#room-hints | TryHackMe | Page 42

white salmon Jul 18, 2020, 9:55 AM

#

What do you call the IP address of your own router in your internal network?

stoic jewel Jul 18, 2020, 9:59 AM

#

any hint about Jeff's room !!

quiet yarrow Jul 18, 2020, 10:01 AM

#

Thanks @white salmon

thorny nest Jul 18, 2020, 10:43 AM

#

Anybody willing to give hints for overpass? Got user but am lost looking for root.

vernal goblet Jul 18, 2020, 10:51 AM

#

Can anyone give me a hint on Overpass ?

lucid crescent Jul 18, 2020, 11:07 AM

#

any hint about Jeff's room !!
@stoic jewel look at write up

#

!writeup jeff

proud scarabBOT Jul 18, 2020, 11:08 AM

#

TryHackMe

Jeff

http://tryhackme.com/room/jeff

By: rennox

http://therennox.github.io/thm/jeff

By: mokha

https://www.khalidalnajjar.com/hacking-jeff-writeup-thm/

By: RFC1918

https://rfc191852608710.wordpress.com/2020/07/11/tryhackme-write-up-jeff/

By: xcth

https://onoma.cf/post/jeff/

edgy gorge Jul 18, 2020, 11:43 AM

#

Um can anyone tell me why priv esc is not working on Overpass

#

i don't want to spoil anything so that's why 🙃

final mortar Jul 18, 2020, 11:51 AM

#

You can ask help with spoiler tags, it's not an issue

white salmon Jul 18, 2020, 12:02 PM

#

Splunk room. "When viewing search results, it's often useful to rename fields using user-provided tables of values. What command do we include within a search to do this?" Surely it's ||rename||?
@radiant dew The answer to this question is the last one I'm missing from completing the room. Can anyone give a hint what the correct answer could be?

keen willow Jul 18, 2020, 12:03 PM

#

Can anyone give me a hint on Overpass ?
@vernal goblet what you want ?

#

any hint about Jeff's room !!
@stoic jewel sure, ask 🙂

vernal goblet Jul 18, 2020, 12:05 PM

#

@vernal goblet what you want ?
@keen willow
I found the admin page. Tried some sqli techniques, didn't worked. I need a hint to go forward

keen willow Jul 18, 2020, 12:07 PM

#

you should check more on admin page. you may want to use ||browser's developer's network tab||.

vernal goblet Jul 18, 2020, 12:08 PM

#

I did check that. It's using api that I know

edgy gorge Jul 18, 2020, 12:10 PM

#

||i did point my ip to curl but i do not seem to get a rev shell maybe i'm running the python server on wrong dir ?||

keen willow Jul 18, 2020, 12:13 PM

#

I did check that. It's using api that I know
@vernal goblet you need to get more info on how it is working.

#

||i did point my ip to curl but i do not seem to get a rev shell maybe i'm running the python server on wrong dir ?||
@edgy gorge copy the request and test it locally.

edgy gorge Jul 18, 2020, 12:15 PM

#

||curl localhost ?||

keen willow Jul 18, 2020, 12:18 PM

#

yup, on your attacker machine, where you started python server and wants to check if you have correct setup for reverse shell.

radiant dew Jul 18, 2020, 12:23 PM

#

@radiant dew The answer to this question is the last one I'm missing from completing the room. Can anyone give a hint what the correct answer could be?
@white salmon I ended up looking through the Splunk docs for all six-letter commands and guessing a few. I kinda get what the question was going for, but I don't feel it's very well worded. Think about what command you would need to use if you wanted to access DATA from another table or a csv.

white salmon Jul 18, 2020, 12:24 PM

#

@radiant dew I'm also thinking about this brute force approach. 🙂

#

@radiant dew Thanks for the hint! I found it. I also think this question as well as some others are not very well-worded.

radiant dew Jul 18, 2020, 12:26 PM

#

I'm still really happy they have a Splunk room and I would love more Blue Team rooms hint hint THM crew

white salmon Jul 18, 2020, 12:28 PM

#

I'm preparing a write-up for the Splunk room. Maybe it will be helpful for future visitors.

oblique cliff Jul 18, 2020, 12:35 PM

#

@white salmon #thm-community-media

#

We don’t post answers/writeups in this channel it defeats the purpose

white salmon Jul 18, 2020, 12:40 PM

#

@oblique cliff Sorry, I removed the URL.

oblique cliff Jul 18, 2020, 12:40 PM

#

Thanks

steep shard Jul 18, 2020, 12:47 PM

#

hey guys im at the linux room at task 43 - the true ending and i just need to get into the /root/root directory and to do that i gotta have sudo permissions but unfortanetely none of the shiba users has it 😭 what can i do?
@umbral tree same as me. even after checking on all users i still didn't figure out what to do... i found the user with sudo permissions but dont know what to do with this. 😫

rare zenith Jul 18, 2020, 12:48 PM

#

@steep shard What is the user with sudo permission?

steep shard Jul 18, 2020, 12:48 PM

#

@rare zenith the user is nootnoot

rare zenith Jul 18, 2020, 12:49 PM

#

@steep shard Yeah I found that too from a screenshot in a previous task but I can't login there.

steep shard Jul 18, 2020, 12:50 PM

#

i didnt even logged into it. i just changed the directory to his home folder

rare zenith Jul 18, 2020, 12:50 PM

#

That doesn't change anything

steep shard Jul 18, 2020, 12:52 PM

#

maybe we're just tired, the room creator said the solution was in the room

rare zenith Jul 18, 2020, 12:53 PM

#

In the sudo task it advised us to check the man page of sudo.

#

I'll probably check sth from therre

steep shard Jul 18, 2020, 12:54 PM

#

thanks for the advice

oblique cliff Jul 18, 2020, 12:54 PM

#

@steep shard @rare zenith y’all are on the right track if you’ve found that!

#

Id recommend now looking at the files each of the users own and see if you find any out of place

rare zenith Jul 18, 2020, 12:55 PM

#

Ok I'll check it out thx

steep shard Jul 18, 2020, 12:55 PM

#

thank you @oblique cliff !

oblique cliff Jul 18, 2020, 12:55 PM

#

👍🏿

digital bolt Jul 18, 2020, 1:09 PM

#

Hi there, any one doing/done https://tryhackme.com/room/owasptop10 ??

TryHackMe

TryHackMe | OWASP Top 10

Learn one of the OWASP vulnerabilities every day for 10 days in a row.

trim haven Jul 18, 2020, 1:11 PM

#

Just ask your question

digital bolt Jul 18, 2020, 1:16 PM

#

Ok, here goes :- [Task 8] [Day 2] Broken Authentication Practical Wondering how it is allowing " darren" to be registered ? Is it because white spaces are not removed before inserting

rotund skiff Jul 18, 2020, 1:19 PM

#

still stuck on overpass. found ||/admin||. tried to use sqlmap and burpsuite to send xml payload but neither were successful. i know i need to use an owasp vuln, but totally stuck

formal pier Jul 18, 2020, 1:21 PM

#

@rotund skiff you passed the owasp top 10 i have a question about the task XML External Entity - Exploiting

rotund skiff Jul 18, 2020, 1:21 PM

#

@formal pier ask away

formal pier Jul 18, 2020, 1:23 PM

#

did you passed the task 17

rotund skiff Jul 18, 2020, 1:24 PM

#

yes, in the previous task xxe payload take that code and modify it

shut pollen Jul 18, 2020, 1:28 PM

#

Anyone help with overpass ?

rotund skiff Jul 18, 2020, 1:29 PM

#

how far along overpass are you?

shut pollen Jul 18, 2020, 1:30 PM

#

Just started

#

Kinda stuck

rotund skiff Jul 18, 2020, 1:30 PM

#

ahh ok yeah i'm stuck at the beginning too haha

#

run gobuster if you haven't already

ashen violet Jul 18, 2020, 1:33 PM

#

@rotund skiff look at what else is on that page

white salmon Jul 18, 2020, 1:33 PM

#

Hey, I have a problem and since it's too long, (exceeds 2000 characters) discord won't accept it. Here's the link to the pastebin https://pastebin.com/kfvXZG9p

rotund skiff Jul 18, 2020, 1:34 PM

#

@white salmon hashcat ran just fine, look closely

#

@ashen violet ||login.js||?

ashen violet Jul 18, 2020, 1:36 PM

#

Yes

white salmon Jul 18, 2020, 1:37 PM

#

@white salmon hashcat ran just fine, look closely
@rotund skiff Yes, but isn't supposed to use my GPU instead of my CPU (my GPU is pretty decent and I'd like it to use it).
Plus, it says Status...........: Cracked but I can't seem to find the password anywhere :c

hasty gust Jul 18, 2020, 1:37 PM

#

In the OWASP room - there's this question: ||How can we specify XML version and encoding in XML document?|| - I thought it was: ||xml version|| but it isn't accepted. Am I missing the obvious?

indigo ridge Jul 18, 2020, 1:37 PM

#

look close

#

@rotund skiff Yes, but isn't supposed to use my GPU instead of my CPU (my GPU is pretty decent and I'd like it to use it).
Plus, it says Status...........: Cracked but I can't seem to find the password anywhere :c
@white salmon you got your pass

white salmon Jul 18, 2020, 1:38 PM

#

Damn it x)

rotund skiff Jul 18, 2020, 1:38 PM

#

i'm not sure about how to use the gpu, but the password is there they just don't make it obvious. look for where the original hash is displayed and you will see it

white salmon Jul 18, 2020, 1:38 PM

#

I though this meant the difficlty

indigo ridge Jul 18, 2020, 1:38 PM

#

In the OWASP room - there's this question: ||How can we specify XML version and encoding in XML document?|| - I thought it was: ||xml version|| but it isn't accepted. Am I missing the obvious?
@hasty gust read the material provided

rotund skiff Jul 18, 2020, 1:38 PM

#

i would ask about the gpu problem though

white salmon Jul 18, 2020, 1:38 PM

#

Thanks!

hasty gust Jul 18, 2020, 1:39 PM

#

@indigo ridge I did. I'll read again. Must have missed something

indigo ridge Jul 18, 2020, 1:39 PM

#

yep

white salmon Jul 18, 2020, 1:39 PM

#

I mean it isn't necesssery atm soo

vapid zenith Jul 18, 2020, 1:39 PM

#

When I can add blog room walkthrough

indigo ridge Jul 18, 2020, 1:40 PM

#

go and add..btw there are already a lot of writeups

When I can add blog room walkthrough
@vapid zenith

vapid zenith Jul 18, 2020, 1:41 PM

#

oo I don't check that okk bro I will add it

shut pollen Jul 18, 2020, 1:42 PM

#

@rotund skiff any progress bro ?

rotund skiff Jul 18, 2020, 1:43 PM

#

inspect the admin page, there is something there. not sure what to do with it though

shut pollen Jul 18, 2020, 1:45 PM

#

📎 0h4l6iuov6e41.png

white salmon Jul 18, 2020, 1:46 PM

#

https://pastebin.com/A3xEymnt
Well, well, well... what went wrong this time?

Pastebin

root@kalinux:/home/idir# hashcat -a 3 -m 100 /home/idir/Desktop/has...

rotund skiff Jul 18, 2020, 1:49 PM

#

rengo which one are you on

white salmon Jul 18, 2020, 1:50 PM

#

Crack the hash, Task#2

rotund skiff Jul 18, 2020, 1:55 PM

#

https://embeddedworld.home.blog/2019/05/11/hacking-walk-through-cracking-the-hashes/

The embedded world

kelcy66

[Hacking walkthrough] Cracking the hashes

Today I was stumbled across a hacking challenge website called tryhackme. Multiple challenges can be found and each of the challenges is written by the community or individual. Feel free to sign up…

#

are you providing a wordlist?

white salmon Jul 18, 2020, 1:57 PM

#

Nop, just the hash and the number of characters ?a?a?a?a?a?a?a?a?a?a?a

#

https://embeddedworld.home.blog/2019/05/11/hacking-walk-through-cracking-the-hashes/
@rotund skiff Allright, this'll help

The embedded world

kelcy66

[Hacking walkthrough] Cracking the hashes

Today I was stumbled across a hacking challenge website called tryhackme. Multiple challenges can be found and each of the challenges is written by the community or individual. Feel free to sign up…

random thunder Jul 18, 2020, 1:57 PM

#

where is the metasploit payload stored?

rotund skiff Jul 18, 2020, 1:58 PM

#

@white salmon that writeup also tells you how to specify your gpu over cpu

oblique cliff Jul 18, 2020, 1:59 PM

#

@random thunder be more specific please

#

What Room? (Link, Room title, room code from URL)
What Task? (Give the number!)
What question? (Number, maybe also basic details)
What have you tried?
What happened?
What didn't happen?
What did you expect to happen?
A picture paints a thousand words. Don't type a thousand words. Screenshots are awesome. Photos of your screen are not.
(If you want to paint a picture, we'll be impressed but a screenshot is really better)

random thunder Jul 18, 2020, 2:00 PM

#

is there a specific location where the payload is stored? when i run msfvenom -p cmd/unix/reverse_netcat lhost=LOCALIP lport=8888 R ?

oblique cliff Jul 18, 2020, 2:01 PM

#

It’s outputted right on the terminal

#

It’ll be mkfifo.....

