#room-hints | TryHackMe | Page 46

stuck fractal Jul 28, 2020, 5:27 AM

#

Do whatever. Don't attack other platform users or any infrastructure.

fleet pike Jul 28, 2020, 5:27 AM

#

So .. mostly speaking within reason, anything goes between you and the practice box, as long as its a consentual activity between you and that specific ip

stuck fractal Jul 28, 2020, 5:28 AM

#

You and that VM.

white salmon Jul 28, 2020, 5:28 AM

#

Don't DDoS or DoS the machine

fleet pike Jul 28, 2020, 5:28 AM

#

consensual. blah

stuck fractal Jul 28, 2020, 5:28 AM

#

@white salmon False

#

Unless it's KoTH, you can do whatever you want.

white salmon Jul 28, 2020, 5:28 AM

#

?

#

I thought ddosing the machines was not allowed

stuck fractal Jul 28, 2020, 5:28 AM

#

You're not allowed to DoS machines in KoTH.

#

Outside KoTH, the only person you're affecting is yourself

fleet pike Jul 28, 2020, 5:29 AM

#

does ddos mean intent to break / consume excessive resources. Like for example enumerating a 1.9M entry list

white salmon Jul 28, 2020, 5:29 AM

#

interesting

stuck fractal Jul 28, 2020, 5:29 AM

#

@fleet pike You are fine to do whatever if it's your instance that you're attacking

#

Go crazy with it

white salmon Jul 28, 2020, 5:29 AM

#

I thought it would impact THM servers because of the VPN and the fact that it's still kinda like a stress on AWS

fleet pike Jul 28, 2020, 5:29 AM

#

Well w/in reason.. I imagine 1.9 million attempts at some thing will take a long time

stuck fractal Jul 28, 2020, 5:30 AM

#

Again, only person you're affecting is yourself

white salmon Jul 28, 2020, 5:31 AM

#

does ddos mean intent to break / consume excessive resources. Like for example enumerating a 1.9M entry list
@fleet pike Usually it's just some kind of coordinated and planned way of using up a server's resources or the network's resources

fleet pike Jul 28, 2020, 5:32 AM

#

Thanks.. am running the gauntlet on enumerators for a windows box right now.. and it occurs to me what this is actually doing will consume a respectable amount of time/bandwidth

white salmon Jul 28, 2020, 5:32 AM

#

you are fine using a majority of enumerators and brute forces

fleet pike Jul 28, 2020, 5:33 AM

#

wanted to make sure i didn't wreck my future ability to play 🙂

white salmon Jul 28, 2020, 5:33 AM

#

nah you're fine

fleet pike Jul 28, 2020, 5:34 AM

#

sort like "Upload" 1GB rooms .. 😉 n hrs per week

white salmon Jul 28, 2020, 5:34 AM

#

just don't hack other people, and don't try too hard to break into THM's internal network

fleet pike Jul 28, 2020, 5:34 AM

#

yessir

white salmon Jul 28, 2020, 5:35 AM

#

otherwise every machine that you deploy is literally your own playground/sandbox

#

I crashed the xss playground machine like 50 times while playing with bof

fleet pike Jul 28, 2020, 5:37 AM

#

Mostly used either self hosted boxes, or hosted boxes have a no automated scanning/enumerating rule.

white salmon Jul 28, 2020, 5:40 AM

#

You're free to scan and enumerate and brute force as aggressively as you want

#

pretend like these are self hosted boxes

#

you can terminate and redeploy if you wish at will

stuck fractal Jul 28, 2020, 5:41 AM

#

you can terminate and redeploy if you wish at will
@white salmon as a note, this will completely reset the box state.

#

Boxes can be restarted without resetting them, but you kind of have to be on the box already with permissions for that

cerulean veldt Jul 28, 2020, 9:39 AM

#

Anyone trying out Brooklyn99 box?

trim haven Jul 28, 2020, 9:40 AM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on

At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?

What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

cerulean veldt Jul 28, 2020, 9:42 AM

#

I've tried the primary steg but can't get past it. Positive that it is stego because I know I am missing something with the image.

trim haven Jul 28, 2020, 9:43 AM

#

Have you tried stegcracker

cerulean veldt Jul 28, 2020, 9:48 AM

#

Trying out stegcracker. But why this tool specifically?

#

@trim haven Thanks for the help! Appreciate it ...

trim haven Jul 28, 2020, 9:50 AM

#

Stegcracker allows you to brute force other tools done

#

Anttime

#

Anytime*

brave bloom Jul 28, 2020, 10:08 AM

#

Another key factor is just checking versions- a lot of Microsoft Windows SMB machines are vulnerable to it
@white salmon I'm counting 17 scanners available in metasploit just for smb.. is it common practice to run each one of them manually, or do you typically use some sort of automation (like this for example: https://kalilinuxtutorials.com/exploitivator-metasploit-scanning-exploitation/) ...?

white salmon Jul 28, 2020, 10:42 AM

#

@brave bloom It's different kinds of scanners with alternative methods of getting the version, but generally you'd probably use a more all-encompassing enumerater that can also check for smb version/exploit. The individual scan scripts are often used in the enumeraters themselves, or for other specialized exploits with checks.

simple shoal Jul 28, 2020, 11:09 AM

#

Is it possible to have a false-positive answer to a hydra bruteforce request ?

#

Nevermind, I attacked the wrong port but still got a password

#

I guess it's a stonks

trim haven Jul 28, 2020, 11:18 AM

#

Hydra can give false-positive answers if you're doing it wrong

simple shoal Jul 28, 2020, 11:19 AM

#

thank you for the info 😉

maiden flower Jul 28, 2020, 11:19 AM

#

@strange river would it be ok if I pm you sometime? or you can PM when you have a moment I have had some issues with the jigsaw room and would like to discuss that with you please?

strange river Jul 28, 2020, 11:20 AM

#

sure

fallen sedge Jul 28, 2020, 11:41 AM

#

hi everybody, I have some trouble with Tempus Fugit Durius. I found a hash for one user but I bruteforce with hydra for more than a hour and have nothing. I'm sure it's the good user. thank you

late patio Jul 28, 2020, 11:42 AM

#

@strange river Are you in here? lol

strange river Jul 28, 2020, 11:43 AM

#

yes

late patio Jul 28, 2020, 11:43 AM

#

nice

rancid solstice Jul 28, 2020, 1:38 PM

#

hi guys i've a little question about the network services room task 7 #6 so my openvpn is set and running on my VM, I launch the tcpdump and try to ping but nothing comes should any ideas ? should I connect my Os to openvpn too ? seems strange too me

final mortar Jul 28, 2020, 1:42 PM

#

You have to start the listener with your tun0, on the vm as you say, and you have to ping the same tun0 ip in the next task, on the same vm

rancid solstice Jul 28, 2020, 1:43 PM

#

it's what i did i pinged the

#

4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 10.8.91.93/16 brd 10.8.255.255 scope global tun0

#

but nothing happened

#

same with the payload thats strange X) I'm doing smth wrong but I cant see what

final mortar Jul 28, 2020, 1:44 PM

#

10.8.91.93 this is your tun0 ip yes

#

what were your commands and what's the result

rancid solstice Jul 28, 2020, 1:44 PM

#

yup i confirmed it with the website on the acces page

#

i'll paste you the command

#

sudo tcpdump ip proto \icmp -i tun0 so this one is listening if i'm correct

final mortar Jul 28, 2020, 1:45 PM

#

Screenshot with the command and the error together would be better

rancid solstice Jul 28, 2020, 1:45 PM

#

I dont have any error I dont receive anything at all

#

the listener start but when i ping from telnet nothing pop

final mortar Jul 28, 2020, 1:46 PM

#

can you show me

rancid solstice Jul 28, 2020, 1:46 PM

#

yep

#

📎 Capture_decran_2020-07-28_a_15.48.04.png

#

i tried to make a clean screenshoot if you dont see correctly i can retake one and zoom a little

final mortar Jul 28, 2020, 1:51 PM

#

and you are connected with vpn too ?

rancid solstice Jul 28, 2020, 1:51 PM

#

yep

#

📎 Capture_decran_2020-07-28_a_15.51.31.png

final mortar Jul 28, 2020, 1:52 PM

#

Access page doesn't always tell the truth. Do you have openvpn running in a terminal or in bg

#

you haven't closed it yes ?

rancid solstice Jul 28, 2020, 1:52 PM

#

open and running Sir !

📎 Capture_decran_2020-07-28_a_15.52.35.png

white salmon Jul 28, 2020, 1:55 PM

#

@rancid solstice Your port for ICMP might be closed

#

or rather* a firewall might be filtering it

rancid solstice Jul 28, 2020, 1:55 PM

#

hummm any idea to check that ?

white salmon Jul 28, 2020, 1:55 PM

#

uhh

rancid solstice Jul 28, 2020, 1:56 PM

#

ohhh

#

i'm on my 4G

white salmon Jul 28, 2020, 1:56 PM

#

nice

rancid solstice Jul 28, 2020, 1:56 PM

#

thats mb the pb

white salmon Jul 28, 2020, 1:56 PM

#

probably

rancid solstice Jul 28, 2020, 1:56 PM

#

duno if the french's providers didnt blocked the icmp

white salmon Jul 28, 2020, 1:56 PM

#

try cat /proc/sys/net/ipv4/icmp_echo_ignore_all to see if your ICMP is actually working

#

it should return 0 which means that you should respond to pings

rancid solstice Jul 28, 2020, 1:56 PM

#

trying asap

#

respond 0

white salmon Jul 28, 2020, 1:57 PM

#

perfect

#

yeah, check if you have any firewalls that might be preventing it from reaching your machine

rancid solstice Jul 28, 2020, 1:58 PM

#

will swap back to the internet connection to see if the pb is coming fro mthe 4G

white salmon Jul 28, 2020, 1:58 PM

#

Is your VM's network adapter set to NAT?

#

your VM sometimes won't receive inbound traffic from outside your network because it has to go through the host machine

#

https://www.virtualbox.org/manual/ch06.html

rancid solstice Jul 28, 2020, 1:59 PM

#

yep it's set to nat

#

my mac is providing the nat to the vm, quoted from vmware

white salmon Jul 28, 2020, 2:00 PM

#

i see

rancid solstice Jul 28, 2020, 2:04 PM

#

even with the box nothing

#

i start openvpn on the mac and on the vm to test = nothing too

white salmon Jul 28, 2020, 2:05 PM

#

I guess one last resort is to try and disable your firewall on your machine?

#

if that might possibly bet the issue

#

not your host machine but the VM*

rancid solstice Jul 28, 2020, 2:07 PM

#

i'll check if a firewall is up by default on kali

#

if i remember correctly i think one is up by default

white salmon Jul 28, 2020, 2:07 PM

#

yeah

#

it's sudo ufw

rancid solstice Jul 28, 2020, 2:08 PM

#

was on google to find the cmd thanks X)

white salmon Jul 28, 2020, 2:08 PM

#

but remember to turn it back on if you disable it

final mortar Jul 28, 2020, 2:09 PM

#

Thanks for engaging while I was gone smackhack. Well I went back and tried the room, it doesn't seem to work for me anymore too

white salmon Jul 28, 2020, 2:09 PM

#

alright welp I guess it's time for me to learn how to hack Windows machines

#

brb I'll try it in a sec too

rancid solstice Jul 28, 2020, 2:09 PM

#

ufw not working thats strange

white salmon Jul 28, 2020, 2:10 PM

#

oh wait it's not windows jk

#

hm, I completed it somewhat recently but I guess it could've broke inbetween then and now

final mortar Jul 28, 2020, 2:11 PM

#

my thoughts exactly, I completed it a couple weeks ago ig

rancid solstice Jul 28, 2020, 2:11 PM

#

ok ok my bad i write ufw with 2 f let's start again, i'll keep you informed ! thanks for the help btw @torn pine

final mortar Jul 28, 2020, 2:11 PM

#

or maybe it's my machine that's just acting out at the moment, give it a try smackhack

rancid solstice Jul 28, 2020, 2:13 PM

#

not working ... i'll try later guys i'm done and the pool is waiting me X) again thanks @white salmon

rancid solstice Jul 28, 2020, 3:11 PM

#

i'm back ! let's try again X)

#

ok guys i think i figured out the problem

#

when i ping the box with my VM the ping come back but when i ping it from my mac the ping respond with a timeout

#

my problem is mb related to that

white salmon Jul 28, 2020, 3:22 PM

#

ah

#

that's what I also was gonna go to for the last resort

#

that means your mac's firewall is blocking the ICMP request

rancid solstice Jul 28, 2020, 3:22 PM

#

think so yep i'll disable it and try again

#

holly molly the ping come back X)

white salmon Jul 28, 2020, 3:26 PM

#

Amazing!

