#room-hints | TryHackMe | Page 66

clever pivot Nov 10, 2020, 1:42 PM

#

Hm, that's true, if I had done that it'd have been easier

#

Thank you

simple mountain Nov 10, 2020, 1:43 PM

#

Well, It's a learning experience. Not all systems have a handy file sitting there with credentials sat in it!

clever pivot Nov 10, 2020, 1:45 PM

#

Ik, in my case I went scrapping for any file related to the room (passwords, usernames and such) and I got to that one 'cause the location was odd and I was feeling like I was doing it the wrong way

simple mountain Nov 10, 2020, 1:50 PM

#

If you get the results you wanted, then it is the right way.

stone oyster Nov 10, 2020, 2:23 PM

#

Flag 26 for Linux Challenges says to locate a file that begins with 4bceb and is 32 characters long. I was thinking that strings would do that. But it didn't seem to. So I tried find with that part of the flag string, and I think it dumped every file.

#

Am I on the right track?

stuck fractal Nov 10, 2020, 2:24 PM

#

Strings looksfor human readable strings in a file

#

So no, not really

stone oyster Nov 10, 2020, 2:24 PM

#

ok

#

ty

stuck fractal Nov 10, 2020, 2:24 PM

#

Remember you're not looking for a filename

#

You're looking for file contents

stone oyster Nov 10, 2020, 2:24 PM

#

right. Trying to look into a file.

#

Find only looks at file names?

#

Does the 32 characters factor into the command, or is that just to make sure you found something that's the right size?

#

So, grep isn't "failing" but it isn't returning anything either.

woven mirage Nov 10, 2020, 2:38 PM

#

What command are you using?

stone oyster Nov 10, 2020, 2:40 PM

#

well, I've used a few trying to get something.

#

grep -iRl "string" ./

woven mirage Nov 10, 2020, 2:42 PM

#

try grep -iRl "string" /

stone oyster Nov 10, 2020, 2:42 PM

#

and so I shall

queen hull Nov 10, 2020, 2:44 PM

#

Hello- currently in network services task 7. I have run the tcp dump as it states on my local machine and ran the .RUN ping etc on the telnet session I have open. I have been waiting for about 7 minutes and havent received any pings. Is it normal for it to take this long? For reference: command used on local machine : sudo tcmdump ip proto \icmp -i tun0. command used in telnet session: .RUN ping 10.10.87.189 -c 1

stuck fractal Nov 10, 2020, 2:44 PM

#

That looks like the wrong IP

#

It should be your VPN IP.

stone oyster Nov 10, 2020, 2:45 PM

#

From the highest folder level I ran grep and it goes straight to /snap/core where everything is Permission Denied. And it just hangs there.

stuck fractal Nov 10, 2020, 2:45 PM

#

You can filter error messages out

woven mirage Nov 10, 2020, 2:45 PM

#

add 2>/dev/null to the end of the command

stuck fractal Nov 10, 2020, 2:45 PM

#

But it's still going to take a while. Searching through every single file on the system

stone oyster Nov 10, 2020, 2:56 PM

#

Why does grep tell me what I know?

#

I try to look into a folder and it says that's a folder. I'm just like...well....duh

woven mirage Nov 10, 2020, 2:56 PM

#

?

stone oyster Nov 10, 2020, 2:58 PM

#

📎 unknown.png

#

oy..

#

hold on.

#

📎 unknown.png

woven mirage Nov 10, 2020, 2:59 PM

#

it is telling you that you cant use grep in a directory like that

#

if you want to use it recursively in a directory you need to use the flag -r

stone oyster Nov 10, 2020, 3:01 PM

#

Ok. So I have this huge list of files coming down. Am I to understand that every one of these files has that sub-string in it?

woven mirage Nov 10, 2020, 3:02 PM

#

whats the command?

stone oyster Nov 10, 2020, 3:03 PM

#

I think grep -rw '4bceb' /

#

yeah.

woven mirage Nov 10, 2020, 3:04 PM

#

well, the files that show up should have the string

stone oyster Nov 10, 2020, 3:05 PM

#

Ok. So, all of those files are also permission denied.

#

lol

median compass Nov 10, 2020, 3:05 PM

#

if i remember correctly you are given other clues in order to help you narrow it down right?

stone oyster Nov 10, 2020, 3:05 PM

#

It says to search all files for that string. it'll be 32 characters long.

median compass Nov 10, 2020, 3:05 PM

#

like it's not only that the string contains 4bceb

stone oyster Nov 10, 2020, 3:06 PM

#

Is there a grep for a max string length?

median compass Nov 10, 2020, 3:06 PM

#

ok, so you want words that are 32 characters long

stone oyster Nov 10, 2020, 3:06 PM

#

I haven't found it yet.

#

Unless i need to regex

median compass Nov 10, 2020, 3:06 PM

#

does it say anything about whether the string starts, ends, or just contains the string?

stone oyster Nov 10, 2020, 3:06 PM

#

starts

median compass Nov 10, 2020, 3:06 PM

#

ok, so you got it, regex is your friend

#

if you man grep you'll see how to include regex as your search term

stone oyster Nov 10, 2020, 3:07 PM

#

I tend to give regex a wide berth as soon as i see.

#

Kinda' like poison ivy.

median compass Nov 10, 2020, 3:07 PM

#

and i'd recommend regex101 as an easy way to build your regex

stone oyster Nov 10, 2020, 3:07 PM

#

ty

#

I will look into that

median compass Nov 10, 2020, 3:08 PM

#

happy hunting

stone oyster Nov 10, 2020, 3:08 PM

#

mmmm....hunting....

median compass Nov 10, 2020, 3:08 PM

#

this btw is the hardest of the questions in this room

stone oyster Nov 10, 2020, 3:08 PM

#

oh goody

#

lol

#

[a-zA-Z] can I sub with numbers?

#

er...nvm

#

[[:alnum:]] Do I need to specify in this flag what I'm looking for? Or is this a flag saying that it will look for alpha-num strings?

median compass Nov 10, 2020, 3:15 PM

#

play with it a little longer, you'll learn more

echo laurel Nov 10, 2020, 3:17 PM

#

Sorry I don't know where to put this, but there was a room on port knocking. It's no longer there.

#

Retired?

median compass Nov 10, 2020, 3:18 PM

#

what was it called, there are a few boxes with port knocking

echo laurel Nov 10, 2020, 3:18 PM

#

Knock knock I guess

astral smelt Nov 10, 2020, 3:19 PM

#

Yea that box is private now

#

At least I think I can’t seem to find it

median compass Nov 10, 2020, 3:20 PM

#

was that in the CTF 100?

echo laurel Nov 10, 2020, 3:20 PM

#

Yup , 😩

#

was that in the CTF 100?
Not sure

stone oyster Nov 10, 2020, 3:29 PM

#

@median compass I tried egrep '(4bceb)' -rwb /|less

#

Is it looking for rwb in the string?

median compass Nov 10, 2020, 3:31 PM

#

i don't see anything in that regex that specifies your 5 characters are at the start of the string, nor that your wanted string is 32 chars long

stone oyster Nov 10, 2020, 3:31 PM

#

yeah. Working on it.

#

[[:<:]]

#

for beginning

median compass Nov 10, 2020, 3:33 PM

#

did you look at regex101.com? it's good because it has a nice ref guide and let's you test if you're matching what you want

📎 unknown.png

stone oyster Nov 10, 2020, 3:33 PM

#

yeah. Poking thru

hidden fractal Nov 10, 2020, 3:37 PM

#

Room: Find Command
Task : 2
Question:2

#

idk whats wrong in my answer

#

file /home -type f -iname user.txt

stuck fractal Nov 10, 2020, 3:38 PM

#

Well, you put file not find

hidden fractal Nov 10, 2020, 3:38 PM

#

wtf thanks

#

lol

stone oyster Nov 10, 2020, 3:40 PM

#

so I was gonna use [[:<:]] for the beginning of the string.

#

I should put the sub-string outside of this, right?

#

I don't want to use [4bceb] because that allows for any character to match, whereas (4bceb) has to match explicitly

median compass Nov 10, 2020, 3:43 PM

#

it's a little simpler than that

#

just 4bceb on it's own will match, no surrounding brackets at all

#

then you need something before it to say that's the start of the string you want

#

and something after to say how long the rest of the string should be

stone oyster Nov 10, 2020, 3:44 PM

#

I'm trying to figure out the length option

median compass Nov 10, 2020, 3:44 PM

#

try testing with these strings in regex101
4bceb 4bceb243523rsadfsdfgserfasefsdscvsdgvrghefdfsdfse fgrfgfdgdfs4bcebsgfsesefdsefse 4bceb123456789012345678901234567

#

you only want to match the last one

stone oyster Nov 10, 2020, 3:44 PM

#

ty

#

I can get it to match that pattern many times. Haven't seen how to limit the length of the string.

median compass Nov 10, 2020, 4:09 PM

#

ok, so give me the start of your regex then

stone oyster Nov 10, 2020, 4:13 PM

#

{32} matches exactly 32 times. That's not what I'm looking for, but it's the only thing that keeps popping up.

median compass Nov 10, 2020, 4:14 PM

#

ok, makes sense to start with your search substring right?

#

and then follow that with a number of ANY characters

stone oyster Nov 10, 2020, 4:14 PM

#

lol my machine expired.

median compass Nov 10, 2020, 4:15 PM

#

yeah, but you can do this bit without the machine

stone oyster Nov 10, 2020, 4:18 PM

#

What I've learned: () exact match, [] any match, ^beginning of string, $end of string, {}match upto x times.

#

^(4bceb)

#

this starts at the beginning of the string and looks for exactly 4bceb

#

I can find 4bceb however many times I want to.

median compass Nov 10, 2020, 4:20 PM

#

that's right except for the (), they're only needed to capture a string, for example in a find-and-replace

stuck fractal Nov 10, 2020, 4:20 PM

#

So you want to match that string

#

Then match x number of alphanum chars afterwards

median compass Nov 10, 2020, 4:20 PM

#

so for your purposes ^4bceb works just as well

stone oyster Nov 10, 2020, 4:20 PM

#

ty

median compass Nov 10, 2020, 4:20 PM

#

but that's right, that's the start of the search string

#

so what matches any alphanumeric character?

stone oyster Nov 10, 2020, 4:21 PM

#

I keep seeing ^[a-zA-Z]{x}$ as a way to get an exact length. But that's not right. That finds the a-zA-Z upto 7 times.

#

[[:alnum:]] or .

median compass Nov 10, 2020, 4:21 PM

#

there you go, the second of those

#

and how many do you want?

stone oyster Nov 10, 2020, 4:22 PM

#

.{32}

median compass Nov 10, 2020, 4:22 PM

#

not quite, 32 is the whole string right?

stone oyster Nov 10, 2020, 4:22 PM

#

so minus 5

#

27

median compass Nov 10, 2020, 4:22 PM

#

bingo

#

so put it all together now

stone oyster Nov 10, 2020, 4:22 PM

#

Lord have mercy on me.

#

ty

#

to insert that into my egrep I need to egrep [option] /regex right?

#

oh...and directory

median compass Nov 10, 2020, 4:25 PM

#

well, i'd check it first against those test strings I gave you just to make sure there's not one last thing (hint hint)

#

and then yes, plug it into your grep/egrep command

stone oyster Nov 10, 2020, 4:26 PM

#

Yeah. Forgot the $

#

I guess I'm asking, how do I tell egrep that I'm using a regex? Does it have to start with the / ?

median compass Nov 10, 2020, 4:28 PM

#

that's a googleable thing, just look for egrep examples

stone oyster Nov 10, 2020, 4:29 PM

#

lololol

#

I might just step away for a little bit. I need to paint the bathroom. Maybe the fumes will help me think clearer and do this righter because it gave me the same file dump as it has so many times before.

