koth

[steep agate]

little trick

heart palpitating

[jovial field]

nah I wouldn't fear lockbit

The head of lockbit was captured not too long ago

[steep agate]

one of the admins/dev not the main creator/founder

[jovial field]

https://www.heise.de/en/news/Lockbit-Investigators-claim-to-have-uncovered-the-head-of-the-ransomware-gang-9711250.html

I read it there

[keen remnant]

are linux kernels all the same version on koth?

[steep agate]

no

-- Debian kernel(s)
----------------------------------
carnage: 3.16.0-6-amd64

----------------------------------
-- CentOS/Rhel kernels
----------------------------------
panda: 3.10.0-862.el7.x86_64
shrek: 3.10.0-862.el7.x86_64
tyler: 3.10.0-1062.18.1.el7.x86_64

----------------------------------
-- Ubuntu 16 kernels
----------------------------------
lion: 4.4.0-87-generic
hogwarts: 4.4.0-1112-aws
spacejam: 4.4.0-142-generic

----------------------------------
-- Ubuntu 18 kernels
----------------------------------
production: 4.15.0-91-generic
h1-easy: 4.15.0.135-generic
food: 4.15.0-91-generic
fortune: 4.15.0-96-generic
hackers: 4.15.0-99-generic

----------------------------------
-- Ubuntu 20 kernels
----------------------------------
h1-hard: 5.4.0-1037-aws```

[keen remnant]

wow ty

[sour vector]

Gave +1 Rep to @steep agate (current: #133 - 50)

[stiff egret]

Lynx.

[violet zealot]

so u had to adapt ur lkm for every machines?

[fading moat]

Just build it using the appropriate headers.

And do some preprocessor ifdefs to handle older kernel versions which do not support the regs convention ig

[steep agate]

yeah, and it's very tiring

[steep agate]

No bro, if you compile an LKM in a kernel version, for example 4.4.0-186-generic, if you try to load the LKM that you compiled in that version, and try in version 4.4.0-142-generic it will no longer work more

[steep agate]

Remembering that most koth machines do not have make installed

[violet zealot]

that's why u have to upload ur own, like chattr etc

[eager fern]

Didn't have VPN setup last time, first config didn't work for some reason. but 2nd one did.

lets see how i do this time https://tryhackme.com/games/koth/98808

[eager fern]

learned 2 things doing the last one

Upcoming https://tryhackme.com/games/koth/98821

[brisk stump]

need some help for this one?

[eager fern]

havent found/learned anything yet 😛

usual ftp, ssh, httpd, some rpc on this one

[brisk stump]

try telnet on port 9999

i wonder how this dude gets points with 0 flags

[steep agate]

? telnet on 9999? lol

[eager fern]

I nmap'd it a few times, but only with --top-ports 50

[steep agate]

port 9999 is where the king/KoTH service is hosted, every 1 minute if your nickname is within king.txt 10 points will be counted

[brisk stump]

mybad 3333

telnet ip 3333

[eager fern]

Scanning 10.10.20x.x [100 ports]

[brisk stump]

who ever is playing right now, tell me how you did that 😄

@fossil pecan

[fossil pecan]

?

[brisk stump]

are you playing ? or are you supporting spraykatzz?

[fossil pecan]

Oh no haha, forgot I joined another one

[eager fern]

I found a zip file

[brisk stump]

zip2john

[fossil pecan]

^ or fcrackzip

[eager fern]

Speed.#1.........: 4017.7 kH/s (0.15ms)

Status...........: Cracked

came close

[brisk stump]

kinda pain if you dont know if higher tier players lock everything :S

[obsidian lark]

there's no anyone called "higher tier players" 🤣

[sweet surge]

no

[bitter tree]

Why not just use netcat? 👀

[near lily]

Pwncat-cs FTW.

[brisk stump]

im noob sir

[bitter tree]

Learn netcat, it’s a very useful tool

[brisk stump]

i use it for reverse, didnt know i can do telnet with it

[bitter tree]

I’d say learn how sockets and protocols work over them too.

[brisk stump]

teach me senpai

[bitter tree]

No thank you

[sour vector]

Gave +1 Rep to @brisk stump (current: #2080 - 1)

[brisk stump]

any link you would share 🙂 ?

[bitter tree]

HTTPS://tryhackme.com

[violet zealot]

me

[broken pilot]

https://tryhackme.com/games/koth/join/d9431f0d5e7e8eb9af39a85a

starts in 20 mins

[obsidian pelican]

so lost in the sauce with this koth, just did my first one and only found the flags

[stiff egret]

I hope you enjoy this, KoTH has been one of the most exciting learning experiences I've had which laid a foundation to where I am today

[bitter tree]

It's okay to be lost in the sauce. There's some very talented people that play KoTH and are normally open to answering questions/give guidance on the approach they took.

[obsidian lark]

Warning: it’s addictive

[jovial apex]

any beginner here wants to play?

[violet zealot]

imagine complaining about poping urandom on a shell and then killing shells... @young bramble

so i take back ur word : really?

[violet zealot]

damn

people who can't play koth without killing shells apparently

[young bramble]

I don't quite understand why players concentrate on other's people sessions instead of the king.txt. You were doing quite fine protecting king.txt there was no need to spam my terminal with urandom. I would't do it unprovoked. I never kill other people shells unless they ask for it. Great game BTW. I'm impressed. You made me rethink my notes on Carnage

[young bramble]

and btw, using commands without relative or absolute path makes your scripts vulnerable ... in your case it was enough to add an alias for hostname="kill -9 $PPID" in your .bashrc and this is why your session was killed

[violet zealot]

and as i said i was just trying it, and killed it right after

it's a bit extreme to respond to it by killing shells the whole game

[violet zealot]

didn't understand this part

[young bramble]

I will check the pspy log more carefully but I know the urandom didn't stop until I killed the cat process myself from another shell

[young bramble]

as I've said I added an alias command replacing the command 'hostname' with killing parent process. I don't know if you executed manually hostname or the pwncat stabilize was doing it. I've just seen it on pspy and took advantage of it. Technically you were killing your own shells

[young bramble]

there... you were on pts/4 on a real terminal. If you would have been pressing Ctrl+C faster than me killing it ... anyway sorry for not seeing you writing on one of my terminals (pts/1) that you were "just testing" ... on me

[steep agate]

just use ssh with -T

for enter in ssh without TTY

and the problem with urandom will be """"resolved""""

[young bramble]

realy "resolved" ? 🙂

[steep agate]

That's why I put a lot in quotes haha

[steep agate]

but, if you have a reverse shell, and don't have an interactive shell, just for example with "/bin/bash -i" , you can't, in some cases 😎 @young bramble

No such file or device 😳

[young bramble]

Yes, reverse connections to C2 cannot be spammed with urandom so you're "safe", But the idea was to not mess with other users terminals because this can degenerate really fast and end up with while loops writing on all terminals 😄... Then it will be no fun playing even for other unsuspecting players.

[steep agate]

In fact, you're not even safe with C2 and reverse shells, I know another really cool trick haha

[young bramble]

flooding the c2 ?

[steep agate]

no

hehe

[young bramble]

it would be against the rules

[violet zealot]

every time i try it doesn't work

so i gave up lmao

[steep agate]

Now, are you safe HEHEHEHEH @young bramble

[young bramble]

damn that's magic.. 2 windows antiviruses on linux without wine

[steep agate]

It has nothing to do with C2 flooding 🙂

[steep agate]

https://tenor.com/view/magic-sorcery-mickey-mouse-fantasia-gif-13645229

No either haha, there are tricks that I will never reveal 😄

[young bramble]

Good. Powerfull tricks are dangerous. And in the wrong hands can create chaos 😄 Or script kiddies will brag how good they are... with your work.

[young bramble]

for me worked everytime... I always keep one -T ... how did you try ?

[violet zealot]

ssh root@ip -T

[steep agate]

Yeah, that's why I might never reveal LKM's tricks haha, oh other than the research I did, which I'll publish later, on how to "defeat" LKM rootkits

worked against @fossil pecan

hahaha

[steep agate]

it's correct

[steep agate]

It works for me too, it's strange that it doesn't work for him 🤔

[young bramble]

maybe it didn't work because I was periodically changing passwords for all users and rewriting ssh keys, or maybe root login is disabled in sshd config... I've seen only a few koth machines with root login enabled

[violet zealot]

never encountered that

did u do it manually or inmplemented it in ur script?

and no it didn't work for me multiple times, not only on this game

[bitter tree]

I mean technically isn’t everything “not safe” if you have an LKM 🤣 You’re basically an extension of the kernel, no?

[steep agate]

kernel extension? what?

[bitter tree]

LKM = Linux Kernel Module right?

[steep agate]

yeah

Loadable Kernel Module

[bitter tree]

They extend the functionality of the kernel, giving you access between Ring 0 and Ring 1, right?

[steep agate]

then you compile, now just load for example "something.ko"

[steep agate]

ring0

kernel mode

[bitter tree]

But with how they’re executed, if you can hook a write() you could technically hook fork(), exec(), socket(), init_module(), etc

Right?

[steep agate]

This is very weak in terms of hooking other syscalls

[bitter tree]

But possible or nah?

[steep agate]

Well, you can try haha

[bitter tree]

Unfortunately don’t have the spare time currently, but from the article @fossil pecan sent me on LKM rootkits you can hook almost any system call from an LKM with the right knowledge

[steep agate]

yeah

A very good article to learn from is xcellerator

I also know what syscalls @fossil pecan hook haha, very smart

If you know what to do hooking, how to implement it and the logic, you will be very good.

[bitter tree]

That’s the one he sent me ^ I’m just wondering if the same logic applies to socket() and you can just negate someone’s system calls for their C2, or reverse shell

But with that same logic, couldn’t you hook init_module() to negate the loading of another LKM rootkit?

