#room-hints

1 messages · Page 109 of 1

ripe hedge
#

I'd guess 80, 8080, and 8888 in that order off the top of my head

lucid junco
#

How are you searching for it on Shodan?

ripe hedge
#

Shodan might say otherwise

lucid junco
winged ocean
#

server:nginx

ripe hedge
#

8000 is also common

lucid junco
#

Take away "server:"

#

Just type nginx and search.

ripe hedge
#

Just nginx should be enough

tranquil parcel
#

they seem to match

lucid junco
winged ocean
#

it worked thanks

ripe hedge
#

Oh yeah 443

cedar anvil
ripe hedge
#

How is 8081 more popular then 8080?

#

Who are these monsters?

lucid junco
#

That's what I thought when I did it. haha.

tranquil parcel
ripe hedge
#

And 5000?! Why?

lucid junco
#

Some people want to watch the world burn.

ripe hedge
#

Looks like there's a lot of synology stuff which defaults to 5000

onyx plank
#

What is meant with account status?

#

Windows fundamentals 1

lucid junco
#

Use lusrmgr.msc

lucid junco
onyx plank
lucid junco
#

Ok, I'mma boot up

left thunder
lucid junco
onyx plank
#

It is probably right infront of my eyes but cant see it

#

ah wait

#

got it

lucid junco
#

😄

slender agate
#

Starting TryHackMe with Buffer Overflow Prep. I’ve already noticed one of the ruby scripts it mentions for generating a length string, is not included in the snapshot (usr/share/metasploit-framework/tools/exploit/pattern_create.rb). Additionally, the stated length 600 for crashing the first program is not sufficient, and 2000 characters are required.

I can understand if the snapshot is accidentally missing the appropriate ruby script, but to state the incorrect length for the buffer overflow on the very first challenge in an easy series for buffer overflows just seems cruel 😔

stuck fractal
slender agate
#

Cheers, I'll take a look.

random wraith
#

.

vague pine
brave basalt
#

Losing my mind on Task5 for https://tryhackme.com/room/googledorking
I had to re-read the prompt many times but I'm fairly confident it's aksing for a ||5-letter|| ||google dork|| keyword... right?
or is it ||4 letters + :||

#

Yep - thanks for the confirmation - but I've still tried every keyword I could find 🤦‍♂️
it's case-insensitive, right?

vague pine
brave basalt
#

what keyword, then..?
tried all ||the 5-letter codes from the sitemap.xml||
with and without ||'<' '>'||

#

got it. 😓

#

(It normal that I can't react to posts? Is that blocked unless I boost??)

proud scarabBOT
vernal basin
#

Has anyone completed the pyramid of pain room? I am stuck on the very last task and I can't tell what is wrong. I am basically matching the answers to the tasks. but it doesn't make a difference.

civic hamlet
#

https://tryhackme.com/room/xssgi i think this last task is broken (Task 8), I'm not getting any staff session token, i've waited for hours , tried different hook method and all i can get is my own cookie.

lucid junco
mighty iron
#

Here is where I'm at: || I managed to enumerate the webserver and found alice's ssh creds. After enumerating the machine for a bit I found that alice has perms to run walrus_and_the_carpenter.py as rabbit. However I'm stuck on understanding how I can exploit this. Should I try a different vector of attack? or is this the way to go? ||

#

nvm, managed to solved it, I didn't notice a very important fact

wise kiln
#

what does that means?

raw grove
#

Shouldn't share text or pics with answers in public channels 😜

jolly crescent
#

Anyone doing the tech support room?

#

I got a shell but I can't elevate to root, any tips?

round kestrel
#

Hi I am in the room in Living off the land and struggling to get right answers in file operations section tried running every command still wrong , can anyone help me out in this
I am struggling in all 2 questions for the right answers

cedar anvil
whole python
#

after search the cve in metasploit on nax i got ||exploit/linux/http/nagios_xi_authenticated_rce|| but it says its incorrect

cedar anvil
whole python
#

i think it could be my msf version too bc in the hints it says use 6+

whole python
#

i updated metasploit and it worked

tired nebula
#

Any hint for room ccpentesting, on task 24 find hidden dir

hearty zodiac
#

doing Holo live, i have to the admin password, but its not working to admin portal... does anyone face the same issue... whats the workaround or fix for it ?

willow shadow
#

k, as i was sayin on general

#

i have a problem with q4

#

idk how to acces

unknown.png
#

like, i acces framework changelog but, i dont find the zip file

cedar anvil
willow shadow
#

how?

cedar anvil
#

share the room link?

willow shadow
#

this?

cedar anvil
#

yeh

willow shadow
#

kay

cedar anvil
willow shadow
#

like i said, i followed the instructions but, nothing, im stuck

cedar anvil
willow shadow
#

XDDD, yeah, i just saw it, im stupid, sorry

bright anchor
#

so I'm in the "Uploading Vulnerabilities" rm, task 7 and none of my uploads are going thru

#

can't even upload a regular PNG file

#

yes

#

trying to use method 3

#

I'm getting a "File sucessfully uploaded" message

#

and if you look at the filter script its says PNG, not JPEG as in the example

#

it sounds like you haven't actually done the room yourself

#

thanks

lucid junco
#

How dare you give advice when you haven't done the room.

bright anchor
#

not trying to be rude but when you ask me if I've read the task text...lol

lucid junco
#

BTW.

lucid junco
bright anchor
#

yes, it says "invalid file type"

lucid junco
#

Have you edited the hex?

bright anchor
#

if you look at the filter script it's looking for a PNG file

lucid junco
#

Is it?

#

I mean, you're right, there is a p in the extension...

bright anchor
#

lol

lucid junco
#

I still have my rev shell from that room.

#

And that screenshot is lifted straight from the task 😂

bright anchor
#

thank you lassi

#

@lucid junco
if (file.type != "image/png"){
upload.value = "";
uploadMsg.style = "display:none;";
error();

#

that's from the script on the actual page

#

not the example

lucid junco
#

Are you doing it on demo.uploadvulns

#

or Java.uploadvulns.thm ?

bright anchor
#

jave

#

java.uploadvulns.thm

proud scarabBOT
bright anchor
#

!docs verify

proud scarabBOT
bright anchor
#

oops. Ok, so I'm uploading a shell with a .png extension

#

and then in Burp I'm changing it back to .php

#

but even I try to upload a legit .png file it still doesn't show up in the /images folder

#

HTTP/1.1 302 Found

Server: nginx/1.14.0 (Ubuntu)

Date: Mon, 18 Apr 2022 21:54:00 GMT

Content-Type: text/html; cherset=utf-8;charset=UTF-8

Content-Length: 1221

Connection: close

location: /?submit=success

Front-End-Https: on

<!DOCTYPE html>
<html>
<head>
<title>Java!</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link rel="shortcut icon" type="image/x-icon" href="favicon.ico">
<link rel="stylesheet" type="text/css" href="assets/css/style.css">
<link rel="stylesheet" type="text/css" href="assets/css/icons.css">
<link rel="stylesheet" type="text/css" href="assets/css/indieflower.css">
<script src="assets/js/jquery-3.5.1.min.js"></script>
<script src="assets/js/script.js"></script>
<script src="assets/js/firstload.js"></script>

    <script src="assets/js/client-side-filter.js"></script>
    
</head>
<body>
    <main>
        <div id="maintext">
            <h1>Café<span id=mug> S </span>Java!</h1>
            <button class="Btn" id="uploadBtn">Select File</button>
            <form method="post" enctype="multipart/form-data">
                <input type="file" name="fileToUpload" id="fileSelect" style="display:none">
                <input class="Btn" type="submit" value="Upload" name="submit" id="submitBtn">
            </form>
            <p style="display:none;" id="errorMsg">Invalid File Type</p>
            <p style="display:none;" id="uploadtext"></p>
            <p class="responseMsg" style="display:none;" ></p>
        </div>
    </main>
</body>

</html>

#

ah

#

I was looking in /assets/images/

#

oof

#

welp. I really appreciate the help

#

and also letting me know how to get verified

#

all right, well...off I go then blobfingerguns . Have a great day @burnt rivet

sharp thicket
stuck fractal
#

!docs verify

proud scarabBOT
stuck fractal
#

Please follow those steps to verify with the bot, and then you can send a screenshot of what you're doing

#

It makes it a lot easier to spot what's going wrong

sharp thicket
#

ok thanks

lucid junco
#

You need to set up the python serve first.