#

Glad it ended up working out :)

rancid solstice Jul 28, 2020, 3:27 PM

#

ah wait talked to fast X) the ping is working on the mac and the ip respond np but when i telnet and ask to ping the ping never comes X)

#

smell like a curse don't you think 😢

stuck fractal Jul 28, 2020, 3:29 PM

#

Are you running the VPN directly in Kali?

#

Are you prefixing the command with .RUN?

rancid solstice Jul 28, 2020, 3:29 PM

#

yep in kali

#

run ? for a ping ?

stuck fractal Jul 28, 2020, 3:29 PM

#

The telnet needs a prefix in order to get it to run a command

#

Just entering ping myIp won't work

#

That's something specific to this telnet

#

.RUN ping myIP is what you need.

rancid solstice Jul 28, 2020, 3:31 PM

#

if it's that i'm really dumb X)

#

the little pb are the most hardest ones X)

#

ok so guess what

#

the RUN was here

#

but the little . was missing ^^'

#

rly sorry @white salmon make you loose a lot of time

white salmon Jul 28, 2020, 3:34 PM

#

Haha, nah you didn't make me lose anything

#

Glad you fixed your issue

rancid solstice Jul 28, 2020, 3:34 PM

#

thanks for your help 🙂

hazy lodge Jul 28, 2020, 3:40 PM

#

I am doing the box DVWA. I think I am gonna need to bruteforce it

#

correct?

#

if so what program can I use? Since I have followed this https://blog.tryhackme.com/going-from-zero-to-hero/ I haven't used Burp yet

TryHackMe Blog

A Guide to go from Zero to Hero

Hackers,

By now it is clear to both free members and subscribers, that TryHackMe has a
daunting amount of content. From rooms, to write-ups, to video walkthroughs it
can be difficult for new (and even seasoned) hackers to know where to start.
Speaking with members of my team ...

stuck fractal Jul 28, 2020, 3:42 PM

#

Depends which login

#

You're given creds for the like, initial login

hazy lodge Jul 28, 2020, 3:43 PM

#

there are username and password fields in the body of the post request

stuck fractal Jul 28, 2020, 3:43 PM

#

Again, depends which login

hazy lodge Jul 28, 2020, 3:44 PM

#

http://10.10.74.143/login.php it is the index page

stuck fractal Jul 28, 2020, 3:44 PM

#

There's one for access to the whole webapp, then there's one designed to be brute forced

#

That's the one for the whole webapp

#

You don't brute force that one

hazy lodge Jul 28, 2020, 3:48 PM

#

could you give me a hint?

stuck fractal Jul 28, 2020, 3:49 PM

#

You are definitely given the credentials for that login

#

DVWA has things like RCE flaws. Of someone could get into DVWA without permission, they could easily get access to the machine

#

That's what the initial login is for

broken cloud Jul 28, 2020, 3:59 PM

#

hi

#

as suggested i search for rwpositories with simple title like :: github notes,github notes with java script ,github system misconfiguration , and so on

stuck fractal Jul 28, 2020, 4:00 PM

#

@broken cloud No

#

Literally the title of the webapp

#

It's like. Right in front of your face.

#

And has been all this time.

broken cloud Jul 28, 2020, 4:01 PM

#

i have done that to pensive

stuck fractal Jul 28, 2020, 4:01 PM

#

You haven't done it right

broken cloud Jul 28, 2020, 4:01 PM

#

😅

stuck fractal Jul 28, 2020, 4:01 PM

#

The title of the webapp will give you the source code

#

You have have to actually use the whole title

broken cloud Jul 28, 2020, 4:02 PM

#

you mean ip address?

stuck fractal Jul 28, 2020, 4:02 PM

#

No

#

If I meant IP address, I would have said IP address

broken cloud Jul 28, 2020, 4:02 PM

#

kk

#

i think i am making thing complex that it has to be

stuck fractal Jul 28, 2020, 4:03 PM

#

Very much yes

#

The title of the webapp is "Pensive Notes"

broken cloud Jul 28, 2020, 4:04 PM

#

yes i search that tooo

stuck fractal Jul 28, 2020, 4:04 PM

#

So try things like "Pensive notes" or "pensivenotes"

broken cloud Jul 28, 2020, 4:04 PM

#

ooh man i get that

stuck fractal Jul 28, 2020, 4:05 PM

#

Shhhh don't spoil it

broken cloud Jul 28, 2020, 4:06 PM

#

now i am emmbered after this much help i was not able to get that😫 😅

#

did that message got deleted?

stuck fractal Jul 28, 2020, 4:06 PM

#

Not by me, but maybe

#

Yes you deleted it

broken cloud Jul 28, 2020, 4:08 PM

#

yes i did i was not aware that will that be deleted from me or from all .. that's why i asked

#

@stuck fractal Thanks for the support...😇 ⭐ Very thanks for the effort of making the room .for a beginner like me it is like a blessing...💯

stuck fractal Jul 28, 2020, 4:14 PM

#

I didn't make the room

#

The room was made by a bunch of the official creators, different tasks by different people

broken cloud Jul 28, 2020, 4:16 PM

#

heartily thanks from myside to them all.

lunar musk Jul 28, 2020, 4:25 PM

#

Hi, at Post-Exploitation Basics, Task 4-2 It asks for Machine2 hash, I enter it exactly but it won't accept it. Why?

trim haven Jul 28, 2020, 4:26 PM

#

You’re probably entering it wrong but the room may also be broken. Let me check.

lunar musk Jul 28, 2020, 4:26 PM

#

Thx

#

I am copying / pasting it

trim haven Jul 28, 2020, 4:27 PM

#

What are the first 3 characters of the has you’re entering

lunar musk Jul 28, 2020, 4:27 PM

#

c4b

trim haven Jul 28, 2020, 4:27 PM

#

That’s incorrect.

lunar musk Jul 28, 2020, 4:28 PM

#

That's the hash I got, well I will try again

#

To get the hashes

trim haven Jul 28, 2020, 4:28 PM

#

Try restarting the room I haven’t heard of any issues with it.

lunar musk Jul 28, 2020, 4:28 PM

#

Ok, I'll try that

#

It worked by reseting the machine... weird

#

I got another hash for that account

#

Thank you

trim haven Jul 28, 2020, 4:35 PM

#

Anytime :)

lavish spire Jul 28, 2020, 4:40 PM

#

Where do I find the videos of the sessions to rewatch?

stuck fractal Jul 28, 2020, 4:41 PM

#

Head over to the TryHackCIT discord

lavish spire Jul 28, 2020, 4:42 PM

#

Thanks Ninja*

humble nexus Jul 28, 2020, 5:01 PM

#

I am trying to do the room "Ra".
After having struggling a bit with connecting to the Spark server, I tried reading up on the writeup. It seems as if I am doing the correct thing.

As info to spark i am entering:

username: lilyle
password: REDACTED
domain: <IP>

I am getting the following error:

javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_xmpp-client._tcp.windcorp.thm'

The dns is however registered in /etc/hosts. I can connect using 'smbclient //windcorp.thm/Shared -U lilyle --password REDACTED'

If anyone has similar problems I would love to know of it.

median compass Jul 28, 2020, 5:05 PM

#

Hi lasse, have you tried adding a couple of entries to your /etc/hosts file? Not just the domain but the host machine names too?

stuck fractal Jul 28, 2020, 5:06 PM

#

That's a subdomain so yep it needs seperate entries

eternal brook Jul 28, 2020, 5:08 PM

#

I'm doing Wgel CTF room I got ||id_rsa file|| and the blog site tried some users to from the blog but none of them works...

#

How do I find the user tried users on the blog but none works

humble nexus Jul 28, 2020, 5:10 PM

#

I have added the following:
10.10.97.18 fire.windcorp.thm
10.10.97.18 windcorp.thm

Sorry I am a bit confused how is this not enough?

stuck fractal Jul 28, 2020, 5:11 PM

#

The subdomajn in what you copy pasted

toxic scarab Jul 28, 2020, 5:12 PM

#

you should redact those usernames, too. finding the username is part of the challenge @humble nexus

stuck fractal Jul 28, 2020, 5:12 PM

#

'_xmpp-client._tcp.windcorp.thm'

humble nexus Jul 28, 2020, 5:13 PM

#

Sorry for that. Thanks for heads up

winged isle Jul 28, 2020, 5:25 PM

#

I am doing Common Linux Privesc room. How should I use msfvenom because this command is not found?

stuck fractal Jul 28, 2020, 5:29 PM

#

Ok, msfvenom is a hacking tool, right?

#

It's not going to be installed on the target machine

winged isle Jul 28, 2020, 5:32 PM

#

but I understand the task to be that autoscript.sh should execute this command on this machine or not?

pseudo hamlet Jul 28, 2020, 5:34 PM

#

Hello guys Need help in Blaster room

#

the way of exploitation show in video is need internet in machine how can i do it

#

The rdp connection i have doesnt have net connection

toxic scarab Jul 28, 2020, 5:38 PM

#

is your next step in that exploit saving the webpage? you don't need the web request to complete successfully to get to the save dialog box, right?

simple shoal Jul 28, 2020, 5:40 PM

#

@winged isle you're talking about Task 8 in Common Linux Privesc Room ?

winged isle Jul 28, 2020, 5:40 PM

#

Yes

simple shoal Jul 28, 2020, 5:41 PM

#

Did you try to use msfvenom on the target machine or on your host machine ?

pseudo hamlet Jul 28, 2020, 5:42 PM

#

@toxic scarab ye bro my nest step is saving the webpage

winged isle Jul 28, 2020, 5:42 PM

#

I am installing right now metasploit on my machine:) @simple shoal

simple shoal Jul 28, 2020, 5:42 PM

#

Ok, tell us if it works after installing metasploit ^^ It should

winged isle Jul 28, 2020, 5:43 PM

#

👍

toxic scarab Jul 28, 2020, 5:44 PM

#

@pseudo hamlet so just save the error page. the exploit has nothing to do with the webpage, it's just a way to get to the cmd executable with elevated privileges

pseudo hamlet Jul 28, 2020, 5:47 PM

#

ok

#

so @toxic scarab if i try to save any other web page it happen with that also

toxic scarab Jul 28, 2020, 5:48 PM

#

no

#

you need the permission context from the dialog box you were in when you clicked that link to pass those permissions to the browser that opened (even though it couldn't get to the page), which essentially transferred the same permissions to cmd.exe when you opened it from the save as dialog box

grand pivot Jul 28, 2020, 5:52 PM

#

Hi everyone!

#

im at /attackingkerberos room

#

in task 3, with Rubeus

#

when im harvesting tgt's im waiting a lot and not having a response. Is this correct?

solemn smelt Jul 28, 2020, 5:56 PM

#

how long did you set your interval for?

#

did you get the rubeus header?

#

@grand pivot

grand pivot Jul 28, 2020, 5:57 PM

#

30

#

yes, i get it

solemn smelt Jul 28, 2020, 5:58 PM

#

can I see a screenshot of your output

grand pivot Jul 28, 2020, 5:59 PM

#

📎 Kali-2020-07-28-14-58-32.png

#

it says displaying the working tgt cache every 1200 seconds... thats 20 minutes blobhuh im doing something very wrong right?