[steep agate]

I've done this before, but it doesn't work, because if someone loads the LKM rootkit first, it becomes completely useless

[bitter tree]

That was my next question 🤣

[steep agate]

🤣

[bitter tree]

I haven’t programmed in a long time, but I might have to look into this. Appreciate the discussion @frail estuary

[steep agate]

Btw, it is also not possible to revert the changes, unless you do a reboot (which is against koth rules)

[steep agate]

Oh, i understand

[bitter tree]

You mind dropping the actual GitHub link? I wanna bookmark it and read it after work

[steep agate]

Maybe later I'll make it available, I think I'll reuse this and leave it in the repository I made and left private, based on research I did on lkm rootkits

[bitter tree]

Gotcha, wasn’t sure if it was a page you were referencing or your own work. I understand

[steep agate]

Oh, it's my github, I have a lot of things I did that are private there

[bitter tree]

I believe it man, you definitely got a good head on your shoulders

[keen remnant]

Hooking init_module? :Dd

[steep agate]

A curiosity: if someone hooks init, it can break the protection using finit, if in doubt, you hook both 🤣

Do you know finit? @keen remnant

[keen remnant]

Its almost the same i just looked at it. Im sure you can hook both

Just takes file descriptor instead

[steep agate]

Yeah, so if someone hooks init_module, you can bypass this using finit_module

[keen remnant]

Exactly :Dd

Is that what you were using?

Just curious if you have some other insane method 😄

Also mind if i dm?

[steep agate]

No, lmao

It didn't even come close 🤣

[steep agate]

Everything ok, feel free to send a message in DM

[small lintel]

come to butthead

[steep agate]

?

[small lintel]

cmoe to the KoTH

come with us to the m00n

[small lintel]

https://tenor.com/view/nah-im-just-kidding-jk-joking-just-kidding-haha-gif-14660749

[fossil pecan]

https://tenor.com/bWfk5.gif

[small lintel]

https://tryhackme.com/games/koth/join/fe1c42269b328032cc8a1a9c

come get some

[small lintel]

https://tryhackme.com/games/koth/join/cad59968b14a8e11aebbef83

come get some... more

[small lintel]

yes it is. unless its a patch

Patch the machines vulnerabilities to maintain your access

crap... domo i used a DoS on accident

it was a cve for the web server

slowaris

it slows him down...considerably

they booted me for it

i wont do it again THM sorry

which port did he close?

i can still access the webpage

gg

sloppy but good

[small lintel]

https://tenor.com/view/king-of-the-hill-koth-yep-yup-hank-hill-gif-18879339

[south pulsar]

https://tryhackme.com/games/koth/join/bcfef85f69340bd492f3ddfe

[small lintel]

https://tryhackme.com/games/koth/join/4696ceea5904a25ed8a2399f

[light flame]

https://tryhackme.com/games/koth/join/fa0a050325d19117edbdf68d

[small lintel]

https://tryhackme.com/games/koth/join/eff9881a1b4ea1405c03eb60

[proper tendon]

how long does it take to get the King badge, after winning?

[proper tendon]

does it need to be a full room? there were 6 people in the room and i still haven't gotten the badge

https://tryhackme.com/games/koth/99695

this was the game

[violet zealot]

yup

[proper tendon]

ah too bad, i didn't know you had to create the king.txt file in /root to be king i was just searching for a txt file named king :/

[sharp siren]

idk why hogwarts have this thing the only machine that doesn't have the file in /root/king.txt

[south pulsar]

https://tryhackme.com/games/koth/join/aa6017d3cd028a041d30565a

[obsidian lark]

you got to make it yourself

[bold patrol]

Hello guys, How do you make read-only file mode in king of the hill competitions?

[bold patrol]

And can someone with data knowledge on this subject explain the situation to me?

[steep agate]

check lsattr /root/king.txt

maybe someone protected king.txt with chattr

[bold patrol]

lsattr /root/king.txt
----ia--------e--- /root/king.txt

[bold patrol]

oh thats true

im root but why im not permitted

[steep agate]

now you can undo this using chattr -ia /root/king.txt

[steep agate]

why chattr directly changes the attributes of a file, making it immutable

[bold patrol]

When I type id, I see that I have root authority, but on the other hand, when I run the sudo su command, it asks for the password of the serv3 user. Why do I not have full authority in the system even though I am a root user?

[steep agate]

only your 'euid' is root, to change the password it is necessary that at least your uid and gid are root too

try putting your public ssh key in /root/.ssh/authorized_keys, so that you can log in to the root user with ssh

[bold patrol]

Well, I somehow gained privilege in the system and rooted my euid value, but is there a way to root my gid value at the same time, or is there no access to this in koth games?

[bold patrol]

ah okay ,Is this the solution to the problem, I have solved it now?

I wanted to say If I log in via ssh, will all my identity values ​​be root?

[steep agate]

There are countless ways to escalate privileges on this H1 Easy machine, try to find a way yourself, if I tell you it won't be funny hehe

[steep agate]

If the user you log in to via ssh is root, yes

[bold patrol]

Okay but hat other way could there be other than ssh? I'm just asking to improve and learn.

[latent sphinx]

Hello, what rooms would you guys recommend for starting with KOTH

[sharp siren]

There isn't specific rooms you need before playing koth.
Maybe before starting playing koth find some ways online on how to protect kind and that stuff...

and with time you and experience frrom playing with other players you well learn a lot of thing in the way

[latent sphinx]

Like what tools should you know ryc

Incorrectly formatted my question

[sharp siren]

You shouldn't "Learn tools " You should learn tools concepts
but for koth probably chattr and how it works and how mounting tricks work too

[broken pilot]

Like matheuz said only your euid is set to 0 (root) if you want to escalate your UID and gid you can do something like python -c 'import os; os.setuid(0); os setgid(0); os.system("/bin/sh")'

[bold patrol]

I understand the problem exactly, I was typing “chmod u+s /bin/bash” into the file run by root and running “/bin/bash -p”, but this was not enough to change the uid and guid values to root. Thanks anyway

[sour vector]

Gave +1 Rep to @broken pilot (current: #83 - 77)

[broken pilot]

If you want to practice KOTH before you play you can try https://tryhackme.com/r/room/kothfoodctf or if you want to simulate playing against someone you can try https://tryhackme.com/r/room/redisl33t

Other than that I'd just jump in and learn on the fly

[broken pilot]

Yea what I just shared with you will change your gid and UID to 0 ....

You run that after your euid is set to root and you will have full root access...

[bold patrol]

Yes, that's right. I thought I would become root permanently when I set the suid bit and run /bin/bash, but that's not possible because suid bits only change the active user.

Thanks for reply btw

[latent sphinx]

Thanks man

[sour vector]

Gave +1 Rep to @broken pilot (current: #81 - 78)

[latent sphinx]

Thanks, I was looking for someone to link me with chattr, forgot the name of it 😄

[lavish geyser]

https://tryhackme.com/games/koth/100650

[young bramble]

there are some ways to set your uid to 0, giving you full root if you only have euid=0. Trapnatized gave you a python method, I can give you a small C program that you can compile statically on your machine (because Easy machine does not have gcc) and upload it to easy and run it with euid=0 :
#1246161294869004378 <stdlib.h>
#1246161294869004378 <stdio.h>
int main(void){
setuid(0);
setgid(0);
seteuid(0);
setegid(0);
execvp("/bin/bash", NULL);
}

[bold patrol]

If I run this script even when my euid value is 0, will my guid and uid values ​​also have root privilege?

[young bramble]

yes ( setuid(0) will set your uid and setgid(0) will set your guid )

[young bramble]

but this is not a script. this is a C program source that you need to put in a file.c and compile it with gcc

[bold patrol]

Thanks, actually it would be easier to get root shell directly with the reverse shell command instead of typing chmod u+s in the backup.sh file and becoming root good to the suid bit, but this is a nice alternative to have full root privileges, thank you again.

[sour vector]

Gave +1 Rep to @young bramble (current: #2092 - 1)

[bold patrol]

I added suid bit to /bin/bash terminal with chmod u+s instead of writing reverse shell in backup.sh

so I only had a zero euid value

[young bramble]

if you compile the above code and make the resulted binary suid root with chmod u+s and run it... it will give you full root

[bold patrol]

Yes, it's really true. Thanks again

[young bramble]

but be carefull if you compile it on another machine with different libraries it won't run and if you compile it with -static directive it will be a bigger binary with needed libraries included.. like 738 KB instead of 16

[young bramble]

making /bin/bash suid root is not a good idea in a competitive game like koth, because other players will find it and use it to get root. The idea is to patch the ways that elevate privileges in order to keep the king

you can add a password authentication to the above C program to make you root only if you know the password. Then you can make it suid or a use setcap or just run it with euid=0 to make you root

I have asked ChatGPT to help me add a hardcoded strong password using openssl library and even if someone finds the hardcoded hash with reverse engineering, it will take ages to crack the password

[cold bronze]

anyone wanna play koth? hmu B) 🤙

[latent sphinx]

Hi guys I want to just double check the rules, am I allowed to change the machines password?

I read the rules but couldnt find anything

[light flame]

Sure, that's just patching👍

[latent sphinx]

ok cool

@light flame another question, can I do writeups for koth ?

without giving flags away ofcourse

[light flame]

It is allowed, as you can read under 'Streaming and Writeups'.

But personally I wouldn't do it, to keep the game 'fair'.

Because as far as I know the machine pool isn't changing

But it's your own choice, and it doesn't matter very much because there are already writeups out on the internet.

[near lily]

There is already githubs put there with KoTH "tips".

[young bramble]

Anyone care to share a tip on where to search for the 6th flag on Medium machine ?

[broken pilot]

Or 8th flag for panda ??

