room-bugs

[spare mirage]

No it's not a bug . It's common for app logic to blacklist certain input and not to blacklist other 🙂

That's a misconfiguration that's done on purpose in this room 🙂

[round cove]

Did this ever get resolved?

[cobalt lily]

I am doing password attack in protocols and server 2 and I typed I think the correct syntax to retrieve the password, but it stay blocked on status and i can’t get the pass

[round cove]

@cobalt lily, do you see packets leaving your attack box? Ex. run tcpdump in a different terminal looking at port 143.

[cobalt lily]

Like in what way? What do I type?

[round cove]

Ex. tcpdump -nnpi tun0 port 143

[cobalt lily]

Why I have to do it?

[round cove]

Oh you are using the Kali VM.

[cobalt lily]

Kali

[round cove]

You don't need tun0 just eth0 or whatever the interface label is.

[cobalt lily]

But why? On the tube i saw they use hydra

[round cove]

To see if packets are actually leaving the attack box and it's just not stuck.

[cobalt lily]

Oh

[round cove]

If it was working you should see a lot of packets going to the target.

[cobalt lily]

But why the packet are not leaving? I typed the string you told me but the system doesn’t recognize tun0

Ok I can install it maybe

[round cove]

Read up. Since you are using the Kali VM from within the browser you would use eth0 instead of tun0.

[cobalt lily]

The system doesn’t recognize even the eth0

[round cove]

ip addr list will give you the interface labels.

[cobalt lily]

Maybe there is another way to see if packages are Lea ing

Leaving

[round cove]

Which room is this?

[cobalt lily]

Protocols and servers 2

[round cove]

Got it. Let me take a look.

@cobalt lily tcpdump -nnpi ens5 port 143

It's just a way to troubleshoot. Look at packet leaving the box.

Run that in a different tab while you are running hydra.

[cobalt lily]

My attackbox doesn’t let me run two box in the same time but I try

[round cove]

Create a second tabl in the terminal

[cobalt lily]

Wait maybe I didn’t type the pass 🤣

I solved

Thanks

[round cove]

lol. okay

The username in screen capture is not the right one too.

[round cove]

bump

[quaint sparrow]

It's a bug with the input entry

[round cove]

@quaint sparrow, so there's no workaround? I don't know if I can survive leaving the room in this state with one unanswered question. 🙂

[quaint sparrow]

Not ATM

[round cove]

Thank you.

[smoky berry]

the oder of the kill chain seems to be pretty messed up in the "Incident handling with Splunk" room

[exotic flame]

hello
[8:13 PM]
I keep getting unable to connect error in Attackbox when trying to access IP address through firefox
[8:13 PM]
Splunk 2 Room

[fresh kernel]

any solution of getting timeout after using ssh?
i can use ping fine but ssh just doesnt work

[spare mirage]

You're using your own machine or AttackBox ?

[fresh kernel]

AttackBox

[spare mirage]

Which room ?

[fresh kernel]

https://tryhackme.com/r/room/meterpreter

ssh: connect to host 10.10.218.239 port 22: Connection timed out

[spare mirage]

Why do you need ssh here ?

This is Windows machine

[fresh kernel]

Username: ballen

Password: Password1
what im i supposedto do with these?

[spare mirage]

Those're SMB credentials

[fresh kernel]

🤦‍♂️

[spare mirage]

It can take up to 10-15min for that machine to fully boot up

[fresh kernel]

thx for the help

[woeful zodiac]

On the search skills section it says to use shodan to see what country uses lighttp the most but it only shows 404 not found in Brazil on shodan

[final nebula]

Metasploit: Meterpreter room task 5.
The hint: In the Meterpreter prompt: You will need to migrate to the "lsass.exe" process first (ps will list its PID), then run "hashdump".
When trying to migrate the session dies. I followed youtube to get the correct first answer first but only my sessions dies. This should not happen?

meterpreter > migrate 736
[*] Migrating from 2912 to 736...

[*] 10.10.195.105 - Meterpreter session 1 closed. Reason: Died

[radiant slate]

Task 2 Blue
msfconsole -q
exploit/windows/smb/ms17_010_eternalblue
set rhosts <ip_target>
set payload windows/x64/shell/reverse_tcp
run
now i have 150 session opened and it doesn't stop

[tight barn]

OWASP Juice box questions unreadable on dark mode

[serene vector]

Hello, I just wanted to report a possible human error in the description for the SOP in SOAR room part of SOC analyst lvl 2 path.

It does estate the same-origin policy SOP description
instead of the Standard Operating Procedures also abbreviated as SOP or SOPs

This would be spotted in task 3.

[light vine]

in https://tryhackme.com/r/room/gobusterthebasics I am running into an issue. Task5 Question #2 wants you to enumerate www.offensivetools.thm but will not enumerate. When I plug in the ip address instead of the website I still find the secret directory, but as far as I can tell offensivetools.thm isn't accessible in VM or even outside of it, or anywhere.

[spare mirage]

Try to add domain to /etc/hosts

[light vine]

I finished the room some time ago.

[spare mirage]

Great job , congrats 🙂 🚀

[light vine]

oh ty.

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2414)

[earnest jetty]

I think it should be mentioned within the room itself, the only part that's being mentioned is to edit resolved.conf

[spare mirage]

Yup , you're right 🙂

[wheat fractal]

Working through the MISP room in dark mode and in Task 4, there's a graphic in the Taxonomies section that is barely legible in dark mode

[tender cove]

#general message
not sure if i am wrong here or the picture is
but please check out my above linked message in #general

[spare mirage]

Yup , you're right 😄

[uncut sandal]

Is this command causing any bugs as it starts the nmapping but doesn't progress:
nmap -A -sS 10.10.41.135

[quaint sparrow]

You're going an aggressive scan stealthily, you'll be there for a while.

[sweet cloak]

Black color in the room : https://tryhackme.com/r/room/javascriptbasics Task 5

[uncut sandal]

Okay, so just waiting then? Would there be a smarter way?

[quaint sparrow]

Either dropping the -Ss or -A

[uncut sandal]

Having the same issue with a few rooms. You can mark the text to make it white

[uncut sandal]

Fair enough. So nmap -A -10.10.41.135 should do the same job but just not stealth, right?

[quaint sparrow]

Yeah, will still be slow though.

[sweet cloak]

yeah i know but it's a problem of color it should be white intead of black

[uncut sandal]

Thanks and that's fine

[livid escarp]

Gave +1 Rep to @quaint sparrow (current: #1 - 3301)

[glad badger]

Fixed. Thank you for reporting. 😎

[livid escarp]

Gave +1 Rep to @sweet cloak (current: #2621 - 1)

[spare mirage]

You can press Enter while nmap is running to check the progress 😄

[uncut sandal]

Oh that's cool. I just learned -v but Enter is helpful too to check the progress

[spare mirage]

Yeah it should display the % of completing of the running scan 😄

[uncut sandal]

Just tested it. That's a neat feature, honestly should be mentioned in the NMAP Room 😄

[wild anchor]

"Command Injection" room has several errors in Task #4

In the example, it says

This means that any commands such as whoami will not be processed.

This is not correct. (HTML-side filters won't prevent command injection). Similarly, the next paaragraph says

2. The application will then only proceed to execute this data which is all numerical.

Awkward English phrasing aside, there is no such check on the server side.

In the same room, "Command Injection", same Task #4, the PHP code in the image has syntax errors and woudln't run anyway! This is hard to see because of the red boxes, but is especially noticeable from the code coloring. (The closing ?> tag is the "string" color)

Line #3 of the code snippet SHOULD read

echo passthru("/bin/ping -c 4 " . $_GET["ping"]);

(Notice the . is in the wrong place, and there is an incorrect " before close of the function call.)

Same room ("Command Injection"), same Task #4, not a bug but enhancement suggestion: in the second code snippet, add a comment, e.g.,

if (!filter_input(INPUT_GET, "number", FILTER_VALIDATE_NUMBER)) {
    // Only run this code if $_GET["number"] is a valid Number // <-- Add comment
}

Though not wrong this is a bad code snippet anyway, because 0 is a valid number and is falsey. Better would be

if (false === filter_input(INPUT_GET, "number", FILTER_VALIDATE_NUMBER)) {
    // Invalid input; handle error and return
}

[heavy jacinth]

Hey! I think there's a room bug in the Nmap Basic Port Scans room, Task 5

I'm tring to do a syn scan to find the services but I can't seem to get the output that's needed to get the answer to the room, I tried scanning for all ports to see if that would fix the issue but it didn't

I looked up online and found a write up and noticed that the author of that write up only did a nmap -sS scan to the the target with no additional flags and was able to get the port and the service to show up

[quaint sparrow]

You may be scanning the wrong machine

[heavy jacinth]

I used the ip that's in the question, 10.10.190.3, it's attached in the screenshot, and the command i used to do the scan

[wild anchor]

The question tells you what flags to use. ...

[heavy jacinth]

Yes, I know! I used extra flags just to see if that would prompt something else but it didn't

This attached screenshot is with the flags that the question tells me to use

[wild anchor]

Okay, so the part you included about certain flags used in someone's writeup isn't relevant to your issue.

The part your report is missing is what result you're expecting but not seeing. In this case, an irc service on port 6**7, right?

And in your steps to reproduce, you launched the new VM? (You didn't confirm this, so making sure.)

[heavy jacinth]

I had to terminate the machine and then start it again and then it worked

don't really know what went wrong on the backend for that to happen

[wild anchor]

In Room "File Inclusion", Task #5, it appears as if all instances of /etc/passwd/. should be replaced with /etc/./passwd (changed position of dot). Does not work as currently written.

The room "File Inclusion" also has "black text" when in Dark Mode. This occurs in several tasks, including at least Task #4 and Task #5.

[sharp ridge]

gys i need help

[empty kernel]

whats the issue

[sharp ridge]

Bro

I got it

[sharp ridge]

Don't worry

[empty kernel]

ok

[sharp ridge]

Wait are u like good at thm

[sick kestrel]

I believe the . at the end is just a period ending a sentence. Placing the dot between /etc/./passwd doesn’t really do anything. In that context the . means “this directory” you could theoretically place dozens of those ./ in a directory string and it wouldn’t change anything. Ex: /etc/././././././passwd is the same as /etc/passwd

[honest turret]

Thank you! I was losing my mind thinking I was not reading the instructions properly. But it is in fact an error in the instructions.

[livid escarp]

Gave +1 Rep to @sick kestrel (current: #174 - 45)

[wheat fractal]

https://tryhackme.com/r/room/blue

Whenever you use metasploit, sometimes the entire terminal will stop responding, if i use a command, such as just a simple search command > search eternal, the terminal will freeze and you're stuck in a loop where whatever you type, it doesn't register and you can only click enter to go down new lines which also doesn't do anything.

[spare mirage]

Search command takes some time to finish 🙂

Be patient

Also specify -f if you want to search for file

[wheat fractal]

regardless of how long you wait

it still stays like that

[wheat fractal]

following up on the video, -f was never used

[spare mirage]

Are you a premium user ?

[wheat fractal]

yes i am

pretty sure that's what this role is for, idk

[spare mirage]

I am starting the AttackBox now to see what's going on 🙂

[wheat fractal]

alright

[spare mirage]

I got results , it took about 2 min which is still longer than it should be 🙂

[wheat fractal]

alright thanks, i guess im just impatient 😅

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2467)

[spare mirage]

Well AttackBox isn't the fastest either 🤣

[wheat fractal]

I am doing linux fundamentals part 3 and just tried running this command: python3 -m http.server

and I got the below error after hitting enter:

Traceback (most recent call last):
File "/usr/lib/python3.8/runpy.py", line 194, in _run_module_as_main
return _run_code(code, main_globals, None,
File "/usr/lib/python3.8/runpy.py", line 87, in _run_code
exec(code, run_globals)
File "/usr/lib/python3.8/http/server.py", line 1294, in <module>
test(
File "/usr/lib/python3.8/http/server.py", line 1249, in test
with ServerClass(addr, HandlerClass) as httpd:
File "/usr/lib/python3.8/socketserver.py", line 452, in init
self.server_bind()
File "/usr/lib/python3.8/http/server.py", line 1292, in server_bind
return super().server_bind()
File "/usr/lib/python3.8/http/server.py", line 138, in server_bind
socketserver.TCPServer.server_bind(self)
File "/usr/lib/python3.8/socketserver.py", line 466, in server_bind
self.socket.bind(self.server_address)
OSError: [Errno 98] Address already in use

.
Is there anything that I am doing wrong or is it just a bug or something? I restarted the whole thing but still didn't work.
Thanks in advance!

