koth

[lilac idol]

kinda getting outdated

the log4shell room was good because its in the present

we need some new rooms on cloud pentesting and things like that

[random trellis]

they have to create a room on AWS s3 bucket vulneribilty too

[lilac idol]

you should make one if you can

[random trellis]

i dont know how to😅

[lilac idol]

it might cost more to do rooms like that idk

since you have to pay for the cloud

or no?

[random trellis]

yess maybe

i got your point

cloud is not free

[lilac idol]

or you would have to actually scan the amazon cloud

and amazon might not allow it

idk

[random trellis]

aws is at number 1 and they will ask for money to host😂

[lilac idol]

are you learning any computer languages?

[random trellis]

yess in college i have subjects

[lilac idol]

yeah i guess thats one of the reasons they havent made those rooms yet

[lilac idol]

python?

[random trellis]

yess

[lilac idol]

C too?

[random trellis]

i have learnt c, c++, python in college

now currently java, sql

[lilac idol]

theres this free harvard online computer science course you can do

they will give you a certification if you complete it

[random trellis]

i registered it

[lilac idol]

you did? nice

[random trellis]

learnt cryptography

course was good

[lilac idol]

yeah the ceasars cipher

[random trellis]

there were 2 parts of it

[lilac idol]

with C and python

yeah one is with C and one is with python

i tried it last year but i didnt finish

[random trellis]

but they take money for certification😂

[lilac idol]

no

[random trellis]

but course is free

[lilac idol]

are you sure?

i think they give one free but one doesnt have your name

[random trellis]

when i did they said you have to pay to get your cert

[lilac idol]

but if you want your name on it i think thats when they charge

[random trellis]

yess

without name, thats sample cert

[lilac idol]

yeah but i dont think they charge much

and the course is good

[random trellis]

yess that was really good, and i appreciate them

they are giving free knowledge

[lilac idol]

yeah and freecodecamp is a good one too

[random trellis]

w3school for coding

[lilac idol]

do you want to study together sometime?

[random trellis]

sure

[lilac idol]

yeah w3school is good

[random trellis]

alr i have to go now, lemme prepare for my exams😂

[lilac idol]

what os do you use? just asking

[random trellis]

parrot os

i find it good

[lilac idol]

okay talk to you later

yeah it is good

[lilac idol]

@graceful bear Hello

[graceful bear]

sssssuuuup

[lilac idol]

whats up

[graceful bear]

i'm good

you?

[lilac idol]

good

for some reason on my mac it freezes when i sudo ftp

ill have to play on vm or attack box

[graceful bear]

👀

[lilac idol]

yeah you might want to patch that

chmod -x /usr/bin/ftp

but i gave up anyway

by the time i get the vm loaded the game will be over

[quiet schooner]

That's uh... Not a great patch

Remove sudo privs for it, don't just nuke the executable bit lmao.

You want the binary to remain available for genuine users, that's patching

[lilac idol]

would that be chmod 666?

[quiet schooner]

No...
Look into how you specify who can run commands with sudo.

[lilac idol]

sudoers file?

edit that?

[quiet schooner]

Not sure why you're putting question marks, you should be checking enough online resources to be sure of the answer first.

[lilac idol]

username ALL = NOEXEC: /usr/bin/ftp

[lilac idol]

is that the patch you were talking about?

[quiet schooner]

No

Running FTP isn't the problem, running it as root is.

This is why it's important to understand what you're doing. Very very important.

[lilac idol]

sudo chown root:root /path/to/application
sudo chmod 700 /path/to/application

this is how you make a file accessible by root only

so it would be sudo chmod 700 /usr/bin/ftp

[quiet schooner]

But that's not what you want

You don't want it only accessible by root

You just don't want people running it with sudo. Do you understand?

[lilac idol]

yeah i understand so to take away sudo priv from a user it would be sudo gpasswd -d your_user sudo

[quiet schooner]

No

You're not trying to take it away from a user

Just find where the rule is defined and remove it...

Use visudo so you don't brick sudo on the box

[lilac idol]

i bricked a ubuntu vm like that a little bit ago

but just tell me already

would it be in the /etc/sudoers file

[quiet schooner]

No, that's lazy.

You'll learn more by doing the reading yourself

[lilac idol]

wouldnt what i already said work though?

i dont even know what youre talking about and you wont explain

visudo opens the /etc/sudoers file with the vi text editor.

and then you delete username ALL = (ALL:ALL) ALL

[lilac idol]

is this right? @graceful bear

[graceful bear]

why would you delete a username?

[lilac idol]

for example delete shifu ALL = (ALL:ALL) ALL

or just delete sudo ALL = (ALL:ALL) ALL

[graceful bear]

but why👀

[lilac idol]

whats the best way to stop a regular user from running sudo for something like ftp or vim

[quiet schooner]

I think you need to read about the sudoers file and syntax

[graceful bear]

deluser USERNAME sudo

[quiet schooner]

That's assuming it's using the sudo group to grant those privs, which is why you gotta do this

[lilac idol]

why cant i change the file permissions

the king.txt

i tried almost everything

[lilac idol]

thanks but how do i make the king.txt file writable again as root

[sour vector]

Gave +1 Rep to @graceful bear

[lilac idol]

even as root i cant write to it or change permissions on it

[graceful bear]

research about chattr

[lilac idol]

it says its not installed when i try to reverse the chattr immunity

and then i install it and it says it is installed

[graceful bear]

that's coz i deleted it

[lilac idol]

yeah its giving me issues trying to download it back too

im trying to download the binary and copy it over

i think i have to uninstall e2fsprogs and then reinstall it

[graceful bear]

lemme upload the binary for you in that case lol

[lilac idol]

okay thanks i saved a copy for the next game lol

[sour vector]

Gave +1 Rep to @graceful bear

[graceful bear]

awesome

[lilac idol]

did i kill your shell at any point?

