plucky walrus Apr 6, 2023, 4:47 PM

#

└─$ nslookup za.tryhackme.com
;; communications error to 10.200.92.101#53: timed out
;; communications error to 10.200.92.101#53: timed out
;; communications error to 10.200.92.101#53: timed out
Server: 127.0.0.53
Address: 127.0.0.53#53

Name: za.tryhackme.com
Address: 10.200.89.101
;; communications error to 10.200.92.101#53: timed out
;; communications error to 10.200.92.101#53: timed out
;; communications error to 10.200.92.101#53: timed out

#

plz guide me

wooden minnow Apr 6, 2023, 4:47 PM

#

Are you connected to the breaching VPN?

plucky walrus Apr 6, 2023, 4:49 PM

#

not breachingAD VPN, connected to Machine VPN

wooden minnow Apr 6, 2023, 4:49 PM

#

You're in the attackbox?

plucky walrus Apr 6, 2023, 4:50 PM

#

iam trying from my own kali machine

wooden minnow Apr 6, 2023, 4:50 PM

#

Ok, you need to be connected to the BreachingAD VPN

#

Click Networks

plucky walrus Apr 6, 2023, 4:52 PM

#

breachingAD VPN is not connecting due to cipher issue. So i tried thm-troubleshoot. It automatically connected to Machine VPN

wooden minnow Apr 6, 2023, 4:52 PM

#

It's not the cipher.

#

Open your Breachad VPN file and change line 2

from dev breachad
to dev tun

plucky walrus Apr 6, 2023, 4:56 PM

#

failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'BF-CBC') if you want to connect to this server.
2023-04-06 12:55:16 ERROR: Failed to apply push options
2023-04-06 12:55:16 Failed to open tun/tap interface

#

2023-04-06 13:01:32 OPTIONS ERROR: failed to negotiate cipher with server. Add the server's cipher ('AES-256-CBC') to --data-ciphers (currently 'AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305') if you want to connect to this server.
2023-04-06 13:01:32 ERROR: Failed to apply push options
2023-04-06 13:01:32 Failed to open tun/tap interface
2023-04-06 13:01:32 SIGUSR1[soft,process-push-msg-failed] received, process restarting
2023-04-06 13:01:32 Restart pause, 16 second(s)

#

client
dev tun
proto udp
sndbuf 0
rcvbuf 0

#

even after changing dev to tun, error is same

#

in hackthebox, i didnt face this type of problem

limber grove Apr 6, 2023, 5:21 PM

#

plucky walrus even after changing dev to tun, error is same

Did you try this?

#breaching-ad message

plucky walrus Apr 7, 2023, 3:48 AM

#

after 4 hours of troubleshooting, i have successfully connected to vpn

#

└─# nslookup za.tryhackme.com
Server: 10.200.92.101
Address: 10.200.92.101#53

Name: za.tryhackme.com
Address: 10.200.92.101

#

┌──(root㉿kali)-[~]
└─# sudo systemctl restart NetworkManager

┌──(root㉿kali)-[~]
└─# nslookup za.tryhackme.com
Server: 127.0.0.53
Address: 127.0.0.53#53

Name: za.tryhackme.com
Address: 10.200.89.101

┌──(root㉿kali)-[~]
└─# ssh thm@THMJMP1.za.tryhackme.com
ssh: Could not resolve hostname thmjmp1.za.tryhackme.com: Name or service not known

plucky walrus Apr 7, 2023, 4:35 AM

#

let it be, i am able to ssh with ip address.

junior junco Apr 7, 2023, 2:37 PM

#

i am getting this error when connecting to Network VPN Server and i cannot fix that. Can someone from help me out with this?

plucky walrus Apr 7, 2023, 2:39 PM

#

junior junco i am getting this error when connecting to `Network VPN Server` and i cannot fix...

for me it worked after uninstalling openvpn, installed again. In 63xxxx.ovpn file, second line change to "dev tun"

#

in 63xxxx.ovpn, added "data-ciphers AES-256-CBC:AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305"

junior junco Apr 7, 2023, 2:41 PM

#

where should i add this line in the file, data-ciphers AES-256-CBC:AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305?

plucky walrus Apr 7, 2023, 2:41 PM

#

also run thm-troubuleshoot

plucky walrus Apr 7, 2023, 2:42 PM

#

junior junco where should i add this line in the file, `data-ciphers AES-256-CBC:AES-256-GCM:...

in 14th line of 63xxx.ovpn , plz check

junior junco Apr 7, 2023, 2:44 PM

#

it worked, thank you for the help!

plucky walrus Apr 7, 2023, 2:44 PM

#

WC

#

guys anyone faced tftp file copying problem like me ?

junior junco Apr 7, 2023, 3:01 PM

#

after connecting to network vpn server i am getting this error while doing nslookup. anyone know what i am missing here?

plucky walrus Apr 7, 2023, 3:04 PM

#

junior junco after connecting to network vpn server i am getting this error while doing nsloo...

are you using Kali ?

junior junco Apr 7, 2023, 3:04 PM

#

yes

plucky walrus Apr 7, 2023, 3:04 PM

#

go to network manager, IPv4, add DNS IP

junior junco Apr 7, 2023, 3:05 PM

#

which IP i have to add there ?

plucky walrus Apr 7, 2023, 3:06 PM

#

Hope you have THMDC IP add as 10.200.92.101, plz add that IP

junior junco Apr 7, 2023, 3:08 PM

#

i use dnsmasq and already added that dns ip but still unable to nslookup

#

tried adding that to network manager

#

#

#

i dont know what i am missing now :/

plucky walrus Apr 7, 2023, 3:19 PM

#

it should work

#

i have added in /etc/resolv.conf also but it is deleting automatically after service restart or reboot.

junior junco Apr 7, 2023, 3:30 PM

#

https://askubuntu.com/questions/143819/how-do-i-configure-my-static-dns-in-interfaces

Ask Ubuntu

How do I configure my static DNS in interfaces?

I am using Ubuntu 12.04.

My /etc/network/interfaces file consists of:

The loopback network interface

auto lo
iface lo inet loopback

The primary network interface

auto eth0
iface e...

#

this method works for /etc/resolv.conf file

#

but its not working for me lol

#

it worked, i forget to restart the network service

#

i am stupid

#

thank you for the help!

plucky walrus Apr 7, 2023, 3:46 PM

#

👍

plucky walrus Apr 7, 2023, 4:48 PM

#

anyone got error opening database file "sqlitebrowser ma.db" ?

junior junco Apr 7, 2023, 5:08 PM

#

I am trying to fix this DNS thing from past 3,4 hours but couldnt fix it. Decided to use the attackbox and when running this command for dns , systemd-resolve --interface breachad --set-dns 10.200.92.101 --set-domain za.tryhackme.comit throws Unknown interface breached: No such device this error. Any help would be appreciated!

#

i cant figure out what i am missing

#

please do @ me if anyone going to reply.

plucky walrus Apr 7, 2023, 5:18 PM

#

your interface is not breachad

#

sudo mkdir -p /etc/resolvconf/resolv.conf.d
sudo nano /etc/resolvconf/resolv.conf.d/tail
nameserver 10.200.92.101
nameserver 8.8.8.8
sudo apt install resolvconf
sudo resolvconf -u

wooden minnow Apr 7, 2023, 5:35 PM

#

junior junco I am trying to fix this DNS thing from past 3,4 hours but couldnt fix it. Decide...

Are you on the attackbox or VM?

junior junco Apr 7, 2023, 5:36 PM

#

attachbox

junior junco Apr 7, 2023, 5:36 PM

#

plucky walrus sudo mkdir -p /etc/resolvconf/resolv.conf.d sudo nano /etc/resolvconf/resolv.con...

did that earlier didnt work for me, i messed up my dns lol

#

whats my interface on my attackbox?

wooden minnow Apr 7, 2023, 5:38 PM

#

Can you do

ip addr show

junior junco Apr 7, 2023, 5:38 PM

#

on my attackbox?

wooden minnow Apr 7, 2023, 5:39 PM

#

Yes, and which interface has a 10.200 ?

#

Or 10.50

junior junco Apr 7, 2023, 5:41 PM

#

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
    link/ether 02:09:1a:72:bf:91 brd ff:ff:ff:ff:ff:ff
    inet 10.10.227.221/16 brd 10.10.255.255 scope global dynamic ens5
       valid_lft 1937sec preferred_lft 1937sec
    inet6 fe80::9:1aff:fe72:bf91/64 scope link 
       valid_lft forever preferred_lft forever
3: persistad: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
    link/none 
    inet 10.50.59.145/24 brd 10.50.59.255 scope global persistad
       valid_lft forever preferred_lft forever
    inet6 fe80::8ec0:761:9ea6:66d9/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:f8:59:7c:d3 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::42:f8ff:fe59:7cd3/64 scope link 
       valid_lft forever preferred_lft forever
6: veth6e80c29@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 1a:30:26:85:be:7c brd ff:ff:ff:ff:ff:ff link-netnsid 1
    inet6 fe80::1830:26ff:fe85:be7c/64 scope link 
       valid_lft forever preferred_lft forever
8: veth5507147@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default 
    link/ether 22:39:0f:bc:99:53 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::2039:fff:febc:9953/64 scope link 
       valid_lft forever preferred_lft forever
root@ip-10-10-227-221:~#

wooden minnow Apr 7, 2023, 5:41 PM

#

persistad I think.

plucky walrus Apr 7, 2023, 5:42 PM

#

sqlitebrowser ma.db

qt.qpa.xcb: could not connect to display
qt.qpa.plugin: Could not load the Qt platform plugin "xcb" in "" even though it was found.
This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.

Available platform plugins are: eglfs, linuxfb, minimal, minimalegl, offscreen, vnc, wayland-egl, wayland, wayland-xcomposite-egl, wayland-xcomposite-glx, xcb.

zsh: IOT instruction sqlitebrowser ma.db

#

any solution ? I uninstalled sqlitebrowser and install again. Updated pacakges but still same error

junior junco Apr 7, 2023, 5:44 PM

#

wooden minnow `persistad` I think.

i tried persisted instead of persistad before asking for help here, i am clearly blind. The command works but nslookup for thmdc.za.tryhackme.com isnt working

#

attackbox meant to be easier

wooden minnow Apr 7, 2023, 5:47 PM

#

junior junco i tried persisted instead of persistad before asking for help here, i am clearly...

Can you cat /etc/resolv.conf

junior junco Apr 7, 2023, 5:49 PM

#

wooden minnow Apr 7, 2023, 5:50 PM

#

junior junco

Put nameserver 10.200.92.101 above 127.0.0.53

junior junco Apr 7, 2023, 5:54 PM

#

#

@plucky walrus everything work for you ?

wooden minnow Apr 7, 2023, 5:58 PM

#

junior junco

Is your network running?

plucky walrus Apr 7, 2023, 5:58 PM

#

junior junco <@731884535121182782> everything work for you ?

ya i dont have DNS problem. It resolved, able to nslookup

wooden minnow Apr 7, 2023, 5:58 PM

#

I had to start mine.

plucky walrus Apr 7, 2023, 5:59 PM

#

for me sqlitebrowser is unable to open mcafee database.

junior junco Apr 7, 2023, 6:02 PM

#

yeap its running

#

i bought tryhackme to learn some ad before buying crtp labs but it looks like i should go for crtp labs directly

plucky walrus Apr 7, 2023, 6:09 PM

#

CRTP lab is too costly. If can complete within 1 or 2 months within time, then CRTP lab is good.

wooden minnow Apr 7, 2023, 6:10 PM

#

junior junco i bought tryhackme to learn some ad before buying crtp labs but it looks like i ...

You got a vm?

junior junco Apr 7, 2023, 6:10 PM

#

nope, using kali as a primary os

wooden minnow Apr 7, 2023, 6:11 PM

#

Wow.

You're brave.

Why don't don't you do this on kali?

junior junco Apr 7, 2023, 6:32 PM

#

because its not working on kali either

#

dns is always hard t configure

wooden minnow Apr 7, 2023, 6:33 PM

#

You don't need to do dms.

#

Dms

#

Dns

#

Just put it on mameserve

junior junco Apr 7, 2023, 6:35 PM

#

its not working for some reasons which i cant figure out

#

i will try again after crying

junior junco Apr 7, 2023, 8:02 PM

#

nslookup is working as seen in the ss but i am unable to access the url in the web browser

#

@charred sandal sorry for the ping but i cant fix the issue can you help me with it?

verbal hearth Apr 8, 2023, 9:31 AM

#

I have the same Problem with the same network...

somber ledge Apr 8, 2023, 11:43 AM

#

junior junco <@243160021674754048> sorry for the ping but i cant fix the issue can you help m...

Hey, please ping me instead of Skidy:)
I'm your go-to man for any issues, I can then let the relevant teams know

sand egret Apr 8, 2023, 4:36 PM

#

Hi guys, need some help to fix this, error message when try to do nslookup to thmdc.za.tryhackme.com:

;; connection timed out; no server could be reached.

I have added the DC ip and I am connected to the VPN. any advice?

wooden minnow Apr 8, 2023, 4:51 PM

#

Are you using the correct VPN?

sand egret Apr 8, 2023, 5:17 PM

#

wooden minnow Are you using the correct VPN?

Yes, breachingad vpn

wooden minnow Apr 8, 2023, 5:17 PM

#

sand egret Yes, breachingad vpn

Can you cat /etc/resolv.conf for me.

sand egret Apr 8, 2023, 5:22 PM

#

wooden minnow Can you cat `/etc/resolv.conf` for me.

sure thing,

#Generated by NetworkManager
search thmdc.za.tryhackme.com
nameserver 10.200.32.101
nameserver 8.8.8.8

wooden minnow Apr 8, 2023, 5:23 PM

#

Hm, strange.

junior junco Apr 9, 2023, 11:28 AM

#

Hey @somber ledge , I ran this command on my attackbox systemd-resolve --interface persistad --set-dns 10.200.92.101 --set-domain za.tryhackme.com and after that the nslookup showing ;; connection timed out; no server could be reached. error.

Secondly, on my local machine i added thmdc ip in my /etc/resolve.conf and after that nslookup working on my local machines but the websites are not reachable in the browser.

#

i couldnt figure out whats wrong so can you please help me with that.

#

gaunt shell Apr 9, 2023, 12:12 PM

#

junior junco

So what room are you actually doing, the breaching AD room or the persisting AD room ?

junior junco Apr 9, 2023, 12:13 PM

#

breaching ad

gaunt shell Apr 9, 2023, 12:13 PM

#

junior junco breaching ad

Okay, because in your command you used the persistad interface instead of the breachad interface

junior junco Apr 9, 2023, 12:14 PM

#

ahh

#

gaunt shell Apr 9, 2023, 12:17 PM

#

junior junco

Might have to restart the attackbox, as if you joined the room after starting the attackbox, you might not have the interface yet

junior junco Apr 9, 2023, 12:18 PM

#

let me try that

#

not working!

gaunt shell Apr 9, 2023, 12:27 PM

#

junior junco not working!