#

Then use Wget

sharp thicket
#

I've SSHd as directed and then gone into the home directory. I have set up the python server as directed

lucid junco
#

Open a new terminal

#

And don't ssh in.

#

just use wget etc

sharp thicket
lucid junco
#

It worked for me earlier.

Both attackbox and VM.

sharp thicket
#

I've been trying for an hour

#

Now, use Python 3's "HTTPServer" module to start a web server in the home directory of the "tryhackme" user on the deployed instance.

so that doesn't mean make sure you're in the home directory?

#

sorry I don't get what you mean...

#

but aren;t I just doing what it says? I'm in the home directory of tryhackme user

#

I still don't understand lol

#

but that's not what the task says

#

if it had said find the file and then start the web server and then download it I'd know the directory to be in cos we establish you need to know the exact location

#

I get what you mean but I also think it's a bit ambiguous

#

but ok

#

thanks

#

oh I must have done cd ..

#

which then put me in the home and not the home/tryhackme

#

ok thank you

tall blade
#

trouble using hashcat

white salmon
#

hey in tryhackme it says there must bu a flash.min.js file

#

but in website there isn't

#

whats the problem

woven token
#

what room is this?

white salmon
#

WEB - Walking an Application

white salmon
woven token
#

i just check it

Screenshot_2022-04-20_at_01.04.55.png
#

did you try reload the page with open debugger?

woven token
white salmon
#

I just tried again but its not working

white salmon
woven token
#

ig no, but it should work

white salmon
#

ah man okay I understood, I have done this in Contact page it worked

#

thank you

woven token
#

did you visit /contact tab?

white salmon
#

ahahhahah

white salmon
woven token
#

nice

white salmon
#

thanks @woven token

green minnowBOT
#

Gave +1 Rep to @woven token

woven token
#

good luck

white salmon
#

you too man

fickle thistle
#

does someone knows why it doesn't spawn the reverse shell even does it injects the payload?

Screenshot_2022-04-19_20_14_28.png
#

i have my listener but it doesn't get any connection

woven token
fickle thistle
woven token
#

what is the room name?

fickle thistle
woven token
#

are you sure this is correct exploit for it? @fickle thistle

fickle thistle
woven token
#

did you found ||/management|| directory?

#

all i can remember from that room, i didn't even use any exploits to get a shell

fickle thistle
#

i may well just see if i can create another PoC

woven token
#

i see, well sorry for not helping you on this one, i guess you need to ||try harder|| then

#

good luck

fickle thistle
silent gyro
#

Hi , im doing https://tryhackme.com/room/adana
im where i need to use sucrack to bruteforce hakanbey user ,i used the wordlist from the subdomain folder in task-1 ,and i modified it with every line start with 123...
no results at all ..

unknown.png
TryHackMe
TryHackMe | Different CTF

interesting room, you can shoot the sun

idle flume
errant skiff
#

i need help

#

with task 1

#

i am not able to guess the cod

#

by using that tool

proud scarabBOT
fickle thistle
idle flume
fickle thistle
woven token
midnight rivet
#

Hi
I'm stuck!
room: room/techsupp0rt1
I need just a hint
I'm sure I did everything right but got nothing
Maybe I missed something, so I need ur help!

left thunder
cedar anvil
toxic summit
#

I am struggling with the file inclusion room, challenge 3.

#

Been tinkering around on Burpsuite for hours and nothing works.

#

No flags

#

I hate that I can't share images lmfao

proud scarabBOT
toxic summit
#

Woot!

#

Damn it, I didn't edit the IP properly. Whatevs

#

And then I get this and I want to cry lmfao

#

Post is working!

#

It worked fine through curl.

#

Weird, the curl one does not mention "file name" or anything like that.

#

I did this and boom, instant results.

#

Got it.

opal lichen
#

How can I get more points then the task allows? For example in the room Pickle Rick. 🤔 With 3 Questions answered u'd only get 90 points, but on the Scoreboard some have got 240 pts

#

ah, okay. Thanks. That was driving me nuts, searching for hidden dragons 😄

green minnowBOT
#

Gave +1 Rep to @burnt rivet

toxic summit
#

How can I give rep to @burnt rivet ?

#

Thanks!

#

sigh

#

Thanks.

#

smh

#

Thanks!

green minnowBOT
#

Gave +1 Rep to @burnt rivet

toxic summit
#

There we go. I am so tired.

fickle thistle
toxic summit
#

I was this close to getting stuck on the very last XSS one, got the cookies, decoded it, didn't work. Apparently there's a bug?

#

Makes sense.

fickle thistle
toxic summit
#

I did. I wasn't the only one who was wondering what happened.

marsh spire
#

Hello can i please get help with Linux Fundamentals Part 3 task 6 q2

#

im real confused at what its asking

lucid junco
#

Have you opened the crontab?

marsh spire
#

yes

#

@reboot /var/opt/processes.sh

lucid junco
#

There you go.

marsh spire
#

thats the only proccess

#

but the answer isnt reboot

lucid junco
#

It is.

marsh spire
#

oh ffs its @rebot

lucid junco
#

But with something added.

#

😄

marsh spire
#

@reboot

#

god dammit

lucid junco
alpine inlet
#

Hello im on task 6 in linux privilege escalation room and im supposed to use one of the services listed by sudo -l to gain a root shell. I am confused on how these services can give me a root shell/ what to do

#

I went on gtfobins and almost all of them have the 'sudo' functtion

cedar anvil
alpine inlet
#

wait so the point isnt to be able to run other commands as root?

#

besides the ones listed there?

#

in task 6 it doesnt ask to read any files, it simply asks to gain a root shell

#

dont think so

cedar anvil
#

Oh there different

alpine inlet
cedar anvil
alpine inlet
#

is the one im doing old? should i rather do the new one?

#

ok ill do both

#

so if youre saying i can read/write, would i use it to edit the files in one of these ?

#

I am, its open

#

oh shxt you can click on them

#

😂

#

thanks @burnt rivet

green minnowBOT
#

Gave +1 Rep to @burnt rivet

real kelp
#

someone have a link or something for hacker forum in deep web?

