright, thanks

||nmap + ftp||

hmm

[stuck fractal]

No

Check harder

You're given the pass

https://tryhackme.com/room/bookface

[brittle rock]

...

well

thanks

1374429

in rockyou.txt

[rain oasis]

yeah... hence forever

[stuck fractal]

1374429
14000000```

Eh, less than 10%

[rain oasis]

at a rate of... what.. 200 per minute?

[stuck fractal]

FTP goes a lil faster than SSH

I've had 180/min happily on THM with 16threads SSH

[rain oasis]

would still take quite a while to get to 1.3 mil though 😛

[stuck fractal]

Ah I had an extra 0

The classic backwards rockyou

[brittle rock]

nice

got to flag3

thanks a lot

[brittle rock]

Boom!

done it

@stuck fractal thanks for helping me get over that block, the rest of the room was really, really fun

[stuck fractal]

Don't thank me

Thank the person that knew it was in the hint

[brittle rock]

Well, thanks for the sanity check anyway

@rain oasis appreciate it

[pallid bough]

Could someone please help me with xss room task 8 number 2? I have tried both of these <a onmouseover="&#x6A;avascript&#0000058&#0000097lert('Hello')">Hello</a> and <a onmouseover="eval(atob('YWxlcnQoIkhlbGxvIik='))>hello</a> they are both giving me popups but not the answer. It seems they are wanting a specific way to get the popup but I'm not sure which way.

[fluid field]

Hey guys, doing the Juice Shop room - was trying to find the user Jims answer to their secret question, tried for ages with different SQL injection methods but no luck. Read a tutorial ||and the name happened to be from Star Trek||. Kinda was hoping to use a more technical method get a better understanding of web hacking - any suggestions of what I could try to get the same answer?

[obsidian fog]

Finally, pwned jeff after a week of frustration and enumeration. But altogether a great machine. Really enjoyed. Thanks to author. @wraith marsh

[steady stratus]

I'll tag him here but #522158404614225920 is the best place for kind comments like that ^^

@wraith marsh

Good job on keeping at it

[obsidian fog]

Sorry, didn't know that. Will post in feedback channel.

[mild eagle]

@pallid bough try with something else then an alert

[toxic scarab]

@fluid field it may seem arbitrary but it isn’t. If you use SQL injection to log into Jim’s account, you will find some stored addresses in his profile. This gives you a hint as to where he lives, which happens to be on the USS Enterprise. Even though this is a fantastical example, this uses standard OSINT techniques to find the answer to his secret question. If this was a more real world situation, you might find that users social media profiles and mine those for the information instead.

[stone blade]

hello, can someone help me out with challenge CrackMe2 on Intro to Assembly x86-64 please?

I´ve found the secret pass on a file but its not working

[ripe cloud]

I'm brand new to all of this, having trouble getting out of the gate: Go to your machines website (http://machine_ip/) - What is the flag text shown on the machines webpage?

[trim haven]

Press "deploy"

Wait 5 minutes

Get machine ip, put in browser

[stuck fractal]

1-5 minutes

@ripe cloud So pressing the "Deploy" button creates a virtual machine for you on the TryHackMe network

In order for you to interact with something, it has to exist

[ripe cloud]

ok, deployed, waiting as mentioned

[stuck fractal]

That machine deploys fairly fast

It's a full virtual machine that's booting up at the moment

[ripe cloud]

ok, it finished booting

public ip?

[stuck fractal]

Private IP

It's a 10.10 IP address, which is a private IP

You need to be connected to the VPN in order to access any machines with a 10.10 IP address

[ripe cloud]

I'm using the in-browser machine

does that matter?

