room-bugs

[celest dune]

is there any problem in
https://tryhackme.com/room/alfred#
i can't get shell via nc ?
i try the hint but also no shell

the ps1 already upload from python3 -m server.http

[mental escarp]

I've noticed an issue with this room: https://tryhackme.com/room/lfibasics
Did a bit of a search in #room-help and noticed a couple of people experiencing the same problem, but no solutions.
The problem is with Task 3 when accessing the log file at /var/log/apache2/access.log
I'm getting a 500 status code as it seems that the page is missing. I went as far as to find some walkthroughs (just to make sure I wasn't going completely crazy), and the url I am using is correct according to the couple I looked at.
I don't know if this can be fixed, or if the relevant people are aware of it already. But I thought I'd make it known to be sure.

[fast bear]

Hey everyone! On the room uploadvulns (https://tryhackme.com/room/uploadvulns), I am having internal server errors every time I try to upload files (png, PHP, whatever)

Even with correct extensions (due to script filters) I can’t upload

[obsidian kiln]

Well that's a new one

Could you explain exactly what you're trying?

(cc @fast bear -- apologies, didn't realise this was back a bit 🙂 )

[fast bear]

Yes! On the task 7 (bypass client side filtering) I am trying to upload a png file in the Java.uploadvulns.thm as normal (clicking on the site buttons and selecting a simple png file to upload)

But it gives me the 500 error

The same thing happens for the task 8 and 9 when I try to upload a simple image (png) file

[obsidian kiln]

Checking now 🙂

[obsidian kiln]

Weird

That's worked for me

Same with task 8 for that matter

Could you deploy a new instance of the VM and see if the same thing is happening @fast bear?

[fast bear]

Trying again 🙂

Now it is working!

Thanks - rebooting is always the answer

[dusty depot]

Hi, i want to share a problem in room/bashscripting, Task 4, Question 1: How can we get the number of arguments supplied to a script? Question 2: How can we get the filename of our current script(aka our first argument)? Hint: "This is using the $n feature we looked at" <-- This Information was not given to me as no-premium-user(yet)... Only Google helped me... This Task could need a improvment by adding a deeper Explaination of what $ can do, because although I answered correct Im still confused about the function... I have a clue about it but surely others could have a bad time searching for this particular two answers. Also in the last Question: " What will the output of “echo $1 $3” if the script was ran with “./script.sh hello hola aloha” " is a missing word "do", a incorrect grammar. I hope this Report will help maybe...

[marsh flare]

In the Active Directory Basics room, task 5 is this sentence: "The type of trusts put in place determines how the domains and trees in a forest are able to communicate and send data to and from each other when attacking an Active Directory environment you can sometimes abuse these trusts in order to move laterally throughout the network." I think there should be a period in between other and when.

[magic wharf]

I'm having the same issue. I guess it's time to redeploy the VM.

[mental escarp]

Just as an update to my previous post,. I tried again today, this time from a different computer, and now I am able to access the file. I'm not sure if the issue was on my end, or if it got fixed overnight on the back end, but everything seems to be working fine now.

[ionic cradle]

Complete Beginner Path - Nmap - Task 14 - Question 1
The correct answer is "N", but as you can see in the screenshot, the host is responding to ICMP requests

[eternal summit]

ping 10.10.83.239

You didn't check if it was responding to ICMP, you checked if it responded to any of those (assuming you were running as root)

[ionic cradle]

Didn't run it with root, so it only sent the SYN packets. Thx and sorry for the false claim!
Strangely the host seems down if I run the same command as root. Shouldn't it be up too, because besides the ICMP echo, ACK packets and ICMP timestamp request, the SYN packets get send too?

[livid escarp]

Gave +1 Rep to @eternal summit

[eternal summit]

¯_(ツ)_/¯

[ionic cradle]

So the best way to determine if a host responds to ICMP packets is by using ping?

[eternal summit]

ping sends icmp echo requests

It determines if it responds to icmp echo requests. It doesn't check other types.

[ionic cradle]

Thx

[digital plume]

https://tryhackme.com/room/brainpan
no flags?

[eternal summit]

Correct, no flags.

[brave prism]

Site: https://tryhackme.com/room/networkservices
Module: Network Services
Task: 3
?Error: Picture (https://image.flaticon.com/icons/svg/2879/2879093.svg) doesn't load.

[hollow vector]

I've not necessarily got a bug, more of an inconsistency in what was asked vs. what the answer was in a room, is this place still alright for that?

[obsidian kiln]

Aye, go for it 🙂

[hollow vector]

awesome

On Phishing Emails 5 https://tryhackme.com/room/phishingemails5fgjlzxc
Question 1 gives you an incorrect hint. The answer is actually in US format and also it expects you to enter a yyyy rather than yy

[hollow vector]

Interesting that one. When I right-click the image and want to view it I see this

[dawn cipher]

hey, I think there is a wrong answer for the question in https://tryhackme.com/room/investigatingwindows
The said question is "At what time did Windows first assign special privileges to a new logon?"
None of the answers seem to be correct

[digital plume]

room thefindcommand

should be

find / -type f -perm 004

wording is a bit werid.
could mean anyone can read, but not above, group or owner can be any permission.
Then it would be impossible to do since - is inclusive and / would return false positives with group or user permissions.

for example

rwx r-- r-x file1.txt

would be returned for find / -type f -perm /444, which is clearly a file not meant to be found by the criteria in text form.

sure, that permission makes no sense, but the point is the same.

[gleaming shadow]

004 is not readable by everyone though

[frozen jolt]

https://tryhackme.com/room/networkservices task3 , img element not working ...

[frozen jolt]

same img error in task4

of that same room'

[west canopy]

hi guys, i was trying out the internal room(https://tryhackme.com/room/internal) and the static resources are not loading for me(GET http://internal.thm/blog/wp-content/themes/twentyseventeen/assets/js/jquery.scrollTo.js?ver=2.1.2 net::ERR_NAME_NOT_RESOLVED and many other) could someone help me out if this is a problem on my end...

[eternal summit]

This is indeed an issue on your end

Or more accurately, something you haven't done.

[west canopy]

okay thanks for replying, i will try a different path then😃

Update: found where i was going wrong, Thanks @eternal summit

[muted panther]

https://tryhackme.com/room/puttingitalltogether

Not sure if this is actually a problem, but under "How Web Servers Work" one of the example web servers is simply "NodeJS", shouldn't it be something like express.js?

[eternal summit]

Nodejs can run a webserver. Express is just a framework for node.

[muted panther]

Oh I see, my bad. I thought express was used to run the web server itself.

[obsidian kiln]

Is it not still a package within NodeJS?

Inbuilt or otherwise

[eternal summit]

Probably ¯_(ツ)_/¯

[wheat fractal]

Nmap Post Port Scans Task 3

Run nmap with -O option against MACHINE_IP. What OS did Nmap detect?
You can get to the answer with -sV and not with -O as suggested.

[sonic willow]

not a bug, -O is the 'official' way to run operating system detection
https://nmap.org/book/man-os-detection.html

[wheat fractal]

Correct. But the instruction is to run an -O test and to answer the question with that, but it does not show the answer to that question!?

[sonic willow]

ah my bad sorry i didn't read your ss properly

[halcyon zenith]

Network Services 2 > Task 4 > run ./bash -p

Any help with this issue, i've restart everything but no luck.

[wheat fractal]

Not a bug. You've downloaded the website and not the binary file.

[halcyon zenith]

Ahh okay xD

ty @wheat fractal

[livid escarp]

Gave +1 Rep to @teal ledge

[teal basalt]

That's _asnwer tolernace_😄

[flint robin]

Room: https://tryhackme.com/room/bpvolatility
Task 4 doesn't have a download link attached.

Could be fixed by maybe including the hash in hint.

[white skiff]

room: https://tryhackme.com/room/walkinganapplication

Task 4's flag is impossible to see for screen reader users.
Don't get me wrong, the task is doable enough, and the objective can be completed without issue, but the way the flag is a generated css background image makes it impossible to reach or read for assistive tech which means these users can't progress even if they get the approach right.

[minor star]

room: https://tryhackme.com/room/vulnversity
Task 4 first question. All files I tried to upload to the target machine's upload page were blocked regardless of extension. I'm assuming image files should have been ok and that possibly PHP files would be blocked.

[eternal summit]

I'm pretty sure it's a whitelist with the correct extension, not a blacklist.
It's working as intended.

[minor star]

well I cant see how I can answer the question if I cant deduce the common extension thats blocked if they are all blocked. That was why I thought there was a bug with the room. I'll keep trying 😉

[eternal summit]

It's a webserver that runs PHP.
As a pentester that's found an upload form, you'd logically want to upload a certain file type.

[wheat fractal]

Can someone take a look at this question, did I spell it wrong?

Room name : Nax
Görsel

[eternal summit]

MSF changed the exploit name/path

Yes, this is a bug, but the room creator is inactive

[wheat fractal]

okay thanks ı found it

[livid escarp]

Gave +1 Rep to @eternal summit

[strong arrow]

On the room solr in the Discovery part (task 3) it says to visit it, but to see the web interface you need to add /solr at the end which is not mentioned.

[robust niche]

It is common for the attackboxes to access the web ? Shouldnt this be disabled?

Might be that i've just not tried browsing the web through the attackboxes before

Nevermind seems to be allowed, i just never use the attackboxes so it was a surprise to me 🙂

[rugged canyon]

if you are a subscriber your attackboxes can access the web and it is allowed and encouraged and used for some rooms... if you are a free user you can not connect to the web through the attackbox and that probably covers the liabilities with this potential problem

[patent pelican]

hello, I found the answer to the question in this room, but every time it says wrong, I think it's a bug, I would appreciate it if you could help me.

https://tryhackme.com/room/malresearching?__cf_chl_rt_tk=WE5_OtRoYxGcuCsm_VcbegwebmDIuITE4BsT.4SezpI-1641824280-0-gaNycGzNCSU

4 task 3 Questions

https://any.run/report/c378387344e0a552dc065de6bfa607fd26e0b5c569751c79fbf9c6f2e91c9807/3363fde4-111b-4aaa-b73d-e4144433c284

even though this is the answer it says wrong

reply:
16/09/2019, 13:54:48

[green charm]

Hi
in room https://tryhackme.com/room/xss
And task 9
An image is missing

[ornate stirrup]

Hey all, I'm not sure if it's a bug per se, but I did find an unused flag in https://tryhackme.com/room/walkinganapplication , title acmeitsupportv10 . Not to get into too many details without spoiling the room for others, but it's after you have the ability to log in to the framework. It doesn't look like the flag's used for any of the tasks.

[obsidian kiln]

iirc the box is reused in other rooms in the module 🙂

[ornate stirrup]

A-ha! Getting a bit ahead of myself, then. Cheers!

[loud heart]

Am I the only one who cannot access the http://machine_ip:8983/ address in
https://tryhackme.com/room/solar ?

[solar drum]

Have you start the target machine?

[strong arrow]

http://machine_ip:8983/ is something that is there until the machine is started, the machine_ip part will get replaced with the machine ip when it has started, so for example if the machine ip is 10.0.0.0 then the link on the page will end up being http://10.0.0.0:8983/, and this is the same on every machine.
Also don't forget to connect to the vpn if you are using your own computer instead of the attack box.
(This is because the ip is not the same all the time because every user has their own instance of the room, this is also why all the progress on the machine resets when you terminate the machine and start it again)

[plucky cave]

Hi.... on room "Python Basics" Task 8 ... I can't seem to get the flag to pop

[verbal geyser]

Hi! On https://tryhackme.com/room/bufferoverflowprep#.
'Type "HELP" and press Enter. Note that there are 10 different OVERFLOW commands numbered 1 - 10. Type "OVERFLOW1 test" and press enter. The response should be "OVERFLOW1 COMPLETE". Terminate the connection. '
Doing OVERFLOW2 test doesn't change and it gives the same params as OVERFLOW1

[dense garnet]

Room: https://tryhackme.com/room/kuberneteschalltdi2020
Problem with VM loading up with only port 22 open, tested multiple times and still stays the same.

[wintry thunder]

Room Red Team Threat Intel - https://tryhackme.com/room/redteamthreatintel
Task 7 Question 1 is not requiring the flag to complete. Intended ?

[simple shell]

It seems to have been fixed

[glad badger]

Fixed. 👍

[coarse trail]

Does anyone know if the kubernetes instance on Kubernetes Chall TDI 2020 is messed up? Doesn't seem accessible to connect to and I had someone else try it and they said they couldn't reach it either. Doesn't show the port it should be on in any scans.

[obsidian kiln]

For the love of

[loud heart]

Hey, thank you so much for replying. But yes I used the IP which was assigned to the attackbox. Still I wasn't able to access.