[graceful bear]

yes!!

several times

[lilac idol]

i changed the password for food too idk if that affected you at all

[graceful bear]

nooop

[lilac idol]

good game though

hey can you tell me if this syntax is right? while true; do echo "iTzNeMeSiS" > /root/king.txt; chattr +ia king.txt; set -o noclobber king.txt; done &

[graceful bear]

looks good

but

you can add 2>/dev/null right before the ampersand

[lilac idol]

so like this while true; do echo "iTzNeMeSiS" > /root/king.txt; chattr +ia king.txt; set -o noclobber king.txt; done 2>/dev/null &

or no?

[graceful bear]

actually there's a problem there

[lilac idol]

i was wondering because i kept getting an error

[graceful bear]

chattr +ia /root/king.txt; set -o noclobber /root/king.txt

use the full path for the king file

[lilac idol]

while true; do echo "iTzNeMeSiS" > /root/king.txt; chattr +ia king.txt; set -o noclobber /root/king.txt; done 2>/dev/null &

does this look good?

[graceful bear]

nooop

lol

chattr +ia /root/king.txt

[lilac idol]

okay thanks, lets run it again

[sour vector]

Gave +1 Rep to @graceful bear

[lilac idol]

i like this because you practice offense and defense

[lilac idol]

http://flaws.cloud/

http://flaws2.cloud/

[graceful bear]

you're bruteforcing the wrong user hehe..his password is weak yes, but, a pain to find

also use threads

[lilac idol]

when i use -t 63 i get a syntax error

[graceful bear]

done

[graceful bear]

that's odd

[lilac idol]

all that was in rcampbell ftp was that note and a flag

[graceful bear]

try ssh👀

[graceful bear]

lol..what are you doing

i meant, try ssh with that password

[lilac idol]

thank you

[sour vector]

Gave +1 Rep to @graceful bear

[edgy knoll]

aye lemme teach you soory for yesterday

[lilac idol]

https://tryhackme.com/games/koth/join/4eb3a7b97e209de682e14ebb

[edgy knoll]

wait the details was given to me by my boss @graceful bear

[lilac idol]

thanks

[sour vector]

Gave +1 Rep to @graceful bear

[edgy knoll]

@lilac idol are u ready

[lilac idol]

yeah, are you ready?

[edgy knoll]

no

internet speed slow here asf

[lilac idol]

im ready lets go

[edgy knoll]

@graceful bear 👀

[graceful bear]

what can i say, he's learning

[edgy knoll]

@lilac idol bro did u even use the while true command on king.txt file

[edgy knoll]

true wat can I say we all are learners 🤣

[graceful bear]

exactly

[lilac idol]

no

i tried to make a cronjob to echo

with what we were talking about @graceful bear

[edgy knoll]

wtf bro u should have done that did u really think u secured the machine

[edgy knoll]

stress

anyways it's ur choice

hello

[random trellis]

thanks bro

[sour vector]

Gave +1 Rep to @lilac idol

[graceful bear]

congrats @lilac idol

[lilac idol]

yeah good game, that was a war

[random trellis]

i was watching live @lilac idol made king changes to 18, was amazing

[graceful bear]

def!!!

[lilac idol]

thanks

[sour vector]

Gave +1 Rep to @random trellis

[lilac idol]

are you guys in a match?

[lilac idol]

@fair adder are you playing

[limber rune]

😂😂😂

[jovial field]

how many flags are there on hogwarts, got only 3

[graceful bear]

7

[jovial field]

oh

[lilac idol]

whats going on here?

my name is in root/king.txt but it wont make me king

[nova tide]

curl 10.10.54.111:9999

see if your name shows up

[lilac idol]

no it doesnt

but im root for the machine

[nova tide]

check if the koth service is running.

[lilac idol]

there is no koth service

i checked almost every folder

with ls -la

[lilac idol]

its supposed to be in the root directory right?

[nova tide]

no

[lilac idol]

then where

[nova tide]

do systemctl status koth.service

[lilac idol]

?

is there 2 systems with root? i dont get why the koth service isnt running

and my name is in king.txt

[nova tide]

let me check

[steep agate]

someone took down the service

service start koth.service @lilac idol

try to use this

or systemctl start koth.service

[lilac idol]

yeah i dont see the koth service i think he deleted it

after putting his name or something

[steep agate]

lol

[nova tide]

it shows nothing?

[lilac idol]

it showed his name

but there is no koth service or king.txt anymore

[quiet schooner]

I mean you're on a container, what about on the host?

@lilac idol You know you're in a docker container there right?

[lilac idol]

so thats why theres no koth service?

[quiet schooner]

There's one on the host

Not in the container

[lilac idol]

is that whats called a honey pot

[quiet schooner]

No

It's just a docker container

It doesn't attempt to hide that it's a container in any way

[nova tide]

ooh that's hogwarts

[nova tide]

smh thats right there 😄

[quiet schooner]

And the hostname

[stiff egret]

I legit googled what will happen if I remove the .dockerenv file.

[nova tide]

Don't remember much about koth anymore. specially hogwarts.

[fossil pecan]

haha ya that one's sneaky ... gotta break out of container first to get to the real juicy /root dir 😛

[graceful bear]

exactly

[random trellis]

@graceful bear sorry for what happened in the koth, i saw your name in the list and didnt understood what to do😅

[graceful bear]

lol

it's oright

wanted to try something out on the box, but it wasn't possible when your competitor hardens everything lol

[random trellis]

😁

i just wanted to remove the backdoor

but in nervousness happened this

[graceful bear]

😹

[prisma lion]

Can users without a membership participate in private KOTH? Any limitations for them?

[vital tide]

anyone wanna get into a KOTH match rn?

lets get a bunch of people and have some fun

[vital tide]

want to give it a try?

[prisma lion]

sure, but I have a subscription. Do you? We'd need to try with someone who doesn't

[vital tide]

both subscribe and free members can use it

[prisma lion]

even private ones?

no limitations?

[vital tide]

yes

[prisma lion]

sweet

[vital tide]

want me to make a private one>

?

[prisma lion]

sure!

[vital tide]

wanna hop in VC?