What is not working ?

junior junco Apr 9, 2023, 12:28 PM

#

its giving me same error as before for breachad interface

gaunt shell Apr 9, 2023, 12:29 PM

#

junior junco its giving me same error as before for `breachad` interface

Then you might want to shut down the attackbox again, leave the room with the little gear icon top right, join the room again, start the attackbox back up again

junior junco Apr 9, 2023, 12:42 PM

#

it worked, thank you so much!

prisma thorn Apr 11, 2023, 8:16 PM

#

I had the same issue with the interface, thanks a lot as well 👍

random token Apr 15, 2023, 11:46 AM

#

Ok, so I have been trying this for the past 2 days. Task 5 in the room "Breaching Active Directory" has to be broken, right? I am not getting any hashes in responder in both my local vm or the attackbox even after resetting the network twice.

#

wooden minnow Apr 15, 2023, 11:46 AM

#

What was the error?

random token Apr 15, 2023, 11:47 AM

#

I have waited on each try for atleast 20 minutes.

random token Apr 15, 2023, 11:47 AM

#

wooden minnow What was the error?

There is none, I am just getting no events.

wooden minnow Apr 15, 2023, 11:47 AM

#

That one?

random token Apr 15, 2023, 11:48 AM

#

That's because slapd is running but that doesn't matter as I am waiting for a SMB event.

wooden minnow Apr 15, 2023, 11:53 AM

#

iI'll need to do it.

random token Apr 15, 2023, 11:54 AM

#

I haven't had any issues with the other rooms or it was just my dumbass who was the problem. With this one, I am pretty conviced that something is broken.

wooden minnow Apr 15, 2023, 12:28 PM

#

can someone reset the .32.101 subnet please.

#

Nevermind.

wooden minnow Apr 15, 2023, 12:29 PM

#

random token I haven't had any issues with the other rooms or it was just my dumbass who was ...

Responder worked for me.

random token Apr 15, 2023, 12:29 PM

#

huh

wooden minnow Apr 15, 2023, 12:29 PM

#

I've obfuscated the Username, and gave you part of the hash as proof.

random token Apr 15, 2023, 12:30 PM

#

wooden minnow I've obfuscated the Username, and gave you part of the hash as proof.

Which Interface did you use?

wooden minnow Apr 15, 2023, 12:30 PM

#

random token Which Interface did you use?

#

random token Apr 15, 2023, 12:31 PM

#

How long did you wait?

wooden minnow Apr 15, 2023, 12:31 PM

#

About 5 min(s)

random token Apr 15, 2023, 12:32 PM

#

I don't have to trigger anything, right? The server will just send a request at some point.

wooden minnow Apr 15, 2023, 12:32 PM

#

Nope, I started it, then started watching general chat.

random token Apr 15, 2023, 12:33 PM

#

I am just booting up the attackbox, as I am in another room with my lab vm. I will try again right now.

#

wooden minnow Apr 15, 2023, 12:39 PM

#

I stopped it, then re run responder, and I got this message.

#

And that took 6 min(s) and 36 sec(s).

random token Apr 15, 2023, 12:40 PM

#

I am running a stopwatch aswell, will report in a few minutes.

#

Super weird though, as I am using the attackbox, to make sure there isn't any interference from my lab environment.

random token Apr 15, 2023, 12:42 PM

#

wooden minnow I stopped it, then re run responder, and I got this message.

Do you think resetting my progress would change anything?

#

wooden minnow Apr 15, 2023, 12:42 PM

#

No.

random token Apr 15, 2023, 12:42 PM

#

Or does that only clear my answers?

wooden minnow Apr 15, 2023, 12:42 PM

#

Yup.

random token Apr 15, 2023, 12:42 PM

#

Ok

random token Apr 15, 2023, 12:46 PM

#

wooden minnow I stopped it, then re run responder, and I got this message.

I don't know what to tell ya.

#

#

Brand new attackbox booted up, network started and issued the responder command.

#

Do you mind hopping in a VC? I can share my screen and show you what I am doing.

wooden minnow Apr 15, 2023, 12:53 PM

#

I'm just heading out.

One thing I can suggest is opening a new terminal and doing the sudo tcpdump -SC -i tun0 tcp port 139

Whilst you're waiting for the responder.

random token Apr 15, 2023, 12:54 PM

#

random token Apr 15, 2023, 1:00 PM

#

wooden minnow I'm just heading out. One thing I can suggest is opening a new terminal and doi...

Did you do this step? It shouldn't matter, as it is for a different interface, correct?

#

wooden minnow Apr 15, 2023, 1:02 PM

#

do ip a s and what is the interface that has 10.50 ?

random token Apr 15, 2023, 1:03 PM

#

tun0

wooden minnow Apr 15, 2023, 1:03 PM

#

change breachad to tun0

random token Apr 15, 2023, 1:04 PM

#

actually they are both in 10.50.0.0

#

wooden minnow Apr 15, 2023, 1:04 PM

#

you can use that commandthen.

random token Apr 15, 2023, 1:05 PM

#

yeah, did that...

#

Just wanted to clarify on this

#

tcpdump also doesn't throw anything

wooden minnow Apr 15, 2023, 1:05 PM

#

You need to keep testing the printer settings for that work.

#

but I had it running whilst I waited for the hash.

random token Apr 15, 2023, 1:06 PM

#

noooooo

#

wait

#

Do I have to press test settings or something in order to get a hash?

wooden minnow Apr 15, 2023, 2:54 PM

#

No

forest cloud Apr 18, 2023, 6:19 AM

#

In my kali machine its showing systemd-resolve command not found

#

and why I try to download it saying unable to locate the package can someone help me plzz

whole cedar Apr 19, 2023, 5:45 PM

#

Hello all! I'm working this network on my own Kali machine, got connected and DNS is configured. I'm trying to do the password spray attack (all files downloaded to my Kali machine), but I keep getting this error message

/usr/share/offsec-awae-wheels/pyOpenSSL-19.1.0-py2.py3-none-any.whl/OpenSSL/crypto.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.

Traceback (most recent call last):
  File "ntlm_passwordspray.py", line 4, in <module>
    from requests_ntlm import HttpNtlmAuth
ImportError: No module named requests_ntlm```

Can anyone help with resolving this? I unzipped the task files to my Kali machine, like I said, so I'm not sure what else I need.

dense cedar Apr 19, 2023, 5:53 PM

#

whole cedar Hello all! I'm working this network on my own Kali machine, got connected and DN...

Hey there, please run it using Python3 as you can see here: Python 2 is no longer supported by the Python core team.. So run it with python3 ntlm_passwordspray.py and see if that works for you. The AttackBox has python3 as the default

whole cedar Apr 19, 2023, 5:54 PM

#

I just ran it with python3 and it still giving the same error

#

  File "/home/kali/ntlm_passwordspray.py", line 4, in <module>
    from requests_ntlm import HttpNtlmAuth
ModuleNotFoundError: No module named 'requests_ntlm'```

dense cedar Apr 19, 2023, 5:54 PM

#

whole cedar I just ran it with python3 and it still giving the same error

pip3 install requests_ntlm

whole cedar Apr 19, 2023, 5:55 PM

#

this worked! Thanks! So to understand, my kali was missing a p3 module that allows the sprayer to run?

dense cedar Apr 19, 2023, 6:00 PM

#

whole cedar this worked! Thanks! So to understand, my kali was missing a p3 module that allo...

That is correct yes. You were missing that python3 package. Most no module named X can be solved by running pip3 install X. In certain cases more steps may be required. But just a rule of thumb

whole cedar Apr 19, 2023, 6:00 PM

#

Good to know, thanks for that tip!

whole cedar Apr 20, 2023, 12:55 AM

#

Hello! Back again, about to finish the "Configuration Files" section. I'm trying to run the mcafee pwd decrypt.py program, but I'm getting an error message similar to the last one
No module named Crypto.Cipher
I did the 'pip3 install Crypto.Cipher, but it still doesn't work after installing the module. Any help with this?

undone knoll Apr 20, 2023, 1:05 AM

#

@whole cedar I had a lot of issues at that part, this is ultimately what I did

whole cedar Apr 20, 2023, 1:11 AM

#

undone knoll <@218902716682862592> I had a lot of issues at that part, this is ultimately wha...

Thanks!

slate swanBOT Apr 20, 2023, 1:11 AM

#

Gave +1 Rep to @undone knoll

safe hound Apr 20, 2023, 11:35 AM

#

plucky walrus in 63xxxx.ovpn, added "data-ciphers AES-256-CBC:AES-256-GCM:AES-128-GCM:CHACHA20...

sen adamsın be oldu teşekkür ederim 🙂

mellow shadow Apr 27, 2023, 6:09 AM

#

whole cedar Hello! Back again, about to finish the "Configuration Files" section. I'm trying...

python3 -m pip install pycryptodome

Crypto.Cipher is a part of pycryptodome lib

However the dcrypt.py is a python2 there is an updated version on github that supports py3

mellow shadow Apr 27, 2023, 6:10 AM

#

mellow shadow python3 -m pip install pycryptodome Crypto.Cipher is a part of pycryptodome lib...

https://github.com/funoverip/mcafee-sitelist-pwd-decryption

GitHub

GitHub - funoverip/mcafee-sitelist-pwd-decryption: Password decrypt...

Password decryption tool for the McAfee SiteList.xml file - GitHub - funoverip/mcafee-sitelist-pwd-decryption: Password decryption tool for the McAfee SiteList.xml file

celest jackal Apr 27, 2023, 2:35 PM

#

Hi, I can't connect to the vpn. I already succeeded without any problem last week, then I tried again this morning and impossible I still have this error when running openvpn breacad.opcn : "2023-04-27 10:22:34 Using peer cipher 'AES-256-CBC'
2023-04-27 10:22:34 Error: problem with tun vs. tap setting
2023-04-27 10:22:34 Exiting due to fatal error
". I launched the thm-troubleshoot which did not solve my problem so I come to ask for help here : "[+] Stable internet connection
[+] OpenVPN is installed
[-] tun0 interface does not exist
Would you like the script to attempt a connection automatically (Y/n)? Y
[+] Connecting....
[Warning!] Connection process is taking longer than expected to complete
[-] Failed to connect
Failure to connect to the VPN can usually be solved by one of the following options:
-Regenerating your OpenVPN config on the TryHackMe access page (https://tryhackme.com/access)
-Switching servers, then regenerating your OpenVPN config
-Checking your system time. If your system time is incorrect then this can cause issues with the authentication process
If none of these methods work, please ask for further assistance in the TryHackMe Discord server, subreddit or forums.
[-] Exiting
"
Thank you

undone knoll Apr 27, 2023, 2:39 PM

#

celest jackal Hi, I can't connect to the vpn. I already succeeded without any problem last wee...

Try editing the ovpn file and changing dev breachad to dev tun

slate swanBOT Apr 27, 2023, 2:48 PM

#

Gave +1 Rep to @undone knoll

celest jackal Apr 27, 2023, 2:49 PM

#

undone knoll Try editing the ovpn file and changing `dev breachad` to `dev tun`

It works! Thank a lot ! 🙂

undone knoll Apr 27, 2023, 2:49 PM

#

Great 🙂

mild needle Apr 29, 2023, 10:15 AM

#

┌──(kali㉿kali)-[~]
└─$ nslookup printer.za.tryhackme.com
Server:         10.200.27.101
Address:        10.200.27.101#53

Name:   printer.za.tryhackme.com
Address: 10.200.27.201

                                                                                                                     
┌──(kali㉿kali)-[~]
└─$ curl http://printer.za.tryhackme.com/settings.aspx
curl: (52) Empty reply from server

#

printer.za.tryhackme.com seems to be unresponsive when I do the LDAP Pass-back Attacks exercise in Breaching Active Directory

dark perch Apr 30, 2023, 4:25 PM

#

Hey everyone! I'm trying to connect to the Breaching AD network. It's running, the VPN is going and I have an internal IP... but I keep getting a DNS error when I try to connect to http://ntlmauth.za.tryhackme.com/ or http://za.tryhackme.com/... Could someone help? I use Kali (not on a VM) and the systemd-resolve command it tells you to execute won't work. I've tried installing systemd-resolved but that just (1) ruins DNS on my computer and (2) still doesn't work because resolvectl has different syntax than systemd-resolve, which is now deprecated...

#

If anyone could help that would be appreciated!

wooden minnow Apr 30, 2023, 4:30 PM

#

dark perch Hey everyone! I'm trying to connect to the Breaching AD network. It's running, t...

sudo nano etc/resolv.conf

Place THMDC at the top with nameserver

dark perch Apr 30, 2023, 4:32 PM

#

wooden minnow `sudo nano etc/resolv.conf` Place THMDC at the top with `nameserver`

Thank you so much. That works.

slate swanBOT Apr 30, 2023, 4:32 PM

#

Gave +1 Rep to @wooden minnow

wooden minnow Apr 30, 2023, 4:32 PM

#

dark perch Thank you so much. That works.

blobfingerguns

#

Happy Hacking.

dark perch Apr 30, 2023, 4:52 PM

#

Okay one more problem... I'm having the same issue here. It says the DNS address couldn't be found for http://printer.za.tryhackme.com/settings.aspx
#breaching-ad message

wooden minnow Apr 30, 2023, 4:54 PM

#

Did you restart the sytemcl?

dark perch Apr 30, 2023, 5:01 PM

#

NetworkManager?

dark perch May 1, 2023, 12:19 AM

#

Yeah... the THMDC IP addr. is in /etc/resolv.conf but now NONE of the domains are working...

dense cedar May 1, 2023, 2:29 PM

#

dark perch Yeah... the THMDC IP addr. is in /etc/resolv.conf but now NONE of the domains ar...

Have you followed the pinned message for debugging? If so, can you share that output?

dark perch May 1, 2023, 2:47 PM

#

dense cedar Have you followed the pinned message for debugging? If so, can you share that ou...

Oh, I didn't see that, thanks, I will look into it

slate swanBOT May 1, 2023, 2:47 PM

#

Gave +1 Rep to @dense cedar

dark perch May 1, 2023, 6:33 PM

#

dense cedar Have you followed the pinned message for debugging? If so, can you share that ou...

Okay, so as I said earlier, the initial DNS steps involving systemd-resolve don't work for me. I followed @wooden minnow's advice about putting the THMDC IP address into /etc/resolv.conf which is now

nameserver 8.8.8.8``` and that worked temporarily. I'm now connected to the VPN and can ping THMDC (in my case 10.200.4.101). However, `nslookup tryhackme.com 10.200.4.101` (step 3) fails with a timeout. Step 4 (`nslookup tryhackme.com`) does work fine though.

wooden minnow May 1, 2023, 6:33 PM

#

nslookup can be buggy.

#

Can you access the website?

dark perch May 1, 2023, 6:34 PM

#

I can access tryhackme.com but not za.tryhackme.com.

#

Wait-

dense cedar May 1, 2023, 6:34 PM

#

dark perch Okay, so as I said earlier, the initial DNS steps involving `systemd-resolve` do...