#

oh i think i know

#

i use /internal instead of /interval facepalm

calm prism Jul 28, 2020, 6:10 PM

#

I'm on agent sudo, and I got the password of the ssh correct, and I found the user. I checked it with the writeups but I'm still getting permission denied from the ssh

#

📎 unknown.png

white salmon Jul 28, 2020, 6:12 PM

#

Are you sure you got the password for the user?

#

Did you already answer questions #1, #2, #3?

#

You can check if the SSH password is correct if it's the same thing as #5

calm prism Jul 28, 2020, 6:12 PM

#

Ye i've answered all the question

#

I also answered #5

#

I tried to copy paste, and write it by myself but still same output

white salmon Jul 28, 2020, 6:13 PM

#

Is it the correct IP that you're SSHing into?

calm prism Jul 28, 2020, 6:14 PM

#

as I understand it is the IP of the machine

#

and ye it is the ip of the machine

white salmon Jul 28, 2020, 6:14 PM

#

uhh

astral smelt Jul 28, 2020, 6:15 PM

#

Did you mistype the user?

white salmon Jul 28, 2020, 6:15 PM

#

from his badly scribbles, I think that's the correct username

calm prism Jul 28, 2020, 6:15 PM

#

||james||

#

this is the user

white salmon Jul 28, 2020, 6:15 PM

#

Yeah

#

Try restarting the machine

astral smelt Jul 28, 2020, 6:15 PM

#

Yea ok so you didn’t mistype it maybe you keep mistyping the password

#

Wait are you putting caps?

calm prism Jul 28, 2020, 6:16 PM

#

on the password?

#

no

astral smelt Jul 28, 2020, 6:17 PM

#

Oh yea idk then

white salmon Jul 28, 2020, 6:17 PM

#

Have you restarted the machine and tried SSHing into it?

calm prism Jul 28, 2020, 6:18 PM

#

ye right now

#

still same output 😐

white salmon Jul 28, 2020, 6:19 PM

#

This is a shot in the dark, but it's possible maybe your keyboard has a different characterset and one of the characters doesn't match?

astral smelt Jul 28, 2020, 6:20 PM

#

Are you using vm?

white salmon Jul 28, 2020, 6:20 PM

#

Type rr and ! for me

calm prism Jul 28, 2020, 6:20 PM

#

ye I'm with vm

#

rr!

white salmon Jul 28, 2020, 6:20 PM

#

hm

astral smelt Jul 28, 2020, 6:20 PM

#

Because in my vm it’s weird my front slash is <>

calm prism Jul 28, 2020, 6:20 PM

#

but any other ssh that I've used before work

#

can you send the password in spoiler ill try to copy yours

white salmon Jul 28, 2020, 6:21 PM

#

The writeups have the password- we can't type in the password here

#

Make sure you're copy and pasting only the password and no extra blank space or anything I guess

calm prism Jul 28, 2020, 6:22 PM

#

ok give me a minute

#

ok it worked!

#

however it's weird because the password is different from the one on the answer

white salmon Jul 28, 2020, 6:23 PM

#

???

astral smelt Jul 28, 2020, 6:23 PM

#

It shouldn’t be i did that room last night and worked fine

white salmon Jul 28, 2020, 6:24 PM

#

Can you DM me the password

#

and answer

#

It shouldn't be different

astral smelt Jul 28, 2020, 6:24 PM

#

Are you sure you wansn’t using the wrong password

white salmon Jul 28, 2020, 6:24 PM

#

OH

#

I see

#

@astral smelt It's the answer's tolerance

astral smelt Jul 28, 2020, 6:24 PM

#

Ohh

white salmon Jul 28, 2020, 6:25 PM

#

yeah

#

that's a #site-bugs

fleet pike Jul 28, 2020, 7:14 PM

#

In BPT room #1.. is there a way other than blind user enumeration of all 3 character names or should i expect to make (26-52?)^3 possible queries (or until it finds what im looking for)

#

is it deducible ?

winter plover Jul 28, 2020, 9:01 PM

#

Do we have the password for the Room "Muscial Stego" Paste Bin page? It's a dead link.

#

haha nevermind

fleet pike Jul 28, 2020, 9:17 PM

#

wow... The last time i ran this cmd it did not give me this output

sharp ether Jul 28, 2020, 9:39 PM

#

Hey, someone solved
ROOM: top 10 owasp,
TASK 20: Security Misconfiguration
VM: Pensive Notes
???

stuck fractal Jul 28, 2020, 9:40 PM

#

Don't ask to ask

#

Just ask your question

sharp ether Jul 28, 2020, 9:42 PM

#

i 'm stuck. couldn't find any information, and i guess i can brute force the usr and pass but i've tried with most common list of usr and passwords and nothing

#

any hint? 😁

stuck fractal Jul 28, 2020, 9:44 PM

#

Look online

#

You'll never get it by brute force, it was designed to prevent that

sharp ether Jul 28, 2020, 9:46 PM

#

📎 unknown.png

#

ok, that's why it tells me that all the pass are valid?

stuck fractal Jul 28, 2020, 9:47 PM

#

No

#

That's because your hydra command is wrong

#

But if you're brute forcing anything at all, you're doing it wrong

sharp ether Jul 28, 2020, 9:51 PM

#

ok

#

hydra -L usr/top-usernames-shortlist.txt -P pass/10-million-password-list-top-10000.txt 10.10.179.229 http-get

stuck fractal Jul 28, 2020, 9:51 PM

#

Again

#

No brute force

#

And most definitely not http get

sharp ether Jul 28, 2020, 9:51 PM

#

although i understand it's not brute forcing, i would like to know what's wrong with my hydra command

#

the method ?

stuck fractal Jul 28, 2020, 9:52 PM

#

uh basically everything after the IP

sharp ether Jul 28, 2020, 9:52 PM

#

ok

stuck fractal Jul 28, 2020, 9:52 PM

#

There are rooms to teach you how to use hydra for HTTP

#

If you'd like to learn, do those. And find some guides online.

white salmon Jul 28, 2020, 11:39 PM

#

hi all, i have user flag on room Jeff i typed it as i found it and tried to do that thing that saidme between {} and nothing, any tip to make it works -- solved thanks @maiden flower

oblique cliff Jul 29, 2020, 2:39 AM

#

#site-bugs @lunar musk

rough grove Jul 29, 2020, 2:42 AM

#

on brooklyn99 room

#

how am i supposed to find the passphrase for the steghide on the website's image?

#

looking for a hint

lunar musk Jul 29, 2020, 2:45 AM

#

What other options do you have?, think about it, sometimes we focus only on one thing

#

It helps from time to time to view the whole picture

hardy matrix Jul 29, 2020, 2:47 AM

#

im doing hydra and I have rockyou and hydra setup and its running but its done wayyy more than 30

#

is it http-post

rough grove Jul 29, 2020, 2:48 AM

#

what room is it?

hardy matrix Jul 29, 2020, 2:48 AM

#

hydra

rough grove Jul 29, 2020, 2:49 AM

#

is it http-post
@hardy matrix http-post-form
iirc

#

Hint on the user flag (brooklyn99) says Jake

#

so i guess thats the username
but without the hint, how do i find the username? bruteforce it?

#

doesnt seem like a great ideia (Please tag me if u respond)

ashen violet Jul 29, 2020, 3:07 AM

#

@rough grove not bruteforce there's somewhere you can find it

rough grove Jul 29, 2020, 3:22 AM

#

i got it, thank you, i was too lazy to check everything i guess

hushed elbow Jul 29, 2020, 10:03 AM

#

Hello, i'm new here. nice to be here.

#

i am currently stuck on a task, task 21 to be precise on learn linux (a room created by paradox) wanted to ask if i could get any possible hints

#

thank you

white salmon Jul 29, 2020, 10:07 AM

#

You should probably take a look at "Environment Variables" in Linux

#

These are variables that basically, the system and any user can use at any time

hushed elbow Jul 29, 2020, 10:08 AM

#

oh okay, i'll get to it. Thank you

trim haven Jul 29, 2020, 10:20 AM

#

cough hints

white salmon Jul 29, 2020, 10:20 AM

#

@crystal aurora Please don't give the exact answer or method to get the answer away.

crystal aurora Jul 29, 2020, 10:21 AM

#

Its a Method

white salmon Jul 29, 2020, 10:22 AM

#

Yes, but this room is for people who don't want to be told how, just a hint.

#

#room-help is more appropriate for giving the actual steps to do something

#

https://discordapp.com/channels/521382216299839518/690557518837186560/735862137158893589

trim haven Jul 29, 2020, 10:23 AM

#

@crystal aurora Remove the message please.

white salmon Jul 29, 2020, 10:23 AM

#

I understand you want to help, but sometimes it's actually more helpful to give people a bone and let them do it for themselves, instead of holding their hands

#

Give a man a fish, and feed him for a day. Teach a man to fish, and feed him for a lifetime.

sinful plaza Jul 29, 2020, 11:35 AM

#

hello guys i can't get the sqlmap to run in the https://tryhackme.com/room/uopeasy

TryHackMe

TryHackMe | uopeasy

University of Portsmouth's beginner room.

final mortar Jul 29, 2020, 11:37 AM

#

Task, Your command, resulting error

#

screenshot would be nice

sinful plaza Jul 29, 2020, 11:37 AM

#

ok

#

task 6
Using SQL injection, can you extract the username and password for this form? You may need the help of Burp's intruder function OR SQLMap.

final mortar Jul 29, 2020, 11:41 AM

#

...

sinful plaza Jul 29, 2020, 11:41 AM

#

sqlmap -u http://10.10.137.208/login.php --forms --risk=3 --level=5 --dbs

#

am getting nothing out

final mortar Jul 29, 2020, 11:43 AM

#

Try with less options

#

Some options are unnecessary

sinful plaza Jul 29, 2020, 11:49 AM

#

ok thanks

solemn smelt Jul 29, 2020, 12:47 PM

#

you’re not telling SQLmap the request for the login page

#

you need to use burp to get the request then put that request into SQLmap changing a few things around for formatting

#

hackpark’s video does a great job of demonstrating this

ashen matrix Jul 29, 2020, 1:31 PM

#

Hello. I am currently working on the 'Ignite' room and having problems getting the root.txt. I have acquired the user.txt. ||by using a form of SQLi + linux commands in the URL|| but am unable to see any way of escalating my priv. My question is 1. Did I get the first flag the correct way to be able to escalate from that vulnerability? 2. If it is any hints on where to begin? ||I have performed find / -perm -4000 on the machine and found what access I have but cant figure out if any of these commands could help||

oblique cliff Jul 29, 2020, 1:35 PM

#

If you got the user flag then you did it right

#

Doesn’t matter how you did it

ashen matrix Jul 29, 2020, 1:35 PM

#

Well im more meaning how can I move across to be able to get the root flag

#

was the way that i got the user sufficient to get the root as well, as I cant see a way to priv esc ||using the URL bar|| for it

oblique cliff Jul 29, 2020, 1:36 PM

#

Nope

#

It’s on the machine

#

It’s not an SUID

#

Enumerate a bit more

ashen matrix Jul 29, 2020, 1:37 PM

#

OK

#

thank you

oblique cliff Jul 29, 2020, 1:37 PM

#

Any time

simple shoal Jul 29, 2020, 1:40 PM

#

In Vulnversity room, I am asked what common extension is blocked by the form where I have to upload files. The answer format is .***
But whatever I try to upload (.txt, .pdf, .zip, .php, etc.) it says that the extension is blocked 😭
Is it a #site-bugs or not ?

white salmon Jul 29, 2020, 1:42 PM

#

@simple shoal Could you take a screenshot of one of the responses from Intruder?

final mortar Jul 29, 2020, 1:42 PM

#

It asks you what's the most common extension for reverse shells , in other words

white salmon Jul 29, 2020, 1:42 PM

#

oh

#

wait

final mortar Jul 29, 2020, 1:43 PM

#

which also seems to be blocked

white salmon Jul 29, 2020, 1:43 PM

#

yeah

#

There's a very common type/form of reverse shell that often uses the same type as webpages.

