koth

[young bramble]

If you are unable to play KoTH because the requirement of being Intermediate or Advanced, click on your avatar in top right corner, then click on Manage Account, then scroll down to Technical Ability and choose Intermediate or Advanced. after this you can start or join KoTH games

[summer eagle]

hmm i dont get it

[void vortex]

guys, is koth hard ? I am a beginner and I dont have access to it, I would really be grateful if someone can tell me whats that (I am currently completeing junnior pentetration tester module rn)

[mystic oxide]

Hi, look at @young bramble message just above, he explains how to do it.

[void vortex]

Thanks, but I am asking if koth is like really hard or not , I saw a few streams on YouTube and I didn't understand a thing

[sour vector]

Gave +1 Rep to @mystic oxide (current: #763 - 7)

[mystic oxide]

some KOTH machines are easy

[young bramble]

A good way to start is to create private games, (2 users required) and study each machine and take notes (scan ports, try services and vulnerabilities to find a way in, then escalate privs, and then start to find faster methods (ssh keys, crackable hashes, backdoors, exploitable services, etc) Take good notes on each machine and update notes with each game. Only 3 machines run scripts to change creds on startup (Fortune, Hackers, Hogwarts) the others are static with same passwords/keys for users

You can also find a lot of tips for each machine, if you search, but it's more helpful to find them yourself and learn practical enumeration and exploitation

After you get this, the fun part begins... Competing with others in the fight for king. Depending on your opponents, you might need in-depth Linux knowledge or even kernel development experience

If you need a reason to start, it's probably hard for you. But if your curiosity is pushing you to try and learn, then you have the right hacker mentality. Even if it's getting harder, it's not impossible. And you can always ask the community for help.

[void vortex]

Thanks , will do

[sour vector]

Gave 1 Rep to horatiu777 (current: #853 - 6)

[civic vortex]

That machenism is so funny

[opaque canopy]

anyone up for some late night koth?

[opaque canopy]

the vc seem dead these days sad

[opaque canopy]

imagine deleting the flags

@timber vale

[mystic oxide]

why ?

[timber vale]

??

are you saying i deleted some flags?

i dont have to. i always win i dont even patch you can get root but you wont get king ....

[opaque canopy]

Well yeah don’t act like koth is something big it’s easy all are beginner level you just automate putting your name in the king.txt

And you did delete the flags there were only one on the system but I find it funny how people think beginner level boxes are something massive to be proud of 😂

[steep agate]

Rootkit in Koth has really made history, even frustrating players 🤣

[steep agate]

I think that just like ch1, me, f11snipe, and other players, who use rootkits or some cool technique to protect king, just get root, put the name itself in king.txt and then leave the machine, and let others try

so there is no need to even patch the machine

It is more common to see players without experience in Koth when they are unable to be king doing this

[opaque canopy]

I just dont really play koth

last time I really played was back in 2020-2021

[mystic oxide]

No, @timber vale doesn't remove anything, he just has very good protection for his king. If you found just one flag, you probably didn't search properly.

[versed vortex]

brother dompriv

donut join the game i join, i am a tiny newbie and you're a sage

i don't want to be steamrolled again

[mystic oxide]

I've been playing KOTH for a long time

[versed vortex]

i got 1 flag bro

😂

just now

[mystic oxide]

you are shaniidev ?

[versed vortex]

yes sir

[mystic oxide]

ok

[versed vortex]

i haven't learned ssh yet so it's difficult

[mystic oxide]

https://zah.uni-heidelberg.de/it-guide/ssh-tutorial-linux

[versed vortex]

thank you

[sour vector]

Gave +1 Rep to @mystic oxide (current: #702 - 8)

[timber vale]

koth is all about king if you can protect the king.txt file and the koth service you dont need flags and you dont need to patch. if you cant find flags its just a skill issue

[opaque canopy]

Skill issue? It’s just koth what are you on about 😂

Have more advanced things to worry about rather than koth and an actual career

[timber vale]

not being able to find flags certainly shows how advanced you are

[opaque canopy]

I didn’t care to find them 😂

You are making straight up assumptions on someone you do not know who would humble you 😂

I’m not gonna feed this childish koth rage bait anymore you have you’re fun man I know who I am that’s all that matters now I remember why I strided away from this discord server full of people who think their stuff better than anyone else 😂

[timber vale]

if you didnt search for them why do you say i deleted them 😂 flags are hidden by nature

[opaque canopy]

Again haven’t hopped on koth in around 3 years forgot how they had their flags setup 😂

Not just koth but thm in general

Their pay is pretty good too been with them since I was 18

[steep agate]

Wow a synack member getting stomped on by a koth player, and a rootkit?

that's new

[opaque canopy]

You clearly didn’t read my previous messages 😂

[steep agate]

I didn't really read it, but putting something without context like synack in a koth conversation doesn't make any sense either, right? That's why I just replied to it 😄

[opaque canopy]

Mentioned that I didn’t care to get the flags just wanted to revisit something from my past 3-4 years ago

[opaque canopy]

Here you go then^

Didn’t care to actually play and again difference between koth and actual penetration testing it’s not something hard to grasp

[steep agate]

Clearly, I'm also a red teamer and a malware researcher, CTI , but that doesn't mean I say what I work with, if I don't care about such a thing, or posting things that are out of koth here.

clearly koth and pentest are totally different, but it's a fun game, just like other battlegrounds like htb

you are frustrated with koth for nothing, besides, i think ch1 is under 18, and you are angry with him, and you lost to him x)

[opaque canopy]

I never said I was angry with him you are just putting words in my mouth now 😂

Never got frustrated and why are we making this such a big thing it was done until you jumped in just adding more for no reason

[steep agate]

https://tenor.com/view/skill-issue-no-skill-skill-massive-l-gif-1772992733160300208

[opaque canopy]

He’ll now if we’re really going there I started working in the field at 18 for my first certification at 14 currently on my 4th like why are we making this a measuring contest now 😂

Just further proves my point on how y’all are childish I’m done here 😂

[steep agate]

i started working in the field with 15y, first certification at 14, but I don't see that as a merit to tell everyone 🤷‍♂️

[steep agate]

again, skill issue in koth 🤓. Even more so for someone who works at synack

[fossil helm]

https://tenor.com/view/windows-linux-linux-users-windows-users-windows11-gif-25304807

[fossil helm]

exiftool -b -W %t.bin synack.png

Damn I can see the pass now it's time to Hakka this pic and login

[near lily]

@opaque canopy @steep agate @timber vale

If you guys can't be nice in the server, you may lose access to speak in the server. 🙂

[fossil helm]

https://tenor.com/view/bye-felicia-hiding-humiliated-leave-me-alone-girl-bye-gif-21567771

[steep agate]

Alright

[civic vortex]

cool

[median heron]

@serene lintel hi

[jovial phoenix]

Hello

[steep agate]

For koth players who want to win against players that uses userland rootkit https://matheuzsecurity.github.io/hacking/bypass-userland-hooks/

[timber vale]

@mystic oxide now 👀

[boreal marlin]

How rude of you to give away the workaround to our rootkits /s

Also really nice detailing about it btw, nice work 🩶

[steep agate]

thank you!

[sour vector]

Gave +1 Rep to @boreal marlin (current: #196 - 44)

[median heron]

@frigid jolt hi

[north hollow]

was chattr blocked?

[mystic oxide]

when chattr is not available, use your own chattr

[north hollow]

I tried to use chattr but I got permission denied

(as root)

[mystic oxide]

use your own chattr

[north hollow]

may I ask how?

[mystic oxide]

you just have to upload your chattr to the machine and then you can use it

[young bramble]

#koth message

[civic vortex]

https://www.google.com.tw/search?q=custom+chattr+binary

[gritty cedar]

hello everyone i am back online and i want friends to join us

https://tryhackme.com/games/koth/123755

[gritty cedar]

is there any problem with the machines ?

┌──(x㉿LAPTOP-01BHP5O4)-[~]
└─$ ping -c 3 10.10.130.83
PING 10.10.130.83 (10.10.130.83) 56(84) bytes of data.

--- 10.10.130.83 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2067ms

┌──(x㉿LAPTOP-01BHP5O4)-[~]
└─$ ping -c 3 10.10.130.83
PING 10.10.130.83 (10.10.130.83) 56(84) bytes of data.

--- 10.10.130.83 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2087ms

┌──(x㉿LAPTOP-01BHP5O4)-[~]
└─$

i am connected to open vpn

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.13.86.149 netmask 255.255.128.0 destination 10.13.86.149
inet6 fe80::55aa:18a2:a490:6bce prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 128632 bytes 5662992 (5.4 MiB)
TX errors 0 dropped 514 overruns 0 carrier 0 collisions 0

┌──(x㉿LAPTOP-01BHP5O4)-[~]
└─$

[mystic oxide]

Yes, from time to time certain machines bug, we can't even ping them, even after a reset

[steep agate]

https://www.youtube.com/watch?v=jz5H2SBjdEg

[viscid sundial]

oooooh, seems very helpful for koth

[mystic oxide]

Hi, for several days now, the Space Jam machine has not been working.

[viscid sundial]

also can confirm 🙂

[dawn ivy]

Same as Lion machine

[mystic oxide]

ha we can be yes, I haven't done the lion machine yet at the moment

[dawn ivy]

Even of we reset the ip still not working

[mystic oxide]

ok i will also report back when i come across the lion machine

[slow reef]

join a koth room

https://tryhackme.com/games/koth/join/103ffb26a9e3fe22e78a69a4

in 20min

[mystic oxide]

Ah yes you're right, the lion machine no longer works either. I am on it and impossible for ping

Machine Space Jame and Lion no longer works.

