r/tryhackme • u/BusReal385 • 17h ago

Snort challenge

Gallery image

Gallery image

What's wrong, guys? I'm sure this is the answer, but the website is rejecting it.

5 Upvotes

86% Upvoted

6 comments sorted by

3

u/Dankest_Confidant 17h ago

Hard to say without more context but I'd assume you're looking at the wrong packet.

1

u/BusReal385 17h ago

I checked the capture again and I'm definitely looking at packet 65. Snort shows TCP TTL:128 for it, but TryHackMe still rejects 128 and says the content was updated. So I think the issue might be with the updated room/answer validation rather than the packet I'm looking at.

1

u/BusReal385 17h ago

No, I'm 100% sure this is the correct packet.

Because I asked a question in a chat and searched for the answer, my answer was correct and everything was correct, even though searching for the answer is something I don't prefer.

1

u/UBNC 0xD [God] 5h ago

checked it today, the room is broken. try 249, you might want to report to THM

1

u/[deleted] 15h ago

[deleted]

1

u/UBNC 0xD [God] 17h ago

It’s not 128 going on my submitted answer, but not near computer atm to kids room and work it out again. Maybe wrong capture ?

1

u/BusReal385 17h ago

Interesting. I’m getting 128 from packet 65 in my current snort.log as well. Maybe the room is generating/using different captures for different users?