[young bramble]

or 8th for shrek 😆

[steep agate]

This is a curious fact, there is no 6th flag for this machine in KoTH... you have to play H1-Medium other than in Koth to get the 6th flag, I don't know if this is a bug or if they simply didn't add the 6th same flag

[young bramble]

I didn't know that. Thanks @steep agate

[sour vector]

Gave +1 Rep to @steep agate (current: #129 - 52)

[steep agate]

I don't know if there is still H1-Medium in THM or elsewhere, but the 6th flag is not in koth's H1-Medium... you can try to look for it, play and get the 6th flag

[bold patrol]

what ur nickname?

[broken pilot]

?? For KOTH? Trapnatized

[bold patrol]

okay

[broken pilot]

Why wassup

[bold patrol]

I thought you were at our match so I asked.

[broken pilot]

Oh ok. I can be 😎 you playing now?

[bold patrol]

I just left, maybe later.

[light flame]

https://tryhackme.com/games/koth/join/dc902a6a4e5da1efda77e37d

[lavish geyser]

https://tryhackme.com/games/koth/join/317fff50c6e8f7d80e0e1895

[latent sphinx]

Yo, can someone help me with Panda, found this with dirbuster but when I try and put a password etc it changes url to panda.thm < which isnt found etc

kinda aids ngl, samba was locked for RCE like 1 min into the game and nobody had king then

I also did add the ip in my /etc/hosts and did put panda.thm

this ip bugging

[naive goblet]

can you show the entire /etc/hosts file

[young bramble]

it worked for me. You need to login via this url http://panda.thm/wordpress/wp-login.php after you put panda.thm in /etc/hosts (not via IP url)

[latent sphinx]

Haha yeah man you were busy beaming me in game

[young bramble]

Naah. I was busy searching for flags

[young bramble]

I didn't even patch anything on this machine. Only changed passwords and ssh keys. The web backdoor was open, the password for po in wordpress was unchanged... what do you mean with beaming you ?

[latent sphinx]

In fortune

Got root in 1 min

Deadass thought you were cheating but after checking your games gotta admit your pretty good

Played against you a couple times but this time my box was aids and didn't wanna recognize panda

[steep agate]

There isn't much to do, there are few pools of machines, so if you played a machine before, and in the next game that same machine falls to you, you already know how to root/shell it.

[latent sphinx]

true but still

[steep agate]

You can try playing in private games to find out how each machine works, since in public games most people already know the path to shell/root 🤷‍♂️

[latent sphinx]

definitely gonna try that

thx for the advice!

Do you know if there are any other platforms with Koth, after I learn all the machines i'm probably gonna become bored

[steep agate]

i have koth repo with tricks for defense king, patch machine, etc.. if you can look: https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks

[latent sphinx]

I saw your repo

I literally follow most of your steps

[steep agate]

There are htb battlegrounds, but you only get two attempts per month (if you are not a premium user), and there is htb practice battles mode too which has some machine pools and over time (I don't know if it is a matter of months) they change with new machines

and there you can also play 2v2 and 4v4, in teams

[latent sphinx]

that's pretty cool

[steep agate]

Nice

[latent sphinx]

THM should definitely add 2v2, would like to be in a team with horatiu

[steep agate]

I'm afraid this may take some time to happen (or it definitely won't happen, idk, if it were up to the players this and other things would be implemented in koth in time) 😅

[latent sphinx]

I want a chat feature in Koth

Ik it can become aids but still, would be cool

[steep agate]

Unfortunately, things don't work like that, just because you want it to be that way, it has to be that way, it can take time to implement, anyway, something like that doesn't depend on the player, but we can make suggestions, ideas for improvements, etc., myself and several others players We have already made countless suggestions for improvements and even offered free help

[light flame]

setup a webserver with chat on the machine...

[latent sphinx]

yh yh ig you, just saying it would be nice

[steep agate]

yeah, it would actually be cool

[steep agate]

just use wall command or redirect a msg in any TTY

but implementing a chat system, similar to battlegrounds for the 10 players in the match would be interesting too

[light flame]

I know, just got the idea of a solid chat system

[latent sphinx]

Not that difficult either

Sockets.io library is very well written, I've created multiple chat systems with it

[terse willow]

Technically easy, yes. Harder to moderate though, which potentially opens you up to legal issues.
Last I heard the devs also have their own... difficulties... to contend with dealing with the existing functionality as well.
I'd say chances of this -- or any other KoTH upgrades for that matter -- happening are unfortunately slim.

[latent sphinx]

Yeh I figured

[steep agate]

Which unfortunately is bad, since KoTH is a very famous game mode (I don't understand why leaving Koth aside), surely if there was a new update, a lot of people would go back to playing

[terse willow]

That's not where the money is though 🤷‍♂️

[near lily]

IMO.

It's the usual suspects who play KoTH.

[steep agate]

HTB Battlegrounds has a system where non-VIP players can only play twice a month on new machines, while non-VIP and VIP players can play practice battles at will, which already has a large pool of machines.

Just think and come up with cool ideas, so that the community benefits from the new experience and learning and THM profits from the VIP so that players can play on new machines, it's not difficult to think of a solution, if money is a barrier 🤷‍♂️🤷‍♂️

Anyway, this is my opinion

[terse willow]

Yeah, but the profits you get from individuals signing up are very unlikely to be on the same scale as you'd get from businesses or institutions signing up for business plans, and KoTH ain't a lot of use to your typical business wanting to upskill their workforce on cyber security

Or, rather, it's much more niche than walkthrough content with the odd accompanying challenge. It's obviously useful for individuals to get a really strong understanding of system hardening and attacking a hardened system, but that takes a long time and isn't exactly the traditional way of learning in a corp

[steep agate]

I disagree with the point that KoTH does not teach anything useful, it was thanks to this that I was able to develop research involving rootkits. KoTH also has other cool things too, you learn how to patch machines, read webapp source code, and several other things, especially for someone who has no knowledge in these areas.

[sour vector]

Gave +1 Rep to @terse willow (current: #9 - 764)

[steep agate]

This would teach a lot of people, even those who work, to know how to defend machines against persistence/malware and fix machine vulnerabilities

[steep agate]

I understand, this is just my opinion

[terse willow]

I agree with you -- see the second message there.

The point is that it appears to be less useful if you're a business. If you're wanting to train your workforce, you look for courses, tutorial content, etc. Using a game takes a lot longer and is far less reliable. Sure, you can get very good by playing it, but that's not what a business sees -- not least because would you, as the person high-enough up in an org to be responsible for training folk, want your employees to spend a completely open-ended length of time playing a game during work hours?

[steep agate]

Yes, you're right, but why not think about the THM community that plays KoTH? Anyway, I've seen that there's really no way to "resurrect" koth lol

But this part of the more "business" look is understandable.

[terse willow]

Put it this way. I remember when KoTH was proposed. I remember how excited about it Skidy was when he thought it up. We had a big group conversation about it -- it's probably still in #general from a few years ago, if you want to go and dig it out.
Point is that KoTH was developed as a passion project. It was built for a vibrant community, and it was tested extensively by that community before it released. It was built for the community in a time where the community and the company were tightly tied together.

Bear in mind that this is an opinion based purely on what I see, but I've not seen that community, or that vibrancy, for a long time now. Things aren't done for the community these days -- they're done for profit. And hey, that's how a business works 🤷‍♂️
It's not unexpected to see that as a company grows. Can't fault that prioritisation, in the end.

What it means though, is that the passion projects designed and built for the community play second fiddle to the projects which actually bring in money. I may be completely wrong -- who knows? I hope I am.
Maybe you'll see some big updates to KoTH at some point in the future. But I doubt it.

[steep agate]

Looking at that vision, and also looking more at the business, I think you're right, it's understandable, but I hope that someday in the future there will be an update, and I can go back and play like other people again

[young bramble]

allow me to disagree with the fact that a company wouldn't pay for you to play a competitive multiplayer attack and defense game during workhours. This depends on the company, the development paths available, the structure of the SOC you are part of and the management interest in employee's well being. If you have results, measurable results you can justify koth as a training that brings more value in real world cyber-security than a guided walkthrough or a course. I cannot imagine a better way to learn this in a legal maner with hackers worldwide meeting in-game fighting against eachother and learning from eachother. This is why I see koth as a gold-mine that is not yet explored properly

[terse willow]

Potentially, but unlike with structured content (e.g., a learning path), there's no defined end to the training, and no concrete results from it.

With a learning path you have a set number of rooms (and even an estimation of completion time). At the end you get a certificate of completion. It's clean. You have a start, a middle, and an end.
That's what management want.

With KoTH you don't get measurable results. You get qualitative experience, but two people could play KoTH for the same length of time and come away with completely different outcomes. Heck, some people may come away with absolutely nothing at all.
That's not what management want.

I can see it being a nice little bonus, but it's never going to be a big selling point (except maybe in very niche scenarios).

[sonic belfry]

Good discussion here. Just wanted to mention that we do read these discussions. 🙂

[terse willow]

Wonderful -- glad to hear it! 🙂

Also, hi Tim 👋

[young bramble]

Great. Thank you for mentioning it. Any thoughts about a posible future upgrade or improvement on Koth machines/game ?

[sour vector]

Gave +1 Rep to @sonic belfry (current: #16 - 450)

[sonic belfry]

Not at the moment particular to KotH. It is interesting you mentioned koth as enterprise training. 🙂

[broken pilot]

Point is that KoTH was developed as a passion project. It was built for a vibrant community, and it was tested extensively by that community before it released. It was built for the community in a time where the community and the company were tightly tied together. imo I think this should still be an option for the community to be able to build and test new machines, new features, etc and be able to submit for a final review and release, that way the koth community can keep this "passion project" alive and thriving. I can see koth being added into certain learning modules (red team, blue team, web, etc), complete the module get your certification of completion now try what you've learned in a more realistic environment. Try to protect your company's secrets (king.txt) , find the vuln, patch etc. could even create some dedicated rooms like redisl33t to "practice" along with more advanced tricks and techniques.