#

It’s that line

white salmon Jul 18, 2020, 2:04 PM

#

@white salmon that writeup also tells you how to specify your gpu over cpu
@rotund skiff I tried using my GPU but it seems like it doesn't detect it 😮 :
`root@kalinux:/home/idir# hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir/Desktop/worldlist/rockyou.txt
hashcat (v6.0.0) starting...

No devices found/left.

Started: Sat Jul 18 15:03:42 2020
Stopped: Sat Jul 18 15:03:42 2020
root@kalinux:/home/idir# `

rotund skiff Jul 18, 2020, 2:04 PM

#

are you in a vm?

white salmon Jul 18, 2020, 2:05 PM

#

Nop

#

I use Kali Linux in dual boot

merry helm Jul 18, 2020, 2:06 PM

#

@rotund skiff I tried using my GPU but it seems like it doesn't detect it 😮 :
`root@kalinux:/home/idir# hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir/Desktop/worldlist/rockyou.txt
hashcat (v6.0.0) starting...

No devices found/left.

Started: Sat Jul 18 15:03:42 2020
Stopped: Sat Jul 18 15:03:42 2020
root@kalinux:/home/idir# `
@white salmon Try --force

white salmon Jul 18, 2020, 2:07 PM

#

@merry helm Like hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir --force?

merry helm Jul 18, 2020, 2:07 PM

#

@merry helm Like hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir --force?
@white salmon Yes

#

/home/dir/<wordlist> --force

shut pollen Jul 18, 2020, 2:09 PM

#

Help with overpass anyone ?

#

One thing l noticed is that ||username and password are in clear text||

#

Is it of any avail ?

white salmon Jul 18, 2020, 2:12 PM

#

@merry helm `root@kalinux:/home/idir# hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir --force
hashcat (v6.0.0) starting...

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.
No devices found/left.

Started: Sat Jul 18 15:12:04 2020
Stopped: Sat Jul 18 15:12:04 2020
root@kalinux:/home/idir# `
Still :/

fast swan Jul 18, 2020, 2:12 PM

#

@shut pollen No. To get in, you need to find something in the dev console, specifically the network tab

#

or Application

merry helm Jul 18, 2020, 2:13 PM

#

@merry helm `root@kalinux:/home/idir# hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir --force
hashcat (v6.0.0) starting...

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.
No devices found/left.

Started: Sat Jul 18 15:12:04 2020
Stopped: Sat Jul 18 15:12:04 2020
root@kalinux:/home/idir# `
Still :/
@white salmon Missed comparison wordlist

#

hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir/<wordlist> --force

rotund skiff Jul 18, 2020, 2:14 PM

#

rockyou wordlist can be found /usr/share/wordlists/rockyou.txt make sure you unzip it first

shut pollen Jul 18, 2020, 2:17 PM

#

@fast swan thanks for the hint but I still don't get it

rotund skiff Jul 18, 2020, 2:17 PM

#

haha yeah me neither

white salmon Jul 18, 2020, 2:18 PM

#

`root@kalinux:/home/idir# hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir/Desktop/worldlist/rockyou.txt --force
hashcat (v6.0.0) starting...

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.
No devices found/left.

Started: Sat Jul 18 15:17:48 2020
Stopped: Sat Jul 18 15:17:48 2020
root@kalinux:/home/idir# `
Even with the right path!...

#

rockyou wordlist can be found /usr/share/wordlists/rockyou.txt make sure you unzip it first
@rotund skiff Ok I'll try this

fast swan Jul 18, 2020, 2:19 PM

#

@fast swan thanks for the hint but I still don't get it
@shut pollen I can't really say much more without giving it away

#

You'll kick yourself when you get it

white salmon Jul 18, 2020, 2:19 PM

#

@rotund skiff Ok I'll try this
@white salmon Doesn't work, there's no wordlist folder in /usr/share/

rotund skiff Jul 18, 2020, 2:20 PM

#

strange, that comes default on kali

bronze ivy Jul 18, 2020, 2:20 PM

#

@white salmon Doesn't work, there's no wordlist folder in /usr/share/
@white salmon try wordlistS

merry helm Jul 18, 2020, 2:21 PM

#

`root@kalinux:/home/idir# hashcat -D 2 -m 100 /home/idir/Desktop/hash.txt /home/idir/Desktop/worldlist/rockyou.txt --force
hashcat (v6.0.0) starting...

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.
No devices found/left.

Started: Sat Jul 18 15:17:48 2020
Stopped: Sat Jul 18 15:17:48 2020
root@kalinux:/home/idir# `
Even with the right path!...
@white salmon Omit -D

white salmon Jul 18, 2020, 2:21 PM

#

I mean, there's no folder that has 'word' inside

#

Like none, I checked

rotund skiff Jul 18, 2020, 2:21 PM

#

do what waldir said, just run on cpu for now

white salmon Jul 18, 2020, 2:21 PM

#

@white salmon Omit -D
@merry helm It works without -D

#

I just would like it to work with my GPU, it can be useful for some cracks

#

It just worked on cpu

rotund skiff Jul 18, 2020, 2:21 PM

#

go to #site-support and ask about the gpu

white salmon Jul 18, 2020, 2:22 PM

#

Okk

#

Thank you guys anyway

random thunder Jul 18, 2020, 2:29 PM

#

what command gives this result?

📎 Screenshot_2020-07-18_at_7.59.24_PM.png

final mortar Jul 18, 2020, 2:33 PM

#

What do you mean

random thunder Jul 18, 2020, 2:34 PM

#

what command gets. me this result?

oblique cliff Jul 18, 2020, 2:39 PM

#

no clue, can you show us what you did

bronze ivy Jul 18, 2020, 2:39 PM

#

Seems like output from MOTD file

final mortar Jul 18, 2020, 2:40 PM

#

yeah looks like a welcome message you will get when you connect via ssh or something

random thunder Jul 18, 2020, 2:40 PM

#

this is the question and after running the script that's the result and i have no clue which commands can get that

📎 Screenshot_2020-07-18_at_8.09.26_PM.png

rotund skiff Jul 18, 2020, 2:40 PM

#

@fast swan mind if i dm?

final mortar Jul 18, 2020, 2:41 PM

#

this is the question and after running the script that's the result and i have no clue which commands can get that
@random thunder Room

random thunder Jul 18, 2020, 2:41 PM

#

@random thunder Room
@final mortar https://tryhackme.com/room/commonlinuxprivesc

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

fast swan Jul 18, 2020, 2:42 PM

#

@fast swan mind if i dm?
@rotund skiff Sure!

final mortar Jul 18, 2020, 2:42 PM

#

Can't you just tell all the info in one message ? Am I supposed to guess which task https://i.imgur.com/cdSM9vE.png ?

Imgur

random thunder Jul 18, 2020, 2:43 PM

#

task9 -> #2 * Sorry

final mortar Jul 18, 2020, 2:44 PM

#

You have to go to user5's home directory where there is a file called script as the question says

#

run that file and based on the output determine what command was executed

#

you can easily tell when you see it

random thunder Jul 18, 2020, 2:45 PM

#

shit sorry* got it now. i thought i ran and i got the welcome message and got stuck

oblique cliff Jul 18, 2020, 2:47 PM

#

PG-13 plz

fast swan Jul 18, 2020, 2:48 PM

#

I'm just gonna leave this here !rule1

final mortar Jul 18, 2020, 2:49 PM

#

!rule 1

proud scarabBOT Jul 18, 2020, 2:49 PM

#

Rule 1: No unsolicited direct messages (DMs) to other members of the discord. This includes staff. Verify that the member you are messaging is ok with you sending them DMs. The only exception to this rule is if a situation warrants the involvement of a moderator in order to handle something such as harassment or a situation where another member of the discord has made you feel uncomfortable.

final mortar Jul 18, 2020, 2:50 PM

#

@fast swan This is the reason he asked for your permission first. You can just decline it's not that much of an issue, but you can't quote rule 1 I think, not just yet

fast swan Jul 18, 2020, 2:50 PM

#

@final mortar I've had multiple haha

rotund skiff Jul 18, 2020, 2:52 PM

#

some people see someone accept the request and think it applies to all dms

tropic flame Jul 18, 2020, 3:01 PM

#

@fast swan thanks for the hints on Overpass, I was way overthinking it!

fast swan Jul 18, 2020, 3:02 PM

#

@fast swan thanks for the hints on Overpass, I was way overthinking it!
@tropic flame No problems! I was as well last night. Completely overlooked it myself

cedar coral Jul 18, 2020, 4:04 PM

#

@fast swan can i dm ?

#

@rotund skiff you got it ? (overpass foot)

pseudo hamlet Jul 18, 2020, 4:29 PM

#

hello guys doing vulnversity in task 4 Burpsuit bruteforce for file extension is not working .php,.phtml.php3,php4,php5

#

i tried all

#

Burp Response is Extension not allowed for all

white salmon Jul 18, 2020, 4:34 PM

#

Could you show us a screenshot of your Burpsuite intruder window?

#

And a example request

pseudo hamlet Jul 18, 2020, 4:36 PM

#

📎 unknown.png

#

@white salmon

white salmon Jul 18, 2020, 4:36 PM

#

Show me a screenshot of the Request

#

any request works- as long as it's one of your intruder ones

pseudo hamlet Jul 18, 2020, 4:38 PM

#

📎 unknown.png

white salmon Jul 18, 2020, 4:40 PM

#

Hmm

valid rune Jul 18, 2020, 4:43 PM

#

i'm sort of frustrated with with learn linux last task "The flag" .. i sort of looked almost everywhere, i used the find and grep commands .. to no avail. i am the point that i don't really know what to look for. tried looking for files that are sort of strange.

trim haven Jul 18, 2020, 4:43 PM

#

@valid rune Task, question?

#

I'm presuming it's the last one

stuck fractal Jul 18, 2020, 4:43 PM

#

learn linux last task

#

Task 43, only one question

trim haven Jul 18, 2020, 4:44 PM

#

Oops myb

valid rune Jul 18, 2020, 4:44 PM

#

@trim haven yes it is.

trim haven Jul 18, 2020, 4:44 PM

#

Have you been looking for files which are owned by specific users, which are also strange

white salmon Jul 18, 2020, 4:45 PM

#

@pseudo hamlet Try re-intercepting a file request again, and re-do the intruder setup

valid rune Jul 18, 2020, 4:45 PM

#

hmmmm i did lots of things .. i am at the point i forgot what i did.

trim haven Jul 18, 2020, 4:46 PM

#

If you could detail any commands you used and send them in spoiler text, I can nudge you to getting the correct command

stuck fractal Jul 18, 2020, 4:48 PM

#

I've seen payload encoding mess with it before. If it's on, turn it off and vice versa @pseudo hamlet

white salmon Jul 18, 2020, 4:49 PM

#

Oh right, I forgot about that too

valid rune Jul 18, 2020, 4:49 PM

#

i did use ||find|| , ||grep|| and ||ls|| and|| ls -al|| aloott

white salmon Jul 18, 2020, 4:49 PM

#

You can tell if encoding is on by looking at the Request of one of your attacks

trim haven Jul 18, 2020, 4:50 PM

#

No the commands, || find / [flag] [flag] [flag] ||

bronze ivy Jul 18, 2020, 4:51 PM

#

i did use ||find|| , ||grep|| and ||ls|| and|| ls -al|| aloott
@valid rune The task already says where the flag is, you have to look for a way to escalate

trim haven Jul 18, 2020, 4:51 PM

#

It does not

bronze ivy Jul 18, 2020, 4:52 PM

#

There's one flag on this machine and it's in /root/root.txt

trim haven Jul 18, 2020, 4:52 PM

#

You have to priv esc to get to it

bronze ivy Jul 18, 2020, 4:52 PM

#

It's a really easy way btw, just google a little

trim haven Jul 18, 2020, 4:52 PM

#

And I'm helping Crowsy find out what they need to do to priv esc.

valid rune Jul 18, 2020, 4:53 PM

#

by ||[flag]|| did you mean the command ||flag|| or the the answer which is the ||flag|| ?

trim haven Jul 18, 2020, 4:53 PM

#

By flag I mean, you can't just type find and expect it to do things, you have to give the command some flags etc to work look specifically.

valid rune Jul 18, 2020, 4:53 PM

#

i also never used google for this .. i'm trying finding out through the write ups and with in terminal manuals.

stuck fractal Jul 18, 2020, 4:54 PM

#

Use google for command documentation and examples too

trim haven Jul 18, 2020, 4:54 PM

#

You can easily find out through write-ups so if you're really using write-ups you're not trying hard enough

wraith tapir Jul 18, 2020, 4:54 PM

#

in Overpass,i ||Understood how the api works|| and what does it do , but i dont understand how to go further

stuck fractal Jul 18, 2020, 4:54 PM

#

Jabba, if you learn something from the write-up then you're fine

valid rune Jul 18, 2020, 4:54 PM

#

i did use ||find /* | grep ||

stuck fractal Jul 18, 2020, 4:54 PM

#

Don't do that

#

Find can do all the filtering you need

#

Don't pipe find to grep

#

You want to look for files belonging to each user, one by one

trim haven Jul 18, 2020, 4:55 PM

#

You may want to re-read the find section and or google

stuck fractal Jul 18, 2020, 4:55 PM

#

There's a flag for find to check the owner

#

@wraith tapir you don't have a username or password. You want to get in. It's not SQLi. Keeping working through the top 10 that's been covered so far

wraith tapir Jul 18, 2020, 4:57 PM

#

Aight i think that will do thanks

pseudo hamlet Jul 18, 2020, 4:57 PM

#

done Ty

valid rune Jul 18, 2020, 4:57 PM

#

hmmmm will try that again .. thanks guys.