#

(big hint)

simple shoal Jul 29, 2020, 1:43 PM

#

aaaaaaaaaahhhhhhhh

#

I see

#

Maybe the bug is my english haha*

#

Thanks guys !

white salmon Jul 29, 2020, 1:43 PM

#

If you're using Kali, try checking /usr/share/webshells/

#

and see if you notice a certain type of webshell that is in the list of filetypes ;)

simple shoal Jul 29, 2020, 1:44 PM

#

I'll look at it ^^

final mortar Jul 29, 2020, 1:45 PM

#

the answer IS in the original message you posseted btw

simple shoal Jul 29, 2020, 1:45 PM

#

Got it 😉

#

Thank you !

tidal sedge Jul 29, 2020, 2:17 PM

#

you’re not telling SQLmap the request for the login page
@solemn smelt --forms is a valid option and will work in this situation

spring tartan Jul 29, 2020, 2:23 PM

#

I'm doing "Lian_Yu" a beginner CTF. The second question is my problem. The hint is "in numbers"... using Dirbuster, I don't get any folder named with numbers. I get two folders, but not one I can convert to numbers. I could read the writeup, but thats too easy. Anyone who can give me another hint ?

📎 unknown.png

trim haven Jul 29, 2020, 2:24 PM

#

Ah I remember this

#

Try looking for wordlists online that contain only numbers

#

Make sure they're related to website busting and not just random numbers

spring tartan Jul 29, 2020, 2:25 PM

#

Thanks 🙂 I just used the default and medium wordlist

trim haven Jul 29, 2020, 2:25 PM

#

Awesome Sauce

final mortar Jul 29, 2020, 2:25 PM

#

You will get the directory with 4 numbers all right. You have to enumerate further levels

trim haven Jul 29, 2020, 2:25 PM

#

cough they found the answer, i think

final mortar Jul 29, 2020, 2:26 PM

#

I go away

trim haven Jul 29, 2020, 2:26 PM

#

haha

final mortar Jul 29, 2020, 2:27 PM

#

medium 2.3 will give him the result btw

#

he's just busting at the wrong place ig

sinful plaza Jul 29, 2020, 4:30 PM

#

anyone completed the https://tryhackme.com/room/uopeasy room??

TryHackMe

TryHackMe | uopeasy

University of Portsmouth's beginner room.

trim haven Jul 29, 2020, 4:31 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on

At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?

What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

sinful plaza Jul 29, 2020, 4:35 PM

#

am in the https://tryhackme.com/room/uopeasy sqlmap part finding the admin username and password i was able to see just 2 username i was unable to locate the admin details

TryHackMe

TryHackMe | uopeasy

University of Portsmouth's beginner room.

#

any hint will help

oblique cliff Jul 29, 2020, 4:36 PM

#

youre dumping the wrong database

sinful plaza Jul 29, 2020, 4:38 PM

#

wow

#

you mean i just spend 4 f$cking hours on the wrong database 😢

#

youre dumping the wrong database
@oblique cliff can you give more hint pls

trim haven Jul 29, 2020, 4:46 PM

#

I've got one

#

Dump the right database?

pseudo hamlet Jul 29, 2020, 4:46 PM

#

Guys need hint in Mr. robot CTF

sinful plaza Jul 29, 2020, 4:47 PM

#

but do you think am on the right|| link http://10.10.137.208/login.php||

trim haven Jul 29, 2020, 4:47 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

@pseudo hamlet

pseudo hamlet Jul 29, 2020, 4:47 PM

#

found wp login page

#

im stuck in enumerating page didnt know how can i enumerate users

#

i used wpscan didnt find anything

#

@trim haven bro any hint on username enumeration

final mortar Jul 29, 2020, 4:58 PM

#

You get a wordlist if you do some scanning with gobuster , use that to bruteforce the login page @pseudo hamlet

white salmon Jul 29, 2020, 4:58 PM

#

If I remember correctly it says if the username is valid or not on the login page

#

on failed attempt

oblique cliff Jul 29, 2020, 5:15 PM

#

@sinful plaza yes youre using the right link, just dumping the wrong database. Whatever you dumped shouldve told you all the database options

#

correcto distorted

torn pine Jul 29, 2020, 6:37 PM

#

On room Daily Bugle.. sqlmap is going at it... but so far it's taken 30 minutes... am i doing something wrong, or just impatient?

oblique cliff Jul 29, 2020, 7:04 PM

#

Neither

#

Sqlmap takes egregiously long sometimes

#

You just have to wait unfortunately

nimble sorrel Jul 29, 2020, 7:08 PM

#

alright I'm starting to feel like I'm overlooking something in "investigatingwindows" room

#

on task 11, I cannot find the log for this under security

#

can anyone point me around the time I should be looking? maybe I'm looking at wrong event IDs

nimble sorrel Jul 29, 2020, 7:35 PM

#

got it

#

but I don't understand what distinguishes this log from the rest

#

looking at it again

sinful plaza Jul 29, 2020, 7:37 PM

#

@sinful plaza yes youre using the right link, just dumping the wrong database. Whatever you dumped shouldve told you all the database options
@oblique cliff ok bro need to cool off my head a little thanks

remote yarrow Jul 29, 2020, 7:47 PM

#

I GET username and password but i cant to connect to ssh on Smag Grotto

#

any hints ??

oblique cliff Jul 29, 2020, 7:49 PM

#

the room just came out, gonna have a tough time getting hints

merry helm Jul 29, 2020, 7:49 PM

#

I GET username and password but i cant to connect to ssh on Smag Grotto
@remote yarrow It may be that this user you found is not to connect via ssh

trim haven Jul 29, 2020, 7:49 PM

#

I'm avoiding these chats because Spoilers

remote yarrow Jul 29, 2020, 7:50 PM

#

ok i try to find more thanks

#

i find it

deep coyote Jul 29, 2020, 7:59 PM

#

On the room Smag Grotto, was able to analyse the pcap and found a username and a password. Thought it was a ssh login. But it is not. Stuck. Need a few hints.

remote yarrow Jul 29, 2020, 8:02 PM

#

on pecap you will find your hint

#

easy

#

just focus

deep coyote Jul 29, 2020, 8:03 PM

#

i found a URI as well.

#

I hope that is the hint im looking for.

plush tapir Jul 29, 2020, 8:06 PM

#

Gah - I can download / view files on the server, but I can't upload anything

#

GAH - Got it

stark reef Jul 29, 2020, 8:52 PM

#

Any hint for how you moved on from finding the login in pcap file in smag?

ripe hedge Jul 29, 2020, 9:08 PM

#

there's obviously a pivot somewhere inside, and thus some form of redirect

#

I don't know 😦

lusty wigeon Jul 29, 2020, 9:08 PM

#

no pivot

glossy basin Jul 29, 2020, 9:09 PM

#

The room was just released...

white salmon Jul 29, 2020, 9:09 PM

#

but doesn't work

#

general question

glossy basin Jul 29, 2020, 9:10 PM

#

'general question' would be 'subdomain doesn't work'

minor bough Jul 29, 2020, 9:10 PM

#

Just a heads up, I've updated rule 15 to state that we don't provide hints or help until a week after release

odd panther Jul 29, 2020, 9:10 PM

#

good shout

#

can i use an id_rsa.pub to my advantage? (i know i can use the id_rsa) not sure on the .pub

stuck fractal Jul 29, 2020, 9:13 PM

#

It's a public key, it's designed to be shared

odd panther Jul 29, 2020, 9:13 PM

#

ok, so a no i take it. thank you

#

oh i see, shared is good

stuck fractal Jul 29, 2020, 9:14 PM

#

It's public

#

Like, given out

#

Freely

odd panther Jul 29, 2020, 9:14 PM

#

aye but i read if i add to server i can just login

stuck fractal Jul 29, 2020, 9:14 PM

#

As opposed to the private key, which you do not share

odd panther Jul 29, 2020, 9:15 PM

#

got from this. A public key, usually named id_rsa.pub. The public key is placed on the server you intend to log in to. You can freely share your public key with others. If someone else adds your public key to their server, you will be able to log in to that server.

stuck fractal Jul 29, 2020, 9:15 PM

#

if you have the private key associated with that public key, then you can use it

#

But you need the private key

odd panther Jul 29, 2020, 9:15 PM

#

right ok

#

I don't understand ssh as much as i thought then, more research

stuck fractal Jul 29, 2020, 9:15 PM

#

It's not really SSH so much as crypto as a whole

#

Asymmetric crypto

remote yarrow Jul 29, 2020, 9:16 PM

#

exactly

odd panther Jul 29, 2020, 9:16 PM

#

So if i added someone else's pub key to my authorized_keys they could not just login ?

#

(i thought they could)

#

oh i think I see how now.. 🙂 missed it in linpeas first time round

meager vine Jul 29, 2020, 10:02 PM

#

I’m struggling with the Intro to Linux room by Paradox, specifically the challenge at the end. He says “everything you need to capture the flag is in the room”. Does that mean there is no need to learn PrivEsc methods to capture it, that is, that the password is hidden somewhere and needs to be found, or does the machine have to be scanned for vulnerabilities?

ripe hedge Jul 29, 2020, 10:03 PM

#

it means all the techniques you need are learned in the room

meager vine Jul 29, 2020, 10:04 PM

#

it means all the techniques you need are learned in the room
@ripe hedge okay, looks like I was overthinking it. Thanks!

ripe hedge Jul 29, 2020, 10:05 PM

#

that happens on that room

odd panther Jul 29, 2020, 10:29 PM

#

is there a way to avoid this situation at all?
Situation: You gain access to a box, get a shell.. (via webpage, php shell). When I kill the shell or run something that hangs.. Then the webpage hangs from this point on, meaning a full room reset and try again. Is there a way to stop that or? (obvs me not running incorrect commands helps)

balmy crystal Jul 29, 2020, 10:40 PM

#

Hi, can somebody give me an hint of the Smag grotto room? I already founded the credentials from the packets, and tried to use them with ssh, i already make directory brute force, but there is no login page, only login directories, but they have the same other pages, but without css, some hints pls?

stuck fractal Jul 29, 2020, 10:41 PM

#

is there a way to avoid this situation at all?
Situation: You gain access to a box, get a shell.. (via webpage, php shell). When I kill the shell or run something that hangs.. Then the webpage hangs from this point on, meaning a full room reset and try again. Is there a way to stop that or? (obvs me not running incorrect commands helps)
@odd panther when you navigate to the page, the server runs the php file.

#

Navigate again, it runs it again

odd panther Jul 29, 2020, 10:41 PM

#

no it does not.

#

not on smag anyway

#

not had an issue before

stuck fractal Jul 29, 2020, 10:41 PM

#

Then you've broken something, because that's how it works PHP wise

odd panther Jul 29, 2020, 10:42 PM

#

I see.. I got the login page, ran a php shell.. got it. lost it.. page is dead from this point. (have to restart)

#

What if anything would I have broken?

#

the shell is from pentestmonkey

stuck fractal Jul 29, 2020, 10:42 PM

#

Load the URL for the shell again

odd panther Jul 29, 2020, 10:42 PM

#

hangs

#

so does login and admin

stuck fractal Jul 29, 2020, 10:42 PM

#

It should.

#

That shouldn't

odd panther Jul 29, 2020, 10:43 PM

#

again it does not

stuck fractal Jul 29, 2020, 10:43 PM

#

It didn't happen while I was testing the box

odd panther Jul 29, 2020, 10:43 PM

#

I know its not usually like that, why i asked

#

hahahaha

#

Classic.