#

only for watch if programming and hacking is right for me

cedar anvil
real kelp
#

but is a fee site

#

if i want to learn i would to pay

cedar anvil
#

!docs free-path

proud scarabBOT
cedar anvil
#

Outdated a bit but still a nice resource

real kelp
#

for real, i want to try for play my city hall site, just for funny and try myself

#

hack*

cedar anvil
real kelp
#

okok i just joke

#

no snitch what do you do ro

#

someone know terminal-comand for mac ?

tidal sedge
#

🤔

inland onyx
#

-warn @real kelp We are not helping you to hack anything illegally. That's a quick way to get yourself put in prison, and it's not something that we will condone in here, on grounds of both ethics and legality.
Equally, if you see making a moderator aware of someone causing trouble as "snitching" then I suggest you leave -- we have no time for miscreants or idiots.
If this happens again it will escalate to a ban :)

green minnowBOT
#

⚠ Warned rednail#2314

cedar anvil
#

But the "snitching" part was said by another guy, not the one who got the warning Thonk

left thunder
cedar anvil
#

Oh they changed it

inland onyx
#

@cedar anvil the heck are you on about?

Screenshot_20220422-095538.jpg Screenshot_20220422-095530.jpg Screenshot_20220422-095520.jpg
cedar anvil
inland onyx
#

Gotta love the cache, dontcha

cedar anvil
steady stratus
#

cache this

#

cache that

#

cache these hands

lucid junco
#

I went to an internet cafe the other day, they declined my card, said it was cache only.

#

I'll see myself out.

ripe hedge
#

Thank you @inland onyx

green minnowBOT
#

Gave +1 Rep to @inland onyx

inland onyx
#

o7

cedar anvil
quasi musk
#

Packets & Frames task 6: Terminate the static site lab deployed in tasks 3 and 5. What to do?

#

Oh

#

That isn’t too difficult

winged harbor
#

could I get some help with the reverse engineering rooms

winged harbor
#

I don't know how to preoceed

lucid junco
#

Which task are you on?

errant skiff
#

i am stuck on first one

lucid junco
#

In terminal where you have the file file downloaded, strings *filename

twin bear
muted steppe
#

Hi, I'm currently doing room/networkservices "Enumerating SMB" For the challenge 1 it says "Conduct an nmap scan of your choosing, How many ports are open?" which I'm not really sure what they are asking me to do ..? Am I suppose to port scan of my choosing ( so any ip / website ? ) But won't that mean the number of open port might be different by my choosing ?

#

Thanks for the clarification ! Seems like I totally misunderstood the question ...

green minnowBOT
#

Gave +1 Rep to @burnt rivet

vague pine
muted steppe
ionic root
#

Im in the network services room and I'm stuck on the question "What variant of FTP is running on it? "

#

where did they mention the variants, my guess would have been ftp and ftps - but the answer's longer than that

#

ok got it I turned on -A switch

left thunder
ionic root
#

I used: nmap -p 21 -A -vv IP, since I knew the port I was looking for, it was quick. But in a real scenario where I don't have the informaion like this, your suggestion is much better. Thanks

worthy hawk
#

Hello

worthy hawk
#

How are you doing boss

rotund gulch
#

Hello.
I am doing room "Phishing Emails 1" task 6 "Enter the defanged URL".
I did follow a video tutorial to find out how to do it, but when I put the answer it tells me it's wrong.

An error on my part or on the page?

worthy hawk
#

Yes boss

proud scarabBOT
#
TryHackMe
That topic does not exist!

Use !docs to list all of the available topics.

From TryHackMe with ❤!
worthy hawk
#

Can I Dm you or I should ask here boss

#

Ok sir

#

Lol 😂

#

Ok

#

I’m doing madeyes-castle room right nw

#

I found a login page which is vuln to sqli injection

#

Have tried so many sqli injection to bypass it but nothing still yet

rotund gulch
#

!docs

proud scarabBOT
#
TryHackMe
Here are all of the possible topics!
!docs url

Visit the help site

!docs verify

Learn how to sync your THM profile to Discord

!docs student

Learn about our student discount programme

!docs levels

View all the TryHackMe levels & point requirements

!docs room-notes

Get started with making TryHackMe room

!docs room-review

Learn about the TryHackMe room review process

!docs api

Read about the TryHackMe API

!docs koth

How to play TryHackMe's King of the Hill (KoTH)

!docs free-path

What rooms should you do? A free guide for beginners

!docs bug-bounty

Learn about TryHackMe's Bug Bounty Programme!

From TryHackMe with ❤!
rotund gulch
#

!docs verify

proud scarabBOT
worthy hawk
#

Ok 👌

#

Thanks 🙏🏾 so much

rotund gulch
rotund gulch
#

OK, I'll start again 😉

#

I tried again, but it gives me the same result.

Error_PE1.png Error_PE2.png
rotund gulch
#

I found the correct URL. Thanks for the help

green minnowBOT
#

Gave +1 Rep to @burnt rivet

quick perch
#

Anyone did battery here?

#

Lol

#

Anyone did battery here and can give me a hint on where to look, am logged in and testing for exploits but cant find an exploit

tame zealot
buoyant coyote
quick perch
#

Yes, but not in depth, just a quick glance, I'll look at it more in depth

onyx flower
#

hey

#

anyone

#

i need help in burp suite room

#

Finally, click 'Start attack'. What is the first payload that returns a 200 status code, showing that we have successfully bypassed authentication?

#

i founf the ans as :a’ or 1=1—

#

but it says it wrong someone help

#

Uh-oh! Your answer is incorrect.

#

what to do

#

i cross cheched with several walkthroughs also the ans is crt but its not accepting

stuck fractal
#

Did you copy it from somewhere that wasn't burp suite?

quiet plank
#

@stuck fractal i'm here now thanks a lot sorry for the confssion

green minnowBOT
#

Gave +1 Rep to @stuck fractal

stuck fractal
#

Ok, and now please ask your question here

quiet plank
#

alright

#

What optional argument can the ftp-anon.nse script take?

#

i'm having an issue with the answer

#

it says that it's not correct but i'm pretty sure it is

#

can i type the answer i'm suspecting here?

stuck fractal
#

Seeing as you've checked the writeups

quiet plank
#

alright

obtuse fox
#

"easyctf" seems to have a problem with the exploit. If someone know why i have this problem ? It's about the
exploit : CMS Made Simple < 2.2.10 - SQL Injection

If you can give me an answer via private message plz

bug-exploit.png
cedar anvil
obtuse fox
#

ok thx ^^

limber gulch
# obtuse fox "easyctf" seems to have a problem with the exploit. If someone know why i have t...

you just didn't install requirements(exploits and tools usually come with file called requirements.txt, in this case you didn't have "requests" module installed). It clearly says "Import Error: No module named requests". Before you get into any exploitation, exploit modification and writing I recommend you to learn core python(and some important modules like requests, socket, etc...) so you can modify, debug and write exploits. I also recommend you to learn some C/C++, since some exploits are written in C/C++, especially kernel exploits and some low level exploits. You will also need it for reverse engineering(assembly too). IT IS REALLY IMPORTANT TO HAVE GOOD PROGRAMMING BASE FOR HACKING.

serene badger
#

is it just me or does the owasp top 10 room have way harder questions then the rest so far in beginner pathway

steady stratus
worthy hawk
#

Hello

brittle crypt
#

hi guys, i was wondering if anyone has solved the brooklyn granny granny steganography challenge.

lucid junco
brittle crypt
#

brooklyn nine nine sorry I forgot to rewrite

#

In brooklyn nine nine CTF there is a picture with hidden message but I couldn't find the message

mighty root
brittle crypt
#

yes I did but I didn't find anything

#

let me write some tool I used

mighty root
#

Did you figure it out?