#

i did go through the find task extensively .. but i guess i'm missing something

stuck fractal Jul 18, 2020, 4:58 PM

#

There's a whole room dedicated to the find command

valid rune Jul 18, 2020, 4:58 PM

#

yaahh i didn't get to that room yet

#

i'm following the learning path.

stuck fractal Jul 18, 2020, 5:00 PM

#

You're not locked in to that

#

You can take a break, do some rooms to build up your skills, and come back

sick sun Jul 18, 2020, 5:02 PM

#

need help overpass room

stuck fractal Jul 18, 2020, 5:03 PM

#

Help or a hint?

valid rune Jul 18, 2020, 5:04 PM

#

well i guess i'm going to do that. just going to try it this hour and if i couldn't .. i'll go to other rooms to build up my skill. but this is pretty very useful. i feel like i can use linux finally. i have tried soo many times in the past, i just couldn't.

bronze ivy Jul 18, 2020, 5:04 PM

#

try harder

sick sun Jul 18, 2020, 5:04 PM

#

hint, im stuck on started

bronze ivy Jul 18, 2020, 5:05 PM

#

It's totally ok spending a lot of time and being stuck

well i guess i'm going to do that. just going to try it this hour and if i couldn't .. i'll go to other rooms to build up my skill. but this is pretty very useful. i feel like i can use linux finally. i have tried soo many times in the past, i just couldn't.
@valid rune

sick sun Jul 18, 2020, 5:05 PM

#

find some ||/api|| but response is ||404 page||

bronze ivy Jul 18, 2020, 5:05 PM

#

It's part of infosec

stuck fractal Jul 18, 2020, 5:06 PM

#

find some ||/api|| but response is ||404 page||
@sick sun you're going to have to go learn about APIs then.

valid rune Jul 18, 2020, 5:06 PM

#

@bronze ivy usually in these cases i give up .. but this time i feel like it's a challenge and i need to solve it.

sick sun Jul 18, 2020, 5:09 PM

#

@stuck fractal so im on wrong path ?

stuck fractal Jul 18, 2020, 5:09 PM

#

I'm not going to answer that

#

But learn what an API is.

sick sun Jul 18, 2020, 5:11 PM

#

ok, i will learning again

marble dagger Jul 18, 2020, 5:34 PM

#

need a hint/sanity check on overpass. I'm looking at something, but I don't know if I'm in a deep rabbit hole

stuck fractal Jul 18, 2020, 5:39 PM

#

I didn't build any real rabbit holes in, so chances are it's either one you've dug yourself or it's the right way

merry helm Jul 18, 2020, 5:42 PM

#

I'm stuck for some time in Overpass, I'll go back a few steps in learning, do not know how to proceed ...

marble dagger Jul 18, 2020, 5:43 PM

#

maybe I need to take a break on overpass. I'm tunnel visioned. values won't change, just by starring at them, I guess 😄

odd panther Jul 18, 2020, 5:53 PM

#

can help with overpass as far as user.. Still working it haha

#

hints tho, can't tell you how

#

Also any hints for root priv esc please pm me 🙂

stuck fractal Jul 18, 2020, 5:55 PM

#

Also any hints for root priv esc please pm me 🙂
@odd panther How much enumeration have you done?

#

Because you should find something pretty quick

odd panther Jul 18, 2020, 5:55 PM

#

about 5 hours now...

stuck fractal Jul 18, 2020, 5:55 PM

#

Try some enum scripts

odd panther Jul 18, 2020, 5:56 PM

#

I'm still not close haha, normally not an issue with linux priv esc, I am jsut lost on this one, I am obviously missing it totally and i bet its staring me in the face. I will do more tho, I would assume a suid trick

#

My issue is this is the first box, I've not had the users password for things like sudo -l, so its throwing me off until I know more.

#

also thanks for the box too @stuck fractal is very good

stuck fractal Jul 18, 2020, 5:58 PM

#

It's not suid but you can get the user password

#

I won't tell you how, but once you've got a shell it's not that hard

odd panther Jul 18, 2020, 5:58 PM

#

oh? Ok, I will work on that first then thank

merry helm Jul 18, 2020, 5:58 PM

#

can help with overpass as far as user.. Still working it haha
@odd panther Do you mind going private and giving me a light?

odd panther Jul 18, 2020, 5:58 PM

#

na that's great i did not think i could, thank you.

#

Has something happened to the box? yesterday it was great, today can't even get ssh login (works but VERY slow) still waiting on the login...

stuck fractal Jul 18, 2020, 6:05 PM

#

You don't share instances here

#

So nothing has happened to the box

odd panther Jul 18, 2020, 6:05 PM

#

was lighting last night

stuck fractal Jul 18, 2020, 6:05 PM

#

It's a little slower if you're not a subscriber

odd panther Jul 18, 2020, 6:05 PM

#

oh..

#

ok

#

its so bad, i type "wget" and have to wait for it (20secs) to display lol

stuck fractal Jul 18, 2020, 6:19 PM

#

I've asked skidy to bump the resources

#

Nothing more I can do

white salmon Jul 18, 2020, 6:19 PM

#

@stuck fractal others including me are having issues with overpass, dk why it is laggy af and after 4-5 mins the box stops responding

odd panther Jul 18, 2020, 6:20 PM

#

Its ok changing vm also to test

stuck fractal Jul 18, 2020, 6:20 PM

#

Literally just answered that

#

be a subscriber

#

Problem solved

#

Its ok changing vm also to test
@odd panther wat

odd panther Jul 18, 2020, 6:20 PM

#

changing vm = Virtual machines.

stuck fractal Jul 18, 2020, 6:20 PM

#

Yes

#

I know what a VM is...

odd panther Jul 18, 2020, 6:20 PM

#

then why you like wat?

#

?

stuck fractal Jul 18, 2020, 6:21 PM

#

Because I have no idea what you meant by that statement

odd panther Jul 18, 2020, 6:21 PM

#

i see

stuck fractal Jul 18, 2020, 6:22 PM

#

Please don't dump answers

upbeat wren Jul 18, 2020, 6:22 PM

#

oki sry

#

📎 image0.jpg

#

there u go

#

may i have some help with no 6 pls

stuck fractal Jul 18, 2020, 6:23 PM

#

Room, task, question

oblique cliff Jul 18, 2020, 6:23 PM

#

Screenshots not phone pictures

stuck fractal Jul 18, 2020, 6:23 PM

#

Don't take a photograph of your screen. Take a screenshot.

indigo ridge Jul 18, 2020, 6:23 PM

#

some nudge on that ||api|| thing in overpass

oblique cliff Jul 18, 2020, 6:23 PM

#

Why do people take phone pics I don’t understand

odd panther Jul 18, 2020, 6:23 PM

#

check what its doing the API and follow along the code

upbeat wren Jul 18, 2020, 6:24 PM

#

cos i cant logon to discord on da laptop

#

cos its my cousins

#

room rpburpsuite

#

task 7

#

q6

white salmon Jul 18, 2020, 6:25 PM

#

some nudge on that ||api|| thing in overpass
@indigo ridge got foothold?

indigo ridge Jul 18, 2020, 6:25 PM

#

no

white salmon Jul 18, 2020, 6:25 PM

#

api is nothing

wraith tapir Jul 18, 2020, 6:25 PM

#

Woah what

odd panther Jul 18, 2020, 6:26 PM

#

Read the api files to see what its doing

stuck fractal Jul 18, 2020, 6:26 PM

#

Read the api files to see what its doing
@odd panther ...you can't

#

The API is serverside

#

You can look at the JS

odd panther Jul 18, 2020, 6:26 PM

#

sorry the .js

wraith tapir Jul 18, 2020, 6:26 PM

#

Thats done ,Making arbitrary req

#

To the api

#

Numerous req nothing seems to work dont know what im overlooking pepehands

indigo ridge Jul 18, 2020, 6:27 PM

#

same here

odd panther Jul 18, 2020, 6:27 PM

#

When you find it you will kick yourself too

wraith tapir Jul 18, 2020, 6:27 PM

#

kekw

white salmon Jul 18, 2020, 6:27 PM

#

Its one of the owasp top 10 that have been covered

#

In the ongoing 10 day challenge

indigo ridge Jul 18, 2020, 6:28 PM

#

Its one of the owasp top 10 that have been covered
@white salmon i think it is idor

white salmon Jul 18, 2020, 6:28 PM

#

Try em see you'll get it , its one of em

wraith tapir Jul 18, 2020, 6:28 PM

#

there is not param for idor

odd panther Jul 18, 2020, 6:29 PM

#

So If i sub this box will instantly start to respond? still VERY slow rn

#

(maybe too many on it free)

wraith tapir Jul 18, 2020, 6:30 PM

#

Its not like too many tho, But your ip got less resources so it doesnt work propery some times

#

subbing would do it faster

#

Much more resources

odd panther Jul 18, 2020, 6:30 PM

#

oh i see, yes its like it now. I may just sub then, was going to anyway

#

waiting is no fun xD

📎 unknown.png

#

only a few on the box "376 users are in here"

stuck fractal Jul 18, 2020, 6:33 PM

#

That's not how boxes here work @odd panther

wraith tapir Jul 18, 2020, 6:33 PM

#

Its not like HTB

odd panther Jul 18, 2020, 6:33 PM

#

Oh single instance each?

wraith tapir Jul 18, 2020, 6:33 PM

#

yeah

odd panther Jul 18, 2020, 6:33 PM

#

ok nice, thanks.

white salmon Jul 18, 2020, 6:33 PM

#

@odd panther you can decrypt the rsa with openssl so you won't have to wait for "Enter the pass pharse" thing

odd panther Jul 18, 2020, 6:34 PM

#

i have the pass, but it still asks.

stuck fractal Jul 18, 2020, 6:34 PM

#

Yeah it will

odd panther Jul 18, 2020, 6:34 PM

#

(unless i did something wrong, ssh2john used)

stuck fractal Jul 18, 2020, 6:34 PM

#

You have to decrypt the key before you can use it

odd panther Jul 18, 2020, 6:34 PM

#

yea

stuck fractal Jul 18, 2020, 6:34 PM

#

You still need to use that passphrase

white salmon Jul 18, 2020, 6:34 PM

#

yeah

odd panther Jul 18, 2020, 6:34 PM

#

yeah i was

thorny nest Jul 18, 2020, 6:35 PM

#

With overpass privesc, do I need to pivot to a different user to gain root or is there an easier way?

odd panther Jul 18, 2020, 6:35 PM

#

just box is slow, enter key wait login.... and wait... and wait... lol

stuck fractal Jul 18, 2020, 6:35 PM

#

@thorny nest https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Linux - Privilege Escalation.md

GitHub

swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

#

just box is slow, enter key wait login.... and wait... and wait... lol
@odd panther Stop complaining. I've asked skidy to add more resources. Your choice is either wait, or put up with it.

odd panther Jul 18, 2020, 6:36 PM

#

Oh I'm ever so sorry for brining up and issue, I thought this was a place of help.. My bad...

