#room-hints
stuck fractal
Remove the other position
royal venture
as in just the symbols or the content too
and there's one at the bottom too, around 'submit'
stuck fractal
Make it not a position
stuck fractal
Then your encoding setting is wronf
royal venture
nope, 200 on that too
stuck fractal
Show me the setting
royal venture
royal venture
it was before my man, already tried it
trim haven
Oh no
stuck fractal
They're meant to all be 200
royal venture
...then why were you telling me i was doing something wrong
stuck fractal
You uploading the wrong file type isn't a HTTP error
Because they all had the same length
copper dome
woohoo i got it! thanks @stuck fractal
pseudo scroll
can someone help with room:ZTH: Obscure Web Vulns // unable to do the xxe challenge tried different payloads but nothing works
royal venture
i got a reverse shell, just need pointing in the right direction for this one:
royal venture
that doesn't seem to give the right answer, the answer's 4 characters long and im pretty sure www-data is longer than that lol
..in fact every pid seems to be "www-data"
if i do ||pid -u p [pid]|| at least
trim haven
Have you looked for users on the system, then checked their files?
Looking for who might have the files for the website
royal venture
i think checking every user like that would take... a long time
oblique cliff
Look at all running processes and see what’s running the web server
Or just check the passwd file
To see 4 letter users if you wanna hack it
Wouldn’t recommend tho
trim haven
blob no cheating!
slate isle
Where the hell i am supposed to download the files from.
trim haven
Good boy.
stuck fractal
@slate isle The box.
royal venture
aaaaaaaand im not sure where to go on the last vulnversity challenge
i ran the command, but...
hmm
white salmon
Which command?
white salmon
So, there's a special permission or "bit" set on the systemctl program
you have to figure out how to exploit this to get you somewhere
royal venture
yeah, i know
white salmon
Also, the command to run isn't necessarily only that
You have to do a little more than that
random thunder
need help with - https://tryhackme.com/room/zthweb2 task 7
slate isle
why am i getting connection refused when trying to connect to the box reeeeeeeeeeeeeee
random thunder
why am i getting connection refused when trying to connect to the box reeeeeeeeeeeeeee
@slate isle try disconnecting and starting it back again
gusty hedge
Harder box is updated....HTB domains are fully deleted.
white salmon
@random thunder Please give more details about what you need help with- where are you at and what do you need a hint for?
random thunder
i did run the wfuzz with --hw 57 but i only get this after the run C=404 instead of a 200
trim haven
@slate isle What command are you running? Has this occurred before? How long have you been connected to the VPN? Are you connected to the VPN? Are you using the correct IP?
slate isle
works through scp, but doesnt work with ftp or filezilla
now my question is how do i get the flag from mp3 file, commands used for playing it don't work as they are not installed.
near shoal
Ok guys... a question about room "Intro to x86-64", last task because I'm confused. So I go into crackme2, look at the disassembled main it ||points at a file. which has the password in it.|| I guess that's too easy... see the hint on the task and guess the thing. Game over, I feel like a cheat. I decide to give ti another look. Look at the assigned vars and find the same answer, but not ||why the answer is reversed||. I feel disappointed that I didn't understand that part in the assembly
anyone got a hint for what I'm missing?
white salmon
I mean- that's the thing about RE is that it's all about critical understanding of a hard-to-understand program.
It helps to try and "categorize" or group a piece of assembly into functions
Remember, this assembly that you're looking at is very likely just a program coded in C++ or something
near shoal
aye
white salmon
and the compiler turns your C++ programming into optimized assembly programming.
Keyword is optimized- so it isn't really meant for "our eyes", but it's still trying to do the same functions as the original C++ programming
Try to think about how you'd program this program in Python for example
A lot of functions, especially string manipulation ones, are usually just loops
wary ridge
Welcome room access your first machine... Do I have to use a VM or is there an easier option like steps 1, 2 & 4 please?
quiet horizon
aye
@near shoal did you RE it with Ghidra? sometimes it's so efficient, especially with it's decompiler, it can give answers away where it normally would have taken a bit more work with gdb or r2.
white salmon
So with this, you can assume something like
password = file.txt
final_password = do_thing(password)
if input == final_password
pass
else
fail```
since you have a rough idea of how the program works already@quiet horizon nah, I did it in r2
white salmon
You just need to piece together the "groups of assembly" to these lines of code
every piece of assembly is linked to one of these lines
near shoal
yeah thanks @white salmon I get what you're saying. I'm going to keep looking at it and see if I figure it out
white salmon
yea
Like it helps to set a breakpoint inside the loop, and try to think of what it's doing in terms of a higher programming language
like "for each letter in string, do thing"
near shoal
yeah, I think I may be still missing some clarity on few instructions. Time to spend some time with it and decompose everything 😄
gladly I have the patience
white salmon
@wary ridge If you have TryHackMe subscriber, then the easiest way is to start up the web-browser based Kali VM. Otherwise you'll have to set up your own, (or alternatively convert your current working computer as your hacking machine but it might be difficult)
near shoal
I actually enjoy this kind of puzzle, kinda wish the hint hadn't given it away so I wouldn't feel like such a cheat 😄
white salmon
Yeah, RE takes a lot of patience, willpower, and understanding
lmao
it's really fun and rewarding though
near shoal
that it is...
white salmon
it's like figuring out a new language (it is)
near shoal
it's the demon-souls of hacking 😛
quiet horizon
lol
near shoal
I do.
white salmon
it helps to try and group things for your own organization's sake
white salmon
if you watch videos on people doing RE or assembly work, they always group together assembly instructions as a whole function
and it really does help
near shoal
yeah, would probably help to look at the chart view
but trying to avoid it for this room
just exactly for that reason that I need to get the habbit of doing that for myself first
thanks for all the help
definitely appreciate it
oblique cliff
if you watch videos on people doing RE or assembly work, they always group together assembly instructions as a whole function
@white salmon any recs 👀
wary ridge
@white salmon got VBox Kali setup it works however not sure how to get the result for the task
white salmon
this is a really interesting video on how the compiler tries to optimize your code
and may help you understand a lot more on how it interprets your functions and conditionals/loops
Oh
have you read the instructions? what have you done so far?