[median heron]

@gusty urchin hi

[viscid sundial]

huh, I thought it was working a few days ago, I guess something happened recently

[dawn ivy]

I think they're working on it now 👌

[young bramble]

It happened to me also last month, I thought it was something misconfigured with my account when I got both machines (Space jam & Lion) in 2 consecutive private games. Nothing worked, switching VPN servers, reset, AttackBox... The KoTH machines were unreachable. I reported this in may20.

[north acorn]

is space jam still down?

[viscid sundial]

yes, space jam does not work right now 🙂

[north acorn]

alright, thx 🙂

[viscid sundial]

no problem 🙂

[twilit pawn]

@fossil pecan any hints on how i can bypass your method? for king.txt

[steep agate]

maybe you can found some cool stuff here https://github.com/MatheuZSecurity/detect-lkm-rootkit-cheatsheet

[novel minnow]

This AI art hella cool ngl

Which one did u use?

[steep agate]

Yeah, AI knows how to make pixel art very well

and I love it

[steep agate]

gpt does this very well, just ask to do it in pixel art style, with a cyberpunk theme or whatever you want

[novel minnow]

Alr, thanks.

[sour vector]

Gave +1 Rep to @steep agate (current: #119 - 71)

[red olive]

Hi guys I want to start playing KotH , any advices for a newbie here 😄 ?

[vocal urchin]

https://tenor.com/view/nuclear-catastrophic-disastrous-melt-down-gif-13918708

rustscan

Rest you def know

[sand pendant]

Bruhhh

Someone is not allowing us to do anything on the target machine

Thats cheating

[civic vortex]

more specific?

[viscid sundial]

when Ch1 joins, leave immediately

I'm joking, I would just say to do it like a ctf

find the vulnerabilites, get root access, enter your name into the king.txt in the root folder, and get the flags (usually there are minimum 6 flags)

[viscid sundial]

without rustscan, you're doomed

[sand pendant]

I mean that guy called Ch1

He like to kick us from doing anything

[mystic oxide]

Hi, no, Ch1 doesn't block anything on the machines, he just takes the king with good protection. That's the goal of the game, and he doesn't need a flag to win.

[viscid sundial]

you also take the king with good protection

I think Ch1 makes the mounted disk readable only or smth

but, he sometimes does kick players out if they are connected to ssh, etc. (which is allowed, I believe)

[mystic oxide]

No, Ch1 doesn't kill sessions, he doesn't need that to win.

[viscid sundial]

yes, he doesn't need that to win, but he sometimes does

it happened to me

[mystic oxide]

who has never killed another player's session 😉

Ch1 is simply a very good player.

[viscid sundial]

once you get into a machine, it really isn't difficult to get into it again the next time

[mystic oxide]

The most complicated thing is not to enter the machine, but to obtain the king and, above all, to succeed in keeping it.

[viscid sundial]

yeah, keeping king is the most difficult part

[timber vale]

no thats not true

i dont kick anybody or close any session

you can play the machine like normal and still get root & flags

but you wont get king

[timber vale]

no i use a kernel module

[vocal urchin]

yuppp

[sand pendant]

Idk tbh maybe its an issue with the openvpn sorry bro ma bad

[mystic oxide]

If you can ping the IP addresses of the machines, your VPN is ok.

[sand pendant]

Ok what are the other possible things this can be

?

Last time i had this problem and fixed it

But forgot what i did its been a long time sisnce i made some koth

[timber vale]

or maybe you're right maybe somone killed your session but thats not me just because i have king doesnt mean i am the only one on the machine since i dont patch also i only stay like 3-4 min in the machine then i close my shell

[timber vale]

also spacejam and lion are not working so thats maybe the issue

you get the ip but you cant reach the machine

[mystic oxide]

In fact, the Spacejam and Lion machines no longer work.

[smoky karma]

Good luck playing with you. If we ever manage to find that kernel module

[smoky karma]

Btw we were just in the same game and i still couldnt find it until the server closed for some reason

[viscid sundial]

wait, will they be discontinued?

[median heron]

https://tryhackme.com/games/koth/join/0411b72bde6bf51687749409

[granite wigeon]

@gusty urchin you kicked me out kill my session illegal process

Just to let you know, I have recorded everything, including screenshots, as evidence. What you’re doing is against the rules and possibly illegal. I will be reporting you immediately.

[viscid sundial]

I believe that is allowed

[granite wigeon]

Bo

No

[viscid sundial]

how is it illegal?

it's koth

[viscid sundial]

where in the rules does it say?

because I thought it was ok

[viscid sundial]

no part of the rules stops someone to kill someone else's session:

[granite wigeon]

6. Do not target other players
   • Attacks must be against the machine only—not against other participants.

[viscid sundial]

yes, but it's not an attack on you

it's an attack on your session

it stops your session

[granite wigeon]

How do you describe when im kicked out and he closed the port

[viscid sundial]

if he kicked you out, that's fine, but if he closed the port (which I just now heard) is against the rules

it's against the rules, but not illegal

you can report this incident

[granite wigeon]

Yes he closed the ports

[viscid sundial]

ok, then that's against the rules

[granite wigeon]

Thank you

[timber vale]

its allowed to kill other sessions as long as its not automated with a script or smth

[viscid sundial]

yeah, but they apparently also closed the ports

which is against the rules

[timber vale]

he is allowed to change ports

[viscid sundial]

he stopped the ports, not changed the ports

[timber vale]

yeah thats against the rules

[viscid sundial]

yeah

[granite wigeon]

Yeah thats what i mean

Btw where can i learn how to kill sessions and change ports?

[timber vale]

find the shell process and kill it you can do that by listing all connections and kill those PIDs with different ip than yours or just list all processes and find bash or sh processes that arent yours and kill them. you can list your shell pid by doing echo $$.

and to change the ssh port you need to change the ssh configuration and restart the sshd

[granite wigeon]

Man it take you 2min to be the king then you lock king.txt no one can be king give us a chance im new here i started hate koth🤣

[boreal marlin]

You can automate a lot of the breaching and securing process tbh

LD_PRELOAD rootkits are commonly used too iirc

[steep agate]

LD_PRELOADs are easy to bypass... just use some static binary or busybox and that's it, in most cases, if it's in koth, it will work perfectly against those who have no idea what an LD_PRELOAD is.

the most effective way is to hook syscalls using LKM

and implement your own defense logic, whether returning -EPERM, etc , the amount of things you can do in kernel land is huge

[north acorn]

but isn't that against the rules, like an autopwn?

[boreal marlin]

Not sure for this CTF but generally it's kinda "how automated is it?"

[near lily]

Yes, It's against the rules for KoTH.

[civic vortex]

It's kinda vague, is writing an automated web password brute force script + one liner to get shell consider as autopwn? idk

[lunar jewel]

any one wanna paly koth

i've never played it before

btw

i'll try my best

and also need suggestion how can i give it best

[lunar jewel]

participants players can also be hack ? in koth ?

[viscid sundial]

what do you mean?

no, it is against the rules for players to hack other players

[lunar jewel]

it can be hack or not

i mean honeypots

[viscid sundial]

what are honeypots?

[lunar jewel]

like to trap the people

[viscid sundial]

could you give me an example?

[lunar jewel]

well nvm

wanna play with me koth i've never play it

[viscid sundial]

you can make the machine more difficult/impossible to get into, but you cannot stop ports, modify, attack, or stop the service on 9999, use scripts, attack other players, etc.

[viscid sundial]

not right now

[lunar jewel]

and ones i have fuly recognized machine struture then i can do auto make attacks?

[viscid sundial]

you cannot automate attacks

you must do them manually

like using scripts and stuff

[fossil helm]

Like a trap server a Hakka man thinking that he pawned a server but it turns out to be a honeypot while the owner is watching what you doing inside his honeypot.

[fossil helm]

You can just YouTube koth you'll get a lot of information from f11snipe streams, matheuz and others.

[timber vale]

yh so basically there is no firewall between players and machines there is only between players so someone could take your ip when you play koth with him then he would create a private machine for himself or even use boxes challenges and he would be able to interact with your machine

so you could get hacked by playing koth if that is what you're asking

[summer burrow]

well I definitely know of a player who uses scripts wasn't even 2 minutes and he had already got king status.

and there is a difference between closing ports and setting up firewalls on all ports right?

Ch1?

lol

[timber vale]

i played 2500+ games do you expect me to take 10 min for king 😂

[timber vale]

also i dont even change ports let alone close them because i dont have to you can get root and all but you cant bypass my rootkit to get king

you maybe talking about lion or spacejam cause those machines dont even work they have been like that for a while. you cant even ping them

[summer burrow]

can't bypass your rootkit eh? hmmmmm sounds like a challenge.

[lunar jewel]

oh thanks well i also got some tips from chatgpt
🛡️ Tip for You:

When playing KoTH:

Use iptables or ufw to block incoming connections if needed.

Don't run a reverse shell listener on all interfaces (0.0.0.0), bind it only to 127.0.0.1.

Always close ports and remove shells once you're done.

[sour vector]

Gave +1 Rep to @timber vale (current: #1923 - 2)

[lunar jewel]

🔐 Example: Defend Your Kali During KoTH

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 4444 # if you're expecting reverse shell on this port
sudo ufw enable

Now, no one else on the VPN network can scan or attack you — only connections you allow will go through.

[timber vale]

what is this hes telling you to listen for a reverse shell on 127.0.0.1 😂. you wont get any lol

[lunar jewel]

yeah thats why i send it here

[summer burrow]

well your rootkit is tough......I'll figure it out

[summer burrow]

@timber vale wasnt lying....can't get the king.txt..........but I will figure it out.....eventually.......