#

Possibly could be a passphrase for the stevhide

brittle crypt
#

steghide, strings, binwalk,stegoveritas, base64 and some scripts also try to open with some other tools

brittle crypt
mighty root
brittle crypt
mighty root
#

Did the ctf require using steg?

vague pine
# brittle crypt probably

I suggest checking out stegseek, it can brute-force the passphrase. Also if i remember correctly it is possible to complete that room without the steganography if you wish to do it that way.

mighty root
green minnowBOT
#

Gave +1 Rep to @vague pine

brittle crypt
green minnowBOT
#

Gave +1 Rep to @vague pine

brittle crypt
mighty root
fleet basin
#

i'm in the owasp room and doing [Severity 5] Broken Access Control (IDOR Challenge), but i don't really see here what should i do exactly to get the flag

#

should i change the url and walk up till i find the flag?

#

i think burp can help me in it if i'm right

digital raven
#

in tryhackme/room/tutorial, when I try to paste the IP that it gave me in a different tab, it says that it takes too long to respond

#

attackbox

#

OH I FIXED IT

#

I did this

#

lol stupid mistake

#

Also

#

II don't know the correct help channel for this

#

so how do I stop the machine?>

#

I pressed terminate

#

but it still shows

#

oh

#

ok

#

I meant the attackbox but I did it I saw the button down that said terminate

fleet basin
#

after an hour's worth of attacking i found the flag...

fleet basin
#

thank you 🙂

#

i wanted to ask help but i stumbled upon the solution

runic marsh
#

windows internals task 5 question 2, im looking at the base address in procmon but the answer is wrong has anyone figured thisone out

iron sand
#

I am in the walkinganaplication room. In task 3 I am viewing the page source. They want to know the flag from the HTML comment, and the hint is to go to the link mentioned in the comment. There is no link in the comment! The comment just says <!--
This page is temporary while we work on the new homepage @ /new-home-beta
-->

unknown.png
stuck fractal
iron sand
#

What do you mean by a path? (I'm new to this, just started 4 days ago)

#

new-home-beta. How do I go to that?

iron sand
#

I don't know. I can't get the machine to connect to the site. I tried restarting it a couple times, and I am using the web-based Kali machine in my area (US-East-Regular-1).

unknown.png
lucid junco
#

You need to start the machine.

#

Lab_web_url won't work.

iron sand
#

How many times do I need to start it before it works?

lucid junco
#

Just the once, there is a timer.

#

Are you on task one?

iron sand
#

I did all the tasks, but could not solve tasks 3 and 6 so now I am trying again. Are you referring to this button?

unknown.png
lucid junco
#

No, you're looking for the "start machine one"

#

You'll need to start that button in every room there is one, to interact with that machine.

iron sand
#

Sometimes it shows a split screen and I can see that button. Now the instructions are taking up the entire screen. How do I split it again?

unknown.png
lucid junco
#

You're using the attackbox?

iron sand
#

It always switches back to that, and I try to remember to change it back to Kali before I start.

lucid junco
#

The kali web box is out dated, I wouldn't use it.

iron sand
#

Oh, I thought attackbox was the free one, and it was better to use Kali.

lucid junco
#

Kali is best used as a VM on your host machine, OR using it as your host OS.

#

Attackbox is Ubuntu.

#

Still good if you can't get a VM on your system.

#

Using that will pop out the attackbox to a new tab in full screen mode.

#

pressing the - beside the shut down icon will *exit split view

iron sand
#

Got it. I had been doing that when the machine was running and forgot that it needs to be fully running before seeing those options again.

iron sand
#

I thought that as a paid subscriber it was best to access it using the browser.

lucid junco
#

It's preference, you can do it in the attackbox just fine, and I think I remember Tim saying that all the stuff should work on attackbox.

I'd rather use a virtual machine because I use it for other things also, if you're new to VM's it's just like having an OS in an application.

attackbox is ubuntu isn't really relevant, but it was just to show it was still linux *apolgies if you knew that.

still good if you can't get a VM, I'm not saying attackbox is bad, it's just I know some people prefer having the VM for same reason as myself, it's theirs.

#

Also with the attackbox it will revert back to the state you booted it up in, so if you mess anything (you can't important stuff) you'll be able to terminate the box and redeploy and it will be like you never done it

iron sand
#

When you say a VM, do you mean using my local installation of VMware?

#

I thought all of this stuff was using VMs.

lucid junco
#

They're all VM's but they're not stored on your computer.

#

unlike your own vm which is.

#

wither it be Vmware or Virtualbox based.

iron sand
#

Same problem now

unknown.png
lucid junco
#

Go down a little bit.

#

After two minutes it changes.

#

That should be yours.

iron sand
#

Thanks! Its working now. I didn't realize that there were 2 separate times I needed to wait 2 minutes. I thought that I had already done that.

#

So are you saying I can somehow run these machines on my own software like VMware or Virtualbox?

lucid junco
#

I use Kali Linux on Vmware, it's just like you see on the attackbox.

Any machines you need to interact with I use the ip address

iron sand
#

How do you connect it to tryhackme's network? They look like local addresses.

left thunder
iron sand
#

Thanks. Are the machines more responsive using a VM with VPN than using the browser? With the browser they are kind of slow even though I am using a machine in my area (US-east).

#

like Firefox opening when I click on it, as opposed to waiting 15 seconds for it to open. Sometimes only the top of an image will be shown, and I have to refresh the page to see the whole thing.

#

Thanks for all your help! Getting back to the original question, how do I find new-home-beta?

#

I don't remember. The machine timed out on me because it wasn't responding to me clicking on add time.

#

I have to go now. Thanks so much! I will try again tomorrow.

quick mesa
#

network services exploiting smb. I got into the share folder but im trying to open the working from home.txt doc how do i do this? i dont think the machine im in is linux or windows i pulled up the help and cant find a command to allow me to open it

terse nova
quick mesa
#

but i hit tab and it autofilled so the file exists

terse nova
#

did you use get home.txt

quick mesa
#

oh was i supposed to do get .profile?

cold eagle
#

Bro use ' becos it have spaces after each word

quick mesa
cold eagle
#

Like 'Working from Home....'

#

Check if that works

quick mesa
#

ahh i tried that and it gave me 'Working error instead of rjust \working

#

oh it got rid of my slash

cold eagle
#

Did you try autocomplete feature??

quick mesa
#

auto complete only worked without the ' and it autofilled with spaces

cold eagle
#

Btw which room are you trying to solve?

quick mesa
cold eagle
#

Lemme see my notes, just a minute

#

Use "Working from..."

quick mesa
#

ahh that worked ty, but now how do i veiw the contents?

cold eagle
#

Exit the smb and cat it

#

Cat *

quick mesa
#

ohhh so the get just downloads the files

cold eagle
quick mesa
#

can I choose what directory get sends the files to?

cold eagle
#

TBH i dont have idea

#

But as per my obs the directory from which i get into smb, get command put into that dir

rocky quartz
cedar anvil
rocky quartz
cedar anvil
#

Just click the cog/settings icon

rocky quartz
#

dooh ... thanks for that 🙂

quick mesa
#

on the telnet room, i run the nmap and im not seeing where any possible username would be? i ran enum4linux and that didnt show anything either

