room-hints

[serene flax]

what if the password was on the last line of rockyou

[ripe hedge]

smb was being too wierd

[serene flax]

it would have taken forever

[ripe hedge]

would've looked for something else after about 30k

or 10 minutes

[serene flax]

yes exactly

but with the hash we can use the whole file

[ripe hedge]

yeah

ok I see your point

[serene flax]

i had a shell and was running crackmapexec on the background and i got the password for achilles who was a admin

i was also little bit suprised

I had two shells from port 80 and 81 and running bloodhound

but did not need any of that🤣

[near shoal]

How did you look at the SMB btw, I was getting nothing out of it at first.. dunno why maybe I should have waited a bit longer...

[slender wyvern]

lunizz... finally got this f... password 🙂

[serene flax]

i didnot look into it. I just bruteforced the password for smb using crackmapexec

[near shoal]

ah, kk

good to know, good to know

[lost crag]

I took the advantage of SeBackupPrivilege.

[serene flax]

which user had that privilege? @lost crag

[lost crag]

achilles

[serene flax]

it is easy once you get the shell as achilles as it was on the administrator group

we were actually talking about the intended way to get a shell as user achilles

those who tried bruteforcing the password for user achilles dont even need to exploit the webservers for any kind of foothold

[storm venture]

admittedly without the flag hints, you wouldn't have known achilles was a user there

unless you fuzzed for usernames, but it's hardly the most common username

and I feel like doing the intended taught me a lot more 🤷‍♂️

[serene flax]

At first i got shell for two users exploiting the webservers and as i was finding that the user achilles was administrator as well as kerberoastable, I got the result from the crackmapexec as it was running on the background. I have shown both ways on my writeup though.

as @fervent python always says it is always beneficial to be running something on the background when you are doing manual enumeration

[slender dawn]

hey when I want to bruteforce a user inside of a machine is there any alternative to su bruteforce

cuz for some reason i am getting errors in it

inside of the thm machine only

[lost crag]

For me this time I think It was lost for me.I was trying to execute command from port 81 but eventually I got password for achilles by bruteforcing and I did not even bother after that to get command execution from port 81.

[serene flax]

@lost crag you can read my writeup. I have showed how to get code execution on port 80 and 81. I couldnot get code execution on port 82 though

[serene flax]

is the ssh open on the box?

[fleet cedar]

where do i put the dirsearch/dirbuster

[stuck fractal]

Please clarify your question, because it doesn't make sense

[fleet cedar]

like i have this question use dirsearch/dirbuster to find the hidden directories. and i dont know where to use the dirsearch/dirbuster i found dirbuster and its a bunch of .txt information

@stuck fractal

[stuck fractal]

Room, task, question?

Did you skip the Linux Fundamentals rooms?

[fleet cedar]

probably

where can i find that

its my first time using the website

[stuck fractal]

!docs free-path

[proud scarab]

TryHackMe

What rooms should you do? A free guide for beginners

https://blog.tryhackme.com/free_path

From TryHackMe with ❤!

[fleet cedar]

Task 1 Web App Testing and Privilege Escalation Question 3

btw @stuck fractal can i use kali linux to do this tasks or i always need to use the web console?

[stuck fractal]

You can use Kali, but I think you need to learn how to use Linux first.

[fleet cedar]

okok thx

[slender dawn]

@serene flax i am not bruteforcing the ssh login

i am bruteforcing the su login inside of the box

to get root

but yeah ssh is open

[serene flax]

can root user login on the box using ssh?

[slender dawn]

bruteforcing the ssh would take much longer tho

[white owl]

I got in as helen. How do I get Achilles hash?

[slender dawn]

yes

[serene flax]

you can try and bruteforce the ssh password. if it is intended way, it would not take more than 10 minutes

[slender dawn]

i actually did

the hint is we will, we will rock you

so ig that means bruteforcing

[serene flax]

use Rubeus @white owl

yes i guess so

which room are you doing? @slender dawn

[slender dawn]

Tony the tiger

https://tryhackme.com/room/tonythetiger

i have done the java deserialization part

i am in task 7

[serene flax]

I havenot solved the box. maybe those who have done it might be able to help you

[slender dawn]

thanks for your reply tho

[serene flax]

happy to help 🙂

[white owl]

Thanks I'll check it out

[mint quest]

Remedial question: I'm on the tutorial and I'm unclear on what the format of the flag text should be. I enter the IP address in Firefox, get a 405 error, and that's it.

[ashen scaffold]

Format should be provided in the answer slot

[stuck fractal]

Wrong IP then

[mint quest]

So, it's supposed to be the IP address from 'Active Machine Information' rather than the IP address at the top of the AttackBox?

[ripe hedge]

Yeah that'll help

[mint quest]

Thanks!

[digital iris]

the IP in the "Active Machine Information" section is the IP of the machine you just deployed, and the IP at the top of the attack box is your IP

[mint quest]

When I entered the IP from the 'Active Machine Information' section, it displayed the flag text instead of the 405 error

[digital iris]

yes that's correct

[ivory glen]

any idea on when we can expect writeups for Hacker of the Hill #1?

[slim axle]

Any hints on root flag for HOTH easy box? Or writeup soon? I got a shell pretty quickly and then hit a wall trying to privesc.... Don't know what I'm missing here.

[ashen scaffold]

Perhaps checking out cronjobs can help?@slim axle

[serene flax]

I have already submitted the writeup. waiting for the creators of the room to verify it.

[serene flax]

there are multiple ways to root that box. have you tried running linpeas?

[ivory glen]

would it be possible to send it or would that be against tos/morals?

[serene flax]

well it is public on my website.

[slim axle]

I did, but don't see anything (or don't know what I'm looking at lol). I just got into THM like a month ago. I dug around looking for creds, checked out SUID, thought I found some exploits but couldn't get anything to run, etc... I'll keep at it.

[serene flax]

as which user do you have the shell currently?

[vast rain]

looking for a hint in the Burp suite room, trying to find a request in juice shop that issues a 'Set-Cookie' parameter in the response header. Anyone know of an endpoint in juiceshop to visit to achieve this?

[digital vector]

you got the permission ?

[stuck fractal]

#room-hints message

[digital vector]

nice .

[slim axle]

@serene flax I got a shell as serv1 and serv3

[serene flax]

||for serv1 check for the groups that the user in and search for the files owned by the group. For serv3 check the entries on the /etc/crontab and you can find that a script is being executed as root in every 1 minute and check if you can use that to execute code as root||

[slim axle]

@serene flax I'll give it a try. Thanks!

[white owl]

@serene flax can you dm me your website? I'm interested in what i missed on the hard box

[gusty kite]

You tolk the breakout shortcut as well? 😂

[white owl]

i got in to the container on the hard machine with the password and i saw that the docker socket was exposed to it, but i couldn't even get root in that container to use it. i found some vulnerabilities/bugs/weirdness on the other sites on the hard box, but nothing i could turn into code execution

[serene flax]

done 🙂

[gusty kite]

There is a way to get to a fully exposed docker socket on another container. From there it is easypeasy to get all flags.

[white owl]

yeah if i could have written to it i would have created a docker that mounts the host system, dropped in an ssh public key into root, and then with root on the host i could use docker exec -it to get into the other ones

[serene flax]

this privesc was possible from the container which was running the service on port 80. I also tried to get root on the container that you were in but the code for that flask server was almost similar to the one of the documentation page except a minor change. So I tried for a while to get root and left that container

[white owl]

that was a good writeup

[gusty kite]

I am looking forward to seeing writeups on how to get flag 1-3 the proper way 😂

[serene flax]

Thanks 🙂

[serene flax]

I have tried to show the intended way as much as i can. As the writeup was pretty long already, so I did not show few privesc techniques for the easy room and also for hard room.

[eager vale]

Question on the writeups of Lunizz: people are building their own python script (https://apjone.uk/tryhackme-lunizz-ctf/) to crack the password, however, I believe that what the script does is exactly what (for example) hashcat does when performing a dictionary attack. Am I crazy here? Why would someone reinvent the wheel? Plus with python? lol

[gusty kite]

Cool will read it when it comes out

[gusty kite]

Can hashcat base64 encode the words prior to hashing?

