red garden
why not work
#room-hints
stuck fractal
elder cliff
median compass
what room, what task are you doing @elder cliff, you have to help us help you
distant grail
Well have you done any research? @elder cliff
elder cliff
yes but not finding
distant grail
I would try harder because it's easy enough
median compass
have you tried google? it's literally in the first result when I try it
elder cliff
uh i am just start today
median compass
google "how many well known ports are there"
a LOT of learning this stuff requires you to be able to search for answers, that's how you learn
median compass
well, keep trying, you'll get there
elder cliff
❤️
sinful thicket
Hey all I’m wondering if anyone can give me a hint to the LookingGlass Room I’m in but stuck with the ||(root) NOPASS /sbin/reboot|| any tips?
woven mirage
Have you checked the cronjobs?
sinful thicket
I have indeed
woven mirage
Let me Just check If im remembering right
yeah, the cronjob is where the cake is at
sinful thicket
I noticed it’s called at reboot , tried doing a imitation reboot file and changed the PATH but that did not work and naturally If I do it wrong I’m back to square one
woven mirage
well, you dont need to imitate anything, you can just reboot the machine
sinful thicket
Yes but then the port and passwords change again hence back to square one lol
woven mirage
they do, but when rebooted something happens doesn't it?
sinful thicket
Yeah that was my next cue to try , so I was looking in the right place lol thank you buddy !
woven mirage
np
stuck fractal
The box is designed to punish you if you make a mistake.
sinful thicket
I noticed haha I quite like it though
silver crater
Hey Everyone!
sinful thicket
Hi all I got stuck again on the LookingGlass room this time on poetry all I managed to find is it’s from the book ||chapter 6 pages 55-56|| Could someone point me in the right direction here please?
I tried a few things but been stuck here a little while now
stuck fractal
What user are you?
sinful thicket
||hunptydumpty||
sinful thicket
Let me check. I see the 6 users and notice execute on 1 in particular is that the right direction?
stuck fractal
I want to say linpeas should catch it, but I'm not sure there
Abnormal permissions are normally worth investigating
sinful thicket
Awesome okay thank you buddy I’ll do some more digging. I also didn’t use linpeas I try to do it myself manually ideally
stuck fractal
Ok but it's a good tool to have
sinful thicket
Of course for sure I do have it so I might put it over and have a check , thank you again!
cinder gazelle
Hi. I'm doing the box "Steel Mountain" and when I try to start the service after replacing .exe from msfvenom, I keep getting this error: The service did not respond to the start or control request in a timely fashion. Can someone please help me with this? Thank you.
stuck fractal
Generate an exe-service payload
change the format you're generating to exe-service
cinder gazelle
Thank you @stuck fractal
@stuck fractal I generated new exe after modifying exe to exe-service and the service won't start:
stuck fractal
Why won't it start?
true yoke
Hello everyone! It would be great if someone could help me.
I'm going thru OWASP TOP 10 [DAY 3]. It's said that there is another bonus flag/challenge. I believe that I found a potential steganography based part, but the problem is that I spent 2+ hours looking for a passphrase. As for now, I'm stuck.
Any hints/ideas?
Thanks in advance.
P.S. sorry if it's the wrong channel.
stuck fractal
For the voucher code?
It's no longer available, you would have to have emailed the address on the page to get it
true yoke
lol :)
Thanks. Anyway, it was great practice with various tools.
such an easy way it was to get the voucher
cinder gazelle
@stuck fractal I don't know. Sorry for being dumb. Is there a way I can check the logs through shell?
stuck fractal
I mean you should be told when you use sc to start it?
cinder gazelle
It doesn't say anything:
stuck fractal
It's starting
cinder gazelle
yeah, that's what I thought, but after a while sc query returns that the service is stopped. Let me try again.
stuck fractal
Do you have a listener etc?
cinder gazelle
yes
stuck fractal
have you tried redeploying?
cinder gazelle
no. Doing it now
cinder gazelle
Redeployed and tried again. No success 😦
solemn smelt
are you using the correct IP address? thats the only thing I could think of that could stop it
cinder gazelle
Yes. I'm using the correct IP
solemn smelt
Have you followed what the writeups have done
honestly not sure where it would stop working other than somewhere in your payload or listener
warm hatch
any write ups on this room? i played so much with the first crackme1 and just got it by guessing a little
i am missing such a small thing and i wanna know what it is
trim haven
No write ups sadly
trim haven
What do you think it is
warm hatch
i got it correct but
trim haven
Oh okay
warm hatch
some random 0 is in there
trim haven
Well now that you have got it correct it should be easier to understand
If you look closely
warm hatch
no i dont get it LOL, thats why i need write ups, my actual answer is missing just 1 character
trim haven
There are 2 0’s
warm hatch
yeah this 0 is confusing me
trim haven
Do you know how to identify loops?
warm hatch
yeah the jumps
is it easier to try and write it as code?
i just put a break point on string call
trim haven
It’s much easier and there are tools out there that will turn it into code iirc
warm hatch
and see what it might be trying to compare
solemn smelt
@warm hatch there are actually writeups you just gotta do a bit of osint to find them
trim haven
unofficial write ups
solemn smelt
writeups none the less that can help when stuck
warm hatch
ill just go to cc radare2 now, maybe it will get better, i feel this crackme was a bit above beginner but maybe it's just me
solemn smelt
I agree those crackmes where decently hard but with a little persistence and additional research they should be easy enough
warm hatch
i finished it but lol, i didnt understand it fully
simple phoenix
hello, I need some advice for flag26 of the linux challenges, at the moment I'm not finding anything trying:
find / | grep 4bceb
I saw the actual answer in the forum but 1 - I don't understand a good part of it and 2- I can't imagine that the search can't be done with a simpler command
stuck fractal
That command looks through filenames for that string
You're not looking for that string in the filenames. You need to look at the contents
simple phoenix
i thought so... I have something lie that in mind but can't find a way to make it work:
find / | strings | grep 4bceb
final mortar
find / | strings will pipe output of the find command to strings, that is not what you want here
Try researching for extended regex grep
simple phoenix
yeah I don't know much about regex so maybe that's why the actual answer looks complaicated for nothing... thanks for the read I'm sure it'll be very useful
final mortar
Try using https://explainshell.com if you are having trouble digesting any command @simple phoenix
simple phoenix
yes I used it to understand the answer, but I thnk taking the opportunity of this problem to finally learn about regex is likely my best option
median compass
I like regex101.com for learning, building & testing regex @simple phoenix
nimble badge
Hi guys,
Can I have some hints for investigatingwindows room? ( for #4, #11, #13)
solemn smelt
@nimble badge those should all be able to be found in the logs but not entirely sure as I haven’t yet completed the room
white salmon
Hey all! Anyone able to help a Linux n00b here pretty please?
wintry yarrow
Is it room related?
white salmon
Yeah its Task 21 Linux walkthrough
stuck fractal
Hey all! Anyone able to help a Linux n00b here pretty please?