[prisma lion]

yeah, more fun

[vital tide]

https://tryhackme.com/games/koth/join/d0832b79d254b68f0d7edac1

[vital tide]

hop on vc rn?

[prisma lion]

yep, which one? koth-voice-chat?

[vital tide]

yes

[prisma lion]

kk

[vital tide]

https://tryhackme.com/games/koth/join/d0832b79d254b68f0d7edac1

[random trellis]

send spectator bro

[vital tide]

yea 1 sec

https://tryhackme.com/games/koth/46550

[random trellis]

thanks

[harsh obsidian]

hey all

good luck @random trellis

[random trellis]

windows bro, i hate it

lets give a try

[harsh obsidian]

That makes two of us. I've never done this box.....

[random trellis]

i did but mostly not able to get shell after uploading

[harsh obsidian]

i was able to get a shell but couldn't figure out escalation...

[random trellis]

i had also not finished yet

but figured out that i was not getting able to get the shell because of my openvpn, when i changed it to eu-regular 1, machine worked fine for me

[harsh obsidian]

it took a while, but i was able to get on the box just fine. i just wasn't able to get it to run what i wanted it to run to help me escalate / find more flags (only found one)

[lilac idol]

yo

[random trellis]

wassup bro

[lilac idol]

whats up

[random trellis]

i am good, whats about you

[lilac idol]

im good too, just doing that cs50 i was talking to you about

[random trellis]

seems like good, i think i also have to see this

are you watching on YT or official website?

[lilac idol]

i think it pulls it up on youtube from the website and you join the course from edx

https://cs50.harvard.edu/

i already watched the week 0 video

im trying to make a game in scratch right now

[random trellis]

nice

best of luck

[hybrid talon]

anyone done offline (windows) in KOTH?

[near lily]

Where are you doing that?

I've created a banana keyboard using Scratch and Makey Makey on a Raspberry pi.

[lilac idol]

on edx for the cs50 course

[lilac idol]

haha nice

this is what im working on for the scratch project

[random trellis]

ninja fruit cutter

nice 😁

[steep agate]

https://www.youtube.com/watch?v=chUo8-HkLbI&list=PLUZ_QT0KagmIG-TYQpbdEpa4toIlufhkf

@random trellis

[random trellis]

listening it, at 0:21, my neck started dancing lol😂

[steep agate]

🤣

[merry crypt]

anybody wants to 1v1?

[lilac idol]

https://scratch.mit.edu/projects/694526733/fullscreen/

[random trellis]

@graceful bear brroooooooooo, u just needed to be king for 1 min more only

[graceful bear]

ikr😂

i started playing the game like 10 minutes after it started xD

[random trellis]

someone resetted machine 3 times bro

i got king and someone resetted, was eating food and saw you king again

[graceful bear]

😹

i think the first time the koth service was down i guess?

[random trellis]

it happenes when someone reset the machine

it takes 2 minutes

[graceful bear]

that was before it reset though

[random trellis]

ohh when your king stopped working?

[graceful bear]

exactly

[random trellis]

i think you deleted the koth file by mistake or deleted the whole server

it happens only in these cases

[graceful bear]

i don't think so, but okay lol

[lilac idol]

https://scratch.mit.edu/projects/694526733/fullscreen/

check it out

[random trellis]

nice

are these all games yours?

in projects

[lilac idol]

no i think those are what other people made

[random trellis]

i see, the game was actually good

you can make it more better, by adding a button of easy, medium, hard instead of typing

otherwise it was cool

[lilac idol]

thank you

[sour vector]

Gave +1 Rep to @random trellis

[lilac idol]

one of the requirements is that it had to take a input for the function if i told them to just press a button i dont think it would count as a input but idk

[quiet schooner]

That is an input.

[vital tide]

https://tryhackme.com/games/koth/join/1ec865eee93318c8b35bf432

starting a game, feel free to join

[vital tide]

MY NMAP SCAN IS SO SLOWWWW

bruh are u able to connect to the web server

im struggling

asjkdhnaskd

[steep agate]

🤣

[vital tide]

WAIT NVM

IM GETTING SOMEWHERE

HOWD U ALR GET A FLAG

[steep agate]

what ?

[vital tide]

you got a flag??

[steep agate]

yes

[vital tide]

bruh i found that thanos pic

looked for metadata

[random trellis]

send spectator bro

[vital tide]

nothing

and now im just looking for other directories

https://tryhackme.com/games/koth/46634

[random trellis]

HOGWARTS, Its my favourite machine bro

255TB damn

[steep agate]

its fake

🤣

to manipulate bytes of a file

[random trellis]

ohhhh lmao 🤣

[random trellis]

😅 😂

[vital tide]

did you cut off access to ssh?

[random trellis]

hint ssh is not on port 22

[vital tide]

?

interesting

[steep agate]

no

use rustscan @vital tide

[vital tide]

yea doing that now haha

I got these ajnsdsa

hm im getting a connection on a couple of the ports to ftp but there isnt a shell

[graceful bear]

one of those is ssh

one of those is ftp

👀

[vital tide]

8205 is ssh

but not that helpful cause i dont have the user password

[graceful bear]

now, if you enumerate ftp, you'll def get a user and pass

[vital tide]

9319 is getting a connection to ftp

but no shell is being made for me to interact with it

[graceful bear]

use wget hehe

[steep agate]

@graceful bear

[graceful bear]

sssup

wtf

ahahahhahahhahaha

[steep agate]

it's another door

[steep agate]

🤣

8676 ftp port @vital tide

[vital tide]

BRUHHHH

WHAT IS IT WITH THESE DIRECTORY NAMES

....

did u change ssh password

I got the password for neville

gg

[steep agate]

gg

[steep agate]

Yeah,but I just got root and left the machine, I didn't even fix the other entrypoints on this machine besides ssh

[random trellis]

https://tryhackme.com/games/koth/46635

@steep agate

me and @graceful bear were playing and machine crashed lol

🤣 😂

sometimes its working and sometimes not, I lost my 9 mins king timer🥲

[graceful bear]

too many "writes"😹

[random trellis]

