TryHackMe! Buffer Overflow & Penetration Testing

[@stevecooper3574]

That room is a fantastic walkthrough for simple buffer overflows. Great job on the vid and to the room creator!

[@Ropex]

Lord Pingu didn't deserve his name to be slandered >:(

[@_JohnHammond]

NOOT N00T

[@jazzorgangrooves]

You are just amazing. Thank you for making such worthful videos. I'm learning so much, everyday, just lookin' at your tutorials. God bless you John

[@ChamplooMusashi]

Happy to see a video on the whole process of executing a buffer overflow exploit. Helps from the programming side to understand more of what needs to be done to make code more secure (evil strings!)

[@TataruTaru]

This is one of the first I've seen where we actually fills in the readme. Most of them, he makes the readme, and never goes back to it :)

[@bluefloyd9058]

"noot noot!". That penguin is from a kids show I used to watch here in NZ called pingu.

[@nuridincersaygili]

This is pure gold for me!

[@masonfuller9823]

"now we are papa"

[@garrettblackard2288]

Thats so awesome about the room u made congratulations

[@_JohnHammond]

Thanks so much! Peak Hill seemed to be well-received!

[@crump404]

This is a brilliant room John also a brilliant video. Thanks.

[@davidfox4253]

Thanks for that great walk thru and the "Think allowed" approach!! Cheers

[@petehinch3871]

Cool man. Learning so much watching your videos

[@samsepi0l227]

thank you for everything john!!!

[@cooliceman0001]

Thank you for another great video

[@mi2has]

buffer overflow part is great

[@671Neuhof]

Tryhackme is great for learning. I used to learn new techniques or new languages only on Udemy, but in my opinion I learn much better on THM as it's quite practical. Without your channel id propably never found that website

[@Thmyris]

I did the same thing with wget a few days ago lol. Downloading the source instead of raw output.

[@neilthomas5026]

very cool vid as always :) , and cant wait to work on your room :)

[@softicecreamer]

Even I have the habit of keeping a log/notes/writeup of any ctf or task

[@D3fconNull]

Here we go, bring it up John :)

[@ritabandas]

Lol that's what I do. Throw my notes on GitHub as a writeup.

[@mattstorr]

Nice run through. was a wee bit fast in some locations though to see what you were doing.

[@xBDCFF]

4:36 Lies, i screamed ^^

[@SiliconSentry]

Did this one last night and got caught at the same point with the 'hidden' passwd file, looking for a file owned by pingu.

[@_JohnHammond]

That was tricky! Thanks for watching!

[@abdulsamihamedi5584]

this room took me 4 hours to complete!!!

[@cocosloan3748]

Peak hill hype !!! Im choosing not to watch this video (for now) sinve I will try it myself.If I stuck-I know where to find all the answers John :)

[@MrZyman]

Soo good!

[@Laflamablanca969]

Do an easy room for us newbies 😁

[@hiimzackjones]

whoa whoa whoa. what is this guake and stabilize shell thing you did? I need that so so much. Incoming DM.

[@NeelNarayan]

What does stablise shell do ?

[@KaLata123456]

Hey John-love your videos , keep it up. On this particular video when you perform the netcat for reverseshell you use 2 commands on the your attacking machine to connect to the victim besides setting up the listener (nc -lnvp 12789). Those 2 commands are nc_reverseshell.sh and nc_stabilize.sh. Can you explain where do you get those executables and how they apply to this use case. Thanks

[@znation4434]

Aaand WHAT IS HAPPENING made me laugh lmao

[@ashutoshpanda4336]

How come you're not using "dir" option in gobuster in current version it's necessary i guess... ippsec does use it... i struggled with that few times

[@AgentPenguinHack]

More please!

[@_JohnHammond]

More on the way! Thanks so much for watching!

[@01nfluence]

Great video! Do you have a video that explains all of the scripts/repositories you're using? Thanks!

[@hypedz1495]

John.. john hammond.. ngl the only thing bugging me on this one is the 15% packet drop.

[@sol2588]

Does anybody know what software he uses for the Linux terminal? Or is it the default for some distro? Would like to use. Thanks!

[@nicolassurfay2585]

it's terminator

[@Thmyris]

This box whooped my ass. Certainly not easy for me, I was completely lost at the buffer overflow part. Any good tutorial suggestions fellow commenters?

[@gitgudsec]

Can't find it - has the room been removed?

[@xBDCFF]

10:05 I'm just curious, why is it not the best to take it from the repos ? is it not updated regularly ?

[@scheli]

Mostly for ubuntu universe packages, it will get no updates at all. He is using xenial, the sqlmap package there is 4 years old :)

[@Thmyris]

@@scheli oof

[@MD4564]

Nice! What's the command at 16:25 ?

[@jovangazivoda2033]

you can find it on pentestmonkey(dot)net like it's described in [Task 5] (reverse shell for netcat)

[@jeromekim5856]

you the real mvp :'(

[@viraat_maurya]

i also try buffer overflow but it printed out permission denied on $ cat /var/backups/shadow.bak

[@patonwhite9385]

Can someone comment what the multi window term is? I like the way John jumps quickly to a split for the ping then closes (what hotkeys are being used?)

[@zerofuchs6976]

4:37 - I did!

[@lizardfog]

great, but would have been even better if you slowed down a bit

[@sahilsaxena2275]

Could please make a video on what you did at 16:21

[@mohammdrezamollasalehi4822]

plz make video for Ignite room !!

[@JashanSaini18]

This seems super cool/fun to do. Is there a way to go about learning all this? If so, does anyone have any tips/ places I can go to and learn? (I am brand new to this and would need to start from the very beginning)

[@Apathy474]

What did you end up doing

[@mmarsyad]

Can i know what the version of ubuntu that you are using now?

[@aquibjavedrollnumber1763]

Cade copper??

[@traperti9098]

Where can I start learning about hacking ? I’m very interested

[@0xshaheen]

I want to know how you are using gobuster without dir flag 😅

[@ransomware9086]

@Shaun he is using an old version or an alias

[@Sutatu]

10:16-10:20 *me, looking at the time left*: hmmmmmmmm

[@ca7986]

♥️

[@bhagyalakshmi1053]

Sull emply skills development adr parsin skills tools URL grpoing arrows work.

[@gianlu9858]

Was I the only one havig issue to crack the root password? John takes ages (On the video it looks like more than 24 hours, while doing the room I left it for about 20 mins) and hashcat was not starting (I think some issue with the VMWare environment) have someone sort it out? Any Advice for next time? Thanks :)

[@sand3epyadav]

So hard

[@viraat_maurya]

also tried your syntax stil same result

[@bhagyalakshmi1053]

Ceqylenjoy ?

[@josephschady1728]

What video recording software do you use?

[@_JohnHammond]

I use OBS Studio. I should make a tutorial on it soon!

[@josephschady1728]

John Hammond thank you, pls do! Right now I’m using Kazam but the audio is not the best, that might just be my computer though.

[@lama-chan]

DID YOU JUST SAY "WHATEVER THAT IS" TO PINGU'S NAME??? HOW DARE YOU

[@VRWarehouse]

this is a comment.

[@cheekibreeki4624]

Its pronounced Ping Goo

[@jaydensh7380]

Did anyone tell you that you look similar to Harry Potter 😅😅

[@sagar2030]

its better if "Try hack me" do not have hints.

[@cassandradawn780]

Help guys i cant think of a good comment