[livid escarp]

Gave +1 Rep to @strong arrow

[dense garnet]

I reported it so much but couldn’t seem to get an answer!

[eternal summit]

That will be the wrong IP.
The target machine and the attackbox are different and have different IPs

[coarse trail]

Yes, I saw your post here. I submitted via feedback on the site, and just came here early this morning to see if anyone mentioned it (first time here) and saw you posted but no response. I DM'd someone on the site to have them try it and they also couldn't connect to the kube. I've tried it five different times on three days since sometimes restarting the machine works after waiting a bit.

[strong arrow]

Were you conected to the vpn?

[dense garnet]

Ill try it! Thanks!

[livid escarp]

Gave +1 Rep to @coarse trail

[coarse trail]

Well, not saying it is working. I haven't tried it again in a few days. I was planning on trying it again today, but if you're going to, post here and let me know if it finally worked for you, if you could be so kind and have the time.

[eternal summit]

@dense garnet @coarse trail it's being investigated

[coarse trail]

Cool, thank you for letting us know!

[livid escarp]

Gave +1 Rep to @eternal summit

[dense garnet]

Thanks James!

[livid escarp]

Gave +1 Rep to @eternal summit

[bleak chasm]

Room - Linux Priv Esc
Module - Privilege escalation Sudo
Bug - Got the flag without privilege escalation

[loud heart]

Yes.

[strong arrow]

Wait... did you use the ip for the machine or for the attack box?

[loud heart]

How can I get the permission to share attachment here?

[strong arrow]

idk

get verified maybe?

btw try adding /solr/ at the end
so it would be https://machine_ip:8983/solr/

[loud heart]

Okay let me try

[wheat fractal]

!docs verify

[tropic flame]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[loud heart]

Thank you very much :)

[livid escarp]

Gave +1 Rep to @teal ledge

[loud heart]

Thanks!! it worked :)

[strong arrow]

lol I had the same issue earlier

[loud heart]

Hehe okay 👍

[mint orchid]

Should we submit typos and such here?

[simple shell]

Could, I guess. Let the room creator know.

[mint orchid]

Just tag them?

Not sure if this was intentional or not but in the ZTH: Obscure Web Vulns room under task 4. The two questions seem to use the wrong syntax for the payloads.

The first accepts:
{{config.__class__.__init__.__globals__['os'].popen(/etc/passwd).read()}} but it should be {{config.__class__.__init__.__globals__['os'].popen('/etc/passwd').read()}}

The second accepts:
{{ ''.__class__.__mro__[2].__subclasses__()[40]()(/home/test/.ssh/id_rsa).read()}} but it should be
{{ ''.__class__.__mro__[2].__subclasses__()[40]('/home/test/.ssh/id_rsa').read()}}

[simple shell]

Paradox doesn't seem to be in here, though I think you can send a message on THM itself.

[mint orchid]

I tried clicking on his username at the bottom of the room but didn't see an option to message.

[simple shell]

Oh

RIP

[mint orchid]

shrug I tried!

Maybe its a clever way to get people to RTFM. 😄

[eternal summit]

That's answer tolerance

[mint orchid]

Fair, they also don't seem to work in the lab without the changes I mentioned.

[eternal summit]

Yeah. That's answer tolerance for you.

It's not something room creators have control over

[simple shell]

Oh, there's a set/default tolerance?

[eternal summit]

There's a tolerance that room creators have zero influence over

[simple shell]

That explains some of my typos that have been accepted as right answers.

[eternal summit]

x% wrong or whatever

[mint orchid]

I probably wouldn't have mentioned it at all but that extra '()' in the second example is misleading. It's also included in the instructions.

[eternal summit]

Now that is a bug that can and should be fixed.

[mint orchid]

Woo! I did a thing.

[simple shell]

+rep @mint orchid

[livid escarp]

Gave +1 Rep to @mint orchid

[rotund burrow]

Cyber Defence Path / Cyber Defense Introduction / Network Services / Task 3 Enumerating SMB first image is not loading.

Tried 2 browsers... Am i missing something important from that pic, does anybody now?

[simple shell]

May be your network. My work network doesn't load any images from the tasks. Can make doing the rooms a little harder, but not too much so.

You're probably not missing anything vital.

If you get truly stuck, you can look at a write-up for the missing info

[rotund burrow]

I'm from my home network it's not blocking it other images in other tasks or rooms load without problems. I will go with it and will search for it if i get stuck of something you are right.

Found another one in another task in the same room.
Task 4 Exploiting SMB

[simple shell]

[eternal summit]

Nothing important, just icons or whatever

It's a bug with the image host rather than the room, they should be removed

[rotund burrow]

Ohh understood thanks do you want me to remove the messages also from here?

[livid escarp]

Gave +1 Rep to @eternal summit

[eternal summit]

No reason to

[kindred turret]

In the 'common linux privesc' room, Task 9,
Let's go to user5's home directory, and run the file "script". What command do we think that it's executing?

When I execute the script I don't think it is using the command it is supposed to. (I am trying to avoid giving the answer).

[kindred turret]

My mistake, script runs /usr/bin/script. We need to run ./script

[noble needle]

is that /room/linuxprivesc or /room/linprivesc?

[kindred turret]

https://tryhackme.com/room/commonlinuxprivesc

[noble needle]

Oh, a third similar room. Don't think I've seen that one yet. Thanks 😄

Ah, that one is on subscriber track. I was waiting for next pay to subscribe.

[kindred turret]

I thought all hackers/wannabe hackers wear rolex and drive lamborghinis?

[obsidian kiln]

Then you thought wrong 😛

[plucky void]

Room: windowseventlogs Question: "Execute the command from Example 7. Instead of the string Policy search for PowerShell. What is the name of the 3rd log provider?" -> Should be: " ... from Example 8" // EDIT: Actually, I think, the wording in that question is not clear, command from example 7 seems to be ok, but it should be changed a bit. The part "Instead of the string Policy" is confusing, because it looks like the author is referring to example 8

[tame karma]

In room Phishing 3, under Phish Tool. It says "The right pane will show if any URLs were found in the email. In this case, no **emails **were found." It should say "The right pane will show if any URLs were found in the email. In this case, no URL's were found."

[tame karma]

In room Phishing Emails 3, Phishing case 1... It asks about the shortened URL. The shortened URL is|| hxxps[://]t[.]co/yuxfZm8KPg?amp=3D= or hxxps[://]t[.]co/yuxfZm8KPg?amp=3D1. It accepts hxxps[://]t[.]co/yuxfZm8KPg?amp as the right answer.|| The best option is to modify the email to make the shortened URL's match, then modify the answer.

[young magnet]

in room Simple CTF the exploit CVE-2019-9053 give me random salt password username and email and password every time i run this exploit script.

[wheat fractal]

this is the correct answer but it doesn't accept room name : windows priv esc task :16

[glad badger]

You typed an l instead on an I after Se 🙂

[simple shell]

Damn ambiguous fonts

Wait, wouldn't answer tolerance accept that?

[wheat fractal]

İ did it thank you 🥺

[livid escarp]

Gave +1 Rep to @glad badger

[eternal summit]

It should but I wonder if they misspelled privilege too

They did not

[gloomy depot]

Hi
https://tryhackme.com/room/nmap03

In the "Nmap Advanced Port Scans" room

I think the stateless (non-stateful) firewall cannot check the TCP connection state.

[simple shell]

Stateless can't inspect the packet, but it can see the flags and uses SYN to determine incoming connections. Those packets would be filtered against an ACL or list of rules.

[gloomy depot]

So it means the stateless firewall can inspect the tcp packet header and apply the ACL rules

[simple shell]

Yeah, wouldn't be able to do anything if it couldn't inspect the header. That's where the src/dest MAC/IP, the packet type, etc etc are.

[gloomy depot]

Yes right

Actually i think this kind of scanning evasion technique is targeted the capability that some kind of firewall can detect the TCP port scanning just base on the TCP flag SYN and ACK. But if the firewall is stateful this evasion technique will not work because the stateful firewall can detect the TCP port scanning base on analyse the connections state. So it only works for the stateless firewall.

[simple shell]

For a stateful, if I remember right, it looks for pre-established sessions. Whenever a host inside the network establishes a connection to a host outside, that connection is remembered and related traffic is allowed. But if a host outside tries to establish a connection to a host inside unprompted (with a SYN packet), it would be blocked.

[viral mirage]

hellooo, I'm new <3 So I'm going through Vulnversity > Task 3 > What is the directory that has an upload form page? and I realize I don't know how to see the various GoBuster wordlists in order to use them on the target IP. I eventually check out a write up on the box and see they were told a direct link to a wordlist to use ||/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt ; full command being:
gobuster dir -u http://<ip>:3333 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt||, which was not listed in the room for me. Was I supposed to go do some independent research to find a wordlist address (/usr doesn't exist in the AttackBox, unless it does and I just don't know that yet) ; Secondary issue with this task was that the page didn't load for me (slow internet connection issue?) and the ||index.html|| page was the one which did load and showed the upload form page to me. Again, I'm new so there's probably stuff I'm missing. Thank you for your help and advice <3

[simple shell]

The AttackBox uses Kali, and does have that directory. Double-check your spelling. Once you get a scan started, the valid directories should come up pretty quickly.

To make sure I'm not spouting wrong info, I'm firing up an AB now. I usually use OpenVPN, so I may be wrong.

[viral mirage]

they did though I had to go search the internet for a wordlist path (before I looked up the write up); This is usual, yes? We're given some information, but not hand held all the way so I'll have to go and research and learn?

❤️

[simple shell]

Yeah alright, it is at /usr/share/wordlists

[simple shell]

Yeah, basically. For this situation, that path is the standard path that Kali stores pre-loaded wordlists, which come with the distribution. You can always put wordlists somewhere else and use that path instead, or make a link to that directory to make it easier to access. There's multiple ways. Kali is a very popular pentesting distribution though, and is usually used throughout the rooms as reference.

[viral mirage]

ok, so where I fell off the wagon was navigating to be able to see/find the /usr/ directory and further investigate wordlist options on the AttackBox. After investigating the wordlists available, really any choice would get the target IP directories on the ||3333|| port, showing me what I could type into the browser to find what the question was looking for. (Does this all sound correct?)

Secondly, ||index.html|| may have been the page where the upload was, but the question was asking for the directory that page was inside, so fiddling with the output cl request would have shown me that ||index is inside of /internal/||. Also correct?

[simple shell]

I wouldn't say any wordlist. There's different wordlists for different purposes. Some for guessing user account, some for guessing passwords, some for fuzzing webapp input; the list goes on. For directory enumerating, the wordlist you used was a good one, as well as most of the wordlists inside the /dirbuster directory.
Yes, if I remember right, your second point is exactly right.

[viral mirage]

sweet. Thank you so much! :D

[livid escarp]

Gave +1 Rep to @simple shell

[simple shell]

No worries. As you go, you're gonna get familiar with a bunch of tools and resources for pentesting. There's tons of them out there.

[viral mirage]

nice. :) Enjoying it so far. Reminds me a lot of the labs at my school. I lie in wait for my next attackbox hour to come, lol. I thought I could get two hours if I did one at 10:30, then another at 12:05, you know, like it's the "next day", but that didn't work tonight

[simple shell]

I think it does it on a rolling 24-hour period. So 24 hours from when you first fired it up.

OpenVPN is free though and has no time limit.

[viral mirage]

My Active Machine doesn't care how long I go for? only the AttackBox has the one hour limit??

[simple shell]

Active machines load with a 2-hour time limit, but you can add to it at any time.

[viral mirage]

gasp

Thank you!!!

[simple shell]

Doesn't help you if you can't access it though.

[viral mirage]

true... hmm and I would want to access it from Kali with OpenVPN, wouldn't I?

[simple shell]

If you're enjoying it but aren't convinced to get a subscription yet (20% off with a student email), using OpenVPN with your own VM/box is the way to go.

Yes

[viral mirage]

I see.

[simple shell]

Kali is free and really easy to fire up in a VM. You can be up and running inside an hour.

Well, maybe 2. Time for things to go wrong. Something usually does.

[viral mirage]

heh, true

okay, thank you for all the advice (You're 100% correct, I should do the kali vm and Openvpn) ❤️ 👍

[simple shell]

[vale sentinel]

the questions in task 6 - shodan.io from passive reconnaissance are not up to date

except for the second question about apache port

[woven pawn]

In SQL Injection, Norwich's postcode area is NR not N. This might be intentional...