[steep agate]

if you are faster than most players on koth, you can simply disable module loading, and then to be loaded again, the machine would need to be restarted, which is forbidden to reboot machines in koth

[fossil helm]

don't leave your python server open someone can crawl it if they know your koth IP, worse they can see your parent directory and the scripts/files that you had and stole it 😁

[fossil helm]

@steep agate rootkit channel on his tag.

[fossil helm]

With ch1's advance haki for 10 seconds so impossible their chance is to have forensics like yours or double the knowledge that you had in Linux rk 😆

[steep agate]

The only problem is that Koth machines are very limited, and so there are many detection tricks that would be easily detected that cannot be tested on Koth machines.

[summer burrow]

yeah not much fun when someone has a rootkit script running preventing any change to the king.txt constantly creating the file to keep his name in it. Clever but I can't find a workaround. Why even play when you go in and set your rootkit.....it's like bullying I think.......BUT i am still interested in figuring it out.

[timber vale]

no one is stopping you from creating one. infact thats the reason i made one, i used to be "bullied" by matheuz and F11

[timber vale]

join matheuz rootkit server there is a lot of content that you can benefit from, also check out the xcellerator blog

[summer burrow]

well it's not cheating but it kinda is like the same thing and takes the fun out of it although the real challenge is actually trying to break it.....so I guess everytime you run it I will try to find a way to defeat it. I know its kinda impossible once you run it but its stoppable if I can just get in before you do but that is the real challenge. getting in before you do.....which I know how on panda now but still........you suck....lol

I have one created but you always beat me getting inside.....

Are you allowed to load LKMs or patch kernel memory?

[steep agate]

for example hidden processes of ch1 can be found, I once found the hidden process of the kernel thread it uses

and among other things, which I didn't mention, but in fact, because it's a CTF and koth machine, it's quite limited and you can't test many things

[steep agate]

Yes, maybe it's even good for other people, or it sparks curiosity and a desire to learn about Linux malware.

[summer burrow]

@steep agate Are you allowed to load LKMs or patch kernel memory?

[timber vale]

yes

[steep agate]

yeah

[summer burrow]

okay just checking

[steep agate]

you can try to write your own module that detects lkm rootkits hidden, but, it may not work against ch1 because maybe it hooked into init_module / finit_module, which, with implemented logic, your LKM simply does not get loaded

[timber vale]

yh i did hook both of those syscalls

https://youtube.com/@crr0ww?si=lSagkfuRXpRjLzx-

https://youtube.com/playlist?list=PL2-MHfTy2uA2m_iGnbwCtjbeMUJ7mKvIL&si=ljIDkvwJZlZSX1ZK

https://youtube.com/@nirlichtman?si=Dcq9yGZnfDMGDLlT

https://xcellerator.github.io/posts/linux_rootkits_01/

[timber vale]

this is a series of 11 articles or so

https://youtube.com/@lowleveltv?si=IkHq11xZAN0Uorza

https://youtu.be/87SH2Cn0s9A?si=s8LzONHuSnB1lC7Z

these are the sources i mainly learned malware dev from. in addition to articles online ... if more people learn malware dev koth will be challenging and fun which will makes us all benefit and i push those who already know to innovate to keep up

[steep agate]

io_uring could maybe bypass your rootkit, but it was only introduced in a more "recent" kernel version

I was thinking of writing some malware using io_uring just 4fun

[mystic stratus]

This is huge, thanks!

[sour vector]

Gave +1 Rep to @timber vale (current: #1454 - 3)

[timber vale]

np

[viscid sundial]

but that's against the rules

[viscid sundial]

if it was seconds, then it is a different story, but 2 minutes is apparently not the quickest time

[timber vale]

yes it is

[viscid sundial]

so technically speaking, they possibly could hack into your machine, but it is against the rules, and if they do, they will be banned from KOTH

[timber vale]

i know, he was asking if it was possible

[viscid sundial]

yeah, but I was just explaining that it is against the rules

and also illegal in a sense

[near lily]

You can get hacked from any point in the THM network.

[viscid sundial]

true, but it is illegal and against thm rules

[near lily]

Doesn't mean the risk won't be there.

[viscid sundial]

also true 🙂

that's also why you shouldn't use your main computer as your attackbox

[vocal urchin]

👀

[timber vale]

i think its exclusive to koth cuz a player cant interact with othet players on the network. but all machines can interact with all players and someone needs to know your ip so to get hacked you have to have played koth before and someone got your ip and he know can use anyother box even private or room boxes to target you

[viscid sundial]

yes, but what if they find an ip from the network?

another person's ip?

so you could be hacked outside of koth

[timber vale]

the other website that we are not supposed to talk about doesnt let any machine interact with you or let you interact with any machine that you aren't part of.

[near lily]

You could also scan the entire vpn range.

[near lily]

the other website that we are not supposed to talk about

Nobody said you can't discuss Hackthebox.

[viscid sundial]

of course not, but "bad" hackers can hack others when connected to the network

[timber vale]

to find a person ip he needs to have played koth cuz you cant interact with other players directly

[vocal urchin]

You can scan the network

👀

[viscid sundial]

you don't necessarily need koth to find ips

[timber vale]

i thought people get muted for that

[viscid sundial]

why would they get muted for saying hackthebox 🤣

[near lily]

Not at all.

[timber vale]

you cant just scan the network like i said your vpn does not allow you to reach other players directly and you will notice that when you try to ping them from your own machine so you need to know the ip another way and the only way is koth or some one sending it in a screenshot. then you can reach them from any other machine

[viscid sundial]

mmm, not according to scrubz

and I trust him more

also, of course you can scan the network, it's a network 🤣

[vocal urchin]

Man try scanning your network rn

[timber vale]

thats fine. you dont need to believe me im saying what i know is true you can agree or disagree you have free will

[timber vale]

its against the rules

[vocal urchin]

Scanning isnt

[viscid sundial]

he meant your network, not thm's network

[viscid sundial]

Scrubz, you can be hacked at any moment if connected to thm's vpn, right?

[timber vale]

but theoretically that would allow you to discover all koth boxes even private ones cuz they always start by 10.10.xxx.xxx so you only have 255x255 possibilities

[near lily]

Yes.

[vocal urchin]

Its a network full of hackers

Ofcourse you can be hacked

[viscid sundial]

yeah, exactly

[near lily]

All THM* machines start with 10.10

*Except two.

[vocal urchin]

Jellyfish?

[timber vale]

yes but this is if someone already has your ip and used another machine to target you

[near lily]

The vpn is 10.xxx.xxx.xxx

[near lily]

Yeah.

[viscid sundial]

yes, and they can find your ip

[timber vale]

koth machines

[vocal urchin]

The otherone?

[viscid sundial]

we're not just talking about koth tho

we're talking about the whole network

[timber vale]

im saying if someone finds your ip he can hack you from anywhere in the network using other machines like private machines or machines in rooms. but the best way to find someone ip is koth. and if yiu scan the network you wont find peoples ip you would just find other machines, and theoretically if you scan this range 10.10.0.0/16 you will find mostly koth machined then you can deanonmize the game by finger printing the box and have access to private games without being a member but ofc this is just theory 🙃

[near lily]

You won't find mostly Koth machines on 10.10

All target machines launched on THM will be on 10.10 or 10.103 if there is too many.

[timber vale]

every koth machine ip starts with 10.10 you can test it out i played 2500+ koth games

[near lily]

As does most target machines on THM.

[timber vale]

theoretically you can finger print them all koth machines have port 9999 💀

[near lily]

You can finger print all target machines

There also won't anywhere near that many of KoTH games running on THM.

It's just not that popular.

[vocal urchin]

Yup

[timber vale]

and they reuse the same http server for port 9999 code so some stuff in headers are gonna be similar so using this you can deanonimuze every private game adding to this the fact that you can see every private game in koth and what machine it is and who is king from your browser if you just keep incrementing the game_id from the latest public game this will allow you yo pinpoint the exact machine but ofc this is just theory 💀

and you can attack that private machine and see what they are doing even tho youre not a member but ofc this is just theory 💀

[near lily]

How many other machines also use port 9999?

I mean, I use it for alot of things I do.

[timber vale]

i would imagine not that many. and they dont use the same http sever for king

[near lily]

Doens't need to be used for king.

[timber vale]

thats what im saying in theory if you send a request to all those machines that you got from the finger print you can find a name in king and match it against the name from that private game and you would have access without even being in that private game

💀

[near lily]

No, I'm saying that you declared you can only find Koth games on the network as they only start with 10.10 as wrong.

When all machines start with 10.10

10.103 if there is too many.

[timber vale]

no i said you will mostly find koth machines on there cuz i imagine other machines having the same subnet

[near lily]

No, you'd find more target machines than Koth machines.

As it feels like there is only 10-15 of you who play KoTH.

And probably > 300 machines booted up at any one time.

[timber vale]

to summurize scanning that range (10.10.xxx.xxx) and fingerprinting machines with port 9999 and the same http server as koth machines and sending a request to that port and getting an html reponse with a name but not an html page will reduce the pool to mostly koth machines then to figure out which machine belongs to which game you can fingerprint the machine type and the person who is king and use that to deanonimise the private game and get its ip but like i said this is just theory.

[near lily]

It would work, you'd get caught and possibly banned.

THM monitor the network.

[timber vale]

yeah. all im saying its theoretically possible idk if you'd get caught .but i take precautions anyway i always compile my lkm on my own vms not koth private games

[near lily]

Yeah, you'd get caught.