[serene flax]

it is out and on my blog. just waiting for @steady stratus to verify the writeup.

[gusty kite]

Ok I usually just wait til it is public on the room page.

[rapid snow]

Hi anyone have solved this room or solving this room https://tryhackme.com/room/bufferoverflowprep

[gusty kite]

yes finished it earlier today. you can DM me with questions if you want.

[ebon cairn]

Is there anyway to get some hint on the room Threat Intelligence question task 3 about the first 3 Network IP address blocks bleongs to?

I just know class A, class B.. etc

[lunar musk]

I think you have to wait some days for hints on that room

Since it has been just published

It's not that difficult though

[ripe hedge]

it's a silly, and poorly worded question

[glacial gust]

@simple mountain need your pin for the new room

[simple mountain]

Oh, cool - Thanks. I thought it was a walkthrough, but that was yesterdays!

Do not provide or ask for help or hints for THREAT INTELLIGENCE room until 6th March, 7pm (GMT)

[ebon cairn]

@ripe hedge I got confused..

[cedar axle]

yeah, that question has me baffled

[simple mountain]

Keep at it, I believe in you, Pood

[lunar musk]

You can do it guys

[cedar axle]

its probably really simple, but sometimes its the simplest things that destroy my brain

[lunar musk]

In fact, I think the question is wrongly redacted... but that's me

[cedar axle]

not sure what you mean by 'wrongly redacted'

[white salmon]

hey, did they change something in Burp? My Community Edition has Sequencer's 'Analyze now' inactive 😦

[stuck fractal]

For the cookies in the burp suite room?

It's a bug with burp

[white salmon]

a ok, thank you

[white salmon]

probably 'wrongly composed' 🙂 in some languages there is a word very similar to 'redacted', which means also 'composed', so English non-natives mix it sometimes (including me, haha).

[cedar axle]

Thanks, that makes sense.

[desert herald]

Working on the linux challenge and it says I need to find flag 3 where the bash history is stored... I don't know where that is. I tried googling and using the command find / -name .bash_history but I didn't see anything that looked like the right directory.

figured it out!

[gusty kite]

You will bang your head against the wall when you realize what the answer is.

[cedar axle]

more so than now?

[gusty kite]

Yeah 😂

[near torrent]

Has anyone here done the Nmap room recently ? Kind of struck on a question. No matter what I do I can't get the required ans. I tried the solutions available online even they don't seem to work

[near torrent]

https://tryhackme.com/room/furthernmap

[near torrent]

Task 14 - Q4 and 6

[gusty kite]

I did it recently

@near torrent I recall that the number of ports came easily from the scan result when limiting the ports to first 5000 and using only SYN scan

[near torrent]

Okay. I will give it another possibly an issue on my side

[gusty kite]

there are 10 possible solutions if you look at the format 🙂

[stark reef]

did you guys change the file in serv3's folder for KOTH #1? I am very bad with vim appereantly

[serene flax]

you can use echo to write on a file. echo whoami >> serv3.txt will append whoami on that file

[stark reef]

ah yes, ofc.. thanks 🙂

[peak cave]

In the threat intelligence room task 3 ques no. 7 ? Anyone help?

[stuck fractal]

@peak cave please see the pins

The room is still under hints embargo.

[peak cave]

Okay sorry @stuck fractal

[native mesa]

Think I'm missing something obvious on this question too.

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[rose cape]

hey everyone, im on goldeneye, task 2 question 2 and im trying to do a dict attack on pop3, however im getting the following error when attempting to run hydra

any help would be appreciated with this as ive had to resort to metasploits very slow bruteforcer

[lime violet]

Have you checked the hydra manual?

[rose cape]

ive googled this error everywhere and havent found anything too helpful

[lime violet]

So maybe don't google the error... perhaps all the info you need is in the error message itself

[rose cape]

?

what use is an error if you cant research it

[lime violet]

Again.. did you read the hydra manual?

[rose cape]

mabye my hydra is an older version?

[lime violet]

That is quite possible... now check the help/options menu. Are there any other options that may potentially be of use?

[rose cape]

hydra is up to date version help menu shouldnt contain anything that the manual dosent alrdy have will check anyway

nothing

[lime violet]

Maybe just try the first half of that command

Sometimes the simple answer is the right one

..sometimes.

[rose cape]

hydra's help is very short and contains nothing too useful besides basic syntax

will try running with -O but i dont think it will fix anything

ok looking at my command it has the -S option because i copied and pasted it from online

very dumb mistake

[lime violet]

Hahaha don't worry you're in good company!

[rose cape]

dont know how i kept missing that flag throughout troubleshooting

[lime violet]

Did that solve it?

[rose cape]

yeah

[lime violet]

Nice!

[split nymph]

hello guys, can anyone tell me please how can I upload a print screen here?

there's no drag and drop and can't find any upload button 😫

[ripe hedge]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[ripe hedge]

follow that

@split nymph

[split nymph]

thanks

[errant jetty]

Can someone give me a hint for flag4 on dogcat?
i literally ran
find / -size +1c -and -size -90c -exec cat {} \; | grep -i THM
and couldn't find the flag

oh well maybe now that i think about it it could be inside a bigger file

jeez, don't help me for now i'll come back later when i failed more

*dogcat sorry

[ripe hedge]

oh

flag 4 is the root flag, no?

[errant jetty]

nope

[dense meteor]

Hello everyone! I need help on the "Intro to x86-64" room 🙂 I'm doing something wrong when checking the value of var_8h for the if2 binary

[errant jetty]

it's the third one, the fourth is probably hidden somewhere in the fs

[ripe hedge]

which flag are you looking for?

[errant jetty]

the fourth

[ripe hedge]

oh right it's not in the container

[errant jetty]

i tough about escaping from the container but i couldn't find anything, i'll try harder thanks for the hint :D!

[split nymph]

Can anyone tell me please why do I get the "?Invalid command" on anything a type in telnet?

[ripe hedge]

there's not supposed to be a space between the c and the 1?

[split nymph]

i've tried. I've tried other commands than ping...they are all invalid

[errant jetty]

try .RUN "ping -c 1 10.10.133.198"

[ripe hedge]

are you sure that you're still connected to the server?

the telnet> prompt is unusual

checking

[split nymph]

no clue

[errant jetty]

try using netcat instead of telnet

[ripe hedge]

naw the room specified telnet

[split nymph]

i am connected to the server. I can use my local machine

[errant jetty]

wich room is that?

[ripe hedge]

I'm spinning up a machine to check

networkservices

[split nymph]

yes, task 7 exploiting telnet

[ripe hedge]

yeah you are not longer connected to the server

there's no prompt normally

[split nymph]

I see. yesterday it happened also. Today I have the same issue

Am I doing something wrong?

[ripe hedge]

exit the client, try reconnecting

[split nymph]

ok, I'll do it...for the 3rd time. I'll let you know. thanks a lot

[ripe hedge]

did you CTRL-C or something?

[split nymph]

ups, yes:)

when I do the tcpdump on my local it runs forever so I stop it with ctrl-c. But even before that the telnet has the same issue

[ripe hedge]

tcpdump is normal

the telnet won't show output

so it's basically blind

[ripe owl]

I am doing linux backdoor room , in php backdoor I have hosted the backdoor but when I access shell.php it ask for downloading it . which is I guess is right. My question is how do I access the cmd parameter

?

[ripe hedge]

it's usually a get parameter, but your server needs to support php for it to work

if it's downloading it, then the php processor isn't setup

[ripe owl]

Ohhh

I have hosted it on local server in attack box

I guess php is not setup there

[split nymph]

I also closed the tcpdump so I can access the telnet. couldn't do the telnet while tcpdump was rolling

[ripe hedge]

it's an apache server or a python server?

