breaching-ad

[coarse parcel]

``` this is THMAD

nameserver is alright?

i am using vbox kali over NAT

[wooden minnow]

Can you visit the link in Task 4.

[coarse parcel]

└─# nslookup tryhackme.com 10.200.26.101
;; communications error to 10.200.26.101#53: timed out
;; communications error to 10.200.26.101#53: timed out
;; communications error to 10.200.26.101#53: timed out
;; no servers could be reached

                                                                                  
┌──(root㉿kali)-[~]
└─# nslookup tryhackme.com              
;; communications error to 10.200.26.101#53: timed out
;; communications error to 10.200.26.101#53: timed out
;; communications error to 10.200.26.101#53: timed out
Server:         1.1.1.1
Address:        1.1.1.1#53

Non-authoritative answer:
Name:   tryhackme.com
Address: 104.22.55.228
Name:   tryhackme.com
Address: 104.22.54.228
Name:   tryhackme.com
Address: 172.67.27.10
;; communications error to 10.200.26.101#53: timed out
;; communications error to 10.200.26.101#53: timed out
;; communications error to 10.200.26.101#53: timed out
Name:   tryhackme.com
Address: 2606:4700:10::ac43:1b0a
Name:   tryhackme.com
Address: 2606:4700:10::6816:37e4
Name:   tryhackme.com
Address: 2606:4700:10::6816:36e4
```  etc/resolv -> ```# Generated by NetworkManager
nameserver 10.200.26.101
nameserver 1.1.1.1```

i can visit over 1.1.1.1 or 10.0.2.2

[wooden minnow]

Can you visit this link?

http://printer.za.tryhackme.com/settings.aspx

I check all services on your subnet and they're all running.

[coarse parcel]

i am checking

[coarse parcel]

yes i can thats printer setting

[wooden minnow]

Then you'fe good to go, Nslookup isn't needed.

[coarse parcel]

why those domain and dns were not resolving?

[wooden minnow]

Changes made so they work sporadically, it's not THM's fault

[coarse parcel]

okkk

[coarse parcel]

thanks bro

[slate swan]

Gave +1 Rep to @wooden minnow (current: #1 - 2800)

[coarse parcel]

└─# tcpdump -SX -i breachad tcp port 389 
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on breachad, link-type RAW (Raw IP), snapshot length 262144 bytes

                                                                                  
                                                                                  
                                                                                  
       ```

nothing is showing in tcpdump

http://printer.za.tryhackme.com/settings

[wooden minnow]

Did yu conre the LDAP properly?

[coarse parcel]

means?

[wooden minnow]

Did you configure, and start the LDAP server properly?

And set it up for plain text etc.

[coarse parcel]

yes

[coarse parcel]

yes

[wooden minnow]

Is the interface called breached, yes?

[coarse parcel]

yes.

checked using ifconfig

[zenith sonnet]

we're you able to fix the communications error? have the same problem using kali, but if attackbox it's working

[coarse parcel]

yes

[zenith sonnet]

Can you share pls?

[coarse parcel]

i installed vbox kali. and change the name server to # Generated by NetworkManager
nameserver 10.200.26.101
nameserver 1.1.1.1

also enable vpn of thm

in my main linux i use smart dns. so it was causing problem. thats why i installed vbox kali

there are two kinds of vpn . another one is network. try that

[zenith sonnet]

i see, will try, thank you

[slate swan]

Gave +1 Rep to @coarse parcel (current: #2243 - 1)

[late thorn]

Anyone know if it's possible to run responder through a pivoting tunnel, like ligolo-ng?

[wooden minnow]

Never tried

[late thorn]

In a lab where I've compromised a linux host connected to an internal network with an AD domain...so can't run responder directly from my attack box, and ssh tunneling doesn't do much good, since responder is run against an interface...

[wooden minnow]

Are you using the attackbox for something else?

[trim mica]

hello i m connected to the network , pinging the DC works but nslookup tryhackme.com <DC IP> doesn't work !

i did add the dc ip into dns config

does anyone knows what could be the problem . ? maybe a reset ?

[woeful sail]

you do not need nslookup tryhackme.com for the room

[prisma thorn]

I am not able to join the breaching ad room, neither I can see it in my access page

[wooden minnow]

Do you have a streak of > than 7?

[prisma thorn]

Yeah can't access it due to streak thing

[wooden minnow]

Intentional.

[prisma thorn]

Someone pointed it out in other channel

[torn turret]

Hello @woeful sail

This does not make sense for me.

When i saw that in screen shot provided by THM that the username hollie.powell shd work

[woeful sail]

I'll have a look

[torn turret]

i manually can do it and got through the user:pass thing

[woeful sail]

worked for me

[torn turret]

not sure what can be the issue

[woeful sail]

here is my command, compare character per character with yours:
python ntlm_passwordspray.py -u usernames.txt -f za.tryhackme.com -p Changeme123 -a http://ntlmauth.za.tryhackme.com

[torn turret]

python3 ntlm_passwordspray.py -u usernames.txt -f za.tryhackme -p Changeme123 -a http://ntlmauth.za.tryhackme.com/

got it

you are the best thank you

[teal acorn]

Hello, working on this room and having trouble using the attackbox to listen on port 389. I disabled the slapd service and I can access things via hostname.

root@ip-10-10-139-242:~# service slapd stop
root@ip-10-10-139-242:~# nc -lvp 389
nc: getnameinfo: Temporary failure in name resolution

Anyone that can provide assistance on this?

[earnest knoll]

DNS

@teal acorn It seems like DNS.

That was really common when I did it.

[tired jacinth]

@teal acorn I had the same problem with netcat and figured it out. I can help you out if you still need it

[worldly rain]

Hello I actually have the same issue and still didn't get how to solve it. I have this same issue on the lateral-movement-and-pivoting-room but I assume the technique to solve it is the same, feel free to dm me in case you can help 🙂

[lime plover]

i made a guide to help you resolve first issues in Breaching AD issues : Step 1: Connect to the TryHackMe VPN
Make sure to download and start your VPN connection using the .ovpn file provided by TryHackMe.
Guide: Configuring a Kali Linux Machine for TryHackMe VPN and DNS Issues
This step-by-step guide will help anyone using their own Kali Linux machine to properly configure the network and resolve DNS issues while connected to the TryHackMe VPN.

Step 1: Connect to the TryHackMe VPN
Make sure to download and start your VPN connection using the .ovpn file provided by TryHackMe.
Step 2: Configure DNS with resolvectl
To properly set up the DNS for the TryHackMe network:

Assign the TryHackMe DNS server:

resolvectl dns breachad "YOUR THMDC IP"
Set the domain name for the network:

resolvectl domain breachad za.tryhackme.com Step 3: Update /etc/hosts File
Edit the /etc/hosts file to hardcode specific domain entries: sudo nano /etc/hosts
Add the following lines:

10.200.55.101 thmdc.za.tryhackme.com
10.200.55.201 ntlmauth.za.tryhackme.com
10.200.55.201 printer.za.tryhackme.com
Save the file (Ctrl + O, then Enter) and exit (Ctrl + X).

Step 4: Update /etc/resolv.conf File
Ensure the correct DNS server is listed in /etc/resolv.conf with the following configuration:

sudo nano /etc/resolv.conf

Replace the content with:
nameserver 10.200.55.101 with THMDC IP in top of file

nameserver 10.200.55.101
nameserver 127.0.0.53
options edns0 trust-ad
search lan

Make sure the IP of THMDC is the first nameserver

Step 5: Refresh Package Manager
To test the setup and ensure the network is properly configured, update your system:

sudo apt update

Key Notes
Always ensure you are connected to the VPN before running any of the steps.
The resolvectl commands will configure your DNS settings dynamically, but you must keep your /etc/hosts and /etc/resolv.conf files updated for specific entries.
If any domain is still not resolving, double-check the entries in /etc/hosts and /etc/resolv.conf.

That's all

😀

[pliant turtle]

Hello
I am trying to do ldap pass-back attack in https://tryhackme.com/r/room/breachingad room, I am using attackbox
tcpdump request is not coming
When I use "ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms" command
I get "dn:
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN" output
Connection is dropped with nc but tcpdumpa content is not coming can you help me

[odd kestrel]

hey i am trying to access the breaching ad room

but it does not allow me to join

[wooden minnow]

Do you have a 7 day streak or a subscriber.

[pliant turtle]

Hello,

I am resolving the room https://tryhackme.com/r/room/breachingad, in the login section it tells me to enter the command "systemd-resolve --interface breachad --set-dns $THMDCIP --set-domain za.tryhackme.com" I enter the IP address given in the room instead of THMDCIP but there is no breached in the interface section. I use Attackbox, I used Attackbox in the previous rooms, in those, when I ran ifconfig in the interface section, it was showing breached, now it is not showing, I closed and opened Attackbox several times but the problem did not change

[plain blade]

I'm having this same problem

[hard mango]

I'm having the same issue too, any solution

[woeful sail]

if there is no breachad network adapter, download the VPN config file from the Access page for the Breaching AD network and run openvpn <VPN config file>
doing ip a will display the breachad interface that will allow to ping the DC
if that fails, regenerate the config file and try again
@pliant turtle @plain blade

[hollow grail]

In my case, if I click on initial Join To Room, button doesn't work and room not starts.

[woeful sail]

you need to be a subscriber or have a 7-day streak to join any THM network

[hollow grail]

No in this case, i can see 0 streaks needed

[wooden minnow]

You need a 7 day streak for non subscription users.

[minor mantle]

Hello. It doesn't work for me. The specified IP address resets automatically... After running the command - > systemd-resolve --interface lateralmovement --set-dns 10.200.48.101 --set-domain za.tryhackme.com

[sand sage]

hello
i'm currentlyu facing this
i don't know how to solve

[woeful sail]

have you done sudo systemctl restart NetworkManager?

[sand sage]

yea stll rthe same

[woeful sail]

can you ping 10.200.55.101?

[sand sage]

Host unreachable

[woeful sail]

that address is the DC and DNS server
regenerate your VPN, download and run with openvpn
make sure it is different from the previous VPN file (you can compare the hashes of both files to make sure they are different)

[wooden minnow]

You don't need to nslookup.

[shy dawn]

There is no breachad network adapter from vpn download, can someone help me?

[old plinth]

Hi, this occurs when you are no longer joined in the room's network (or have not joined the room yet). Leaving the room and rejoining it will make it appear for the ovpn file. 🙂

[verbal mica]

hi, how to open Breaching AD network ?

[wooden minnow]

Are you a subscriber, or a free user with a steak => 7?

[verbal mica]

I'm a subscriber

my steak is 3

[wooden minnow]

Ok, can you verify and show a screenshot?

[unkempt wren]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Mar 6, 2025, 8:42 PM

[wooden minnow]

Ah, you need to use options and leave the room, and re-join in 15 mins

@crimson dirge Is it yourself we still ping about network subnets?

[crimson dirge]

Hey, could you try clearing your browsers cache or using an incognito tab?

[woven shadow]

Breaching AD, Enum AD, Wreath, all the network VPNs are not connecting and timing out for me. Tried regenerating but didnt work. BTW I am on M2 Macbook

[wooden minnow]

You'll be better installing brew, then installing openVPN on the CLI via brew and running it there.

[woven shadow]

Thanks, this solved the problem.

cc: @woeful meadow

[slate swan]

Gave +1 Rep to @wooden minnow (current: #2 - 3537)

[woeful meadow]

appreciate it man! I will try it out!

[unkempt wren]

Information

Discord Slash Commands

https://support.discord.com/hc/en-us/articles/1500000368501-Slash-Commands-FAQ

Apr 5, 2025, 8:22 AM

[slender bough]

Hello network is not opening , saying "Failed to start the network"

if @admins pls check

i can't attach SS here

[delicate ore]

Hi, when i do the ldapsearch command to verify the rogue LDAP server's configuration, I dont have the PLAIN and LOGIN

[ivory spear]

I had the same issue. Restarted the room from scratch, followed the exact steps without improvising and it finally worked.

[nimble pollen]

Active Directory breaching room not working?

I don't see the VPN file to connect

[wooden minnow]

Have you joined the room?

[sick mason]

what am i doing wrong ?