@white salmon It's always best to ask your question directly, if someone can help then they will
white salmon
Ok sorry, I am a linux n00b. I was wondering if anyone can reword the question in a different way? "This challenge is pretty simple. The binary is checking to see if the environment variable "test1234" exists, and if it's set equal to the current $USER environment variable."
white salmon
Sorry run what binary?
woven mirage
If It exists It Will check if its value is equal to $USER
stuck fractal
It's in the title of the task
white salmon
oh shiba2
hmm Ok I think I may have missed a step so I have gone back. But shouldn't I be allowed to do this?
white salmon
shiba2@nootnoot:/home$ echo hello > file
bash: file: Permission denied
Still the same
I went cd /home/
wintry yarrow
Home directory of user. Which will be /home/shiba2.
stuck fractal
Your home, not /home
void lava
lmao
white salmon
I know
Thank you all for your help though
I am guessing "test1234" already exists?
stuck fractal
No
It's a variable that you need to create and assign
Then run the binary, and you will be given the password
white salmon
my machine run out of time 
Guess its easier to just make a vm and ssh into the attack box
stuck fractal
SSH into the target machine?
As a free user your limited to one deploy per day of the attackbox
You're not limited like that on room VMs
white salmon
Oh I lost connection to my attackbox and now I can't launch it being a free user. Have to wait till tomorrow
twilit wasp
what is this discord all about
stuck fractal
@white salmon Yeah so you can SSH in to the Learn Linux VM from your own machine if you connect to the VPN
@twilit wasp #general
white salmon
thank you @stuck fractal
hollow holly
hello peeps!
im on Root Me Room
Trying to have a shell by using file uploads
I've already done the reverse shell php upload, i've changed the extension to phtml and php5 and
I've also changed the ip and port on the payload
But I'm having this error when I try to execute the thing on the website
"WARNING: Failed to daemonise. This is quite common and not fatal. Connection refused (111)"
Anyone knows what it could be?
stuck fractal
@hollow holly the port that you've told the reverse shell to connect to is not open
Do you have a listener running?
hollow holly
oh shoot ... maybe I entered the vuln machine Ip instead of my attack machine Ip
yes I'm using my own kali vm
stuck fractal
Make sure you're using the correct IP and that the VPN is running directly in Kali. Not on the host.
hollow holly
Thank you so much @stuck fractal !
stuck fractal
Got it working?
hollow holly
already got the shell! 🙂
and the user flag
now lets go to the privilege escalation!
stuck fractal
Great, good luck!
potent slate
what three letter web file extensions are there that end with 'a'?
Its for cc pen testing
stuck fractal
Aren't you given the extension to use?
rose cape
hey all, im working on wgel and this should be easy so i must be really missing something here. the attack surface is obv on the webserver and i found the site on || /sitemap. ||ive been dirbusting ||/sitemap|| and i ended up letting the entire wordlist run through finding || /js /css /fonts /sass|| ive viewed a lot of the files in these directories and havent turned up anything. am i being stupid or did i overlook something?
solemn smelt
yes you’re missing something there what wordlist are you using
rose cape
im using directory-list-2.3-big.txt
i suspected it wasnt big enough so i got that off of github
but what i mentioned above are the results from the list i used so i must have done something wrong
thanks guys, no need for a hint then, if big dosent work ill find a different wordlist
graceful sun
anyone on nerdherd
median compass
that's a new box @graceful sun no hints available in the first 72 hours after release
graceful sun
ahhhh! ty!
median compass
@rose cape, you should try seclists, the raft lists are good, my go-to lists these days
rose cape
@median compass gracias
median compass
de nada @rose cape
median compass
that is about 35% of my Spanish so it wasn't ever going to last long elBlob
silver crater
Hey Hey everyone
silver crater
what is the 1005:1006 stand for?
noot:x1005:1006:,,,:/home/noot:/bin/bash
the user and group?
silver crater
white salmon
I'm doing Anthem on the Final stage, and in the previous step I gained access to the admin panel and I'm sort of just lost as to which direction I'm supposed to go in. There is an upload section on the panel, to which I uploaded a payload without sucess but also the first step in the Final stage says 'the box is not on a domain' which implies I need to look at rdp port, which I did but was not able to gain access with the same user/pass I used to login to the admin panel
final mortar
Which task and question exactly are you looking for help with ?
white salmon
Technically I'm on Final Stage, question 1 but its more of a direction question than that question specifically
well I guess question 2 not 1
heady anchor
Can u send the picture of ur rdp option 👀
final mortar
Then, have you tried adding the IP to /etc/hosts for logging into RDP
@white salmon
white salmon
no
and the rdp I did: rdesktop -u sg@anthem.com -p UmbracoIsTheBest! 10.10.x.x:3389
even when I change /etc/hosts it just says user/pass incorrect
final mortar
Try with another rdp client ? I'm not very much familiar with rdesktop syntax
heady anchor
Try the remmina
final mortar
Remmina works fine
white salmon
I got remmina but its still saying incorrect user/pass
white salmon
... its 'sg' not sg@anthem.com :<
heady anchor
in remmina
white salmon
if it is so in remmina idk how because I just tries and it doesn't even say bad user/pass it just starts up and terminates
heady anchor
should use remmina i think
spark abyss
can anybody give me a hint on the room nerdherd?
wintry yarrow
Hints/help for new rooms are allowed after 72 hours of release.
sinful obsidian
Can i get a hint for undiscovered room?
weary quarry
hey hi , guys , ROOM nax i cant do the image decode --> || https://www.bertnase.de/npiet/npiet-execute.php ||
woven mirage
Yeah, i remember that tool is a little bugged
You need to make a small modification in that file, let me check what It is
Export It to ppm format with any image editing software
raw verge
Is there a way to view/download files via FTP without using get?
stuck fractal
Without downloading it, or without using get?
raw verge
Without using get, because I don't have permission.
200 PORT command successful. Consider using PASV.
550 Failed to open file.```Yeah you're probably not going to get around that. What room?
raw verge
NerdHerd, I know we aren't allowed hints or anything so I thought I'd just ask it as a general question.
stuck fractal
#infosec-general for general questions
raw verge
Ah, thanks.
stuck fractal
I answered your question when you first asked it.