#

egrep '^(0|1)+ [a-zA-Z]+$' searchfile.txt is an example I found. So I egrep '^4bceb.{27}$' /

#

Ya'll have a great day. I will talk more with you later.

#

Thank you for your help.

queen hull Nov 10, 2020, 4:39 PM

#

Hello- Currently stuck in the room "blue". task 2. I chose the exploit, changed the RHOSTS to the victim machine, and ran it. I keep getting back "fail" as it executes the exploit. I searched through the show options command and didnt find anything else that I could change. Any pointers of what I could do to get back on track?

stuck fractal Nov 10, 2020, 4:40 PM

#

show options and post a screenshot

#

Most likely your LHOST is wrong

queen hull Nov 10, 2020, 4:45 PM

#

I noticed that before and changed it to the host IP and ran it and it didnt work so i restarted the victim machine and started from scratch (thinking that it wasnt the issue) ran it just now before getting the screenshot just in case..AND it worked.

stuck fractal Nov 10, 2020, 4:45 PM

#

LHOST needs to be your VPN IP

queen hull Nov 10, 2020, 4:46 PM

#

vpn ip**

#

i set it to that the first time with no luck. not sure why it didn't work the first time but ran the second but it is what it is. onto the next task 🙂

median compass Nov 10, 2020, 4:49 PM

#

it's a not uncommon thing with msf @queen hull, sometimes the LHOST parameter resets itself, it's a good idea just to quickly do a show options right at the end before you exploit

rustic lodge Nov 10, 2020, 5:27 PM

#

Hello, i've got an issue with room : https://tryhackme.com/room/nax - i've made it all the way to the metasploit bit. However it doesn't want to connect/says host is not exploitable.

TryHackMe

TryHackMe | Nax

Identify the critical security flaw in the most powerful and trusted network monitoring software on the market, that allows an user authenticated execute remote code execution.

#

Yes i set the LHOST and RHOSTS and PASSWORD

#

I checked writeups and they all say the same and it should work but doesn't, also connected to VPN, able to ping host/open website manually

#

📎 unknown.png

rustic lodge Nov 10, 2020, 5:51 PM

#

nvm had to restart machine..

queen hull Nov 10, 2020, 6:03 PM

#

I have another question/stuck in the blue room. I got to the very last task (find the flags) and found the first flag on the C: drive. in meterpreter i ran cat flag1.txt. I got back an operation failed. I tried to download it, same thing. I have since restarted the victim box as well as my own just to make sure there wasn't any issues there. the screenshot provided is the second time around

📎 Screenshot_123.png

stuck fractal Nov 10, 2020, 6:05 PM

#

cat C:/flag.txt?

#

Remember, file paths that aren't full relate to your cwd

queen hull Nov 10, 2020, 6:08 PM

#

ahh ok that makes sense. I was confused on how I was connected but not able to reach it. thank you!

winged mist Nov 10, 2020, 6:10 PM

#

Hi guys. Anybody done the physical security room please?

stuck fractal Nov 10, 2020, 6:10 PM

#

It's always best to just ask your question

#

Plenty of people have done most rooms

frail rain Nov 10, 2020, 6:11 PM

#

i mean you ccould just do shell get windows shell and read the file

stuck fractal Nov 10, 2020, 6:11 PM

#

Just ask.

winged mist Nov 10, 2020, 6:13 PM

#

I can’t answer a few questions from the room. I’ve solved 64%

#

I’ve watched the videos over & over but I still can’t answer the questions

#

Maybe if someone explained or sumn

median compass Nov 10, 2020, 6:14 PM

#

google bosnianbill on youtube, some of the answers require you to research beyond the videos you're given

#

like a lot of the rooms here, google is your friend

winged mist Nov 10, 2020, 6:15 PM

#

Rip me lmaooo this is proving to be my most difficult room ngl

median compass Nov 10, 2020, 6:16 PM

#

patience grasshopper, soon you'll try Ra or YearOfTheWhatever and this will be but a happy memory

winged mist Nov 10, 2020, 6:16 PM

#

uncomfortable

#

kekw

#

Challenge accepted kek kittyfasthands

stone oyster Nov 10, 2020, 7:20 PM

#

lol

#

so true

#

ONCE you get it, you get it. You'll look back and wonder why you didn't.

#

I FOUND #36!!!

#

Not looking for that one.

stone oyster Nov 10, 2020, 7:42 PM

#

So, if you run a regex and it says Permission Denied, it's saying that I can't scan thru that file to find what I'm looking for.

#

If it says Invalid argument, it's telling me that the string I'm looking for isn't there.

#

Does that sound correct?

stuck fractal Nov 10, 2020, 7:45 PM

#

It should fail silently of the string isn't there

#

Invalid argument means one of the arguments was not valid

visual jolt Nov 10, 2020, 8:13 PM

#

In the Madness room I couldn't get the shell exploit for the suid binary to get root to work for some reason and couldn't find another way to get access to that flag 😦

#

Really enjoyed that room otherwise though 🙂

balmy crystal Nov 10, 2020, 9:23 PM

#

hello, can somebody help me plz, im on room "upload vulnerabilities", and i am stuck at the challenge of task 8, help plz

#

cri

hasty slate Nov 10, 2020, 9:29 PM

#

can you explain exactly where are u stuck at?

balmy crystal Nov 10, 2020, 9:29 PM

#

bypassing the filter

#

but wait a sec

#

lemme try something ive found

hasty slate Nov 10, 2020, 9:29 PM

#

okay. reading the material will probably give u everything u need to solve that task 🙂

balmy crystal Nov 10, 2020, 9:30 PM

#

ok ok

#

i uploaded it

#

can i dm u ??

hasty slate Nov 10, 2020, 9:30 PM

#

if u uploaded then u are pretty much done.

#

you can say it here, if something is spoilery u can enclose that with spoiler tags ||...||

balmy crystal Nov 10, 2020, 9:31 PM

#

oh no

#

it didnt worked

#

the machine doesnt recognize the format XDDD

hasty slate Nov 10, 2020, 9:32 PM

#

okay but did u read the material that is there in the walkthrough itself?

#

every step of the way is explained there isn't it?

balmy crystal Nov 10, 2020, 9:33 PM

#

yes

#

something tells me that ive missed something

hasty slate Nov 10, 2020, 9:34 PM

#

yeah re read and try to do the steps in the task itself, as it's a walkthrough room i think most of information would be there itself.

balmy crystal Nov 10, 2020, 9:34 PM

#

ok ok

#

coolguy

#

ill try other time / later

#

im kinda tired

#

thx anyways @hasty slate

hasty slate Nov 10, 2020, 9:41 PM

#

np 🙂

hidden fractal Nov 10, 2020, 11:03 PM

#

Uhmm what do u guys think what is wrong here

#

find / -type f -perm 604

#

Find all files that are exactly readable and writeable by the owner, and readable by everyone else (use octal format)

woven mirage Nov 10, 2020, 11:04 PM

#

well, i don't see nothing wrong

limber bane Nov 10, 2020, 11:04 PM

#

That currently looks for the following conditions: (U)ser / owner can read, can write and can't execute. (G)roup can't read, can't write and can't execute. (O)thers can read, can't write and can't

hidden fractal Nov 10, 2020, 11:07 PM

#

That currently looks for the following conditions: (U)ser / owner can read, can write and can't execute. (G)roup can't read, can't write and can't execute. (O)thers can read, can't write and can't
@limber bane Yeah but it's not working

limber bane Nov 10, 2020, 11:07 PM

#

You want 0644

#

(U)ser / owner can read, can write and can't execute. (G)roup can read, can't write and can't execute. (O)thers can read, can't write and can't execute.

hidden fractal Nov 10, 2020, 11:09 PM

#

644 works thanks men
i thought i need to 0 the group

limber bane Nov 10, 2020, 11:10 PM

#

blobfingerguns

#

Always remember the octal values, (R)ead = 4, (W)rite = 2, (X) = 1

#

Total of 7

#

(U)ser R,W,X (G)roup R,W,X, (O)thers R,W,X

#

-rwxrwxrwx = 777

#

You can get really easy to use permission calculators online that will help with understanding but try to not rely on them outside of understanding what they're performing

#

Eg. http://permissions-calculator.org/

Unix Permissions and Lookup

Permissions Calculator provides a straight forward way to work out how to change permissions with the chmod command.

white salmon Nov 11, 2020, 12:26 AM

#

so i need a hint

stuck fractal Nov 11, 2020, 12:27 AM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

white salmon Nov 11, 2020, 12:27 AM

#

OK

#

The learn linux room, task 21, and i'm not finding a binary

stuck fractal Nov 11, 2020, 12:32 AM

#

Screenshot please?

white salmon Nov 11, 2020, 12:33 AM

#

okay

#

Room- steel mountain tried powershell_shell > . .\PowerUp.ps1 hangs. uploaded to correct directory file on the machine

#

here is my screenshot

📎 SPOILER_shiba_01.png

#

so i found some stuff that the question talks about but i don't know if it's what i am looking for.

stuck fractal Nov 11, 2020, 12:39 AM

#

Go home

#

To your home

white salmon Nov 11, 2020, 12:41 AM

#

shiba2 home, right?

stuck fractal Nov 11, 2020, 12:43 AM

#

Your current user's home, yeah

#

cd on its own takes you home

white salmon Nov 11, 2020, 12:44 AM

#

Okay so anyone who has trouble on steel montain don't use msf6 worked first time using attack machine

#

done

#

Okay as im reading the challenge it says take close attention to the can reset being set to true where is this? i have the answer im just trying to understand for future reference

📎 SPOILER_ans.png

#

how do i find a file in windows using command prompt? tried google

vale umbra Nov 11, 2020, 12:58 AM

#

hello guys can someone help me with the room Upload Vulnerabilities Task 9?

#

I can't find the uploaded files

#

nobody? 🙂

white salmon Nov 11, 2020, 1:02 AM

#

room upload vulnerabilities?

stuck fractal Nov 11, 2020, 1:02 AM

#

Please try to remember that everyone here is a volunteer

vale umbra Nov 11, 2020, 1:06 AM

#

@stuck fractal I didn't knew that. First time I ask a question here, sorry.

#

@white salmon https://tryhackme.com/room/uploadvulns

TryHackMe

TryHackMe | Cyber Security Training

An online platform for learning and teaching cyber security, all through your browser.

white salmon Nov 11, 2020, 1:07 AM

#

ah sorry i haven't got that far i only started yesterday

vale umbra Nov 11, 2020, 1:09 AM

#

I'm stuck in that part :/

hollow maple Nov 11, 2020, 1:13 AM

#

how do i find a file in windows using command prompt? tried google
@white salmon dir fileyouwant.ext /s /p
/s = look all disk; /p = pause if found
But it could take a century..

white salmon Nov 11, 2020, 1:13 AM

#

thanks alot @hollow maple

hidden fractal Nov 11, 2020, 1:16 AM

#

Room: Find Command
Task: 2
Question:
Find all files with write permission for the group "others", regardless of any other permissions, with extension ".sh" (use symbolic format)

The answer i try:

find / -type f -perm g=w -name "*.txt"

spice stream Nov 11, 2020, 1:17 AM

#

Hello All. Working on NIS - Linux Part I task 5 (grep). When using grep against any of the two grep txt files it is given a permission denied reply. Is it looking for a specific input?