[ripe owl]

Python

[ripe hedge]

run the tcpdump in a separate terminal

[split nymph]

👍

[ripe hedge]

well yeah that won't work 😉

[ripe owl]

Will it work on apache server

[ripe hedge]

if it's set up

[ripe owl]

Is thwre any syntax error in this cronjob

Your ip

Forget it

Shit

[white salmon]

Hello, I'm doing the " Threat Intelligence " Room but I'm pretty blocked at this last question ( pic below ) I've read all links provided at the start + googling of course and it seems that I'm missing something but I don't know what, any ideas ? Thanks and have a good day

I'm sure the flag is very easy to get but I know I'm missing something

[ebon cairn]

hey guys can I get a hint on the Windows investigation 2.0 for question

[rose cape]

room goldeneye, task 3, final quest, officer needs help pulling up the aspell spell check feature when creating a new page, heard its CTRL+right click but when doing this i just get firefox's options. any help on getting this gosh darn spell checker to reveal itself would be amazing ❤️

[stuck fractal]

Kind of a guess but that ABC ✅ button looks about right for a spellcheck

[rose cape]

its a strikethrough 😦

[stuck fractal]

Not that one

@rose cape

[rose cape]

ohh 🤦‍♂️

[candid nimbus]

Have to say I wasn't expecting a woop woop when I put the answer in. It's better to think of it as 'what standard defines those addresses'

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[white salmon]

It's my fault, I did not notice it was a new challenge

when doing it

[stuck fractal]

I'm pointing it out, I haven't done anything more than that.

[white salmon]

Yeah I know but I should have verified before asking

But I just found the answer, I've already tried it before but it kept telling me wrong answer, I don't very know why

Anyway thanks again for replying

[indigo acorn]

In the ultatech1 room: The software using the port 8080 is a REST api, how many of its routes are used by the web application?

Can someone give me a bit of guidance on how to proceed? 8080 seems closed to me.

[digital iris]

it might take a while to spin up, give it 5 mins then re-run your scan

[indigo acorn]

I think the question is just wrong. I looked at the writeups and it seems like people just ignore the question asking 8080 and they go with 8081.

Box has been up for over an hour as well.

[gusty kite]

have you considered that 8080 (api) is only accessible from the local host (via port 8081)? I haven't done that particular room but it is pretty common to do it like that

[ripe hedge]

8080 can be open Internally

[cursive sand]

This isn't specifically room advice but i'm working on something and I would like to understand how remote port forwarding works a little more. I think I just need to talk to someone to understand

If someone could DM me or something

[stuck fractal]

#infosec-general

[blazing hare]

hey everyone, i'm a new user of tryhackme, can someone help understand what i should do here please, it's the getting started room

[green brook]

I'm not sure what room that is but you could try the common credentials provided in the description

[blazing hare]

i tried all of them and they didn't work

that's why i'm asking

the room is called "getting started"

[green brook]

The description is talking about a hidden administrator page

I don't think the /login is the correct page

[blazing hare]

oh i see

i found it

thanks dude

[green brook]

No Problem

[brisk pivot]

how can I access sublist3r

?

[storm venture]

you could try install it from github if it's not already on your system

[brisk pivot]

ok ty

[stuck fractal]

I recommend against it, just like the room does. Because you're gonna have to fill out a bunch of Captchas

[brisk pivot]

ok

[steady elm]

Trying to solve Lunizz CTF room, stuck at brute-force password, its been 20 minutes. Can someone tell me approx how long does it take to crack?

[gusty kite]

depends on your computer. I have seen everything from 4 hours to 5 days

[steady elm]

seriously lmao

[gusty kite]

it is pretty much midway in the password file

[steady elm]

idk but would u mind sharing it? I really wanna finish and move on... Like i never would have allowed bruteforce to go this long. Instead i would have stopped and looked somewhere else...

[gusty kite]

I recall it being in the 700.000-800.000 #word

are you bruteforcing or breaking the password using a modified script ?

[steady elm]

i just used this https://zetcode.com/python/bcrypt/ and checking password

[gusty kite]

I do not have the password here anymore but I suspect you can find it in writeups

[steady elm]

i actually took a hint but yeah i am on the right track i confirmed

[gusty kite]

remember the base64 part

basically word -> base64 -> bcrypt -> compare to the mentioned hash. If match, then word is the password

[steady elm]

hmm... i opened but they are hidden lmao

[gusty kite]

I did a multithreaded script and it took me a day to crack it on my normal laptop. I initially used a sudo exploit to just get on with it and continue

[steady elm]

hmm yeah i noticed that path too via writeup. but initally when i found the script i thought of using that but i really didnt like the idea to hide password so below

afterall its not simulating a real life pentest

its a CTF lol

I will follow down the exploitation path from here... but practiced a bit of python too. Thanks @gusty kite

[candid nimbus]

If you pick the right length words out of rockyou, you can get the wordlist down to about 14000 and crack it in a reasonable time

[median compass]

how would you know the right length from the clues you can find? I didn't see any hint of that

tbh I got a hint that the password was 7m in and I used a sed to cut out a chunk of the file and checked that in a "reasonable"™️ time

[candid nimbus]

You don't. You need the write ups for that - although you could reasonably have a stab at a certain minimum password length from the first one given. Someone on here said they'd done that and had success. After 36 hours of running a script, I felt that was a decent short cut, just to prove the script I'd written did crack it. I also considered the route you took.

[median compass]

i buckled before you did and gave up after about 6 hours checking 🙂 even multiprocessing it over 8 cores it was so painfully slow I just couldn't...

at least my script did find it with the shorter list, so that was nice

[candid nimbus]

Out of interest, did anyone try it with colab? In hindsight I probably should have tried that 😀

[median compass]

bcrypt is designed to be slow, even on colabcat I reckon it would have been a decent amount of time to check >7m passwords - certainly longer than the 5-10mins THM guide time

[candid nimbus]

Yeah. Bit of an odd one. Be interesting to know the thinking behind those choices. I mean it's realistic to say that rockyou isn't going to crack everything in 5 minutes, and make people think about that, but that did seem to go to the extreme if that's the only point.

[median compass]

i can only assume all the room testers used the baron to jump from the first user and didn't have to try cracking it, otherwise I can't imagine it would have passed testing

[steady elm]

if you guys wont mind, can u share ur scripts with me. I would learn and improvise from them @median compass @candid nimbus

like how u did the mulithread part

[median compass]

well, on the understanding that it's about my second time trying multiprocessing and I can't guarantee the code is any good, then absolutely

dm?

[steady elm]

yes sure, i appreciate it!

I am also trying to improve my python scripting and its hard to find like these kind of stuff, so its better to solve boxes and learn...

[candid nimbus]

I'm on my phone and haven't got the right computer with me, but feel free to ask about anything you get stuck with.

[red sandal]

Hello someone can pm for administrator flag in hackerone challenge (medium box)

[ripe hedge]

I can share my terrible code....

import base64
import bcrypt
import sys
import concurrent.futures
from tqdm import tqdm

salt = b'$2b$12$SVInH5XmuS3C7eQkmqa6UOM6sDIuumJPrvuiTr.Lbz3GCcUqdf.z6'

def testPasswd(password):
    bpass = password.encode('ascii')
    passed= str(base64.b64encode(bpass))
    return bcrypt.checkpw(passed.encode(), salt)

def genPasswd(password):
    saltySalt = b'$2b$12$SVInH5XmuS3C7eQkmqa6UO'
    bpass = password.encode('ascii')
    passed = str(base64.b64encode(bpass))
    crypted = bcrypt.hashpw(passed.encode(), saltySalt)
    return crypted == salt

with open(sys.argv[1]) as f:
    passwords = f.readlines()
    maxLines = len(passwords)
    print(f'{maxLines} passwords to test')
    with concurrent.futures.ThreadPoolExecutor(max_workers=16) as executor:
        for pwd, res in tqdm(zip(passwords, executor.map(genPasswd, passwords)), total=maxLines):
            if res:
                print(f'Found match: {pwd}')

tried both methods

no dice

and it has issues loading all of rockyou

[dense meteor]

Room Buffer Overflow
https://tryhackme.com/room/bof1
Hi all, I'm looking for help on Task 7, anyone dying to help on this one?

