#room-hints | TryHackMe | Page 70

glossy radish Dec 5, 2020, 7:56 AM

#

Introductory researching

#

room/introtoresearch

white salmon Dec 5, 2020, 7:57 AM

#

its about 13 years old

glossy radish Dec 5, 2020, 7:58 AM

#

😅 i just started

white salmon Dec 5, 2020, 7:58 AM

#

the vulnerbility is 13 years old

glossy radish Dec 5, 2020, 7:58 AM

#

2007 right

#

oh right

#

i just found it

white salmon Dec 5, 2020, 7:59 AM

#

good

glossy radish Dec 5, 2020, 7:59 AM

#

thank you!

white salmon Dec 5, 2020, 8:03 AM

#

you're welcome

orchid root Dec 5, 2020, 8:08 AM

#

Hello

#

I m doing basic pentesting

#

There is I m typing this command

#

But it isn't retuning me which anonymous files

#

I completed it thanks😀😀😀

steady stratus Dec 5, 2020, 10:53 AM

#

😄 ✌🏼

sturdy folio Dec 5, 2020, 11:24 AM

#

Anyone can help with Physical Security Intro Task 6 Q6/8?

lethal cliff Dec 5, 2020, 11:43 AM

#

hey, did someone try DevGuru box and could help me ? (https://tryhackme.com/room/devguru)

wintry yarrow Dec 5, 2020, 11:48 AM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done.

tardy basin Dec 5, 2020, 12:42 PM

#

|| Room DevGuru

I have just dump .git repository and recover files
-I used to Adminer for access db and i got the frank's bcrypt password ,
-I created another user and logged in cms after that i have impersonate frank ||

#

I am trying to access gitea with frank but I could not do that

zinc oyster Dec 5, 2020, 12:44 PM

#

Hi I'm stuck on owasptop10 task16 last question... if I reuse the XXE payload I sucessfully got out the /etc/passwd and replace the path to the ssh-key (answer I gave on that question was accepted), then the response is weird and breaks the html-page like so: <p style="font-size:2em;"> <root/> </p> and having looked at writeups it seems this should work.

#

Am I missing something? I've tried more fancy things like getting a reverse shell going without success, nor managed to upload stuff either

fiery moth Dec 5, 2020, 12:45 PM

#

lethal cliff hey, did someone try DevGuru box and could help me ? (https://tryhackme.com/room...

i am at the right direction as of now i but i am stuck at smth

lethal cliff Dec 5, 2020, 12:46 PM

#

fiery moth i am at the right direction as of now i but i am stuck at smth

okk can i go in u'r DM i think i'm less advanced than u?

tardy basin Dec 5, 2020, 12:46 PM

#

fiery moth i am at the right direction as of now i but i am stuck at smth

I also tried to find nope.jpg and sftp-config.json but i didnt

lethal cliff Dec 5, 2020, 12:47 PM

#

fiery moth i am at the right direction as of now i but i am stuck at smth

or here if u want

fiery moth Dec 5, 2020, 12:47 PM

#

add me and we can talk

lethal cliff Dec 5, 2020, 12:47 PM

#

okk

zinc oyster Dec 5, 2020, 12:52 PM

#

If I change to any other file that ought to exist like /etc/group I get nothing back

tardy basin Dec 5, 2020, 1:07 PM

#

tardy basin || Room DevGuru - I have just dump .git repository and recover files -I used to...

Is there any idea ?

fiery moth Dec 5, 2020, 1:09 PM

#

@tardy basin i got the creds for adminer but i didnt know what to do then

#

they dont work

#

found em in database.php

sonic wigeon Dec 5, 2020, 1:17 PM

#

tardy basin Is there any idea ?

How much time did it took for dumping .git ?

fiery moth Dec 5, 2020, 1:18 PM

#

3m for me

sonic wigeon Dec 5, 2020, 1:18 PM

#

It's taking way longer for me IDK what's wrong

fiery moth Dec 5, 2020, 1:19 PM

#

just let it run

tardy basin Dec 5, 2020, 1:19 PM

#

fiery moth found em in database.php

you can clone frank account and give him a password encrypted with bcrypt

fiery moth Dec 5, 2020, 1:20 PM

#

ok ty

fiery moth Dec 5, 2020, 1:40 PM

#

bruh the creds work now for adminer

#

@tardy basin what is the persist code

tardy basin Dec 5, 2020, 1:53 PM

#

fiery moth <@!418145386067132416> what is the persist code

idk , i think it releated with october cms password storing mechanism

fiery moth Dec 5, 2020, 1:54 PM

#

Duplicate entry 'frank' for key 'login_unique'

tardy basin Dec 5, 2020, 1:54 PM

#

change it for frank2 , also you need to change email address

fiery moth Dec 5, 2020, 1:55 PM

#

ty

tranquil moat Dec 5, 2020, 2:18 PM

#

I got access to October another way

#

But I’m stuck there 😂

sonic wigeon Dec 5, 2020, 2:24 PM

#

Question , if we try to add a new user into database that gets suspended ?

tardy basin Dec 5, 2020, 2:25 PM

#

sonic wigeon Question , if we try to add a new user into database that gets suspended ?

no , i added new one , just you need to give password bcrypt format

simple mountain Dec 5, 2020, 2:25 PM

#

Gonna need a little more context

sonic wigeon Dec 5, 2020, 2:26 PM

#

tardy basin no , i added new one , just you need to give password bcrypt format

Hmm ,okay

tardy basin Dec 5, 2020, 2:26 PM

#

sonic wigeon Hmm ,okay

you can use cyberchef to create bcrypted password

sonic wigeon Dec 5, 2020, 2:27 PM

#

Okay Thanks mate

fiery moth Dec 5, 2020, 2:27 PM

#

tranquil moat But I’m stuck there 😂

lol same

#

i am in the admin panel

#

and i am trying to get a shell

white salmon Dec 5, 2020, 2:48 PM

#

does anyone know how to upload a shell to october once you are logged in?

sonic wigeon Dec 5, 2020, 2:50 PM

#

Nope ,stuck on that part

median compass Dec 5, 2020, 2:57 PM

#

devguru is pretty new everyone, we don't give hints for 72 hours on new challenge boxes, let alone outright spoilers like above!

stuck fractal Dec 5, 2020, 2:57 PM

#

median compass devguru is pretty new everyone, we don't give hints for 72 hours on new challeng...

The creator gave out hints

strange river Dec 5, 2020, 2:57 PM

#

no one told me there was a 72 hour rule

median compass Dec 5, 2020, 2:58 PM

#

stuck fractal The creator gave out hints

ah, fair enough

stuck fractal Dec 5, 2020, 2:58 PM

#

strange river no one told me there was a 72 hour rule

You're good, you're the creator so you decide

strange river Dec 5, 2020, 2:58 PM

#

I'm only one person, I can't give hints to all these people

stuck fractal Dec 5, 2020, 2:59 PM

#

@median compass Please remember rule 15, please don't enforce the rules as you're not a mod

median compass Dec 5, 2020, 3:00 PM

#

how is reminding people about the 72 hours "enforcing the rules"?

#

literally everyone does it

stuck fractal Dec 5, 2020, 3:00 PM

#

It's part of Rule 13.

#

And you're wrong to apply it here as the creator is OK with it

winged mist Dec 5, 2020, 3:01 PM

#

But everyone is a volunteer.

median compass Dec 5, 2020, 3:01 PM

#

fine, I'll just ignore everyone who asks for hints on new boxes from now, no worries, that'll be much better for them

winged mist Dec 5, 2020, 3:01 PM

#

Well the rules are ok just difficult at times

fiery moth Dec 5, 2020, 3:02 PM

#

@white salmon i am not sure but i might have found a way

stuck fractal Dec 5, 2020, 3:03 PM

#

median compass fine, I'll just ignore everyone who asks for hints on new boxes from now, no wor...

That's OK, that's your decision.

median compass Dec 5, 2020, 3:03 PM

#

apparently it isn;t

#

if it's not ok for me to remind them that 72 hours should pass then what am I supposed to say?

stuck fractal Dec 5, 2020, 3:04 PM

#

If you have a problem with a moderation decision, please speak to muirland.

stuck fractal Dec 5, 2020, 3:04 PM

#

median compass if it's not ok for me to remind them that 72 hours should pass then what am I su...

Wait for a moderator, or bring it to the attention of a moderator

median compass Dec 5, 2020, 3:04 PM

#

I just have a problem with your constant need to reprimand me in public for simply trying to help, but don't worry, I'll get over it, all good

inland onyx Dec 5, 2020, 3:07 PM

#

Way I see it, you're fine to say that you're not at liberty to give hints until after 72 hours has passed, unless the creator specifies otherwise. Just be very careful yo word it as an "Under rule 13, I cannot give..." rather than a "Under rule 13, you may not ask..." 🙂

median compass Dec 5, 2020, 3:08 PM

#

understood. I feel that's exactly what I did before james decided to comment on my mini-modding, but i'll phrase it more clearly next time. thanks for the clarification

strange river Dec 5, 2020, 3:09 PM

#

Great political answers

median compass Dec 5, 2020, 3:10 PM

#

great box so far zayotic, enjoying it

strange river Dec 5, 2020, 3:10 PM

#

tuxcooctus

#

coolguy

narrow barn Dec 5, 2020, 3:22 PM

#

Yup, great box 🙂

stuck fractal Dec 5, 2020, 3:28 PM

#

The outermost layers that you need to decode are base16

#

No

#

Reverse

#

5 times with 16, then 5 times with 32 etc

median compass Dec 5, 2020, 3:34 PM

#

surround it with || front and back to mark it as a spoiler

#

s'ok, everyone gets spoilers wrong at least once 🙂

pliant tapir Dec 5, 2020, 3:37 PM

#

need little help with nmap script to work...can any1 help?

median compass Dec 5, 2020, 3:38 PM

#

pliant tapir need little help with nmap script to work...can any1 help?

what room, task & question are you doing and what's going wrong?

#

you don't need an i+=1 in a for loop @woeful viper the for statement will give i an increasing value each iteration of the indented block

#

that's probably your issue as it means i reaches 5 too quickly and the necessary number of decoding steps isn't done

pliant tapir Dec 5, 2020, 3:40 PM

#

im doing learning path nmap scanning...im at very last where i need to scan ip which all ports are filtered.....task is to enter via FTP with snmap script ftp-anon but i just cannot get any open ports.....i got open/filtered with -sN

median compass Dec 5, 2020, 3:41 PM

#

you'd want to manually increase the value of i if say you were using a while loop

#

you'll get the hang of it quick enough i'm sure 🙂

pliant tapir Dec 5, 2020, 3:43 PM

#

@median compass dm is also ok if have a min to spare.....

median compass Dec 5, 2020, 3:44 PM

#

pliant tapir <@!236818583458414592> dm is also ok if have a min to spare.....

here is fine, just looking at a python script for a min

pliant tapir Dec 5, 2020, 3:44 PM

#

kk

stuck fractal Dec 5, 2020, 3:46 PM

#

pliant tapir im doing learning path nmap scanning...im at very last where i need to scan ip w...

Don't use the null scan

median compass Dec 5, 2020, 3:46 PM

#

what do you get if you skip the encode(ascii)/decode(ascii) steps before and after each b16/32/64 decoding? I'm not sure they are necessary

pliant tapir Dec 5, 2020, 3:48 PM

#

i tryed without null scan too....after gettting tired of waiting i started to experiment just on port 21 to be faster what ever i put in the command i always get just filtered....filtered......

stuck fractal Dec 5, 2020, 3:48 PM

#

Then check your VPN

#

!vpnscript

proud scarabBOT Dec 5, 2020, 3:48 PM

#

TryHackMe

Use our VPN troubleshooting script to diagnose common issues!

https://github.com/tryhackme/openvpn-troubleshooting

pliant tapir Dec 5, 2020, 3:51 PM

#

well it saiz im connected normally to THM if that is what you mean .....i can maybe try restart vpn....and redeploy machine.....

jade oracle Dec 5, 2020, 3:52 PM

#

tardy basin || Room DevGuru - I have just dump .git repository and recover files -I used to...

lol, where in adminer?

stuck fractal Dec 5, 2020, 3:52 PM

#

pliant tapir well it saiz im connected normally to THM if that is what you mean .....i can ma...