[spare mirage]

Try to specify different port like 9000 🙂

python3 -m http.server 9000

default port is probably used by another service

[wheat fractal]

Thanks KGB, i tried port 8080 and it workded

[odd falcon]

In Linux Fundamentals 2 room, this portion doesn't make any sense.

The highlighted portion refers to older content.

[spare mirage]

Screenshots in rooms are usually just for example purposes 🙂

[odd falcon]

But the text refers to screenshot which is not there.

Although it is available in walkthorugh video.

[spare mirage]

Ah , I see now 😄 . Yup , you're right 🙂 .

[spare mirage]

This room was updated in the meantime that's why the video gives different results 😄

[odd falcon]

I hope THM team updates the text to refer to the updated screenshots.

[proper hinge]

I was completing the passive reconnaissance room, and it asked me this: "According to Shodan.io, what is the 2nd country in the world in terms of the number of publicly accessible Apache servers?"....I went to shodan.io, and it said china was second, so I put that in. it wouldn't take it, so I went back to shodan. I saw that Germany was close in 3rd, so I put that in instead, and it worked. (im gonna guess china passed germany since the room was made)

[wild anchor]

Disagree. The context of the page is /etc/passwd is explicity filtered, so /etc/./passwd gets around the filter.

[wild anchor]

See specificly this paragraph (notice where the code ticks are):

To make it clearer, if we try this concept in the file system using cd .., it will get you back one step; however, if you do cd ., It stays in the current directory. Similarly, if we try /etc/passwd/.., it results to be /etc/ and that's because we moved one to the root. Now if we try /etc/passwd/., the result will be /etc/passwd since dot refers to the current directory.

(Also worth noting that /etc/passwd/.. doesn't work as the text claims because passwd isn't a directory.)

[strong kelp]

Hi. In https://tryhackme.com/r/room/insecuredeserialisation is a typo. A missing 't' in 'PHP Gadge Chain'

[wild anchor]

In room "Burp Suite Basics" there is a very minor dark text issue in Task #14

Submit the form — the request should be intercepted by the proxy.

Somehow the em-dash gets it's own explicit black styling.

Submit the form&nbsp;<span style="color:rgb(32, 33, 36);font-family:arial, sans-serif;font-size:14px">—</span>&nbsp;the request should be intercepted by the <span data-testid="glossary-term" class="glossary-term">proxy</span>.

[sick kestrel]

I was referring to the first question/answer in that task... what you suggest doesn't make sense

[wild anchor]

You're referring this this paragraph (which is also incorrect)?

2. In this section, the developer decided to filter keywords to avoid disclosing sensitive information! The /etc/passwd file is being filtered. There are two possible methods to bypass the filter. First, by using the NullByte %00 or the current directory trick at the end of the filtered keyword /.. The exploit will be similar to http://webapp.thm/index.php?lang=/etc/passwd/. We could also use http://webapp.thm/index.php?lang=/etc/passwd%00.

Again, please note the positioning of the code ticks. I don't think your interpretation is correct. ... but perhaps it's because both paragraphs incorrectly treat passwd as a directory.

[sick kestrel]

Give Lab #3 a try to read /etc/passwd. What is the request look like? is just a .

[wild anchor]

I'm not referring to the Q/A at all, just the explanatory text.

[craggy laurel]

Hi everyone. I was doing https://tryhackme.com/r/room/introtok8s Task #8. It seems like when I run kubectl apply -f nginx-deployment.yaml the container is stuck at ContainerCreating status. kubectl describe pod returns following error " Warning FailedMount 119s (x14 over 14m) kubelet MountVolume.SetUp failed for volume "webapp-volume" : configmap "webapp-config" not found ". If someone has faced this issue before, please help

[civic loom]

I'm not at all sure if this is a bug or not, but I'm doing https://tryhackme.com/r/room/netsecchallenge on the very last task, and I got it down to 6% chance of discovery and nothing's happening. I'm not sure if I need to get it even lower (if so I have no clue what else I can possibly due, as fragmenting the response returns no open ports no matter what seemingly, and I am using everything else that I have access to I think) or if it's just not giving me the flag. I'm just kind of confused.
EDIT: I got it to work with some help. I added too many flags and for some reason it wasn't working because of that. A simple nmap -sN <ip> was all that was required. This was a bit confusing to me personally, but it did work.

[sour jolt]

i think there is problem in sql in this ctf :Lunizz CTF

have a look

[naive osprey]

think i found a room bug for
https://tryhackme.com/r/room/xss

could be a nothing burger

okay, while i have the start machine in browser on right side for the practice, my browswer extension block the use of the lab material. i view page source and i see my details of when i signed up to THM, IP address, etc

(i already did this room, just going over material)

using https://10-10-x-x.p.thmlabs.com works. when iwent back to the way i had it before it still shows details when view page source.

[wild anchor]

Right. Looks like I was trying this on the Lab3 page not the Lab4 page.

On further investigation the trailing /. does work with include() and file_get_contents() in PHP 5.2.17. However, much like the null byte trick, the trailing /. does NOT work with PHP 7.4.3 (the version on the AttackBox) for include() or file_get_contents(). (See attached images; one with reverse shell + PHP interactive into the Lab's target, the other with PHP interative on AttackBox.). For the particular filter in Lab4, the suggestion of doing /. infix (in the middle of the path) will work in all versions.

[earnest jetty]

https://tryhackme.com/r/room/wiresharkthebasics

This room has issues with text coloring specific to Dark Mode

[odd arrow]

Hello,

I'm working on a Kubernetes challenge and I've encountered an issue with the question about the replica set name. From the kubectl commands I ran on the cluster, I can see:

1. When I run kubectl get rs, the replica set name shown is:
   hello-tryhackme-875767b84

2. When I run kubectl get pods, the pod name shown is:
   hello-tryhackme-875767b84-sfk2c

I entered the replica set name as shown in the kubectl get rs output (hello-tryhackme-875767b84), but the system is marking this as incorrect. Could you please verify if there's an issue with the answer validation or clarify what exactly is being asked for in this question?

Thank you for your help.

[lilac solstice]

i encountered the same problem.. did this get resolved?

[rotund raptor]

Using the most up to date kali VM to redo AoC D10, and reverse TCP fails to bind, had to use the AttackBox in order to be able for it to work.

[lyric lynx]

I'm still stuck on this SNORT The Basics set of challenges. I have the packets without issue and they match those on the write up i'm using https://medium.com/@jcm3/snort-challenge-the-basics-tryhackme-walkthrough-0fd146bed94f ```WARNING: No preprocessors configured for policy 0.
05/13-10:17:10.205385 65.208.228.223:80 -> 145.254.160.237:3372
TCP TTL:47 TOS:0x0 ID:49316 IpLen:20 DgmLen:1420 DF
A* Seq: 0x114C7C80 Ack: 0x38AFFFF3 Win: 0x1920 TcpLen: 20

I've edited the correct local rules file and my snort command should be alright snort -v -n 63 -c local.rules -A full -l . -r mx-3.pcap I have the rule alert tcp any 80 <> any 80 (msg: "this should work as a message"; sid: 101; rev:1) Does anyone see anything wrong? Is there anything I'm missing?

[mystic bronze]

Room "Upload Vulnerabilities", Task 7:
dead link at "Having established this, let's start Burpsuite and reload the page."
Please refer to https://tryhackme.com/r/resources/blog/setting-up-burp instead of the now broken link https://blog.tryhackme.com/setting-up-burp/ thanks 🙂

[lethal hornet]

On the offensive security intro room, they want you to use gobuster to scan textfiles on a fake website but it is not working in accordance to the lesson. It's supposed to output a set amount of statuses but on my box, it just says "unable to connect".

Lesson: https://tryhackme.com/r/room/offensivesecurityintro

[sick kestrel]

You need to add the target ip and domain to your /etc/hosts file

[lethal hornet]

@sick kestrel The module gives you the exact command to enter into the terminal for the desired result I mentioned:

gobuster -u http://fakebank.thm -w wordlist.txt dir

This is supposed to give the exact output I mentioned previously where it displays "/images (Status:301 and /bank-transfers (Status: 200)" however, the TryHackMe webhosted VM's connection request to the URL in the command above is being refused.

I appreciate you taking the time to reach out!

[unborn pulsar]

Can you describe what the exact issue is or a general description of the issue you are having?

[quaint sparrow]

Are you on the correct machine?

[median patio]

Hi, I have a room bug

ok third time is a charm lol.

The docker pull command is incorrect in the DAST room - Task 7
It says to run docker pull owasp/zap2docker-stable but it should be docker pull zaproxy/zap-stable

and some of the other commands are wrong also

[tidal zephyr]

I just got the idea from #general chat that this channel might be more appropriate for this issue (I posted this in #site-bugs earlier today):

There are outdated links in the Velociraptor room.
https://tryhackme.com/r/room/velociraptorhp

In Task 5, it provides this link (in both the task body and the first two hints), which takes you to a 404 page:
https://docs.velociraptor.app/docs/gui/vfs/

The updated link appears to be this:
https://docs.velociraptor.app/docs/clients/vfs/

It looks like there's an outdated link in Task 6 as well.
The final question hint of the task provides:
https://docs.velociraptor.app/docs/extending_vql/

But the correct link is:
https://docs.velociraptor.app/docs/vql/extending_vql/

[wheat fractal]

Wireshark: The Basics room (Task 2) has black text on Dark Mode

More below:
Highlighted text:

Non-highlighted:

[raw bison]

Should be fixed now. Thanks for bringing it up. 🙏

[livid escarp]

Gave +1 Rep to @thorny sequoia (current: #2629 - 1)

[stone crow]

Hello, in https://tryhackme.com/r/room/commonattacks there is a white text on a light purple background
Is this a bug ?

[obsidian kiln]

I mean, it was certainly not intentional...
That's the new dark mode causing chaos again

[stone crow]

[austere gorge]

'MBR and GPT Analysis' room is unreachable, tried on 3 differents browsers restarted the machines 6 times. When i finally connect it's unstable as hell. Am i alone ?

[wraith obsidian]

@austere gorge I just tested there and its working ok for me. Are you able to browser or search for the room and find it? Other rooms all working fine?

[austere gorge]

Now it's looking good, before, during the issue, others rooms worked fine.

Just this one restarted itself a couple of time

[wraith obsidian]

Interesting, good its back working. Strange, website logic wise there isn't anything specific to certain rooms (unless there is some A/B product experiment ongoing). Thanks for reporting, I'll keep an eye on it.

[austere gorge]

Maybe, my connexion was unstable, in that case, my bad.

[umbral girder]

In room /Zeekbro, there is a minor dark text issue (when in dark mode) on Task 6 Zeek Scripts | Fundamentals.

[ashen swift]

Hello Guys hope you're fine,
I got an eror when lauching the room nmap :https://tryhackme.com/r/room/nmap When i tried to start the machine for practice nothing happen, like the screen of the VM don't display, someone can check this out ?

[quaint sparrow]

This is intended to happen, not all machines open up as a split screen machine.

[ashen swift]

I know that we can connect with ssh, but there's no credential to connect to and i need sudo for nmap

[quaint sparrow]

You don't need to connect to SSH for that machine.

All tasks can be answered with nmap.

[ashen swift]

i know but i can't acces it

[quaint sparrow]

Are you using the attackbox?

[ashen swift]

nope, it is preferable for this task to use the attackbox ?

[tiny pilot]

@quaint sparrow I’m in the Security Principles room on Task 6. There are 3 questions. I’ve tried all 10 answers but none of them work. Any suggestions?