[gusty ferry]

I'm also looking for help on the regex room.

[Ff]ile[1-9]

How do I exclude 'File7' from the output?
Any help would be great!!

[gusty kite]

maybe expand the number range ?

[ripe hedge]

[Ff]ile[0-689]?

[stuck fractal]

Do not provide or ask for help or hints for the Team room until 8th March, 7pm (GMT)

[tawny stratus]

any one playing Team room?

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[stuck fractal]

Right after my message here too...

[little mason]

Cyber Scotland 2021
theo - password?

[little mason]

@slow slate i done it bro 🙂

@slow slate thanks anyway 🙂

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[worthy cape]

Hope you enjoy the room man

[pine reef]

Your code looks good, i bet the issue you are having with loading rockyou can be solved using using the following command to open a file: with open(sys.argv[1], encoding='utf-8', errors='ignore') , and when trying to encod the password to ascii put that code inside of a try except because it will fail, also it takes a looong time to find the password, so i can give you a hint : it is 19 characters long

[ripe hedge]

naw it's just that rockyou is too big

[pine reef]

Are you sure? I am having no issues

I can share my code if you want, also i've stolen from yours the loading bar, looks good 🙂

[pine reef]

Then filter it using the hint i gave you, i really hate when boxes ask you to brutefoce things because not everyone has the cpu power to do it

[ripe hedge]

especially bcrypt

I reencoded rockyou with iconv to remove the bad chars

[pine reef]

Yeah, also hashcat does not support bcrypt with salts, odd

[stuck fractal]

it totally does

Because bcrypt is default salted.

I've cracked salted bcrypt because there's no unsalted bcrypt.

[pine reef]

yeah sorry i ment to say that it does not allow me to specify a salt, for example hashcat lets me specify a salt when cracking md5, but not with bcrypt

[stuck fractal]

You can specify it, but it's actually a part of the hash

Same as sha512crypt.

[pine reef]

Oh really

Well i've learned something new

[limber iron]

any hint on foothold for team final

[trim haven]

Do not provide or ask for help or hints for the Team room until 8th March, 7pm (GMT)

[fickle bronze]

You read the hint on the room page?

[limber iron]

yesss

[open badger]

I did it yesterday. Dm me if u still need help

[stuck fractal]

@worthy cape Can I DM rq?

[worthy cape]

Sure

[limber iron]

can i dm you ?

[proud crag]

Where the heck is this “relevent config file” located in the Team box

[fickle bronze]

@proud crag

Do not provide or ask for help or hints for the Team room until 8th March, 7pm (GMT)

[proud crag]

Ok sorry

[twilit rampart]

Hello, I'm on GameZone room at Meterpreter part. I've tried all the suggested payloads with no luck, I've tried RHOSTS with 127.0.0.1, also with target machine, I've tried LHOST with target machine and RHOST localhost but I got no luck. Any advice?

[stuck fractal]

Please don't ask the same question over multiple channels like that

@cedar sluice Please remember rule 13, that room is under hints embargo.

[twilit rampart]

Sorry I didn't know! ty ty!!

[brisk pivot]

Idk where to search

What is it called when you use Google to look for specific vulnerabilities or to research a specific topic of interest?

[digital vector]

you generally google any vuln with its CVE. every vuln has its own CVE

[brisk pivot]

ok ty

so I just would type a cve in this question?

[stuck fractal]

We don't know the context because you haven't stated it

If you want help with a question in a room, we need to know what room and what question.

[digital vector]

^^ @brisk pivot tell the problem followed by screenshots 🙂

[white salmon]

teamcw i'm baffled

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[stuck fractal]

Still under embargo

[white salmon]

mhhhhh

very super baffled now

ok i'm autistic l

and blind

[stuck fractal]

Would you like to clarify that comment?

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[wild bison]

So I am doing the investigating windows 3 room and could really use a hint on the question “this is the default communication profile the agent used to connect to the machine. What attack framework was used? What is the name of the variable”. I thought attackMitre was a framework I have also found a ton of variables in the powershell. Could use a hint here 🙂

[brisk pivot]

oh ok

like I try to search for an cve but I don't get it

[stuck fractal]

Please don't post answers @brisk pivot

[brisk pivot]

But I do not have the answer

do I?

oh oops

so sorry I forgot that the answer was there 😐

[frozen crane]

hey guys, could anybody please give me a little hint for the team room? I found the lfi and been stuck on it for such a long time and couldn't make anything out of it. Would really appreciate a little hint 🙂 Thanks

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[frozen crane]

Why though?

[stuck fractal]

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[frozen crane]

alright make sense 🙂

[brisk pivot]

could I please get a hint of how to find the answer for the question: What is it called when you use Google to look for specific vulnerabilities or to research a specific topic of interest?

like a hint to find it

[stuck fractal]

Please state the room, task, and question when you're asking for hints

[brisk pivot]

oh sorry I gtg

I will ask it tmr if that is ok

🙂

[random thunder]

any hits for room: teamcw ?

[candid nimbus]

The attacker is using a specific tool which you need to identify to answer those questions. It's also listed in Mitre. They've also used a particular module. You should be able to identify what it is from googling information in the payload. After that it's a case of digging around, and reconstructing the steps to identify what settings the attacker chose (or left as default-hint) in running the attack. Oh and in that question the answer is the wrong way round from the question. The framework is the second word in the answer.

[cedar axle]

OMG, the answers are reversed, I lost a lot of hair over that for nothing 😦

[candid nimbus]

Yeah it was only when I got both answers and couldn't see what else they could be looking for that the penny dropped!

[faint gust]

I'm also looking for one

[ripe hedge]

please read the pinned messages

no hints until monday evening GMT

[sweet ferry]

Hint for Team room?

I added the ip in my hosts

[white salmon]

cyberjunkie, on monday come back one will be realeased.

[sweet ferry]

Then tge main site appeared

[sweet ferry]

What?

[white salmon]

a hint for the room will be released on monday.

[sweet ferry]

Oh

[modest swift]

anyone got any tips for getting from LFI to rce? no room in specific :))

or a tool which could help ?

[worthy cape]

Haha maybe the box doesn't have RCE from LFI

https://www.rcesecurity.com/2017/08/from-lfi-to-rce-via-php-sessions/

That is my go to for LFI to RCE

Unfortunately doesn't work often

[modest swift]

yes im starting to think that, but having no luck locating specific files which could give me any creds, have user.txt but no foothold 😤

thanks !

ah its you ! 😂

[hollow lynx]

@worthy cape nice box man 👍

[worthy cape]

Btw after Monday you can ask for hints officially on here

[worthy cape]

Cheers man glad you enjoyed it

[modest swift]

yup is fun so far

[modest swift]

guess im waiting till monday lol

[wet pollen]

hi guys i am stuck in wineventlogs romm at XPath Queries section ...can someone who completed this room give me some help with q1 and q2....i tried everything and no luck for now 😫 tnx

[ashen moon]

Is it possible to execute a script with lfi vuln?

[stuck fractal]

When you're asking for a hint for a room, please state the room, task, and question.

Otherwise if it's a general question then #infosec-general

[ashen moon]

its team

[stuck fractal]

Then don't ask at all

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[white salmon]

!rule 13

[steady thicket]

Having issues with Linux challenges "Flag 16 lies within another system mount". Tried cat /etc/os-release, cat /etc/lsb-release, findmnt (going through all the mounts). Hitting a wall here.

[stuck fractal]

/etc/os-release, cat /etc/lsb-release, Why would those be relevant here?