#

was ok when i tried it

stuck fractal Jul 29, 2020, 10:43 PM

#

I ran through it a couple times

odd panther Jul 29, 2020, 10:43 PM

#

I can show you if you really like

#

i'm not crazy lol

#

Its not much of an issue etc, just thought its not normally like that at all

fleet pike Jul 29, 2020, 10:58 PM

#

In the Basic Pentesting by Ashu .. I am trying to discover the alternate route (I presume it's the one that does not involve the very long password via su/sudo) I've copied some exploratory scripts up to probe vulnerabilities and i'm drawing a blank.. lucky0 isn't. Dirty certonwrite has been washed out. and most of the rest of the "possible" exploits are from 2016, since the kernel is from 2018 i'm pretty sure those are also no go. but i tried a few of the cve's by compiling the poc w/ static, uploading, and running... big fat nothing.

balmy crystal Jul 29, 2020, 10:59 PM

#

Check the forum

fleet pike Jul 29, 2020, 10:59 PM

#

i checked the kernel patches from the successors to 4.4.0-119

balmy crystal Jul 29, 2020, 10:59 PM

#

There is an post

#

Maybe it help u

#

There is an post that talks about the alternate way

#

Did it help ?

fleet pike Jul 29, 2020, 11:09 PM

#

hmmmm

#

I dont want to peek yet. i already had to peek regarding the primary entry password (My rockyou password list was sorted, resulting in an order that would have taken hundreds of hrs to match)

balmy crystal Jul 29, 2020, 11:17 PM

#

Mmm

#

If u need a new one, i recommend u to check github, and there u search rockyou.txt

fleet pike Jul 29, 2020, 11:19 PM

#

i just found the xz i sorted originally and unpacked it, leaving it alone this time

#

I found rockyou was GOOD, but there were better options for locally hosted challenge boxes 😛

stoic jewel Jul 29, 2020, 11:19 PM

#

Hi folks, I have a ssh's public key, can I generate its private to use it to login ssh !!

stuck fractal Jul 29, 2020, 11:20 PM

#

No

fleet pike Jul 29, 2020, 11:20 PM

#

Short answer: no.. long answer: How much time you got?

stuck fractal Jul 29, 2020, 11:20 PM

#

That'd break like, everything

errant falcon Jul 29, 2020, 11:21 PM

#

Hey guys, is there a way to speed up port scanning on nmap?

stuck fractal Jul 29, 2020, 11:22 PM

#

Scan less ports, use a different scan type

#

nmap -sV -v -p- is pretty fast

stoic jewel Jul 29, 2020, 11:22 PM

#

I though I can analyse that public key, maybe it vulnerables to factorization

fleet pike Jul 29, 2020, 11:23 PM

#

Isn't there a courtesy setting, allowing for less time between request and response... most people refer to it as insane... the opposite being what, stealthy/sneaky?

errant falcon Jul 29, 2020, 11:23 PM

#

@stuck fractal actually I have tried night (Indonesian time zone) but the results are long, I played in the CTF Boiler room to find where the SSH service is running

stuck fractal Jul 29, 2020, 11:23 PM

#

I don't understand

white salmon Jul 29, 2020, 11:26 PM

#

you can try RsaCtfTool if it a weak public key

#

https://github.com/Ganapati/RsaCtfTool @stoic jewel

GitHub

Ganapati/RsaCtfTool

RSA attack tool (mainly for ctf) - retreive private key from weak public key and/or uncipher data - Ganapati/RsaCtfTool

stoic jewel Jul 29, 2020, 11:28 PM

#

Thanks @white salmon I'm playing the smag room and I find a public_key of ssh

white salmon Jul 29, 2020, 11:28 PM

#

ah no that won't work 😛

stoic jewel Jul 29, 2020, 11:29 PM

#

lol so what !!

white salmon Jul 29, 2020, 11:29 PM

#

it will take a billion years to crack that key

stoic jewel Jul 29, 2020, 11:30 PM

#

hard_work enable 😉

white salmon Jul 29, 2020, 11:30 PM

#

look what you can do with public keys

stoic jewel Jul 29, 2020, 11:31 PM

#

operating system !!

white salmon Jul 29, 2020, 11:32 PM

#

how public keys work with ssh

balmy crystal Jul 29, 2020, 11:44 PM

#

Short question, with smag, u refer to the smag grotto room, no?

#

the new one

balmy crystal Jul 30, 2020, 12:41 AM

#

.?

red arch Jul 30, 2020, 1:37 AM

#

I've got a rev shell on Smag Grotto and have been trying to ||get permission to access /home/jake/.ssh|| but I'm not finding anything, kinda stuck here

odd panther Jul 30, 2020, 1:48 AM

#

finally got root on smag, 6 hours over, i was so lost on something so simple

thin hare Jul 30, 2020, 1:49 AM

#

smag was fun

odd panther Jul 30, 2020, 1:49 AM

#

i found user so much worse, root was a 2min job lol

#

but i was being dumb so..

thin hare Jul 30, 2020, 1:50 AM

#

indeed

balmy crystal Jul 30, 2020, 1:50 AM

#

Some hint please

#

Im stuck

odd panther Jul 30, 2020, 1:50 AM

#

not allowed now

#

admin made it 15days from release..

#

i think

balmy crystal Jul 30, 2020, 1:50 AM

#

Ok

#

By now, im warching the packets, to se if there is something interesting

odd panther Jul 30, 2020, 1:52 AM

#

you know how to read them yeah? it was in a previous room

balmy crystal Jul 30, 2020, 1:52 AM

#

Yup

odd panther Jul 30, 2020, 1:52 AM

#

ok

balmy crystal Jul 30, 2020, 1:52 AM

#

I do

odd panther Jul 30, 2020, 1:52 AM

#

thats all you need

balmy crystal Jul 30, 2020, 1:52 AM

#

Ok

#

I’ll focus

odd panther Jul 30, 2020, 1:52 AM

#

you got this bro 🙂

balmy crystal Jul 30, 2020, 1:53 AM

#

Im shure that is something super easy but at same super dumb

#

xD

#

Its weird

odd panther Jul 30, 2020, 1:57 AM

#

It usually is I'm finding. I'm starting to learn to like take a 15min break have a coffee and a think etc, really helps

balmy crystal Jul 30, 2020, 1:58 AM

#

I ran nikto on /mail/index.php/login and its giving to me a lot of info

#

A lot

#

Im fine

#

Or lost

#

?

red arch Jul 30, 2020, 1:58 AM

#

xd

balmy crystal Jul 30, 2020, 1:59 AM

#

Its an hiden service or kinda facade, its weird

red arch Jul 30, 2020, 1:59 AM

#

I wonder if I can get linpeas on there

white salmon Jul 30, 2020, 2:00 AM

#

did you read the pcap?

balmy crystal Jul 30, 2020, 2:00 AM

#

Who

#

I?

#

(Me)

#

??

red arch Jul 30, 2020, 2:00 AM

#

well both of us lol we doing the same room

odd panther Jul 30, 2020, 2:00 AM

#

Just a heads up, I've updated rule 15 to state that we don't provide hints or help until a week after release
@minor bough Its a week sorry, not 15 days

balmy crystal Jul 30, 2020, 2:00 AM

#

Ok ok

#

did you read the pcap?
@white salmon i did, but didn’t found the .php site (hope u understand)

white salmon Jul 30, 2020, 2:01 AM

#

ok no hints anymore then 😛

balmy crystal Jul 30, 2020, 2:01 AM

#

Okey

odd panther Jul 30, 2020, 2:01 AM

#

<

balmy crystal Jul 30, 2020, 2:02 AM

#

I’ll drink something

#

And back

balmy crystal Jul 30, 2020, 2:36 AM

#

I guess I’ll let it 4 tomorrow, i got to sleep early

ripe rock Jul 30, 2020, 3:03 AM

#

i have a doubt on Smag, i did find something on the packet but seen it is not a ssh creds. did i am missing something?

wooden mist Jul 30, 2020, 3:08 AM

#

yes, you missed the whole http request

ripe rock Jul 30, 2020, 3:09 AM

#

there are only two http request protocol and 10 packets

digital iris Jul 30, 2020, 3:09 AM

#

google around more for how a http request is constructed

ripe rock Jul 30, 2020, 3:14 AM

#

@digital iris with all respects the guy was downloading a file with a .xxx extension thats all i see

red arch Jul 30, 2020, 3:29 AM

#

I think ill just wait for a writeup on Smog I cant get shit done after I get the revshell

ripe rock Jul 30, 2020, 3:29 AM

#

at least you have user flag

#

if i have ssh login i could do the entire challenge in less that a minute @red arch but not even close

true dust Jul 30, 2020, 3:54 AM

#

where to use the credentials found in a packet ? Room name: Smag Grotto

heavy anvil Jul 30, 2020, 3:56 AM

#

try open services

#

or website login if any

true dust Jul 30, 2020, 3:57 AM

#

tried on ssh! nothing

#

and there is no login page

stuck fractal Jul 30, 2020, 4:01 AM

#

google around more for how a http request is constructed
You got a hint from the creator that will help you massively

teal belfry Jul 30, 2020, 4:01 AM

#

I need some help in Smag Grott room, i found the login but couldnt find the proper login form..
any hint?

stuck fractal Jul 30, 2020, 4:01 AM

#

I just repeated the one from the creator

vernal goblet Jul 30, 2020, 5:09 AM

#

Just solved Smag Grotto
I want to say the creator and THM, a big thanks for this cool box.

final mortar Jul 30, 2020, 5:10 AM

#

#522158404614225920

indigo ridge Jul 30, 2020, 5:50 AM

#

Smag Grott: need hint on privesc.. I know the right path.. but I can't do it

#

can I dm someone?

radiant sage Jul 30, 2020, 5:55 AM

#

any privesc hints for smag grotto

indigo ridge Jul 30, 2020, 5:55 AM

#

any privesc hints for smag grotto
@radiant sage use linenum..

radiant sage Jul 30, 2020, 5:55 AM

#

@indigo ridge k thanks

lusty wigeon Jul 30, 2020, 6:19 AM

#

@radiant sage @indigo ridge you don't need any enumeration. you can get root the way you got user

indigo ridge Jul 30, 2020, 6:20 AM

#

I know

#

@radiant sage @indigo ridge you don't need any enumeration. you can get root the way you got user
@lusty wigeon I just need a little thing

lusty wigeon Jul 30, 2020, 6:20 AM

#

dm

frank dirge Jul 30, 2020, 8:25 AM

#

Hey! Doing the Overpass room. Successfully got the user flag. But stuck at the priviledge escalation part. Help please?

white salmon Jul 30, 2020, 8:28 AM

#

What steps have you done already?

#

Have you tried enumerating?

frank dirge Jul 30, 2020, 8:29 AM

#

Yeah did it using LinPeas. Still haven't found anything. I've decoded the user's password though. Am I missing something?

trim haven Jul 30, 2020, 8:30 AM

#

Figure out what you can and can’t control

#

Also look at the room tags that may be helpful

#

From looking at your level, I’m going to let you know that by any means this is not a beginner box. This is an intermediate box and will require more than basic knowledge. But you haven’t verified so I’m non the wiser.

frank dirge Jul 30, 2020, 8:41 AM

#

Yeah!! Already on it!! Have got the root flag!!

#

I was trying to figure out why I can't get the reverse shell to work

#

Damn the BSD netcat xD

shell shale Jul 30, 2020, 10:10 AM

#

Hi. I got to the end of this room

https://tryhackme.com/room/zthlinux

and the last task says I'm supposed to get the flag in /root/root.txt and that the room has everything I need to access that file.

I tried id and sudo -l on every user available to me (shiba1, shiba2, shiba3, shiba4, noot) but they all don't have root access. Then there is nootnoot which is in the sudo group, but its password is unknown. And the root user also has an unknown password.

Am I missing something?

I went through the whole room a few times already.

TryHackMe

TryHackMe | Learn Linux

A guided room designed to teach you the Linux basics!

white salmon Jul 30, 2020, 10:13 AM

#

You're absolutely on the right path.