[ashen swift]

do i need to use the attackbox ?

[sullen epoch]

Is anyone else having difficulty getting the system to accept answers?
https://tryhackme.com/r/room/introwebapplicationsecurity
I have entered text directly from the page into the answer box and it still will not accept it.

🙃

[naive osprey]

this room https://tryhackme.com/r/room/lle has a link [thefindcommand] which is a private room.
plus there are few typos

[spare mirage]

Which question and what's your answer 🙂 ?

[sullen epoch]

I got it. 🤦🏻‍♀️🤦🏻‍♀️🤦🏻‍♀️

[mossy socket]

noy a bug but a typo... ROOM: Networking Core Priotocols task 2: states. "DNS traffic uses UDP port 53 by default and TCP port 53 as a default fallback." which im sure it ment to mention a different port number to fall back. im happy to help 🙂

[tardy silo]

Not really a bug but some texts are invisble in dark mode due to font color
This is from Snort room

[raw bison]

I think it's meant to be like that. Using port 53 via UDP by default, but using port 53 via TCP as fall back.

[hardy ice]

https://tryhackme.com/r/room/walkinganapplication

In task 3, "what is the framework flag?" I have the answer for it but it is not accepting the answer. Error shows that answer is too short but it is the correct answer

[spare mirage]

What's your answer ?

[hardy ice]

THM{CHANGE_DEFAULT_CREDENTIALS}

[spare mirage]

That's not a correct framework flag 😦

[hardy ice]

Oh sorry then

[neon palm]

im having the same issue

only works if i ctrl+A

and its highlighted

[wheat fractal]

Apologies, finishing the remainder of the room, task 5 has more black text, cheers 🙂

[stone crow]

Lmao true, highlighting helps reading it

[little field]

https://tryhackme.com/r/room/owaspjuiceshop this room in dark mode also contains a lot of unreadable black text

[wheat fractal]

Is this the correct channel to highlight these? I'm just calling them out as I progress through all the learning paths. Apologies if it's not and I'm spamming the wrong channel.

[spare mirage]

Yes it is 🙂

[spice pollen]

im trying to upload a VM as a material but i keep getting stuck here can somone help pls?

cant upload a picture for some reason but it says 'NaN% Converting...'

[quaint sparrow]

@dusky junco

[raw grotto]

A few hours ago Wreath network was down and I was unable to start it, now it shows as Running but no timer and no vpn server file available

[fallen trail]

guys, i'm trying to complete active Reconnaissance room and there's a task where i need to nc to a vm via 21 port, but the vm is refusing connection

i'm stuck

it lagged

everything's okay now

[spare mirage]

This room has a separate machine for nc , make sure that you're using machine from Task 6

[ashen swift]

Hello Guys, everything fine ?
I got a little problem when trying to answer to nmap room : https://tryhackme.com/r/room/nmap i don't get the "machine IP" that i need to scan on Task 3, someone can help pls ?

[spare mirage]

Go to Task 2 and press green Start machine button 🙂

[ashen swift]

thx so much 🙂

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2602)

[vestal surge]

yea you gotta start machine twice in some rooms for some reason

[ashen swift]

i got it, thanks you too, that's bc all the previous room (except for ssh) only used VM without attackbox ^^

[livid escarp]

Gave +1 Rep to @vestal surge (current: #2633 - 1)

[naive osprey]

for the DOM based attacks room, the AttackBox has warning about Unable to mount 77MB volume. No. Filesystem or .Encrypted interface on D-Bus object

[upbeat fulcrum]

Finding issues with my first TryHackMe course... seeing exercises are poorly constructed and VM instance does not work. For example in the first course SOC1 - Threat Intelligence Tools - Task 7, the VM instance does not have internet connectivity to access VirusTotal to upload malicious attachment. There isn't a method to download the malicious emails used to local machine.

Is anyone else running in to similar issue?

[spare mirage]

If you aren't premium user AttackBox doesn't have Internet access

[upbeat fulcrum]

Our company paid for a subscription. How does one go about completing the room if the tools are not available to complete the material?

[spare mirage]

Try to calculate md5 hash of the file and search it on VT on your own machine

Or if you're premium user you can use AttackBox

[upbeat fulcrum]

I did load the Attack Box, but unable to download the email samples to transfer the malicious attachment

[spare mirage]

You don't need sample , you can calculate the hash and search for a hash on VT 🙂

[upbeat fulcrum]

Is there a method to download the sample malicious emails? I would then be able to analyze on my on local workstation

[spare mirage]

Use md5sum <file-name> to calculate the hash of the email file

Then search that hash on VT 🙂

[upbeat fulcrum]

Are all the excerises on TryHackMe half baked?

s

[spare mirage]

What do you mean ?

[hazy tiger]

We cannot give advice on downloading any of the lab material to your local workstation as these are usually real malicious samples. It is for your safety that they are kept in our environments:)

[upbeat fulcrum]

Thanks Jabba. I would have loaded to my local VM for analysis. The instructions provided in the course do not match the example, which I was reaching out. Per @KBG I did pull the hash and was able to search VirusTotal on my local

[livid escarp]

Gave +1 Rep to @hazy tiger (current: #6 - 1461)

[scarlet marlin]

owaspjuice shop/ dark bug

[wild anchor]

In room "25 Days of Cyber Security", Task 7 (Day 5) [from 2020]

You can find a cheatsheet for more snippets of SQLMap commands here

... "here" links to a website that no longer exists. Suggested link: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL Injection/SQLmap.md

[wild anchor]

In room "25 Days of Cyber Security", Task 8 (Day 6) [from 2020]

Question "Run a ZAP (zaproxy) automated scan on the target. How many XSS alerts are in the scan?" has accepted answer of 2; correct answer is 5

[lilac spindle]

Downloading wreath openvpn file leading to http error 500 now

[heady cairn]

Dark bug on /r/room/fileinc

[trim moat]

#room-bugs
Small bug in "Task 5 - Interacting With the Filesystem!" in "Linux Fundamentals Part 1"

What is the contents of this file?
Hello World

But content of the file is: Hello World!

[little field]

maybe its just me but in room https://tryhackme.com/r/room/uploadvulns Task 9. According to older walkthroughs the site is supposed to tell you "Gifs only please!" when you upload another file type. but instead nothing happens it just returns to the original screen with "no files selected"

[fallen trail]

guys, i have a problem with both attack boxes (kali, thm attack box), my keyboard input is not working though the mouse is working

i've reloaded them multiple time

s

On kali there was also a similar kind of error

@spare mirage

[spare mirage]

Yeah , I think that staff is aware of that , it is already reprted a few times 🙂 . You can just ignore it . It should impact AttackBox functionality 🙂

[fallen trail]

thx, it fixed itself somehow

strange things

[long valley]

Hi! Room "Linux Privilege Escalation" task 7 about SUID seems a bit scrambled structure-wise. It says "nano /etc/shadow" will read the file when you actually need to exploit another binary. Semantically a bit confusing that part. Also there is a sentence in lowercase "reading the /etc/shadow file" in the middle of the task seeming out of place 🙂

[sour sandal]

a

[runic path]

Hello everyone. Need a little help here. I'm receiving the 405 error code - method error when trying to access a local URL on one of the atattack boxes that is assigned to me. I can't answer the questions without accaccessing the site. Has anyone run into that issue?

[blazing gulch]

In the Caldera room of the SOC Level 2 path, the command to run the Caldera server doesn't work as shown in the room walkthrough. After activating the Python virtual environment, running python3 server.py --insecure as instructed results in a ModuleNotFoundError. However, if one executes the command with python rather than python3 then the server works as expected.

[spare mirage]

You're probably entering AttackBox instead of machine ip 🙂

[storm canopy]

Hello, the GoBuster: The Basics room doesn't work properly. I have everything well configured, I restarted it and still doesnt' work 😦

I used the IP of the machine instead the adress "www.offensivetools.thm" and still can't make it work properly

[spare mirage]

Try to add www.offensivetools.thm and offensivetools.thm domain to /etc/hosts

[storm canopy]

omw!

Like this?

[spare mirage]

Save it 🙂

ctrl+x

[storm canopy]

yep i'm gonna try

Yeah it works now

hahah

ty

Gonna try to enumerate everything again

Works flawlessly, thanks again

❤️

[spare mirage]

You're doing great , keep up the good work 🙂

[raw bison]

Should be fixed now. Thanks for mentioning 🙏

[livid escarp]

Gave +1 Rep to @tardy silo (current: #1725 - 2)

[raw bison]

No worries! Should be fixed now too ✌️

[raw bison]

No it's the right channel, all good 🙂

[deep glade]

what is the secure port for SMTP

[spare mirage]

Depend 587 or 465

[daring cloak]

anyone also having some problems with Nessus scanner? it shows zero vulnerabilities

[quaint sparrow]

Are you scanning the right ip?

[daring cloak]

I'm using the "target ip adress" from the THM machine

even though I applied all the settings that are recommended, it still showing zero vulnerabilities

https://tryhackme.com/r/room/rpnessusredux
here in task 4

in other domains I can scan without any problems

[stone crow]

Hello, in Android Hacking 101, task 3, there is a typo: Dinamyc Analysis

[shrewd wharf]

Hello !
There seems to be a small error in the task03 of the room Moniter Link (CVE-2024-21413) ( https://tryhackme.com/r/room/monikerlink ) :

It says: Modify the Moniker Link (line #12) in our PoC to reflect the IP address of our AttackBox, but it seems to me that the IP address of the attack box should be indicated in line #17.

Thanks for all you do! ❤️

[daring cloak]

I changed my VPN and it worked

[delicate fox]

Hey text me if you need help

[sick kestrel]

the URL republicofkoffee.com used in the webosint room was bought up and it now redirects to malicious site

[hazy tiger]

-mute 1334499215338115153 DM Jabba to be unmuted

[livid escarp]

🔇 Muted bryanjackson.9052 for 1 day

[hazy tiger]

-mute 1334499215338115153 9999d time update

[livid escarp]

🔇 Muted bryanjackson.9052 for 27 years 20 weeks and 4 days

[mossy socket]

what could be the reasdn for tryhackme website freezing every 10 seconds for me in firefox? its the only website that does this? i am even worried about being hacked LOL

[marble barn]

hello

I can't connect to the VPN

[spare mirage]

We had the same issue earlier today , check out that message 🙂
#room-help message

[mossy socket]

its almost imposioble to study like this. the website freezes. lags, its the only website that does that

[marble barn]

I have no way to connect

[mossy socket]

yesterday io spent 2 hours and could not go over almost anything,. its very frustrating... is there suipport here for that?

[spare mirage]

Yes it is , here's the mail below

[last loom]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Jan 31, 2025, 4:20 AM

[mossy socket]

ty

[mossy socket]

what password did the user submit here? i decoded it but the pass wont fit the solution blank...

needs to fit here unless ists bugged.

[spare mirage]

What's your answer ?

[mossy socket]

THM(7BB8WM6P) but that does not fit

[spare mirage]

||THM{7BB8WM6P}||

Curly not ordinary brackets 🙂

[mossy socket]

yeah yeah.. thats automatic on the response format

but it does not fit. it fits up until the M

[spare mirage]

Which room and which question ?

[mossy socket]

see?

Nestworking Secure Protocols, task 8

[spare mirage]

%7B is encoded {
%7D is encoded }
Refresh the page and copy this || THM{B8WM6P} ||

[mossy socket]

and how do i know that?

it worked, but how do i know next time where it should begin ?

[spare mirage]

You can use cyberchef to decode it for you

When you see % it usually indicates some URL-encoding

https://gchq.github.io/CyberChef/#recipe=URL_Decode()&input=VEhNJTdCQjhXTTZQJTdE

[tardy silo]

Snort Challenge - Live Attacks room, task 3

[hasty mountain]

Thanks it would be nice if this information would read in the room instructions (about the timeframe).

[livid escarp]

Gave +1 Rep to @waxen yoke (current: #91 - 82)

[sick kestrel]

@obsidian kiln

[obsidian kiln]

Oh, that's not an Easter egg or a bug. Just unfortunately what happens sometimes. The room needs to be reworked around it, although if it's a community room there's a good chance the creator is long gone.
I'm assuming that domain was once legitimate and owned by someone else, or I would say the room creator should have bought it themselves to protect the room.