[steady thicket]

Just based on the previous (Flag 15 Can you find information about the system, such as the kernel version etc.). Thinking 16 was a continuation

[wet pollen]

this are my best gueses on the questions... Using Get-WinEvent and XPath, what is the query to find WLMS events with a System Time of 2020-12-15T01:09:08.940277500Z? Get-WinEvent LogName -Application -FilterXPath '*/System/TimeCreated[@SystemTime='2020-12-15T01:09:08.940277500Z'] and /System/Provider[@Name='WLMS']' and second Using Get-WinEvent and XPath, what is the query to find a user named Sam with an Logon Event ID of 4720? Get-WinEvent -LogName Security -FilterXPath '/EventData/Data[@Name="TargetUserName"]="Sam" and */System/EventID=4720'

[stuck fractal]

Ok. Look into where a USB stick would be mounted by default in Ubuntu @steady thicket

[digital bolt]

Any hint for question "Run Loki. Inspect the output. What is the name of the module after Init?" from room -Investigating Windows 2.0.
Checked the o/p but not able to understand.Is the module name printed in the o/p or do we need to dig it out from the Loki's code?

[coarse hornet]

We are the same, I only need that one for weeks I still do not get it

[digital bolt]

Got it, DM me if you want to know

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[stuck fractal]

@white salmon This applies for another 48 hours or so.

[turbid sequoia]

@worthy cape I am enjoying your room, beating head against soooooo many walls, finally got my first flag!

[worthy cape]

Glad you enjoying it haha! Foothold is always the hardest bit in my opinion

[timid cedar]

I already gave up and come back to it 3 times, about to go for the 4th lol

[turbid sequoia]

heh...

[sweet ferry]

So you are the creator of team box?

Been at it from evening

[sweet ferry]

I replied to you on forums

[slender dawn]

@worthy cape thanks for creating the "easy" box

[worthy cape]

Haha yeah i was on the fence of easy / medium

[slender dawn]

your profile pic suits you

[worthy cape]

😂😂😂

[ornate pumice]

still haven't been able to successfully enumerate that box... I'd vote "medium" @worthy cape 😋

[slender dawn]

so tru

[sweet ferry]

@worthy cape plss a hint for priv esc

When i got the user flag i was very happy

[turbid sequoia]

@sweet ferry no hints until monday

[sweet ferry]

F

[turbid sequoia]

concur 😭

[sweet ferry]

If i got root tonight

I will do a writeup and publish it on. Monday or when allowed

Else i will be the one reading a writeup

[slender dawn]

xD

[turbid sequoia]

😭 my wife wants me to watch Coming to America 2 with her today...but "easy" team room!

[sweet ferry]

The name hints it bro

It requires team work

[turbid sequoia]

ha!

[slender dawn]

invite your wife to solve the box

ez

[sweet ferry]

Yeah woman can solve any problem

[turbid sequoia]

@slender dawn her solution would be to throw all of my computers away then say, "see, problem solved!"

[sweet ferry]

Stonks

[drowsy moon]

Team room is so depressing xD

[turbid sequoia]

I feel like I am stuck in an empty room enclosed on a all walls with the word "easy" being yelled at me constantly. However, I am enjoying it. Started playing with pentesting monday.... so learning all the things.

[worthy cape]

good proper enumeration always pays off

[turbid sequoia]

Once I figured out the blindingly obvious thing staring me in the face, getting the first flag was easy. This second one is going to be problematic, but may also be slap the forehead when I do figure it out kind of thing.

Funny thing, did not figure out the obvious thing from the actual obvious thing staring at me.

[ripe hedge]

IMO it's on the hard end of easy

Bit guessy though

[worthy cape]

If you find all the clues its not that much guessing

[turbid sequoia]

Ok, taking a break, think I went down a ridiculous rabbit hole.

[white salmon]

hello hackies, i have a question about the burp suite room

[astral smelt]

What's your question?

[white salmon]

in the target definition portion:

"Navigate to the Target tab in Burp. In our last task, Proxy, we browsed to the website on our target machine (in this case OWASP Juice Shop). Find our target site in this list and right-click on it. Select 'Add to scope'."

i dont know which website is the OWASP Juice Shop

wait, do i just go to the website? 😆

[ripe hedge]

still a lot of fuzzing to do

which is basically guessing

[frail rain]

Hey great box!!

Just finished it!

[worthy cape]

isnt that what 90% of pentesting is?

[brisk pivot]

Hacker Methodology. Ok so I searched but I cannot manage to find anything, may I have some help please. Just like a hint not the answer like where to find or what should I type in the google search bar

[brisk pivot]

what room is that?

xD

[worthy cape]

google ****ing

[brisk pivot]

nvm I found the answer from someone

but ty

[timid cedar]

I'm pretty sure that all those terms are in the description of the tasks

at least for all the rooms I completed so far

if it is not it is in the hint button

[open badger]

Dalemazza's room is harder than 2 hard rooms I finished before trying this one because everyone was talking about it:D

[worthy cape]

😂

I swear when you make it. You think it's easier then it is

[turbid sequoia]

^

[gusty kite]

I might have been lucky but I found it to be pretty straight forward. The most usual tools and attack vectors for easy rooms.

[turbid sequoia]

Uh oh, think I may be making a small, very small bit of progress....

[hexed crescent]

If anything, regardless of the difficulty rating of a room, it demonstrates gaps in one's skillset related to the tasks/methods/techniques required to complete a room. A beginner room can take 4 hours, while a hard room for the same person can take 30 minutes. This is all part of learning. 🥳

[turbid sequoia]

Considering the fact that I just started learning a week ago, everything is hard 😉

But, learning a lot!

[hexed crescent]

When it becomes easy, it is good for confidence for a bit, and than amp up for the next level of complexity/difficulty. 🙂

[turbid sequoia]

"when it becomes easy", they say....

[hexed crescent]

It never becomes easy. 😄

[turbid sequoia]

well, then I must be a pro already, because it is hard, like rock, my head that is 😉

[open badger]

100% agree 😅

[green brook]

Its inspirational vibes today💪

[iron hinge]

Room : linux fundamentals
Task : 8/9
Problem : everytime I try to run a file it says /root/b.txt: Permission denied

[stuck fractal]

Screenshot.

[iron hinge]

the machine or task?

[stuck fractal]

Of exactly what you're doing and what's happening

[iron hinge]

what I'm trying to do

what's actually happening

[stuck fractal]

You're not on the machine that you need to be

[iron hinge]

you mean attack box?

[stuck fractal]

You are on the attackbox

[iron hinge]

oh u mean I forgot to ssh?

[stuck fractal]

You need to SSH into deploy

Or as it's linux fundamentals 1, you use the browser access FOR THAT MACHINE

[iron hinge]

so in short

i forgot to ssh

[stuck fractal]

In short, you're on the wrong machine

You're not told to SSH in, you're not told how to SSH in.

[iron hinge]

Ok, so what is the right machine?

sorry If I sound frustrating btw

[stuck fractal]

The one that you deploy with the deploy button

NOT the attackbox

Caps are for emphasis, not anger.

You get a terminal above the tasks, because the room is set up specially for that

[iron hinge]

this?

[iron hinge]

oh wait lemme check

[stuck fractal]

Yes that button

[iron hinge]

not clickable so ig it's already started

which lead me to this

[stuck fractal]

That's different

That's not the main button

Screenshot the whole page.

[stuck fractal]

Ok, below that video.

See this?

That's where a shell on the target machine shows up.

[iron hinge]

yep just got it after refreshing

[stuck fractal]

This doesn't happen in very many rooms.

[iron hinge]

what's the difference between it and the other machine attack box ? and this doesn't require to be connected on the VPN right? cuz I'm not

[stuck fractal]

The attackbox is a substitute for using your own kali machine. It's a machine you fully control that you attack from

The VM you deploy in the room is your target.

[iron hinge]

alright thanks James for saving my night!

[sonic night]

not help but I didn't know where else to post this, what a fun box! Thanks THM and all involved.

