Tier 0: Redeemer - HackTheBox Starting Point - Full Walkthrough

[@ItsTheSebbe]

I've never heard of the tldr command before until now, that seems immensely useful. Thanks!

[@_CryptoCat]

No problem! 👊

[@goodtoot3145]

Thank you for everything you made me a better person

[@_CryptoCat]

awww such a lovely comment, thank you 🙏🥰

[@vickycodex4975]

Hello, a faster way to do the enumeration is using the hint that HackTheBox gives you, it ends in 9 and there are 4 digits so the largest number has to be 9999 and the shortest 1008. So I used the following command combined also with -Pn to skip the pings. It is much faster and more functional nmap -sV -p1008-9999 (target) -Pn Literally it took me 1 minute to get the port. Greetings from México !!!

[@_CryptoCat]

nice tip, thanks! 💜

[@oramos309]

Thank you!!! This took seconds, compared to -p- -p- was taking way too long

[@Djreversal]

for some reason when i type redis-cli -h it doesnt do anything.. just goes to a blank line and never connects and i cant do anything but shut the terminal down.. not sure why

[@_CryptoCat]

Somebody else mentioned a similar issue, not too sure what's the cause 🤔 Tried to restart boxes, VPN etc?

[@steamplay3222]

@@_CryptoCat I have tried restarting the VPN and that helped! Thanks

[@DeputatKaktus]

I am currently stuck on this - I cannot for the life of me get a connection on the redis server. I can ping it just fine and it replies with "PONG", as it should. But as soon as I try to connect, I get a blank line with a blinking cursor and it just sits there doing nothing. Any pointers? I have no idea whether the box is buggy or my setup somehow is.

[@_CryptoCat]

Double check the steps in the official PDF walkthrough, reset the box and maybe reset the VPN connection would be my main tips. Can check HTB discord/forums for additional troubleshooting steps if that doesn't sort it 😉

[@hardrock4449]

My vm is unable to locate the package for redis-cli, I’ve tried updating everything but it still says that it is unable to locate package redis-cli.

[@_CryptoCat]

sudo apt-get install redis-tools

[@hardrock4449]

I fixed it, just needed to update /etc/apt/sources.list with new links to the Kali website

[@burso8023]

When I ran "redis-cli -h" and IP address nothing happens. Just does a paragraph. It doesn't connect me to it..

[@_CryptoCat]

hmmm it doesn't give any connection error? tried to restart?

[@LadislavVydra]

You have to reconnect VPN, it worked for me.

[@Velohian]

Hello, i know it may sound strange, but how do i manage to get the TLDR "plug in" or "app" to work?

[@_CryptoCat]

You can install it various ways, e.g. npm or pip. Full instructions here: github.com/tldr-pages/tldr#readme

[@Velohian]

@@_CryptoCat Thank you very much for the help, this is very useful for a novice in pentesting and I am grateful for your posted content.

[@codexverma8389]

I found this redis vuln in a actual website And I am start research about that and your video helps me a lot thanks 👍👍👍👍👍

[@_CryptoCat]

Awesome! Was it a bug bounty program?

[@codexverma8389]

@@_CryptoCat yes

[@_CryptoCat]

@@codexverma8389 Congrats! 👏

[@MantisSTS]

Another awesome video dude

[@_CryptoCat]

thanks bro 💜

[@brightonshifu]

time take scanning ports for this challenge server is the longest so far, taking an eternity such that nmap doesn't even list the open ports.. yet works just fine on the other challenges on tier 0

[@_CryptoCat]

try and run nmap with the -vv option, then it will show open ports as they are discovered. you could also checkout mscan, i often use it to quickly scan all TCP/UDP ports before feeding the results to nmap 😉

[@francocaterini3706]

You know that the answer only has 4 digits, so you better scan from port 1000 to 9999, the scan becomes almost instantaneous. Use this nmap -sV -vv -p 1000-9999 "IP"

[@michaelinzo]

I always had to -Pn in Nmap this sucks is there no passing this one? they seem to always block probes should I delete AV?

[@_CryptoCat]

Ermm you could try disabling your security software temporarily to see if it's interfering. Also could be connection issues so try and reset VPN, swap servers etc.

[@michaelinzo]

@@_CryptoCat Starting Nmap 7.93 ( nmap.org ) at 2022-11-06 13:18 +03 Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 2.21 seconds even with Avast Shield Control Disabled...

[@manuelwie]

I have struggled so much with this machine. i can get my way around with basic sql, but this redis was somehow hard for my brain to work out. especially after i took a wrong turn somewhere while simply looking around :(

[@randomdeathzombithree344]

Just wonder , in the end of the video when we were supposed to write in the root code. How did u know that it was the key "flag" was the right answer?