oblique cliff
Ty
white salmon
ye
You can learn some cool programming tricks too
that may or may not be useful for speed
white salmon
yeah
Really cool cool idea of using math expressions as if conditionals
instead of using if statements
oblique cliff
Only time speed matters if you’re doing a coding interview
wary ridge
Copied the IP address tried to load the website in Kali Linux connection timed out.
white salmon
Are you connected to the VPN?
oblique cliff
Really cool cool idea of using math expressions as if conditionals
@white salmon what do you mean?
white salmon
are you going to the actual IP address of the machine, or are you going to http://MACHINE_IP
wary ridge
white salmon
@oblique cliff This is an If statement
for a very specific purpose but it's an if conditional that's made pretty much made only out of math
near shoal
oh boi
proud scarabBOT
TryHackMe
oblique cliff
Very interesting
white salmon
Theoretically this is super optimized for assembly
and runs very very quickly
compared to using an if statement
which may or may not have to "pause" to interpret future data
oblique cliff
That’s really cool
wary ridge
Run it through OpenVPN?
oblique cliff
I’m gonna code like that for work from now on
near shoal
@oblique cliff good luck on your new job next month
stuck fractal
Run it through OpenVPN?
@wary ridge You need to connect to the TryHackMe network in order to talk to anything on 10.x.x.x. The THM Attack Box or THM Kali are already on the network
wary ridge
@stuck fractal ok, how do I do that from VBox Kali as don't have a way to use either through tryhackme site please
stuck fractal
Connect to the VPN from Kali
The tutorial is in the welcome room, and you've just been linked to it
wary ridge
Ok thank you
stuck fractal
any hints on Looking Glass still in enumeration phase
@limber iron New box
No hints
Rule 13
limber iron
Sure
wary ridge
The hint is in that room? Hmm... Inspect?
stuck fractal
The hint is in that room? Hmm... Inspect?
@wary ridge ???
wary ridge
Is OpenVPN in Kali?
trim haven
wut
stuck fractal
Is OpenVPN in Kali?
@wary ridge Openvpn is preinstalled in Kali Linux
You need to get your config file and use that to connect to TryHackMe's openvpn
proud scarabBOT
TryHackMe
stuck fractal
Connect to the VPN
Follow the OpenVPN room.
We've asked you to please look at that about 3 times now
We've provided a solution, please actually listen and act on it
wary ridge
Hold on... Just got something that didn't show up before... Thanks for your help everyone
royal venture
i have no idea why johntheripper is doing this
this is what im doing:
sudo john --wordlist=/usr/share/wordlists/rockyou.txt.gz hash.txt, with the hash in the hash.txt file
stuck fractal
It does not
trim haven
I hate to give answers but
royal venture
i remember it working in the past
trim haven
unzip rockyou.txt.gz
stuck fractal
gunzip
trim haven
Whoops sorry
wary ridge
Obviously been typing something wrong here, as it claims there's an error in the command line...
white salmon
smh imagine not using tar xzcf
oblique cliff
That’s what I do
trim haven
As long as the command works I really couldn’t care
royal venture
...aaaaaaaaaaaand apparently the cracked password isn't the right one, despite it... definetly being the right one
trim haven
So you cracked it and got an output?
wary ridge
Typed sudo openvpn file location, filename, error opening configuration file of filename
Obviously it's different from what I wrote down.
stuck fractal
Then you didn't specify the location correctly
#site-support please
This isn't room help, it's VPN help
unkempt tapir
iron swallow
I am currently working on the “Linux challenge” room an need some hints to get access to the / .bash_history directory for some reason not working for me 😩
stuck fractal
It's not a directory
iron swallow
I
iron swallow
The flag is located where bash history is stored
stuck fractal
Why did you put a / there?
iron swallow
I’m new to this lol
stuck fractal
Have you done the Learn Linux room?
iron swallow
Yes
stuck fractal
I recommend you go back and do it again
iron swallow
😩😩
Going back lol
Lol I figured it out thanks looks like I need to go back and read up on some more
stuck fractal
If you can't explain why you're doing something that isn't working, you probably ought to try something else
stuck fractal
What enumeration have you done?
dull epoch
i have done linpeas
but i saw these two files called credential.pgp and tryhackme.asc
dull epoch
No
@stuck fractal oh ok thx
dull epoch
thanks @stuck fractal !!
i rooted the box
stuck fractal
Research is important
random thunder
wfuzz not completing the entire list of words, is there anyway to force it?
iam using wfuzz from cli with version2.2.9-1
stuck fractal
That sounds like a generic problem?
random thunder
How do i fix that?
stuck fractal
If you'd like a hint, please ask
And please give us enough info to give you a hint, like what room and what stage
white salmon
Im at the learn linux and task 21
im a beginner so im kinda having trouble understanding all these
stuck fractal
So have you broken down the task?
final mortar
At this point, I know Task 21 by heart 😄
stuck fractal
@white salmon Do you know what an environment variable is?
Do you know how to set them?
Do you know the name of the variable you need to set here?
Do you know the value that you need to set it to?
white salmon
I dont fully 100% comprehend it yet, I'm looking back to other tasks and rereading but I've been at this for 30 mins now 😂😂
stuck fractal
You're told what the binary will test for. You need to make that test succeed
Then you will get the password
white salmon
Okay ill try
verbal vale
Hey there, I don't get it .. I'm stuck on a dumb question and I can't find the answer, I must be dumb haha ..
What is the name of the technique that "Search Engines" use to retrieve this information about websites?
