You playing kioptrix here? I remember running the same exploit earlier in the week.
Jordan Nelson
yep kioptrix 1.0. first time i've used metasploit on a box
Oliver Robinson
Im sitting on kioptrix 4 atm. 2 was very enjoyable, I learnt a hell of a lot about why bash shells work moving through that one
Camden Reed
Bash reverse shells, rather
Brody Bell
tfw need to look at walkthroughs to beat kioptrix levels
Caleb Foster
the OSCP torrent has a fuckload of material in it. 80GB and there's loads of SANS pdf's in it. no way anyone could get through that in 1 lifetime i read a chapter of a book on metasploit so needed no walkthrough to get root, but i didn't know the flag per se was in /var/mail
Jaxon Cox
Finally, my favorite general has returned
Josiah Richardson
Bruss it's only been gone for a few hours. There was one up for a few days that died maybe 8 hours ago
Grayson Reyes
TOO LONG TIME IS PRECIOUS
Robert Cox
so this where all the script kiddies hang out woah
James Lewis
This is where that title is shed.
Blake Baker
Sure is. It's a nice place for nice people to play at hackerman. It's also amusing to rile people "in the game" up.
Andrew Moore
>Best way to spend a Friday night >alpha af
Jace Smith
Hell yeah boyee
Alexander Myers
i literally spent last night with my proto gf on my couch doing farmville while i hacked and posted on hmg
Luke Harris
Thinking of getting OSCP cert, I've worked as a Linux admin for about two years now, anyone know how long it takes to study for it?
Luke Ortiz
>proto gf What
Isaac Martinez
>thinking of building a house, I have experience building model trains, how long do you think it'll take?
This is how stupid your question was. You are missing so many pieces of information from your question how can someone POSSIBLY give you a useful answer?
Evan Rivera
Proto gf? Wtf is that. Also, don't play farmville, that shit is bad for your brain.
Henry Davis
I mean I have to secure systems and make sure they don't get fucked, it seems like that should help with some background knowledge for the OSCP versus someone who's never used Linux. Your analogy is pretty shitty
Michael Butler
Not him, but I would say go for it if you feel confident enough. 24 hour test so I hope you're prepared.
Nolan Lewis
>Your analogy is pretty shitty No its not. Blue team work doesnt lend itself to red teaming at all.
Oh wait, its already in the fucking OP. Did you even look ANYTHING up?
Xavier Robinson
I didn't say Blue team lent itself to Red Team, but having the Blue team experience helps. And yes, I did look it up, but I thought I'd ask in case anyone was in a similar situation and could give advice, stop being an autist.
Henry Torres
>stop being an autist. Where the fuck do you think you are?
I seriously don't know why you still think your question is valid. From the posts you've put up, no one still has any idea how well you study, how rapidly you learn, how much free time you have to lab, wether you've done any pen testing before, how badly you want to obtain it, wether you're even interested in it, how good your report writing skills are, or even what you know. "Two years of Linux admin" means literally anything on earth.
Itll take you as long as it'll take you. That's the only correct answer.
Eli Moore
shut the fuck up bitch ass nigga
Jaxon Ramirez
Why should I cunt
Austin Myers
Bad day?
Cooper Sullivan
u a lil hoe nigga wite boi faggot
Levi Ross
No, my day is fine.
Questions like >how long does x take >what's the best way to start >how do I move from y career to z career without providing any information
are why the cyb thread is such shit. The OP which was drawn up by the OG handsome man general poster answers these questions.
It'll take you as long as it takes you. It's super individual and you can't trust a blanket "it'll take y days" statement. I doubt as a Linux admin you have experience crafting buffer overflows. Maybe that's the topic that trips you up, and you take an extra 6 months in your learning plan to get it down.
Maybe you are a 1337 iq beanbag and crush the learning in two weeks.
It'll take you as long as it'll take you. It's a learning path, not a tick and flick to get past HR like SANS.
Nathan Moore
I'm not the op you were replying to. You just seem to stress over subjectively trivial things. Is what is. Enjoy your night, user.
Bentley Young
>Enjoy your night, user. You too.
Im presently doing an awful smelling shit and my guts feel like fire, but I think I can workout a way to get a foothold in kioptrix 4
Christopher Diaz
Guys, is it right if I used classic stack overflow instead of classic buffer overflow for referring direct-return exploit?
Liam Green
stack overflow is when the stack collides with the heap. i'm not aware of exploits for that
Grayson Cox
All of my curiosities. Pl0x answer.
Ryan Cox
are you sure? stack collides with heap?
Isaac Sanders
stack overflow? yes, that's what it is. the stack starts in high memory, and stack frames are created that go downwards towards the heap. if the new stack frame's pointer is out of bounds, you get a stack overflow
Nolan Parker
any of yall used secgen to make custom vulnrable images? how do they compare to the vulnhub boot2roots?
Mason Cox
There's no collide between stack and heap, as far I undestand. But more toward the heap that correct.
I would ask another question, what is that mean classic buffer overflow? is that mean there's no stack involved in it or what?
Wouldn't stack is available even in a simple program isn't it?