Can you quickly send me your VPN IP? So in your VPN file, there will be an internet IP where you are connecting to. If you send me that one I can take a quick look to see if DNS is working in the network

dark perch May 1, 2023, 6:34 PM

#

It started to work

dark perch May 1, 2023, 6:34 PM

#

dense cedar Can you quickly send me your VPN IP? So in your VPN file, there will be an inter...

One second...

#

I think the reason might've been that I had THMDC IP as the second entry in /etc/resolv.conf? I don't know how that would change anything but reverting it to the first entry now fixes the issue

dense cedar May 1, 2023, 6:36 PM

#

dark perch I think the reason might've been that I had THMDC IP as the second entry in /etc...

Yeah, that would be an issue, remember DNS takes priority, so if it is the second instance, would never get used

dark perch May 1, 2023, 6:36 PM

#

dense cedar Yeah, that would be an issue, remember DNS takes priority, so if it is the secon...

Ah thank you so much. I had assumed that if a host didn't resolve for the first one (8.8.8.8) it would advance to the second one.

slate swanBOT May 1, 2023, 6:36 PM

#

Gave +1 Rep to @dense cedar

dark perch May 1, 2023, 6:36 PM

#

I guess that's not how it works though 😅

dense cedar May 1, 2023, 6:37 PM

#

dark perch Ah thank you so much. I had assumed that if a host didn't resolve for the first ...

That is a correct assumption, but 8.8.8.8 is an internet DNS, so it will at all cost try to resolve your request. Always put your internet DNS second 😉

dark perch May 1, 2023, 6:38 PM

#

dense cedar That is a correct assumption, but 8.8.8.8 is an internet DNS, so it will at all ...

That makes sense. Thank you for clarifying! I have a lot to learn about DNS

dense cedar May 1, 2023, 6:38 PM

#

dark perch That makes sense. Thank you for clarifying! I have a lot to learn about DNS

And remember the golden rule when hacking AD, your issue is always DNS related 😂 Have fun!

dark perch May 1, 2023, 6:38 PM

#

dense cedar And remember the golden rule when hacking AD, your issue is always DNS related �...

😂 Yes it is... I will!

grave dune May 1, 2023, 9:09 PM

#

Hello guys
Im currently blocked on BreachingAD because a connection
i do all the step , i have ping to the ip , when i execute nslookup thmdc.za.tryhackme.com it's work
but when i try access to http://ntlmauth.za.tryhackme.com/ on firefox it's give me this error :
Hmm. We’re having trouble finding that site
if someone have the solution it's can be helpful
thank you 🙂

dark perch May 6, 2023, 3:53 PM

#

grave dune Hello guys Im currently blocked on BreachingAD because a connection i do all t...

Do you have the THMDC IP as the first entry in /etc/resovl.conf?

grave dune May 6, 2023, 5:13 PM

#

dark perch Do you have the THMDC IP as the first entry in /etc/resovl.conf?

Yes

grave dune May 6, 2023, 6:39 PM

#

dark perch Do you have the THMDC IP as the first entry in /etc/resovl.conf?

All is good only the access to the website not working

languid mulch May 9, 2023, 7:28 AM

#

tftp -i 10.200.32.202 GET "\Tmp\x64{11576AEB-86
2C-43B3-8BC8-BC99BFEC579C}.bcd" conf.bcd
Connect request failed

#

why is there an issue in connection ?

vivid jetty May 9, 2023, 6:04 PM

#

undone knoll Try editing the ovpn file and changing `dev breachad` to `dev tun`

It worked for me! Thank you!

Here are the steps I used while connecting from my own kali VM

Generate and download the breachingad openvpn config file from the "Access" page
Change the line from "dev breachingad" to "dev tun" in the breachingad.ovpn file
Add the $THMDCIP as the DNS server address (follow the kali steps from the breachingad page)
sudo openvpn breachingad.ovpn
sudo resolvectl status => Check the tun0 interface number. (Say, 3)
sudo resovectl dns 3 $THMDCIP
nslookup za.tryhackme.com

slate swanBOT May 9, 2023, 6:04 PM

#

Gave +1 Rep to @undone knoll

undone knoll May 9, 2023, 6:06 PM

#

Great 🙂

quasi rose May 12, 2023, 1:45 AM

#

I'm trying to follow task 1 for breachingad with the attack box.

#

Does anyone know what I've done wrong here?

#

I see other network intnerfaces

#

but not breachad

#

karmic jackal May 13, 2023, 8:12 PM

#

cmdlet not existing? any idea?

dense cedar May 14, 2023, 5:44 AM

#

karmic jackal cmdlet not existing? any idea?

Did you import PowerPXE?

karmic jackal May 14, 2023, 9:06 AM

#

dense cedar Did you import PowerPXE?

Did it yesterday, but i repeated again the process with success. Import-Module .\PowerPXE.ps1

karmic jackal May 14, 2023, 9:06 AM

#

dense cedar Did you import PowerPXE?

Thank you!!!

slate swanBOT May 14, 2023, 9:06 AM

#

Gave +1 Rep to @dense cedar

karmic jackal May 14, 2023, 9:07 AM

#

anyway, i mounted the image and grep "Password" in every file 😄

coral yew May 17, 2023, 3:49 PM

#

Hello I'm new and was told I can get help here I can't get my kali VM to connect to the network i've already tried following the steps in the room

wooden minnow May 17, 2023, 3:53 PM

#

Can you verify and share screenshots it will make it easier

#

!docs verify

outer timberBOT May 17, 2023, 3:53 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

coral yew May 17, 2023, 4:15 PM

#

wooden minnow Can you verify and share screenshots it will make it easier

i can't seem to find a button to upload images how do i post my screenshot?

wooden minnow May 17, 2023, 4:15 PM

#

See my previous message above.

coral yew May 17, 2023, 4:20 PM

#

wooden minnow See my previous message above.

ok

stable ledge May 18, 2023, 5:13 AM

#

on doing nslookup thmdc.za.tryhackme.com , i am getting server cant find the host error

#

please help

dense cedar May 18, 2023, 10:52 AM

#

stable ledge on doing nslookup thmdc.za.tryhackme.com , i am getting server cant find the hos...

Hey there, please review the pinned messages

prisma thorn May 18, 2023, 10:54 AM

#

Hi! I'm in the Breaching AD room and I'm using the attack box. I don't have the breachad interface or any other interface with another IP than the one assigned to the attack box. What can I do?

worldly timber May 19, 2023, 9:02 AM

#

Same here

#

I think it needs to be resetted. Yesterday it worked for me

prisma thorn May 19, 2023, 9:10 AM

#

worldly timber I think it needs to be resetted. Yesterday it worked for me

Tried again today, same issue

worldly timber May 19, 2023, 10:54 AM

#

Just tried it too and it doesn't work. Really weird

wooden minnow May 19, 2023, 3:24 PM

#

worldly timber Same here

I think the breached interface is actually tun0

#

ip a s would confirm this.

verbal cipher May 20, 2023, 10:05 AM

#

Hello. I downloaded my vpn configuration file for Breachingad network, but when I try to execute "sudo openvpn breachingad.ovpn" I keep getting an error "Options error: Unrecognized option or missing or extra parameter(s) in breachingad.ovpn:14: data-ciphers (2.4.7)". How to solve this?

dense cedar May 20, 2023, 10:38 AM

#

verbal cipher Hello. I downloaded my vpn configuration file for Breachingad network, but when ...

Open the ovpn file and change the line that says data-ciphers

#

Change that to cipher

verbal cipher May 20, 2023, 10:40 AM

#

Yeah, I already solved it by replacing breachad to tuv and data-ciphers to cipher

#

But now I get another problem. I did "systemd-resolve --interface tun0 --set-dns 10.200.97.101 --set-domain za.tryhackme.com
" and the response to "nslookup thmdc.za.tryhackme.com" was
Server: 127.0.0.53
Address: 127.0.0.53#53

** server can't find thmdc.za.tryhackme.com: SERVFAIL

verbal cipher May 20, 2023, 11:18 AM

#

I have an interface
ens5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9001 inet 10.10.201.163 netmask 255.255.0.0 broadcast 10.10.255.255 inet6 fe80::37:62ff:fe9f:2659 prefixlen 64 scopeid 0x20<link> ether 02:37:62:9f:26:59 txqueuelen 1000 (Ethernet) RX packets 91820 bytes 7200391 (7.2 MB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 59295 bytes 73881197 (73.8 MB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
which seems to correspond to my internal IP, but when I try to
systemd-resolve --interface ens5 --set-dns 10.200.97.101 --set-domain za.tryhackme.com
I get
The specified interface ens5 is managed by systemd-networkd. Operation refused. Please configure DNS settings for systemd-networkd managed interfaces directly in their .network files.
(In AttackBox)

verbal cipher May 20, 2023, 3:10 PM

#

3. Run nslookup tryhackme.com <THM DC IP> - This will verify that the THM Name server is active. If the PING worked but this does not, time to contact support here since something is wrong. I'd also suggest hitting the network reset button.

`nslookup tryhackme.com 10.200.97.101
Server: 10.200.97.101
Address: 10.200.97.101#53

** server can't find tryhackme.com: SERVFAIL`

I already reset the network and I still getting the same error

wooden minnow May 20, 2023, 3:12 PM

#

Did you set the THMDC in resolve.config?

verbal cipher May 20, 2023, 3:13 PM

#

How to do this?

wooden minnow May 20, 2023, 3:14 PM

#

sudo nano /etc/resolve.conf

Put the nameserver on top.

verbal cipher May 20, 2023, 3:14 PM

#

I set the DNS throug Network Manager.

#

`sudo cat /etc/resolv.conf

Generated by NetworkManager

search za.tryhackme.com
nameserver 10.200.97.101
nameserver 127.0.0.53
Previously I didn't havenameserver 10.200.97.101, now I've added it, but the error didn't gonslookup tryhackme.com 10.200.97.101
Server: 10.200.97.101
Address: 10.200.97.101#53

** server can't find tryhackme.com: SERVFAIL`

nslookup tryhackme.com 10.200.97.101 ;; connection timed out; no servers could be reached

verbal cipher May 20, 2023, 3:49 PM

#

`python3 ntlm_passwordspray.py -u usernames.txt -f za.tryhackme.com -p Changeme123 -a http://ntlmauth.za.tryhackme.com/

Traceback (most recent call last):
File "/home/kali/ntlm_passwordspray.py", line 4, in <module>
from requests_ntlm import HttpNtlmAuth
ModuleNotFoundError: No module named 'requests_ntlm'`
😕

#

pip install requests Defaulting to user installation because normal site-packages is not writeable Requirement already satisfied: requests in /usr/lib/python3/dist-packages (2.28.1)

#

Does anyone know how to fix this?

limber grove May 20, 2023, 3:52 PM

#

verbal cipher `python3 ntlm_passwordspray.py -u usernames.txt -f za.tryhackme.com -p Changeme1...

The error says that it is missing requests_ntlm. Installing that particular package should take care of it.

verbal cipher May 20, 2023, 4:02 PM

#

limber grove The error says that it is missing requests_ntlm. Installing that particular pac...

You're right, I should have installed requests_ntlm, not just requests

worldly timber May 24, 2023, 10:50 AM

#

I'm still having problems with the breachad interface...

#

The problem is, that it doesn't exist in the attackbox network

#

wooden minnow May 27, 2023, 3:54 PM

#

worldly timber I'm still having problems with the breachad interface...

sudo nano /etc/resolv.conf and add as the top nameserver

hardy tulip May 28, 2023, 12:09 PM

#

Task 6 : I'm having issues with the tftp command to get the bcd files :
Any clues to what I'm missing ?

hardy tulip May 28, 2023, 3:21 PM

#

Solved : new .bcd files have been generated after restarting the network, and these can be downloaded via tftp

dreamy hamlet May 29, 2023, 6:42 PM

#

i am not unable to connect to breachad.vpn

#

anyone know this issue?

undone knoll May 29, 2023, 6:51 PM

#

dreamy hamlet i am not unable to connect to breachad.vpn

Edit the ovpn file and change dev breachad to dev tun

dreamy hamlet May 29, 2023, 7:07 PM

#

WORKED❤

#

Thanks @undone knoll

slate swanBOT May 29, 2023, 7:07 PM

#

Gave +1 Rep to @undone knoll

undone knoll May 29, 2023, 7:19 PM

#

You're welcome 🙂

cunning thorn Jun 3, 2023, 8:20 AM

#

I cant get into http://printer.za.tryhackme.com/settings.aspx

#

what is the solution?

woeful grove Jun 3, 2023, 10:25 AM

#

I came here specifically to look for answers for the same question @dreamy hamlet ! Thank you @undone knoll !

slate swanBOT Jun 3, 2023, 10:25 AM

#

Gave +1 Rep to @dreamy hamlet

fringe lagoon Jun 3, 2023, 6:01 PM

#

sometimes I wonder what the point of teaching about outdated tools with no real world usage is 😅

undone knoll Jun 3, 2023, 6:10 PM

#

fringe lagoon sometimes I wonder what the point of teaching about outdated tools with no real ...

Showing what's possible, also the tool has been adapted for Python 3, you can find it

fringe lagoon Jun 3, 2023, 6:12 PM

#

yeah of course, I'm just saying since there's been a lot of instances of outdated content that I've seen, could've just put the updated version in the room

undone knoll Jun 3, 2023, 6:12 PM

#

It's honestly very hard to keep up with new tools and what gets updated

#

Pretty sure the updated tool isn't by the same person even

fringe lagoon Jun 3, 2023, 6:13 PM

#

undone knoll It's honestly very hard to keep up with new tools and what gets updated

reason I mentioned this specifically is because it was clearly already outdated when the room was made

#

hence the note

undone knoll Jun 3, 2023, 6:14 PM

#

Yeah, I'm just also not sure the updated tool was out at the time

#

If something is outdated, try to find out whether there's a current version on GitHub, and sometimes you have to work with multiple versions because of compatibility issues

jolly fiber Jun 4, 2023, 10:44 PM

#

Anybody setup this up with the Kali attack box?

#

The DNS is giving me a challenge

prisma thorn Jun 5, 2023, 10:39 PM

#

one mistake I made with the DNS resolving is I was using the wrong IP address

#

systemd-resolve --interface breachad --set-dns $THMDCIP --set-domain za.tryhackme.com

#

in the above $THMDCIP should be the IP right below the THMDC computer in the network diagram

#

(from the kali attack box)

prisma thorn Jun 7, 2023, 12:28 PM

#

need help

#

i have setup everything still throwing this error ERROR The requested URL could not be retrieved

#

why

#

!help

rich eagle Jun 7, 2023, 2:58 PM

#

undone knoll Edit the ovpn file and change `dev breachad` to `dev tun`

🙏

prisma thorn Jun 7, 2023, 3:04 PM

#

changing the browser then it got fix

wild lake Jun 16, 2023, 11:26 PM

#

I've been struggling for 2 hours, I tried it on 2 different computers and I still can't access this goddamn AD, it's complete bullshit, I'll stop trying.

wooden minnow Jun 17, 2023, 6:44 AM

#

wild lake I've been struggling for 2 hours, I tried it on 2 different computers and I stil...