[toxic rune]

hello every one here

i had the same issue like this one while trying to configure with the ldif file , and it outputsto me with

dn:
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: NTLM

i donot know what i am missing now , it some how the slapd service is not reading or writing the new ldif file configiration to the rogue ldap server

if any one have any idea to solve this would be appreciated

thanks in advance

[slate swan]

Gave +1 Rep to @delicate ore (current: #2914 - 1)

[plain blade]

I should be getting an actual webpage for the printer in Task 4, right? I've unjoined and rejoined the room, can ping the network, DNS resolves correctly, the NTLM auth popup from Task 3 worked just fine. What have I over looked? Or, should I try resetting/unjoining? Thanks for any suggestions!

nm. Something reset, my nameserver was missing again.....😕

[astral galleon]

hey guys i have a problem with the breaching active directory room and what ever i do i cannot resovle the za.tryhackme.com domain from the THMDC ip address it always responds with NXDomain here are my commands and kali network configuration state
nslookup za.tryhackme.com 10.200.4.101
Server: 10.200.4.101
Address: 10.200.4.101#53

** server can't find za.tryhackme.com: NXDOMAIN
dig @10.200.4.101 za.tryhackme.com -type ANY
;; Warning, ignoring invalid type ype

; <<>> DiG 9.20.9-1-Debian <<>> @10.200.4.101 za.tryhackme.com -type ANY
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7972
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;za.tryhackme.com. IN A

;; AUTHORITY SECTION:
tryhackme.com. 1102 IN SOA kip.ns.cloudflare.com. dns.cloudflare.com. 2374853812 10000 2400 604800 1800

;; Query time: 28 msec
;; SERVER: 10.200.4.101#53(10.200.4.101) (UDP)
;; WHEN: Wed Jun 11 14:18:27 EDT 2025
;; MSG SIZE rcvd: 122

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 51458
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 1, flags:; MBZ: 0x5126, udp: 512
;; QUESTION SECTION:
;ANY. IN A

;; AUTHORITY SECTION:
. 86310 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2025061101 1800 900 604800 86400

;; Query time: 408 msec
;; SERVER: 10.200.4.101#53(10.200.4.101) (UDP)
;; WHEN: Wed Jun 11 14:18:28 EDT 2025
;; MSG SIZE rcvd: 107
and i can ping the host just fine

[astral galleon]

hey guys does the dns of this box woks for anyone still if not is there a way to find the ntlmauth.za.tryhackme ipadress manually ?

[ivory spear]

Everything works fine. I used the attackbox and followed the steps.

[astral galleon]

oh really so it must be some confusing problem with my kali dns then i wasted too many hours trying to fix it

[astral galleon]

thanks btw

[slate swan]

Gave +1 Rep to @ivory spear (current: #47 - 198)

[fiery inlet]

I cant seem to ping THMDC

Same issue on attackbox

[fiery inlet]

fixed, just waited on the shutdown of network

[stone glacier]

I am trying to do the Breaching Active Directory room... issues with resolving DNS to the DC and the NTLMauth URL.
Is there an issue atm?

[stone glacier]

My issues:

nameserver 10.200.26.101
nameserver 169.254.169.253
root@ip-10-10-26-77:~# nslookup thmdc.za.tryhackme.com
Server:        127.0.0.53
Address:    127.0.0.53#53

** server can't find thmdc.za.tryhackme.com: NXDOMAIN

root@ip-10-10-26-77:~# nslookup ntlmauth.za.tryhackme.com
Server:        127.0.0.53
Address:    127.0.0.53#53

** server can't find ntlmauth.za.tryhackme.com: NXDOMAIN

root@ip-10-10-26-77:~# ping 10.200.26.101
PING 10.200.26.101 (10.200.26.101) 56(84) bytes of data.
64 bytes from 10.200.26.101: icmp_seq=1 ttl=127 time=2.18 ms
^C
--- 10.200.26.101 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 2.183/2.183/2.183/0.000 ms
root@ip-10-10-26-77:~# **ping thmdc.za.tryhackme.com**
ping: thmdc.za.tryhackme.com: Name or service not known```

I tried to run the python script anyway and it failed:

python3 ntlm_passwordspray.py -u usernames.txt -f za.tryhackme.com -p Changeme123 -a http://ntlmauth.za.tryhackme.com/

This error happened a few times in the output of the terminal on the Attackbox.

Failed to establish a new connection: [Errno -2] Name or service not known'

[languid sable]

are you in the same path than ntlm_pass[...] and username.txt ?

[stone glacier]

Yes.

I was able to solve it. It was DNS... I had to edit the /etc/resolv.conf file directly and add the DC as the first line.
Really frsutrating.

cat /etc/resolv.conf
,,,
nameserver 10.200.26.101 <<<< I added this line manually... the command in Task 1 did not work.
nameserver 127.0.0.53

[languid sable]

i've made the same mistake

[stone glacier]

Thanks for chiming in... it feels good to make progress.

[slate swan]

Gave +1 Rep to @languid sable (current: #664 - 9)

[thorn totem]

is anyone on here using macos & openvpn while having issues connecting to the THM network?

[grave notch]

anyone know if this is a common error when trying to start the network, and if there's a fix client side?

[stone glacier]

I have never seen it before. I started the network just a few hours ago and it worked fine.

[astral galleon]

hey guys i've finally managed to fix my dns issues for the room and decided to share it it might be useful to you
install resolvectl on kali
and run
sudo resolvectl dns <tun interface> <dns server ip>
installing this might brake your normal dns lookup you can fix it by running the same command and putting one of the googles or cloud flares dns servers eg 1.1.1.1
and if you ran to any problems just restart the systemd-resolved service with systemctl

[stone glacier]

👍

[old plinth]

Hello, I don't see you currently joined to any instance of the breachingad Network?
Leaving and rejoining the room probably will solve it.

[grave notch]

Ahhh

Ty

[dapper tiger]

thanx fixed

[indigo herald]

I'm stuck in this Breaching AD room. I can't seem to get the DNS settings to work in the attack box. They were working the other day in my VM, but I can't use that right now. Any advice?

[dull wedge]

What box are you using?

[indigo herald]

Thanks for replying. I was using the standard attack box, not Kali. I added the DC IP to resolv.conf instead of resolv-dnsmasq like the tutorial recommended. Maybe I was just overlooking something obvious. But that worked enough for me to finish the room.

[dull wedge]

Yeah the DNS is tricky. I used a Kali VM with custom configs I found out how to set up by watching various YouTube videos

[indigo herald]

@dull wedge are you currently working through this room?

[dull wedge]

I finished it over the weekend as part of prepping for PT1

[indigo herald]

Oh, cool. I'm preparing for the CompTIA pentest+, and it's on that track. I'm on task 6.

The Microsoft Deployment Toolkit section. I've never heard of MDT before.

[toxic ice]

Guys I have issues in the box I have followed the steps but it shows invalid DN error

0....D..wc....;..
..
.......x.....objectclass0.......supportedCapabilities
0    ..wd...0.0...we.
......
0....F..xc....=..
..
.......x.....objectclass0.......supportedSASLMechanisms
04..xd/..0+0)..supportedSASLMechanisms1...LOGIN..PLAIN0...xe.
......
0....D..yc....;..
..
.......x.....objectclass0.......supportedCapabilities
0    ..yd...0.0...ye.
......
0....<..z`....3.....NTLM.(NTLMSSP.........................
.cE....
0...za.
."...
invalid DN

The TCP Stream of LDAP

nahh never mind I tried a few more times I got the password

[woven rose]

Hey, I think something is wrong with my network. I just started this room and saw the reset count over 100. Not sure how it got there, but the network doesn't seem to want to work for me. First time I connected I was able to ping it and received smt. Now I can't despite being connected to the private network. The network has been in this resetting state for a few days now. Any ideas on how to resolve?

[woeful sail]

I suggest you leave the room via the Options button and join back a few minutes later You will be assigned to a different network instance If you land back on the same network instance, repeat the process but wait a bit longer

[woven rose]

Ah okay, I will give that a shot later today. Thank you

[slate swan]

Gave +1 Rep to @woeful sail (current: #13 - 645)

[blissful quartz]

I have an issue, I am sure that I configured everything correctly but when trying to test connection from printer webpage am not being able to get the password.

[blissful quartz]

My DNS configuration is correct and I tested it. Moreover, when I also tried to test connection using nc it doesn't work.

[toxic heath]

@woeful sail its all right here

trying to figure out what step hes on and remember how i did this room

[toxic heath]

took a look at it but i'm out of time right now. if no one has answered this once i get back i'll look further into it

[woeful sail]

can you screenshot ping to printer.za.tryhackme.com from the terminal where you ran nc -lvp 389?

[woeful sail]

thanks
and 10.50.29.20 is the IP of your breachad interface, right?

[slate swan]

Gave +1 Rep to @blissful quartz (current: #3163 - 1)

[blissful quartz]

Right

[woeful sail]

I have just started redoing that task, but I am using THM AttackBox, and I did not have the problem

[blissful quartz]

Yes I do it in Attack-Box and it works but on my own machine it does not. Now I tested this command to see if my local ldapd server responding:
ldapsearch -x -H ldap://localhost -b "" -s base
and the output was:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

I will try to fix the ldapd service it may cause the issue because it doesn't respond to printer packets, I saw in Wireshark they arrived but no response from my side.

[woeful sail]

testing your local ldap server would be useful beyond the step with nc, right?, I mean after you have done the section "Hosting a Rogue LDAP Server"

[woeful sail]

I am going to formulate my idea, hopefully better:
if you can succesfully run nc -lvp 389, that means port 389 is not used, hence no other server is in the way to capture your LDAP packets
hence, maybe something else is in the way, like firewall?

[blissful quartz]

You are right I'll check.

[blissful quartz]

Thank you, it works I have forgotten the ufw firewall.

[slate swan]

Gave +1 Rep to @woeful sail (current: #13 - 825)

[median linden]

.

[hearty bridge]

Hi can somone help me ? . I was trying to use the attack box but my dns can't solve that the DC thmdc.za.tryhackme.com ?

[woeful sail]

check that:

• you can ping the IP of the DC
• you have updated /etc/resolv-dnsmasq as per room material
• do /etc/init.d/dnsmasq restart
  then you can perform DNS lookups for the server names

[hearty bridge]

Hi thank you

[slate swan]

Gave +1 Rep to @woeful sail (current: #12 - 866)

[jagged dome]

I'm facing trouble with this room, I may or may not have attempted it in the past, which explains the 7% room progress

I am unable to reset the room, or join the room 😢

Please help me firgure out the issue

[lofty hamlet]

Hi!

Is the AttackBox buggy getting connected to the network?
i cant reach to the DC with the THM Attackbox..

pinging the IP dont work.. correcting the dns and pinging does neither work.

• I have started the attackbox from the room where im in.
• i have reverted the attackbox

I have tried to finish the module "Compromise the active directory" but the struggle to get the network up with working attackbox takes the fun out of it.. it works sometimes.... but oftenly not..

[woeful sail]

this could be an issue with the browser
I suggest you disable all browser extensions for the moment, clear browser cache and reload the web page

[woeful sail]

make sure:

• the network is in the state of running
• you have an network adapter called breachad
  after that, if pinging the DC IP fails, I suggest you leave the room and join a few minutes later (you should have different IPs)

[jagged dome]

It actually turned out to be the streak requirement issue, turns out I didn't see the thumbnail in Networks section which specified you needed a minimum of 7 day streak to access it

I paid for the sub and now am able to access it without having 7 day streak

[dull onyx]

I've submitted a ticket through THM and uploaded screen shots, but this is not the first time ive had to submit a ticket. Is the system being updated site wide? there have been quite a few issues with operability and things not working, lagging etc. Is there anything that THM can at-least publish to users to inform everyone? so at least we dont have to waste time trying to figure things out especially if its broken. I am a paying premium user and have been for a few years and this is the worst i've ever experienced on the THM platform. My yearly subscription renews next month, and if we cant get some feedback and/or issues resolved i may not renew my subscription. I really like the THM platform and have learned a lot but at this point, with all the issues, I feel this is wasting my time and hindering my growth, along with wasting my money on a sub-standard product. Some feedback would be greatly appreciated. thx

[jagged tree]

I've been experiencing the same issue in the "Breaching AD" room. Even downloading and running its associated VPN file doesn't work. I've been stuck for two days because of this issue.
I join you, at kindly requesting feedback on this issue.

[lethal pollen]

I have the same issues i leaved the room yesterday and joined now again and again i have the same IPs

[lethal pollen]

Anyone help...

[old plinth]

Can you please retry?

[lethal pollen]

Now im trying i got the same results i cannot connect

Im sure that i follow all the steps ...

I don't know what else i have to do i hope THM see that & fix it..

[woeful sail]

@old plinth
Hi Tim
About your message here (#breaching-ad message), if you do not mind , here is the feedback from my personal experience

• context
  • Breaching Active Directory (topology as per first screenshot)
  • results obtained in the past half-hour
• connecting using personal VM (Parrot):
  • it works
  • VPN file is breaching_ad_v2
  • check attached VPN log finishing with Initialization Sequence Completed
  • pinging of DC IP successfull (second screenshot)
• connecting wtih THM AttackBox (Ubuntu):
  • did not work initially after startup:
    • no other THM VPN instance running
    • no route to 10.200.70.X, hence no ping (screenshot #3)
  • did work after running openvpn with same VPN file as downloaded earlier for Parrot (screenshot #4)
    Conclusion:
• it works, for the moment
• earlier today (10-12 hours ago), tests with 3 AD rooms were disappointing:
  • it worked either with local VM or THM Ubuntu Attackbox or THM Kali, but not with 2 or all 3 ways of connecting
  • the 3 AD rooms were: Breaching Active Directory, Enumerating Active Directory and Exploiting Active Directory

[dense cedar]

Hey,

We migrated to v2 networks Friday last week. All but Holo and RTCC were migrated.