[hazy tiger]

Does it affect the tasks or makes the room impossible to complete? 🙂

[split mulch]

Has anyone resolved this bug- https://tryhackme.com/forum/thread/6015c96e548b1546dc7e1f68 ?
At first it returned "superman" for me, now hydra is returning 14 false passwords

[deft elm]

https://tryhackme.com/room/corp

Last task is asking for a renew of the password

Unfortunately i cannot even renew the password due to a bug on xfreerdp which cause the "(" in the password to not be input in the Windows login password changing box

So cannot login to the administrator session to receive the flag

I tried with different RDP client without success regarding the "("

[bitter lantern]

Broken link in https://tryhackme.com/room/googledorking
http://googledorking.cmnatic.co.uk/

[formal moth]

For LinuxFund3 on Task 4, it should tell you to open a new instance of terminal to wget after you open the webserver.

[obsidian kiln]

@dusky junco

[dusky junco]

Will look after Uni ta @bitter lantern @obsidian kiln

[vernal saddle]

Aloha There, could someone of the staff have a look Mr.Robot room??? it's running really slow thanks in advance

[simple shell]

In the Yara room, task 10, it walks you through generating a new rule for a suspicious file. The task assumes the yarGen will make a rule file with only 1 rule, but it actually creates 5 rules. The following questions follow the same assumption of only 1 rule; the fact that it's 5 makes answering them harder. Not impossible, but more difficult and potentially misleading.

[pale quest]

Has anyone noticed that in windows forensics 1, task 4 question 5 is missing? If you read through it tells you to use network interfaces and past networks to answer question 5, however question 5 relates to a guest user uid.

[jade sun]

Hello i've just completed Introductory Networking room but i've noticed that it didn't give me any points from the answered questions is that normal ?

[ornate stirrup]

The attackbox really does not like the python2 script needed for https://tryhackme.com/room/easyctf . I was able to install missing python2 modules after I downloaded and installed a python2 version of pip, but the script doesn't want to run as designed. FYI, pip won't support Python2 after Jan 2022. I know it's an older room, but it might need looked at.

[jade plinth]

room: https://tryhackme.com/room/phishingemails5fgjlzxc
Task: 1, question 1
Bug: Wrong format in the question.
Should be: mm/dd/yyyy hh:mm
It's June folks.

[rugged canyon]

could also be that it accepts both as the correct answer as a safety catch

[simple shell]

THM is stationed in London, where they use dd/mm/yyyy. So, it's the correct format.

I say everyone should use ISO 8601, but no one cares what I think, so I shrug and deal with it.

[glad badger]

Thank you for reporting. I've forwarded it to the content developer. 🙂

[livid escarp]

Gave +1 Rep to @jade plinth

[simple shell]

Ohhh I see what he's saying. Oops.

I'll just walk away in shame.

[rugged canyon]

agree heavily with this... why can't such an old international standard be followed more often

[eternal summit]

This is going to be the case for thousands of exploits, it's an infosec problem that loads of people will face.

[dense garnet]

Room: https://tryhackme.com/room/kuberneteschalltdi2020
Still doesn't work, hasn't been fixed in a couple months, Thanks!

[ornate stirrup]

Including that room! :)

[jade plinth]

it's not accepting both

[jade plinth]

ok, but correct answer is June 10th, not October 6th

[dusky junco]

hey yes this has been raised since you (mostly as a result of you) reporting it as a point of action / query to the creator as to whether or not it needs changing (:

[dusky junco]

hey ((: I believe this has been changed to reflect the answer that you're expecting now. Can yo utry and let us know please? 😄

[jade plinth]

It's correct now, thank you very much for fast response :)

[livid escarp]

Gave +1 Rep to @dusky junco

[dusky junco]

sweet sweet (: glad it's all good. I'm a small cog in the machine of getting it fixed 😄

[restive urchin]

This old typo is still present on the room.

[vernal saddle]

any update?????

[jade sun]

?

[eternal summit]

That's a very old room. One of the oldest.
It runs wordpress. WordPress is heavy. It's hard to get good performance out of it.
The room is completable either way.

[vernal saddle]

other rooms run wordpress as well and I haven't had that issues, so because that is old room it's not and enough excuse to improve it or have a look what is wrong, even more for the people who is paying a subscription. you say that it's completable but what waste of time just running hydra :S 😦

[eternal summit]

Oh, the hydra issue is something else.
You didn't remove duplicates.
Remember that mods aren't site staff.

[obsidian kiln]

That room just outright needs removed.
I suspect the abnormally high resources it requires come from the way WordPress is installed. It might even be running with a desktop environment iirc, which won't be helping.

But yeah, reverse the wordlist if you want to get the password within the 5 minute rule

[vernal saddle]

I did remove duplicates, I just mentioned as an example no focus on that.... but in general that room not stable at all to perform the attacks to solve it... I don't wanna waste time

[obsidian kiln]

@glad badger Mr Robot... again :)

[lost cove]

Hi there seems to be a problem in the Splunk 101 room on the cyber defender path. the answer for Task 6 question 1 is different than what the external site is giving

I tried some different things but can't find the intended answer

But it should be very straightforward

[dense garnet]

Room: https://tryhackme.com/room/inacave
the room is supposed to display a || deserialised || output in a few directories but doesn't, this leads to the room not being exploitable at all.

[dense garnet]

I managed a work around, but had to use the writeup for it

[glossy berry]

The windows Forensics 1
Task 7/ 1st question
The Kingston serial number
If you type the correct 26 digits 😑
The answer will mark as incorrect
After half an hour, of trying
I replaced "8" with "B" and I got correct answer
The right answer from the screen shot provided by the room is
1C6F654E59A380C179D366AE&0
The change I have to make is
1C6F654E59A3B0C179D366AE&0

[eternal summit]

This has been raised internally, it's some weird scaling making the image look weird

[glad badger]

I'd suggest to save the image, load it into an image viewer, and zoom in. 🙂

[hasty lodge]

Room SoMeSINT: https://tryhackme.com/room/somesint

Task 4, 2nd question requires to search the "shadowban API" using the shadownban.eu. Unfortunately it seems that the shadowban website has shut down permanently so now the only way to complete this task is to read the answer on a walkthrough.

[hasty lodge]

Still on the same room above but on task 6, question 5:
We are asked to find some information that is in a ghostbin link. The link doesn't exist anymore so it doesn't work.

Link in question is the one mentioned on the image below.

[tired flicker]

Hello

There is problem, the room CC Pen Testing

For smbmap one answer will not be marked as correct and same for smbclient. Also the database 'tests' on the room VM the tables are both empty - there should be a flag in one of the tables

[15:46:08] [INFO] retrieved:
Database: tests
Table: msg
[2 entries]
+---------+---------+
| m | v |
+---------+---------+
| <blank> | <blank> |
| <blank> | <blank> |
+---------+---------+

[15:46:08] [INFO] table 'tests.msg' dumped to CSV file '/root/.sqlmap/output/10.10.127.71/dump/tests/msg.csv'
[15:46:08] [INFO] fetching columns for table 'lol' in database 'tests'
[15:46:08] [INFO] used SQL query returns 1 entries
[15:46:08] [INFO] retrieved: flag
[15:46:08] [INFO] retrieved: varchar(100)
[15:46:08] [INFO] fetching entries for table 'lol' in database 'tests'
[15:46:08] [INFO] used SQL query returns 1 entries
[15:46:08] [INFO] fetching number of entries for table 'lol' in database 'tests'
[15:46:08] [INFO] resumed: 1
[15:46:08] [INFO] retrieved:
[15:46:08] [WARNING] (case) time-based comparison requires larger statistical model, please wait.............................. (done)

[15:46:08] [INFO] retrieved:
[15:46:09] [WARNING] (case) time-based comparison requires larger statistical model, please wait.............................. (done)

Database: tests
Table: lol
[1 entry]
+---------+---------+
| f | v |
+---------+---------+
| <blank> | <blank> |
+---------+---------+

[15:46:09] [INFO] table 'tests.lol' dumped to CSV file '/root/.sqlmap/output/10.10.127.71/dump/tests/lol.csv'

[eternal summit]

No, there's a problem with SQLMap. Update your SQLMap.

[tired flicker]

OK i will try - I was using an attackbox

And the 2 questions ? Task 20 Q9 and Task 21 Q3

[eternal summit]

DM me what answers you're putting.

[dusty depot]

try-hack-me-advent-of-cyber2-day-1-web-exploitation is full of unsolvable traps, I cant be the only one having massiv timeloss, running into incredible stupid issues tht teached me nothing

[minor magnet]

Hey I am having some trouble with a specific machine on CC: Pen Testing.
ITs for the SQLMap section.
I've tried a load of things but eventually resorted to walkthroughs but im still not getting the flag.
All i am getting is this

Database: tests
Table: msg
[2 entries]
+---------+---------+
| m       | v       |
+---------+---------+
| <blank> | <blank> |
| <blank> | <blank> |
+---------+---------+
Database: tests
Table: lol
[1 entry]
+---------+---------+
| f       | v       |
+---------+---------+
| <blank> | <blank> |
+---------+---------+

I can share the SQLMap commands I have used if needed

[eternal summit]

Update your sqlmap

@dusky junco I think it needs updating on the attackbox because there have been two people complaining about this today

[minor magnet]

I've also lost a lot of my hour due to this. If there is anyway to get some of that back 😕

sqlmap is already the newest version (1.2.4-1).

Update does not seem to help

root@ip-10-10-251-220:~# apt install --only-upgrade sqlmap
Reading package lists... Done
Building dependency tree       
Reading state information... Done
sqlmap is already the newest version (1.2.4-1).

[eternal summit]

Newest, not newest in apt

[tight raft]

I've got an issue in the Splunk 101 room, task 7. I enter the search as directed, but receive nothing in the statistics or visualizations tabs. Its definitely seeing events, but EventID is not registering as a valid search term. Any ideas?

[earnest yoke]

Room: https://tryhackme.com/room/yearofthedog
There seems to be an issue with the user login. I got the password and tried it with the according user against both of the services, but it doesn't work. When looking into the write-up, I see that I did what I was supposed to do. But it doesn't work :/

NVM, spotted my mistake: Was a layer 8 problem, again

[vernal saddle]

https://tryhackme.com/room/corp, doesn't anyone else having issues on the machine after running RDP? also running Invoke-Kerberoast.ps1

[wheat fractal]

Room : https://tryhackme.com/room/passiverecon
Bug : In the summary, Shodan.io service name is misspelled as "Shodian.io"

[ancient jewel]

I think my linux fundamentals part three is bugged, it wont give me the ip i need to check the var logs

need a refresh aparently

[eternal summit]

You don't share instances.
Bear in mind that you need to look in the files you have read privileges for

[ancient jewel]

thanks

[glad badger]

Fixed. Thank you for reporting. 🙂

[livid escarp]

Gave +1 Rep to @pale venture

[reef fjord]

There seems to be a problem with the Splunk 2 room. I cant get it load the splunk instance.

I will appreciate it if someone checks this particular room. It is part of the Cyber Defense path, so I believe it is quite popular.

[wheat fractal]

Linux fundamentals part 2.

I have already done this task, task 2 but for task 5 and other task in this part I need to log in. Password is correct, it's in the task 2 explained.
But didn't work,
so I terminated the machine because I thought maybe restart will help but attackbox can't be open anymore because non sub can only 1 hour a day. But I was only for 10min in the Attackbox. I thought this migt be a bug, also the password didn't work 😅

[hazy tiger]

Hey!

Here -- I hope this should make it clear enough!

In order to properly connect to the machine, first head to the room you want to complete and scroll down to the task that has the "Start Machine" button.
(as you can see in the first screenshot below)

After pressing it, you should see some notifications:
(See second screenshot)

After the two notifications appear, you should see this in the middle of your screen.
Press "Start AttackBox"
(Third Screenshot)

You will use the AttackBox to complete the tasks in the deployable room.
Your screen should look something like this:
(Fourth Screenshot)
Patiently wait for your AttackBox to start, then follow the next steps.

Perform the SSH command as you did, but with the Active Machine Information (as detailed in the task):
(Last screenshot)

So, I would type "ssh tryhackme@10.10.177.11"
Yours should be different so follow whatever is on there:)

After typing the password, you should connect!

[wheat fractal]

Hey thanks for the reply. I did that exact as you described but there wasn't a pop up (in your third screenshot) Instead I clicked on the blue box AttackBok and using the recommend attackbox and so yeah I was in the Attackbox.

Also used the IP-address that is shown for me

Do you mean this actually for the next time?

[hazy tiger]

In the screenshots you provided, you were using the AttackBox's IP address from what I could tell.

You have to make sure you are using the IP address of the machine that you have deployed (which can be found on the Active Machine Information).

As seen, in the second task, when you press "Start Machine" it loads a banner with the IP address you should be using.

