TryHackMe! Bypassing Upload Filters & DirtySock

Be sure to jump into the TryHackMe Discord! discord.gg/tryhackme
Hang with our community on Discord! johnhammond.org/discord
For more content, subscribe on Twitch! twitch.tv/johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: patreon.com/johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: [e-mail]
Discord: johnhammond.org/discord
Twitter: _johnhammond
GitHub: github.com/JohnHammond

[@ayodub]

Videos of you solving challenges with no fore-knowledge of the box are the best. Please do more of these.

[@samfisher8426]

bro its fake ,he must have done this 100 times before start recording lol

[@mossdem]

Oooop we almost, very almost, had a swear in there haha!

[@AUBCodeII]

21:12

[@cedricvillani8502]

What? FUCK?

[@themasterprivate1075]

Not almost, we did have one, quietly. At least I heard him swear when he said it the second time.

[@Mysticsam86]

The "stabilizing the shell manually" part was awesome!

[@popooj]

editing that python script on the fly was definitely dope 🔥🔥

[@blaisemuhune8160]

Mwana boka, du moins un congolais ici,j'y m'entendais pas

[@wasifekbal]

What an amazing journey. Totally enjoyed the raw experience. Keep uploading John. JohnHammond's video = Motivation.

[@lepsycho3691]

Man that was impressive! I will definitely study this video a lot more, to get a better sense of how to interact with a remote server like this! Thank you for sharing!

[@imuser007]

thanks john, the art of editing the exploit for foothold is really amazing

[@savoyblue777]

Thank you John your going back and forth teaches me the many different ways to go after the solutions your looking for!!!!!!

[@jacobslaver7887]

I was watching one of the old vids where there was more light and the cam was closer and I just noticed how beautiful jhon is. You got a life dude try to keep it

[@jorisschepers85]

Glad your back to kind of content (HTB,THM). Keep it up.

[@AlexElement]

Really dope! Enjoyed this live a lot!

[@KaliMax1337]

John Hammond "You are an exploit!" - hilarious!!-another great write up and I was able to follow your steps and root it myself tonite- well done!

[@KaliMax1337]

Did I fail to mention I spent most of the week struggling on this one during the contest?? I am on 1st name basis with all the animals on the site!! BTW, please, what is the Firefox extension you use in tool menu that drops down and shows you the site cookies?? Gotta get that tool!

[@hayaanrizvi]

Just subscribed, you deserve a lot more of subs :)

[@raven8592]

cool that was one of your best videos, please make more like this

[@MatteoGariglio]

It's insane how you make it "easy"... unbelievable! Super super interesting videos! Thanks

[@abdirahmann]

i loved this. this was soooooo fun. i really enjoyed it. i love it. thanks john. :)

[@aditikeni804]

He is better then my computer teacher 😂🤣

[@korki4330]

Wtf is a computer teacher

[@JTwisted]

@@korki4330 Bruh

[@aditikeni804]

@@korki4330 in our country there are teacher/sir who teaches basics and above about computers. We (actually everyone) call them computer teacher/sir

[@DHIRAL2908]

Even I know more than my cyber-security professor lol..

[@sparrow243]

Wtf 😂😒

[@pedrocunha9266]

Awesome!! Was a pleasure seeing this

[@anmolsingh2820]

I've completed the room :) It was nice, for me it was a new concept

[@saifallahchakroun6253]

thank you for the video , it helps me a lots to improve my skills

[@AJXD2]

I’ve learned a couple of things from watching this guy. The most important thing is to not mess with him

[@neilljamieson9606]

Great content again. Thank you John for this. Really cool stuff.

[@elliotdohm2883]

The first searchsplit script was making the request via POST. When you tried to see if the path exists, it was a GET. Not sure if using POST would've worked, but it's possible that the request path 404s if it's not a POST.

[@NothingPicksLocks]

That was freaking awesome

[@xB-yg2iw]

I have a chance at this! Here's hoping!

[@nxmxss]

Getting the foothold for this one was one of the most annoying thing i have dealt with.

[@pw5687]

great video as always! :)

[@myusernameisrighther]

Gotta get all those jifs. Wouldn’t want to miss all those jraffics.

[@johtodev]

Let's goo! Love this

[@dedkeny]

Almighty Algo stuff!!!!!