But there was a slight issue in the migration with the VPN server templates. Which causes several of the networks to have issues. Especially breaching AD.

About an hour ago, a patch was launched for the networks, which seems to be working, but we will continue to monitor this week.

It did however mean that we have to forcibly kill all existing network instances to force their restart. So this might mean you need to rejoin the network and then regenerate your VPN file.

We do apologise for the inconvenience, but hopefully it is now resolved. V2 networks should also be significantly more stable.

One thing to note though, your subnet will now persist. So regardless of what network you are actually in, the IPs in the room will remain constant. This is a new feature of v2 networks.

We are in the process of also updating the AD content, which will then reflect this change of static IPs as well.

Just two more things to be aware of:

• Make sure you don't run the network VPN locally and the Attackbox at the same time, given they are the same profile they will disconnect each other
• On the AttackBox, run tryconnectme to do network debugging. Often a simple profile regen by following the instructions it gives can help resolve the issue

[dull onyx]

Thanks for the feed'back, I was not able to get the attack box working. But i was able to regen the v2 and connect through my own machine on the vpn

[slate swan]

Gave +1 Rep to @dense cedar (current: #34 - 332)

[lethal pollen]

So now we use the v2 VPN config file ?

Im using the V2 VPN config file and not working !

[dense cedar]

Did you regenerate your VPN file and lastly what region are you?

[lethal pollen]

Im in Europe Greece

[dense cedar]

Should not be regional blocking then. Did you regen your VPN profile and ensure the network was running?

[lethal pollen]

Well here ia 7 in the morning i was trying last night until 2 pm hahaha i'll drink some coffee and i'll again haha...thanks for the help btw

[dense cedar]

For v2 networks, if the network goes into the sleep state, the VPN server does as well, meaning you won't be able to connect. V1 networks kept the VPN server active but this added to confusion, since was it a network issue or just network sleeping. So with v2 we sleep the VPN server as well. That way you know what is the actual state.

Anytime, hopefully sorted for you else DM me your THM username and I can Che your specific network instance

[lethal pollen]

Thank you i' ll give it a try later and i will reach out again if the issue remains !!

[slate swan]

Gave +1 Rep to @dense cedar (current: #33 - 333)

[lethal pollen]

@dense cedar Good Morning from Greece again i regenerated my VPN config. file and it worked fine !!! Thanks a lot...💪

[slate swan]

Gave +1 Rep to @dense cedar (current: #33 - 334)

[dense cedar]

Perfect, enjoy!

[slender talon]

Hello All, I'm not using VPN but directly the AttackBox and I can't connect to the VM DC of the lesson, is this normal ? Is there an issue still persisting please ?

[slender talon]

Just a summary of what I'm facing :

• I use AttackBox directly, no OVPN usage
• When i do an ip route command, I have no route to the dedicated subnets where DC is located (10.200.70.101)
• Ping does not work
• I restarted the attackbox many times over the previous days with the same result
• Let me share some screenshots

HUm do not know how we can add screenshot there, sorry I'm new ...

[woeful sail]

as per #breaching-ad message, run tryconnectme

[trim ginkgo]

The attackbox does not work for this room. It does not reach THMDC. However, the VPN works, but why the attack box is not working, it seems it is a long pending issue now.

[woeful sail]

check the latest from here: #breaching-ad message

[slender talon]

Hello Sir, I ran tryconnectme but it puts me the question on what OVPN I'm using, but I'm not using OVPN, I'm using directly the attackbox, it does not require to have a VPN connectivity. Do I miss something ? As I can't provide an OVPN name, the tryconnectme stops with no more diagnostic.

[woeful sail]

the VPN file is used by the AttackBox Normally, it is automatic, but in case of problems you have to feed it yourself
the VPN file is called breaching_ad_v2

[slender talon]

Hello Sir, does it mean that I must run manually this file from the AttackBox, right ?

[woeful sail]

that is correct, that is if THM AttackBox has not done its job properly when booting up
in the past, I have seen that situation often for another AD room (Exploiting AD), but it seems to affect Breaching AD too at the moment (for how long?: i do not know)
context: you are doing troubleshooting based on a particular situation that may be different next time you come around

[warm narwhal]

Could you provide the steps for the 'profile regen' process?

[dense cedar]

There you go. It is also mentioned in the rooms as well in Task 1. You will notice the names of the VPN profiles are slightly different that what are in the tasks, we will still update the rooms to show the new names. But same VPN profile and same steps

[trim ginkgo]

Connecting through Attackbox still does not work, not even with the tryconnectme and regenerating the vpn script with server breaching_ad_v2.

[dense cedar]

Please share more detailed output from running the script and from the log file it asks you to provide output from for more help. We have tested it several times and were working, so having more output helps understand what the potential issue could be

[trim ginkgo]

2025-10-24 17:50:43 OPTIONS IMPORT: timers and/or timeouts modified
2025-10-24 17:50:43 OPTIONS IMPORT: --ifconfig/up options modified
2025-10-24 17:50:43 OPTIONS IMPORT: route options modified
2025-10-24 17:50:43 OPTIONS IMPORT: route-related options modified
2025-10-24 17:50:43 OPTIONS IMPORT: peer-id set
2025-10-24 17:50:43 Using peer cipher 'AES-256-CBC'
2025-10-24 17:50:43 net_route_v4_best_gw query: dst 0.0.0.0
2025-10-24 17:50:43 net_route_v4_best_gw result: via 10.10.0.1 dev ens5
2025-10-24 17:50:43 ROUTE_GATEWAY 10.10.0.1/255.255.0.0 IFACE=ens5 HWADDR=02:8b:c5:31:34:c9
2025-10-24 17:50:43 TUN/TAP device breachad opened
2025-10-24 17:50:43 net_iface_mtu_set: mtu 1500 for breachad
2025-10-24 17:50:43 net_iface_up: set breachad up
2025-10-24 17:50:43 net_addr_v4_add: 10.50.79.20/26 dev breachad
2025-10-24 17:50:43 net_route_v4_add: 10.200.80.0/24 via 10.50.79.1 dev [NULL] table 0 metric 1000
2025-10-24 17:50:43 Data Channel: using negotiated cipher 'AES-256-CBC'
2025-10-24 17:50:43 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2025-10-24 17:50:43 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
2025-10-24 17:50:43 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2025-10-24 17:50:43 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
2025-10-24 17:50:43 Initialization Sequence Completed
2025-10-24 18:00:21 event_wait : Interrupted system call (fd=-1,code=4)
2025-10-24 18:00:21 SIGTERM received, sending exit notification to peer
2025-10-24 18:00:24 net_route_v4_del: 10.200.80.0/24 via 10.50.79.1 dev [NULL] table 0 metric 1000
2025-10-24 18:00:24 Closing TUN/TAP interface
2025-10-24 18:00:24 net_addr_v4_del: 10.50.79.20 dev breachad
2025-10-24 18:00:24 SIGTERM[soft,exit-with-notification] received, process exiting

[dense cedar]

That SIGTERM received.

The only reason to get that line is the VPN server is forcefully disconnecting you. The only reason that can happen for is the VPN profile is running at more than one location at the same time.

Are you perhaps running both the Attackbox and your VPN profile somewhere else at the same time?

If not, can you run ps aux | grep "openvpn" on the AttackBox and sent the output?

[warm narwhal]

Thank you. I appreciate it

[slate swan]

Gave +1 Rep to @dense cedar (current: #33 - 335)

[trim ginkgo]

Hi, thanks for the response, I can assure I do not use VPN connection (not it is used elsewhere) when I use Attackbox (I am aware since I am facing this problem from a long time now). I am posting the text output here (new connection, same problem, thus sending only ps aux | grep "openvpn"), as I cannot upload: root@ip-10-10-142-120:~# ps aux | grep "openvpn"
root 4719 0.0 0.1 7680 5448 ? Ss 15:13 0:00 openvpn --config /root/Desktop/NetworkConfigs/breachingad.ovpn --daemon --log /root/Desktop/NetworkConfigs/logs/breachingad.log
root 6150 0.0 0.0 9044 720 pts/0 S+ 15:16 0:00 grep --color=auto openvpn

[slate swan]

Gave +1 Rep to @dense cedar (current: #33 - 337)

[dense cedar]

Sorry, was away yesterday. Can you send the output from that log file as well? At the same time? Reason I ask is that if the openvpn command did a SIGTERM, then it should not be running anymore, but here you can see that it is actually still running, so something is going on.

Also, can you just make sure that:

• The network is running
• You regen your VPN profile. Also send me your VPN profile via DM

[trim ginkgo]

OMG! It is now working from Attackbox. Many thanks for your responses and troubleshooting

[slate swan]

Gave +1 Rep to @dense cedar (current: #33 - 338)

[upbeat juniper]

for me the room it is not working i can't even ping THMDC, what am I missing? I also tried openvpn but with the same result

[woeful sail]

troubleshoot by running tryconnectme
also, check the latest from this: #breaching-ad message

[upbeat juniper]

I dont now what is mean by that

[upbeat juniper]

tahnk you, but i want to connect via attackbox not openvpn, and it was the same result, no ping possible

[woeful sail]

enter breaching_ad_v2 at the prompt where it requests the OVPN connection: tryconnectmejust wants a name

[woeful sail]

sorry: I made a correction from breach_ad_v2 to breaching_ad_v2 🙃

[upbeat juniper]

it is breachingad i thing

how can i regenerate my profile? i am not sure

[woeful sail]

use my screenshot earlier: #breaching-ad message, where you can see the regenerate button just on the right of the largest red rectangle

[upbeat juniper]

wow finally i made it 😄 hopefuly i will be lucky with DNS too, thank you 🙂

[woeful sail]

🥳 🥳 🥳 🥳 🥳

[upbeat juniper]

hm but now before i finish room, attack box crash and i had to reconnect it, and now it is no working again, and the steps before didnt help 🙁

[woeful sail]

that text file is from THM AttackBox?

[upbeat juniper]

yes this is logs from /root/Desktop/NetworkConfigs/logs/breaching_ad_v2.log

[woeful sail]

do killall openvpn

[upbeat juniper]

ok i did but at the access page it still seems connected

[woeful sail]

refresh?

[upbeat juniper]

still

[woeful sail]

that page has been reported as unreliable for a long time, but I thought it was OK by now
I would rather trust ip a: if you have a breachad network adapter with an IP, you are connected, otherwise you are not

[upbeat juniper]

it is very short time for me when attack box is working 😄 only 20 minutes now 🙁 and i have to start from scratch again

[woeful sail]

what is your Server Region under Profile > Manage Account > Account Details?
do not confuse it with Access via OpenVPN though

[woeful sail]

you can try to switch to US-East to see whether you have a better experience
no guarantee though 🙃

[upbeat juniper]

hm just 5 minutes now 😄 ok i will leave it

[restive creek]

Hey everyone, I've been trying to get this room to work for weeks and I'm pretty certain at this point the reason why I'm having so much trouble is because I am making a silly mistake.

Well I can't share screenshots but this is what I've been doing. For reference, I am using the attackbox:

sed -i '1s|^|nameserver 10.200.70.101\n|' /etc/resolv-dnsmasq
systemctl restart dnsmasq
nslookup thmdc.za.tryhackme.com

Error:

;; communications error to ::1#53: timed out
;; communications error to ::1#53: timed out
Server: ::1
Address: ::1#53

** server can't find thmdc.za.tryhackme.com: NXDOMAIN

The THMDC IP address is 10.200.70.101. Am I making an obvious mistake?

[unkempt wren]

How to Verify as a Student Without a Student Email

Article Link

https://help.tryhackme.com/en/articles/10617468-how-to-verify-as-a-student-without-a-student-email

Oct 30, 2025, 1:05 PM

[dense cedar]

You need to verify your account first before you can share screenshots.

You need to provide more info as well:

• Are you using the Attackbox or your own machine?
• If the Attackbox, have you used tryconnectme to debug what is happening?
• Can you ping the domain controller?

[restive creek]

That’s strange. I have my email and phone number verified

• Using the attack box
• Tried debugging with tryconnectme but will attempt again so I can get the specific messages
• I cannot ping THMDC (10.200.70.101)

[dense cedar]

On TryHackMe, go get your discord token and use /verify to verify your token

[dense cedar]

If you cannot even ping the DC, then the VPN profile isn't active or the network itself isn't active. tryconnectme will give you the steps required

[restive creek]

Ah, I thought that the attackbox automatically connected to the VPN profile if launched in the room?

[restive creek]

Yeah, the OpenVPN profile itself is not connected. I've refreshed the configuration file for breaching_ad_v2 and restarted the attackbox

Wait is the nameserver supposed to be the name of the Network VPN server?

Welp it's working now. Not 100% sure what fixed it but I'll take it!

Thanks for your help

[dense cedar]

It does automatically connect you. But sometimes something can go wrong (you leave the room and rejoin but don't regenerate your VPN profile), tryconnectme helps to figure out where in the process something is going wrong.