📎 SPOILER_unknown.png

stuck fractal Nov 11, 2020, 1:17 AM

#

@hidden fractal Extension: .sh

#

.txt and .sh are different

#

And it's asking for others, not group

hollow maple Nov 11, 2020, 1:18 AM

#

I mean, .sh =/= .txt '-'

hidden fractal Nov 11, 2020, 1:19 AM

#

oh ok im sorry
i think its my second time asking for a obvious mistake
lol

hollow maple Nov 11, 2020, 1:19 AM

#

U.G.O
User - Group - Others

hidden fractal Nov 11, 2020, 1:19 AM

#

tnx

hollow maple Nov 11, 2020, 1:26 AM

#

Hello All. Working on NIS - Linux Part I task 5 (grep). When using grep against any of the two grep txt files it is given a permission denied reply. Is it looking for a specific input?
@spice stream Yeap, but, you can't do that, 'cause you don't have permission for..

white salmon Nov 11, 2020, 1:32 AM

#

@stuck fractal i found the answer to Learn Linux, Task 21. Thx for the help!

spice stream Nov 11, 2020, 1:33 AM

#

Up until this point the commands had permissions to the file for that task. i.e. cat for cat.txt. Am I just missing something?

hollow maple Nov 11, 2020, 1:35 AM

#

Well 🤔

#

Where's the file? currently directory?

spice stream Nov 11, 2020, 1:38 AM

#

/home/chad/

hollow maple Nov 11, 2020, 1:41 AM

#

What's your pwd?

spice stream Nov 11, 2020, 1:42 AM

#

📎 unknown.png

hollow maple Nov 11, 2020, 1:43 AM

#

wait, are you in grep group?

#

-rw-r----- = root (user) | grep (group) | --- (others)

#

root can read and write, grep can read, others can nothing.

spice stream Nov 11, 2020, 1:50 AM

#

This box has been pretty restrictive with commands. It seems the commands are in the groups related to their file. Example:

📎 unknown.png

hollow maple Nov 11, 2020, 1:52 AM

#

Yeap

#

root cat cat.txt
root grep grep1.txt(?)
root grep grep.txt
....

late patio Nov 11, 2020, 2:39 AM

#

did anyone get the 7zip file?

stuck fractal Nov 11, 2020, 2:39 AM

#

That's very vague.

late patio Nov 11, 2020, 2:39 AM

#

on the nislinuxone room. my bad

woven mirage Nov 11, 2020, 2:59 AM

#

wrong ninja there

#

more information would help us help you

#

what task

late patio Nov 11, 2020, 3:00 AM

#

holy crap. show's you how long it's been since i've been in this discord. lol

woven mirage Nov 11, 2020, 3:00 AM

#

and what are you tring to do?

late patio Nov 11, 2020, 3:00 AM

#

task 15

#

extract the zip.7z file.

woven mirage Nov 11, 2020, 3:00 AM

#

which room is nislinuxone?

#

learn linux?

late patio Nov 11, 2020, 3:00 AM

#

yeah

hollow maple Nov 11, 2020, 3:01 AM

#

which room is nislinuxone?
@woven mirage https://tryhackme.com/room/nislinuxone

TryHackMe

TryHackMe | Cyber Security Training

An online platform for learning and teaching cyber security, all through your browser.

woven mirage Nov 11, 2020, 3:01 AM

#

ooh the new one

#

i can't help you, sorry

late patio Nov 11, 2020, 3:02 AM

#

no worries. i'll figure it out. ty.

woven mirage Nov 11, 2020, 3:04 AM

#

lol wrong ninja again

late patio Nov 11, 2020, 3:04 AM

#

holy crap..

#

arghhhh

woven mirage Nov 11, 2020, 3:04 AM

#

dont need to ping

#

just ask

#

anyone can answer

late patio Nov 11, 2020, 3:04 AM

#

I'm used to a lot smaller thm discord. whoops. lol

stuck fractal Nov 11, 2020, 3:05 AM

#

I can't help either, heads up

#

I might work through the room tomorrow if you're still stuck

late patio Nov 11, 2020, 3:06 AM

#

ok, thank you. i'll ping Chevalier in a bit. thank you guys.

lyric oasis Nov 11, 2020, 7:06 AM

#

box: library .... done dirb with custom user agent ... s

#

did some ssh bruteforce

#

coudn't fifgure the useragent:rockyou in robots.txt

#

sorry for the trouble ssh brute force worked.....seems i lack patience😅

inland mirage Nov 11, 2020, 7:13 AM

#

In "Relevant", can't do anything with the file left there, enumerated even more just in case, but knew I had write permissions in this box and decided to put a rshell, one made for the version of IIS it is. (Hopefully not giving away tooo much.. lol) Anyway, I couldn't get it to work, tried multiple ways, encoded even, getting execution through browser, or through curl etc... it doesn't want to reach back out to me. I've done these before and don't think I'm missing anything.... Looked up the owners walkthrough, and looks like I'm doing it the same way.

#

I've restarted the box multiple times

#

I think I'm locking up the service

hasty slate Nov 11, 2020, 7:15 AM

#

did u try to put nc and run nc with cmdasp?

#

as relevant has windows defender on, malicious signatures will be deleted

#

so try with nc?

late patio Nov 11, 2020, 7:20 AM

#

is the payload staged?

inland mirage Nov 11, 2020, 7:25 AM

#

non-staged

#

gonig to try cmdasp

#

lol

#

I didn't get that to work either, let me reset the box again

#

Pretty cool little webshell though, I never used it before

inland mirage Nov 11, 2020, 8:00 AM

#

So, I restarted, did everything the same I just waited awhile first. Then, the shell took a minute to come back to me as well. But, i'm in.. 🙂

hasty slate Nov 11, 2020, 8:04 AM

#

eyy gj 🙂

inland mirage Nov 11, 2020, 8:05 AM

#

I mean, if you know it should work... just go over all the details again... right port, type of system, port, ip, all that... then restart the box and try again with patience lol

late patio Nov 11, 2020, 8:40 AM

#

had my fair share of those. very true. lol

paper plinth Nov 11, 2020, 9:30 AM

#

hi

#

I would like to ask about some hints for NIS - Linux Part 1, Task 15 7zip

#

extract the zip.7z file.
@late patio Owh, u have the problem too?

astral smelt Nov 11, 2020, 9:36 AM

#

Reread the task it tells you how to unzip the 7z file

paper plinth Nov 11, 2020, 9:37 AM

#

yes i read it

#

I am not sure whether i understand the steps wrongly or i didnt use the correct method

astral smelt Nov 11, 2020, 9:42 AM

#

It gives you a command to use use that command

paper plinth Nov 11, 2020, 9:46 AM

#

i do use it

#

but i state that permission denied

fallen jolt Nov 11, 2020, 9:54 AM

#

LFI Basics task 3 trying to inject the command as shows on the task.
User-Agent: Mozilla/5.0 <?php system($_GET['lfi']); ?> Firefox/68.0 if there any typos since it wont work?

paper plinth Nov 11, 2020, 9:59 AM

#

Havent done that yet.

LFI Basics task 3 trying to inject the command as shows on the task.
User-Agent: Mozilla/5.0 <?php system($_GET['lfi']); ?> Firefox/68.0 if there any typos since it wont work?
@fallen jolt

late patio Nov 11, 2020, 10:06 AM

#

@paper plinth Yeah, there's something wrong with it I believe. I got it once. never again. lol

paper plinth Nov 11, 2020, 10:07 AM

#

So u get the flag already?

past night Nov 11, 2020, 10:41 AM

#

Wait, please don't tell me that the 7zip is broken again

#

yo @late patio @paper plinth what happened

#

OH FOR GODS SAKE I JUST FIXED BINWALK WHY IS THIS BROKEN NOW

paper plinth Nov 11, 2020, 10:56 AM

#

yes

#

ahaha

#

sorry to tell you that but

#

7z is broken too

#

permission denied

late patio Nov 11, 2020, 10:59 AM

#

@past night not sure. run the command and it doesn't extract the .txt file.

past night Nov 11, 2020, 11:00 AM

#

yeah, i figured it out

late patio Nov 11, 2020, 11:00 AM

#

i was going to pm you, but didn't want to bother. lol

past night Nov 11, 2020, 11:00 AM

#

instead of doing -aG i-ve done -ag last night to fix permissions on xxd

late patio Nov 11, 2020, 11:00 AM

#

yeah, noticed you fixed the binwalk one. lol

past night Nov 11, 2020, 11:00 AM

#

yup

#

and messed up 7z because i didn't set up the groups correctly

late patio Nov 11, 2020, 11:00 AM

#

🤣 whoopsies.

past night Nov 11, 2020, 11:01 AM

#

there's a privesc too for the ones that want to get the file the hard way kekw

late patio Nov 11, 2020, 11:02 AM

#

lol. i'm about to get some sleep, but might check out the priv esc in a bit.

past night Nov 11, 2020, 11:02 AM

#

📎 unknown.png

#

fixed now will ask one of the admins to republish it again

late patio Nov 11, 2020, 11:04 AM

#

yup. that looks a bit more like the output i was bashing my keyboard to find. kekw

past night Nov 11, 2020, 11:08 AM

#

yeah, i am really sorry for this

#

i've mistyped a command

#

say thanks i haven't broken everything around it while at it!

late patio Nov 11, 2020, 11:12 AM

#

lol. all good. the rest of it works. lol

#

@past night ty, and have a good one. going to get a bit of rest.

past night Nov 11, 2020, 11:15 AM

#

oki, rest well

paper plinth Nov 11, 2020, 11:33 AM

#

thank you

oki, rest well
@past night

past night Nov 11, 2020, 11:33 AM

#

no worries, if you want the flag i am happy to dm it to you as you clearly done it correctly @paper plinth

paper plinth Nov 11, 2020, 11:34 AM

#

nah its ok @past night Thank you fror the room

past night Nov 11, 2020, 11:34 AM

#

no worries, and apologies

frail rain Nov 11, 2020, 12:58 PM

#

in startup is the ||.pcap|| file supposed to be empty?

hasty slate Nov 11, 2020, 1:11 PM

#

nope. but it's not ||pcap|| it wa ||pcapng||

frail rain Nov 11, 2020, 1:11 PM

#

yuh yuh same

#

its showing empty to me, i guess ill restart the machine

strange nest Nov 11, 2020, 1:21 PM

#

What is a flag.h file?

hasty slate Nov 11, 2020, 1:32 PM

#

its showing empty to me, i guess ill restart the machine
@frail rain yeah probably good idea.

frail rain Nov 11, 2020, 1:33 PM

#

rooted the machine thnx

hasty slate Nov 11, 2020, 1:33 PM

#

eyy gj potato!

glacial gust Nov 11, 2020, 2:22 PM

#

@past night I think the new room is having a grep error

📎 unknown.png

past night Nov 11, 2020, 2:22 PM

#

~~i think your command might be wrong~~ scrap that

#

let me check

#

can you drop me your room ip really quick @glacial gust

glacial gust Nov 11, 2020, 2:24 PM

#

10.10.47.135

past night Nov 11, 2020, 2:24 PM

#

2 minutes for Attacker Box to boot

#

fixed it for you @glacial gust

#

just exit and enter again ^^

#

i'm waiting for the fix to be pushed live

glacial gust Nov 11, 2020, 2:30 PM

#

thanks

past night Nov 11, 2020, 2:30 PM

#

no worries, i do apologise

glacial gust Nov 11, 2020, 2:31 PM

#

is the 7z error still being fixed

#

nvm

past night Nov 11, 2020, 2:32 PM

#

i fixed it on your instance

#

just doing hot fixes for now

glacial gust Nov 11, 2020, 2:32 PM

#

its a good room

past night Nov 11, 2020, 2:33 PM

#

thank you, i'm sorry i messed up that part, i tried fixing something and broke it somewhere else

glacial gust Nov 11, 2020, 2:33 PM

#

it happens

past night Nov 11, 2020, 2:33 PM

#

thank you for understanding and letting me know 🙂

#

i wasn't sure how many things were broken afterwards

white salmon Nov 11, 2020, 4:39 PM

#

Who is the creator of Ghidra room? I am having some difficulties

stuck fractal Nov 11, 2020, 4:40 PM

#

You don't usually need the creator

white salmon Nov 11, 2020, 4:40 PM

#

Task 4 question 2 "What is the first variable set to in the main function?"

stuck fractal Nov 11, 2020, 4:40 PM

#

Just ask your question directly, and if someone can help then they will

white salmon Nov 11, 2020, 4:41 PM

#

I don't see where I have to look

stuck fractal Nov 11, 2020, 4:42 PM

#

Have you jumped to the main function in ghidra?

white salmon Nov 11, 2020, 4:43 PM

#

yes I am on it

#

📎 Immagine_2020-11-11_174323.png

#

I think at least, is that correct?

