room-hints

[glacial gust]

of the attackbox terminal

[icy shard]

oh ok

[glacial gust]

are you logged into the linux host

[icy shard]

not sure

[oblique cliff]

You’re not

[stuck fractal]

You need to use the window in the room

[oblique cliff]

JAMES

[oblique cliff]

NO

[icy shard]

this is my screen

im using attackbox

thingy

[glacial gust]

you need to deploy the host for the room

[icy shard]

how do i do that

??

[glacial gust]

in task 1 there is a button that says "Deploy", this will launch the host that you need to ssh to

[icy shard]

ok

is that it

[glacial gust]

once you are ssh'ed to the host, create the noot file and then run the binary in the same folder

[icy shard]

ok

i think i know what you mean

wait it says i need to log into the ssh

how do i do that

??

[glacial gust]

ssh shiba1@<ip of deployed host>

[stuck fractal]

You don't SSH for that one

You get in-browser access

[icy shard]

everything is so confusing

[glacial gust]

comarade do you want to go down to the voice chat Small Study Room?

[icy shard]

maybe

ok

one sec

its locked

[midnight swallow]

can anyone give me a hint on spice hut? I know it has to do with ||planner.sh and the variable|| but not sure what to do

hint on root

[midnight swallow]

i got it but i dont understand how

[woven mirage]

you mean the room startup?

[midnight swallow]

no the room start up

i mean spice hut lol

oh wait

start up youre right sorry

[woven mirage]

well, if you see, planner.sh is executing another file

and planner.sh is being executed as root in a cron job

[midnight swallow]

yeah but when i cat /etc/crontab its not llisted there as a cron job

i ended up getting root like on accident lol

cuz my listener was running

[woven mirage]

not all cron jobs are in /etc/crontab

the best tool to identify cron jobs is pspy

it checks the processes that are starting in the machine

run pspy in the machine and you will see that the file is being executed once every couple seconds

[midnight swallow]

oh wow cool yeah i do see that

is there a way to manually check that?

oh wait it says it in the readme

first time ive used that thanks

[unique siren]

Room Linux: Local Enumeration
Task 6
How r we suppose to find the flag in such amount of files😩
I mean, what parameter could help?

I used "find -type f | grep .conf" in the "/" directory, but couldn't find a clue.

[cold oracle]

use the -name

find / -type f -name < name of the file >

@unique siren

[unique siren]

Thanks!!!

[sonic axle]

room is network services im having issues. with telnet

[cold oracle]

what error u got

can u share a pic pls

[sonic axle]

i cant seem to run any commands with telnet

i followed the instructions to install the tcpdump

i was considering looking through a walk through but i wanted to ask in here first

[wintry yarrow]

@sonic axle read the instructions. You have to do it like .RUN ls this.

[prisma prawn]

the usage of tcpdump is to make sure that the commands ran in the telnet session are actually executed when you do .RUN prefix like .RUN ping (attackbox) . Tcpdump listener on the interface is seeing ICMP (ping) traffic. That confirms it works. So next step is to create a reverse shell with this knowledge using msfvenom raw payload for cmd/unix

[eager bramble]

I had that issue some un-intentional logs look like thier generating after you log into the box, they should be a few minutes away from the rest of the events, filter for eventa by time and fin the last event that occured a few minutes before the rest and you'll be the right number

[jade bolt]

hi guys, someone has any hint on where should I look to get access to this machine?
ColddBox: Easy

tried to bruteforce 2 users passwords, no luck so far

[median compass]

what are you using to bruteforce and what users have you tried? Not sure that box is 72 hours old yet

[jade bolt]

I used hydra

against hugo and philip

and wpscan

[eager bramble]

||Http get or http post form?||

[jade bolt]

post form

[median compass]

you can (should) use spoiler tags around answers (double pipe | before and after) please

so i'd recommend using wpscan to brute the passwords, it's faster as it uses the XML-RPC interface, and there's one more user you didn't try

[jade bolt]

I gave up too early, hmm

[median compass]

this is the post i was suggesting spoiler tags for fyi

[jade bolt]

I see, Ok

[jade bolt]

I'm gonna try it, thanks!

[sterile jacinth]

is kali allowed here??

[median compass]

what do you mean? you can of course use kali to work on thm boxes yes

[sterile jacinth]

i mean like does this server help? since i joined a server and they said kali linux is not allowed

[median compass]

this server is associated with tryhackme.com, if you register there and learn your way through the rooms then you'll pick up how to use kali

[sterile jacinth]

alright thanks

[median compass]

this server is here to support in using that site

[smoky hollow]

@median compass Can you recommend any word lists for the users in ColddBox? Either the box is being battered or my VM is not having a fun time with rockyou.txt 😂

[median compass]

i just used rockyou, for the correct user the password is within the first 1500 passwords, it should find it almost instantly

[smoky hollow]

Huh, maybe I need to enumerate more then. ||I have four users in my username file currently||

[median compass]

show me what command you're using?

[smoky hollow]

||wpscan --url 10.10.88.65 --passwords /usr/share/wordlists/rockyou.txt --usernames users --max-threads 50||

I'll give it another go, I think the combination of bruteforce in a VM and the box getting a bit toasty from the requests just requires a bit more patience

[median compass]

no, i think your problem is with your syntax. have a look at wpscan --help again and check out how to specify users to brute force

[smoky hollow]

The brute force looks like it's cycling the users within the file just fine though 🤔

[median compass]

hmmmm, then i don't know, it should find it quickly, there are only 3 valid users to search

[smoky hollow]

Time will tell 😄 Thanks for the help

Eyyyyyyy finally! Who knew that patience was a good quality for cybersec workers

[median compass]

nice

[jade bolt]

thanks, I was able to get the user's password

[lone locust]

Thanks @eager bramble

[lone locust]

@eager bramble I notice that there are two same question "What are the total number of events?"

I place the same answer as the first yet it is saying incorrect.

[eager bramble]

|| different set of logs, I missed this one first time around scroll down || @lone locust

[lone locust]

@eager bramble Scroll down??

[eager bramble]

two two's let me boot the machine and check

|| yeah scroll down it's not in that section it's outside of the Microsoft folder it's called "windows powershell", the question above does state it but it also stumped me when i first came across it ||

[lone locust]

😅 After the above and just re reading the question asked, while using a lot of brain cell muscle I was able to figure it out. Thanks again for the hint/assistant .

[eager bramble]

happens to the best of us 🙂

[median dirge]

working through the nmap room right now, and i hit this question under the "practical" module, and i dont think im scanning it properly, since the result that i get is that ||all 5000 ports are filtered||, but ||saying that there are 0 ports open is not the correct answer, the syntax for the command im using is sudo nmap -sS -vv -p0-4999||

where am i going wrong here?

should probably send the question lmao

[exotic canyon]

I just finished task 8 in Upload vulnerabilities. I was able to do the server side bypass based on info given on the task. I always like to look at the hint in case it was solved differently. I am a bit perplexed by the hint in this one "Commands do not start with a "-". Just use the word itself.
"
Anybody available to discuss it?

[white salmon]

room link?

[dapper ginkgo]

Hi there! I'm working on the tryouts

I have a question. How do I open the .bad files on task 7?

I would appreciate any pointers

[remote gate]

What room is this?

[dapper ginkgo]

it is the tryouts from TryHackMe

[night fractal]

would you mind sending a link to the room?

[remote gate]

Is this a private room? If so, this channel is meant for publicly available rooms

[wet flicker]

looking for a little nudge in the right direction - currently working on windows privesc (https://tryhackme.com/room/windows10privesc) task 9. Its asking us to find:

 What was the admin password you found in the registry? 

I ran the command

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"

From what i understand, i should be looking for a "defaultpassword" flag with the password set there, however my output doesnt not list such a source. Im just looking for a gentle nudge of where i should be looking if this isnt correct

[wet flicker]

how bizare, i checked using regedit and it appears that the password is just not even set on here.....

welp, i just guessed the pass 🙃

[zinc oyster]

We are a bunch last couple of days that could not find any password there. So something is weird

[wet flicker]

Glad to know I’m not going too crazy! I ended up calling it quits for the night - for some reason when I would transfer the Sam and system files off it would force close the rdp session and not let me reconnect, so strange

[zinc oyster]

I had to reboot the machine some times when rdp got too upset too

[cedar axle]

@zinc oyster #room-help message

[ripe hedge]

Yeah I couldn't find the password either.

