room-hints

[mellow notch]

When you see it, you’ll know what to do. It’s just a matter of knowing the right tool and seeing what is going on

@verbal wedge did you create this room?

[verbal wedge]

Yes

[mellow notch]

Awesome room! It was fun. After I got the link from the QR code I may or may not have listened to it during the rest of the time rooting the box

[verbal wedge]

Hahahaha finally somebody that actually looked at the SMB stuff

[burnt dust]

lol, I also analyzed the QR code

me too

tailor swift ❤️

[verbal wedge]

Lol kinda

[mellow notch]

Lol yeah when I saw the null session I went straight there and quickly realized what was going on with the stego lol. Still worth it for the soundtrack 😂

[stuck fractal]

@verbal wedge at least you did your research once I mentioned that musician to you lol

[verbal wedge]

I'm glad you enjoyed it hoof

Hahahah I included that FOR you man

Literally was the next thing I did when you mentioned it

[open storm]

Hi everyone, Im a bit stuck in the webgramming room, I created a bash script to get the flag in the 'repeat'section. I do get feedback repeating 'behind me' as the input of the nc command but even after a 1000 iterations, it still doesnt match the flag and gives me the 'wrong answer' :/ Anyone could give a hint ? Thanks 🙂

[atomic shuttle]

Just to confirm, does blog room priv esc need bof?

[patent token]

no

[mellow notch]

No, just look at what it is doing

[atomic shuttle]

can i pm you @mellow notch

[mellow notch]

Yeah for sure 👍🏼 @atomic shuttle

[burnt dust]

room: Blog
regarding getting first shell, can MSF help ?

or I have to use some manual technique ?

[stuck fractal]

Have you tried either?

I recommend trying things before asking for help

[burnt dust]

msf failed 😕

the RCE in MSF, i mean

[mellow notch]

What error did you get?

There is a weird bug in msf where you have to set the payload manually.

[burnt dust]

let me try again !
it said exploit completed but failed

[mellow notch]

Try different payload options

[burnt dust]

-] Exploit failed: An exploitation error occurred.

[mellow notch]

Did you manually set the payload?

[burnt dust]

@mellow notch no

and okay

[stuck fractal]

There is a weird bug in msf where you have to set the payload manually.
@mellow notch I didn't have to, but interesting

[mellow notch]

Oh really? Yeah I was having that issue with other machines on various platforms, so I googled the error and saw that there was a bug with the default payload. Suggested setting it manually so I did that and it worked. @stuck fractal

[stuck fractal]

Might be the default payload on your version

I haven't updated msf for a bit

[mellow notch]

Okay yeah then that is what it is, the bug is on recent updates of msf so that is most likely why

[stuck fractal]

They fixed the windows payload but

[burnt dust]

payload failed:
1 multi/meterpreter/reverse_https (default)
2 php/meterpreter_reverse_tcp

payload I tried, that worked:
php/meterpreter/reverse_tcp

@mellow notch thanks.

[mellow notch]

No problem, just make sure to exhaust all your options and try multiple approaches

[burnt dust]

why are my USER.txt location and USER.txt value not being accepted ?
whats wrong with default "user" path and default "user.txt" file ?

[dense pike]

@burnt dust did you read the file?

[burnt dust]

damn it. sorry.

[reef carbon]

Anyone able to help navigating around SMBclient? I've connected to the share, but don't know how to navigate around the files shown with ls

[dense pike]

dir

[toxic scarab]

try help

[stuck fractal]

Anyone able to help navigating around SMBclient? I've connected to the share, but don't know how to navigate around the files shown with ls
@reef carbon More or less standard ftp/linux commands

not so much linux

[burnt dust]

get command to download files ?
Anyone able to help navigating around SMBclient? I've connected to the share, but don't know how to navigate around the files shown with ls
@reef carbon

[reef carbon]

I think i'm doing something wrong. I get a load of NO_SUCH_FILE or OBJECT_NAME_NOT_FOUND errors

have I connected to the wrong share maybe?

[toxic scarab]

you have provided no information. we dont even know what room you're working on. how could we possibly answer that?

[verbal wedge]

Aye

[reef carbon]

Network Services, [Task 4] Exploiting SMB

I've connected with //[IP]/p******* -U Anonymous

but now any command results in errors

[stuck fractal]

Show us

If you want help with errors, it helps to screenshot them

Tells us what you're doing, and what the error is

[reef carbon]

Thanks @stuck fractal , I'm a little new to all this

screen shot of error messages

[toxic scarab]

you have to escape spaces. it is looking for a file called Working, which does not exist

[oblique cliff]

or put it in quotes @reef carbon

[reef carbon]

Thanks, I knew it was something dumb

[oblique cliff]

not dumb, just didn't know it yet

now ya do

[twin cypress]

I've been poking the owasptop10 room that dropped a half hour ago, on lunch from work. I finished the day 1 stuff but there is a question for day 2, are we supposed to find that from further exploiting the box or is that just a way of keeping the room open for each day? (If I don't have more to find in the box I need to get back to work)

[wooden mist]

it's a placeholder

[twin cypress]

thanks - gotta get back to the day job

[mild eagle]

what is the best way to grep for payloads in msfvenon if i wants to get windows x86 meterpreters ? .. cmd : msfvenon -l payload | grep windows?????

[white salmon]

@stuck fractal hi, thanks to your suggestions I was able to complete room "intro x86-64", "CC:Ghidra" and now i just completed the Blog room. Thank you so much 👍

[devout palm]

@mild eagle yes, you can apply several greps to further specify, e.g. msfvenom -l payload|grep windows|grep x86

[stark reef]

Is there a good read on the passthru command somewhere other than what was linked?

[toxic scarab]

@stark reef is this room-related?

[stark reef]

Related to the new OWASP 10 injection room

[toxic scarab]

and are you looking for a hint for that room?

[stark reef]

Correct

[toxic scarab]

in that case, you should tell people the room, task, and question, so that they can assist you

[nova rampart]

Where should I start in OWASP 10 injection

[toxic scarab]

reading all the content of task 4 is a good start

[stuck fractal]

Have you read the content in the room yet?

[nova rampart]

yes ive read it

[merry helm]

@nova rampart By following the reading and step by step of the room you can unroll it smoothly...

[nova rampart]

ok

[clear quail]

hi there. I am almost done with the "learn linux" one. But really, I am searching in files and with find for an hour now. I can't get to find a way to read the root.txt file. Any hints appreciated. Thanks

[mild eagle]

in room GHIdra i'm missing two questions but task 4 question 2 i the function i can't see what the variable is set to . maybe I got the question wrong but i cant get it to find with the ** in the answer box any hints ?

and the question 3 no variables is in the function have i decompiled it wrongly ?

sorry the decompiled c code didn't match the assembler code.. it was easier to get it from the assembler but wasn't the answer supposed to be in the c code ?

and it was the same, "yes i got the answer", for the first question so i guess i decompiled it wrong ?

[merry helm]

hi there. I am almost done with the "learn linux" one. But really, I am searching in files and with find for an hour now. I can't get to find a way to read the root.txt file. Any hints appreciated. Thanks
@clear quail Which user are you logged into the machine?

[clear quail]

I went through all 4 shiba users.

[trim haven]

[merry helm]

Sorry for the delay as to the answer, was turning on the machine and redoing the room to remember...

[trim haven]

@trim haven cblte *

[clear quail]

but none has sudo right, so I need to get access to the other ones. I know to read the file with a user who has the rights to do so

[trim haven]

Maybe you’re not looking for sudo rights

Maybe you’re looking for a file ;)

[clear quail]

I found ||some files in the nootnoot home dir. the file ll for example. But it does not make any sense to me. Counting numbers from 1 to 1000||

[merry helm]

but none has sudo right, so I need to get access to the other ones. I know to read the file with a user who has the rights to do so
@clear quail In the room you were guided to use the find command, it may help you in the search for the user who will take you to the home of root...

[clear quail]

I know that it must be the ||nootnoot|| user because of that ||.sudo_as_admin|| file. But the search for a password was not successful. I keep trying...