#

question says "first variable" so "iVarl" correct?

stuck fractal Nov 11, 2020, 4:46 PM

#

What is it set to?

white salmon Nov 11, 2020, 4:48 PM

#

||strcmp = (local_18, "l\n")||

#

I think

#

But that not the correct answer

stuck fractal Nov 11, 2020, 5:53 PM

#

You'll want to look at the assembly if you're still working on it @white salmon

white salmon Nov 11, 2020, 5:55 PM

#

@stuck fractal I still have Ghydra open yes, even thou I was doing something else. I am not really good at assembly right now😬

stuck fractal Nov 11, 2020, 5:55 PM

#

It's a crucial skill for RE.

white salmon Nov 11, 2020, 5:56 PM

#

But that was an hint anyway, now I know where to look thanks!

meager vapor Nov 11, 2020, 6:18 PM

#

Hi

#

how can I chain oput of one command as argument of another?

stuck fractal Nov 11, 2020, 6:19 PM

#

That sounds like a good question rather than a #room-hints question

lime verge Nov 11, 2020, 6:21 PM

#

I have a question for Motunui room. || I found the network.pkt file but it says the only way to open it is with Cisco Packet tracer. Downloading it requires me to make an account and follow a course. Am I doing something wrong or is this the intended route of the room? If it is, it seems oddly complicated||

heavy lake Nov 11, 2020, 6:30 PM

#

Hey can somebody give me an idea on how to get ||root password|| on room Brute It

jovial sentinel Nov 11, 2020, 6:37 PM

#

Room: ToolsRus
Metasploit task

I am getting an error and I don't know how to get rid of it. Can someone help me with a tip? I have attached my options for msf5

📎 Screenshot_2020-11-11_at_19.36.54.png

trim haven Nov 11, 2020, 6:39 PM

#

Your LHOST seems a bit off?

white salmon Nov 11, 2020, 6:41 PM

#

set LHOST to tun0

jovial sentinel Nov 11, 2020, 6:41 PM

#

well, i've read that it should be my VPN ip but I am using an in browser machine and I thought that it is the machine ip

trim haven Nov 11, 2020, 6:42 PM

#

It should tell you your IP on the page

white salmon Nov 11, 2020, 6:42 PM

#

either set it to tun0 or go to 10.10.10.10 in your browser copy that ip and put it

trim haven Nov 11, 2020, 6:43 PM

#

Have you used the Browser Based Machine @white salmon

white salmon Nov 11, 2020, 6:43 PM

#

ohh

#

sorry i didnt notice

astral smelt Nov 11, 2020, 6:44 PM

#

Wrong exploit it's upload not deploy

trim haven Nov 11, 2020, 6:44 PM

#

Thanks Blackout blobheart

astral smelt Nov 11, 2020, 6:44 PM

#

blobheart

jovial sentinel Nov 11, 2020, 6:45 PM

#

I just checked in 10.10.10.10 and it's the one from there. I will try the upload one now blobheart

#

working 😉 thanks guys

fathom mulch Nov 11, 2020, 7:19 PM

#

Just trying to do old advent calendar and got stuck on Day 24,Elf Stalk 2nd task. Am I correct if I'm thinking CVE-2018-17246 should be used over here?

astral smelt Nov 11, 2020, 7:25 PM

#

@fathom mulch Yea that's correct

fathom mulch Nov 11, 2020, 7:25 PM

#

Cheers.

#

Now need to figure out how to upload that revshell..

white salmon Nov 11, 2020, 7:53 PM

#

finally rooted startup took a good 45mins

root@startup:~# id id uid=0(root) gid=0(root) groups=0(root)

hollow wyvern Nov 11, 2020, 8:57 PM

#

Hey guys, I'm new to THM, just going through the Metasploit intro lab but I'm just a bit confused, I want to load an exploit into a Windows host but I don't have a Windows lab host?

white salmon Nov 11, 2020, 8:57 PM

#

press the big green deploy button at the top of the page homie

hollow wyvern Nov 11, 2020, 8:58 PM

#

That's deployed my linux box, or is there another big green button I'm not seeing

stuck fractal Nov 11, 2020, 8:59 PM

#

Task 5

#

Click the green button

#

📎 unknown.png

#

NOT this one

📎 unknown.png

hollow wyvern Nov 11, 2020, 9:00 PM

#

Ohhh got it, nice one thanks for that

onyx stream Nov 11, 2020, 9:02 PM

#

i'm having an issue with the metasploit room...one of the questions is not accepting my answer O_O

#

📎 unknown.png

stuck fractal Nov 11, 2020, 9:02 PM

#

It's not asking for the number

#

read the question again carefully

pallid siren Nov 11, 2020, 9:26 PM

#

could anyone give me a push for the Startup room? I gained shell as www-data, then priv-esced to the next user....i have an idea of how to root, but everything i tried failed....dont really know what to do now

woven mirage Nov 11, 2020, 9:27 PM

#

run scripts to enumerate the machine such as linpeas and pspy

pallid siren Nov 11, 2020, 9:29 PM

#

Linpeas doesnt really give anything...i know the files i need to work with, but idk how to make them do what i want since they need root access to edit

woven mirage Nov 11, 2020, 9:32 PM

#

pspy will give great info

pallid siren Nov 11, 2020, 9:33 PM

#

Im not really familiar with that.. i used it once in the oscp proving grounds... ill find it and mess with it some more... thank you

white salmon Nov 11, 2020, 9:37 PM

#

check linnies home folder and pay attention to the files permissions and who they run as

simple phoenix Nov 11, 2020, 9:55 PM

#

quick question: in the OWASP room task 5, am I supposed to see a txt file somewhere in Burp's site map?

#

OWASP TOP 10 to be more precise

#

Task 5 question: What strange text file is in the website root directory?

#

nevermind I figured it out

pallid siren Nov 11, 2020, 10:11 PM

#

Thats weird.... i did the same thing i did earlier, but my 2nd shell spawned as the low priv user again, so i thought it was wrong....just tried it again and it spawned as root 🤷‍♂️

#

Really fun box though

past night Nov 11, 2020, 10:16 PM

#

nah its ok @past night Thank you fror the room
@paper plinth fixed now 🙂

stone oyster Nov 11, 2020, 10:59 PM

#

On the Linux Challenge room, flag 26 that gives the start of the flag, someone mentioned using find/grep. Could someone explain what I would find that then goes to grep?

#

or should it be grep/find?

woven mirage Nov 11, 2020, 11:15 PM

#

Is the one that gives a string that's the beginning of the flag?

#

You don't need find for that

#

Only grep

#

Use grep recursively in the directory you want to find

#

If you don't know the directory, use grep in / and it will search through all the files

#

It can take a while

white salmon Nov 12, 2020, 12:11 AM

#

I personaly used find and grep, tried with only grep and it took forever, but works

inland mirage Nov 12, 2020, 1:40 AM

#

Ack, I'm totally brain farting the setting I need to change sometimes for browser to lookup the domain and tld '.thm' .... Very sleepy today, struggling to remember dumb things

#

It's like..... domain lookup file, refer it to this box IP specifically or something.. I think it's a linux setting not a browser setting... top of my tongue here for awhile

woven mirage Nov 12, 2020, 1:41 AM

#

do you mean /etc/hosts?

inland mirage Nov 12, 2020, 1:41 AM

#

ding ding ding

#

thank you good sir/ma'am

woven mirage Nov 12, 2020, 1:42 AM

#

np

inland mirage Nov 12, 2020, 1:42 AM

#

lol

half citrus Nov 12, 2020, 2:58 AM

#

Working on Mr. Robot, not looking for hints, but am I nuts in that I'm completely missing flag two? I got dashboard access, but. Stumped. Again no hints, but I feel like to get the second flag it's complicated. Am I possibly overthinking this maybe? Trying to be vague cause this is the first non-walkthrough box I've attempted and trying to do this without hints really..

stuck fractal Nov 12, 2020, 2:58 AM

#

Do you have wordpress admin?

half citrus Nov 12, 2020, 2:58 AM

#

ya

stuck fractal Nov 12, 2020, 2:59 AM

#

You can usually get a shell on the system from that

half citrus Nov 12, 2020, 2:59 AM

#

that's what I was fiddling with anyway so that's good. at least I'm not over thinking it

tidal dune Nov 12, 2020, 2:59 AM

#

hey guys... pretty fresh here... I'm up to task 7 in the OWASP juice shop: Question #1: Perform a DOM XSS!.

I put in <iframe src="javascript:alert(xss)"> into the search bar and get the xss alert but no flag? Trawled through a bunch of walkthroughs on the internet to figure out what i'm doing wrong but it's pretty straightforward - apparently the flag should appear like the rest?

#

tried inspecting the element/checking browser console for the flag as well

woven mirage Nov 12, 2020, 3:01 AM

#

try to redeploy the machine and do it again

tidal dune Nov 12, 2020, 3:01 AM

#

I'll give it a go now

#

nope still won't appear

stuck fractal Nov 12, 2020, 3:03 AM

#

You need to follow the instructions super carefully

#

Use the payloads etc you're given

tidal dune Nov 12, 2020, 3:05 AM

#

uh there isn't any? It just says to input <iframe src="javascript:alert(xss)"> into the search bar

#

maybe i'll run it through burp suite

plush estuary Nov 12, 2020, 3:07 AM

#

I would suggest clearing cache or trying the payload through burp

tidal dune Nov 12, 2020, 3:13 AM

#

clearing the cache didn't work - would delivering the payload through burp be by using the repeater and crafting the http://ip/search/?q= bit

tidal dune Nov 12, 2020, 3:37 AM

#

i went to /api/challenges and found the line for it (#15) and tried searching using the iframe in there <iframe src="javascript:alert(xss)"> which didn't work either haha sorry if i'm just being dumb... pretty lost

polar mountain Nov 12, 2020, 3:40 AM

#

can somebody please help me with Physical Security Room - Task 6 - Number #5 - An improperly hung door which opens away from you can be bypassed using this type of tool? and Task 6 - Number #8 Adams Rite hardware fixtures are susceptible to a bypass where a wire is snaked through the keyway and actuates the locking mechanism behind it, what could prevent this bypass?

#

I have watched the videos over 3 times and cant find the answer to them

#

thankyou

cunning quartz Nov 12, 2020, 7:58 AM

#

Can somebody help me in intro to x86-64 room in the crackme2 binary?

#

I'm so confused

night cave Nov 12, 2020, 8:12 AM

#

@cunning quartz What's up?