#

nvm i got it,

white salmon
#

hey guys i stuck at OWASP Top 10 room on task 11, it says i have to find the source code but i dont get it

left thunder
quick mesa
#

this telnet room is gross

white salmon
cold eagle
#

Look for comments on that page

quick mesa
#

i forgot to add the -c 1 to the ping command and broke it T_T

left thunder
quick mesa
white salmon
left thunder
left thunder
white salmon
quick mesa
#

crap now im running into a new issue, the msfvenom command isnt working T_T

left thunder
quick mesa
left thunder
# quick mesa

Look at the error, it seems to have something to do with the LPORT, then compare it to the command given in the task, it seems you have a typo there

quick mesa
#

welp

left thunder
#

In case you didn't know, there is a copy paste clipboard in between the split view, which makes things way easier then to type everything on your own

CopyPaste.png
quick mesa
#

that probably enough practice today if im making those types of mistakes

#

😮

jovial shale
#

how do I find a users shell

#

thank you im just not really sure how to read all this

unknown.png
green minnowBOT
#

Gave +1 Rep to @burnt rivet

jovial shale
#

thank you

mighty root
#

ah the elusive /usr/sbin/nologin....

white salmon
#

hi everyone. question - im on the intro to burpsuite module. on task 13 - it asks this:

#

but no machine is spawned or ip given

#

im an idiot

#

lol

white salmon
#

i need a hint... room owasp top 10 task 16, how can i find the ssh key ?

left thunder
iron sand
#

Got it! Thanks! Now I am trying to find the directory listing page. I looked all over for it and can't find it. Edit - found the answer here. #room-help message

unknown.png
green minnowBOT
#

Gave +1 Rep to @burnt rivet

white salmon
#

There are 10,000 different combinations of codes we can enter. We could try increasing them one by one, 0001 then 0002, then 0003, but that will take forever.

Try inputting any random reset code.

#

someone help

stuck fractal
#

Like pick a number and put that in.

white salmon
white salmon
stuck fractal
#

Well there's your problem

#

It tells you what to do, you need to read the instructions and follow them.

white salmon
#

it incorrect :(

#

i did it

stuck fractal
#

Ok, and keep reading.

white salmon
#

oki

#

Use the BruteForce tool with a code min (1) and max (10,000) value.

#

@stuck fractal

#

what this mean

stuck fractal
#

Look at what it says in the content

#

Read it

#

Take some time to understand it

white salmon
#

DUDE

stuck fractal
#

We cannot understand it for you, you have to read and understand yourself.

white salmon
#

I TRIYING

stuck fractal
#

Try more.

white salmon
#

bruhhh

#

ok man

near shoal
#

try smarter XD

#

you can do it

white salmon
#

Lol

stuck fractal
#

It will take work, but you need to put that work in

#

We cannot do the work for you, it's something you need to learn

white salmon
#

bro im SO STUCK

near shoal
white salmon
#

IDK WHAT DO

stuck fractal
#

Hacking isn't as easy as clicking a button that says hack

near shoal
#

It's like exercise. If I exercise for you, you're not getting muscles.

stuck fractal
white salmon
#

GOT IT

#

I DID IT

near shoal
#

🥳

white salmon
#

Code 0187 is correct!

#

lets goooo

stuck fractal
#

See what happens when you put the work in?

white salmon
#

Yea

white salmon
#

like i didnt look properly

near shoal
stuck fractal
near shoal
#

it's probably one of the most common mistakes.. ppl skipping stuff and not reading carefully

white salmon
white salmon
white salmon
#

anyone can help me at room owasp top 10 task 19 ? i can't find anything in source code

#

lol thx

keen seal
#

hello

#

where can i start learning, anythin ?

#

like the basics

alpine kestrel
keen seal
#

thank you

alpine kestrel
#

then continue with junior pentester

keen seal
#

ok

alpine kestrel
#

which should get you very well into your ethical hacking journey

keen seal
#

thanks a lot

alpine kestrel
#

no problem

keen seal
white salmon
#

ah found it xd

toxic summit
#

So I need help.

#

I am working on the OSWAP room and it asks me to go into a specific address.

#

But it won't load

#

SOS\

white salmon
#

Are you connected to the VPN?

toxic summit
#

Yes

#

I am using the attackbox, as well.

white salmon
#

How much time have you waited after the machine started ?

toxic summit
#

Haven't tried this on my Linux machine.

white salmon
#

Usually you should wait around 2min

toxic summit
#

Nevermind, I had the other machine from the exercise opened up.

#

Whoops!

white salmon
#

Perfect then !

white salmon
toxic summit
#

Now it's loading. I am so tired lmfao

white salmon
#

Have fun !

stone heath
#

the tool runs sucesffully but doesn't output any users?

#

not sure if i'm using the right word list but not even the default AD administrator account is popping up so not sure what's going wrong

idle flume
#

Maybe the timeskew of your machine is not matching with the victim's

stone heath
#

should that matter just for user enumeration? The tool is checking if the KDC responds back with pre-auth but it shouldn't be trying to de-crypt anything

#

this was nmap so i think the flag values should be accurate

terse nova
stone heath
#

Ok I’m dumb lol

#

I admit the thought of how the tool was supposed to know which computer to attack crossed my mind

#

Missed the top part of the instructions lol

#

Thanks!

quick mesa
#

trying to run the http server to do escalation but im getting this error and not sure what to do

white salmon
#

With python3, it's python -m http.server

#

With python2, it's python -m SimpleHTTPServer

quick mesa
#

ahh ty

quick mesa
#

i am here to ask for support again lol

unknown.png
#

i pulled and copied the id_rsa key and now im trying to crack the hash with john but none of the commands seem to be working

white salmon
#

Put the hash in a txt file instead

quick mesa
#

i copied the text from the targets id_rsa file and made my own file and pasted it into my .ssh folder. when i went to ssh , it still asked for the password so i ran the ssh2john.py and turned the id_rsa to id_rsa.hash

#

fysa this is the basic pentesting room

#

the last step

#

yall ganna make fun of me hold the file says no directory found

#

im ganna rerun the ssh2john again with full paths

white salmon
#

Well you have you answer now then lol

quick mesa
#

i hate that room omg finally finished it T_T

white salmon
#

Yaaay

lyric pebble
#

Hi guys. I'm working on https://tryhackme.com/room/dailybugle#. Trying decrypt hash passwork. Both john and hashcat suggest pass is starwars but room deny it. Any hints for me in this case? Thanks

cedar anvil
lyric pebble
#

john file_hash --wordlist= rockyou.txt

cedar anvil
#

What are the contents of file_hash?

lyric pebble
#

hashcat -m 3200 hash_file, wordlist file

lyric pebble
cedar anvil
#

can you show your hashcat command?

cedar anvil
lyric pebble
#

hashcat -m 3200 hash_pass.txt /usr/share/wordlists/fasttrack.txt

#

Session..........: hashcat
Status...........: Exhausted
Hash.Name........: bcrypt $2*$, Blowfish (Unix)
Hash.Target......: $2y$10$0veO/JSFh4389Lluc4Xya.dfy2MF.bZhz0jVMw.V.d3p...BtZutm
Time.Started.....: Mon May 9 12:23:20 2022 (7 secs)
Time.Estimated...: Mon May 9 12:23:27 2022 (0 secs)
Guess.Base.......: File (/usr/share/wordlists/fasttrack.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 21 H/s (8.24ms) @ Accel:2 Loops:64 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests
Progress.........: 222/222 (100.00%)
Rejected.........: 0/222 (0.00%)
Restore.Point....: 222/222 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:960-1024
Candidates.#1....: qwertyuiop -> starwars

Started: Mon May 9 12:22:35 2022
Stopped: Mon May 9 12:23:28 2022

cedar anvil
#

use rockyou

lyric pebble
green minnowBOT
#

Gave +1 Rep to @cedar anvil

toxic summit
#

On the OWASP room...