Should be under 5 minutes
Should really be under a minute unless you're doing it wrong
You should be using POST @white salmon
Nope
Capture a genuine request
white salmon
dont use ", use ' instead
stuck fractal
Also, take the time to unzip rockyou now
dont use ", use ' instead
@white salmon That's not the issue here but it is good advice
Hydra can deal with compressed rockyou but most other tools don't
Burp, browser dev tools, ZAP
You just need a few bits of information
Where does the request go? The PATH
What verb does it use? POST/GET
What is the request parameter structure?
What's the failure message?
stuck fractal
@white salmon DM me the IP and password please
white salmon
Nmap Task-1 question 3 help
stuck fractal
Did you google it? That question is designed to be googled
white salmon
I searched but unfortunately couldn't find the answer
white salmon
ok
white salmon
hi, room = hackpark i dont understand this question "Using winPeas, what was the Original Install time? (This is date and time)"
stuck fractal
It's stated in the output of winpeas
white salmon
thanks
stuck fractal
Res:
I have a shell as www-data, and I have file read as root. Can't find the user password for q6, have the root flag already.
Tried linpeas, nothing stood out
I have a root shell
junior latch
you talking to me @stuck fractal ?
stuck fractal
Nope, asking for help on Res
junior latch
oohh
stuck fractal
Or at least a hint, I'm root FFS so I should be able to answer this q
junior latch
gl 🙂
stuck fractal
Either that or I'm about to boot my desktop just to try crack a password and it probably won't work
astral smelt
Have you checked any files for SUID?
junior latch
id assume you
astral smelt
Oh ok
junior latch
do it for bants 😄
stuck fractal
I already did.
junior latch
lol
stuck fractal
So I rooted it in a slightly unintended way
Might be worth writing it up I guess
For reference, I didn't try harder or smarter. I tried dumber.
astral smelt
What ever works I guess works
astral smelt
wild bear
@astral smelt thanks
cedar coral
NerdHerd any one?
cedar coral
@stuck fractal i got some candy , but its not a common package
median compass
I had to crack it @stuck fractal, just checked my notes, cracked with john though so you can probably do it fast in the VM
median compass
lol 🙂
stuck fractal
I'm working on writing it up now
median compass
you didn't root with ||xxd||?
stuck fractal
I did
But not quite the intended way
||arbitrary file write|| gives you some nice fun things
median compass
cool, i'll look out for the writeup so
fathom mulch
Hello good peeps of the internet. Just poking around old "Advent of Cyber" room, and kind of got stuck in the encryption room(day 12). I know I could potentially run john to crack the password, but kind of using old machine... So I did look at write up and they've provided a password over there without any explanation so I'm just curious was there anything obvious that I've missed or just run the john and patiently wait?
white salmon
I'm doing Revenge and I have defaced the website according to the mission objectives. How do I get the flag now?
I got all the flags except the last one.
sand glen
ur not supposed to get a shell on the box?
white salmon
@sand glen, is that in response to me?
sand glen
@white salmon yeah 😄
I was saying that maybe u should exploit something to get a shell
and then privesc to get the 3rd flag
from what I saw (from ur stream), I think maybe it's something has to do with SSTI (Server-Side Template Injection)
white salmon
I can already gain root privileges but I can't see it still.
The root privileges is how I defaced the website according to the mission objectives.
white salmon
Cool, never mind. I had to just get rid of the index.html page in order to "deface" it.
Not very intuitive though.
upbeat wren
Hi uhh, on this room, https://tryhackme.com/room/owaspjuiceshop Task 3 Q1, whenever i put in a username and password, my post request goes to http history and a get is in the intercept tab
would it be ok if i had some help
potent quail
when is the 72 hours up for Nerd herd? is it tonight? ive been so stuck
potent quail
ah ok - people were discussing last night a little so thought it was done
white salmon
How can I go about priv esc?
I'm on the Vulnerability room, final Task and it's asking me to do it.
Any hints?
eternal brook
If you mean vulnversity room for Priv esc look at || SUID|| @white salmon
white salmon
oh, is that something I should use then?
eternal brook
Research what that is and how to use it for Priv esc...
You need to find the right ||SUID|| and then use it for Priv esc
https://gtfobins.github.io/
This can be helpful for many Priv esc methods you might find some help here:)
kind bear
can i get some hints on nerdherd ?
trim haven
!rule 13
proud scarabBOT
Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.
Although we are a a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release, unless specifically allowed by the content creator.
astral smelt
Still 7 hours til hints are available
kind bear
i am so close but i dont know what to do
solemn smelt
@kind bear have you actually read the rule, there’s a reason he gave it to you
Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.
Although we are a a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release, unless specifically allowed by the content creator.
straight from that rule if you read it
simple phoenix
Hi I'm a little stuck in the Task 2 of the Gotta Catch em All Scripting room, I see that my connection is (I think), but somehow I'm not receiving any data from the server even if I set it in a continuous loop because it says the ports only live for 4 seconds:
from socket import *
ip = '10.10.243.223'
port = 3010
num = 0
s = socket(AF_INET, SOCK_STREAM)
s.connect((ip, port))
while True:
print(s)
data = s.recv(1024)
print(data.decoce('utf-8'))
kali@kali:~/Documents$ python3 sockTHM.py
<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('10.9.185.144', 56128), raddr=('10.10.243.223', 3010)>
^CTraceback (most recent call last):
File "sockTHM.py", line 12, in <module>
data = s.recv(1024)
KeyboardInterrupt
basically I'm trying to figure out first what kind of message the server will send me in order to finalize the script to make the operation on the number and connect to the next port...
is my logic completely out of wack?
trim haven
I doesn't look like you have sent any data whatsoever
simple phoenix
so I have to send the number to the server for it to reply?
trim haven
You need to send data for it to reply or else you're just listening for something that won't come
I'm sure the room describes that
hidden turret
@white salmon yep
white salmon
Hello, I just started learning about this stuff and started NMAP room.. I cant solve question 3 " [Research] How many of these are considered "well-known"? (These are the "standard" numbers mentioned in the task)" can someone help me?
trim haven
Have you googled it?
white salmon
yea
white salmon
I am not good with english.. I think it's 1023 but nope..
white salmon
yea
woven mirage
so how many are there?
white salmon
1023? 😂
white salmon
Finnaly I get it
white salmon
Hello, i'm looking for a hint for the task 8, question #3 for the room: https://tryhackme.com/room/wireshark
Am i just looking the wrong element ? Thanks.
mossy obsidian
is the embargo up on nerdherd?
mossy obsidian
I am completely stuck, not sure if the web login is a rabbit hole, I have a username (decoded) but the form requires an email. I can't decode what appears to be a password, base 64 fails. SMB share is password protected, and ssh fares no better.
white salmon
So im doing the wireshark room Task 7 # 3 and the packets i put are correct but its saying theyre not
mossy obsidian
also I know nothing of the show Chuck
white salmon
they are the only ARP reply packets in the pcap
Yes, but look at some opcodes
There are 4 different than all others
Find one, then you'll find the other 3 very easily
i already found all 4
its saying theyre not correct
is your format correct **, *** ,..
