Unlock the World of Shellcode - Day 8 of TryHackMe Advent of Cyber 2024

[@m4st3rcub3]

Hey. For anyone having difficulties to copy and paste. Make the two machines side by side, then copy to clipboard, let the clipboard open and select the whole content in the clipboard. Then shift click anywhere on the Victim Machine and a Paste button should appear and now you can CTRL-SHIFT-V. Hope it helps.

[@GnashingFox]

Best solution for me was to use Chrome from a Windows Machine. I had to try today's challenge 3 times (Tried Safari from a Mac and FireFox on Windows, no dice for either of those) and that finally worked for me.

[@camerawman]

Man if only walkthroughs were this easy to understand and with this quality. Great Video overall

[@TheBeardedITDad]

Thank you so much This made my day

[@TachikomaByte]

My technique for copy-pasting: 1) Arrange your windows: a. Place a Linux window on the right (single window). b. Place a Windows window on the left (single window). 2) Open NotePad in the Windows (left). 3) Linux (right): a. Copy all the text using Ctrl + C (Sublime Text). b. Paste this text into the clipboard using Ctrl + V. c. In the clipboard, press Ctrl + A to select everything. Windows (left): a. Hover your mouse over the Windows and left-click. b. "Paste" option will appear. Click it. (If this doesn’t work, try again) step 3)-c c. Now, you can use Ctrl + V to paste the text into NotePad.

[@ivanduseigneur403]

Yo Thanks for that. I was having trouble with the copy-pasting. Glitchy

[@SNKGO]

Dear The Bearded I.T. Dad, I really enjoyed completing this task by watching your video. Thank you, and I wish you a Merry Christmas!🎄

[@TheBeardedITDad]

You're welcome! Merry Christmas to you as well!

[@Lahmikhara]

Great video, it was easy to follow along. Like many others in the comments here I struggled with powershell crashing. After loads of grubling, cursing and sleeping on it over the night I figured out where I went wrong eventually. Actually being rested helps! Who knew! Turns out, in the final step, I used the target i.p. adress, (for generating the shellcode through msfvenom) instead of the one from the attackbox. It's shown to the left of the screen. Once I changed the shellcode accordingly and setup the nc -nvlp 4444 command on the terminal so it started listening. Everything worked like a charm. Hope this helps others who struggled with the same issue I had. Personally I had a very strong urge to facepalm when I figured out where I went wrong 😅

[@TiredTyler1]

For copy and paste issues: What worked for me is getting out of split screen and making each machine its own window. I used the clipboard on the attack machine and then created a text document on the desktop from the remote machine. After Ctrl+shift+V into the text document, I was able to copy and paste from the text document into PowerShell.

[@GnashingFox]

Best solution for me was to use Chrome from a Windows Machine. I had to try today's challenge 3 times (Tried Safari from a Mac and FireFox on Windows, no dice for either of those) and that finally worked for me.

[@T-Rex0711]

I wish you were doing the walkthroughs for all the tasks this year, loved your set, outfit, and readings. Bringing some jolliness to this challenge!

[@joshkundrat4584]

why does Powershell keep crashing when i do the last part of the command?

[@sarah-og8cb]

glad it not just me with that.

[@constantinmihailuta7599]

Same here: on the last 4 lines of code, even if I do line by line copy-paste, powershell crashes after the command $thandle = ....

[@MatthewWharton]

Anti-virus is detecting it as a virus. I couldn't disable it and didn't find a solution to bypass it.

[@TheBeardedITDad]

You need to copy paste line by line (or code segment by code segment as mentioned in the task) for it to work.

[@GnashingFox]

Make sure you have the port open to listen from the AttackBox. My PowerShell crashed when I forgot to set the port (1111 or 4444) with the 'nc -nvlp xxxx' command in the AttackBox Shell.

[@abdisamadjoe]

Keep up the good work, Dakota!