[@_CryptoCat]

5:33 we see there are 4 keys; "flag", "temp", "numb" and "stor" so we could check all of them but in hackthebox machines and challenges the goal is always to capture a "flag" so that one made the most sense. As for why "root", normal machines involve gaining the privileges of a user and submitting the "user" flag found in a file on the Desktop. Next, you escalate privileges to root and submitting the "root" flag (/root/root.txt).

[@vojtechsmola9295]

Hello will u make video on the Cyber Apocalypse 2022 ? love ur walkthroughs it would be nice

[@_CryptoCat]

Nope, sorry! I was in England visiting family and missed this years comp 😔

[@vojtechsmola9295]

@@_CryptoCat shame ! well what can you do

[@rickycdnb]

i cant seem to install redis-cli. ive tried soo many methods. i get unable to locate package from sudo apt-get install redis-cli ive tried redis-tools too. any idea how i can sort this??

[@rickycdnb]

when trying to run redis-cli this comes up..... command 'redis-cli' not found, but can be installed with: sudo apt install redis-tools Do you want to install it? (N/y)y sudo apt install redis-tools Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package redis-tools

[@_CryptoCat]

Ermmm try "sudo apt-get install redis" as well.. What OS are you running?

[@MrGreen-xi9yt]

So when I run the nmap scan it's estimated time for completion is several hours long. Do you have any idea why this is?

[@_CryptoCat]

Hmmm you could try changing VPN server and/or reset the box. Check out some of the suggestions here also: forum.hackthebox.com/t/why-nmap-scanning-is-too-slow/2352/9

[@frankjohnon9736]

u making very good job!

[@_CryptoCat]

tyty 💜

[@nocteam8918]

how long do you get for results this nmap...? i've try it but this take along time...

[@_CryptoCat]

Hmmm looking at the output @ 0:23, this one took 53 seconds. If yours is taking much longer I would try to: a) reboot machine b) restart VPN c) change VPN connection pack (new server if possible) d) check your own network connectivity (speed/stability) e) temporarily disable security software, e.g. firewall

[@ashioyajotham]

Appreciate it

[@thechallenger4755]

Thank you for your awesome content And i want to ask a question and if you could do a video about it I am using kali linux on vmware and its very laggy and i have a good cpu and gpu Ryzen3700x rtx 2060super How to solve this problem And again thank you for this awesome content

[@_CryptoCat]

thats good CPU and GFX card mate, what about your RAM? do you have the VMs on a HDD or SSD?

[@thechallenger4755]

@@_CryptoCat on a ssd And i have 16 gb of ram But kali is very laggy

[@_CryptoCat]

@@thechallenger4755 RAM might be an issue, I have 32gb and assign my parrot VM 16gb (via VMWare machine options). Double check your CPU/RAM settings in VMWare and make sure they aren't too low. When you find it's running slow, check your windows task manager and see if you are maxing out your CPU/RAM 😉

[@thechallenger4755]

@@_CryptoCat thank you i will try it

[@Jugg215]

Oops, deleted my comment while editing it.... Came for some help guys and gals. I ran this exact scan and im getting a prompt in the terminal saying "Note: host seems down. If it is really up, but blocking our ping probes, try -Pn"..... Sooooo I tried that and the scan finished but didnt really give me any info other than saying the host is up.. This is my first big hang up so I was just hoping someone knew away through this.

[@Jugg215]

Currently running: nmap -p- -sV -Pn- [ip] ... This looks like its gonna take awhile so I will let you know if this rectifies the situation but I cant for the life of me find what -Pn even does.

[@_CryptoCat]

how long has the machine been running? are you running on all ports with "-p"? try "-sS" as well maybe.. shouldn't be VPN issues because host is up, but maybe check local firewalls as well.

[@Jugg215]

I reset the machine again and now running "sudo nmap -p- -sV -sS $IP" I just started HackTheBox today and the first 3 rooms in starting point were easy. Didnt have any issues at all. Ive been using TryHackMe for awhile now and just wanted to see something fresh on the eyes. Im still new so I dont even know how to check local firewalls but would they be an issue if the first 3 rooms went by without a hitch? If so I will definitely look in to how to change firewall settings on VirtualBox. Also, thank you very much for the sS idea even if that doesnt end up being the fix. Totally hit that Subscribe button.

[@Jugg215]

Must have tried 14 different variations of the scan and keep getting nothing. Guess its time to look in to whatever this firewall situation might be.

[@GT_Levicus]

@@Jugg215 Exit the terminal and restart running the command with a new one and without -Pn. It's because the machine has been running for a while.