#

Where are you stucked? What have you tried?

white salmon Nov 12, 2020, 12:43 PM

#

I'm almost embarrassed, but I'm stuck in the NIS-Linux room. I just can't find anything that has to do with shiba in any way ... Tast 2-16 were a piece of cake, but task 1 is killing me NotLikeThis

#

Can someone point me to the right direction?

#

Am I supposed to break out of the rbash?

snow matrix Nov 12, 2020, 12:49 PM

#

i need help in mitre room

median compass Nov 12, 2020, 12:54 PM

#

hey @white salmon, did you read the text at the start of the room? ||A requirement for this room is to finish the Learn Linux room - https://tryhackme.com/room/zthlinux.

As it covers all the basic requirements and this is just a follow up to it in order to strengthen the understanding you gained throughout the room. In order to do so.
Below I will be asking a few questions related to that room, so please, make sure to complete it first :). If you didn't feel free to go through the tasks and come back to this once you finished the room||

TryHackMe

TryHackMe | undefined

An online platform for learning and teaching cyber security, all through your browser.

white salmon Nov 12, 2020, 12:55 PM

#

So I have to Deploy the machine from the other room?

median compass Nov 12, 2020, 12:55 PM

#

@snow matrix it's better just to ask the question

#

well it's more that you should have done that room and have the answers in your notes/stored in THM - if you haven't then yes, the only way to get them is to go do the other room

white salmon Nov 12, 2020, 12:56 PM

#

done the other room a month ago 🙂

#

maybe i didnt get the task right. thanks 4 help 🙂

#

But it's not a problem to break out of the rbash in NIS 😄

median compass Nov 12, 2020, 1:00 PM

#

it doesn't matter if you break out of the rbash, the users shiba3 & 4 don't exist on this system

#

the only way to get their passwords is from the other room

past night Nov 12, 2020, 1:36 PM

#

there is a way of breaking out of rbash discovered by 0day, but the only thing you gain out of it is cheating yourself imo

compact sail Nov 12, 2020, 1:38 PM

#

For the scripting room i am at task 2 where you need to use socket but i am not receiving anything. Do i need to send a command after i connected?

median compass Nov 12, 2020, 1:41 PM

#

usually you open a connection then ||recvXXXXX from it||. you should go study up on python sockets is my suggestion, lots of examples out there

compact sail Nov 12, 2020, 1:41 PM

#

ok thx

#

I use recv but stays empty

📎 unknown.png

median compass Nov 12, 2020, 1:43 PM

#

you could/should have a look at pwntools too, their socket implementation (tubes) is very easy to use and it leads on nicely to buffer overflow techniques later

compact sail Nov 12, 2020, 1:45 PM

#

i will have a look at pwntools thanks

median compass Nov 12, 2020, 1:45 PM

#

i'm afraid I haven't done the room in question, your script looks ok at a glance, what port are you interrogating first?

#

3010?

#

if so do you get anything from it when you connect directly with ||nc IP 3010||?

compact sail Nov 12, 2020, 1:50 PM

#

the port changes every 4s i am refeshing the webpage to get the current port and giving that as arg with the script.

#

i will try to convert tubes and see if i get more luck. I think it has to do with the recv(1024)

#

i will try to lower that

#

because i don't think i get that much data

#

so its waiting to long

#

i hope

median compass Nov 12, 2020, 1:53 PM

#

pwntools has a very useful-for-ctfs recvuntil which let's you read from the socket up until you get a particular character/string, makes it much easier to grok incoming info and script a response

compact sail Nov 12, 2020, 1:56 PM

#

gotit

#

i need to send the get command

#

But i will be using tubes waaaaayyyyy easier

#

thanks for the push in the right direction

solemn smelt Nov 12, 2020, 3:48 PM

#

@rose cape if its not for a thm room then please ask in #general

rose cape Nov 12, 2020, 3:48 PM

#

alr

queen hull Nov 12, 2020, 5:11 PM

#

Hello- Stuck in steel mountain- task 3. I downloaded the file, unzipped it, and ran the command prompted within metasploit (within meterpreter). I have also tried using the location of where it is at in my host machine to no avail.

stuck fractal Nov 12, 2020, 5:12 PM

#

Can you be a bit more precise?

#

"the file"?

queen hull Nov 12, 2020, 5:12 PM

#

Im sorry, the file from task 3. it is a powerup script that we are prompted to download

#

Told to download said script, then use upload command in metasploit then gives the following : upload /opt/windows/powersploit/Privesc/PowerUp.ps1

stuck fractal Nov 12, 2020, 5:14 PM

#

Ok, and what happens?

#

Is that where you downloaded it?

queen hull Nov 12, 2020, 5:17 PM

#

no. I used the original command first (the one above), then I also tried it with the location of where that file is at on my host machine, got the same error message both times

#

📎 Screenshot_130.png

white salmon Nov 12, 2020, 5:19 PM

#

did you download the script to that location?

#

you have to put the location of the file on your local machine

#

most likely ~/Downloads/PowerUp.ps1

queen hull Nov 12, 2020, 5:22 PM

#

yeah thats where I had it prior. it is currently in the opt directory

#

ran code, same error message

stuck fractal Nov 12, 2020, 5:23 PM

#

wait

#

why have you got - / on the end?

white salmon Nov 12, 2020, 5:24 PM

#

put a web server on your local machine then wget from meterpreter

stuck fractal Nov 12, 2020, 5:24 PM

#

No no no

#

They're doing something really weird

white salmon Nov 12, 2020, 5:24 PM

#

huh

stuck fractal Nov 12, 2020, 5:24 PM

#

They have - / as the destination

#

Urgh that font nvm

#

Whatever they're doing, the file isn't there

queen hull Nov 12, 2020, 5:26 PM

#

the current command im using is: upload /opt/PowerSploit-Master/Privesc/PowerUp.ps1

stuck fractal Nov 12, 2020, 5:26 PM

#

So the file isn't there.

queen hull Nov 12, 2020, 5:26 PM

#

I see it in there, I'm not sure what you mean

median compass Nov 12, 2020, 5:27 PM

#

do an ls -la /opt/PowerSploit-Master/Privesc/PowerUp.ps1 for us @queen hull

stuck fractal Nov 12, 2020, 5:27 PM

#

upload evil_trojan.exe c:\\windows\\system32

#

upload source destination

queen hull Nov 12, 2020, 5:30 PM

#

📎 Screenshot_132.png

#

ninja I tried to do the upload for evil_trojan, same error

median compass Nov 12, 2020, 5:32 PM

#

ok, so in none of the original commands you showed us was that the path

queen hull Nov 12, 2020, 5:32 PM

#

yes after xnth mentioned that I moved the file there and tried, can provide screenshot for that as well

median compass Nov 12, 2020, 5:32 PM

#

please do

queen hull Nov 12, 2020, 5:33 PM

#

📎 Screenshot_133.png

stuck fractal Nov 12, 2020, 5:33 PM

#

upload source destination

queen hull Nov 12, 2020, 5:34 PM

#

re ran it and it went

#

idk

#

lol

#

it was the M in master. all that. im dumb

median compass Nov 12, 2020, 5:35 PM

#

you're nearly always better off cutting and pasting long paths for exactly that reason

#

good luck with the rest

queen hull Nov 12, 2020, 5:35 PM

#

thank you for your help

half citrus Nov 12, 2020, 7:04 PM

#

In reference to Mr. Robot, I discovered either a modified or custom switch on a certain command and I was trying to see if I could tell what the switch was doing because I'm getting strange stdout msgs with it. In reference to the command, for those that have completed the box, is there a .conf file or something that houses custom switches?

stuck fractal Nov 12, 2020, 7:05 PM

#

That's very very unlikely

half citrus Nov 12, 2020, 7:05 PM

#

i figured. Just thought I'd ask

stuck fractal Nov 12, 2020, 7:06 PM

#

You're being quite vague about it. If you'd like an answer, it's best to be more specific

half citrus Nov 12, 2020, 7:06 PM

#

I know, I'm trying not to get to many hints with this box cause it's the first I've attempted without a walkthrough.

stuck fractal Nov 12, 2020, 7:06 PM

#

There's #room-help if you're worried about spoiling something

half citrus Nov 12, 2020, 7:07 PM

#

ah so that one is less specific in regards to questions about a box?

stuck fractal Nov 12, 2020, 7:07 PM

#

No

half citrus Nov 12, 2020, 7:07 PM

#

oh I see

stuck fractal Nov 12, 2020, 7:07 PM

#

#room-help is for once you've checked writeups and something is not working

#

More than just hints, you don't have to worry about spoiling the intended path

#

Obviously don't post passwords or flags if you can avoid it, and don't dump spoilers for no reason, but that's how it breaks down

median compass Nov 12, 2020, 7:08 PM

#

the more specific you are the easier it is for us to help you just the right amount @half citrus, if you ask a very general question you're likely to get more than you want/need

stuck fractal Nov 12, 2020, 7:09 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

half citrus Nov 12, 2020, 7:09 PM

#

I know. But it's like, I need to have that first box I get on my own you know? as a noob it's a fine line

stuck fractal Nov 12, 2020, 7:09 PM

#

That's the template

#

Then don't ask at all?

#

It's your decision, and we can't help at all unless you help us help you

half citrus Nov 12, 2020, 7:13 PM

#

Ok, I'll try it this way: Working on Mr. Robot, 3rd flag. found in interesting switch within nmap that upon using it, i get this output. I'm not showing input due to spoilers unless you think it's ok to post.

📎 Screenshot_2020-11-12_141219.png

#

as for the input, I'm targeting localhost, and various standard nmap switches to see what the output is, if it changed.

median compass Nov 12, 2020, 7:14 PM

#

so you can surround anything you think is a spoiler with ||

half citrus Nov 12, 2020, 7:14 PM

#

ah thanks

median compass Nov 12, 2020, 7:15 PM

#

no, double pipes

half citrus Nov 12, 2020, 7:15 PM

#

lol

#

my input is ||nmap -oS - localhost||

stuck fractal Nov 12, 2020, 7:16 PM

#

Right process, total rabbithole

half citrus Nov 12, 2020, 7:16 PM

#

lol ok

median compass Nov 12, 2020, 7:17 PM

#

-oS means to output your findings in scriptkiddie format

#

hence the int3resting

half citrus Nov 12, 2020, 7:17 PM

#

wait, so scriptkiddie format is l33t?

median compass Nov 12, 2020, 7:17 PM

#

yeah

half citrus Nov 12, 2020, 7:18 PM

#

haha ok, that makes sense

#

I didnt know that

median compass Nov 12, 2020, 7:18 PM

#

https://nmap.org/book/output-formats-script-kiddie.html

#

google is your friend 🙂

half citrus Nov 12, 2020, 7:19 PM

#

I did google around for that, but I didn't put together that -oS was a part of nmap

#

so that's why I missed it. Thanks folks.

median compass Nov 12, 2020, 7:20 PM

#

good luck with the rest

stuck fractal Nov 12, 2020, 7:20 PM

#

You're supplying it as a flag to a program

median compass Nov 12, 2020, 7:22 PM

#

everything after the nmap has to be passed to the program as an argument unless there is a ';', '&', '&&', '|' etc. that signifies a new command or a pipe/redirect to another binary

half citrus Nov 12, 2020, 7:24 PM

#

thanks for the help. I feel a bit like a dummy spending so much time on this.