The "automatic" connection of the Attackbox is nothing more than the system automatically downloading your OVPN profile from your account and running it 😅

[dense cedar]

Glad you got it working!

[restive creek]

Ah, okay! I tend to do rooms in increments instead of in one sitting so that is likely what happened

[blissful geyser]

Hey, I just tried to start this room with a web based attack box, but sadly when I try to ping the THMDC.za.tryhackme.com host it doesnt work.

Also I ran tryconnect me, so I am not sure if I should paste the logs here.
Any help would be much appreciated

Never mind, it seems to work now

[worthy sedge]

i tried to run the password sprayer from my kali VM and it says there's no module named requests_ntlm

i reinstalled it several times and rolled back to version 0.0.3 like suggested on https://stackoverflow.com/questions/27660034/python-requests-ntlm-import-error but it still won't work

[white jacinth]

Hello
I'm trying to go thru the configuration of the Rogue LDAP server, but I cannot get it to only accept PLAIN LOGIN mechanisms
(looks like i cant post screenshots here)

[white jacinth]

have you tried python3 instead of just 'python' in the command

[worthy sedge]

yes

same error

[woeful sail]

can you screenshot:

• the connection back on your Netcat LDAP listener when you do nc -lvp 389?
• cat olcSaslSecProps.ldif?
  in order to uplood screenshots, you first have to verify your THM account with Discord, using the instructions coming the link below

[unkempt wren]

@worthy sedge

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Nov 7, 2025, 10:18 PM

[worthy sedge]

i tried creating a venv and running it from there but i still get the exact same issue

including installing it and it saying it's already installed

actually, i ran the same script from the downloads folder i was using before. i feel like i should move it to the folder it created when i created teh venv, but where do i even find it?

oh i found it

the w3 page says it should include a folder called Scripts but it's not here so i'm gonna create one

i'm still getting the exact same issue

how am i even supposed to use venvs

all i did was set up the default kali linux VM and go straight into tryhackme

normalizer (symlink missing or pointing to unexpected location)
this line worries me a little

i tried to log into discord on my VM and the VM completely froze

restarted the VM and it made me do two captchas in a row and booted me back to the beginning

using pip instead of pipx within the venv installed requests

as well as requests_ntlm and the script ran

[worthy sedge]

i think i skipped a few steps when i started this room, i'm in a little over my head

[hollow rampart]

Hi, I'm tring to have the network working for a few days, and it never works 🙁 I cannot have the ip subnet accessible, from the Attackbox or from my own machine with the specific openvpn configuration. Do you have any hint to help me ? Thx

[dense cedar]

Verify your THM discord profile using /verify so you can send screenshots. Then, make sure you are ONLY using either the AttackBox or the VPN profile. Never use both at the same time. Then, using the Attackbox, run tryconnectme and provide the results here

[hollow rampart]

Thanks for your tips. I've followed all the steps with the tryconnectme command, and now the VPN is up and running in the Attackbox! Definitely, this tool should be more advertised 🙂

[slate swan]

Gave +1 Rep to @dense cedar (current: #33 - 343)

[dense cedar]

Happy to help. We are revamping the AD content. So haven't really updated the old networks. Should hopefully be resolved with the updates we are pushing.

[hollow rampart]

Should I then wait for new/updated rooms on AD ? Maybe the revamped version will be more interesting for me? Wdyt?

[dense cedar]

I'd do these still, they are pretty decent, and the revamp will take a couple of months. The content here is still relevant to get you started

[pale parrot]

hello, i am having trouble to connect to the breachingad vpn

[woeful sail]

check this: #breaching-ad message

[heavy inlet]

question: should we use breaching_ad_v2 or breachingad.ovpn

Help, i still cannot ping THMDC after following all the debugging steps from tryconnectme, here is my log:

[dense cedar]

Have you tried to regenerate your VPN profile?

And it should be the v2 profile

[heavy inlet]

work now thanks!

Is my configuration correct? Reason is the site mentions that :

"Finally, run nslookup tryhackme.com - If you now get a different response than the one in step three, it means there is something wrong with your DNS configuration. Go back to the configuration steps at the start of the task and follow them again. A common issue seen on Kali is that the DNS entry is placed as the second one in your /etc/resolv.conf file. By making it the first entry, it will resolve the issue."

But as you can see from my screenshot that my nslookup tryhackme.com is different versus nslookup za.tryhackme.com <THM DC IP>

[lyric musk]

Niether me nor my students can connect to the breaching_ad_v2 VPN (to work on the Breaching Active Directory room). Can someone verify if there's a technical problem on THM's side or if everything is fine??

[woeful sail]

if you are using THM AttackBox, use tryconnectme for troubleshooting
also:

• personally , I have not used that network in the past days, but I have interacted with other users who could connect to the network
• I suggest you review the recent messages of this channel till Oct 30, concentrating on the messages by Am03baM4n

[spice breach]

Jesus…. This room scarred me but I learnt a LOOOT about AD. Took me 3 days to complete

[slender talon]

Hello the community !!! I can't do the room because I'm facing a network error. No possibility to ping the servers ... I have no specific configuration, I'm only using the AttackBox machine. But once network has been starting and attackbox too ... no ping succeeded. Then no needs to go farest ... network does not work. Someone could help please ? I'd like so much complete this room. Thank you very much by advance !!!

root@ip-10-80-72-114:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
link/ether 0a:30:8d:9d:77:19 brd ff:ff:ff:ff:ff:ff
altname enp0s5
inet 10.80.72.114/18 metric 100 brd 10.80.127.255 scope global dynamic ens5
valid_lft 3556sec preferred_lft 3556sec
inet6 fe80::830:8dff:fe9d:7719/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:99:d1:5f:9c brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:99ff:fed1:5f9c/64 scope link
valid_lft forever preferred_lft forever

5: veth2546fe7@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether a6:67:e8:e2:90:cc brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet6 fe80::a467:e8ff:fee2:90cc/64 scope link
valid_lft forever preferred_lft forever
7: veth88f62df@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether ba:96:74:be:64:05 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::b896:74ff:febe:6405/64 scope link
valid_lft forever preferred_lft forever
8: breachad: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.50.94.11/26 scope global breachad
valid_lft forever preferred_lft forever
inet6 fe80::1f7:5176:71e9:cb2d/64 scope link stable-privacy
valid_lft forever preferred_lft forever
root@ip-10-80-72-114:~# ping 10.200.70.101
PING 10.200.70.101 (10.200.70.101) 56(84) bytes of data.

[leaden fable]

I have the same problem

[slender talon]

Hum, I assume that this is not possible now to use the AttackBox for completing this room ... will try with a VPN from my home. I'm a little bit disappointed about the lack of support on this ... 🙁

[plush pond]

attackbox wont work

it just wont ping

the DC

[plush pond]

yup same problem

[plush pond]

did it work?

[woeful sail]

@plush pond @slender talon @leaden fable when using THM AttackBox, do troubleshooting with tryconnectme

[leaden fable]

Thank you very much, that did indeed fix the problem. 🎉

[slate swan]

Gave +1 Rep to @woeful sail (current: #8 - 1122)

[leaden fable]

Have a nice day 😁

[plush pond]

🔥

[plush pond]

ty

[slate swan]

Gave +1 Rep to @woeful sail (current: #8 - 1123)

[plush pond]

i cant get the printer to connect back to me

my ip is in the 10.50.x.x subnet breachad interface

🤷‍♂️

[digital plover]

Hi All
I am unable to ping THMDC itself.. Struck in the first step itself.. Iam using Room's attackbox..
Plese help..

[woeful sail]

maybe this helps: #breaching-ad message

[bleak marsh]

For the Breaching AD environment. I am showing it as paused right now, when I go to Start it back up, it redirects to the 500 error page. Anything else I could try here?

[plush pond]

still having this issue

[gritty hornet]

I tried this and tried connecting via my own machine (thru ovpn) and I'm still unable to reach the DC IP

[woeful sail]

are you getting a breachad interface after running openvpn?

[gritty hornet]

Yes I am.

[gritty hornet]

And it still cant reach the DCIP and I am still unable to resolve its domain name

[woeful sail]

please screenshot ip a and ip route

[woeful sail]

you seem to have output similar to mine
and you cannot ping 10.200.70.101 right? I mean, literally that IP address?

[gritty hornet]

yup. I can't

[woeful sail]

for the VPN, you used the v2 file, right?

[gritty hornet]

yes, I am using the v2 ovpn file

[woeful sail]

is the Breaching AD network running?

[woeful sail]

I mean, the Start button is greyed out, as per screenshot?

[gritty hornet]

Yes it is running

For some odd reason, I can now ping the IP address, but nslookup is still unable to resolve the dns lol

[woeful sail]

the odd thing for me also is that your network topoloy looks different to mine

[woeful sail]

for the DNS, I would run again sudo systemctl restart NetworkManager

[gritty hornet]

I tried this multiple times already and it didn't work

[woeful sail]

please share /etc/resolv.conf

[@gritty hornet back in 30-45 minutes :up]

[gritty hornet]

I think i got it working now lol. Whenever I run this command, sudo systemctl restart NetworkManager it removes the nameserver IP i add to the resolv.conf file. Also, I was having the hunch the IP addresses in this conf file has to be in a certain order? I used to put the THM DC IP address after the 192 IP address

[gritty hornet]

Anyway, thanks for your help! 😄

[frank pond]

hey guys! when i go to the access page at https://tryhackme.com/access there are no servers listed in the network tab, i cant download the VPN conf file...
What's up with this ?

[woeful sail]

you first need to join the room, and possibly refresh the access page

[plush pond]

.

this issue doesnt exist on other networks similar to it

i would like to keep learning AD but this is borderline unusable

the vms randomly freeze and they're highly reliant upon the trust that previous people did not destroy anything

[frank pond]

still nothing... ;/

[woeful sail]

then use the Options button to leave the room and join again a few minutes later

[woeful sail]

you are a subscriber, right?

[frank pond]

yes, i am

[plush pond]

does anyone get an ldap error when trying to downgrade the ldap thing

Authentication method not supported (7)

[woeful sail]

screennshot shows what I have
did leave/join improve? can you download the VPN file for normal machines?
also:

• once you joined the network, start the network with the green button before you try to download the VPN file
• good precaution: disable all browser extensions, clear browser cache and refresh the page too Possibly, switch to another browser

[hearty bridge]

Hi everybody , i'm trying "to get the password from the ma.db", i have installed "pycryptodome" lib but i get this error everytime i use the script "from Cryptodome.Cipher import DES3
ModuleNotFoundError: No module named 'Cryptodome'"

[deft narwhal]

hi im try to do ldap task but the websiters doesnt load any idea why i can ping the dc and nslookup the name server to the ntlm task but not ldap ?

[peak sentinel]

is the import spelt correctly ?

[nova vortex]

Hi, paying well for a few hour job to write a script, someone who knows how to use fiddler or burp cuz also we will need to intercept, ill explain more in private, if anyones interested shoot me a dm 🙂

[south summit]

This page for me has nothing in the dropdown, even after leaving and rejoining

[woeful sail]

Is the network running? I suggest you refresh the web page for the network and confim that there is an uptime value at the bottom right of the topology

[south summit]

There was, 16 hours, this was after restarting browsers and trying different browsers as well to verify it wasn't just Firefox acting up as per DKob's input

[woeful sail]

I do not know that the issue is, however I have done live troubleshooting with other users who, it seems, had to wait a little bit for the v2 file to come up I do not have a specific reference but you can check here (#wreath-network message) another user who had that experience for the v2 VPN file of the Wreath network (go back the message chain if you want, which shows how confusing it can be)
BTW are you using THM Attackbox or your own VM like Kali for this? THM Attackbox maybe the prefererred way at first, although I have found that the tryconnectme troubleshooting script has been failing with me for a couple of weeks Also, do not use both THM AttackBox and THM VPN at the same time
additional suggestions:

• do not do high-speed clicking with whatever VPN-related: give seconds-minutes for the system to settle
• when checking for the VPN file in the drop-down menu, do a hard refresh (Ctrl-F5) of the web page (instead of using the refresh button further above); same as earlier when checking for the uptime of the network topology
• check another network, like "Enumerating Active Directory" or "Persisting Active Directory" (https://tryhackme.com/room/adenumeration or https://tryhackme.com/room/persistingad): it would be interesting to see whether you are getting the right VPN file listed in the drop-down menu for these networks
• I guess you are not using browser extensions when troubleshooting this

[glad yacht]

@night dock Please slow down. Further spam will result in a short timeout.

[cursive pendant]

The instructions on Task 1 state "If you are using the Web-based AttackBox, you will be connected to the network automatically if you start the AttackBox from the room's page. You can verify this by running the ping command against the IP of the THMDC.za.tryhackme.com host." But when I run ping 10.200.70.101 within the attack box it is unable to reach it. Anyone know why this would be happening?