[merry helm]

I know that it must be the ||nootnoot|| user because of that ||.sudo_as_admin|| file. But the search for a password was not successful. I keep trying...
@clear quail So you know that nootnoot has the right rights to your goal, forget it for now, go back to the beginning, [Task 31] #3 is your 😉

[valid canopy]

@verbal wedge nice box. just finished and learned something new. Thanks!

[verbal wedge]

Awoooo

Thanks

[clear quail]

@merry helm thanks. but .... i have no idea. nevermind. i will continue tomorrow. maybe the brain is able to solve it in the morning. 🙂

[merry helm]

@merry helm thanks. but .... i have no idea. nevermind. i will continue tomorrow. maybe the brain is able to solve it in the morning. 🙂
@clear quail Well, you have other users... how about finding something from another user that is relevant? Well, good rest

[clear quail]

ah oh man. thanks. I could not believe I oversaw that thing there. from then on it was easy. thanks @merry helm I totally oversaw that one thing. Should pay more attention to the details.... now I can sleep well 😉

[proven pier]

hello i was wondering if somewon coold give me a hint about the room RP namp, in nmap scanning for question 6

[halcyon lodge]

Is there anyone I can dm about blog?

[astral trellis]

which part of blog?

[halcyon lodge]

@astral trellis Privesc from www-data.

[astral trellis]

ah, honestly thats where i am but from what ive gathered its a SUID

[lyric scarab]

I'm stuck there too

[stuck fractal]

Try some RE

[astral trellis]

RE? Reverse Engineering?

[halcyon lodge]

@astral trellis yup.

[formal pier]

anyone doing the OWASP top 10 room pls

[solemn smelt]

yes

We can help you better if you give us a little more to work with on what you’re stuck on

[formal pier]

how can know how much non root users there are on a linux system

i tried to cat /etc/passwd

this is the only way i know is there any other one ?

[solemn smelt]

Have you tried researching and googling before coming here?

[formal pier]

yeah i did

[astral trellis]

ok i got it, that was funny

[solemn smelt]

Well you can look at how many users based on how many are in the home directory or you can do it from etc/shadow

[formal pier]

yeaah but i think and the home directory you can know how many users there are

[solemn smelt]

?

[formal pier]

but how to check if they are root or not

[inland onyx]

How many subdirectories are in /home?

There is only one root user -- ignore it

[solemn smelt]

There’s one root

[inland onyx]

(It also won't have a home directory in /home)

So, the answer is literally how many subdirectories are in /home

(In this case)

[formal pier]

but on the shell i can't change directory

i type cd /

[inland onyx]

You don't need to change directory

ls /home

[formal pier]

aaah thanks

[inland onyx]

Or pull a reverse shell and do it that way -- either

[formal pier]

i think there's no need to upload a reverse shell to answer the questions right ?

[inland onyx]

There is not. The webshell will suffice for that

[formal pier]

i don't understand this question

what i'm suppose to look up for

[astral trellis]

the default shell of the user

[pine echo]

shell's have to be be kept somewhere

[astral trellis]

like /bin/bash etc etc

[worthy iris]

hey guys when you paste a mkfifo payload how long does it take to get shell access?

[stuck fractal]

@formal pier hey, I'd recommend learning how to use linux

[worthy iris]

the payload stuff never works for me

[stuck fractal]

Run your VPN directly in kali

Make sure you're using the right IP

Make sure your listener works

[worthy iris]

tun0 ip or your host ip?

i'm using the ovpn ip

i pinged it and it works on the listener

[inland onyx]

https://discordapp.com/channels/521382216299839518/522158539129618453/697185180657385525

Read that 🙂

[formal pier]

@stuck fractal i already know how to use Linux but the way questions are put in here it's kond of tricky for me

[worthy iris]

so if I interpret that correct, I just use my host IP? @inland onyx

[inland onyx]

No, use your OpenVPN IP, but never run OpenVPN on your host

Do it inside your VM

[worthy iris]

oh, but i do that anyhow

[inland onyx]

i already know how to use Linux but the way questions are put in here it's kond of tricky for me
@formal pier Users have shells -- that's how they execute commands. The setting for which shell they use is stored somewhere -- that's where you're looking.

oh, but i do that anyhow
@worthy iris Hm. In that case check the settings for your listener. Make sure you're using the right port, and that the payload is correct. Should be virtually instantaneous unless you have serious lag

[worthy iris]

@inland onyx thats what confuses me, when i ping my ovpn it gets picked up on the listener, but the payload does not

[formal pier]

@inland onyx thanks mate i solved both of the tasks

[hazy finch]

Users have shells -- that's how they execute commands. The setting for which shell they use is stored somewhere -- that's where you're looking.
@inland onyx

Thanks, I was a bit stuck there myself. That got me in the right direction for Google to finish off the problem

[formal pier]

yeah that question was a litl bit tricky for me too i think they should've used where instead of what

[worthy iris]

@inland onyx am i meant to paste the payload into the telnet listener? cos I've been doing that, I'm clearly messing up somewhere I just dunno where

[worthy iris]

hey just an update, I decided to use the VM on my laptop instead of my PC, and it just worked instantly, not sure why, but yeah...

[coral marten]

Omg the users shell question got me a bit. But thanks to google I squashed it 😉

[verbal wedge]

@formal pier sorry if the question was confusing. I tried to be as specific as possible

[worn yew]

Nice Day 1 task in the OWASP TOP 10 room. I don't believe me on my self I answered all the question with some researching on google. Thanks. In hope for winning something😇

[patent token]

Win what?

[solemn smelt]

There is a drawing everyday for the next ten days for the OWASP top 10 room

[patent token]

I had no idea there were prizes.

huh

[solemn smelt]

no one knows what the prizes are but there’s prizes everyday

[worn yew]

Win what?
@patent token Something at least something

[patent token]

No need to ping please.

Thanks. 🙂

[worn yew]

By the way newbie here so Hello To ALL

https://tenor.com/view/penguin-hello-hi-heythere-cutie-gif-3950966

[fresh quarry]

Hi everyone, I need a hint on the LFI walkthrough. I am on the last section, I've escalated privilege and have root. However, when I list files I am only getting returned the same text file from the previous section (user.txt). I know the flag in the file is not correct. What should I do?

Nevermind, I literally just figured it out

We'll call that a "taking a car whose engine is making a noise to the mechanic, only for it to stop making the noise when you pull in" sorta situation

[indigo ridge]

some hint on room Blog for privesc.. i know it is something to do with ||binaries||

[stuck fractal]

Have you searched for those then?

[indigo ridge]

yes

[stuck fractal]

I really recommend learning what's normal to see on an ubuntu system, and what's not normal

[indigo ridge]

but there are a lot of them.. and of them one stands out..

[stuck fractal]

There's one that shouldn't be there

Figure out what that one does

Do some basic reverse engineering on it

[indigo ridge]

but there are a lot of them.. and of them one stands out..
@indigo ridge can I dm you for the confirmation.. becuase there some other also that I think should not be there

[stuck fractal]

There's only one that isn't standard on ubuntu

[indigo ridge]

okay

[stuck fractal]

You can do your own research. I'd recommend that you do.

[indigo ridge]

i will try it

[indigo ridge]

Blog: for finding binaries i am using find / -perm -4000 2>/dev/null is it ok?

[stuck fractal]

I don't know, is it ok?

If the command doesn't error the heck out, then it's ok.

You're allowed to do whatever

[burnt dust]

Room: BLOG

what should I be looking for changing from 'www-data' to a valid user ?
have looked into DATABASE conf for password
but the password don't work to switch from 'www-data' to a valid user?

[indigo ridge]

some hint on room Blog for privesc.. i know it is something to do with ||binaries||
@indigo ridge .

Room: BLOG

what should I be looking for changing from 'www-data' to a valid user ?
have looked into DATABASE conf for password
but the password don't work to switch from 'www-data' to a valid user?
@burnt dust ur answer

[burnt dust]

@indigo ridge lol I got one binary with 'suid' bit

but don;t know how to proceed 😕

[indigo ridge]

same here i just know you have to do RE

[burnt dust]

Hmmm

"strings" command can help you, but at the moment its not 😕

[stuck fractal]

Eh I think it's better to use a decompiler

[burnt dust]

Grrr !