#

And I can tell you that you're basically right at the edge of getting the answer

#

It helps to know everything about your target

eternal brook Jul 30, 2020, 10:29 AM

#

In the smag grotto room I got some creds but do not know where to use them....tried bruteforcing SSH but nothing found ||/mail and trodd user in page source || can't find any sort of login page nor the creds are working on SSH...

lime needle Jul 30, 2020, 10:30 AM

#

I am stuck in smag grotto

eternal brook Jul 30, 2020, 10:30 AM

#

https://tryhackme.com/room/smaggrotto

TryHackMe

TryHackMe | Smag Grotto

Do you remember how to analyse packets?

lime needle Jul 30, 2020, 10:30 AM

#

I know I am doing right but thing is not working

white salmon Jul 30, 2020, 10:32 AM

#

what step

fallen sedge Jul 30, 2020, 10:33 AM

#

@lusty wigeon can I dm you about smag grotto.

lime needle Jul 30, 2020, 10:33 AM

#

Can I dm it would be spolier?

white salmon Jul 30, 2020, 10:33 AM

#

@eternal brook read the whole request

eternal brook Jul 30, 2020, 10:35 AM

#

The wireshark one ?
||development.smag/login.php||?

white salmon Jul 30, 2020, 10:35 AM

#

yeah

eternal brook Jul 30, 2020, 10:35 AM

#

I tried visiting that

#

It's not opening...

white salmon Jul 30, 2020, 10:36 AM

#

you need to do something in your ||/etc/hosts|| file to visit it

eternal brook Jul 30, 2020, 10:36 AM

#

I added it to hosts file

#

Yeah I already did that

white salmon Jul 30, 2020, 10:36 AM

#

I know what you are doing wrong but figure it out yourself

eternal brook Jul 30, 2020, 10:37 AM

#

I tried using || curl || too still stuck

#

Ohk I'll try more I suppose...

#

Thanks anyway 👍

rapid flower Jul 30, 2020, 10:42 AM

#

@eternal brook same page

eternal brook Jul 30, 2020, 10:46 AM

#

Which page?

edgy gorge Jul 30, 2020, 10:46 AM

#

Where to look for Privesc in Smag room ?

rapid flower Jul 30, 2020, 10:47 AM

#

Which page?
The one that you want to access

zinc current Jul 30, 2020, 10:49 AM

#

@eternal brook stuck at the same point got wireshark stuff dont know what to do

eternal brook Jul 30, 2020, 10:50 AM

#

Yea I'm trying to use || curl on development.smag.thm/login.php used the creds with my curl command used curl cause site is not accessible || stuck at this point

final mortar Jul 30, 2020, 10:51 AM

#

for all those who are stuck with smag : look closely at the login.php request in the Wireshark capture , maybe you can get a new sub domain

lusty wigeon Jul 30, 2020, 10:51 AM

#

@fallen sedge sure

eternal brook Jul 30, 2020, 10:51 AM

#

I think I need to look into the way to deal with the subdomain I suppose @zinc current ..

edgy gorge Jul 30, 2020, 10:51 AM

#

and what about privesc once you're in ?

#

||tried the usual stuff with linpeas and pspy||

white salmon Jul 30, 2020, 10:54 AM

#

and what about privesc once you're in ?
@edgy gorge look carefully linpeas shows it, || crons ||

final mortar Jul 30, 2020, 10:54 AM

#

and what about privesc once you're in ?
@edgy gorge I don't think I can tell you that cause it's too easy 😅 Look closely

white salmon Jul 30, 2020, 10:55 AM

#

@final mortar do you think it can be also done with || dirtyc0w|| ? I kept trying it earlier lol

minor geyser Jul 30, 2020, 10:56 AM

#

Hey guys, I need some help with room room/ra. I'm stuck on privesc. ||Found something that runs regularly and what group I am part of but can't seem to advance||

final mortar Jul 30, 2020, 10:57 AM

#

@final mortar do you think it can be also done with || dirtyc0w|| ? I kept trying it earlier lol
@white salmon Maybe , don't know for sure. Now you mention it, I can check it too if you want

minor geyser Jul 30, 2020, 10:57 AM

#

Would really appreciate some help, been stuck on this room for a while now

white salmon Jul 30, 2020, 10:59 AM

#

@white salmon Maybe , don't know for sure. Now you mention it, I can check it too if you want
@final mortar Would be great if you do. I used || linux exploit suggestor|| and it lists || dirtyc0w|| don't know its reliability tho.

rapid flower Jul 30, 2020, 10:59 AM

#

Any resources for ||reverse shell payloads||

#

???

final mortar Jul 30, 2020, 10:59 AM

#

I never ran any automated script xD. I always try to look manually first

minor geyser Jul 30, 2020, 10:59 AM

#

Any resources for ||reverse shell payloads||
@rapid flower https://www.cybergoat.co.uk/cheatsheet/Reverse_Payload_Cheatsheet/

Reverse Shell Cheatsheet

When penetration testing, hackers often find themselves in a compromised system with a command execution vulnerability. Whenever the opportunity persists, the attacker must establish a reverse shell.

rapid flower Jul 30, 2020, 11:00 AM

#

@minor geyser thanks!

minor geyser Jul 30, 2020, 11:00 AM

#

np

shell shale Jul 30, 2020, 11:01 AM

#

It helps to know everything about your target
@white salmon
/etc/groups shows group a but I know nothing about it. No user is assigned that group and I can't change any user's groups anyway.

white salmon Jul 30, 2020, 11:01 AM

#

Try checking for any interesting files

#

maybe the user has some interesting documents or something lying around

final mortar Jul 30, 2020, 11:01 AM

#

Any resources for ||reverse shell payloads||
@rapid flower It's a simple googleable answer, not room related, so try to do your own research next time 🙂

eternal brook Jul 30, 2020, 11:02 AM

#

Hey just ont doubt regarding smag || do I need to add development.smag.thm to etc/hosts or just smag.thm cause when I visit dev.smqg.thm it does not load ||

minor geyser Jul 30, 2020, 11:02 AM

#

Anyone done this room --> tryhackme.com/room/ra? Would love some hints about privesc 🙂

shell shale Jul 30, 2020, 11:03 AM

#

maybe the user has some interesting documents or something lying around
@white salmon
I found ||/home/nootnoot/ll|| which contains numbers from 1 to 1000, not very useful.

final mortar Jul 30, 2020, 11:03 AM

#

Hey just ont doubt regarding smag || do I need to add development.smag.thm to etc/hosts or just smag.thm cause when I visit dev.smqg.thm it does not load ||
@eternal brook you need the one you want to visit 🙂 both if you need both

white salmon Jul 30, 2020, 11:03 AM

#

not very useful

#

you aren't trying hard enough

#

but that's not the right file

#

try looking for another file

#

it'll be a file that you've never really touched before

eternal brook Jul 30, 2020, 11:07 AM

#

Dammm I got thanks @final mortar thanks alot

final mortar Jul 30, 2020, 11:07 AM

#

blobfingerguns

#

Maybe you could edit out the message where you mentioned the full subdomain name @eternal brook

#

@white salmon

white salmon Jul 30, 2020, 11:09 AM

#

hi

final mortar Jul 30, 2020, 11:09 AM

#

oops that was a mistake

#

Don't hurt me pls (T_T)

eternal brook Jul 30, 2020, 11:12 AM

#

Sure

white salmon Jul 30, 2020, 11:14 AM

#

blobknife

oblique cliff Jul 30, 2020, 11:14 AM

#

So scary

rapid flower Jul 30, 2020, 11:30 AM

#

Any hints on how ti use the ||pub|| key... In smog?

tidal sedge Jul 30, 2020, 11:32 AM

#

We don't provide hints/help for newly released rooms.

rapid flower Jul 30, 2020, 11:33 AM

#

Ohh np

spring tartan Jul 30, 2020, 11:35 AM

#

I need a hint here in this beginner CTF. I need to find the folder, and the hint is "in numbers". I have created a wordlist going from 0000 to 9999, and used Dirb to run it. But it finds nothing. I guess I'm doing something wrong, since the name of the folder must be between 0000 - 9999

📎 unknown.png

final mortar Jul 30, 2020, 11:39 AM

#

go up a level 😉

spring tartan Jul 30, 2020, 11:43 AM

#

go up a level 😉
@final mortar My guess is that I should change something in this line "dirb http://x.x.x.x wordlist.txt" to go up a level ?

rancid crystal Jul 30, 2020, 11:51 AM

#

@spring tartan which room is it again?

#

oh lianyu

#

when i did it i just made a wordlist from google

📎 unknown.png

edgy gorge Jul 30, 2020, 11:56 AM

#

You can try default wordlists too

#

It'd give you in few seconds

spring tartan Jul 30, 2020, 11:58 AM

#

@spring tartan which room is it again?
@rancid crystal

📎 unknown.png

#

I created my own wordlist with numbers from 0000 to 9999. But did not find anything

rancid crystal Jul 30, 2020, 11:59 AM

#

what was the command you were using?

spring tartan Jul 30, 2020, 11:59 AM

#

Using Dirb or creating the wordlist ?

rancid crystal Jul 30, 2020, 12:00 PM

#

gobuster > dirbuster though

#

but it should give you the answer in between that though

spring tartan Jul 30, 2020, 12:00 PM

#

dirb http://x.x.x.x wordlist.txt

patent token Jul 30, 2020, 12:00 PM

#

~~dirsearch > gobuster > Dirbuster~~

rancid crystal Jul 30, 2020, 12:01 PM

#

Mayor waiting for your talk today

patent token Jul 30, 2020, 12:01 PM

#

🙂

oblique cliff Jul 30, 2020, 12:01 PM

#

I love dirsearch but its default wordlist misses a lot

edgy gorge Jul 30, 2020, 12:02 PM

#

~~Manually >dirsearch > gobuster > Dirbuster~~

rancid crystal Jul 30, 2020, 12:03 PM

#

so coming back to the question. idk why its not giving the answer..

spring tartan Jul 30, 2020, 12:03 PM

#

so coming back to the question. idk why its not giving the answer..
@rancid crystal Someone told me to go up a level. Not really sure how to

rancid crystal Jul 30, 2020, 12:03 PM

#

i didn't get what he meant by that either 🤔

oblique cliff Jul 30, 2020, 12:05 PM

#

Neither do I tbh lol

rancid crystal Jul 30, 2020, 12:05 PM

#

lemme try it myself

oblique cliff Jul 30, 2020, 12:05 PM

#

@final mortar

rancid crystal Jul 30, 2020, 12:05 PM

#

just a sec

spring tartan Jul 30, 2020, 12:05 PM

#

I thought it meant something like "dirb http://x.x.x.x/../" instead of "dirb http://x.x.x./" But not finding anything still.

shell shale Jul 30, 2020, 12:05 PM

#

@white salmon
:o I found the file. I didn't expect that to be in there. The room is complete now. Thanks for giving me hope lol 🙂

rancid crystal Jul 30, 2020, 12:06 PM

#

I thought it meant something like "dirb http://x.x.x.x/../" instead of "dirb http://x.x.x./" But not finding anything still.
@spring tartan no it didn't meant anything like that

#

just a sec

#

📎 unknown.png

white salmon Jul 30, 2020, 12:07 PM

#

@shell shale Haha, nice! Congratulations

#

yeah that file was fairly well hidden

shell shale Jul 30, 2020, 12:09 PM

#

Pretty much agreed. I wasn't aware of that dir at all. It was fun!

rancid crystal Jul 30, 2020, 12:12 PM

#

@spring tartan i tried it too but dirbuster didn't show anything with 200 threads 🤔

📎 unknown.png

spring tartan Jul 30, 2020, 12:13 PM

#

I guess it would be the same if I tried dirb or dirbuster ? Have only tried dirb

final mortar Jul 30, 2020, 12:14 PM

#

@final mortar My guess is that I should change something in this line "dirb http://x.x.x.x wordlist.txt" to go up a level ?
@spring tartan after you find a initial directory, scan it again

oblique cliff Jul 30, 2020, 12:15 PM

#

@final mortar that would be down a level FYI

final mortar Jul 30, 2020, 12:15 PM

#

no

oblique cliff Jul 30, 2020, 12:16 PM

#

Yea. Top level is home directory. You’re traversing down when you go in the subdirectories

final mortar Jul 30, 2020, 12:17 PM

#

if you look at it this way ...

#

In a general scan you can do something like x.com/FUZZ/FUZZ just another recursive level to your search

rancid crystal Jul 30, 2020, 12:18 PM

#

yeah get it.. you are not supposed to find that numbered directory before.. now by looking at going one level higher makes sense

oblique cliff Jul 30, 2020, 12:18 PM

#

You recurse down a tree, not up it

#

https://stackoverflow.com/questions/4939980/top-down-vs-bottom-up-recursive-data-definition

Stack Overflow

Top down vs bottom up recursive data definition?