[timber vale]

ok.

[timber vale]

but you guys should fix that in your vpn servers and and only allow accesss to people in the machine and let the machine reach only people in the game. this would fix your security problem cuz if the people are on the same machine they would mostly see if another person tries to attack them from it

[timber vale]

that other website does this

[vocal urchin]

doesnt Hackthebox free account, use a shared machine?

[timber vale]

yes you all need access to the shared machine in any platform but you dont need access to another machine that you arent in and that machine shouldn't be able to reach you. thats is were that other website shines amongst other things

also no player should reach any other player this one thm does already

[vocal urchin]

so on htb i cant do 2 boxes at the same time?

[timber vale]

basically this needs to happen to improve the security of everybody. and ensure fair play

[vocal urchin]

Hmmm oki

[timber vale]

read what i said i didnt day that 🤓

[vocal urchin]

Oki

[timber vale]

if you are in a machine like joined from the website you should have access to it, otherwise you shouldn't and that machine shoudn't be able to reach you so nobody can hack you

[timber vale]

except from the shared machine and you should be able to see that if someone tries to use it to hack you

also thm needs to improve its bug bounty experience i reported a bug before that gives you access to the ip of any game that you were in and quit and now you are not part of. and you would get the ip and all game info as soon as the ip gets released and as soon as a reset happens without needing to scan anything and they fixed it in their newest version of koth but it took them 2-3 weeks to even reply about the bug and they didnt give me anything not even a 1month premium also @broken pilot have had a very bad experience with them when he tried to report a bug before and he says they threatened him.

[vocal urchin]

👀

Threatened

[timber vale]

even the way they fixed my bug was not efficient. its like they didnt even fully read what i sent. they used websockets to emit updates when needed like at the game start or when a reset happened reducing bandwith and saving money on the cloud bill. i recommended they check if the current websocket user is in the userlist before emiting any new data to him (because the periodic updates emitted included users so they dont even need to add any additional requests ) and if the user is not on the list they should simply close the websocket connection. the bug was that the websocket connection is kept alive and receives updates even if you quit the game. when attempting to reconnect they should check if you are in the game again. (which they did) so that would have solved the bug efficiently. but instead of taking that recommendation now they are back to using the old system that they have used before now to get the ip and to keep up with resets your browser sends periodic request to the api backend to get the ip even if no reset happened which increases the cloud bill and if the user also doesnt have unlimitted internet (thankfully i do) they would spend more.

[timber vale]

this touched down on another problem which is fake accounts. people could use those to exploit that design flaw

[steep agate]

I think in hackthebox battlegrounds you could also be easily owned

but, the end of battlegrounds htb is near, on the 25th they will officially delete battlegrounds

[vocal urchin]

womp

[steep agate]

this works

[solar pecan]

Does koth require linux os or there is an attackbox

[mystic oxide]

Hi, if necessary you can install Linux on a virtual machine

[red olive]

You can use both your box or AttackBox

[solar pecan]

ok so i joined a koth game with some dude but when it started i couldnt find attack box or even the ip

the status was running and the time was going

[north acorn]

Sometimes I have to refresh the page to get the IP to show up

[red olive]

Two machines from the pool are broken

[solar pecan]

ok thx

[mystic oxide]

hi, yes the lion and spacejam machine are broken down

[timber vale]

@near lily new bug you guys have a race condition in the join implementation.

https://tryhackme.com/games/koth/125486

[near lily]

I'll forward on.

[timber vale]

it can be used to join a lot of times before the record gets written to the database in this instance i only joined 5 times im sure it can be used to join more times than 5 ...

[steep agate]

🤣 wtf

[short tusk]

Looks like Ch1 wins 1st, 2nd and 3rd place prizes! /s

Reporting it to our team thank you @timber vale

[sour vector]

Gave +1 Rep to @timber vale (current: #1171 - 4)

[lunar jewel]

i should use vpn network or just virtual machine givign by thm ?

[timber vale]

you can use the vpn or the attackbox but if you use the vpn. just make sure to have secure webserver with passwords that changes automatically. and if you have the ssh port or other services running on your vm just make sure to use a strong password for the ssh.

[lunar jewel]

i dont use vm i use as OS

[timber vale]

what i explained there is how you could get hacked from the thm network if you dont take precaution

[lunar jewel]

main OS

@red olive kindly make documents to follow precautions

[timber vale]

samething applies

[lunar jewel]

all services are disable btw

in my machine

just make sure to have secure webserver with passwords that changes automatically.
why which web srerver thm vpn have also a webserver ?

[timber vale]

when you solve machines in thm. alot of times you're gonna need a webserver. even in koth. and if that webserver isnt secured and someone knows your ip (like you played a koth game with him, or you sent a screenshot with your ip by accident) he could browse through the files served by that http server and if you have an ssh service with a weak password that could be a target too ...

[timber vale]

but that message was talking about a different thing. it was talking about how a private game is not really private and anyone can get the ip

[lunar jewel]

like example

i am testing it by my self

try to scan network by nmap but doesnt get response

[timber vale]

go to dms

[timber vale]

to summarize. players cant reach each other directly because of the firewall however, every box in the network can reach your machine and your machine can reach every box in the network. this means that anyone can use a machine in the network like a koth private game or a room machine to try and hack you if he knows your ip. and the other usage for this. is if you scan the 10.10.xxx.xxx range you can fingerprint koth machines. and deanonymize private games or even get access to public games that you arent a member of

[light flame]

Although you can find the IP, isn't the main point of a private game that you control who joins the game, and consequently can get points?

[timber vale]

you're missing the point finding the ip is the main target. you dont necessarly need to be ranked in that game if you wanna be a silent observer this can be used for example if someone compiles an lkm or smth. you can steal it ....

[light flame]

So you mean like interfering in the game?

Since seeing private games is possible since forever as far as I know, just not the IP

[timber vale]

this can be used to find the ip of the game without being in that game. whatever can be done afterwards is up to the person

[timber vale]

you can see the users the king and the machine type but you cant see the ip normally. and those things that you can see are whats gonna help you to fingerprint the exact koth machine you want the ip for. you can filter for all machines with port 9999 that returns an http response but not an http page. and you can send a request to that port to find out whos king and match it against the game you want. and for example you can fingerprint the exact machine type like somemachines have fixed open ports with the same services and web pages ... there are many ways you can use to fingerprint the exact machine

[light flame]

True

The only good fix would be to put the KOTH machine and players on the same network though (or some IP-based rules, dunno about that).

So I don't think tryhackme will fix it, it means loads of work for a feature that isn't too popular anyway

[timber vale]

only the players should have access to machines that they are part of like even if you find the ip of the other machine you shouldnt be able to ping it or reach it. also a machine should only be able to reach players in that game

[timber vale]

true

[sonic belfry]

What did you do to join the game 5 times?

[timber vale]

used a script to join with 5 threads simultaneously

i could have used more threads ....

[sonic belfry]

Also, how did you submit all the flags in 9 seconds?

[timber vale]

using pyautogui. i write all the flags one by one automatically in the box and press the submit button and move the cursor on the box so the other flag gets written ....

[sonic belfry]

Doesn't sound like fun to me. 😄

Adding yourself 5 times to a game also provides no gains for you though, I would recommend not doing it again.

[timber vale]

yh i was just testing smth. i saw that when i press the join button and it redirect me to the page i dont see my name there its like i never joined. so i figured that i get the response before the record gets in the database. thats why i tried that race condition and it worked ....

[short tusk]

That sounds like “autopwn”?

Saving the flags just to use a script to submit, iirc you recently were reported for cheating? 😄

[timber vale]

do you know what autopwn is?

automatically submitting the flags is not autopwn

[lunar jewel]

@fossil pecan hi i am on koth with u

[lunar jewel]

@fossil pecan did u say welldone to me XD

[lunar jewel]

how

thanks @fossil pecan 🙃

[sour vector]

Gave +1 Rep to @fossil pecan (current: #137 - 64)

[lunar jewel]

waht @fossil pecan

[fossil pecan]

nyancat 😛

[lunar jewel]

ah again u are playing with me

[fossil pecan]

😦

[lunar jewel]

well u are really a legend

how u bypass it

[fossil pecan]

this one can be bypassed with regular system commands

[lunar jewel]

and u use malware i know

to restrict me so that i couldnt modify king.txt lol

[fossil pecan]

this isnt lkm king, just regular system command defense and bypass 😉

[lunar jewel]

okay

[steep agate]

@fossil pecan he is a true fan of mr robot just like me

[lunar jewel]

@fossil pecan ah i see late README.txt

i tried to unmount then modify to file but shows read only permision

i forgot to change file permision after remount

[fossil pecan]

dm me if you want, we could retry food on a practice private match if you want too

[lunar jewel]

okay 🙃

[fossil helm]

Also you can see matches in the koth. Private matches and incoming matches 😁 there are only a few people who used this. For example they will try to surprise the players who are waiting in the room or they don't want their name to be in the room cuz some of the players may dodge them.
I do this often before. 5 seconds before the game starts i just hop in. There is no need to be in the room.

Thm can fix that by just making the room ID random and not in order.