Maybe only subscribers / enterprise get access to new machines, while free gets the older machines, after a set amount of time maybe 1 machine gets "retired" and bumped down to subscribers / free ..

[young bramble]

Right now with the current limitations it is is a bit unfair for those starting playing, being smashed by anyone that knows the machine. Only a few machines have startup scripts that randomize credentials or service ports. The others are the same old instances. This is the main concern for upgrade/improvement... If interesting changes are implemented, I don't see why this wouldn't become a good selling point. Imagine Private Company-wide competitions with no 10 players limit and cool badges to earn 🙂

[fierce nacelle]

That's what the competition does afaik

[broken pilot]

No the pool of machines are the same regardless of subscriptions the only difference is being able to choose the machine in practice mode.. but could implement something like business vs business (team vs team) , maybe some more windows machines, or networks of machines to attack and defend against.. (similar to battlegrounds)

[fierce nacelle]

By competition I meant a competitor. Also 3 letters.

[broken pilot]

Yea I mean why not compete with the competition... Can implement it in a little different way but something similar... I think koth has the potential to outdo the competition honestly.

[obsidian lark]

@muted gyro why play dirty?

breaking services, moving binaries, and on top of all removed koth binary

[steep agate]

Before I stopped playing Koth, I had gotten the binary it ran on the machine to do reversing haha

[trail iris]

I saw @steep agate script

"mount --bind -o ro /root/king.txt /root/king.txt 2>/dev/null"

i think just using this is almost hard to recover.
how about changes the mount point to /tmp or other dir ?

[light flame]

Reversing it would stay the same, just umount /root/king.txt or umount /root.

[steep agate]

My script? I don't use that haha, just my LKM

[steep agate]

Sometimes when you do this, it appears as if you are in "busy", so you have to use umount -l /root/king.txt

[light flame]

Thanks for pointing it out, I've seen it before but never understood why.

[sour vector]

Gave +1 Rep to @steep agate (current: #125 - 54)

[trail iris]

I am still struggle wrote that LKM please send me a reference to learn if you don’t mind 😅😅

[violet zealot]

What u mean by that?

I didn’t do koth for a while now, so I never heard of it

[steep agate]

the xcell blog is really cool https://xcellerator.github.io/tags/rootkit/

[steep agate]

He left the binary he uses for king/persistence on the machine, so I downloaded it and reversed it to find out what it was about

[steep agate]

But that's the thing, you'll learn basic things for a rootkit then, in my case, the one I use isn't there, I had to create one from scratch specifically for Koth, hooking syscalls @trail iris

[trail iris]

Oke thank you bro ... i found something there to improve mine

[sour vector]

Gave +1 Rep to @steep agate (current: #120 - 55)

[young bramble]

one example of what players with lack of fair-play can do when they don't know how to defend king... sends urandom on others terminals, stops services, shuts down the machine 3 times in the same game, breaking rules. Congrats @unagisan great game.

[obsidian lark]

the tragic truth

[trail iris]

The first time i am on koth i patch the vuln. Is that breaking the rule?

[young bramble]

No. Patching the way you get in is not breaking the rules. Every machine has 4-5 ways to get in. Maybe patching them all and making the machine unreachable, is a bit unfair for other players

[trail iris]

The fools thing is make is when patches the vuln is kill all tty including mine 😅😅😅 that’s the big mistake i make without put any persistent

[young bramble]

It happens. Sometimes you patch one thing and others are patching the rest. Sometimes you kill all tty terminals, and the next time somebody else kills all the shells even without tty. Wouldn't be nice if users stay all connected and fight for king without killing shells ?

[trail iris]

Agree, 👍

[steep agate]

https://github.com/MatheuZSecurity/Imperius

[austere isle]

can anyone playing a koth share screen

i wanna see

[ivory marsh]

One just started, it's me and one other person if you're interested still. i've never done KOTH before

[ivory marsh]

Wild

[austere isle]

i was sleepin

[fallen palm]

Anyone wanna play KOTH.?

[cold bronze]

hai :3

[light relic]

hello

[cold bronze]

hi

[cold bronze]

are you down?

[austere isle]

anyone down to play koth

il spectate

[silver crystal]

going to try my first koth. I suspect this is going to go badly!

[near lily]

You never know! 💪

Have you gave the KoTH trianing rooms on THM?

[silver crystal]

Oh, there are training rooms for this? That's probably a good idea 😮

Reality is the real training, it seems!

[near lily]

https://tryhackme.com/r/room/kothhackers
https://tryhackme.com/r/room/kothfoodctf
https://tryhackme.com/r/room/redisl33t

I'd leave Red till last.

[silver crystal]

Thanks, I'll try those after this.

[light flame]

Is it even possible to get root through port 8888 on the hard machine?

I always get 500 error when I try something with the api

I don't want to know how, just if anyone ever succeeded with that.

[sweet dome]

is THM KOTH fun?

[sharp siren]

depends on whom you are playing against tbh

But sure give it a try

[light relic]

Mostly, it's especially fun with friends and terrible with people using autopatching scripts

[sweet dome]

ahh I see

thanks

[steep agate]

It's good when you play with friends, or "worthy" opponents who don't play dirty, as there are many players who enter the machine, put their name in king and remove all the binaries, or else block your access/patching and most of the time these players don't even know what they are doing, they just ruin the fun of playing koth

But you also learn a lot by playing with people who don't play dirty and ruin the machine.

[young bramble]

@light flame GG

[light flame]

You too

[austere isle]

koth?

[austere isle]

i mean if anyones up to play koth

[true valve]

I'm up, fair playing only.

[austere isle]

dm'ed you

[low charm]

can you screenshare the game, spectating only lets you see the points chart

[austere isle]

yeah i would love to see it

but, its a risk

pple are weary of leaking something accidentally

[low charm]

u cant play it on the sites attack box?

@austere isle wanna do a private game, i just wanna see what its like?

[austere isle]

im on a game

dmed you

@low charm its about to start!

[low charm]

ima fix my mic

[kind hollow]

do you have a room link to watch what is happening

?

[austere isle]

@steep agate could you check your dms?

[fallen palm]

Lets play after 3 hours

[cold bronze]

I can't then

[austere isle]

anyone wanna go for a koth?

[sturdy pivot]

is there a way to spectate koth to learn more of how it is done?

[light flame]

The only 'spectating' option is just viewing a game like this: https://tryhackme.com/games/koth/101691, but that only let's you view the points and who's king.

Or have someone share their screen.

[stone cypress]

what do i do when i try to connect to ssh, but it immediatelys kicks me out (which was not happening before) "Connection to 10.10.102.134 closed by remote host." Also when i could ssh before i was getting really weird characters in my screen like "??!@*UIDJ", i wasnt typing in my terminal or something

i still managed to win the koth somehow

[light relic]

Probably someone messed around with SSH service and changed either it's config or just binary in general. AFAIK it's considered rule breaking

[light flame]

except when the port was changed, AFAIK that's allowed

[light relic]

Yeah, you can change ports, but doesn't rest cout as breaking rule nr.2?

[light flame]

Yeah, that's mostly the case. I've seen someone change service ports, but it almost never happens.

[stone cypress]

ahh maybe could that be the reason, not sure why the other guy didnt login & win the koth but ill take the win ig

arnout zullen wij een xtje 1v1 koth doen?

[light flame]

you're dutch? (Sorry other languages aren't allowed in this server)

[stone cypress]

yeah! i saw your profile in the dutch leaderboards (koth)

[light flame]

lol

I will send you a DM

[sharp siren]

lil bro couldn't figure rm -rf ---no-preserve-root / Kappa

[violet zealot]

whoever is muntarockz, stop resetting machine when it's not needed

[austere isle]

koth anyone?

[austere isle]

koth

😦

[steep agate]

https://www.youtube.com/watch?v=FoX9euULFQo

[fading moat]

Is this tool open source?

[steep agate]

The project is currently private, but I will leave it open source later

[fading moat]

Interesting! May i message you privately

[fallen palm]

Anyone down for a private KOTH .?

[austere isle]

me

im bad but sure

[fallen palm]

Theres a public CTF starting in 2 minutes, join fast

Koth

[fallen palm]

That's fine mate, I am new too

[austere isle]

aight lets go

[fallen palm]

That one is over 😅

[austere isle]

oh

so i joined a random one?

[fallen palm]

Nah

That guy already got the access before us.

Join another one.

[sturdy fox]

Hey, so im wondering how do you get into a machine with ssh, ftp or a backdoor webiste login, i was in a Koth match and no one of us managed to get into it.

[cloud birch]

Thats the whole kit and kabootle right there lol, I am a bit of a noob and maybe shouldnt be answering but I feel confident in saying:

It depends

A common flow is sort of:

1. Do recon
   I see you've already identified ssh, ftp and a website running as services, you'll also want to find thier versions and look for easy, low hanging fruit in vulnerable versions

You'll also want to look for anything that could be a username

You need two things to login with both ssh or ftp, that is, a username and password

Now, you can guess both but it might take you a long long time

if you already have a valid username or a valid password you can cut the time it'll take you to guess a valid set of credentials down

Make a userlist then hit any service that requires a login and password with a brute force

[mortal folio]

FTP servers can alos be configured for guest login without a password, and in CTFs tend to have useful files for further exploitation

[fallen palm]

Which room in KOTH you are talking about.?

Anyone down for a KOTH rn..??