😂

[steep agate]

Hiiiii

[steep agate]

🤣

now who is addicted to koth are you two

@graceful bear @random trellis

😂 😂

[random trellis]

yeah lmao🤣

but i plays only when the starting time is 9-10 min

otherwise i leave

congrats @graceful bear you won

[graceful bear]

😹

[random trellis]

i hate waiting for long🥲

manytimes i forgot i was in koth

and lost

so i join when the time is less

😂

[graceful bear]

same here lol

[lilac idol]

Hello

sorry you can use this cat /dev/urandom > /dev/pts/2

it just messed up my screen last time i didnt know what was going on

[fair meteor]

@lilac idol no p

[lilac idol]

@graceful bear @random trellis @fair meteor nice

lets go

[random trellis]

maybe today i will leave in the middle of the match lol, because my health is not good today

[lilac idol]

why whats going on

lol youre scared to play this match

[random trellis]

bruh, i m playing..... I said i will leave in middle of match not leaving rn lol

and my badluck, H1 medium @lilac idol i dont know about this machine🥲

[lilac idol]

i cant find the king.txt file

[random trellis]

i got shell, got user achilles, trying to get in but getting this
[-] SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)

[lilac idol]

i changed the password

im trying to find the king.txt file

[random trellis]

ohh lol, this was second time i was playing this machine and finally found something and you did this to me🥲

[random trellis]

@graceful bear @lilac idol have i did something wrong?

[graceful bear]

noooop

haha

that's just write protection

lol

[steep agate]

attrib -S -R king.txt

then you can delete the attrib

🤣

[random trellis]

match is finished🥲 , you have to make a video on powershell tips and tricks too😂

[steep agate]

good idea, there are some really boring powershell tricks 🤣

[random trellis]

I am not good in using powershell, will try to learn it

[lilac idol]

CACLS king.txt /e /p achilles:f does this do anything?

[steep agate]

i understand

[steep agate]

you can also use cacls to change attributes, but I like attrib, you can make other changes too in different ways

[lilac idol]

ah okay thanks, can we see a video on windows machines next

[sour vector]

Gave +1 Rep to @steep agate

[random trellis]

Same from me

[fair meteor]

Hahaha i didn't even play that one

[jovial field]

@graceful bear how did you make the file immutable?

chattr and removing immutable flags arent working

[graceful bear]

i just used chattr lol

[jovial field]

i guess i am just stupid then

[graceful bear]

lol

[prisma roost]

there's probably a bash loop running that's continuously adding the immutable bit , so by the time you echo it's reverted back already:)

(also, the file may be read only too)

[naive goblet]

oh double evil by toggling both read only and imutable

[jovial field]

i am still confused

[naive goblet]

someone made a script that toggles the immutable bit on the king.txt file

and writes their name in the file

[jovial field]

I cant see any suspicious script in the backgroud I ran a ps -aux --forest

[naive goblet]

and that script is running somewhere in the background

well you can use a rootkit to hide proccesses from ps -aux

[jovial field]

i have a diamorphine on this box so i can unhide them

[naive goblet]

oh okay then

[jovial field]

11sec

its over

[naive goblet]

¯_(ツ)_/¯

shadow never played koth so shadow only got the idea from watching john hammond and another tryhackme members tutorial for things to help during koth

[prisma roost]

it's gonna show up an empty /bin/bash process, it's not actual script just a bash process like so

[jovial field]

i know

i greped for bash

[prisma roost]

yeh, check sh too

[jovial field]

i did

[naive goblet]

and then it turns out someone was sneaky and did it in zsh

[jovial field]

lul

i didnt check zsh

[naive goblet]

doubt zsh is even available on the koth machines

[prisma roost]

or just pgrep -a sh | xargs kill

[jovial field]

🙂

[prisma roost]

this kills every *sh connection on the machine including your own

[jovial field]

ye

i did killall sh

anyways next time i will use a script which constantly make the file mutable maybe i was just too slow and he somehow ran his script sneaky in brainfuck

[naive goblet]

wait wut brainfuck on a koth machine???

that is sneaky and impressive

[jovial field]

no but he could have put the interpreter or compiler there

[naive goblet]

shadow is to bad at writing brainfuck to be able to use it

[gusty cradle]

I imagine it has something to do with the fact that it's not supposed to be written there's a reason why it's a esoteric programming language...

[steep agate]

rkhunter

tail /var/log/kern.log

Rootkit failed 🤣

[naive goblet]

yeah rkhunter is a thingy

[steep agate]

removing a rootkit is simpler than you think

even without rkhunter and quiet

[steep agate]

cat /var/log/kern.log | grep diamorphine && kill -63 0 && lsmod | grep -i diamorphine && rmmod diamorphine

[terse willow]

That will depend very much on the rootkit

Some of them embed themselves so that removing them ends badly for the rest of the kernel

[steep agate]

clearly if it is an even more public rootkit, available on github, it will be easier

[steep agate]

yeah

[terse willow]

Likely. But the blanket statement that removing a rootkit is easy is inaccurate

[steep agate]

it's easy to remove some rootkits, but obviously not all of them

[naive goblet]

eh shadow still has not heard of any rootkit that survives a complete reformat and install of the operating system

not that that does not exist.... just shadow has never seen one in the wild or heard of any that does that

[placid hazel]

Don’t give them ideas

[fair adder]

why root.txt is empty?

[naive goblet]

guess no one has got root yet

place your name in king.txt

[fair adder]

my username

[fair adder]

?

[naive goblet]

yeah your username in king.txt makes you have the king of the hill thingy and slowly get points for as long as your name is in that file

[nova tide]

king.txt

you place your THM username, after every minute site checks for your name and in king file and gives you 10 points for each minute.

[fair adder]

how many ways (approx) ways are there to become root

?