I tried a lot of stuff but nothing works --'
mortal kernel
I would approach this question asking how search engines get their information
Would a key phrase stick out?
verbal vale
The crawler get the different keywords of the website, send it to the Search engine so it can store it
Then the search engine make a query to his DB to retrieve it ?
mortal kernel
Eventually, yes. But is there a phrase associated with what the bot is doing?
mortal kernel
How does a spider move?
verbal vale
oh
mortal kernel
You were right there 
verbal vale
It moves on a web .. what i'm supposed to do with that haha
I thought your hint would help me but I don't know how to keep going lol
mortal kernel
If I’m remembering the question and associating it correctly to a room, I believe you have already said the answer, but have called it a noun instead of a verb
verbal vale
Room "googledorking" btw (task 2)
A noun instead of a verb hmmm
The noun query I believe
Oh
mortal kernel
A spider doesn’t just move it <...>
mortal kernel
You're not dumb, you're learning
verbal vale
true !
- the fact that english isn't my main langage doesn't really help for the understanding
mortal kernel
Not a problem.
Try re-reading the segment Let's Visualise Some Things... It mentions how search engines work and briefly mentions how crawlers also have another word associated with their actions.
verbal vale
They index the content ?
But index was the answer of the previous question on the task
mortal kernel
They index the information after they've acted as crawlers
A crawler will look through a website and attempt to traverse it
verbal vale
Yes ?
I've read everything again but can't find the word i'm looking for
Found it ...
That was dumb
verbal vale
In my mind, it wasn't the search engine that was doing the indexing part
So I wasn't looking on that side
mortal kernel
You figured it out, though and you persisted 🙂
verbal vale
Anyway, thank you for your help on this one !
mortal kernel
So spiders don't just move, they crawl among a web. In IT terms, we talk about crawlers the same way. Fun fact, crawlers can also just be called spiders.
verbal vale
Okay, got it
agile whale
Are we able to talk about looking glass yet or is it still too new?
mortal kernel
Usually it takes about a week before we can talk about them 🙂
agile whale
ok thanks, I will keep going at it then
James is just mean for making the SSH change each boot
trim haven
I mean it’s been more than enough time but I’m not sure if James wants a specific amount of time or not
sinful plaza
can someone give me a nudge on the jigsaw 2 room i have ||d0zk0zsi4s07m3w0s3
p4as1aqz3m3cc
y375cy4l4a3j64z3|| but i have no idea what to do with it
jolly crane
@sinful plaza: Try to decrypt the hash?
sinful plaza
hash??
golden sedge
Hi, can anyone give me a hint for the privesc on the Overpass 2 - https://tryhackme.com/room/overpass2hacked room
trim haven
ls -lAh ~ in home directory
Well I mean that will give you the home directory contents
golden sedge
Yeah I've already tried that and there's a .suid_bash executable which does not set your UID to root
golden sedge
@trim haven Thanks for the help
cursive nexus
That one took Cake and I a few minutes to figure out what the issue was there.
random thunder
Iam getting no devices connected when i setup Nox and enabled the developer options on mac for https://tryhackme.com/room/androidhacking101 - task5 can somone help?
real storm
I had to scroll up and see hints on Overpass 2. That was a neat little thing..
verbal vale
I'm kinda confused on /room/zthlinux (task 33) ..
Here's the question (see screeshot)
So I went in the folder with cd test and now I don't really know what to do, I tried grep shiba4 test1234 but obviously that's not it (I was quite desesperate lol)
oblique cliff
try using the find command to find the binary
verbal vale
I already did
But what do they mean by "The actual binary will check for two things"
Like, I got the directory called "test", and I got the file "test1234", so the binary should have all he needs ^^
trim haven
Did you create the directory called "test"?
trim haven
Okay, good
verbal vale
But to run the binary, I need to find it
verbal vale
At the root there's only the test folder
And in the test folder there's only 2 files : test & test1234
trim haven
You shouldn't be able to access root..?
oblique cliff
thats not root
verbal vale
trim haven
That's not root
oblique cliff
thats the base of the home directory for the user shiba3
verbal vale
oh
oblique cliff
jabba
trim haven
Yos
verbal vale
oblique cliff
@verbal vale you need to find the binary shiba4
trim haven
@oblique cliff wut
verbal vale
Yeah I did
trim haven
I'm sure the binary is called binary 3 btw
verbal vale
trim haven
The room put the wrong binary name iirc
verbal vale
Oh
trim haven
You need to look at the task name
verbal vale
"Binary - Shiba3" ?
oblique cliff
ok either way, you need to use the find command to find it. the find command you tried is only gonna search in the current directory for whatever youre searching for
you want to search the entire file system
verbal vale
oh
oblique cliff
"Binary - Shiba3" ?
@verbal vale yes, the binary is calledshiba3
verbal vale
ok Imma try something
oblique cliff
👍
verbal vale
But the previous one was already shiba3 (when I was logged into shiba2)
^^
anyway I need to find the flag that search in every directory
trim haven
Must be shiba4 then my b
oblique cliff
ok so lets ignore jabba for now
verbal vale
np np
oblique cliff
verbal vale
haha
oblique cliff
and the binary name will be shiba4
trim haven
Yeah ignore me, I'm half asleep
oblique cliff
everything still stands that i said before, just change the name
so you now need to search the entire file system for a file called shiba4
verbal vale
But the find command is supposed to search through all the child' folders isn't it ?
(Without any flags)
Default find command
oblique cliff
no
well, uh yes
but you gave the base directory the home of shiba3 the user
they never said its in a subdirectory of the user shiba3
hence your need to search the entire computer
which starts at /
verbal vale
Oh
oblique cliff
youre starting at /home/shiba3
trim haven
I'm presuming you type find / shiba3
oblique cliff
haha
trim haven
or find / shiba4
oblique cliff
no
you just searched for everything the subdirectory /home/shiba4 contains
you need to find the file shiba4
regardless of where it is in the file system
can you research how to use the find command to search the computer for a file of a specific name?
verbal vale
Using a flag that only give me files and not directories ?
