#koth

1 messages Β· Page 70 of 1

placid fable
#

Or pywhat from bee?πŸ€”

bright geyser
#

pywhat

placid fable
#

Sorry, I had Wiener's attack in mind from some other userπŸ˜… πŸ€¦β€β™‚οΈ

placid fable
formal sable
#

@bright geyser @placid fable excellent, thank you very much, I'll try that later.

sour vectorBOT
#

Gave +1 Rep to @bright geyser

stiff egret
#

++rep @placid fable

#

eh

#

whatever

#

thanks @placid fable

sour vectorBOT
#

Gave +1 Rep to @placid fable

stiff egret
#

dumb bot

molten mason
#

the only true way to defend spacejam

spacejam.png
gilded bough
#

anyone up for playing a priv battle?

steep agate
#

Creating

20220216_1119532.jpg
nimble lily
steep agate
steep agate
nimble lily
nimble lily
sour vectorBOT
#

Gave +1 Rep to @steep agate

steep agate
nova tide
#

seems good other than alias and script to keep killing shell(should suggest patching machine instead of auto kill sessions).

steep agate
#

Yes, I'm still going to put more defense techniques in this repository, lately it's been pretty busy here because of school

nova tide
#

would be better if you can remove those? Your choice though πŸ€·β€β™‚οΈ

molten mason
#

using dark magic, I think I've extracted the wordlists from hackers. interestingly, it uses a separate wordlist for each user

placid fable
molten mason
molten mason
quiet schooner
#

I'd honestly ask you not to share the wordlists themselves as that strikes me as a massively unfair advantage @molten mason

molten mason
quiet schooner
#

The process is pretty cool though, good job there

molten mason
sour vectorBOT
#

Gave +1 Rep to @quiet schooner

stiff egret
#

That is some really nice blog. @molten mason Loved the last quote.

quiet schooner
fair adder
fair adder
#

Hey is there any recording of a KOTH game to see how it's played or what is done?

steep agate
fair adder
sour vectorBOT
#

Gave +1 Rep to @steep agate

steep agate
fresh wyvern
#

Anyone know the reason behind this error when using ssh in the spacejam koth

#

Load key "id_rsa": error in libcrypto

nova tide
bright geyser
fair adder
fair adder
bright geyser
#

@fair adder quite a nice game, I enjoyed it 😁

fair adder
#

thank's @bright geyser

#

@bright geyser Close Match, Well Played

#

GG!

fair adder
fair adder
placid imp
#

theres a player named SamHattter he's removed all flags and copied them somewhere

#

later on in the game he got 8 flags after the flags got deleted

nova tide
placid imp
#

πŸ‘

fleet gale
nova tide
#

@nimble lily deleted your message as it was showing flag in the screenshot.

nimble lily
#

i dont notice i just was fixing the code

vapid dragon
fair adder
hybrid talon
#

hey, anyone up for KOTH?

hybrid talon
fair adder
harsh obsidian
#

.

#

Anyone up for a game?

fair adder
fair adder
vapid dragon
nimble lily
#

gg

worthy isle
muted wasp
#

yo

normal hawk
worthy isle
brittle flicker
#

Who is this Koth fella? Eh?

fair adder
brittle flicker
#

Oh I know :3 I keep asking that

#

I got muted on the channel for asking so many times :3

#

Just wanted to pop in tho

fair adder
#

The bot muted you? πŸ˜‚

brittle flicker
#

Nah, i think it was someone running this

#

It was a while back tho πŸ˜‚

#

I haven’t used tryhackme in almost a year

bright geyser
#

20 minutes to figure out that I was using double quotes to write my name and windows echo write those quotes too... I feel so dumb πŸ˜…

nimble lily
nimble lily
worthy isle
#

Someone broke the box πŸ˜¬πŸ€¦πŸ»β€β™‚οΈ

#

He’s gonna win by 5 points fml hahahah

merry crypt
#

this is my second koth game ever

#

@worthy isle i lost to you today, we were playing the lion box

#

but it was fun, i got 3rd place

nimble lily
fair adder
fair adder
shrewd spire
#

in koth are you allowed to delete chattr? seems to be what the king has done

#

ah nvm

#

was just moved somewhere different

steep agate
shrewd spire
#

how do you get it back? or is there a cute alternative to remove immutable from king.txt?

quiet schooner
shrewd spire
#

next time i come prepared

#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <linux/fs.h>

int main(int argc, char **argv)
{
    FILE *fp;

    if ((fp = fopen(argv[1], "r")) == NULL) {
        perror("fopen(3) error");
        exit(EXIT_FAILURE);
    }

    int val = atoi(argv[2]); // 16 adds the immutable flag, 0 removes it
    if (ioctl(fileno(fp), FS_IOC_SETFLAGS, &val) < 0)
        perror("ioctl(2) error");

    fclose(fp);

    printf("done");

    return 0;
}
stiff egret
#

Long time, hop in, it starts in 20 mins. Public game.

prisma roost
nova tide
stiff egret
#

our tools and tricks are in sync, we tie each other bruh @nova tide

stiff egret
nova tide
stiff egret
#

I would

nova tide
#

Noob

stiff egret
#

et tu brute

nova tide
#

Food > *

#

Not the KoTH food

stiff egret
#

which one is yours @prisma roost

unknown.png
nova tide
#

He's not in

stiff egret
#

justforaday

#

name says it all

prisma roost
stiff egret
#

ah, best of luck for that exam fingerguns

nova tide
#

You gotta try beating holmes in koth

prisma roost
nova tide
prisma roost
stiff egret
nova tide
stiff egret
prisma roost
nimble lily
#

carnage

nova tide
#

Carnage?