Also when I try on my own kali vm I get this:

sudo openvpn breaching_ad_v2.ovpn 
sudo: unable to resolve host ip-10-67-68-27: Name or service not known
2026-03-09 00:49:51 Note: --cipher is not set. OpenVPN versions before 2.5 defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
2026-03-09 00:49:51 OpenVPN 2.6.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
2026-03-09 00:49:51 library versions: OpenSSL 1.1.1f  31 Mar 2020, LZO 2.10
2026-03-09 00:49:51 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2026-03-09 00:49:51 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2026-03-09 00:49:51 TCP/UDP: Preserving recently used remote address: [AF_INET]54.228.134.173:1194
2026-03-09 00:49:51 Socket Buffers: R=[212992->212992] S=[212992->212992]
2026-03-09 00:49:51 UDPv4 link local: (not bound)
2026-03-09 00:49:51 UDPv4 link remote: [AF_INET]54.228.134.173:1194
2026-03-09 00:49:51 TLS: Initial packet from [AF_INET]54.228.134.173:1194, sid=41c97f45 3508695d
2026-03-09 00:49:51 VERIFY OK: depth=1, CN=ChangeMe
2026-03-09 00:49:51 VERIFY KU OK
2026-03-09 00:49:51 Validating certificate extended key usage
2026-03-09 00:49:51 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2026-03-09 00:49:51 VERIFY EKU OK
2026-03-09 00:49:51 VERIFY OK: depth=0, CN=server

[queen mist]

Can anyone help in resetting the network im unable to download the bcd file using tftp

[rough panther]

في عرب؟

[agile crystal]

Did you make it work?

[paper anvil]

hello, i am having an issue while trying to connect on breaching-ad network vpn.

i have both tried to connect to it using my in-browser kali box, but dns not replying, and tried to use openvpn but it stucks while trying to connect.

any ideas?

i think it's fixed now

[naive pebble]

Hi,

I am having issue connecting with the AD network

[naive pebble]

Paying the price of permium subscription and this kind of access issue is unexpected

I won't be renewing my subscription with THM

[young gorge]

hi

[upbeat juniper]

hi can you help me anybody with ldap downgrading in ldap pass-back attack? it still supports many methods 🙁 I dont know what am I doing wrong

[idle ginkgo]

Yeah

[rough panther]

good

[charred sandal]

https://tryhackme.com/room/breachingad 👋

@dense cedar 👋

[dense cedar]

Will answer support questions here 🙂

[drifting rain]

Shouldn't this go under the networks category?

[paper laurel]

So uhm, all credential pairs is valid?

[wooden minnow]

use crackmapexec to verify the passwords.

[dense cedar]

You are using the IP, not the hostname, which means it resolves to the default website that gives a 200 OK, fooling your brute forcer into thinking the credentials are valid

[paper laurel]

ahhh

[dense cedar]

This is why you need DNS, 10.200.4.201 is hosting three different websites using virtual hosting, only one of those support NTLM authentication

[paper laurel]

Now it works

the dns can't find za.tryhackme.com even though I have changed it to said DNS, but if I just change the ip into hostname via /etc/hosts it works

[dense cedar]

Are you using the AttackBox or your own machine? If you are using your own machine, you need to alter whatever is doing DNS on your machine. That may be systemd-resolv, but could also be Network Manager or even something else. So if you follow the exact steps in your own machine, that may not solve DNS for you.

Safest way to verify DNS is to embed it directly in the /etc/resolv.conf file, but most network managers overwrite that file so it is not persistent

[paper laurel]

yup, I am using my own machine and has changed /etc/resolv.conf file

[charred sandal]

Good point - yes - can you move it please?

[dense cedar]

What is your current /etc/resolv.conf file contents?

[paper laurel]

nvm, a second reset of systemd-resolved fixed the problem

gosh dam DNS

[dense cedar]

DNS is a massive pain, but since kerberos uses hostnames and not IPs, you just have to grind your teeth and get through it. No different on assesments though

[paper laurel]

yeah, good thing I have some hard candy to grind my teeth on instead 😛

[wooden minnow]

Lol, mine won't work 😂

[jovial nacelle]

I can't download Breachingadbovpn file. On Access - Machines my connection status is shown in green but not on the Networks side. If I click to download breachad file I get an 404 error. Any suggestions?

[dense cedar]

@charred sandal can you maybe check this one please?

[wooden minnow]

Is this right?

[drifting rain]

Should be good now

[dense cedar]

<THM DC> Should be your actual DC IP

[wooden minnow]

D'oh!

[dense cedar]

Look at your network diagram for the IP to your DC

[wooden minnow]

Top one?

[dense cedar]

Indeed, one that says THMDC.za.tryhackme.com

[wooden minnow]

Still can't find it 😂

Oh, not a good night for me.

[paper laurel]

should look like this

[wooden minnow]

Yup.

That's the one I have.

[paper laurel]

that's the ip you'll put in

[dense cedar]

My bad, forgot we removed the actual FQDN and just named it THMDC

[wooden minnow]

The one I have. 🙂

[dense cedar]

Yeah, if you add that and reboot the service twice should start to get DNS resolution

[wooden minnow]

Still nothing.

Infact

My issue could be the VPN

It's constantly restarting.

[neon lichen]

is anyone else getting. Uh-oh, this page has been lost in the matrix. when you try to download the VPN file for the new network. After

1. regenerate vpn key again
2. log out and back in
3. use a browser with no add block enabled
4. use a browser without add block on windows instead

[dense cedar]

Yeah, if the VPN is not stable, DNS won't be either.

Are you perhaps running the VPN in two different locations? That might cause the constant reboot

[wooden minnow]

No, just the one.

[dense cedar]

What is your assigned subnet? I'll need @charred sandal to just take a look at this. It may be the VPN server in your network

[dense cedar]

Not running the AttackBox as well right? Since that loads the VPN profile automatically?

[wooden minnow]

Nah, 🙂

[dense cedar]

I'm running out of ideas. Have you tried turning the machine on and off again? 😂 Otherwise might have to regen your VPN profile

[neon lichen]

10.200.24.0/24

[wooden minnow]

I'll give that a bash later tonight. 🙂

[dense cedar]

The team is looking into the VPN servers, just give them a bit to fix it

[chrome sentinel]

Why I have only 3 days to use this room?

[dense cedar]

This is to ensure that inactive users are removed freeing up some of the networks. You will be automatically removed from the room after three days, but can just rejoin again then

[chrome sentinel]

Makes sense, thanks

[dense cedar]

Says file not found, just do a dir and confirm the filename

[paper laurel]

it was the correct filename, ps just wanted .\ in front 😄

when you have to debug code

[dense cedar]

Then chances are good you are doing something wrong...

[paper laurel]

I don't have crypto installed on my VM and crypto can't be installed for some reason 😄

[wooden minnow]

I still can't even do the dns 😂

[dense cedar]

Ah yes, the lovely old mcafee password decrypt script that only works in Python2. That's why I have a VM just for that script 😂

[paper laurel]

gib vm

don't I'll just open up attackbox

[dense cedar]

Lol, almost like you can read my mind guessing what I was going to say

[paper laurel]

I have dealt with @dark carbon a lot, so I know how to read minds now

[dense cedar]

Looks good, did you reboot the service? Also, what is currently in your /etc/resolv.conf file while we are at it?

[wooden minnow]

I rebooted the service and the machine

[paper laurel]

what about /etc/resolv.conf?

[wooden minnow]

Blank

[dense cedar]

Run nslookup za.tryhackme.com for me please, want to see where it is trying to do the resolution

Also has your VPN issue cleared up? Or is it still trying to reconnection constantly?

[wooden minnow]

I regen'd it and it's fine now

[dense cedar]

Yeah, that is not the 10.200.4.101 IP, meaning something else is controlling DNS there

[paper laurel]

nice room

@dense cedar thx for the support and a nice network

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Okay, let's try to add the entry to /etc/resolv.conf - nameserver 10.200.4.101 and then run the nslookup again and see what happens. If that doesn't work, need to find whatever is controlling DNS on your machine

[ebon crescent]

In task 5 I've been waiting for 30 min for responder to intercept a request still no request (using attackbox)

[dense cedar]

Issue should be resolved now, can you please regenerate your VPN file and test?

Issue should be resolved now, can you please regenerate your VPN file and try again?

[wooden minnow]

I got it.

[wooden minnow]

Thanks!

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

What is your tunnel IP and specific subnet? Just so I can check what is happening

[ebon crescent]

send message to you and thanks

[slate swan]

Gave +1 Rep to @dense cedar

Gave +1 Rep to @dense cedar

[wicked obsidian]

same

[wicked obsidian]

Network is 10.200.27.0/24

[dense cedar]

Let me ask the team to check it. This is the one thing I can't fix

[dense cedar]

Should be fixed now if you regen your VPN file

[wicked obsidian]

Thanks, it worked 🙂

[slate swan]

Gave +1 Rep to @dense cedar

[frozen sable]

in the breachingAD room I can't get the DNS to resolve even after adding the DC's IP Address to my /etc/systemd/resolved.conf and running systemctl restart systemd-resolved (x2) or completely rebooting my vm. when i run nslookup thmdc.za.tryhackme.com I get my default gateways IP. Is there any other way to run the configuration besides changing my nameserver in /etc/resolv.conf or changing the default route? It seems I won't be able to access the internet that way. @dense cedar

[glacial yew]

i'm in the same boat

[dense cedar]

If you are using your own VM, I can't really do a lot to help with regards to the DNS, since I won't be sure what is setting DNS for your VM.

However, what you can do is basically hardcode the IPs in your /etc/hosts file. So for every DNS entry that will be used, just make a new entry:

<IP> <Hostname>

[glacial yew]

I'm using the attackbox

[frozen sable]

Yea I figured that could potentially be a work-around but wasn't sure. I added it to /etc/hosts as well but it also happened on the attackbox for me.

[dense cedar]

If you are using the attackbox, DNS should work with the provided steps. Can you ping the DC?

[frozen sable]

I can ping the DC on both the vm and attackbox

[glacial yew]

yes

[dense cedar]

On the attackbox it should not happen.

[frozen sable]

Let me try it again I'll let you know

[glacial yew]

hmmm, no it pings out, no packets back

[dense cedar]

Yeah that's your issue, your VPN profile may only be active on one machine at any given time. Running the VPN profile in both VM and attackbox means they are fighting, causing the VPN to reboot constantly

[dense cedar]

Then chances are your VPN did not connect in the attackbox. Run ifconfig to see if you have any adapters? Also just confirm the network is actually started and active?

[frozen sable]

actually no I can't ping from the attackbox only from my vm

[dense cedar]

You can't have the VPN active in both your VM and the attackbox. It causes a reset of the VPN constantly on both.

[glacial yew]

I'll restart the box 1 mo. I haven't used my own VM today so I know there's no conflict for me there

[dense cedar]

AttackBox automatically pulls and runs the VPN profile for the network for you. So just something to note if you want to switch to your own machine, make sure to terminate the attackbox first

[glacial yew]

there is a script you can run to ensure there's no clashes also. James sent it to me before

still no ping reply i'm afraid

[dense cedar]

What's your subnet?

[glacial yew]

pm'd

[tender flame]

Thank you for the suggestion. I was struggling with the DNS

[slate swan]

Gave +1 Rep to @brave niche

[old otter]

i can't access

[wooden minnow]

#breaching-ad message

[unique mist]

Might need to pin this.

[prisma thorn]

I’m trying the ntlm_passwordspray.py script and inputting all the right switches. But it’s resulting in so many errors that I don’t know where to start

It’s mentioning Failed to establish a new connection. Name or service not known. As well as a BUNCH of other errors on different lines

[hasty hinge]

Try ping to ..*.101, if no response, try to check your vpn connection

[shy flint]

for task 5 how long we need to wait till it hits our responder?

[prisma thorn]

I can get a response from pinging

But nslookup doesn’t work

I’m using THM attack box, am I supposed to be making ANY changes to my config? DNS, etc/hosts?

[shy flint]

you need to change dns as showed in taks 1

[hasty hinge]

are you setting DNS server?

[prisma thorn]

F*ck that worked. What’s wrong with my brain?

It’s literally described in task 1

[neon lichen]

done and time to go to bed

[unborn mountain]

Not sure if they're still looking into vpn download issues, but just wanted to mention I'm not able to download the ovpn file for the network/getting the 404 error as well, subnet is 10.200.52.0/24

[rigid wasp]

when I run the command "sudo responder -I tun0" for some reason it reset the dns and I have to enter the command "systemctl restart systemd-resolved" on the attackBox again

for nslookup to resolve the hostnames

[shy flint]

are you able to retrive the hash?

[rigid wasp]

no i have not been able to retrive the hash?

on task 5

i have waited over an hour

[shy flint]

i stoped responder after 30 min

i guess i will have to wait

thank you

[prisma thorn]

On the AttackBox, can someone please check to see if they have either of these IPs 10.50.x.x or 10.51.x.x IP. I only have a 10.10.x.x. I'm also connecting using the room to access the AttackBox.
Thanks,

[rigid wasp]

the interface tun0 or tun1 should be ip you are looking for if you enter "ip a"

[prisma thorn]

@rigid wasp that is what I thought, it is not present. I terminated the machine x2 no luck.