Run the script

#

If you're getting filtered, something is wrong here

#

You never do anything with the results you get from decoding it

#

decode is discarded after each iteration of the loop

#

Just use the same variable

#

Also, 0,5 is the same as just putting 5

#

So just put 5, makes it simpler

#

But you need to use a variable that's outside the scope of each for loop

#

You could just print to console rather than writing to a file

#

And you could just read the file instead of iterating through it

median compass Dec 5, 2020, 3:58 PM

#

not quite

#

if you insert a line before your first loop, something like decode = text.readline()

pliant tapir Dec 5, 2020, 3:59 PM

#

it saiz all is ok ninja

median compass Dec 5, 2020, 3:59 PM

#

and then change your base16 loop to the same as your base32 then you should end up with the right value in decode at the end

#

finish with a print(decode) and you should have a flag

#

your text = open("encodedflag.txt","r") just opens the file and lets the name text refer to it, you still need to read the data out

#

python is like that, it takes a while before you learn to do things as simply as possible

stuck fractal Dec 5, 2020, 4:03 PM

#

decode = base64.b16decode(text) That's gonna give you issues btw

#

You're decoding the same thing 5 times, not decoding the result each time

tardy basin Dec 5, 2020, 4:12 PM

#

jade oracle lol, where in adminer?

http://devguru.local/adminer

pliant tapir Dec 5, 2020, 4:15 PM

#

ok so i fixed the problem it only needed redeploying the machine for some reason.....so i solved scanning part only script part remains......im getting a timeout - Can't get directory listing: TIMEOUT

jade oracle Dec 5, 2020, 4:16 PM

#

tardy basin http://devguru.local/adminer

ty

stuck fractal Dec 5, 2020, 4:17 PM

#

@pliant tapir There's something very wrong with your network connection to THM, I bet

pliant tapir Dec 5, 2020, 4:17 PM

#

its all ok i checked 🙂

#

ports are opened now

#

only nmap script i cant solve....i mean scrit is working i get ftp-anon: Anonymous FTP login allowed (FTP code 230) i am missing something in sintax i think....

stuck fractal Dec 5, 2020, 4:19 PM

#

I don't think you are

#

You need to answer yes or no, correct?

#

The message tells you

pliant tapir Dec 5, 2020, 4:19 PM

#

correct

stuck fractal Dec 5, 2020, 4:19 PM

#

You don't need to access the FTP server.

pliant tapir Dec 5, 2020, 4:19 PM

#

oh so i dont need to actually get into the machine....

#

omg.........so much time lost.....

stuck fractal Dec 5, 2020, 4:19 PM

#

You just need to answer yes or no...

pliant tapir Dec 5, 2020, 4:20 PM

#

-.-

#

Please Note: This machine is for scanning purposes only. You do not need to log into it ......so yea 😋 well.....at least iv spend 3 hours on learning nmap in DETAILS AS well it scripts 🙂

charred fable Dec 5, 2020, 4:41 PM

#

can anyone give any hints on why i am recieving back connection closed by IP address on port 22 when i am trying to SSH in ?

stuck fractal Dec 5, 2020, 4:44 PM

#

Often wrong username.

#

If you're using a key

charred fable Dec 5, 2020, 4:45 PM

#

yeah so i have dowloaded the id_rsa key from the smbclient onto my machine and changed the chmod of that key, then when trying to ssh in i have used the comant, ssh -i id_rsa administrator(amongst other usernames)@<ip address>

stuck fractal Dec 5, 2020, 4:46 PM

#

Room?

#

Network services?

charred fable Dec 5, 2020, 4:46 PM

#

Network Services yeah

#

exploiting smb

stuck fractal Dec 5, 2020, 4:47 PM

#

So yeah you need the correct username.

#

Username of the person that the profile folder belongs to

#

Remember unix usernames are always lower case.

charred fable Dec 5, 2020, 4:48 PM

#

is there a way to find that out through smb client ? when i have tried to open the .profile it says access denied

stuck fractal Dec 5, 2020, 4:48 PM

#

That's not what I mean

charred fable Dec 5, 2020, 4:48 PM

#

oh

stuck fractal Dec 5, 2020, 4:48 PM

#

The share is called profiles

#

Just have a read through the text file

#

You'll get a name

#

From there, make a couple educated guesses

charred fable Dec 5, 2020, 4:49 PM

#

I have the name, i shall give it a go 🙂 thanks james 😄

#

thought i had it for a second and got this :

The authenticity of host '10.10.240.171 (10.10.240.171)' can't be established.
ECDSA key fingerprint is SHA256:RZt+npRH1P+pLVe+/9mqAkepvpb20f+TzqgPAhYhHss.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.10.240.171' (ECDSA) to the list of known hosts.
Connection closed by 10.10.240.171 port 22

stuck fractal Dec 5, 2020, 4:53 PM

#

Wrong username still then

charred fable Dec 5, 2020, 4:54 PM

#

i found it in the end 😄

stuck fractal Dec 5, 2020, 4:56 PM

#

Yeah it's a challenge

charred fable Dec 5, 2020, 4:56 PM

#

So far i think thats one of the hardest i have done

stuck fractal Dec 5, 2020, 4:58 PM

#

Looking for potential usernames is a useful part of recon

charred fable Dec 5, 2020, 4:59 PM

#

Its definitely been a good room so far, this site and discord is honestly amazing

sonic night Dec 5, 2020, 6:18 PM

#

tardy basin || Room DevGuru - I have just dump .git repository and recover files -I used to...

This should really be edited to have a spoiler tag

#

For those of you don't know, if you're typing something and it might contain critical steps, information, or files on a box that others may not have found yet but are part of the problem solving process, you can highlight your message you're typing and click the eyeball (far right, sorry for the low res) and itll mark it as a spoiler. This can be all of the text or just a portion of the text. It also works with images.

📎 Screen_Shot_2020-12-05_at_1.22.04_PM.png

charred fable Dec 5, 2020, 6:25 PM

#

does anyone have a hint why the tcpdump on -i tun0 comes back with an error saying no such device exists when i am telnet into another computer?

sonic night Dec 5, 2020, 6:25 PM

#

Then you can highlight important pieces of info without disclosing it to others who may still want to solve it on their own. Like: the folder you're looking for is ||/secret/folderpath||

sonic night Dec 5, 2020, 6:26 PM

#

charred fable does anyone have a hint why the tcpdump on -i tun0 comes back with an error sayi...

This might get more traction in #site-support

charred fable Dec 5, 2020, 6:26 PM

#

its in a room

sonic night Dec 5, 2020, 6:27 PM

#

I mean lots of rooms may still need tech support if you're running into errors haha. I'll DM you

charred fable Dec 5, 2020, 6:27 PM

#

thanks @sonic night 🙂

final mortar Dec 5, 2020, 6:29 PM

#

charred fable does anyone have a hint why the tcpdump on -i tun0 comes back with an error sayi...

Are you attempting that on the Attackbox

charred fable Dec 5, 2020, 6:37 PM

#

yeah i am

final mortar Dec 5, 2020, 6:38 PM

#

Well, you won't have the tun0 interface on the AttackBox

#

You get it when you use openvpn to connect to THM Network, and AttackBox is already on the network

#

You'll want to use the eth0 interface, i.e., the interface you get your internet from

sonic night Dec 5, 2020, 6:53 PM

#

If the room was created before the attack box, since it looks like it might be an intro to networking type room (basic level) perhaps we need to update the language? People learning may not understand interfaces and how they work on VMs and VPNs yet

graceful prism Dec 5, 2020, 6:54 PM

#

I dont understand what should I do

📎 unknown.png

sonic night Dec 5, 2020, 6:54 PM

#

I'm guessing reference the question above it? Haha

astral smelt Dec 5, 2020, 6:55 PM

#

graceful prism I dont understand what should I do

Room, Question and Task?

graceful prism Dec 5, 2020, 6:56 PM

#

astral smelt Room, Question and Task?

Nmap room, Task 14

astral smelt Dec 5, 2020, 6:58 PM

#

It's asking what responses there are

graceful prism Dec 5, 2020, 6:59 PM

#

what do you mean, I looked at the hint what didn't understand anything

stuck fractal Dec 5, 2020, 7:01 PM

#

Very verbose mode like you're told 😉

graceful prism Dec 5, 2020, 7:04 PM

#

Is it related to the previous question?

#

what ip should I use for that scan?

📎 unknown.png

stuck fractal Dec 5, 2020, 7:07 PM

#

The deploy in the room?

#

That's the target...

graceful prism Dec 5, 2020, 7:07 PM

#

the "virtual-ip"?

stuck fractal Dec 5, 2020, 7:08 PM

#

No?

#

Click the green deploy button in the room if you haven't

graceful prism Dec 5, 2020, 7:08 PM

#

The ip at the top of the page?

stuck fractal Dec 5, 2020, 7:08 PM

#

No. That's your IP.

#

Deploy the machine with the deploy button

#

Use the IP under active machine information

graceful prism Dec 5, 2020, 7:09 PM

#

do you mean to deploy the virtual machine?

stuck fractal Dec 5, 2020, 7:09 PM

#

Yes. Click the deploy button.

#

Not the attackbox. The attack box is seperate.

graceful prism Dec 5, 2020, 7:10 PM

#

okk

#

I still cannot understand the question, what should I do?

📎 unknown.png

#

I did the scan with the -vv flag as the hist says

median compass Dec 5, 2020, 7:25 PM

#

ok, then in the output of that command you should see a reason given

graceful prism Dec 5, 2020, 7:27 PM

#

ha

📎 unknown.png

#

ok, makes sense

median compass Dec 5, 2020, 7:27 PM

#

generally we try to hint more than straight out give the answer, just FYI

acoustic steppe Dec 5, 2020, 7:35 PM

#

median compass generally we try to hint more than straight out give the answer, just FYI

Sorry I slipped my hands for the answer

stuck fractal Dec 5, 2020, 7:51 PM

#

@acoustic steppe Please do not post answers.

acoustic steppe Dec 5, 2020, 7:54 PM

#

I'm sorry

sonic night Dec 5, 2020, 8:04 PM

#

Can someone DM me about initial foothold on devguru? I think I'm on the right path but I might be an idiot. I'm connecting to the ||repo|| and it connects but doesnt ||clone||

fiery moth Dec 5, 2020, 8:08 PM

#

i am on the room devguru and i am at ||gitea|| site but idk how to proceed

sonic night Dec 5, 2020, 8:08 PM

#

#room-hints message

#

This comment and the few below may help nudge

fiery moth Dec 5, 2020, 8:09 PM

#

i already have access to the machine

#

i am talking abt ||Gitea||

#

not .git

sonic night Dec 5, 2020, 8:10 PM

#

Tried to DM you but its blocked, can you shoot me a DM so I can talk through my process and you can tell me if I'm a moron

fiery moth Dec 5, 2020, 8:11 PM

#

accept req

strange river Dec 5, 2020, 8:11 PM

#

@sonic night I get ego death all the time from boxes mannn

sonic night Dec 5, 2020, 8:12 PM

#

I just want this ||gitconfig|| path to ||clone||! Is that so much to ask?! haha

#

Thanks for the fun box so far

white pike Dec 5, 2020, 8:21 PM

#

Got access to the cms on this room, but can't find a way in. @zayotic could you give me a nudge?

fiery moth Dec 5, 2020, 8:25 PM

#

@white pike i can help if i am allowed to

#

i have access to the machine but idk what to do now in order to privesc

strange river Dec 5, 2020, 8:29 PM

#

lateral?

graceful prism Dec 5, 2020, 8:36 PM

#

why is that? [on the Metasploit room]

📎 unknown.png

sonic night Dec 5, 2020, 8:38 PM

#

looks like your db isn't initialized on msfconsole?

graceful prism Dec 5, 2020, 8:39 PM

#

I tried, msfdb init

#

but nothing

sonic night Dec 5, 2020, 8:39 PM

#

did you do it from terminal, outside msfconsole, with msfconsole exited?