[stuck fractal]

That means you don't need to connect to the VPN if you use the browser inside that machine

But you still need to deploy the machine in the welcome room

And the IP address will be the 10.10 address in the welcome room

[ripe cloud]

ok

[stuck fractal]

It's worth mentioning now

Not all machines run a webserver

So you can't open the IP address in your browser and expect there to be a website

[sharp sage]

CTF collection Vol.2 ..task2...ques 20th ....i'm sending the post request and correct credentials but still its not showing the flag...anyone help pls

[ripe cloud]

ok, thanks for the guidance, I need to stop for now and come back to it later

have to finish out my current career before I move to the next one

[sharp sage]

anyone?

[cursive pilot]

Hello people 🙂 .. I have a question on [Task 18] [Section 3.5 - JWT]: Challenge for "ZTH: Obscure Web Vulns"

[wooden mist]

@sharp sage you sure you're sending it correctly?

[cursive pilot]

After setting the token (Firefox > F12 Cookies > token > value) . .how do i 'reload' or apply this new token?

The guide isnt clear on this

[stuck fractal]

It is applied

[cursive pilot]

Oh.. I guess I have thw rong token then 😦

Thanks

[azure fossil]

I need a hint for the Linux Walk Through room, task 12. It's asking how to specify which shell is used when I log in. Other than making profile configuration changes, I don't know this one. Can anyone give me a hint?

[stuck fractal]

If you read the task title, it's specifically asking about the su command

[azure fossil]

Yes, it does and the answer format even shows ** but it tells me my answer is wrong if I put in "su".

[stuck fractal]

Let me rephrase it for you

How do you specify what shell is used when you're using su?

@white salmon Can you rephrase that question at some point?

Seems to confuse people because they don't read the task title

[azure fossil]

Ah, got it! I just needed to rtfm. LOL Thanks!

[stuck fractal]

Always read the manual.

[white salmon]

What's up?

[stuck fractal]

@white salmon The question about Su

No one reads the task title

So they think it's not about su

[white salmon]

.-.

[stuck fractal]

I know, I know. You shouldn't have to cater for people who don't read..

[white salmon]

And I'm not going to

I will not change a question because the people refused to read the bloody title

[stuck fractal]

Add a hint "Read the title of this task"

[white salmon]

James I get where you're coming from, I really do

But the command

Is litterally used in a picture

In that same task

Aswell as multiple examples of litterally exactly what command to run to switch users

[stuck fractal]

Pars

The question is asking for an option for su

[white salmon]

Correct

[stuck fractal]

All I'm asking is for you to clarify that

[oblique cliff]

grabs popcorn

[stuck fractal]

Not everyone speaks english as a first language

[white salmon]

I've made it very clear in previous tasks multiple times that if you're stuck on a question to read the man page for that command, I left it out so you would have to use some logic there

In a guided room where just about everything is handed to you on a silver platter, those little sections of logic are nice

[stuck fractal]

Yes, it does and the answer format even shows ** but it tells me my answer is wrong if I put in "su".

[white salmon]

Ok?

[stuck fractal]

This makes me reee

Me reeeing is bad

[white salmon]

It makes me reee too

[stuck fractal]

One small change could prevent the reeeing

It's your room

[white salmon]

It's a small change that would remove litterally any requirement of logic to solve the question

[stuck fractal]

Just add a hint saying "Read the title"?

[white salmon]

And questions about flags like that have been asked in the past

So it's not new

The command is used in the text body multiple times James

Even with a picture

[stuck fractal]

I think people are ignoring the fact that the questions relate to the task text

And I don't think there's that much we can do

[glossy basin]

we are about to witness a school fight over discord

[white salmon]

And that is not the responsibility of the room creator to make people figure out that the task body corresponds to the task question

[stuck fractal]

It's likely to be someone's first or second room, that's the issue

[glossy basin]

i got the camera

[white salmon]

I would agree if it was the first task

[oblique cliff]

Both sides have good points 👀

[white salmon]

There's 11 other tasks before it multiple of which ask for flags as answers

This is not new

[oblique cliff]

Who will come out victorious

[stuck fractal]

Obviously pars

Because I can't edit his room

[white salmon]

The two of us are very stubborn @oblique cliff

[oblique cliff]

Oh no james is losing ground!!