[past cargo]

short question about brainpan, or buffer overflows in general:

||this is about exploiting the "validate" executable.
the basic schema for exploiting it would be ./validate 'shell_code_to_write_into_eax' + 'padding_to_overflow' + 'address_of_a_call_eax'.
however, initially i had it the other way around, first putting the 'padding_to_overflow' (NOPs), followed by shell code, followed by the address to write into the eip.
with the second approach, the shell code is not being executed. i simply get a segmentation fault. shouldn't it not matter?
if i preprend the shell code with NOPs, program execution should simply slide along until it hits the shell code, no?||

[sweet ferry]

@worthy cape

[slender sand]

Is there any who solved Basic Malware RE ?

I need some help.

I am not able to unzip the file and lod the binary to Ghidra. If anyone can help me !

**load

[rare dust]

@slender sand What do you mean "I am not able to unzip"? any error messages? or you don't know password?

The password is written in Task 1.

[slender sand]

😂 I didn't saw the password earlier. Thanks for reminding.

I was trying to crack it. But was not able to. Thank you.

@rare dust Thanks

[modest swift]

easy box my hole 😬

[worthy cape]

Tbf if you do good enumeration there is little to none guess work 😂

[surreal sentinel]

anyone rooted Team room?

[modest swift]

im stuck there atm

[surreal sentinel]

I need some help

[surreal sentinel]

In Team too?

[modest swift]

yeo

[surreal sentinel]

where are you atm?

[modest swift]

lovely beginner box 🙃 🙃 🙃

[shut kernel]

Has anyone completed the Windows Event Logs room? I'm stuck on Xpath queries and need some help.

[slow slate]

Yeah, I was lost in Middle-Earth for a while.

[late patio]

@modest swift what room?

@surreal sentinel yup

@modest swift you got it?

[prime perch]

Can I have some help/hints with the third question? https://imgur.com/a/Y7kpBcg.png

room = https://tryhackme.com/room/ccpentesting

[late patio]

what have you tried?

[prime perch]

ports, -port

[late patio]

what is the question?

[prime perch]

there is an image https://imgur.com/a/Y7kpBcg

how do you set the target port

[late patio]

so... how do you set the target port?

[prime perch]

that's what I don't know

[late patio]

you haven't tried anything?

[prime perch]

I tried ports, and -port

or do you mean what have I tried to try and figure it out

I googled it

and looked at the metasploit help

[late patio]

what is the question?

[prime perch]

why do you keep asking

i've already told you

the question is How do you set the target port?

[late patio]

is this a walkthrough room?

[prime perch]

well, it's this room https://tryhackme.com/room/ccpentesting

[late patio]

no no...

[prime perch]

sorry, I don't understand

[late patio]

what task?

[prime perch]

task 8, question 3

you could've looked at the image

[late patio]

ummmm...

what was the question?

[prime perch]

what are you talking about

[late patio]

How do you set the target port?

this one

[prime perch]

yes..

[late patio]

what did you do before?

[prime perch]

before what

[late patio]

the previous ?

[prime perch]

the previous what

[late patio]

how do you set the host?

[prime perch]

that is rhosts

[late patio]

oh.... lol

have you solved everything else?

[prime perch]

all the previous things, yes

[late patio]

you can dm me

[prime perch]

but.. why?

[late patio]

i'll explain

[modest swift]

@late patio sure

[wet pollen]

same

[modest swift]

on Inferno, was getting disconnected from your shell/ssh every 30 seconds meant to be part of the box?

[stuck fractal]

Yes

[modest swift]

🤮

[stuck fractal]

Why are you specifying version 2?

Wait which Linux Priv Esc room?

There's a dozen

[final crater]

smh, just realised i was being an idiot and had the wrong ip - the error message threw me off. Thanks anyways!

[gusty kite]

Part of the fun yes. Pretty easy to circumvent though If you realize what happens

[shut perch]

any kind soul could provide some hints? I read the article like 10 times ..... cant get it.

[candid nimbus]

They all have something in common which is defined by a particular specification. That's what you're looking for.

[modest swift]

anyone working on wekor hmu

[hexed crescent]

No hints for wekor. It's a new room release.

[ripe hedge]

Needs a pin

[cedar axle]

the arpawocky is one

[shut perch]

THANKS. @cedar axle @candid nimbus got it

[nimble frigate]

guys, please, someone had this same problem on Wonderland chal?

hatter@wonderland:/home/rabbit$ whoami
hatter
hatter@wonderland:/home/rabbit$ ls
date teaParty
xec "/bin/bash";':/home/rabbit$ perl -e 'use POSIX (setuid); POSIX::setuid(0); ex
bash: /usr/bin/perl: Permission denied

my terminal sucks with the entire command but its right. I really dont know why perl is displaying it. I tried every perl version on /usr/bin

[stuck fractal]

Are you sure you're the right user?

Your command is super weird

[nimble frigate]

its from https://gtfobins.github.io/gtfobins/perl/#capabilities

its a privesc by CAP_SETUID

[stuck fractal]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[stuck fractal]

I made that room

I know what it is

[nimble frigate]

oh ok

[stuck fractal]

If you think you're doing everything right, #room-help and post screenshots. You'll need to verify to post images.

[nimble frigate]

ok thank u bro

[stuck fractal]

Please don't call me bro.

[nimble frigate]

🤦‍♂️

[digital vector]

[slender dawn]

can someone give me a hint on how do i find the username for wgelctf

i have the private key

i tried with www-data but thats not it

https://tryhackme.com/room/wgelctf

[echo peak]

see comments in html

[slender dawn]

shit i forgot to check comments of the apache site

thanks

[dawn mango]

Can someone please help in the room of wekor? The room owner said feel free to ask questions

[ripe hedge]

didn't see that but defaulting to wait until the embargo is over first

sorry

[modest swift]

fucking lmao

[true widget]

Need a hint for overpass priv escalation?

[ripe hedge]

where are you at?

[frozen crane]

Hey guys! I’m the creator of wekor. If you guys need hints, I would gladly give you some without spoiling anything 🙂

[winter leaf]

bait ?

there is an embargo on wekor to Wednesday i suppose

[ripe hedge]

creator can override, technically

I suspect that there are shenanigans with that room though

[winter leaf]

didnt started it yet

but looking forward to complete it

[ripe hedge]

yeah I hit an impasse

[fickle bronze]

Same... Hit a brick wall... Did some research but, dont even k ow if its the right thing 😆

[ripe hedge]

I saw something but it doesn't look vulnerable

anyways

[frozen crane]

Are you guys all talking about wekor right now ? 😄

[ripe hedge]

yeah, but not necessarily asking for hints

[frozen crane]

Ah ok 👍

[ripe hedge]

I think I have an idea for something to try though

[gusty kite]

just finished it - thanks for an interesting room @frozen crane

[frozen crane]

No problem 🙂 glad you liked it

[gusty kite]

hated you last night though when I first started 😆 was too tired to do propper sqli checks. After a bit of sleep it all went a lot easier

[frozen crane]

😄

[ripe hedge]

haha, I've yet to see where we can actually inject yet...but distracted by work

[wet pollen]

can anyone help me with this question from windows log event ...i cant get the right variable 😫

[gusty kite]

I thought I had checked everything and pretty much gave up. then tried again this morning and found it almost straight away

[frozen crane]

Oh and guys just another little detail.... how was the machine, if we are talking about performance ? Was it fast was it slow ?

[fickle bronze]

The second one is a little slow at times for me

[ripe hedge]

seemed alright, but sub boxes are faster

[gusty kite]

it was slow and for some reason the/xx-xxxx/ uri did not respond at first when I found it. returned to it some time later and it worked.

[frozen crane]

I actually did my own box yesterday and the pages weren’t even loading haha 🤣

[ripe hedge]

spoilers, @gusty kite

[frozen crane]

Yeah it’s slow there’s only half a gigabyte of ram haha

I think we should boost the box a bit

[ripe hedge]

it's a bloody huge site though >.<

[frozen crane]

Yeah that’s true as well

Well I guess I’ll ask at least

[ripe hedge]

part of why I hate WP I guess

[feral fjord]

Hello! I am practicing nmap, but in the first exercise it asks me to verify the ip of "MACHINE_IP" with ping. Does anyone know how to get that MACHINE_IP?