[sick kestrel]

Yea, I was being facetious about Easter egg. The domain was bought in 2022 and has been changes ip addresses every few days since

[obsidian kiln]

Oops

[austere jacinth]

see as it show room completed but not updating in path

Also similar happen with another room like i complted the room didn't get the badge then i have reset and redo the room to get the badge

[spare mirage]

Try to leave the romm and re-join

[austere jacinth]

yeah it would fix but this happening with both the room so, i wanted to report it as i tried it signing out and login again

[mild owl]

There seems to be a problem in the room: Passive Reconnaissance. The answer for task 6 is no longer germany but china.

[waxen yoke]

I agree.

[glad badger]

Thank you for reporting. The room is now private and locked. 🙂

[livid escarp]

Gave +1 Rep to @sick kestrel (current: #147 - 53)

[junior shore]

k2 middle camp and summit has a lot of disconnections. Tried with both attack box and kali. Its a premium room. Lost my shell so many times because the VM keeps disconnecting. Not a fan that this is a premium room and its having issues. Please get this fixed, I did not pay to do premium rooms that keeps disconnecting.

[wheat fractal]

for the third metasploit room in cybersec 101, can run msfdb init as root. but also doesnt work as non-root (ubuntu).

as root i get: Please run msfdb as a non-root user

as ubuntu i get: pg_ctl: could not start server failed

[spare mirage]

You don't need to do that on AttackBox , db is already initialized 🙂

[wheat fractal]

oh okay, Thanks!

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2707)

[split iris]

Idk if it’s something I’m doing but in the metasploit room, I start the attack box. Click start machine on the task 1 and it doesn’t open. Aside from that when I try to run msfconsole it tells me the software needs to be updated.

[spare mirage]

It isn't supposed to open in split-screen view , follow along with the room , you will need to exploit it using AttackBox/your own machine 🙂 . You can ignore update warning

[split iris]

Yeah one opens in the split screen and the other from task 1 doesn’t open. I had the same issue for John the ripper. Maybe cus I have the web page open to long 🤷‍♂️

[spare mirage]

It isn't supposed to open

[sick kestrel]

when there are two "split-screen" devices open like attck box and a lab box, they are accessible by pressing the tab with their name at the bottom center of the VM screens. Is that visible?

[split iris]

No it’s not. I’m guessing you mean like in John the ripper there’s attack box and ctfjpr next to it like two tabs.
But for metasploit it’s just attack box and then putting in the code for evasion should work? That’s what I put in after the root@ line and it said no such file or directory.

[spare mirage]

Yes , that's how it should work , follow along the task to see what you will need to do 🙂

[split iris]

Ok yeah I’ll give it another go. Could be something I’m doing again. Still new haha

[spare mirage]

You will rarely be able to access machines directly in split-screen view like in john room 🙂

You're usually supposed to use AttackBox to exploit the machine like in this case

[sick kestrel]

yes, thats what I mean't. its rare but it happens sometimes, and i couldn't remember exactly which rooms do it, so wanted to check. Go Blue! 😉

[split iris]

Ah ok, yeah I’m just getting into this and making the mistake of trying to do it while I’m working too sometimes a bad combo. GO BLUE!

[summer dirge]

Windows Fundamentals 1 room
unable to switch windows local users
On lusrmgr.msc user: tryhackmebilli . 'V' Marked on "User not allowed to change password" and I have changed the password .

[fading ivy]

Hey everyone I need help I solved some questions on the webosint room like 2 or 3 hours ago but when I re-open the room. This is saying room is locked the room owner has locked this room to access material start machine and answer questions sh***tt!!!!!

[quaint sparrow]

The room was locked recently.

[severe tundra]

DevSecOps path, CI/CD and Build Security Room, Network is not starting

[odd kite]

Hey guys, does any one knows if there's an error with What the shell? task 14 ? , I'm trying to use nc with -e but it keeps saying invalid option -- 'e'

[sour hawk]

In room "Windows Fundamentals 1", task 3, I don't really understand the question "Besides Clock and Network, what other icon is visible in the Notification Area?". What does it look for?

[odd kite]

@sour hawk you're looking for Action Center

[sour hawk]

Got it. Thanks.

[austere jacinth]

Just leave room then refresh and join again

[pallid quarry]

Double check your rule. The walkthrough you're looking at shows "<>" which provides both directions, so your total count and log file will actually be doubled. If you fix your local.rules to have only 1 rule you should get the right information in the right order.

[gloomy sphinx]

Room -> Gobuster: The basics
Issue - Adding dns server to resolved.config as instructed doesn’t work at all.

Fix - Added the dns server to /etc/resolv.config & it worked.

Anyone want to explain why? I’m all ears.

[severe tundra]

thank you, it works now

[livid escarp]

Gave +1 Rep to @austere jacinth (current: #1728 - 2)

[wild anchor]

Room "JWT Security", Task 3
TYPO

Symmetric Signing - A symmetric signing algorithm, such as HS265, creates the signature [...]

HS265 should be HS256

[spare mirage]

Can you provide a screenshot 🙂 ?

[obsidian kiln]

Not every version of netcat is compiled with -e. In fact, most don't these days. It's affectionately known as the "gaping security hole" for a reason.

[misty gull]

Thinking this may be more of a bug...

[spare mirage]

Use ls -la in root dir 🙂

[stone crow]

In Linux fondamentals part 3
Task 8
There are no .log files that describes what the question is asking me for
I tried checking all access and error logs, tried all ips and none is matching the format or the answer after for the file, am I dumb and missing something or the room is bugged ?

[spare mirage]

You're inspecting files on your AttackBox

[stone crow]

....

No dont continue

Please

I'm dumb

My bad, sorry

[stone crow]

Thanks, resolved

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2726)

[valid temple]

I can't ssh, into vm of https://tryhackme.com/room/linprivesc room

It's showing /home/karen: No such file or directory

[spare mirage]

Seems like you're already on the machine

[valid temple]

Yeah but the connection getting closed, getting the following error message

Warning: Permanently added '10.10.84.83' (ED25519) to the list of known hosts.
Could not chdir to home directory /home/karen: No such file or directory
mktemp: failed to create directory via template ‘/home/karen/.kitty-ssh-kitten-untar-XXXXXXXXXXXX’: No such file or directory
Creating temp directory failed
Shared connection to 10.10.84.83 closed.

[uncut sandal]

Moniker Link (CVE-2024-21413) Exploitation
Not sure if this is a bug or me just being dumb but in the Task it says "Modify the Moniker Link (line#12)..."
However in line 12 is the recievers e-mail and the moniker link seems to be in line 17.
The line 31 for the "Mailserver placeholder" fits perfectly.

[quartz yew]

Currently doing the "Subdomain Enumeration" room, I can't complete Task 6. Looks like all of the requests have a size of 472. If I use -fs to filter that out, I get no requests returned. I've tried copy and paste, but still no results so maybe it's not a typo. I'm assuming MACHINE_IP is the AttackBox IP as I see no other IP address.

[spare mirage]

No MACHINE_IP is the ip of the target machine 🙂

[quartz yew]

Ah, thought that didn't make sense. Thanks!

I think my confusion was that I was expecting a Start Machine button in that particular section, but it was at the start. The View Site buttons throughout made me think it would be in the same place as the task. But that makes sense now.

[vocal hollow]

I just started the nmap room and i cant seem to open the virtual machine.

I click on start machine and nothing pops up

[sick kestrel]

Not crazy, I mentioned this in here a few weeks ago. I guess they haven’t gotten around to correcting it yet.

#room-bugs message

[spare mirage]

It isn't supoosed to 🙂 . You're supposed to perform scan against that machine 🙂

[vocal hollow]

Okay thanks

[sick kestrel]

https://tryhackme.com/r/room/threatinteltools

phishtool.com from task 5 appears to no longer exist and now yields a 403 error

[sick kestrel]

Additionally, whois has been updated, so Task 6 Q2 is incorrect

[grim marsh]

#room-bugs

[frail berry]

https://tryhackme.com/r/room/hashingbasics task 6 has small typo saved in saved in

[livid leaf]

https://tryhackme.com/r/room/subdomainenumeration , This room have a little problem, with task 2 crt.sh dont work, website down ?

[smoky citrus]

Please, I'm trying to deploy the machine on the Linux fundamental room, but it kept saying error parsing

[spare mirage]

Try to refresh the web page

[quaint sparrow]

Ctrl and F5

[smoky citrus]

I've done that, but it's still the same

[tidal void]

Hello, hope everyone is fine

I was trying to do the room called Enumerating Active Directory, I started the attack box and I am not able to ping THMDC IP, seems attackbox is not part of the network, could you please help me?

[novel carbon]

I have just answered to your question here: #room-help message

[novel carbon]

not from my local host and not from THM AttackBox

[livid leaf]

@novel carbon oh 😮

i just tried, and now its working, ok perfect then

[novel carbon]

hit it with whatever you can think of, if Ctrl-F5 does not work:

• use the Options button to leave and join again
• restart your browser with no history
• switch to a different browser
• logout/login of THM
• check DevTools > Console if there are errors

[novel carbon]

I can reach www.phishtool.com while browing from my host, but that fails if I go through a VPN (ProtonVPN, NordVPN)
also, I can reach it when browsing from THM AttackBox as per screenshot

[sick kestrel]

Ah ok! I’ll try again later, I was definitely on a vpn

[novel carbon]

I have come across this same error: Could not chdir to home directory /home/karen: No such file or directory as per screenshot
I did not have the issue with mktemp: failed to create directory, and the connection getting closed
referring to your output, did it all happen in one go as part of the ssh login, or was there other activity (like entering commands) between the first error msg (Could not chdir to home directory ) and the seconde one (mktemp: failed to create directory)?

[full sonnet]

does the challenge room Smol supposed to show a website ?

[spare mirage]

Yes it is

[cobalt lily]

I’m trying to run the attackbox but the machine tell me that I can’t run 3 vm at time

I’m not running 3vm at time

[spare mirage]

Terminate all your vms from previous rooms that you've done earlier today

[cobalt lily]

Already done

[warm dagger]

why does the url for rooms changes? for exmaple: change from https://tryhackme.com/r/room/furthernmap to https://tryhackme.com/room/furthernmap
I'm using Glasp (a plugin that allows u to highlight web pages), it seems like if the url changes the highlights and notes no longer apply too?

[solar nest]

The rooms Basic Pentesting attached VM does not expose users, or rather usernames.
First I tried it myself and then got a collegue with 25 years of experience to look over it.
He is also sure it should work. I guess there is a misconfiguration within the VM.

┌──(root㉿kali)-[~]
└─# enum4linux -a 10.10.75.98 | tee enum4linux-out
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Mon Feb 3 13:00:04 2025

[+] Got OS info for 10.10.75.98 from srvinfo:
Cannot connect to server. Error was NT_STATUS_UNSUCCESSFUL

========================================( Users on 10.10.75.98 )========================================

Use of uninitialized value $users in print at ./enum4linux.pl line 972.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 975.

Use of uninitialized value $users in print at ./enum4linux.pl line 986.
Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 988.

==================================( Share Enumeration on 10.10.75.98 )=========================

[quaint sparrow]

VM or Web Kali box?

[solar nest]

https://pastebin.com/SXL8ty1F

Kali Box von THM

Sorry, there you have the enum4linux output.

I think the problem lies within the target machine.

[quaint sparrow]

Yeah, enum4linux isn't friends on that, I'd suggest using the Attackbox.

[solar nest]

Ah that explains a lot. Alright, I'll try it again with the Attack Box and give feedback. Thanks 🙂

[solar nest]

That was the solution, thank you! Is there any way to add a note within the room to let people know that they should use the AttackBox and not Kali?

[livid escarp]

Gave +1 Rep to @quaint sparrow (current: #1 - 3340)

[quaint sparrow]

I think staff were pinged ages ago.

[solar nest]

Let's hope they implement a warning. It really confused me why it wasn't working.