You can’t admit that James!

[stuck fractal]

I can get muir to, but that's aboose

[toxic scarab]

the "logging in" is the confusing part. It would make more sense if it said "How do you specify which shell to use when you switch users?", or "What option allows you to specify which shell to use when switching users?", especially since it isn't really a "login" without specifying --login as well. Then you aren't necessarily completely spoon feeding it, but you are short-cutting some of the confusion.

[stuck fractal]

People see the question generically, and look at like chsh and etc passwd

[white salmon]

That is outside the scope of that task

[stuck fractal]

Pars, I will find and send shibes

Several shibes.

[white salmon]

You make a tempting offer James

[stuck fractal]

@toxic scarab's solution is really what I was aiming for

[white salmon]

But I really, really don't think I'm asking a lot of the user by expecting them to figure out to read the su manpage and find the option that says shell

[wraith marsh]

🍿

[white salmon]

You don't even have to scroll down

[stuck fractal]

The task isn't difficult

People make their own problems here

[white salmon]

You don't even have to read the man page, su --help has it to, and using --help was established in the cat section

[stuck fractal]

It's like, under a minute to add some changes that don't detract from the room

[white salmon]

It's not about the time it would take, I'm litterally reading the section right now, I'm just expecting the room user to use a tiny bit of logic

That shouldn't be so much to ask James

Especially if they wanna do the rest of the rooms on the site

[oblique cliff]

🥊 🥊

[stuck fractal]

It's not about the time it would take, I'm litterally reading the section right now, I'm just expecting the room user to use a tiny bit of logic
@white salmon You and I both know you can't expect that

You still find the answer in the same way

Through research

[white salmon]

And that is not my problem if they can't use the minimum level of logic to solve a very very easy question

[stuck fractal]

They do use logic

But they don't understand that it's about su

[white salmon]

It's in the title, it's in the task body as text, it's in the task body as a picture

[odd idol]

has anybody here done the hashing crypto 101 room?? in particular the password cracing section?

[stuck fractal]

I made it, what's up?

[odd idol]

number 1 and 3, i have nearly finished running through rockyou and I am starting the think they are not in that list!!

they are the sha512 unix and bcrypt

[stuck fractal]

They are in rockyou

They crack in under 5 minutes using the tryhackme kali.

[odd idol]

mine has been going 24 hours now and they are nearly finished and still nothing!!

[stuck fractal]

Then you're doing soemthing wrong 😉

Are you using hashcat or john?

[odd idol]

hashcat

[stuck fractal]

Are you using --force?

[odd idol]

yeah, I have to, if not it won't run on my machine

[stuck fractal]

Ok, so that's your problem

The room covers this

I swear

[odd idol]

Thanks, I will have a check

[stuck fractal]

--force gives you false positives and false negatives

basically meaning it can skip over the correct password

Use john

Don't use hashcat in VMs

[odd idol]

thank you!!

[stuck fractal]

Use hashcat when you have a graphics card.

[odd idol]

aaah ok! Thanks for the info!

[hazy sequoia]

Hi guys, so i'm in the room called, linux challenges. I'm on Task 4 #7

Find flag 26 by searching the all files for a string that begins with 4bceb and is 32 characters long.

I run find at the root level, pipe grep -irl '^4bceb' *

the command runs, i see the search, my issue is the search freezes on files called "clear_refs" everytime! I mean is there something wrong with the room or am I just doing something wrong which causes the search to hang there?

[oblique cliff]

@hazy sequoia look into not descending into directories on other file systems while using the find command. And also you’re grepping on the filenames that find outputs rn. Look into grepping the files of the find output

[hazy sequoia]

thank you, i'll see how i go about doing that

[oblique cliff]

That flag is a tough one for sure!