Vpn issues?

daring musk Jun 17, 2023, 3:11 PM

#

should I contact support? I'm able to ping the DC IP but not able to run nslookup with tryhackme.com in front.

undone knoll Jun 17, 2023, 3:18 PM

#

Everything seems to be working fine, why are you trying to lookup tryhackme?

daring musk Jun 17, 2023, 3:31 PM

#

step 3 in the pinned message, also can't access ntlmauth.za.tryhackme.com.

daring musk Jun 18, 2023, 4:13 PM

#

I'm on my own Kali installation, if that helps

#

Ok, so I ended up just adding the line
10.200.97.201 ntlmauth.za.tryhackme.com
to my /etc/hosts file, which is ridiculous considering the room doesn't even mention this.

wooden minnow Jun 19, 2023, 10:42 AM

#

daring musk Ok, so I ended up just adding the line 10.200.97.201 ntlmauth.za.tryhackme.com...

This is a very rare occurrence.

shadow viper Jun 20, 2023, 10:16 AM

#

Hi! I facing some issue after i click join room, i cannot find start button under the diagram for start the lab, how can i solve it's. (try using chrome and firefox same issue).

wooden minnow Jun 20, 2023, 12:39 PM

#

shadow viper Hi! I facing some issue after i click join room, i cannot find start button und...

Him

The network runs 24/7.

So when you joined the room the "box" will already be started.

If its not there is a start button under the diagram.

prisma thorn Jun 21, 2023, 12:20 AM

#

daring musk Ok, so I ended up just adding the line 10.200.97.201 ntlmauth.za.tryhackme.com...

this is what I had to do as well, but now the printer settings page isn't showing up no matter what combination of IP/host I add to my /etc/hosts file and the network manager instructions haven't worked from the very start of the room

#

so not sure where to go from here

#

probably just gonna try the attackbox

prisma thorn Jun 21, 2023, 12:29 AM

#

undone knoll It's honestly very hard to keep up with new tools and what gets updated

isn't that one of the uses of this server? for people to bring up issues so that they're resolved? it's hard, but if you're going to operate a service it's on the providers to update that service

#

jfc gonna just do HTB's Active Directory room lol

undone knoll Jun 21, 2023, 1:08 AM

#

prisma thorn isn't that one of the uses of this server? for people to bring up issues so that...

I mean, sure, but if room creators had to deal with every single issue and update rooms any time something new came out, they wouldn't have time to make new rooms 🤷 I thought we were supposed to learn the mindset of researching and resolving issues ourselves, and that's certainly what HTB content wants too, but to each their own

prisma thorn Jun 21, 2023, 1:10 AM

#

I resolve issues when I can. I did everything I could, even used the solutions found in here and nothing worked. Went to the attackbox and it's barely working over there as well. Sure, researching is an important skill, but it's also a cop out for anyone who's responsible for creating something and just allows it to deteriorate

"just research bro"

#

I've spent hours on HTB having to research for a solution. I've never had to find my own solutions for a problem that isn't my responsibility

undone knoll Jun 21, 2023, 1:18 AM

#

I did actually have the most issues with Breaching AD for some reason, the rest of the network rooms work fine. This is where I learned the most about active directory so far.

I'm trying to look around, I may have missed it, but if you've shared what you've tried so far, someone here might be able to help. It's just my personal opinion that bashing the platform isn't conducive to anything productive.

prisma thorn Jun 21, 2023, 1:39 AM

#

how is offering a little bit of harsh, yet deserved, criticism bashing? is everyone supposed to only say nice things and ignore the parts of the platform that are subpar? If so then I apologize and I won't say anything mean anymore

olive lichen Jun 22, 2023, 7:54 AM

#

prisma thorn how is offering a little bit of harsh, yet deserved, criticism bashing? is every...

👍

olive lichen Jun 22, 2023, 8:27 AM

#

Sorry, nano /etc/resolv.conf and add on top "nameserver 10.200.32.101" with the THMDC adress in the top ot the diagram. The other nameserver must be below
Kill openvpn and restart it
nslookup ntlmauth.za.tryhackme.com
Server: 10.200.32.101
Address: 10.200.32.101#53

Name: ntlmauth.za.tryhackme.com
Address: 10.200.32.201
You can add on /etc/hosts: 10.200.32.101 za.tryhackme.com

crisp geode Jun 22, 2023, 6:40 PM

#

Please I need help, I have been able to connect to the breachingad VPN network and I have edited the DNS but I get the following error when I run the command. nslookup thmdc.za.tryhackme.com
;; communications error to 10.200.54.101#53: timed out
;; communications error to 10.200.54.101#53: timed out
;; communications error to 10.200.54.101#53: timed out
Server: 8.8.8.8
Address: 8.8.8.8#53

** server can't find thmdc.za.tryhackme.com: NXDOMAIN

olive lichen Jun 22, 2023, 10:50 PM

#

Look at my post

wooden minnow Jun 23, 2023, 7:51 AM

#

crisp geode Please I need help, I have been able to connect to the breachingad VPN network a...

Can you verify and post screenshots

#

!docs verify

outer timberBOT Jun 23, 2023, 7:51 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

prisma thorn Jun 24, 2023, 3:16 AM

#

yes

void trail Jun 25, 2023, 10:35 AM

#

Can someone guide me how to connect to the breaching ad?

wooden minnow Jun 25, 2023, 10:43 AM

#

VM or attackbox?

void trail Jun 25, 2023, 10:55 AM

#

From VM

void trail Jun 25, 2023, 10:55 AM

#

wooden minnow VM or attackbox?

I posted my problem in support chat yesterday at 11:52 PM

wooden minnow Jun 25, 2023, 10:56 AM

#

you migh tneed to nano your VPN file and change dev breachad to dev tun

void trail Jun 25, 2023, 10:57 AM

#

I did, before this change the vpn file did not work

#

And I can ping the THMDC but I can not nslookup on them

void trail Jun 25, 2023, 11:20 AM

#

wooden minnow you migh tneed to nano your VPN file and change `dev breachad` to `dev tun`

Any other solution?

wooden minnow Jun 25, 2023, 11:26 AM

#

void trail Any other solution?

nslookup can be bugged, can you also view the webpage?

wooden minnow Jun 25, 2023, 11:34 AM

#

void trail Any other solution?

Are you on it just now

#

?

#

I edit /etc/resolv.conf and put the THMDC in first.

void trail Jun 25, 2023, 11:40 AM

#

wooden minnow Are you on it just now

No, I will try in a few minutes

void trail Jun 25, 2023, 12:00 PM

#

void trail Jun 25, 2023, 12:01 PM

#

wooden minnow nslookup can be bugged, can you also view the webpage?

I tried also with the ip

wooden minnow Jun 25, 2023, 12:06 PM

#

can you cat /etc/resolv.conf

void trail Jun 25, 2023, 12:09 PM

#

#

I didn't add anything here

void trail Jun 25, 2023, 12:11 PM

#

wooden minnow can you cat /etc/resolv.conf

Can you show me what should I add?

wooden minnow Jun 25, 2023, 12:15 PM

#

Whatever ip you have here

#

Place it at the top

void trail Jun 25, 2023, 12:19 PM

#

wooden minnow Whatever ip you have here

nslookup is working now, but I am still not able to access from the browser. Is that ok?

wooden minnow Jun 25, 2023, 12:26 PM

#

the URL?

wooden minnow Jun 25, 2023, 12:26 PM

#

void trail nslookup is working now, but I am still not able to access from the browser. Is ...

you don't access that IP from the browser.

#

THMDC is the Domain Controller

wooden minnow Jun 25, 2023, 12:27 PM

#

void trail nslookup is working now, but I am still not able to access from the browser. Is ...

http://ntlmauth.za.tryhackme.com/

Can you access this link?

void trail Jun 25, 2023, 12:31 PM

#

wooden minnow http://ntlmauth.za.tryhackme.com/ Can you access this link?

No, is not working

wooden minnow Jun 25, 2023, 12:32 PM

#

void trail No, is not working

That's fine, that's all you need to access, you'll interact with the DC when you use the python script to bruteofrce the password.

#

Just work thorugh the materials and tasks and you'll be done.

void trail Jun 25, 2023, 12:32 PM

#

Ok thank you! blobheart

#

And what happens when the number of days of access are left?

wooden minnow Jun 25, 2023, 12:34 PM

#

You'll be kicked out, if this happens and you're not done you just re-join.

#

You have x days so that in active users can be kicked, as the network rooms run 24/7 and it would be wasted resources.

void trail Jun 25, 2023, 12:35 PM

#

I understand

void trail Jun 25, 2023, 3:33 PM

#

wooden minnow That's fine, that's all you need to access, you'll interact with the DC when you...

Sorry, but how am I supposed to do the tasks if I can not visit this login panel from the URL provided?😅

wooden minnow Jun 25, 2023, 3:34 PM

#

void trail Sorry, but how am I supposed to do the tasks if I can not visit this login panel...

I thought you said the website worked?

void trail Jun 25, 2023, 3:34 PM

#

void trail No, is not working

I said here that is not working

wooden minnow Jun 25, 2023, 3:35 PM

#

oops!

void trail Jun 25, 2023, 3:35 PM

#

😂 no problem

void trail Jun 25, 2023, 3:39 PM

#

wooden minnow oops!

But do you have a solution for this?

wooden minnow Jun 25, 2023, 3:39 PM

#

Right no, I'm in the middle of setting up a new VM.

void trail Jun 25, 2023, 3:40 PM

#

Who should I contact for a little help? I posted on site-support and nobody answer😢

wooden minnow Jun 25, 2023, 3:46 PM

#

They would just direct you here.

void trail Jun 25, 2023, 4:05 PM

#

I tried also from the Attack Box and is worse, the THMDC is not reachable and the systemd-resolve command is not working...

wooden minnow Jun 26, 2023, 12:54 PM

#

@long mural

What issue are you having?

long mural Jun 26, 2023, 12:55 PM

#

done the changes in openvpn file from dev brachad to dev tun
vpn file connect, after that i add the nameserver of domain
but still not working i try to do via nslookup

wooden minnow Jun 26, 2023, 12:56 PM

#

Can you verify your account please.

#

!docs verify

outer timberBOT Jun 26, 2023, 12:56 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

long mural Jun 26, 2023, 12:58 PM

#

sure let do it first

#

done

wooden minnow Jun 26, 2023, 1:00 PM

#

Now, can you send me a screenshot of

cat /etc/conf.resolv

long mural Jun 26, 2023, 1:01 PM

#

sure

#

wooden minnow Jun 26, 2023, 1:03 PM

#

Can you try nslook up in sudo?

long mural Jun 26, 2023, 1:03 PM

#

nslookup <domain name here>?

wooden minnow Jun 26, 2023, 1:04 PM

#

yeah, but chuck sudo in front

long mural Jun 26, 2023, 1:04 PM

#

i think its working fine right?

wooden minnow Jun 26, 2023, 1:05 PM

#

It's still using 192...

#

Oh!

#

Look at your syntax.

#

namserver 10.200.92.101

#

You've missed out an e.

long mural Jun 26, 2023, 1:06 PM

#

sure let me change it quickly

#

Now is it working fine?

wooden minnow Jun 26, 2023, 1:07 PM

#

That's progress.

#

Is your network running?

long mural Jun 26, 2023, 1:08 PM

#

let me check first

#

#

yes runing

#

running

#

Now it did show any progress error

wooden minnow Jun 26, 2023, 1:10 PM

#

That worked. 😄

long mural Jun 26, 2023, 1:11 PM

#

thankyou so much for your valuable time

wooden minnow Jun 26, 2023, 1:11 PM

#

Can you access <http://ntlmauth.za.tryhackme.com/> ?

long mural Jun 26, 2023, 1:11 PM

#

sure let me check

#

can we become good friends? kekw

wooden minnow Jun 26, 2023, 1:15 PM

#

kekw

I'll accept your friend request.

(I question DM's because people have asked me about unethical black hat stuff. OR because I'm im a room tester they mistake me for THM staff)

wooden minnow Jun 26, 2023, 1:17 PM

#

long mural can we become good friends?<:kekw:658061932577816606>

Happy hacking, and enjoy the network rooms.

long mural Jun 26, 2023, 1:18 PM

#

wooden minnow <:kekw:658061932577816606> I'll accept your friend request. (I question DM's b...

Understood bro!

long mural Jun 26, 2023, 1:18 PM

#

wooden minnow Happy hacking, and enjoy the network rooms.

thankyou

void trail Jun 26, 2023, 8:08 PM

#

wooden minnow Can you access <`http://ntlmauth.za.tryhackme.com/`> ?

I don't understand for me is still not working...😢 I am connected to the openvpn file, I added the ip address in the /etc/resolv.conf, the nslookup is working but I still can not access the web page

#

What I see different is that I can not access /etc/resolv.conf without sudo and is a symlink, is looking like this:

#

void trail Jun 26, 2023, 8:10 PM

#

long mural can we become good friends?<:kekw:658061932577816606>

Did you do something different than me?

wooden minnow Jun 26, 2023, 8:14 PM

#

You need sudo to edit it.

void trail Jun 26, 2023, 8:18 PM

#

wooden minnow You need sudo to edit it.

I edited I sent here the photo

wooden minnow Jun 26, 2023, 8:19 PM

#

void trail I edited I sent here the photo

Try putting it on line 12

void trail Jun 26, 2023, 8:21 PM

#

wooden minnow Try putting it on line 12

Still not working :/

indigo garden Jun 30, 2023, 3:29 AM

#

No matter what I do for task 7, when I try to scp the ma.db file I get a "./ma.db: Broken pipe" error.

half jetty Jun 30, 2023, 7:52 AM

#

Hi guys,

If anyone have problem using burp suite with NTLM authentication, I'll share a solution

Setup NTLM auth credentials
Enable use of HTTP/1.1

#

void trail Jun 30, 2023, 3:33 PM

#

long mural sure let me check

Can you please explain me what steps did you follow to make the connection? I can't find the solution and the support is answering very hard

half jetty Jun 30, 2023, 5:40 PM

#

This room is so struggling

#

Wasted a lot of time fixing weird issues

zenith sparrow Jul 2, 2023, 3:32 PM

#

hey guys, I can't setup my Kali host for this room, I tried editing my IPV4 settings in the gui, also tried /etc/resolv.conf and it's not working

wooden minnow Jul 2, 2023, 3:42 PM

#

zenith sparrow hey guys, I can't setup my Kali host for this room, I tried editing my IPV4 sett...

The GUI is not a good idea.

#

Can you show a screenshot?

zenith sparrow Jul 2, 2023, 3:52 PM

#

wooden minnow Can you show a screenshot?

of my resolv.conf ?