#

jesus

stuck fractal Jul 18, 2020, 6:36 PM

#

You know, it is

#

But there's nothing that can be done RN

#

So you're just whining about the same issue that is being fixed

odd panther Jul 18, 2020, 6:36 PM

#

Right well no need to be a martyr buddy.. I asked a question for help..

stuck fractal Jul 18, 2020, 6:36 PM

#

No, you complained

#

That wasn't a question

wraith tapir Jul 18, 2020, 6:37 PM

#

Oh I'm ever so sorry for brining up and issue, I thought this was a place of help.. My bad...
@odd panther Yo man just tell me ill give you the flags

odd panther Jul 18, 2020, 6:37 PM

#

ok, As you say buddy

stuck fractal Jul 18, 2020, 6:37 PM

#

Not your buddy

odd panther Jul 18, 2020, 6:37 PM

#

ok pal

stuck fractal Jul 18, 2020, 6:37 PM

#

Not your pal.

odd panther Jul 18, 2020, 6:37 PM

#

ok love

stuck fractal Jul 18, 2020, 6:37 PM

#

Stop.

tidal sedge Jul 18, 2020, 6:37 PM

#

🔨

wraith tapir Jul 18, 2020, 6:37 PM

#

👀

odd panther Jul 18, 2020, 6:38 PM

#

literally stopped lol

tidal sedge Jul 18, 2020, 6:38 PM

#

@indigo ridge There is no reason for your comment, a mod has already told them to stop

indigo ridge Jul 18, 2020, 6:38 PM

#

sorry

odd panther Jul 18, 2020, 6:38 PM

#

ok not trying to moan here, but what is the best solution for this situation?

📎 unknown.png

stuck fractal Jul 18, 2020, 6:39 PM

#

Use a correct username.

odd panther Jul 18, 2020, 6:39 PM

#

it keeps resetting, anyone else getting this too? Or am i the special one

wraith tapir Jul 18, 2020, 6:39 PM

#

redeploy

stuck fractal Jul 18, 2020, 6:39 PM

#

Your key isn't in a valid format

#

It's telling you that

odd panther Jul 18, 2020, 6:40 PM

#

it was telling me that before.. ok (and let me in) maybe why I'm confused and "moaning" as you put it.

stuck fractal Jul 18, 2020, 6:41 PM

#

No, you were complaining about the box speed

#

Which is being addressed

#

So you should be happy about that

odd panther Jul 18, 2020, 6:41 PM

#

Should I now, ok great thank you

stuck fractal Jul 18, 2020, 6:41 PM

#

Yep.

#

Glad you're satisfied.

odd panther Jul 18, 2020, 6:42 PM

#

Excellent >.<

#

Totally 🙂 (LOL)

worthy iris Jul 18, 2020, 6:50 PM

#

Permission denied (publickey) how does one go about fixing this error?

#

while trying to ssh into a machine

jolly folio Jul 18, 2020, 6:50 PM

#

Use a public key

worthy iris Jul 18, 2020, 6:50 PM

#

if you only have private?

#

how would i resolve that

#

is there a way to generate a public via a private?

odd panther Jul 18, 2020, 6:51 PM

#

I'll try later for this, do you know when it may be back to speed at all @stuck fractal Or is it a more first come first serve basis here? thanks.

jolly folio Jul 18, 2020, 6:51 PM

#

@worthy iris ssh -i /path/to/key <user>@<host>

tidal sedge Jul 18, 2020, 6:52 PM

#

@odd panther Once Skidy(one of the admins) comes online he will bump up the resources

odd panther Jul 18, 2020, 6:52 PM

#

Oh I see, ok thank you for the help. @tidal sedge

worthy iris Jul 18, 2020, 6:52 PM

#

I do that, that's how I get the error, I only have a private rsa key

jolly folio Jul 18, 2020, 6:53 PM

#

What are the permissions on the key?

worthy iris Jul 18, 2020, 6:53 PM

#

700

odd panther Jul 18, 2020, 6:53 PM

#

should be 600

#

isn't it?

jolly folio Jul 18, 2020, 6:54 PM

#

There is no reason for it to have u+x so, I'd set it to 600

worthy iris Jul 18, 2020, 6:55 PM

#

so just having the private key alone isnt enough i take it

odd panther Jul 18, 2020, 6:56 PM

#

it should be, chmod 600 key then try to use it

worthy iris Jul 18, 2020, 6:56 PM

#

same results 😦

odd panther Jul 18, 2020, 6:56 PM

#

Where is this from (what box?)

pseudo hamlet Jul 18, 2020, 7:01 PM

#

Guys need help in Vulnversity privesec

fathom jolt Jul 18, 2020, 7:02 PM

#

need some help at the overpass room can some one gimme a hint please

jolly folio Jul 18, 2020, 7:02 PM

#

It helps when you actually say what you're struggling with

fathom jolt Jul 18, 2020, 7:03 PM

#

the login page don't know what todo exactly

jolly folio Jul 18, 2020, 7:04 PM

#

I'm just going to go ahead and assume you probably need to enumerate more

odd panther Jul 18, 2020, 7:09 PM

#

the login page don't know what todo exactly
@fathom jolt What on the page do you see using Dev tools? (f12) look about

pseudo hamlet Jul 18, 2020, 7:09 PM

#

guys systemctl privesc help

oblique cliff Jul 18, 2020, 7:12 PM

#

@pseudo hamlethave you googled anything about that?

stuck fractal Jul 18, 2020, 7:13 PM

#

@odd panther Terminate, redeploy.

#

It's been bumped. You're welcome.

pseudo hamlet Jul 18, 2020, 7:14 PM

#

yes

#

i google privesec using sysctl

jolly folio Jul 18, 2020, 7:14 PM

#

@pseudo hamlet https://gtfobins.github.io/

odd panther Jul 18, 2020, 7:15 PM

#

I thank Skidy for sure, your attitude while dealing with this was more then subpar sorry to say, so much so i don't even want to sub now due to you. but THANKS...

#

You're Welcome..

jolly folio Jul 18, 2020, 7:15 PM

#

I'm going to assume that was a joke lol

stuck fractal Jul 18, 2020, 7:15 PM

#

Eh, they do nothing but complain about things that are being fixed

odd panther Jul 18, 2020, 7:16 PM

#

I came here for help tbh not to be chastised for a slow box i knew nothing of. Also I was asking, i never got an answer apart from some smart replies..

#

But still no issues, I do thank you for asking for the box to be updated. Just was not overly happy with how you spoke to me, I'll put it down to tiredness from you, I'm sure you're not this obtuse usually

#

I'll be honest, I really love thm.

stuck fractal Jul 18, 2020, 7:18 PM

#

I'm sure you don't complain this much about things that I'm actively trying to get fixed normally

odd panther Jul 18, 2020, 7:18 PM

#

but today you made me feel like i don't want to come for help lol

#

it should not be like that, your a mod to help man..

#

Ok I can see your still the same, James. Have a good day brother

jolly folio Jul 18, 2020, 7:19 PM

#

Nah, just read up.. I disagree with ya there entirely

odd panther Jul 18, 2020, 7:19 PM

#

You may disagree with me, we can't all agree.

jolly folio Jul 18, 2020, 7:19 PM

#

Anyway, off-topic for channel - convo dead

odd panther Jul 18, 2020, 7:20 PM

#

This was how i felt and you're quite right, its enough. Get cracking that box!!! (those who have not already)

jolly folio Jul 18, 2020, 7:20 PM

#

I just went through wonderland

fathom jolt Jul 18, 2020, 7:21 PM

#

@fathom jolt What on the page do you see using Dev tools? (f12) look about
@odd panther did it but didn't found any thing

odd panther Jul 18, 2020, 7:21 PM

#

Where are you looking? Like see... how is the page loaded. What's being loaded, scripts etc, this is a good start on any box

#

Also I'll be honest, I'm a noob too, been at this 35days now lol so a lot to learn (why i ask here)

fathom jolt Jul 18, 2020, 7:23 PM

#

I didi and found that the passwords are encrypted in ||rot47|| but don't know where is || the file with encrypted passwords .. ||

odd panther Jul 18, 2020, 7:23 PM

#

I will mess things up I will ask

#

what box are you on?

rapid flower Jul 18, 2020, 7:23 PM

#

Help with initial foothold in overpass... I know something is in l****.js but what... Idk... Some hints needed

odd panther Jul 18, 2020, 7:24 PM

#

Read the .js files, learn how it works. (its all we can really say at this stage)

rapid flower Jul 18, 2020, 7:24 PM

#

It's the f**** function... I'm not understanding

white salmon Jul 18, 2020, 7:25 PM

#

|| authentication is broken ||

odd panther Jul 18, 2020, 7:25 PM

#

I don't think I can say more, its upto the mods here to help more, I feel If i give more its too much

worn yew Jul 18, 2020, 7:42 PM

#

I'm in Owasp to 10 today's task(day 6 - task 20) and I googled about pensive notes but unable to find the documentation

#

Anyone got anything?

odd panther Jul 18, 2020, 7:43 PM

#

O.o not even checked todays out!

#

Day 7 is not out yet?

lyric scarab Jul 18, 2020, 7:44 PM

#

day 6

worn yew Jul 18, 2020, 7:44 PM

#

Thanks changed it

odd panther Jul 18, 2020, 7:46 PM

#

Working now, wish the customers would hurry up so I can get back to the box's xD

worn yew Jul 18, 2020, 7:46 PM

#

yeah web app is running pensive notes which might have default creds but no luck by trying admin -admin but hint says look to documentation but no luck in finding it

lyric scarab Jul 18, 2020, 7:47 PM

#

What is the first question of the hint ?

white salmon Jul 18, 2020, 7:47 PM

#

app source code

odd panther Jul 18, 2020, 7:48 PM

#

this is gold: https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A6-Security_Misconfiguration

A6:2017-Security Misconfiguration on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.

worn yew Jul 18, 2020, 7:51 PM

#

No idea

halcyon citrus Jul 18, 2020, 7:52 PM

#

owasp day 6 . app source code ,,, any hints for that ?

worn yew Jul 18, 2020, 7:53 PM

#

Stuck on the same

stuck fractal Jul 18, 2020, 7:56 PM

#

What's a common website used to share source code for open source projects?

#

Google doesn't index everything

digital bolt Jul 18, 2020, 7:57 PM

#

Hi, does anyome know how to replace firstName name also with any ENTITY ??
<!DOCTYPE replace [<!ENTITY name "Test"> ]>
<userInfo>
<firstName>falcon</firstName>
<lastName>&name;</lastName>
</userInfo>

#

Also, want to run other system command like id,ls,ps but they are not working on https://tryhackme.com/room/owasptop10
Used this but no result:-
<?xml version=”1.0″ encoding=”utf-8″?>
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM “expect://id” >]>
<root>
<name>&xxe;</name>
</root>

TryHackMe

TryHackMe | OWASP Top 10

Learn one of the OWASP vulnerabilities every day for 10 days in a row.

stuck fractal Jul 18, 2020, 8:02 PM

#

Doesn't that assume expect is enabled?

rapid flower Jul 18, 2020, 8:03 PM

#

Wrong chat😅

odd panther Jul 18, 2020, 8:03 PM

#

ok in to the site. again read the code lol

digital bolt Jul 18, 2020, 8:05 PM

#

ok so expect is not enabled then, but if yes than this should work ? another example :- <?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY read SYSTEM 'expect://id'>]>
<root>&read;</root>

spice stream Jul 18, 2020, 8:05 PM

#

What's a common website used to share source code for open source projects?
@stuck fractal Well played

stuck fractal Jul 18, 2020, 8:09 PM

#

Try not to spoil it

rapid flower Jul 18, 2020, 8:10 PM

#

This was damnnnn dirtyyyyy😂😂😂😂😂😂😂😂

random thunder Jul 18, 2020, 8:11 PM

#

Try not to spoil it
@stuck fractal that spoiled the fun for me i finally got it 😆

white salmon Jul 18, 2020, 8:13 PM

#

lol i didn't read the readme and got straight to the database and tried to crack that PW with rockyou - without success

rapid flower Jul 18, 2020, 8:13 PM

#

lol i didn't read the readme and got straight to the database and tried to crack that PW with rockyou - without success
@white salmon
I was going to do the same

white salmon Jul 18, 2020, 8:15 PM

#

Therefore reminder: RTFM!

rapid flower Jul 18, 2020, 8:18 PM

#

I am suspecting... If the same solution is for overpass initial foothold🤔

stuck fractal Jul 18, 2020, 8:23 PM

#

Nope.

marble moat Jul 18, 2020, 8:24 PM

#

Anyone getting anything from the source code of the webapp for day 6??

stuck fractal Jul 18, 2020, 8:24 PM

#

What's a common website used to share source code for open source projects?
@stuck fractal

odd panther Jul 18, 2020, 8:25 PM

#

I can't even find it on there, need better google fu

stuck fractal Jul 18, 2020, 8:26 PM

#

Don't use google

#

Google doesn't index everything

odd panther Jul 18, 2020, 8:26 PM

#

Oh god you really know how to mess me up James haha

oblique cliff Jul 18, 2020, 8:27 PM

#

Don't use google
@stuck fractal
That’s a first

stuck fractal Jul 18, 2020, 8:27 PM

#

Second.