[rigid wasp]

try to ping THMDC.za.tryhackme.com

[prisma thorn]

yes, I tried that too and no luck. Going to restart one more time and call it a day and try tomorrow.

[rigid wasp]

or rejoin the the room

[prisma thorn]

That I have not done, but will try. thanks again for the help. Also, could not download the VPN files, something seems wrong there as well.

Third time, no luck. I'll try again tomorrow. At least of someone is having the same problems, they will see these messages.

[dense cedar]

Can you please send me your subnet and VPN IP so I can quickly investigate what is happening there?

[dense cedar]

Can you please send me your subnet and VPN IP so I can quickly investigate what is happening there?

[dense cedar]

If your VPN is not connecting and you cannot download the VPN file since it gives you a 404, please send me your subnet so we can look into the issue

[rigid wasp]

@dense cedar i have dm you the subnet and vpn ip info

[prisma thorn]

I did what Lassi had mentioned above and nslookup still doesn't seem to work (I'm using kali in my own vm, not the attackbox... my friend is trying the attackbox and nslookup doesn't work there either)

[dense cedar]

Can you ping the DC?

[prisma thorn]

Yup, I can ping the DC, the iis site, but browser doesn't resolve ntlmauth

But I was able to ping them without having to add the additional ip in network manager (so while icmp works, dns resolution doesnt)

[dense cedar]

ICMP works by default. DNS needs configuration. I just want to make sure the network is actually live.

[prisma thorn]

Ah ok :) :)

[dense cedar]

Perform an nslookup for za.tryhackme.com

What resolving server does it use?

[prisma thorn]

Name: za.tryhackme.com
Address: 10.200.54.101

[dense cedar]

Can you send me the full output? Cause that looks like DNS is working?

[prisma thorn]

Yup, lemmie install discord on my pc, one sec :)

[dense cedar]

Try nslookup thmiis.za.tryhackme.com?

[prisma thorn]

awe i cant post screenshots, but maybe itll work now

its resolving now, when it wasnt before

[dense cedar]

🤷‍♂️

Glad it got sorted

[prisma thorn]

and password spray python script is working 😄

Am03, can y'all reach out to the creator of this room and have them add the comments about Network Manager and such if using kali for personal vm?

[dense cedar]

I'm the creator of the room.

We cater these rooms specifically for the attackbox, since we can't cater for every flavour of VM out there. But I'll see if I can add a small comment there about it

[prisma thorn]

definitely understandable 🙂 I just made the comment since a lot of people seem to either use Kali or Parrot for their attack vm

thats way cool ur the creator, loving the room thus far 😄 😄

[wooden minnow]

@tender flame Hi. please don't DM me without speaking first.

[ebon crescent]

anyone else getting this

PS C:\Users\thm\Documents\warm> Import-Module .\PowerPXE.ps1
PS C:\Users\thm\Documents\warm> $BCDFile = "conf.bcd"
PS C:\Users\thm\Documents\warm> Get-WimFile -bcdFile $BCDFile
>> Parse the BCD file: conf.bcd 
Invoke-CimMethod : Access denied  
At C:\Users\thm\Documents\warm\PowerPXE.ps1:1695 char:32
+ ...      $OpenStoreResult = Invoke-CimMethod @OpenStoreArg @CimMethodArgs     
+                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~     
    + CategoryInfo          : PermissionDenied: (ROOT/WMI:BcdStore:String) [In  
   voke-CimMethod], CimException
    + FullyQualifiedErrorId : HRESULT 0x80041003,Microsoft.Management.Infrastr  
   ucture.CimCmdlets.InvokeCimMethodCommand
 
Get-BCDStore : Unable to open BCD store. Likely reason: You do not have the  
required permissions to open the BCD store.
At C:\Users\thm\Documents\warm\PowerPXE.ps1:106 char:17
+     $BCDStore = Get-BCDStore -FilePath $bcdFile
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorExcep  
   tion
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorExceptio  
   n,Get-BCDStore

[dense cedar]

Documented this as a known issue. Will quickly fix this for your network and patch will be applied for all networks a bit later

[vestal sequoia]

Am i the only one not receiving the printer connection back?

ok, i am dump af

dumb*

[main urchin]

Hi guy. I need help. I a using my kali box I try to configure the rogue LDAP following the task descriptin.

[dense cedar]

For all users, we are currently aware of two issues in the network:

• Responder not capturing the challenge in the 15 minute timeframe
• PXEBoot permissions of the THM user is incorrect

We almost have a patch ready for both these issues, but if you experience them in the mean time, please just send me a message here and I'll apply the patch manually

[dense cedar]

Cat your ldif file and send the output here please

[dense cedar]

Empty newline at the start of the file should be removed

[main urchin]

ok let me try and back

[main urchin]

the output after remove the empty newline.

with the last command it thing something is wrong. but i dont know how to fix it

this is the output from tryhackme lab description.

[dense cedar]

Yeah if you get that output I don't think it applied correctly. But try to continue with the task and see what happens? I can sadly not debug this on your specific kali and ldap server version

You may have to restart with the config from scratch

[main urchin]

ok. I will try to restart config

tanks @dense cedar

[trim ledge]

I have the issue with pxeboot permissions. I'm happy to just wait for the patch though if the manual method is a pain.

[dense cedar]

Patch should be going out real soon still today. Will keep you posted else I'll fix manually

[trim ledge]

happy to wait for the patch. ty for the work on the room 🙂

[dense cedar]

Patch just went live. If you reset the network the patch should work 🙂

[trim ledge]

ty

[ripe hound]

remember when holo held a competition 👀 jk

[dense cedar]

Maybe submission of a report for all the AD rooms? 🤔

[wooden minnow]

I plan to write up my experience in these rooms.

But I won't release them, they'll be for my notes.

[main urchin]

same issue after reset all my config. I will try it later with the attackbox maby

[dense cedar]

Even with the issue, did you try to do the rest of the attack? Might just be an output issue but the config did take hold?

[jovial nacelle]

Today I still had the problem that I couldn't download the breachingadb.ovpn file where I got 404 error. Regenerating this file worked for me and after that, the download works.

[main urchin]

yes but cant get any output using this command sudo tcpdump -SX -i eth0 tcp port 389 i switch eth0 with tun0

[dense cedar]

What IP are you specifying on the website? Did the nc -lvp command work for you?

[main urchin]

nc -lvp command dit not work. by default by rogue Ldap turn with the 389 port

[main urchin]

On the web page i use my tun0 Ip 10.50.x.y

[dense cedar]

You can turn of the rogue ldap service and use nc first just to verify you are at least getting the callback

[dense cedar]

That one should work for you. If it doesn't then probably something wrong with the ldap server config

[tender lily]

same any solutions ?

[jovial nacelle]

Thanks!!! I was stuck with this step and now it works on my Kali box.

[slate swan]

Gave +1 Rep to @brave niche

[tender lily]

Thank you for this , issue resolved

[slate swan]

Gave +1 Rep to @brave niche

[main urchin]

I think same. With my ldapd stop nc -lvp 389 work and I get some output like on the lab description.

I try to reconfigure the ldap and try to continue the lab. @dense cedar thanks for your support and help. appreciate

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Perfect, that means the LDAP connection is working. So then it is the LDAP server config that is causing the issue. Best would be to use the attackbox then.

[main urchin]

ok good

[twilit crown]

I'm unable to download openvpn config file, is that temporary issue or i'm missing something?

[dense cedar]

Are you getting a 404 error? Have you tried regenerating the VPN config file

[twilit crown]

Yeah, getting 404 error. Tried couple times with regenerating a new vpn config file

[dense cedar]

What is your network subnet? I'll send it to the team to investigate

[twilit crown]

10.200.52.0/24

[dense cedar]

Sent to the team. It is the one issue I can't fix myself

[main urchin]

finaly work after reset, and reinstall ldap after purge all config file.

[unique mist]

It might be worth you leaving the room, wait a minute, rejoin it, then go back to the access page and try download again / regenerate and download again.

[dense cedar]

Should be fixed now. Just regen your config

[dense cedar]

We still have an active issue open on the network VPNs. Permanent fix for this will be applied end of the week. Seems like it is some miscomms between the VPN server and the THM website. If it happens, no amount of resets will get that VPN back.

[twilit crown]

Its working

[unique mist]

Fair enough, i was wondering if the leave and re-join would possibly assign a different subnet

[jovial nacelle]

I also have a Responder without results within 25 min. A manual patch would be appreciated. My responder gives errors on port 5986, 443, 389 and 53. If these ports are used in communication than perhaps this is the cause of not working.

[dense cedar]

Have you reset the network? Just checking since that is required for the patch to apply

[dense cedar]

You might hit it lucky, or you might get it even worse and just join a brand new network which would cause the exact same issue again. But 50/50 odds is better than nothing 🙂

[jovial nacelle]

No I didn't. I will reset now. Did restart Kali en latest version Responder but that didn't help.

[jovial nacelle]

I requested reset but 4 others need to ask this too in order for it to reset. But thanks for fast response and assistance! 👍

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Sorry about that, I can't do a manual reset of the networks but if you don't get the votes in an hour send me your subnet and I'll ask the team to see if they can do it

[rigid wasp]

@dense cedar can you patch my PXEBoot permissions of the THM user?

[jovial nacelle]

Still stuck at 2 of 6 votes for reset. If you could ask the team that would be nice. Does it also patch the pxeboot issue?

[dense cedar]

Give me your subnet pls

[dense cedar]

Quickly DM me your VPN file and I'll do the patch manually. Should fix both issues yes.

[rigid wasp]

@dense cedar 10.200.49.x

[dense cedar]

Fixed

[rigid wasp]

@dense cedar just so you know i can't cleanup directory I created because when i try to delete pxeboot.wim it give me the error "Access is denied."

[dense cedar]

All good, members should just perform as much cleanup as possible. Good practice for assessments 😉

There is a script that runs every 30 minutes and performs a full cleanup. Files are locked since the PXE boot image is mounted, so the script solves that.

[rigid wasp]

does it delete the directory i made?

or just the files inside it

cause i made that directory yesterday

[dense cedar]

It flushes the files that take the most space. You are technically extracting a full blown ISO on that host. It only has 60Gb of HDD space. If 30 users do that at the same time that HDD is going to get full quite quickly. So it flushes most of the large files and the things that you used to stage the attack (so others can't just use it)

Also only runs if the network has been active for longer than 60 minutes

[prisma thorn]

@dense cedar can you fix the pxeboot for me? 10.200.47.x

[dense cedar]

DM me your VPN file and I'll quickly fix it

[jade cypress]

Hello, i can't get responder to capture, is there something special to do ? (using attackbox)

(10.200.25.0)

[dense kelp]

has anyone manage to get kali accepting the olcSaslSecProps.ldif ? (task4)

[jovial nacelle]

I'm almost there. Using latest version of Kali with task 7 I get an error with python2 mcafee_sitelist_pwd_decrypt.py <SECRETPASSWORD>. File "mcafee_sitelist_pwd_decrypt.py", line 15, in <module> from Crypto.Cipher import DES3 ImportError: No module named Crypto.Cipher. Any suggestions how to fix this?

[dense cedar]

Patch was released earlier today. Please reset the network

[dense cedar]

Latest kali does not support the crypto lib you need. I have a vm just for running these outdated python2 scripts. Best is to quickly use the attackbox

[dense cedar]

Also DM me your vpn file if there isn't enough votes for a reset, then I'll do a quick manual patch

[somber ledge]

Uhhh

Let’s not edit/ send out your VPN files please

Oh wait

You’re staff, I’m so sorry

[dense cedar]

No worries 😂

[jovial nacelle]

Yes, it did work with my latest version of Kali. The ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms didn't display results but the reverse connection worked and credentials were sent.

[somber ledge]

The colour of your looks slightly lighter and I’m half blind 😆

[ivory ledge]

@dense cedar Can I get a manual patch as well? reset has been 3/6 for about an hour. Responder not working for attackbox or VPN.

[jovial nacelle]

Ok, I will switch to the Attackbox.

[dense cedar]

Sure, just send VPN file and your subnet. I'm calling it for the day in the next 30 min so let's get those patches in

[jade cypress]

iam using the attackbox, do you need subnet?

[dense cedar]

I need the external IP of your VPN to SSH into. Can you quickly go pull the VPN file via Profile -> Access? Then download VPN file there and quickly send it to me on DM

[jade cypress]

done 🙂

[ivory ledge]

Does anyone have info on the 3 days of access left for this room? Is this just a resources thing or a new THM subscription thing I missed?

Thank you!!

@brave niche @dense cedar = poggers

[dense kelp]

me too. @dense cedar, perhaps it should be more explicitly stated that you recommend using the attackbox?

[dense cedar]

I'll make a bold note about that quickly tomorrow 😉 But all THM-staff created rooms are created specifically with the AttackBox in mind

[jovial nacelle]

@dense cedar Little suggestion, in the text of Task 7 "it can be found in /root/rooms/BreachingAD/task7/ directory". You have "rooms" and it should be "Rooms". This avoids an error if people copy and paste your URL.