Owen Roberts
I wouldn't say it collides, but it can and will over write the heap, and go out of bounds and eventually causes a segment fault if it isn't controlled. A buffer overflow occurs with variable assignment or any kind of input, which occurs in the stack; but unlike the heap, the stack is tightly packed; so variables are over written by the overflow of input.
Aiden Lee
bump for this question
Luke Reed
So what are we all learning this weekend?
Liam Anderson
>writing a simple encrypted messaging system in python, to learn more about TCP, encryption, and password hashing >Working on some simple vulnhubs to get better at utilizing exploits after recon >Setting up a facebook phishing site manually for practical use against some cunt
what about you, user?
Joshua Taylor
where should a newfag start this shit keeps extending i can't wrap my head around it
Jackson Kelly
start with the first link in the OP, unless you cant into shell (bash, or alternatives), then start with bash. also, learn python then ruby, and a compiling language a bit later.
Angel Collins
yeah user i was already going to specify about 2 weeks for python, what do you mean by a compiling language tho?
Ryan Allen
a language that compiles, dude. You can compile python with pytoexe, but its usually a pretty big file because it has to compile all the modules with it and stuff. I like go, because from my experience, it usually works cross platform despite what it was compiled on, unless you choose to invoke something that is system specific. But for now, just stick with python man. How are you going to go about learning it? How do you learn best?
Aiden Carter
By trying and failing I guess? i'd say youtube tutorials for the most part
why what do you recommend?
Brody James
Personally, i learnt python from a guy called derek banas on youtube. Trying and failing is just part of the process of learning anything practical, especially programming. After you get the basics of the language down, you'll be using stackoverflow quite a lot, but make sure you take the time to read, and actually understand the python docs. The docs will tell you a lot more about the capabilities of the module, and everything it can be used for, rather than just knowing it can be used for your one specific use case.
Hows your bash/shell knowledge?
Carson Thomas
very little user, quick rundown?
Hunter Price
You should start with bash, rather than python. If you wanna get into pentesting, you will be using it a hell of a lot. You are running linux, yeah? Start by trying to do more stuff from the cli than gui. The more programs you can replace with a cli/curses program, the better you will become. youtube.com/watch?v=hwrnmQumtPw also, run man $command when you want to know about that specific command.
you really are super new to this, hey user?
Julian King
yeah kinda, but i'm heavily motivated so it wouldn't take much for me to learn
cheers user you're awsome
James Robinson
No problem user. dw, we all start somewhere. Just get stuck into it, write some bash scripts to automate what you do (almost)everyday, play around with the basic commands, learn to navigate your system with bash, and learn the linux file system, and you'll be well on your way to start learning pentesting.
Nolan Anderson
The 1st thing I tell my students is to write a version of echo in C or C++. Echo, if you don't already know, is just printing out all arguments you have it. It shouldn't be more than 6 lines in total, but it tells you a lot.
James Cook
yeah about linux, which distribution do you recommend, i already downloaded mint KDE but haven't installed it, is it any good cause people keep recommending it
Nathan Ramirez
i barely started with python dude wouldn't that be confusing?
Leo Sanchez
That sounds like a good exercise
Mint is fine for a beginner, its not my recommendation, but i used it as my first distro. In the past it had some security issues, but they should be all cleared up. I dont really like KDE, its resource intensive, has lots of flashy animations that do nothing but look good, and is pretty bloated. but if your coming from windows its probably a good choice. Either that, of cinnamon. Personally, I would recommend Xubuntu. It will get you in the habit of not using too many GUI software tools (although they are all still there, just not as flashy, they don't seem like the be all end all), and you'll start learning to customize linux by right clicking everything and seeing the extent of what you can change. But really just choose one, Install it for a few months, make note of what you like and dislike, ask anons on Sup Forums about alternatives, and try another distro. soon you'll find a distro you really like the look of. I also recommend sticking to debian derivatives for now, too.
Yeah, i suggest taking it slow, unless you want to throw yourself in the deep end/
Michael Martinez
>what about you, user? Same as your second point eh. Do some vulnhub images and try to not look at a walkthrough for it
Christopher King
What images are you doing?
I always try to wait at least 24 hours before i look at a walkthrough, so i give myself time to think about what i missed. Sometimes, you'll be doing something completely different and the a new possible solution will just come to you. also >bored googling while taking a fat shit >FUCK THAT MUST BE IT
Jeremiah Parker
Anyone know how to unlock an icloud lock on an iphone 4s?
This lock is fascinating me what with the iboot exploit recently, does this mean the icloud unlock is theoretically possible using the exploit? If so could someone point me in the right direction?
Thomas Phillips
Pytoexe does not compile python into native code, it simply includes the python runtime as a wrapper around the python
Owen Cooper
Oh ok, thanks i didnt know that
Matthew Ramirez
The fact you think the two are even related shows how little you know.
Give it back Rajesh and fuck off
Jaxson Ramirez
My gf found it on public transport, want to unlock it so my elderly mother can use it to look at photos sent from relatives properly because currently she has a terrible phone. Yea I know very little about this shit because I don't really like apple stuff myself.
Oh and your mother sucks nigger dick.