@stuck fractal thanks, was reluctant for going 2 disass, but now I think I should

[stuck fractal]

Ghidra's decompiler is available for radare

Cutter is a good gui for radare

[burnt dust]

👍 thnaks

[burnt dust]

@stuck fractal thanks, cutter is good a GUI friendly too, the question is how to change the VARIABLE it asks for ?

[stuck fractal]

That'll be a research thing

[mellow notch]

A quick google search will give you the answer

[stuck fractal]

Look into the system calls and what they do

[burnt dust]

👀

[stuck fractal]

Understand what it's talking about

Then it's trivial

[burnt dust]

yes, I got that !
i know I have to just modify (forge) the value

to binary to work

ThankGod!
iam root

^__^

room: BLOG

Room: BLOG
Difficulty: 6.5/10
I found it a good machine.

For shell: a RCE is req (msf default payload won;t work, so make sure to change it)
For priv-esc: do R.Engg via CUTTER

peace

and just some information regarding priv-esc, I usually use following 3 scripts:

1. linpeas (google it)
2. linenum (google it)
3. suid3num (https://github.com/Anon-Exploiter/SUID3NUM)

@indigo ridge ???

[indigo ridge]

which software should I use?

[burnt dust]

which part you're stuck at?

[indigo ridge]

privesc

[burnt dust]

try running all the three scripts I mention and then try to read outputs and see if you find anything useful.
specially script# 3

[indigo ridge]

okay let me do that

[radiant dew]

Splunk room. "When viewing search results, it's often useful to rename fields using user-provided tables of values. What command do we include within a search to do this?" Surely it's ||rename||?

Also can #27 allow English spelling 😉

#31 has changed too (although it still redirects)

[white salmon]

For the Ghidra room, can I use a VM for Ghidra?

[burnt dust]

Room: Jeff

how to get PASSWD for a valid user (web login)
the dic attack fails (ran for 10mints)
😕

[white salmon]

advent of cyber task 29 || lfi in kibana || is the right path?

[radiant dew]

@white salmon yes

[white salmon]

@radiant dew but we also need to do a file upload for || lfi||?

[radiant dew]

no

[white salmon]

ok I'll try harder

[radiant dew]

search for Kibana CVEs

[white salmon]

ye

[radiant dew]

feel free to DM me if you need

[white salmon]

I'll try for couple for hours will do If I fail

[mild eagle]

in room linuxprivescarena task 12 question 1 i know what binary is assisting but i cant find the name of the cve - Any hints ?

[white salmon]

Try looking up the name of the exact file/script that you're exploiting, and with the keyword 'exploit'

The version number of whatever binary can also help a lot in identifying the CVE

[mild eagle]

@white salmon makes sense but in the examples nginx is used and i pretty much tried all the cve for that .. could be the format of my input is wrong.

or it could be more related to something else in the tasks as symlinks ?

@white salmon finally got it 🙂

[white salmon]

It's definitely something to do with nginx- try researching the exact hinted version in the task

nice

[mild eagle]

wrong input tnx @white salmon

[tough hollow]

Hi everyone, I'm new.

I'm working through the steel mountain room (https://tryhackme.com/room/steelmountain) but I'm having trouble with winPEAS.

I've managed to get a winPEAS executable onto the target machine, but when I then try to run it using the command winpeas.exe it just hangs on a blinking cursor.

I've tried numerous versions of the winPEAS binary - obfuscated and not, x86, x64, "all" - they all give the same non-result.

I was really reluctant to come and ask for help but I'm just stumped. Any ideas?

[white salmon]

restart machine?

[tough hollow]

Tried multiple times. Just managed to get the .bat version of winpeas to execute, but others that have done writeups have succeeded with the exe version

[trim haven]

@tough hollow what have you tried

Have you tried .\winpeas

[tough hollow]

Yep, but now I think of it I onyl started on that with some later binaries

Having to reboot server again, will try that same .\ prefix with some other binary versions

[burnt dust]

anyone ?
Room: Jeff

how to get PASSWD for a valid user (web login)
the dic attack fails (ran for 10mints)
😕
@burnt dust

[tough hollow]

Have you tried .\winpeas
@trim haven

So I've now tried the .\ prefix again mutiple different versions of the binary.

All result in a simple blinking cursor in the reverse shell.

[trim haven]

Screenshot screenshot

[tough hollow]

Screenshot screenshot
@trim haven

[trim haven]

You’re executing it but I don’t think you’re getting the output maybe slow connection

How long have you waited

[tough hollow]

About 10 min?

Maybe 15?

The batch file works quite quickly.

[trim haven]

I’m not experienced in Windows. Have you googled your issue

[tough hollow]

I have. People just say "use the bat file", which I have, with success. Just can't see why the binary wouldn't work

Thanks for your help @trim haven , looks like it's just some weird bug. I'll try it on other Windows boxes

[red minnow]

Hi, i'm doing the "blog" room, i found 2 usernames for WP. To acces wordpress do i have to brute the login page or there is another way?

[fallen sedge]

@red minnow you can bruteforce the login page for one user.

[red minnow]

@fallen sedge 😄 yea i found it, it took took long

[fallen sedge]

Yeah very long for me too

[wooden mist]

shouldn't take long

you just need to bump up the threads for bruteforcing

[fallen sedge]

Yes but with wp.... It's very long. 😉

[wooden mist]

no

took me two minutes

maybe even a bit less

and i don't have a good connection

[fallen sedge]

Serious, almost 10mn for me

@wooden mist do you have a little hint for blog. I know where user.txt is, but i'm stuck to move to the other user

[wooden mist]

Maybe you don't need that user after all 😉

[fallen sedge]

Thanks @wooden mist i will try to find.

[verbal wedge]

The best way isn't always user -> root

Sometimes it's a bit different

[spare cobalt]

What option sets the architecture to be exploited in metasploit?

[final mortar]

You just have to select the appropriate exploit for the architecture you need

[white salmon]

a question about the OWASP Top 10 #6 Print out the MOTD. what is referring to i got a rev shell on the box but still cant figure it out XD

[tidal sedge]

Do you know what MOTD is?

[white salmon]

not sure what shortcut is.

[tidal sedge]

What

[white salmon]

i got the flag .txt but cant figure this one

[spare cobalt]

@final mortar but what option is it??

[tidal sedge]

@white salmon Research what MOTD is

[white salmon]

@tidal sedge i translated the hole question and i figure it out still MOTD has in dic a few specifications

[sharp ether]

Hello there, could someone use the sequencer of the BURP in the OWASP Juice to analyze the cookies??

[final mortar]

@final mortar but what option is it??
@spare cobalt there is no option, there are different exploits

[white salmon]

@sharp ether If OWASP Juice Shop has any sort of consistently randomly generated cookies, then yeah, you can probably use burpsuite's sequencer to analyze the data

[sharp ether]

@sharp ether If OWASP Juice Shop has any sort of consistently randomly generated cookies, then yeah, you can probably use burpsuite's sequencer to analyze the data
@white salmon ok, because i send to the sequencer a registry from the HTTP history with a header like this :

POST /rest/user/login HTTP/1.1
Host: 10.10.77.78
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/plain, /
Accept-Language: es-AR,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 56
Origin: http://10.10.77.78
Connection: close
Referer: http://10.10.77.78/
Cookie: io=ZX8ukEj_TnPUmeFEAAAA; cookieconsent_status=dismiss

sometimes it appears in the sequencer with the cookie and sometimes not, apart from that when i try to start the live capture i can't get any token

[stuck fractal]

What you've shown is a request, not a response

The room asks for a response with a SetCookie header right?

[sharp ether]

yes

oh

ok, because i couldt find setcookie anywhere..

that's why

thanks

Now i sent this one to the sequencer:

HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
Content-Length: 23
Access-Control-Allow-Origin: *
Set-Cookie: io=ZX8ukEj_TnPUmeFEAAAA; Path=/; HttpOnly
Date: Tue, 14 Jul 2020 14:54:03 GMT
Connection: close

20:42["server started"]

and i set Cookie: io=ZX8ukEj_TnPUmeFEAAAA in "Token Location Within Response"

now it has done over 4k requests and i haven't any token captured

[oblique cliff]

you shouldnt be setting the cookie, you should be getting a response that already has the set-cookie header

[white salmon]

Could somebody point me in the right direction for priv esc on the Blog room

I have a shell with www-data, and I'm not sure if the ||checker|| file is the key to escalation

[sharp ether]

you shouldnt be setting the cookie, you should be getting a response that already has the set-cookie header
@oblique cliff the header of the response that i send to the sequencer has in the header "Set-Cookie:" , where i put the Cookie: "io=ZX8ukEj_TnPUmeFEAAAA" is the location in the response where the token appears

inside the sequencer

[echo thunder]

can anyone help me with the Blog room? can someone give me a hint on how to get the user joel?