[dim ether]

Hello, just wondering if anyone can give me some pointers on the OWASP Juice Shop, [Task 7] Broken Access Control, #1. I have been stuck on this one for a few days and have decided to give in and ask for help (other than google that is!). Thank you in advance 😄

[quiet yarrow]

@dim ether are you stuck on the first question

[dim ether]

Yeah ☺️

[quiet yarrow]

What is the name of the page <--- this is what you need to focus on

you have already been to the page if you have done the other tasks

Hope that helps you out

[dim ether]

Okay, thank you ☺️ I will have another look at previous tasks.

[true widget]

I m solving the pickle rick room.when I try to login using the username ||R1ckRul3s|| through ssh I get permission denied public key

thanks in advance

[trim haven]

Are you sure that's meant to be used to ssh and not || login to the webpage || ?

[true widget]

Are you sure that's meant to be used to ssh and not || login to the webpage || ?
@trim haven havent found any login portal on|| webpage|| so far.I m not sure whether|| R1ckRul3s|| is t be used for ssh.I ll keep enumerating

[trim haven]

gobuster ;)

[true widget]

i m using dirb

[trim haven]

Don't think it makes much of a difference

[livid quarry]

hi in this room https://tryhackme.com/room/thecodcaper i'm at task 5 and i found the id_rsa file then tried to use ssh2john but it says there is no password

[oblique cliff]

So then try to log in with it and see if It’ll works without a password @livid quarry

[livid quarry]

no it still asks for a password

[trim haven]

What wordlist are you using @livid quarry

[livid quarry]

i didn't use any wordlist i tried to extract the hash with ssh2john but it said there is no password

[true widget]

i m unable to change directories in the|| command panel at web server||

[trim haven]

Explain

|| http://<Machine IP>/directory ||

[livid quarry]

here is my asd.txt

[true widget]

the hint|| says look around the file system for other ingrediant||but i m unable to change directories in the|||| command panel|||

[trim haven]

@livid quarry You're not specifying a password list.

@true widget The webserver is not the file system. You've gotta somehow get onto the computer

[livid quarry]

as far as i understand i should first extract the hash with ssh2john and then use johntheripper to crack it

[trim haven]

No you convert the hash to something john can understand

[final mortar]

What wordlist are you using @livid quarry
@trim haven you get the ssh password in plain text, as I have already told him before

[near vine]

how long did it take you to crack falconfeast password on the LFI room?

[stuck fractal]

Don't use hashcat in a VM

[near vine]

with john

[stuck fractal]

Shouldn't take very long at all

Under 10 minutes

[near vine]

i'm at 10 already 😕

nevermind, the pass is commented

[eternal brook]

Hey guys I was trying out mr. Robot room ...it uses ||wp- 4.3.1 which is vulnerable to authenticated RCE || but I cannot find the login credentials any hints?

[oblique cliff]

@eternal brook what have you done to try to get the log in credentials?

[eternal brook]

Some fuzzing looking for some directories...also tried some default credentials...

[oblique cliff]

oops didnt realize you replied, @ me next time. you didnt find anything interesting when fuzzing the directories? @eternal brook

[eternal brook]

i'm off subscription these days don't know whether this is supposed to happen or not but when i run gobuster i get 2-3 dirs then comes the error messages i'm trying to run gobuster again now ....found some dir like || feed, atom wp-content || running scans in them now 🙂 @oblique cliff

also hydra is running but no success yet

[oblique cliff]

brute forcing isnt gonna work unless you have the correct wordlist and username

subscription has nothing to do with it if youre on a free room

gobuster is gross use dirsearch

@eternal brook

[stuck fractal]

Being a subscriber gives all VMs more resources

Nothing wrong with gobuster

[eternal brook]

alright ill switch to it

oh i thought maybe it had something to do with the vpn connection

[oblique cliff]

nope

[stuck fractal]

If it's a timeout, that points to a VPN issue normally

[eternal brook]

this?