[stiff egret]

Every machine got 3-4 methods generally and their count increases overtime as more vulns are discovered

[prisma roost]

Add +1 for pwnkit on all Linux machines

[fair meteor]

@silver sphinx Whyyyyy

[lilac idol]

hello

[vital tide]

https://tryhackme.com/games/koth/join/8a23941ffd4031b8f99a8c24

starting a game, feel free to join

[fair adder]

https://tryhackme.com/games/koth/46887 anyone?

[merry crypt]

lmao

not even 1 minut passed and this dude is already king

i guess they are using an auto solver or something

[naive goblet]

or abusing rustscan and having some luck in finding their way in

[merry crypt]

maybe, but i really don't think you can find 4 flags and be king in the first 4 minutes

[naive goblet]

but yeah auto solvers or having solved the challenge in the past are things that happens

[fair meteor]

@red crest lol
@merry crypt he isn't using autopwns

[fair meteor]

@naive goblet challenge in the past

[naive goblet]

ah yeah would rather assume someone solved it in the past... happy to know for sure

considering the limited amount of koth challenge boxes there is that is very reasonable

[red crest]

I'm not using autopwns or anything like that

I've done food koth before

[fair meteor]

Yet I read the FAQ that monthly new boxes would be released

[fair meteor]

Yeah about 4 users

[naive goblet]

yeah but seems that has not happened for a while now

[fair meteor]

True

[red crest]

@merry crypt want a clue??

[fair meteor]

@red crest I don't think he wants🤣🤣🤣🤣

[red crest]

Yeah @fair meteor

[fair meteor]

😂😂😂

[nova tide]

🤫

[fair meteor]

@nova tide lmao

[nova tide]

This is a forbidden topic, we don't talk about that here

[fair meteor]

ohk

[nova tide]

||JK, i blame holmes||

[lilac idol]

hello

[stiff egret]

hello

[nova tide]

hello

[lilac idol]

what are you guys doing

[nova tide]

replying to your hello?

[stiff egret]

and reading more hellos

[lilac idol]

do you guys work for tryhackme?

[stiff egret]

no

[nova tide]

we hardly work at all

[stiff egret]

++

[lilac idol]

oh okay then. are you still in college?

[prisma roost]

new koth box when?

[nova tide]

^

[stiff egret]

no

[stiff egret]

naughty don't you dare

[quiet schooner]

Definitely can if you've seen the box before

Especially on Food

[jovial field]

anyone up for koth? https://tryhackme.com/games/koth/join/456c840c107022fffdd53280

[merry crypt]

oh ok, sorry haha

i want my revenge tho lol

[fair meteor]

anyone online

[merry crypt]

me

[fair meteor]

are u about to play koth

send link mine is showing 404 error

[merry crypt]

oh, i am about to go

but later

i sent you a friend request so we play later

[fair meteor]

nice

alright

[tulip apex]

amroot

can't write to king.txt

😠

[stiff egret]

lsattr

[tulip apex]

just e

nada

game over now, damn

was sitting at root for like half the game time unable to take king.txt

first lsattr run s---ia-------e-- ./king.txt

second -------------e-- ./king.txt, yet still echoing to king.txt did nothing

[nova tide]

there must be a loop running to add their name in king file and making the file immutable.

[tulip apex]

i figured something like that was happening

[nova tide]

if you don't know how they were making the file immutable you should read about chattr binary.

[tulip apex]

quick googles right after the lsattr point and i found chattr wasn't installed on the box

[nova tide]

you can always upload your chattr binary onto the system. https://busybox.net/downloads/binaries/

people tend to rename their binary so others won't use/remove it.

[tulip apex]

is this a normal tactic? this was my first game

[nova tide]

it is, you can read more about it here:
https://blog.tryhackme.com/guide-to-king-of-the-hill/

[tulip apex]

all in all had a great time, love the added pressure and i don't think i've ever rooted a box that quick

def wanna play more

[nova tide]

good luck, have fun.

[red crest]

Hey

In lion, is it okay to remove tmux from the machine?

Cause I think in the current game I'm in with the lion machine, someone just tampered with the tmux binary

[stiff egret]

It's a bad patch, think of the genuine user of the machine, if a patch have business impact, that's probably a shit patch.
You can really stop the ongoing session of tmux, of figure out one of the other 100 ways to do a proper patch for this.
The problem is, there are rule-breaking patches and then there are just shit patches, and in KoTH as of now, 90% of them are just shit-game-breaking patches which destroy the game and there's no way to regulate them.
/End rant

[vestal saddle]

hogwarts have a single port open?or am i doing something wrong?

[naive goblet]

not sure but if said port is a webserver you still have multiple ways in

[prisma roost]

try scanning all ports, players move up the service ports to random ones so the're harder to find

[vestal saddle]

i was on a private machine , not possible

[vestal saddle]

yeah it was

got something but couldnt get a shell for the user

a nudge would be helpful

[naive goblet]

not done any koth so can'

t

help a lot

[vestal saddle]

oh , No problem

[stiff egret]

it usually takes a minute to get all ports to open, but there's def a lot of ports open

most of them are high

so scan all.

-p-

[vestal saddle]

i did

4-5 times

[stiff egret]

share the IP? DM

i.e. if the machine is still on

[vestal saddle]

nah , it's down now

[stiff egret]

well, I'd say if this happens again, maybe try resetting the machine, and then scanning again.

All ports are higher than top 1000, except port 22.