Anyway, thanks a bunch 🙂

[wheat fractal]

After doing a TCP SYN Scan a bunch of times against the target VM, i get 7 ports shown to be open, right?

Guess what? My answer was considered wrong for apparently no reason

[potent terrace]

please help my openvpn connection problem in kali linux os

[spare mirage]

Can you provide a screenshot of machine info box

[spare mirage]

What's the problem 🙂 ?

[potent terrace]

ok

[spare mirage]

Looks like you're scanning ip of attackbox

[wheat fractal]

It was the target VM

[spare mirage]

Which room ?

[wheat fractal]

Nmap - Task 14

[spare mirage]

Can you provide a link there're multiple nmap rooms 🙂 ?

[wheat fractal]

https://tryhackme.com/room/furthernmap

This is the one

[spare mirage]

Can you tell us which task and provide a shot of machine info box 🙂 ?

[wheat fractal]

Just by terminating the target VM and restarting it was enough to get the correct results

[spare mirage]

Glad to hear that , keep up the good work 😄 🚀 🔥

[novel carbon]

aside from your question, I am curious if you are root when you run that SYN scan
are you root or user kali (i. e. non-root)?

[wheat fractal]

kali

[spare mirage]

You need to be root for -sS scan

[novel carbon]

that's what I found strange, as the command should be rejected otherwise, as per screenshot
something I do not get here 🙃

[spare mirage]

Well it may defaulted to -sT in his case

[wheat fractal]

Now I've completed the room

[spare mirage]

Congrats 🙂 🚀

[novel carbon]

seems like there is a change in nmap from 7.94 (not OK without sudo) to 7.95 (OK without sudo) 🙃

[quaint sparrow]

Was the first screenshot a fresh command?

Or did you use sudo previously?

[spare mirage]

Thanks for sharing 🙂

[livid escarp]

Gave +1 Rep to @novel carbon (current: #16 - 555)

[novel carbon]

I used sudo previously

[quaint sparrow]

That could be why it didn't ask for a password then.

You're in a terminal where you've already used sudo.

Nevermind, it has changed

[novel carbon]

yes, just confirmed by running it all again in fresh terminal (no sudo)

[wheat fractal]

Not only that, but I was also able to finish the entire Free Roadmap for the Penetration Tester as well

[sour gale]

is there anyone aware of any known issues with silver platter? I am attempting to ssh using the username and password found @ the ip address of the box and it's coming back as permission denied. I've used the attack box and my own kali vm.

[signal jewel]

https://tryhackme.com/room/passwordattacks
Task 6 needs to be updated, as changes to john.conf are depreciated, and custom rules must be added to a new file /etc/john/john.local.conf, else they will return a rule-not-found error

[alpine kindle]

Hello every one quick question I'm currently in the Investigating with ELK 101 room . I've deployed the attack box and its been more than 5 minutes since i started the machine for this room typed the Ip in the browser getting 504 error any suggestion?

[spare mirage]

Great job , keep up the good work 🙂

[spare mirage]

Are you sure that your credentials are correct 🙂 ?

[spare mirage]

Press F5 from time to time to refresh the page, it can take up to 15min for that machine to fully boot up 🙂

[warm dagger]

just stumble upon a typo when looking up for the word 'reconnaisance' at https://tryhackme.com/room/furthernmap
anyways, can't post the pic for some reason😅

[spare mirage]

You can verify in order to upload images on Discord 🙂
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[warm dagger]

Ok thanks

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2818)

[wheat fractal]

There seems to be a bug in the Content discovery room, task 7. The answer is site and it’s only showing that the answer is too short which it isn’t.

Learning path: Jr Penetration Tester

[quaint sparrow]

site is too short.

The answer is 5 characters long.

Look at the hint.

[wheat fractal]

site: doesn’t work either

[spare mirage]

Try to refresh the page

[wheat fractal]

Same thing

[quaint sparrow]

Do you have underscores?

[wheat fractal]

I would send a screenshot but I don’t have the permission

[quaint sparrow]

Or *

I've forwarded this on to the team

[wheat fractal]

Thanks, I’ve been trying for like 10 minutes thinking I’m crazy or something

Hopefully they fix it

[glass depot]

Hey guys,
Do you have issues submitting written answers in https://tryhackme.com/r/room/disgruntled ?
I cannot copy nor enter anything in answer fields, already cleared cache and changed browsers

[warm sage]

I know this is basic, "Which of the following characters cannot be used in a subdomain ( 3 b _ - )?" the answer is _ right? though its not accepting this

the answer is '_' right

[quaint sparrow]

Staff are aware of users having issues unputing answers.

[warm sage]

Perfect thanks for the response mate

[livid escarp]

Gave +1 Rep to @quaint sparrow (current: #1 - 3343)

[sour gale]

🙂 turns out they were not! Lol

[spare mirage]

Is everything ok now 🙂 ?

[sour gale]

Yep finishd it. was missing a single character in the password lol

[spare mirage]

Glad to hear that , keep up the good work 🙂 🚀

[sour gale]

thanks and thanks for the follow up

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2832)

[cosmic mica]

I'm trying to solve this question but isn't solve it. Room Link: https://tryhackme.com/room/monikerlink

[spare mirage]

Try to refresh the page and copy this ||file://||

[cosmic mica]

Same issue..

[glass depot]

seems ok now

[cosmic mica]

Yes.. Thank you.. 😊

[candid drum]

Hi I am stuck with CI/CD and Build Security room. I forgot my password (to mother) and now I neither cannot login nor to register again. How to proceed??
I even restarted the room and reset all progress but it didn't help

[full sonnet]

Hey in the room Nmap Basic Port Scans, Task 5 i have done the nmap scan but there's no new ports with 4 digits, im assuming the service has been deleted from the machine

[spare mirage]

Can you provide a ss of what's going on ?

[spare mirage]

add -p- flag to your command 🙂

[spare mirage]

Are you sure that you're using the right machine , this room has 3 diffrent machines 🙂 ?

[full sonnet]

oh shoot this one got over my head

i feel dumb now 💀

[novel carbon]

for me you're good with the IP, check your first screenshot (left pane and right pane)

[full sonnet]

i have started the machine for task 5 TCP SYN Scan and now im getting one only open port

[novel carbon]

wait a bit more, ports will open slowly, one after the other

[full sonnet]

it worked, thank you ❤️

[livid escarp]

Gave +1 Rep to @novel carbon (current: #16 - 558)

[rotund spire]

Hi 👋

Maybe it's bug, but greater than that ( >= ) so... if we take greater than 65 it means 65, 66, 67 and so on so forth. In this room 3 question task 2 maybe little issue, check pls 😉

https://tryhackme.com/room/nosqlinjectiontutorial

[waxen sparrow]

Hello everyone. Just fyi, the ORM Injection room needs an Attack Box Start Button added to it.

[waxen sparrow]

||ORM Injection, ORMInjection, ORM Injection room, ORMInjection room ||The work around is to start the Attackbox VM from another room then come back to the ORM Injection room.

[wispy moon]

It's =>, not >=. In nosql what you're looking for is $gt (greater than) and $lt (less than)

[rotund spire]

Yeah, I know that => and >= it's different. I mean in question we have $gt ( greater than ) 65, that means we can filter by age starting from 65 then 66, 67 and so on. Why answer for that question " 0 " if we have 1st document that contain "gender" : "male" and "age" : "65"?

[wispy moon]

$gt is "greater than", not "greater than or equal to"

[rotund spire]

ohhh... I'm.... Thanks, I need to revise basic math signs, I thought it's >= not > 🫨

[wispy moon]

Yeah that's why I brought up => and >=, I think because you saw $gt and => right next to each other, your brain naturally thought greater than or equal to

[rotund spire]

Yeap, you're right 😊

[spice meadow]

In introductory networking task 8 Dig
Qesution = what is the very first place your computer would look to find the ip address of a domain

[spare mirage]

What's the name on cache file on Linux that keeps DNS records 🙂 ? it is /etc/..... 🙂 ?

[spice meadow]

Ahh still showing wrong

[spare mirage]

How is it called /etc/..... 🙂 ?

[spice meadow]

I send you a picture please help me out I trying half an hour

[spare mirage]

/etc/h..... 🙂 ?

/etc/ho.... 🙂 ?

[spice meadow]

I send you a picture in private

..... /....

[spare mirage]

Yeah , how is the file called 🙂 ?

[spice meadow]

Hosts

?

Cache

[spare mirage]

Exectly hosts file 🙂

[spice meadow]

😭Thank a lot for helping me out. I didn't think I get help that much fast

Thank you KGB thanks a lot

[spare mirage]

Anytime 🙂

[pseudo jay]

what should I do if the tasks in the room disappeared

[spare mirage]

What do you mean 🙂 ?

[pseudo jay]

write to me and I’ll send you a photo of the bug

[spare mirage]

You can verify and upload an image directly here 🙂
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[spare mirage]

Do you some AV running ?

[pseudo jay]

What is AV?

[spare mirage]

Anti-Virus 🙂

[pseudo jay]

yes

[spare mirage]

Try to disable it temporary and refresh the page 🙂

[pseudo jay]

thank you this helped me, I hope I won't get hacked while my AV is disabled

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2868)

[spare mirage]

Some AVs probably flag some words from the page content and block them 🙂 . Enable AV as soon as you finish the room .

[real grail]

(Nmap Basic port scan room)
I run this command: nmap -sU -F -v 10.10.148.149, and it asks what new port is now open, but only the 2 ports that are in the example are open.

[soft iron]

Hello guys, on room https://tryhackme.com/room/threatinteltools , the "phishtool" task. The emails are given only on the VM but firefox isnt working on this VM therefor I cannot verify the emails on https://app.phishtool.com/. What would be a solution to have the internet work on the vm or download the eml files to my own pc?

[spare mirage]

You can use your own machine

[soft iron]

the eml files arent given in the room

I will try with the openVPN app see if I can copy the files from there

[quaint sparrow]

THM would rather you didn't download room materials to your own machine, this in the event if something was to go wrong, THM would not be responsible, and it's generally not a good idea to remove malicious content from their enviorments.

[quaint sparrow]

You're supposed to use Thunderbird to analyse the emails.

[soft iron]

how are we supposed to use virustotal with thunderbird?

[quaint sparrow]

You just need to take the hash of the email.

You don't need to remove the file for that.

[steel escarp]

not sure if this is a bug or intended, in Phishing Analysis Fundamentals task 6 it says to defang the urls or ips so they cant be clicked, but question 2 doesnt require the email to be defanged, idk if it was intentional but thought it should be here edit: especially since question 4 needs to it be defanged

[true ice]

Passive Reconnaissance - TASK 6:
Question: According to Shodan.io, what is the 2nd country in the world in terms of the number of publicly accessible Apache servers?
Answer Germany, but shodan shows China

[novel carbon]

for the third UDP port, you have to wait for a few minutes, like 5-6 minutes, for the service to be ready
after that nmap is able to see it open

[storm canopy]

Isn't this a bug?

[lime cape]

xpath

[idle python]

No

[still niche]

Is the Incident handling with splunk bugged? I got the email address which I believe is correct: ||[e-mail]|| but it doesn't fit so it just does ||[e-mail]||

[primal radish]

Tcpdump: The Basics - Task 4
For the last question i get the IP address x.y.53.80 but the accepted anwser is x.y.80.53

[quaint sparrow]

Not a bug, could be answer tolerance.

[primal radish]

I could not get it to accept the correct anwser

[rocky dune]

Issue is still present

[fluid gorge]

lol

[storm canopy]

Yeah I solved it but still is weird hahah

[rocky dune]

Not sure if this is the right place to report, but the url in this room (rubyfu[.]net) redirects to a malicious looking page

[idle python]

What's weird about it? It's two different tables. 😂

[wind night]

was the interactive lab shut down or..? (what is network room)

[quaint sparrow]

Should be a static website attached

[wind night]

Apolegies..realised what that icon was

[fleet root]

The remnux room is not loading and freezes…

[storm canopy]

Don't know I'm still a beginner it didn't make sense for me

[signal jewel]

Enumeration Room (https://tryhackme.com/room/enumerationpe)
Task 5
For current release of SNMPCheck, the snmpcheck command simply brings up the GUI, whereas the command that provides the data needed to finish the task is named snmpwalk

[median flare]

Hello, for the room 'LookUp', why i can not access at her web site :

[spare mirage]

Have you added domain to /etc/hosts ?