graceful prism Dec 5, 2020, 8:40 PM

#

I dont know, ill try

sonic night Dec 5, 2020, 8:40 PM

#

db has to be initialized prior to launching for this to work, I believe

graceful prism Dec 5, 2020, 8:41 PM

#

I think it says that this is already configured,

📎 unknown.png

sonic wigeon Dec 5, 2020, 8:41 PM

#

@fiery moth Could you point me to the right direction in gaining access to machine , I have access to cms

#

But I'm not sure what to do with || Gitea ||

fiery moth Dec 5, 2020, 8:44 PM

#

@sonic wigeon ight add me and i will give you a hint

sonic wigeon Dec 5, 2020, 8:44 PM

#

Ok

sonic night Dec 5, 2020, 8:48 PM

#

graceful prism I think it says that this is already configured,

Man I dont know what to do with that 😦 I am sorry

graceful prism Dec 5, 2020, 8:55 PM

#

ok, thank you anyway

autumn kite Dec 5, 2020, 9:51 PM

#

guys i need help

#

I'm stuck at the room blue

#

task 3

trim haven Dec 5, 2020, 9:55 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

opal sandal Dec 5, 2020, 10:12 PM

#

Hello, I'm stuck with this question: Why are NULL,FIN and Xmas scans generally used ? (room : further nmap, task 8) can you help? I did not understand what you said

astral smelt Dec 5, 2020, 10:16 PM

#

Look at the last paragraph

opal sandal Dec 5, 2020, 10:17 PM

#

oo thank you

#

ı got ıt

brisk moat Dec 5, 2020, 10:17 PM

#

Room: Linux Fundamentals 3 Task: 7- Binary Shiba3

I'm a little unsure about how this Binary question is completed. I used the command find / -name shiba4 I used the mkdir and touch commands to make the neccesary files. However, it says no such file exists or that I dont have permissions. Any help is much appreciated!

brisk moat Dec 5, 2020, 10:35 PM

#

Any help is much appreciated...

stuck fractal Dec 5, 2020, 10:48 PM

#

@brisk moat show us where you're getting that error and what you're doing

brisk moat Dec 5, 2020, 10:48 PM

#

ok one sec

#

i get a permission denied after running find / -name shiba4

📎 Screen_Shot_2020-12-05_at_5.53.15_PM.png

#

I made the test folder in home directory and made the file inside test1234...am I missing something?

📎 Screen_Shot_2020-12-05_at_5.54.39_PM.png

#

Honestly these results are a little different than what I was getting last night, either way couldnt find it.

stuck fractal Dec 5, 2020, 10:57 PM

#

Yes, you're getting permission denied

#

Because find is trying to look in folders that you don't have permission to look in

#

You can filter that out

#

Append 2>/dev/null to the end

brisk moat Dec 5, 2020, 10:58 PM

#

How would I know to do that? Did I miss something?

stuck fractal Dec 5, 2020, 10:59 PM

#

I just said how you'd do that

#

Append that string to the end

#

find whateverArgs 2>/dev/null

brisk moat Dec 5, 2020, 10:59 PM

#

I get that, I was asking If I had missed that info somehow. My apologies, wasnt questioning your method

stuck fractal Dec 5, 2020, 11:00 PM

#

That info is easily found with some google

#

linux how to supress errors

brisk moat Dec 5, 2020, 11:10 PM

#

Thanks for the help

white salmon Dec 5, 2020, 11:17 PM

#

I’m sure this gets asked a bunch but I guess I’m stuck. I’m on the hydra room and have very little experience with it. I brute forced the SSH creds easy enough. But can’t get the web one

#

Used both rockyou and fasttrack. And hint says I’m doing something wrong with rockyou lmao

stuck fractal Dec 5, 2020, 11:20 PM

#

Can you show us what you're doing?

white salmon Dec 5, 2020, 11:20 PM

#

Yea one sec

#

📎 image0.jpg

#

I did the same with the fasttrack list as well which popped a bunch of false positives like Spring2017 etc.

stuck fractal Dec 5, 2020, 11:26 PM

#

That's web, not SSH?

#

Oh

#

You're sending the data to the wrong placw

#

Intercept a legitimate request, see the path it's submitted to.

#

You're also missing an =

white salmon Dec 5, 2020, 11:28 PM

#

Ahh. Okay! I will go try. Thanks

#

Oh hey ninja, can you take my eJPT/CEH/sec+ stuff of my name. I thought it was cool but I don’t lmfao

stuck fractal Dec 5, 2020, 11:31 PM

#

Not easily.

white salmon Dec 5, 2020, 11:34 PM

#

Ah then nvm.
That worked man thanks

celest moth Dec 6, 2020, 12:02 AM

#

Going through the Advent 2019 challenges today. Got to the RE exercises. I still don't know what I'm even looking at ... anyone else feel the same the first 100 times they look at RE stuff?

boreal pond Dec 6, 2020, 12:11 AM

#

Hey all, I'm a Python n00b and wanted to see if I could get some help with the Intro to Python Task 12 challenge. It says to use from base64 import * but when I do and I use base64.b64decode(line) in my code, I get a undefined variable 'base64' should I only use import base64 instead?

boreal pagoda Dec 6, 2020, 12:12 AM

#

Night guys, I'm doing devguru and got access to the cms, but I need a nudge with foothold. Can you help me pls?

stuck fractal Dec 6, 2020, 12:21 AM

#

@boreal pond Yes, that will fix that error

#

from module import * means you use the functions and stuff from the module without module. in front of them

boreal pond Dec 6, 2020, 12:23 AM

#

stuck fractal `from module import *` means you use the functions and stuff from the module wit...

Thank you

night fractal Dec 6, 2020, 1:05 AM

#

graceful prism I think it says that this is already configured,

you're running a distro that's not using systemd as it's init system and msf probably tries to startup the database using systemd utilities which results in failure to start it up

stuck fractal Dec 6, 2020, 1:24 AM

#

If you're using WSL, don't.

white salmon Dec 6, 2020, 1:51 AM

#

brisk moat Thanks for the help

@brisk moat i am also doing same box

jade oracle Dec 6, 2020, 2:07 AM

#

boreal pagoda Night guys, I'm doing devguru and got access to the cms, but I need a nudge with...

me 2

fiery moth Dec 6, 2020, 2:50 AM

#

you want a hint?

cedar axle Dec 6, 2020, 2:51 AM

#

wsl uses sys-vinit sudo service postgresql start

jade oracle Dec 6, 2020, 2:53 AM

#

fiery moth you want a hint?

talking with me?

fiery moth Dec 6, 2020, 2:54 AM

#

both of u

jade oracle Dec 6, 2020, 2:55 AM

#

yes pls

fiery moth Dec 6, 2020, 2:55 AM

#

the page executes php code

#

you need to add a page

#

https://octobercms.com/forum/post/running-php-code-on-pages

jade oracle Dec 6, 2020, 2:57 AM

#

like that?

📎 unknown.png

fiery moth Dec 6, 2020, 2:57 AM

#

yeah

jade oracle Dec 6, 2020, 2:57 AM

#

fiery moth https://octobercms.com/forum/post/running-php-code-on-pages

thanks !!!! :)

jade oracle Dec 6, 2020, 2:57 AM

#

fiery moth yeah

nice

fiery moth Dec 6, 2020, 2:57 AM

#

np

ancient island Dec 6, 2020, 4:12 AM

#

I am stuck on privesc of this machine

boreal pond Dec 6, 2020, 4:33 AM

#

I'm working on the Intro to Python exercise. I'm getting close, but can't figure out why my while loop isn't iterating through the line more than once. What am I doing wrong?


file = open("test.txt", "r")

def run_decode():
    for line in file:
        base64_bytes = line.encode('ascii')
        message_decode = base64.b64decode(line)
        message = message_decode.decode('ascii')
        return(message)

x = 0
while x <= 5:
    print(run_decode())
    x += 1```

boreal pond Dec 6, 2020, 4:34 AM

#

boreal pond I'm working on the Intro to Python exercise. I'm getting close, but can't figure...

I'm using a test double encoded message, it decodes it once from the file and this is the output I am getting

None
None
None
None
None```

sonic night Dec 6, 2020, 5:13 AM

#

are you running through a flag that has multiple lines or is it just one long line?

umbral umbra Dec 6, 2020, 6:00 AM

#

boreal pond I'm using a test double encoded message, it decodes it once from the file and th...

When writing code dealing with file pointers, pay special attention to variable scope and exit conditions.

boreal pond Dec 6, 2020, 7:19 AM

#

sonic night are you running through a flag that has multiple lines or is it just one long li...

It's just one long line

boreal pond Dec 6, 2020, 7:21 AM

#

umbral umbra When writing code dealing with file pointers, pay special attention to variable ...

Thanks for the hint, I will check this out

tall rain Dec 6, 2020, 7:34 AM

#

How much time did you guys spent to brute elliot's password using hydra on Mr. Robot CTF's room? It took so long on my attempts, the machine is almost expired now

granite pelican Dec 6, 2020, 7:49 AM

#

Looking for a hint! in the CC: Pentesting room, task 10. Found the dir but cant open, cant download.. what else.. must have to be done with msf?

#

@tall rain can't imagine it should take that long. what's your command look like?

tall rain Dec 6, 2020, 7:53 AM

#

granite pelican <@!512194326537830401> can't imagine it should take that long. what's your comma...

hydra -P fsocity.dic -l elliot 10.10.184.242 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=The password you entered for the username' -V -t 30

tender compass Dec 6, 2020, 10:48 AM

#

tall rain `hydra -P fsocity.dic -l elliot 10.10.184.242 http-post-form '/wp-login.php:log=...

It have 800000 entries .. just make each line unique .. so u can shorten it to almost 110000 Words

#

With a Py script or something..

fiery moth Dec 6, 2020, 12:25 PM

#

tall rain `hydra -P fsocity.dic -l elliot 10.10.184.242 http-post-form '/wp-login.php:log=...

use wpscan

wide grove Dec 6, 2020, 12:29 PM

#

here is a hint :You dont even have to brute force the password,one of my friends just googled " mr.robot wiki elliot alderson" and the password was somwhere in his fandom page 😉

drowsy sequoia Dec 6, 2020, 12:32 PM

#

Can someone give me a hint for devguru i got till the cms page and got the username to login but i cant find the password

tall rain Dec 6, 2020, 12:36 PM

#

fiery moth use wpscan

wpscan brute time is even worse lol

tall rain Dec 6, 2020, 12:37 PM

#

wide grove here is a hint :You dont even have to brute force the password,one of my friends...

gotcha, i double-checked on the dict and moved it to the upper part so that it was able to scanned faster with hydra lol

tall rain Dec 6, 2020, 12:39 PM

#

drowsy sequoia Can someone give me a hint for devguru i got till the cms page and got the usern...

#room-hints message
This comment helped me quite much. Anyway, ||frank|| is the username, am i right?

drowsy sequoia Dec 6, 2020, 12:39 PM

#

tall rain https://discord.com/channels/521382216299839518/690557518837186560/7847616641930...

Yeah right

tall rain Dec 6, 2020, 12:46 PM

#

tardy basin || Room DevGuru - I have just dump .git repository and recover files -I used to...

You created new user in gitea? Last time i checked the register feature is disabled. Would you please elaborate the way you got his bcrypt password?

graceful prism Dec 6, 2020, 12:57 PM

#

At the Metasploit room, I did what I told to do, and I dont see nothing

📎 unknown.png

#

📎 unknown.png

sonic wigeon Dec 6, 2020, 12:58 PM

#

Try to run it with -Pn maybe

#

Also check that if your vpn is connected

stuck fractal Dec 6, 2020, 1:00 PM

#

graceful prism At the Metasploit room, I did what I told to do, and I dont see nothing

it didn't scan because it through the host was down

#

You need to re-run with -Pn like the message tells you

graceful prism Dec 6, 2020, 1:00 PM

#

why is that?

#

ok

stuck fractal Dec 6, 2020, 1:00 PM

#

because it didn't respond to an ICMP echo request (ping)

#

Windows machines generally don't, due to the firewall

graceful prism Dec 6, 2020, 1:03 PM

#

It works, thanks

boreal pagoda Dec 6, 2020, 1:43 PM

#

fiery moth the page executes php code

Thx man!

fiery moth Dec 6, 2020, 1:44 PM

#

np

valid zealot Dec 6, 2020, 2:10 PM

#

In Linux Fundamentals Task 9, it wants me to change the USER variable to test1234. I used export $USER=test1234 and ran the shiba2 binary and it's not working. It's still showing the $USER variable as shiba2. Not sure what I'm doing wrong.