[wet flicker]

Let’s hope that box gets fixed soon! Would love to be able to fully complete the complete beginner line

[wicked bolt]

I'm getting a 500 server internal error when doing a POST request on the xml-rpc.php on ColddBox: Easy
am i down a rabbit hole? ( i found a dir with some usernames in it which suggests pw can be bruteforced. I would've thought xml-rpc requests would be a good method)

ok. did some more research and ||wpscan has a bruteforcer function built-in, i guess xml-rpc was a rabbit hole||

[exotic canyon]

https://tryhackme.com/room/uploadvulns

[zinc oyster]

Oh nice to know it wasn't in there in some unexpected way. The wording really sent me searching for quite a while but I learnt a thing or two on the way

[jovial cape]

Hi, I'm working on glass box and I managed to || find the valid port by pursuing the "higher" and "lower" responses, and I got shell on the box, however when I reboot the box to elevate the my privileges I don't a shell, this is not the problem here, my problem is after rebooting the box I try to find the valid port again since I found it's randomized, but all the ports just say "Lower", even the lowest open port ||, is this normal ? the ports act normally again after I restart the box but I need to get in without restarting so I can debug the reverse shell problem

[stuck fractal]

lower means you're lower

It's mathematically impossible that it doesn't have a correct port.

[jovial cape]

this was a very stupid moment 😂, I thought I should go lower

thanks

[teal marten]

Hi #room-hints, I need help with task 3 of https://tryhackme.com/room/networkservices2. I am able to do the showmount but then I cannot mount it due to acess denied. any hint?

[stuck fractal]

@teal marten run the VPN directly in your kali VM

[teal marten]

AHHHHHH Makes sense!! Im not forwarding all ports to the vm

[stuck fractal]

It's not worth it

Run the VPN in the VM

Port forwarding NFSv3 is pain

[teal marten]

I agree

thanks!

[mild eagle]

in room motunui I've got a shell but when trying to run a cmd ie. (id, or other) nothing happens shell/cmd-line is not repsonding I've looked at writeups and used the same route as them.

[wicked bolt]

May I DM you @cursive star , I don't think I have any chance of solving your room but I would like to know if I am even in the right area 😄

[cursive star]

@wicked bolt My DMs are open

[cedar palm]

To the creator of Enterprize: I hate you so much, I've been stuck for hours

[agile jewel]

u got some @cedar palm ?

[cedar palm]

Still at step 0

[agile jewel]

👀

@proven bridge can tell if its about typo?

[cedar palm]

am still thinking about it.```
I'm pulling my hair out trying to search for the foothold.
All I know is that the OS is ||Ubuntu 18.04.5 LTS||

[pure oracle]

Im here to ask for help about Linux Fundamentals Part 2. On 'Section 4' I cant find the answer to the second question

The question is What is the value of the home environment variable

[cedar palm]

It's similar to $PATH

[pure oracle]

? Im new to linux all together

I never read anything about $PATH

[cedar palm]

It's in part 1/2

[pure oracle]

would it be ./usr?

[tight halo]

Stuck on Task 26 https://tryhackme.com/room/owasptop10

[pure oracle]

@cedar palm would it be home/shiba2

[cedar palm]

No, I'm talking about the $PATH environment variable\

[pure oracle]

?

so to access that I type echo $PATH

[cedar palm]

Yea

Now do the same for $HOME

[pure oracle]

ooohh

Okay thank you

so the answer is /home/shiba2?

[tight halo]

Task 29 https://tryhackme.com/room/owasptop10
Executing RCE returns 404 from script. No write permissions. Can't connect to DB.

[snow wind]

Match all of these emails while also adding the username and the domain name (not the TLD) in separate groups (use \w): [e-mail], [e-mail], [e-mail]

Room Regular Expression

(\w+)@(\w+).com i tried to used this but it showing me that this is wrong answer even though it works in regex101

in tryhackme answer format it having 12 characters before the dot show i try to use ^(\w+)@(\w+).com but this also not work

anyone know how to solve it??

https://tryhackme.com/room/catregex

this Task 5 Question 8 (last one)

[wicked bolt]

Same, I got some bits but yeah, If I haven't seen it before, I've only been doing this stuff for less than a month so unlikely I'll find it

I had a dream about it this morning; I thought i had an Inception moment but my brain was dreaming of bruting a mysql password over ssh somehow 😆

[simple tide]

ive found the thing he told as a hint but no idea where to go from there

[wicked bolt]

I don't know enough to figure out what is old and what isn't. ||an out of date version of something? sure. There are a few things like that. An old page? icons/readme?|| I'm not sure if what i'm putting here is 'illegal' for this 2 weeks so let me know if i should delete

[cedar palm]

I don't think we should say anything else about that here, except if we move to another place.

[cedar palm]

||There has to be a hidden website, why would they put that there then?
But then again, the default installation of apache2 has those installed. Probably just a honeypot||

[peak cave]

Hey can anyone help me with anonymous room?

[trim haven]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[peak cave]

Currently I'm working on anonymous room.I have done enumration and I'm currently on exploiting stage but can't get any hints for exploiting I have got two images from smb shares but they are protected by passphrase and got three files from ftp but they are also not usefull for exploiting phases so how should I got user flag?

[simple tide]

did i spoil too much?

[bronze marsh]

Hey guys, is someone already on the new enterprize room? Any hints?

[robust cosmos]

Can anyone help me out on Blue? I'm running the exploit but it keeps failing and as far as I can see everything appears to be correct.

[bronze marsh]

Hey blinkz! I had the same issue....sometimes you have to redeploy the machine. Have you tried that already?

[astral smelt]

Post a screenshot please

[robust cosmos]

ya i've redeployed it a few times. I've tried over the course of the past few days off and on thinking I might be doing something wrong but in the end I'm running the same exploit that they marked as correct on the previous question.

[astral smelt]

The room is new please wait at least 72 hours from release before asking for hints

[robust cosmos]

I shot you a screenshot @astral smelt . Didn't want to post any spoilers

[trim haven]

Make sure you're asking for permission before DMing users

[pliant tapir]

hello im doing LFI Basics room and at the end im stuck on getting a shell on my listener....i input a code in burp and forward it....then open a listener on a port....in browser when i go wget to call a my script i get a response in first listener...but when i actually start the script i cannot get a shell.....any1 who can mabe tell me where is my mistake?

[bronze marsh]

oops, sorry!

[barren rapids]

If I type 'sudo -l' and it asks for a password, does that mean I have no sudo privileges?

[bronze marsh]

not necessarily, it could be that you'll be shown some command you can execute with sudo after typing in the correct password

[barren rapids]

thanks. i'm not positive but I feel like other times it just lists my privilege's but maybe I ran another sudo command before trying it.

[bronze marsh]

it depends on the configuration of the sudoers file - commands that have the option "nopasswd" set will be shown without typing in a password

[bronze marsh]

https://apple.stackexchange.com/questions/53065/why-does-sudo-ask-for-a-password-in-terminal

[barren rapids]

Yeah, that's I'm guessing. Thanks for the clarification!

[neon ridge]

I'm in the owasptop10 room doing task 20 cross site scripting.
I'm supposed to craft a reflected XSS payload that will cause a popup with your machines IP address.
What I tried: ||Hardcoding the machine IP to an alert, it alerted but no flag was given. I've also tried making a request to checkip.amazonaws.com (displayed my public ip) and api.ipify.org?format=jsonp&callback=getIP (requested rejected by client).||
Any ideas?