I'll try to find than using man find
oblique cliff
you could do that but thats not important for this. They is where to start your search
@verbal vale you can use the almighty google for this, which will work. There's also a room called thefindcommand which will help your endeavors. tremendously
verbal vale
I'm confused, I don't really understand, so somewhere in the computer there's a binary file called shiba4 right ?
And using the find command I need to find it ?
With his path, I'll then be able to execute it because I have all the requirements
I guess I'm right so far
oblique cliff
With his path, I'll then be able to execute it because I have all the requirements
@verbal vale ?
i dont understand what you mean by that
but the other 2 comments are correct
verbal vale
The requirements given in the task description
I mean, if I execute it but the 2 things aren't good, it won't give me the password I believe
oblique cliff
yes, the binary checks that the directory /home/shiba3/test exists
verbal vale
I tried find / shiba4 -type f but it says there's no file or dir with shiba4
oblique cliff
and that the file /home/shiba3/test/test1234 exists
really? get rid of the type and see if that helps
stuck fractal
That's not how you use find to find a file with that name
Keep reading the manual a little closer
verbal vale
find -type f / shiba4 that's what I tried at the beginning
But I think I'm doing a punctuation pistake
mistake
oblique cliff
research how to find a file based off the name of it
trim haven
^
stuck fractal
That means take stream 2 (standard error) and redirect it to /dev/null (like a black hole)
trim haven
you typed "2>dev/null"
verbal vale
Yay !
trim haven
Woop
verbal vale
Nice it works !
stuck fractal
No spoil
verbal vale
Thank you for your help @trim haven @stuck fractal @oblique cliff 😄
No spoil
@stuck fractal +1
white salmon
Is there like a possible hint for the last task in learning linux?
toxic scarab
there's a whole write up
oblique cliff
Look for files owned by users that are out of place @white salmon
there's a whole write up
@toxic scarab he just wants a hint. Hence the hints channel
white salmon
Oh okay thanks
toxic scarab
@oblique cliff and for that final task there isn't really a hint i can think of that doesn't say what it says in the write up
steel oyster
im confused on task 12
oblique cliff
Same
toxic scarab
of learn linux?
it's looking for a flag that you can use with su command. maybe try man su to read more about the command?
oblique cliff
Don’t know he didn’t specify the room or anything
white salmon
Okay I'm still dead stuck at task 43 of learn linux
toxic scarab
just going by the last room he was asking for help in #room-help
white salmon
none of the shibas are able to do sudos
toxic scarab
so you can't sudo then
white salmon
check files owned by every user
toxic scarab
Sir Blob's hint from above told you to check for files owned by different users
oblique cliff
Shibas aren’t the only users on the machine
white salmon
Oh sneaky, thanks okay ill find my way around 😅
buoyant zenith
im in c4ptur3-th3-fl4g room
i cant seem to find the #3 datatype
MJQXGZJTGIQGS4ZAON2XAZLSEBRW63LNN5XCA2LOEBBVIRRHOM======
dont need a direvt answer if there is some resource i can llokup
stuck fractal
That looks like a base encoding to me
buoyant zenith
oksy ill check
stuck fractal
And a specific one by character set and trailing =======
buoyant zenith
i tried 64
stuck fractal
Too many = for b64
buoyant zenith
hmm
stuck fractal
And base64 typically has lowercase
stuck fractal
The character set and the bunch of trailing = tells me pretty quickly what encoding it is
toxic scarab
keep looking
grave rain
Also tried wfuzz on the command params
On all three pages
When i reach 'select' word while bruteforcing with big.txt the connection times out
It doesnt time out while using other wordlists
toxic scarab
it doesn't time out. it creates an error on certain words in big.txt
toxic scarab
the same word causes the error, but the server responds at different rates so it gets back to you on a seemingly different word in the wordlist
but this really has nothing to do with the challenge
grave rain
Aah yes i got that word
But its irrelevant¿
Ill try continuing the fuzz after that
Am i still on the right track?
toxic scarab
you found 3 .php pages
the hint was given: keep looking
toxic scarab
i don't think so, since it pretty much reveals that the 3 .php files you found are not going to do you any good, so there's no need to fuzz them with command parameters
grave rain
Ill search for a fourth page
Still nothing 😪
Obv im doing something wrong
Cant figure it out anyhow
woven mirage
The task doesnt tell you to search for a .php page
woven mirage
read the task
grave rain
I got one part
bronze ivy
re read the task multiple times
grave rain
Omg
empty osprey
Hi people. I'm at the last task on ZTH: Web 2 room (API Bypassing), the room uses the wfuzz tool, I'm really stuck here
Any tip?
I tried to pass these parameters: IP/api.php?cmd=FUZZ
empty osprey
Alright, I'm probably losing something
toxic scarab
keep in mind your ultimate goal for the task
tight tendon
anyone ... am stuck again on overpass2 ive found the needded file .||/suid_bash|| ive searched gtfo bins and tried most of the commands there..almost all of them put me back again in james or spawn a reverse shell with james's acc 😦 how do i get root 😦
stuck fractal
It's just bash
Bash drops privileges when ran as root with suid, unless you tell it not to
toxic scarab
gtfobins bash
tight tendon
gtfobins bash
@toxic scarab ive tried almost evrythng there 😦
Bash drops privileges when ran as root with suid, unless you tell it not to
@stuck fractal let me search that
stuck fractal
It's on GTFOBins
verbal vale
There then 🙂
So : /room/zthlinux
How am I supposed to access the root folder ?