[median flare]

i restarted my VM, thank you anyway

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2925)

[midnight terrace]

I think the flag is missing a closing bracket

Room: Data Exfiltration

[junior shore]

who on earth implemented this crap flag submission

[junior shore]

I am having the same issue

I have the correct flag but its not accepting it

mine is for a different room but I would imagine its affected in other rooms

[spare mirage]

Try to input your answer without that closing bracket

[midnight terrace]

Did, doesn’t work

[junior shore]

I think its an issue in all rooms

[midnight terrace]

Not all

Some

[junior shore]

Why on earth did they change the flag submission style

like please we do not care about the design of it. We just care about submitting it. I am hoping they roll back to the previous one

[spare mirage]

Luckily i still have * but yeah many people are reporting issues

[junior shore]

What happened during the QA check 😅 . I swear I am able to find an issue for a lot of rooms nowadays.

[junior shore]

@gleaming shadow u able to take a look at this? pretty sure its affecting several if not many rooms.

[junior shore]

Think this is the wrong chat Katherine 🙂

@spare mirage is the site down for u?

literally got a 404 error and cannot even access any pages anymore on THM 😅 .

ok nvm the flag issue is now fixed. I guess they applied some sort of fix that caused me to get booted out of my account. Logged back in and now all is working

[spare mirage]

Works ok for now 😄

[obsidian kiln]

Think that might be a Kali thing:

Not least because the docs haven't been updated and (logically) that scan will always require raw packet privileges. i.e., Linux distros would need to remove the restriction which prevents low privileged users from crafting raw packets. I'd expect that from Kali, but not a distro designed to be stable

Kali definitely seems to be okay with it though

[whole fossil]

Hey everyone. I just wanted to let the THM team know that I've encountered a bug in the Room "CyberChef: The Basics", in Task 5 question 5. The answer is correct but (I suppose) because of the way the input form is structured with a clear URL structure, the correct solution can't be entered because it's in a different structure but the form on the site is hardcoded.
The answer is: https%3A%2F%2Ftryhackme%2Ecom%2Fr%2Fcareers

While writing this I was able to solve the issue but it's still a bug, beacuse the answer to the question is provided directly in the question. Currently the correct answer is defined as https://tryhackme.com/r/careers while it probably should be https%3A%2F%2Ftryhackme%2Ecom%2Fr%2Fcareers therefore either the question is not properly asked or the answer is not defined correctly.
Kind regards, Daniel

[jaunty matrix]

I had the same issue.
To bypass this bug I used Burp proxy (on the attackbox) with a "Match and replace" rule:
Type: Response Header, Match: SameSite=None, Replace: (empty)

Burp would also help to solve some of the questions. Instead of removing the cookie from the browser devtools, use Repeater and delete the cookie from REST requests.

[scarlet narwhal]

The last task called "Msfvenom" in room https://tryhackme.com/room/metasploitexploitation . Seems to have some issues. The virual machine that you start for that part "MetasploitMSFVENOM". Starts up with error "Could not chdir to home directory /home/murphy: No such file or directory". Then it is possible to do the sudo su and get a shell, but every time I switch back and forth between the attackbox and that box, that session is kicked out and stopped. And I need to do the sudo su again. This does not seems to be correct.

[spare mirage]

Start AttackBox in full-screen view and use the provided machine in split-screen view. That way you wouldn't be kicked out of a session 😄 .

[scarlet narwhal]

But what about the missing home folder for user murphy, that does not seem to be a ok error message?

[quaint sparrow]

The directory isn't needed, the machine is probably used for another room and was changed.

[midnight terrace]

Hope this is fixed soon. I have just this flag missing on my learning path and in the room 😂

[strong jasper]

PROBLEM: The underscore(_) character introduces regression when answering a flag.
ROOM EXAMPLE: windowprivesc20
REPRODUCTION: When typing manually a flag containing an underscore in the "Windows Priviledge Escalation" room from the Jr Penetration Tester path, the underscore will automatically delete itself.
SOLUTION: Copy/Pasting flags w/ underscores will work.
PS: As a side note whomever baselined 60 minutes to complete this same room was A BIT too optimistic 😉

[smoky berry]

Velociraptor room task 4 question "Review the output. How many files were uploaded?" Has an error. The answer it wants is 20, but the actual output you get in the exercise is 19 and I confirmed this not just in my machine, but in multipe walkthrough and youtube videos all sharing the same issue

[fast mortar]

this room machine is bugged , i am unable to connect to it when im on my own machine with VPN.
link : https://tryhackme.com/room/ctf

[glad badger]

Thank you for reporting. 🙂

[livid escarp]

Gave +1 Rep to @strong jasper (current: #2656 - 1)

[quaint sparrow]

Have you verified your connection?

[strong jasper]

PROBLEM: Dead link(404) from the Conclusion portion of the windowsprivesc20 room
ROOM: windowsprivesc20
REPRODUCTION: Clicking on the "Hacktricks - Windows Local Privilege Escalation" link brings a "Document no found(404)" tab

[wild anchor]

TYPO (duplicated text)
ROOM: ORM Injection / TASK 5

Let's take a closer look at the source code used by the developer: to Let's take a closer look at the source code used by the developer for the Email (Vulnerable) input field:

GRIPE: "LDAP Injection" room was a mere 16 points. "Server-side Template Injection" room was similarly few points. Contrast with the next room in the series, "ORM Injection" which was 100+ points.

[sly maple]

guys is this machine bugged? or have any issuse?
i cant read the "/var/log/apache2/access.log." file
and i tried everything
even i saw the writeup and still

[tame karma]

In the new Bypass Really Simple Security room, Task 1, "servers" is mispelled as "severs"

https://tryhackme.com/room/bypassreallysimplesecurity

[gusty lotus]

@last loom whatever you did with the answer bar, please restore it to old method. copy pasting screws up,
first Wreath now Snort room

[gusty lotus]

?

[quaint sparrow]

That's a bot.

[gusty lotus]

whom should I contact so they look into it

[quaint sparrow]

You don't need to, this is an issue they're aware of.

Won't be fixed today though

[gusty lotus]

ok

[tropic rover]

Anyone know if the wreath room is down? I try starting up the network and it fails.

[smoky berry]

the pcap is not on the virtual machine tryhackme provides for this task in "thehiveproject" room. Task 5 Question: "Upload the pcap file as an observable. What is the flag obtained from https://10.10.195.217//files/flag.html". Also that link does not work that is provided in the question unless you remove the "s" from "https", since the site uses http

Also new answer format makes it impossible to enter the full answer to this last question for "thehiveproject" room meaning I cant answer it -

[quaint sparrow]

This is a known issue.

[spare mirage]

You have a typo there
THM{FILES_ARE_OBSERVABLES}

[smoky berry]

i cant type the s

its the new answer format bug that scrubz says is a known issue

[spare mirage]

But you're entering THM{FILES_ARE_OBSERVABLER} instead of THM{FILES_ARE_OBSERVABLES}

But those two have same number of characters , only in your is R at the end and it should be S 🙂

[smoky berry]

oh wait wait

wait wait i see what u mean

[spare mirage]

Try it and provide an update

[smoky berry]

yea i did i was SO CONFUSED cause i literally copied the exact answer i found in a walkthrough but its just a copy paste issue not a character limit. Didnt realize the typo at the end

[spare mirage]

Is everything ok now ?

[smoky berry]

these are still issues @spare mirage and obviously copy pasting messing up the answer format, but yea i was able to fix the typo

[spare mirage]

Glad to hear that

🙂

[timid cloud]

That's a problem i encounter moslty in old rooms. It's readable only in light mode or if i have it in dark mode i need to highlight it in order to read it.

[frosty yarrow]

hi, somone can help me with the Loopkup challenge? I can't reach the login page. I'm connected with vpn on my own kali machine

[spare mirage]

Have you added lookup.thm domain to /etc/hosts ?

[frosty yarrow]

oh xDxD, i try

ty very much, but should I do the same on the AttackBox?

[spare mirage]

Yes , if you want to access that domain 🙂

[frosty yarrow]

ok, ty

[daring hollow]

Hello, is this room working for anyone ? https://tryhackme.com/room/shellsoverview
I can't add attachments to show but this is what I see: there is the page structure (room description, "created by" section), but no tasks
thanks :)

[spare mirage]

Do you have some anti-virus software 🙂 ?

[daring hollow]

Yep, Avast showed an alert but I flagged it as false positive, So it was'nt enough ! Thanks, I'm going to investigate that!

[livid escarp]

Gave +1 Rep to @spare mirage (current: #2 - 2991)

[spare mirage]

Turn AV off temporary until you finish the room , many users reported that Avast blocked the room 🙂

[daring hollow]

Ok, thank you for the help! :) 👍

[tidal zephyr]

It appears that something is not working correctly with the URL given (http://MACHINE-IP.p.thmlabs.com) in Task 3 of the room "Splunk: Dashboards and Reports" (https://tryhackme.com/room/splunkdashboardsandreports).

It says it will take 3-5 minutes for the Splunk instance to start, but after 15 it still shows a webpage stating that "Further configuration is required."
This is in both my browser and the Firefox browser in the AttackBox

However, using the Target IP Address directly in the address bar of Firefox on the AttackBox pulls up the Splunk instance.

[civic carbon]

Can I report typos here?

[spare mirage]

Yes 🙂

[civic carbon]

https://tryhackme.com/room/logstash

Task 11, just before the questions, it has you save a .conf and run from location:

/usr/share/bin/logstash/

should be:

/usr/share/logstash/bin/

thanks KGB

[tidal zephyr]

Upon further investigation, it looks like the hyperlink itself is the issue. A copy and paste of the link into my browser rather than clicking on it after the IP has populated pulls up the Splunk instance.

[spare mirage]

Try to enter target IP with - between octets to resolve the issue 🙂 . http://10-10-203-87.p.thmlabs.com/

[spare mirage]

Oh my bad sorry , didn't see this 🙂

[tidal zephyr]

Hah, no worries, I just posted that recently

[spare mirage]

Yeah , I saw it too late 🤣 , but anyway glad that you resolved the issue , keep up the good work 🙂

[true leaf]

Guys, when doing the Olympus room, i send my shell through the chat, but it doesnt show up on the database when i dump it, in fact it only shows the 3 "standard" messages the chat has when you dump the database, is this a bug?

[tame karma]

In Bypassing Really Simple Security, Task 3, it says "Browers" instead of Browsers

https://tryhackme.com/room/bypassreallysimplesecurity

[tame karma]

I have the same issue. ctrl-z and ctrl-y also don't work

[signal jewel]

type the letter before, then after any underscores. I agree though, the old way was better.

[manic flame]

Hi. How much affects operation of the Caldera room if Aurora License is expired? ( License file found
Module: Aurora-Agent
Owner: [e-mail]
Reason: license expired
Valid: false
Valid-From: 2024/01/31
Valid-To: 2025/02/07)

[pearl wren]

Hello, please check the room - "pyLon"
https://tryhackme.com/room/pylonzf
There is an error in getting privilege escalation.
There is probably an error in the certificate itself. Because the room was created a long time ago.
Please check for operability.
Thank you.

[sand pumice]

I'm having an issue where webpages aren't loading, I've waited up to an hour, I can ping 10.10.10.10 and DNS is even working but no website

[spare mirage]

Which website ?

[sand pumice]

Smol right now, but it's occured on others

[spare mirage]

Can you provide a ss 🙂

[spare mirage]

Have you added that domain and subdomain to /etc/hosts

?

[sand pumice]

I just put in the IP

[spare mirage]

Can you provide a ss from /etc/hosts 🙂 ?