[neon ridge]

Nvm

[vocal thistle]

On the network services room with the exploiting smb part at the end it wants you to login via ssh. Everyone i do it closes the connection. I downloaded the one file and changed permissions to 600 but still it won't let me login in when trying: ssh (what i assumed the username was)@ip address -i (name of the id file)

[opal dagger]

you're using the username found at the end of the public rsa file, right? should be ______@polosmb

[vocal thistle]

I had the username wrong and fixed that but it keeps asking for password even though im using the other file and changed permissions

[opal dagger]

double check that you have the entire private key, including the little dash '----' notations at the top and bottom. Won't read the key correctly without the proper syntax. Other than that, change your syntax on ssh to:
ssh -i [file.txt] [username]@[ip]

[vocal thistle]

Still wouldn't work so i terminated machine ill reboot and try again

@opal dagger i found out what i was doing wrong i kept the whole polosmb part in the username. Must have looked over something so simple like 30 times anyways thanks for the help

[opal dagger]

np 👍
Had similar 'oops' issues dozens of times, it happens

[white salmon]

so I get this info about mysql from an nmap scan:

but when I try to set sql 5.7.29 or 5.7.29-0ubuntu0.18.04.1 then run exploit, it trips on that parameter

so am I inputting the wrong format or something?

[median compass]

what room, task & question are you attempting? what exploit are you running?

[white salmon]

ah sorry, I'm in Network Services 2, task 9, running mysql_sql module of metasploit

[stuck fractal]

I don't think you're meant to set that option...

[white salmon]

it still fails if I unset the sql parameter, and the error references sql

[median compass]

so you set PASSWORD, RHOSTS and USERNAME right?

can you screenshot those options?

[stuck fractal]

The SQL option is the sql command to run

Not the version

[median compass]

so what do you get when you run this, cause I just did it and it gave the expected output

[white salmon]

[-] Auxiliary failed: Msf::OptionValidateError One or more options failed to validate: SQL.

[median compass]

ok, that's because you unset SQL

do set SQL select version() again

and then exploit

and you'll get the version returned from the server

[white salmon]

ah ok, so unset puts in a null value instead of default?

[median compass]

seems to yes

when you check options it shows the default but it's not really there

[white salmon]

gotcha, thanks for that clarification. Setting it back worked, btw

[median compass]

there is a mistake in that room @stuck fractal, that question says "select module()" but the command it defaults to is really "select version()"

[pure thistle]

hey yall is there anybody online that has completed the Attacking ICS Plant #1 room that can DM me and explain what the creator is asking for in Task2 questions 1&2

[bronze marsh]

I just answered them correct right now...have you analyzed the code of the scripts? They are asking for the name of a specific function.

[keen swallow]

hi

[languid raft]

Hey, I'm working through linux: local enumeration room and hitting a bit of a snag. I've managed to get onto the computer and use python command to stabilise the shell (I think) but as the manager user I don't seem to have sudo privledges. So when it comes to section 2 I can't run some of the commands but by section 4 I can't access the password file.

Any suggestions on where I am failing here? I've looked for the shadow file and can't access to see hashes, I've checked the ssh folder for a rsa key but the folder is empty.

[white salmon]

have you privescd?

run whoami

who are you logged as

[languid raft]

Manager

That's what I'm struggling to do at the moment, which is why I was looking for root hash to crack... Or find an rsa key to ssh into, but no dice yet

[languid raft]

So I've managed to upload linenum to run and get more information on the system

I've tried generating my own idrsa and moving it over but there is no autorized key file... So I think ssh is out

I've found a video online of someone working through this same box from December and they seem to have sudo privledges... From linenum I've seen the suoders info and manager does appear to have some sudo rights but cannot locate a password for them

[shut lion]

Hello. In the room https://tryhackme.com/room/nax, I found the username and password and filled in all the appropriate options for the Metasploit exploit module, but I can't login with those details. Is there something I'm missing?

[astral smelt]

use -Pn

what task is this?

[shut lion]

anyone to help on this? ☝️

[white salmon]

what the diference of #room-help and this channel?

[astral smelt]

This is for where people want hints in which direction to go and don't want to look at the writeups whereas #room-help is for people that have checked the room writeups but still need help

[cedar axle]

one is for a gentle hint

the other is full on help

[vocal thistle]

Anyone give me hint on network services 2 where to find the root flag for NFS I've good root shell and everything just cant seem to find the flag

[stuck fractal]

cd /root && ls

[vocal thistle]

Appreciate it

[candid gulch]

Can anyone give me a nudge on the new EnterPrize room? I can't find anything.

[hexed crescent]

No hints allowed yet.

[candid gulch]

Why though?

[hexed crescent]

Check rule 13.

[white salmon]

I just finished the Metasploit room but there are some things I don't understand yet. Why do we use icecast at the beginning?

[pine ridge]

hey there , i am doing the brooklynctf room and the image i got here has a passphrase ; can someone guide me to break that passphrase !

[stuck fractal]

You're exploiting a service running on the machine

The machine is running Icecast, a media streaming service

You're exploiting a vulnerability in that, using a metasploit module designed to exploit that flaw.

[keen swallow]

can some one help me at #room-help

[stuck fractal]

Don't be impatient.

[keen swallow]

ok sorry

[pine ridge]

||i am doing the lian_yu room in which i found this link at a certian level . this link no longer has the video contained . so can i know if there was something supposed to be in this video which i cant access now ! https://www.youtube.com/embed/X8ZiFuW41yY||

[white salmon]

And how could I know this? I found icecast2.exe (or something similar) once I had access to that machine, but until then, I had no idea that machine had icecast

[stuck fractal]

Your Nmap scan told you it

When you did nmap -sV

[white salmon]

Oh okay! I did the nmap yesterday and I didn't remember a port had that service

So when I scan the ports, the next thing I should do (in general) would be to check if a service matches an exploit?

you are doing the Ice room, right?

[stuck fractal]

You find what services are running, and their versions

[white salmon]

No, I just finished the Metasploit room

[stuck fractal]

Depending on what you find, you might look for exploits for the software

Or attack it otherwise

[pine ridge]

james could we also find it using searchsploit or something ?

[white salmon]

Perfect, thank you!! It is much clearer now :)

[bitter salmon]

Gents, there is a problem with the question of " What two services make up the KDC?" in the Attacking Kerberos room.. the correct answer is not accepted, right?

[plush tapir]

Potent room @stuck fractal - This is a mission :p

[crisp sapphire]

haha my name on thereeeee feeling psyched

it's hard though

i'm off to sleep

all the bestttt

[white salmon]

@plush tapir indeed potent room

I'm out of ideas for now

[plush tapir]

As am I :"|

[white salmon]

I think I'm going to sleep it off, let's see if tomorrow I have fresh ideas

[plush tapir]

I saw a couple of possibilities but none of them worked out

One I might explore more tomorrow...

[crisp sapphire]

yup :/ 0day got the 2nd and 3rd flag before the first

wonder how he did it

:3

[eager bramble]

is it too early to get a hint on overpass 3?

[stuck fractal]

Entirely.

72 hours from room release

[eager bramble]

yeah fair play mate, this is a real head scratcher

[balmy wedge]

Hey all | Room: tomghost || I have cracked the pgp password and got !!!josh14!!!.a6_123 no matter how I try I cannot get that to unlock the credentials.pgp || Any hint's would be the best please!

[balmy wedge]

Nevermind, I was having some weird issues with Johntheripper that I figured out now.

[dire maple]

I m stuck at Room: javascript basics .
Task 5 question 2. The answer should be "Red Blue but it's not accepting it.