[@gans512]

50:13 John: I dont think that was too awful Me: It would have taken me yearsss !!! LOL - As always great xploit. Keep the good stuff coming. Hope you win the raffle !!

[@AUBCodeII]

Thanks for uploading this video, John! I learned a lot from it. Unfortunately I wasn't even able to get the first flag. That made me feel really bad :( Maybe I gotta try harder

[@cuttlefishn.w.2705]

After an hour or 2, go out for some fresh air for about 5 minutes, brainstorm, and come back googling whatever you came up with.

[@AUBCodeII]

@@cuttlefishn.w.2705 I'm afraid this wouldn't have worked in this case because I got stuck in the /etc/hosts part. I didn't even know that was necessary to proceed with the CTF. I was trying to exploit the main subdomain, using its IP address

[@bmbiz]

@@AUBCodeII That suggests you shouldn't be doing rooms with "hard" difficulty yet.

[@AUBCodeII]

@@bmbiz oh that was a room with "hard" difficulty? I didn't know lol

[@bmbiz]

@@AUBCodeII 😀

[@jeromesheerin1982]

your the cream of the crop, John, very very good.

[@erosmlima5981]

​🏂Like always, the most Top on the field!!☕

[@clarksoft]

I spent all the time to get foothold. no clue about privesc.. nice machine.

[@yanex4631]

8:41 You are very funny 😂😂

[@48pluto]

Nice Job

[@PreetisKitchenltr]

This was hard!

[@Maik.iptoux]

Is there a way to specify the installation directory of Programms with the standard apt-get packet manager? Like you with all your tools in one folder /opt

[@ARZ10198]

Peculiar

[@TalsonHacks]

29:44 that moment xD

[@maxbunnies]

Love watching these. Have no idea what’s going on. All seems wayyyy to hard

[@_AN203]

20:11 SO THAT IS A USER IMAGE !!!!

[@Johnstuart2023]

Ah a shrek reference a man of cloture 👌

[@abdullahshoukat2075]

Bro thus room was very hard

[@Shiv_the_human_code]

Hello sir I am also interested penetrate testing but sir I have little bit confusion when I play start CTF on try hack me platform. Many of concept I never be familiar with them so it makes difficult to solve so sir you have resources which can help us plz tell and If you make the videos on pentrate testing concept which things exactly to know for beginners it's very helpful And what to do when we stuck ? And I solved blue machine (tryhackme) by taken reference from your video

[@mossdem]

One more comment then I'm out of here lol but I am currently trying to learn how RSA works and how I can decrypt it effectively to complete some CTF's but i am finding it incredibly difficult to learn. Would it be possible for you to make a tutorial on how to get around these types of things using python etc.

[@xB-yg2iw]

Check out cryptohack, they have a pretty comprehensive series of challenges to learn this

[@mossdem]

@@xB-yg2iw ah you absolute legend! Much appreciated

[@mossdem]

@@xB-yg2iw wow it’s perfect just checked it out. Couldn’t thank you enough for this 👍🏼

[@kuldeepkasab]

l love you john you are the best :)

[@cuttlefishn.w.2705]

How do you determine what's considered "cheating" when the game is hacking, i.e. unauthorized/roundabout access to information? Apparently searchsploit's on the table, how about prior writeups?

[@softwarecyclist5348]

What computer set up do you use John ?

[@mohinparamasivam5189]

I guess you wouldn't need to use ngrok, since ur in THM VPN connection... cool video @John Hammond

[@venomanonymous916]

Like your videos maybe you can do a easier one and Chyna do a walk-through explanation of what you’re doing and why like so much

[@lioralalouf61]

youre so awsome

[@anonymous.reddy0]

PLEASE make a video how to install sublime in linux i am unable to install sublime text editor

[@RareSushi]

so was jellyfin just a rabbit hole?

[@dedkeny]

Alistair the Alligator is legit

[@ahmad_el6861]

can I ask to teach the Termux application?

[@jkobain]

- _That should request the page!- Yes, if only you had edited both requests to use the same path.

[@neilslater877]

everytime I run the exploit for monitorr it's giving me a " is not an image". Its like it's not uploading anything at all???

[@SecurityTalent]

Great

[@tanrrivtko1249]

Trying to join your discord, but can't seem to get the link to work :(

[@mechadrake]

hey, would you try analyzing RotaJakiro linux malware next?