#

unless i have been reading the name wrong this whole time

nimble lily
#

keyboard mistake dark

stiff egret
#

Tyler

prisma roost
#

I wouldn't leave the food either

stiff egret
#

@fair adder πŸ‘€

nimble lily
#

its not allowed to stop ssh blobhuh

stiff egret
#

I don't know if anyone is stopping ssh?

#

kekwsurprised whoever it was, hehe

#

I don't have a pts, @fair adder

fair adder
naive smelt
placid fable
naive smelt
sour vectorBOT
#

Gave +1 Rep to @placid fable

upbeat bone
#

Anyone want to play a game?

upbeat bone
#

I'm working now....

upbeat bone
#

you still wanna play?

shrewd spire
#

is it legal to kill other players terminal sessions from root?

#

cause thats really annoying πŸ˜„

terse willow
shrewd spire
#

wouldnt that be rude to the attackers, after they put in so much effort?

#

everyone has to make a living ;D

terse willow
#

Nah, killing shells is perfectly legitimate

upbeat bone
#

I'm lookin for a game in the next couple hours if anyone wants to ply

upbeat bone
#

15 mins till go time

upbeat bone
#

Likewise

#

that was a blast

#

Yes please

#

Hahaha it was a surprise for sure. I'll have to add that to my playbook thanks for sharing!

#

Never heard of it. I got some research to do I guess lol

bright geyser
#

Have you used the +i flag with chattr?

#

Strange if it was only two of you playing

upbeat bone
#

I noticed some weird things too. Couldn't watch cat <king>

#

Permissions denied

#

But idk if I had a full shell.

#

I'm sort of new

bright geyser
#

while if the player got a reverse shell via python or something else you can use:
ps -ax | grep + a regex for finding an IP address that starts with 10. πŸ˜‰
(P.S: please don't use it just to annoy the other players)

upbeat bone
#

That would kill your own shell tho too...perminant lockout right?

#

Oh I guess it's just run once. But wouldn't the regex match your ip as well?

#

Lol nvm. Still manually passing the pid to kill so it's safe

fair adder
shrewd spire
#

'patching' by wiping all the web directories seems like it should be forbidden

fair adder
#

@shrewd spire i Did't do that

shrewd spire
#

it felt like you did... on the second reset none of the web directories were available any more, even on the random ports?

fair adder
#

@shrewd spire No I did't Touch the Web stuff

shrewd spire
#

hmmmm

stiff egret
#

You need to post the invite link for others to be able to join

#

@fair adder

sour vectorBOT
#

Gave +1 Rep to @stiff egret

prisma roost
#

anyone up for a koth game?

quiet schooner
bright geyser
#

in the Hogwarts machine the king file was missing (I managed to become king anyway) was it supposed to be like this (I mean the player have to do "some magic" itself) or was just that time that was missing?

nova tide
upbeat bone
#

It was 2AM my time when you asked. I'm down for another game sometime though!

upbeat bone
stiff egret
#

I have no clue how I missed that, but it is what it is, and in cyber sec, it's never a vuln its always a feature.

bright geyser
bright geyser
upbeat bone
#

Mine involved spoiler: ||SQLi on the spell/login page||

fair adder
#

When can i start playing koth

prisma roost
fair adder
#

But look at my level

#

It says i need a higher one

prisma roost
#

You can change that in your profile to intermediate

#

Read the first pin in this channel

fair adder
#

i am lost in here what should i

#

do

#

how does it even work

prisma roost
#

Find flags

nimble lily
#

take ip

#

scan it

#

find ports open

#

find vulnerable service or application at the ip

#

get in the machine
get flags

#

than become root
and put your name at /root/king.txt
defend your title

prisma roost
#

Ezpz

nova tide
pearl gladeBOT
nova tide
#

You can also watch some videos people have created

fair adder
#

That's what I need to do before I dive in.

upbeat bone
#

Anyone playing now?

shrewd spire
#

im enjoying koth almost more for finding all the little ways to get a foothold and root than the actual comp haha

#

i get root one way then try to reverse engineer all the sites and services to see what other tricks the authors came up with

upbeat bone
#

Not at 2:30 AM lol

naive cradle
#

looking for people to play my first game of koth with

steep agate
#

πŸ‘€

shrewd spire
#

hey in the offline machine, setting king.txt doesnt seem to work

nova tide
shrewd spire
#

i set king.txt to my username and its not updating the scorebored

#

figure it might be because i used backup privilege to get writes to admin

upbeat bone
#

It's bc you patched SMB πŸ˜„

shrewd spire
#

me? i havent patched anything

#

would be rude πŸ™‚

upbeat bone
#

oh...in that case I have nearly 2 mins to catch up lol

shrewd spire
#

go go go! (king might be broken though)

upbeat bone
#

nah, I can't get it. I joined late but still can't get a foothold

#

if you cat does it show your username?

shrewd spire
#

type, and yep

upbeat bone
#

oh...see! no foothold lol

#

You still won, but yeah that's odd it wouldn't take

shrewd spire
#

i dont think the win really counts unless someone gets king

upbeat bone
#

what do you mean by 'counts'? is there a KOTH rank or something?

shrewd spire
#

doesnt show up in the list of recent games as far as i can see

#

and there is a koth rank under leaderboards

upbeat bone
#

oooo I never knew that.

#

With the right filters in place I rank 3 πŸ˜„

pearl crane
pearl crane
#

@shrewd spire spare me

shrewd spire
#

lolol

#

still cant figure out how to make king stick in offline

#

administrator/king-server/king.txt seems to be the place, but no jazz

pearl crane
#

i dont think king.txt is working?

#

i was king for a bit

#

still not getting king

shrewd spire
#

pretty sure you put it in administrator

#

not /king-server

pearl crane
#

yea its in there

shrewd spire
#

but it doesnt work there either

pearl crane
#

weird

#

gg

shrewd spire
#

i reckon the issue might be windows echo adds a newline

#

ran out of time to test it 😐

inner nexus
#

anyone down for koth?

prisma roost
#

@shrewd spire are you still trying to get in?