[ripe hedge]

deploy the machine

there's a big green button

[feral fjord]

ya lo hice

already did

[ripe hedge]

there should be an ip address at the top of the page then

kind of like this:

[winter leaf]

also verfiy yourself

on discord

[ripe hedge]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[feral fjord]

is the IP on machine details, on the attacking machine screen?

[ripe hedge]

the box I screenshotted

[fickle bronze]

No... Its on the room page where you deploy it. After the countdown is done, it'll show

[ripe hedge]

that says "Active Machine Information"

for example

this is my machine, not yours though

[frigid summit]

Not asking for hints but i need a sanity check about wekor room because looks like I stuck at stupid thing, does ||privesc to root has anything to do with python library hijacking or path variable?||

[native mesa]

I'm still looking for this one too. Did you figure it out @white salmon ?

[white salmon]

Yes I did, need a hint ?

[balmy verge]

Hey, i would appreciate a little nudge on the privesc part. || i think i know what i need to to with the netstat -tunlp command and the open ports but idk how to reach them without curl or ssh creds for port forwarding ||

[frozen crane]

You can use nc or telnet

[gusty kite]

||ignore first part of the question and focus on the last part - question should really just say "where were the 3 first IP address ranges first get described?"||

[high parcel]

yo man...help me out im stuck at the wordpress site

[frozen crane]

Take a look at /it-next 😉

[slow slate]

Nice work!

Love the Kaspersky keyboard.

AV with one key only.

[frigid summit]

@frozen crane hey, liitle help! Stuck here for forever.

[untold fulcrum]

@frozen crane can i pm you ?

[frozen crane]

Sure

[ripe hedge]

@frozen crane you did not make this very cli friendly

[frozen crane]

what do you mean?

[ripe hedge]

the massive html that comes out of each request 😦

[frozen crane]

euhh every website has a lot of html lol

there's always a lot of html if you want to make the website beautiful 😉

[distant tartan]

can i ask for hint about the wekor room

or its a bit early

[astral smelt]

Not until the 10th 7PM GMT

[distant tartan]

ok thanks

[ripe hedge]

yeah ... but not 10 KB worth >.<

[frozen crane]

yeah maybe I exagerated with the website a bit haha

[white salmon]

hey @frozen crane, a little nudge for prviesc to root? I was able to extract password for the binary.

[frozen crane]

sure

[analog karma]

hey, do I need some special wordlist in order to bruteforce Bounty Hacker ssh credentials?

I went thru like 3.5k pass from robot.txt

hope the question is ok

[stuck fractal]

You should have found a file earlier

That looks like passwords

[analog karma]

I did find that file that was mentioned, but apparently I'll have to take another look at it. Thanks

[fickle bronze]

@frozen crane can I DM you?

[frozen crane]

Sure

[timid frigate]

yo guys, I'm doing wekor, can i get any hints? found the vhost and the cms running on it. feel like I'm missing something. also found a dir /re*******n

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[simple mountain]

Do not provide or ask for help or hints for the Wekor room until 10th March, 7pm (GMT)

[white salmon]

Need help for the team room 🥲

[stuck fractal]

#room-hints is here for people who want a "pointer" towards the room they are completing, and not necessarily a spoiler. As such, when asking a question, be sure to include:

• What room you are on
• At what stage are you stuck exactly? Enumerating? Exploiting? Priv esc?
• What techniques / tools have you tried so far? Just so that we know how to hint you in the right direction without repeating what you've already done

[white salmon]

||Cannot connect to the Maschine with the openssh private key. SSH says invalid file. Is there any other step to do? I also can’t convert the key to ppk||

[cedar axle]

the comments in here are ridiculous

[minor bough]

Is there something I can help you with?

[cedar axle]

lol, was a cryptic hint for F43i

[minor bough]

Gotcha

[white salmon]

Do you mean the # ? I removed them. Otherwise I don’t get it

[spice frost]

im stuck on the network services 2 room. PM me if you can help

[stuck fractal]

Just ask your question

many people can help, many people would rather it wasn't over DMs

[spice frost]

can't showmount the NFS shares for some reason

[stuck fractal]

Screenshot

[spice frost]

nvm, figured it out

[cedar axle]

you do get it

[worthy cape]

You need toakw sure the key does not have and spaces in or line breaks ie make sure there isn't an "enter" at the end of each line. Also chmod 600 it

[white salmon]

Thx guy’s you’re great

[sinful plaza]

Hmm

[white owl]

i got user on wekor but root looks like it will be hard

[stuck fractal]

Still under embargo 😉

[white owl]

yeah i know

[digital vector]

whats embargo

[stuck fractal]

Rule 13.

[digital vector]

ah

actually these things give a lot of info bout the box

[spice frost]

is it just me or is there a step missing here

[stuck fractal]

No

The room sets the scene at the start of the mysql section, explaining that you already have creds

[spice frost]

ty, must have missed that

[white salmon]

On teamcw, I think I've found what I'm supposed to do but I'm not ||receiving a reverse shell ||

[tranquil ivy]

Im stuck on ConvertMyVideo room
i cant find the user that can access the secret folder
Im beating my head for a long time
someone plz gimme a hint :/

[tranquil ivy]

anyone

[cedar axle]

@tranquil ivy whats the room called?

[tranquil ivy]

@tranquil ivy whats the room called?
@cedar axle
ConvertMyVideo room

[cedar axle]

you have the link

?

[tranquil ivy]

What link?
Of room??

[cedar axle]

yeah

[tranquil ivy]

https://www.tryhackme.com/room/convertmyvideo

[cedar axle]

have you found the rce?

[tranquil ivy]

I opened with burp
Trying to do a reverse shell not working :/

[cedar axle]

but you can confirm basic command injection?

think about what characters might be filtered and try to bypass that

[slow slate]

what is not working? The shell or the injection?

[tranquil ivy]

think about what characters might be filtered and try to bypass that
@cedar axle
Yeah
Figured out a way and got shell thnx :)

[cedar axle]

🙂

[slender idol]

Hint please!
Nmap room
Task14
Scanning

[slender idol]

Scanned using this command
Sudo nmap -Pn -sX -vv --top-ports 999 ip-address

[slender idol]

Never mind, solved

I need some explanations tho, for the Xmas scan I got 1000 non-responses but the answer is 999
For the TCP SYN scan I got 6 open ports but the answer is 5... why is that?

[white salmon]

Just fir practice, I'd not recommend using sudo for nmap

[worthy cape]

Reverse shells can be hard to fault find. If I can run elevated commands I always just throw a sticky bit on bash then run with bash with the "-p" argument. Saves the need for a reverse shell and listener and still get yous a elevated shell

[white salmon]

I ended up doing just that qnd it worked perfectly

[white salmon]

only use pn if requested by nmap, it mike make the scan longer as it considers all the hosts actives

[faint gust]

any hint in room teamcw? Is the vulnerability in the home page or I need to find a another page?

the hint they give for the user flag is related to open ports but I just found 2.

And I'm stuck

[median tulip]

https://tryhackme.com/room/wekorra

[stuck fractal]

Still under embargo for help and hints, Rule 13.

[candid nimbus]

You've got a way to go. You need to find more pages.

[white salmon]

Anyone able to give me a hint on priv escing in Retro? I have a low level shell....

Was checking the pins and I saw this

nvm think I know the way 🤓

[jovial sentinel]

Hello. Room Steel Mountain. Task 4. I am unable to start a http server because it says that the port 80 is already in use. Is there any way to bypass this? I am thinking about changing somehow the port where the exploit is requesting the nc.exe but I don't figure out how can I change that. Looking through 39161.py I can't find the specific part that is using the port 80 😦 Can someone give me a for my problem? 😄 Thanks.

[stuck fractal]

Yeah you can change it in the script

Look at where it's using your IP without a port for nc.exe

That's port 80, by default, because HTTP

[jovial sentinel]

I think I figured it out. I decoded that thing and added a :8080 after the ip 😏

Thank you. I hope it works

[sonic night]

If you're talking about an initial foothold, you shouldn't be getting a reverse shell. You may need to enumerate more to access another service on the box.