Like ... I don't have his password
tight tendon
Bash drops privileges when ran as root with suid, unless you tell it not to
@stuck fractal thank you so much ❤️ ❤️ after two days now i've solved it 😄
stuck fractal
@verbal vale You need to get root privs
verbal vale
Oh
Lemme try something
I don't get how, I wanted to see group list with /etc/passwd but I can't
I also tried to add the user shiba4 to sudo group (believed there is one, but no)
toxic scarab
have you tried all the users?
stuck fractal
I don't get how, I wanted to see group list with /etc/passwd but I can't
I also tried to add the user shiba4 to sudo group (believed there is one, but no)
@verbal vale You need to be root to add the user to the sudo group
group list is in a different file
verbal vale
Before I check room write ups, is it gonna give me the answer or just hints ?
verbal vale
I don't want it then
I prefer searching more "myself"
With just hints when I'm stuck
So I need to be root user, or give myself permission to the file
stuck fractal
You need to become root
verbal vale
So maybe I should check the permissions associated to the file ?
stuck fractal
You can't give yourself permissions without being root
verbal vale
Okay
stuck fractal
It's only readable by root
verbal vale
So you said root id's are written somewhere else on the computer ?
verbal vale
By id's i meant password, and yeah my bad I don't know why I thought you did ^^
Alright then, where can I start my research in order to try to be root ?
stuck fractal
Look for files that are out of place
verbal vale
Files that are out of place ... there are so much files ^^ '
toxic scarab
and when doing that remember that different users can access different files, so you might want to try the same thing as different users
oblique cliff
maybe poke around there and see if theres anything interesting in those directories, eh?
stuck fractal
Files that are out of place ... there are so much files ^^ '
@verbal vale Users will usually create files in their own home directory
verbal vale
Yeah that's what I see
But I can't access this file with my actual user ..
That's pretty tough I got to admit
I didn't think the third room I do would be that challenging haha
verbal vale
That's what I did I found something interesting
I finnally succeeded to get a good command and I try to run it on the different users
stuck fractal
no spoil
verbal vale
Yeah sorry
But, I can't connect to that user, even tho I'm using su command and the right password
Oh i was using the wrong one ..
Did it!
empty osprey
Hi again, after the @toxic scarab tip I tried with this command:
wfuzz -c -z file,/usr/share/wordlists/dirb/big.txt --hw 0 -Z http://IpAddress/api.php?cmd=cat /FUZZ/flag.txt but without success
toxic scarab
wow. that looks pretty complicated
empty osprey
I'm close to the resolution? I'm in the right way?
toxic scarab
nope.
toxic scarab
you are making it much more complicated than you need to. just remember what the task tells you to look for
empty osprey
the task tell us "You don't know any user, try and read the flag.txt"
I don't know where the flag.txt is, because that I used the FUZZ as the user folder
toxic scarab
so do that: read the flag.txt
were you able to get http://ipaddress/api.php?cmd=ANY_COMMAND to display anything no matter what command you tried? if not, why expect that your fuzzing is going to generate anything?
if http://ipaddress/api.php?cmd=id did not generate something like the example showed, then this version of the api does NOT work the same way the example described. Without documentation or any clue as to how the api works, we don't know what parameter the api will work with. It could be cmd, action, command or a near-infinite number of other parameter names. Without that, we can't even begin to try different values for the parameter.
white salmon
No time is lost if you learnt something.
south sail
Is firefox the only web browser allowed on the virtual machine?
south sail
I am trying to hit my machines webpage and keep getting an error with firefox
sry noob here
stuck fractal
Not all machines have a webserver
south sail
I am trying to answer probably one of the simplest questions...Go to your machines website - What is the flag text shown on the machines webpage?
I would take the public IP address and place that in the machines webpage?
stuck fractal
Not a public IP address
Click deploy on the Welcome room
it gives you a 10.10 IP address
The Public IP address will be for your Kali or AttackBox
Which also has a 10.10 IP
south sail
ty..I was deploying the attack machine
white salmon
i mean there is a certain way how to use it, that does not add up
stuck fractal
It's something special about bash
white salmon
i got it
stuck fractal
Bash drops permissions if suid
white salmon
i exploit it but i do not understand how i access it
stuck fractal
What do you mean?
white salmon
can i msg u ?
stuck fractal
Ok
white salmon
ok lame failure as always, thank you James. I delete my comment as there are hints in it
faint helm
I am probably way overlooking the obvious here, but need help with the initial room. I tried both the Kali and Attack Box in-browser deployments and both just give a 405 error on their IP's in the in vm browser. I see port 80 is open on 0.0.0.0 with python.
stuck fractal
You're not meant to put those IPs into the browser
You're meant to deploy the VM in the Welcome room and use the IP in Active Machine Information
faint helm
When I deploy the VM in the Welcome room via the "Deploy" button, it will configure and show at the top of the screen, but only with the non-routable IP. That machine is not listed under "My Machine".
stuck fractal
@faint helm That is expected
It's a local IP address, on the TryHackMe network
My Machine is your attacking machine
The machine that you deploy in a room is the target machine
faint helm
I just figured that out...knew I was missing something about how the platform worked. Thanks for the help.
alpine lantern
hey, need help for this room :https://tryhackme.com/room/linuxctf for #2 Task 3 : ```
Flag12 is located were MOTD's are usually found on an Ubuntu OS. What is flag12?
What do you need help with?
ashen matrix
Did you google what MOTD is as well as what this may be located?
white salmon
^
You'll have to google where MotDs are stored on Linux for it
and look inside the file itself
alpine lantern
@ashen matrix yeah
i already look for a lot of website that's why i'm asking here 🙂 i already found this :
||/etc/update-motd.d/ ; /etc/motd ; but none of them works||
white salmon
The flag is stored in a file that has the MotD when you login.
white salmon
Please delete the first screenshot because it shows the flag/correct answer
@white salmon sorry
thanks :D
np np
Are you sure your LHOST is correct?
i hope so im using the web brwoser thm kali linux
ill try the ip below the browser kali
Yeah, double check both IPs
I don't think the web browser kali linux should be in 10.10.0.0 range
verbal vale
Hey, for room/linuxctf
I heard about the uname command, am I on the right path ?