[steep agate]

check DM

[fallen palm]

Didn't received any

[sharp siren]

Hey are you talking about hackers Machine? If so you need to brute force your way into the machine in ftp server or /backdoor login other than that you can't get a foothold. and if someone was able to get a foothoold without brute forcing mind sharing?

[cloud birch]

Also if you find a place you can upload files, this may be a good place to try uploading a web-shell

If you see a spot that will take user input, or especially evaluate something - try putting random stuff in

special charachters, html tags etc

See if you can get it to break or error out

might give you a clue

You can sometimes parlè FTP access into a shell

[cloud birch]

But yeah I would highly recomend going through some of the THM courses and rooms, and just doing ctfs (not koth) to get sort of a more broad level of understanding how to do these things

Do enough and you'll start to see patterns

[fallen palm]

@steep agate Better don't dm me like that next time mate without having any proper proofs, you are no one to talk to me like that and I am not scared of you mate.

[steep agate]

? Just wanted to ask if you really killed the machine lol, maybe it was the other player

because you were the only one on the machine, ending with the IP address 244

[reef echo]

hy guyz

[fallen palm]

creeman was also here and maybe when you saw, I kicked the other guy that time.

[fallen palm]

Hlw

[reef echo]

are you playing king of the hills rn?

[sturdy fox]

yeah i managed to get into it via ftp with hydra

[sturdy fox]

It was a Match

[fallen palm]

I mean which machine was there in the match for example lion, Hogwart, etc

[sturdy fox]

i think it was Hackers but im not sure

[mortal folio]

there's no greater feeling of defeat like seeing matheuz in the lobby of a koth 😂

[broken pilot]

After you play enough games you'll be happy to see a challenge. And start looking for those games 😜

[sturdy fox]

Yes xd

[steep agate]

Hahaha, I only played 2 games to distract myself

[cloud birch]

I am pretty interested in koth but I think mostly too new to really compete

[light flame]

or F11Snipe

If I see him, the game is already over😂

[sturdy fox]

Yeah me too, i dont even have beginner path completed

[cloud birch]

Like I can get a foothold on some.of the machines but not nearly as fast as I have seen otbers, and priv esc takes me a long time

let alone defending the hill from other attackers lol

Some day though

https://tenor.com/view/soon-cat-peek-gif-10008520

Man if only I didnt start so late

I didnt know about any of this stuff when I was a kid

[fallen palm]

The key is to make a note of each and every step you take on a machine and save it in a file for next time.

That way you can get fast root access. All does the same.

[cloud birch]

Oh for the next time you mean

if the KOTH machine on one run is the same as one ive done before?

I can do the next one much faster if its the same machine

Ah, good tip

[fallen palm]

Yeah the process is always same, just the ports can change and pass.

Anyone got idea about Carnage koth.?

Can't change king.txt files permission.

[true valve]

It's append only. You can find this via lsattr.

To change this, you'll have to upload your own chattr binary.

[sharp siren]

echo "username" >> /root/king.txt

[fallen palm]

Did

[fallen palm]

Oh ok, Tysm

[sharp siren]

in carnage you need to use the double >> to be able to write into it, this is if not someone used chattr kek

[fallen palm]

Oh lol

I did single >

Will try this one.

[fair adder]

https://tryhackme.com/games/koth/join/0112c6c80830771b608b7cf7 i accidently joined koth game someone want play too??

[fair adder]

suggestion to fortunate room : add steganography with flag to videogames.jpg file

@sharp siren thx for game and giving me a king. This room was kinda fun

[sour vector]

Gave +1 Rep to @sharp siren (current: #431 - 11)

[sharp siren]

hheeehhhe np

next time you won't get it for free lmao

[steep agate]

I believe this will never happen lol

[near lily]

Somebody used this on the box?

[civic vortex]

yes

[near lily]

Send the screenshot to [e-mail]

[civic vortex]

Thanks for informing, but since report never works, I decided to share to community to alert other players

[near lily]

Ok, but I'm going to have to delete the screenshot as it's got a harmful command in it. 🙂

[steep agate]

lol

[fair adder]

https://tryhackme.com/games/koth/join/69e112f680fa1c7d5b848e59 someone want?

[fair adder]

why i have again king i didnt even add my username

[fair adder]

It's legal move to edit pages or deleting them ?

[sturdy fox]

i dont think so, but im not sure

may need to use gobuster again to find it

[fair adder]

i logged in too /backdoor directory with good credentials and it redirected to /backdoor/shell

[broken pilot]

here come to next game https://tryhackme.com/games/koth/join/eae18c2c795ccc8989dc2bb6

[fair adder]

okay

[fair adder]

this kinda non sense someone probably added me to king.txt flag

but thank you

[broken pilot]

GLHF

[fair adder]

glhf

it could be sad if someone on this mysql used drop database lmao

[sturdy fox]

isnt that the machine "Hacker"?

[fair adder]

it is

[fair adder]

who is moderating room ?

flag probably doesnt work

[broken pilot]

wdym?

[fair adder]

nvm it works

i added space for mistake

[broken pilot]

lol thats not gonna help you...🤣

[steep agate]

note the uid 1003

HAHAHHAHA

[sturdy fox]

what does it do?

[steep agate]

a common user trying to delete /*

without root

[sturdy fox]

lol okey xd

nt tho

[fair adder]

😭

[steep agate]

this proves that these players who ruin koth machines know absolutely nothing lol

[steep agate]

check ps aufwx

and then

lsof -i -P -n

after do this, execute the command w

and then pls give me output @fair adder

[fair adder]

no

walling is fun

okay wtf

wtf why im a king 😭

[steep agate]

lol

[sturdy fox]

i dont even know whats going on there tbh

are u using the attackbox or ur own pc to play koth?

[broken pilot]

why u mad bro 🤣

it was just a chattr lock 😜

[austere isle]

least toxic koth player

jkjkjk well played

[fair adder]

this is not mine

i didnt use for example screen -ls

[austere isle]

you know if trev is awake man?

[broken pilot]

GG

[fair adder]

yup

gg

[broken pilot]

🤷‍♂️

[fair adder]

another game?

[fair adder]

lmao someone used mine shell file

[broken pilot]

maybe in a little bit, bout to take off

[fair adder]

virtual box for me

attackbox it's also good

you gave me ideaq

i gonna play with attackbox

[sharp siren]

skill issue sob~1

[fair adder]

GG i used chattr

gg

What are the rewards?

🤣

[sharp siren]

@wintry isle Imagine losing can't be me Kappa

[sturdy fox]

Who is in my Match rn stop messaging me🥲

He just keeps spamming so i cant do anythinh

Can anyone sometime show me some things cause im realy bad

[fallen palm]

Anyone down to play a private koth.? (Script users stay away)

If yes then tag me.

[fair adder]

nah i canceled subscription

suggest about subscription: Student plan should cost less for example same price as hackthebox student plan (8 dollars per month)

[broken pilot]

Yea if you're interested in some tips and tricks dm

[civic vortex]

@alpine quarry stop modifying system binaries

do something new

atleast know how to hide from command logs lol, so that others cant complain

[sturdy fox]

that modifies it so only root can use it right?

[civic vortex]

no, it removes the x bit, so no users can execute it

[sturdy fox]

ohh okey, so ig he got root with it than and wanted no one else to use it after

[civic vortex]

yes, players will have to give back the x permission

[sturdy fox]

But is that even allowed? cause it is like shutting down a service isnt it?

[civic vortex]

any modification to system binaries except chattr is not allowed, it's in the rules

[light relic]

Chill, he is known for playing like this. You're lucky he didn't block you with IPtables rules or he didn't kill sshd

[civic vortex]

dam

[steep agate]

he always did this, take permission or remove wget/curl from the machine lol

[light relic]

As far as I remember he even showed on his yt how

[violet zealot]

It’s crazy to be known as a rule breaker and still not banned

[near lily]

AFAIK, one user is aware, but they're not reporting them.

[violet zealot]

I’m pretty sure some of them already reported him

[civic vortex]

I decided to tag him and paste proof every time until I get tired XD

[austere isle]

hows that mission?

[civic vortex]

didnt play much

[radiant sun]

New KoTH Machine, lfg 🚀

[steep agate]

BRO FINALLY ❤️

[sonic belfry]

Woohoo!

[stiff egret]

wohoooooooo

[sharp siren]

🔥

[jovial field]

wait what?

i didn't see that coming but great!

someone up for a match?

[steep agate]

bro, the new machine is very good, congratulations to the creators

[radiant sun]

@stiff egret ❤️

[stiff egret]

GG

[steep agate]

gg

[stiff egret]

kudos to the creator of this, nice box indeed.

[steep agate]

I wasted 30 minutes on something that was rabbit hole hahaha, nice machine

[charred hare]

Nice to see some love for koth ❤️

[cold badge]

This machine changes a little bit every time you play 👽

[radiant sun]

oh yea

[sonic belfry]

This is the best typo ever: rabbit + habit 😎

[steep agate]

oh damn, I just noticed, sorry my native language is not English 🤣

[austere isle]

mind if i dm you?

[sonic belfry]

No worries, neither is mine. 😄

I think it should be part of CTF jargon: habbit hole.

You can trademark it and make millions.™️

[broken pilot]

Let's Go... TY ❤️

[valid slate]

397 streak 💀

[violet zealot]

Idk how that's possible...

Like do u go out? See ur friends?

This guy didn't see a human being in 397 days

[near lily]

You do realise you can cheat the streak, right.

Besides

It's answer one question, not sit there for hours

[sturdy fox]

i have seen someone on linkedin with a 1k streak so

[violet zealot]

But u have to be connected every day, that's the thing. Idk I can't be on thm everyday...