[white salmon]

Thanks. I went down a rabbit hole there but ended up rooting it yesterday

[untold fulcrum]

@frozen crane can i pm you... intentionnaly this time

[frozen crane]

sure

[jovial sentinel]

so I still have a problem here.

this is how I have tried to add :8080 after the ip_addr in order to get the nc.exe from that specific port

and I, obviously, opened the http server on that port (8080)

but I am still getting this error

and I did changed the ip_addr and local port

this being the ip_addr

and this is the nc listener I opened on that 9001 port

yet, this is not working.

someone that can tell me any little hint?

[true widget]

i am stuck on blog priv escalation.Currenly I have a shell as www-data .I found sql username and passwords.Am I heading in the right direction or is it a rabbit hole??

[ripe hedge]

you might need to escape the backslashes

not sure that the vbs part does

oh

wait

haha you're trying to run a python2 script with python3

[jovial sentinel]

oh my god

im so dumb.

you are right

[ripe hedge]

naw it's an easy thing to miss

[jovial sentinel]

God, I've been spending my last hour looking at this.

Thank you 🥰

[faint gust]

Thanks @candid nimbus

[carmine holly]

What hash format are modern Windows login passwords stored in? I have tried LM hash and NTLM hash. None worked, need help.

[stuck fractal]

What room? What task? What question?

[ashen mulch]

On Brainstorm nmap shows fewer ports open than the correct answer. I did nmap -T4 -p- -Pn X.X.X.X any hints/clues?

[gusty kite]

did you give it enough time to start?

[ashen mulch]

RE: Brainstorm, I ran nmap a couple of times the last was at least 20 minutes after I started the machine.

[still coral]

Any hints on wekor room privilage escalation?

[stuck fractal]

!rule 13

[proud scarab]

Rule 13: When asking for help/tech support please perform research to your fullest ability. Mods and Community Mentors have the right to refuse helping those who have not done troubleshooting/research on their own first. Clearly phrase your questions as we (fortunately for all parties involved) cannot read your mind. Please include the room, task, and question number in your question if possible.

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

[white salmon]

^ what have you tried so far?

[stuck fractal]

Although we are a learning platform, we politely ask that you respect the competitive nature of newly released challenges. As such, no hints for new challenge boxes should be given immediately after a release (72 hours, by default), unless instructed otherwise by the content creator.

It is still under embargo

[white salmon]

Ahh

Thanks fir the clarification. Didn't check the release

[still coral]

Okay

[edgy inlet]

hi everyone, hope you're fine, please can someone tell me what is the name of room when we use burpsuite to change our IP because the siteweb accept only ip 10.10.10.x thanks

[median compass]

if you proxy your browser through burpsuite using forxyproxy or similar, then you don't need to change anything in burpsuite, anything you browse to will pop up in burpsuite

so I don't understand what you mean, sorry!

[edgy inlet]

thanks my friend, look on tryhackme there was room i forget the name,, there is some issue that the sitweb accept only reqeust from ip 10.10.10.x

so i forget the command to use on burpsuite to change the IP

and i forget the room name

[median compass]

sorry, I can't go through every room on tryhackme to find the one that you're thinking of

if you remember then perhaps come back and tell us then ok?

[edgy inlet]

yeah yeah of course, i will search and told you

[median compass]

if what you're asking is about bypassing a WAF, web-application firewall, then you can often add a header like X-Forwarded-For: 127.0.0.1

[edgy inlet]

yeah yeah the room name is harder

thanks my friend and yes im looking for this command X-Forwarded-For

thanks a lot

[median compass]

ok, so that's not a command, hence the confusion, that's a http header

[edgy inlet]

yeah i was wrong i expressed badly

[median compass]

no worries

[copper hound]

I tried IPv4 but It say's Incorrect Ans someone help
Room : DNS Manipulation Task 4 Question 3

[median compass]

it's asking about different types of DNS records I think

[copper hound]

😤 thanks @median compass

yes It is

[median compass]

my memory wasn't that good after all lol, sorry!

[stuck fractal]

@storm venture let's not just post answers.

[oak hawk]

Hello. I have problem with solving HOTH#1. I can't find second and third containers in hard challenge. I have got root and ssh connection, but there is not /var/www/container2_flag.txt the same with third. Can you help me please? https://tryhackme.com/room/hackerofthehill

[storm venture]

Oh sure, my bad

I'm not able to do a thumbs-up emote on that message, screen kinda shakes

is that just me?

[median compass]

i think most folks got privesc through one container or another, and then went backwards and got the flags from the others that way

[oak hawk]

Thank you very much

[median compass]

don't forget to look at the hints, flag locations are there now

[ripe hedge]

you need to escape the containers first, then the rest can be found

[oak hawk]

I already escape the container

[ripe hedge]

then docker it up

the flags are in their respective containers

[oak hawk]

Thank you guys

[ionic cedar]

hay guys could you help me? how can i make a Xmas scan to a specific number of ports. I guess that I need to use the flags -sX and -p to specify the ports, but how i have to construct the command line?

[stuck fractal]

just put them in sequence?

[ionic cedar]

i'm using "sudo nmap -sX -p1-999" but it says that there is no target specified

[stuck fractal]

So, you haven't said what you want to scan

[ionic cedar]

Oh ok, so how do i do that?

[stuck fractal]

How did you do it before?

[ionic cedar]

maybe putting the ip address at the end?

[stuck fractal]

Doesn't overly matter where in the command, but yeah you need to put the IP in there

[hearty jackal]

Hello guys, not sure what Im missing here, Room Network services2 : exploiting NFS

chmod +s on the uploaded bash file but the user doesnt seem to gain a root shell..

as chown the permissions asked on the procedure are the same in my shh session

[stuck fractal]

It needs to be root owned

[hearty jackal]

the bash file needs to have root as owner?

will try

just noticed in the procedure a few step back that it does specify it should be root owned... ahah... thanks, I guess once thats done it will work. I delete/recopied the file a few times but forgot to make it root owned everytime

hm.. might just restart a need machine might have destroyed something by playing so much with permissions, still not working

[stuck fractal]

You just need to add suid back

[hearty jackal]

goddamnit... yup... anyway, restarted it fresh it will just give me more practice lol

didnt though it would reset permissions too

[stuck fractal]

Suid is special

[hearty jackal]

trying do go faster than I should. thanks again

to go*

[stuck fractal]

So with suid, if the file is modified at all then Suid goes

[hearty jackal]

hm, will remember it for the next times thats for sure

[cedar axle]

SUID binaries run as the owner of the file

[ionic cedar]

I'm sorry guys but i got stuck en task 14, question 3, it says that there is a reason given for -- and that i have to use the verbosity to find but i set the verbosity in level 3 and can't see anything

[cedar axle]

read it carefully

[ionic cedar]

nope I don't understand

[cedar axle]

oh there you are

[ionic cedar]

sorry i was reading the question like 10 times hahaha

and still don't understand

[cedar axle]

the answer is right in front of you

[ionic cedar]

I know that should be something easy but I swear that I can't find it

[cedar axle]

i actually gave you the answer

[stuck fractal]

Yeah please don't do that

[cedar axle]

sorry

[ionic cedar]

so i have to put 2 words right?

ok i got the answer, but i really don't know why

i was just guessing

[cedar axle]

hmm

post a screenshot of the result

[stuck fractal]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[stuck fractal]

Follow those instructions in order to be able to post screenshots

[ionic cedar]

ok i'll do that

[hearty jackal]

so.... got the bash to work but not sure what Im supposed to do to get the flag... normaly its executing the .sudo_as_admin_successful file but this time it seem like its empty or im not executing it the right way?

[stuck fractal]

normaly its executing the .sudo_as_admin_successful file wat

It is NEVER that.

Look into the purpose of that file and you will see why it is never that.

[hearty jackal]

ah... might just not remember from the last rooms though it was that for some reason ahah