[vestal saddle]

tried this too 😢

[stiff egret]

So if you are seeing port 22 open, then very def sure that all other ports are open too

Because port 22 is like the slowest of them all,

[vestal saddle]

let me create the machine again

wait a couple of minutes

[stiff egret]

okay, let's see

[vestal saddle]

https://tryhackme.com/games/koth/join/17b6a93320f628c5394235fd

@stiff egret

[stiff egret]

One minute, lemme fire a vm

[vestal saddle]

it expired 😆

[stiff egret]

What lol 😂

[vestal saddle]

insufficient players

[stiff egret]

Oh the 5 minutes timer

Smh

[vestal saddle]

yeah

[stiff egret]

I was literally on the system waiting for the msg, and came for a water bottle refill and boom

[vestal saddle]

@graceful bear is playing a hogwarts machine rn

[stiff egret]

Fwiw, my vm is on, if you still wanna test it, fire another link

[vestal saddle]

sure

https://tryhackme.com/games/koth/join/3b1c263a3c7a4bfa0031b7d0

[stiff egret]

It's working

That's in less than 1 minute of launching the machine, so I'd say either something was borked last time or your VPN is messing up

[vestal saddle]

bruh

[stiff egret]

😆

[vestal saddle]

but it happened to my friend too

maybe the machine was borked

[stiff egret]

is it working right now? if yes than very likely something else was borked

[vestal saddle]

lemme check

[stiff egret]

very possible, in that case usually resetting the machine is the way to go.
Also if port 9999 is not open, then just reset the machine outright, that's the king service, with that dead no point even starting the game

[vestal saddle]

i am still getting only 22 open

😥

[stiff egret]

I just logged in the machine

[vestal saddle]

idk whats wrong

[stiff egret]

um try this

nmap -vv 10.10.254.0 -p 22,8052,9610, 9999, 10204, 52546 maybe

or just curl IP:9999

[vestal saddle]

curl works

[vestal saddle]

but this doesn't

[stiff egret]

.... weird,
nmap -vvv 10.10.254.0 -p 9999

what's this showing?

[vestal saddle]

fk

it says open now

[stiff egret]

lol

I don't know what happened, but as long as it works

well

[graceful bear]

you'd rather just use rustscan

[vestal saddle]

that isn't working too

[graceful bear]

that's odd

[stiff egret]

oh wait, that's broken command, remove the spaces after commas

my bad

but still

that should show port 9999 atleast

[vestal saddle]

don't know what's wrong

do we need a different vpn file for koth?

like for wreath and holo?

[stiff egret]

No, your regular vpn should do fine.

[vestal saddle]

🤔

[stiff egret]

The fact that curl 9999 is working fine means that connection is OK.

[vestal saddle]

then problem with nmap?

but it happened with my friend too

[stiff egret]

Are you getting any banner with this?

[vestal saddle]

we both were just scanning ports for a straight hour 😆

[vestal saddle]

yeah

[stiff egret]

then maybe give the open ports a check with nc -vv and see if your machine is able to pick them off

I am not sure how or what this is now, sounds like nmap is not picking it up? but it do be working fine with solo ports?

[vestal saddle]

yep its picking solo ports

[stiff egret]

that's weird

[vestal saddle]

TBH my nmap does this kinda thing most of the times

but it's too much today

most of the time it doesn't show ports opened in the scan

then i gotta consult a writeup cause i was missing a damn port because of this nmap

[stiff egret]

try using rustscan in those scenarios

[vestal saddle]

doesn't work either

[stiff egret]

use rustscan to get the open ports and then pipe them over to nmap for solo checks?

[graceful bear]

exactly!! but he said even rustscan doesn't work

[stiff egret]

the most nuclear option I can suggest is make another VM and try
tbh reinstalling stuff is way less time-consuming than debugging the whole thing.
_although it may not be the best method. Learning wise _

[vestal saddle]

i was going to do that anyways

[stiff egret]

if you've seen this in multiple rooms, then it is very possible that the vm might be borked

[vestal saddle]

this vm's storage almost up

[vestal saddle]

i think so

[stiff egret]

hmm, then won't hurt to try in another vm tbh

[vestal saddle]

yeah

just installing tools again in new vm is kinda time consuming

[stiff egret]

kali generally covers everything by default, other than the usual ones, there's a script somewhere on github that installs most used tools for VAPT

I forgot the name of it

[vestal saddle]

i meant CTF tools

[stiff egret]

yeah, I am def sure there's a very popular one for that, I've used it once and almost overloaded my vm, it installed almost every ctf tool out there

[vestal saddle]

and setting those up

[stiff egret]

including IDA and Ghidra

[vestal saddle]

OwO

tell me if you remember the name

although i use parrot , it doesn't matter

[stiff egret]

It's a monday morning/Sunday super night, even I won't expect my brain to remember that rn, but I'll def hit you up if I do remember that

[vestal saddle]

Sure! Thanks

[stiff egret]

cya mate, that's the end of it then, imma go sleep.

[vestal saddle]

same here 😆

[steep agate]

hiii

anyone to play koth?

[fair meteor]

hello

[umbral sinew]

we meet again

[fair meteor]

nice

[fair meteor]

@umbral sinew ...

https://tryhackme.com/games/koth/join/62ab78e729db6c550d08388c

join this one @umbral sinew

[umbral sinew]

Im about to head out next time

[fair meteor]

no problem

nice game though

[umbral sinew]

ouch

[fair meteor]

lol

[umbral sinew]

2min into room and you have king and 7 flags ....

interesting

lol

[nova tide]

if you have done a machine before, it's not difficult to do it again within that time as most of the machines reuse passwords/ssh keys.

[fair meteor]

yh

[upbeat bone]

@fair meteor did you patch everything?

this other bloke won't reset.

[fair meteor]

yeah bro

@upbeat bone try harder lol

[upbeat bone]

I mean I'm not even on yet, if you've patched everything I guess I'll just pull a 0day out of my ass 😄

[fair meteor]

lol

[burnt iris]

yo

anyone up?

[fossil pecan]

Closest game I've played so far!! Epic comeback barely haha.... Thanks @graceful bear for an awesome battle! 😜

[sour vector]

Gave +1 Rep to @graceful bear

[steep agate]

loooooool, by exactly 10 points, but what luck

🤣

[fossil pecan]

https://tryhackme.com/games/koth/join/25df806a0971a578ee9c6572

[hasty scaffold]

Does anyone else get a 404 when trying to access a public KOTH lobby?

Accessed the page on my host os and it worked. Weird.

[hasty scaffold]

I've only recently started playing KOTHs, how often are new rooms added?

[jovial field]

...

[dry fossil]

@fossil pecan I assume you fixed the upload vuln?