While reading "Essentials of Programming Languages" I came across top down and bottom up definitions for list of integers.While I understand what these definitions say. But I am not able to underst...

wraith tapir Jul 30, 2020, 12:20 PM

#

In a general scan you can do something like x.com/FUZZ/FUZZ just another recursive level to your search
@final mortar depends on perspective

oblique cliff Jul 30, 2020, 12:20 PM

#

Particularly “When you're defining something top-down, you are defining it recursively”

spring tartan Jul 30, 2020, 12:20 PM

#

I'm a bit confused, but I guess I should look for the folder inside another folder ? like x.x.x.x/icons/ ?

oblique cliff Jul 30, 2020, 12:21 PM

#

When you go top down it’s the definition of recursive. When you go bottom up it’s iterative. Enumerating a subdirectory after you’ve found it is a recursive search. Therefore it’s top down

#

So down a directory

spring tartan Jul 30, 2020, 12:22 PM

#

Thnaks 🙂 I found the folder, inside another folder 🙂

oblique cliff Jul 30, 2020, 12:22 PM

#

Recursively 👀

final mortar Jul 30, 2020, 12:22 PM

#

Ok makes sense @oblique cliff

#

but I just meant in the command perspective tho

oblique cliff Jul 30, 2020, 12:23 PM

#

Not trying to call you out, that’s just important if someone’s trying to understand recursion to not confuse that

hollow arch Jul 30, 2020, 12:23 PM

#

guys any hint on windows priv esc by tib3rius... task 16
I've tried all options but to no avail

📎 windows_priv_esc_by_tib3rius.png

final mortar Jul 30, 2020, 12:23 PM

#

Not trying to call you out, that’s just important if someone’s trying to understand recursion to not confuse that
@oblique cliff ofc it's not a problem. You are even allowed to call me out mate but I just mean it in a loose sense

patent token Jul 30, 2020, 12:28 PM

#

Tr0x, the user privilege is there if you type whoami /privs in. The terminal on that machine.

lime needle Jul 30, 2020, 12:51 PM

#

Hello I am sure I am doing right I put my ssh public key in smag groto but still the ssh is prompting me password

#

Can anyone help or else there is something wrong with my approach?

final mortar Jul 30, 2020, 12:52 PM

#

Your approach is right

white salmon Jul 30, 2020, 12:52 PM

#

Public keys do not substitute for SSH password.

#

Public keys are basically the "lock", and private keys are the "keys"

lime needle Jul 30, 2020, 12:53 PM

#

I put the public key and I am trying to login with private key which I generated

final mortar Jul 30, 2020, 12:53 PM

#

That's not what he said as far as I understood. @white salmon

white salmon Jul 30, 2020, 12:53 PM

#

Oh

#

Did you add the key to authorized keys

final mortar Jul 30, 2020, 12:53 PM

#

I put the public key and I am trying to login with private key which I generated
@lime needle yeah the approach is right as I said

#

you are just doing something wrong with the command ig

lime needle Jul 30, 2020, 12:54 PM

#

ssh -i id_rsa jack@ip

final mortar Jul 30, 2020, 12:55 PM

#

ahem I meant the generating part

tidal sedge Jul 30, 2020, 12:55 PM

#

Restart ssh and it should work.

white salmon Jul 30, 2020, 12:55 PM

#

^

#

Usually you have to restart it once you've added a new key

lime needle Jul 30, 2020, 12:55 PM

#

Ohh I just gen using ssh-keygen

tidal sedge Jul 30, 2020, 12:55 PM

#

Through I have to warn you, we don't provide help/hints for newly released boxes.

final mortar Jul 30, 2020, 12:56 PM

#

It's 48 hours minimum for hints isn't it

white salmon Jul 30, 2020, 12:56 PM

#

I mean it sounds like he might just be having an issue using SSH correctly

final mortar Jul 30, 2020, 12:56 PM

#

Yeah and we are helping him out too rn

tidal sedge Jul 30, 2020, 12:57 PM

#

It's 48 hours minimum for hints isn't it
@final mortar It will be extended to a full week soon.

lime needle Jul 30, 2020, 12:57 PM

#

I am not asking about any part regarding box I know the process but the thing is whenever I tried login it ask me password

final mortar Jul 30, 2020, 12:57 PM

#

If his problem is with the generating part, as I suspect, then there's nothing much we can do

#

@final mortar It will be extended to a full week soon.
sounds good

lime needle Jul 30, 2020, 12:58 PM

#

If his problem is with the generating part, as I suspect, then there's nothing much we can do
@final mortar
Alright I will try

lethal zephyr Jul 30, 2020, 1:20 PM

#

so Smog Grotto got me all in a fuss I have logged into something but whatever i throw at it i get nothing in return. anyone able to throw me a nudge?

merry helm Jul 30, 2020, 1:25 PM

#

so Smog Grotto got me all in a fuss I have logged into something but whatever i throw at it i get nothing in return. anyone able to throw me a nudge?
@lethal zephyr You can take a test to check whether or not commands are being sent to the server, how about a simple ping test?

wraith tapir Jul 30, 2020, 1:25 PM

#

try ping -c 10 127.0.0.1 if the server hangs for 10 seconds, it means you have command execution

so Smog Grotto got me all in a fuss I have logged into something but whatever i throw at it i get nothing in return. anyone able to throw me a nudge?
@lethal zephyr

lethal zephyr Jul 30, 2020, 1:26 PM

#

thank you @wraith tapir @merry helm I can see I have command execution. just hunting for the right command now 🙂

wraith tapir Jul 30, 2020, 1:26 PM

#

what about a reverse shell?🙂

lethal zephyr Jul 30, 2020, 1:30 PM

#

what about a reverse shell?🙂
@wraith tapir yeah I am just trying to find one that works, got one to half work but the connection breaks

wraith tapir Jul 30, 2020, 1:34 PM

#

You will find the right one in reverse shell cheatsheet

lethal zephyr Jul 30, 2020, 1:34 PM

#

got it 🙂

gusty remnant Jul 30, 2020, 1:34 PM

#

I get the connection but I don't have root privs

#

You can try perl

#

Shell

#

It works

lethal zephyr Jul 30, 2020, 1:35 PM

#

got a shell now

gusty remnant Jul 30, 2020, 1:35 PM

#

But the privs is www-data

wraith tapir Jul 30, 2020, 1:35 PM

#

I get the connection but I don't have root privs
@gusty remnant the very first privesc command would do 🙂

gusty remnant Jul 30, 2020, 1:35 PM

#

Which one??

wraith tapir Jul 30, 2020, 1:36 PM

#

did you run linpeas

gusty remnant Jul 30, 2020, 1:36 PM

#

Yess

wraith tapir Jul 30, 2020, 1:36 PM

#

i will give it away if i tell the command

#

look carefully

gusty remnant Jul 30, 2020, 1:37 PM

#

Okk

polar plaza Jul 30, 2020, 1:42 PM

#

Hi there. Can anyone give me advice what to do with downloaded flag32.mp3 in Linux Challenges room to get a flag?

final mortar Jul 30, 2020, 1:44 PM

#

You just have to listen to it 🤔

amber rampart Jul 30, 2020, 1:45 PM

#

Is there a real info in the rick rolled video ? from the year of rabbit room ? or it's just a bait ?

final mortar Jul 30, 2020, 1:50 PM

#

There is never real info in that video kekw

amber rampart Jul 30, 2020, 1:51 PM

#

🙃 i was wondering if mb creator modify the vids or smthing like that 😂
Shit happen i got rick rolled 😦

polar plaza Jul 30, 2020, 1:56 PM

#

@final mortar thank you 😂 I don't know why I was looking all around and I didn't think to listen to the file

final mortar Jul 30, 2020, 1:58 PM

#

xD happens

azure hinge Jul 30, 2020, 2:07 PM

#

Hey their. Can anyone give advice me in which direction should i move in Smag Grotto . I found the pcap file but things aren't working ... could anyone give me a hint on what should i do

oblique cliff Jul 30, 2020, 2:09 PM

#

we dont give hints on box until a week after their release (will be added to the rules at some point)

lethal zephyr Jul 30, 2020, 2:15 PM

#

root
smag
uid=0(root) gid=0(root) groups=0(root)```

oblique cliff Jul 30, 2020, 2:16 PM

#

nice!

wraith tapir Jul 30, 2020, 2:16 PM

#

feels good right blobheart @lethal zephyr

lethal zephyr Jul 30, 2020, 2:24 PM

#

feels good right @lethal zephyr
@wraith tapir Yeah good box 🙂 nice and CTF'y

oblique cliff Jul 30, 2020, 2:26 PM

#

post in #522158404614225920 @jakeyee if you wanna give the creator some good feels 🙂

#

@lethal zephyr

fleet pike Jul 30, 2020, 2:55 PM

#

wow.. this dictionairy file is like the worlds biggest prank

#

raw file > 858k lines.. sorted uniq .. 11.5k

torn pine Jul 30, 2020, 3:03 PM

#

?

winged isle Jul 30, 2020, 3:26 PM

#

Hi, I have two questions for the room "Common Linux Privesc"

With LinEnum we see: "[-] Can we read/write sensitive files: -rw-rw-r-- 1 root root 2694 Mar 6 07:08 /etc/passwd". My question: user3 is not in the root group, why can he still write to /etc/passwd? Because everyone else is only allowed to read the file because of the last "r".
If user7 is member of the root group, and I know the password for that user, why should I still create the new user "new"?

heavy anvil Jul 30, 2020, 3:34 PM

#

user3 can't write to /etc/passwd

random thunder Jul 30, 2020, 3:34 PM

#

How about the second common private home range?

heavy anvil Jul 30, 2020, 3:35 PM

#

user7's group is root but he is not root himself so he can't run root commands @winged isle

winged isle Jul 30, 2020, 3:35 PM

#

Thank you! 🙂

heavy anvil Jul 30, 2020, 3:36 PM

#

How about the second common private home range?
@random thunder sorry couldn't get you

random thunder Jul 30, 2020, 3:37 PM

#

https://tryhackme.com/room/bpnetworking ~ #6

TryHackMe

TryHackMe | Networking

Part of the Blue Primer series, learn the basics of networking

heavy anvil Jul 30, 2020, 3:39 PM

#

its very comman almost all home routers have it set as defualt @random thunder

random thunder Jul 30, 2020, 3:40 PM

#

@heavy anvil can i DM you?

heavy anvil Jul 30, 2020, 3:40 PM

#

sure

rapid flower Jul 30, 2020, 4:28 PM

#

To the creater of Smag Grotto... A huge thanks to you!!! This room gave me a new perspective at solving things... Especially the privEsc part😂😂😂

white salmon Jul 30, 2020, 4:28 PM

#

@rapid flower #522158404614225920 material!

rapid flower Jul 30, 2020, 4:28 PM

#

Ohhh sorry... Didn't know about that

white salmon Jul 30, 2020, 4:29 PM

#

It's alright, but awesome that you like it!

#

#522158404614225920 is just where we'd like to keep all the nice things (or bad) about rooms and such

sinful plaza Jul 30, 2020, 4:41 PM

#

any hint for the smag room i can't access ||development.smag.thm/login.php|| even after adding it to /etc/hosts

final mortar Jul 30, 2020, 4:42 PM

#

that's weird

white salmon Jul 30, 2020, 4:42 PM

#

H3llo , has anyone completed Webgramming machine? i have some problem with task 3 and 8

stuck fractal Jul 30, 2020, 4:43 PM

#

Have you checked the Known Issues?

white salmon Jul 30, 2020, 4:44 PM

#

yes, but is for task 9

sinful plaza Jul 30, 2020, 4:45 PM

#

any hint for the smag room i can't access ||development.smag.thm/login.php|| even after adding it to /etc/hosts
@sinful plaza even after using a post request to send it also

#

any hints pls

stoic jewel Jul 30, 2020, 4:47 PM

#

@white salmon well bro I know how the ssh keys auth works, but I dont figure out it here

white salmon Jul 30, 2020, 4:48 PM

#

you know that you can login with a public key?