Now you know just try it for those who are new in koth 😁

[viscid sundial]

you can't join private maches, but of course you can join public matches

[fossil helm]

But you can watch them I saw a lot of people doing matches in private practicing so I know they will use their practice in the public anytime soon

[viscid sundial]

ok, you can look a private game, hurrah, great, good for you, but it isn't really that important if you see it or not

[fossil helm]

You don't get the point lol what's the advantage of it

Lol

Just read what I said at firdt

First*

[fossil helm]

Both public and private

[viscid sundial]

public doesn't matter, there literally is a way to look at public games, they aren't hidden

[viscid sundial]

if you do it randomly, what if you use the same number twice?

and it will be sooo confusing

[fossil helm]

You didn't get

It

Can you search what idor is

I'm at work now but I will make a example just for u using phone

I can see Mr f11snipe and trap waiting queue

But I can join in the match 5 seconds when it's start

[viscid sundial]

ok, makes sense

that's fine

[fossil helm]

Not fine 🤣

You will see the advantage of it once you spam koth and win always

[viscid sundial]

you can join whenever you want, just before the koth game starts

[viscid sundial]

you spam koth?

[fossil helm]

4 months ago lol

[viscid sundial]

how many times have you won using this method, curious

[viscid sundial]

that was 4 months ago, how about now

[fossil helm]

Often

[viscid sundial]

often means???

[fossil helm]

I just wait for someone to make match

[viscid sundial]

ok, when they make a match, you join?

that's fine

what's wrong with that

you pounce

nothing wrong

[fossil helm]

Will comeback playing koth once they will revamped koth like no same creds

Dynamic machines

Or just make all machines like fireworks

[fossil helm]

You will never know what's the advantage of that to a player like ch1 🤣

[viscid sundial]

CH1 is strong, can root the machine in 2 minutes

he pounces, advantage for him, good, what's wrong with pouncing

[fossil helm]

He has still a bug that he didn't report 🤣

[fossil helm]

Not even 2 mins lol

[viscid sundial]

mm, 2 mins

1.5 maybe

[fossil helm]

If players like matheuz f11snipe and trap will have a hard time dealing with ch1 then none of us here will win against him that's the truth except for 2 windows machines and I forgot the other I think fireworks also.

[broken pilot]

Yea theres a few bugs, that havent been fixed yet... I reported how to "break into" those private games awhile back by just being able to observe the private match.... along with a few others that have been patched already... And if you were to chain a few of them together you could completely own KOTH games, public or private.... But yes ch1 is right if you really wanted to you could target certain players once you were able to get their ip.... Could be considered illegal tho... so probably not worth it... but i have had some players target my python http server to try to scrape any files i had in that folder, while we were playing. But what he's saying, is it can also be done from a normal machine, it would be harder to tell who did it because you're not currently playing with the person...

i guess you could always just get a new vpn config file and switch up your ip every now and then...

[near lily]

it would be harder to tell who did it because you're not currently playing with the person...

No, it would be really easy, your tun0 is assigned to you, and THM will know who boots what attackboxes.

[fossil helm]

Spacejam can be pawned if you're fast like 5 seconds then you can command this sudo sysctl -w kernel.modules_disabled=1 or
echo 1 > /proc/sys/kernel/modules_disabled to disable ch1 lkm

And guess what still he will win

Because he is

https://tenor.com/view/katakuri-whole-cake-island-future-gif-22188936

[fossil helm]

Do you know the ability of this guy? @viscid sundial 😁

[viscid sundial]

uhuh, ok

[fossil helm]

Yeah could take at least an effort every time you want to change new ovpn cuz you'll change all your koth stuff into that ip.

https://tenor.com/view/charlotte-katakuri-katakuri-one-piece-gif-11987275

My G @timber vale rn:

The katakuri of koth 😆

[timber vale]

who is this guy?

i dont watch a lot of anime

[timber vale]

no need for an attackbox, you could join a normal room and once you solve that room and know the machine creds you can use that to do whatever you want afterwards and just extend the time by an hour before it runs out. or you can use a private koth room to do that and thats better ig because they cant know which of the people in the private room targetted the other person cuz they are using the shared machine

[fossil helm]

@timber vale imagine you woke up and you had your [Bounty Hunter] title like 0day? Or I'm wrong lol

[short tusk]

You have to report 3 security vulnerabilities that get accepted to earn the title

https://help.tryhackme.com/en/articles/6495946-the-bug-bounty-program

[final onyx]

@lunar jewel has been warned.

[fossil helm]

https://tenor.com/view/blackish-crying-cry-tears-sad-gif-5613528

@timber vale

[light flame]

Public KOTH with a lot of players is the best option, then it becomes hard to track after the machine went offline who used the machine as 'proxy'. Normal THM rooms should be linked to your account in the logs, and if you are the only player in a private match it's not difficult to track you down either😎

Although if thm keeps logs of what's send over the network, you could still be caught

[timber vale]

if we do not count the network design flaw that allows you to de-anonymise private games that you arent part of and get their ip or even the ip of public games that did not join and it can be used to hack other players. if we do not count that then i have 2/3 cause i reported the websockets bug that allowed you to get the ip instantly even if you are not in the game and you didnt need to even scan the network for the ip (which takes time) it just sends it to you whenever the game starts or when a reset happens this one got fixed after i reported it with the support guy named blackout. the other one is the join race condition i sent yesterday so that makes 2/3 if we do not count the network flaw but if we do its 3/3

[short tusk]

It’s not my decision, you will he contacted by support for a reward if a bug you report is applicable

[timber vale]

hackers only has 9 flags i submitted 13

[timber vale]

you guys should give this this title 🙏

wait i deleted the message i gotta send it again

@near lily new bug, race condition in flags
https://tryhackme.com/games/koth/125544

[fossil helm]

https://tenor.com/view/crying-asian-guy-with-cat-gif-1187717551369309065

i only have 7 flags on that machine

@timber vale

NO WAYYYYYYYYYYYYYY!!!!!!!!!!!!!!!!!!!!!!

[timber vale]

i dont see it, your just messing with me 😂

[peak marsh]

You need to find 3 different bugs to get that.

[timber vale]

i found 3 bugs

[fossil helm]

https://tenor.com/view/nobi-pintu-tokocrypto-nanovest-crypto-gif-26605558

[fossil helm]

15 flags

[timber vale]

that means you have faster internet

[fossil helm]

nah i just inspect element it haha

damn that 13 flags only hackers machine?

[timber vale]

so you didnt try the bug 😂
https://tryhackme.com/games/koth/125544

[light flame]

How do the points work then tho? Like the amount of points depend on which flag is submitted extra?

[timber vale]

every flag is worth a predefined amount of points points. the harder to find the more points you get, i think the root flag is worth the most

[light flame]

Can you submit a flag x times, and then another flag x times as well? that would be wild😂

[timber vale]

i tried to submit each flags simultaneously 5 times. but i didnt get 5*9 which means i only won the race a few times. i'll probably get another result depending on my internet

[viscid sundial]

ahhh, race conditions

[broken pilot]

Me too, well 4 😢 ... And the race condition on flags is back 😢... I reported that like 2 yrs ago... Thought that already got patched........

I stopped hunting for bugs here since i had that debate over the free bug hunter role... I feel like a valid bug is still a bug.... I shouldnt need to provide a p1 to get a free role... Just my opinion though

[broken pilot]

Yea I guess, but what about alts and an extra VPN connection.... If someone really wanted to target you, it could happen... Sure that's a lot for a KOTH game but it's still a possibility...

[broken pilot]

https://tryhackme.com/games/koth/66264 10 flags... Machine only has 7.... Way back from 2023 😂

[timber vale]

nice, it really just depends on your internet connection im sure you can get more with a better internet connection and optimized code

[broken pilot]

Ok I'll stop now... I'll go back into hibernation... 🫡

[broken pilot]

Yea I had a few with over 15 flags... I could've done more but went with a small count not to over do it... I still have the poc's I sent them for the other ones too....

Like I said tho I just stopped hunting, I didn't feel like it was worth the reward, of nothing.... Not even a thank you.... And I still have all of the communication that took place 😉...

[vocal urchin]

[cobalt mountain]

https://tryhackme.com/games/koth/join/9d8a7627a665dd5b5ab6b5a9

[lament meteor]

Hi Players

[lament meteor]

Hi i acces the mashine in KOTH and then i change user name of mashine and in king.txt i also change but in KOTH leaderboard my name doent show and so tell me beacuse i am new in KOTH

[mystic oxide]

on which machine? Linux or Windows?

you don't need to change the username, you just need to put your THM nickname in the king.txt file

[lament meteor]

yee bro in offline maschine we play together whe i did this but

[lament meteor]

and bro nicname means username

[mystic oxide]

For Offline, you must place your king.txt in: C:\Users\Administrator\king-server\

[lament meteor]

thankyou broo

we are playing together 😍

[lament meteor]

Hi @mystic oxide Please Broo can you teach me to How to create animated profile Picture and How To upload on TryHackme Please

[mystic oxide]

Look on Google my Friend

[timber vale]

download a gif then change the extension to png and upload it

[nova tide]

@timber vale can I DM?

[timber vale]

yes

[lament meteor]

Thankyou Guys @timber vale @mystic oxide

[lament meteor]

Hi guys, can someone help me out? Every time I get access to a machine and put my username in king-server/king.txt, my name still doesn't show up as King. Can anyone explain why this is happening? I'm new to KoTH

[mystic oxide]

Because I think F11SNIPE to use the ICACLS DENY EVERYONE command , which even prevents the Koth service from being able to read the King.TXT file. This is why he has that 2 min from King Time

[lament meteor]

can i DM?

[mystic oxide]

yes

[lament meteor]

is it right to do this in KOTH?

[mystic oxide]

There is always a way to remove these rights, so I think that yes, it's fine.

[lament meteor]

can we break this

is it possible to break or stop this command or use other tecnique and @mystic oxide bro my english is very weak so please dont mind when i am say sonething wrong

[mystic oxide]

I don't speak English either, I'm French

[west seal]

@timber vale wut u do here??? i can't write nothing?!?!? 😲

$ find / -type d -writeable 2>/dev/null
$ 

isn't breaking machine?