[stuck fractal]

If it does it with other tools, you'll want to fix your VPN

[eternal brook]

yeah ill download the connection again and try again

maybe the issue with vpn...not able to detect dirss

[true widget]

hello guys I m solving lazy admin room and i m unable to exploit the|| arbitary file upload|| vulnerability.thanks in advance!

[oblique cliff]

the rest of my comment in #room-help still remains @true widget

be clearer

[true widget]

okkk i ll elaborate a bit

i m solving the lazy admin room and i have managed to log into the web server and upon lil research I found out that|| sweetRice version 1.5.1|| is vulnerable to|| arbitary file upload||.Upon enumarating the website I have found a feature(data import) which allows to import files.I tried uploading a ||reverse php shell|| but i couldnt execute it.I downlaoded the python exploit which allows us to upload a file on servers rinning on ||sweetRice version 1.5.1||.Upon running the exploit I entered the ip address of the machine but I got the following error.Any help would be appreciated!@oblique cliff

much easier to help now! @true widget

[oblique cliff]

much easier to help now! @true widget

and in future, mark the pic as spoiler please

but anyway, that all looks good to me, have you looked at the error the exploit youre running is throwing?

[tidal sedge]

New channel name 🥳

[true widget]

i ll make sure to spoiler for pic next time.I did search the error but found nothng useful

@oblique cliff i tried to upload ||php reverse shell|| here

[oblique cliff]

the pic from before you were running an exploit and getting an error, did you read that error?

[true widget]

the pic from before you were running an exploit and getting an error, did you read that error?
@oblique cliff It told me to enter target url

[stuck fractal]

I exploited it manually

[true widget]

i tried to do it manually by uploading a ||reverse php shell||

but even after uploading it I couldnt see the exploit in|| data import||

what could be the issue @stuck fractal

[stuck fractal]

Did you research the exploit enough?

[brave bear]

you can use the manual explit via searchsploit

[stuck fractal]

||It's through ads||

[brave bear]

like find it through that

btw how do i add my stuff as sploilers?

[stuck fractal]

||message||

[true widget]

||It's through ads||
@stuck fractal i did read about it

[brave bear]

thanks

[true widget]

shall i directly upload my code there?

[brave bear]

yeaah

try that should work

[oblique cliff]

@true widget you can do it that way, the exploit you were trying to use also works, if you read the error you may be able to debug why its not working when you enter the URL

[true widget]

@true widget you can do it that way, the exploit you were trying to use also works, if you read the error you may be able to debug why its not working when you enter the URL
@oblique cliff but how come can I enter the url for website in|| .com|| manner?

[oblique cliff]

What do you mean. Try different things on how to enter it. Read the error

[odd idol]

I have just cracked the passwords in crypto 101, in less than 5 seconds on the thm vm, on a vm on my computer I couldn't get them to crack, using hashcat and jtr

Ninjajc01 | james explained why the hashcat didn't work, but any idea why jtr won't run properly?

[eternal brook]

generally robots.txt is detected by nmap right?

[stuck fractal]

generally robots.txt is detected by nmap right?
@eternal brook No?

Ninjajc01 | james explained why the hashcat didn't work, but any idea why jtr won't run properly?
@odd idol That's uh... Really weird

robots might be picked up with a script scan

But won't be picked up with most scan types

[eternal brook]

hmm i got that ||robots.txt|| in mr.robot room it was kiinda surprising for me cause earlier whenever there is ||robots.txt|| it is mentioned in nmap

yeah next time i'll check it manually

[stuck fractal]

Nmap won't detect it with most scan types

[eternal brook]

first time for me when it's not detected

[odd idol]

@odd idol That's uh... Really weird
@stuck fractal is there a way to run jtr in verbose mode? so I can see what is actually happening

[stuck fractal]

man john

[eternal brook]

thanks 🙂

[oblique cliff]

@eternal brook even if it’s not caught by nmap you should be directory busting and any directory buster will pick up robots