#

I've killed your terminal sessions but you've already won so no matter

inner nexus
#

gg

#

i spawned a tty with python but got stuck lol

inner nexus
shrewd spire
#

something tricksy with lxc?

prisma roost
#

Made an infinite while loop which changed the file to mutable, wrote my username and made it immutable again,
Started this loop in the background as a process

shrewd spire
prisma roost
shrewd spire
#

i was seriously startting to look askance at echo

prisma roost
#

Nah, just a simple bash scripting trick cPES_Wink

inner nexus
#

Niceee

#

I was just stuck as serv3 the whole time πŸ’€

prisma roost
#

yeh, I patched the crontab privesc and changed it so it ran as the serv3 user rather than root

shrewd spire
#

can still get to root via find if you need it

#

on that machine

prisma roost
#

yeh, there are at least 2 or 3 different ways for foothold and privesc on every machine

placid fable
#

Gotta catch patch 'em all πŸ˜„

prisma roost
#

I joined the game 30 mins late, aquinas was already king for that time

#

so, after putting my name in king.txt, I just gave up

placid fable
#

IDT you got it fawaz

prisma roost
prisma roost
placid fable
#

NVM, both of you played well blobfingerguns

shrewd spire
#

i usually dont bother patching things unless threatened

#

like... some sort of forest animal

placid fable
#

I ain't forest animal blobno

prisma roost
#

yeh, most games you play are with beginners, patching is only needed when someone has oscp in their profile πŸ‘€

stiff egret
#

I shouldn't say this, but count me in

#

less goooo @fair adder

unknown.png
#

you know we can start a public match and it will start sooner?

#

2 mins

#

gogogo

placid fable
#

That's for private matchesπŸ‘€

prisma roost
#

infloop, you coming? πŸ‘€

stiff egret
#

where you guys at?

prisma roost
#

oh, ffs, it's started already

stiff egret
#

Really hope this isn't windows or Hogwarts

placid fable
stiff egret
#

lets go

inner nexus
prisma roost
stiff egret
#

Uh, not me

prisma roost
#

πŸ‘€

#

ok who's this?

unknown.png
stiff egret
#

whoever it is, they've passed the humour check

#

to whoever is using pspy There are ways to kinda ruin pspy yk..

prisma roost
#

okay, to whoever is killing pty sessions, you're not killing the connection, I just respawn a pty KEKW

stiff egret
stiff egret
#

machine died or something? @prisma roost you able to ping?

prisma roost
#

nah, looks good but it is slow

stiff egret
#

yeah, that's why I said, someone is running pspy

#

slows the whole machine super down

#

famous last words

prisma roost
#

kill him or his connection πŸ‘€

stiff egret
#

be a dear and Ctrl + C yourself

prisma roost
#

not sudo/pwncat

stiff egret
#

I have a feeling they have a nc session

stiff egret
prisma roost
#

AHHHH @placid fable

placid fable
#

What?

#

You are dev/pts/0?

prisma roost
#

NYANCAT

stiff egret
#

god this is fun

#

that wasn't me btw

prisma roost
#

oh I see

stiff egret
#

that wasn't me I swear on my keyboard

#

and it's new

prisma roost
#

this is beyonf annoying

unknown.png
stiff egret
#

slow the machine so much that even king service is not able to read the flag lol KEKW

#

okay imma just throw this trick out

placid fable
stiff egret
#

since the game is over already
if you throw enough information at pspy, the service clogs and you can do your work hidden

prisma roost
#

You know, I've been sporty but I could end this with pwnkit

stiff egret
#

what's on the machine writing my name will be unaffected by pwnkit - but you'll get shells tho

#

also /etc/bash.d is suid KEKW

stiff egret
placid fable
#

WTF, I just kicked someone once and my own other pwncat shell

stiff egret
#

lol

placid fable
#

πŸ˜†

prisma roost
stiff egret
#

gotta say this was highlight of my day so far KEKW

prisma roost
placid fable
#

I did get root within 3-5 minutes fawaz
Put to no correct use

prisma roost
#

A'ight Imma give up

stiff egret
#

for what it's worth, I am not even on the machine

#

it's infloop torturing you

prisma roost
#

me neither anymore

placid fable
#

Did you too get to see those, Holmes?

stiff egret
#

nada

#

no pty no nyancat

#

ez

prisma roost
stiff egret
#

I didn't go that far today, just normal unstable nc

#

why stablise it if unstable can get you nopty session

placid fable
prisma roost
stiff egret
#

ah

#

hac indeed

prisma roost
#

I just rm -f king.txt && echo Zeeshan1234 > king.txt

placid fable
#

I will figure it out, patch the kernel to disallow writing to /root/king.txt πŸ˜…

stiff egret
placid fable
#

GGs Holmes blobfingerguns

stiff egret
#

GG mate, it was fun

prisma roost
#

GG fun indeed

stiff egret
#

a good game after a long while -

#

cya soon again (:

placid fable
stiff egret
#

I once did pgrep sh | xargs kill -9 long back

#

bad move KEKW

#

suicidal

prisma roost
stiff egret
#

yee

prisma roost
nova tide
upbeat bone
shrewd spire
#

so who was doing all the messing about yesterday, nyan cat and random etc? be keen to learn some tricks

#

also no idea how the king file was being reverted so quickly πŸ˜„ id do make mutable && echo my name && make immutable && cat and find mr.holmes laughing at me from the terminal

pearl crane
#

are you allowed to change passwords in koths?