$ cd /tmp
sh: 2: cd: can't cd to /tmp
$ ls -al /tmp
total 8
drwxrwxrwt  2 root root 4096 Jun 28 02:08 .
drwxr-xr-x 23 root root 4096 Feb 15  2021 ..
$ ls -al /var/tmp
total 8
drwxrwxrwt  2 root root 4096 Jun 28 02:05 .
drwxr-xr-x 13 root root 4096 Feb 15  2021 ..
$ cd /var/tmp
sh: 5: cd: can't cd to /var/tmp
$ cd /dev/shm
sh: 6: cd: can't cd to /dev/shm
``` ... can i bypass this???

[timber vale]

i didnt do anything to those directories. i have no interest in them

i can cd into them normally

[vocal urchin]

Lol dont u shadow the thing

[west seal]

@mystic oxide GG i cant find the way in /root lul

[storm frigate]

hi, i think i won a koth game but nothing is happening

can someone help me ?

[mystic oxide]

an official or private match?

[storm frigate]

public match

it was my first one, luckily im the only one who found a flag, the others couldnt find flags or PE

score is 25-0-0-0 (I also couldnt PE)

[mystic oxide]

If you only have flags, it doesn't count as a victory, because you have to be root with the king for at least 1 minute.

[storm frigate]

noted, thanks !\

got into another public game ... llegends and guardians ... hahaha im doomed

[light relic]

level does not determine a skill

[storm frigate]

dw i was cooked, some guy called ch01 joined and got root in under 1 minute

he been doing that all day

[timber vale]

Ch1 not ch01.

[storm frigate]

no way the boss is here

[storm frigate]

any tips ? love the pfp btw

[timber vale]

for a begginner i would recommend this: https://github.com/MatheuZSecurity/Koth-TryHackMe-Tricks

but if you wanna get into malware and rootkit dev i sent the recourses i used here:
#koth message

also you can dm me if you have anything specific to ask abt

[storm frigate]

thank you so much, today was my first day trying koth hehe

I find it super exciting and it actually pushes me

[lunar wave]

https://tryhackme.com/games/koth/join/b0f2d1d4421fc8da4eb51832

any1 join with me

[fresh coral]

Get on my level.

[deft echo]

1st koth was mad... i dunno how @mystic oxide got root in like 3 seconds

lul

[deft echo]

@fossil pecan how... just how

im way outta my depth with these

did u just nyan me?

bros going hard

[deft echo]

@fossil pecan very good

[deft echo]

nice whoever changed that password

well im stuck again pahaha

the password john cracked is not working

[haughty turtle]

Where can we download vpn for koth?

[jovial field]

There is no separate VPN bundle for koth. Just use the one you use for normal machines

[haughty turtle]

Thank you

[lunar jewel]

hello anyone wanna play koth just for practice

[lunar jewel]

this is prvate
https://tryhackme.com/games/koth/join/3a2aa2fabef74261f25d4373

[winter talon]

do you accept newbies?

[lunar jewel]

yep

[lunar jewel]

no restrictions

just for practice

[lunar jewel]

but to join on koth , u'll need to do some manual configuration

go to ur manage account setting and click on intermediete level

[winter talon]

done

[lunar jewel]

@winter talon sending u link

[winter talon]

wanna do a call ? never played koth

[lunar jewel]

https://tryhackme.com/games/koth/join/27728bcccf403aa7fb99e017

[lunar jewel]

okay

[north hollow]

do koth machines have access to the internet?

[lunar jewel]

and also building for other machine but obviously i need to pawned them manually first

[peak marsh]

AutoPWN scripts are not allowed.

[lunar jewel]

ahhh

okay

well for education purposes

[lunar jewel]

https://tenor.com/view/ahoklollmao-noooo-nooo-noo-no-gif-17139315586294057944

[lunar jewel]

it says go wild on private games ... so really @peak marsh

https://tenor.com/view/jevil-deltarune-undertale-crazy-i-can-do-anything-gif-16394661

on private koth 💀

[lunar jewel]

wait

here look @peak marsh

[peak marsh]

Oh, maybe, I'm not sure. I just know it's generally not allowed.

[steep agate]

autopwns are not allowed

[lunar jewel]

https://tenor.com/view/its-great-for-educational-purposes-education-great-its-great-educational-purposes-gif-22409948

[lunar jewel]

anyone wanna play koth

juniors welcome

i'll host private koth

and also seniors welcome , welcome to anybody

[solar pecan]

I just set up linux vm and connected with the vpn
Wanted to test if koth will work so i joined a game
So i cant leave and have to wait the game to end?

[timber vale]

yeah once the game starts you cant leave

[solar pecan]

Ok

[deft echo]

10 mins until next box.. lets go join up lets have fun

im new so have at it

im here to learn

[deft echo]

hmmmmm....

[dusty sand]

I'm new too lol

That was my first koth...gg @alpine quarry

[deft echo]

someone is working some magic in offline

im locked out.. i have no clue on how to fix.. pls nudge

[dusty sand]

Locked out?

[deft echo]

not locked out as such.. just kinda cant go anywhere

https://tenor.com/view/batman-thinking-gif-18107621495886085895

[dusty sand]

seems massco knows what he's doing lol

Ima go back to training and get my weigh up

[deft echo]

yh that guy is a wizard

[dusty sand]

I started 3 weeks ago lol

[deft echo]

we all start at some point.. im new too

but it is fun

[dusty sand]

Yea it is...I was also not fully prepared as I just had to reinstall my borked kali vm, so I'm still kinda getting some things setup

[deft echo]

ive borked so many kali vm's i finally got my build down tho..

[alpine quarry]

anyone can help me on KOTH. LOL

[deft echo]

the king is here...

how did you manage this i wanna know

[alpine quarry]

play much game u will learn new tricks

[deft echo]

challenge accepted friend

[alpine quarry]

most boxes on KOTH has more than 4 ways to go. so if u solve 8 box u will learn more than 30 ways to exploit machine and priv escalation

[deft echo]

it is a really fun way to learn

R0cgZnJpZW5kISBHb29kIEhhY2tpbmcgWEQgSG9wZSB5b3UgYXJlIGdvb2QgQG1hc3Njbzk5IExFR0VORA==

[alpine quarry]

thanks bro

[sour vector]

Gave +1 Rep to @deft echo (current: #2986 - 1)

[alpine quarry]

i will leave the game go and enjoy

[deft echo]

have a good day/night. it was nice to meet you

[deft echo]

guys on fortune right now.. whos changed the password to ssh?

nvrmind im in idiot lul

[mystic oxide]

Hi, it sometimes depends on fortune, sometimes the SSH password you remember is good and sometimes not, but there are several ways to enter the box

[deft echo]

it was my mistake i was silly and didnt use the correct user

[deft echo]

gg @fossil pecan

[brisk stump]

hi anyone up for a koth? im a newbie learner myself. all are welcome.

[split sable]

You’re asking the right questions lol I see what you’re doing and tbh it’s most realistic. Real hacks are scripted/automated so they happen fast & are harder to detect/remediate.

[summer burrow]

Scripts that automatically hack(autopwns) and/or harden the machine are forbidden. So why is it within 10 seconds on Hard machine which I KNOW takes a second to pwn.....all of a sudden a player has king AND has filtered all ports? you can't do it manually that freaking fast!

@fossil pecan

someone tell me Im wrong?

maybe Im wrong......Im learning Ill figure it out I guess.......

[jovial field]

depends. yes an experienced player will be much faster than you especially because they have notes on the machine and automated some steps like install implants and run their king script which you are allowed to do but still this shouldn't mean the machine is pwned in 10s ofc depending on the machines difficulty

[mild sorrel]

@summer burrow let's play private I just did 2 of them and did horrible

[jovial field]

So yeah you basically don't know but in my opinion you shouldn't really care that much. Just try to learn by attempting to win. The win isn't that important

[summer burrow]

appreciate it......

[fossil pecan]

I try hard to be first in to keep games open & boxes unpatched (not closing/filtering ports) so others can still play & learn ... lots of players will patch and break stuff very quickly, and isn't very fun or easy to learn for other players

I'm happy to play private practice anytime also, feel free to DM too if you want 🙂

[deft echo]

is koth box lion live for players in the game? cant seem to connect

[mild sorrel]

@fossil pecan are you on offline too?

[fossil pecan]

lion & spacejam are currently broken, and won't actually boot up 😦

[fossil pecan]

I am, but idk enough about windows to actually fight for king with someone else 🤣

[deft echo]

47 mins of my life wasted lmao

[fossil pecan]

next starts in 4min 😛

https://tryhackme.com/games/koth/join/91a6d5808abdffc9de7a9eca

[deft echo]

ima join later on tonight

[mild sorrel]

I managed to use ms17-010 vuln and log in but all flags were gone lol

[fossil pecan]

gone?? nobody should be deleting flags lol 😂

[mild sorrel]

yeah this guy suljov is mean

[fossil pecan]

hmm don't remember exactly where all the flags are, but they're spread around all the different users and their home/user folders ... you had admin/system access? I think most are still named flag.txt

[fossil pecan]

Can play private matches if you want to try again fresh haha

[storm frigate]

bruh not fun to start and someone is already king at 2 minutes in

[storm frigate]

gg @timber vale literally nothing i can do

[mild sorrel]

https://tenor.com/view/sweats-gif-25346666

@timber vale

[timber vale]

you can still play the machine like normal. i dont patch anything

[storm frigate]

Oh I thought u did, the user I was on didn't have any permissions 😭😭😭

[timber vale]

you start with a normal user then you have to privesc

[storm frigate]

Yeah but as a normal user I couldn't cd into anything or ls anything

[timber vale]

do you have the output?

[storm frigate]

Yeah I had it, right now taking a break, but I couldn't even ls home

I was rev shelled through the upload on port 82

[timber vale]

maybe someone messed up permissions for binaries. which is against the rules. but thats not me

[timber vale]

did you have a restricted shell?

[storm frigate]

Normal shell from NC -lvnp

Sth about suid being set to 0,-1,-1

I'm still new to this so it also might be a fk up on my end

I'll check it again after dinner

[fossil pecan]

next game 20min 😄
https://tryhackme.com/games/koth/join/f3f0d0dc1d935a0cc153457e

[mild sorrel]

why are you deleting flags @timber vale

[timber vale]

i didnt delete any flags

i dont need to play dirty to win

[timber vale]