[wheat fractal]

I am sure I did the IP also correct. SSH tryhackme@10.10.114.83
If its the IP that's wrong, why can I not use the Attackbox anymore, for today?

didn't use attackbox longer then around 10min, couldn't log in

I mean couldn't log in because of the password and so I terminated the machine to restart, thought maybe would help

[west wren]

Cyber Defense - Security Operations & Monitoring - Windows Event Logs -- Task 4, Questions 3 & 4 <-- answers are wrong. When you run the commands you get different answers

Sorry question 3 has the wrong description, not the wrong answer.

[dusty zodiac]

Windows Forensics 1 - https://tryhackme.com/room/windowsforensics1
Task 8 last question "When was the USB device with the friendly name 'USB' last connected?"
The answer doesn't work for "USB". But does for another USB listed.

[vernal saddle]

Admin pass has expired on the machine....bit tedious type all the password to change it :S

[vernal saddle]

https://tryhackme.com/room/brainstorm
Machine running really slow, I can even connect to the service exposed to get the file.....could you please have a look??..... thanks in advance!!

[vernal saddle]

even not accepting the right answer :S, please have a look!!!

[reef fjord]

Reporting that the room is still having issues

[minor magnet]

Hey I'm still having trouble with the sqlmap challenge on the CC: Pen Testing room.
Re: #room-bugs message

@eternal summit said to update sqlmap. How should i do it?
I've tried updating with apt,
Tried downloading the repo. Tried
pip install --upgrade sqlmap
python sqlmap.py --update

This is all i am getting

root@ip-10-10-10-107:~# git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
Cloning into 'sqlmap-dev'...

fatal: unable to access 'https://github.com/sqlmapproject/sqlmap.git/': Failed to connect to github.com port 443: Connection timed out
root@ip-10-10-10-107:~# 
root@ip-10-10-10-107:~# git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
Cloning into 'sqlmap-dev'...
fatal: unable to access 'https://github.com/sqlmapproject/sqlmap.git/': Failed to connect to github.com port 443: Connection timed out
root@ip-10-10-10-107:~# 

[eternal summit]

Download the repo
Run the script from the repo

Your attackbox doesn't have internet as you're a free user

[minor magnet]

So i have no way to update it ?

[obsidian kiln]

@dusky junco SQLMap needs an upgrade on the AttackBox next clone 🙂

[eternal summit]

(I already mentioned but hopefully both of us will reinforce the importance)

[obsidian kiln]

Is he not away actually?

Oh, yeah, he is. I'll just stuff it on his calendar for him 🤷‍♂️

As I catch up on appeal emails... yay

Knew it was a bad idea to open this

[dusky junco]

Hey, yeah that sounds reasonable. I'll sort this in dev, but I don't think it'll be in prod/live until early next week (monday/tuesday) @minor magnet @eternal summit @obsidian kiln

Let me set a reminder to let you know when it's all sorted, does that sound okay Billybob?

(sorry if I missed your ping Ninja, I try to keep up 😄 )

[glad badger]

Billybob. 😂

[minor star]

Room: Brainstorm. Task 1. Number of open ports as per nmap scan (nmap -sS -sV -Pn -p-) shows 3 open ports only and answer isn't correct. After connecting to the FTP server, doing a directory listing just says "229 Entering Extended Passive Mode (|||49341|)" and does nothing.

[bitter lantern]

In https://tryhackme.com/room/historyofmalware the referenced link https://malware.wikia.org/wiki/Techno is no longer valid

[vernal saddle]

same happening with me... could you have a look please???? @glad badger @obsidian kiln @eternal summit trying to finish the Offensive security path....

[wheat fractal]

How many did you have?

[minor star]

ok, I've resolved the FTP connection problem. Pretty simple and can't believe I overlooked it. ||Need to enter passive mode in your client||

[vernal saddle]

and the answer for the ports are ||double||

[bleak harness]

Investigating Windows 3.x - https://tryhackme.com/room/investigatingwindows3

How many files are supposed to be on the Desktop? I got stuck with the Sysmon question and googled some writeups -- they said there is a Sysmon.evtx file on the Desktop. 😗

[vernal saddle]

I could complete bruteforce part of this room with WPScan instead of Hydra... finally finished the Offensive Pentesting Path 😄

[obsidian kiln]

Oh Lord. So that's why people keep doing that goddamn room.
@dusky junco pinging you to escalate to the right place: I would highly suggest removing that room from the offensive pentesting path.

It's buggy, slow, incredibly CTF-y/unrealistic, doesn't comply with the bruteforce rules, and is generally a pain in the backside

[dusky junco]

Hello

Ngl do you think the room just needs pulling entirely?

Rather than pulling from the pathway?

@obsidian kiln

[obsidian kiln]

I've been nagging Tim to do that for months -- apparently the number of users who attempt it makes it a bad idea, buuuuuuuut, we just figured out why so many users do it

It's in the offensive pentesting path -- you need to do it to get the certificate

[eternal summit]

Isn't it also an ancient vulnhub box?

[obsidian kiln]

It is, yes

[dusky junco]

Ah I see

Okies

I will bring it up for discussion (:

[glad badger]

A maintenance process is part of the 2022 QA plan. 🙂

[prisma pier]

Is anyone here?

I have been stuck on the room DNS in Detail for almost 2 weeks. No one can answer my question so far. The practical does not work no matter how exactly I follow the youtube video. At 13:30 the speaker says he's having an issue, the video cuts for a sec and the speaker comes back and says if your having issue to wait a few minutes and it will resolve itself. This is not working for me. I just want to speak to someone, a real person, who can walk me through what is going on, what is going wrong, etc. I am so frustrated I could cry and I only just started this whole thing.

Just how do you get help? What am I paying for with this website if I am just on my own????

[dusky junco]

Hey, sorry to hear that. What’s your problem / what isn’t working exactly? @prisma pier

[misty halo]

Hello, how are you?

Currently I m trying to do Brainstorm from the penetration path but the issue is when trying to run the execution file downloaded from the server (trying not to give hints) and when I try to run it on the windows system in OSCP Prep, it doesn't want to run (even on admin), I recreated a windows XP/7/10 environment without any success.. Am I doing something wrong or might it be a bug ?

Error given by Immunity debugger: "Exception 40000005 - use Shift+F7/F8/F9 to pass exception to program"

[dense garnet]

Hello!
In the Osiris room (https://tryhackme.com/room/osiris) There is a bug that is consistent, after speaking to the room creator we decided that it would be best to bring it up to the team here! I would love some help.
The bug: || whenever trying to setup the malicious service, the code in the service is executed locally, but when trying to get a reverse shell, it never works, I have tried usually whitelisted port, using a different command and using different variations of the netcat payload but none worked! ||

[untold pike]

Are you able to solve the issue? I have the same problem. I tried with query * EventID=12 and the result is "0 events"

[tight raft]

I haven't gone back and tried anything new yet. All I know is that the search is supposed to produce graphable data in the visualization tab, but the search as written in the instructions fails to do so.

[still quiver]

In the room "Common Attacks", phishing task - the following information appears:

I think the information box is inaccurate

[dense garnet]

Can someone address this? I have been having this problem for a while and so are a few more people

[eternal summit]

It'd be on the room creator to address. It might even be intentional and designed to catch you out.

[dense garnet]

I had spoken to the room creator, and we got to the conclusion that something is broken with the room.

[eternal summit]

Then it's on the room creator to fix?

[dense garnet]

Alrighty, I'll talk to them, Thanks James!

[livid escarp]

Gave +1 Rep to @eternal summit

[exotic oriole]

Anyone got problems with the marketplace ctf? My terminal crashes when i try to connect via ssh even after restarting the machine.

[cinder jasper]

Can anyone tell me whats wrong with task 3 of memory forensics ?

[mighty arch]

Room: Active Reconnaissance (https://tryhackme.com/room/activerecon)
Task 6: Netcat
At the bottom of the task, just before the question, it says "You can find a recording of the process below. Note that the listening server is on the left side of the screen." However, no recording is available for viewing.
Thank you.

[atomic lion]

i think i broke it

[upper pumice]

Room: https://tryhackme.com/room/bpvolatility
Impossible to do the task 4 we can't download the file with SCP beacause we don't have the password, and there is no file to upload attached to the task. This problem was said before but it's not still fixed.

[teal basalt]

Download the file from where?

If you are talking about the AttackBox then why don't you change the password (now you know it )

sudo passwd

[median coral]

Or just sudo -i to login as root and skip passwords altogether

Sorry, Will scp still need a password when run as root?

Oh yeh

Nvm then

[obsidian kiln]

Nah, nothing to do with you :)
Just a connection made by one of the many bots that scans the internet

[jade edge]

Hello, not sure it's the correct channel to post but:
I'm actually working on the "Windows Event Logs" room and i'm encountering a weird issue:
if i try to go on the "details" tab on the event viewer, it just instantly crash and i have to relaunch the event viewer :/
so i can't do some question of the practice part. Does some of you face this issue? (tried with rdp on the machine itself and in-browser split view)

[fading idol]

the bounty hacker room, ftp doesn't display output for the ls command

[eternal summit]

Use the passive command first

[fading idol]

tried that, but didn't work

it did take an unusually long time for the output to be displayed

[dense garnet]

try -p in the initial ftp command, Ben taught me that

[fading idol]

ah, I'll try doing that

[stable silo]

Hi everyone

So I was doing the overpass 2 room and while answering the Task 1 question 2, I'm facing this issue

And also this

[eternal summit]

Not a bug with the room

You're pasting a literal reverse shell payload into the site.

Bitdefender is detecting that.

[slow pawn]

Task 9 in the Burp Suite room (as part of the Complete Beginner path), https://tryhackme.com/room/rpburpsuite, has a suggestion to go to the Learn Burpsuite room for further learning, https://tryhackme.com/room/learnburp. The link results in a message "The owner has made this room private". I suggest removing the link, or directing elsewhere, until the room is public again.

[eternal summit]

Both of those rooms are deprecated, as well as the whole path.

[noble needle]

In the sysinternals room under Miscellaneous section.
The href at the bottom points to System-Information instead of misc-utilities. The text shows the correct destination.
https://tryhackme.com/room/btsysinternalssg

[vernal saddle]

FYI- Task 8 Practical Example (Blind XSS), Payload works straightaway with the attackbox or catcher, with VPN didn't work to me at all.

[ashen stirrup]

I'm stuck on Task 8 as well. I can't get netcat or the website to display cookies or anything else.

[vernal saddle]

try to up a http server with python, better in the attackbox or try the catcher http://10.10.10.100/

[misty halo]

Hello, how are you?

Currently I m trying to do Brainstorm from the penetration path but the issue is when trying to run the execution file downloaded from the server (trying not to give hints) and when I try to run it on the windows system in OSCP Prep, it doesn't want to run (even on admin), I recreated a windows XP/7/10 environment without any success.. Am I doing something wrong or might it be a bug ?

Error given by Immunity debugger: "Exception 40000005 - use Shift+F7/F8/F9 to pass exception to program"

[dense garnet]

Room: https://tryhackme.com/room/kuberneteschalltdi2020
room isn't booting up, only port 22 is open and room is unusable.

[median coral]

I just went to this room and was about to report this!

the link in the config file is dead too

i.e, the server

[dense garnet]

its been like this for like 2 months now, I didn't know the config was dead though

[median coral]

yeh, cat it out and there's a link in it to the "server(I think)"

[granite sedge]

Hi there, anyone can help me on this? In this room (https://tryhackme.com/room/owasptop10) - Task 20 (display the cookie). I'm doing an alert to show (document.cookie) and get this:

s%3A7drDfnv5FRV_YkD0qhrGDoVM4lUg7FF-.ZTLhhq38WR0ELXlxaNuvIl4GpDBGkq459YvyJByVcbM

not any flag

basically the cookie.

which is too long for the answer 😛

[eternal summit]

That's the cookie, indeed.

If you submit the payload it wants, it'll give you the flag

[granite sedge]

I'm summiting the alert popup with document.cookie

I restarted the machine to see if was something wrong in there. same thing...

[minor star]

Room Windows Server (https://tryhackme.com/room/activedirectorybasics). Task 8 - Hands On Lab. All the relevant commands are supposedly available at https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993, but there is no command listed for the question "Which group has a capital "V" in the group name?" which forces you to use the Hint

[granite sedge]

now working. Just needed to reset the attackbox too.

[turbid wing]

Room : Wreath
Task 1
Pre-requisites

There is a broken link which is mistakenly referencing "Linux command line" to https://tryhackme.com/room/tryhackme.com/room/linuxfundamentalspart1

[obsidian kiln]

Fixed :)

Looks like the behaviour of how links that don't start with http(s) has changed. That used to work

[sonic veldt]

not a bug, probably just doc change
Room: windowseventlogs
Task: 4

Tasks ask to execute Example 7 and 8, but the correct online docs examples are 8 and 9

[glossy blade]

After submitting the answer I realised that my answer is wrong because lack of my depth in -perm flag in find command but tryhackme corrected my answer I don't why this happened?