With the spaces
yeah
got it... lol
vapid magnet
hey guys, I'm stuck with this cipher aGVoZWdvdTwdasddHlvdQ==
mossy obsidian
me too
vapid magnet
it's not base64 and I tried a lot of cipher combinations but nothing helps .. any hints ?
rugged fossil
So im doing the wireshark room Task 7 # 3 and the packets i put are correct but its saying theyre not
@white salmon I'm not sure what to look for, any hints?
white salmon
@rugged fossil Opcodes 🙂
^ yep
read the task carefully and try to memorize what u learned
hi i stuck https://tryhackme.com/room/uploadvulns room task 9 #1 I need help. I upload shell but i cant find uploaded directory. (sorry for my english.)
Did you tried some more gobuster (more in depth) ?
Did you tried some more gobuster (more in depth) ?
@white salmon room: The website in the last task implemented an altered naming scheme, prepending the date and time of upload to the file name. This task will not do so to keep it relatively easy; however, directory indexing has been turned off, so you will not be able to navigate to the directory containing the uploads. I dont know what i write before the file name. I do not know how the date format is, as I am from another country.
rugged fossil
read the task carefully and try to memorize what u learned
@white salmon @white salmon Found it! Thanks. I really should have read the notes. 😩
white salmon
dont get ahead yourself 😉
golden lodge
Hi
white salmon
@white salmon I'm sorry, i answered without check your room 😒 i did not done it yet.. my bad
graceful sun
@vapid magnet same
white salmon
I'm still looking for some hint for task #8 question #3 of the wireshark room 🙂
same im 99.99% sure i have it correct its just not accepting it
🤔
yep its correct just not accepting it whaaat
its a bug
the correct answer is the 30th even tho the packet shows 31th so yep its a bug fix plez
rugged fossil
the correct answer is the 30th even tho the packet shows 31th so yep its a bug fix plez
@white salmon maybe i got a different file, but mine has been 30th all along
white salmon
then its timezones
solemn smelt
Yeah I need to make a note for it
I’m out for the night though
@inland onyx could you add a note about the time zone difference for me?
potent quail
Any hints for nerd herd now please ? I have enumerated everything on the web server, ||have the base64 credentials from the hidden page||, have enumerated users with enum4linux, and checked out ||FTP and SMB||. Most importantly I know that ||the bird is the word||. Not sure how to use the hint, or how to piece this together.
inland onyx
@solemn smelt -- sorry, saw that when I was out with the dogs and forgot. Looks like you've got it fixed?
winged token
im on the wireshark room and im sure i got all the right arp reply packets but it still says wrong answer lol i even looked in the packet and they all say reply but it says incorrect
haughty veldt
any hints on the stupid nerd herd box?
solemn smelt
im on the wireshark room and im sure i got all the right arp reply packets but it still says wrong answer lol i even looked in the packet and they all say reply but it says incorrect
@winged token make sure to get the order correct have you look at the format hint to see how they’re ordered
winged token
Yeah i've tried like multiple times and they didnt take
inland onyx
Please don't use that word @winged token 🙂
winged token
sorry
solemn smelt
Can you send us in spoilers what you’re trying @winged token
winged token
||76,400,459,520||
solemn smelt
That’s correct
winged token
Says its wrong tho
solemn smelt
Add spaces
winged token
ye that workd
heady falcon
Does anyone have a second to explain the outcome of one of the beginner room tasks? I figured out how to do what it was asking however I am not understanding why it got the outcome it did.
stuck fractal
It's always best to directly ask your question.
If someone can answer then they will.
heady falcon
Sure, makes sense.
For Learn Linux Walkthrough task 21 it asks to get the password for shiba3. The way to do so is ||export test1234=$USER||. I don't understand where or how this gets the result. Wouldn't doimg this just make the result of test1234 just 'shiba2' as you're making it equal the user?
stuck fractal
Yes
Then you run the binary
The binary performs a check
If the check succeeds, you get given the password
It's like an exam. You're demonstrating that you know how to set variables.
cedar axle
anyone help in room "year of the dog" is || gitea the path to privesc and is it CVE?||
cedar axle
ok what time is it?
trim haven
2:50am 
cedar axle
cool
haughty veldt
Anyone got any hints for nerdherd
cedar axle
@haughty veldt where are you stuck DM me
wintry yarrow
#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:
- What room you are on
- At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
- What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done
dense sleet
Hi. I'm stuck in the Complete Beginner track; Linux Challenges section; Task 4; question #7. Any pointers on what to do there would be much appreciated!
I'm guessing I need to use grep or find..
final mortar
You need to use grep yeah, with extended regex @dense sleet
It's quite a hard one I'd day
You are welcome to take a look at a write-up, and then figuring out what it means if you can't answer it on your own
vocal shard
hello, im having an issue with the metasploit room, despite following the instructions to the letter, when I run the job, it get back a no session was created
final mortar
Can I see your metasploit options @vocal shard
proud scarabBOT
TryHackMe
final mortar
Are you sure the machine at 10.10.203.195 is up
vocal shard
wow your right i refreshed and now the ip is different
yet its been running over an hour... ok ill try withj the new one thanks
thank you it worked, I had to send the run command a few times but it connected eventually
final mortar
umbral crescent
Remember ladies and gents fully explain your problems with pictures. 50% of the time you will just solve it yourself after explaining the problem. The other 49% of the time more experienced members will be able to very quickly help you out because you explained yourself well. The other 1% of the time... well... then it's time to roll up and cry.
final mortar
That's some pretty serious looking statistics 
trim haven
add dir before -u
trim haven
:D
trim haven
Nope haha
distant violet
did it froze or i just have to wait?
trim haven
woven mirage
You need to specify the cms directory in the url for the exploit
woven mirage
Is everything alright with your connection with the machine?
distant violet
Yes
woven mirage
Can you see the webpage?
woven mirage
Now it's connecting, this error explains itself
distant violet
Oh
simple phoenix
Stuck on Gotta Catch em All (task 2) in Scripting room, I looked at the writeup and there's still a few things I don't understand
it looks as though you're supposed to look for port 1337 when looking at the writeup but in the problem it states:
Go to: http://<machines_ip>:3010 to start...