median compass Nov 12, 2020, 7:25 PM

#

everyone starts at the start, keep at it and you'll find a whole world of new things to fail at, that's the joy of infosec 🙂

oblique cliff Nov 12, 2020, 8:54 PM

#

Some start before the start

white salmon Nov 12, 2020, 9:32 PM

#

On kali what is the best wordlist to use for gobuster i can't find anything decent i check the dirb wordlists but there like 5 directory searches

stuck fractal Nov 12, 2020, 9:32 PM

#

THere is no best

#

There's a lot of wordlists in /usr/share/wordlists

#

dirb and dirbuster lists are the best place to start

white salmon Nov 12, 2020, 9:33 PM

#

Yeah but which is okay. common.txt is awful

stuck fractal Nov 12, 2020, 9:33 PM

#

Common is just fine

#

Big is just fine

white salmon Nov 12, 2020, 9:33 PM

#

really?

stuck fractal Nov 12, 2020, 9:34 PM

#

You have to try these things out yourself

#

It's a tradeoff between time and coverage

#

Like password cracking

white salmon Nov 12, 2020, 9:35 PM

#

Ahh okay. ive just tried big.txt this is working better thanks common was too quick didn't get much

#

another question if an exploit for example the one i have is 2.4.3. and it shows other exploits with 2.4.3.1 can i use them on the 2.4.3 version?

hasty slate Nov 12, 2020, 9:46 PM

#

I am saying this generally not for any room, usually it depends on the software, exploit etc.
like they may have fixed it, or they haven't. I have used like exploits which was for very different version with no problems. And also i have seen exploit that didn't work because of .1 difference of patch version. So if you can find an exploit which exactly matches it's cool otherwise u have to use trial and error to see what works.

white salmon Nov 12, 2020, 9:48 PM

#

thank you

elder knot Nov 12, 2020, 11:32 PM

#

Hello I'm stuck on the room CC:pentesting on task 4 last question, I tried to do my gobuster command with (I think) the good parameters but I cannot find the file, can someone give me an hint please ? 😄

#

(I tried a lot of dictionnaries too)

hollow maple Nov 12, 2020, 11:46 PM

#

What did you use to specify the extension?

stuck fractal Nov 12, 2020, 11:47 PM

#

If it's the question I think it is, make sure you're looking on / rather than the dir you found

white salmon Nov 12, 2020, 11:56 PM

#

Trying to crack the password on the HackPark room: Hydra find a wrong pass everytime, is my command wrong ? Task2 Q2

📎 unknown.png

stuck fractal Nov 13, 2020, 12:09 AM

#

That wordlist looks broken

white salmon Nov 13, 2020, 12:09 AM

#

That's rockyou.txt

stuck fractal Nov 13, 2020, 12:10 AM

#

it's got a different name

#

It's got HTML in it

white salmon Nov 13, 2020, 12:10 AM

#

I just get the 8 chars from rockyou

stuck fractal Nov 13, 2020, 12:10 AM

#

Rockyou has HTML but I think you're doing something wrong and breaking the page

#

You're missing A LOT of request body from your hydra command

white salmon Nov 13, 2020, 12:10 AM

#

Since i know the lenght of the pass i just stripped rockyou

#

Alright, that's maybe the problem then. Thanks

elder knot Nov 13, 2020, 12:18 AM

#

I used -x .xxa to specify the extension

stuck fractal Nov 13, 2020, 12:20 AM

#

I used -x .xxa to specify the extension
@elder knot Make sure you're using gobuster on / not the dir you found before

elder knot Nov 13, 2020, 12:21 AM

#

Ok I'll try tomorrow thanks a lot

white salmon Nov 13, 2020, 1:57 AM

#

How am i suppose to do simple CTF if the exploit is written in python2 and kali no longer uses python2 or pip2 installer?

stuck fractal Nov 13, 2020, 1:57 AM

#

Either fix the exploit, or fix python2 for Kali

white salmon Nov 13, 2020, 1:58 AM

#

not so simple ctf lol

magic vector Nov 13, 2020, 2:09 AM

#

room. owasp zap:
hi
i need help with owasp zap. i installed it and import the certificate on firefox. set foxyproxy for go through port 8080 and zap rout me always over https and not to http.
anyone has a solution?

stuck fractal Nov 13, 2020, 2:12 AM

#

That's intended behaviour

magic vector Nov 13, 2020, 2:14 AM

#

okay. its not like burp?

hollow maple Nov 13, 2020, 2:25 AM

#

Did you try to set the proxy manually (firefox)?

magic vector Nov 13, 2020, 2:25 AM

#

okay after a few resets it worked!

#

nope with foxy proxy; 127.0.0.1, 9090, http

hollow maple Nov 13, 2020, 2:26 AM

#

Ok!

grizzled berry Nov 13, 2020, 5:51 AM

#

I'm currently on Task 21 of the Linux Walk Through, and here's what i've got so far.

shiba2@nootnoot:/home/shiba1$ echo $USER
shiba2
shiba2@nootnoot:/home/shiba1$ ./shiba2
bash: ./shiba2: No such file or directory
shiba2@nootnoot:/home/shiba1$ ls
b.txt  ls  noot.txt  noot.txt.  shiba1
shiba2@nootnoot:/home/shiba1$```

#

what am I not seeing this time

jagged heron Nov 13, 2020, 5:52 AM

#

link the room please @grizzled berry

grizzled berry Nov 13, 2020, 5:52 AM

#

https://tryhackme.com/room/zthlinux

TryHackMe

TryHackMe | Learn Linux

A guided room designed to teach you the Linux basics!

final mortar Nov 13, 2020, 5:53 AM

#

Change to the home directory of the new user @grizzled berry

#

You are still in /home/shiab1

grizzled berry Nov 13, 2020, 5:54 AM

#

which command would I use for that?

final mortar Nov 13, 2020, 5:55 AM

#

You have to change directory to /home/shiba2, how would you do that ? cd /home/shiba2, or relative path cd ../shiba2 , Or just type cd anywhere to go to your home directory

jagged heron Nov 13, 2020, 5:55 AM

#

cd ../ to go back

#

and then what could you do 👀

final mortar Nov 13, 2020, 5:56 AM

#

There is a cd section you must have passed on your way here tho

#

Read up things more carefully

grizzled berry Nov 13, 2020, 5:57 AM

#

I keep forgetting things, thanks for the help

jagged heron Nov 13, 2020, 5:57 AM

#

~

final mortar Nov 13, 2020, 5:57 AM

#

I keep forgetting things, thanks for the help
@grizzled berry Read them again, take notes, read the notes again !

#

Whatever you gotta do :)

jagged heron Nov 13, 2020, 5:58 AM

#

Yea it can be confusing learning a lot of new information at once but I find for stuff lie using linux for example it becomes a lot easier to learn it when you immerse yourself in it

#

maybe try using wsl or a linux distro as a main os occasionally? seems to work for a lot of people

grizzled berry Nov 13, 2020, 6:21 AM

#

I actually don't remember learning cd

final mortar Nov 13, 2020, 6:23 AM

#

Hmm, it's coming up then @grizzled berry

grizzled berry Nov 13, 2020, 6:24 AM

#

I did a C^F on the page for cd and found it a couple Tasks later

#

im on chown right now

final mortar Nov 13, 2020, 6:24 AM

#

Yeah it's Fine. Keep doing them 🙂

grizzled berry Nov 13, 2020, 6:36 AM

#

I have officially learn what cd does

jagged heron Nov 13, 2020, 6:39 AM

#

change directory

#

@grizzled berry

grizzled berry Nov 13, 2020, 7:26 AM

#

I'm back

#

im trying to create a new directory called test in home, but im getting Permission denied. Heres how its looking...

shiba3@nootnoot:/home$ mkdir test
mkdir: cannot create directory ‘test’: Permission denied

I've tried to use chmod to change my permissions however that wasn't successful either:

chmod: changing permissions of '..': Operation not permitted

I feel like im somewhere near the right path...

cunning quartz Nov 13, 2020, 7:29 AM

#

@night cave
Actually I'm not able to crack the crackme2 part

night cave Nov 13, 2020, 7:29 AM

#

What have you tried?

cunning quartz Nov 13, 2020, 7:30 AM

#

I have tried in the radare2

night cave Nov 13, 2020, 7:30 AM

#

And?

cunning quartz Nov 13, 2020, 7:30 AM

#

Gdb

#

Changing the breakpoints for noticing the eax and eips but I got confused

night cave Nov 13, 2020, 7:31 AM

#

Okay, show me what have you done.

cunning quartz Nov 13, 2020, 7:31 AM

#

Okay

wintry yarrow Nov 13, 2020, 7:35 AM

#

@grizzled berry make sure you are right user and in the right directory.

grizzled berry Nov 13, 2020, 7:36 AM

#

found it

cunning quartz Nov 13, 2020, 7:43 AM

#

@night cave i not able to get the movq operation

📎 unknown.png

#

you can see the last intruction of comparing the registers, but when i check their values it always gives me fffffff @night cave

📎 unknown.png

#

see @night cave

📎 unknown.png

night cave Nov 13, 2020, 7:48 AM

#

Are you trying it on your machine?

cunning quartz Nov 13, 2020, 7:48 AM

#

no on remote machine

#

ssh

#

i deploy the machine and the files are present their only

night cave Nov 13, 2020, 7:49 AM

#

Do you have the directory /home/tryhackme/install-files/secret.txt?

cunning quartz Nov 13, 2020, 7:49 AM

#

yes

#

it got some text

#

but that is not the answer

#

i already tried

night cave Nov 13, 2020, 7:49 AM

#

Indeed, that's not the answer.

cunning quartz Nov 13, 2020, 7:50 AM

#

actually i'm a beginner in binary exploitation

night cave Nov 13, 2020, 7:50 AM

#

Wait, so where exactly the program ends for you?

cunning quartz Nov 13, 2020, 7:50 AM

#

wait

#

@night cave

📎 unknown.png

night cave Nov 13, 2020, 7:52 AM

#

Ah, move to DM, if I try to help you any further, this will just spoil everything.

#

So, DM would be the best.

cunning quartz Nov 13, 2020, 7:52 AM

#

all these pics?

#

What should I do now? @night cave

night cave Nov 13, 2020, 8:06 AM

#

No, just DM me your approach on where you set breakpoints and all

cunning quartz Nov 13, 2020, 8:06 AM

#

Okay

true dune Nov 13, 2020, 10:30 AM

#

Can anybody provide a hint as to where I should be looking for Mitre: Task 6 "Where can you find step-by-step instructions to execute both scenarios?". I' feel like I've read the whole website and entered the correct answer, but I must be missing something obvious for the required answer

astral smelt Nov 13, 2020, 10:36 AM

#

Click on the APT29 link and you will find it

true dune Nov 13, 2020, 10:41 AM

#

@astral smelt Thanks, I got it. I was looking in completely the wrong place

grizzled berry Nov 13, 2020, 11:57 AM

#

anyone know where I can find command aliases

median compass Nov 13, 2020, 11:57 AM

#

what do you mean 'find' them

#

like on a running system?

#

or examples of them

#

what room and task are you doing?

grizzled berry Nov 13, 2020, 11:58 AM

#

https://tryhackme.com/room/linuxctf
task 2 question 1

TryHackMe

TryHackMe | Cyber Security Training

An online platform for learning and teaching cyber security, all through your browser.

#

im supposed to find where command alias are stored and get flag 11

median compass Nov 13, 2020, 11:59 AM

#

you mean task 3 question 1?

grizzled berry Nov 13, 2020, 11:59 AM

#

yes, apologies

median compass Nov 13, 2020, 12:00 PM

#

have you tried googling? it pops up in the very first result for me when I search "linux define alias"

grizzled berry Nov 13, 2020, 12:02 PM

#

Im googling the wrong questions I guess

median compass Nov 13, 2020, 12:03 PM

#

that's just a question of practice too. Got it now?

stiff ridge Nov 13, 2020, 12:08 PM

#

hi, on the INVESTIGATING WINDOWS machine i am surprised to say that I am stuck on question " What was the extension name of the shell uploaded via the servers website?