[winged mist]

Red blue isn’t the answer

[cold oracle]

im on BOLT. but cant find version of bolt Please tell me where can i find it

thanks

[trim haven]

It's a very new room, please wait at least 72 hours (as per rule 13)

[trim haven]

Wut

When did I say you did

All I did was tell you not to discuss the room

[sand comet]

Hi guys does anyone played with the Splunk room using the OVA file? I can't get in using the provided credentials

[trim haven]

-undelete -a

[green minnow]

Up to 10 last deleted messages (last hour or 12 hours for premium):

12 minutes ago (Mon Jan 11 09:29:31 2021) Skynet#1028: But I didn't say anything bad, much less give hints -_-

40 minutes ago (Mon Jan 11 09:01:05 2021) Skynet#1028: I'm in the Overpass3 shell but I can't get any user's shell haha

[coarse hornet]

Wtf

[trim haven]

@coarse hornet Trying to delete messages that you have sent doesn't work here

[coarse hornet]

Hahah

I don't understand now, can you avoid deleting messages? Haha

[trim haven]

You don't

[coarse hornet]

Lol

[umbral hatch]

I really need help with questions in task 8 of the XSS Playground room. 😭 #room-help message

[smoky hollow]

I'm finally taking a crack at Overpass 2, and I'm a bit stuck on ||analysing the code for the ssh-backdoor. I can't view the raw code on Github as it's too large, and the contents are gibberish as it's a compiled binary. Am I missing something obvious?||

[stuck fractal]

yes

You're looking at the binary

You have the source right there

[smoky hollow]

... You're right

Damn man, I feel silly now

Thanks! 😂

[old lava]

How did you even get shell? @_@

[limber iron]

https://tenor.com/view/elmo-shrug-不造-i-dont-know-gif-5094560

[ancient island]

i am so stuck to get second flag

hehe

[limber iron]

me 2

[old lava]

Wait did you get the second flag?

[ancient island]

nop

[limber iron]

not yet

[ancient island]

i think i know how to get, but i can't explore

[glacial gust]

please wait 72 hours from a rooms release to request hints

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[warm spire]

i just got the web flag of overpass, its been 4 hours that i cant find second hahaha

[spring ember]

Overpass3 was a super fun room. Thanks to creator 🙂

[stuck fractal]

I'm glad you enjoyed it!

[true widget]

need a nudge on haskhell.

[woven mirage]

which part are you in?

[true widget]

i am in the enumeration phase

i tried to uplaod a||** reverse shell in haskell**|| but could not find the upload location

@woven mirage

[woven mirage]

iirc correctly the site sends you to the upload location after uploading the file

[true widget]

I got an internal server error

[woven mirage]

then probably there is something wrong with your reverse shell file

try some simple haskell things to see what works and what doesnt

[true widget]

will do some research on it

[normal olive]

Hi all I'm doing the room Upload Vulnerabilities - Task 8 bypassing server side, file extension. I have found that the server accepts ||.jpg and .png|| for example it does not accept does ||.php or .jpg.php||, but seems to accept ||.php.jpg|| so I'm guessing that it checks that at the end of the filename it has that extension. I uploaded the payload ||payload.php.jpg|| I have tried different extensions but can't get the shell, any hints?

[woven mirage]

read the task again, it shows 2 ways of evading extension filters, you're trying just one of them

[normal olive]

it shows 2, first using|| different php extension||, and then using|| jpg.php|| I have tried both

even mixing for example ||.phtml.jpg .jpg.phtml, .phar.jpg, .jpg.phar||

am I missing something?

[sonic belfry]

Anyone done with Overpass 3 and would like to give a hint?

[astral smelt]

No hints allowed for 72 hours from release

[sonic belfry]

Alright, cool.

[candid gulch]

Can anyone give me a nudge on the new EnterPrize room? I can't find anything.

[sour vector]

Yo, I'm stuck on Overpass 3 for the web flag, I enumerated the web server with every tool I could think of but can't seem to find anything, can I get a hint pls?

[fallow brook]

same

[trim haven]

Wow

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[trim haven]

@sour vector

[topaz yacht]

I'm stuck on the very beginnig of the linux room, I can;t even SSH, I've used the password 'shiba1' but it doesnt work. Anyone got any ideas?

[sour vector]

well ty for not answering, I really didn't think hard enough whereas I had the answer in front of my eyes lol

[topaz yacht]

it's Task 4 on Learn Linux Walkthrough if that helps. And i'm using windows and tried to SSH from the command prompt and putty.

C:\Users***>ssh shiba1@10.10.4.88
shiba1@10.10.4.88's password:
Permission denied, please try again.
shiba1@10.10.4.88's password:
Permission denied, please try again.
shiba1@10.10.4.88's password:
shiba1@10.10.4.88: Permission denied (publickey,password).

this is what I get ^

[trim haven]

What password are you enterring

[topaz yacht]

shiba1

[smoky hollow]

I'm not jealous at all 😂

[dire maple]

There r only 2 colour pills that I know of. ?

[winged mist]

https://en.m.wikipedia.org/wiki/PHP

[winged mist]

||Answer format = Color + pill||

[dire maple]

Red + ? @winged mist

Lol

[winged mist]

Kek

Delete please so mods don’t get mad

[dire maple]

Thanks

[winged mist]

No p

[sand comet]

Finally finished the Investigating Windows room. Some questions were a bit tricky but manageable

[normal olive]

is it an specific extension? should I try them all?

[winter leaf]

can someone give me hint for overpass 3 for user flag other then its in james directory

trying to escalate its been 3 hours and still no effects

[winged mist]

Would be nice to try them all & find the right one Yunno

[normal olive]

ok, will do, thanks

[winged mist]

No p. Let me know how it goes

[astral smelt]

No hints for new rooms until after 72 hours from release

[normal olive]

got it now thanks.. thought it was something else, I feel dumb 🤪

[winter leaf]

This is a free room, which means anyone can deploy virtual machines in the room (without being subscribed)! 469 users are in here and this room is 64 days old.

am i missing something ?

[winged mist]

Kek good job hommie. Keep grinding!!

[stuck fractal]

It was released yesterday.

#announcements

[winter leaf]

ok thanks

[potent quail]

are hints allowed for enterprize now? It’s been 72 hours from what I read earlier on.

[normal olive]

hi again! I'm doing the next task, with the magic number. I was able to change the magic number and upload the shell, I found the directory in ||IP/graphics/payload.php|| I have tried all the extensions already.. any additional hint?

[winged mist]

What’s the problem? Uploading file or not getting shell?

[normal olive]

not getting the shell, is not recognising the file

[winged mist]

I don’t think you changed the magic number right. Try runing file <reverse shell name>

[normal olive]

the website requires a|| gif file,|| otherwise wont let me upload it

I have changed the extensions, this is the current one

[winged mist]

Sure. But if you did change the magic number correctly you wouldn’t need to change extension

[normal olive]

there are only two types of magic numbers for gif, is it expecting a specifc one?

[winged mist]

Of ||shell.php||

[winged mist]

I used the first

[normal olive]

I did it with just .php and got the same output, that's why I tried changing extensions

magic number

regular extension

[winged mist]

Try this;
Get your php reverse shell as .php
Include the 6 random letters on first line of reverse shell script
Change magic number to that of ||gif ||
Then upload

[sonic belfry]

Overpass 3, fun box. Found the web flag last, though. :p

[normal olive]

oh you mean like in the example when they use ||AAAA||?

[winged mist]

Yes

[winged mist]

That of gif isn’t 4 letters for the records

[candid gulch]

Anyone solve EnterPrize? If yes, can you please drop a hint?

[median compass]

we're not allowed to hint for 72 hours after the drop of a new box, sorry!

[candid gulch]

72 hours is over

[median compass]

how's that? didn't overpass3 only go live yesterday?

ahhh, lol, sorry, read it wrong

doh!

[candid gulch]

Nvm

[median compass]

i didn't finish enterprize yet, sorry

must go back and try again

[stuck fractal]

0day did that too, first person to complete the whole room

[normal olive]

got it now, thanks for the tip.. I believe that it's better if you add the first letters as placeholder, since I just changed it, it modified the initial tag of the script|| <?php|| therefore the website didn't interpreted as code.. learned one more thing today! thanks dude!

[winged mist]

No worries bud. Pleased to help & learn too

[white salmon]

anyone is working on overpass 3 room ?

[warm spire]

yes

[white salmon]

i hacked the machine but i cant find the flags any tips ?