But when I try port 3010 it just seemingly runs in a loop and never hit the port
<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('10.9.185.144', 57196), raddr=('10.10.141.181', 3010)>
Waiting for the port to become available
<socket.socket [closed] fd=-1, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0>
Waiting for the port to become available
<socket.socket [closed] fd=-1, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0>
Waiting for the port to become available
<socket.socket [closed] fd=-1, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0>
Waiting for the port to become available
And when I try port 1337 I get a connection refused message:
raceback (most recent call last):
File "1337sockTHM.py", line 10, in <module>
s.connect((ip, port))
ConnectionRefusedError: [Errno 111] Connection refused
My script:
from socket import *
from time import *
ip = '10.10.141.181'
port = 3010
num = 0
s = socket(AF_INET, SOCK_STREAM)
s.connect((ip, port))
while port != 9765:
try:
if port == 3010:
print(s)
print('Waiting for the port to become available')
s.send(b'GET / HTTP/1.1\r\nHost: {ip}:{port}\r\n\r\n').encode("utf8")
data = s.recv(1024)
print(data.decode('utf-8'))
except:
s.close()
sleep(3)
pass
The operation and moving to next port part I'm not too worried about, but the receiving the data from the socket part I'm having a tough time getting through my dumb skull!
woven mirage
Okay, first you're not dumb 
And iirc in this room the ports are open for just a while and then close
simple phoenix
oh and btw I add some prints at a lot of places to help me troubleshoot
I know I don't really need them for the actual task
woven mirage
So if you run the script expecting port 1337 most of the times it will not receive a connection and will give up
For http it's best the requests library
simple phoenix
indeed, but I tried the script from the writeup which uses 1337 and ends up hitting it within a couple minutes everytime... doesn't seem to be the case for 3010 though
woven mirage
With sockets I think you need to receive 2 times to get the body
You said that when you run the script it just runs in a loop doesn't it?
simple phoenix
yes I used Requests before and found it much easier, I thought using socket would help me learn more the connection process and it's also what the task suggest
for 3010 yes it seems to be in a endless loop never hitting the port
woven mirage
Take a look at the script, it is hitting the port
The endless loop it because there's a while loop in it
The port doesn't change, so it will keep running forever
What's the output when you run using port 3010?
simple phoenix
<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('10.9.185.144', 57206), raddr=('10.10.141.181', 3010)>
Waiting for the port to become available
<socket.socket [closed] fd=-1, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0>
Waiting for the port to become available
^CTraceback (most recent call last):
File "sockTHM.py", line 16, in <module>
s.send(b'GET / HTTP/1.1\r\nHost: {ip}:{port}\r\n\r\n').encode("utf8")
OSError: [Errno 9] Bad file descriptor
I stopped it after the second loop, it just returns the same thing over and over after that
woven mirage
If you remove the "try except" does the error change?
From the output i imagine your socket is closing and in the second loop it is trying to connect again
You need to know why it is closing
What happens if you call recv twice?
simple phoenix
<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('10.9.185.144', 57224), raddr=('10.10.141.181', 3010)>
Waiting for the port to become available
HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 1031
Server: Werkzeug/0.14.1 Python/3.5.2
Date: Sun, 01 Nov 2020 21:47:19 GMT
<center>
You need to write a script that connects to this webserver on the correct port, do an operation on a number and then move onto the next port. Start your original number at 0.</br></br>
The format is: operation, number, next port.</br></br>
For example the website might display, <b>add 900 3212</b> which would be: add 900 and move onto port 3212.</br>
Then if it was <b>minus 212 3499</b>, you'd minus 212 (from the previous number which was 900) and move onto the next port 3499</br></br>
Do this until you the page response is STOP (or you hit port 9765).</br></br>
Each port is also only live for 4 seconds. After that it goes to the next port. You might have to wait until port 1337 becomes live again...</br></br>
<h3>Its currenly on port <u><a target="_blank" id="onPort">9765</a></u>. Refresh this page and it will update.</h3></center>
<script>document.querySelector("#onPort").href= "http://"+window.location.hostname+":9765"</script>
<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('10.9.185.144', 57224), raddr=('10.10.141.181', 3010)>
Waiting for the port to become available
<socket.socket fd=3, family=AddressFamily.AF_INET, type=SocketKind.SOCK_STREAM, proto=0, laddr=('10.9.185.144', 57224)>
Waiting for the port to become available
Traceback (most recent call last):
File "1337sockTHM.py", line 15, in <module>
s.send(b'GET / HTTP/1.1\r\nHost: {ip}:{port}\r\n\r\n')
BrokenPipeError: [Errno 32] Broken pipe
what I'm passing:
from socket import *
from time import *
ip = '10.10.141.181'
port = 3010
num = 0
s = socket(AF_INET, SOCK_STREAM)
s.connect((ip, port))
while port != 9765:
if port == 3010:
print(s)
print('Waiting for the port to become available')
s.send(b'GET / HTTP/1.1\r\nHost: {ip}:{port}\r\n\r\n')
data = s.recv(2048)
print(data.decode('utf-8'))
sleep(2)
woven mirage
What do you want to do exactly?
I will stop helping you now because I'm not in my computer so I think I'm not being much helpful :p, but someone may come and help you
simple phoenix
I'm trying to get the server response of the operation, the number and the next port
cool thanks anyway I appreciate it
timid pendant
Hey, I’m doing “Year of the Dog” any hints would be greatly appreciated. I believe it has to deal with c***ies . I used burp to collect a list and I’m currently fuzzing
wind peak
hello im on task 18 learn linux
i did the command to see what was in the variable
but when i type it in it says im wrong?
im pretty sure i can read
so this has to be some kinda voodoo but i changed it to something else and it worked
seems like an error to me
stuck fractal
Make sure you switch user when you're told to
wind peak
task 25 learn linux. i dont see any operator mentioned anywhere. am i expected to google it?
any help would be appreciated
simple phoenix
@wind peak which number?
simple phoenix
what's the format of the answer and is there a hint?
wind peak
What flag allows you to operate on every file in the directory at once?
no hint
dont see it mentioned anywhere in the room so far
and its 2 characters
im about to google this cuz i dunno where im expected to find this
and google wins again
Thanks anyways @simple phoenix
simple phoenix
did you look 'man chown' in your terminal?
wind peak
Task 43 Bonus Challenge - The True Ending in the learn linux room is kicking my booty. any hints?