[eternal brook]

idky what's goin wrong with gobuster it's just showing that error messages that i posted earlier ...so i tried using dirsearch as suggested by you and got robots thanks @oblique cliff

[odd idol]

man john
@stuck fractal found it in the config file! thanks

[oblique cliff]

@eternal brook tag james to show him the inferiority of gobuster as illustrated by your success

[eternal brook]

hahah gobuster is good don't know what happened this time but dirseach also seems nice @oblique cliff ...it took me 2 hrs to detect that robot.txt cause of gobuster and nmap also detect it sad part😂

[true widget]

@stuck fractal i still could nt get the reverse shell.what am i doing wrong?

[stuck fractal]

No idea, it's been a while

[true widget]

i get connection timed out error

also tried using the python reverse shell

[stuck fractal]

Sounds like something is dodgy with your VPN setup or your listener

Try different payloads

[true widget]

tried everything but couldnt get a reverse shell

[eternal brook]

which room?

[true widget]

maybe i should look at the writeup

lazy admin

[stuck fractal]

I have a writeup but it won't help you for this stage

[true widget]

okkk

I wanted to complete it without loking at writeups but i m stuck

[eternal brook]

i would say try harder looking at writeups don't give satisfaction... @true widget

[oblique cliff]

@true widget ||have you looked to see if you can upload a file rather than put something in the ads code?||

[toxic scarab]

there are dozens of ways to get a shell on that box

[worthy iris]

hello guys, i'm on the beginner path and I'm doing toolsrus, I'm using metasploit for the first time and I noticed no matter what it never tries the IP I set rhost to, but instead my default address, how do I change the address? (set "rhost, RHOSTS, rhosts and RHOST" don't seem to work)

oh wait nvm I just realised I lost connection to openvpn, oops, I'll leave this here anyways for documentation of my stupidity 😄

nvm, it still doesn't fix the issue

[stuck fractal]

Show options in a screenshot here

And explain what you're doing a little more

[carmine scroll]

Error: the server returns a status code that matches the provided options for non existing urls. http://10.10.14.29/83c87063-f9f7-4fe9-9242-32ed59709f59 => 200. To force processing of Wildcard responses, specify the '--wildcard' switch. Can someone help with this error. I am not able to use dirb or dirbuster as well and when i use -- wildcard switch then every page returns 200 code

[pseudo hamlet]

gusy Im doing Burp Suite room im not understanding task6 #9 question plss help me

[worthy iris]

@stuck fractal ```msf5 exploit(multi/http/tomcat_mgr_upload) > set rhosts 10.10.144.xxx
rhosts => 10.10.144.xxx
msf5 exploit(multi/http/tomcat_mgr_upload) > set rport xxxx
rport => xxxx
msf5 exploit(multi/http/tomcat_mgr_upload) > run

[] Started reverse TCP handler on 192.168.xxx.xxx:4444
[] Retrieving session ID and CSRF token...
[] Uploading and deploying 9y9ezOi6jdDN3ob...
[] Executing 9y9ezOi6jdDN3ob...
[] Undeploying 9y9ezOi6jdDN3ob ...
[] Exploit completed, but no session was created.
msf5 exploit(multi/http/tomcat_mgr_upload) >

I get this every time

[stuck fractal]

Wrong LHOST

That's an IP on your LAN

You need your VPN IP

[worthy iris]

🙇‍♂️ thank you

would that be set lhost?

[stuck fractal]

With an IP yes

[worthy iris]

can I dm you?

[stuck fractal]

Nope

Whatever it is, it can go in public chat

Unless it's a moderation issue

[pseudo hamlet]

Help me with this

[worthy iris]

it starts from my lhost but then has the same error

[stuck fractal]

Show us

show options and screenshot

[worthy iris]

the console?