#

# Generated by NetworkManager
search za.tryhackme.com
nameserver 10.200.xx.101
nameserver 192.168.1.1
nameserver MYPERSONALIPV6

wooden minnow Jul 2, 2023, 4:03 PM

#

Yes

zenith sparrow Jul 2, 2023, 4:09 PM

#

maybe it is because my network is ipv6?

zenith sparrow Jul 2, 2023, 4:23 PM

#

void trail I don't understand for me is still not working...😢 I am connected to the openv...

I have the exact same problem

void trail Jul 2, 2023, 5:46 PM

#

zenith sparrow I have the exact same problem

I openned a ticket a few days ago, still not getting an answer…

void trail Jul 2, 2023, 5:49 PM

#

void trail I openned a ticket a few days ago, still not getting an answer…

To be exactlly, monday, almost a week

wooden minnow Jul 2, 2023, 6:00 PM

#

zenith sparrow ``` # Generated by NetworkManager search za.tryhackme.com nameserver 10.200.xx.1...

Which subnet are you in?

zenith sparrow Jul 2, 2023, 7:52 PM

#

wooden minnow Which subnet are you in?

was .25

#

10.200.24.101

zenith sparrow Jul 3, 2023, 10:40 PM

#

@void trail did it finally work for you?

#

mine's still not working

void trail Jul 3, 2023, 10:45 PM

#

zenith sparrow <@389824498813370368> did it finally work for you?

No, I am just waiting for the answer of my ticket

#

The problem is that the Attack Box is also not working for me :))

zenith sparrow Jul 3, 2023, 10:46 PM

#

oh you paid for it and it's not working?

#

I got the room for free with the 7-days streak

#

do other AD rooms like enumerate AD work for you? Or is it the same problem?

restive furnace Jul 4, 2023, 6:54 AM

#

does any one have issue regading breaching-ad machine

wooden minnow Jul 4, 2023, 8:39 AM

#

restive furnace does any one have issue regading breaching-ad machine

What issue do you have?

#

Connecting:

If you're having an issue connecting to the room via OpenVPN.

Download your VPN.
Connect to it as normal (probably best you turn off the normal or VIP THM VPN)
When connected use the command sudo nano /etc/resolv.conf, your conf should look at the attached screenshot, the ip will come from 10.200.xxx.101, the x's will be your subnet, this can be obtained from the THMDC.
place the nameserver at the top, above all others, only then nslookup will work.

Attackbox

Steps are the exact same, Open the Attackbox inside the BreachAd room

#

Troubleshooting:

If the communication cut out, just after you've started the server, wait 5-10 min(s)
Website not working? Double check your using HTTP, the website won't work if you're trying to do HTTPS, if Firefox is making https the default, turn it off.

restive furnace Jul 4, 2023, 9:00 AM

#

wooden minnow # Connecting: If you're having an issue connecting to the room via OpenVPN. 1)...

i am able to connect using open v[n sucessfully but unable to access any site of the AD

wooden minnow Jul 4, 2023, 9:01 AM

#

restive furnace i am able to connect using open v[n sucessfully but unable to access any site of...

Did Firefox resort to https?

restive furnace Jul 4, 2023, 9:02 AM

#

wooden minnow Did Firefox resort to https?

plz wait i will attached the Screenshot shortly

wooden minnow Jul 4, 2023, 9:04 AM

#

Attackbox screenshot

restive furnace Jul 4, 2023, 9:08 AM

#

wooden minnow # Attackbox screenshot

I am not able to send attachment here but here is the error message
;; connection timed out; no servers could be reached

restive furnace Jul 4, 2023, 9:08 AM

#

restive furnace I am not able to send attachment here but here is the error message ;; connecti...

before executing the nslook command i have follewd the instruction:

wooden minnow Jul 4, 2023, 9:09 AM

#

restive furnace I am not able to send attachment here but here is the error message ;; connecti...

!docs verify

outer timberBOT Jul 4, 2023, 9:09 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

wooden minnow Jul 4, 2023, 9:09 AM

#

Can you verify your account?

restive furnace Jul 4, 2023, 9:14 AM

#

wooden minnow Can you verify your account?

yes

wooden minnow Jul 4, 2023, 9:14 AM

#

restive furnace yes

Can you edit the resolv.conf file?

restive furnace Jul 4, 2023, 9:15 AM

#

wooden minnow Can you edit the `resolv.conf` file?

yes can you provide me configuration?

wooden minnow Jul 4, 2023, 9:15 AM

#

restive furnace yes can you provide me configuration?

Look at the screenshot above.

wooden minnow Jul 4, 2023, 9:16 AM

#

restive furnace yes can you provide me configuration?

in your case it will be

nameserver 10.200.20.101

restive furnace Jul 4, 2023, 9:17 AM

#

wooden minnow in your case it will be `nameserver 10.200.20.101`

oaky the second nameserver will be same?

wooden minnow Jul 4, 2023, 9:17 AM

#

restive furnace oaky the second nameserver will be same?

That's the IP from your screenshot, I'm assuming from your THMDC.

restive furnace Jul 4, 2023, 9:18 AM

#

wooden minnow That's the IP from your screenshot, I'm assuming from your THMDC.

wooden minnow Jul 4, 2023, 9:18 AM

#

restive furnace

Put it above the searchdomain

restive furnace Jul 4, 2023, 9:20 AM

#

wooden minnow Put it above the searchdomain

wooden minnow Jul 4, 2023, 9:21 AM

#

restive furnace

does nslookup work now?

restive furnace Jul 4, 2023, 9:21 AM

#

wooden minnow does nslookup work now?

no here is the result

wooden minnow Jul 4, 2023, 9:22 AM

#

restive furnace no here is the result

Ok.

Nano it and put it above the search localdomain

#

nameserver 10.200.20.101
search localdomain
etc```

restive furnace Jul 4, 2023, 9:25 AM

#

here is the changes config and result.

wooden minnow Jul 4, 2023, 9:26 AM

#

restive furnace here is the changes config and result.

I'd suggest now leaving the room, using the cog at the top right, and re-enter the room in a few min(s)

restive furnace Jul 4, 2023, 9:28 AM

#

wooden minnow I'd suggest now leaving the room, using the cog at the top right, and re-enter t...

i have already tried it but it is not working.

void trail Jul 4, 2023, 9:28 AM

#

zenith sparrow do other AD rooms like enumerate AD work for you? Or is it the same problem?

I did not try others because I want to do them in order

wooden minnow Jul 4, 2023, 9:28 AM

#

restive furnace i have already tried it but it is not working.

Did it place you in a new subnet?

restive furnace Jul 4, 2023, 9:29 AM

#

no sir it had place me in same subnet.

wooden minnow Jul 4, 2023, 9:29 AM

#

restive furnace no sir it had place me in same subnet.

You used this part, yes?

restive furnace Jul 4, 2023, 9:30 AM

#

wooden minnow You used this part, yes?

I had leave the room as you shows in the screenshot.

wooden minnow Jul 4, 2023, 9:31 AM

#

restive furnace I had leave the room as you shows in the screenshot.

Wait 5 min(s)

restive furnace Jul 4, 2023, 9:31 AM

#

wooden minnow Wait 5 min(s)

okay sir

void trail Jul 4, 2023, 9:32 AM

#

You can nslookup but you can not acces the web server, right?

wooden minnow Jul 4, 2023, 9:32 AM

#

They can't nslookup.

wooden minnow Jul 4, 2023, 9:32 AM

#

void trail You can nslookup but you can not acces the web server, right?

Which webserver are you trying to connect to?

void trail Jul 4, 2023, 9:33 AM

#

wooden minnow Which webserver are you trying to connect to?

Right now I am not trying, but I have the same issue for weeks, we already talked about this problem in this thread😄

#

Is about the first login pannel

wooden minnow Jul 4, 2023, 9:34 AM

#

void trail Right now I am not trying, but I have the same issue for weeks, we already talke...

This one?

void trail Jul 4, 2023, 9:35 AM

#

wooden minnow http://ntlmauth.za.tryhackme.com/ Can you access this link?

This one

wooden minnow Jul 4, 2023, 9:36 AM

#

You never seen this?

void trail Jul 4, 2023, 9:39 AM

#

No, and is not working also from the Attack Box

restive furnace Jul 4, 2023, 10:02 AM

#

wooden minnow Wait 5 min(s)

Thanks now its working.

slate swanBOT Jul 4, 2023, 10:02 AM

#

Gave +1 Rep to @wooden minnow

void trail Jul 4, 2023, 10:15 AM

#

wooden minnow You never seen this?

I will give it another try tonight, can I tag you to take a look?😁

wooden minnow Jul 4, 2023, 10:18 AM

#

void trail I will give it another try tonight, can I tag you to take a look?😁

I'm in the UK, and I won't be around between 6PM and 8Pm, but sure.6

zenith sparrow Jul 4, 2023, 10:54 AM

#

restive furnace does any one have issue regading breaching-ad machine

I do

wooden minnow Jul 4, 2023, 10:55 AM

#

zenith sparrow I do

https://discordapp.com/channels/521382216299839518/983792015382810634/1125710954995396739

zenith sparrow Jul 4, 2023, 10:56 AM

#

wooden minnow Did it place you in a new subnet?

I'm in another subnet and getting the exact same problem

wooden minnow Jul 4, 2023, 10:57 AM

#

zenith sparrow I'm in another subnet and getting the exact same problem

Same steps?

zenith sparrow Jul 4, 2023, 10:58 AM

#

Yes but I'll try to change the search line because I don't have exactly the same one

wooden minnow Jul 4, 2023, 10:58 AM

#

Can you show a screenshot of what you do have?

zenith sparrow Jul 4, 2023, 11:02 AM

#

# Generated by NetworkManager
search localdomain
nameserver 10.200.25.101
nameserver 192.168.0.10
nameserver fd0f:ee:b0::1

#

I can nslookup but can't access http://ntlmauth.za.tryhackme.com/

#

oh actually it's working with firefox

#

not with Chrome

wooden minnow Jul 4, 2023, 11:05 AM

#

🙂 There we go.

void trail Jul 4, 2023, 11:58 AM

#

Now I have a hope for me also😂

wooden minnow Jul 4, 2023, 1:48 PM

#

There's been a few people not being able to connect to the breached room, @somber ledge

Are you able to pin this?

#breaching-ad message

somber ledge Jul 4, 2023, 1:50 PM

#

wooden minnow # Connecting: If you're having an issue connecting to the room via OpenVPN. 1)...

void trail Jul 4, 2023, 2:05 PM

#

@wooden minnow I am not sure if I have /etc/resolve.conf. I see your screenshots, on the first line I must have "Generated by NetworkManager". I don't have this.

#

#

I have this file instead

wooden minnow Jul 4, 2023, 2:06 PM

#

void trail <@958383130102870026> I am not sure if I have /etc/resolve.conf. I see your scre...

I made a spelling error then corrected it.

void trail Jul 4, 2023, 2:06 PM

#

#

Is that ok?

wooden minnow Jul 4, 2023, 2:06 PM

#

Yeah

void trail Jul 4, 2023, 2:07 PM

#

And what should I do now? Is the same problem, I can nslookup, but I can't reach the page

wooden minnow Jul 4, 2023, 2:07 PM

#

Can you show a screenshot of the page.

void trail Jul 4, 2023, 2:07 PM

#

#

This should be added in /etc/hosts?

wooden minnow Jul 4, 2023, 2:08 PM

#

No, it doesn't need to be

wooden minnow Jul 4, 2023, 2:08 PM

#

void trail

Can you double check it's http and not https

void trail Jul 4, 2023, 2:08 PM

#

Yes, is http

#

I tried with Chronium also

wooden minnow Jul 4, 2023, 2:09 PM

#

void trail Yes, is http

Can you leave the room for 5 mins and rejoin the room?

void trail Jul 4, 2023, 2:09 PM

#

Ok

#

Join and wait 5 minutes, or wait 5 minutes and join?

wooden minnow Jul 4, 2023, 2:11 PM

#

Wait 5 mins then join

void trail Jul 4, 2023, 2:19 PM

#

wooden minnow Wait 5 mins then join

Is still not working

wooden minnow Jul 4, 2023, 2:19 PM

#

void trail Is still not working

Did you change resolv?

void trail Jul 4, 2023, 2:19 PM

#

No, the ip is the same

#

The network did not restart

wooden minnow Jul 4, 2023, 2:19 PM

#

Use the cog and leave again, lol

void trail Jul 4, 2023, 2:20 PM

#

What is cog?

wooden minnow Jul 4, 2023, 2:21 PM

#

You'll find it top right

void trail Jul 4, 2023, 2:22 PM

#

I already did that...

wooden minnow Jul 4, 2023, 2:24 PM

#

If you wait slightly longe,r it could put you in a new subnet.

void trail Jul 4, 2023, 2:25 PM

#

#

I also added the ntlmauth in resolv.conf, is that ok?

#

I mean, in the instructions they mentioned that you need to nslookup on THMDC and then you can access ntlmauth

wooden minnow Jul 4, 2023, 2:55 PM

#

Is it working now?

void trail Jul 4, 2023, 3:05 PM

#

wooden minnow Is it working now?

I am in other network now, but the nslookup is not working :))

#

Oh wait, the network was stopped, let me check

void trail Jul 4, 2023, 3:20 PM

#

wooden minnow Is it working now?

Still not working...

wooden minnow Jul 4, 2023, 4:25 PM

#

void trail Still not working...

Can you click in the address bar?

void trail Jul 4, 2023, 4:28 PM

#

wooden minnow Can you click in the address bar?

What do you mean?

wooden minnow Jul 4, 2023, 4:32 PM

#

void trail What do you mean?

This part.

#

void trail Jul 4, 2023, 4:36 PM

#

Is http if this is why are you asking

wooden minnow Jul 4, 2023, 4:37 PM

#

Just double checking, Firefox can be annoying and stick in https

#

Can you try a different browser?

void trail Jul 4, 2023, 4:38 PM

#

#

This is Chronium, still not working

#

I appreciate your help, but I think the source of the problem is not this one

wooden minnow Jul 4, 2023, 4:39 PM

#

Is that the website?

#

http://printer.za.tryhackme.com/settings

#

Try that one

void trail Jul 4, 2023, 4:40 PM

#

Nope, didnt work

#

We can try with Attack Box if you want

ashen dock Jul 7, 2023, 5:17 AM

#

I am not able to intercept NetNTLM challange using responder. I try more than 3 times and wait for more than 30 mins. Can someone Please help me

wooden minnow Jul 7, 2023, 8:34 AM

#

ashen dock I am not able to intercept NetNTLM challange using responder. I try more than 3 ...

Can you show a screenshot?

safe hound Jul 7, 2023, 11:41 AM

#

http://printer.za.tryhackme.com/settings.aspx is responding to "Why is there no browser" even though I've done everything and the network is working?

#

guys ?

neon osprey Jul 10, 2023, 4:14 PM

#

wooden minnow Can you show a screenshot?

#

Everything is running. Network responds to pings. Responder NO LONGER WORKS. In my opinion, someone needs to go in and test and likely re-write the scheduled task.