[stuck fractal]

Maybe challenge your assumptions

Your goal from www-data is to get anywhere

[white salmon]

the only where i've gotten is nowhere 😭

[echo thunder]

I know where the user flag is in Blog. I need a hint on how to proceed and also how can I get the joel account

[stuck fractal]

Challenge your assumptions

You're assuming you need to log into that account

Or gain access

You can read the flag in that dir anyway

[echo thunder]

I receive permission denied

I am with www-data user

[stuck fractal]

Wat

[echo thunder]

In Blog challenge

[stuck fractal]

That doesn't narrow it down at all

[median compass]

you're assuming you have to get from www-data to the bjoel account @echo thunder, rather than look for that instead look for a file that doesn't fit when you enumerate the box and see can you exploit that directly

[echo thunder]

I did not understand the part to look for a file @median compass , can you explain it with other words or meaning

?

[median compass]

yes, when you enumerate looking for privesc a common trick is to look for a file that doesn't fit right? that looks odd or out of place, like it has privileges that it doesn't usually have or is in an odd place or owned by a strange user or group. When you find such a file that will be your path

and it may help to see the full list of tags for the room, only the first four show in the dashboard
"tags":["cve 2019-8943","wordpress","blog","web","wpscan","linux","security","cutter","reverse engineering","binary exploitation"]

[white salmon]

yeah i figured out how to disassemble it with radare2 but i have zero idea how to read it lmao

I can tell that ||the binary has a setuid in there, and a check for a ENV variable, but I have no idea how to find out what it is||

[hardy pewter]

Im at privsec at blog too
But i not good at reverse engineering
Any good room to practice and learn how to do this privsec ?

[mellow notch]

You don’t really need to do deep disassembly or reverse engineering, although it does give a very clear picture of what is going on if you do (radare/cutter/ghidra). Look up what commands can TRACE system calls.... hint hint

@white salmon google how to exploit what you found and there should be a useful article on the first page

[white salmon]

hmm

[verbal wedge]

He's really helping ya out here

You can do eeet

[white salmon]

Got it

haha epic

Thanks so much!

tbh I really did fall too deep into the rabbit hole (of reverse engineering) lmao

[mellow notch]

It’s still a good exercise in reversing it tho, just for practice.

[white salmon]

Oh yeah, definitely

It's definitely a good motivator for trying to learn more about reverse engineering

[worn yew]

Nice and easy Task 2 in OWASP Top 10 room

Thanks @proud scarab

[tidal sedge]

That's the bot

[winter plover]

so having issues with "BLOG CTF" ||zlib file extraction|| help anyone?

[median compass]

what are you trying to extract @winter plover and are you sure you need to?

[winter plover]

no im not sure hahah found a|| Zlib file in a .png and tried to pull some info using a python zlib script got nothing||. If im going the wrong way plz feel free to tell

@median compass

[toxic scarab]

in the blog room?

[stuck fractal]

PNG images are often detected as containing zlib

[median compass]

so binwalk etc wil tag any 'magic words' it finds in a file, the png standard uses zlib to compress the image data, so it's normal to find that there - a rabbit hole I'm afraid

[winter plover]

haha well thank you.. iv been digging for a bit. appreciate the help. I don't use Binwalk often. @stuck fractal @median compass

[median compass]

no worries, happy hunting

[verbal wedge]

Good luck!

Love, bjoel

Also, please find the hidden things I left

[white salmon]

I really liked the Taylor Swift video

:)

[verbal wedge]

Yessssss

[white salmon]

i wonder how many people actually watched it

[stuck fractal]

I, for one, think you did start the fire.

[patent token]

I watched it

[verbal wedge]

Yayyyy

It gives me laughs every time

[white salmon]

it's funny because I was actually thinking of the goat version when I watched it

[verbal wedge]

Hahahah yesss

Did you find the QR code?

[white salmon]

Yeah, that was a nice touch too

Also Billy's termination letter lmao

[verbal wedge]

I'm glad you liked it hahaha

I figured it was a nice touch lol

[white salmon]

Not enough backstory for all these poor users whose boxes are being hacked into 😤

[verbal wedge]

Lol

[mellow notch]

That letter was awesome “because we don’t care”

[verbal wedge]

Hahaha Im glad you liked it

[robust nymph]

What does Jack's first hint mean when it says "and don't use tools"? Does it mean don't use tools besides wpscan?

[stuck fractal]

Don't use msf etc

[robust nymph]

Okay gotcha

[shut pollen]

Guys am stuck with BLOG room. Did SMB stuff , got down the rabbit hole. Now what ? It's wordpress , maybe wpscan ? I'm a beginner.

[stuck fractal]

My personal recommendation would be try things

You suggested wpscan, why not try it?

[shut pollen]

I tried it with rockyou.txt , doesn't seem to work

[mellow notch]

Mmm... it works

Try to enumerate some users

[shut pollen]

Got the two of them sxb and bxxxl

[mellow notch]

Looks like something is missing

Enumerate the blog a little more

[shut pollen]

Suggestions ?

[mellow notch]

Google tools to enumerate Wordpress blogs

[verbal wedge]

Ayyy

He's got it

|| I think wpscan has an enumerate users feature ||

[shut pollen]

||Kwheel||

[mellow notch]

Yup, just didn’t wanna outright say it

How do you make the text blackout to hide spoilers?

[verbal wedge]

Heyo

Double pipe on each end

[mellow notch]

Okay thanks. Good to know 👍

[verbal wedge]

[shut pollen]

Thanks buddy @mellow notch

[verbal wedge]

I'll be reviewing write-ups this week with the release of mine on Friday

[mellow notch]

No problem @shut pollen

[shut pollen]

Let's see if we can break in

[verbal wedge]

I'm around if you get stuck

I'm sure others will offer help too

[patent token]

wpscan does enumerate users

[verbal wedge]

[mellow notch]

Yeah I just didn’t wanna outright say wpscan, but that was what I was poorly hinting at... still trying to figure out what is and isn’t a spoiler

[verbal wedge]

Anything that gives something away for a room I'd imagine is a spoiler

[shut pollen]

Broke into ||kwheel|| , It's reverse php now I guess ?

[verbal wedge]

Maybe, maybe not

[shut pollen]

Mysterious

[verbal wedge]

|| maybe there's a specific WordPress vulnerability lying around somewhere ||

[stuck fractal]

Really I gotta recommend trying stuff before asking

[shut pollen]

Ok man !

[verbal wedge]

But yeah. Try a few things out

I'm here

I can help so long as I'm not busy

I'm just watching some anime

[shut pollen]

It's 5:01 am here man , I should have been in bed 6 hours ago.

[verbal wedge]

Oof

Go to sleep

[mellow notch]

Lol jeez

The box isn’t going anywhere! But yeah I get it, once you start... its hard to stop

[shut pollen]

It's great. Plus need to learn stuff man.

[verbal wedge]

Lol

itll be there in the morning

just note the password

then head to sleep

[shut pollen]

Thanks @verbal wedge you're a good man

[verbal wedge]

its my room 😛

i gotta help

[grave totem]

Hey guys,
This is my last question in the AttackerKB room. Went over all the posts posted on the form. As well as the Webmin sight that explains the vunerablity. However, No luck with what the answer is. Please advise.

[oblique cliff]

There’s a hint there

[stuck fractal]

Look at the first evaluation on attackerkb

States it explicitly.

[chrome sand]

How you do the bar over text in chat?

[weary wave]

use two pipes - ||

oh

you mean this

strikethrough

~~ use two tildes

[stuck fractal]

https://support.discord.com/hc/en-us/articles/210298617-Markdown-Text-101-Chat-Formatting-Bold-Italic-Underline-

[chrome sand]

no ||this||

figure it out.