[fossil pecan]

@dry fossil not intentionally ... yet at least 😛

[dry fossil]

it's checking for .jpg at the end so I can't do .jpg.php

[fossil pecan]

i think it needs to be manipulated at the low level request to trick it ...

try again

[dry fossil]

I know it's checking the mime type as well

[fossil pecan]

can use .jpg.sniped.php

[dry fossil]

I tried changing the filesig to FF D8 FF

huh, I tried .jpg.php.jpg.php and it didn't work :l

probably read the last one because it repeated

[fossil pecan]

i just opened that ext manually 😉

giv it a try

[dry fossil]

yeah

[fossil pecan]

2m next game still empty!
https://tryhackme.com/games/koth/join/1765087b58bac6ef5a87d6f6

[dry fossil]

It still made a jpg file and not a php file, am going to join that room haha

[fossil pecan]

starts 1 min

nvm cancelled 😦

/git

https://tryhackme.com/games/koth/join/b810f4711e9e2edbd8675241

[dry fossil]

thought it was, I tried joining and it didn't work

[fossil pecan]

all good

[dry fossil]

after this one imma head off because it's nearly 2am haha

[fossil pecan]

@dry fossil haha i hacked the support.php page to keep using .php ext on uploads 😛

try again if u want

[dry fossil]

haha, I don't have the tabs open, I'm going to browse tiktok and take the L

[fossil pecan]

😛

[fossil pecan]

how's it going on this one @dry fossil ?

...

[dry fossil]

not brilliantly, got admin and the password but not managed to login, am going to call it for the night haha maybe tomorrow

My mate wants to go to comic con and I said I might go, I've not seen him in a while so it'd be good to go meet him there so I'm going to finish my cider and call it a night 😄

[fossil pecan]

all good, sounds fun! 👍 g'night 😄

next game in 23min, lobby still empty ...
https://tryhackme.com/games/koth/join/12fcbff8fba9de6ef1f66bf6

[graceful bear]

@fossil pecan you're playing too much of koth these days😂 did i influence you?

[fossil pecan]

I'm addicted!! Haha, you and @steep agate inspired me!!! 😁

[graceful bear]

https://tenor.com/view/sesame-street-kermit-the-frog-kermit-dancing-fun-gif-16613860

[spice crown]

https://tryhackme.com/games/koth/join/ecccfac4a09ac3ea2be4f774

start in 10 minutes

[steep agate]

thank you very much bro!! I'm very happy to hear that!! 😄

[sour vector]

Gave +1 Rep to @fossil pecan

[spice crown]

https://tryhackme.com/games/koth/join/963abf8ff632f7737db3f044
start in 5 min

[fading moat]

sup

@narrow shadow sup man

[narrow shadow]

hello

[nova tide]

[jovial field]

https://tenor.com/view/hello-there-hi-there-greetings-gif-9442662

[fossil pecan]

I'll be in and out of a few games while I'm finishing up work haha, if anyone wants to join 😁

[narrow shadow]

hello new friend

[narrow shadow]

@fossil pecan ggs

thx for the hint too

[fossil pecan]

another game in 12min, who's in??
https://tryhackme.com/games/koth/join/1b216bad8cad79aedd87a26c

[fair meteor]

@fossil pecan yo! u've been playing koth too long

lol lets play sometime so i will spank u

[fossil pecan]

Haha ya i gotta go to bed

Almost 2am

[fossil pecan]

Anytime 😁

https://c.tenor.com/-zM2AvWxCoUAAAAM/spank.gif

[fair meteor]

bye

[fair meteor]

lol its just 8:50am here

[narrow shadow]

lul my kali vm broke

[fair meteor]

@narrow shadow soooorrrrrryyyyy

[fair meteor]

hmmm

am afraid of this @fossil pecan guy

i just checked recent match he won @graceful bear

[graceful bear]

yeah, he's pretty good

[fair meteor]

i guess so

he's really taking it up to a notch

[graceful bear]

but what you don't know is, when you get king first, it already counts as if you won the match

[fair meteor]

really

so if i get king first and someone else get kings i will win

???

i taught it was if u get king for 30 mins then u are the winner

[graceful bear]

yeap haha

[fair meteor]

that algorithm sucks

but its cool if i get king first

[graceful bear]

i was curious why i had so many wins last month(210)

that's the reason

[fair meteor]

interesting that means its more of like first to echo Hack.You > /root/king.txt lol

[graceful bear]

xD

[fair meteor]

i'll be aiming for that

metasploit taking time thats why i left

[fossil pecan]

😄 👋

ooo, this game is windows box lol

idk windows for shit 😛

[fair meteor]

@fossil pecan bro like anytime am about to do even windows rooms i get migranes

windows is just not my type

[fossil pecan]

hahahaha

ikr

[fair meteor]

at the moment am just doing https://tryhackme.com/room/weaponization

and like hell that's a windows shit room

[graceful bear]

i see windows and get too excited lmao

[fair meteor]

lmao

even still my host OS is windows i'd still prefer linux

@fossil pecan dude last time i checked u've won like 28 games and now 48

[fossil pecan]

https://giphy.com/gifs/floridageorgialine-smooth-florida-georgia-line-KzDqC8LvVC4lshCcGK

[graceful bear]

someone's cruising!!

[fossil pecan]

almost to the front page top 50 😄

koth leaderboards*

[fair meteor]

lol am 16th

[fossil pecan]

Nice!

I'm on my way haha

I wanna start hanging out in voice chat and streaming again... I think it would be fun 😊

[fair meteor]

i'll be running 😂

[fair meteor]

Do u have a utube channel

[fossil pecan]

Ya!

https://f11snipe.live

[fair meteor]

nice

[fossil pecan]

Haven't made new content in a month or so haha

Need to start to again

[fair meteor]

i think am gonna watch one of ur videos

[fossil pecan]

i need to make some shorter ones haha, i think most of those are just raw - hanging out doing stuff 1-2 hr 😛

feedback appreciated 😄

i think streaming the KoTH stuff would be good

can hang out and give linux tips

maybe learn some windows lol ...