[stuck fractal]

In msf

[eternal brook]

show options after selecting the module

you haven't selected any module yet

@worthy iris

[eternal brook]

lhost is incorrect

put in the tun0 ip there

[worthy iris]

because I reset msf but even when its correct i had same issues

[eternal brook]

your vpn ip

[true widget]

@true widget ||have you looked to see if you can upload a file rather than put something in the ads code?||
@oblique cliff i uploaded got a shell but I have one question.How come we came to know that uploaded shell would be in ||ip/content/inc/ads||?

[eternal brook]

set rhost too

send ss after setting it up completely

[oblique cliff]

@true widget research the version of the thing you're exploiting and eventually you'll find where the uploads go. I don't actually remember cuz its been awhile since ive done the box, but thats what i wouldve done

or just lookeed around

[eternal brook]

also make sure your module is correct @worthy iris

[worthy iris]

i've tried the other 2, i can retry them with a different lhost i guess

this is my earlier ss with it all set

[eternal brook]

probably wrong module i think it's lazy admin right?

[worthy iris]

not sure what lazy admin means but i'll try another module thanks

[oblique cliff]

lazy admin is the name of the room, not the module

[eternal brook]

yah i was asking the room...

hey i am brute forcing the login page with the file found but it's been hours no result yet right path? @oblique cliff

i also used that list for dir bursting but no results

[oblique cliff]

yes, it will take a very very long time because there are lots of duplicates in that list

[eternal brook]

already been 2 hrs i suppose 😩

[oblique cliff]

if i had to guess itll take days unless you remove the duplicates

[sly nova]

Working on the Intro To Python room and was wondering if anyone has any tips or resources for the base64,32,16 decoding? I’ve been stuck adjusting my code for a day and a half and can’t get it. Even downloaded pycharm to help see my errors easier, but no luck.

[stuck fractal]

Outermost layers are base16

That should be enough

[sage moth]

I can't figure out which user it can be, except shiba1,2,3,4!
@white salmon do you need help?

[white salmon]

@white salmon do you need help?
@sage moth Thanks, I used some hints from the internet and I found the solution! 😅

[sage moth]

@sage moth Thanks, I used some hints from the internet and I found the solution! 😅
@white salmon it took me some time, but I found three steps ||1) use find 2) find password 3) use sudo -u root ...||

[toxic scarab]

sudo -u root... is the same as just sudo...

[sage moth]

sudo -u root... is the same as just sudo...
@toxic scarab that is so true, thank you

[white salmon]

@sage moth What I couldn’t figure out was, how could I find files from a specific user without having tons of files. ||I did find the answer on internet and then I could continue. The file had an admin user password so I could sudo /root/root.txt||

[sage moth]

@sage moth What I couldn’t figure out was, how could I find files from a specific user without having tons of files. ||I did find the answer on internet and then I could continue. The file had an admin user password so I could sudo /root/root.txt||
@white salmon It wasn't easy. but it's satisfying once you know the solution. 🙂

[white salmon]

Yep indeed 🙃🙃

[verbal wedge]

@wooden mist || have you found the binary? ||

[wooden mist]

no, is it really used on this step? 😟

[verbal wedge]

Yes

[wooden mist]

oof

[verbal wedge]

I recommend LSE or LinEnum

You'll find it easy

[odd idol]

the value of var_8h before popq and ret? I thought it was 60, but it is not being accepted as the answer!

I have ifnished the room, I am just stuck on this one!

[solemn smelt]

Are you doing intro to x64-86

[odd idol]

yes, sorry. I forgot to name the room!

[solemn smelt]

if so try converting the value to decimal or hex

[odd idol]

that doesn't seem to be it either

got it

[toxic scarab]

anyone have a hint for blog? does it start with ||XSS in comments||? Trying that, but no luck so far.

and, nevermind. just found an alternative to that

[wooden mist]

nah

the tags are referencing a specific CVE which requires authentication

with enumeration + bruteforcing you can get the required credentials

[toxic scarab]

yes, i was trying to get to that point by doing some XSS, but found creds after a while

and then binex? ugh...