"

#

I have answered all other questions, been wondering how to find out

median compass Nov 13, 2020, 12:10 PM

#

sorry, haven't done that one. Can you find a log file for the web server?

grizzled berry Nov 13, 2020, 12:10 PM

#

yeah I found the one, but now its telling me to look where the alias are created

stiff ridge Nov 13, 2020, 12:11 PM

#

hmmm @median compass will try to find one

median compass Nov 13, 2020, 12:12 PM

#

all the commands and info you need are in that link @grizzled berry. It gives you the command to print all aliases and further down it tells you how to make aliases that persist across sessions

grizzled berry Nov 13, 2020, 12:13 PM

#

im going through it right now

stiff ridge Nov 13, 2020, 12:13 PM

#

@median compass I have discovered it. THanks man, hah, cant believe i spent like 30 min and did not think about that

white salmon Nov 13, 2020, 12:37 PM

#

https://tryhackme.com/room/lle
Task 6.
I can't find the flag

TryHackMe

TryHackMe | Cyber Security Training

An online platform for learning and teaching cyber security, all through your browser.

#

@white salmon What extension you tried ?

median compass Nov 13, 2020, 12:44 PM

#

using spoiler tags (surrounding the text with || on both sides), show us what you've done, i.e. the commands you used @white salmon

polar mountain Nov 13, 2020, 12:46 PM

#

Could someone please assist with this question in the MITRE room

📎 unknown.png

#

task5 Q1

#

thanks

median compass Nov 13, 2020, 12:48 PM

#

have you gone to the SHIELD website as instructed and looked at each of the tactics in turn? @polar mountain

polar mountain Nov 13, 2020, 12:49 PM

#

https://shield.mitre.org/tactics/

#

https://shield.mitre.org/techniques/

median compass Nov 13, 2020, 12:49 PM

#

no, I'm aware of the website, I'm asking have you gone there and read it?

#

because each tactic lists the techniques that apply to it

#

and the question just wants to know which has most

#

so the answer is on the site

polar mountain Nov 13, 2020, 12:50 PM

#

there seems a fair bit to read through

median compass Nov 13, 2020, 12:50 PM

#

well, that's kind of the essence of learning

#

but you could just count them and not read them

polar mountain Nov 13, 2020, 12:51 PM

#

true

#

not sure if i am looking at the right page

median compass Nov 13, 2020, 12:51 PM

#

this is #room-hints, not #room-tldr

polar mountain Nov 13, 2020, 12:51 PM

#

fair enough

white salmon Nov 13, 2020, 12:59 PM

#

I did ||find / -type f -name "*.conf" 2>/dev/null|| but there are too many results

#

@white salmon You can snag a sneeky grep if you want to

#

||find / -type f -name "*.conf" 2>/dev/null | xargs grep "*THM*"|| did not find anything

#

You're very very close

#

Check for more option in your grep

#

||-i|| did not help

#

Nop. But look arround you're close

polar mountain Nov 13, 2020, 1:10 PM

#

@median compass sorry mate i was bamboozled with the website and was looking at the attack codes instead of the name, all sorted out

white salmon Nov 13, 2020, 1:14 PM

#

do i have to use ||-e||?

#

What this tag used for ?

#

||regex||

#

Well, this channel is for hints not help. I might gave you the hints that can lead you to the flag (i just tried once again and it works). Try to find by yourself again with those hints. Then check the writeups, if you still can't find your way then ask in #room-help

#

alright. thank you

stone oyster Nov 13, 2020, 1:21 PM

#

morning

grizzled berry Nov 13, 2020, 1:32 PM

#

any idea on how to search all files for a string that starts with 4bceb and is 32 characters long?

median compass Nov 13, 2020, 1:33 PM

#

@stone oyster, you got this one!

stone oyster Nov 13, 2020, 1:34 PM

#

nope

white salmon Nov 13, 2020, 1:34 PM

#

You can use grep only, or find/grep(my favorite)

stone oyster Nov 13, 2020, 1:34 PM

#

lol

#

Find is kicking my butt.

#

I was trying type.

#

size.

#

I just keep geting errors or super long lists

#

Currently I have find / -size -50b -type f | grep

#

I'm trying to remember the grep I had the other day.

median compass Nov 13, 2020, 1:36 PM

#

you need to build a regex to match the search string @grizzled berry - you can try regex101.com to test to make sure it matches - and then as kana says, use grep on its own (works fine but very slowly, like >1hr) or find with grep together

stone oyster Nov 13, 2020, 1:36 PM

#

using a regex do I need a -regex flag, or / or ' ?

#

@grizzled berry We are working on the same flag

grizzled berry Nov 13, 2020, 1:37 PM

#

I caught up skidy

#

ill let you know if I get anywhere then

cursive ermine Nov 13, 2020, 1:38 PM

#

I remember that one being a nightmare. Let me look thru my notes to see if I wrote anything down about the regex string that could be helpful without giving it away

stone oyster Nov 13, 2020, 1:39 PM

#

I had started building a regex, but I can't seem to find it right now.

median compass Nov 13, 2020, 1:39 PM

#

i can't hint any more than I already have @stone oyster sorry

stone oyster Nov 13, 2020, 1:39 PM

#

I know.

#

No worries.

#

I'm working on it.

#

You mentioned the size, the string...

white salmon Nov 13, 2020, 1:39 PM

#

Actually if you don't like the regex, i just tried with find only

#

It works (but that's very silly)

cursive ermine Nov 13, 2020, 1:41 PM

#

If I was better at grepping back then I would have done that probably. Find * in / | grep string

white salmon Nov 13, 2020, 1:42 PM

#

A awk can be usefull too

cursive ermine Nov 13, 2020, 1:42 PM

#

and maybe sed

white salmon Nov 13, 2020, 1:43 PM

#

There are so many ways to find this, hardest part is to pick one lol

stone oyster Nov 13, 2020, 1:46 PM

#

for the regex, do we need the /gm at the end?

white salmon Nov 13, 2020, 1:46 PM

#

nop

stone oyster Nov 13, 2020, 1:47 PM

#

ok. To begin a regex is there a special way to signify that we are usinig regex?

white salmon Nov 13, 2020, 1:47 PM

#

First thing first

#

man grep

#

Google grep regex

#

Then ask again here.

stone oyster Nov 13, 2020, 1:51 PM

#

In the research that I've done I've seen pages us -regex, /, and '

#

So I don't know if I need or dont' need and if so, which.

#

need more coffee.

#

brb

#

afk

white salmon Nov 13, 2020, 1:53 PM

#

https://www.cyberciti.biz/faq/grep-regular-expressions/

nixCraft

Regular expressions in grep ( regex ) with examples - nixCraft

Regular Expressions in grep - Learn how to use regular expressions (regex) in grep to search for text/words in Linux, macOS or Unix-like operating systems.

#

If you can't find your way with that, i don't know what else i could do without giving the answer

grizzled berry Nov 13, 2020, 1:59 PM

#

heres what im thinking
rgrep -e '--5bceb--' /

stone oyster Nov 13, 2020, 1:59 PM

#

Looking at this example about purchase followed by anything it says to use 'purchase..'

#

Would only 2 dots allow the 27 characters we need?

#

or would we have to put in 27 .?

#

We had discussed .{27} the other day

white salmon Nov 13, 2020, 2:01 PM

#

Guys if you really want to learn something about that (which is important to me) try to find the command by yourself with the resources i provided. There is literaly the answer in this web page. Try to work on that together if you want to. It will be way more useful for you.

stone oyster Nov 13, 2020, 2:04 PM

#

I'm trying

median compass Nov 13, 2020, 2:11 PM

#

that site regex101.com is great for building regex guys, seriously try it

#

it has all the syntax and you can see exactly what is and is not being matched

#

a dot matches any single character marc

#

so purchase.. matches purchase99 and but not purchase9

#

putting a number inside {} means match that many of the character before

#

but seriously lads, you can get all this from the links kana sent or from that regex101 site

stone oyster Nov 13, 2020, 2:15 PM

#

No doub.t

#

We just need to piece it together.

#

find / looks at everything from / onward. I guess it's about as root as we will get with this one.

#

so we can look at all files in garry, alice, bob and elsewhere.

median compass Nov 13, 2020, 2:20 PM

#

find looks at everything from where you tell it to

stone oyster Nov 13, 2020, 2:20 PM

#

riight

median compass Nov 13, 2020, 2:20 PM

#

if you use find / ... then from root

#

if you use find /home ... then from /home, etc

stone oyster Nov 13, 2020, 2:26 PM

#

Do we need to look for hidden directories?

#

Do we need to look for hidden files?

median compass Nov 13, 2020, 2:27 PM

#

have a look here for an example of find|xargs|grep https://unix.stackexchange.com/questions/131535/recursive-grep-vs-find-type-f-exec-grep-which-is-more-efficient-faster

Unix & Linux Stack Exchange

Recursive grep vs find / -type f -exec grep {} \; Which is more eff...

Which is more efficient for finding which files in an entire filesystem contain a string: recursive grep or find with grep in an exec statement? I assume find would be more efficient because you c...

grizzled berry Nov 13, 2020, 2:27 PM

#

I think were supposed to look through all files just to find something that starts with 5bceb and is 32 characters long

stone oyster Nov 13, 2020, 2:27 PM

#

I found a 41da

#

lol

median compass Nov 13, 2020, 2:27 PM

#

4bceb @grizzled berry

stone oyster Nov 13, 2020, 2:27 PM

#

Is the file named like the flag?

median compass Nov 13, 2020, 2:28 PM

#

no, the flag is what you'er searching for

#

when you get the command it'll return one 32 character string and that's your flag

stone oyster Nov 13, 2020, 2:28 PM

#

Right. The file has it's name, and we will find that name, not that it really matters, by running a grep for the contents

median compass Nov 13, 2020, 2:28 PM

#

yes, the file name is incidental

stone oyster Nov 13, 2020, 2:30 PM

#

My size option isn't working. I tried -size 32b and -size 10b and received the same huge list

grizzled berry Nov 13, 2020, 2:34 PM

#

its not making any sense

median compass Nov 13, 2020, 2:35 PM

#

if you want an answer then i suggest #room-help, there's not many more hints anyone can give I'm afraid

stone oyster Nov 13, 2020, 2:48 PM

#

the beast is going to give in to me if only to get me to quit poking it.

#

I'm making assumptions. Is the file we are looking for going to be a .txt?

median compass Nov 13, 2020, 2:53 PM

#

nope, the only assumptions you should make are the ones that are given to you

stone oyster Nov 13, 2020, 2:54 PM

#

Bah! I have to go for now.

#

Thanks for the help

#

will poke more later.

jaunty vault Nov 13, 2020, 4:32 PM

#

Any hints for what Room Mitre, Task 6 Question 5 is needing. I've found the website but everything I enter isn't working. Not sure what I'm missing

hollow maple Nov 13, 2020, 4:48 PM

#

Ctrl + F and keyword from the question into website.

#

I found it right now easy peasy..

jaunty vault Nov 13, 2020, 4:55 PM

#

I'm still missing something.. the question is "Where can you find step by step instructions to execute both scenarios?" and I see the link to the website but the answer format is ****** ******* and I can't seem to make anything work..

hollow maple Nov 13, 2020, 5:02 PM

#

It's a placeholder.. So 2 words..

astral smelt Nov 13, 2020, 5:02 PM

#

Click on the APT29 link and you'll find your answer

hollow maple Nov 13, 2020, 5:02 PM

#

Yeap

jaunty vault Nov 13, 2020, 5:05 PM

#

I'm in the APT29 link and it takes me to pdf hosted on github and I find the link within that document that claims it has step by step instructions which it does. But I've tried several different combinations of 2 words I could think of that would match the format with no luck. I know I'm missing something I'm just not sure what..