[sand pumice]

I didn't put anything in hosts

That's just the DNS working

[spare mirage]

You must put smol.thm and www.smol.thm if you want to access them 🙂

[obsidian kiln]

What DNS

[sand pumice]

Doesn't work

[sand pumice]

The DNS that I'm assuming is running in the room if it can tell that 10.10.35.60 is supposed to be smol.thm

[obsidian kiln]

What makes you think that's DNS?

[spare mirage]

Can you provide a ss from /etc/hosts and machine info box 🙂 ?

[sand pumice]

Oooor now it's working

[spare mirage]

Those domain aren't registered anywhere , normal DNS won't work in this case and as far as i know that machine doesn't have DNS service running 🙂 . So we need to add it to our /etc/hosts , now our machine acts as a DNS server . This doesn't apply just to this room 🙂

[obsidian kiln]

Your machine doesn't act like a DNS server. It just manually maps the hostname smh

DNS in a lab environment like THM is technology possible. I've got a PoC sitting around in a repo somewhere. I've never seen it implemented in practice though.

[obsidian kiln]

And for the record, the term you're looking for here is "virtual host". Worth reading into those 🙂

[smoky berry]

linux fundamentals 3 says its 18 min long, but the provided youtube video is 45 min long. Might need some adjusting

[amber sleet]

I completed the Trooper room a week or so ago it showing that its only been 50% completed. How can this be resolved.

[strong jasper]

PROBLEM: Use of the underscore regresses the next character
ROOM: traverse
DESCRIPTION: When manually typing an answer containing the underscore caracter, typing the next character will sum up in the underscore being deleted. (More explicitly at answer 3). The only solution is to copy/paste an expression containing an underscore and then clicking on "submit".

[quaint sparrow]

Staff are aware of this one.

[dark reef]

I wanted to confirm if this was not an issue on my end.
PROBLEM: cannot access upload-1.php page via target machine and THM Attackbox.
ROOM: Demonstrate Obfuscation
DESCRIPTION: I get four separate warnings relating to an Undefined array key and trying to access array offset on value of type null. Cannot complete Task 8 due to this

[serene vector]

https://tryhackme.com/room/threathuntingendgame

Some sentences or definitions of certain fields are in black font, whilst the dark mode is on, making it sort of difficult to read.
Can be seen in task 3, and task 4.

[spare mirage]

Which room ?

[plush kiln]

hi, I think there is a bug having with ques 2, task 9 in Incident handling with Splunk room. There is not enough space for the second answer due to which i am not able to complete the room. Stuck at 95%.

[dark reef]

All I see is Learn > Demonstrate Obfuscation

[spare mirage]

Can you provide a link 🙂 ?

[spare mirage]

What's your answer 🙂 ?

[dark reef]

https://tryhackme.com/room/obfuscationprinciplesDX

[grave aurora]

Hello, i'm trying to practice pivoting using the wreath room, but i'm not able to see/download the ovpn file for the wreath network. i did it in the past, just wanted to try it again using ligolo-NG.

[spare mirage]

You need to join/start network first 🙂

[grave aurora]

is there a way to unjoin then rejoin the room again?

[spare mirage]

Click start button . You're automatically kicked out of networks after certain amount of time @grave aurora

[grave aurora]

it says it failing to start the network, when i clicked the green start button

i'm not connected to any vpn yet

[spare mirage]

Wreath ?

[grave aurora]

tep

yep

[plush kiln]

[e-mail],

the answer is also given in the conclusion of the room

[spare mirage]

Try with [e-mail] , some user said that it fixed this problem for them 🙂

[grave aurora]

The ovpn for wreath network is not listed in the list of Network VPN server when i go to the access page

[spare mirage]

Yeah , seems like a temporary problem on THM side . I also can't start wreath network

[plush kiln]

i can't type it because the space only accepts .___.

[spare mirage]

Try to copy the above

[plush kiln]

this is what happens when i try to paste it - lillian.rose@po1s0n1v.y.c

[grave aurora]

where can we report it?

[spare mirage]

In #site-bugs channel 🙂

[spare mirage]

It won't let you type either ?

[plush kiln]

nope, the formatting has fixed dots

[spare mirage]

😦

[plush kiln]

im guessing the room creator or thm would be able to resolve it?

[spare mirage]

Yeah , it is already few times in a last few days , should be resolved soon probably

[plush kiln]

okay great, thanks

[hearty prism]

i have uploaded an ova file in tryhackme and after processing its not pinging what to do its is my first box

[quaint sparrow]

What specs have you gave it?

[novel carbon]

thank you for this piece of education
not sure it is smart of Kali to have nmap behave differently than others

[livid escarp]

Gave +1 Rep to @obsidian kiln (current: #10 - 846)

[twilit spruce]

Room Burp Suite: Intruder; Task 10

Room Burp Suite: Intruder: Task 10
When doing everything like described in the task, the respons with the shorter length has the credentials "j.wilcox:corleone"
this works for logging in but is not accepted as the right answer.
Instead "m.rivera:letmein1" is accepted as the right answer but does not work for logging in.

[hearty prism]

i didnt give nothing

[quaint sparrow]

Ram and cores?

[hearty prism]

2gb ram 1 core cpu

it was a ubuntu server

i have using it in nat is there a issue on that

[quaint sparrow]

Maybe drop the ram to 512mb and half core.

See if that helps

As that's what free users get

[dense tiger]

the explanation in premium room oauthvulnerabilities is quite confusing, in task 7 which is about the CSRF:

• The section "Exploiting the Vulnerability" mentioned "obtaining the victim's authorization code and sending it to the attacker", however the following procedure is getting attacker's auth code and let victim send the auth code on attacker's behalf instead. We can even say the description is completely opposite.
• the code snippet is embedded out of the sudden, without further explanation on what it is related to, plus the function naming might be the wrong one, which makes me wonder what's the point of showing this code. After going thru the whole procedure, just realize the code might be showing us a helper function, but yet the link shown in the code is not the same as the screenshot, which makes it more confusing

[boreal steppe]

The data you acquire in the Networking Secure Protocols task 8 challenge is flawed. The data you get from the wireshark analysis is "thm&pass=THM%7BB8WM6P%7". The challenge answer space will not allow you to enter the found PW correctly. There's not enough spaces in the answer prompt. Therefore the challenge is un-solvable.

[spare mirage]

It's correct . It's URL encoded just like it would be in a real request 🙂

[boreal steppe]

assuming you mean that the %7 means a curly bracket?

[spare mirage]

You can use CyberChef to decode it 🙂

https://gchq.github.io/CyberChef/#recipe=URL_Decode()&input=VEhNJTdCQjhXTTZQJTdE

%7B - {
%7D - }

[boreal steppe]

that's what I was missing. They really need to be more clear on how these should be being done.

[heavy stone]

https://tenor.com/view/desmondpacito-cooking-chef-gif-12378159

[spare mirage]

🤣 Not really Cyber but definitely a chef

[heavy stone]

Its his hoby you never know 🙂

[mystic island]

Hi, Found a small error in this room:

CyberChef: The Basics

Task : 5

Error:
The answer of the last question is not correct, The learner should encode the vlaue of the URL according to the question: What is the URL encoded value of https://tryhackme.com/r/careers?
The correct answer is currently the exact same URL without encoding.

[hexed thistle]

Task 3 https://tryhackme.com/room/vulnerabilities101

CVSS v4 is released, the current version is no longer 3.1

[obsidian kiln]

This is true, although it's worth noting that CVSS 3.1 is still very much the standard in use. I can't think of a single org using CVSS 4, although I'm sure there are some.

[hearty prism]

even after making it 512 gb ram and half core still not pinging

[hearty prism]

can anyone here help me

[obsidian kiln]

Well you're gonna have to either strip it down so it doesn't need more than that, or ask THM staff to bump the resources for you.

Dare I even ask what you've got running to make Ubuntu Server panic on 512mb of RAM?

Assuming GB is a typo

[wind fog]

I think I found a bug on the room "Internal". For whatever reason dns resolution to internal.thm does not redirect. Resolving for the internal address using resolvectl query returns nothing. Not sure if this is a new issue or not.

actually looks like you need to add "internal.thm" to your hosts file but that does not make sense at all to have to do that for this lab lol

[swift mason]

I'm solving TryHack3M:Bricks heist but when i spawn target machine and try to open website or mentioned ip (10.10...) it gives me DNS error or content of page take forever to load. Need help 🥲

[spare mirage]

You need to add domain bricks.thm to your /etc/hosts file and use it to access the app

[spare mirage]

That seems like a normal thing not a bug

[swift mason]

Worked!!!

[swift mason]

Changed interface mtu to 1200

[spare mirage]

Is everything ok now 🙂 ?

[swift mason]

Yes

[spare mirage]

Glad to hear that , keep up the good work 🚀 🙂

[hearty prism]

Yes I have just given like that as a typo

Need to reduce that as well ?

[obsidian kiln]

How not?

[obsidian kiln]

Pardon?

[naive barn]

goodmorning everyone new room new noob problem : room hydra task 2 I get errors concerning the password lists i am trying to use.

[spare mirage]

use /usr/share/wordlists/rockyou.txt . passlist.txt is just a placeholder 🙂

[naive barn]

Ah because rockyou.txt i also tried but i guess i need to use full path to it, so that was my mistake 😦 thank you

[naive barn]

How long should it take to find that pasword .. been more than 30 minutes now heheh

ohh i am in the wrong room so sorry

[spare mirage]

You need to specify path also

[naive barn]

yeah sorry i was in wrong room i got it to work but it is still running ( for over an hour now)

[spare mirage]

Also username=^USER^ not username=^molly^ , that's not username placeholder

[naive barn]

ok i will break it off and try again 🙂

[wheat fractal]

For the https://tryhackme.com/room/networkservices2 room, under Task 3 (enumearating NFS), under the section Mounting NFS shares, the breakdown is lacking the destination directory where the nfs share gets mounted

[lucid steppe]

can someone hack me

[sick kestrel]

@hazy tiger

[thick island]

Still having accees problem to the log file: /var/log/websrv-02/rsyslog_sshd.log which is required to finish task 4 in SOC Level 2/Log Analysis/Intro to Logs room. I thing there is a bug since user damainhall does not have access to this file.

[sick kestrel]

did you decompress it first?

[spare mirage]

Open up terminal and use cat to read the file

[thick island]

Please see the sccreen shot I do not have access to compresed (rotated) file and to uncompressed file.

[thick island]

As you can see on the screenshot (and what I tried to communicate) I do not have read permision to the file, so I can not do anything with this file.

[sick kestrel]

i see, i thought you were talking about the file you have highlighed in the SS

[thick island]

actually I do not have access to highlighted commpresed (rotated) file and to the uncompresed log file

[sick kestrel]

i see the permissions are different, read access is not on the user level

[thick island]

Exactly, this maybe a bug in this excercise,,,

[sick kestrel]

is the user in the sudoers group? (im spinning up a VM but it will take a minute)

or the adm group

[thick island]

not in admin. group, and only admin grup has permisions required to open the file

[sick kestrel]

i was able to generate the file with the correct perms.

try terminating the VM, and starting over being very careful with the steps

sudo systemctl status rsyslog
confirm service is running
nano /etc/rsyslog.d/98-websrv-02-sshd.conf

$FileCreateMode 0644
:programname, isequal, "sshd" /var/log/websrv-02/rsyslog_sshd.log

ctr-x & y Save and Quit
sudo systemctl restart rsyslog
ls -la /var/log/websrv-02
** you should see the file with the correct perms**

you can also cat /etc/rsyslog.d/98-websrv-02-sshd.conf to confirm it has the correct file creation perms '0644'

[thick island]

3rd time is a charm :) It finaly worked for me. Thank you very much!

[sour bear]

it is fixed now

[gusty lotus]

please fix the answer bar

this is Phishing Analysis Tool room task 7
this is the From email : [e-mail]

how ami supposed to submit it

[spare mirage]

You need to wrap it in <> N e t f I i x <[e-mail]>

[gusty lotus]

is there any hint provided for the asnwer format?

[spare mirage]

Other than * or _ placeholders , no

[proven haven]

My laptop shows erorr recovery screen how to fix

Please

[quaint sparrow]

Please use General for help regarding your laptop.