[flint robin]

should be answer tolerance.

[glossy blade]

Yes, but is it not a bug?

[median coral]

it matches the answer so if it's 90-95% same, it's assumed correct
this way you're not scrutinized for mistyping/capitalizing/forgetting a character in the flag

[glossy blade]

Ok

[wheat fractal]

In the room of Vulnversity even if I have connected with machine via VPN, whenever I am searching http://ip/ in the address bar it shows unable to connect

[eternal summit]

Not a bug. You're forgetting something. Please ask in #room-hints

[soft terrace]

Room: https://tryhackme.com/room/rpmetasploit
Task 7, 2nd question
the answer is ||auxiliary/server/socks5||
however if you follow the instruction, you won't find it

[storm leaf]

https://tryhackme.com/room/activerecon
I'm on Task 6, I clicked on "TCP" in the first paragraph to see the definition, and it should actually be Transmission Control Protocol not Transfer Control Protocol.
I know it doesn't matter but I'm just very proud of myself for knowing I had it right.

[teal barn]

https://tryhackme.com/room/linuxmodules
Task 6 awk

Quotes are wrong and the filename is missing.

-awk "BEGIN {FS='o'} {print $1,$3} END{print 'Total Rows=',NR}"
+awk 'BEGIN {FS="o"} {print $1,$3} END{print "Total Rows=",NR}' file.txt

[long mortar]

pretty sure not taking this as correct is a bug

[teal barn]

room?

[long mortar]

https://tryhackme.com/room/phishingemails4gkxh

[long mortar]

I got the "right" answer, but tbh according to the link given in the task, it is not. Maybe I understood something wrong though.

[wheat fractal]

It's a typo.

Or is it?

[agile sequoia]

I think The hydra syntax is wrong on backpack.

[nocturne robin]

I can't reach the http://MACHINE_IP/robots.txt after replacing MACHINE_IP to IP of machine

[nocturne robin]

In Content Discovery Room

[eternal summit]

If it's not automatically replaced then you have not deployed the target machine

You've likely deployed the attackbox instead.

[dense garnet]

Room: https://tryhackme.com/room/kuberneteschalltdi2020
said it a couple times but didn't get any response or fix, the room doesn't boot up properly, only port 22 is open.

[glad badger]

Let me check and see if the problem can be diagnosed. 🙂

[dense garnet]

Thanks!

[livid escarp]

Gave +1 Rep to @glad badger

[glad badger]

I'd recommend to skip this room for now while we make an assessment of what the problem is. 🙂 Thank you for reporting.

[livid escarp]

Gave +1 Rep to @dense garnet

[restive urchin]

Room: Investigating Windows 3.x
Question No: 16
**Question: **

This is the default communication profile the agent used to connect to the attack machine. What attack framework was used? What is the name of the variable? (answer, answer)

Like specified in the question, the flag is needed to be submitted in (answer, answer) order combining the both answers.
The correct answer to the question ||is in reversed order. ||
Since the questions are asked consecutively, ||why is the answer accepted in reversed order without any hint? ||
Almost any player is likely to waste a lot of time for nothing without this clarification.

[kindred hull]

Typo spotted in Sysmon room under task 2

Gotta stay doubly prepared though, so I don't mind it

This one's super nitpicky, but the closing TargetFilename tag is missing a >

[atomic lion]

No flag for reflected XSS? and on a side note the instructions are outdated for Burpsuite and I can not figure out how to add a custom header for persistent XSS.

[tired laurel]

I was JUST on this @atomic lion

Had to lookup a write up because there is no "Header" category like you explained

Also sorry for the tag

[atomic lion]

no problemos

the header category is now on the lower right of http history but I didn't see an add button like on a video walkthrough i saw.

[eternal summit]

You can edit the request manually if you understand the structure of an HTTP request

[atomic lion]

still learning

i tried manually doing it but i guess i got it wrong as to where to add the custom header

active recon lab not pinging for task 3. i'm going to sleep hopefully the machine works tomorrow.

[misty cave]

fixed both

[misty cave]

Having a look at it now

[misty cave]

This has been discussed and updated 🙂

[wheat fractal]

Was it a typo?

[misty cave]

More of an unclear wording I think

[wheat fractal]

Ah, just because my answer has ~all instead of -all

[misty cave]

yup, that's the intended answer, Just the question has been re-worded to reflect that (some external research as to why may be required, but it's linked)

[wheat fractal]

Hi, https://tryhackme.com/room/androidhacking101 has some all around weird formatting and some code sections are hardly readable (see attached picture). The section Dynamic Analysis - Complications is even missing a picture and other pictures are way too big. The room could need a bit of reformatting to make it more enjoyable to follow

[tribal prawn]

Hi Guys a do a brainstorm machine every time i log on ftp server by anonymous credentials its show me "ftp entering extended passive mode" and i cannot list files ;/ i think the machine is broken

[eternal summit]

Try initially connecting in passive mode

Also cc @dusky junco this seems to be a somewhat recent change, last time something weird like this happened with FTP it was VPN and routing related

[tribal prawn]

ok i will try with passiv mode

okey i figured it out, ftp has defult connect via passive mode to make it work we need to do opposite think and connect via active mode (-A flag)

[tribal prawn]

thanks for idea

[livid escarp]

Gave +1 Rep to @eternal summit

[long mortar]

Room https://tryhackme.com/room/passwordattacks
Task 8 3rd Question. Password is supposed to be in the generated wordlist form task 7, but its not. Or at least it seems so to me.
Edit: My bad, I missed it because the server gives the same answer (same amount of chars!!) on successful login duh

[rotund burrow]

nvm it was something wrong with the machine started another and it worked

[candid fiber]

not sure if it is a bug but i attackative directory when i submit ntlm hash of admin it shows wrong but on using the hash for exploitation in evilwinrm it is right and works this one question is not allowing me to comeplete room

[heady pebble]

Not exactly a bug but more of a typo - in the Cross-Site Scripting room, Task 1 has some links to examples of bug bounties paid out to people who found XSS vulns. One of the links says "Instagram" but the link is actually to a report for a company called "Infogram"

[misty bay]

On FILESRV01 on Holo, I believe there should be a scheduled task, but there doesn't appear to be. This is the case after a reset.
I think it's a bug where that's not being added on setup

[wheat fractal]

Room : https://tryhackme.com/room/nmap01
Task : 6
Bug : Typography, in the word highlighted in the screenshot

[median coral]

Room: https://tryhackme.com/room/mnemonic
youtube link in first task is unavailable, I know its an old room

[eternal summit]

-ban @iron orchid -ddays 1 Piracy spam

[livid escarp]

🔨 Banned BU-BE-SOUND#8390 indefinitely

[bleak harness]

Room: https://tryhackme.com/room/androidhacking101
Task: 3
Bug: Typo in the image

[hybrid valve]

https://tryhackme.com/room/fileinc

Shouldn't Task 4 say

Theoretically, we can access and display any readable file on the server from the code above if there isn't any input validation. Let's say we want to read the /etc/passwd file, which contains sensitive information about the users of the Linux operating system, we can try the following: http://webapp.thm/get.php?**lang**=/etc/passwd

As currently published, the parameter for the GET request to get.php is file when the example code uses lang

[timber socket]

https://tryhackme.com/room/pyramidofpainax
Task 9 only takes wrong answer (IMO)
Here are some screenshots marked as spoiler:

Wrong answer giving the flag

My answer was this one, didn't accept it

https://tryhackme.com/forum/thread/61fd266b1bacdb34500dfc99
In the forum people are reporting similar issues

[glad badger]

Looking into the issue. Thank you for reporting. 🙂

[livid escarp]

Gave +1 Rep to @timber socket

[timber socket]

Always!

[wheat fractal]

Room: https://tryhackme.com/room/linprivesc
Issue: Task #8 - Capabilities can be completed by just cd'ing into ubuntu's folder and cat'ing "flag4.txt" without having to do any privilege escalation at all.

[charred summit]

Well done on getting the flag to pop! I guessed they'd got it upside down or something, but even so that 'correct' answer is totally borked. It doesn't help that two of the definitions apply to the artifacts layer IMO There are lots of other things wrong on this box as well. The any run URLs are the wrong way round in task 3 and the same question repeats in task 5. In the first instance you don't need OSINT as the answer is in the screenshot, and the second the answer is not a malicious document.

[bitter lantern]

Pyramid of Pain (/room/pyramidofpainax) editing issue, not certain where else I'd mention this

[bitter lantern]

Pyramid of Pain - [Task 3] - the url for Task 3 points to the main site rather than the task that the questions refer to

[bitter lantern]

Pyramid of Pain - [editing] - might want to consider removing the url link here for this site

[dense garnet]

I can't screenshot but in the same room in TTPs there is a punctuation issue in the third paragraph

fight back. For, example if

[bitter lantern]

Pyramid of Pain - [Task 5] - copy pasta for last two questions

[timber socket]

Totally, also I didn't get the flag in the intended way.
I got the flag and the order by doing some stuff 😅
Let's say i did what the name of the website told me to do.

I still wanna know the correct answer tho

[dense garnet]

goddammit i've been on this for like 3 hrs and it's broken?

life is mean

[bitter lantern]

yeah, I didn't mention it since someone else already did

[glacial plank]

It’d be nice if they would disable a room or take it offline temporarily until the bugs get worked out.

[glad badger]

The Task 9 question can be skipped for now (no answer needed), until the challenge has been fixed. 🙂

[modest tundra]

I am also stuck on this, are the answers supposed to be the same or different?

I got the first one but I can't figure out the second one

[dusky junco]

Hey, so re. Pyramid of Pain. I got attributed and assigned the room very recently, but it is not a room that I have made at all (neither has heaven) due to reasons I wont share. I'm working with QA on getting errors with this room resolved. Appreciate your feedback on this, but yeah, it is very difficult for me to pickup a room that has been developed by someone else.

Sorry that you're experiencing issues with this

[zenith mortar]

hi in room: https://tryhackme.com/room/ctfcollectionvol1
Task 18:
using wayback machine this link for the flag expired
https://t.co/vbRrl6MdvU

[slow frigate]

Answer to question 4 is in the second screenshot, the exe is repeated everywhere. Question 5 is buggy

[gentle coral]

could some mod look on brainstorm https://tryhackme.com/room/brainstorm looks like something is broken with ftp server - I cannot connect to it neither from kali vm, host manjaro or attackbox
I tried forcing passive ftp, active none worked

also restarted vm 2x, reconnected 3x and changed server from EU-VIP1 to EU-VIP2

[bitter lantern]

Supposed to be different

There last one is probably referring to the question being asked. The one before it is referring to something else

You can still guess the answer like I did

[bitter lantern]

One should say something like "what is the name of the malicious binary?" The next one should say "what is the name of the malicious document" (as it does already, so it's fine)

[slow frigate]

Agree. Or even make a more challenging question and give a useful hint instead of use Google with a wink that throws you off, like are you kidding me. LOL

[bitter lantern]

Let's just start with the words matching the questions and work our way up from there 😆

[plucky void]

throwback network 1. missing pictures in multiple tasks, 2. task 21: "MSF6 and newer will have socks/auxiliary/socks_proxy" but msf6 has socks in: auxiliary/server/socks_proxy

[timber socket]

If you want I can tell you what I found and what I think it's the problem.

Don't think that giving the details here would be a good idea, but my DMs are open.

PS: I will only give the details to THM staff and/or mods

[timber socket]

Just 3 words in Google, first result gives the answer.

[tame karma]

Hello. In Phishing 5, Question 1. It says format should be "
(answer format: mm/dd/yy hh:mm)

But it only accepts mm/dd/yyyy hh:mm. Basically, it wants a 4 digit year, but says the format is two digits. The grey text in the box shows 4 digits. This is ANNOYING and an easy fix.

[minor star]

Confirmed. Room name "Powershell Scripting" (part of the Offensive Pentesting path), task 3 "Basic Powershell Commands". The accepted answer is ||6638 || but using the following search returns 6641

||get-command -commandtype cmdlet | measure||

[slow frigate]

For which question are you talking about? For the last question of task 5, I’ve searched a lot and with no luck. The question doesn’t make sense.

[trail merlin]

Throwing in support for this bug. Drove me nuts for a while until I finally guessed it.