I guess I just don't understand 🤷‍♂️

[sand pendant]

sup

guys

anyone would like to play ?

https://tryhackme.com/games/koth/join/28b0c268d3ab9dc56ec8ed18

[tacit crescent]

Anyone up for a quick round?
https://tryhackme.com/games/koth/join/58d2bc63093d4c202f02034e

yeah no dice lmao

oke

[north wolf]

gg

[civic vortex]

@north wolf wtf??

@north wolfdisgusting

hahahaha

[near lily]

@civic vortex Please don't use that word to describe something negative again.

[civic vortex]

ok

[north wolf]

hence, bug.sh and I very rarely use it as something to hide behind koth binary but its easiest indicator is its PID (i.e. 4 digit PID, while real koth binary uses 3 digit PID)

and something to replace with bashrc 😆

# COLORS! :)
red='\033[0;31m'
cyan='\033[0;36m'
blue='\033[0;34m'
green='\033[0;32m'
yellow='\033[0;33m'
nocolor='\033[0m'

# Track initial login
FIRST_PROMPT=1

# Directories
tmp_dir=/var/tmp/.troll
art_dir=$tmp_dir/art

function art() {
  msg=${2:-"Something clever..."}

  if [ -e $art_dir/$1 ]; then
    cat $art_dir/$1
  else
    echo $msg
  fi
}

function nope() {
  art nope.txt NOOOOPE
  echo -e "${cyan}Take a breath and think about that for 5s"
        i=5; while ((i > 0)); do echo $i; sleep 1; ((i--)); done
  echo -e "${nocolor}"
}

function nyan() {
  frames=${1:-30}
  if [ -x $tmp_dir/n ]; then
    $tmp_dir/n -f $frames
  else
    echo -e "${yellow}Nyan friend not found :(${nocolor}"
  fi
}

function rand-nyan() {
  chance=${1:-75}
  range=${2:-100}
  frames=${1:-30}
  rand=$(($RANDOM % $range))

  arr=('|' '/' '-' '\')

  for c in $(seq 1 5); do
    for elt in ${arr[*]}; do
      echo -ne "\r\033[<1>A🎲 Rolling $elt" && sleep 0.1;
    done
  done

  echo -ne "\r"

  echo -e "${blue}You rolled: $rand 🎲${nocolor}"

  if ((rand >= chance)); then
    echo -e "${green}WINNER!${nocolor}"
    sleep 2
    nyan $frames
  else
    echo -e "${yellow}Better luck next time${nocolor}"
    echo
  fi
}

function rand-msg() {
  chance=${1:-35}
  range=${2:-100}
  rand=$(($RANDOM % $range))

  # TODO: Pick from list of random messages
  msg="${yellow}Hmmm ... interesting 🤔"

  if ((rand <= chance)); then
    echo
    echo -e $msg
    echo -e "${nocolor}"
  fi
}

function pre-prompt() {
  if [ -z "$AT_PROMPT" ]; then
    return
  fi
  unset AT_PROMPT

  rand-nyan
}

function lol-prompt() {
  local EXIT="$?"
  PS1=""
  AT_PROMPT=1

  # Colors!
  local RCol='\[\e[0m\]'
  local Red='\[\e[0;31m\]'
  local Gre='\[\e[0;32m\]'
  local BYel='\[\e[1;33m\]'
  local BBlu='\[\e[1;34m\]'
  local Pur='\[\e[0;35m\]'


  if [ -n "$FIRST_PROMPT" ]; then
    unset FIRST_PROMPT
  else
    if [ $EXIT != 0 ]; then
      nope
      PS1+="${Red}Nope, try again! 😜${RCol}\n"
    else
      rand-msg
    fi
  fi

  PS1+="${Gre}ŦʀøĹĹ${RCol}👺${BBlu}ϞҺ311 ${Pur}\W${BYel}$ ${RCol}"
}

# Attach pre-prompt function to "before cmd"
trap "pre-prompt" DEBUG

# Attach lol-prompt function as "after cmd"
PROMPT_COMMAND="lol-prompt"

so, "di*******ing" ikr

[steep agate]

i see

[north wolf]

when actual koth binary is down

and I don't see /root/koth again

[steep agate]

😄

[civic vortex]

nah, you used that on me because you cant get king by obeying game rules

[timber vale]

https://tryhackme.com/games/koth/join/42b28f2edefc632c081a0c07

game start in 3 min and no one exept me

https://tryhackme.com/games/koth/join/5a56e2f334da63d611687a8c

[stiff egret]

@north wolf Kindly consider this a gentle warning, using that script is against the rules, if caught in a match or reported, you will be warned and/or banned from the platform and/or discord.
Tampering with koth service / binary is a clear violation of rules.

cc: @short tusk (just so this is noted for, will also add in #koth-staff)

[timber vale]

https://tryhackme.com/games/koth/join/e5c242823c3ddb3a8182f4f0

[timber vale]

https://tryhackme.com/games/koth/join/e9bf61df67dce1fc0edea504

https://tryhackme.com/games/koth/join/2b7632db615dcd18c8d644a9

[obsidian lark]

yeah 😂

[timber vale]

did it to me yesterday

https://tryhackme.com/games/koth/join/5b3f62e9ea9bf3cedf48e081

join this new game

anyone

[civic vortex]

nah it's full of autopwn and dirty players, I would rather play hbg

[timber vale]

no one joined im alone

[broken pilot]

Ahhh this troll shell looks familiar 🤣

[steep agate]

copied from f11

hahahaha

[broken pilot]

You do know koth binary is not always in the /root directory.... Hahahahah and koth binary should never be "down" .... Even when modifying koth binary it won't be enough to stop the good players 😜..

[north wolf]

yup, bug.sh was something lying on my tar ball since a long time now deleting it right away and that koth script was written when some bugger was constantly getting port 9999 down, and I came up with that thing. Also obviously, if the player's good, no cheating will help.

[north wolf]

*stolen 😝

idk tbh, sources for most of the things I know are from F11snipe, Matheuz, Trapnatized, Aquinas, and most of the people you all guys know already

and even if I did something myself, that was something with the help of matheuz's guidance, and reference to GitHub repos from Aquinas

[steep agate]

? In my repository there is nothing written about a technique to modify the koth binary or bug the service (btw I didn't even know that was possible)

Own up to your mistakes, throwing your mistakes at other people is shameful

[north wolf]

Not throwing away my mistakes, just saying what I know are stuff known from people mentioned there. What I did, was shameful on koth binary but I had to while on a game with some guy (I can check and update on who was him if you wish to know) And, regarding on mistakes I'd made. It'll not repeat.

[sharp siren]

I had the same idea long time ago tested it in a private game knew it is against rules.

But still tricky way to confuse your enemy lmao

[north wolf]

well, if PID is of 4 digits most probably it is not the real koth binary, since one running from the starting of game usually get 3 digit PID

[steep agate]

🤔

[sharp siren]

it can be but still there is ways to play with PID

[obsidian lark]

• I’ve seen profxade putting down the koth service and making a custom service on port 9999 with netcat. just disappointed to see a really good game mode being destroyed

[terse willow]

Yeah, just gonna put this here @north wolf

That's pretty explicit...

[timber vale]

https://tryhackme.com/games/koth/join/5768ea21c9e6d762ad41746f

I'm then only one in the game(i tried refreshing the page) i haven't patched anything if anyone wants to get in

still 40 min left

[north wolf]

I've stated what I'd to say, here. And, regarding on 3/4 digit PID thingy I'm not gonna use it on the actual game and I think intercepting the write sys call would make those shameful things not work but not 100% sure if intercepting syscall would actually work. Sharing it here, while not expecting anyone to use it on the game though.

/* REMOVED CUZ YOU'RE NOT WORTHY. */

[civic vortex]

stop drawing attention away from the fact that you break rules

ofc good players won't be defeated by the mod of koth binary, but it's annoying and dirty

new players won't like to be treated by that as well

[north wolf]

everybody knows what happened, and what was my response if not it's just up right there all you need to do is "scroll" I did it and claimed to never do it again along with a gentle warning from Mr.Holmes: "will be warned and/or banned from the platform and/or discord. " and drawing away attention? bruh it is called a "reply" to "self" with PoC that 3/4 digits thingy doesn't work as I'd expected it to.

if you cannot cope up with what's going on in present, and you're stuck in past not my problem.

[north wolf]

I wonder how on earth you expect "fair" players in real life, I first time did a dirty play as a response to a dirty play. Later, it was my bad that I used it without its necessity due to laziness. But, that doesn't mean you stop trying.

[civic vortex]

just stop, you did that to me and I didn't do dirty stuff

if you stop, i will not blame

[north wolf]

You could have simply collected evidence of "cheating", reported it with pieces of evidence then, removed the process. or maybe modified the shell script's username part section with $(cat /root/king.txt) 🤷‍♂️

you didn't do it, all you did was blame with a screenshot of something that wasn't even used. 😐

[north wolf]

now, I really don't wanna get to what actually happened
but if possible then, does the code within message (I'm replying to) can be defeated via LKM? why I wanna know it? "just curious"

[civic vortex]

hahaha

im speechless

[north wolf]

it is what it is, since there's no point in lying 🤷‍♂️

[steep agate]

lol

[steep agate]

There aren't many people on koth who use LKM, I think it's just me and F11snipe, but f11 is missing and never appears on discord or koth again, he must be busy, and I am too haha, sometimes while I play koth but only 4fun

It's really very OP to use LKM if you know how to code in C and have a more advanced understanding lol

[late wadi]

Is there any reason my tryhackme openVPN is working but my hackthebox openVPN exits with a fatal error even after redownloading the ovpn file?

[young bramble]

Agree. Going from standard C coding to kernel programming needs a more advance understanding ... and a lot of testing... for each of 14 linux koth machines with 12 different kernel versions. Thanks for playing again @steep agate 🙂 you bring the next level of playing koth.