#

I have tried it both on the attack box and my kali an left it running for more than 45 minutes...nothing. Also this is the second day I have tried to accomplish this.

#

#

#

@wooden minnow please let me know your ideas regarding responder. Thanks in advance.

slate swanBOT Jul 10, 2023, 4:22 PM

#

Gave +1 Rep to @wooden minnow

wooden minnow Jul 10, 2023, 5:43 PM

#

neon osprey Everything is running. Network responds to pings. Responder NO LONGER WORKS. In ...

Responder worked for me...

#

How long did you wait?

neon osprey Jul 10, 2023, 5:44 PM

#

45 minutes on 3 different occasions...

#

That's great that it worked for you. I wonder what the difference is...

wooden minnow Jul 10, 2023, 5:45 PM

#

#

Are you doing it now?

neon osprey Jul 10, 2023, 5:47 PM

#

I moved on to EnumeratingAD

#

hmm... I'll try it again tomorrow morning. All I can think of is that I had two services that did not start on port 80 and 53, that is not pictured in you screen print...but I don't see how that would matter. Did you use the attackbox?

#

I already made sure my responder was up to date...yeah I'm at a loss.

wooden minnow Jul 10, 2023, 5:50 PM

#

No, I used my VM.

neon osprey Jul 10, 2023, 5:51 PM

#

Are you remoting in with the vpn package or are you already in the internal network?

#

I guess my fear is that my responder is not working...I've successfully used it quite a few times. I am even repeating this exercise in preparation for OSCP. Last time I had no trouble.

#

I'll have to test responder on another exercise, I guess.

#

Also, thanks for checking it out for me.

wooden minnow Jul 10, 2023, 5:57 PM

#

neon osprey Are you remoting in with the vpn package or are you already in the internal netw...

VPN.

neon osprey Jul 10, 2023, 5:58 PM

#

Okay, well all the boxes are checked. That's all I can think of. Thanks again. If I find the difference and get it to work for me, I'll report back

finite thicket Jul 10, 2023, 6:07 PM

#

didnt realise this was a channel

finite thicket Jul 10, 2023, 6:22 PM

#

ok I think it wasnt workign cos I didnt change my IP address in the $THMIP section lmao

wooden minnow Jul 10, 2023, 6:23 PM

#

That will do it.

#

😄

#

If in doubt, check the pins.

neon osprey Jul 10, 2023, 7:12 PM

#

I started this all over again in the AttackBox. I'm going to walk the dog and come back. Fingers crossed.

neon osprey Jul 10, 2023, 7:48 PM

#

Nothing. Knowing when to move on will be my biggest challenge with the OSCP. So, moving on...

chrome iron Jul 11, 2023, 10:23 PM

#

Whenever I try to download the OVPN config to connect to the Breachingad network it throws a 404. Also, when I launch an AttackBox I can't ping the THMDC IP as documented. Am I missing some part of the process?

wooden minnow Jul 12, 2023, 7:44 AM

#

chrome iron Whenever I try to download the OVPN config to connect to the Breachingad network...

Leave the room for 5 mins

Small cog at the top right.

chrome iron Jul 12, 2023, 9:28 PM

#

wooden minnow Leave the room for 5 mins Small cog at the top right.

Ah, this worked. Thank you!

slate swanBOT Jul 12, 2023, 9:28 PM

#

Gave +1 Rep to @wooden minnow

next sand Jul 12, 2023, 10:11 PM

#

I am having the same issues with never getting anything with Responder. I have tried both with my own VM and with AttackBox. Waiting over an hour yields nothing.

grizzled glacier Jul 13, 2023, 1:41 AM

#

you could try deleting the responder.db file and retry

ashen dock Jul 13, 2023, 4:38 AM

#

I'M not able to connect to Breaching AD I am coonected to Ovpn and set the DNS server of THMDC also

#

See

grizzled glacier Jul 13, 2023, 4:51 AM

#

I had to comment out my 192.168 address in my resolv.conf file or else I got recursion errors.

wooden minnow Jul 13, 2023, 10:31 AM

#

ashen dock See

Check the pinned posts.

next sand Jul 13, 2023, 12:20 PM

#

grizzled glacier you could try deleting the responder.db file and retry

This worked. Thank you!

slate swanBOT Jul 13, 2023, 12:20 PM

#

Gave +1 Rep to @grizzled glacier

mystic berry Jul 13, 2023, 10:26 PM

#

Hello I have problem to connect by breachindag.opvn from my kali machine...

wooden minnow Jul 14, 2023, 7:21 AM

#

mystic berry Hello I have problem to connect by breachindag.opvn from my kali machine...

Check the pinned posts. 🙂

mystic berry Jul 14, 2023, 9:08 AM

#

wooden minnow Check the pinned posts. 🙂

The problem is with the file...

wooden minnow Jul 14, 2023, 9:11 AM

#

Which file?

mystic berry Jul 14, 2023, 9:12 AM

#

.opvn from THM

mystic berry Jul 14, 2023, 9:22 AM

#

wooden minnow Check the pinned posts. 🙂

This pinned post doesn't fix the file... file is broker whilemis generete from THM. Everyday others opvn files working fine. Only this one doesn't!

wooden minnow Jul 14, 2023, 9:22 AM

#

mystic berry This pinned post doesn't fix the file... file is broker whilemis generete from T...

Tey regen it then.

Or how is It broken?

mystic berry Jul 14, 2023, 9:23 AM

#

wooden minnow Tey regen it then. Or how is It broken?

I done that mamy times... its not want to connect - showing error

wooden minnow Jul 14, 2023, 9:23 AM

#

mystic berry I done that mamy times... its not want to connect - showing error

Can you copy and paste the error?

#

Or verify and submit a screenshot?

#

!docs verify

outer timberBOT Jul 14, 2023, 9:24 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

mystic berry Jul 14, 2023, 9:34 AM

#

wooden minnow Can you copy and paste the error?

I can't attached here any printscreen

mystic berry Jul 14, 2023, 9:42 AM

#

wooden minnow Can you copy and paste the error?

https://cdn.discordapp.com/attachments/1059323021057327160/1129182469833371709/image.png

mystic berry Jul 14, 2023, 9:42 AM

#

wooden minnow Can you copy and paste the error?

https://cdn.discordapp.com/attachments/1059323021057327160/1129183400582991943/image.png

wooden minnow Jul 14, 2023, 10:31 AM

#

mystic berry https://cdn.discordapp.com/attachments/1059323021057327160/1129182469833371709/i...

Nano your file, and change the 'dev breachadtodev tun`

mystic berry Jul 14, 2023, 10:32 AM

#

wooden minnow Nano your file, and change the 'dev breachad` to `dev tun`

I fixed it by myself - edit numbers - breachingad to breachingad solve problem after regenerate file...

#

ruby palm Jul 15, 2023, 7:25 PM

#

hello there

#

someone experience or know why the nslookup wont work but Ping works when i try to ping the domain IP

trim mica Jul 15, 2023, 7:26 PM

#

#breaching-ad message

ruby palm Jul 15, 2023, 7:26 PM

#

when i ping the IP it gives a response, but nslookup says not found

trim mica Jul 15, 2023, 7:26 PM

#

also known as pinned messages in here

ruby palm Jul 15, 2023, 7:27 PM

#

thx man

#

i have a look

#

sorry for disturbance

#

just bounced my head all night and day

trim mica Jul 15, 2023, 7:27 PM

#

no problem and good luck

ruby palm Jul 15, 2023, 7:27 PM

#

for this thing...

trim mica Jul 15, 2023, 7:27 PM

#

worst case that subnet needs a reset

ruby palm Jul 15, 2023, 7:28 PM

#

i have a look, if you dont hear from me again, it could be my moms spinache or i fixed it with your and the others help!

#

i hope it will be the 2cond

#

wtf bruh.. it works ?

#

i feel like i created frankenstein

final fjord Jul 16, 2023, 4:53 PM

#

Hi All, do i need to update the configuration of the attack box to be able to connect to this website http://ntlmauth.za.tryhackme.com/. I just start the network and attack box but I am not able to get any information about this URL. Do I need to update any file or DNS related records, if yes, could you please share the steps with me?

wooden minnow Jul 16, 2023, 5:22 PM

#

final fjord Hi All, do i need to update the configuration of the attack box to be able to co...

*Check pins

ruby palm Jul 16, 2023, 7:54 PM

#

someon experience with the ldap pass attacking task, where is gives the message "invalid credentials" the moment you have set up the slapd rogue access point

#

LDAP Connection failed: The supplied credential is invalid.

#

this is the exact respond i get

tough barn Jul 22, 2023, 6:53 PM

#

Ive been looking for hours now so I guess I’ll break down and ask. So I installed slapd ldap-utils and sudo depkg-reconfigure and all of that. Made the olcSaslSecProps.ldif file and when I run ldapmodify command , I keep getting no mechanisms available , security flags do not match required, error. Sometimes it works but then I don’t get any mechanisms showing after ldap search. Just a dn: with a lot of emptiness . Anyone got a fix .

wooden minnow Jul 23, 2023, 8:06 AM

#

tough barn Ive been looking for hours now so I guess I’ll break down and ask. So I installe...

Did you follow along with the installation of the room?

tough barn Jul 23, 2023, 2:24 PM

#

wooden minnow Did you follow along with the installation of the room?

Yes . All the way .

tough barn Jul 23, 2023, 3:30 PM

#

I figured out the problem.

wooden minnow Jul 23, 2023, 3:34 PM

#

What was it?

obtuse oriole Jul 25, 2023, 12:56 PM

#

Hello! Several days I can't configure the DNS on this room: is it normal that I can't ping THMDC?

#

PING 10.200.24.201 (10.200.24.201) 56(84) bytes of data.
From 10.50.22.1 icmp_seq=1 Destination Host Unreachable
From 10.50.22.1 icmp_seq=2 Destination Host Unreachable
From 10.50.22.1 icmp_seq=3 Destination Host Unreachable

#

I already checked the pinned content

wooden minnow Jul 25, 2023, 1:09 PM

#

obtuse oriole Hello! Several days I can't configure the DNS on this room: is it normal that I ...

Check the pins.

obtuse oriole Jul 25, 2023, 1:17 PM

#

Already checked 2 times, reset 3 times.

obtuse oriole Jul 25, 2023, 1:43 PM

#

Already tried the brick thing, I'll retry again

obtuse oriole Jul 25, 2023, 3:57 PM

#

Do you confirm that even if the DNS setup is not set, we should be able to ping the IP of THMDC? I have the same problem on the Attackbox while applying the steps

wooden minnow Jul 25, 2023, 3:58 PM

#

obtuse oriole Do you confirm that even if the DNS setup is not set, we should be able to ping ...

Yes, because it's up?

obtuse oriole Jul 25, 2023, 3:59 PM

#

wooden minnow Yes, because it's up?

The destination is unreachable even in the Attackbox

#

I waited the end of the network timer and redid Start

wooden minnow Jul 25, 2023, 4:06 PM

#

Try leaving the room, and waiting for a peroid and re-joining.

obtuse oriole Jul 25, 2023, 4:08 PM

#

wooden minnow Try leaving the room, and waiting for a peroid and re-joining.

OK I leave the room, I'll come back in a few days. Thanks for the help

slate swanBOT Jul 25, 2023, 4:08 PM

#

Gave +1 Rep to @wooden minnow

dense cedar Jul 26, 2023, 7:19 PM

#

The patch for this issue is in a pull request today. So hopefully soon this is a problem of the past

obtuse oriole Jul 28, 2023, 9:15 PM

#

dense cedar The patch for this issue is in a pull request today. So hopefully soon this is a...

Hello, I just tried today and it seems to work like a charm. Thanks for the update

slate swanBOT Jul 28, 2023, 9:15 PM

#

Gave +1 Rep to @dense cedar

obtuse oriole Jul 29, 2023, 8:50 AM

#

Hello! On the responder task, I waited 1h and no hash captured. I retried after deleting responder.db, but it's 20 mn I'm waiting and no hash captured. The command used is sudo responder -I tun0 , the interface matches with the one displayed by ip addr, and the VPN is activated for both tun0 and breachad

#

Am I doing something wrong? Is the scheduled task online?

quasi dome Jul 29, 2023, 8:55 AM

#

obtuse oriole Hello! On the responder task, I waited 1h and no hash captured. I retried after ...

You should get a capture in less than 20 minutes from what i remember, are you using a local VM?

obtuse oriole Jul 29, 2023, 8:57 AM

#

quasi dome You should get a capture in less than 20 minutes from what i remember, are you u...

I'm using a local VM Kali on my Windows computer

quasi dome Jul 29, 2023, 9:02 AM

#

obtuse oriole Hello! On the responder task, I waited 1h and no hash captured. I retried after ...

and the VPN is activated for both tun0 and breachad, Do you actually have two openvpn connections?? (daraxxo.ovpn , breachad.ovpn) If so, you should only be using the breachad.

obtuse oriole Jul 29, 2023, 9:06 AM

#

quasi dome `and the VPN is activated for both tun0 and breachad`, Do you actually have two ...

If I remove the daraxxo.ovpn I don't have tun0 in the interfaces listed by ip addr

obtuse oriole Jul 29, 2023, 9:34 AM

#

I killed the 2 openvpn connections and only used the breachad one. ip addr lists the interface breachad but not tun0

#

Shouldn't I use the breachad interface instead of tun0?

#

For responder I mean

#

I'm testing it

obtuse oriole Jul 29, 2023, 9:57 AM

#

Nothing in 22 minutes

#

Haha the network was stopped! Restarting it. I'm confident it will work (if the scheduled task is here)

obtuse oriole Jul 29, 2023, 10:31 AM

#

It worked 🙂

#

Thanks @quasi dome for the tips

slate swanBOT Jul 29, 2023, 10:34 AM

#

Gave +1 Rep to @quasi dome

thick crest Jul 30, 2023, 7:18 AM

#

hi, when trying to join the room it redirects from https://tryhackme.com/room/breachingad to https://tryhackme.com/r/rooms

undone knoll Jul 30, 2023, 9:05 AM

#

thick crest hi, when trying to join the room it redirects from https://tryhackme.com/room/br...

Do you have a 7-day streak?

thick crest Jul 30, 2023, 12:50 PM

#

undone knoll Do you have a 7-day streak?

no, should I?

wooden minnow Jul 30, 2023, 12:51 PM

#

Yes.

undone knoll Jul 30, 2023, 12:51 PM

#

Yes, it's a prerequisite for the room if you're not a paying subscriber

thick crest Jul 30, 2023, 12:52 PM

#

ok

#

I'll make it these days 🙂

coral bay Jul 31, 2023, 4:31 PM

#

Hey can anyone tell me the steps to connect

#

To the network

wooden minnow Jul 31, 2023, 4:32 PM

#

coral bay Hey can anyone tell me the steps to connect

Check the pinned posts, I wrote out a post with screenshots.

coral bay Jul 31, 2023, 4:32 PM

#

I tried, but i don't know where m missing

#

Thanks bro , m checking em..

west pine Aug 3, 2023, 6:39 PM

#

Hey doing lie, the pin command but

#

#

#

#

Its not working

#

Any idea ?