#

Am I on the right track or am I overlooking something?

hollow maple Nov 13, 2020, 5:06 PM

#

PDF?

astral smelt Nov 13, 2020, 5:08 PM

#

You're clicking the FIN6 link if it's taking you to GitHub

hollow maple Nov 13, 2020, 5:08 PM

#

I mean, read the previous question, it's a huge hint.. just saying..

jaunty vault Nov 13, 2020, 5:09 PM

#

Found it. I was going into the pdf from the link, I needed to back up and look at the other page. I had the answer correct I was missing a "special charactor" within the answer. Thanks for your help

hollow maple Nov 13, 2020, 5:11 PM

#

no prob

white salmon Nov 13, 2020, 6:09 PM

#

on room hydra what wordlist should i use to bruteforce i have loads of wordlists

#

lord i hope the passwords in here

📎 SPOILER_lord.png

dusk violet Nov 13, 2020, 6:18 PM

#

@white salmon rockyou 🙂

#

always rockyou unless the room states otherwise

white salmon Nov 13, 2020, 6:18 PM

#

@dusk violet thank you 🙂 didn't wanna sit through a million different wordlists and thanks good tip. also does hydra work off gpu or cpu?

dusk violet Nov 13, 2020, 6:19 PM

#

cpu

white salmon Nov 13, 2020, 6:19 PM

#

damn i only got i5

dusk violet Nov 13, 2020, 6:19 PM

#

normally passwords will be closer to the begining of the file..so wont take too much time

white salmon Nov 13, 2020, 6:19 PM

#

Orite thank god

dusk violet Nov 13, 2020, 6:20 PM

#

no worries...hydra is bruteforcing password on a webserver

#

the bottleneck is the network

white salmon Nov 13, 2020, 6:20 PM

#

Lets hope it doesn't crash im using high threads

dusk violet Nov 13, 2020, 6:21 PM

#

when you are cracking hashes or pgp using john/hashcat is more cpu intensive

white salmon Nov 13, 2020, 6:21 PM

#

you can crack pgp with john wtf?

dusk violet Nov 13, 2020, 6:21 PM

#

-t 4 will be enough

white salmon Nov 13, 2020, 6:21 PM

#

hashcat uses gpu right?

dusk violet Nov 13, 2020, 6:21 PM

#

if you set a high threads you might miss the password...

#

hashcat can use cpu/gpu or both

#

gpu is much more fast 🙂

white salmon Nov 13, 2020, 6:22 PM

#

ahh okay im on 40k passwords right now so maybe reduce threads?

#

will a gt710 work okay lmao?

dusk violet Nov 13, 2020, 6:23 PM

#

are you using a VM to connect to THM openvpn?

white salmon Nov 13, 2020, 6:23 PM

#

yeah

dusk violet Nov 13, 2020, 6:23 PM

#

then you cannot pass through the GPU resourses to the VM

#

just CPU

white salmon Nov 13, 2020, 6:23 PM

#

ahh okay. thanks for the tip

dusk violet Nov 13, 2020, 6:24 PM

#

however...if you get something to crack offline you can send it to the Host and use Hashcat there with GPU

white salmon Nov 13, 2020, 6:25 PM

#

So you mean a hash.txt?

dusk violet Nov 13, 2020, 6:25 PM

#

yep

white salmon Nov 13, 2020, 6:25 PM

#

great im not sure a gt710 will handle hashcat though pretty weak gpu

dusk violet Nov 13, 2020, 6:26 PM

#

in THM metwork you won't need a beast to pass the rooms 🙂

#

in fact the VM they provide to use through the web browser is basic. so don't worry

white salmon Nov 13, 2020, 6:27 PM

#

Thank god i had a problem with a ctf on another website that used hashcat

dusk violet Nov 13, 2020, 6:27 PM

#

make sure the hash is detected

#

and you're using the right -m

#

https://hashcat.net/wiki/doku.php?id=example_hashes

#

use 'Find' to make sure you are doing it properly

white salmon Nov 13, 2020, 6:28 PM

#

yeah i was it said something like your GPU could crash and aborts

#

i was using a bog standard hp intergrated graphics card lol

dusk violet Nov 13, 2020, 6:28 PM

#

🤣

stuck fractal Nov 13, 2020, 6:58 PM

#

@white salmon Hydra is network brute force. It doesn't really depend on your hardware speed, unlike hash cracking.

white salmon Nov 13, 2020, 6:58 PM

#

Okay thanks what are recommended specs for hashcat

stuck fractal Nov 13, 2020, 6:58 PM

#

There are none.

#

Your cracking speed will depend on your hardware. It will run on most GPUs.

white salmon Nov 13, 2020, 7:09 PM

#

i dont have decent hardware though

woven mirage Nov 13, 2020, 7:10 PM

#

normally hashed password on thm rooms take a little time to crack even in bad pcs

white salmon Nov 13, 2020, 7:11 PM

#

Is it safe to run with bad specs?

woven mirage Nov 13, 2020, 7:11 PM

#

well, i don't see why it wouldnt be

white salmon Nov 13, 2020, 7:11 PM

#

might crash pc?

woven mirage Nov 13, 2020, 7:11 PM

#

are you afraid that your pc will explode because of hashcat?

white salmon Nov 13, 2020, 7:11 PM

#

no ive had it crash before

hollow maple Nov 13, 2020, 7:12 PM

#

Try AttackBox to do it!

woven mirage Nov 13, 2020, 7:12 PM

#

theres probably an option to make it use less resources

oblique cliff Nov 13, 2020, 7:12 PM

#

are you afraid that your pc will explode because of hashcat?
@woven mirage let me tell you ok. I’m on my sixth exploded computer after trying to use hashcat ok

white salmon Nov 13, 2020, 7:12 PM

#

so your pc can explode lol

woven mirage Nov 13, 2020, 7:13 PM

#

he's joking kk

white salmon Nov 13, 2020, 7:13 PM

#

lmao

oblique cliff Nov 13, 2020, 7:13 PM

#

Am I 👀

dusk violet Nov 13, 2020, 7:19 PM

#

@white salmon I've read to don't use the --force option (ignore warnings) on hashcat, and you'll be good to go.

#

(on machines with low specs)

white salmon Nov 13, 2020, 7:19 PM

#

that explained why my pc crashed before

woven mirage Nov 13, 2020, 7:23 PM

#

at least it didn't exploded 🤷‍♀️

hollow maple Nov 13, 2020, 7:23 PM

#

yet*

#

Hydra + John + Hashcat = what would happen? kekw Using a 775 LGA socket w/o GPU, 1GB RAM

white salmon Nov 13, 2020, 7:28 PM

#

https://tenor.com/view/fire-fire-bender-avatar-flame-burn-gif-4493955

Tenor

Fire

▶ Play video

#

looking for hint on gaming server ctf. i have the private rsa key. how do i use it to login using ssh ?

#

google how to login to ssh with rsa key

#

or do man ssh

#

do i have to bruteforce a private rsa key?

#

nah you use it to login

#

just think of it as a password and youll be fine

#

i think the syntax is ssh -i id_rsa

#

i tried that but doesn't work

#

https://tenor.com/view/google-it-eyes-search-engine-mike-barreras-gif-13674257

Tenor

void lava Nov 13, 2020, 8:14 PM

#

did you chmod it?

white salmon Nov 13, 2020, 8:15 PM

#

oh true

void lava Nov 13, 2020, 8:15 PM

#

also it would be great if you gave us more info than just "it doesn't work"

white salmon Nov 13, 2020, 8:21 PM

#

chmod 600 yes

woven mirage Nov 13, 2020, 8:27 PM

#

@white salmon send screenshot of the output of the command

white salmon Nov 13, 2020, 8:27 PM

#

i closed it lol

#

accessdenied try

#

to hard lol

fleet pike Nov 13, 2020, 8:59 PM

#

Room: Mitre, task 4, question 2. "For the above analytic, what is the pseudocode a representation of"

Do they mean the TA0003 tactic, or the analytic of CAR-2014-11-004 ?

Room Mitre, Task 5, question 5, "Continuing from the previous question, look at the informationf or this ATT&CK Technique, what 2 programs are listed that adversary's will check for?"

I've scanned all of the VM detetction techniques and I cannot find any mention of two specific programs (especially that correlate between the sub techniques) on those pages, or any linked content on those pages that match that hash count.

Room mitre, Task 7, question 3. "As your organization is migrating to the cloud, is there anything attributed to this APT group that you should focus on? If so, what is it?"

Stupid users doesn't fit the hash. Email phishing, does. but apparently is not the right answer. neither is Cloud Security or Email Filtering ... any thoughts on what they are trying to get as an input box? (As this seems to relate directly to Crowdstrike, i also mined crowdstrikes site with the feline sounding group name who is listed as an actor. No particular mention of tools/techniques, detection tips. or deployed platforms on crowdstrikes webiste asides from the same copypasta that went everywhere.. Email phish, person clicked msg. application executed. blah ) .. By correlating the empire links, i discovered an app that starts/ends with same letter on an entirely diff url .. But I'm not sure what I should be detecting as an aerospace industry to catch this person (asides from incompetent users)

subtle drum Nov 13, 2020, 10:40 PM

#

Can someone help with a https://tryhackme.com/room/physicalsecurityintro, task 4 question 5? I've done all the others but completely stuck on this one

TryHackMe

TryHackMe | undefined

An online platform for learning and teaching cyber security, all through your browser.

white salmon Nov 13, 2020, 11:05 PM

#

@fleet pike Task 7 question 3 you almost had the right answer, just try some variations of the ones you already said...

fleet pike Nov 13, 2020, 11:05 PM

#

spear phishing didn't work either ..

hexed crescent Nov 13, 2020, 11:05 PM

#

For T4 Q2, another analytic tied to TA0003 tactic. @fleet pike

fleet pike Nov 13, 2020, 11:05 PM

#

hmm

#

Ty for clarifying TA003

white salmon Nov 13, 2020, 11:06 PM

#

Is a variation of ||Cloud security||

fleet pike Nov 13, 2020, 11:07 PM

#

TBH, if i'm trying to protect my organization against APT33, im just goign to remove my users ability to send/receive email

#

lmao

#

"No email privileges for you"

#

Make them go back to letters and stamps

#

Got any Azure creds? Go phish

hexed crescent Nov 13, 2020, 11:08 PM

#

For T5 Q5, the answer is on the page that represents the technique mentioned for T5 Q4.

fleet pike Nov 13, 2020, 11:08 PM

#

TY

white salmon Nov 13, 2020, 11:11 PM

#

T5 Q5 My Hint his that in the page of the technique the tools are listed with a "," but in the answer you have to use a conjunction

white salmon Nov 14, 2020, 12:03 AM

#

Is there a prefered way to nmap scan ? i usually do nmap -sS -sC -sV -A -p- -oX scan.xml <ip_Address>

#

@white salmon I think this kind of question goes to #general channel or something along that line

#

it's for a room im doing

#

Anyway for the sake of answer, there is no prefered way it all depends on what you are doing, how much time you have, what kind of machine you are scanning etc...

#

the machine im scanning is a windows machine

#

But as example if you read nmap man page you will see that -A incorporate -sV and -sC in himself

#

what do you mean

#

Read the nmap man page you will understand

#

Oh i see thanks

#

how do i connect to the pics? Anonymous CTF

📎 help.png

#

Do you have access to that folder?