nova tide
stiff egret
stiff egret
crimson zephyr
#

someone doing koth ? I want to spectacle πŸ˜‰

upbeat bone
#

@crimson zephyr I usually do one over lunch. Started an hour ago. Same time tomorrow probably

crimson zephyr
#

@upbeat bone @fair adder thanks bros for the answer, maybe a next time ❀️

sour vectorBOT
#

Gave +1 Rep to @upbeat bone

upbeat bone
#

Is the message about cheese strats baked into the VMs or is that something being deployed by users?

upbeat bone
upbeat bone
#

@shrewd spire I don't think you'll need it, but good luck anyways!

shrewd spire
#

to you too!

upbeat bone
#

I'm gonna need it for this one

shrewd spire
#

phew, now im king i can give you a hint πŸ™‚

upbeat bone
#

hahahahaa

shrewd spire
#

this koth machine was originally the hacker of the hill hard box

upbeat bone
#

well I just started like a week or 2 ago πŸ˜›

shrewd spire
#

i dont think its cheating to look up a writeup of that. i have a writeup from when it was a regular room for me

upbeat bone
#

Currently trying SSRF...but that doesn't seem like the answer.

shrewd spire
#

its a real hard box, imo

#

some things are different than from ^, but its mostly the same

upbeat bone
#

Cool. I'll do my best to 'try harder' but might pull a few clues from there.

#

I appreciate it!

shrewd spire
#

oh def. to get king you need to understand: command injection, php filter lfi, api brute forcing, xxe, access log poisoning, restricted shell escapes, credential reuse, static binaries, and docker escapes

#

you have 18 minutes. good luck πŸ˜„

upbeat bone
#

rofl.

placid fable
#

Hackerman adminπŸ˜„

prisma roost
verbal remnant
#

hi everyone! I was wondering, how do i actually connect to KOTH?

#

I connected with openvpn from my kali machine, THM showed i was connected

#

but in the KOTH loading room, it doesnt show an ip that i use for hacking

#

Can i have help?

upbeat bone
#

you are a spectator I believe.

verbal remnant
#

then how do i play?

upbeat bone
#

You will need to join a game

verbal remnant
#

i did

#

i cliked join game

#

it shows me the time until start

#

i see whos in my lobby

#

then when it starts it shows machine name... no ip

upbeat bone
#

does it show you in your lobby?

verbal remnant
#

yes

#

i know that i am in a game.

#

It wont show me the machine ip

upbeat bone
#

try refresh the browser once timer starts.

verbal remnant
#

ok

upbeat bone
#

if anyone is playing 42322 sorry about breaking the box twice

#

but also there's 10 mins left. If we reset I wont break it again (at least not the same way lol)

#

@verbal remnant did you get it working?

oblique lark
#

Hey everyone, I need some help regarding the Linux Privesc room in the cronjobs task

#

I modified the backup.sh using the script provided and using my machine ip and port and already had a listener setup but nothing is connecting back

#

I checked that the cronjob is there with the right path, and the file that I modified is in the right path as well

#

For reference I'm using the attackbox

#

that's the command

unknown.png
#

Ofcourse using my own machine ip and port for the attackbox and listening port respectively

oblique lark
#

You got it

upbeat bone
inner nexus
#

Does anyone want to do a private ctf on H1:Easy? I want to practice my blue teaming

jaunty gyro
inner nexus
jaunty gyro
nova tide
#

You don't really need anything specific. Just do it as you do a normal box. You might will be using some reverse shells and other common tools, don't forget to keep notes as you go through koth machines that could come in handy in future.

prisma lion
#

Are there times when KOTHs tend to be more active? Weekends?

#

(as in, greater likelihood of participation by other members)

nova tide
inner nexus
#

i mean invite*

prisma lion
nova tide
#

voice channel/voice call

jaunty gyro
inner nexus
#

ight

nova tide
#

@prisma lion you can also share invite link here so if anyone wants to play they can join you.

prisma lion
sour vectorBOT
#

Gave +1 Rep to @nova tide

jaunty gyro
inner nexus
#

just sent it

steep agate
#

hide your process in the machine, you gain advantage

#

😎 πŸ‘

upbeat bone
naive cradle
#

starts in like 15 mins

steep agate
#

Vale use these types of tricks in koth?

normal hawk
steep agate
steep agate
terse willow
#

You're asking the "original author" credited in your repo to credit you..? For generic, commonly known commands no less... πŸ€”

steep agate
steep agate
terse willow
steep agate
#

oh i got it

copper kindle
#

Does anyone have tips on shell persistence?

#

I figured it's easy enough to setup a bind shell and just hide the process but I'm wondering what fun strategies that everyone else has

tardy pulsar
prisma lion
#

^starting in 10 mins

upbeat bone
rugged leaf
#

KOTH machines need to be updated

#

nobody is realing learning from them anymore, y'all just save creds and hack faster

prisma roost
#

I think, it was mentioned that they were going to start using dynamic flags but it's been ages so don't think that's gonna happen, as for the creds, it's more a game of patching/defending your title imo

bright geyser
prisma roost
bright geyser
nova tide
nova tide
prisma roost
terse willow
#

Dynamic flags are something I can add, but they aren't integrated with THM

#

Convince Skidy to commission a KoTH box from me and I'll build you a new one πŸ˜†

nova tide
terse willow
#

Not really how it works these days

steep agate
#

πŸ‘€

grand hornet
#

I am unable to use find command says permission denied in koth

placid fable
#

Someone messed up with it then, ls -al /usr/bin/find might not be showing the executable bit set

grand hornet
#

does that comes in fair play, I am playing for the first time

placid fable
grand hornet
#

so can we report about this or not?

placid fable
#

You can report them to koth@tryhackme.com with the game ID, user you suspect and the reasons

grand hornet
#

ok

steep agate
placid fable
#

Isn't it a basic utility, which should be usable out of the box? And the creator of the box might not have changed that behaviourπŸ€”

placid fable
steep agate
#

for example when you get reverse shell on carnage machine, you enter as user duku, you are not allowed to execute find