#

sorry it's Linux Fundamentals 2^

stuck fractal Dec 6, 2020, 2:17 PM

#

@valid zealot It doesn't change the value of the variable

#

The binary performs a check

#

And you've misread the task

#

It asks you to set test1234, not change $USER

autumn kite Dec 6, 2020, 2:18 PM

#

hello guys, could somebody give me hints for the room introresearch?

stuck fractal Dec 6, 2020, 2:19 PM

#

Just ask directly

#

Although 99.9% of the content in that room comes under Rule 13

autumn kite Dec 6, 2020, 2:20 PM

#

I'm stuck at the Task 3

#

Vulnerability Searching

stuck fractal Dec 6, 2020, 2:20 PM

#

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

What room you are on
At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

tardy basin Dec 6, 2020, 2:26 PM

#

tall rain You created new user in gitea? Last time i checked the register feature is disab...

|| Did you access gitea db ? ||

sonic wigeon Dec 6, 2020, 2:27 PM

#

I have accessed that but not getting any further

tardy basin Dec 6, 2020, 2:29 PM

#

|| After the access to gitea db you can duplicate frank user as frank2
And you need to supply hashed password with true combination ||

sonic wigeon Dec 6, 2020, 2:31 PM

#

Yeah I'm struggling with that

fiery moth Dec 6, 2020, 2:33 PM

#

@tardy basin have you got any further
i have access to the machine but idk how to privesc

tardy basin Dec 6, 2020, 2:34 PM

#

fiery moth <@!418145386067132416> have you got any further i have access to the machine bu...

Have you done Linux PrivEsc room ?

fiery moth Dec 6, 2020, 2:35 PM

#

yeah

ancient island Dec 6, 2020, 2:35 PM

#

fiery moth <@!418145386067132416> have you got any further i have access to the machine bu...

yes, me too

#

it's hard

tardy basin Dec 6, 2020, 2:36 PM

#

|| linepeas ? ||

fiery moth Dec 6, 2020, 2:36 PM

#

yeah tried that too

#

i saw some ports open though

ancient island Dec 6, 2020, 2:37 PM

#

linpeas just show interesting files

fiery moth Dec 6, 2020, 2:37 PM

#

||8585 which is gitea and ssh but on ssh i get access denied and idk what to do in gitea||

ancient island Dec 6, 2020, 2:37 PM

#

i am logged on gitea, but i'm stuck

fiery moth Dec 6, 2020, 2:38 PM

#

how did you find it

ancient island Dec 6, 2020, 2:38 PM

#

tardy basin || After the access to gitea db you can duplicate frank user as frank2 And you ...

. with this

#

the login is in somewhere

tardy basin Dec 6, 2020, 2:40 PM

#

ancient island i am logged on gitea, but i'm stuck

|| Do you have app.ini.bak ? ||

ancient island Dec 6, 2020, 2:41 PM

#

yes

tardy basin Dec 6, 2020, 2:42 PM

#

|| which algorithms can be use with gitea db password hashing ? ||

ancient island Dec 6, 2020, 2:44 PM

#

this answer is in the app.ini.bak, i don't know if i can speak

fiery moth Dec 6, 2020, 2:46 PM

#

tardy basin || After the access to gitea db you can duplicate frank user as frank2 And you ...

arent you supposed to do that for just accessing the cms backend?

valid zealot Dec 6, 2020, 2:49 PM

#

stuck fractal It asks you to set test1234, not change $USER

I don't wna to give it away, but I think I am understanding now. I typed test1234=$USER and ran shiba2, but it gives me an error Segmentation fault (core dumped)

stuck fractal Dec 6, 2020, 2:50 PM

#

You haven't actually set the variable then

#

Look back at the task explaining how to set variables

white salmon Dec 6, 2020, 3:03 PM

#

fellas , any work around on ssh in devguru ?
help is very appreciated .

strange river Dec 6, 2020, 3:04 PM

#

stewie needs help

white salmon Dec 6, 2020, 3:05 PM

#

yeah , indeed

fiery moth Dec 6, 2020, 3:05 PM

#

i've accessed the gitea site but idk what to do now

stuck fractal Dec 6, 2020, 3:06 PM

#

@pseudo tapir #778305825797177374 please

pseudo tapir Dec 6, 2020, 3:06 PM

#

Sorry, ninja!

white salmon Dec 6, 2020, 3:07 PM

#

@fiery moth you should comeback and read the config

fiery moth Dec 6, 2020, 3:08 PM

#

ok

valid zealot Dec 6, 2020, 3:10 PM

#

stuck fractal You haven't actually set the variable then

It is set. I checked with set | grep test1234 and I get back test1234=shiba2 which is the current user, but I still get that error.

stuck fractal Dec 6, 2020, 3:10 PM

#

It is not set if you are getting that error

#

You can argue, or you can do what I suggested

#

One way leads to me ignoring you.

white salmon Dec 6, 2020, 3:17 PM

#

Yo Fellas, Some Help

fiery moth Dec 6, 2020, 3:18 PM

#

same

valid zealot Dec 6, 2020, 3:19 PM

#

stuck fractal You can argue, or you can do what I suggested

Sorry I did go back and look. I typed export $test1234=$USER I even tried env test1234=$USER I'm really lost here. The instructions say that export <varname>=<value> will set the environmental variable.

stuck fractal Dec 6, 2020, 3:19 PM

#

You added a $ in the export command

#

Don't do that

valid zealot Dec 6, 2020, 3:19 PM

#

oh

valid zealot Dec 6, 2020, 3:23 PM

#

stuck fractal You added a $ in the export command

Ok I ran ./shiba2 and now I get no error, but still not sure where the password is. Thanks

stuck fractal Dec 6, 2020, 3:23 PM

#

If you have the variable set correctly, you will get the password

#

Screenshots. Show us what you're doing. Show us what happened.

valid zealot Dec 6, 2020, 3:23 PM

#

ok

sonic wigeon Dec 6, 2020, 3:25 PM

#

white salmon Yo Fellas, Some Help

Same : (

valid zealot Dec 6, 2020, 3:25 PM

#

stuck fractal If you have the variable set correctly, you will get the password

I got it. Thanks for your help. 🙂

white salmon Dec 6, 2020, 3:28 PM

#

@strange river some help dude

strange river Dec 6, 2020, 3:38 PM

#

@white salmon which part

white salmon Dec 6, 2020, 3:38 PM

#

the ssh part

strange river Dec 6, 2020, 3:38 PM

#

|| There is no SSH part ||

white salmon Dec 6, 2020, 3:39 PM

#

👀

sonic wigeon Dec 6, 2020, 3:39 PM

#

xDD

white salmon Dec 6, 2020, 3:40 PM

#

so for the last 50min i'm struggling with something is not included xd

lyric steeple Dec 6, 2020, 3:40 PM

#

Any hints for getting flags for unbaked pie. Already have reverse shell but stuck ?

strange river Dec 6, 2020, 3:41 PM

#

@white salmon It can't be as hard as building that time machine

white salmon Dec 6, 2020, 3:41 PM

#

@strange river at least i know what i should do now, Thanks

simple mountain Dec 6, 2020, 3:42 PM

#

nonickid - Thats a new room, so no hints for 3 days after release 🙂

lyric steeple Dec 6, 2020, 3:43 PM

#

@simple mountain ok, understand. Thanks. So continuing my fight 🙂

simple mountain Dec 6, 2020, 3:43 PM

#

Keep at it, You'll get it 🙂

strange river Dec 6, 2020, 3:44 PM

#

lmaooo, misunderstanding

#

blobknife

royal mirage Dec 6, 2020, 4:06 PM

#

In devguru I got into the machine and somehow managed to get credentials to access || gitea || database. And now I am stuck,can someone help me?

boreal pagoda Dec 6, 2020, 4:08 PM

#

royal mirage In devguru I got into the machine and somehow managed to get credentials to acce...

Same here...

fiery moth Dec 6, 2020, 4:12 PM

#

i cant find the creds for gitea

white salmon Dec 6, 2020, 4:18 PM

#

escalating to frank is a pain

sonic wigeon Dec 6, 2020, 4:18 PM

#

fiery moth i cant find the creds for gitea

Have you ran || linpeas|| it shows some interesting output

fiery moth Dec 6, 2020, 4:19 PM

#

i have

#

imma run it once more tho to make sure

fiery moth Dec 6, 2020, 4:24 PM

#

sonic wigeon Have you ran || linpeas|| it shows some interesting output

didnt find anything

royal mirage Dec 6, 2020, 4:25 PM

#

sonic wigeon Have you ran || linpeas|| it shows some interesting output

Yea this will help you @fiery moth

fiery moth Dec 6, 2020, 4:25 PM

#

i only found a hash

white salmon Dec 6, 2020, 4:28 PM

#

@fiery moth you got the config ?

fiery moth Dec 6, 2020, 4:28 PM

#

there are a lot of configs

white salmon Dec 6, 2020, 4:29 PM

#

there's one specific config that is very obvious related to gitea

grizzled brook Dec 6, 2020, 4:29 PM

#

fiery moth i only found a hash

im still stuck on the login fields😫 i found the ||october login with the frank user|| and the || gitea login site|| but im absolutely clueless as to what to focus on next.. tried guessing, brute forcing and enumeration with gobuster but im out of ideas already

sonic night Dec 6, 2020, 4:30 PM

#

white salmon there's one specific config that is very obvious related to gitea

I know what you're talking about! And I haven't been able to "set" it, if thats the right route

sonic night Dec 6, 2020, 4:30 PM

#

grizzled brook im still stuck on the login fields😫 i found the ||october login with the frank...

You enumerated it with dirb or something like it right?

royal mirage Dec 6, 2020, 4:30 PM

#

white salmon there's one specific config that is very obvious related to gitea

Yes

grizzled brook Dec 6, 2020, 4:30 PM

#

sonic night You enumerated it with dirb or something like it right?

dirb yes

fiery moth Dec 6, 2020, 4:30 PM

#

@grizzled brook ||adminer.php||

white salmon Dec 6, 2020, 4:31 PM

#

sonic night You enumerated it with dirb or something like it right?

no it's not meant to edit it

grizzled brook Dec 6, 2020, 4:31 PM

#

fiery moth <@!763344622821834753> ||`adminer.php`||

damnit .. searched for|| php extensions|| but apperently the wrong wordlist.. will try that later!

sonic night Dec 6, 2020, 4:31 PM

#

grizzled brook dirb yes

So there shouldve been a result in there that has some information about the machine, like a...|| place where you might get all the code or something of the sort ;)||

midnight spindle Dec 6, 2020, 4:32 PM

#

Hello everyone 🙂 , I'm on the room DevGuru and I'm a bit stuck 😦 I founded a|| git repo|| and I downloaded it but it didn't give me more info than that. Someone have a hint ? 🙂

grizzled brook Dec 6, 2020, 4:32 PM

#

sonic night So there shouldve been a result in there that has some information about the mac...

i really appreciate the hint.. i will try again later, thank you!

sonic wigeon Dec 6, 2020, 4:32 PM

#

midnight spindle Hello everyone 🙂 , I'm on the room DevGuru and I'm a bit stuck 😦 I founded a|...

Did you use automated tools to get the repo ?

midnight spindle Dec 6, 2020, 4:33 PM

#

@sonic wigeon yes I used gittools for that

sonic wigeon Dec 6, 2020, 4:34 PM

#

You have only downloaded it , try to dig more into that reporistory

midnight spindle Dec 6, 2020, 4:35 PM

#

i got the logs and I have a username ( more a confirmation ) and a TTOOONNN of files

#

shall I brute force something or more dig in the folders like you sugest

sonic wigeon Dec 6, 2020, 4:36 PM

#

Not brute force but try to use || extractor|| that comes with gittools

midnight spindle Dec 6, 2020, 4:36 PM

#

😮

#

got it ( I think 😄 )

fiery moth Dec 6, 2020, 4:37 PM

#

@white salmon i think i found it

white salmon Dec 6, 2020, 4:38 PM

#

Nice

midnight spindle Dec 6, 2020, 4:41 PM

#

@sonic wigeon OMG DUDE !! thanks for the help !!