#

It applied in Advent Of Cyber too

marble moat Jul 18, 2020, 8:27 PM

#

@stuck fractal I used developer options to see the HTML code but I'm not getting anything in it

stuck fractal Jul 18, 2020, 8:27 PM

#

You're looking for serverside information by viewing client-side code?

oblique cliff Jul 18, 2020, 8:27 PM

#

That fact that you actually know the count is impressive enough

odd panther Jul 18, 2020, 8:28 PM

#

oh so we can enum? I've only been using the dev tools lol

stuck fractal Jul 18, 2020, 8:28 PM

#

Do what you want with the VM and webapp, but there's an intended solution

odd panther Jul 18, 2020, 8:29 PM

#

I would rather go intended, I'm here to learn, if not very slowly. I mean its intended for a reason so I should aim for it

marble moat Jul 18, 2020, 8:29 PM

#

@stuck fractal well I thought it was similar to the day 3 one

stuck fractal Jul 18, 2020, 8:29 PM

#

@odd panther Have you seen the hint I've given?

white salmon Jul 18, 2020, 8:29 PM

#

you can google open source community

odd panther Jul 18, 2020, 8:30 PM

#

no... but let me stare at your words for a while, I bet its obv too.. thank you again

stuck fractal Jul 18, 2020, 8:31 PM

#

What's a common website used to share source code for open source projects?

odd panther Jul 18, 2020, 8:31 PM

#

yeah i know, but i can't find this on it

merry helm Jul 18, 2020, 8:31 PM

#

Closed room, thank you to the colleague @odd panther who assisted me in the first steps.

odd panther Jul 18, 2020, 8:31 PM

#

Da man! Good job!

stuck fractal Jul 18, 2020, 8:31 PM

#

I can confirm you can find it

#

Don't have to be signed in or anything

merry helm Jul 18, 2020, 8:32 PM

#

A good challenge, I learned new things, thank you @stuck fractal

sinful badger Jul 18, 2020, 8:32 PM

#

I am doing the Blue Primer Networking room but I am stuck on this problem, can someone please give me a hint:

stuck fractal Jul 18, 2020, 8:32 PM

#

Please don't show answers

sinful badger Jul 18, 2020, 8:32 PM

#

Sorry it was part of a two part question

#

Let me try again

stuck fractal Jul 18, 2020, 8:32 PM

#

The second is similar to the first

odd panther Jul 18, 2020, 8:33 PM

#

ok thank you. (i've not done any enum thought it was not ok for this one, doing now)

sinful badger Jul 18, 2020, 8:33 PM

#

📎 unknown.png

stuck fractal Jul 18, 2020, 8:33 PM

#

https://superuser.com/questions/905660/what-other-ip-addresses-can-should-i-use-for-my-home-network

Super User

What other IP addresses can/should I use for my home network?

I've been using 192.168.1.x for my home network, which has been perfectly happy for quite some time. However, I just started a new job, and they use the same set of IP addresses when I connect over...

valid rune Jul 18, 2020, 8:33 PM

#

is it a bad habit if i always used pipe and grip after find to find certain files ? (because apparently i don't know how to use find properly)

stuck fractal Jul 18, 2020, 8:33 PM

#

Yes

#

find / -iname "*someSubString*" 2>/dev/null is a really useful command to understand

sinful badger Jul 18, 2020, 8:35 PM

#

https://superuser.com/questions/905660/what-other-ip-addresses-can-should-i-use-for-my-home-network
@stuck fractal None of the answers/comments shown have a format of xxx.xxx.x.x that I need to answer the problem

Super User

What other IP addresses can/should I use for my home network?

I've been using 192.168.1.x for my home network, which has been perfectly happy for quite some time. However, I just started a new job, and they use the same set of IP addresses when I connect over...

valid rune Jul 18, 2020, 8:35 PM

#

hmmmm ... yahh i don't seem to understand that who line you just wrote

#

that whole*

stuck fractal Jul 18, 2020, 8:35 PM

#

@stuck fractal None of the answers/comments shown have a format of xxx.xxx.x.x that I need to answer the problem
@sinful badger Eh, I found various answers in there. And with a few google searches

#

@valid rune -iname is for case insensitive

odd panther Jul 18, 2020, 8:35 PM

#

@stuck fractal also sorry for my attitude earlier.

stuck fractal Jul 18, 2020, 8:35 PM

#

Apology accepted

glossy basin Jul 18, 2020, 8:37 PM

#

aww, that's sweet

white salmon Jul 18, 2020, 8:39 PM

#

@sinful badger Have you ever set up a network for your home or business before?

stuck fractal Jul 18, 2020, 8:40 PM

#

I just realised how much of a hint I gave in the room text on Day 6

#

And a hint on the question

white salmon Jul 18, 2020, 8:40 PM

#

~~That's assuming people actually read the room/task text~~

random thunder Jul 18, 2020, 8:41 PM

#

any other hints for Overpass challenge 😐

sinful badger Jul 18, 2020, 8:42 PM

#

The answers seem to say these are the three ranges:
192.168.0.0 - 192.168.255.255
172.16.0.0 - 172.31.255.255
10.0.0.0 - 10.255.255.255

stuck fractal Jul 18, 2020, 8:42 PM

#

Yep

sinful badger Jul 18, 2020, 8:42 PM

#

Unless the answer is 192.168.x.x

stuck fractal Jul 18, 2020, 8:42 PM

#

It's not asking for a range though

#

It's asking for a single network

sinful badger Jul 18, 2020, 8:42 PM

#

second common private home range

stuck fractal Jul 18, 2020, 8:42 PM

#

Ok well that's misleading but yeah

#

It's looking for a network

#

@inland onyx Could I get you to fix that on BP networking?

marble moat Jul 18, 2020, 8:43 PM

#

Okay I think I'm just dumb then

stuck fractal Jul 18, 2020, 8:43 PM

#

I mean it's fairly close to the first

sinful badger Jul 18, 2020, 8:43 PM

#

192.168.x.x doesn't work when I put it in the answer though

white salmon Jul 18, 2020, 8:44 PM

#

Yeah, that question is kinda weird

stuck fractal Jul 18, 2020, 8:44 PM

#

192.168.x.x doesn't work when I put it in the answer though
@sinful badger Nope, because that's not how you denote a network

#

Typically, 192.168.x.0/24 is used, so only the last octet will change

#

So logically, the next one up from the answer before

sinful badger Jul 18, 2020, 8:45 PM

#

192.168.x.0 does not seem to work either

white salmon Jul 18, 2020, 8:45 PM

#

You're close- stop being too broad and be more specific

stuck fractal Jul 18, 2020, 8:45 PM

#

Nope, because you put an x in there

#

That's not how you write a network, properly.

white salmon Jul 18, 2020, 8:46 PM

#

I just wanted to say thanks to @odd panther and @stuck fractal for the hints in their convo about today's OWASP challange. For such an easy one, it took me down some weird paths. 😅 Cheers!

#

It's asking for the second most common IP network configuration basically

sinful badger Jul 18, 2020, 8:47 PM

#

@stuck fractal @white salmon Thanks, I got the answer now

white salmon Jul 18, 2020, 8:47 PM

#

Awesome!

random thunder Jul 18, 2020, 8:47 PM

#

any other hints for Overpass challenge 😐

white salmon Jul 18, 2020, 8:47 PM

#

Glad you found it :D

stuck fractal Jul 18, 2020, 8:48 PM

#

any other hints for Overpass challenge 😐
@random thunder Where have you got so far?

random thunder Jul 18, 2020, 8:48 PM

#

@random thunder Where have you got so far?
@stuck fractal able to run the executable on my machine but unsure about the service parameter 😐

stuck fractal Jul 18, 2020, 8:49 PM

#

You created your own rabbit hole

#

Also, don't run random binaries on your own machine

#

Unless you've RE'd them

random thunder Jul 18, 2020, 8:51 PM

#

Iam stuck and i have no clue where to proceed now

stuck fractal Jul 18, 2020, 8:53 PM

#

It's an OWASP top 10 web vuln

#

That's in the hints

#

So maybe some more web enumeration would help you out here?

odd panther Jul 18, 2020, 8:53 PM

#

@stuck fractal able to run the executable on my machine but unsure about the service parameter 😐
@random thunder I thought that was actually a rabbit hole, I could not get any sense but also I am bad a RE on ELF

stuck fractal Jul 18, 2020, 8:53 PM

#

I mean you're given the source code lol

odd panther Jul 18, 2020, 8:54 PM

#

I don't know the language 😦 haha but your right I only need to learn more

stuck fractal Jul 18, 2020, 8:54 PM

#

It's a rabbit hole, but one that you throw yourself into

#

It reads like most curly brace languages

keen willow Jul 18, 2020, 9:01 PM

#

It reads like most curly brace languages
@stuck fractal here comes a new defenition, lol

stuck fractal Jul 18, 2020, 9:01 PM

#

wat

keen willow Jul 18, 2020, 9:02 PM

#

thought, you were talking abt ||.js|| isn't that ?

stuck fractal Jul 18, 2020, 9:02 PM

#

No

#

But Go and JS are both curly brace languages

#

They have a similar structure

keen willow Jul 18, 2020, 9:02 PM

#

fish, but thats fits on that too.

stuck fractal Jul 18, 2020, 9:03 PM

#

here comes a new defenition, lol no idea what you mean tho

odd panther Jul 18, 2020, 9:06 PM

#

I have to learn how to make a shell in go with the ability to upload and download files.. I don't know go.. so that will be fun

#

reverseshell sorry

stuck fractal Jul 18, 2020, 9:06 PM

#

~~If it's for overpass, you really don't~~

odd panther Jul 18, 2020, 9:06 PM

#

for Mcsi training

rapid flower Jul 18, 2020, 9:07 PM

#

I searched about... ||fetch function|| anf the entire ||login.js|| appears to be the intended way for login... What is the loophole here

stuck fractal Jul 18, 2020, 9:08 PM

#

It's an OWASP top 10 web vuln that's been covered in the first 3 days

valid bough Jul 18, 2020, 9:18 PM

#

any hint for privesc on overpass?

stuck fractal Jul 18, 2020, 9:18 PM

#

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Linux - Privilege Escalation.md

GitHub

swisskyrepo/PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF - swisskyrepo/PayloadsAllTheThings

valid bough Jul 18, 2020, 9:20 PM

#

tnx

random thunder Jul 18, 2020, 9:37 PM

#

any hints on how to access the machine to run the code? @stuck fractal

odd panther Jul 18, 2020, 9:37 PM

#

Them feels

📎 unknown.png

trim haven Jul 18, 2020, 9:37 PM

#

dont @ james anyone can help you

stuck fractal Jul 18, 2020, 9:38 PM

#

You're fixating on the code @random thunder

odd panther Jul 18, 2020, 9:38 PM

#

Thank you to @merry helm r and @stuck fractal for the help

stuck fractal Jul 18, 2020, 9:38 PM

#

Stop fixating on the code

random thunder Jul 18, 2020, 9:38 PM

#

Okay.

valid rune Jul 18, 2020, 9:39 PM

#

Flag 3 is located where bob's bash history gets stored. and Flag 4 is located where cron jobs are created. require privesc, right ?

white salmon Jul 18, 2020, 9:39 PM

#

No

stuck fractal Jul 18, 2020, 9:39 PM

#

404 users Nice

white salmon Jul 18, 2020, 9:40 PM

#

@valid rune You have to find where these locations are, and then the flag.txt will be located inside of them.

stuck fractal Jul 18, 2020, 9:41 PM

#

Or the flag will be text inside those files

valid rune Jul 18, 2020, 9:41 PM

#

i tried with bob's bash history, but it required privs

#

same as crontabs .. they require privs

trim haven Jul 18, 2020, 9:42 PM

#

They don't

#

You're looking in the wrong area

#

You can view the history by typing one word

valid rune Jul 18, 2020, 9:43 PM

#

📎 priv.PNG

stuck fractal Jul 18, 2020, 9:44 PM

#

Wrong place

plucky steppe Jul 18, 2020, 9:55 PM

#

Hey everyone, I am stuck on Day 6 of OWASP Top 10 challenge. I have looked through the page source and found a comment ||js/cookie.js|| I tried to use ||github|| to look for the application name and also the javascript but could not find anything. I am not sure if I missed something or I overlooked it.

white salmon Jul 18, 2020, 9:56 PM

#

Hey everyone, I am stuck on Day 6 of OWASP Top 10 challenge. I have looked through the page source and found a comment ||js/cookie.js|| I tried to use ||github|| to look for the application name and also the javascript but could not find anything. I am not sure if I missed something or I overlooked it.
@plucky steppe you were looking in the right place on one of those

rapid flower Jul 18, 2020, 9:57 PM

#

Any alternative for sudo -l???