#

Apparently the answer is incorrect?

#

I did everything correctly.

sullen drum
#

not sure if what im doing is incorrect or if im just dumb. would like a pointer on this one. on linuxfundamentals3 room, task 4, im either not waiting long enough for my python3 http server isnt loading or something, i cannot seem to get the server to load for the wget command for question3 to continue. ive tried ^C to cancel and retry but it doesnt seem like its connecting. i can find it via ls -a then cat the file but thats not what im supposed to be learning here. Am i just dumb and not waiting long enough for the connection?

loud nebula
#

You need another terminal to use the wget

#

When you run the python command, you start a simple http server

#

Then open another terminal, use the wget command

limpid rover
#

Can someone PM me regarding the OSIRIS room. I managed to change the KP* password but it's still not working for some reason

white salmon
white salmon
#

why is the 'a' automatically spawning

unknown.png
white salmon
#

the problem persist even if i replace B with return address

unknown.png
lyric pebble
# cedar anvil use rockyou

Bro, I go to the bash now. There are two flag to go. I try privilege escalation to root but not yet success. Here is what I do

  • Check crontab, not see any envident
  • Check SUID. use find . -writable program. Not see any program can use SUID.
  • check sudo - l. Not sucess
  • nano and vi, gcc can not use anyway
  • I think python2 may have good point. But still not success

Do I miss something? Any hints for me? Thanks, Bro

green minnowBOT
#

Gave +1 Rep to @cedar anvil

cedar anvil
lyric pebble
cedar anvil
#

Yeh, but it's the same concept

cold eagle
drowsy oracle
#

hallo

#

hi

drowsy oracle
#

,maroc

#

yes

#

etats unis

toxic summit
white salmon
#

Crack it with John + rockyou

toxic summit
white salmon
#

Oh it’s okay, look at the John the ripper documentation, or you can ask for my help

toxic summit
white salmon
#

Are you using kali ?

toxic summit
#

Yep!

#

The AttackBox.

white salmon
#

Okay so you do have John and maybe the rock you wordlist

toxic summit
#

I have both.

#

Do I need to create a text file with the keys I have to hash?

white salmon
#

Yep

left thunder
left thunder
# toxic summit

Beside the above, that seems to be simply the wrong flag for the task you are on, considering the image in task 1, it's the same flag and it is about "Error handling"

white salmon
#

Oh 😅

toxic summit
#

I did the Burpsuite thing and I got that flag, Weird.

#

But if I use SQL injection directly...?

#

I got the correct key.

#

Ummm

#

Task 3 completed!

#

I should be happy but I am mostly confused now. lol

white salmon
#

Well sometimes, the answer is easier than it seems hahaha

toxic summit
#

And now the next step of the exercise leads me to this.

unknown.png
#

Which leads me to getting nothing but 200 OKs

unknown.png
#

Kinda sus ngl

#

There. Changed it and now it's running. Now I am not getting 200's.

#

But I am getting 500's

vague pine
#

Did you also changed the HTTP Method?

toxic summit
#

NVM Had a typo. Fixed

toxic summit
#

Who would use "bitch" as a password? lmfao

lyric pebble
# cedar anvil Yeh, but it's the same concept

I have user and pass of root, database mysql now (from config file joomla). But still not yet clear what to do. As far as I know, we can gain privilege by exploit my.cfn of mysql config to add toxic library of us. But I still stuck here:

  • file python to exploit can not work, because of error not have library mysql.connector
  • mysql not run under root. It run under mysql user (use: ps aux |grep mysql)

What can I do here? Thanks

green minnowBOT
#

Gave +1 Rep to @cedar anvil

cedar anvil
lyric pebble
green minnowBOT
#

Gave +1 Rep to @cedar anvil

orchid flare
#

doing wonderland and I cant even get a foothold, found that there is ||/r/a/b/b/i/t and /poem|| but this didnt get me anywhere

orchid flare
#

nvm found it

lyric pebble
#

Hi guys, I need your help. In the room https://tryhackme.com/room/skynet. I got in the squirrel email and have smb password of milesdyson ( )s{A&2Z=F^n_E.**) But I can not login smb of this account use smbclient. Password have some special character and can not process
Command:
smbclient //<ip>/ -U milesdyson
Password for [WORKGROUP\milesdyson]:
Any hints for me? Thanks

idle flume
#

You need to specify a share name

humble nimbus
#

why everytime doing nmap keep saying file doest exit?

cold eagle
rigid badger
#

Needing some help with pwn101 room... I'm on the final pwn challenge (10) and have crafted my exploit, the only trouble is that I am getting a strange segfault in _dl_get_tls_static_info+21

Seems no matter what gadget I use to get the required value in RAX, I get a segfault.

Edit - room link https://tryhackme.com/room/pwn101

cold eagle
rigid badger
#

Rgr. All good anyway I managed to solve it using a diff approach, gamblers remorse got me good though 😛

stuck zealot
#

hey having a bit of trouble with https://tryhackme.com/room/postexploit
whenever i work on task 2 i'm able to ssh into the machine but the instructions, and instruction commands don't seem to work properly.
it wants my to start powerview using "..\Downloads\PowerView.ps1" which doesn't seems to work on the vm, as well as further commands like get-netusers and get-netgroup aren't working

stuck zealot
#

i see, so i guess i missed the space on the . . then, thanks

humble nimbus
#

keep saying no directory,

idle flume
granite meadow
#

Hey, which of the following is like johntheripper?

hexed crescent
granite meadow
#

Oh, i really need to read more carefully, thanks

lusty rampart
#

Hi. I'm new, and seem to be having a struggle!

#

"What is the flag from teh HTML comment?"

#

What is a flag?

#

Ok figured it out. Flags are the THM{}

#

And they must include THM

#

OK, the intent is you spellunk the page, find stuff you need the page source for, and copy+paste the THM{} words you find in teh most suitable-sounding answer box

lyric pebble
#

Hi guys, I'm in room https://tryhackme.com/room/relevant try to blackbox service website. I try some method include:

  • Nmap discover vulscan/vulscan.nse -> not found vulnerable
  • Gobuster -> not found any directory
  • Check service vulnerable: port 80, 135, 139, 445, 3339 -> not yet found anything
    Do you guys hints me something? Thanks
lyric pebble
green minnowBOT
#

Gave +1 Rep to @idle flume

waxen wave
#

I am so much stuck in this question: Cyber Defence room | Splunk 2 room
Task 6 | What unusual file (for an American company) does winsys32.dll cause to be downloaded into the Frothly environment?

method._2.png splunk_3.png splunk_error.png
jovial shale
#

anyone know why this isnt working?

cold eagle
cold eagle
lusty rampart
#

How do I open http://MACHINE_IP/sitemap.xml?