#

you have to put your pub key in authorized_keys

stuck fractal Jul 30, 2020, 4:50 PM

#

That's backwards

#

You log in with a private key

#

You authorise the public key that corresponds to the private key

#

If you have someone else's public key, you can't gain access to their machine

white salmon Jul 30, 2020, 4:51 PM

#

^

#

yes you're right

#

You can put the public key in the authorized_key, and then you can make a private key out of the public key you just inserted, to give yourself access

stuck fractal Jul 30, 2020, 4:51 PM

#

You can put the public key in the authorized_key, and then you can make a private key out of the public key you just inserted, to give yourself access
@white salmon You generate the public and private at the same time

#

It's a key pair

white salmon Jul 30, 2020, 4:52 PM

#

yea that

eternal brook Jul 30, 2020, 5:02 PM

#

Is there some problem with smag as soon as I get a shell and somehow loose I need to reboot the machine to access the || command page|| it's not loading of I loose the shell once I have to deploy the machine again

trim haven Jul 30, 2020, 5:08 PM

#

Haven’t heard anything. Losing connection is usually a VPN/Network issue. Check your VPN by running the command !vpnscript in #bot-commands (you will have to download the resources and set it up)

Also please try regenerating your configuration file and change regions. On top of that make sure multiple instances of the VPN are not running, to check this type !multivpn in #bot-commands to get instructions on how to solve it.

Anymore issues please come back here and or tech support.

stuck fractal Jul 30, 2020, 5:09 PM

#

I've seen other people reporting it, but it's not something I noticed when I tested the box

#

I recommend properly stabilising your shell so that you don't kill it by accident

sinful plaza Jul 30, 2020, 5:18 PM

#

@sinful plaza even after using a post request to send it also
@sinful plaza ???

trim haven Jul 30, 2020, 5:19 PM

#

I would have said the same, James, but having to restart the machine sound strange.

fickle jacinth Jul 30, 2020, 5:26 PM

#

i rooted smag grotto

#

it's very cool

trim haven Jul 30, 2020, 5:27 PM

#

Maybe leave a nice message in #522158404614225920 !

white salmon Jul 30, 2020, 5:27 PM

#

^

balmy crystal Jul 30, 2020, 5:27 PM

#

Nice

white salmon Jul 30, 2020, 5:27 PM

#

We love that you like it, #522158404614225920 is a good place for the creators to see it

balmy crystal Jul 30, 2020, 5:27 PM

#

Nice, I am in that @fickle jacinth

#

Its hard?

#

I think that yes

#

But it actually does?

trim haven Jul 30, 2020, 5:28 PM

#

#general

fossil iris Jul 30, 2020, 5:33 PM

#

Hey guys, can someone give me a hint for Smag Goro, i got the revese shell but dunno how to escalating?

fickle jacinth Jul 30, 2020, 5:34 PM

#

@fossil iris linpeas is your friend x)

fossil iris Jul 30, 2020, 5:35 PM

#

tks man

eternal brook Jul 30, 2020, 5:42 PM

#

Alright thanks :)

thorny nest Jul 30, 2020, 6:58 PM

#

rooting smag grotto was easy for me. Getting the initial shell was the tricky part. Overall, fun and a good learning experience.

white salmon Jul 30, 2020, 6:58 PM

#

@thorny nest I'm glad you liked it! The creator would gladly appreciate it if you put your thoughts on it in #522158404614225920 (he looks there a lot)

#

i have problem in WebGramming task 3, im trying enumerate with wordlist, with cartesian product and permutation of some char, but every time after 40 mins connection goes down. hint?

blazing ruin Jul 30, 2020, 7:15 PM

#

Trying to spin up OWASP Zap Scanner...

📎 Screen_Shot_2020-07-30_at_3.14.11_PM.png

stuck fractal Jul 30, 2020, 7:17 PM

#

You need to install it first

eternal brook Jul 30, 2020, 7:35 PM

#

I'm stuck at the Priv esc part of smag I found the ||cronjob tried editing it with some rev-shells also tried adding things like /bin/sh -i|| but it's not working any hints?

minor geyser Jul 30, 2020, 7:43 PM

#

Trying to spin up OWASP Zap Scanner...
@blazing ruin What OS are you using?

#

oh

#

haha

#

kali

#

I just didnt recognise the terminal

shut pollen Jul 30, 2020, 7:44 PM

#

Guys I logged into ||login page of snag but am stuck , no command I enter returns anything|| , help ?

#

Go KDE ! r/unixporn

eternal brook Jul 30, 2020, 7:48 PM

#

I'm stuck at the Priv esc part of smag I found the ||cronjob tried editing it with some rev-shells also tried adding things like /bin/sh -i|| but it's not working any hints?
@eternal brook anyone?stuck since long at this part..

#

@shut pollen try || rev shells you'll get your shell||

shut pollen Jul 30, 2020, 7:50 PM

#

|| will bash shells from pentest monkey/highoncoffee do || ?

eternal brook Jul 30, 2020, 7:50 PM

#

Yea

remote leaf Jul 30, 2020, 8:00 PM

#

So, I'm curious about task #4 on common linux privsec (how many shells - and yes I know the answer already). Since a shell accepts input from the user and provides ouput, options like ||bash|| are correctly considered a shell, however, other options like ||false, & nologin|| can't accept input or generate output, so as far as I know, they can't be considered shells, this makes the expected answer for this question in correct. If that definition is used (and it's the most widely used definition of a shell ) shouldn't the answer be ||9 , 1 for each user (8 in total) and 1 for the root ) ? || Yeah I know, noob question. Still learning, what can I say ?

shut pollen Jul 30, 2020, 8:01 PM

#

@eternal brook tried || bash reverse shells on admin.php || but doesn't seem to work man

red arch Jul 30, 2020, 8:01 PM

#

try perl

eternal brook Jul 30, 2020, 8:02 PM

#

|| nc worked for me||

oblique cliff Jul 30, 2020, 8:02 PM

#

@remote leaf there are no noob questions

red arch Jul 30, 2020, 8:02 PM

#

^^^^^^^^^^^^^^

oblique cliff Jul 30, 2020, 8:02 PM

#

its not asking how many users can have a shell

eternal brook Jul 30, 2020, 8:02 PM

#

||mkfifo|| one

oblique cliff Jul 30, 2020, 8:02 PM

#

its asking how many types of shells there are

shut pollen Jul 30, 2020, 8:03 PM

#

@eternal brook @red arch you are good people

red arch Jul 30, 2020, 8:03 PM

#

:P

eternal brook Jul 30, 2020, 8:03 PM

#

Np mate :)

ashen meadow Jul 30, 2020, 8:30 PM

#

any hint for smag don't know what to with that cron job

tidal sedge Jul 30, 2020, 8:34 PM

#

No hints/help for newly released rooms.

eternal brook Jul 30, 2020, 8:35 PM

#

Smag was fun box though loved it

balmy crystal Jul 30, 2020, 8:47 PM

#

@eternal brook can i dm you?

#

or can i dm somebody, im stuck on PE

#

pls

torn pine Jul 30, 2020, 9:28 PM

#

Seriously... "No hints/help for newly released rooms."

#

🙄

shell shale Jul 30, 2020, 9:35 PM

#

What's a newly released room? How new does it have to be to be considered as such?

trim haven Jul 30, 2020, 9:36 PM

#

A room that has been released within 48 hours.

shell shale Jul 30, 2020, 9:36 PM

#

Within the last 48 hours?

trim haven Jul 30, 2020, 9:36 PM

#

Yes.

#

Please talk about this in #general

stuck fractal Jul 30, 2020, 9:37 PM

#

The policy is a week

odd panther Jul 30, 2020, 9:37 PM

#

Bountyhacker was a fun box. I must be getting better only took me like 30mins!

shell shale Jul 30, 2020, 9:37 PM

#

Oh okay. I didn't expect that.
Yeah sorry.

trim haven Jul 30, 2020, 9:37 PM

#

The policy is a week
@stuck fractal Thought they were asking about the rule.

stuck fractal Jul 30, 2020, 9:37 PM

#

@trim haven I am too.

trim haven Jul 30, 2020, 9:37 PM

#

Oh is it 1 week?

#

Thought it was 48 hours, my bad, sorry.

odd panther Jul 30, 2020, 9:38 PM

#

Admin changes yesterday as it was a bit much everyone asking lol

#

like its only just out and people are asking for help.

#

enum, ENUM!!!! lol

shell shale Jul 30, 2020, 9:39 PM

#

Anyway. I'm working on this box's flags.

https://tryhackme.com/room/blue

But this question is rather more general.

What should I look for in Windows boxes? How to identify files as flags? Do they contain only one word or something, or are they named with some keywords?

TryHackMe

TryHackMe | Blue

Deploy & hack into a Windows machine, leveraging common misconfigurations issues.

odd panther Jul 30, 2020, 9:39 PM

#

files as flags? As in user.txt and root.txt?

stuck fractal Jul 30, 2020, 9:40 PM

#

Flags are typically in set locations on CTF boxes

#

On windows, normally desktops. One of the user, one of the admin. You're told where the flags are for that box

shell shale Jul 30, 2020, 9:44 PM

#

I didn't open the hints so I'm not told where they are.

odd panther Jul 30, 2020, 9:45 PM

#

When a box is out and done, how long before writes ups are typically added. I would like to make one in the future.

shell shale Jul 30, 2020, 9:45 PM

#

Just wanted some general overview about solving these CTF boxes.

odd panther Jul 30, 2020, 9:45 PM

#

Why not? Hints are there for a reason.

shell shale Jul 30, 2020, 9:47 PM

#

I would first try looking for something and if I wouldn't find anything, I'd use a hint.

stuck fractal Jul 30, 2020, 9:47 PM

#

When a box is out and done, how long before writes ups are typically added. I would like to make one in the future.
@odd panther Depends on the creator, I wait a week typically

shell shale Jul 30, 2020, 9:47 PM

#

But it looks like I'll use it anyway.

odd panther Jul 30, 2020, 9:47 PM

#

Thank you @stuck fractal 🙂

shell shale Jul 30, 2020, 9:50 PM

#

How can I Ctrl+C to kill a process running in cmd over meterpreter over msfconsole? O.o

#

Without killing the cmd shell.

#

Nevermind. Ctrl+C killed the cmd shell and put me back to meterpreter.

shell shale Jul 30, 2020, 10:12 PM

#

Finished Blue. Yay.
||Found out about meterpreter's search command.|| Very helpful.

odd panther Jul 30, 2020, 10:24 PM

#

how do you get the like website name from the IP? I'm trying to use Kerbrute but its asking for a domain name. I have the IP only and no info on how to get the name.

stuck fractal Jul 30, 2020, 10:24 PM

#

You're given the domain name often

#

Or you can get it from LDAP

#

Nmap can do it

odd panther Jul 30, 2020, 10:25 PM

#

Ok thank you, I will try these now, I think I have it but not working for me, I'll keep at it thank you

#

every time.. no wonder it stops working when the vpn goes off 🙂

#

Also again me... using wrong Ip.. had a 4 that should had been a 2.. my own worst enemy

odd panther Jul 30, 2020, 11:17 PM

#

forget there are write ups...

dire egret Jul 31, 2020, 4:40 AM

#

I'm doing that thing where I'm on an easy box - have something infront of me that should be simple - but with a tired brain I'm blanking

#

don't you love it?

white salmon Jul 31, 2020, 4:51 AM

#

Helps to have a process/methodology laid out, like a game plan.

stuck fractal Jul 31, 2020, 4:53 AM

#

Also no shame in taking a break

#

Grab some hydration, focus at different distances for a bit.

red arch Jul 31, 2020, 4:58 AM

#

sharks live in water so water is bad D:

worn kite Jul 31, 2020, 11:47 AM

#

Smag Grotto room help to get pcap file via wget

#

anyone

inland onyx Jul 31, 2020, 11:58 AM

#

@worn kite you're unlikely to find help for a newly released room, but try using wget <uri-of-file>