[weary wave]

spoiler, then the pipes - or just check the markdown reference posted

I don't have any experience with that particular box, but try it! and if there's a lot of users try using Hydra

[chrome sand]

humm guess not

[shut pollen]

So I guess in Blog it's the ||checker|| SUID

But I guess it's RE stuff now

[verbal wedge]

kinda

not really RE

go to bed

[shut pollen]

Ghidra ?

[verbal wedge]

could use Ghidra

or GDB

or Cutter

[shut pollen]

Doing that , now am stuck

#Noob

[green sorrel]

I'm a noob at RE and I used Ghidra and got it so if I can u can

[shut pollen]

Still man

I am new

[stuck fractal]

I'd recommend not starting on intermediate content then 😉

or doing walkthrough rooms first

[shut pollen]

I have done stuff

Just ghidra and binaries are scary for me

[stuck fractal]

Then you know what to work on

[shut pollen]

Just a bit on this and I'll push

[stuck fractal]

Nothing stopping you coming back later

Keeping passwords as notes

[shut pollen]

||getenv|| and ||setuid|| parts ?

[stuck fractal]

Do your research

[shut pollen]

:(

[verbal wedge]

I'm feeling incredibly stupid

I'm trying Source

and im stuck at the initial enumeration

[stuck fractal]

you nmap'd?

[verbal wedge]

mhm

[stuck fractal]

Try going to 443

[verbal wedge]

im at the ||webmin login page||

[shut pollen]

Man I eaven got the code

[stuck fractal]

im at the ||webmin login page||
@verbal wedge Maybe do the attackerkb room first?

break it down

[verbal wedge]

that pretty much spells it out for ya 😛

[stuck fractal]

Work out what it does

Trace the code through

@verbal wedge You want the screenie deleted?

[verbal wedge]

plz

[stuck fractal]

@shut pollen This is the hints channel, try to avoid dumping spoilers like that

[shut pollen]

Sure man, noted

Sorry am new

[verbal wedge]

It's okay

It's my room though and its still fairly new

So avoid posting huge spoilers like that

Why cant I add the hostname ot my /etc/hosts?

Rather, which hostname do I put lol

[stuck fractal]

the one you found

[verbal wedge]

||source|| or ||root@source||?

[stuck fractal]

One of those isn't a host name

[verbal wedge]

true

but yeah im stuck

i dont mess with this file much

[stuck fractal]

the first one

name\tip

\t is a tab

[verbal wedge]

||https://i.imgur.com/EXXppsV.png||

like that?

[stuck fractal]

👍

remove the old ones tho

[verbal wedge]

lol

it doesnt work like that though

like if i do https://source

I get nothing

[stuck fractal]

dig source

see if it resolves

[verbal wedge]

I think so?

Im still rusty on reading dig's output

I'll work on it

ill just use the IP

well that was easy

[cosmic crag]

Hi, I'm doing Alfred's room, but the machine don't boot...

[stuck fractal]

it does

[cosmic crag]

how long it take it to boot??

[stuck fractal]

Many windows boxes don't respond to pings

[cosmic crag]

I'm doing hping3 --udp <ip>

[stuck fractal]

And?

[cosmic crag]

It should respond?

[stuck fractal]

Still won't reply.

[cosmic crag]

mmmm...so I have to scan it with -Pn flag in nmap i think

I don't understand why do not respond to hping3 set in a different protocol....anyhow nmap is running well

[stuck fractal]

Why would it respond though?

[cosmic crag]

because it says that does not respond to ping (ICMP)

and hping craft package in other protocols upd, tcp

[stuck fractal]

Ok, but why would it respond?

There's nothing running that would accept that and reply

No reason it'd respond

[cosmic crag]

@stuck fractal OK, I will study more this topic

[stuck fractal]

I mean if you use some logic

Why would it respond?

There's nothing listening

it's going to ignore them

[cosmic crag]

Yes but ohter machines with no ICMP replay in other rooms has respond to hping3 --udp for example..

but I have to read more of this topic to understand why

[stuck fractal]

Responding with ICMP port unreachable?

That'll be a firewall thing

[verbal wedge]

Stuck on Intro x86-64

Trying to get the value of var_8h before popq and ret

[white salmon]

I must of missed something, in Blue I have scanned it and found the open ports but how do I check vulnerabilities with that?

Try using the option --script=vuln with nmap

I'm gonna go through the nmap room again

[indigo ridge]

https://tryhackme.com/room/ra
How should I approach this room.. where to start?

[devout palm]

@indigo ridge Enumeration is always a good start

[indigo ridge]

Already did that.. nmap scan gobuster

[devout palm]

@indigo ridge
Okay. Without having done the room I saw two interesting vectors from initial look around. Have you discovered anything you want to pursue?

[devout palm]

For instance there is an ||interesting http form|| and a ||service with associated users|| that might be worth checking out

[vernal goblet]

Can anyone give me a hint on billy's password on Blog room? I know the username

[indigo ridge]

For instance there is an ||interesting http form|| and a ||service with associated users|| that might be worth checking out
@devout palm

I was thinking about ldap.. but I never did that.. so no experience
And about that form.. i am still clueless

[devout palm]

@indigo ridge There are several services running on the box. Have you identified which common and not-so-common ones are running?
What makes you clueless about the form? Without having attacked it I'd imagine it'd be a great place to start to gain access.

[indigo ridge]

Okay.. yeah there was a service.. Which was not identified

[radiant dew]

Crack the hash room. Level 1 #4 and level 2 #3. For 1.4 ||bcrypt||, how? And 2.3, how do I format it for hashcat (with rounds)?

[white salmon]

Have you tried googling the commands and its general usage

usually "how to decrypt with x" works as a good guideline on how to structure the command

[radiant dew]

I have, and I've managed the others, just not these two

[devout palm]

@indigo ridge I think you're misinterpreting your results. There's a service with various listening ports for client/server and web admin console in both plain HTTP and TLS. That ties together with a ||username list|| on the webpage. There's also the ||reset form|| which is highly interesting.

[radiant dew]

For the ||bcrypt|| one I have an estimated time of 60 days 😆

[indigo ridge]

Okay.. yeah there was a service.. Which was not identified

[devout palm]

@radiant dew For 1.4: ||You specify bcrypt as the hash type.||
For 2.3: there's no need to specify rounds, it's already formatted the way you want it.

[radiant dew]

For 1.4 I'm running ||hashcat bcrypt.txt -a3 ?a?a?a?a -m3200||

2.3 is ||hashcat cth23.txt /usr/share/wordlists/rockyou.txt -a0 -m1800||

[devout palm]

@radiant dew You are on the right path. For 1.4 I'd first try with a smaller character set than 'all', that'll probably lessen the time it takes for you.
For 2.3 it seems completely fine.

[radiant dew]

Thanks! I'll give it a go. Also I've just made a rockyou with ||only 6 characters|| which should speed things up too. And it's just the Hash, not the salt or rounds?

[devout palm]

@radiant dew Yes, a 6 character rockyou ought to speed things up substantially for 2.3. I'm pretty sure you don't need to specify rounds (I just tried without, but could be because I've already cracked it and it's in hashcat's potfile I managed without), otherwise this link ought to explain rounds to you in the hash: https://security.stackexchange.com/questions/93674/how-does-hashcat-figure-out-the-sha-crypt-rounds-on-a-linux-password
I'm having trouble following your last question though. The hash string comprise of both the salt and the hash, and eventually the number of rounds for the hash function.

[radiant dew]

I found that and tried but it said invalid hash. I'm wondering if it's because Mrtn wrote rounds=5000& when I think he meant rounds=5$

My last part I simply meant do I need to reformat the hash given ($6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.). I can see it includes the salt, but not the rounds. Perhaps I'll try $6$rounds=5$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.

[devout palm]

As I said, I managed without rounds specified

[radiant dew]

I'll just leave it running 🙂

[devout palm]

@radiant dew for reference, ?a?a?a?a takes 3+ days for me on 1.4 while ?l?l?l?l takes ~25 minutes

your gpu may vary though

[radiant dew]

Yeah, I'm doing ?l?l?l?l and it's saying 8hrs. Maybe not the best task for a Kali VM on a laptop, especially as it seems the VM isn't using the GPU at all

"VMware Workstation 15 does not support GPU pass-through at the moment."