[dense cedar]

🤔 I was pretty sure I fixed that during the stress test. Might have forgotten to press the save button. Good catch thanks. I'll quickly change that

[slate swan]

Gave +1 Rep to @jovial nacelle

[dense cedar]

Fixed

[dense cedar]

Recommendation added

[jovial nacelle]

I have finished, @dense cedar thanks for the nice room and assistance with the patches. Great!!!

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Glad you liked it! 🙂

[jade cypress]

thanks @dense cedar it's working now 🙂

[slate swan]

Gave +1 Rep to @dense cedar

[sage spire]

hi all
ive modified my resvolved.conf file, restarted it and still cant seem to access sites in the network
any ideas?

[jade cypress]

Ok I just finished ! Thanks you for the room @dense cedar and for the patch 🙂

[slate swan]

Gave +1 Rep to @dense cedar

[delicate jay]

Could we put this in the room took me some time to figure this out may help others that are not in the discord

Great stuff 🙂 Will let you know of any bugs I find on my run though !

My bad I thought you was staff haha

[ornate maple]

responder not capturing anything ,passed since 20mins

[wild locust]

hmmm, using the Attack_Box, I modified the systemd/resolve.conf DNS entry with the Domain Controller IP , I then restarted the service but can't nslookup ?? Also, it clearly says the network config should be already working on the attackbox, however if I do a ip -c a there is no tun interface

[dense cedar]

Can you download your VPN file? Try to regen the VPN file and download. If that fails let me know then we need to apply a fix

[dense cedar]

Patch was applied yesterday. Can you reset the network? If you don't get sufficient votes send me your network subnet and VPN file and I'll do a manual reset

[wild locust]

im using the attackbox, shouldnt I be able to be connected to the network right away ?

[dense cedar]

We are adding a small extra section to explain this. The THM-Staff rooms are made for the AttackBox, so everything is stress tested using this. We can't cater for every type of VM out there, but agree for Kali should have something since this is a popular one

[dense cedar]

I'm trying to debug whether it is the known VPN issue or something else. Can you please follow the provided steps so I can debug the problem?

[wild locust]

I could regenerate the file and downloaded it rn

[dense cedar]

Okay so the download actually worked? Then it is not the VPN issue. Can you quickly terminate your AttackBox and DM me your VPN file so I can run a quick check?

[wild locust]

Sure, thanks

[dense cedar]

Got pushed to the room content this morning

[amber compass]

permission issue on task 6

[dense cedar]

Can you reset the network to apply the patch? if you don't have votes send me your VPN file and I'll do a manual patch

[amber compass]

its from yesterday, I just started fresh now today, same problem

[dense cedar]

We released a patch yesterday, but the patch only applies in the network if it receives a reset. So you can either reset the network or send me your VPN file and I can manually run the patch

[amber compass]

I am not using VPN, using web base access, I will try reset again

[dense cedar]

Web-based access uses the same VPN, it is just automatically loaded for you. Go to Profile -> Access, download your VPN file there and send it to me

Resetting the attackbox won't fix the issue, you need to reset the network itself with the vote to reset button

[amber compass]

ok thank you very much

[slate swan]

Gave +1 Rep to @dense cedar

[unreal nova]

@dense cedar thank you for this room! I'm only missing contact from responder to complete it. I'm listening on tun0 of my attackbox (tun0 is in the 10.50.2.0/24)

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Send me your VPN file on DM and I'll check for you in the next couple of minutes

[main urchin]

Very Nice room @dense cedar thank you very much for the support.

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Glad you liked it! 🙂

[amber compass]

I just to confirm that reset of network solve permission issue on Task 6 and task 5 using Responder services (you do not wait for long to get response)

[dense cedar]

Do you mean you confirm it worked or are you asking?

[amber compass]

I confirm it worked, I just finished the room, thanks

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Ah perfect, thanks for the confirmation!

[slate swan]

Gave +1 Rep to @amber compass

[wet oyster]

Hello, i cant connect to these breachingad. I did all by rule, but it doesn't work. I downloaded vpn file and open with sudo openvpn, and i have ip. Than i opened file resolved.conf and change #DNS to DNS=ip of THMDC. Than i run systemctl restart systemd-resolved. And when i check nslookup it doesnt work. It shows my ip address(not that i owned by vpn file) and it wrote server can't find thmdc.za.tryhackme.com: NXDOMAIN.

what the problem?

[dense cedar]

Are you on Kali?

[wet oyster]

yep

[dense cedar]

See the pinned comment in this discord channel and also see the note in the room Task 1 about DNS on kali

[wet oyster]

Thank you. Now its work

[slate swan]

Gave +1 Rep to @dense cedar

[delicate jay]

Great to see!

[old otter]

still didn't get result with responder and i have problem with permission in task 6

responder

[dense cedar]

Have you reset the network?

[old otter]

you mean restart machine ? or redownload new vpn

i just download new vpn

and start machine cause it was stopped

[dense cedar]

Nope, I mean actually reset the network through "Vote to Reset". The patch was deployed yesterday, but only takes once the network receives a reset. That's why I've been asking everyone to vote to reset.

if you don't have enough votes, pop me your VPN file and I'll quickly do a manual patch

[old otter]

im only one who voted

so can i upload my vpn file to you via message ?

[stone flame]

anyone has the "Connect request failed" in step 6 when trying to connect through TFTP ?

[dense cedar]

Are you sure you are specifying the correct details? TFTP terminates if any of the details are wrong. Also just confirm you can ping the THMMDT host

[tiny halo]

Anyone else having issues with the AttackBox not routing the correct subnet?
Tried killing the attackbox and spinning it back up without it helping.
Doesn't help adding a route to the IP/subnet displayed on the network overview map in the room either :/

[old otter]

hi guys i have a question about responder , responder in CTF when we setup a responder Listener there is some script running in target machine as cronjob right ?? am asking to confirm only, thanks

[tiny halo]

Hopefully, i'm still waiting for something to connect, been waiting for about 30 mins now... 🤞

[old otter]

use the one from github

[prisma shale]

Hey

[heady tide]

Hey is breachingad difficult compared to throwback?

[dense cedar]

If this happens, best to do is to regen your VPN file and then reconnect the AttackBox

[dense cedar]

If you don't get a callback in 15 minutes, it means the network has not yet applied the patch. The patch is only applied when the "Vote to Reset" is used. So please make sure to vote to reset. If however you don't have enough votes, send me your VPN file and I'll do a manual patch for you

[dense cedar]

It should be easier. This is the first of five AD rooms that are meant to explain the fundementals of AD hacking. Everything is written like a walkthrough so should be easy to follow and understand. See these rooms as the introduction course to AD. Thereafter you can go explore more on your own

[heady tide]

Thanks for prompt response!

[slate swan]

Gave +1 Rep to @dense cedar

[little pine]

Thanks man...this did it...had restart the service twice

[slate swan]

Gave +1 Rep to @paper laurel

[high mountain]

@dense cedar Loved the MDT stuff, very cool

+rep @dense cedar

[slate swan]

Gave +1 Rep to @dense cedar

[ripe hound]

Great network, i was almost able to completely do it from my own kali instance, but yeah the mcafee utility wasn't working and probably have ruined my python at this point, but all things considered, great introductory for getting to know about AD-attacks

[exotic plaza]

Hello 🙂 Is the network still working and did anyone work with the web based attack box?

Im not even able to ping the IP of the DC from the web attackbox 😦

[dense cedar]

The network is working. Have you made sure to start the network? Also see previous messages about if your tun adapter is not connecting, might be good to regen your VPN file and then restart the attack box.

[exotic plaza]

It is the Web Attack Box, there should be no need of activating a VPN afaik

The guide says the following: If you are using the Web-based AttackBox, you will be connected to the network automatically if you start the AttackBox from the room's page. You can verify this by running the ping command against the IP of the THMDC.za.tryhackme.com host. ...and thats already the point where I'm stuck

routes and default gw looks set correctly

[dense cedar]

Please read the previous messages. The attackbox only imports your VPN file automatically. If your VPN file is broken, that means the attackbox will import your broken VPN file and won't work. Please follow the steps I listed above.

[exotic plaza]

Well the thing is that the VPN is connected and the tun Interface has an IP, i can even ping the tun interfaces default GW. How would I know that the VPN file is broken?

[dense cedar]

I can't help you if you are not willing to follow the help I'm providing. The previous messages explain why this issue occurs.

[exotic plaza]

What is the previous message you are referring to? AFAIK the VPN Files are only relevant to self hosted attack boxes, right? In my case Im using the webattack box. the tun adapter is up and running and ive got a valid ipv4 address

This should make the problem more clear: https://pastebin.com/8ARWRgBt

Okay youre right, I really had to regenerate the vpn cert, copy it into the webbased thm attack box and restart openvpn

But thats a bug, right?

[dense cedar]

When asking for support, it is good practice to just first read some of the previous messages in the channel to see whether others had a similar issue and where able to solve the issue. This just saves time for everyone.

You don't need to copy it onto the AttackBox. AttackBox automatically pulls your VPN file when you start the AttackBox in the network. You just need to terminate and then restart after regen-ing your VPN file so it pulls the new one.

It has been seen before that when you join a room earlier, leave, and then rejoin the room, sometimes the web does not automatically regen your VPN file to be attached to the correct subnet. So you are still attached to the old subnet. The simplest solution is just regen-ing your VPN file. The team is aware of it and looking for a more permanent fix.

[hard crystal]

@dense cedar Would it be possible to get our network reset? There are currently 40/72 reset requests and new people keep joining and extending the uptime. Around this time yesterday we had 5/36 reset requests

[dense cedar]

Why do you need a reset? Is one of the tasks not working? Also send me your subnet, I don't have the permissions to reset but could perhaps relay to the team to see if they can

[hard crystal]

Yeah we're still having the delay with Task 5 where the intercept doesn't arrive and I don't have permissions to clean up after Task 6 so it looks like the patch hasn't applied. Was the same yesterday

On the 10.200.4.x network

[dense cedar]

Can you DM me your VPN file and I'll manually apply the patch so you can do it without reset?

[vague ingot]

I could not find info anywhere how does the Breaching -AD labs differ from Throwback? Humble appologies if question has been alrady ansered but could not find anything.

[rose junco]

Thanks for the tip @dense cedar . Gonna regen my ovpn file

[slate swan]

Gave +1 Rep to @dense cedar

[dense cedar]

Hey there, so Breaching AD is the first AD room in the AD module series. There will be six rooms that teach you AD concepts:

• Breaching AD
• Enumerating AD
• Lateral Movement and Persistence
• Credential Harvesting Techniques
• Exploiting AD
• Persisting AD

By doing this AD module, you should have a very good understanding of Active Directory, how to exploit it on an assessment, and how to mitigate against AD attacks. That's the goal here. Throwback covers some of these concepts, but not to this level of depth for specifically AD concepts.

[dense cedar]

We are aware that the networks are currently full. So we have allocated additional networks right now. This should at least also help with the problem. Seems like the network were even more popular than what we initially expected 🙂

[rose junco]

Sweet, I'm in

[vague ingot]

Wow! Thank you for the quick response. This looks amazing. I'll definitely check them out

[slate swan]

Gave +1 Rep to @dense cedar

[rose junco]

Honestly gotta say, Tryhackme has been the most fun I've had with computers in a min. I love the platform

[viscid breach]

Hello @dense cedar... I have a problem: I wasn't able to delete my folder and clean up for the Task 6 because I got "Access is denied" error and my VPN dropped ~50 times so... Can I send you the IPv4 of the THMJMP1 or my VPN Access IP and folder name so that you can free up some space for other people?

[dense cedar]

Hey, so some of the files are locked since they are actively mounted, but we do have an additional script that should kick in once a day to also flush the mounts. The cleanup there is just to make sure you teach good practices of cleanup during assessments 😉

[prisma thorn]

anybody else having issues connecting? i tried own machine and attackbox and dns or ping dont go throught already regenerated the vpn file

[paper laurel]

did you setup DNS as it says on the start of the room?

[prisma thorn]

yes i tried in my box and attackbox. dns and ping were not working

[paper laurel]

did you restart the system module 2 times

[prisma thorn]

i tried restarting it a couple times yea

[paper laurel]

hmmm

[nocturne crescent]

https://www.codegrepper.com/code-examples/shell/change+dns+on+kali+linux
This may help.

[low mortar]

Hi, my browser isn't able to resolve ntlmauth, due to some certificate issue :

[viscid breach]

Try it with Chrome...

[brisk trench]

Hello guys

[young vale]

I'm using my local machine and can't seem to download the LiteTouchPE_x64.wim file and it just gets stuck on this one, the bcd conf file is available and working tho, any help would be appreciated :)

it just downloaded

[paper laurel]

it takes a good amount of time to download those files as they are really big

[young vale]

must be a big file

[young vale]

yeh

[paper laurel]

This download will take a while since you are downloading a fully bootable and configured Windows image. Maybe stretch your legs and grab a glass of water while you wait.