[warm spire]

try harder :d

[median compass]

too soon for hints on that one i'm afraid, not allowed for 72 hours after drop

[white salmon]

Hi guys

[white salmon]

haha the ugly part is i did the hard part and im in 😛

[warm spire]

i would say the hard part is to priv esc not getting in

[white salmon]

can anyone give me a hint on "Madness" ? i have a username, "ROTed" it and try to use the password i already used before to ssh on the machine. looks like the PW is wrong and i have no idea where to look

[white salmon]

i know how to priv to root from james

but i cant find the apache flag

I found the apache flag but I'm not able to login as james 😦

[ancient island]

i just can’t find privesc to james, i know how to get root, but not how to get james

or i am just wrong

[spring ember]

Banging my head against the wall on Enterprize 😂 something small I must be missing

[woven mirage]

overpass 3 is new people, lets ask for hints and help after 72 hours have passed 😄

[white salmon]

Web Fundamentals, task 5, question 3. I'm having trouble finding the flag. After doing the GET request for a cookie, I check in Firefox's dev tools but don't find anything helpful

[woven mirage]

send screenshot of your browser, showing the url and with devtools showing cookies

on the webserver running on the victim machine

don't show your cookies for other sites

[white salmon]

This is from the browser-based AttackBox. Used curl for the get request, so the URL bar of Firefox should be irrelevant if I'm not mistaken (on default home page of THM)

[woven mirage]

if you used curl, the cookies wont be added to your browser

but you can probably see the set-cookie header in the response if you use the -v flag, to get more verbose

[white salmon]

That did the trick, thanks!

[white salmon]

ugh, now I'm struggling with question 4. The mozilla documentation on Set-Cookie seems to assume the format will be in HTML docs, so I'm not sure how to structure my curl command

[stuck fractal]

For setting a cookie for curl?

[white salmon]

yes

[stuck fractal]

I uh

Googling is 90% of hacking

Get the practice in, get fast at it

[white salmon]

good point, I should know better and I suppose my brain is just a bit lazy after the work day I had. Thanks for the reminder of a basic truth

[brave holly]

Overpass 3

Man

already tried everything

[white salmon]

Any reason why when I run hashcat to crack a service ticket, it runs but doesnt output the password?

I made sure my command is correct and all that

[stuck fractal]

That room isn't up for hints yet. You haven't tried everything. The room will be up for hints 72 hours after release

[brave holly]

James how to escalate to you)🙃

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[white salmon]

Is this applying to me??

[stuck fractal]

No.

[glacial gust]

what kind of service ticket

[white salmon]

Kerberos 5 TGS-REP etype 23

[glacial gust]

could be the wordlist you are hashing against doesn't have your word

[white salmon]

Im using the wordlist provided by cryllic which im guessing has the password

[glacial gust]

which room

[white salmon]

Attacking kerberos

Kerberoasting section

[glacial gust]

you may have a wrong hash or formatting then, should work just fine

[white salmon]

Okay ill check my hash formatting

[summer sonnet]

can anyone help me for room Overpass 3

[glacial gust]

please wait 72 hours after a room release before requesting hints

[summer sonnet]

ok

thanks

[ripe hedge]

I think I know how to crack overpass 3 but I can't figure out how 😦

[oblique cliff]

sudo su

[ripe hedge]

ha

p much

naw, I found something interesting

[stuck fractal]

oi

[oblique cliff]

Yes james my luv?

[ripe hedge]

but it's not working for me

[glacial gust]

I am 1/3rd in, the other 2/3 are messing with me

[ripe hedge]

yeah

😦

[glacial gust]

but this room is gonna be full of questions in 2 days

[stuck fractal]

good

[ripe hedge]

I'm getting yelled at to go to bed

[oblique cliff]

Yell back

[ripe hedge]

haha

[oblique cliff]

Tell them blob is telling you to be more blobular

And you do that by completing overpass3

[ripe hedge]

maybe tomorrow, I'm missing something really stupid

[glacial gust]

I bang on it for a few hours, then THM tells me I'm outta for that box

[white salmon]

has anyone done the new enterprize box?

[remote gate]

try different wordlists with dirsearch if you haven't found anything

[white salmon]

i swear like i've used 20 different wordlists from seclists and nothin:(

[remote gate]

i looked and there's a handful of wordlists in seclists that should return results

[white salmon]

yeah, 4 dirs which are forbidden, ran again on those and nothing showed up, imma try again harder, maybe put some extensions, who knows ^_^

[remote gate]

have you added enterprize.thm to your /etc/hosts?

[white salmon]

yup

[remote gate]

try some more file extensions

[white salmon]

php,rar,ssi,sh,old,txt,html,zip,htm,cgi that's what i've used

idk why's old there, but in thm boxes you never know lol

[snow crest]

overpass3

omg!

im totally stuck after getting the web flag

and no writeUp yet

some hint?

for the user flag?

[cedar axle]

72 hours

[white salmon]

Find all files in the /usr/bin directory (recursive) that are owned by root and have at least the SUID permission (use symbolic format)

If I'm right, I think it's find /usr/bin -type d -user root -perm ####

I don't know what the last 4 letters are

the # things

[bronze marsh]

symbolic format = "-x=x" - ever seen this?

[white salmon]

Nah

first time seeing that

Actually I may have seen it but I forgot it a long time ago

[bronze marsh]

when you google suid permission symbolic format you will find something like this -> "-u=s"

[white salmon]

Thx

I got the answer

[bronze marsh]

👍

[teal cedar]

quick question

is this
wfuzz -c -z file,wordlist -d "date=FUZZ" -u 10.10.174.10/api/site-log.php --hc 200
the same as this
wfuzz -c -z file,wordlist 10.10.174.10/api/site-log.php?date=FUZZ --hc 200
?

[stable jay]

Hey ya'll, working through EnterPrize and feeling a little bit at a stand still. Any nudges for foothold?

[cedar axle]

GET v POST

[slate moat]

Anyone for PE on Delivery??

[old lava]

can I get a nudge on enterprize?

[glacial sapphire]

Hi all. I'm doing the owasp top 10...currently working on the injection practice... did anybody else have an issue with identifying shell and version of ubuntu?

what I've input is "wrong" but it's literally the output that I was given

Kind of scratching my head trying to figure out why that would be.. I match the format and all

[wide lagoon]

Exploiting telnet
I have been following multiple walk throughs and none of the commands are working in the terminal, I am unable to connect via telnet using the following: telnet 10.10.63.130 8012
Error msg reads unable to connect to remote host: connection refused. Any tips will be much appreciated cheers.

[whole holly]

any nudge on overpass 3

trying to perform lateral movement to ja*es user

[wintry yarrow]

@whole holly no hints or help are allowed for new rooms till 72 hours pass.

[whole holly]

okey

[candid nimbus]

Enterprize- there are some hints further up about trying different word lists and extensions. Don't know whether they get you anywhere. FWIW I have been looking at 403 bypasses and client-side authorisations for the port that sends a ACK-RST response as that's something the designer seems to have worked on, but from those hints I'm guessing those may be dry holes, and it's more a case of battering the word lists?!

[old lava]

I've only found 2 files, and I can do nothing with them.

[candid nimbus]

That's two more than I've got, but then I'm at work and will have another go later.

[old lava]

I did find something interesting but I can't ... really do anything with em.

[candid nimbus]

Interesting, thanks. Afraid I can't help with that till I've caught up!

[candid gulch]

Enterprize is killing me

What do I even look for?

I've thrown wordlists, a lot of them, but got back nothing interesting

A nudge please, dear room creator?

[cedar axle]

after the 15th wordlist i just gave up, fuzzing is my least favorite thing

if i can see the goal, ill figure the rest out

i would suck as a blind person

[austere ingot]

anyone doing overpass 3

[trim haven]

Cannot give out hints until 72 hours after release :) @austere ingot

[austere ingot]

hahahaha damn its supposed to be teamwork

[candid gulch]

Same here :(

[white salmon]

@austere ingot yes

anyone (else) having a problem with "nfs - no route to host" ... any advise on that, please 🙂

[trim haven]

Overpass 3 by chance?

!rule 15

Whoops

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[white salmon]

Yes. I think we are not breaking rules here as room is over 72 hours old ... I think ...