[@AlphaLumenTV]

I would be interested in this as well!

[@AUBCodeII]

About ngrok, I think the only reason it didn't work is because the outbound traffic to the port created (11559) is not allowed by the box. I may be wrong though

[@AUBCodeII]

[SPOILER] After rooting the machine, if you run the command "iptables -nL" you can check out the allowed ports: 443,445,80,25,53

[@mayurahir9340]

I trying this room and i am successful uplod the shell but i dont know why my reverce connection of net cat is not get back i also try with ngrok but still not working pless help me

[@BluEhui09]

Oh Jesus, this is a big giveaway, and I really need this😛

[@PreetisKitchenltr]

Nononono. You aren't aware. This giveaway is not by John Sir... There is a room on TryHackMe Called Year Of The Jellyfish. The rooters of that box are participating in the giveaway. It's gonna end soon.

[@aditikeni804]

@@PreetisKitchenltr yeah

[@grim.reaper]

What OS you are on?

[@REBL0X3RSCREW]

Ok nice

[@liamlouw4643]

Did this exceptional specimen say... jif?!??

[@untitled8027]

what's the song at the end of the video?

[@abulaman8713]

How did he "stablize the shell", he has done it like multiple times, but I have no idea what he does

[@rajdipdeysarkar4553]

Great 🔥😍

[@lorenzo42p]

jif is wrong, Gif! it's a G

[@mossdem]

Can someone give me the shortcut John is using to open a new instance of his shell please. Absolutely nothing I have searched gives me the answer lol

[@_JohnHammond]

I use Terminator, and have the keybinding hotkeys so Super+Right will split vertically and Super+Down will split horizontally. Very convenient for just jumping into a new shell in the same current directory :)

[@mossdem]

@@_JohnHammond ah that’s awesome! Thanks for getting back to me. Awesome video by the way

[@jimgetsjob9551]

i have watched so many of johns videos. really started to respect him... untill 1:15 ...it is a sad day... Pfft Jiff

[@v4ltonn]

Every time I get blocked for reverse shell i use 53 port so that can bypass firewall and so i can have shell give it a try !

[@vibiemood1079]

♥️🇮🇳 pretty cool and knowledgeable !!!

[@babekpasha]

I want to get this :)

[@ayush_panwar1]

Hi sir, you should use clipboard extension to have your copy paste functionality more fast , btw im your big fan , your videos are awesome . Hope to meet you one day. Love from india🤗🤗

[@vordann2829]

what is ur os?

[@anthony6604]

cool

[@wikeff]

Damn ur voice is just Farquaad himself

[@eliasmoreira7335]

Desafio muito bom, mas dificil

[@allenjo]

Cookies!

[@wasifekbal]

What happed between 29:43 - 29:56 ?? What you were thinking ??

[@user-mc7pq3oh3i]

3:15 You are inside a VPN, how your ISP will know that you are doing an Nmap scan?

[@_JohnHammond]

This box uses a public IP address that is not within the VPN.

[@themightiestofbooshes9443]

i made a python module to do my math homework for me but watching you do all this is making me feel just a little unintelligent

[@lorenzo42p]

what is updog

[@mattburks5243]

What's updog?

[@jd-raymaker]

ooknib and ogwxxb collab when?

[@magicball60]

Pretty easy for a contest

[@stirringthepot3652]

what OS does he use?

[@rxy10]

Ubuntu

[@joelpainchaud4887]

Why does it sound like John has a 75 character password.

[@roshantiwaree8737]

I'm waiting for zeus 😐

[@Lone_God]

I need it ...

[@kraemrz]

9/10 likes 1 down because you missed to rename the extension on rev-shell script 🤪 Love your videos ❤️

[@neilslater877]

man how do you even cheat in these boxes?? lmfao

[@shivaganesh6939]

🤩🤩🤩🤩🤩😍

[@itxmustfa]

The room does not look hard as before advertising the Ctf. It's a really easy one not so much tough Thanks by the way because I was also stuck on the back connection but my scenario style is different.

[@dafivehd1953]

Wee

[@ImagoCanis]

yo frick muiri! this box was harder than anything that’d be on oscp. i’m so sick of being made to doubt my readyness for it because of this kinda shit. and the oscp itself isn’t even a fair representation of what any netsec job would entail. ctfs are literally cancer.