[@TheBeardedITDad]

Thank you

[@atharvavlogs1446]

Thank you so much sir for the DAY 8 solutions. Great video

[@TheBeardedITDad]

Thank you

[@ce9509]

Thanks for the walkthrough, @The Bearded I. T. Dad Q: How is Glitch regaining access if the reverse shell still works. Is he creating a different reverse shell access and changing the the listening IP and port so that the attacker listening in 1111 will be waiting in a void? Can he successfully block the reverse shell by finding and clearing the allocated memory of the custom script?

[@sylvainkirouac3262]

Tried the last part with listener active on 4444. the powershell windows crash every time, even if I paste the last part line by line( got to be real quick for the last line, as it crashes almost immediately after &thandle line). Retried it many time, checking spelling , making sure my msfvenom command is correct. Giving up for tonight after spending more then an hour on the last part.

[@G3rmanGsnLP]

Did you make sure to run nc -nvlp 4444 on the attackbox beforehand? At first I assumed there was some service running on the attackbox listening to 4444 which places the flag via the reverse shell, but apparently not.

[@sylvainkirouac3262]

@@G3rmanGsnLP turns out i had my virtual machine ip instead of my attack box ip in the msfvenom. must of been too tired when I started to do the task and used the wrong ip. worked in 2 minutes today.

[@SNKGO]

@@sylvainkirouac3262 In the beginning, I had a hunch that I was doing something wrong when I adjusted msfvenom. But then, I didn’t care much about that mistake. Your last command saved me from making the same mistake over and over again and helped me figure out where I was doing wrong. Tons of thanks!

[@LuisPerez-ir5mw]

i tried the same 1111 and 4444 but no luck PowerShell just keeps crashing

[@rightmw8079]

@@LuisPerez-ir5mw same. tried copy pasting line by line, everything FROM Notepad, then into PowerShell, just doesn't budge.

[@PushingYourLimit-]

This task is fun, I enjoyed it.

[@TheBeardedITDad]

Thank you

[@Dr4hcir]

Nice one, great walkthrough. Thank you!

[@TheBeardedITDad]

Glad you enjoyed it!

[@Ox8jOrn4r8Or93]

Thank you beard! Great video.

[@TestTest-e9d]

Great video. However how do I paste in the AOC windows machine ? I am on safari and used everything I know and I can’t paste….

[@hadar996]

you succeeded?

[@TheBeardedITDad]

I found if you pop it out of split screen it works

[@GnashingFox]

Hello! In the split screen view, you will see a small tab on the left side. Click that, then click the clipboard icon. After that, paste the text from Try Hack Me in there, and you should be able to paste into the virtual machine from there. Don't forget, use CTRL+SHIFT+V OR RightClick > Paste to paste into the shell/powershell. :)

[@xAESEC]

Thanks for the short but also good explanation :D

[@Evangelos_Bl]

Thanks for the tutorial. But in real case scenario how do we gain access to the target machine remotely? we are supposed to hack it to install the shellcode.Happy new year!!

[@TheRealVegapunk]

Happy Soc-Mas :)

[@לומדטסטר]

i have a q for u - What you did here is use both "computers" But when I actually do an attack like this, I do it from my computer Without a computer that I'm attacking... So how is it done?

[@ce9509]

+1 the target system is the one that initiates an outbound connection to the receiving network host. so, physical access or injection of code with the powershell script in the victim's machine will be the 1st step .

[@לומדטסטר]

@@ce9509 yes, but to do that you will need access to the victim's machine...

[@Siarczak88]

Any idea why the flag isn't showing up? I'm using Kali Linux, as I'm capable of establishing a connection to the target machine, I guess IP address is correct as well as I'm listening on 4444. I can access from Kali C:\Users\glitch\Desktop, but there's no flag... ?