#

Got this problem since few days ago ...

wooden minnow Aug 3, 2023, 7:49 PM

#

west pine Hey doing lie, the pin command but

I see what you've done.

wooden minnow Aug 3, 2023, 7:49 PM

#

west pine Hey doing lie, the pin command but

You've edited the wrong file.

#

it's resolv.conf not resolve

west pine Aug 3, 2023, 7:50 PM

#

I mean...

#

x)))

#

in your pin comment ^^

wooden minnow Aug 3, 2023, 7:51 PM

#

west pine in your pin comment ^^

My bad!

west pine Aug 3, 2023, 7:51 PM

#

wooden minnow My bad!

Your fine x)

#

You already helped a lot

#

maybe just edit it as nobody else get in thr trap 😉

wooden minnow Aug 3, 2023, 7:52 PM

#

Already fixed 😉

west pine Aug 3, 2023, 7:52 PM

#

wooden minnow Already fixed 😉

^^

#

Ill take a look if it will work like this

west pine Aug 4, 2023, 6:41 AM

#

Working fine !!

lone osprey Aug 5, 2023, 3:15 AM

#

I am currently unable to access the http://pxeboot.za.tryhackme.com website, as it displays a "server not found" error. Additionally, I'm unable to establish an SSH session using "ssh thm@THMJMP1.za.tryhackme.com" while using Microsoft Deployment Toolkit. I would greatly appreciate any expert suggestions or assistance to resolve these issues. Thank you in advance for your help.

west pine Aug 5, 2023, 9:55 AM

#

#

And now its my VPN who is causing troubles x)

#

#

I cant connect to the VPN 😢

#

ANy idea ?

wooden minnow Aug 5, 2023, 9:58 AM

#

Regen.

west pine Aug 5, 2023, 9:58 AM

#

Already done

wooden minnow Aug 5, 2023, 10:00 AM

#

Still not working?

#

Did you delete the old one?

west pine Aug 5, 2023, 10:01 AM

#

Working now

#

Guess i just had to wait ^^

#

#

Arf

#

Tryes w/ python 3 and 2.7

#

And everything have been downloaded

#

Idk if its the machine,or m

wooden minnow Aug 5, 2023, 11:06 AM

#

what is the error output?

west pine Aug 5, 2023, 11:32 AM

#

None

#

Like

#

Nothing

#

It just do that x)

wooden minnow Aug 5, 2023, 11:33 AM

#

It doesn't look like it's running at all

west pine Aug 5, 2023, 11:35 AM

#

but im doing it with python

#

Thats strange

#

So no answers ?

wooden minnow Aug 5, 2023, 2:38 PM

#

Can you cat the python file?

west pine Aug 5, 2023, 2:45 PM

#

The python file is exactly the one given

muted kernel Aug 9, 2023, 9:01 AM

#

Hi folks, I've been facing issues with the breaching AD room. I'm using my own machine to connect to the breachAD network. The site then asks me to change my DNS settings using the follwoing command systemd-resolve --interface breachad --set-dns $THMDCIP --set-domain za.tryhackme.com , but the kali linux throws an error systemd-resolve: command not found .

I googled about this and someone said that the systemd-resolve has been replaced by resolvectl. Can someone please help me with this!!!

#

pls dm or mention me if you have an answer with regards to this

undone knoll Aug 9, 2023, 9:18 AM

#

muted kernel pls dm or mention me if you have an answer with regards to this

Check the pins in this channel, there's a good explanation on how to connect from Scrubz

muted kernel Aug 10, 2023, 6:43 PM

#

undone knoll Check the pins in this channel, there's a good explanation on how to connect fro...

Thanks a lot mate

slate swanBOT Aug 10, 2023, 6:43 PM

#

Gave +1 Rep to @undone knoll

muted kernel Aug 11, 2023, 4:24 AM

#

Ok so I have been trying to access the AD Breaching room for the past couple of days. I am using a Kali VM in VirtualBox. I edited the resolv.conf file and added the nameserver to the top of the list. This helped me with the nsloookup thmdc.za.tryhackme.com and the domain got resolved properly on the terminal. But whenever I enter the same domain in the browser it throws an error that we're having trouble finding that site. I even reset the network, but nothing seems to be working. Any help or channels where I can let the moderators/admins know about this??

#

ok so entering the site manually in /etc/hosts did solve my probleme but I don't think this is the intended method

wooden minnow Aug 11, 2023, 6:52 AM

#

Which subnet are you in?

muted kernel Aug 11, 2023, 4:56 PM

#

10.200.92.101

muted kernel Aug 11, 2023, 5:21 PM

#

What do you recon could be the reason @wooden minnow ??

wooden minnow Aug 11, 2023, 5:25 PM

#

Could be a dead subnet.

muted kernel Aug 11, 2023, 5:47 PM

#

#

#

@wooden minnow

#

@dense cedar can you help me trace the problem ?

muted kernel Aug 11, 2023, 5:49 PM

#

wooden minnow Could be a dead subnet.

I reset the network

wooden minnow Aug 11, 2023, 6:07 PM

#

Which task are you on?

muted kernel Aug 11, 2023, 6:07 PM

#

pxe one

#

Task 6

#

also the site pxeboot.za.tryhackme.com won't load on the browser

wooden minnow Aug 16, 2023, 5:59 AM

#

Did you check pins

#

@cosmic kite

#

I meant pins

#

In this channel

spice prawn Aug 16, 2023, 6:01 AM

#

anyone know how to hack roblox accounts?

cosmic kite Aug 16, 2023, 6:02 AM

#

wooden minnow <@691113577863577641>

thanks

slate swanBOT Aug 16, 2023, 6:02 AM

#

Gave +1 Rep to @wooden minnow

wooden minnow Aug 16, 2023, 7:28 AM

#

state your subnet, other people might reset it for you, or vote yourself every 30 min(s)

slate swanBOT Aug 16, 2023, 7:29 AM

#

Gave +1 Rep to @wooden minnow

prisma thorn Aug 17, 2023, 11:56 AM

#

Hey Guys I am stuck in BreachingAD on Task5 because there is no more diskspace left. What can I do?

wooden minnow Aug 17, 2023, 11:57 AM

#

Are you on the attackbox?

prisma thorn Aug 17, 2023, 11:57 AM

#

Oh no I am SSH into the Jumbhost (THMJMP1.za.tryhackme.com)

#

Its Task6 sorry 😄

wooden minnow Aug 17, 2023, 11:58 AM

#

Is this on your VM?

prisma thorn Aug 17, 2023, 11:59 AM

#

No, you need to ssh into the machine THMJMP1.za.tryhackme.com and make a new direcotry with your user and download from the PXE server. Currently I cant even make a new direcotry cause no more space

#

dense cedar Aug 17, 2023, 12:09 PM

#

prisma thorn

This might require a network reset, too many users have then extract the PXE image. You could also just look to use the image that another user downloaded in their directory

prisma thorn Aug 17, 2023, 12:13 PM

#

Yes that was my intention but then I got this:

#

It cant even write a history txt file

dense cedar Aug 17, 2023, 12:19 PM

#

prisma thorn Yes that was my intention but then I got this:

Mmm, I think it is then going to need a reset sadly since it is even too full to read files. There is a script that should flush the entries every 60 minutes, but it can fail. You can send me your remote IP (in your OVPN file) and I can try to take a look for you

prisma thorn Aug 17, 2023, 12:20 PM

#

I managed to execute the powershell and find the location of the wim file. I am not gonna download anything and using the resources that are downloaded already. Can I come back to you if I get stuck again? 😄

dense cedar Aug 17, 2023, 12:21 PM

#

prisma thorn I managed to execute the powershell and find the location of the wim file. I am ...

Jip, good luck there!

prisma thorn Aug 17, 2023, 12:21 PM

#

Thanks for the help! @dense cedar

slate swanBOT Aug 17, 2023, 12:21 PM

#

Gave +1 Rep to @dense cedar

prisma thorn Aug 17, 2023, 12:24 PM

#

For anyone stuck at the same part atm I used the "Wally" folder there are all the files you need. And you dont have to download anything.

mossy stump Aug 17, 2023, 1:31 PM

#

Task5 I set the dns and wait with responder on tun0 but no capture ever appears

wooden minnow Aug 17, 2023, 3:41 PM

#

Is the with responder ?

mossy stump Aug 18, 2023, 1:26 PM

#

sudo responder -I tun0 is the command. And it says I should receive a SMBv2 Connection in up to 30 minutes

wooden minnow Aug 18, 2023, 1:28 PM

#

Should be faster than that.

Usually is.

#

Might need to reset the network

prisma thorn Aug 19, 2023, 9:14 PM

#

Breaching ad network is very slow for me and sometimes it is not reachable at all

exotic vessel Aug 20, 2023, 7:29 AM

#

@wooden minnow I tried the exact steps from the pinned message, but still not able to configure properly. I am getting the message saying "server can't find thmdc.za.tryhackme.com: NXDOMAIN
"

wooden minnow Aug 20, 2023, 7:39 AM

#

!docs verify

outer timberBOT Aug 20, 2023, 7:39 AM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

wooden minnow Aug 20, 2023, 7:39 AM

#

exotic vessel <@958383130102870026> I tried the exact steps from the pinned message, but still...

Can you follow the above link verify, to send screenshots?

exotic vessel Aug 20, 2023, 7:40 AM

#

wooden minnow Can you follow the above link verify, to send screenshots?

Hey scrubz, I restarted the machine, now its working fine. Thanks!

slate swanBOT Aug 20, 2023, 7:40 AM

#

Gave +1 Rep to @wooden minnow

peak dove Aug 22, 2023, 10:45 PM

#

hi guys im having issue connecting using kali attackbox

#

┌──(root㉿kali)-[~]
└─# nano /etc/resolv.conf

┌──(root㉿kali)-[~]
└─# cat /etc/resolv.conf

Generated by NetworkManager

search localdomain
nameserver 10.200.55.101
nameserver 8.8.8.8

┌──(root㉿kali)-[~]
└─# systemctl restart NetworkManager

┌──(root㉿kali)-[~]
└─# nslookup thmdc.za.tryhackme.com
;; communications error to 10.200.55.101#53: timed out
;; communications error to 10.200.55.101#53: timed out
;; communications error to 10.200.55.101#53: timed out
Server: 8.8.8.8
Address: 8.8.8.8#53

** server can't find thmdc.za.tryhackme.com: NXDOMAIN

viscid tundra Aug 25, 2023, 2:26 PM

#

Hey guys! Anyone here done the room and uses Arch? I have followed Arch wiki for setting up an openldap server, but I could not downgrade the suite to utilise the 'PLAIN,LOGIN'. Any LDAP gurus here?

#

Also, I am experiencing TFTP problem with "breachingAD" room, Task6.

I managed too pull the BCD file, but I am unable to GET the .wim file, I get 'Connect Request Failed' . Now I can't even pull the bcd file, as I get the same error.

Quick google tells me that this is server side TFTP problem.
Anything I can do, other than vote to reset the network and wait some 5 hours...?

untold vale Aug 27, 2023, 6:27 PM

#

hi guys

#

I'm trying to crack the NTLMv2 hash that I got from responder and no matter what I do it always output "Exhausted"

wooden minnow Aug 27, 2023, 6:28 PM

#

Are you doing the full hash?

untold vale Aug 27, 2023, 6:28 PM

#

I'm using the passwordlist.txt file

wooden minnow Aug 27, 2023, 6:28 PM

#

Or chopping a part off?

untold vale Aug 27, 2023, 6:28 PM

#

yes the whole row

#

with the username and all

#

Can I post here the whole hash ?

wooden minnow Aug 27, 2023, 6:30 PM

#

Yes, include spoilers please.

untold vale Aug 27, 2023, 6:30 PM

#

How do I do it ?

#

the spolier part

wooden minnow Aug 27, 2023, 6:31 PM

#

Yeah, that's the hash.

#

What syntax are you using for the hashcat?

untold vale Aug 27, 2023, 6:33 PM

#

the same as mentioned: hashcat -m 5600 lsntlmv2_svcFileCopy2.txt ~/Downloads/passwordlist.txt --force

wooden minnow Aug 27, 2023, 6:33 PM

#

strange..

Mine justr worked.

#

Your hash is different from mine...

untold vale Aug 27, 2023, 6:35 PM

#

hmmm so thats the problem

#

but how

#

if its the same user

wooden minnow Aug 27, 2023, 6:35 PM

#

Ah, I have an idea.

#

check your hash, do you have any spaces?

#

Because I copied your to try, and when I copied and pasted, you had line breaks

untold vale Aug 27, 2023, 6:37 PM

#

Thanks you were right

#

instead of the previous one

wooden minnow Aug 27, 2023, 6:38 PM

#

🙂

You get it now?

untold vale Aug 27, 2023, 6:38 PM

#

yes thank you 😄

wooden minnow Aug 27, 2023, 6:38 PM

#

🙂 Excellent, can you please delete your two previous please, so we don't spoil it for others. 🙂

untold vale Aug 27, 2023, 6:39 PM

#

Done, thank you 😄

wooden minnow Aug 27, 2023, 6:48 PM

#

untold vale Done, thank you 😄

Thank you 😄

Happy hacking.

slate swanBOT Aug 27, 2023, 6:48 PM

#

Gave +1 Rep to @untold vale

untold vale Aug 28, 2023, 5:19 PM

#

Hi

#

Im doing Task 6 and I cant connect to the server

#

to download the PXE image via tftp

#

||tftp -i 10.200.55.201 GET "\Tmp\x64{C9AB627F-9759-435F-8229-5C4B3F8688FF}.bcd" px eboot.wim Connect request failed||

hearty sequoia Aug 29, 2023, 5:20 PM

#

Someone can please vote for Reset only one more vote required

trim mica Aug 29, 2023, 5:27 PM

#

hearty sequoia Someone can please vote for Reset only one more vote required

please specify the subnet as there are multiple and hence not all of them need resets

hearty sequoia Aug 29, 2023, 5:36 PM

#

Oh sorry it is 92

#

10.200.92.xxx

trim mica Aug 29, 2023, 6:13 PM

#

hearty sequoia 10.200.92.xxx

thanks... lets hope someone else on that network can vote... if not you can vote yourself about once every hour

slate swanBOT Aug 29, 2023, 6:13 PM

#

Gave +1 Rep to @hearty sequoia

hearty sequoia Aug 30, 2023, 8:03 AM

#

Need a help, I'm on 10.200.92.xxx and everything is responding well except I can't access the printer.za.tryhackme.com/settings.aspx. ntlm.za.tryhackme.com us working well also I hard-coded the domain in hosts file still the same problem (I waited for network reset but it didn't help me)

hearty sequoia Aug 30, 2023, 9:36 AM

#

I waited for network to get stopped and I started it again and now luckily it is working.

bright nimbus Aug 31, 2023, 3:16 PM

#

does anyone have time to help me connected to the network? been trying for 1 hour and cant get it to work

wooden minnow Aug 31, 2023, 3:17 PM

#

bright nimbus does anyone have time to help me connected to the network? been trying for 1 hou...

check the pinned posts in this channel. 🙂

bright nimbus Aug 31, 2023, 3:21 PM

#

just did, everything look correct if im not missunderstand anything

wooden minnow Aug 31, 2023, 3:22 PM

#

!docs verify

outer timberBOT Aug 31, 2023, 3:22 PM

#

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

wooden minnow Aug 31, 2023, 3:22 PM

#

can you verify asnd provide screensdhots?

bright nimbus Aug 31, 2023, 3:25 PM

#

wooden minnow Aug 31, 2023, 3:33 PM

#

bright nimbus

Don't use the GUI for this.