#

( this print is from a friend of mine when he was playing koth against a person from another country, and he told me this)

steep agate
#

taking some binary out of SUID also results in report ?

placid fable
#

Removing SUID bit?
It should be allowed πŸ˜„

steep agate
#

I understand, removing the binary with rm or chmod 700 is prohibited, I believe only removing the binary that is allowed SUID is enabled

placid fable
#

Nah, one of the rules says - Removing a binary or removing the executable bit isn't allowed

#

SUID could be removed, it isn't executable bit

#

IIRC, some boxes have ||find|| as a SUID binary, so one should simply remove the SUID bit only and not the whole binary out of the wayπŸ˜†

steep agate
#

so, that's what I said, take it out of SUID, I'm using the translator, it's kind of hard to communicate around here

placid fable
#

Ok, I get itblobfingerguns

steep agate
#

i from brazil

placid fable
#

Espanol then?

steep agate
#

no, here we speak in brazilian portuguese, there are two types of portuguese, portuguese portugal and portuguese brazilian

bright geyser
grand hornet
#

Yes i did that

bright geyser
#

unfortunately there are some "pros" who do some copy paste to make you angry πŸ˜…πŸ˜Œ

grand hornet
#

So how could I be able to find flags or files with suid permissions

bright geyser
#

just set up a python server and get the binary from your PC

#

Put it somewhere else and change the name

#

So the "enemy" can't find it

nimble brook
#

i'm just on the carnage box with KOTH, and the walkthroughs online seem to match the box, however, my machine doesn't give me any response for ports 80-82 alike what is seen on the tutorials, am I missing something?

bright geyser
#

try to reset it, if nmap doesn't find any services
P.S the KOTH machines was made to practice, walkthrough won't help you improve

nimble brook
#

i only went to walkthrough after it was finished

#

but noticed that I couldn't navigate to the sites that the walkthrough could

#

i am able to nmap and find the open ports

#

but the html sites do not show the correct things

#

same now for shrek box

#

i'm not trying to cheat by using walkthroughs, but didn't think that I was seeing the intended behaviour

#

oops, just realized my own VPN was on....

white nymph
#

@mighty spoke
found you

steep agate
#

I'm going to do a koth event on my server next month πŸ‘€

hot owl
#

hi there, how do you guys unlock a permission denied king.txt file ( I got the root access), I tried with chattr -i /root/king.txt but it didn't work, any suggestions ? thank you

prisma roost
nova tide
prisma roost
naive goblet
#

you can do near nothing with the file if the imutable tag is set using chattr

nova tide
prisma roost
#

the file permissions may have been set differently

#

if chmod 400 king.txt has been run, it doesn't change even after removing the immutable bit

lean comet
#

Question about Hogwarts KOTH machine. I don't wanna ruin it for others who have not completed it yet, view this at your own discretion. || I cannot find a king.txt file on this machine. I have gained root access but the king file is not in /root? Can I get some help with this, I am confused? ||

SPOILER_unknown.png
stiff egret
#

Sorry for that mate @lean comet
I can confirm that I forgot intentionally didn't add the king.txt file in root directory. You need to create it in /root/king.txt and add your name there.

lean comet
#

Ah thank you very much for the clarification.

fair adder
raw grove
#

7m left

steep agate
#

@brittle lotus

#

why did you remove the binaries?? oh shit man this ruins the game

naive goblet
#

that definitely breaks the rules

brittle lotus
#

root@web-serv:/# echo *
dev proc root run sys tmp var

#

somebody fucked up machine

#

maybe dock0d1

steep agate
brittle lotus
#

I will vote for reset

Screenshot_from_2022-03-31_21-30-04.png
fair adder
#

@brittle lotus

brittle lotus
#

What?

fair adder
#

what do you want with me?

brittle lotus
#

Are you dock0d1?

fair adder
#

yes

brittle lotus
#

Did you delete binaries on H1: Easy?

fair adder
#

and no, it wasn't me who fucked up the machine, i left the room after that

brittle lotus
#

Thank you

#

I don't know

#

I hope we will play again. See you

fair adder
#

we are going Yes

#

I have free time now, if you want to play

brittle lotus
#

I'm tired now. Next time. πŸ‘

fair adder
#

ok, have a good rest

steep agate
#

dock0d1, read script automatic kill pts

#

@nova tide

nova tide
#

you can email at koth@tryhackme.com

steep agate
#

Ok

prisma lion
fair adder
#

@prisma lion

#

password 1234

prisma lion
#

dang, just now saw this

#

what password was that for?

#

or were you just trolling? πŸ™‚

fair adder
#

@nova tide

nova tide
verbal remnant
#

yo

#

matheu

#

my nmap is stuck at scanning 7 services

#

@steep agate it wont move 😦

fair adder
spare walrus
cobalt mist
#

Hey koth staff

#

the Lion machine is broken(I think?)

#

when I get the id_rsa and paste it in

#

it's in a weird format

#

actually nvm

fair adder
spare walrus
verbal remnant
#

My koth connection is hella slow for me and my friend

#

we're both connected OVPN

#

but the webpage takes FOREVER to load

#

and he cant even ping 😦

#

but nmap detects it

#

like whaaa

fair adder
bright geyser
cobalt mist
prisma lion
normal hawk
#

take a look a this folks.

fair adder
naive cradle
#

starts in 15 mins

vague venture
steep agate
fair adder
random fjord
nova tide
brittle lotus
#

@steep agate , what is going on with shrek?