[young vale]

[paper laurel]

takes around 200-400 seconds, depending on how your internet speed

[young vale]

188 seconds for me

and it's not on your internet connection

it's all happening in the remote machines connection

[paper laurel]

oh yeah, you could also download it to local

[young vale]

[dreamy crater]

Any advice regarding configuring our LDAP server for task 4? I am using this file as given by the terminal:

My LDAP is complaining

sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart

ldap_sasl_interactive_bind: Authentication method not supported (7)
        additional info: SASL(-4): no mechanism available: security flags do not match required```

This is the output of http://printer.za.tryhackme.com/settings

Am I missing something obvious?

On a local kali, will try attackbox

[wooden minnow]

Did you add the server to the name-serve?

[dreamy crater]

needed to replace eth0 with tun0 & wait a bit

ty @paper laurel

[slate swan]

Gave +1 Rep to @paper laurel

[dreamy crater]

❤️

[wooden minnow]

/etc/resolv.conf

replace the nameserver with the IP.

[wooden minnow]

That last message was for you.

[delicate jay]

Got the same issue here

[dreamy crater]

essentially

make sure your TCPdump command is using the interface of your interface connected to the network (if you're VPN this is probably tun0)

[delicate jay]

If I remove the first line the server sets up however when checking to see if the downgrade works it shows just dn: then nothing

[paper laurel]

what errors are you getting?

to send ss

!docs verify

[outer timber]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[delicate jay]

Starting from the top

Created a file called olcSaslSecProps.ldif

Set up the server with the DNS names ect

go to use sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart

then get the error
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind: Authentication method not supported (7)
additional info: SASL(-4): no mechanism available: security flags do not match required

using ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms gives me the output of dn: then notthing

Sorry sent that a little to early

[paper laurel]

that's perfectly fine, and should mean that your ldap server is working

[delicate jay]

I thought this was an issue however ?
ldapsearch -H ldap:// -x -LLL -s base -b "" supportedSASLMechanisms
dn:

As the room output shows the config file as different?

Sorry for all the stupid questions first time doing this with slapd

[paper laurel]

Run this command:
sudo tcpdump -SX -i tun0 tcp port 389
and go to the printer settings and plug your tun0 ip into the Server

and press send settings

[delicate jay]

Next step just wanted to ensure the server was configured correctly

[paper laurel]

yeah, it happens some times that they don't show up, but it should work either way, it can be bugged with that

[delicate jay]

Arh thanks mate! much appreciated !

[paper laurel]

but if you don't get the error message This distinguished name contains invalid syntax on the website when pressing test settings, then the ldap is wrong

[delicate jay]

Got it thank you! Well I just spent 2 hours reading up on ldap and how to get it working on linux all for it to be okay...

[paper laurel]

that happens some times, been there before

[delicate jay]

Final question any idea on the syntax used to find the authentication mechanism tried this ldapsearch -H ldap:// -x -LLL -s base -b "" authentication but no dice struggling to find any documentation on it if anyone has any links?

[paper laurel]

sorry, what do you mean? 😄

[delicate jay]

Sorry was not clear trying to answer this " What two authentication mechanisms do we allow on our rogue LDAP server to downgrade the authentication and make it clear text?"

[paper laurel]

that is what it should show when doing the ldapsearch command, but because it's bugged just go up in the room and read the terminal on the site

what does it show after the ldapsearch command

[delicate jay]

Arh I thought it was something that was specific to the install. Thanks!

[paper laurel]

no worries

[dreamy crater]

😎

[clever knot]

I'm having the same problem. I get a feeling of that the IP's showing in the diagram is faulty as well, they do not represent the actuals. When I instead pinged the "old" IP I got a reply. I'm stuck a "Authentication Relays" and can not get further. Something seem quite of with the room unluckily.

[dreamy crater]

The hash takes about 10 minutes to come through when you're listening with responder

IPs in the diagram were accurate for me

double check that the network isn't sleeping (refresh the page and view the status to confirm)

also, the network needs to reset to apply patches as of last night iirc

[clever knot]

it says "Running" so don't think that is the problem mate. Having problem from both the attackbox and my local VM.

[dreamy crater]

so if you can, maybe worth seeing if you can help vote to reset

[clever knot]

done that aswell. 22/54 😄

[dreamy crater]

the Ips shouldn't change unless you're placed into a network by leaving and re-joining the room manually

I'll look at the status of your network on our side

10.200.22?

[clever knot]

of. left the room and now rejoining. getting a new set of IP's

[dreamy crater]

yes that is likely to place you on a different network

it depends on how much space there is in other networks. Networks have a certain amount of users per network(:

maybe you'll have better luck with the new subnet

[clever knot]

understand 🙂
nah, same thing there. 4/8 who vote. things anit working that well 😄

[dreamy crater]

can you give me the full IP address of a machine that you see on the network map?

I'll check on our-side the status when I'm back at my PC

I'm currently cycling

[clever knot]

10.200.47.101, that is the DC

[dreamy crater]

also some screenshots of what you see in the termiinal/what you think is wrong would be useful (:

!docs verify

[outer timber]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[clever knot]

Enjoy the cycling. I will give up for now, not getting any longer with this room at the moment. Later mate

and thanks for the help

generated a new VPN file.
from my own kali VM i get at least a ping response from THMDC..but the DNS queries are not working. I have made the changes in the resolver conf file.

from the attackbox, nothing works. not ping or DNS.

[dense cedar]

I checked the VPN file. Everything there was working as expected including both ICMP and DNS. Provide your subnet according to your diagram and I'll see if we can debug further. But the network seems up and stable

[prisma thorn]

it works now for me, maybe it was full yesterday

ip shows same as before

[clever knot]

ok. now it kicked in. can't really say what I made that caused a difference. But the responder provided me with the hash both on the AttackBox and my Kali. Thx guys....but this most felt like a "ghost in the machine" for me.

The next issue, from Attackbox and Kali Linux:

root@ip-10-10-87-45:~# systemctl restart systemd-resolved
root@ip-10-10-87-45:~# nslookup thmdc.za.tryhackme.com
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: thmdc.za.tryhackme.com
Address: 10.200.47.101

root@ip-10-10-87-45:~# ssh [e-mail]

ssh: Could not resolve hostname thmjmp1.za.tryhackme.com: Temporary failure in name resolution
root@ip-10-10-87-45:~#
root@ip-10-10-87-45:~# ssh [e-mail]
ssh: Could not resolve hostname thmjmp1.za.tryhackme.com: Temporary failure in name resolution
root@ip-10-10-87-45:~# ssh [e-mail]
ssh: Could not resolve hostname thmjmp1.za.tryhackme.com: Name or service not known
root@ip-10-10-87-45:~# nslookup thmdc.za.tryhackme.com
Server: 127.0.0.53
Address: 127.0.0.53#53

** server can't find thmdc.za.tryhackme.com: NXDOMAIN

suddenly the nameresolution on the attackbox stops working. and on the Kali VM I don't get it to work at all :/

From Kali VM ssh could be established by IP instead ofc but when connect to the machine it hanges for a couple of minutes and comes back and I can type in one command and the same thing over and over

[prisma thorn]

seems borked

attack box wasn't even working today for me but own box all good

the dns i mean

also on pxeboot steps of cleanup user doesn't have permission to delete the files

[clever knot]

yes. the DNS is not working as it should.
and I am on that stage now, the MDT stuff. can't even navigate to the web page 🙂

and for an Active Directory infrastructure that is everything. If the DNS is not working correctly, well then all the other stuff will suffer as well 🙂 done my years of troubleshooting, designing and operating AD's 🙂

[clever knot]

A tip for those who are running into DNS trouble. Use IP when possible to get further in the tasks. I used in for "Microsoft Deployment Toolkit" and "Configuration Files". The DNS started working for a while so I got the chance to get the BCD-file name.

all in all a fun room besides the DNS hustle.

thanks all for the support and help though 🙂

[delicate jay]

Done it all.
A few issues along the way with DNS but a really well put together lab thank you for this!

[clever knot]

agree @delicate jay!

[dense cedar]

Sorry I was away for the afternoon. I'll investigate what is happening with the DNS there. But hard to replicate since it seems stable. I'll ask the team to drop me in a couple different networks and run some tests to see if I can replicate the issue.

[dense cedar]

TL;DR The DNS struggle is real, but solving it yourself is also a valuable lesson to learn for attacking AD.

I think it is important to create a distinction. The DNS in the network works. 100%. If you run a DNS command from any of the domain-joined machines, it works perfectly. So there is nothing wrong with the actual configuration of the DNS.

Where the issue lies, is in the configuration of, us the attacker, trying to configure DNS to also work for us, from our Unix and non-domain joined machines. Which is always a pain, but part of the necessary evil if you want to do security testing against AD environments.

While the THM team is trying to make it simpler for the AttackBox to connect and resolve DNS in the network through a new patch we are testing this weekend, on the other hand, having to battle with and solve DNS issues is part of the required learning curve to attack Active Directory. I can count on my one hand the number of security assessments where the DNS "just worked out the box" when I was testing against AD estates. I can't really go to the client and tell them their DNS is not working? Cause it is? It is just not working for me, the security consultant and I had to learn to solve that problem in order to be able to attack their AD estate.

Especially for something like Breaching AD during a red team, often we would do social engineering to get access to a boardroom or meeting room and plug into the network. At that point, we have almost zero knowledge of the network and would have to figure things out like the FQDN, DNS, etc. On a red team, you can't really call the client and ask for help at that moment.

All that being said, I want this module to focus on learning AD, so we at THM want to make the learning experience as seamless as possible, which is why we are still trying to make DNS easier. Especially on the AttackBox. Just know that you won't usually be afforded this luxury on an actual red team in most circumstances.

[quaint hearth]

@dense cedar is the Breaching AD lab currently down?

[wooden minnow]

If it's been longer than 3 days since you started, you'll need to rejoin the room.

Otherwise it's running. 🙂

[south hollow]

is it possible to do privilege Escalation on THMDC machine ?

[wooden minnow]

Try it?

[young vale]

eh, it might be discouraged but who knows

[south hollow]

so where the Breaching-AD task ends ?

[quaint hearth]

any idea what I'm doing wrong?

[young vale]

no

[quaint hearth]

sorry. trying to share screenshot

seems that I can not share screenshots

[young vale]

!docs verify

[outer timber]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[young vale]

you'll have to verify to share ss

[quaint hearth]

some reason I'm not getting the expected output for ldap server when running

sudo ldapmodify -Y EXTERNAL -H ldapi:// -f ./olcSaslSecProps.ldif && sudo service slapd restart

[young vale]

yeh that happened with me too

but it works out alright in the end, just carry on :)

[quaint hearth]

cool deal. thanks mate

@young vale how many times did you press "Test-Settings" before getting back output?

[young vale]

once

it takes a while to call back

[quaint hearth]

gotcha

[quaint hearth]

@young vale about how long until you caught data using tcpdump on port 389?

[young vale]

you've messed something up in your setup if you're still waiting

[quaint hearth]

seems that way... hmm

[young vale]

do you get a regular callback with nc -lp 389?

[quaint hearth]

no.... which I think might explain some issues to begin with

[young vale]

yeh, there's some config issues on your end likely

mayyyybbbeee the network needs a reset but unlikely

[young vale]

I hope you know that the server has to be "your ip"

[quaint hearth]

cough cough..... um yea 😂

[young vale]

you're calling back to... well I don't even know what you're calling back to there

[quaint hearth]

I should learn how to read.

[quaint hearth]

Not sure if this is a common error but I'm unable to GET the bcd file from thmmdt server. Does anyone have any advice?

[quaint hearth]

I think there is something wrong with pxe server

[cosmic cedar]

Nice room, learned a lot! Keep up the good work. Had to do a bit of troubleshooting in the beginning, but after that everything went smoothly. If someone else is having issues, I can recommend regenerating the .ovpn file

[buoyant basin]

Same, it does not work for me.

[quaint hearth]

Still trying to figure it out lol. No luck

[buoyant basin]

I pinged THMMDT, it works. I tried to use tftp 10.200.X.202 many times but connect request failed after reset. 🤷‍♂️

[quaint hearth]

It's working for me now

[buoyant basin]

Yeah, me too.

@dense cedar Cool room and I completed this 🙂

[quaint hearth]

tried cleaning up my files but it wouldn't let me. 😦

[quaint hearth]

@dense cedar Thanks for sharing this awesome room! Great stuff!!

[slate swan]

Gave +1 Rep to @dense cedar

[quaint hearth]

@dense cedar do we get extra points if we pwn the DC?

[dense cedar]

DC is out of scope for Breaching AD 😉 But congrats! You will have a go at full root domain compromise in Exploiting AD.

That IP does not look correct? 125 is an internet IP. It should point to the IP in your network diagram. Looking at the screenshot, you are using Kali, meaning you should follow the Kali step in Task 1. Can you give that a go?

[quaint hearth]

Sometimes my reach far exceeds my grasp.

[dense cedar]

Out of interest, which path worked for you? Creds or something else?