[proven haven]

Please easy way

Hi

[rough glade]

Can someone help with the CyberChef: The Basics Room? - Task 5, Question 5. - Think the answer is wrong

||Surely the answer should be https%3A%2F%2Ftryhackme.com%2Fr%2Fcareers||

Or am I missing something?

[naive osprey]

literally cannot answer question as answer box does not allow any characters

• /learnssti room
• task 2 the answer box has {{ by default and does not allow characters
• refreshed the page and still does not work

[spare mirage]

You're right

Site is wrong 🙂

[rough glade]

Legend - Thank you for confirming!

[low shard]

100,000 most common passwords link on Operating System Security task 2 - the page has been removed

[fair quarry]

Anyone very new to Kali Linux here?

[quaint sparrow]

Is this a room bug related question?

[fair quarry]

No. I just felt it’d be more fun to pair with another beginner so we can learn the same thing and the same time.🙂

[quaint sparrow]

Please use #general for such requests

[civic loom]

Hi! I'm not 100% sure if this is a bug or if I'm just being dumb, but on the linux privilege escalation room task 10, nothing's coming up when I start the machine. Every other task when I hit start machine it has opened up a terminal connected to the ssh, but for some reason this one isn't. I've restarted it 3 times and still nothing. It's been 2 days since I worked on the room, so I'm not sure if it's this task isn't working, something got updated and now it's bugging out, or if it's not supposed to launch one for some reason on this task. But it feels like a bug to me.
EDIT: Just wanted to add that I was able to SSH into the machine and complete the challenge, but the actual in browser tab never worked. (Also this isn't at all a bug, but I didn't understand what ./test was at all or why I needed to use it). The next task, task 11 properly opened up the split view machine when it was started, so I do believe that it is just something weird with task 10.

[spare mirage]

It is normal behavior that machine doesn't pop-up in a split screen view and that you need to connect via ssh to it 🙂 .

[lost veldt]

im doing the
enumeration and brute force room
Task 3: [Enumerating Users via Verbose Errors]

I believe the page used http://enum.thm/labs/verbose_login/
doesnt exist anymore?

[spare mirage]

You need to add that domain to /etc/hosts

[lost veldt]

ill move to #room-help

[neat depot]

https://tryhackme.com/room/monikerlink

guys I want to know it the problem is from me, I want to acces this room but can't

I try to ssh into the machine but can't

and even with attackbox I can't

[stone crow]

https://tryhackme.com/room/threatinteltools
Task 7

The Detection Alias is on Talos and not on VirusTotal but the answer is in VirusTotal and not in Talos

[lethal cave]

Hey all. It won't let me input the answer for Task 6 Enumeration through Bloodhound in the Enumerating Active Directory Room. 😦

[cosmic flint]

is there a bug with https://tryhackme.com/room/basicpentestingjt Basic pentesting? I got the password to login to the second user using their password but it does not work

i know i have the right one since i looked at a walthrough after and did everything right

[rich roost]

Hey there 😊
I’m currently working through the Metasploit Module in Room 3, and I’ve run into a bit of an issue. The progress bar seems to be stuck at 50% even though I’ve already completed the tasks in the room.
I’d really appreciate it if you could take a look and help me out!
Thanks so much for your time and support 🙏

[naive osprey]

• https://tryhackme.com/room/prototypepollution
• task 8
• spelling mistake in 1st sentence under Pentesters
• word: mostly

Avoid Using __proto__ : Refrain from using the `__proto__` property as it is mosltly 

[unborn pulsar]

Can you send a screenshot of it? You'll need to verify your account to do so.

[last loom]

@rich roost

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Feb 16, 2025, 12:03 AM

[spare mirage]

Can you provide a screenshot of what's going on 🙂 ?

[warm dock]

https://media.discordapp.net/attachments/763851419806990358/1115138621389938788/01EB7356-D670-4B11-9480-2C058D514A7F.gif

[spare mirage]

Try to leave the room and rejoin. If the issue persists try to report it in #site-bugs channel 🙂

[neon hornet]

Hello, in regards to the Intro to Networking for the question: Which city is the registrant based in? under the WHOIS section - it seems the answer has changed from what was previously accepted by the site. The information given by whois is both the incorrect number of characters and is two words.

[merry creek]

Found a bug in "Intro to IR and IM" first room. You can't interact with it to solve the task and acquire the flag.
Correction: You can solve it, it's just not very well optimized and need to be careful where you place the puzzle.

[obsidian kiln]

The answer hasn't changed.
Did you read the previous question?

[neon hornet]

worked it out, thank you!

[livid escarp]

Gave +1 Rep to @obsidian kiln (current: #10 - 851)

[warm bridge]

Hey there. I am not able to finish task task 8 (What is the IP address of the user who visited the site?) in Lindux Fundamentals 3. Apache Access Log is empty 😦

[spare mirage]

Try to insepct apache.log.1 file

[warm bridge]

i did. the answer is not there 😉 i also restarted sthe machine.. access log has always 0 size

[spare mirage]

CAn you provide a screenshot ?

You will have to verify first
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[warm bridge]

dont know how 😦

[spare mirage]

Follow instructions from the link above

[warm bridge]

afk

[spare mirage]

You're inspecting logs on your AttackBox , you need to connect via SSH to target machine and inspect logs there 🙂

[warm bridge]

I know. But when i am trying to access the logs on the other machine i am getting an access denied

ok, the second file works. getting access denied only on the first one. thank you!

[rich roost]

I tried but not working also tried to reset the progress but still the same.

[spare mirage]

Try to report it in #site-bugs channel then 😦 . Probably some issue on THM side

[radiant slate]

Cyberchef task5 question 5
https://tryhackme.com/room/cyberchefbasics

encoding url doesn't match
help pls

[raw bison]

Should be fixed, check again please

[radiant slate]

yeaa i found a bug
thank it's work now

[livid escarp]

Gave +1 Rep to @raw bison (current: #5 - 1847)

[raw bison]

Mh, okay it seems to accept the URL encoded value but represents the answered question wrongly. I need to raise that. But I guess you should be able to answer it.

[last creek]

Small note for Wreath:Task 45, link for Offsec's sample pentest report (shows 404) could be replaced with https://www.offsec.com/reports/sample-penetration-testing-report.pdf

[velvet pebble]

Recon-ng does not work in the attack box. Modules are not loaded.

[storm canopy]

in activerecon room, aren't theese IPs the tryhackme.com ones and not the last ones before reaching tryhackme.com?

[supple steppe]

Armitage doesn't start on AttackBox -> Room is specifically based around using the Blue_exploit through armitage.
Any workaround?

[spare mirage]

You can use metasploit . Armitage is just metasploit with GUI 🙂

[supple steppe]

ooh okay lemme look up cli commands then 😄

[livid escarp]

Gave 1 Rep to kgbkp (current: #2 - 3306)

[spare mirage]

You have room that explains blue exploit with metasploit , you may want to check it out 🙂
https://tryhackme.com/room/blue

[tidal zephyr]

Forgive me if this doesn't qualify as a bug, but it's a typo that I feel should be fixed.
In Task 5 of the Atomic Red Team room (https://tryhackme.com/room/atomicredteam), the example PowerShell command in the Sysmon section reads:

Invoke-AtomicTestT1547.001 -TestNumbers 1

but it should be:

Invoke-AtomicTest T1547.001 -TestNumbers 1

I stumbled on the missing space for a bit (not noticing it because this is my 4th room of the day 😵‍💫) wondering why the command wasn't working...

[tidal zephyr]

Also, I keep getting an expired license for Aurora for the same task as above:

[rigid robin]

In the room Nmap Post Port Scans Task 4 , third question: Launch the AttackBox if you haven't already. After you ensure you have terminated the VM from Task 2, start the target machine for this task. On the AttackBox, run Nmap with the default scripts -sC against MACHINE_IP. You will notice that there is a service listening on port 53. What is its full version value?
The problem is that everytime i try to scan that port i will get that the port its closed/filter and i tried fragmented scan, using decoys, custom packets, max-parallelism , scan delay everything (in my opinion) and i cannot get that answer if you are kind to help me

[spare mirage]

Can you provide a screenshot ? You will have to verify first 🙂
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[rigid robin]

yes sorry

[spare mirage]

Start the machine and perform scan 🙂

[spare mirage]

Specify port nmap -p53 -sC <ip>

[rigid robin]

i tried that too

[wraith ginkgo]

In CI/CD and Build Security, someone managed to delete the Enviroments repo in Gitlab. You can't move forward without it. Can someone force reset? It's at 4/5.

[spare mirage]

Can you provide screenshot of machine info box ?

[rigid robin]

i tried to restart the machine

[quaint sparrow]

Please remove the flags

[spare mirage]

Try to add -sV flag also

[rigid robin]

nothing about port 53

[spare mirage]

Can you try to restart the machine ?

[rigid robin]

i tried this many days and many times

i tried this friday saturday today and nothing

[spare mirage]

I will try to start the machine later and i will reach out to you with an update 🙂

[rigid robin]

thanks a lot

[spare mirage]

Can you just send a room link just to make sure that i don't go to the wrong room 😄

[rigid robin]

yes sure https://tryhackme.com/room/nmap04

[spare mirage]

Thank you 🙂 . I will reach out back to you as soon as i can 🙂

[livid escarp]

Gave +1 Rep to @rigid robin (current: #2679 - 1)

[wraith ginkgo]

Hello, Enviroment Project still missing after reboot in https://tryhackme.com/room/cicdandbuildsecurity.

You can't do Task 9.

Meaning: http://gitlab.tryhackme.loc/ash/environments/ This link returns 404.

[quaint sparrow]

Thanks, I've pinged staff with this one.

[livid escarp]

Gave +1 Rep to @wraith ginkgo (current: #2679 - 1)

[spare mirage]

Hey @rigid robin , I just ran the scan and i got the results on the 1st try. Try to start new machine instance later and try again it should work .

[rigid robin]

at bind version what its 9.9x ...

[spare mirage]

Yeah it was something along those lines

[rigid robin]

that its the answer

i will try again

tomorrow

[rigid robin]

incredible

[waxen sparrow]

Just FYI, I noticed in the fileinc room there are a lot of formatting and grammar/wordage issues that make the content harder to understand and sift through.

For example, this snippet from the bottom of Task 5, a big part of the sentence is invisible until you highlight it:

[spring crag]

Hi
I have a problem with Practical Exercise on Cyber Security 101
Security Solutions
Vulnerability Scanner Overview
Qestion is "What is the score of the single high-severity vulnerability found in the scan?"
But scaner found only 1 medium and 1 low vulnerability 😦

[dusty raft]

Had the same issue, but there is a scan-report html on the desktop.

[spring crag]

thank you

[hazy tiger]

Hey everyone,

We're moving bug discussions to a new forum channel to help us better organise and track bug reports.

🔗 Bug Reports Forum: https://discord.com/channels/521382216299839518/1333993673381253162
📌 Post Guidelines: https://discord.com/channels/521382216299839518/1333994601157103626

Before submitting a bug report, please:
✅ Check existing posts to avoid duplicate reports.
👍 If you're experiencing the same issue, use the reaction instead of creating a new post - this helps us assess impact.

This channel will stay public for reference but will be locked moving forward.
If you have any questions, issues, or feedback, feel free to DM me or use the #community-feedback thread.

Thanks for your cooperation! 🚀

[weary pier]

Hello, not a big deal but on the first metasploit course (may be others too), even if i have already add 1 hours to the machine, the page send a pop-up to tell me the machine expire soon (even if my machine count say i still havec 1h02). And the machine stop after the 2min like if the hour was never added (im using an adblocker, may be its linked).

[thick panther]

The box doesn't stop, you just need to refresh the page and your IP will be listed again

It's a weird site bug that's in progress for a fix

[weary pier]

Ok thanks, its working 🙂

[compact meadow]

👀

[wheat fractal]

Alfred room does not seem to have a root.txt flag

[viral cobalt]

it would likely be in c:\Users\Administator\Desktop\root.txt

[wheat fractal]

Not according to the room:

I've searched filesystem for root.txt