#

That does not ask me for a password

plucky steppe Jul 18, 2020, 9:59 PM

#

@white salmon hmm interesting is the source code that the hint talk about for the ||js-cookie v3.0.0-beta.4||?

tropic flame Jul 18, 2020, 9:59 PM

#

@rapid flower There's other tools you can use such as linpeas to enumerate for potential privilege escalation opportunities.

rapid flower Jul 18, 2020, 10:00 PM

#

@rapid flower There's other tools you can use such as linpeas to enumerate for potential privilege escalation opportunities.
@tropic flame
Is that possible on ||overpass||

frank lagoon Jul 18, 2020, 10:00 PM

#

Hello everyone! Can someone give me a hint? I am stuck at security configuration from the OWASP top 10 room

crystal saffron Jul 18, 2020, 10:01 PM

#

@white salmon hmm interesting is the source code that the hint talk about for the ||js-cookie v3.0.0-beta.4||?
@plucky steppe I cloned this repo and I did not find any default credentials 😩

tropic flame Jul 18, 2020, 10:01 PM

#

@rapid flower yes, you would have to serve up a local server and use wget to get it, but it's not needed on Overpass.

rapid flower Jul 18, 2020, 10:01 PM

#

Okay

#

Will look for some other way

frank lagoon Jul 18, 2020, 10:02 PM

#

Anyone can that can help me?

white salmon Jul 18, 2020, 10:02 PM

#

@frank lagoon Could you give a little more information about what you're stuck on and what you've done already?

#

@crystal saffron dont really want to reveal the ans in here. Theres a massive hint slightly earlier in this chat 👍

frank lagoon Jul 18, 2020, 10:03 PM

#

@white salmon sure

#

So I tried to look at the source code, found that it looks for a cookie with a value, I changed that value and the server tought that I was a user, it sent me to /mynotes/. I tried to create a note --> didn't work.

#

Tried directory bruteforcing, logging in via ssh with default creds, tried default creds on the web login form @white salmon

cedar coral Jul 18, 2020, 10:08 PM

#

can i dm some one about overpass?

solemn smelt Jul 18, 2020, 10:08 PM

#

no need for dm just send your question here

white salmon Jul 18, 2020, 10:08 PM

#

You're looking in the wrong place @frank lagoon

buoyant grove Jul 18, 2020, 10:08 PM

#

can i dm some one about overpass?
@cedar coral yeah

frank lagoon Jul 18, 2020, 10:09 PM

#

Yep that's what I tought

#

I readed most of the js files

plucky steppe Jul 18, 2020, 10:10 PM

#

I am very lost now I am still trying to look at ||github|| but cannot find anything that seems as a security misconfiguration

stuck fractal Jul 18, 2020, 10:13 PM

#

The text in the OWASP room tells you exactly what the vulnerability is

frank lagoon Jul 18, 2020, 10:14 PM

#

Am I looking at the right place? Path: /api/note/list

stuck fractal Jul 18, 2020, 10:14 PM

#

Still no

buoyant grove Jul 18, 2020, 10:14 PM

#

fork:can't allocate memory 🙂 @stuck fractal

stuck fractal Jul 18, 2020, 10:14 PM

#

Check the hint in the room

#

@buoyant grove Wasn't me.

buoyant grove Jul 18, 2020, 10:14 PM

#

Overpass *

frank lagoon Jul 18, 2020, 10:15 PM

#

I already did it

odd panther Jul 18, 2020, 10:15 PM

#

@buoyant grove keep trying i had that, but wait in between

#

it will work for you

stuck fractal Jul 18, 2020, 10:15 PM

#

@frank lagoon So you know from the hint in the room that you need to find the source code

buoyant grove Jul 18, 2020, 10:15 PM

#

it will work for you
@odd panther okay thxx

frank lagoon Jul 18, 2020, 10:15 PM

#

Yes from cookie.js?

stuck fractal Jul 18, 2020, 10:15 PM

#

no

white salmon Jul 18, 2020, 10:15 PM

#

Once you have the source code credentials are in plain text

stuck fractal Jul 18, 2020, 10:15 PM

#

The source code

#

Not clientside JS

frank lagoon Jul 18, 2020, 10:15 PM

#

How?

#

I can't find anything related to that app that is installed

plucky steppe Jul 18, 2020, 10:16 PM

#

I think it is ||cookie.js|| am I right?

stuck fractal Jul 18, 2020, 10:17 PM

#

No

#

Find the source code

#

It's an open source program

frank lagoon Jul 18, 2020, 10:17 PM

#

Pensive notes?

plucky steppe Jul 18, 2020, 10:17 PM

#

@white salmon use the double pipes

frank lagoon Jul 18, 2020, 10:18 PM

#

Thanks MrRobot

white salmon Jul 18, 2020, 10:18 PM

#

|| there is a place where people upload source code ||

buoyant grove Jul 18, 2020, 10:18 PM

#

Lmao

frank lagoon Jul 18, 2020, 10:18 PM

#

|| github? ||

odd panther Jul 18, 2020, 10:18 PM

#

I finally get it, the other place to search, I see why you said the hint about indexing now...

rapid flower Jul 18, 2020, 10:19 PM

#

@odd panther does that allow to prevent indexing from web searches?

plucky steppe Jul 18, 2020, 10:19 PM

#

@frank lagoon I dont think its that

stuck fractal Jul 18, 2020, 10:19 PM

#

No

#

Google just doesn't index everything

odd panther Jul 18, 2020, 10:19 PM

#

This ^^

#

no cigar

#

for you

stuck fractal Jul 18, 2020, 10:20 PM

#

What's a common website used to share source code for open source projects?

#

I'll keep giving out this hint

frank lagoon Jul 18, 2020, 10:20 PM

#

Webserver hosts it?

stuck fractal Jul 18, 2020, 10:21 PM

#

No

marble moat Jul 18, 2020, 10:21 PM

#

Bitbucket?

stuck fractal Jul 18, 2020, 10:21 PM

#

What's a common website used to share source code for open source projects?
@stuck fractal Literally this is all you need

odd panther Jul 18, 2020, 10:22 PM

#

Bitbucket?
@marble moat that still a thing?

marble moat Jul 18, 2020, 10:22 PM

#

😭😭

desert thorn Jul 18, 2020, 10:23 PM

#

Thanks @stuck fractal for the hint -- fully agreed with what you said -- it's literally the only hint that's needed... 🙂

tall rover Jul 18, 2020, 10:23 PM

#

@stuck fractal Literally this is all you need
You can even put it like this into google 🤣

stuck fractal Jul 18, 2020, 10:23 PM

#

You need more than just google

#

But yeah

odd panther Jul 18, 2020, 10:24 PM

#

I can learn from that, thank you. Its in golang!

tall rover Jul 18, 2020, 10:24 PM

#

I meant your hint/question 😛

white salmon Jul 18, 2020, 10:26 PM

#

Common website for source code for projects

frank lagoon Jul 18, 2020, 10:26 PM

#

To download?

stuck fractal Jul 18, 2020, 10:26 PM

#

To share.

frank lagoon Jul 18, 2020, 10:27 PM

#

Does the domainname start with 'opensource'?

tall rover Jul 18, 2020, 10:28 PM

#

@frank lagoon You're not gonna bruteforce-ask the domain name now are you? 🤣

frank lagoon Jul 18, 2020, 10:28 PM

#

Hahaha

#

Lol, google doesn't help

marble moat Jul 18, 2020, 10:28 PM

#

Something to do with mit license?

odd panther Jul 18, 2020, 10:29 PM

#

This is pain, I want to help you so bad but can't.. hammers etc haha

#

your all so close to 😦

strong laurel Jul 18, 2020, 10:29 PM

#

Thanks for the hint @stuck fractal

marble moat Jul 18, 2020, 10:29 PM

#

This is pain, I want to help you so bad but can't.. hammers etc haha
@odd panther tried etc/shadow 😭😭😭

frank lagoon Jul 18, 2020, 10:30 PM

#

|| Sourceforge? ||

odd panther Jul 18, 2020, 10:30 PM

#

/etc/shadow never works for me ( i mean not been a good priv esc as usually locked down)

#

I'm sure there are ways tho

worn yew Jul 18, 2020, 10:31 PM

#

Open source repo

stuck fractal Jul 18, 2020, 10:32 PM

#

tried etc/shadow 😭😭😭
@marble moat Seriously, try some privesc enumeration scripts

#

Or check the room tags and the checklist I keep linking

frank lagoon Jul 18, 2020, 10:32 PM

#

|| SourceRepo? ||

stuck fractal Jul 18, 2020, 10:33 PM

#

You're thinking of tiny things

#

Think bigger

frank lagoon Jul 18, 2020, 10:33 PM

#

Can you give another hint?

stuck fractal Jul 18, 2020, 10:34 PM

#

No

#

I've given plenty of hints

worn yew Jul 18, 2020, 10:34 PM

#

You try every answer posted here

#

Might find it

stuck fractal Jul 18, 2020, 10:34 PM

#

https://en.wikipedia.org/wiki/Comparison_of_source-code-hosting_facilities have fun

Comparison of source-code-hosting facilities

A source-code repository is a file archive and web hosting facility for source code of software, documentation, web pages, and other works, accessible either publicly or privately. They are often used by open-source software projects and other multi-developer projects to maint...

worn yew Jul 18, 2020, 10:35 PM

#

James any hint on This - #room-help message

stuck fractal Jul 18, 2020, 10:35 PM

#

Wait for a response

worn yew Jul 18, 2020, 10:35 PM

#

Ok

tall rover Jul 18, 2020, 10:36 PM

#

https://en.wikipedia.org/wiki/Comparison_of_source-code-hosting_facilities have fun
@white salmon James just listed quite a lot

Comparison of source-code-hosting facilities

A source-code repository is a file archive and web hosting facility for source code of software, documentation, web pages, and other works, accessible either publicly or privately. They are often used by open-source software projects and other multi-developer projects to maint...

white salmon Jul 18, 2020, 10:37 PM

#

@white salmon James just listed quite a lot
@tall rover just seen 👍

frank lagoon Jul 18, 2020, 10:40 PM

#

Source code hosting? || Assembla || If that was incorrect then I will try everything on that list (litle bruteforce)

stuck fractal Jul 18, 2020, 10:40 PM

#

You need to put the work in yourself

#

You've used it before

frank lagoon Jul 18, 2020, 10:41 PM

#

I will complete it later

strong laurel Jul 18, 2020, 10:44 PM

#

@frank lagoon it is most likely the first place that comes to mind when talking bout opensource projects

frank lagoon Jul 18, 2020, 10:45 PM

#

|| Github, gitlab, sourceforge ||

white salmon Jul 18, 2020, 10:45 PM

#

Have a look around maybe¯_(ツ)_/¯

frank lagoon Jul 18, 2020, 10:46 PM

#

Thanks, I think I got it

stuck fractal Jul 18, 2020, 10:46 PM

#

@frank lagoon Maybe try searching on those platforms

#

Google doesn't index everything

marble moat Jul 18, 2020, 10:46 PM

#

I got it

#

Maybe

odd panther Jul 18, 2020, 10:46 PM

#

lol bout time 🙂

#

Have been smashing my head on my desk your so close haha

marble moat Jul 18, 2020, 10:59 PM

#

Okay I see salt values?? am I on tight track?@odd panther

stuck fractal Jul 18, 2020, 10:59 PM

#

no

#

Read the documentation

#

Always read the documentation

marble moat Jul 18, 2020, 10:59 PM

#

Ohhhh

#

Goddddddd

#

Dumb

#

Me

stuck fractal Jul 18, 2020, 11:00 PM

#

try harder

marble moat Jul 18, 2020, 11:00 PM

#

@stuck fractal thanks for pushing my brain man

#

Got it

stuck fractal Jul 18, 2020, 11:00 PM

#

This was designed to be easy

#

Just people overcomplicate it

odd panther Jul 18, 2020, 11:02 PM

#

I did overcomplicate it a lot.

toxic scarab Jul 18, 2020, 11:02 PM

#

@stuck fractal I was slightly disappointed that you properly escaped all your SQL for Pensive Notes. I was hoping to find some Easter eggs. Of course, there is a good chance there were things to find and I’m just not bright enough to find anything. 😀

marble moat Jul 18, 2020, 11:02 PM

#

@stuck fractal yesss it was easy, guess had a lot of red herring

odd panther Jul 18, 2020, 11:03 PM

#

Its one of those tho, when searching and not knowing you try all and give up fast even when on the right track. I'm leaning now to keep going even after hours of enum, you WILL get it at some point.

stuck fractal Jul 18, 2020, 11:03 PM

#

@toxic scarab There's nothing interesting on the DB

#

I just learnt with prepared statements, I don't know how to do it in a vulnerable way yet

lyric scarab Jul 18, 2020, 11:04 PM

#

btw google indexed it just you have to remove the space

stuck fractal Jul 18, 2020, 11:05 PM

#

Oh interesting, it indexed it because of my readme

#

nice

plucky steppe Jul 18, 2020, 11:06 PM

#

Thanks for the help guys finally found it. You were right James, it was easy just overthought alot of it.