#

I had some REALLY cool stuff to check 😄

fiery moth Dec 6, 2020, 4:45 PM

#

nvm

zinc echo Dec 6, 2020, 4:56 PM

#

hello, i got stuck on devguru room, i successfully login to cms on port 80 and trying to exploit them but its didnt work. what I have been doing is right? *sorry for my bad english

fiery moth Dec 6, 2020, 4:56 PM

#

@zinc echo you can execute php code on a page

zinc echo Dec 6, 2020, 4:57 PM

#

on port 80?

sonic wigeon Dec 6, 2020, 4:57 PM

#

Yes

midnight spindle Dec 6, 2020, 4:57 PM

#

@zinc echo : gg I'm stuck to login on it 😭

zinc echo Dec 6, 2020, 4:58 PM

#

thanks! @fiery moth @sonic wigeon

sonic wigeon Dec 6, 2020, 4:59 PM

#

midnight spindle <@!521933619695190018> : gg I'm stuck to login on it 😭

Check the files when you extract something out of it 😉

fiery moth Dec 6, 2020, 4:59 PM

#

midnight spindle <@!521933619695190018> : gg I'm stuck to login on it 😭

what login

midnight spindle Dec 6, 2020, 4:59 PM

#

yeah , is what I'm doing now

#

try to check rge file and get osme info from there

fiery moth Dec 6, 2020, 5:00 PM

#

?

strange river Dec 6, 2020, 5:00 PM

#

what is everyone stuck on?

fiery moth Dec 6, 2020, 5:01 PM

#

i need the creds for gitea

#

to clone the repo

strange river Dec 6, 2020, 5:01 PM

#

@fiery moth || overwrite or create ||

#

@fiery moth wait

midnight spindle Dec 6, 2020, 5:01 PM

#

I extract the comit from git and I have a lot of file and I try to find credential on it but I can't 😦

strange river Dec 6, 2020, 5:01 PM

#

you're trying to clone it?

#

@midnight spindle git restore

fiery moth Dec 6, 2020, 5:01 PM

#

@strange river yeah but it asks for creds so i need the creds

#

@midnight spindle once you dumped the .git you need to use the extractor from gittols

strange river Dec 6, 2020, 5:02 PM

#

@fiery moth what have you done so far

midnight spindle Dec 6, 2020, 5:02 PM

#

yep this is what I did

fiery moth Dec 6, 2020, 5:02 PM

#

i am on the machine and i am trying to privesc

#

@midnight spindle check the config file

#

you will find an interesting file there

midnight spindle Dec 6, 2020, 5:02 PM

#

really cool stuff here but I can't find some creds ! ^^

📎 SPOILER_unknown.png

#

@fiery moth ok I will double check

strange river Dec 6, 2020, 5:02 PM

#

Use grep

midnight spindle Dec 6, 2020, 5:02 PM

#

thanks

strange river Dec 6, 2020, 5:03 PM

#

grep -lr 'password'

#

something like that

zinc echo Dec 6, 2020, 5:03 PM

#

dirb / gobuster maybe you can something interesting @midnight spindle

fiery moth Dec 6, 2020, 5:03 PM

#

@strange river can you give me a hint on where the creds can be for gitea

strange river Dec 6, 2020, 5:03 PM

#

@fiery moth do you have a shell yet?

fiery moth Dec 6, 2020, 5:03 PM

#

yeah

strange river Dec 6, 2020, 5:03 PM

#

@fiery moth || replace them ||

fiery moth Dec 6, 2020, 5:04 PM

#

ok lemme try

strange river Dec 6, 2020, 5:04 PM

#

gitea is open source, keep in mind

#

docker experience would be good here

midnight spindle Dec 6, 2020, 5:04 PM

#

thanks for the help guys , I will continue to dig

fiery moth Dec 6, 2020, 5:06 PM

#

dont have much expereince in docker but i will do my research
@strange river also the room is good af nice

strange river Dec 6, 2020, 5:06 PM

#

I'm going to ask around and see if someone can make a walkthrough video on this machine sometime

#

videos like ippsec always help me see it clearly and learn from it

fiery moth Dec 6, 2020, 5:07 PM

#

yh ippsec explains things in depth

sonic wigeon Dec 6, 2020, 5:07 PM

#

That's it for me doing DevGuru today gonna try to crack on it tomorrow xD

strange river Dec 6, 2020, 5:08 PM

#

I'm just glad a lot of people are learning something from it 🙂

sonic wigeon Dec 6, 2020, 5:09 PM

#

Yeah man it's very challenging box and so far learned a lot from it 👍

fiery moth Dec 6, 2020, 5:10 PM

#

@strange river is it ||app.ini.bak||?

midnight spindle Dec 6, 2020, 5:10 PM

#

omg I found some creds but it dosn't work 😦

white salmon Dec 6, 2020, 5:10 PM

#

cuz

#

you're using them wrong

sonic wigeon Dec 6, 2020, 5:10 PM

#

Hmm

midnight spindle Dec 6, 2020, 5:11 PM

#

yeah I think so

#

because I found the creds for the database itself but not to the website

white salmon Dec 6, 2020, 5:11 PM

#

there u go , you answered your own question

midnight spindle Dec 6, 2020, 5:12 PM

#

haha yes but I'm back to the starting point. I can't connect to this DB because is use a specific port and this port is close on the server

#

so I guess , it's a wrong way to go/think

white salmon Dec 6, 2020, 5:13 PM

#

no

sonic wigeon Dec 6, 2020, 5:13 PM

#

No your on the right track

white salmon Dec 6, 2020, 5:13 PM

#

that's were

#

enumeration

#

comes in hand

zinc echo Dec 6, 2020, 5:14 PM

#

hey, i trying to bypass ext when rename it, but its doesnt work, i read that exploit from google. am i doing right?

white salmon Dec 6, 2020, 5:14 PM

#

bypass doesn't work

#

find another way

zinc echo Dec 6, 2020, 5:14 PM

#

hmmm, okayy

midnight spindle Dec 6, 2020, 5:15 PM

#

As expected ! 😦

📎 SPOILER_unknown.png

fiery moth Dec 6, 2020, 5:15 PM

#

@zinc echo|| https://octobercms.com/forum/post/running-php-code-on-pages||

#

@midnight spindle mysql is closed

#

didnt you scan for open ports at the start?

midnight spindle Dec 6, 2020, 5:15 PM

#

yes

fiery moth Dec 6, 2020, 5:15 PM

#

there is another way to connect to the dtb

midnight spindle Dec 6, 2020, 5:15 PM

#

3 port are open

sonic wigeon Dec 6, 2020, 5:16 PM

#

Yeah enumerate through the files where you got the creds

midnight spindle Dec 6, 2020, 5:16 PM

#

omg this room make me crazy 😄 thanks for the support guys ^^

fiery moth Dec 6, 2020, 5:16 PM

#

sonic wigeon Yeah enumerate through the files where you got the creds

^^^^^^^^

sonic wigeon Dec 6, 2020, 5:16 PM

#

midnight spindle omg this room make me crazy 😄 thanks for the support guys ^^

It's still making me and I think I am not half way through it xD

midnight spindle Dec 6, 2020, 5:16 PM

#

hahah

fiery moth Dec 6, 2020, 5:16 PM

#

same i need to find the creds for gitea

midnight spindle Dec 6, 2020, 5:18 PM

#

I dont' understand something. The creds is link to "october" and on the webiste I found the "october login" BUT it doesn't work

fiery moth Dec 6, 2020, 5:18 PM

#

||adminer||

midnight spindle Dec 6, 2020, 5:19 PM

#

OMG OMG !!

sonic wigeon Dec 6, 2020, 5:19 PM

#

xD

midnight spindle Dec 6, 2020, 5:19 PM

#

it was FRONT of me !!! and I was sure this file look SO STRANGE !

fiery moth Dec 6, 2020, 5:30 PM

#

@white salmon is thats the file i am supposed to look for?
||app.ini.bak||

ancient island Dec 6, 2020, 5:30 PM

#

strange river what is everyone stuck on?

privesc, hint please hahah

strange river Dec 6, 2020, 5:30 PM

#

@ancient island which part

ancient island Dec 6, 2020, 5:31 PM

#

www-data to frank

#

i am in gitea

#

but i’m stuck

fiery moth Dec 6, 2020, 5:31 PM

#

you found the creds?

strange river Dec 6, 2020, 5:31 PM

#

|| Its a feature of gitea ||

ancient island Dec 6, 2020, 5:32 PM

#

yes, i know, but i couldn’t find this feature

strange river Dec 6, 2020, 5:32 PM

#

Google for gitea CVE's and the method will show up

ancient island Dec 6, 2020, 5:32 PM

#

i searched a lot

#

oh

fiery moth Dec 6, 2020, 5:32 PM

#

i only found an ssrf

ancient island Dec 6, 2020, 5:32 PM

#

i know now

strange river Dec 6, 2020, 5:32 PM

#

I checked again, and I found it

#

Lots of documentation on this method exist

fiery moth Dec 6, 2020, 5:32 PM

#

oh

#

i found it

#

rce

strange river Dec 6, 2020, 5:33 PM

#

Its not really a CVE, more of a consequence of having access

fiery moth Dec 6, 2020, 5:36 PM

#

it says its authenticated so i suppoose we need the creds

midnight spindle Dec 6, 2020, 5:36 PM

#

guys, I changed the password from ||frank|| and now it say that Frank has been suspended !

strange river Dec 6, 2020, 5:36 PM

#

@fiery moth its hard to explain without spoiling it

fiery moth Dec 6, 2020, 5:37 PM

#

@midnight spindle you need to|| clone|| it

#

@strange river np and ty for helping me out

midnight spindle Dec 6, 2020, 5:37 PM

#

why ?

fiery moth Dec 6, 2020, 5:37 PM

#

cause you cant crack his hash

#

so you clone it

midnight spindle Dec 6, 2020, 5:38 PM

#

thats why I didn't crack the hash I just changed his PASSWORD ^^

fiery moth Dec 6, 2020, 5:38 PM

#

and what kind of error did you get

#

also it needs to be hashed in bcrypt

midnight spindle Dec 6, 2020, 5:39 PM

#

aaahhhhh thats why !!

white salmon Dec 6, 2020, 5:40 PM

#

why does it say "User [frank] has been suspended."

midnight spindle Dec 6, 2020, 5:40 PM

#

same here , is because you used a texte without encryption

white salmon Dec 6, 2020, 5:40 PM

#

i cracked the password

midnight spindle Dec 6, 2020, 5:40 PM

#

ah

fiery moth Dec 6, 2020, 5:41 PM

#

@white salmon you need to clone frank

white salmon Dec 6, 2020, 5:41 PM

#

okay! does git allows cloning of users?

#

we can clone only repos right?

fiery moth Dec 6, 2020, 5:42 PM

#

not that kind of cloning

#

cloning his user in ||adminer||

white salmon Dec 6, 2020, 5:43 PM

#

but adminer is not accessible

#

with db creds?

midnight spindle Dec 6, 2020, 5:43 PM

#

xD

white salmon Dec 6, 2020, 5:43 PM

#

**without

midnight spindle Dec 6, 2020, 5:43 PM

#

OMG !! after 1h30 !!! I'm log IN backend !!!

#

anidab

fiery moth Dec 6, 2020, 5:44 PM

#

@white salmon you can login to adminer

#

if you have the creds

white salmon Dec 6, 2020, 5:47 PM

#

so this means adminer creds are out in public..?

dull pulsar Dec 6, 2020, 5:48 PM

#

lmao

strange river Dec 6, 2020, 5:49 PM

#

manjuice got root, you can ask him hints

dull pulsar Dec 6, 2020, 5:56 PM

#

woop woop

midnight spindle Dec 6, 2020, 5:57 PM

#

someone have a hint to get a reverse shell after log in to the backend/cms

#

?