2.3 should only take 20mins or so though

[open storm]

Hi everyone, anyone has a clue regarding the webgramming room ? I did a script providing "behind me" through nc a 1000 times but still I always get the same feedback from the server which is "wrong answer"

[visual vapor]

Can someone suggest me the answer to: "If A password hash starts with $6 $, what format is it (Unix variant)?"

[white salmon]

Have you tried googling that exact question

[open storm]

type something like hashcat mode list on google, you should find some interesting stuff

[proven pier]

hey what does a ip hostname looks like

[white salmon]

A hostname is just another name for "device name" or "machine name" usually

But it depends on context- because it can also just be another way to say "website" usually

Host names are converted to IP Addresses via DNS servers

[proven pier]

relly i passed device names like a while ago

haha thank you

[brave bear]

Hey in Lord of the Root room there is a question about what method to exploit the system for privellage escalation called any hints on that i got root and stuff and i tried the name of the exploit and didnt get anywhere

[white salmon]

Mr robot room || Can't switch to user robot automatically gets declined? ||

Are you sure the password you're inputting is correct?

I don't input any pass

It gets declined before I can enter

Are you typing in ||su robot||, or are you trying to copy and paste it or something?

sometimes a copy and paste might have a new line character in it that causes your terminal to involuntarily press enter

@white salmon || I am typing su robot, su - robot || I think my current user is at very low privilege

it should just be ||su robot||

tried both

Try SSHing directly into the machine as robot

ssh is filtered

Most likely the user that you're using probably can't su then

Try seeing if you can gain access to another user on the system

checked writeup they did the same and it works 😦

"python -c 'import pty; pty.spawn("/bin/sh")'" used this to change my shell and it works

oh

perfect

[cold night]

any hint for blog room

[white salmon]

any hint for where you're currently at in the room

[cold night]

can I dm you bro

??

[white salmon]

sure ig

[trim haven]

read rule 13 btw

[lusty notch]

What are automated tasks called in Linux?

i think ans is crontabs but it's wrong?

[oblique cliff]

||cron jobs|| i already answered in general, didnt i?

[white salmon]

||jabs||

[oblique cliff]

lol woops

[white salmon]

@lusty notch The answer is clearly linked with a topic your doing, if you can tell us what including the question number we can perhaps help you a little more rather than trying to guess the answer.

[lusty notch]

Introductory researching task 2-> Q.2,4,5 ? @white salmon

[white salmon]

You are on the right lines with Cron.

Perhaps use a space between Cron and the (next word)

[lusty notch]

now finally it's correct, thanks @white salmon

[white salmon]

Regarding Q4 & 5 google is your best friend (especially given your doing a room called introductory researching 😉 )

[lusty notch]

@white salmon 👍 okay

[white salmon]

Give it a bit of a shot with google, it's all easily researchable, if you're still struggling then come back and we'll be able to help!

Don't give up while researching- just keep trying different terms and ideas

trust me- if you give up just on googling, then you won't want to see what real enumeration will be like

[lusty notch]

Done bro @white salmon @white salmon 🤘

[white salmon]

Glad to hear it!

[reef carbon]

Anyone got some experience with eternal blue? I'm on the blue machine trying to run m||s17_010_eternalblue|| but get this error. I've tried restarting the box a few times and changing LHOST but it keeps failing.

[oblique cliff]

youre lhost is wrong

it needs to be your tun0 VPN IP address

[reef carbon]

tried that @oblique cliff still the same error

[obsidian rover]

oh god the eternalblue exploit, i was never able to do it with metasploit

it always failes for me

[oblique cliff]

@reef carbon the exploit itself is inconsistent so you may have to try several times. But you definitely need to have that IP changed

[white salmon]

yeah tbh my experience with eternalblue was very rng

but when it works, it works

(but if it doesn't, then it crashes the entire machine)

also i like how you ||spoilered the exploit|| but forgot to censor the pic

[reef carbon]

yeah I tried a few writeups and googled it, all said the same thing. I guess I'll just pray to RNGesus

[white salmon]

are you using a VM on your host, or the THM kali?

[obsidian rover]

there's a room called Blue where the tryhackme admin that posted the video says "this exploit is very inconsistent"

[white salmon]

i actually found a higher success rate tbh using THM's machine

[reef carbon]

Ah that's a good idea @white salmon i'll try using that

[stuck fractal]

@reef carbon update your metasploit

You're using an old version that sets a payload that doesn't work

[white salmon]

oh good point

i forgot to check which payload he was using

[stuck fractal]

With correct settings, it works like 90% of the time

[reef carbon]

thanks @stuck fractal , i'll report back once i've finished

[oblique cliff]

Break Out of the Cage 1, privesc to root, can someone give a hint as to what the note is? I figure ||its encoded/encrypted something along those lines|| but i dont recognize it. And I tried it as roots password but its not that either

[gritty helm]

is anyone working on the new room "Blog"? trying to get privesc going

[stuck fractal]

||It looks like plaintext, but shifted. What if it wasn't caesar|| @oblique cliff

@gritty helm Do some privesc enumeration

[oblique cliff]

i did ||rot1-26 but it wasnt that||

[stuck fractal]

That's caesar

[oblique cliff]

maybe its a ||ascii shift or whatever its called||

oh

ok ill look for what the other one is called

[stuck fractal]

Have a look into similar but different schemes

||Maybe one that has a key||

[oblique cliff]

oof im so bad with that stuff. Alright ill look into it

[gritty helm]

@stuck fractal linpeas showed ||ca-bundle.crt as 99% privesc vector|| but I've never gone that route before

[stuck fractal]

It's talking nonsense

[white salmon]

@gritty helm I'm pretty sure it's a false positive

[stuck fractal]

Keep enumerating

[gritty helm]

-_- alright that's basically what I wanted to confirm, thanks!

[white salmon]

linpeas tries detecting SSH keys, and that file is just full of random ones

[gritty helm]

yeah I was going through it and couldn't think of how to leverage them for privesc lol

[white salmon]

have you tried logging in with every single key

¯_(ツ)_/¯

[oblique cliff]

what are these 'schemes' generally called? i dont even know the category im researching... ||shift cipher||?

[white salmon]

@oblique cliff Probably cryptography/string manipulation

[oblique cliff]

thanks

[gritty helm]

unreal I got so hung up on that I missed the very obvious creds haha

[stuck fractal]

I think you're being misled again

[gritty helm]

creds in the ||wp-config||?

[stuck fractal]

Eh, try em if you want

[shut pollen]

Hey guys , still stuck with the ||checker SUID|| in Blog

Any help ?

[verbal wedge]

You had the entire code

Read the code

Lookup the functions being called

See what they do

[shut pollen]

And then man ?

[verbal wedge]

The manual?

I mean yeah I think there's man pages for them

[shut pollen]

Nah I mean I did that stuff

[verbal wedge]

But Google has info too

[shut pollen]

What's next ?

[verbal wedge]

Ah

Uhhh

If you're still stuck beyond that I'm not sure

Maybe practice some C?

[toxic scarab]

i don't think you googled all the functions, then

[verbal wedge]

Or that

[stuck fractal]

Linux Programmer manual is included in Man

You can look up the library functions in that

Or online

[oblique cliff]

so researching your hint for break out the cage I "narrowed" it down to:
||coumnar redefence transposition ubchi autoclave beaufort bellaso gronsfeld porta slidefair variant beaufort vigenere||

is it even in that list or am i on the wrong track entirely. Also, you said ||one with a key. I don't see a key anywhere, but i guess thats another problem altogether unless we're reusing the key from the vigenere cipher but thats doubtful||

[stuck fractal]

That last one is typical in CTFs

You've seen the key. Make some educated guesses. 😉

[oblique cliff]

we already used it on the foothold, so i thought it was gonna be something else

but i will soldier forth!

thank you for that

@stuck fractal 1 I love you (in a completely non-bro way 😉 ) 2 i actually got it! thank you yay for beginner CTFs 😄

[stuck fractal]

I'll keep making content, just for you 😉

[rare zenith]

I'm doing the Learn Linux room by Paradox and I got stuck in the last task.

Any hints on how I get root access?