Please help me
I am so lost atm. Maybe i need a break or something
but i know where the file is
and i know the root user can access anything
but i cant find pass for root
can i use john the ripper to brute force it or is that cheating lol
wintry yarrow
Search for user owned files. Also taking a break helps.
wind peak
thanks for responding darkw but how is that gonna help. im trying to figure out the logic behind it
if i can figure out the mental process i can get the answer
wintry yarrow
Well, you can't figure out everything in one day. It takes some time.
wind peak
well i guess i did go ham today completing everything up to that point
wintry yarrow
Use find command to find files belongs to some users.
wind peak
break time i guess
wintry yarrow
Yeah take a break when you feel a burnout.
cedar axle
nice advice @wintry yarrow
tardy crater
hi, i'm doing the "basic pentesting" room and i'm stuck at question 5, i'm supposed to somehow exploit smb to get a username but i don't really how to do that. any hint would be appreciated
eternal brook
Google something like smb enumeration you'll find some good articles read them. Like on hacking articles website @tardy crater
tardy crater
thanks, i'll get to it
white salmon
Someone can give me something on NerDherd ? For the first Flag. I found /admin/ , something like credentials but I can't decipher them ...
Hi there, I am doing Intro to x86-64, last question but I'm not sure what the correct password is. I have extracted so far ||dwperuca|| from the binary through the CMP instructions so far.
cedar axle
anyone help me out on "year of the dog" || ive got www-data, but now i have no idea how to defeat this gitea || this is a learning platform yeah?
@white salmon youre close, very close, ||there's just a few more chars||
cedar axle
i cant remember, to be fair, but i checked my notes and you are nearly there
white salmon
Just completed it!!! Thanks @cedar axle for the nudge! I'm going to be the next Marcus Hutchins.
cedar axle
lol, the wannacryguy
white salmon
yah! :))
white salmon
Yeah, he thought he was going to get some sick a** malware that way.
But it was actually the killswitch.
cedar axle
he saw it trying to connect to the domain that didnt exist, and thought i wonder what its trying to send, i know ill register the domain, and capture the traffic
white salmon
XD
Funny how we take for granted what he did.
Not to put him on a pedestal or anything.
cedar axle
he wasnt always a good guy either
cedar axle
well he did some dodgy stuff, i mean hes not a murderer or a pedo, so hes ok with me
white salmon
Yeah, we should probably move this chat somewhere else.
white salmon
one hint for get root in LazyAdmin ?
stuck fractal
Looked like you had root code execution
If you can run commands as root, you could make yourself a sudoer or add your own fake user or add SSH keys
Reverse shell is just one of many many options, and not usually the best one
royal mirage
any hint for getting root in Willow tree room
kind bear
any hint for nerdherd
stuck fractal
#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:
- What room you are on
- At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
- What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done
kind bear
i am in room nerdherd
i have currently got some png and a text file from ftp ano login
the text file says 'you want is in leet' and i did a exiftool and steghide scan of that png photo
nothing got with steg but i found something diff in exif as it contains the owner name in some random words
now i want a hint what to do next ?
white salmon
ZTH:Obscure Web Vulns
Task 22
Section 4 - XXE Challenge
Tried To Do :
<!DOCTYPE replace [<!ENTITY xxe SYSTEM “expect://id”> ]>
Result :
Sorry , ....is already registered
Any Help?
stuck fractal
Please don't ask in multiple channels like that, it's kind of spammy
white salmon
I deleted the other one
kind bear
what about my nerdherd hint ?
stuck fractal
Please remember that everyone here is a volunteer. You will get an answer when someone who has completed the room or at least is further than you wants to give you a hint. Please be patient.
kind bear
👍
sturdy kiln
ROOM: Physical security intro
TASK: 3
Question: #7 When single pin picking, this term refers to when you feel like you have set a pin and the core rotates slightly
I tried googling everything i could.. if someone can hint me about this
stuck fractal
Did you watch the videos?
near shoal
not sure that's actually mentioned on the vids (particularly the 2nd vid which is where it should be if at all), but think about pins, what pins behave that way and what is it called when you think you have a set but you actually don't
rain nimbus
hello I'm in the owaspjuiceshop room and trying to answer "question 1: access the administration page", I guess they mean that I can access the administration page without logging in ... but when I try to go to the page it doesn't show. Do I miss something here?
wintry yarrow
You need admins creds and you need to be logged in as admin I think.
rain nimbus
Ok, I thought you had to access the page without admin login
wintry yarrow
It'll not open unless you are logged in as admin.
rain nimbus
bit of an unclear question then ... only in the next question it's asked to login as admin
I thought I maybe was missing some point ... but I'll try to login as admin first and then access the page and see if I get the answer
rain nimbus
yep
wintry yarrow
First question is what's the admin email.
rain nimbus
it's first quest of task6
wintry yarrow
Oh got it, you didn't mentioned task so I was confused.
rain nimbus
sorry
wintry yarrow
No worries but if you've done the task 3 then you already know how to log in as admin. 🙂
rain nimbus
in task3 it's been shown indeed with sql injection ... but since the question didnt say to login as admin I thought you were not supposed to
wintry yarrow
rain nimbus
yes it makes sense indeed ... but maybe i wasn't supposed to since it's not explicitly asked to login as admin ... my english interpretation not good I guess 🙂
oh well, I get the answer when I access the administration page with the admin account ... so you are supposed to login with admin account first
@wintry yarrow thnx for the replies
wintry yarrow
Np, happy hacking!
rustic sphinx
hmm, Im doing the intro network course would anybody mind giving me a hint on "Where is the very first place your computer would look to find the IP address of a domain?", Ive got everything else but im strugglingn with this one
white salmon
Exploit failed: Msf::OptionValidateError The following options failed to validate: SESSION.
raven locust
what is my ip
white salmon
@rustic sphinx It's written just on top
stuck fractal
hmm, Im doing the intro network course would anybody mind giving me a hint on "Where is the very first place your computer would look to find the IP address of a domain?", Ive got everything else but im strugglingn with this one
@rustic sphinx So you know it's going to be DNS because it's domain from an IP
rustic sphinx
mk
stuck fractal
So where's the first place it looks?
rustic sphinx
Well on a server right?
white salmon
Read the paragraph, attached to the task
primal tapir
I am working on Attacking Kerberos room - 4th section. I got the hash from the Rubeus and I was trying to perform Kerberoasting...I got the following error. I think its due to line spacing but I tried all possible options.