#

because the page are not supporting PHP and we can't upload php ( maybe with changing the magic number )

fiery moth Dec 6, 2020, 5:58 PM

#

https://octobercms.com/forum/post/running-php-code-on-pages

midnight spindle Dec 6, 2020, 5:58 PM

#

nice !

fiery moth Dec 6, 2020, 5:59 PM

#

need to find the git creds then use the exploit for the gitea version

dull pulsar Dec 6, 2020, 6:01 PM

#

im pretty sure there isnt an exploit involved

#

besides user to root

fiery moth Dec 6, 2020, 6:01 PM

#

||https://www.mageni.net/vulnerability/gitea-110-1125-rce-vulnerability-113773||

stuck fractal Dec 6, 2020, 6:02 PM

#

Mark as a spoiler

dull pulsar Dec 6, 2020, 6:03 PM

#

idk i didnt use any exploits for gitea

#

apparently frank uses strong passwords

fiery moth Dec 6, 2020, 6:04 PM

#

i have found a repo but you need to be authenticated to clone it

dull pulsar Dec 6, 2020, 6:04 PM

#

yup, but frank has strong passwords

fiery moth Dec 6, 2020, 6:05 PM

#

can i find the pass through a backup file or smth

dull pulsar Dec 6, 2020, 6:05 PM

#

not exactly a backup

#

well

#

yes a backup

#

but not franks

fiery moth Dec 6, 2020, 6:06 PM

#

app.ini?

dull pulsar Dec 6, 2020, 6:06 PM

#

maybe

fiery moth Dec 6, 2020, 6:06 PM

#

i found a secret key

#

nothing seems to work tho

dull pulsar Dec 6, 2020, 6:08 PM

#

remember the foothold into october cms?

midnight spindle Dec 6, 2020, 6:09 PM

#

OMMGG !! AFTER 2H !!! anidab

📎 SPOILER_unknown.png

dull pulsar Dec 6, 2020, 6:09 PM

#

nice nice :D

#

yea this rooms also made me hate october cms

fiery moth Dec 6, 2020, 6:10 PM

#

dull pulsar remember the foothold into october cms?

what foothold

dull pulsar Dec 6, 2020, 6:10 PM

#

you got into backend right?

fiery moth Dec 6, 2020, 6:10 PM

#

yh

dull pulsar Dec 6, 2020, 6:10 PM

#

yup, its the same thing essentially into gitea

#

idk if im giving away too much so ima cool it down for now

fiery moth Dec 6, 2020, 6:10 PM

#

ok

#

@dull pulsar with adminer?

dull pulsar Dec 6, 2020, 6:11 PM

#

well you could use adminer

fiery moth Dec 6, 2020, 6:12 PM

#

does it has to do with user_roles?

#

||clone a user and change his id into the publisher or dev||

dull pulsar Dec 6, 2020, 6:15 PM

#

nope

midnight spindle Dec 6, 2020, 6:15 PM

#

omg this room ! I just get the shell and boom stuck again ^^

#

but let's start diging ! 😄

dull pulsar Dec 6, 2020, 6:16 PM

#

lmao yea same i had to spam zayotic for hints as well

ancient island Dec 6, 2020, 6:16 PM

#

omg, this privesc is not easy

fiery moth Dec 6, 2020, 6:16 PM

#

its hard af

#

but its actually realistic compared to other rooms

dull pulsar Dec 6, 2020, 6:16 PM

#

yup yup

ancient island Dec 6, 2020, 6:16 PM

#

i am trying understand how to do

dull pulsar Dec 6, 2020, 6:16 PM

#

its got something to do with gitea

ancient island Dec 6, 2020, 6:17 PM

#

fiery moth but its actually realistic compared to other rooms

yes, its very realistic

fiery moth Dec 6, 2020, 6:17 PM

#

i have learned some new stuff so far

ancient island Dec 6, 2020, 6:17 PM

#

me too

midnight spindle Dec 6, 2020, 6:17 PM

#

same here ^^

#

even if is not done ( YET :p )

fiery moth Dec 6, 2020, 6:20 PM

#

@dull pulsar can you give us some more hints

dull pulsar Dec 6, 2020, 6:20 PM

#

hm

#

where are you right now?

ancient island Dec 6, 2020, 6:20 PM

#

privesc

dull pulsar Dec 6, 2020, 6:20 PM

#

gitea

fiery moth Dec 6, 2020, 6:20 PM

#

yh

ancient island Dec 6, 2020, 6:20 PM

#

www-data to frank

fiery moth Dec 6, 2020, 6:20 PM

#

need to privesc to frank

ancient island Dec 6, 2020, 6:20 PM

#

i found the vuln

dull pulsar Dec 6, 2020, 6:20 PM

#

its all got to do with gitea

ancient island Dec 6, 2020, 6:20 PM

#

but it is hard to explore

#

i think

fiery moth Dec 6, 2020, 6:21 PM

#

i need to find the creds i think and then clone frank's repo

ancient island Dec 6, 2020, 6:21 PM

#

yes, but in gitea, frank doesn't have repo

dull pulsar Dec 6, 2020, 6:22 PM

#

yup, its like yotd

#

nope

fiery moth Dec 6, 2020, 6:22 PM

#

sad

ancient island Dec 6, 2020, 6:22 PM

#

not exist anymore

dull pulsar Dec 6, 2020, 6:22 PM

#

lmao

ancient island Dec 6, 2020, 6:22 PM

#

this repo

ancient island Dec 6, 2020, 6:22 PM

#

dull pulsar lmao

af

dull pulsar Dec 6, 2020, 6:23 PM

#

frank is running gitea

ancient island Dec 6, 2020, 6:23 PM

#

yes

fiery moth Dec 6, 2020, 6:24 PM

#

i've been trying to complete this room for a day now lol

midnight spindle Dec 6, 2020, 6:24 PM

#

haha

#

I found an adminer.key , do you think is usefull ?

fiery moth Dec 6, 2020, 6:25 PM

#

same in /tmp

#

but i doubt

#

its any useful

sonic wigeon Dec 6, 2020, 6:26 PM

#

fiery moth i've been trying to complete this room for a day now lol

Same this was my second day to attempt it but got a further than yesterday

fiery moth Dec 6, 2020, 6:29 PM

#

sadd

#

i will probs give up idk what to do

midnight spindle Dec 6, 2020, 6:31 PM

#

no don't ! we are here 😄

#

if it can help I found ||"app.ini.bak"|| I still looking to it

white salmon Dec 6, 2020, 6:32 PM

#

tried my best shot getting frank , the shell return as www-data -___-

fiery moth Dec 6, 2020, 6:33 PM

#

midnight spindle if it can help I found ||"app.ini.bak"|| I still looking to it

i have already found that i found some secret keys on it

#

but idk what to do with em

midnight spindle Dec 6, 2020, 6:34 PM

#

JWT ?

fiery moth Dec 6, 2020, 6:34 PM

#

yh

dull pulsar Dec 6, 2020, 6:34 PM

#

nope

fiery moth Dec 6, 2020, 6:35 PM

#

i gotta go through the whole file ffs

midnight spindle Dec 6, 2020, 6:35 PM

#

it a json key

fiery moth Dec 6, 2020, 6:36 PM

#

the pass?

midnight spindle Dec 6, 2020, 6:39 PM

#

no I don't know , I still on it ^^

#

ok I found a JWT CSRF but nothing that I can use 😦

#

I found something else but..yeah...

📎 SPOILER_unknown.png

fiery moth Dec 6, 2020, 6:49 PM

#

does it work

midnight spindle Dec 6, 2020, 6:50 PM

#

I don't know where and how to use them

fiery moth Dec 6, 2020, 6:51 PM

#

doesnt work

midnight spindle Dec 6, 2020, 6:54 PM

#

OMG !

#

I think I GOT IT !

#

I will confirm you that in a bit^^

fiery moth Dec 6, 2020, 6:55 PM

#

fr?

midnight spindle Dec 6, 2020, 6:55 PM

#

like french ? ^^

#

or for sure ? :p

fiery moth Dec 6, 2020, 6:55 PM

#

for real?

midnight spindle Dec 6, 2020, 6:56 PM

#

haha w8 I will confirm you but I found something REALLY cool !

fiery moth Dec 6, 2020, 6:56 PM

#

kk

tribal olive Dec 6, 2020, 6:56 PM

#

any clue why my gobuster doesnt work?

📎 unknown.png

sonic wigeon Dec 6, 2020, 6:57 PM

#

You didn't mention the protocol

white salmon Dec 6, 2020, 6:57 PM

#

@tribal olive gobuster dir ......

sonic wigeon Dec 6, 2020, 6:57 PM

#

Oh yeah also that xD

tribal olive Dec 6, 2020, 6:57 PM

#

thank you @white salmon

midnight spindle Dec 6, 2020, 6:59 PM

#

OMMMG OMMMGG !! I GOT IT !! OMMMGG !!!!!!!!! anidab

📎 SPOILER_unknown.png

junior scaffold Dec 6, 2020, 7:02 PM

#

Hello, can someone give me a hint of what encryption is this?
*@F DA:? >6 C:89E C@F?5 323J C:89E C@F?5 Wcf E:>6DX
I'm doing c4ptur3-th3-fl4g room

fiery moth Dec 6, 2020, 7:03 PM

#

midnight spindle OMMMG OMMMGG !! I GOT IT !! OMMMGG !!!!!!!!! <:anidab:623335162595508235>

how

sonic wigeon Dec 6, 2020, 7:03 PM

#

midnight spindle OMMMG OMMMGG !! I GOT IT !! OMMMGG !!!!!!!!! <:anidab:623335162595508235>

How xD

midnight spindle Dec 6, 2020, 7:03 PM

#

MWHAHA !!

#

anidab

#

the hint is : check , double , triple check the .bak

#

and think about how you found the frist cred

fiery moth Dec 6, 2020, 7:03 PM

#

app.ini

midnight spindle Dec 6, 2020, 7:03 PM

#

yep

sonic wigeon Dec 6, 2020, 7:04 PM

#

So there is something else that we need to look for ?

midnight spindle Dec 6, 2020, 7:04 PM

#

hmm ( hard to no spoil ^^ )

dull pulsar Dec 6, 2020, 7:05 PM

#

ayy nice nice nice

sonic wigeon Dec 6, 2020, 7:05 PM

#

I came across something but didn't try it , gonna try to look again xD

midnight spindle Dec 6, 2020, 7:06 PM

#

I'm stuck again xD omg this room !

white salmon Dec 6, 2020, 7:06 PM

#

what a nice room thanks @strange river

midnight spindle Dec 6, 2020, 7:06 PM

#

let's start diging !!

strange river Dec 6, 2020, 7:06 PM

#

@white salmon thanks Stewie

midnight spindle Dec 6, 2020, 7:07 PM

#

yeah thanks a lot @strange river ! super room

strange river Dec 6, 2020, 7:07 PM

#

Glad you liked it

#

It was a pain to get it released

white salmon Dec 6, 2020, 7:07 PM

#

no i'm talking suriously i already finished the room, it was quite a ride .
and the frank path huh that's new !

