/KoTH-Tools

Personal "King of The Hill" toolkit.

Primary LanguageShellMIT LicenseMIT

KoTH-Tools

Welcome to KoTH-Tools, a collection of custom tools used in TryHackMe's King of the Hill competition.

These tools are designed for use on Linux machines.

Table of Contents

CVEs Directory

This directory contains exploits for CVEs found in the machines.

Static Directory

This directory contains static binaries that can be used in the machines. These binaries are compiled statically to avoid problems with missing dependencies. Some of them are used in other tools.

* Compiled with Makefile. Source code is available in the static directory.

Monitor Directory

Includes a script to monitor file changes in the /root/king.txt file.

When changes are detected, the script will attempt to overwrite the file with the player's username.

Currently in development.

Animations Directory

  • hello.sh - Display a "Hello" message.
  • nyan - Display nyan cat animation.
  • rickroll.sh - Display rickroll lyrics animation.
  • spin.sh - Display animation of a spinning saturn.

This directory contains animations that can be displayed in other player's terminals. Like so:

# Get your tty number
tty
# Enumerate the tty numbers of other players
ls -l /dev/pts/
# Display the animation in the other player's terminal
./animations/nyan > /dev/pts/<tty_number>

Getting your terminal flooded with animations is a significant setback toward winning the game.

Here's a simple way you can prevent that from happening when using ssh:

ssh -T <username>@<ip>
tty
# No tty number will be displayed

From ssh manual:

-T      Disable pseudo-terminal allocation.

Scripts

* According to KoTH rules "chattr" is the only binary that can be replaced in the machine.

Reverse Shells

Used to get a reverse shell in the machine.

VPN

  • thm - Connect to TryHackMe VPN.

You will need to install openvpn to use this script.

Next you will need to edit the thm to replace your username, vpn file path and other variables.

# Define variable for THM username
username="z0d1ac"

# Define directory were $username.ovpn is located
vpn_dir="$HOME/.vpn"

# Session logfile
session_log=$vpn_dir/session.log

# Optional: Location of profile to update (.zshrc, .bashrc, .bash_profile, etc)
profile_file="$HOME/.bash/custom.sh"

Usage:

# Connect to THM VPN
thm

# In alternative add the machine ip wich will be saved in your .profile as VMIP environment variable
thm <machine_ip>

# Disconnect from THM VPN
thm kill

# Show OpenVPN connection log
thm log

Special Thanks

Special thanks to the following contributors for their valuable contributions:

  • @MatheuZSecurity
    • for his tricks.md file.
    • for inspiring me with his systemd.sh script.
  • @f11snipe
    • for his trollrc file.
    • for his thm script for vpn connection and utilities.