[@maleu77]

same, flag didn't appear for me

[@pramodyadav.007]

For copy paste issue: Guys chill and take a deep breathe, the issue is to give access to clipboard, simple trick which I do is: "or me this works: there is option to maximize the split part (or VM or Attackbox) to the another tab and now there on the browser address bar just adjacent to refresh icon (say u r on chrome) there is an option (view the site information) click on it and there will be an option to give permission to clipboard (a toggle switch, if it is off, toggle it to on) and then you can do whatever you want to do... meaning you can copy paste in all the windows (i do right click and use copy/paste) as needed. This way I can have the maximized screen for VM or AttackBox and this works for copy paste frustration as well !!

[@xfraylin7932]

Thank you

[@arczeroes]

I'm unable to copy and paste between the VM and AttackBox. I copy the contents of the clipboard with cmd+c but once I switch over to paste it into the AttackBox (ctrl+v in a txt file first or directly into powershell) nothing happens. When I go back to the VM the clipboard is empty. Is there something I need to consider if I am using a Mac right now?

[@9cesec.1]

you have to paste it in the attackbox clipboard first before you will be able to paste properly. Check this video at 10:47 and see how he did it.

[@wasssuuuppp]

@@9cesec.1but how do we do it for the Windows one? I did everything he did and it’s not letting me. I’ve been so frustrated doing this whole cyber advent lol

[@9cesec.1]

@@wasssuuuppp Sorry about that, I also did experience the same thing at first, I noticed that if your browser blocks sending pop up notification then you won't see an option to allow copy and paste. You can check and allow pop up notification and see. you can also try a different browser and see, I usually use virtual box but for that particular task I had to use my normal machine chrome browser.

[@rufoesd]

AMI NO ME DEJA COPIAR EL PAYLOAD DESDE LINUX PARA PEGARLO EN LA POWERSHELL NI PASANDOLO POR EL PORTAPAPELES NI DIVIDIENDO LA PANTALLA NI NADADA QUE OPCION TENGO ?

[@DtfT_]

Yo abrí una sesión RDP con Remmina en parrot, copie el código directamente de la Tarea en THM. Luego, para pegar, presionas Ctrl + Click en cualquier parte de la pantalla pero de la ventana que tiene corriendo la VM Víctima en el navegador y notarás que aparece un pequeño botón en pantalla que dice Paste, le das click sobre ese botón, vas a la sessión abierta con Remmina, das click derecho sobre la ventana abierta de powershell y se pega el código. Intenta así.

[@wasssuuuppp]

Me too what a shame

[@nasif5660]

Good to know that I'm not the only one struggling with copy-pasting

[@wasssuuuppp]

I feel like I’m losing my mind trying to do it lol. I know how to do it from the Linux machine but the Windows one won’t let me.

[@pito01234]

I had issues running both VM's at the same time but thankfully I was able to follow along with your video. Thank you

[@samuelaguiar2392]

In this class, I learned how an attacker can use shellcode to gain remote control of a Windows machine, generating a payload with msfvenom, injecting the code into memory via PowerShell and establishing a reverse shell using Netcat to control the victim's system. I thank your for your excellent explanation and the clear and practical demonstration of essential cybersecurity techniques!

[@zigaudi]

First! Also, great video.

[@TheBeardedITDad]

Yay! Thank you!

[@dj_bsec]

Great Video quality….subscribed.

[@TheBeardedITDad]

Thank you! I'm glad you enjoy the quality!

[@j_ray0101]

the flag is not appearing in the machine after reverse shell in port 4444

[@TheBeardedITDad]

are you using the correct IP address?

[@daratolsam]

If you're going to finish this challenge, let's gather here 👇😉

[@handle_your_set]

I’m here for all of it. The way it’s geared, in combination with being properly medicated, I feel like my old self. Obsessively curious, and adequately capable. ADHD used to be such a frustration… since this event, I’ve completed more consecutive planned for the day tasks, than I have in the last 6 months combined. This event, is my ramp up. ❤

[@daratolsam]

​That's cool man 😎 @@handle_your_set

[@dhimic]

How do you copy into the Windows VM? read thru the comments, I can copy to my local machine to a text document, but I can't get it to copy into the VM for anything. Tried in Safari, Chrome, Edge. Exited Split View, restarted the machine. I cannot copy into the VM. I can copy and paste to and from my local machine and the attack box all day.