[trim haven]

It says after release

I wouldn't bring up a rule if it did not apply ;)

[eager bramble]

Assuming it's allowed to set up a group to work on overpass3 together?

[trim haven]

If a group of friends are working on a room, we cannot do anything about that. Whereas if someone is sharing hints without the owners permission, you may get in trouble.

[eager bramble]

Yeah that's fair, just thought as so many of us are stuck on the room might be cool to get together and give it a punt as a wider group

[trim haven]

No

That's literally just the community working together

[ripe hedge]

Oh bloody hell I just got a stupid idea for overpass

[trim haven]

Which is the purpose of the help chats

And thus completely goes against the rule

[eager bramble]

Oh okay, fair enough :)

[trim haven]

72 hours is not that long :D

[eager bramble]

Depends how eegar you are 😅😅😅

[agile jewel]

then can share hints about enterprize?

[trim haven]

It says 1 week in the room

Not sure if that applies to hints

[agile jewel]

need respect 0day then him finish both in few times 👀

[white salmon]

when exactly is it going to be 72 hours for Overpass 3? Currently it says that room is 64 days old.

[agile jewel]

tomorrow

[trim haven]

#announcements message

[ripe hedge]

darn, my idea isn't working 😦

[coarse hornet]

+1

[stuck fractal]

The room is not up for hints yet. Please follow rule 13. I will start banning people from the room if they don't have the patience to wait 72 hours from release

[ripe hedge]

ha!

bash-5.1# id
uid=1001(paradox) gid=1001(paradox) euid=0(root) egid=0(root) groups=0(root),1001(paradox)

@stuck fractal you are bloody evil

and for those stuck, try harder 🙂

[coarse hornet]

I don't know what you're talking about, no one is giving clues, I just put +1 it's not bad

Haha

[stuck fractal]

They stopped when asked. You added to that. Please don't argue.

[coarse hornet]

Calm bro, I don't want any problems, I won't do anything

[stuck fractal]

Not your bro.

[coarse hornet]

❤️

[eager bramble]

Yeah sorry for asking for hints as well before, hope you're well. It's a really intresting room, look forward to the write ups coming out

[soft geyser]

is this suppose to take this long? anyway around this?

[glacial gust]

that's an estimate time, it will change

[soft geyser]

its been 10plus minutes though

[trim haven]

@soft geyser Ty refining your search; nmap -T4 -p- <MACHINE_IP, nmap -T4 <MACHINE_IP>

If the second one takes long, there's an issues with the attackbox/ box you are attacking.
These do not perform any type of detection although so you may wanna do another scan in the background while you are investigating the ports found.

[soft geyser]

doing the T4 did it instantly @trim haven

do you know why that is?

[trim haven]

Hmm, which room is this?

And which command?

[soft geyser]

networkservices2

nmap -T4 ip

[trim haven]

So that scan completes (iirc) 1000 ports

[soft geyser]

i was having the same issues in the onebefore this too.

[trim haven]

And -T4 is the quickest you can make it without getting false positives

-p- scans 65,000 ports so that one usually is not instant

[soft geyser]

hm

ty!!

[past mulch]

when can i get a hint for overpass?

3

[astral smelt]

in about 24 hours

[past mulch]

thx

[stable jay]

Hey guys/gals, anyone have any advice for foothold on Enterprize that I could pm?

[ripe hedge]

Good luck and try harder

We're not allowed to divulge.anything for a while

As per the room creator's request

[glacial gust]

[trim haven]

👀

[stable jay]

What a strange mentality. To tell someone to try harder when you have no idea what they've even done is just rude. That childish l33t attitude is what will push people away who are actually here to learn with each other and not act like they are a god.

[trim haven]

Hey @stable jay Please do not try to start drama.

[ripe hedge]

creator explicitly forbade help until next week

[trim haven]

Hydragyrum is respecting rule 13

[ripe hedge]

if it's any consolation I'm throwing my face against that wall as well...

[trim haven]

@pine gulch Your reactions also are not necessary. Please stop.

[pine gulch]

freedom of speech

[glacial gust]

even 0day said he had a little trouble with the host

[ripe hedge]

yeah it's meant to be hard

[stable jay]

nice hint

thank you

[woven mirage]

wat

[inland onyx]

Not in here there isn't. Don't be a twit and we have no problem

And just to make sure of that

[pine gulch]

Its an emote

[inland onyx]

-mute @pine gulch 5m Don't be rude

[green minnow]

🔇 Muted pbot#9377 for 5 minutes

[inland onyx]

This is designed as a challenge box. As per the creator's wishes we are restricting the hints that get given on it for the time being. There are plenty of other walkthroughs and challenges available in the mean time. Hints/writeups will be released in due course for that one 🙂

As you say, there are definite gains to be made by working together with people to solve challenges -- this is one of the fundamental goals of the platform. As it stands, that particular box is not designed for that -- not yet

[ripe hedge]

yeah I'm not good enough for that box yet 😦

[coarse hornet]

finally god

Haha

[stable jay]

@coarse hornet Overpass 3?

[ripe hedge]

looks it

[stuck fractal]

God what did AWS do to my hostname

[coarse hornet]

Yep

[stable jay]

Nice well done

[pine gulch]

Great Job @coarse hornet

[coarse hornet]

+1

[coarse hornet]

Thanks bro

[glacial gust]

I saw that, thought it was weird

[ripe hedge]

it's the default aws thing iirc

might be due to the os

[stuck fractal]

Yeah I think it's just AWS being mean

[pulsar harness]

Congratulations Skynet

[glacial gust]

looks like it changes your whole host config too

[stuck fractal]

huh?

[glacial gust]

aws, I was hoping to find a hidden gem for your room there

[wooden compass]

https://www.tryhackme.com/room/basicmalwarere

I can not unzip the zip files in this room (I click the zip files on Mac OS X with password input, but nothing happens.) Does anybody know what is wrong?

[regal tendon]

hey, anyone want to give me a hint for overpass 3's web flag?

i have user and root already, but cant seem to find the web flag haha

[glacial gust]

I don't think any of the files have passwords on them, just straight unzip

[ripe hedge]

if you have root, it should be trivial to find

[regal tendon]

you would think so

[wooden compass]

But it says "Password for the ZIP is MalwareTech."

[ripe hedge]

you should be able to find it

[regal tendon]

found it ha. the hint threw me off

the hint is actually wrong, says its owned by the apache user. it is not 😄

[ripe hedge]

the hint is fine

[glacial gust]

sorry was thinking of the other room

[regal tendon]

that 'sorta' isnt good for find -user apache 😄

[stuck fractal]

Should be super super easy to find from your initial shell, but no help or hints yet. Rule 13 says no help/hints for 72 hours from release

[ripe hedge]

it's easy to find, just not that obvious

[regal tendon]

got it thanks. just out of interest, how is that 72 hours presented on the site? overpass 3's 'more' tab says its 65 days old

[stuck fractal]

It's not presented on the site

[ripe hedge]

72 h since release

[stuck fractal]

#announcements

The 65 days is from when I created the room. Not uploaded the VM, not released it, but when I created the room on the site

[regal tendon]

ah

[glacial gust]

not sure if you host if removing the files as possible malicious

[wooden compass]

I don't know. But I try the command line. It seems that 'unzip` has some problem with the compression method of the zip file.

$ unzip -P MalwareTech strings1.zip 
Archive:  strings1.zip
   skipping: strings1.exe_           unsupported compression method 99

[glacial gust]

I see what you mean, I got them to unzip from the folder correctly

I did find this "The compression method 99 refers to Adavanced Encryption Standard encryption, which is not supported by unzip. However, you can use 7zip to unzip your password-protected file"

if you install 7zip you can unzip the files though

[coarse hornet]

Has anyone solved jvm reverse engineering?

[astral lance]

im on EasyCTF room and it says ssh is open however i cant even ssh to it. my syntax is right

its on port 2222

[stuck fractal]

What happens when you do?