[timber socket]

Use your OSINT skills and provide the name of the malicious document associated with the dropped binary

the hint I would give is: ||The dropped binary is G_jugk.exe, and the malicious document is the doc associated with that G_jugk.exe||

[minor star]

Room name "Powershell Scripting" (part of the Offensive Pentesting path), task 4 Enumeration, question "What is the path of the scheduled task called new-sched-task?". The correct answer as per the powershell below output is |||| but the answer expected is|| /||

||get-scheduledtask | where-object Taskname -eq new-sched-task||

[wheat fractal]

maybe just by me, but first when is started Dear QA, the target's IP didn't show up. After refreshing the page, it was there. ( it was about 10 minutes after i started it so it's maybe a bug)

[wheat fractal]

The room itself is not so easy but this question was a cake 🙂

[slow frigate]

That's exactly what I searched for, the binary name you hid. I found a very nice site that left almost nothing about the e%$#@t malware https://www.joesandbox.com/analysis/302663/1/html . Also the anyrun sandboxer and still nothing. But I'll keep looking since there is still a possibility of finding ans answer somewhere.

[timber socket]

Keep googling, you're close.
I looked at that same exact report before finding the name

[slow frigate]

Thanks @timber socket damn it was looking me in the eye. Believe it or not I almost read that whole report, but there is always place to learn. Thank you!

[livid escarp]

Gave +1 Rep to @timber socket

[atomic lion]

it wont upload my php file 😦

[obtuse ingot]

https://tryhackme.com/room/shodan

[median coral]

an old room: https://tryhackme.com/room/xss , linked website is down

[charred laurel]

are the answers on the "introductory networking" room in the whois section outdated?
nothing i find from whois facebook.com seems to be a correct answer..

[eternal summit]

Note that it changes domain part way through

[charred laurel]

oh oops, i'm blind

[golden plover]

Wreath Room: ssh -i access is to the web server is no longer available to me. Can somebody take a look at this.. It is pingable, but no longer ssh accessible, can't proceed further...

[median coral]

yeh, that's pretty common unfortunately, means people on the machine removed/changed the id_rsa, just go for a reset

also, there is #wreath-network for help

[golden plover]

Ok, thanks mate.

[patent merlin]

This is a minor bug at #intro2windows(https://tryhackme.com/room/intro2windows) in the task-7 called "Creating your first GPO". There is a typo for "Groups GPO". It mentioned that "Group GPO"(Correct is "Groups GPO") need to be linked to the root of the domain (thm.lab). If someone add "Group GPO" as mentioned , it will create a new Object called "Group GPO" that may create confusion to others and policy may not work as assumed.

[eternal summit]

-ban @wheat fractal -ddays 1 Nitro Phishing scam

[livid escarp]

🔨 Banned WonderMan#9152 indefinitely

[glad badger]

Fixed. Thank you for reporting. 😎

[livid escarp]

Gave +1 Rep to @patent merlin

[eternal summit]

Post it here please

[void spruce]

this room is broken
https://tryhackme.com/room/phishinghiddeneye

github link is broken, the default mirrors for 2 requirements are broken in the gitlab version (equinix.io) and the whole room has 2 questions (what would u use the tool for and whats the weakest element in IT) which independent on the actual tool

[rugged canyon]

the room is also over 2 years old

so it being broken is more easily acceptable by that standard

[tight plank]

Hi, I have an Issue with the Linux Fundamentals Part 2 Room. The attackbox does not allow the input of the password when executing the SSH command. https://tryhackme.com/room/linuxfundamentalspart2

[eternal summit]

It does, but it does not show the characters as that would be a security risk to people watching

[tight plank]

okay very good to know. Thank you!

[jagged pine]

Hi there is a bug in "https://tryhackme.com/room/packetsframes", all users started to face with this. i wrote about it in #room-help

[eternal summit]

Tim has already addressed this

[jagged pine]

yeah i saw it too, thanks

[humble pumice]

Hello, I noticed a small bug in the Network Fundamentals - Packets & Frames room. Each task is repeated 2 times.

[harsh olive]

Hey guys, I have an issue on pre security learning path, packets and frames room from network fundamentals can't be completed. I did all the answers and stuf, but it won't mark as completed so the path progress is always at 95%

ah you already know about it 😄

[gaunt skiff]

Hi. What was the resolution? Because it seems that the issue is still there

[eternal summit]

Yes

It's known, but being fixed.

Not fixed yet.

[lost cove]

Not sure why but in the Redline room, the exe file gets removed from AppData/Temp after running the IOC scan. Makes it so you can't get the hash without resetting the machine

[ionic latch]

In the room intro to Django, there is a link for the user hash, but the antivirus block it (pastbin..)

[eternal summit]

That's not a bug. If your machine is blocking pastebin, that's a you problem.

[lost cove]

It's not related to running the scan? Just launching the machine and opening the AppData Temp folder will get it removed on you

[lost cove]

Obviously the SHA256 hash could just be selected in Redline, but that assumes we read all the questions before launching the scan. Also means that the hint as to how to find the hash with PowerShell won't work without a reboot and we can't run it multiple times to experiment with different scan settings

[livid escarp]

Gave +1 Rep to @eternal summit

[gaunt skiff]

Alright thank you

[median coral]

Its a known bug, the're working on it

It's been reported in multiple channels honestly

[twilit citrus]

Ok ok Zeeshan thank for the answer.

[livid escarp]

Gave +1 Rep to @median coral

[median coral]

🙂

[restive pulsar]

https://tryhackme.com/room/introtonetworking

right answer

whois results

came back to this room to show something to my friend, noticed that

[rugged canyon]

nice catch but that was apparently updated less then 3 weeks ago

[eternal summit]

You missed that it changed domain half way through from Facebook to Microsoft

[rugged canyon]

oh wait yeah

[tame karma]

The new Red Team Fundamentals room links to the Cyber Kill Chain room. That room has a message saying that the owner has made it private. You might want to unlink it from Red Team Engagements: https://tryhackme.com/room/redteamfundamentals https://tryhackme.com/room/cyberkillchainzmt

[zinc ice]

Good morning THM 🙂
I did the whole phishing module a while ago but did not receive the fancy badge for it. Did I miss anything?

[modern raven]

#site-bugs message Might be that you completed it before the badge was around so you need to reset and redo the 5th room

[atomic lion]

this eternalblue room does not work. i've rebooted this machine 5 times.

[zinc ice]

Ok I'll try that, thanks @modern raven!

[livid escarp]

Gave +1 Rep to @modern raven

[atomic lion]

i get fail evrytim, no win

[dusky junco]

Yes exactly, if that doesn't work email into support and we'll get the badge awarded @zinc ice

[zinc ice]

I just did room five again! Now I have the badge 🙂 Should have tried that before posting tbh. Makes sense...

[dusky junco]

Woot woot 💪

[wheat fractal]

Are you still doing it?

[atomic lion]

i started working on the phising one because Newk did it and looked interesting, but i can boot it up again for like the tenth time and try

[wheat fractal]

If you do, let me know

[atomic lion]

ill do so now

starting machine

[wheat fractal]

Ok, we can move over to #room-help so we're not flooding this one.

[atomic lion]

okay will do if it end ups not working

[craggy niche]

Hi everyone,
i have an issue in Attack Kerberosroom
I already add CONTORLLER.local in/etc/hosts and i can ping it as well
but i still cannot use kerbrute to Enum and user(result is 0)

It shows
Done! Tested 1663 usernames (0 valid) in 0.347 seconds

[ripe patrol]

I'm getting the question duplication bug on Packets and Frames. I am unable to complete the Pre-Security course and get my certificate because of it. Resetting the room doesn't help, nor does answering the duplicated questions.

[ripe patrol]

I know its a kknown bug.

Just wondering if I can do anything about it so I can get my cert.

[eternal summit]

@ripe patrol @gaunt skiff @harsh olive @jagged pine this is now fixed (packets and frames)

[jagged pine]

i saw it, thank you so much

[ripe patrol]

Thank you!

[quiet viper]

Hi !
I think I found an error :
--> Complete Beginner
--> Web Hacking Fundamentals
--> OWASP Juice Shop room
--> Task 4
PB : It says You can load the list from /usr/share/seclists/Passwords/Common-Credentials/best1050.txt but it is not the right path. The right path is :
/usr/share/wordlists/SecLists/Passwords/Common-Credentials/best1050.txt

[hazy tiger]

Are you using Kali or AttackBox?

[quiet viper]

AttackBox

[wheat fractal]

Hi everybody ! I'm on the POLOTELNET learning machine, but i get no open ports is it normal?
I think maybe it's an issue but i'm a complet beginner x)

I get this with Kali --> All 8320 scanned ports on ip-10-10-187-203.eu-west-1.compute.internal (10.10.187.203) are closed

[eternal summit]

Please use #room-hints if you need hints.
This channel is for once you're certain it's a bug

[wheat fractal]

Ok sorry

[snow tide]

Hi anybody else has machine lag? i have premium but sometimes ctf machines starts lag and i can t ping them for a while.

[eternal summit]

Sounds like a VPN issue, #site-support for more help please

[fast prawn]

I found a typo in https://tryhackme.com/room/splunk101

Open Chrome and navigate to ...

I think the author meant "Firefox"

(I'm incredibly funny)

oh wait on a serious note, chrome is installed on the attached machine 🥲

[median coral]

Yep, completed that room recently and used chrome

[fast prawn]

matches well with the ~2GB RAM of the machine

as if windows wasn't bloated enough

[tame karma]

In the Content Discovery Room. Task 3 requires you to run a CURL command, but the command throws an error. This command works:

curl -s https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico|md5sum

[twilit fjord]

i have a problem with ustoun room. i didnt find a way into the box so i looked in the writeup. regarding to it should port 1433 mssql be open. i tried several machine spawns but it never was open. i think its bugged

[dense garnet]

Happened to me too!

[untold comet]

Hi, when will be Suricata room prepared? Thank you.
https://tryhackme.com/room/btsuricata

[noble needle]

https://tryhackme.com/room/osqueryf8

Schema documentation section says current version is 4.7.0, links to 4.7.0, shows screenshots from 4.7.0, and then asks about the schema "for this version."

But its looking for answers from 4.6.0 (Which is the installed version on the machine, but not the one referenced in the rightup)

[proven gale]

Just had a similar experience, thanks for posting in here, was losing my mind! Thought I needed to something else.

[livid escarp]

Gave +1 Rep to @minor magnet

[minor magnet]

No problem, glad it was helpful. How did you find it all the way back up the chat?

[proven gale]

CTRL+F my dude 😄

[eternal summit]

-ban @strong cradle Posting fornite cheat videos in the room-bugs channel. Ban appeals are [e-mail]

[livid escarp]

🔨 Banned Mhortas#5364 indefinitely

[wheat glacier]

Thank

He was copy-pasting into multiple rooms, pretty sus

[atomic lion]

fornite cheat videos lolwut

[tame karma]

This is not as much a bug as it is a suggestion. In the Content Discovery Room, Task 7, you recommend people look at Wikipedia to learn about Google dorking. THM has a google dorking room. It might be better to link there.

[jade void]

I believe i found a room bug in the Jr Pentesting in the cross site scripting room

On the last section, i retrieve the session key like it asks and its not the right value no matter what i try

its a walkthrough room and the exact code it tells me to put gets me a session key that i decode to the session=(value) and wont work.

[strong arrow]

In https://tryhackme.com/room/oscommandinjection task 3 it mentions

For example, the shell operators ;, & and && will combine two (or more) system commands and execute them both.

but just doing one & will run the program in the background, it is && that combines commands

[eternal summit]

They both still run them both

It's whether it waits for the success of the first or just runs it in the background

[twilit fjord]

https://tryhackme.com/room/ustoun still bugged. port 1433 is never open

[little hull]

https://tryhackme.com/room/passiverecon Task 6, question 3: Based on Shodan.io, what is the 3rd most common port used for nginx?
3rd port by Shodan.io is 5000 (https://www.shodan.io/search/facet?query=ngnix&facet=port), but the accepted answer is different (||8888||)

[eternal summit]

query=ngnix

[little hull]

Yes? Did I do smth wrong, so that the result is different?

[eternal summit]

Ngnix is not the correct spelling

Correcting the typo gives you the correct results.

[little hull]

Ah

Thanks!

[ionic elk]

Has anyone noticed a bug with the video in the Hydra room? That bug being Basic networking sometimes playing rather then the Hydra video. A quick refresh fixed it, so I'm good. Just making sure someone new doesn't get frustrated.

[eternal summit]

This sounds like a site bug, can I ask you to repost it in #site-bugs please?

[ionic latch]

https://www.tryhackme.com/room/walkinganapplication last flag doesn't seem to work i found the X-Flag header but it says incorrect

[teal basalt]

There's some extra flags in that room (the target machine, for other purposes)
You can ignore the one that isn't working

[ionic latch]

it's for the last question and there is only one for that i think

[teal basalt]

#room-bugs message

Here's a reference for the same

[ionic latch]

thank you i think i was looking in the wrong place

[lament cliff]

I'm not sure if it's a bug, but in the "Brainstorm" room I can't get any files using FTP, only "229 Entering Extended Passive Mode (|||49179|)." I have went through all the writeups and followed their steps, yet I got nothing.