#

I've run ifconfig, and tried that, but not working

#

eg http://10-10-110-208/sitemap.xml

cold eagle
lusty rampart
#

Yes

cold eagle
#

http://<ip>

lusty rampart
#

Standby; restarting machine

cold eagle
cold eagle
cold eagle
proud scarabBOT
lusty rampart
#

Works now; the machine restart worked, and the link was replaced with the actual IP

cold eagle
lucid junco
lyric pebble
cold eagle
lyric pebble
#

Thanks for your hinds. In term of enumerate, use nmap scrip, I found some smb directory include:
smb-enum-shares:
| account_used: guest
| \10.10.96.159\ADMIN$:
| Type: STYPE_DISKTREE_HIDDEN
| Comment: Remote Admin
| Anonymous access: <none>
| Current user access: <none>
| \10.10.96.159\C$:
| Type: STYPE_DISKTREE_HIDDEN
| Comment: Default share
| Anonymous access: <none>
| Current user access: <none>
| \10.10.96.159\IPC$:
| Type: STYPE_IPC_HIDDEN
| Comment: Remote IPC
| Anonymous access: <none>
| Current user access: READ/WRITE
| \10.10.96.159\nt4wrksv:
| Type: STYPE_DISKTREE
| Comment:
| Anonymous access: <none>
|_ Current user access: READ/WRITE

nmap script also say that:
| smb-protocols:
| dialects:
| NT LM 0.12 (SMBv1) [dangerous, but default]
I search and find some one use eternal blue + mysmb.py but still not yet success. I guess I not yet have username and password require in file. My pipe name I use: 'nt4wrksv'

Any hints for me? Thanks

green minnowBOT
#

Gave +1 Rep to @burnt rivet

lyric pebble
#

Ohh, My bad. I see report Anonymous access: <none> and don't even check it
Now I have user Bob, Bill and their password. But I can not access use smbclient with these account. It have error "tree connect failed: NT_STATUS_BAD_NETWORK_NAME". I use command
smbclient //10.10.209.60/C -U Bob
I guess the command need a Workgroup but I can't find it. I try nmblookup and enum4linux but not success
I try use IP as workgroup, still not success
So, what can I do now? Thanks

green minnowBOT
#

Gave +1 Rep to @burnt rivet

fossil mantle
#

Nmap is showing all port closed in the network services/task 6 room. can anyone help?

white salmon
#

Hello I need help with room Cross-site Scripting task 8. I could get my coockie with nc but not the staffs

median matrix
#

If anyone is wondering about the RegEx room’s task 2 q5, the answer is [fF]ile[^7] and this worked for me.

honest smelt
#

Hi, is anyone here that can help me with the Snort Challenge - The Basics room?

#

I'm on task 3, and the question is "What is the FTP service name". Not sure how to find this in the log file.

short wing
#

do we need to know basics before studying introduction to honeypots room ??

humble nimbus
#

why i keep getting no such file or directory? (sudo chown root bash)

#

task 4

proud scarabBOT
severe leaf
#

I am stuck in this question
What is the syntax of the command to use Impacket's addcomputer.py to add a new computer to the lunar.eruca.com domain using the AD credentials of test:pass, with the LDAPS method, with the hostname of thmtest, and the password of computer1?

honest smelt
#

Hi, is anyone here that can help me with the Snort Challenge - The Basics room? I'm on task 3, and the question is "What is the FTP service name". Not sure how to find this in the log file.

fluid garden
#

Hi! I'm really new to all this so I have no idea how-
I need help with this question:

What is the syntax to ping 10.10.10.10?

#

It's for the what is networking room

modest orchid
modest orchid
peak sail
#

Hi. I am working https://tryhackme.com/room/linuxprivesc Task19 NFS following along on my Kali VM (using vpn). I keep getting the following error while trying to mount. "mount.nfs: requested NFS version or transport protocol is not supported"

fluid garden
modest orchid
fluid garden
#

:D

west plinth
#

Walking An Application
Q3 - What is the directory listing flag?
Can anyone give me a hint? Super lost on this question
Also - I cant see anywhere "secr" as it advises

peak sail
#

Help! Hi. I am working https://tryhackme.com/room/linuxprivesc Task19 NFS following along on my Kali VM (using vpn). I keep getting the following error while trying to mount. "mount.nfs: requested NFS version or transport protocol is not supported" These are the exact commands i copy/paste:
mount -o rw,vers=2 10.10.10.10:/tmp /tmp/nfs

stuck fractal
peak sail
stuck fractal
#

Run the VPN directly in your Kali VM

#

Not on your host OS

peak sail
lament whale
#

I'm running RootMe, trying to shake down a few easy boxes for a class I am teaching this week. But for some reason I absolutely cannot catch the reverse shell. I've triple-plus checked the IPs and ports, redownloaded the pentestmonkey shell on my own VM and multiple AttackBoxes, reset the target multiple times, tried multiple extensions on the revShell file, sudo and non-sudo listener commands with varying tags (except -l of course)...no dice.

Anyone have an idea of what I might be missing?

#

I've tried about a dozen different ports, too, for the record.

white salmon
#

Hey! I'm currently working on Task 10: Exploiting FTP in the Network Services room (https://tryhackme.com/room/networkservices). Initially when I tried to run Hydra on the target machine to get the login password it ran for an incredibly long time with no results. After suspecting that something may be going wrong, I read a write-up which showed that hydra was in fact attempting the correct password in the first batch of attempts but it was not being recognised as correct. What is going wrong here? I am using the same IP address that you use in the ftp command from the previous task as I am in the hydra command.

TryHackMe
TryHackMe | undefined

TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!

left thunder
white salmon
left thunder
white salmon
left thunder
white salmon
left thunder
white salmon
left thunder
white salmon
left thunder
#

I should have asked first, you are connected to the thm vpn, right?

white salmon
green minnowBOT
#

Gave +1 Rep to @left thunder

left thunder
vestal bison
west plinth
#

and then you have to click on access i think

vestal bison
#

That worked, thanks so much! i was stuck on this for so long

west plinth
#

yeah so was i lol

west plinth
#

how to "Save the results from this command into a file called valid_usernames.txt which we can use in a later task and then answer the questions below"

#

ok ty

#

also is there an actual application on the machine called ffuf? i cant seem to see it , or just use "ffuf" into the terminal

west plinth
#

anyone can assist with Authentication Bypass task 3? brute force, very stuck on this

#

ya

#

like where do i enter the "bruteforcing with ffuf" information?

#

ive tried that but it just does nothing

#

got the file saved , but when running the command it doesnt do anything

proud scarabBOT
sharp jewel
#

hi everyone i need help i'm stack on task 8

#

shell.jpg.php 🥲

#

didn't worked for me

torn wren
#

workoing on windows privilege escalation and trying to rdp to the windows machine, but getting an error

#

"Failed to connect , CREDSSP required by server"

#

this is the command i used rdesktop -u user -p Password1 x.x.x.x -g 60%

#

googled the error but not able to find the required answer to solve this issue

#

how to solve this issue?

ember vale
ember vale
torn wren
ember vale
torn wren
torn wren
green minnowBOT
#

Gave +1 Rep to @ember vale

cold eagle
sharp jewel
honest jay
#

in room Internal
how can i browse the internal port 8080 from my machine because i can't understand how can I use port forwarding that much

pallid moss
lucid junco
#

For Safetygirl.

If you look through the images you'll find one that looks like this with the phone model & number.

Spoilers for Networkwork miner.

SPOILER_unknown.png
toxic depot
green minnowBOT
#

Gave +1 Rep to @lucid junco

lucid junco
#

Also room creator is THM, think it was ujohn.

cedar anvil
spark hemlock
#

Hi, I need some help with Biblioteca. I managed to get a potential username but Hydra hasn't been able to help me with rockyou. Any hints would be helpful

terse eagle
spark hemlock
#

Yeah, sorry found it. Should have said so. Thanks for the reply

green minnowBOT
#

Gave +1 Rep to @burnt rivet

plush girder
#

guys i'm hard stuck on vulnversity , need some help with the challengs

#

looked up the suid that had bits set, only /bin/systemctl had results on gtfobins

plush girder
#

nothing

#

let me send a sc

#

enable --now $TF ?