#

Now it is ok

steep agate
#

I don't know, I'm on the phone, and snacking @brittle lotus

slim umbra
#

How do I host my own koth event :hmm: I need my own custom room anyone help 😭

#

I'm making it complete beginner friendly with all low hanging vulnerabilities, a lot of flags (So people don't get bored) and maybe 50-60 people might attend it for 2 hours πŸ‘€

#

any help from Tryhackme

#

πŸ™

quiet schooner
slim umbra
#

Oh the CTFd koth-agent right

grand ember
#

yes but no, the koth agent isn't really that suited for this environment and to get it to work you'd need to play a bit with it

#

at least not if you're hosting it on thm

quiet schooner
grand ember
quiet schooner
#

Oh, wait, ctfd

grand ember
#

yes

#

that's the caveat here

quiet schooner
#

Pretty easy to have an app that polls it every minute and keeps totals, serves stats on update over websockets

grand ember
#

i remember making a obs overlay that parsed websocket koth data from a thm koth game and displayed it

quiet schooner
#

Yea, if you wanted to run your own custom games you'd need the polling and score tracking yourself though

grand ember
#

mhm

slim umbra
#

Oh where can I find the service ??

quiet schooner
#

It's on my github which is linked in my discord profile

slim umbra
sour vectorBOT
#

Gave +1 Rep to @quiet schooner

slim umbra
slim umbra
#

last thing xD just a feasability check

slim umbra
#

works right

#

:hmm:

stiff egret
#

hmm fair

terse willow
#

If you speak to the site then they might be willing to set something up to help you with this over the event -- any of the internal devs (or myself) can create boxes that don't exire and have internet access, so it's not difficult to do provided you have permission to do so πŸ™‚

slim umbra
#

Wait I lost context here πŸ˜‚

#

site*- tryhackme right

#

The thing is my event isn't open for public it's for students in college

#

CTFd I've contacted them for sponsoring enterprise license for the event but It wasn't a fruitful thing as it was a hosting platform and all the attendees of the Techno-Cultural fest (which my event is part of ) is attended by students

#

even thm my marketing team has contacted πŸ‘€

terse willow
#

Oh, hang on, yes, you could do it by connecting to the tryhackme.com websocket for the game

#

Ignore me -- I anticipated polling the machine directly. Doing it with the THM points system that already exists is a much better idea

slim umbra
#

yeah...
Is there any chance that I could develop a koth room for thm which first I would use it for my event ?? πŸ˜‚

terse willow
#

You can develop a room and attach a machine to it then get everyone to attack the same machine πŸ€·β€β™‚οΈ

#

But then you don't get the KoTH websocket stats

#

Actual KoTH machines can't be created without help from Skidy or Ashu (the directors/owners). You can ask if they'd be willing to help out with that πŸ™‚

quiet schooner
terse willow
#

OH!

quiet schooner
#

deploy another instance ezpz

terse willow
#

You could, however, deploy the king service on port 80

#

And poll it using the .p.thmlabs.com domain

slim umbra
terse willow
slim umbra
#

and manual polling

quiet schooner
terse willow
#

Yeah, but the one doing the polling can't connect to the CTFd instance externally

slim umbra
#

for me it's a offline event so people will be infront of me so I can ask them to rise hands πŸ˜‚

terse willow
#

And will also die after a maximum of 6 hours

slim umbra
quiet schooner
slim umbra
#

but yeahhh I can take this up as a hobby project maybe - Koth Opensource modification for CTFd πŸ˜‚

#

But it would mess CTFd's licensing as they have their own enterprise version of koth

terse willow
quiet schooner
terse willow
#

Ah

terse willow
slim umbra
#

23rd April

#

But honestly all the things I do for training students I indirectly promote thm it's just soo good

terse willow
#

What email address did you use to get in contact with THM?

slim umbra
#

it must be @pes.edu mail I'll confirm with marketing and get back one sec

terse willow
#

As in

#

What email did you send the query to

slim umbra
#

yes

terse willow
#

When did you email?

slim umbra
#

atleast 8-10 days back

terse willow
#

Hm, okay, I'll query that and see what comes back πŸ™‚

terse willow
#

@slim umbra Mind if I DM? πŸ™‚

#

Actually, ignore that. Will make a thread instead

slim umbra
shrewd spire
#

hey in offline, how do you fix the king-server

#

suspect its been turned off

#

actually tips and tricks around offline / windows koth would be appreciated - had a bit of a struggle for king just now

brittle lotus
fair adder
crisp wagon
velvet ocean
bright geyser
#

How do I have to write my username into offline (windows) machine? πŸ€”
I see there is a bat script, I tried to put my username there but it didn't work

bright geyser
#

nevermind, I was looking in the wrong directory πŸ˜…

shrewd spire
#

yeah not sure what that share folder is for on offline

#

or if there is a way to mess with it with malicious intent

fair adder
crisp wagon
#

can anyone make KOTH game? πŸ˜„

quiet schooner
crisp wagon
#

πŸ˜„

quiet schooner
crisp wagon
#

i was talking about game (KOTH GAMES)

#

edited my mistake @quiet schooner .

fair adder
bleak briar
fair adder
#

mans dominating fortune

terse willow
#

Want me to help?
Reckon I still have creators notes for that box somewhere kekw

prisma lion
jovial field
#

He didnt Patch everything, He Just chnged ssh and telnet credentials.

crisp wagon
silver sphinx
#

No bro I never stopped services

#

I just changed ssh port two times :)

shrewd spire
#

did you close the port 8080 webserver @steep agate

steep agate
steep agate
silver sphinx
#

No problem

crisp wagon
#

is anyone interested in playing king of the hill so i ll make one game?

jovial field
#

starts ins 21 minutes

pearl crane
#

Is it allowed to use that new pkexe exploit on rooms?

stiff egret
#

Yes.