[stuck fractal]

The room gives you a way of getting root access

[rare zenith]

ok

[supple sun]

Hi can someone give some hints for priv esc? Im doing the Blog room and I'm stuck in www-data 😦

Thaaanks 🙂

[white salmon]

Have you enumerated the machine yet?

[supple sun]

I tried using LinEnum

but i havent found anything

or maybe i miss something? lol

[white salmon]

Try multiple enumeration scripts to help you narrow down a possible path of escalation

It's possible- you might have to read through the output very carefully

[shut pollen]

Hey guys finally did it ( it was real easy and I was stupid ). Thanks everyone for the encouragement. Especially @stuck fractal @verbal wedge

[verbal wedge]

Woooo

[rare zenith]

Hello I'm still stuck in the Learn Linux room. Can you please tell me where is this way you mentioned before? @stuck fractal

[stuck fractal]

Read the previous tasks

[supple sun]

Is it the /usr/sbin/checker?
@white salmon

[white salmon]

Have you tried checking out the program

[supple sun]

I just tried running it and it just shows Not and Admin lol

[stuck fractal]

Reverse engineer it

[supple sun]

Oh i guess i need to learn reverse engineering first

thanks 🙂

[stuck fractal]

If you know some C, you'll be fine

[mild eagle]

in room dailybugle i found || a cve for the cms trying to run the sqlmap defined in cve to save time when i know th db is Mariadb isn't the correct to add the --dbms=mariadb switch " || just doesn' seems to work

[stuck fractal]

the sqlmap one doesn't work for a lot of people

[mild eagle]

tnx so have to use the || metasploit || ?

[stuck fractal]

No

There's a lot of exploits for it

[white salmon]

In blog room || the dbase iii dbt file can be opened with libre office|| ?

[verbal wedge]

Probably if you're www-data

[white salmon]

I have the file in my system?

[verbal wedge]

Did you download it from the box? You shouldn't be able to

[white salmon]

I got it from || smb share||

[verbal wedge]

Oh uh I didn't include anything worthwhile there just sayin

[white salmon]

thanks ig 😄

[mild eagle]

questionhave I missed something in the hascat command line since hashcat only finds wrong pasword and john can password to bcryp $2y$10$0 || hashcat -a 0 -m 3200 crackme /usr/share/wordlists/rockyou.txt --force||

[stuck fractal]

Room, task, question

Don't use --force

Otherwise you will get invalid results.

[mild eagle]

sorry dailybugle I use force because of running inside vm Device #1: Not a native Intel OpenCL runtime. Expect massive speed loss.
You can use --force to override, but do not report related errors.

[stuck fractal]

Do not use --force

I've told you why

You've seen why

Use john

[mild eagle]

Got it 🙂

and tnx

just wanna try different tools to learn

[stuck fractal]

Kali 2020.2 has working hashcat CPU support

Without --force

[mild eagle]

okay how ?

[stuck fractal]

How what?

[mild eagle]

how do i run it without --force then ?

[toxic scarab]

don't

[stuck fractal]

Just... don't put --force?

Probably update your kali first

[toxic scarab]

just don't use it on a vm

[stuck fractal]

best to crack on the host if you have a GPU

[mild eagle]

I am running 2020.2 .. 🙂 and guess you are right about host and gpu anyway 🙂

[stuck fractal]

I normally am right, especially about hashing

[white salmon]

yeah- you don't need to hashcat in a VM technically

since it can take a local file as input

[oblique cliff]

Room Madness hint on how to get ||ssh username||. Was able to ||get the secret from the hidden directory, but no leads how to get the username||

[stuck fractal]

Steg

Steg everything

Literally everything

[oblique cliff]

is that a life tip or room tip

but noted, steg everything when doing CTFs, got it

[stuck fractal]

This room specifically

By everything, I can't emphasise how literal I want you to take that

[oblique cliff]

no, you have emphasized it

so there are no other ||images|| that i can find... and I cant steg html pages, so what else is there to steg?

besides everything cuz i feel like ive covered everything but clearly im missing something

[stuck fractal]

||Images on the room page? Hidden HTML on the room page?||

[oblique cliff]

........................

whaaaaaaaaaaaaa

thats not fair

i didnt realize ||outside of the box was in scope for everything||

[stuck fractal]

You're fairly passive here

So scope is eh

You're not attacking THM's infra

[oblique cliff]

na its fine i just didnt realize the scope of CTFs, but now i know

also, so ||I found the other pic (the bunny ears and card) but its unable to be opened by steghide I believe this is right picture, is there another picture I should be looking for too?||

should I inspecting the kali machine image too

never mind i looked at the hint

[worn yew]

Wow OWASP TOP 10 Day 3 task only resources to read that is it.

Not too much of a challenge

[stuck fractal]

There's a challenge there....

[worn yew]

Oh

I missed it then let me see again

My mistake did not refreshed the page

Thanks

[oblique cliff]

@stuck fractal thanks for help as always, rooted 😄

[stuck fractal]

Madness was designed to just be a pain

[oblique cliff]

haha i mean the only thing that was a pain was the one part, everything was pretty normal. It was just a pain for me cuz i havent done many straight up CTFs so i have no experience with ciphers or extracting image from data or anything like that

but yea outside of ||the room image having data|| i thought it was pretty fair if you know how to do CTFs

although idk if id say that was an easy room - again, beginner at ctfs, though, so i might think different in a few months or whatever

[worn yew]

Got the flag but I have no idea about the extra thing on the challenge (OWASP Top 10 Day 3)

Tried to extract data from the images but without the passphrase no luck

Any hints guys?

[trim haven]

Are you looking for the voucher..?

[worn yew]

Yes

[trim haven]

Doubt anybody will help you there dude.

[tidal sedge]

It's already been claimed

[trim haven]

^

There you go :)

[worn yew]

but for the time being here's a starting point: boxes are boring, escape 'em at every opportunity.

What they are trying to say?

It is okay that the voucher is gone but still want to know about how to proceed on here

[ancient hemlock]

there was 1 voucher and first to find it got it?

[stuck fractal]

Yes

[silent iron]

Has anyone solved this There may or may not be another hint hidden on the box, should you need it, but for the time being here's a starting point: boxes are boring, escape 'em at every opportunity.
i have an idea what its regarding but havent found anything yet..

[stuck fractal]

That is related to the subscription code

Which is already claimed

[trim haven]

I type #room-hints Yes someone has, meaning Check the channel, we've already discussed it.

[silent iron]

Oh OK

theres only one. interesting

No one has really disscussed the solution?

[robust lagoon]

Nope. I haven't managed to solve it in time but I think it had something to do with the ||email address on the front page as the domain was registered on the 12th this month||

[oak iron]

I feel im missing something obvious on the ccghidra room,
currently stuck on task 4#2, where its asking what the first variable in main is set to, and it appears to want two characters...

[silent iron]

how can i say what i think its about without the spoiler? is it OK to post that here?

[ancient hemlock]

can someone say if it's ctf-related, as in finding a flag on the box,or was it as simple as ||sending an email to that address||?

[stuck fractal]

An email would have worked

Muir has said that

[ancient hemlock]

ok ty man

[silent iron]

ohh so the solution was to send an email!?

[stuck fractal]

That was a solution

I don't know if that was the solution

[silent iron]

interesting theres more than one then... :/

[ancient hemlock]

I guess walking up to the thm office with a printed html of the page would also have worked

[stuck fractal]

interesting theres more than one then... :/
@silent iron I didn't say that, but ok

[silent iron]

your speaking in riddles

LOL

a solution is the correct action isnt it

[stuck fractal]

No

I'm saying that's the solution I know of

There may be more, but I do not know if there is

[white salmon]

In the world of penetration/hacking, there's always more than one solution usually.

[stuck fractal]

Or what those might be.

[white salmon]

It just depends on how hard you look/try for a new solution.