white salmon
i got two different ips and none of them seems to be working
i heard the bolt_authenticated_rce doesnt work nomore
alpine lantern
@verbal vale i got it and didn't do it with the "uname" command
white salmon
strange
verbal vale
Okay
white salmon
Have you updated your metasploit?
verbal vale
Because for the hint, they give *release but it doesn't really help haha
verbal vale
I tried find / -name "*release" -type f 2>>/dev/null
alpine lantern
@verbal vale yeah 🙂
white salmon
i had the older version of it cause i coulnt find the exploit, but after updating i finnaly saw it in my metasploit
alpine lantern
i didn't use "release" btw 🙂
verbal vale
Oh
white salmon
@white salmon ill try it at home on my own kali linux
verbal vale
@alpine lantern I found a lot of commands there, I'm testing them : https://www.tecmint.com/commands-to-collect-system-and-hardware-information-in-linux/#:~:text=1.,kernel name of your system.&text=To view your network hostname,with uname command as shown.
alpine lantern
@verbal vale i didn't found the flag with theses commands too 🙂 but maybe u can
verbal vale
I didn't ^^
agile whale
Are we able to get hints for Looking glass yet? I am stuck at humptydumpty.txt, I have the password from it but having issues with the first part of the file
fossil coyote
Hey I'm trying to do the cross site scripting room, In the stored XSS challenge where you need to steal jack's cookie I am using request bin and I'm sending it with window.location, my only problem is that jack never checks the message. Is there something special I have to do to make jack view the message board or does it run automatically?
ok I'm an idiot I just found the solution to my issue. I just had to hide it in an image tag 😄
tidal token
Hi, can soemone help me for the last question of this room : https://tryhackme.com/room/lfi#
I run as root but I don't know how to find the root flag
wooden mist
check /root/
wary shuttle
@tidal token try using the find command
wooden mist
should be there
tidal token
Thanks I found the flag
mossy ermine
Ultratech room. Stucked at the beginning of task3. I'm trying to understand the hint 'Look closely how the Api is used'. Any hint to clarify the hint?
astral smelt
Using command injection
mossy ermine
Using command injection
@astral smelt Ok many thanks. Trying command injection the page outputs a file name and It was it. Thanks!!!!!💯
astral smelt
NP 🙂
craggy socket
Need some help with Sublist3r room Task4 #8
One last one for fun. NBC produced a popular sitcom about typical office work environment, which dns record might be associated with this show?
Can anyone give a hint?
trim haven
I’m presuming they’re referring to “The Office” but you can probably find that with a google search
craggy socket
Yeah! I've looked all over the records...Got no clue
oblique cliff
There’s one that pretty obviously related to “the office”
final mortar
Jabba just mentioned the show
Try searching with that keyword in the accompanying text file
white salmon
Hi everyone. I am pretty stuck at the room ZTH: Obscure Web Vulns. I am trying to get tplmap to work. But neither on my pyhsical client nor on the THM VM I can start tplmap successfully. I get python errors all the time. Anyone was facing this issue recently?
white salmon
Please consider my question as resolved. It took me some time but finally got tplmap to work
woven mirage
Whats the situation in asking for tips in looking glass, can we ask yet? 👀 I'm stuck in humptydumpty and dont know where to go, i have one thing that i think maybe is the next step but i'm not sure, not gonna say here because might be spoilers
oblique cliff
are the writeups published yet?
if no, ask james, but probably not till he posts writeups
ebon ferry
royal venture
yo
im a little stuck here
i got the key, changed the permissions, all that but uh
i can't figure out the username
this is in the networkservices room btw
the only usernames that seem to make sense don't exist, apparently
royal venture
i have tried literally every format i can think of
final mortar
You haven't done the most common one apparently
opaque wedge
can anybody give me a hint of looking glass
stuck fractal
I did over in the John Hammond discord
opaque wedge
can i dm you?
stuck fractal
@woven mirage seeing as you're both at the same stage...
Something is out of place and should stick out for you when you're enumerating the filesystem. See what you can do.
No. You cannot.
opaque wedge
okey let me try
stuck fractal
There's a video coming soon as well, once the video drops I'll give more hints.
willow rock
white salmon
@white salmon so the exploit doesnt work in browser. i tried it in my own kali linux and everything worked fine 🙂
sinful plaza
hint now available for the looking glass room??
sinful plaza
cool
mild eagle
So is it okay now to ask for small hints in room looking glass . Been at it for days 🙂 just stuck at Alice now
stuck fractal
Run some privesc enumeration scripts and try some manual enumeration
See what files you can read that might give you some information on how to privesc
mild eagle
Yup already been doing that ... but guess I would have to better at using my looking glasses 🤓 since I must have overlooked it.....
stuck fractal
There's a video coming soon on it, I'll give more hints then
In the mean time, I recommend working through that
left frigate
so quick question, on looking glass ||do the poems have anything hidden inside them, after getting access as humptydumpty I mean||?
mild eagle
@stuck fractal tnx will be working through the list again more thoroughly... just want to make it before the video 🙂
stuck fractal
@left frigate Keep enumerating
Same hint I gave earlier.
seeing as you're both at the same stage...