pearl crane
#

Kk

jovial field
shrewd spire
#

oi what

naive cradle
#

spooky

#

oh this game is not gonna be fun

shrewd spire
#

he patches all the privescs to root making it basically impossible 😦

#

its basically a race to see who can get to root first

naive cradle
#

yeah I can see that now

shrewd spire
#

i dont do that - think it kind of defeats the purpose

naive cradle
#

It really does

shrewd spire
#

(even though its basically in the rules)

naive cradle
#

is it really possible to just patch everything on the box?

shrewd spire
#

this machine theere are only three paths from foothold to root, over three different suid binaries

#

pretty sure hes just gone chmod u-s on each one. done

naive cradle
#

welp

shrewd spire
#

welp indeed

naive cradle
#

fun stuff

steep agate
steep agate
#

πŸ€·β€β™‚οΈ

#

sometimes there's even more, just look, research and especially study

#

soon I will record and post a video with more than 10 minutes, talking about tips and tricks for Koth, explaining how to defend and how to attack too, it will be really cool

#

in my opinion the best part is definitely when defending the box

naive cradle
#

nice

steep agate
shrewd spire
#

didnt you report a guy when he beat you, claiming he must have used an autopwn?

steep agate
#

yes, you train your "blue team" side too

bright geyser
#

Isn't about learn is about taking notes and copy paste some commands or even worse (it happened) just copy paste credentials from previous games... That's why, at least random creds should be implemented

shrewd spire
#

hogwarts has random creds. but even then, knowing the path to get them is basically as good as compared to someone who doesnt know

#

its a bit of a flawed format. i like enumerating the rooms though and building stealth tools Β―_(ツ)_/Β―

stiff egret
#

Random creds are there in multiple boxs, and likely in all future boxes. (with all the sarcasm in the world, fo Naughty if you reply anything on this one.)

shrewd spire
#

yeah not much you can do really

#

UNLESS YOU RANDOMLY GENERATED BOXES ENTIRELY

#

i am a genius

stiff egret
#

lmao

shrewd spire
#

random boot2roots when

stiff egret
#

Some part of that is there in Hogwarts with almost every file name changes and ports, but we have to make the boxes themed, otherwise one box for all might come in picture.

shrewd spire
#

yeah boot2root with no theme is no fun

#

what is this, offsec labs?

stiff egret
#

lmao

stiff egret
stiff egret
#

There were some boxes in dev with a lot of 'asked for' features, but creators got busy with life and stuff.

prisma roost
shrewd spire
#

hmm

#

not sure im going to win this one

bright geyser
#

lol

stiff egret
#

That ideally shouldn't happen

naive goblet
#

wait lols you got a empty koth room????

steep agate
# shrewd spire

this happens because when the game is about to start with very few seconds left, the person leaves the room, and even then it counts as if the person who left was still in the room, so it's practically free king, it's happened to me a few times

naive goblet
#

wait does that mean you could technically exploit this if you have 2 tryhackme accounts????

steep agate
naive goblet
#

then again if you abuse this your account is at risk of getting terminated

#

as it would most definitely break tos

steep agate
#

this happened to me i think twice a while ago but i thought it was a visual bug just for me and i forgot to report it to the staff because i had to leave at the same time, now that aquinas says he proved the theory

steep agate
shrewd spire
stiff egret
bright geyser
#

@brittle lotus you were my hero, now you're just a random guy πŸ˜‚ 😝

limber rune
brittle lotus
#

He is not talking about me.

bright geyser
# brittle lotus Me?

If you have the same username on tryhackme website then yes. We were playing a game against a pro who got root before I even scanned the machine and since I saw you are top 5 I thought you were going to win 😝

brittle lotus
bright geyser
brittle lotus
brittle lotus
bright geyser
#

I will explain in DM to not spam here.
P.S don't worry you didn't anything wrong

brittle lotus
valid mulch
#

Last game, kth, there was a username lookup lets say, I discovered usernames, which I think are correct but they wouldn't show up in the lookup-thingy? So how does this exactly work, who gains root first controls others sessions and services basically and wins?

#

Im pretty new to this game mode, so I'm trying to figure out what is happening, can somebody delete like a ssh file to disable ssh login for others, sounds too OP to me

nova tide
#

!docs koth

pearl gladeBOT
shrewd spire
#

theres no skill in just knowing the machine more than someone who doesnt, and abusing that knowledge to ensure they cant get a foothold

shrewd spire
#

good going @brittle lotus for being the only opponent ever able to find and stop it after i dropped it (only used it against people like flint)

steep agate
#

this from the ban?

steep agate
# steep agate

I need to update my repository, I wanted to know whether to banish or not to put it there, and in my video that I will also release it, with defense and aggressive attack techniques

#

good repository bro xD

valid mulch
#

Yeah, why do you ask?

#

The reason I asked this question, was because firstly I thought it is command injection vulnerability, so scanned it with my tool for like 10+payloads, and nothing was found. Little after, found a few usernames using SMB/netbios port, but they weren't valid in the web lookup, so I'm almost positive that somebody removed them from /etc/passwd. Also, found what I think is a password on a share, so I wouldn't be surprised if somebody deleted entries from authorized_keys or something... Not really sure how I would use the lookup functionality, but perhaps there was a password hash or something... Wasn't really familiar with the rules, so I'm to blame for fuzzing port 9999, which now I know is not needed.

brittle lotus
sour vectorBOT
#

Gave +1 Rep to @shrewd spire

nova tide
#

@shrewd spire can you please not share all the writeups + flags here? even if you are bored.

terse willow
#

Writeups are fine. Flags are technically not allowed to be shared per site rules anyway.

shrewd spire
#

not sharing any flags (hopefully)

#

oi you nuked my link

terse willow
#

Also, so he did

#

-undelete -a

sour vectorBOT
#

Up to 10 last deleted messages (last hour or 12 hours for premium):

none...

shrewd spire
#

flag content shouldnt be in there

terse willow
#

Yeah, I didn't see any flag contents in the KoTH Writeups

shrewd spire
#

i think there is flag content in one of the main room writeups, but that room specifically doesnt accept flag submissions

nova tide
terse willow
#

I mean, writeups are allowed, and how many seconds would it take you to find a repository containing all the writeups on Google?

nova tide
#

I just meant sharing here.