[sour vector]

Gave +1 Rep to @steep agate (current: #115 - 60)

[steep agate]

😄

[steep agate]

this is not the right chat for that

[late wadi]

could you kindly link me to the right chat

k

[steep agate]

maybe #site-support

[steep agate]

It was thanks to this that I was able to delve deeper into the kernel and even developed some tools and means to detect and remove rootkits

[sour vector]

Gave +1 Rep to @young bramble (current: #1417 - 2)

[sharp siren]

LKM rootkits indeed operate at the kernel level (ring 0), which grants them the highest level of privileges on a system. This allows them to intercept and manipulate system calls (syscalls) and other kernel operations.

If there is code embedded within a message (such as a malicious payload or exploit), LKM rootkits theoretically could intercept or manipulate the syscalls related to message handling.

For instance, if your message involves syscalls like read, write, send,(I couldn't see it since it is deleted) the rootkit could potentially intercept these calls and modify the behavior to protect the king.txt

[broken pilot]

It is OP, but even rootkits can be beaten without the need for another rootkit... Just takes some enumeration of the rootkit itself to find flaws or loopholes... Anything can be beaten, it just takes the time and effort to understand what's going on..

[north wolf]

Thanks, I'd forgotten kernel-rootkits executes at ring 0. It answers the question. (if code was still there)

[sour vector]

Gave +1 Rep to @sharp siren (current: #379 - 13)

[broken pilot]

If I'm being honest I enjoy playing games with opponents better than me cuz it forces me to get better, at the same time I enjoy playing with players that play dirty also, cuz this also helps me get better and plan for edge cases... Like rm -rf / ... Because of this I have stuff in place .... Even modified koth binaries... Ez ... Kinda makes it more fun 😜 cuz now I get to bend the rules when playing against them hahahahahahah.... 🤷🏼‍♂️ Guess it's just how you look at it ..

[north wolf]

*reason for the code to get removed*
~ Also, note to Mr. FairPlayer__cryIfyouLoose. Crying doesn't work always, learn to tackle situations without making it a cry-cry experience for yourself. Will see next time, if you're actually good at koth or just crying.

[steep agate]

I don't know who wrote this but I can say that the only ones who use LKM in Koth are me and f11snipe, sometimes horatiu and terraminator, but without being LKM there are people who use userland rootkits, but it's not LKM

[north wolf]

yep, absolutely it's super fun when something unexpected happens!

[sharp siren]

Btw if you are intersted in LKM rootkits here is some good ressources I found usefull
https://xcellerator.github.io/tags/rootkit/

https://www.youtube.com/watch?v=hsk450he7nI&t=0s

[broken pilot]

I have an lkm but I rarely use it, it's not as advanced as f11's or matheuz but 🤷🏼‍♂️... It's like the last option for me, if I can't beat you manually then I may load in the rootkit but so far I've managed to get around most rootkits... Going up against their rootkits for so long exposed me to where the loop holes may be at...

[broken pilot]

Ayy on another note, I spoke with f11 earlier and he may get the streams back going starting this weekend... Maybe we can get some games going, get enough ppl together and do another tournament or something 🤷🏼‍♂️... Still haven't been able to try the new machine yet ....

[steep agate]

Oh nice, it would be cool to stream again, I tested the new machine and it's really good

[broken pilot]

Would be cool to get the new machine on stream... Maybe a private match with all of us on the new machine 🤷🏼‍♂️... I'm curious on how many different vulns get introduced by "fireworks", could it even be patched?

Saw in announcements a new vuln gets introduced with every "boom 💥" so could do a stream on one way in and next game will be completely different... So it wouldn't technically ruin the fun ..

[steep agate]

There are several vulnerabilities, for example, if you play in a box, the path to another box that you play in fireworks will be different.

[sharp siren]

hey if you want to try the new machine I can set up one if you'd like

[north wolf]

may I join?

[sharp siren]

I wont be playing but sure Dm me

[broken pilot]

Yea I'll try it out I'm bout to spin up VM now

[obsidian lark]

really… you won’t do it again? hahaha go do the math…

[north wolf]

Math? bruh next time it won't be a warning, it'd be a bold decision to either ban me from koth or something similar. What math are you talking about? Do you mean the number of times I can fool around unless I get banned from playing koth?

[obsidian lark]

i mean the numbers of time you got caught cheating lol

[timber vale]

https://tryhackme.com/games/koth/join/0153ff60797dc5fb04df0d37

[timber vale]

guys wtf

how do i know if he is cheating

[light flame]

im not

I put my name in king.txt a few seconds before the new minute

[timber vale]

wtf is this

[light flame]

not my work

[timber vale]

you cant because it reads Ch1

[light flame]

if I use a while loop the machine will crash eventually

look exactly the new minute

now

wait what

your right

I'm doing nothing now

[timber vale]

you did something

[light flame]

I didn't cheat, really

[timber vale]

confess bro

i sent evidence

[light flame]

did you block my ip?

I didn't cheat! I would say it if I did, I have no idea

[fair adder]

Chill guys😂

[short tusk]

Hey @timber vale please report rule breakers to [e-mail] or open a ticket by the chat bubble in the bottom right corner of the website

[timber vale]

ok

[sharp siren]

why is lsattr a sybolic link to dev null> lmao?

[timber vale]

he did something to the kotj binary maybe i found out about lsattr when i tried it with king.txt to see if my chattr worked 😭

[sharp siren]

that means either two things either the koth binary is being messed with or the simulanies loops are causing weird behavior lmao

[sharp siren]

can you send me the koth binary in dms?

[timber vale]

no loops i ran ps aux many times to check if the koth binary is there

[timber vale]

the machine ended while ago i exited

im playing new machine

[broken pilot]

Lol one machine is like that from start... I forget which one tho

[timber vale]

i think the machine we where playing is tyler

[broken pilot]

He could also have a time based loop that only puts his name in the king.txt say the last 5 seconds of the minute until first 5 seconds of next minute and return king to you for the remainder 50 seconds.... He will still get the points

[timber vale]

i checked ps aux many times

[broken pilot]

I've encountered this before and there was a way to beat it... But I believe this is a f11 challenge so I won't expose how to beat it but it's pretty simple...

[light flame]

no, if I did nothing I stll got king somehow. only explanation I have that something else was messing around, no idea why though

[timber vale]

good explanation 🤣🤣 just admit

[light flame]

btw @timber vale , did you send me /dev/urandom?

[timber vale]

yes

that is not against rules

players can even kick you if they don't use scripts

[light flame]

okay, and did you dowload a file called 'key.pub' from my ip?

[light flame]

sure, just verifying who did what

[timber vale]

no i don't even know your ip

[light flame]

strange

[timber vale]

i focus on the king i didn't even patch stuff

[light flame]

it must be someone that knows that I have that file because I didnt use it in this game

[broken pilot]

Are you hosting this in a python http.server???

[light flame]

yes

[broken pilot]

If so I'd make a dedicated transfer folder with only files u want/need to be transferred to the machine so you don't expose unnecessary files...

And start your python server from that folder only

[light flame]

I use a transfer folder, it was a public ssh key

it has happened before, but then I saw things like dowloading the index '/', this time it was directly that file

[broken pilot]

Hahaha well if he did and placed it in his authenticatized keys folder looks like you can ssh in hahaha although against the rules and you probably get in trouble so wouldn't recommend...

[timber vale]

choose a random port not 80 or common

[light flame]

doesn't matter, if someone sees it in his pspy the will know immediately

if they know my ip they will be smart enough to figure that out

anyway, Im just investigating what actually happened

[broken pilot]

I would also stop your python server after transfering your files to stop ppl from enumerating your server .... Although this is against the rules also but I've had this done to me before and they scrapped all files inside my transfer folder to figure out how I was taking king 🤣🤣🤣🤣.... Thought about including a zip bomb or something to that nature in my own transfer folder and then 🤷🏼‍♂️ if they hit it hahahaha

[light flame]

that's what Im doing now, that 'previous time' I saw in my pspy that the almost downloaded my scripts, but I stopped my webserver already😂

[light flame]

Didn't found much though, only that downloaded file and I couldn't access the server at the end of the match (iptables?), so I gues I will be suspected of cheating for the coming months. Can't blame anyone for that though, so I will just move on.

[broken pilot]

Ahhh I wouldnt let it bother you too much... Just a game... Me personally I'd ask for rematch lol 😂 and then both of you would be monitoring everything so should be fair 🤣🤣🤣

[light flame]

me looking at all the dumped packets hours after the match

tcpdump would leak tons of passwords though, only a lot of work to set up efficiently

since most reverse shells are not encrypted

[light flame]

@timber vale where did you go?

[timber vale]

launch

what do you want?

[light flame]

just wondered why you aren't doing anything in the match im in

you got access

I definitly noticed that you were on the machine😂

[light flame]

If you want you can get the win on this game, that would be fair on the leaderboard

But submit some flags then, otherwise you can't get more points than me

[steep agate]

https://tenor.com/view/slide-drift-crash-fail-gif-16909243

[light flame]

@timber vale do you want the win or not

at least I offered...

[timber vale]

nah im going to take some time out and do other thingd im staring at my screen 5 hours straight since i got from school

[sharp siren]

Bro matheuz is out of pocket 🙏

https://tenor.com/view/wait-what-excuse-me-0_0-out-of-pocket-gif-22951568

[steep agate]

on some machines in koth this is normal, chattr too

[fathom yacht]

I just found out like 100 "hidden" rooms in this server. I am such a n00b when it comes to discord.

Hi guys.

[sharp siren]

I only knew it was for chattr but didnt know it was also for lsattr tho

[sharp siren]

https://tenor.com/view/skill-issue-simply-a-difference-in-skill-frog-dancing-skill-gif-21877908

[fathom yacht]

Don't worry, I am reaching 0x9 soon...