#

For sure a learning moment

cedar coral Jul 18, 2020, 11:08 PM

#

omg got root on overpass

frank lagoon Jul 18, 2020, 11:09 PM

#

Am I on the right path? I found a main.go file

stuck fractal Jul 18, 2020, 11:09 PM

#

You need to read the docs

#

It's not got a hardcoded password

#

Hardcoded and default are slightly different

#

Hardcoded cannot be changed

frank lagoon Jul 18, 2020, 11:10 PM

#

Thanks ninja

#

I think I found it

sterile robin Jul 18, 2020, 11:10 PM

#

where are these documents

rapid flower Jul 18, 2020, 11:11 PM

#

@frank lagoon not yet i guess

stuck fractal Jul 18, 2020, 11:11 PM

#

The internet

odd panther Jul 18, 2020, 11:11 PM

#

he we go again xD

#

haha

stuck fractal Jul 18, 2020, 11:11 PM

#

@sterile robin Do your research and enumeration and you will find them

sterile robin Jul 18, 2020, 11:11 PM

#

what web site

stuck fractal Jul 18, 2020, 11:11 PM

#

Google works

#

Keep trying

frank lagoon Jul 18, 2020, 11:11 PM

#

@rapid flower I found it

stuck fractal Jul 18, 2020, 11:11 PM

#

What's a common website used to share source code for open source projects?

#

That's the hint

rapid flower Jul 18, 2020, 11:12 PM

#

@frank lagoon you are talking about owasp or overpass?

stuck fractal Jul 18, 2020, 11:12 PM

#

Don't spoil the room.

#

@rapid flower OWASP

frank lagoon Jul 18, 2020, 11:12 PM

#

Ninja, the reason why it took so long to find it is because I didn't look.

#

Owasp

stuck fractal Jul 18, 2020, 11:12 PM

#

Exactly

sterile robin Jul 18, 2020, 11:12 PM

#

I didn't mean it sorry

stuck fractal Jul 18, 2020, 11:12 PM

#

If you look, you will find it

rapid flower Jul 18, 2020, 11:12 PM

#

Ohh my bad... I misunderstood

stuck fractal Jul 18, 2020, 11:12 PM

#

But you have to look yourself

frank lagoon Jul 18, 2020, 11:13 PM

#

I know, alot of people maybe misunderstood me and told me to look somewhere else then that platform

sterile robin Jul 18, 2020, 11:27 PM

#

found it😂 😂 🤦‍♂️

odd panther Jul 18, 2020, 11:28 PM

#

same just, I can't believe i missed the comment "check the documentation"

#

I so almost pasted the key here too.. lucky lol

#

must have better window arrangement

rapid flower Jul 18, 2020, 11:34 PM

#

Some hint for privesc on overpass... Ran ||linpeas|| but nit able to figure out next step

stuck fractal Jul 18, 2020, 11:34 PM

#

Look at your results

#

Look at what you can control

#

Look at the room tags

odd panther Jul 18, 2020, 11:37 PM

#

Pentesting=Everything is hard until you know how. I spend so many hours on a task but when i get it, ahh its good. (usually simple too, after you know how), this sums up learning for me so far haha

white salmon Jul 19, 2020, 12:38 AM

#

i'm looking for a hint or a push in the right direction for Task 18 SQL Injection of room CC:Pen Testing

#

i've ran sqlmap -u "http://{ip}/?id=1" --level=5 --risk=3

#

but I can't seem to get any useful information, it just shows testing info, and at the end it says all tested parameters do not appear to be injectable

#

my first question is to answer how many sqli vulnerabilities there are, but from the output i'm getting it seems like none, lol

stuck fractal Jul 19, 2020, 12:42 AM

#

There's no parameter called id.

white salmon Jul 19, 2020, 12:42 AM

#

doesn't sqlmap require there to be a parameter?

stuck fractal Jul 19, 2020, 12:42 AM

#

Yes

#

But it's not id

white salmon Jul 19, 2020, 12:43 AM

#

ohhhhh i think i know how to get it

#

is it the id located in the page source?

#

nevermind, looks like i can just run it with --forms

stuck fractal Jul 19, 2020, 12:48 AM

#

You typically look at a request to find the parameter

#

Or see what the form is going to do

white salmon Jul 19, 2020, 12:51 AM

#

ohhh, okay, that makes sense

sick sun Jul 19, 2020, 2:58 AM

#

@odd panther hii bro can i pm you about overpass ?

waxen iron Jul 19, 2020, 5:01 AM

#

the owasp challenge for today hint is to locate the app source code, i am not sure how to find out what this app is , i tried googling for 'pensive notes' and no results on github. Enumerated via dirb / nitko but no luck either. Any direction ? also tried a bunch of user/pw combos but not luck.

stuck fractal Jul 19, 2020, 5:01 AM

#

Google without a space

#

But it's available quite easily

#

Google doesn't index everything

#

A website's own search feature will be better for results on that site

waxen iron Jul 19, 2020, 5:08 AM

#

10-4 , that took all of 5 minutes, now taking my beginner level skills to Overpass and all the rabbits hole i have dug for myself

ivory kernel Jul 19, 2020, 5:25 AM

#

How can I get output file on the remote host in meterpreter ? Any idea .

stuck fractal Jul 19, 2020, 5:25 AM

#

That sounds like a question for google.

#

There's a nice meterpreter basics article out there

#

I recommend finding and reading it

ivory kernel Jul 19, 2020, 5:26 AM

#

I checked .it .but I can't find ...
Ok .maybe I will give through reading..

#

@stuck fractal searched everything ...I found command download ...but my answer need to be in 3 letter .like this can u give me hint

📎 JPEG_20200719_110729.jpg

white salmon Jul 19, 2020, 5:38 AM

#

Room wonderland, I was user rabbit, teaParty binary is owned by root. I did ||enviroment variable privilege escalation ||on this binary by creating a fake date binary but I got hatter as user and not root?

📎 unknown.png

stuck fractal Jul 19, 2020, 5:38 AM

#

You can't possibly have searched everything. @ivory kernel

#

@white salmon time for you to learn about suid and some RE

#

Have you looked at the source code of the binary?

white salmon Jul 19, 2020, 5:39 AM

#

I did strings only

#

Didn't re

stuck fractal Jul 19, 2020, 5:39 AM

#

Eh, do some RE

#

Look at the system calls

white salmon Jul 19, 2020, 5:39 AM

#

Oh I'll try

stuck fractal Jul 19, 2020, 5:39 AM

#

That explains why

ivory kernel Jul 19, 2020, 5:39 AM

#

@stuck fractal if this one is over .whole machine is over .jus stucked here .😅😅

stuck fractal Jul 19, 2020, 5:39 AM

#

Or you can accept that I added a setuid(100Whatever) at the start of the program @white salmon

#

And that you can't get root from it

waxen iron Jul 19, 2020, 5:40 AM

#

yes/no on overpass rabbit hole i m stuck in- is there sql injection on the admin form ? cause my sqlmap is not finidng any

stuck fractal Jul 19, 2020, 5:41 AM

#

@ivory kernel I told you to go find the meterpreter basics. It's in there. Please remember rule 13. This is very easy to find via google.

#

@waxen iron No, it uses prepared statements so there's no possible SQLi.

white salmon Jul 19, 2020, 5:41 AM

#

Yeah I added setuid(0). I'll read more about suid I think I need to get more clarity in it.

stuck fractal Jul 19, 2020, 5:42 AM

#

It's already running as a different user

#

You can't change that

#

You managed to go one user up the chain

#

That's a good thing. Now keep going.

waxen iron Jul 19, 2020, 5:43 AM

#

thanks @stuck fractal btw - for patiently answering everyones questions here.

stuck fractal Jul 19, 2020, 5:44 AM

#

I made the room, so I can answer that question quickly

#

I also made wonderland, so that's quick to answer

#

I'm slowly taking over the platform and there's nothing you can do to stop me muhahaha

ivory kernel Jul 19, 2020, 5:54 AM

#

@stuck fractal I searched it man ...
I got answer ...
One is download .and another one is spool .
But it's states that 3 letter word can fit in .? .

trim heath Jul 19, 2020, 5:54 AM

#

Hey guys I need help with owasp top 10 room latest challenge. Can you give me any hint on security misconfiguration.

thorny nest Jul 19, 2020, 5:54 AM

#

So finally rooted overpass. Thanks for the box @stuck fractal

stuck fractal Jul 19, 2020, 5:54 AM

#

@ivory kernel https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/

Meterpreter Basic Commands | Offensive Security

#

Try. Harder.

ivory kernel Jul 19, 2020, 5:54 AM

#

Lol yes yes

stuck fractal Jul 19, 2020, 5:56 AM

#

I told you that this guide exists, and asked you to find it yourself and look at it.

ivory kernel Jul 19, 2020, 6:05 AM

#

Man I fully went through that document I couldn't find answer 😭😭😭😭 .
Can u pls say answer or otherwise show answer in that site @stuck fractal I'm sure I didn't missed anything .

stuck fractal Jul 19, 2020, 6:05 AM

#

It's in there.

#

We do not give answers

#

Do your own research.

halcyon citrus Jul 19, 2020, 6:09 AM

#

i too struck on that bro @ivory kernel

marble kiln Jul 19, 2020, 6:22 AM

#

Any hint on Day 6, room owasptop10, find comment and try how fetch is working here for JSON
Atleast tell me, am I going wrong

stuck fractal Jul 19, 2020, 6:27 AM

#

@marble kiln Read the material in the room, check the hint

#

You're not going to be able to hack in unless you know credentials

rapid flower Jul 19, 2020, 6:31 AM

#

Any hints related ||cron|| in overpass?

stuck fractal Jul 19, 2020, 6:32 AM

#

Work out what you can control and what you can't control

marble kiln Jul 19, 2020, 6:33 AM

#

@stuck fractal reading source code from hours but couldn't see any credentials except a comment in js fiel🥺😅

stuck fractal Jul 19, 2020, 6:33 AM

#

It's not in JS

#

So have fun

#

The source code isn't the frontend code

#

Try harder. Do some research.

rapid flower Jul 19, 2020, 6:34 AM

#

Overpass is not beginner level... Or is it?

stuck fractal Jul 19, 2020, 6:34 AM

#

It is.

#

Upper end of beginner

#

It's not expected to be your first box

rapid flower Jul 19, 2020, 6:34 AM

#

Then I surely need to go a long way

stuck fractal Jul 19, 2020, 6:34 AM

#

You're expected to know privesc and enumeration

#

Run some privesc enumeration scripts

rapid flower Jul 19, 2020, 6:35 AM

#

And it's my first... Atleast where things are relted to ||cron||

stuck fractal Jul 19, 2020, 6:35 AM

#

Ok, so time for you to do some research into that

rapid flower Jul 19, 2020, 6:35 AM

#

||gtfobins|| don't appear to be working over here

stuck fractal Jul 19, 2020, 6:37 AM

#

Copy/paste from GTFOBins is boring

#

You have to actually understand what's going on.

rapid flower Jul 19, 2020, 6:37 AM

#

Yup... Looking for ||cron|| privesc methids

stuck fractal Jul 19, 2020, 6:38 AM

#

You won't get it until you actually understand what's going on

rapid flower Jul 19, 2020, 6:38 AM

#

Ohkayyy

green sorrel Jul 19, 2020, 6:38 AM

#

for jack do we have to bruteforce the wp-admin

rapid flower Jul 19, 2020, 6:38 AM

#

😅

stuck fractal Jul 19, 2020, 6:39 AM

#

@green sorrel try it and find out

green sorrel Jul 19, 2020, 6:39 AM

#

I am

stuck fractal Jul 19, 2020, 6:39 AM

#

If it takes more than 5 minutes, then either wrong user or you're not meant to

marble dagger Jul 19, 2020, 6:47 AM

#

still stuck on overpass foothold. I try force to go somewhere. but it is a little tricky because I don't know where I actually want/can go. so I guess I'm again on the wrong path

cedar coral Jul 19, 2020, 6:49 AM

#

@marble dagger dm me for help

random thunder Jul 19, 2020, 7:41 AM

#

@marble dagger dm me for help
@cedar coral can i dm you for help?

cedar coral Jul 19, 2020, 7:41 AM

#

Yes

autumn rivet Jul 19, 2020, 7:46 AM

#

Anyone done with the Day 6 of OWASP room (Beginner)? I'm stuck there. I took the hint that I should go through the web app source code... It says maybe the documentation will mention default credentials.... I couldn't find any documentation. I went through all the html pages and it's .js scripts. The closest I've got to in the default values in main.js? Hint?

white salmon Jul 19, 2020, 7:48 AM

#

You are looking at the frontend. Not the source code

autumn rivet Jul 19, 2020, 7:51 AM

#

@white salmon so you mean to say it's not 'View Page Source' or curl?

white salmon Jul 19, 2020, 7:52 AM

#

@white salmon so you mean to say it's not 'View Page Source' or curl?
@autumn rivet Yeah its not that.

random thunder Jul 19, 2020, 7:52 AM

#

@autumn rivet Yeah its not that.
@white salmon Yes its actually not

#

Try to find the documentation for the code online. @autumn rivet

#

i need help with https://tryhackme.com/room/rpmetasploit ~ task 5 ~ #12

TryHackMe

TryHackMe | Metasploit

Part of the Red Primer series, learn to use Metasploit!

dense saddle Jul 19, 2020, 8:07 AM

#

any hint on latest release of owasp top 10? security misconfiguration?