#

They can keep it on their repo if they want.

terse willow
#

All of the regular players have this stuff memorised anyway. Not a whole lot you can do to protect the integrity of machines this old πŸ˜†

shrewd spire
#

admittedly mine are somewhat more comprehensive than most you would find via google

#

i tried to find all the paths and document them

terse willow
#

Click a link here or google it and click a link

#

If people wanna get a writeup for one of the KoTH machines they won't have any difficulty doing so

nova tide
#

πŸ€·β€β™‚οΈ

shrewd spire
#

i guess my intention was around those who dont know the machines - if they face someone who is locking paths, and they dont know, then they could spend a frustrating hour trying to enumerate a hardened machine

#

at least with a guide, they can see if all the paths are closed off? eh

terse willow
#

Mhm, it levels the playing field a little

nova tide
shrewd spire
#

totally

#

I guess what im saying though, is you need to make me official king of the hill

terse willow
shrewd spire
#

emperor of the hill, if you will

terse willow
#

Or don't Google for writeups

#

Or whatever is the easy way to obtain a walkthrough

steep agate
#

I will update my repository and a video of mine about shell x shell of koth, I will explain how to defend more and attack too, not kill shell B)

steep agate
grand ember
#

Even better, just unmount procfs wesmart

steep agate
fair adder
balmy pagoda
#

@nova tide is that you messing up with my shell

nova tide
#

I just joined Niko's link but they left.

balmy pagoda
#

seriously
who is this fake naughty then in my shell

nova tide
#

OOF

fair meteor
#

Hi

#

Please can anyone overwrite a file
If -i chattr isn't working

balmy pagoda
swift fossil
#

anyone up for koth

fair meteor
sour vectorBOT
#

Gave +1 Rep to @balmy pagoda

cloud birch
#

anyone wanna play?

naive cradle
#

I could

cloud birch
#

gang

fair meteor
#

@steep agate stop the oppression

#

U basically patch everything in 3min

#

Then join another game

steep agate
#

what ?

#

lol

#

the machines are easy to fix

fair meteor
#

Am just sayingπŸ˜† u're too good

#

I tried using john to brute force the id_rsa but its telling me id_rsa file is not a private fie

steep agate
sour vectorBOT
#

Gave +1 Rep to @fair meteor

brittle ether
steep agate
#

on all machines, there is more than one way to gain access

brittle ether
steep agate
#

But don't worry, next time I won't change the id_rsa for you

brittle ether
#

Cya next time

steep agate
steep agate
brittle ether
steep agate
#

you can change them

brittle ether
steep agate
steep agate
# brittle ether Are u sure ? Xd

"Look for the most common possible ways to patch a box i.e: changing ssh keys, changing passwords, look for the processes running or give cronjobs a look?"

jovial field
#

I guess it is not allowed to kill services, is it?

jovial field
#

@steep agate could it be that you killed nostromo, the upload page and fixed the lfi

#

got it

steep agate
#

I didn't kill any pages, I just fixed the LFI, and the file upload

#

I left the nostromo open exactly for you to get shell

#

root@lion:~# cat /var/nostromo/conf/nhttpd.conf

MAIN [MANDATORY]

servername 127.0.0.1:8080
serverlisten *
serveradmin webmaster@nazgul.ch
serverroot /var/nostromo
servermimes conf/mimes
docroot /var/nostromo/htdocs
docindex index.html

LOGS [OPTIONAL]

logpid logs/nhttpd.pid
logaccess logs/access_log

SETUID [RECOMMENDED]

user gloria

ALIASES [OPTIONAL]

/icons /var/nostromo/icons
root@lion:~#

#

@jovial field

steep agate
jovial field
#

yeah i see

#

the problem was the port

#

you changed it to 365554

steep agate
steep agate
#

here is 8080

jovial field
#

xD

#

Not really but fine

#

And it is very impolite to mess up shells with the true randomness

steep agate
jovial field
#

Allright

normal hawk
cloud birch
#

You can do that? Just disconnect people's shells? Lol? That's not against the rules?

terse willow
#

If so, yes, it's within the rules

#

(Correct answer to that is yes, btw, you would absolutely terminate their access)

steep agate
steep agate
lilac idol
lilac idol
steep agate
sour vectorBOT
#

Gave +1 Rep to @lilac idol

steep agate
lilac idol
#

16 years old you know a lot

#

you must have fixed it fast

terse willow
lilac idol
#

this is my first time trying koth

steep agate
# lilac idol 16 years old you know a lot

thanks bro :D, the @graceful bear and @brittle ether they both know a lot too!! the only one who managed to do 26 king changes in total on me, resulted in a good match

steep agate
graceful bear
steep agate
brittle ether
lilac idol
steep agate
brittle ether
steep agate
#

I think the koth itself is a matter of speed

steep agate
lilac idol
#

i have to start using rustscan

#

look how slow this scan is

steep agate
steep agate
graceful bear
#

rustscan == "nmap --min-rate 10000" lol

lilac idol
#

what else do you use

brittle ether
#

πŸ˜„

steep agate
brittle ether
lilac idol
#

how has none of them logged you out or anything

brittle ether
#

Good question

steep agate
lilac idol
graceful bear
lilac idol
#

i havent got 1 flag because i wasnt prepared, my vm is too slow

graceful bear
#

don't look at me, you're the only one who has root on the system