#

or which

#

it should be /tmp/output ?

#

so ?

#

copying the content of root.txt to /tmp/flag ?

#

says permission denied

#

even with root

slow scaffold
# plush girder says permission denied

Lassi is showing you the way... Ignore this problem for a second, what command would you normally use to copy the content of one file to another? I don't think it's what you are trying. Might help if you make sure you are clear that this breaks down into two parts so be clear on what /bin/sh -c does and also what "/root/root.txt > /tmp/flag" does.

elfin inlet
#

Hi guys! I need some help on the LinPrivEscNFS. I have mounted the share to a folder in my /tmp, and then go ahead and create and compile the binary that I want to run on the target, but when I run it on the target i get: ./nfs: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./nfs)

I'm not sure what I am doing wrong, can anybody give me a hint or point me in some direction?

#

I compile my binary on my system. Is the target system missing some dependencies?

#

I re-created the one in the task:

int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }

#

And then compiled that with gcc nfs.c -o nfs -w

cedar anvil
elfin inlet
#

I am running the gcc from my machine, but inside the folder that is mounted in the target

cedar anvil
#

check if gcc is on the target(if you have access to it), it might need a specific version or something

elfin inlet
#

The target does not have gcc installed

#

😦

#

I now tried running them without compiling them first by setting the SUID on the nfs.c instead;
chmod +s nfs.c
chmod +x nfs.c

But when i try to run it from the target machine (have ssh access), i get a Syntax error :/ I don't know C to can't actually confirm that the syntax is correct.

./nfs.c: line 1: syntax error near unexpected token ('
./nfs.c: line 1: int main()'

#

I will give that a try instead 🙂 Thing is i've been following along with the witten material asociated with the lab, and I just assumed it would work. Now I now that in the real world I would need to be flexible, but in this case, following the written instructions has always worked :/

Will try with python or bash instead and see if I can manage to get it to work 🙂

elfin inlet
#

I kept trying, but still don't succeed. I tried writing a tiny bash script that just cat out the content of the file /home/matt/flag7.txt, but I still get "Permission denied" :/

#

Hmm, okey, fair, i'll give that a shot 🙂

#

Doing the same thing (compiling the binary) from the attackbox instead of my local machine did it, it worked now 👍 Been pulling my hair in this one for 2 hours ^^

#

Thanks @burnt rivet for the help 🙂

green minnowBOT
#

Gave +1 Rep to @burnt rivet

plush girder
glass pine
#

Hi, im currently going through the Jr. Penetration tester path and im currently on the cross-site scripting room. Ive been stuck on the last task for hours trying to get the final payload to go through. Ive tried using a netcat listener, python http server, and nothing. I was able to see a request get sent when i use https however any http is being blocked due to the site being in https. When i load the site in http it is blocked by CORS policy. I still see what i believe is the flag in the reaponse i get under console however when i enter it for the answer it is wrong. Has anyone been able to solve this or is it a bug in the room?

left thunder
glass pine
green minnowBOT
#

Gave +1 Rep to @left thunder

glass pine
green minnowBOT
#

Gave +1 Rep to @left thunder

left thunder
glass pine
green minnowBOT
#

Gave +1 Rep to @left thunder

split sequoia
#

was there an easier way to find the username for box set there's no way the authors thought you'd sit there forever

cedar anvil
#

But other than that, you have to use an obscure top 22 ssh password wordlist with crackmapexec so that is annoying

split sequoia
#

Not sure why they thought doing that was a good idea

cedar anvil
#

Yeh, it's meant to be real world and this is what real world means

#

🤷

split sequoia
#

Uh with 0 lockout policy in place ? No

cedar anvil
#

The box is older tho, but yeh, somethings have to be taken out, but at least defender is running I guess

onyx plank
#

#site-support message my bad @ Fontane. Am I supposed to use "profiles" instead of "secret"?. Network Services task 4

left thunder
#

Beside that, I'm not sure what the wildcard is good for after -p

onyx plank
#

There were multiple but it was the one which was interesting apparently

onyx plank
worldly granite
#

hi guys i have a problem with the Blaster room
i can't find the history in the explorer browser
they are only today history

stuck fractal
#

@worldly granite Please do not post the same message over many channels, it is spam.
That's a known issue with the room but it does not stop you completing it, it just makes it a little more difficult.

worldly granite
#

But if i didn't find the historic how can find the cve to use ?

stuck fractal
#

Standard enumeration

worldly granite
#

Okey thanks

#

I will try winpeas script

weak token
#

I think the "Brute Force" section in the Authentication Bypass part of Introduction to Web Hacking, may have some errors. I've checked my syntax over and over, and it's not giving the expected results... I should get back one entry that is not a 200 response code, according to the lab, but I'm not getting any entries. I have no returned errors, and I am getting 200 responses, so the ffuf command is working as it should, just not getting what I need back to complete the lab.'

#

yup

proud scarabBOT
weak token
#

!notifyme

proud scarabBOT
#

Ok @weak token, you will now be notified of future announcements.

weak token
#

It works now, just needed to restart both machines for some reason

iron sand
#

In room Basic Pentesting, I am trying to use GoBuster and am getting this error. "Error: unknown shorthand flag: 'u' in -u

GoBuster_Error.png
stuck fractal
iron sand
#

I was using the video in the beginning of that room for instructions. I guess I should do the "Web Enumeration" room first? Or "Easy Peasy"?

dim fractal
#

in the capstone challenge of linux privEsc, will john work for missy's hashed password or do i need to find something else?

ember vale
dim fractal
green minnowBOT
#

Gave +1 Rep to @ember vale

trim haven
#

gobuster dir [rest of command]

warped rune
#

gobuster is so slow i am dying

ember vale
#

there are alternatives (I prefer ffuf or wfuzz), but scanning is something you can do in the background while you investigate things manually. Get used to it taking a while 😉

warped rune
#

yeah i figured, i did some google and there isnt really any speed options i can find so I just figured thats what I should be doing (investigating other things) multitasking

#

eh i found what i needed all i had to do was complain, thanks

ember vale
#

np 🙂

iron sand
green minnowBOT
#

Gave +1 Rep to @trim haven

heavy beacon
#

hi can somebody help me for the follwing question

#

its the DNS in Detail page

#

the last question of task 4

#

"What type of server holds all the records for a domain"

#

im pretty sure its Authoritative DNS

lucid junco
#

It is. 🙂

lucid junco
heavy beacon
#

nope ive typed it in acouple times

lucid junco
#

Here's a tip.

#

If you look at the answer without answering anything, it will show you *

#

This will give you an idea of the size of answer it will accept.

heavy beacon
#

true

lucid junco
#

So you got the correct answer ||just drop the DNS part||

heavy beacon
#

ohh my god damn

#

i typed authoritative DNS

#

yeahh that makes sense tysm

lucid junco
#

Happy Hacking 😄

heavy beacon
#

👽

mossy elbow
#

im at this room and i found out the username, but trying to bruteforce with hydra either results in nothing or takes a very long time

unknown.png
#

with which wordlist are you supposed to bruteforce the ssh credentials?

#

nvm finally found smthg

slate torrent
#

Hi I'm having trouble with Practical Example of SOC. I can't figure out which IP addresses I am supposed to block can anyone help?

shadow quail
#

why cannot post pic heree

lucid junco
#

Oh,

#

You need to verify

#

!docs verify

proud scarabBOT
tulip mural