Jaxson Miller
>My gf found someone else's phone on public transport, >i want to unlock someone else's phone and give someone else's property to my elderly mother
Liam Torres
you have good point.
David Foster
Your gf is a cunt for not taking the lost phone to the transport company, and how pathetic are you that you need your girlfriend to steal someone else's phone so your mom can have one?
Carson Smith
You're the one preaching morality on an anonymous feedboard. I'm no moral simpleton racist anyways so fuck you and your high horse fuckface I'll do whatever the fuck I like.
Luis Rogers
>so fuck you and your high horse fuckface I'll do whatever the fuck I like Exactly. You are entitled to do whatever you like. Just like we can ridicule you for being a faggot piece of shit and offer no assistance to you.
Evan Turner
You're the ridiculous racist wanker who thinks I give a flying fuck, Go back to thinking you matter in the world by 'ridiculing' random strangers you fucking retard with your tired borrowed Pajeet references. Grow a fucking imagination.
Nicholas Robinson
Jesus Christ this thread is even worse than what you might find on /r/NetSec
Just give up man
Ian Flores
>Oh and your mother sucks nigger dick. >calling other people racists Wow, you're a special kind of stupid; aren' you?
Leo Torres
>waaah waaaah i can do whatever i want mommy! also you're racist!
Just end yourself you massive faggot.
Lincoln Sullivan
>oh i can greentext
You're a special king of autistic pedant mealy mouthed prig aren't you. I said your mother sucked nigger dick to trigger your racism you fucking gaping asshole. Don't be a smug basement dweller all your life.
>being this triggered by someone you find stupid
Alexander Gray
>>Oh and your mother sucks nigger dick.
Implying that's a bad thing. Mom doesn't, I do it myself. Learn to love! Racism is obsolete. Cucking has replaced it.
Caleb Rodriguez
look up the definition of the root word proto then figure it out yourself
Jason Phillips
Guys, stop replying to this obvious sub-human bait. Sage.
David Hernandez
OG /hmg/ OP here, still super nice to see this shit keep coming back.
Here's my run through of Mirai from htb which just retired.
Start fiddling with bash scripts with this tutorial: youtube.com/watch?v=smbeKPDVs2I It's pretty low level shit but it's all you will need for the time being.
William Perez
I don't live with my mother. The use of nigger in that context is racist. Don't spew too much montain dew getting this upset, dumasses. What are you even doing on this thread? You don't seem very intelligent.
Logan Evans
Wew, first view!
Evan Bailey
hey guys, i wanted to ask if you all know good non meme resources and guides about learning how to hack? or just some advice on where i should start i suppose
Daniel Brown
doing kioptrix 1.1 and i got admin access to the web app and can execute commands, but i'm only apache, not root. feel pretty close but idk where to go from here. might be a dead end
Kevin Lewis
literally everything in the OP you tarded mong
Eli Scott
i tried bind and reverse shells with netcat and i only crashed the application and had to restart the box. now i'm going to try to use msfvenom to host my own executable, and try to get it to download it and run it
bad omen is that this: 192.168.0.11; echo "echo hello world" > file.sh; chmod +x file.sh; ./file.sh; didn't cause it to display hell world
Jacob Lewis
always fire off a sudo -l, once you have a shell. You'd be surprised what you find.
Jack Rodriguez
well since i have absolutely zero experience with this stuff it's not so hard to see that i can't understand shit of what the OP said
Joshua Lopez
Scroll back up in the thread, a newb asked the same question and there were helpful replies.
I personally started with the first link in the OP but I'm not exactly a complete zero, I already know bash, Python, and currently learning C.
Jack Adams
>looking at exploited drives >they literally just run a script to create their rootkits >it doesn't even bother to reset the times is this done intentionally by the rootkit designers? or are they just lazy and don't give enough of a shit to do simple date changes?
Luke Perez
Hacking is just one of those things kids find so cool, then they realize what they see on t.v. doesn't exist and you're stick between >just type exploit() in python or >literally getting your phd in cyber security and constantly looking at low level shit to see all the dumb shit people do. and at the time you get to the second point you just don't give a shit about anything anymore.
Anthony Turner
Good for you. Have you started learning about the stack yet?
Nicholas Davis
>might be a dead end Most certainly not.
Push some privlage escalation exploits into your Apache session and compile them on the kioptrix machine
Daniel Thomas
Is it just me or are the SWF files for Offsec fucked?
I'm trying to play them in MPV, mplayer, nothing fucking works. Not even VLC works.
When I tried playing the HTML file, it just showed me I need newer flash. I installed newer flash and it still throws an error. Wat do?
Jose Hall
You're likely autistic, fellow.
Adrian Carter
Need help people, I create some executable to produce buffer overflow, in this time, I use Windbg instead of immunity-debugger.
The executable, I create is command line, but everytime I add open the executable, status on windbg is always INT 3.
How can I crash the exe then start analyze within windbg?
What should I do?
Connor Brooks
>Wat do? MPC + CCCP
they work fine for me
Landon Evans
Anyone have some experience with API end points testing? Care to share it's own approach?
Logan Parker
>and at the time you get to the second point you just don't give a shit about anything anymore.