Something is out of place and should stick out for you when you're enumerating the filesystem. See what you can do.
left frigate
alright thanks 🙂
mild eagle
@stuck fractal tnx man think i found something very interesting i just need to figure out how to use it 😄
left frigate
@mild eagle can I dm you? something small I found that I wanna confirm 🙃
brittle hedge
i am currently in Linux Walkthrough room, under task 18, im asked what the value of the home environment variable is, i am at a dead end here, am i supposed to find it in PuTTY or? hints plz 🙂
shut pollen
Hints on Looking Glass ? Nmap let me down on this one 
oblique cliff
@shut pollen not yet
i am currently in Linux Walkthrough room, under task 18, im asked what the value of the home environment variable is, i am at a dead end here, am i supposed to find it in PuTTY or? hints plz 🙂
@brittle hedge google how to check environmental variables on Linux
stuck fractal
Hints on Looking Glass ? Nmap let me down on this one
@shut pollen Nmap is going to give you a bad day. Use a simpler scan or wait for it to finish
shut pollen
Simpler than NMAP without any flags ?
uneven nebula
but i have the text file
but i don't know how to run it..i mean it's giving me an error
stuck fractal
You don't run the text file
uneven nebula
ugh
alpine lantern
hey, need help for https://github.com/rebootuser/LinEnum the LinEnum room, i wget LinEnum but i can't execute it :
oblique cliff
you downloaded the html page
you need to wget the raw.github page, not the github page itself
gib more upvotes 
alpine lantern
@oblique cliff Thx 🙂
stuck fractal
@trim haven reeee
trim haven
😎
oblique cliff
HEY
thin sorrel
For Dumping Router Firmware Room, Task 2 number 7 . I have tried submitting the date and time i got from Binwalk 20*8-*****. The room says wrong submission
Please help.
slim cedar
So I'm trying to do the burpsuite room (rpburpsuite) and I'm stuck on the Sequencer, I can't seem to get it to show any results and the Analyze now is always greyed out, any ideas how to let burpsuite sequencer analyze?
royal venture
would be cool if the room had explained that
stuck fractal
And you need to replace [local tun0 ip] with your tun0 IP. No brackets.
would be cool if the room had explained that
@royal venture it did.
astral smelt
it tells you the question before
royal venture
right, i misread
aaaaaaaand i didnt get anything on the listener
and, yes, its my tun0 ip
stuck fractal
...you pasted it in there as [local tun0 ip]
You didn't replace it
You also may have killed it by attempting to run sudo
royal venture
yes, i know, im saying i went back and re-did it correctly (relogged too) and it isn't working
stuck fractal
What do you mean by relogged?
And you need to show us what you're doing if you want help with it
royal venture
stuck fractal
You can't just say "I did it correctly and it didn't work" because the room isn't broken so you've made a mistake
royal venture
well im doing what it says so idk man
stuck fractal
What do you mean by relogged?
royal venture
i mean i exited the telnet session and started a new one
stuck fractal
Terminate the box and deploy it again
agile whale
Are we able to get hints for Looking glass yet? I am still stuck at humptydumpty.txt, I have the password from it but having issues with the first part of the file
stuck fractal
@agile whale https://crackstation.net/
agile whale
James, when is that video coming out? I need some hints on getting into Alice (have found possible way but having issues exploiting it), am hoping to get some more hint before the solutions are given out
agile whale
ok
dusky sleet
Hello, I am stuck on the Hacktivity called Linux Walk Through on the last task, 43. I don't know how to gain access to get the key at /root/root.txt. I know that I need sudo priviledges to check the password of root which is at /etc/shadow. I checked /etc/group and found out that nootnoot is in the sudo group so if I could find the password of nootnoot first, I can gain sudo priviledges. I'm stuck now. I know the /home/nootnoot has the file ll that counts from 1 to 1000, but I don't knwo what to do afterwards. Can someone give me a hint?
stuck fractal
Look for files that are out of place, using find
white salmon
If the ll file doesn't have anything useful in it, then you'll have to keep looking.
dusky sleet
hmm k
white salmon
Try to look for files that you haven't really messed with during the entire walkthrough
those are usually the suspects
dusky sleet
I went back to the shiba1 directory. I noticed that the shiba1 binary file has user rws priviledges. I tried editting the shiba1 binary file by looking at where the file calls the shiba2 password and it was "cat /etc/shiba/shiba2". I made sure noot.txt was there. I changed that string to /root/root.txt. I ran it, but it didn't work. It just gave me the Segmentation fault (core dumped) error. Do I have the right idea?
stuck fractal
Nope.
You found that one of the users was a sudoer
You can't edit a SUID binary btw, it loses the SUID bit when you do that
dusky sleet
k so in shiba3 directory, I realized that I never used /test/1234 but there's no data inside it so it's useless?
dusky sleet
are you talking about the /opt/secret/shiba4 binary? because it only requires a test directory in the home dir and contain a file test1234. The previous task doesnt require a file 1234
stuck fractal
I'm talking about a file that is out of place
Normally users create files in their own home directory
dusky sleet
well the shiba3 and shiba4 files in /etc/shiba do look strange since the groups are both not root
stuck fractal
Keep looking.
You will 100% know when you see it.
Use find, search for each user.
sick sun
anyone here done with privs on python playground ?
need some hint
low oriole
i must be overthinking looking glass
stuck fractal
If you're trying kernel exploits, you've gone too far
low oriole
@stuck fractal not at all 🙂 enumerated a lot and found stuff that sounds like it is intended for later
stuck fractal
Which user are you?
low oriole
just jabberwock
stuck fractal
Oh... Do some super basic privesc enumeration then.
It should jump out at you pretty fast.
low oriole
I always, always, always overcomplicate 😄
agile whale
is it possible to get another hint with looking glass, I logged as alice and found a few things with sudo but not short if I am wasting my time with it (have been stuck on this bit for a while now)
low oriole
oooh i wish i was there 😛
agile whale
you sound to be just a few days behind me 😉
stuck fractal
I always, always, always overcomplicate 😄
@low oriole no seriously just throw an enum script at it or follow the Payloads All The Things guide
low oriole
@stuck fractal I just did. I'm so stupid 😄
stuck fractal
That cheatsheet is really really helpful.
agile whale
@stuck fractal is hostname/sudo important or am I wasting time on it? can you give a few more clues before the video gives out the solution in a few hours
low oriole
That was actually a lot of fun. Thanks @stuck fractal
shut pollen
Hints on looking glass ?
low oriole
@shut pollen how far are you?
shut pollen
Scan
trim haven
If writeups aren’t on the room I believe it’s because James doesn’t want any hints
I believe that later on tonight the room will open up as there is going to be a video uploaded of the room.