but if i remember correctly in fortune flags arent in user folders except root maybe idk. you need to read that flagtips file it says smth like flags are hidden in files with game names. its been a while since i actually searched for flags. i have them all saved

[mild sorrel]

ok

[zenith tiger]

Any beginners want to join a private match?

[deft echo]

I love koth but everytime @timber vale is here I get anxious lmao.. guy pwns boxes in 27 seconds

[timber vale]

don't be i never patch any footholds or privescs i dont patch anything as a matter of fact. so you would still be able to play the machine like normal and take your time

[deft echo]

ur good mate i just see ur name and think "guys gonna get king real quick"

[deft echo]

anyone know why john isnt giving me the password for the hash? it loads the hash but dosnt give me anything after that

[north acorn]

if you cracked the hash before, use "john <file> --show"

[deft echo]

omg thank you

[deft echo]

so weird i got the pass to ssh but i think i borked the key somehow

[steep agate]

not 27 sec

in fact it does this in a matter of 2-3 seconds

[deft echo]

jesus

[steep agate]

for it to load a kernel module it needs root, that is, 2-3 seconds after the machine "boots", it already has root and automatically loads its rootkit, so there is no time to even copy the IP correctly 😄

[timber vale]

this must be my rootkit automatically loaded after reboot. cuz that is not possible

[steep agate]

anyway, a few seconds difference until the machine starts and until it loads its rootkit, I guess in 2/5 seconds

[steep agate]

Actually no, you deleted the kernel logs, I recovered them, and I saw the logs of when it was loaded

You got caught

next time use shred or something better because there are still log remnants in the filesystem

[timber vale]

lol your scared for your spot and tryna make stuff up.
this must be my lkm loaded after reboot like i said you can make it autoload.
and also yes i delete kernel logs like most people who use kernel rootkits.
and you didnt recover shit this was a left over of systemd in the /tmp dir

[steep agate]

You yourself know that you do this in less than 10 seconds, I don't know why you're saying that it has persistence after reboot, in fact, something that is probably not even possible, since practically when you reboot a machine, a new IP is generated, and the original state of the box is loaded too.

[timber vale]

no

[steep agate]

I used debugfs to recover /var/log/kern.log and then I dumped its inode to tmp and saw the logs

[timber vale]

f11 is approaching your spot and im approaching his. and you just dont want to put in the work thats why you are scared.

[steep agate]

Even @fossil pecan knows you do this in seconds, come on, don't hide ch1, this is ugly 🙂

[timber vale]

@fossil pecan wins against me a lot of times so that is not possible.

unless he is faster

[steep agate]

The machine was not rebooted, as soon as you got root in the first few seconds, I got into the machine, got root, and the first thing I did was use debugfs to retrieve the inodes from kern.log, and then I saw how fast you really are with your "oneliners" 😄

I think you should be more cautious next time, just in case someone decides to punish you

[timber vale]

thats not true. if you didn't edit the image or the terminal log that means the machine was rebooted cuz 3 sec is impossible

[steep agate]

😂 your forensics skills are bad my friend

next time then, I invite everyone in this chat to do the same thing, if ch1 doesn't use shred or something like that in the kernel logs

just do it

cd /var/log/
ls -d kern.log (get the inode)
dump <inode_here> /tmp/x
quit
cat /tmp/x

[timber vale]

its obvious that if you already had proof of smth like this you would have sent it a long time ago cuz you are scared for your spot. but since you dont have any you are fabricating evidence 😂

https://tenor.com/view/ishowspeed-speed-trying-to-not-laugh-speed-holding-laugh-speed-laughing-speed-laugh-gif-242565803459391828

[steep agate]

I already sent these logs and showed them to some of my friends, everyone was making fun of you 🤣

Btw, I'm not at all worried about my place in the rankings. In fact, to be honest, I'm actually happy after 3 years to see someone passing me, like f11snipe, but time flies, I can't dedicate my time to koth (which I clearly haven't played for over a year, I think, and I'm busy with really relevant things, like work).

the day you did this, I forwarded the logs

[timber vale]

you prob were the one to reboot the machine 😂

[steep agate]

You and I both know the machine was not rebooted, as soon as you logged in as root and got king, I logged in and got the logs

Anyway, none of this is relevant if the thm staff doesn't do anything about it, so don't feel threatened :))

[timber vale]

you know thats not true i know you are unhappy about that koth spot cuz i saw it in your linked in portofolio and you just dont want to loose it 😂 and you dont want to put in some effort to keep it.

[steep agate]

? You know that Koth is the least important in my portfolio, right? Even f11snipe is very fast, and he knows that you do it in fewer seconds than him

I don't need to lie, I'm just telling the truth, and it's funny you trying to explain it with things that have nothing to do with anything

[timber vale]

f11snipe is faster than me in some machienes and even he can do it in 3s like you said

[timber vale]

trust me bro argument 😂

[steep agate]

Anyway, if others want to do the same step, here it is, if you can't recover the file's inode, it's because ch1 has already made it unrecoverable

[steep agate]

It is only fast on some machines

even because he told me that, that he can only be faster than you on some machines

[timber vale]

thats what i said. f11snipe is faster than me and even he cant do that kind of time. also i have a database of all games i can pull out the games where f11 is faster

[steep agate]

It's only faster on some specific machines, for example, you have difficulties with the H1 hard drive, right? Furthermore, that is true evidence, the machine had just booted, it wasn't even 58/59 minutes old and no reset had been done until then at that moment when I had recovered the logs, so no reboot was done either. You deleted the kernel logs, but forgot that they can be recovered if you have the inode, but I want to congratulate you for doing it so quickly, the machine starts and practically 2-7 seconds after it starts, you already have your rootkit loaded, giving no chance for common players to copy the machine's IP, any way, good luck, koth is really fun 🙂

[timber vale]

like i said that doesnt prove anything. you prob rebooted the machine and my rootkit had persistance no need for reset so the machine gets rebooted

i've seen people do all kind of dirty tricks with me like killing the koth service which i block rn from my rootkit. and i block some ways people can reboot the machine or shut it down the but there is always ways to reboot a machine by escaping the logic and using smth like sysrqs .... or direct syscalls via binaries etc

[steep agate]

Btw, a really cool trick for all koth players, if you want to see a specific log that was deleted and if you have time to recover the filesystem inode, you can follow this step, and you will see that it will work, see that in the image the kern.log was deleted, but I recovered the log by getting its inode

in ls -d

It's really cool to use debugfs for forensics 🙂 and it's funny how I see ch1 trying to defend himself with things that have nothing to do with it, anyway, that was fun.

[timber vale]

whats funny is that you are trying to to claim this without actual evidence so you preserve your spot without actually playing or putting in work 😂 .

your argument is just trust me bro

https://tenor.com/view/try-not-to-laugh-gif-7516440236715803256

[steep agate]

Well, believe it whoever you want, but the evidence that you did this in seconds is there. The machine wasn't rebooted. You know you do this yourself, ch1. You don't need to lie to me, especially not in chat. It's always good to be honest with others, and most importantly, be honest with yourself. Besides, your rootkit leaves a lot of stack traces in the logs, which is bad. I don't play Koth because I'm really sick of it. I was even talking about it with f11 a few days ago

I mean, playing more than 3,000 games eventually gets boring, right? And you have other responsibilities like work, research, etc. I was your age when I was addicted to Koth too. Anyway, the evidence is there, and you clearly have a very good "oneliner" right? 😉

[timber vale]

like i said you are the one who rebooted it 😂

[timber vale]

idk about your responsibilities and idc tbh but ik i dont have any i have all summer here and your spot will be taken one way or the other so just stop wining and put in some effort if you want to preserve it

making up lies wont get you that far

[steep agate]

yes that's for sure 😆

[lunar bone]

koth

king of the hill

wait so is Ch1 the number 1 in all countries right now?

[lunar bone]

and your 2nd?

[timber vale]

no im number 3 in all country ranking. but im getting there to number 1. i average abt 300+ wins a month

[lunar bone]

ah just so you know

one day ill be higher then you

[timber vale]

he is making up lies so i dont take his spot on the leaderboard. because he doesnt want to actually play or put in effort. and he doesnt even have a working rootkit for it his rootkit was the one i leaked previously and it had many bypasses.

[lunar bone]

WAIT

300+

?????

[timber vale]

yeah lol

[lunar bone]

HOW?

[lunar bone]

rootkit for what

[timber vale]

i just play a lot cuz im 16 and i dont have anything todo also i use a kernel rootkit to protect the king.txt file and protect koth service and machine ... so i rarely loose king

[lunar bone]

dude im 17 and your 10x smarter then me

i envy you

[lunar bone]

wait

people try and get your king.txt file?

but isnt that against the rules

[timber vale]

this has nothing to do with me being smart. its just experience with programming. i focus on maldev more than actual pentesting

[lunar bone]

to steal it

[timber vale]

no lol everyone is trying to put their name in the king.txt file thats how you get points the machine is shared by everyone on the game its just one instance

[steep agate]