[wooden mist]

nah

if you look closer it's way easier than it looks

[verbal wedge]

Can confirm

Easier than it looks

Gdb is the most you'll need

[oblique cliff]

XSS room task 3 #6, I have Jack's cookie, I'm trying to set it by ||running document.cookie={his cookie} in the developer tools and then leaving a comment, but it still comments as myself||

I also tried to use burp suite but that crashes the box every time for some reason. Can someone point my in the correct direction for how to actually set my cookie to someone elses to leave a comment as them?

[stuck fractal]

XSS room task 3 #6, I have Jack's cookie, I'm trying to set it by ||running document.cookie={his cookie} in the developer tools and then leaving a comment, but it still comments as myself||
@oblique cliff You really shouldn't be touching the devtools for XSS

Because that's just editing the data clientside, rather than XSS

[oblique cliff]

gotcha, so id tried to do it with burp but it crashed the box (twice)

am i just doing that wrong?

🙃

[oblique cliff]

@stuck fractal so I got it by ||changing the cookie value in storage|| . Is that not part of the dev tools?

[stuck fractal]

I think the goal was to XSS Jack into posting it

[oblique cliff]

Watching the hint on the room it says to change the cookie via the dev tools. I believe the xss part of the challenge was just obtaining the cookie

how would you do it the way you’re describing? I’d like for to learn 🤓

[stuck fractal]

payload would be something like

document.getElementById("messageBox").textContent = "yeet"
document.getElementById("submitButton").click()``` @oblique cliff

[oblique cliff]

and thats in the comment that i'd do that?

wait, I'm on the part where I'm trying to impersonate Jack, I don't believe thats what youre showing, is it?

[stuck fractal]

You wouldn't impersonate Jack at all

You'd XSS them, so you can run JS in the browser

[oblique cliff]

@stuck fractal ?

[stuck fractal]

So that's stealing the cookie

So you're just becoming Jack there

[solemn smelt]

That’s not nice to steal someone else’s cookie

[stuck fractal]

[oblique cliff]

right, so is how I did it the correct way or is there a xss way to do it?

cuz my interpretation of it was that the xss part was getting the cookie, and then youre supposed to use the dev tools to impersoante

[stuck fractal]

I think you're correct for the room

But be aware of more entertaining ways

[oblique cliff]

i was trying to do a ||<script>Document.cookie="cookie"</script>||but that wasnt working

is there a different entertaining way that will work?

[stuck fractal]

The one that I described earlier

[oblique cliff]

right, im a bit confused how that would be impersonating someone else?

all youre doing is setting the messagebox as something and then clicking submit via javascript

where is the impersonation happening?

[stuck fractal]

In their browser

You don't impersonate anyone

You have XSS

You can run JS in their browser

As them

[oblique cliff]

I believe I understand what you're saying but i dont understand who the big "them" is. In this case, for example, I'm trying to do something as Jacky boi. How would the browser know to do something as Jack when it's not his app, he's just another user on the system

using your aforementioned method

[stuck fractal]

So you want to do stuff as jack

You have XSS

You can run code in Jack's browser

You can run code in the browser of anyone who gets hit with the payload

[oblique cliff]

ohhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

ok, so youre talking a realistic situation

where you would store the payload

and whenstever jacky boi executes it, it would run as him

[stuck fractal]

Or even this situation

If it's a webapp with a real user

Which I'm looking at building into a room for better XSS practice

[oblique cliff]

ya as you can see I have 0 experience with it, so ill stick to this one for now lol

ok but circling back, how would jack ever execute this payload seeing that he's not a real person?

[stuck fractal]

You remember the 25days XSS?

The admin visits the page

[oblique cliff]

i havent done that yet

[stuck fractal]

Well, you can automate browsers

[oblique cliff]

my web app hacking skillz are lacking, to say the least