#

Checked all the source codes of the html pages, examined js files. Hint says to look in source code but there is nothing interesting there

#

even checked source code of ip/mynotes which is not accessible through browser

random thunder Jul 19, 2020, 8:09 AM

#

any hint on latest release of owasp top 10? security misconfiguration?
@dense saddle Its not in the actual code but you have to check if the documentation exists for that code anywhere online. DM me if you need any further hints.

dense saddle Jul 19, 2020, 8:09 AM

#

Ok Sundeep thanks

little idol Jul 19, 2020, 8:41 AM

#

hi

#

on the overpass box, ||which software to use for authentication bypass||

rancid crystal Jul 19, 2020, 8:42 AM

#

@little idol what exactly you are trying to bypass?

fast swan Jul 19, 2020, 8:44 AM

#

@little idol Developer tools

little idol Jul 19, 2020, 8:45 AM

#

@rancid crystal web site access on /admin

#

@fast swan i'm going to try

rancid crystal Jul 19, 2020, 8:47 AM

#

Source code gives you the best hints

valid bough Jul 19, 2020, 8:50 AM

#

Any hint to get root on overpass?
I feel stuck.

rancid crystal Jul 19, 2020, 8:53 AM

#

@valid bough did you try linpeas?

final mortar Jul 19, 2020, 9:08 AM

#

on the overpass box, ||which software to use for authentication bypass||
@little idol I used burp, you can use anything

sullen vine Jul 19, 2020, 9:42 AM

#

i searched for source code and documentation
for Security Misconfiguration challenge of OWASP 10 i just found Go-IPFS and InfluxDB Code On Github but i didnt found any thing in docs

vernal goblet Jul 19, 2020, 9:59 AM

#

Help me on Owasp top 10 challenge 6. I found the ||database file and the password hash but not able to crack it||

lyric scarab Jul 19, 2020, 10:08 AM

#

you mean day 6? There only need to read the docs

fathom jolt Jul 19, 2020, 10:10 AM

#

guys I'm just stucked at the overpass room I know that there is || a broken auth || but can't deal with it if some one could give me a nice hint it will be helpful ! ❤️

white salmon Jul 19, 2020, 10:15 AM

#

@vernal goblet|| you have to go on github||

vernal goblet Jul 19, 2020, 10:17 AM

#

I found the ||GitHub page and got a database file with a password hash in it||

final mortar Jul 19, 2020, 10:19 AM

#

I found the ||GitHub page and got a database file with a password hash in it||
@vernal goblet It's way easier

#

Maybe the documentation gives you default credentials that you can try.

#

Look for default creds

vernal goblet Jul 19, 2020, 10:21 AM

#

Found it! I'm so dumb 😶

#

Thanks @final mortar

maiden violet Jul 19, 2020, 10:42 AM

#

@final mortar ?

worthy iris Jul 19, 2020, 11:28 AM

#

guys how would you privesc if you connected to a box via ssh rsa (and dont have any passwords so I cant sudo -l to find any NOPASSWD)

worn yew Jul 19, 2020, 11:28 AM

#

Just read the github page and you see creds are lying around

hardy quest Jul 19, 2020, 11:29 AM

#

@worn yew go-ifps-api github page?

worn yew Jul 19, 2020, 11:31 AM

#

I'm referring to owasp 10 day 6 task

hardy quest Jul 19, 2020, 11:32 AM

#

@worn yew me too... I can't find github page for pensive note taking app...

white salmon Jul 19, 2020, 11:32 AM

#

there is also a plugin called || cookie editor|| you can use that too if you are lazy to turn on burp

worn yew Jul 19, 2020, 11:32 AM

#

It is there

white salmon Jul 19, 2020, 11:34 AM

#

@worn yew don't share answers

worn yew Jul 19, 2020, 11:35 AM

#

ok

little idol Jul 19, 2020, 11:35 AM

#

find a way with cookies editor

#

for ||overpass||

storm condor Jul 19, 2020, 11:38 AM

#

@worn yew me too... I can't find github page for pensive note taking app...
@hardy quest a little search can help you

turbid spruce Jul 19, 2020, 11:39 AM

#

@worn yew If it may help to find it at first try, play with spaces

north moat Jul 19, 2020, 11:40 AM

#

i got root OverPass 🙂

solid cave Jul 19, 2020, 11:41 AM

#

@north moat Me too - 'grats (my root was about 2 mins after user - which took me hours to foothold... duh)

random thunder Jul 19, 2020, 11:42 AM

#

i got root OverPass 🙂
@north moat any hints?

north moat Jul 19, 2020, 11:42 AM

#

yeh root Less time than user.txt 🙂

keen willow Jul 19, 2020, 11:42 AM

#

@worn yew me too... I can't find github page for pensive note taking app...
@hardy quest you may want to use ||github's search|| rather then ||google's||

solid cave Jul 19, 2020, 11:43 AM

#

@random thunder - if overpass was any more spelt out than it was already ^^above^^ - it would be a walkthru 🙂

hardy quest Jul 19, 2020, 11:44 AM

#

@keen willow thanks bro! After your hint I directly found it 😁✌🏻

strange tundra Jul 19, 2020, 11:58 AM

#

can i get a hint about overpass ?

green sorrel Jul 19, 2020, 11:59 AM

#

just use the search bar

#

u'll find heaps

#

📎 unknown.png

final mortar Jul 19, 2020, 12:24 PM

#

i got root OverPass 🙂
@north moat I mean it's an easy rated room after all

north moat Jul 19, 2020, 12:53 PM

#

@final mortar is it easy ?

little idol Jul 19, 2020, 12:57 PM

#

root overpass just now !!!!

north moat Jul 19, 2020, 12:59 PM

#

good job 🙂

sick sun Jul 19, 2020, 1:21 PM

#

@little idol hii bro can i pm you about overpass ?

keen willow Jul 19, 2020, 2:10 PM

#

@sick sun you can scroll up till today's msgs, there are a lot of hints for overpass.

crisp wigeon Jul 19, 2020, 2:19 PM

#

hi guys, rockyou will work to crack overpass key

hollow gazelle Jul 19, 2020, 3:13 PM

#

yes

jade rampart Jul 19, 2020, 4:54 PM

#

Thanks for the hints @worn yew , @final mortar , @vernal goblet ,
It helped me alot!
I have a question though,
How'd you figure out that you had to go to some Github page?

stuck fractal Jul 19, 2020, 4:54 PM

#

Where else would you go?

#

Some googling will take you to that page

#

The hint tells you to find the source code

jade rampart Jul 19, 2020, 4:56 PM

#

Where else would you go?
@stuck fractal Whaoh! that's your github repo right? Awesome!

#

The hint tells you to find the source code
@stuck fractal I was of the view that I'd try looking at inspect element to find something

stuck fractal Jul 19, 2020, 4:56 PM

#

That's not the sourcecode for the webapp

jade rampart Jul 19, 2020, 4:57 PM

#

That's not the sourcecode for the webapp
@stuck fractal okay, okay
Got it

#

Sorry, beginner's mistake

#

Thanks alot though!
Really appreciate your web app

stuck fractal Jul 19, 2020, 4:58 PM

#

Don't use it in production

graceful plinth Jul 19, 2020, 4:59 PM

#

@stuck fractal okay, okay
Got it
@jade rampart can you give some hints been looking for about one and half hour

stuck fractal Jul 19, 2020, 4:59 PM

#

I have

#

Many many many hints

#

On the task text, and in here

#

hi guys, rockyou will work to crack overpass key
@crisp wigeon On tryhackme, you use rockyou unless you're told to use something else.

crisp wigeon Jul 19, 2020, 5:02 PM

#

@stuck fractal thanks then i have some problem...

stuck fractal Jul 19, 2020, 5:03 PM

#

Probably.

crisp wigeon Jul 19, 2020, 5:04 PM

#

Shall i DM ?

stuck fractal Jul 19, 2020, 5:04 PM

#

No

#

You shall not.

crisp wigeon Jul 19, 2020, 5:04 PM

#

Okay ..

median compass Jul 19, 2020, 5:06 PM

#

just ask your question here @crisp wigeon, that's what the channel is for. If you're afraid that you have spoliers then just surround them in || marks

crisp wigeon Jul 19, 2020, 5:07 PM

#

Sure ..

#

I tried cracked so many times but only one time it showed cracked and give passwd with this string ||em****d|| again tried nothing worked .. need to confirm this also ..

median compass Jul 19, 2020, 5:10 PM

#

so, it's double | for spoilers

crisp wigeon Jul 19, 2020, 5:10 PM

#

Yep

median compass Jul 19, 2020, 5:10 PM

#

i.e. || before and after

#

not what you did

#

there you go!

maiden moss Jul 19, 2020, 5:10 PM

#

||text||

crisp wigeon Jul 19, 2020, 5:11 PM

#

Thanks @median compass @maiden moss

maiden moss Jul 19, 2020, 5:11 PM

#

👍

median compass Jul 19, 2020, 5:14 PM

#

so you want to confirm what? that you got the right passphrase?

crisp wigeon Jul 19, 2020, 5:17 PM

#

I got the key and i tried to crack with John ..it's not working and at random time, only one time i got this ||em****d|| string ..

stuck fractal Jul 19, 2020, 5:18 PM

#

Did you use ssh2john first?

crisp wigeon Jul 19, 2020, 5:19 PM

#

No,,

stuck fractal Jul 19, 2020, 5:19 PM

#

Well then you're not cracking it properly

crisp wigeon Jul 19, 2020, 5:19 PM

#

Let me do it then ..

median compass Jul 19, 2020, 5:19 PM

#

you need to make a hash first that John can work with

#

on kali that's /usr/share/john/ssh2john.py

crisp wigeon Jul 19, 2020, 5:20 PM

#

Yep will do .. thanks @median compass @stuck fractal

median compass Jul 19, 2020, 5:20 PM

#

happy hunting

jade rampart Jul 19, 2020, 5:24 PM

#

@jade rampart can you give some hints been looking for about one and half hour
@graceful plinth Any progress? or may I give a hint?

stuck fractal Jul 19, 2020, 5:34 PM

#

Check the room tags, run some enum scripts

graceful plinth Jul 19, 2020, 5:34 PM

#

@graceful plinth Any progress? or may I give a hint?
@jade rampart came up with github searches

#

got the password hash and salt too

stuck fractal Jul 19, 2020, 5:35 PM

#

That won't help you

#

You don't need to download anything. There's your hint.

graceful plinth Jul 19, 2020, 5:36 PM

#

okay

#

got it

#

thanks 😄

wanton epoch Jul 19, 2020, 6:04 PM

#

any hints for root on retro? priv esc for windows is a challenge for me 😦

trim haven Jul 19, 2020, 6:06 PM

#

Let me just check the room to refresh myself 2 seconds

wanton epoch Jul 19, 2020, 6:06 PM

#

thanks @trim haven !

trim haven Jul 19, 2020, 6:07 PM

#

Have you tried uploading winpeas or other tools that will looks for ways of privilege escalation??

wanton epoch Jul 19, 2020, 6:08 PM

#

yup

#

gone through all the output but cant seem to find any attack vectors

#

maybe i just dont know what things to look for specifically?

trim haven Jul 19, 2020, 6:09 PM

#

Personally I haven’t used winpeas, I have used linpeas so I’m unsure if it was the same colour-scheme style