[teal barn]

https://tryhackme.com/room/passwordsecurity this room was removed?

also I want to remove the room (since it no longer exist) from My Rooms list. The tricks for rooms that were passed from free to subscription-only doesn't work (https://gist.github.com/noraj/46f8ec31205f72a604b13ffa4c03dfbc).

[median coral]

I have the same issue as yours, it doesn't even allow you to leave the room

[final loom]

How much do we care about small things like typos and grammatical errors? Going through some of these rooms I occasionally find fallout from quick edits. Don't want to spam up the room with this stuff if it's the wrong place for it

[sonic willow]

this is the right place, put them here and make sure to give the following

• room name
• task
• what's wrong
• what it should be

[final loom]

Room Name: Network Services 2

Task 6: Questions: "top-usernames-shortlist.txt" file location may have moved since room creation? My location was /usr/share/SecLists/Usernames/ instead of documented /usr/share/wordlists/SecLists/Usernames

Task 7: Hydra:
"password attacks against of many different services" - remove "of"
"if you'd like to browse and find a different wordlists" - either "find different wordlists" or "find a different wordlist"

[final loom]

Room Name: Burp Suite

Task 7: Questions:
"Which poisoning issue arises when an application behind a cache process input that is not included in the cache key?" - "process" should be "processes"

[wheat fractal]

#site-support message

Does this help?

[median coral]

no, the problem is that the room has been outright deleted for us, so any of the usual joining/leaving methods don't work as it doesn't even show up in search only in https://tryhackme.com/rooms

[lone viper]

I'm doing advent of cyber 1 - day 9. I keep trying the IP address 10.10.169.100 port 3000 and I keep getting "connection timed out". I've tried it over several days now and it's just not coming up.

[ionic cradle]

Path: Jr Penetration Tester - Network Security | Room: Active Reconnaissance | Task 4
Question 1 & 2: "...what is the IP address of the last router/hop before reaching tryhackme.com?"
Answer: It's the last IP address listed in each traceroute example.

Issue: The last IP address in each traceroute example is the IP address of tryhackme.com, so shouldn't the IP address in line 13 or 25 be the right answer?

Path: Jr Penetration Tester - Network Security | Room: Active Reconnaissance | Task 4
Question 3: "In Traceroute B, how many routers are between the two systems?"
Answer: 26

Issue: It's asking for the hops between the two systems. The first hop is "me" and the last hop is tryhackme.com or my target. So shouldn't they be excluded? Right answer 24?

[eternal summit]

Before tryhackme.com implies not tryhackme.com?

[ionic cradle]

Yes? At least for me in this context. It sounds like where do you go before you go shopping. The answer can't be "shopping" (assuming I don't go shopping twice in a row...).

[eternal summit]

That's more clear now

[tight sequoia]

ftp commands aren't not working for me in this room after connecting to anon ftp. https://tryhackme.com/room/brainstorm can someone help

[wheat fractal]

I answered you in #site-support FTP is working for me.

[brazen gulch]

quick catch on the recent redteamfirewalls room;
first diagram has a typo:

[glad badger]

Thank you for reporting this. 🙂

[livid escarp]

Gave +1 Rep to @brazen gulch

[lone viper]

I'm assuming this is a known bug and nothing will be done about it? I've searched discord and quite a few people have reported this and it's still an issue.

[trim cape]

Hi. I'm trying to do an attach using burp intruder. In BurpSuite Intruder room give us credentials when try to do attack there is no 200 response for credentials. Can anyone help me ?
room link: https://tryhackme.com/room/burpsuiteintruder
Task:10

[radiant cairn]

Good day, I am having trouble with the OpenVAS room. I had to use the kali attack machine due to space restrictions on the other. I have downloaded and started the docker of OpenVAS but when I follow the instructions to visit https://127.0.0.1 firefox complains about the credentials. I go to advanced and click Accept Risk and Continue and nothing happens. Any suggestions on how to move forward with the room?

@trim cape it states in the task that finding a 200 is out and to loot at the Length of the responses are you referring to this part of the task?

[eternal summit]

Please use #room-hints or #room-help if you're looking for assistance, this channel is meant for reporting bugs

[hot flame]

Hi, I would like to report a Bug on Containme room. I don't know why I took so long to speak up for this but it has been months since the room was released and I am still unable to complete it due to a bug on SQL service not starting. Restarting the machine 1000 times doesn't work and it is a fundamental service to complete the room.

[median coral]

https://tryhackme.com/room/brainstorm, ftp server works in attackbox but doesn't work on your local machine(tried active, passive, -p, -A, binary mode)

[glad jackal]

In https://tryhackme.com/room/yara task 6, there is a rule that counts the number of occurrences of a string. I believe the condition should read #hello_world <= 10 rather than $hello_world <= 10 per https://yara.readthedocs.io/en/stable/writingrules.html#counting-strings.

[rotund crystal]

Hi, I don't know if this is a bug but a few people have been having this issue

In the Post-exploitation Basics room task 3 there is constant errors when trying to transfer/upload files into bloodhound

With uploading the error being "BAD JSON FILE"

And drag and drop the error being

"NaN% the file is incompatible"

I could show anyone who would.be willing to review it in vc

[amber tartan]

for basic splunk 101, task 6 question 1, the sigma APT29 to splunk using Uncoder.io now returns a different value

[vernal saddle]

Hi there, Protocols and Servers => task 6 should ask for POP instead of IMAP

[median coral]

yes, you have to use only the ||commandline=""|| from the result

[dusky junco]

-ban 898988800208953426 get outta here with your scamming nonsense.

[livid escarp]

🔨 Banned tweekerry#6525 indefinitely

[dusky junco]

ah damn I forgot the ddays

-ban 478442913521598464 -ddays 1 get outta here with your scamming nonsense.

[livid escarp]

🔨 Banned Ryan.Scc#0416 indefinitely

[chrome coral]

I am working on linux fundamentals and when I start the machine, it gives me an IP address. But according to videos, a second window should open where we can try linux commands and get the flag. The window is not opening for me, any fixes?

[rotund crystal]

There's a blue button at the top of the room

It says start attackbox

Does pressing that make it pop up?

[chrome coral]

no

It just starts the machine and gives out IP

no split screen

[rotund crystal]

Try reloading the webpage and doing the same thing, see if it pops up

[astral anvil]

@remote hamlet dis looks kinda sussy?

[rugged loom]

Yeah......it loads a dotnet assembly from a url and then executes it totally not sus at all 🙃

[astral anvil]

Sir you went way further than I did 😬 I just looked at title 😦

[rugged loom]

I'm bored and I like reversing malware

[languid walrus]

Tried to install the bloodhound package on the attack in the Attacktive directory and post-exploitation rooms. I received the error : E: Unable to locate package bloodhound

I tried running apt update && apt upgrade but it's not working. Are there any other workarounds and troubleshooting tips?

[rugged loom]

But yeah the file linked in this video is malware though 🙂 @queen sphinx

[queen sphinx]

hitting it up in virustotal first

[rugged loom]

You mind if I DM? I have the executable and the stage 2

[queen sphinx]

Yeah, please do. Always down to learn new to me techniques.

[atomic lion]

I think the upload vuln room not working for jewel?

It won’t let me get the shell but the file with nodejs payload uploads successfully

[atomic lion]

burp worked in the attack box flawlessly but not in my VM, i have no idea what is wrong with my proxy i think its the room.

[blissful vector]

Introductory Researching Room->Task 3->first question... Accidentally entered an extra number at the end of the answer, still registered solved. Not sure if intended, but thought I'd report

[sonic willow]

answer tolerance, allows up to 10% (iirc) of an answer to be incorrect to allow for mistypes

if you refresh the page you’ll see the real answer

[blissful vector]

yeah I've seen that before (the refreshing). OK thanks. Good to know it's allowable 🙂

[obsidian kiln]

The AttackBox is Ubuntu, so it doesn't have many cyber tools in its apt repos. Bloodhound should definitely be installed already though -- possibly even on the dock at the right hand side?

[dusky junco]

Yup it's located on the dock on the right (: @languid walrus

[obsidian kiln]

Ah, thanks Ben :)

[languid walrus]

Thank you!!!

[livid escarp]

Gave +1 Rep to @obsidian kiln

[languid walrus]

Thank you!!!

[formal tendon]

there's a problem with "Authenticate" room
it doesn't want to open the browser based ip or even the port it keeps giving me unable to connect

i thought it was a problem with my vpn, so I tried to use the "attack box" but as you can see it still doesn't want to connect

[obsidian kiln]

+rep @dusky junco

[livid escarp]

Gave +1 Rep to @dusky junco

[modern crag]

not sure if it's a bug but in the TCP SYN Scan room, when I run the scan noted by the assignment (nmap -sS $IP) it doesn't display the 4 digit port needed to answer the question

maybe need to reboot smn but didn't show up for me

[median coral]

@gleaming shadow

[eternal summit]

-ban @loud shard -ddays 1 Your account has been compromised and used to send phishing scams. Please change your password and preferably enable two factor authentication and then appeal this ban by emailing [e-mail]

[livid escarp]

🔨 Banned Bleton#1239 indefinitely

[eternal summit]

[median coral]

[gleaming shadow]

GJ all

[atomic lion]

im going to try to restart the machine but its not working

[blissful vector]

broken image? https://image.flaticon.com/icons/svg/2879/2879093.svg Network Services -> Task 3 -> before "Enumeration" header

might just be me reporting things that don't really matter again :<

[rotund crystal]

Hey @dusky junco I don't know if this is an intended feature but in the room Mr.Robot CTF(wonderful room btw) when going to the /admin/ the website gets sent into a perpetual reloading loop

[hazy tiger]

Room is super slow

Might take a while

[obsidian kiln]

That room really needs to die smh
It breaks so many of the site rules for room releases.

[twin bay]

https://tryhackme.com/room/pyramidofpainax
Task 5 - The last two questions are duplicated (The first one wants the name of the binary)

[wheat fractal]

So I have to do it before it's removed?

[wheat fractal]

@gleaming shadow

[gleaming shadow]

...

[wheat fractal]

I don't know if you're annoyed with the ping or not?

[gleaming shadow]

technically at work

[wheat fractal]

Sorry, I didn't know.

[gleaming shadow]

it's fine

[grim turret]

i hope you can help me, i'm taking the cyber defense room at task 6 and it ask me to scan the IP given, so when i scan that address it says "all ports closed" when there should be 1 open tcp port, i tried different machines but nothing, i dont know if im doing it wrong or there is a problem with the machine

[placid quail]

Wow this issue you spoke of from last month is still a thing. I wasted about 10-15 minutes until I saw your post

[blissful vector]

Did you run it more than once? Just asking cause I ran a nmap against something and it only got one of the two ports the first time. I dunno why

[hollow vector]

Still not fixed? Shit

[placid quail]

correct. i’m not sure who to ping about it

[dusky junco]

Oh wow

Let me take a look at this

@placid quail

That is what I have changed it to, that looks right?

cc @hollow vector

[hollow vector]

Cheers for that @dusky junco thank you. Go to sleep please

[livid escarp]

Gave +1 Rep to @dusky junco

[placid quail]

yes thank you 🙂

[livid escarp]

Gave +1 Rep to @dusky junco

[hexed plume]

Blue machine appears to be unresponsive to msfconsole blue exploit

Using following commands

msfconsole

search blue

use 13

set payload windows/x64/shell/reverse_tcp

set RHOSTS 10.10........

exploit

[wheat fractal]

Set LHOST to your THM IP

[hexed plume]

Thank you @wheat fractal

[livid escarp]

Gave +1 Rep to @half quarry

[hexed plume]

noob level 1000

[wheat fractal]

Did it work?

[hexed plume]

Trying now...

Yes it did, thanks

[median coral]

!dark

[tropic flame]

DarkStar7471

***dab***

[wheat fractal]

!dark

[tropic flame]

DarkStar7471

Sir, this is a Denny's. Imma have to ask you stop.

[dense garnet]

!dark

[tropic flame]

DarkStar7471

Sir, this is a Denny's. Imma have to ask you stop.

[wheat fractal]

!dark

[tropic flame]

DarkStar7471

Try HARDER.

[eternal summit]

Can we try to keep this to #bot-commands please? One where appropriate is fine

[final loom]

Room Name: OWASP Top 10

Task 5: "What is Active Command Injection?" - The second and third paragraph mentions things that we supposedly did before, but have not. I assume there was some reordering done on this page because this is the first exercise in the room.