[astral lance]

it just hangs

does nothing

ssh x.x.x.x -p 2222

hangs

[stuck fractal]

ssh -p 2222 user@ip

The order matters, because anything after the IP is a command to run on the remote machine

[astral lance]

still just hangs

[stuck fractal]

Do you have creds?

[astral lance]

not yet. however with ssh, if its opened, it woulda worked no matter what right? from my experience anyway thats how its been

[stuck fractal]

Depends what you mean by that

[stable jay]

I've used ssh user@host:port or ssh user@host -p <port>

[stuck fractal]

Honestly I'd check your VPN but if other services are working then ¯_(ツ)_/¯

[astral lance]

ok any other good ctf pentesting boxes thats not a peice of crap?

[stable jay]

Why is it a piece of crap? Generally it's user error somewhere. There are lots of good ctf boxes.

[astral lance]

My ssh worked on other boxes on my network. I can't figure out the ssh other than its not meant to be ssh into even tho nmap says it can@stable jay

Still opened to solutions ofc

[stable jay]

did you try the other ssh formats I posted?

also, Right. I get that. So, I'm not commenting on the box you are on specifically but sometimes just because it's open doesn't mean you can access it

sometimes you'll need a key for example and will get permission denied if not

There is nothing wrong with the ssh on the box you are on, just need to try different things

[inland onyx]

Yeaaaaah, you need either creds or a key there mate. You can't just access it because it's open

[stable jay]

yup

[astral lance]

So generate a key?

[stuck fractal]

Not yet

-mute @stable jay 20m Follow rule 13.

[green minnow]

🔇 Muted professor-moody#3884 for 20 minutes

[stuck fractal]

@mint copper Please stop asking

[mint copper]

No problem

[inland onyx]

-undelete -a

@stuck fractal did he ask again?

[astral lance]

Um whats happening lol?

[stuck fractal]

Someone's in trouble

[astral lance]

Ty so much everyone. I'll try it tomorrow. I'm worn out from cyber all day lol

[clear cargo]

someone already finished overpass 3?
I finished it, but I have a question about the priv esc

[bronze marsh]

I did it

[wintry yarrow]

No hints or help are allowed for new rooms till 72 hours passes.

[candid gulch]

Can anyone gimme nudges of EnterPrize?

[agile jewel]

need wait more 7 days to give hints about enterprize

[cursive star]

Let me see what I can do. I will get back to everyone here soon.

[cursive star]

☝️

[latent jungle]

Hi Team I need one Hint on this - I cant find name of scan as such in Advance Tab of Nessus Room

FYI

[latent jungle]

Please Ignore Got it

[rich shard]

Hi guys, I need help to find the right syntax
in the Task 7 of What the shell? room

I cannot figure out what I need to put in : (EXEC: ...)

my synthax so far => socat OPENSSL-LISTEN:53,cert=encrypt.pem, verify=0 EXEC:"...", raw, echo=0

[pure thistle]

your trying to get a shell so i would guesss thats where you would put the /bin/sh

or whatever shell you are trying to invoke

[neon summit]

https://tryhackme.com/room/rust ~ Task 12, Question 2.

I simply do not understand what is being expected. I believe the answer lies somewhere in the result<> format, but i do not know what to put inbetween <>. The documentation is not clear (to me) about it.

Yes, there are examples mentioned with the <> symbols used, but i do not see the relation, nor the application for this question.

A nudge in the right direction or a page that clarifies this subject would be greatly appreciated!

[cursive rover]

Hey everyone

Im stuck in the overpass3 room . I would enjoy a little hint if someone can ! Thanks !

[stuck fractal]

@cursive rover Not yet.

Come back in like 5-6 hours.

[cursive rover]

Oh okay

But why in 5 - 6 ? Something happens ? Or there is any rules ?

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[stuck fractal]

That last bit.

72 hours from release - no help or hints.

[cursive rover]

Aaah yes that's right

[stuck fractal]

We're still in that 72 hours

[cursive rover]

That's a new challenge I'm sorry

Forgot that fact

Thx anyway !

[little sable]

I'm lost on Task 29 of https://tryhackme.com/room/25daysofchristmas I managed to get the password but I don't know what to do with it. Any tips?

[neon summit]

@little sable Perhaps u can use the password for another user on the system? (dunno)

[little sable]

facepalms.

[paper seal]

what exactly am I supposed to do when the terminal tells me to fnum 1?

[stable jay]

I'd look up the function of fnum

[paper seal]

Checked it out - didn't understand a thing

[hexed crescent]

Which THM room?

[paper seal]

Network services; task 4; question 3

Honestly now that I'm asking about the whole thing, I'd rather ask in the room-help channel, because I need help (a lot of it)

[frozen crane]

anybody is available for a hint on Enterprize?

[astral smelt]

No hints yet the creator wants at least a week before giving hints please wait two more days

[frozen crane]

bruh

k

[white salmon]

Can i have a nudge for Jeff? I found ||wordpress.jeff.thm|| i don't know what i can do

[neon summit]

i haven't done it. was i right? :P

[little sable]

no idea. no time to look yet. work day

[neon summit]

@white salmon Perhaps u can scan the Wordpress version for vulnerabilities, or perhaps login is another user?

[white salmon]

I use wpscan and i don't find something interesting

[glacial gust]

what options are you using for your wpscan

[white salmon]

I get reverse shell

[paper seal]

I got stuck at Network services task 4 question 7
The instructions bellow said question say that ||the authorized_keys are to be downloaded|| However I lack the permissions to do so.
How am I supposed to bypass this?
(Pls tag me, for I won't be checking this channel, but will rather think of a solution to my problem)

[winged mist]

I don’t think you need sudo or “any perms” to download the file really. Anyway you are in smb right? For clarity

[paper seal]

Yes, smb

[winged mist]

You should only change the permission of the file after you download to your machine

[paper seal]

Yes, that's what's said in the task

However when I try it prints out the following:

Will insert screenshot in a moment

[winged mist]

Yeah follow the steps in the task & change permission then use the file & get access through ||ssh||

[winged mist]

Did you download the file from smb to your machine yet?

[paper seal]

No, I'm being greeted by this upon trying

[winged mist]

That’s weird. Any way can I get a full ss of this page as you sent it & of previous dir cus it’s been a while I solved the room

[paper seal]

You want the ||Shares||?

[winged mist]

The directory before this

[paper seal]

Ah, nvm yes

Just a sec

[winged mist]

Ok

[paper seal]

And that's the ||ssh|| directory that you also asked for

[winged mist]

Ok try moving to the ||.ssh|| dir then see the files there then get id_rsa <newfilename.txt>

@paper seal

[paper seal]

What will that command do exactly?

[winged mist]

It’ll get the file then rename it as the new filename you’d give

Also don’t forget to get the ||pub key too||

[paper seal]

This one I don't know what to do with

I downloaded it a few minutes ago, but there's no software suited for reading it

[winged mist]

Almost Same thing. Get, rename then inspect this one for an information

[winged mist]

||cat||

[paper seal]

Why am I like this...

[winged mist]

Kek. Lmk how it’s going

[paper seal]

Well

I ||cat-ed the pub one and found half of the infomation, rn I am looking for a password or someting in the other file...||

[winged mist]

Wrong.

Big spoiler but I’ll minimize it kek

Ok

[paper seal]

I am lost, so I've got no problem with that

[winged mist]

The ||pub|| has a username for you. Also no need for password. Just change the perms of ||id_rsa || (ofc you renamed) then use it to ssh with the username you find in ||pub||

[paper seal]

That makes sense

Why am I like this?

I was thinking earlier about some of that... but got confused and forgot about all this

[winged mist]

Kek it’s ok. We learn

Gotta go now. Be back in a bit

You can ping me

[hazy rune]

Im having issues with task 4 of network services using smb client, I am putting in the correct info but I can't seem to get into the share

[paper seal]

Which question?

[hazy rune]

Lets see if our interesting share has been configured to allow anonymous access, I.E it doesn't require authentication to view the files. We can do this easily by:

• using the username "Anonymous"

• connecting to the share we found during the enumeration stage

• and not supplying a password.

Does the share allow anonymous access? Y/N?