[tidal sedge]

@oak iron I'll take a look, through if I remember correctly, you need to convert it to decimal(should be in hex I believe) 🤔

[oak iron]

🤔 im missing a variable then, as the only vars i see are set by reading from STDIN and comparing the result

||```c

int main(void)

{
int stdin_similarity;
char stdin_data [8];

                /* read from STDIN */

fgets(stdin_data,5,stdin);
/* compare STDIN against "1\n" /
stdin_similarity = strcmp(stdin_data,"1\n");
if (stdin_similarity == 0) {
/ on match, print success */
printf("nice!");
}
return 0;
}

[stuck fractal]

your speaking in riddles
@silent iron Ok, it was just email

[mild eagle]

@oak iron i had the same look in the assembler code 🙂

[tidal sedge]

Yep, it's in the assembler code

[silent iron]

what do you mean it was just email?

like you need to send an email to that address?

[oak iron]

got it, thanks @mild eagle @tidal sedge

not sure why that worked, however

[stuck fractal]

Yes, but it's claimed so don't email now @silent iron

[silent iron]

oh OK

awsome, i just did actually before you said about it

oops

[trim haven]

I already told you it was claimed... -_-

[slim girder]

Did anybody find another way for the subcode (extra challenge in owasp top 10 day3)? Just want to know if there is another way

[stuck fractal]

The only way was emailing

It has been confirmed by the creator

[void lichen]

hello, I am struggling on finding the privesc and user flag for the box blog

[velvet talon]

I've spent 3 hours looking for the solution.. Would it not be better to add something like "the fastest gets the bonus price" to the description? 😄

[void lichen]

does anybody have hints

[wide rune]

does anybody have hints
@void lichen use linpeas.sh

[void lichen]

I did

maybe I missed something

the pkexec looked weird

[wide rune]

does anybody have hints
@void lichen yes i think so! im currently on it too...

the pkexec looked weird
@void lichen look for three config lines, these are "extracted" within the linpeas run... theres something like a hardcoded string

[void lichen]

yeah the mysql database

[wide rune]

right

[void lichen]

which I got the password hash for the other user

which I couldn't decrypt

[verbal wedge]

You won't be able to

Protip

[median compass]

hey there lovely helpful people, I have a quick question on jeff, finally went back to it after being scared away the first time 🙂 rooted it now but I can't get the user flag accepted. I got the hint to do the thing but can't seem to find a coding that works, anyone to give me a hint, sucks to be stuck on that part after getting the rest lol

nevermind, got it... did the thing on a online generator and it worked where ||md5sum|| did not, better go back and read the manual again I guess

yeah, no, I don't understand that... the command line consistently gives me a different response to the online tool... very VERY confused

[stuck fractal]

\n at the end?

[median compass]

don't think so, on the command line I'm doing ||echo <text>|md5sum||

[stuck fractal]

So you'd have a newline at the end

because echo has a newline by default

[median compass]

ahhh

i get the same result when I dump the text into a file though, and there's no \n at the end then, I checked with xxd

[stuck fractal]

¯_(ツ)_/¯

[median compass]

yeah, me neither 🙂 thanks for the suggestion

[toxic scarab]

does echo -n <text> | md5sum work?

[median compass]

that's a sheepish yes, thanks @toxic scarab

[toxic scarab]

it is the newline that James suggested

[stuck fractal]

So it's the \n then

[median compass]

yes James, you were right 🙂

[stuck fractal]

I love crypto

I hate CTF crypto

[median compass]

well, at least I won't forget it now lol

[solemn smelt]

use ciphey problems solved

[craggy pulsar]

oh hi

[solemn smelt]

bee it took me a while to figure out who you were

[wooden mist]

wtf

[craggy pulsar]

Dw @wooden mist , I'm a new person now

[wooden mist]

jfc i'll mix you two constantly if you don't change it

[valid rune]

hey guys ! i'm on room Learn Linux, task 11. whenever i try to run the binary, it says access denied. is there something i am supposed to do ?

[stuck fractal]

Are you trying to run the text file you created?

[valid rune]

yes

[stuck fractal]

are you doing ./noot.txt

That's not a binary

That's an empty text file you just created

[valid rune]

yes i did ./noot.txt

ohh

[hazy sequoia]

Hi guys, so i'm in the room called, linux challenges. I'm on Task 4 #7

Find flag 26 by searching the all files for a string that begins with 4bceb and is 32 characters long.

I run find at the root level, pipe grep -irl '^4bceb' *

the command runs, i see the search, my issue is the search freezes on files called "clear_refs" everytime! I mean is there something wrong with the room or am I just doing something wrong which causes the search to hang there?
@hazy sequoia so i still havnt figured this out yet, however i completed everything else in the room and moved on to tmux, while attempting this for probably 30 mins each day. no luck. any hints? Also do i have to run tmux from within an actual linux environ, using the web based virtual machine doesnt seem to work as when do for instance ctrl + b w it just closes the window.

[valid rune]

so i got the password and succeeded. what's the point of creating noot.txt if i'm not going to be running it, and will use instead ||./shiba1 ||?

[stuck fractal]

The binary performs a test

To see if you created that file

It's like an exam

[valid rune]

soo if i didn't create noot.txt and ran the correct binary, it wouldn't give me the answer ?

[stuck fractal]

Correct

[valid rune]

does this apply in real life cases ? or is this something just to test me user out ? (not the running binary part, but creating the pointless file).

[stuck fractal]

This is testing you.

[valid rune]

ohh okaayy got it ! thanks james.

[narrow kettle]

Hey, one question about OWASP day 3, I brute force directories for getting the "sensitive data directory" there is other way to get ir? Already end it, just curious

[inland onyx]

@narrow kettle Realistically, using something like gobuster is usually the way to go

In this instance there was a comment telling you the directory in the login page

[narrow kettle]

In the main page? Can't see it

[inland onyx]

The login page

[narrow kettle]

But the answer were a***** not login

[inland onyx]

Look at the source code in /login

[narrow kettle]

Gotcha, that was I missed, check the code, thank you!

[stone blade]

hello, can someone help me out with the last 2 flags on Django Room?

I'm struggling to find the user flag and the hidden flag

[valid rune]

on room Learn Linux, task 14. whenever i do ||echo hello > file|| it gives me file: permission denied

[oblique cliff]

Did you check if file exists

And if you have write permissions

[stuck fractal]

Are you logged in as shiba2? Is you current directory still /home/shiba1?

[valid rune]

yes i am logged in as shiba2, and directory is actually /home/shiba1 .. am i supposed to change it ?

[oblique cliff]

Try it and see what happens 🙂

[stuck fractal]

yes i am logged in as shiba2, and directory is actually /home/shiba1 .. am i supposed to change it ?
@valid rune Yes, you generally can't create files in someone else's home directory

[valid rune]

even though i don't know how to change the directory to only be using shiba2 .. but i'll look on how to do it. if i'm stuck, i guess i will need help 😆

[oblique cliff]

Google how to change directories

And if you’re the user and you’re trying to go to /home/{username} then it’s called your home directory

So you can google how to change to your home directory as well

@valid rune

[final mortar]

Learn Linux room actually cover's it later too

Yeah Task 29, if you want

[pale trout]

Looking for that code in the OWASP top 10 room, anyone find it? is it still there?

[stuck fractal]

It's no longer claimable

The creator has said what you had to do to obtain it

[pale trout]

I figured, darn.

It said it was on the homepage, tried steg on the image but nada

w/e

thanks!

[valid rune]

@oblique cliff thanks ! i already did find the answer and changed the directory with a very simple command. honestly it's a small thing, but i feel proud that i figured it out myself 😂

[oblique cliff]

good job! we all gotta start somewhere nothing wrong with being proud of yourself 😄

[valid rune]

and to be honest it's all thanks to the researching rooms and motivational writing that one should google almost everything.

[final mortar]

The creator has said what you had to do to obtain it
How 👉 👈

[stuck fractal]

Email the address, but don't do that now

[wraith pivot]

Hey everyone

I'm doing the linux challenge room

And I'm looking for flag26, but I'm kind of stucked with the regex synax

Could anyone help me?

[hazy sequoia]

And I'm looking for flag26, but I'm kind of stucked with the regex synax
@wraith pivot same here, been stuck on that flag for a while now.

[final mortar]

Email the address, but don't do that now
Nah nah I am already subbed, just wanted to know the method 😂 damn it was so literal , I missed it

[verbal wedge]

why am i stuck on enumeration for LotR

-p- isnt completing

and without it, it only finds one port

[patent token]

Want a big or small hint?

[verbal wedge]

mmmmm

small

fornow^TM