#

Really good one

strange river Dec 6, 2020, 7:08 PM

#

Yea, I wanted to make something that I haven't seen done before

#

that would also be IRL

midnight spindle Dec 6, 2020, 7:10 PM

#

omg I have no idea what I supose to do that now I have acces to gitea with Frank

fiery moth Dec 6, 2020, 7:11 PM

#

icba to go through the whole app.ini file

strange river Dec 6, 2020, 7:12 PM

#

My OSCP was like that, just reading a big config file

#

whats with the thumbs up reactions haha

fiery moth Dec 6, 2020, 7:14 PM

#

i will probs give the oscp in some years so i got time to prepare

midnight spindle Dec 6, 2020, 7:14 PM

#

@strange river any hint after get acces to gitea with frank ?

strange river Dec 6, 2020, 7:14 PM

#

DevGuru is very similar to the way they make exam boxes

#

blobknife except they like windows a lot now

fiery moth Dec 6, 2020, 7:15 PM

#

active directory?

midnight spindle Dec 6, 2020, 7:16 PM

#

I guess so

strange river Dec 6, 2020, 7:16 PM

#

No, thats more PWK

#

Unless its changed

#

@midnight spindle || The config files mentions its enabled, and its a feature of gitea ||

midnight spindle Dec 6, 2020, 7:18 PM

#

ok thanks I will double/triple check that 😉

strange river Dec 6, 2020, 7:19 PM

#

|| Its not suppose to be enabled by default, at least according to the example config provided by gitea ||

midnight spindle Dec 6, 2020, 7:20 PM

#

when you said " the confirm files is enabled" where you get this info ?

strange river Dec 6, 2020, 7:20 PM

#

|| Its a well documented way to get RCE on gitea, you just have to find it ||

midnight spindle Dec 6, 2020, 7:20 PM

#

ok

strange river Dec 6, 2020, 7:23 PM

#

@dull pulsar manjuice is suppose to give hints since I gave him hints

#

blobknife

fiery moth Dec 6, 2020, 7:23 PM

#

@strange river does it has to do with mysql?

strange river Dec 6, 2020, 7:24 PM

#

@dull pulsar i'm joking haha

dull pulsar Dec 6, 2020, 7:24 PM

#

lmaooo

strange river Dec 6, 2020, 7:24 PM

#

@fiery moth which part

fiery moth Dec 6, 2020, 7:24 PM

#

getting into gitea

#

i got the creds

strange river Dec 6, 2020, 7:24 PM

#

Thats the hardest part

fiery moth Dec 6, 2020, 7:24 PM

#

for the dtb of gitea

#

i found mysql creds for gitea while reading thr config file

strange river Dec 6, 2020, 7:25 PM

#

|| There might be other ways to do it, but the way I did it was taking advantage of gitea being open source and writing a reimplementation of their hashing ||

#

|| You don't have to do that, just use their software instead of writing it manually ||

fiery moth Dec 6, 2020, 7:25 PM

#

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE2MDU3NTc1MjV9.TgIEm15weeIsUgo2aG-oL7JqzClHpdIVyn1ohFkYm7o

#

||; Password Hash algorithm, either "argon2", "pbkdf2", "scrypt" or "bcrypt"||

#

i found that

strange river Dec 6, 2020, 7:26 PM

#

The config will specify it

#

That's just a comment

#

I didn't want to be mean and use || argon2 ||

fiery moth Dec 6, 2020, 7:27 PM

#

i read the whole config file didnt find anything other than mysl creds which are no use

strange river Dec 6, 2020, 7:27 PM

#

use grep

#

|| creds are very useful ||

midnight spindle Dec 6, 2020, 7:28 PM

#

@fiery moth try to grep with what you looking for

fiery moth Dec 6, 2020, 7:29 PM

#

i am looking for a pass

midnight spindle Dec 6, 2020, 7:29 PM

#

for what ?

fiery moth Dec 6, 2020, 7:29 PM

#

to login to gitea

midnight spindle Dec 6, 2020, 7:29 PM

#

ok you have it 😉

strange river Dec 6, 2020, 7:30 PM

#

The DB or gitea directly ?

fiery moth Dec 6, 2020, 7:30 PM

#

gitea or the db idc as long as i get to user frank1

strange river Dec 6, 2020, 7:32 PM

#

@fiery moth how long have you been on this part?

fiery moth Dec 6, 2020, 7:32 PM

#

a lot of hours

sonic wigeon Dec 6, 2020, 7:35 PM

#

fiery moth to login to gitea

Wait so you need to find the creds and not add another user for || gitea ||

fiery moth Dec 6, 2020, 7:35 PM

#

idk

strange river Dec 6, 2020, 7:36 PM

#

Its hard to answer this stuff without spoiling

#

@sonic wigeon || you're on the right track ||

midnight spindle Dec 6, 2020, 7:37 PM

#

omg I think I have it !! about RCE in gitea !

fiery moth Dec 6, 2020, 7:37 PM

#

there is an exploit for it yeah

#

authenticated rce

white salmon Dec 6, 2020, 7:38 PM

#

I am stuck with login itself.. it is always throwing error message.. hashed creds dont match

sonic wigeon Dec 6, 2020, 7:38 PM

#

fiery moth authenticated rce

Yeah but that doesn't work I tried running it

midnight spindle Dec 6, 2020, 7:38 PM

#

same here

fiery moth Dec 6, 2020, 7:38 PM

#

i cant even find the exploit for it

sonic wigeon Dec 6, 2020, 7:39 PM

#

white salmon I am stuck with login itself.. it is always throwing error message.. hashed cre...

On cms ?

white salmon Dec 6, 2020, 7:40 PM

#

yea.. unable to login... hashed creds dont match error

fiery moth Dec 6, 2020, 7:40 PM

#

you need to gen a bcrypt hash

sonic wigeon Dec 6, 2020, 7:40 PM

#

Yes

white salmon Dec 6, 2020, 7:40 PM

#

i did that for my new user..

fiery moth Dec 6, 2020, 7:40 PM

#

you need to clone frank

white salmon Dec 6, 2020, 7:40 PM

#

it is still saying the same.. what is persist_code?

fiery moth Dec 6, 2020, 7:40 PM

#

and change everything unless the persist_code

#

from example from frank do frank1

#

and make sure there arent any spaces ahead in the bcrypt hash

white salmon Dec 6, 2020, 7:41 PM

#

okay.. let me try again..

slow lantern Dec 6, 2020, 7:42 PM

#

on my first way, anyone can give me a short hint?
(This challenge is pretty simple. The binary is checking to see if the environment variable "test1234" exists, and if it's set equal to the current $USER environment variable.)

fiery moth Dec 6, 2020, 7:42 PM

#

there are writeups

stuck fractal Dec 6, 2020, 7:43 PM

#

fiery moth there are writeups

No

#

This channel is for hints

#

Not pushing people to writeups

slow lantern Dec 6, 2020, 7:43 PM

#

no, i will go ahead by myself and with few hints, everything else is crap

stuck fractal Dec 6, 2020, 7:43 PM

#

slow lantern on my first way, anyone can give me a short hint? (This challenge is pretty simp...

You need to set the variable, then run the binary

midnight spindle Dec 6, 2020, 7:46 PM

#

OMMGG !! after 3h! anidab anidab

📎 SPOILER_unknown.png

strange river Dec 6, 2020, 7:46 PM

#

@midnight spindle congrats

midnight spindle Dec 6, 2020, 7:46 PM

#

I'm so GLAD and HAPPY omg ^^

fiery moth Dec 6, 2020, 7:46 PM

#

i am stucked

strange river Dec 6, 2020, 7:47 PM

#

@midnight spindle pretty satisfying

midnight spindle Dec 6, 2020, 7:47 PM

#

yeah ! and for me is meaning a lot ! because I really want to pass my OSCP and try to work on field so... yeah ^^

#

anidab

fiery moth Dec 6, 2020, 7:48 PM

#

same

midnight spindle Dec 6, 2020, 7:49 PM

#

if someone need any help feel free ! 🙂 and @fiery moth your close dude ! try to make a small break and back to that 🙂

#

you just missed something ^^

fiery moth Dec 6, 2020, 7:50 PM

#

i legit read the whole config file

sonic wigeon Dec 6, 2020, 7:50 PM

#

@midnight spindle Damn , GG's man

midnight spindle Dec 6, 2020, 7:50 PM

#

I know we said that but focus on what you looking for and FOR WHAT ^^

#

@sonic wigeon thanks dude !

ancient island Dec 6, 2020, 7:51 PM

#

FINALLY!!!

📎 frank.png

sonic wigeon Dec 6, 2020, 7:51 PM

#

Damn GG's man (2) xD

fiery moth Dec 6, 2020, 7:51 PM

#

@ancient island grats

strange river Dec 6, 2020, 7:51 PM

#

@ancient island you been at it for a while, congrats 🙂

midnight spindle Dec 6, 2020, 7:51 PM

#

NICE !!!

ancient island Dec 6, 2020, 7:52 PM

#

thanks guys, without your help I wouldn't have made it

midnight spindle Dec 6, 2020, 7:55 PM

#

same here ! thanks a LOT guys 🙂

fiery moth Dec 6, 2020, 7:55 PM

#

i've been stuck for hours now

sonic wigeon Dec 6, 2020, 7:55 PM

#

Hahahah I feel you man

slow lantern Dec 6, 2020, 7:55 PM

#

stuck fractal You need to set the variable, then run the binary

thx done

midnight spindle Dec 6, 2020, 8:05 PM

#

omg I'm stuck again 😭

#

someone know what "!" mean where is front of the sudoers cmd ?

ancient island Dec 6, 2020, 8:07 PM

#

hahahha

#

same

stuck fractal Dec 6, 2020, 8:07 PM

#

midnight spindle someone know what "!" mean where is front of the sudoers cmd ?

Not

#

!root means not root

ancient island Dec 6, 2020, 8:07 PM

#

hmm

midnight spindle Dec 6, 2020, 8:07 PM

#

hmm

#

like everyone can use it expect the root ?

#

like (ALL,!root ) NO PASS = everyone can use it without pass but not as root ?

ancient island Dec 6, 2020, 8:08 PM

#

i think it is

midnight spindle Dec 6, 2020, 8:09 PM

#

hmmm

fiery moth Dec 6, 2020, 8:11 PM

#

@midnight spindle can you give me a hint

midnight spindle Dec 6, 2020, 8:11 PM

#

what did you 'grep" ?

fiery moth Dec 6, 2020, 8:12 PM

#

passwd
password
pass
user

#

and some others

ancient island Dec 6, 2020, 8:12 PM

#

cool!!

📎 root.png

midnight spindle Dec 6, 2020, 8:12 PM

#

ok le's making again ^^

#

what you looking for ?

#

omg @ancient island WELL DONE !

ancient island Dec 6, 2020, 8:12 PM

#

thanks @strange river for the machine. I learned a lot!!!

fiery moth Dec 6, 2020, 8:13 PM

#

@ancient island noice

midnight spindle Dec 6, 2020, 8:13 PM

#

I'm still stuck with the !root 😄

fiery moth Dec 6, 2020, 8:13 PM

#

@midnight spindle to access gitea

slow lantern Dec 6, 2020, 8:13 PM

#

I'm trying tos start my machine -> (after deploy the one for linux3)
=> Uh-oh! You can only deploy a maximum of 3 machines at a time.

midnight spindle Dec 6, 2020, 8:13 PM

#

ok so what you have to grep ? 😄 ( is in front of you ^^ )

slow lantern Dec 6, 2020, 8:13 PM

#

how can i shutdown running ones?

fiery moth Dec 6, 2020, 8:14 PM

#

finnaly

midnight spindle Dec 6, 2020, 8:14 PM

#

hahaha

fiery moth Dec 6, 2020, 8:14 PM

#

@midnight spindle ty

midnight spindle Dec 6, 2020, 8:14 PM

#

no problem dude !! KEEEPP GOINNGG !!

ancient island Dec 6, 2020, 8:14 PM

#

slow lantern how can i shutdown running ones?

go to the active machine, and click "terminate"

fiery moth Dec 6, 2020, 8:14 PM

#

i feel so stupid

slow lantern Dec 6, 2020, 8:15 PM

#

ancient island go to the active machine, and click "terminate"

ok thx, thought they will be terminated automatically after switchting to new lesson

midnight spindle Dec 6, 2020, 8:16 PM

#

@ancient island I'm wasting my time with this !root ? or 😄

fiery moth Dec 6, 2020, 8:16 PM

#

@midnight spindle accept my req

ancient island Dec 6, 2020, 8:17 PM

#

midnight spindle <@!483445271250993153> I'm wasting my time with this !root ? or 😄

no, this is interesting

midnight spindle Dec 6, 2020, 8:18 PM

#

ok

ancient island Dec 6, 2020, 8:18 PM

#

just

#

google

#

hahah

midnight spindle Dec 6, 2020, 8:18 PM

#

haha this is what I'm doing since 3h xD

ancient island Dec 6, 2020, 8:19 PM

#

hahaha me too

white salmon Dec 6, 2020, 8:25 PM

#

any hints for reverse shell exec?