Hashfile 'hash.txt' on line 29 (FBFD5D...211C7EA3EBABF3CE6BE4C25B0E9FC74B): Separator unmatched
Hashfile 'hash.txt' on line 30 (D6054E...8949166F676552EB329DD7F1FFF1AC8A): Separator unmatched
Hashfile 'hash.txt' on line 31 (77CF4D...29D54FB972916DA8E4A75C39881C8A9C): Separator unmatched
Can someone help me
crude orchid
Quick question...I'm doing Simple CTF as a beginner box...I've rooted the box and got the flag, but there's two questions that I don't know how to answer..The two questions are: What's the CVE you're using against the application and To what kind of vulnerability is the application vulnerable...any advice on google searches would be much appreciated
stuck fractal
It'll be asking for the intended way
stuck fractal
So you used a script to exploit the webapp?
stuck fractal
You should have exploited a webapp
crude orchid
used FTP anonymous login to retrive a document for a user...bruteforced the user name with hydra to get initial foothold into box
stuck fractal
That wasn't the intended
crude orchid
solved. Thanks for the nudge!
noble ledge
working on learn linux task 43: I broke down and went to the walkthrough for the answer and am confused about part of the command that i dont understand
for finding the file the answer says : find / -user <insert-username-here> -type f 2>>/dev/null
the part i dont understand is the <2>>/dev/null> portion
stuck fractal
2>/dev/null
it redirects IO stream 2, which is the standard error output, to /dev/null
So discards it
noble ledge
ugh now im more confused lmao
stuck fractal
So there's 3 things
Standard input
Standard output
Standard error
They do what you'd expect
Errors go to stderr, output goes to stdout
All you're doing is redirecting the errors so you don't see them
simple phoenix
Hi I'm on Task 2 of the Python Scripting room and I don't quite understand the error message I'm gettting when I try to hit the second port open:
requests.exceptions.ConnectionError: HTTPConnectionPool(host='10.10.232.94', port=34232): Max retries exceeded with url: / (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f5649ad64f0>: Failed to establish a new connection: [Errno 111] Connection refused'))
I know that that port is supposed to be the next one open according to the message received from the first port:
Its currenly on port 34232. Refresh this page and it will update.
simple phoenix
I do cycle every 4 seconds as it states in the message
should I just include some sort of a while loop until I get a Response 200 instead of the sleep function
^
?
remote gate
@olive birch you wont need to that post module as you already have a meterpreter session
i think what happened is the default payload for that changed to windows/x64/meterpreter/reverse_tcp at some point after the box was created
olive birch
yes and if I run it again it fails and says that its already listening on port 4433
Thanks; I'll keep working on it.
cedar axle
@olive birch you should upgrade your shell to a more stable process
rugged sapphire
Can anyone please give a nudge for https://tryhackme.com/room/physicalsecurityintro
Task 6, Question 8. I've spent several hours watching videos on the bypass and browsing forums but not found the acceptable answer to the question.
Edit: I got the answer thanks to @remote gate . Hint: Medieval defense tool extended to 9 characters
white salmon
Doing the 'LookingGlass' room, i could find some 'interesting' open ports on 9k+, after some googling i'm trying an exploit with msfconsole, but got a 'Connection reset by peer'.
Am i looking in the wrong direction ?
stuck fractal
100% yes
white salmon
Ok thanks.
stuck fractal
Did you try actually looking what's running on the ports?
white salmon
Yep, i googled that
white salmon
Oh ok
lavish wigeon
hey, im doing security misconfiguration, its supposed to be a flaw where default passwords are set. now, i tried with intruder, but on wrong user/pass combination, server responds with 200 code, i tried filtering out 200 responses, but seems like deadend
stuck fractal
Room, task, question?
lavish wigeon
i remember hydra had something like looking for certain words on page upon bad combo
just a sec
white salmon
If i recall correctly, check out the length of the response
stuck fractal
Yeah don't use hydra
lavish wigeon
task 19
stuck fractal
You should not be bruteforcing anything
lavish wigeon
If i recall correctly, check out the length of the response
@white salmon all same
i tried 110 most common combinations
stuck fractal
You should not be bruteforcing anything
white salmon
Then @stuck fractal has the good answer ^^
lavish wigeon
how then am I supposed to find which default login is there
stuck fractal
Single google search
noble ledge
hey guys quick question about grep
noble ledge
yes
need to grep a flag
does it read the txt file then output matches or are the matches in the title
white salmon
@noble ledge https://tryhackme.com/room/thefindcommand
stuck fractal
does it read the txt file then output matches or are the matches in the title
@noble ledge Depends entirely on what you're doing
Grep searches through the input for the pattern
Input can be done a few different ways
noble ledge
ok ty 😄
white salmon
Don't forget the man it's always helpfull like, man grep in your case, or man find and so on
lavish wigeon
got the flag, thank you!
queen hull
hello- I am stuck on Linux challenges task 5 sub task 4 (use scp to download flag32.mp3) . from my research i have tried using : scp alice@my.ip:flag32.mp3 /home/alice
once i run cat on it is still comes out jumbled
queen hull
is there a built in media player i am unaware of? using just the active machine shell. i tried mpg123 and it needs to be installed which it wont allow me to do
woven mirage
download it to your machine and play it
stuck fractal
is there a built in media player i am unaware of? using just the active machine shell. i tried mpg123 and it needs to be installed which it wont allow me to do
@queen hull The whole idea was to copy it to your machine using SCP
You're copying it from the box to itself, it looks like
Probably best to check your SCP syntax and try again
queen hull
got it to my machine. however VLC is silent when i open the file to play it and I can't open VLC to check to see if it is muted for some reason
woven mirage
maybe while trying scp you accidentaly overwrite the file with nothing
try to redeploy the machine and copy the file again
raven locust
Can someone give me a hint for the Bonus Challenge (Final question) for the learn linux room
stone oyster
Hey folks. I'm working on Ice room Task 3 #1. it's asking what type of vuln is Icecast. Now I've looked up the cve site and done some other research and I'm just not finding what needs to be found. Or...I've overlooked it. I see the star pattern for the answer but I don't see anything that fits. Give me a nudge in the right direction, please?