I apologise if I’m incorrect I’m just following what other people was told yesterday.
shut pollen
Still , a lil help would be good. Like the Nmap scan is returning a long list.
final mortar
I believe that later on tonight the room will open up as there is going to be a video uploaded of the room.
@trim haven
trim haven
Exactly
Thank you Quantum
We have to respect what the room creator wants so until James comes online we will have to avoid providing help.
low ore
mossy ermine
Guys, I need some help for the ConvertMyVideo room. Stucked on challenge 2, where I've to find a username to log in the secret page. Any hint?
white salmon
hello I am working on the splunk room and on task 2 question 21 it wants the splunk command for renaming fields when doing a search and I believe it is rename but every time I type rename it says it is wrong. I have checked the pdf and searched through google and splunk's other docs and they all say rename. Is this an issue with the question or is there a different renaming command?
hello I am working on the splunk room and on task 2 question 21 it wants the splunk command for renaming fields when doing a search and I believe it is rename but every time I type rename it says it is wrong. I have checked the pdf and searched through google and splunk's other docs and they all say rename. Is this an issue with the question or is there a different renaming command?
wow don't know why that sent twice
final mortar
Because rename is wrong
white salmon
got it thanks!
sleek mantle
hi , I'm working on the advent of cyber room and I'm stuck in [Task 16] [Day 11] , I created a directory named 'nfs ' as a mount point ..so i run this commande : sudo mount <IP-address>:/opt/files /home/root/nfs .. but i get " mount point /home/root/nfs does not exist".
but when I use : mount......./root/nfs I get : acces denied by server while mounting <IP-address>
if anyone can help pls
oblique cliff
Can you show screenshots instead of typing that ugliness
tidal sedge
Try specifying the nfs format using the -t flag
silk oracle
mount -t nfs <ip>
fallen hamlet
question 2 task 18 of Learn Linux room pls help?
sleek mantle
still get the same result
tidal sedge
@sleek mantle Post a screenshot again
tidal sedge
Try using nfs version 3 🤔
sleek mantle
tidal sedge
Let me try from my machine
tidal sedge
Okay, it works for me, try changing the directory name to something else other than nfs, try test
tidal sedge
Try changing the dir and cd'ing to it again
Oh, wait you can't mount it 🤔
It worked for me on the same ip 🤔
Are you running the vpn on your host or your kali?
sleek mantle
yea i'm the only one with this prblm .. I've seen some solutions and it worked for them without any trouble
on my host
tidal sedge
Run it on your Kali
silk oracle
create a new directory in different location better to be in desktop, root sometimes won't allow
tidal sedge
It's a VPN problem
You're supposed to run the vpn on your attacking machine (in your case Kali)
sleek mantle
but I've already used many tools and thm tasks with vpn on my host
tidal sedge
Run it on your Kali.
sleek mantle
ok
tidal sedge
Running the vpn on the host can cause problems, like not being able to catch a reverse shell, being unable to mount stuff etc
eternal brook
Hey stuck at Priv esc part of Year of the rabit I'm user ||Eli|| but I know there is some msg sent when I login using SSH some database where o couldn't find something useful any hints?
wooden mist
Guys, I need some help for the ConvertMyVideo room. Stucked on challenge 2, where I've to find a username to log in the secret page. Any hint?
@mossy ermine try messing with the/page first,
eternal brook
Hey stuck at Priv esc part of Year of the rabit I'm user ||Eli|| but I know there is some msg sent when I login using SSH some database where o couldn't find something useful any hints
oblique cliff
do you know what the message is?
dusky sleet
@stuck fractal I finally figured out the solution! Finding all the files of each user was a big hint. Bad assumptions I made are that I did something like find / | grep shiba1, but that was too specific. And I thought that the Permission denied error output was too long to read so it's only when I added 2>/dev/null at the end of find which mades things much easier to see.
stuck fractal
Ew, don't pipe find into grep!
Use the arguments to find to make your find more specific
dusky sleet
the pipe into grep makes a red highlight on my terminal which made it easy to see which files were not permission denied
bad assumption
deft sand
Can any1 tell me if I’m barking up the wrong street with a brute forcing script for looking glass?
stuck fractal
If you're checking more than 20 ports, you are.
You shouldn't be brute forcing anything
stuck fractal
I wouldn't use nmap here
deft sand
Tyvm
stuck fractal
For those stuck with initial access on Looking Glass, your hint is "O(log n)"
deft sand
Lol not sure what’s different other than the 1 with c so not sure how to use that
simple mountain
anyone free to give me a hand with the.. umm beginners nmap room?
stuck fractal
Just ask your question, don't ask if anyone can help
After all, how do we know if we can help if we don't know what you need help with?
simple mountain
Good point, well presented.. I'll try again...
Hey guys, I'm having trouble with the last nmap beginners room task. i'm running it as nmap -A --script vuln <ip address>, but I'm not seeing the promised vulnerability
This is what I see
rough helm
hello, i need help i don't know why i can't send my "POST request" in the "Web fundamentals" room last task question 2
oblique cliff
Screenshot
oblique cliff
That’s cuz that’s supposed to be <
You didn’t send it to the right url
Look where you’re supposed to send it
Look where you did
oblique cliff
The directory
patent token
Hello
rough helm
Hello
grand pivot
im at /Harder yet and im trying to get the shell, but when im trying to execute some command like nc or php for the shell the server is like... freezing?
i reboot the server 3 times now because of this
but just that subdomain
rough helm
( @oblique cliff )
rough helm
thanks
oblique cliff
Just a bit inexperienced you’ll get there 🙂
grand pivot
i thougth that maybe would be nc for some reason and like php was going to work and, same thing. I dont know if keeping trying or what
oblique cliff
Replace <whatever you want to send> with what you want to send
Which is just flag_please
After you do that. Check the directory you’re sending the post request to and check if it matches where you’re supposed to be sending the post request @rough helm
hint: it’s not
grand pivot
or maybe some way i can experiment with commands without taking down the service?