[@pramodyadav.007]

for me this works: there is option to maximize the split part (or VM or Attackbox) to the another tab and now there on the browser address bar just adjacent to refresh icon (say u r on chrome) there is an option (view the site information) click on it and there will be an option to give permission to clipboard (a toggle switch, if it is off, toggle it to on) and then you can do whatever you want to do...

[@joedoe9134]

after the line $thandle ,powershell ,it just crashes. 4x time now...just...

[@GnashingFox]

Make sure you have the port set to listen on the AttackBox, My Powershell crashed when I forgot to set the port to listen (nc -nvlp 1111 OR 4444) in the Attackbox shell.

[@anikettiwari5116]

Sauta claus

[@patongpanda]

Windows Defender closes down the PowerShell when I add the CreateThread line

[@GnashingFox]

Make sure you have the port set to listen on the AttackBox, My Powershell crashed when I forgot to set the port to listen (nc -nvlp 1111 OR 4444) in the Attackbox shell.

[@sanahabib1538]

Great Video! I am facing the same problem with pasting code in windows power shell. I tried right click and paste, CTRL+SHIFT+V, and popping it out of the split screen but nothing seems to work. I would appreciate any suggestions. Thanks in advance!

[@GnashingFox]

Best solution for me was to use Chrome from a Windows Machine. I had to try today's challenge 3 times (Tried Safari from a Mac and FireFox on Windows, no dice for either of those) and that finally worked for me.

[@pramodyadav.007]

Hey Sana: For me this works: there is option to maximize the split screen (of VM or Attackbox) to the another tab and now there on the browser address bar just adjacent to refresh icon (say u r on chrome) there is an option (view the site information) click on it and there will be an option to give permission to clipboard (a toggle switch, if it is off, toggle it to on) and then you can do whatever you want to do...

[@wasssuuuppp]

@@pramodyadav.007I’m using Firefox and it isn’t a option 😢

[@fyreweaver91]

The copying and pasting is completely scuffed and broken. Why can't it just be a simple ctrl v and ctrl c? I've tried all the suggestions and am on Mozilla Firefox. WTAF?!

[@sb77de]

whats causing the flag to show up?

[@hypoblood21]

defender got smart gg

[@Miklos211]

I got windows instead of Linux so I cannot complete the task

[@sauceymitts137]

Yours Separates the chunks of shellcode mine just gives me >> for every line -_-

[@TheBeardedITDad]

you got to paste them in line by line then click enter

[@GnashingFox]

there should be 3 separate 'pastes' 1.) first chunk > hit enter. 2.) shell code from attackbox > hit enter. 3.) the last 4 lines (I did mine all at once) > hit enter. Now, check your attackbox (make sure the port was set to listen before executing cmds on Powershell with 'nc -nvlp 1111 OR 4444' ) and you should see a connection to the Windows Machine.

[@wasssuuuppp]

I can’t even paste, been trying the method you use but won’t work for me 🤦‍♂️

[@ephraimyberman6299]

solution ?

[@carsonjamesiv2512]

NICE!😃👍👍

[@TheBeardedITDad]

I'm glad you like it!

[@whilykitt]

so uh, why are the flags being shown unencrypted in these videos? I had to freaking RDP in from my own VM to get copy/paste functionality. I had a lot more fun doing that than I did watching these videos. If this is a contest, why does it seem more like remedial education? Game shows have standards, this seems like more enshitfication as all you have to do is watch the videos and bobs yr uncle. There's no skill in that. I wouldn't even have to "do" the rooms to succeed in this. So again why not make the slight extra effort and hire artists or poets. I'm not really impressed by the amount of kind of crap AI used for this whole thing. This isn't a dig on The Bearded I.T. Dad, I actually quite like his content and this video was informative, this is just the room I got most frustrated on, thus this comment!