I thought the nmap would tell me what version it was or something.
wintry yarrow
Can someone give me a hint for the Bonus Challenge (Final question) for the learn linux room
@raven locust find files owned by different users.
white salmon
Hello, looking for a hint with challenge 2 and 3, task#8 of the XSS room, got the alert with the message 'Hello' spawnned but nothing then. Any idea ?thanks
stone oyster
Still on Ice Task3, but question 14. Says the privs listed should show one that allows taking ownership of files. I tried the one I thought it was, then tried them all. None worked. So I'm curious if I actually escalated or not. How many privs should be listed?
also, side note. In tmux, if I have 2 panes open, are they both connected to the same box so that if I've elevated in one the other benefits, or are they their own entities?
oblique cliff
theyre their own entities @stone oyster
Hello, looking for a hint with challenge 2 and 3, task#8 of the XSS room, got the alert with the message 'Hello' spawnned but nothing then. Any idea ?thanks
@white salmon that room is broken. Best to just move on and wait for the replacement
well, you could keep trying i guess, as it is possible, its just very particular
white salmon
Finaly a answer ! Thanks @oblique cliff i'll leave it for now. Thank you very much
oblique cliff
no problem
white salmon
A note could be great i think.
oblique cliff
yes, it would
if you'd submit that to #feedback-and-ideas thatd be kewl
sorry for the lack of responses, since @trim haven became mod he thinks he's above helping people
stone oyster
In the Ice room, when I run the second exploit to escalate, bypassuac_eventvwr, what kind of output should I expect?
oblique cliff
a shell that gives you sys admin privs
stone oyster
Looking at privs prior to and after the run they are the same.
oblique cliff
screenshots plz
balmy crystal
hello, im in ZTH: Web 2 room. at last task, could somebody help me plz, because i dont find anything useful
raven locust
hello im in the blue room, cracking task question 2. would someone mind telling me how i am to go about figuring out the hashed password?
oblique cliff
do you have the hash? @raven locust
oblique cliff
are you using kali?
@raven locust if youre using kali, you neep to gunzip the zipped rockyou file that comes default on kali in /usr/share/wordlists/rockyou.tgz or something like that
raven locust
oh okay, thank you 😄
balmy crystal
could somebody help me at question 4, in task 9, in room "network services 2", because the options that should be, arent those plz
stuck fractal
@balmy crystal what do you mean?
stuck fractal
In descending order
balmy crystal
yess
i did
and tells me that arent fine
:/
F
maybe is cuz metasploit chaged the name of the options
well, now i am at "Hacking with Powershell" room
thx, anyways
stuck fractal
It won't have changed it
balmy crystal
really ?
ok
ill try later
thx
@stuck fractal This is what i see when i make "options"
: /
balmy crystal
the ones that are marked as required
||when i make "RHOSTS/RPORT/SQL" it doesn't work||
@stuck fractal 
balmy crystal
ooww
I know i must put RHOSTS
as i dont have passw or usernames, i cant put them
stuck fractal
Yes you do.
stuck fractal
Just try things until they work.
balmy crystal
now i know what to do
xD
thx
im kinda slow today
@stuck fractal yeess, now i got it right
stuck fractal
balmy crystal
balmy crystal
@stuck fractal i made the room, thanks ./James 
manic citrus
Anyone able to give me a hint for nerdherd ? As no write ups until the atleast tomorrow will dm what part I am stuck on
steady elm
Anyone able to give me a hint for nerdherd ? As no write ups until the atleast tomorrow will dm what part I am stuck on
@manic citrus same here stuck on pass hash but i am pretty sure what it is but cant crack it
if anyone could provide a direction or hint?
stuck pendant
no hints today for that room you can get it tomorrow
rigid dagger
I need a hint about the room alfred
i am nt-system but there is no root.txt in the given directory
wintry yarrow
It's in admin desktop iirc. Read the task it says where you can find it.
ebon crypt
Anyone able to give me a hint for Introx86x64 room, am stuck in the task6
wintry yarrow
#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:
- What room you are on
- At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
- What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done.
oblique cliff
i am nt-system but there is no root.txt in the given directory
@rigid dagger you need to have a sys admin token
ebon crypt
- I'm in Introx86x64 room
- Am stuck i task6 I checked the algortithm using radar2 but I know that there are spliting the string into substrings using delimiters but I don't how I can know the string
oblique cliff
set breakpoints everywhere and see if you can figure out where your input is being compared @ebon crypt
white salmon
I'm in the Empire room stuck @ t8 #2... Searched the Git repo, searched the attack.mitre.org, but found nothing 😦 Where do I have to search for it? 😦
white salmon
me2
balmy crystal
did you made ZTH: Obscure Web Vulns ??
im stuck at Task 14, idk what to put on the payload
xd
could somebody help me plzz
white salmon
Have you followed the commands in task 12? Manual JWT Exploitation?
balmy crystal
yess
white salmon
white salmon
So you got your hint 😉
balmy crystal
i forgot to re validate on each try
so i was always re trying with same no valid key
ok, here we go again
im too slow
F
lets do iiiiitttttt
thorny drift
I am having some trouble access the root directory of bob, is the a linux navigation issue?
[9:18 PM]
still gives garry's home directory after chaning user to bob
stuck fractal
@thorny drift Please don't ask the same question in multiple channels, it looks kinda spammy. Ask in one and then wait please.
thorny drift
Apologies @stuck fractal still figuring out discord, wont happen again.
quartz totem
This one is annoying me.
https://tryhackme.com/room/javascriptbasics
Task #2
What tag is used for linking a JavaScript file to HTML?
11 characters.
The hint gives example <TagName>, but I cannot find one that fits.
white salmon
The hint tells you to not use the <> type only the TagName
white salmon
Now you know ^^
quartz totem
Solved. The character length probably needs to be updated too, if it hasn't already- as the answer is 5 characters shorter than the input suggests.
white salmon
That's pretty obvious anyways
quartz totem
I'm fairly positive I had entered the correct answer prior to the hint being updated too- but it is whatever.
white salmon
I can't figure out what the answer of task 5 #2
that's the very last thing i'm missing.. Any hint ?
quartz totem
@white salmon For the JS room?
white salmon
yep
quartz totem
var choosePill = ['Red', 'Blue', 2];
var choice = choosePill[0];
console.log(choice); // Outputs 'Red'
Work backwards, what is the console trying to log, which item from the array is being selected and what is the question asking specifically.
stuck fractal
Solved. The character length probably needs to be updated too, if it hasn't already- as the answer is 5 characters shorter than the input suggests.
@quartz totem the length is automatic.
stuck fractal
The length. Is automatic.
quartz totem
I am capable of repeating myself too:
The length. Was. 11.
The room was edited while I was discussing it here. Thank you.
little parrot
Hello guys
I m on task 21 of zthlinux room
I can't seem to find the binary file to be executed named shiba2 to find the password of shiba3
Plz help
trim haven
It should be in the user's home directory
trim haven
Then switch to shiba2 using the knowledge the room should have taught you
little parrot
I m in shiba2
May i send a picture?
I tried going back to shiba1
But nothing there
And nothings in shiba2 too
trim haven
Show me please
little parrot
little parrot
https://linuxconfig.org/single-linux-command-to-return-to-home-directory
@trim haven got it...thanks for the help😄