[paper seal]

I'm on the exact same task

[hazy rune]

this is my syntax

smbclient//10.10.212.13/profiles -U Anonymous

[paper seal]

Ah

I did the same

[hazy rune]

ive even tried to specify a port and nothing happened

[paper seal]

You need to put a space between smbclient and /

smbclient //10.10.212.13/profiles -U Anonymous

[hazy rune]

that did it, thanks. linux is so picky haha

[paper seal]

Just wait until you move down a few questions (I'm here because of them)

@winged mist , I didn't get something right with the ||id_rsa||

[stuck fractal]

Spaces separate arguments. It's the same in windows

[hazy rune]

thanks for the info

[hazy rune]

youre right, im already stuck but ima try some stuff

[sour vector]

May I get a hint for the user flag for Overpass3 if the 72 hours period is over pls?

[hazy rune]

what did you do to get the username

I ls to see the contents but I cant change dir

[paper seal]

Dirs are changed with cd

[hazy rune]

i found it thanks

[ebon cairn]

hey can I get a hint on how to get the user flag in overpass3?

got the webflag

having trouble with user

[stuck fractal]

@ebon cairn Not quite yet

[ebon cairn]

oh

[stuck fractal]

Another hour or two.

[ebon cairn]

sorry

okok

tyty

ill come back in one or two

👍

[coarse hornet]

someone finished the hacker methodology?

[woven mirage]

ask your question

[glacial gust]

good room

[stuck fractal]

Is that room public?

[coarse hornet]

I'm about to finish but I'm stuck on question 2 of task 5 is the only one I'm missing

[paper seal]

@winged mist, could you DM me, when you're back, because I'll also be going for some time and don't want the convo to be lost in time?

[coarse hornet]

I can't get it

[stuck fractal]

Oh it's brand new ok

[coarse hornet]

Yep

[woven mirage]

read the task again, the answer is written in it somewhere like SSH ____

[coarse hornet]

Yup I have it thanks room finished!

[winged mist]

Henlo

I’m back now

[winged mist]

You around ?

[white salmon]

can you put it as a spoiler please hehe

[desert talon]

how do i do that?

[white salmon]

um || ||

like this

[desert talon]

lol

i might have figured it out

[white salmon]

ye

[desert talon]

if not ill add it as a spoiler

[white salmon]

i think when you upload pic there is a check button asking if you want to spoiler it

[desert talon]

yep i see the option now, thanks

[white salmon]

by the way || https://gchq.github.io/CyberChef/ ||

this should help you

with your problem

[paper seal]

I am here now @winged mist

[winged mist]

Ok how far now?

[paper seal]

Well, I had (bc the VM has terminated itself) The User and the ||id_rsa with the permissions for me to read and write||

However I can't find use of it

[winged mist]

Deployed new machine?

[paper seal]

Just did so

Getting the files back

[stuck fractal]

They're not dynamic

[paper seal]

Yes, I'm just doing everything again

I'm doing as said in the task - ||ran chmod 600 id_rsa||. However I don't think that anything has changed for it

[stuck fractal]

What do you think will change?

[paper seal]

That i'd be able to view the file via cat or the GUI?

i have no clue what to do with this ||key||, honestly

[stuck fractal]

It's an SSH key

[winged mist]

Look for a way to ssh with a private key

& that’s it

[paper seal]

Many, many thanks

I'll need to improve my knowledge around this however, that was amazingly frustrating

[winged mist]

You finished?

[frozen crane]

anybody how to fix this mistake ? mount.nfs: requested NFS version or transport protocol is not supported

been doing overpass 3

[stuck fractal]

It's NFS v4 only

[frozen crane]

how to do it lol?

been struggling

[stuck fractal]

I'm not gonna tell you exactly how to do it

This is the hints channel

Just look up how to ||mount an NFS v4 share||

[paper seal]

yes

[winged mist]

Ayyy congrats 🍾

[paper seal]

Thanks 😅

[ripe hedge]

That's already a huge hint

[native oyster]

In OP3 do you have to move to james first, or straight to root?

I've tried for quite some time but couldn't find anything for that

I know how to get root, but I'm not sure if it works with paradox

[stuck fractal]

||To james, kinda. If you're thinking correctly, you can do something using the paradox user that will get you closer to your goal||

[native oyster]

|| I tried mounting /home/james with sshfs but it was empty afterwards||

[stuck fractal]

You don't have perms, do you?

Their homedir is private.

[native oyster]

yeah

[stuck fractal]

So why would you be able to read it using that tool?

[native oyster]

wasnt sure how some of the mounting options work, so I thought it might be possible

[stuck fractal]

LinPEAS should highlight something

Combine that with the fact that ||CentOS has a default firewall that's very strict, you have to explicitly allow services||

[native oyster]

|| is it apache logrotate?||

[stuck fractal]

No

[white salmon]

Regarding Overpass3, any tips on how to deal with "nfs: no route to host" error please?

[stuck fractal]

Maybe you're using the wrong IP? Maybe you ||didn't forward it correctly||?

[white salmon]

i used machine IP:shared/folder ... but to me it seems strange, as if nfs is not running since nothing on port 2049 ...

[stuck fractal]

Hmm, that's intentional

Keep trying

[ebon cairn]

hey james, does the port are setted to not be found by scanner(rustscan, nmap)

[stuck fractal]

No.

[ebon cairn]

hm okay thanks

[ripe hedge]

Firewalls are meanies

[stuck fractal]

I mean it's more or less out of the box config

[white salmon]

||the ssh tunnel should be LPORT:localhost:111 right ?||

[woven mirage]

no

search on google what port does ||nfs|| uses

[nocturne vault]

:))

[white salmon]

Thanks, then I must be doing something wrong, I first try with the default port and failed

[heavy bone]

I need some help with user flag for overpass 3. Can I DM anyone?

|| I see paradox user as the owner of the reverse shell ||

[white salmon]

what did you try so far?

[stuck fractal]

@heavy bone It doesn't belong to that user, you need to keep escalating

[heavy bone]

|| I tried to change the httpd.conf file but permission denied, I could not see any suid permissions nor anything in logs ||

[stuck fractal]

Run linpeas...

[white salmon]

how does one make changes to default firewall settings when one is not superuser ... ? Or one doesn't? 🙂

[ebon cairn]

i was just be able to list the zones

and when i try to get more details. it asks for sudo

[white salmon]

yeah, exactly ... guys please, any tips? 🙂

[ebon cairn]

im thinking if we can find what port it allowes to connect to

[nocturne vault]

Pretty sure you can't change firewall rules without sudo privs

[ebon cairn]

maybe we can forward nfs to that port?

yeah

so def not the way to go there to change the firewal

more like forwarding?

[nocturne vault]

😉

[ebon cairn]

sooooo hmmmm

i got an idea

[nocturne vault]

gogo, i believe 💪

[white salmon]

||I did the ssh tunnel LPORT:localhost:2049, but when I try to do mount -t nfs4 -o port=LPORT localhost:/home/james/ $mydir/ it keeps failing with an error about the NFS version or protocol, I tried with "-t nfs -o v4,proto=tcp,port=LPORT" and "-t nfs4 -o proto=tcp,port=LPORT" with the same result||

[coarse hornet]

Use chisel

[coarse hornet]

That's wrong

[white salmon]

@coarse hornet which part?

[nocturne vault]

||read about fsid=0||

[coarse hornet]

Nfs

[white salmon]

Thanks, looking at it

I'm stuck on CTH level 2 how you can add the rule in john ripper .config

[coarse hornet]

-o port=etc

[near shoal]

this here is the secret sauce...

[barren rapids]

Read the text again

[white salmon]

Finally got the user flag on overpass3 , now time for the root one

I’m probably having a super small brain move but could someone point my in the right direction in this MITRE room? Task 5, last question “what two programs do adversaries look for” concerning detecting if they’re in a virtualized environment. I’m looking at the ATT&CK framework page and just don’t see any programs named specifically. Probably just over looking it

[winged mist]

Yeah I think you’re overlooking. It should in the same page with different wording or a link or 2 iirc