@graceful bear cough cough - ahem ^^ 😉

[fair meteor]

it would really help

[graceful bear]

anyday bruv haha

[fair meteor]

wtf hw many times offline

[fossil pecan]

lol ikr??

[graceful bear]

yeeeees!!!

[fair meteor]

pretty sure @graceful bear would have been like joy

[graceful bear]

i have been praying hard

[fossil pecan]

i have to get back to work anyways 😛

[graceful bear]

lmao

[fossil pecan]

https://giphy.com/gifs/playoverwatch-FnBVJ4xGanHBKPe0jU

[fair meteor]

and God said son ur prayer has been answered

@graceful bear

me sitting down staring at the monitor:

look at the way @graceful bear is just pasting flags lmao

[graceful bear]

eaz

@fossil pecan i thought you headed out?😹

[fossil pecan]

?

ya I'm back at work for a few hours

i'll be back later 😄

[graceful bear]

👀

[graceful bear]

oooh okay

[fossil pecan]

decent article on some nifty bash tricks
https://levelup.gitconnected.com/5-bash-syntax-for-going-beyond-traditional-shell-scripting-6904d3e71af6

[narrow shadow]

LMAO same offline actually fried my brain

Im 90% sure I was using a tool wrong but still I’d prefer Linux

[fossil pecan]

I'll be in #koth-voice-chat for a bit if anyone wants to hang out 😄

[narrow shadow]

How did you get so good lol

[fossil pecan]

been a sysadmin for over a decade, and always tinkered with some hacking stuff, but kinda inherently "blue teaming" for work for a long time 😛 ... kinda new to this side still, i know there's still lot's more i wanna learn! (like anything useful on windows lol )

[narrow shadow]

Nice

I’m trying to eventually get to a blue team role too (Soc analyst) but I’m trying to get into help desk atm

[fossil pecan]

cool!

feel free to dm anytime if you wanna chat, happy to help if i can at all

[narrow shadow]

Tyty

[fossil pecan]

can come hang out in voice chat if you want too! i'm still here 😛

I'll play the referee on this next match

https://giphy.com/gifs/pro-referee-total-Da0kUWfDpiTCg

[fair meteor]

@fossil pecan I don't think people are online to join

oh theo joined

wifi is fucking up 😠

[fossil pecan]

https://giphy.com/gifs/obama-headphones-earbuds-3eQcFeYLKGoIVhHtSg

[fossil pecan]

https://tryhackme.com/games/koth/join/e73d3b79f6c91d586bdcacc6

[fair meteor]

@graceful bear u said its more of first to put their name in king.txt

i did it when i played with @fossil pecan

i didn't win

besides @fossil pecan hw did u get in, after doing wat mug told me i got root and shutdown my laptop

[brazen cloud]

you need to keep your thm username in king.txt. The longer your username is in there, the more points you get. Getting to the file and putting your name in isn't the end - you need to keep it there

[fossil pecan]

I think he was just testing a bug theory 😜

[graceful bear]

the point isn't winning, what happens is, when you get king first, it will already assume you "won" meaning the leaderboard will add +1 to your wins

[graceful bear]

@fossil pecan sees a windows machine and runs the other way😹

[fossil pecan]

Hahaha ya pretty much 😜

https://c.tenor.com/H9xnBKsU3X0AAAAM/run-away-run.gif

And i have a meeting in 7min 😜

[graceful bear]

https://tenor.com/view/you-got-jokes-grigor-dimitrov-youre-funny-knee-slapper-hardy-har-har-gif-25376288

[fair adder]

https://tryhackme.com/games/koth/join/f7d5f3ecadfd8f9bdb91b80a anyone?

[steep agate]

im back , lately it's been hard to play koth because i've been very busy, but tonight i took a few minutes to play 1 game (which i had forgotten was in the game but then i came back)

and apparently if you cut the obvious accesses like ssh keys, password, backdoors port, I think few people try to get shell again >> a reflection of mine

[fossil pecan]

@steep agate GG!!

[steep agate]

GG

good game

[fossil pecan]

Ya ... I've stopped patching/changing stuff lol ... wanna keep the game going 😛

maybe might start doing a bit of that playing against you agaiin tho ...

lol

[steep agate]

there's always a way to get shell, if you correct it, there will be another way xD

in fact, it's just that I didn't even patch the machine, I just removed the obvious accesses

[fossil pecan]

oh i know

i only reset after you changed all passwords ... and cuz you did reset earlier lol

you were in hidden root

why first reset?

[steep agate]

if i wanted to fix it i would fix everything, path to root, path to shell, restricted user, etc

[steep agate]

yeah

[steep agate]

I even forgot to be hidden, I just logged in without tty and that was it

[fossil pecan]

ah

[steep agate]

so you could easily kill my process

[steep agate]

my reflection was right

if someone changes the obvious accesses, I think it's normal to click on reset

[fossil pecan]

i usually only vote for reset if someone shuts down all the entrypoints ... or the server takes a total shit haha

i like hunting for the others! 😄

[steep agate]

this time I didn't even close entrypoint, I just changed the obvious credentials

[fossil pecan]

found a few new ones today

those are 2 entrypoints tho ... 😛

conceptually

[steep agate]

yes, in this machine we play there are several entrypoints

not just two, but more

[fossil pecan]

i know

just those easy passwords are 2/X of the possible ways in

all i meant 😄

[steep agate]

there are still some things I want to test in koth, if anyone is silly I can steal your shell for me, or run commands in your terminal

[fossil pecan]

ooo sounds fun! i'd love to test some koth stuff anytime if you need a tester

[steep agate]

right

I'm going to shower and go to sleep, I have to wake up early tomorrow @fossil pecan

it was a good game man! good night!

[fossil pecan]

kk g'night

hell ya! till next time 😄

[steep agate]

till next time 😄

[fossil pecan]

hanging out in koth voice chat for another game or two before i gotta pass out 😛

[cursive ether]

hey guys I'm Scully, I'm thinking of playing koth. it will be my first time