#

Are you running the breachad VPN?

bright nimbus Aug 31, 2023, 3:36 PM

#

yes and connected

wooden minnow Aug 31, 2023, 3:39 PM

#

Can you do ip a s please.

bright nimbus Aug 31, 2023, 3:41 PM

#

wooden minnow Aug 31, 2023, 3:50 PM

#

Can you visit the link In the task?

Nslookup can be a bum.

bright nimbus Aug 31, 2023, 3:51 PM

#

no, this one right http://ntlmauth.za.tryhackme.com?

#

btw im on a kali, not the attackbox

wooden minnow Aug 31, 2023, 3:56 PM

#

That won't matter. 🙂

#

But yes, that website

bright nimbus Aug 31, 2023, 3:59 PM

#

have a new error now
not sure that better

wooden minnow Aug 31, 2023, 4:00 PM

#

You don't need to do that part.

#

Can you access http://ntlmauth.za.tryhackme.com in your web browser?

bright nimbus Aug 31, 2023, 4:01 PM

#

no

wooden minnow Aug 31, 2023, 4:01 PM

#

which subnet are you on?

#

You'll get it there.

bright nimbus Aug 31, 2023, 4:01 PM

#

10.50.24.29/26

wooden minnow Aug 31, 2023, 4:02 PM

#

Nah, that's your own.

I'm interested in the THMDC.

#

Is the network state running?

bright nimbus Aug 31, 2023, 4:03 PM

#

yes

#

wooden minnow Aug 31, 2023, 4:04 PM

#

Ok, let's try leaving the room

Press the cog and leave the room for 5 min(s)

bright nimbus Aug 31, 2023, 4:05 PM

#

will do

wooden minnow Aug 31, 2023, 4:28 PM

#

@bright nimbus How are you getting on now?

bright nimbus Aug 31, 2023, 4:39 PM

#

took a dinner break, will try again now, let you know how it goes

#

ey it works, thanks for the help @wooden minnow

slate swanBOT Aug 31, 2023, 4:54 PM

#

Gave +1 Rep to @wooden minnow

wooden minnow Aug 31, 2023, 4:54 PM

#

bright nimbus ey it works, thanks for the help <@958383130102870026>

Happy hacking.

weak yoke Sep 2, 2023, 2:17 PM

#

Hi Guys, need some support, regrading an issue I have been facing for a while now, I started learning active directory after covering the basics I tried to join the "Breaching AD" room, whenever I try to join, it redirects to "My Rooms" of my profile whithout letting me join the room. Any advice?

dense cedar Sep 4, 2023, 5:52 PM

#

weak yoke Hi Guys, need some support, regrading an issue I have been facing for a while no...

Are you a subscriber or do you have the required streak amount?

weak yoke Sep 4, 2023, 8:50 PM

#

dense cedar Are you a subscriber or do you have the required streak amount?

generating streaks now, will try later on

polar mango Sep 7, 2023, 5:37 AM

#

Hi, am I the only one misunderstanding the "DNS debug" part in the first task of Breaching AD ? Or is it outdated ?

It's quite treacherous and confusing to say "use nslookup tryhackme.com" and you're supposed getting the same answer than "nslookup tryhackme.com [DC IP]", I have literally taken several hours debugging my DNS config before finally understanding that everything was just fine : you can't get the same result by using the BreachAD network DC and not, your resolver doesn't look at the same domain name...

It would have been better saying "use nslookup za.tryhackme.com [DC IP]" and next "use nslookup za.tryhackme.com" OR "use nslookup tryhackme.com 1.1.1.1 or other public dns server" and "nslookup tryhackme.com"

Anyway, positive point : you understand more how DNS works after being mad about this 😅

open anvil Sep 8, 2023, 12:52 PM

#

hello, I have a problem, I can no longer access the site http://ntlmauth.za.tryhackme.com/

#

(I had access a few minutes ago)

night totem Sep 8, 2023, 9:35 PM

#

open anvil hello, I have a problem, I can no longer access the site http://ntlmauth.za.tryh...

is your vm still up?

open anvil Sep 8, 2023, 9:35 PM

#

night totem is your vm still up?

yeah, but i'm tired

#

if you have solution tell me

night totem Sep 8, 2023, 9:35 PM

#

can you ping it?

open anvil Sep 8, 2023, 9:36 PM

#

yes

night totem Sep 8, 2023, 9:36 PM

#

what does nmap say about it?

open anvil Sep 8, 2023, 9:38 PM

#

wait, what do you want me to ping ?*

#

the website ? or dc

#

this is my configuration btw about what i already saw

open anvil Sep 8, 2023, 9:52 PM

#

night totem what does nmap say about it?

this is what i have whit the nmap of 10.200.xx.101

night totem Sep 8, 2023, 9:53 PM

#

that says thmdc?

#

different from ntlm auth?

open anvil Sep 8, 2023, 9:55 PM

#

night totem that says thmdc?

i can ping the thmdc

night totem Sep 8, 2023, 9:55 PM

#

that's what that says it is

#

soooo where is ntlmauth?

open anvil Sep 8, 2023, 9:56 PM

#

sorry, but what do you mean, i don't understand

dense cedar Sep 11, 2023, 4:54 AM

#

Hi all, the Breaching AD network has received updates. These will help improve overall stability of the network and allow us to closer monitor each subnet. Updates will be applied to the hosts in your subnet once it resets. You can vote reset to have these changes applied.

weak yoke Sep 11, 2023, 6:45 PM

#

open anvil sorry, but what do you mean, i don't understand

since you are using kali, there is an issue, I solved it after few googling around : you have to edit the following file sudo nano '/etc/systemd/resolved.conf' and then try changing the '#DNS=' line to 'DNS={thmdc ip}' in '/etc/systemd/resolved.conf' . thmdc is the dns ip that we are meant to use.

#

also use firefox incognito mode to visit the site, chrome does not work

wooden minnow Sep 11, 2023, 6:48 PM

#

Chrome works for me.

old plinth Sep 11, 2023, 6:50 PM

#

dense cedar Hi all, the Breaching AD network has received updates. These will help improve o...

weak yoke Sep 11, 2023, 7:03 PM

#

@old plinth please pin my message as well, for those who are using kali, it will help them, since /etc/resolv.conf resets the nameserver

wooden minnow Sep 11, 2023, 7:26 PM

#

weak yoke <@719230703161835633> please pin my message as well, for those who are using kal...

I've already got one there that will show them the steps without touching systemcl folders

weak yoke Sep 11, 2023, 7:33 PM

#

wooden minnow I've already got one there that will show them the steps without touching system...

👍

weak yoke Sep 11, 2023, 8:38 PM

#

anyone else loosing connection while doing MSDT section of the room while connected via ssh?

wooden minnow Sep 11, 2023, 8:41 PM

#

sudo ip link set dev tun0 mtu 1200

Try that command in a new terminal.

weak yoke Sep 11, 2023, 8:44 PM

#

wooden minnow `sudo ip link set dev tun0 mtu 1200` Try that command in a new terminal.

thanks for the tip, I will try it if I have the same issue again, its working again automatically

slate swanBOT Sep 11, 2023, 8:44 PM

#

Gave +1 Rep to @wooden minnow

wooden minnow Sep 11, 2023, 8:45 PM

#

weak yoke thanks for the tip, I will try it if I have the same issue again, its working ag...

No problem, that command lower the size of each packets sent.

weak yoke Sep 11, 2023, 8:45 PM

#

wooden minnow No problem, that command lower the size of each packets sent.

👍

weak yoke Sep 11, 2023, 9:17 PM

#

completed the room, it was fun to learn. There is sooo much to learn about active directory

woven shadow Sep 12, 2023, 4:57 AM

#

For some reason I cant join the Breach AD room; it redirects me to /rooms directory when I click on Join Room and it stays unjoined

sage knot Sep 12, 2023, 5:00 AM

#

woven shadow For some reason I cant join the Breach AD room; it redirects me to /rooms direct...

Are you subbed or do you have the 7 day streak required to join the room?

woven shadow Sep 12, 2023, 5:01 AM

#

sage knot Are you subbed or do you have the 7 day streak required to join the room?

Nop, where is this requirement mentioned?

sage knot Sep 12, 2023, 5:01 AM

#

woven shadow Sep 12, 2023, 5:02 AM

#

:/

sage knot Sep 12, 2023, 5:02 AM

#

Ah yeah, don't think it shows up on the room search area

#

Can be a bit confusing

woven shadow Sep 12, 2023, 5:03 AM

#

It should not show the join button, anyways, the image you shared helps. Thanks

sage knot Sep 12, 2023, 5:03 AM

#

np

weak yoke Sep 12, 2023, 3:23 PM

#

woven shadow For some reason I cant join the Breach AD room; it redirects me to /rooms direct...

you need to have 7 day streak

#

I had the same issue

orchid plover Sep 13, 2023, 10:08 AM

#

Hi Guys, I am stuck with Task 4 (LDAP Bind Credentials) of this room. I can not see the password of the printer. I think that the ldap server still considers the domain name as the default one of the hosted rogue ldap server (eu-west...) which i changed during configuration to "za.tryhackme.com" for sure as tcpdump shows this in the end of the IPs of the printer and the breachad interface. Anyone who had the same issue?

eager grail Sep 14, 2023, 10:27 AM

#

Hello everyone,
Little problem on the room, I'm on task number 6, where we have to download the ".bcd" via TFTP, but the program replies as follows:

What should I do to solve the problem?
Thanks 🙂

wooden minnow Sep 14, 2023, 11:55 AM

#

That could take a reset to fix,

Maybe @dense cedar can advise.

dense cedar Sep 14, 2023, 11:55 AM

#

eager grail Hello everyone, Little problem on the room, I'm on task number 6, where we have ...

Reset will fix it. Other option is to just go and read the files from another user's directory

wooden minnow Sep 14, 2023, 12:10 PM

#

I'll take a note of that too so I don't ping you for it 🙂

steady gull Sep 17, 2023, 7:38 PM

#

Question: Doing "Intercepting NetNTLM Challenge" what VPN do I have to use the "breachad" or the other one?

exotic moth Sep 18, 2023, 7:43 AM

#

hi, i need help

#

i cant access this site

#

ok i solved it😁

#

YOU MUST CHECK YOU THMDC IP in the configurations

#

you will see the old ip for the THMDC in the NetworkManger in your virtal machine
so you MUST change it

steady gull Sep 18, 2023, 5:45 PM

#

Is the server runniing?

#

I can't get an IP

wooden minnow Sep 18, 2023, 5:45 PM

#

Hello, can you please tell me your subnet.

#

And I can have a look.

steady gull Sep 18, 2023, 5:45 PM

#

50

wooden minnow Sep 18, 2023, 5:45 PM

#

Ok, bare with me.

#

Yup, everything on your network is running good.

steady gull Sep 18, 2023, 5:47 PM

#

I got "2023-09-18 13:47:15 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2023-09-18 13:47:15 TLS Error: TLS handshake failed
2023-09-18 13:47:15 SIGUSR1[soft,tls-error] received, process restarting
2023-09-18 13:47:15 Restart pause, 8 second(s)
"
but not IP

#

It's a loop

wooden minnow Sep 18, 2023, 5:48 PM

#

That looks like your end.

steady gull Sep 18, 2023, 5:48 PM

#

what do you mean?

wooden minnow Sep 18, 2023, 5:49 PM

#

TLS handshake error is a problem on your network, not THM's.

steady gull Sep 18, 2023, 5:49 PM

#

I'll check out

steady gull Sep 18, 2023, 6:05 PM

#

wooden minnow TLS handshake error is a problem on your network, not THM's.

I had to download the My configuration file again and now runs like a charm

#

thx

#

BTW Now I don't have tunX adapter

wooden minnow Sep 18, 2023, 6:06 PM

#

You should have a breachad one instead.

steady gull Sep 18, 2023, 6:28 PM

#

wooden minnow You should have a `breachad` one instead.

yeah, but I'm doing Intercepting NetNTLM Challenge and it says you have to use a tunX

wooden minnow Sep 18, 2023, 6:28 PM

#

steady gull yeah, but I'm doing Intercepting NetNTLM Challenge and it says you have to use a...

Which task?

steady gull Sep 18, 2023, 6:29 PM

#

task 5

wooden minnow Sep 18, 2023, 6:29 PM

#

Just replace the tun0 with the interface you now have.

steady gull Sep 18, 2023, 6:30 PM

#

I got "[!] Error starting TCP server on port 389, check permissions or other servers running."

wooden minnow Sep 18, 2023, 6:31 PM

#

Do you have something else running?

steady gull Sep 18, 2023, 6:31 PM

#

I don't think so. I've just reboot the machine

#

doesn't mind it works

wooden minnow Sep 18, 2023, 6:34 PM

#

blobfingerguns

steady gull Sep 18, 2023, 6:34 PM

#

👍

stray summit Sep 18, 2023, 7:19 PM

#

I can ping the DC IP but there seems to be no DNS running on port 53 nor does nslookup resolve in anything besides a time out

wooden minnow Sep 18, 2023, 8:19 PM

#

stray summit I can ping the DC IP but there seems to be no DNS running on port 53 nor does ns...

I've had a check, is the network running?

stray summit Sep 18, 2023, 8:20 PM

#

Just recently reset the network will check in a few minutes

wooden minnow Sep 18, 2023, 8:21 PM

#

I think that seems to be dead.

Can you use the cod up the top right and leave the room for 5 mins.

stray summit Sep 18, 2023, 8:24 PM

#

Left the room. Will I need to regenerate a new VPN config in 5 minutes?

wooden minnow Sep 18, 2023, 8:26 PM

#

No, you shouldn't need to.

stray summit Sep 18, 2023, 9:09 PM

#

Still can't get the DNS working, a normal nmap on the DC does give no results however a thorough scan does result in a 53 port for DNS. I do not run Kali but I do use NetworkManager so I've set it up following the instructions. Maybe I'm doing something wrong but it is setup as primary DNS server which I definitely feel when browsing the internet. The pinging is working.

#

wooden minnow Sep 19, 2023, 8:16 AM

#

Are you still in subnet 53?

steady gull Sep 19, 2023, 5:46 PM

#

Hey, I'm having some trouble to run "Import-Module .\PowerPXE.ps1". Any help?