[sturdy fox]

Gg @wintry isle

[wintry isle]

GG bro
sorry i was little bit late XD

[sturdy fox]

Yeah my Attackbox crashed as soon as u got in🥲

[timber vale]

hard box dont have koth service by default do i need to make one?

🤔🤔

im king and i cant find the koth binary but it doesn't show me king in the website

is this a bug i had the same thing hours before with the hard box🥲

[steep agate]

this is docker bro

lol

Ch1_was_here_in_docker.txt 🤣

[timber vale]

🤣🤣🤣🤣

[south pulsar]

👽👽

[sturdy fox]

Has someone ever found all 8 flags in the shrek machine? I only find 6...

[fallen palm]

Same here

[tardy imp]

@south pulsar GG you are so fast 🥲

[south pulsar]

Thanks dude , 😸

[sour vector]

Gave +1 Rep to @tardy imp (current: #2141 - 1)

[stiff egret]

primary reason being that they are not in standard format, some of them are base64 encoded too, which makes them hard to find with regex

[sturdy fox]

ohh okeyyy, i always looked with the find command ig

[light flame]

@steep agate you know what happened to the machine?

[steep agate]

I don't know, I'm not on the machine 🤷‍♂️

[light flame]

okay

suddenly I can't access the machine anymore, so I was wondering if you had info

nobody gets king points so maybe the machine is just down

[fair adder]

Maybe someone removed the whole filesystem?

[light flame]

@south pulsar you are also on the machine?

[light flame]

I would've seen it in pspy right

wait let me check

RIP

[fair adder]

Lol

[south pulsar]

which one ?

[light flame]

panda

[south pulsar]

no

are you able to get root?? @light flame

[light flame]

ofcourse

[broken pilot]

Yea I don't think matheuz would've ran that....

[steep agate]

Are you sure the machine hadn't ended on that machine? Normally when the machine finishes it automatically turns off

[light flame]

no, after it was reset I could access the new machine, so that match wasn't expired

and all my shells terminated, so it wasn't an earlier session

id was 103315

[steep agate]

This is normal, if you reset the machine after an hour it has to finish lol

If you were on a machine, and it was reset, it has to be turned off for a new IP to be generated, and when this new IP is generated, time has passed, even though the session continues, after 5 minutes or so ( depending on the machine, as there are machines that as soon as the time runs out, it turns off instantly) it turns off

[light flame]

no I resetted it after I lost connection

it wasn't reset, otherwise I would've seen a popup in the browser

but I won anyway so it doesn't really matter anymore

[steep agate]

either someone who was on the machine shut it down, or someone also clicked to reset and turned off the machine

I have no idea why I wasn't on the machine much less connected to the VPN so I don't know

[timber vale]

https://tryhackme.com/games/koth/join/d0c3852bf94037ad6295ab3c

[young bramble]

would you please not ask this kind of questions on the wrong server ? I've just got muted for 24 hours because I was trying to point you to the right server. Just ask the question where the problem is not on the competition's discord server. I wish THM staff would be so fast in taking actions on koth reports ...

[young bramble]

how did you get in tyler machine ? via port 6555 ? because that is a chroot

[timber vale]

no

i don't remember how i got in but i didnt use that because i couldn't get king with it

when i got in i was king for sometime on the website then what happened happened

[young bramble]

I suggest repporting this ASAP. This is not only against the rules, this is illegal and considered a hacking attempt against your vpn endpoint. At least I consider it this way. and I would not let the offending IP get unpunished. It's one of the reasons we use openVPN and Attackbox, to have private IPs so anyone using them could be tracked inside the THM network and pay for this kind of irresponsible actions. Some IPs are not changing unless we switch servers but even then everything remains in the logs.

[late wadi]

I’ve already solved the issue and need no further guidance, thank you

[sour vector]

Gave +1 Rep to @young bramble (current: #1071 - 3)

[timber vale]

you can see here

in the img

@young bramble

its not the first time i play that machine 🤣

[young bramble]

ok. just wanted to check if it was that chrooted folder.. sometimes confuses users... docker too. It must have been a glitch/bug then. Or maybe the browser did not refreshed the page even if you were king (happened to me) or maybe Arnout used F11snipe's tecknique to put his name in last seconds of the minute and put back your name after few seconds

[timber vale]

i tried refresh many time cause it was strange and i used ps aux and mount to check if there is a folder mounted in top or a process that was hidden with mount

[young bramble]

did you try to open port 9999 of the machine in browser or in "curl http://<machine_IP>:9999" to see if koth service is responding with your name or his ?

[timber vale]

yeah it did give his name when i used curl

the koth service was up apparently

[chilly torrent]

I never played koth before,like i am pretty much good with linux and some tools is it hard?

[timber vale]

no not that hard

[chilly torrent]

liek how do you get points?

[timber vale]

just some machines like hard and windows in windows i don't know many tricks to protect king i only use attrib because icacls break the permissions

[timber vale]

every one minute king = 10pt submit some flags and you get points

[chilly torrent]

how do you get king?

like is it in a hidden directory?

[young bramble]

you put your name in file /root/king.txt

[sturdy fox]

the harder the flag the more points right?

[chilly torrent]

like all i have to do is just enter on the machine and do that?

[timber vale]

yes

[young bramble]

you cannot just enter 🙂 some machine have dirrect root access but most of them you need to get a foothold and the elevate privileges to get root.

[chilly torrent]

thats confusing, what rooms / pathaway would make the koth after i solve them

[young bramble]

nothing to do with paths

[near lily]

There is a few rooms that help with KoTH

[chilly torrent]

by any chance you remember the names of any of them?

[near lily]

KOTH Food
Koth Hackers
Red

[chilly torrent]

thank youu

[lyric geode]

https://cdn.discordapp.com/attachments/1263256022558970008/1264316591408025732/caption.gif?ex=669d6e15&is=669c1c95&hm=c42bc7cd002e7399e977ada5611e2e1d8b45c1ab5b5c8f057a4636bfe86bd4d4&

[light flame]

Thanks for the advice, but sadly the requests were made from the IP of the target machine, so reporting isn't going to help.😢

[sour vector]

Gave +1 Rep to @young bramble (current: #872 - 4)

[timber vale]

https://tryhackme.com/games/koth/join/9cfb7279ec954e73a666eb13

[timber vale]

https://tryhackme.com/games/koth/join/1ce3d5f8ffa5186f5cab00f6

[north wolf]

I've discovered a flag in fireworks, but it says its incorrect, how!?

I don't think, it's a good idea for me to share how and where I found it so where do I report it?

[north wolf]

and, what makes the find I found flag is how I found it.

[fair adder]

https://tryhackme.com/games/koth/join/0e92d31a83b5bd6c49e3bee3

[sturdy fox]

@timber vale how are you in a machine 2 minutes after start?😭

[timber vale]

know them well 🤣 make my commands ready when the ip get out i run them if they need just curl 🤣 always ready before the ip❤️

[sturdy fox]

Damnn

[broken pilot]

@light flame I would suggest making a backup copy of /bin or certain binaries , renaming them, hiding them somewhere, and adding a chattr lock to them.... Although this is still easy to find and remove, it may help you if someone decides to rm -rf / ....

[light flame]

I had enough backup bins, so that was still possible, but just if I should report or not

doesn't matter anymore because machine is reseet

[broken pilot]

Well I mean you can but it really won't stop them or an alt account from doing it again.... And from the screenshot it looks like you didn't backup some essentials.... Or if you did you could've used those instead...

[light flame]

I could use echo to write my name and a chattr backup, it wasn't mounted otherwise I would've been done

[north wolf]

found flag not working on fireworks, report where?

or is it a rabbit hole?

or do I need to do something with the THM{<hex_string>} "hex_string"?

[timber vale]

https://tryhackme.com/games/koth/join/481a21d843d53f418a3105d1

[fair adder]

Mhhh isnt it an idea to open KOTH only for people with rank 0x5 or higher? That lowers the risk of people making alt accounts, and as the bar is higher, unlocking koth feels more special than having it already when making your account. So there is a chance more people are trying it.

This is probably already discussed, but I was just thinking about it.

[timber vale]

there are new people constantly joining that have experience maybe coming from other platforms they also have right to play koth and can compete

[fair adder]

Yeah I guess that's why

[sturdy fox]

Is it allowed to remove a subdomain on a koth machine if it reveals the id_rsa key? Shrek machine in mind

[light flame]

I don't know, but I would just change the public key

[violet zealot]

If I remember well there's an LFI, so don't touch the subdomain and just patch the LFI

[young bramble]

I was telling you that reporting is the only way of stopping this. attacking or starting reccon on your private IP (your vpn endpoint) is forbidden. No matter if it's done from the IP of a koth machine. It's even better because the number of attackers is reduced to those participating in that game, plus those who saved the IP of the machine. The important thing is that he connected to koth machine from his own private IP that can lead to his account just investigating the logs. But there will be no investigation if you don't report.

[young bramble]

Yes, the format of all the flags I found on Fireworks machine is this: THM{32HexChars} ... I found 6 flags. I don't know how many are there

[timber vale]

https://tryhackme.com/games/koth/join/f7cc0dfb173ae1f7fdb70100

[sturdy fox]

13 King Changes haha😂

[sturdy fox]

Ur dirty @timber vale

[timber vale]

wtf

what do you mean?

@sturdy fox

[sturdy fox]

I meant u are pretty good, so fast in Carnage, got king than used chattr on it, made chattr unusable, made the /root read only mode, i dont even know how to do all these things 😂

[timber vale]

i have my own chattr 🤣 i dont think the machine chattr work i didnt even delete it i bring my own 👍

what is your username ?

[timber vale]

were you accussing me of something ? 🧐

[sturdy fox]

No lol it was meant as a compliment 😂