Task 15:
"As you can see we are defining a ENTITY" - should be "defining an ENTITY"
"the difference is that we are setting it value to 'SYSTEM'" - should be "setting its value"

Task 17:
"OWASP have a listed a few attack scenarios" - should be "OWASP have listed a few attack scenarios"

Task 20:
Question 5 (document cookies) - The answer seems to have an extra "s" appended

Task 24:
"In the web application, we're going to exploit, you'll notice cookies store login information like the below!" - Remove the commas

Task 27:
"The situation becomes even worse when you realize, that it's really quite easy for this to happen, if a company misses a single update for a program they use, they could be vulnerable to any number of attacks." - This sentence is oddly segmented and too long. Recommend rewriting as "The situation becomes even worse when you realize that it's really quite easy for this to happen. If a company misses a single update for a program they use they could be vulnerable to any number of attacks."

Task 28:
"Let's download it and try and to get code execution." - should be "Let's download it and try to get code execution."
"Fortunately for us, the error was caused by an line that should have been commented, so it's an easy fix." - should be "a line" not "an line"

Task 30:
"For example, certain actions will higher impact than others." - Should be "For example, certain actions will have a higher impact than others." or something similar

[rugged canyon]

???

is this a spot the error challenge

[eternal summit]

Lots of grammar fixes

[rugged canyon]

oooh now shadow sees it

did not see the corrections in the message in a quick glance

[runic swallow]

I've seen complaints mentioned by others in this channel, but the Yara room in the Cyber Defense path needs changes. In Task 9, when using my own fully updated version of the Loki scanner (both the release & updated signature-base), the scan results did not match up with the room's expectations.

However, if you rely on the VM's version of the scanner, the correct answer does show up. Screenshots can be supplied if needed.

I recommended stating in the Task that it's best to use the remote VM's tools (or update the questions).

[formal tendon]

same bug still exists

i can't access "Authenticate"

i did everything right
tried my vpn
tried my attack box
still nth is working
the room is bugged and it keeps giving me "unable to connect"

@eternal summit

[eternal summit]

Why are you pinging me for this?

[jade flax]

🤣

[formal tendon]

you usually respond when someone reports a room bug, thought we ping you for the problems, sorry if I misunderstood. :""

[eternal summit]

You do not. I'm not THM staff.

[eternal summit]

Is it not port 8888?

[formal tendon]

nope

not 8888, and the ip itself doesn't load anything

[eternal summit]

Scan it

[gusty hull]

Hi
In WebOSINT - Task 6 - Q5: "Is the the Google Analytics code in use on another website? Yay or nay"
If you input the code from the previous answer it should be Yay, as there are 18 pages using this code.
Am I missing something, or is it an update problem (as in the code got reused since the room launched)?

[peak oasis]

Just re did the Nmap list, isn't the -vuln part of the script removed? Maybe an update on the tasking? Or em I being dense?

[next galleon]

Typo still not fixed

[dusky junco]

I've just sorted this, thanks cc @next galleon

[livid escarp]

Gave +1 Rep to @heady pebble

[dusky junco]

@misty cave do you have manage room perms?

[wheat fractal]

so the revshell uploaded as IKD.jpg and i typed in ../content/IKD.jpg in the Admin page prompt and it returns this

i used curl to check if the file was missing and :

its there

[obsidian kiln]

(And yes, I can see in your screenshot that you messed with the magic number)

This entire challenge is an exercise in critical thinking and putting things together in a new way. You're not going to get anywhere by just applying the information in the room -- you need to actually think about it, shift it around in your head, and devise a solution for yourself.

No point in spoonfeeding everything

[wheat fractal]

it did not get by the client side filter without me changing the magic number

[obsidian kiln]

What was the important lesson you were taught about client side filters?

[wheat fractal]

they can be removed

[obsidian kiln]

Mhm
If it happens on your device, it's yours to control.

[wheat fractal]

oh shit

[obsidian kiln]

See what I mean about turning things around in your head? 😄

[wheat fractal]

yes sir thank you for your insight

i will keep trying

[wheat fractal]

omg thank you soo much

[livid escarp]

Gave +1 Rep to @obsidian kiln

[wheat fractal]

i just got the flag

i've been thinking about this room for about two months now i feel soo relieved

[obsidian kiln]

You are most welcome 🙂

[wheat fractal]

would it be possible to get to hear whats being talked about in the small study room?
im just curious as of what are these great minds are talking about

[obsidian kiln]

I mean, by the looks of things they're playing Dark Souls

[wheat fractal]

oh yeah lol

i thought 0day was giving a lecture on azure

[obsidian kiln]

0day isn't even in there

That's Varg

[wheat fractal]

oof

[rotund crystal]

Study study study

[misty cave]

I do

[graceful path]

Network Services issue I'm unable to mount NFS due to the fact when I mount it there are no files!
I did enter sudo mount -t nfs IP:/home /tmp/mount/ -nolock!

[median coral]

I've seen that this has been brought up multiple times but is there any working fix for https://tryhackme.com/room/csp task 7 question 5 and 6 as the admin bot doesn't have internet connection :/

[vernal saddle]

Aloha there, could you please ADD the credentials from Task 1 in the room https://tryhackme.com/room/winprivesc Cheers!

[graceful path]

credentials are added just used example like /home

is the share part of the syntax

Including IP from my own target machine, still nothing including with nolock! This is still a bug!

[modern raven]

the room is working fine for me and many others

[vernal saddle]

well much easier and clear if are added from task 1 or even for each task as Linux Priv-esc is.

[graceful path]

Nothing is in it though!

Cappuccino has nothing in it!

[modern raven]

yes it has

you just need to use a command to show hidden files as well

[graceful path]

ls -l and 0 files?

[modern raven]

ls -la

[graceful path]

Ohhhh of course it is hidden duh! I'll have a look soon!

Cheers @modern raven

[unique mural]

Windows "instance" not loading after trying to "Start Machine". I have tried multiple times, letting it sit there for up to 15 minutes, MACHINE_IP does not get populated. Room: MAL:Malware Introductory - Task 6 (https://tryhackme.com/room/malmalintroductory5f). I posted in Support as well.

[dusky junco]

Hi, this is a private room (a copy of my MAL introductory). The owner of the cloned room will need to re-clone from the original as the VM works in the original just fine

[median coral]

uh ben, could you take a look at this when you have the time
#room-bugs message,

[fading idol]

@gleaming shadow @dusky junco @queen sphinx @icy elbow
pinged all the mods I saw online 😅

[unique mural]

Thank you for that info. I will bring it to my instructors attention.

[livid escarp]

Gave +1 Rep to @dusky junco

[crystal spruce]

Hello guys, for challenge https://tryhackme.com/room/introtox8664, there are big errors in the Task 2 Introduction. All ASM operations are reversed. For instance: movq source, destination instead of movq destination, source, same with all examples. Can somebody correct this?

[bold dock]

hello, is all windows room down?? i can't connect them.. i've waiting for 1 hour (blaster, windows fundamentals, post exp,retro)

[dusky junco]

No reason why they wouldn't be specifically -- it'd be all rooms or none

How are you trying to connect to them exactly? Are you able to access http://10.10.10.10 in the browser of the device that you've got connected to THM?

[bold dock]

yes i can

but when i ping machine is seems not pinging back

[bold dock]

i ask this cause i can't connect all windows machines .. how to solve this?

[dusky junco]

Windows machines don't respond to pings unless configured to do so

so they will look like they're down but they're not

[bold dock]

but nmap also didn't working

[dusky junco]

You need to add -Pn to your scan

[bold dock]

ok nice.. thanks for your advice

[livid escarp]

Gave +1 Rep to @dusky junco

[dusky junco]

[paper halo]

a little help in room "Linux privesc" when i m trying to ssh the machine i m getting this message

and i m connected via openvpn

[rotund crystal]

I just booted up the room and ssh'd in, think it might be a problem with not waiting long enough

[ebon roost]

hello, if THM staff online i need to inform that Nax room has one question regarding the full path stuff is not accepting the correct name of the path so kindly look into it

[median coral]

did you see the hint?

[ebon roost]

yes

also went through all the walkthroughs there they also got the same path but for them the submission was working but for me its showing wrong though i got the flags in similar way

[median coral]

yeh, just check the length of your flag

also, here's an msf6 output for reference

[ebon roost]

flags are correct

[median coral]

the answer is in here

[median coral]

this is not the correct flag

[ebon roost]

ok let me try again

[ebon roost]

I just now ran the msfconsole in my vm there I got different path from the one I got in attack box but in both the places the flag is same

so i guess as attack box is not updated thats the reason i got the correct flag as the attack box had msf5

[median coral]

have you considered the idea that the flag you're trying might be incorrect and you should try other exploits listed in this output?

[median coral]

its number 8

the correct flag

[median coral]

yes, attackbox has msf5 and msf6 is recommended

[ebon roost]

yes i got this when i ran it on the virtual box but this i was not getting on the attack box which is on THM

[ebon roost]

okay

Thanks for the help

[fallow cove]

is there a bug with Metamorphosis? I think that i'm doing the expected thing, but the results i'm getting don't match

[hexed widget]

Hi 🙂

It might be an old conversation but I am currently trying with the Osiris room and stuck at the same, did you managed to bypass that?
thanks,

[livid escarp]

Gave +1 Rep to @dense garnet

[dense garnet]

Yes! Want to DM me?

[hexed widget]

Yes Sure !

[hallow oxide]

Not really a bug, but this channel is the best place I could find for reporting typos. I'm in room "NetSecMod Room 07 Services" on task 6 about POP3 and the final question of the task refers to IMAP, which is the next task. I would assume this is a mistake and that it should refer to POP3. Just an FYI 🙂

[hollow galleon]

Not sure if it's under maintenance or something but a relatively newer room(password security) I completed recently shows as unavailable now: https://tryhackme.com/room/passwordsecurity

[real grove]

I am having the same problem.

[obsidian kiln]

-ban @rigid shadow -ddays 1 Compromised Account - Game spam

[livid escarp]

🔨 Banned Robin DaBanks#5611 indefinitely

[polar flare]

https://tryhackme.com/room/kuberneteschalltdi2020 The only port 22 is open. Can THM fix it? Thanks.

[indigo girder]

Anyone know of any issues with Blaster v3 powershell script not executing on the exploited machine? It just closed cmd after I press enter and doesn't connect to the attack box.

[eternal summit]

This is a known issue, but TryHackMe did not create the room and therefore aren't really responsible for fixing it.
They've reached out to the creator, I believe.

[livid escarp]

Gave +1 Rep to @eternal summit

[surreal siren]

There seems to be some issues with the Buffer Overflow room.

I've indeed found all the badchars for first flag but the submission will not take

[obsidian kiln]

What do you think the answer should be? 🙂

[surreal siren]

what mona is telling me for bad chars. The offset is correct. So after through the bad chars at it with the correct offset I just be able to run !mona compare -f C:\mona\oscp\bytearray.bin -a with ESP output and get the bad chars.

THM is saying the offsets are right but not the bad chars. Wasted a whole day fooling around with it. Has this happened with other people?

[obsidian kiln]

Okay, but what do you think the answer should be

Or rather, what is mona telling you

[surreal siren]

\x00\x07\x08\x2e\x2f\xa0\xa1

[obsidian kiln]

I can tell you for a fact that those are not correct; however, I can also see exactly how it's come to that conclusion

It's made the same mistake that many people make manually when hunting for bad chars -- it's failed to factor in that a single bad character may corrupt more than just itself

Specifically, each bad character has also corrupted the character immediately after itself -- the correct answer is \x00\x07\x2e\xa0

[surreal siren]

what the frickle frack

well dang

[obsidian kiln]

i.e. if you remove those characters, \x08, \x2f and \xa1 will come back

(Which is why checking manually can be helpful -- you remove the first character that causes a corruption and see what happens when you run it again)

[surreal siren]

is mona misleading?

let me try again

[obsidian kiln]

Nah. If you did it manually you would see that each bad character has been replaced with \x0a\x0d -- or \n\r in ASCII. A line break, in other words. The effect of the bad characters (in this particular instance -- remember that these are engineered) is that they cause a line break. Line breaks on Windows take two characters, so the next character is also corrupted.

Mona simply doesn't take that into account -- it just sees out of sequence characters and flags them for you to look at

It knows that \x0a doesn't follow \x06, and \x0d doesn't follow \x07 -- they are both in the wrong place, so they both get flagged. It doesn't have the logic to question whether there's any significance to this particular sequence of corrupted characters

[surreal siren]

rdp keeps dropping. I'll have to tackle again later

[cosmic wren]

Hey there, i guess on the room rpmetasploit is a mistake in the second last question. "additionally, we can start a socks5 proxy server out of this session. Background our current meterpreter session and run the command search server/socks5. What is the full path to the socks5 auxiliary module?" the answer is auxiliary/server/socks5, but there is no socks5 module anymore (at least in my metasploit version) there is just auxiliary/server/socks_proxy . am i wrong there or is this not updated ?