#

stuck with it for a long time

ancient island Dec 6, 2020, 8:26 PM

#

gitea

midnight spindle Dec 6, 2020, 8:28 PM

#

OMG !!! THANKS TO @ancient island anidab anidab

📎 unknown.png

night fractal Dec 6, 2020, 8:28 PM

#

boreal pond I'm working on the Intro to Python exercise. I'm getting close, but can't figure...

pretty sure run_decode() can't see the file variable bc it's out of it's scope

sonic wigeon Dec 6, 2020, 8:29 PM

#

@midnight spindle OP

midnight spindle Dec 6, 2020, 8:30 PM

#

anidab

#

@strange river I know that we already told you that but... thanks for this room ! it was hard but really nice !

strange river Dec 6, 2020, 8:30 PM

#

Should it be leveled hard?

midnight spindle Dec 6, 2020, 8:31 PM

#

for me I will say yes ^^ but I don't know

strange river Dec 6, 2020, 8:32 PM

#

ill let darkstar decide

sonic wigeon Dec 6, 2020, 8:32 PM

#

strange river Should it be leveled hard?

Yes xD

strange river Dec 6, 2020, 8:33 PM

#

its hard to understand the difficulty for me because its in hindsight from the beginning

ancient island Dec 6, 2020, 8:34 PM

#

strange river Should it be leveled hard?

for me, yes i think hahah

strange river Dec 6, 2020, 8:35 PM

#

darkstar will change it if it is, he did that to daily bugle I think?

fiery moth Dec 6, 2020, 8:41 PM

#

finnaly got into gitea

ancient island Dec 6, 2020, 8:43 PM

#

good!

fiery moth Dec 6, 2020, 8:43 PM

#

and my machine expired

#

great

night fractal Dec 6, 2020, 8:43 PM

#

midnight spindle like (ALL,!root ) NO PASS = everyone can use it without pass but not as root ?

exactly as you said it

midnight spindle Dec 6, 2020, 8:45 PM

#

@night fractal thanks 🙂

night fractal Dec 6, 2020, 8:46 PM

#

but I saw you got the root so I'm guessing you found a way around the !root

midnight spindle Dec 6, 2020, 8:46 PM

#

yep 😄

#

anidab

night fractal Dec 6, 2020, 8:47 PM

#

weirdest thing about that CVE is that we only found it a while back ago

#

but I guess !root is not really a common way to configure sudo

fiery moth Dec 6, 2020, 8:55 PM

#

@strange river any hints
i am on gitea rn

strange river Dec 6, 2020, 8:56 PM

#

@fiery moth google everything you can on hacking gitea

fiery moth Dec 6, 2020, 8:56 PM

#

k

#

i noticed it uses a vuln version but i cant find an exploit for it

slow lantern Dec 6, 2020, 9:27 PM

#

136 Questions done for today (no writeup), yeah! beginners mood

jolly snow Dec 6, 2020, 9:33 PM

#

I'm on the devguru room, I found the ||login|| page, running gobuster on the room ip makes it explode everytime (I have to restart the room everytime I do a directory scan), any hints?

strange river Dec 6, 2020, 9:33 PM

#

@jolly snow free or VIP?

jolly snow Dec 6, 2020, 9:34 PM

#

the room? room is Free

strange river Dec 6, 2020, 9:34 PM

#

No, the VPN you on

jolly snow Dec 6, 2020, 9:34 PM

#

VIP

normal olive Dec 6, 2020, 9:34 PM

#

Hi, I'm doing the furthernmap room, on task 8 it's asking "Why are NULL, FIN and Xmas scans generally used?" The answer it's relative stealth but it's not accepting it.. what am I doing wrong? thanks in advance for guiding

strange river Dec 6, 2020, 9:35 PM

#

@jolly snow how many threads

jolly snow Dec 6, 2020, 9:36 PM

#

strange river <@!207333073262477316> how many threads

I was trying 50, after a while the server crashes

strange river Dec 6, 2020, 9:36 PM

#

yea don't do 50, it will overload the CPU since apache is in prefork

#

And its limited resources

jolly snow Dec 6, 2020, 9:36 PM

#

I see, but any other tips rather than brute forcing for folders and files?

jolly snow Dec 6, 2020, 9:37 PM

#

strange river And its limited resources

thanks btw

strange river Dec 6, 2020, 9:37 PM

#

You can, just cause less load

#

ffuf should be fine

stuck fractal Dec 6, 2020, 9:53 PM

#

@normal olive check the task text, it explains

somber crag Dec 6, 2020, 10:04 PM

#

i am a bit stuck with the "DevGuru" room

#

it seems that the user|| "frank"|| was suspended 😦

#

I updated the ||backend table|| and I guess that I mess something with the DB

fiery moth Dec 6, 2020, 10:09 PM

#

@somber crag || clone the user then change the username and some other stuff like from frank to frank1 and change the password which should be bcrypt
so take for example the string password hash it in bcrypt and use it as the pass||

somber crag Dec 6, 2020, 10:12 PM

#

fiery moth <@!326681448700575744> || clone the user then change the username and some other...

I got this error|| A user was found to match all plain text credentials however hashed credential "password" did not match.||

granite perch Dec 6, 2020, 10:12 PM

#

Hey everyone, I'm in the Nmap room and been stuck on Task 14 question "Perform an Xmas scan on the first 999 ports of the target -- how many ports are shown to be open or filtered?". I've tried nmap -sX -p1-999 <IP> and I'm not getting any open or filtered ports. Am I entering it wrong?

fiery moth Dec 6, 2020, 10:12 PM

#

check your bcrypt hash @somber crag cause you might have a space at the end

somber crag Dec 6, 2020, 10:13 PM

#

I checked it and I didnt have any spaces

fiery moth Dec 6, 2020, 10:14 PM

#

want me to generate you one?

somber crag Dec 6, 2020, 10:14 PM

#

I am generating the hash here https://bcrypt-generator.com/

Bcrypt-Generator.com - Online Bcrypt Hash Generator & Checker

Bcrypt-Generator.com is a online tool to check Bcrypt hashes. You can also use it to generate new Bcrypt hashes for your other applications that require a Bcrypt encrypted string or password

fiery moth Dec 6, 2020, 10:15 PM

#

$2y$12$HgRvJSGWKlA1BtztdcIB1.qbqnCaJC1VGpddPFAH53ejyMYOnH3NK

#

use that

#

its pass in plaintext

somber crag Dec 6, 2020, 10:16 PM

#

wait

#

that worked xD

#

what I was doing wrong ?

fiery moth Dec 6, 2020, 10:16 PM

#

you probs left a space at the end

somber crag Dec 6, 2020, 10:16 PM

#

idk, thanks

fiery moth Dec 6, 2020, 10:17 PM

#

np

night fractal Dec 6, 2020, 10:28 PM

#

normal olive Hi, I'm doing the furthernmap room, on task 8 it's asking "Why are NULL, FIN and...

not stealth my guy, as has been said many times before, XMAS scans are super easy to discover, the answer lies in your nmap output, and is connected to the previous question

sonic night Dec 6, 2020, 10:36 PM

#

fiery moth check your bcrypt hash <@!326681448700575744> cause you might have a space at t...

and @somber crag this is resolved if you select "encrypt" from the drop down and put in a plain text password. You do not have to generate a bcrypt

rigid dagger Dec 6, 2020, 10:48 PM

#

Is there a way i can find my fully domain name by reading files?

#

I dont have access to /etc/*

#

Also i cant read the /proc/sys/kernel/hostname

fiery moth Dec 6, 2020, 10:53 PM

#

uname -a

rigid dagger Dec 6, 2020, 10:54 PM

#

I can only read files

#

Im connected fia ftp

fiery moth Dec 6, 2020, 10:54 PM

#

oh

normal olive Dec 6, 2020, 10:58 PM

#

night fractal not stealth my guy, as has been said many times before, XMAS scans are super eas...

sorry I'm new here and didn't know it's been said before, will look more into it, thanks

normal olive Dec 6, 2020, 10:58 PM

#

stuck fractal <@514087771388903444> check the task text, it explains

will take a more thorough look, thanks

boreal pagoda Dec 6, 2020, 11:01 PM

#

fiery moth finnaly got into gitea

Just got home and I see you guys did get into gitea, congrats. I'm accepting hints. I have access to gitea db, have secret key, ... but can't see a way through it

fiery moth Dec 6, 2020, 11:02 PM

#

||clone it||

#

like you did first time with adminer to access backend

#

@strange river ik how to exploit it but i get some errors

boreal pagoda Dec 6, 2020, 11:02 PM

#

k will try it 😄

random scroll Dec 6, 2020, 11:40 PM

#

I'm curious if anyone knows if there's some efficient way you're supposed to find flag 16 in the linux challenges room. The clue is "Flag 16 lies within another system mount.". I eventually found it by sheer luck, but it doesn't seem like it's actually in a mount or anything, just one of the directories off of /. I checked the writeups, but they mostly seem to just say you have to dig to find it. Could be that's all there is to it... Look all over!

stuck fractal Dec 6, 2020, 11:40 PM

#

It's not actually another mount

#

Find out where Ubuntu mounts USB sticks when you connect them

random scroll Dec 6, 2020, 11:41 PM

#

Ahh, okay - thanks!

night fractal Dec 7, 2020, 1:04 AM

#

normal olive sorry I'm new here and didn't know it's been said before, will look more into it...

it's all good, I only realised now that my message sounds a bit mean and I'm sorry for that, this is a room to ask for hints after all and you simply asked for one

strange river Dec 7, 2020, 1:26 AM

#

Where are the mods

jade oracle Dec 7, 2020, 1:26 AM

#

i wrong?

#

srry

strange river Dec 7, 2020, 1:26 AM

#

Its not your fault, they are incompetent

buoyant elm Dec 7, 2020, 1:27 AM

#

oh

#

man im sorry

strange river Dec 7, 2020, 1:27 AM

#

@jade oracle that was just to much info 🙂

#

I would delete it myself no problem, but not mod anymore

jade oracle Dec 7, 2020, 1:27 AM

#

strange river <@!747220148477362177> that was just to much info 🙂

u right

jolly snow Dec 7, 2020, 1:28 AM

#

I'm a bit lost on DevGuru, I got the username ||frank|| but trying to recover its password made his user get suspended, do I need to restart the box? (The password recover was returning a error every time I tried to recover the password)

buoyant elm Dec 7, 2020, 1:29 AM

#

i got the same problem, i dont think thats the error ...

minor bough Dec 7, 2020, 1:29 AM

#

-mute @strange river Rude to modes

#

*mods

green minnowBOT Dec 7, 2020, 1:29 AM

#

🔇 Muted zayotic#2616 for 1 day

minor bough Dec 7, 2020, 1:31 AM

#

Actually, you've been nothing but problems. Enjoy the ban.

jolly snow Dec 7, 2020, 1:33 AM

#

jolly snow I'm a bit lost on DevGuru, I got the username ||frank|| but trying to recover it...

this is the error

📎 SPOILER_unknown.png

stuck fractal Dec 7, 2020, 1:35 AM

#

I'd assume you need to restart the box

#

It's throwing that error because the boxes don't have internet

jolly snow Dec 7, 2020, 1:35 AM

#

I just did, thats a new box

buoyant elm Dec 7, 2020, 1:36 AM

#

maybe your user get suspended because server limits login attempt

jolly snow Dec 7, 2020, 1:37 AM

#

buoyant elm maybe your user get suspended because server limits login attempt

yeah, so brute forcing is out of question, same with the db page

#

too many attempts on db login gets me a timeout of 25 minutes

night fractal Dec 7, 2020, 1:40 AM

#

minor bough Actually, you've been nothing but problems. Enjoy the ban.

before I say anything sorry for the ping
now, I'm not saying you're wrong, actually I'm pretty sure you're right, but I'm just wondering what do you have to do in order to actually get banned like zayotic, like how bad did he mess up?

minor bough Dec 7, 2020, 1:41 AM

#

There have been other events and I'll level with you, I'm not going to elaborate

night fractal Dec 7, 2020, 1:42 AM

#

k

#

thanks for at least replying 😅

minor bough Dec 7, 2020, 1:42 AM

#

No problem ahaha

night fractal Dec 7, 2020, 1:43 AM

#

I respect you saying you're not gonna elaborate more than you just straight up ignoring me like lots of mods on other servers usually do

minor bough Dec 7, 2020, 1:44 AM

#

Honest to goodness, the main reason I'm not elaborating is that there's a lot involved with that issue and I'm eating dinner lol