Do you really think I'm going to donate my time to create LKM for Koth? Nah, it's too lazy. It's easier to create something real like Ringreaper than EDR bypass, and it's used in the real world, in red teaming. Besides, you don't know how to create a rootkit that doesn't depend on syscall table hooking, which is an old and outdated method. As I said, I haven't played Koth in a long time, and I only play when f11snipe is on stream for fun or when he wants to test something. I really don't care about the leaderboard, so much so that I was happy that f11snipe is almost catching up with me after years 🙂

[lunar bone]

ah so even i can get it from you?

[steep agate]

Well, next time, delete the logs properly, because it can be easily recovered if you have the inodes

[lunar bone]

so are you behind Ch1?

[timber vale]

lol, i have my own x86_64 hooking framework that i use along syscall table hooking if the function im trying to hook is not a syscall. it can also be used for syscalls. you can dedicate your time for whatever you want but the fact of the matter is you're loosing your spot if you dont put in some effort

[steep agate]

On the leaderboard? To be honest, I don't even know, I haven't seen it

[lunar bone]

so what are you trying to prove

[timber vale]

he has more wins than me atm. but he hasnt played for a very long time and im slowly taking his spot

[lunar bone]

you got this bro im sure you can

you'll be behind me though

one day

[steep agate]

I'm not missing anything, in fact, you're the one wasting time with Koth, I got benefits from it, and it was also one of the reasons I stopped playing Koth, because I have something really important to do like working with cyber

[timber vale]

yeah im sure its gonna be my turn next to loose my spot cuz i graduated highschool a week ago and im gonna start putting my time towards university.

[steep agate]

I'm not trying to prove anything, I just gave evidence of how fast ch1 is, and that's a good thing

[lunar bone]

oh good

[lunar bone]

cool cool

[timber vale]

how am i the one wasting time on koth and you have more wins than me 😂

[lunar bone]

how do i do koth

[steep agate]

Well, I haven't played for a long time, I was still in school when I played every day and I didn't have many responsibilities when my position was trainee/apprentice

[lunar bone]

🥲

[timber vale]

you just change your experience level from settings to be able to join games.

[lunar bone]

ah ok

[timber vale]

😂 thats what im doing rn but you are clearly not happy abt it. im still 16 i graduated high school a week ago and i have no responsibilities so i can basically do whatever i want

im not even trying to have a career in cyber security there are almost no jobs for that im my country. but this is smth i do for fun.

[lunar bone]

you should your really talented

[timber vale]

my parents wont let me 😂 they want me to be a doctor or an engineer or one of those jobs that pays here.

[lunar bone]

why are you letting your parents decide what career you have

you find this fun right?

then do something you enjoy

[lunar bone]

and your good at it

seems like wasted potential because you cant decide on what you want

to do

[timber vale]

im the biggest son for the family so i have to think about others when choosing a career path and realistically cyber security jobs here are almost non existent with little income im still in africa after all

[lunar bone]

not that you have to

[lunar bone]

move countries.. and why does having to be the eldest matter?

why think about others

in the end there not the ones taking it

its you

if you don't find the career your being made to do atleast a little bit enjoyable or feel like its your responsibility to do it for your family then its going to be extremely boring

you don't even have to do cyber security

[timber vale]

its just the way i was raised ig. also my parents spent a huge amount of money and effort on me and i need to be able to repay that i cant just decide to move out and never speak to them. and also its not just what they want i also want a career where i could get a good income and live comfortable with my own family and support my parents because they are getting old

[timber vale]

we dont have pension here. its just your savings.

[lunar bone]

of course you can speak to them abroad through phone and cyber security is such a great career to get a good income from you can live amazingly with it especially with your talent and i know parents spend alot of money and effort on you however that doesn't mean you got to do it no matter what career you choose you can repay them back

however again you don't have to do cyber security

just something you enjoy

before you take care of parents put yourself first because if you don't you wont even be able to take care of them if you can't take care of yourself

think about what you really want to do

[fossil helm]

https://tenor.com/view/huh-no-way-you-just-popped-a-shell-gif-9013190

https://tenor.com/view/windows-linux-linux-users-windows-users-windows11-gif-25304807

[fossil pecan]

No need to get defensive here. Be careful accusing others of lies, especially after everything you've said here that isn't the truth. There are other ways for you to avoid admitting these things without lying yourself 😉 ... I can confirm everything @steep agate says here is accurate, let's not play the "blame game" and just play the actual King of the Hill game!
We're all here to learn and have fun, let's keep a positive environment for all KoTH players 😄

[timber vale]

you too 😂 you cant keep up with me you have work & other stuff but i on the other hand can play all day. i need less than 240 games to get your spot so be prepared.

[swift laurel]

A year later the koth drama is still around!

[light flame]

😂

[deft echo]

so.. rootkits.. how to? or is it outta my skill lvl.. im new so just wondered

[timber vale]

read those previous messages:

#koth message

[deft echo]

cheers

[deft echo]

anyone wanna fuck about in a priv? its my bday an i wanna get nyancatted for the lulz

lets go @timber vale

[fossil pecan]

https://tenor.com/icWrhqAky2x.gif

[deft echo]

welcome @fossil pecan seasir

[fossil pecan]

https://tenor.com/bHsPo.gif

[deft echo]

is it live now i cant connect

[mild sorrel]

Pass the room invite

[deft echo]

https://tryhackme.com/games/koth/join/abe54ee7f7b7ad81762e8f03

[fossil pecan]

your vpn is ok? seems good and quick from here 🤷‍♂️

[deft echo]

is this box borked... i cannot connect at all

cant even ping

[fossil pecan]

still up & fine here, dbl check your vpn?

[deft echo]

my vpn is fine

[fossil pecan]

sanity check procs ps aux | grep vpn ... i need to restart sometimes ... oh hmm

can DM if you want

[deft echo]

yh pls

[mild sorrel]

f11snipe stop lol

you are scary

@fossil pecan was this you?

[fossil pecan]

was trying to get nyancat, but didn't start i guess haha

[mild sorrel]

Man my mind is fried. Finally got in after trying 1k commands lol

[short tusk]

@steep agate Mind if I DM?

[storm frigate]

.

yay my color changed,
I will try to get better to do better at koth, but I hope I dont see any of the 2 second rooters in my matches

[sand pendant]

hi

guys anyone know if the offline machine in tryhackme koth have a king.txt?

cz i cant find it

[north acorn]

should be at C:\Users\Administrator\king-server\king.txt

[sand pendant]

ok can some one make me a koth game with that machine : offline

so i can do it again plz

[lunar jewel]

https://tryhackme.com/games/koth/join/9fcf27be15963b1102c676a0

[young arch]

hello guys, new here

hope to play with you guys sometime on king of the hill! been watching videos and even though im not really skilled id love to learn

[lunar jewel]

-rw-rw-r-- 1 user user 0 Jul 20 18:35 adenumeration.ovpn
i always get 0byte file

@red olive

[red olive]

This isn't the question for #koth channel . Please go to #site-support

[deft echo]

spacejam is borked right?

[fossil pecan]

ya spacejam & lion still don't boot up as far as I know ...

[deft echo]

good fun that

[young arch]

https://tryhackme.com/games/koth/join/1b02c2d2e2931eff15e863a8

join up if you want to play with me

please i want to try

^^^

[young arch]

https://tryhackme.com/games/koth/join/0af8237ce785ea261282aaa9

[fossil pecan]

I don't know Windows much still haha ... I'm in another lobby here for next game, if you wanna join 🙂
https://tryhackme.com/games/koth/join/864ad1b17b3b516de80f220f

[young arch]

how did you do it

i cant get in or find any flag

i knew you were number 1 and instantly knew id lose

i was hoping you didnt join so i could atleast attempt to find a flag and win but when i saw you join i was like dammit

[fossil pecan]

how's everybody today? next game in 20min here 🙂
https://tryhackme.com/games/koth/join/8c73058b76e15c9b3fc088ee

[lunar wave]

Is the sys_write the most hooked sys call in koth ?

[steep agate]

read*

SendFile too

[lunar wave]

But you're goal is to prevent people from writing there names in the root.txt file

[steep agate]

believe me, hook on read and sendfile is one of the most OP

[light flame]

FYI, read is the best because while people can write their names to king.txt, reading king.txt will still give your name. So when the koth service reads the file it will think that the file contains your name.

[lunar wave]

Nice

[hushed bone]

Looking at the KOTH rn and i see that Devilman24 has won every box that i can see right now. Is he macro / botting it or just grinding all day to instantly get king?

[mild sorrel]

what's up fellas!

[timber vale]

the koth service binary tries sendfile first if it fails it uses normal sys_read so hooking sendfile will always show your name in king.
but if you want your name to be there when someone reads /root/king.txt you have to hook more syscalls

[mild sorrel]

man, I am just happy I can do a simple reverse shell

[covert fern]

hi

can someone help me

i wanted to get into koth but i dont wanna get completely crushed by other guys

can someone guide me through my first matches

[mild sorrel]

@covert fern sure man, send me a link and i can show you

we can join vc as needed, I am also learning myself

[covert fern]

should i create a private one?

[mild sorrel]

yeah

[covert fern]

sure

wanna join here or private?

just sent you the link

[mild sorrel]

send it here, should be ok