modules

[forest tapir]

is this a meme?

[candid zephyr]

In fairness hijacking discord accounts has been a profitable venture in recent years. Tho in most instances here you've got random creepers stalking people

If you look at some big nft scams you'll see people get access to creators discord for launch day. Post non genuine nft. Run away with crypto.

I mean nft scams in the meta sense. Nft is a scam in and of itself. Scamming people already being scammed. 🤷‍♂️

[forest tapir]

Does anyone else get transport failure with xfreerdp? I'm using proxychains so i'm not sure if that might be the issue.

"certificate verification failure",

[vocal vortex]

that would be ssh using the key from d.
Done: thanks for the hint 🙂

[sacred ermine]

Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer. any help for that, I have tried multiple ways like: /home/sambauser/sambashare and other ones, but nothing worked out

[rustic sage]

https://tenor.com/view/waking-up-monkey-just-woke-up-get-up-gif-16655750

waking up realizing you have CS code to write and another module to finish

[pastel gale]

anyone do the live engagement of shells and payloads recently ? i am unable to get the shell on host 1 there is some shitty error

*] Started reverse TCP handler on 10.129.204.126:4444 [*] Retrieving session ID and CSRF token... [*] Uploading and deploying YbaqAfJDIGA1I6CJ0zdEykhnGwrrIH... [*] Executing YbaqAfJDIGA1I6CJ0zdEykhnGwrrIH... [-] Exploit aborted due to failure: unknown: Failed to execute the payload [*] Exploit completed, but no session was created.

[fathom pendant]

https://academy.hackthebox.com/module/77/section/859 I'm missing something on this to move laterally from metasploit grabbing the web vuln but idk what it is

[fickle trellis]

In th minishop from sqlmap essentials skill assessment, I keep getting hints about using * character. I don't understand it. Can anyone explain???

[fathom pendant]

The '*' character is a wildcard for you to grab anything matching after a point so for instance . Finds all files

[fickle trellis]

Yes got it..Thanks

[woeful mural]

Anyone here working on or already done the DNS module?

Has anyone finished the footprinting Module, DNS section?

[worthy jasper]

So I have broken something in linux and don't know how, trying to run ftp [ip] and it says that it cant find ftp, anyone know what I broke and how I can fix it

Ignore previous question, just gonna reinstall parrot again and just run all the commands I need to to get everything again

[rustic sage]

what advice do you give to anyone who wants to become a hacker and has never used a computer

[median anvil]

Have you found a solution yet?

[rustic sage]

first let themuse a computer then let them decide again

[pastel ginkgo]

I finally found it, I just had to re read the source code. I guess my eyes were scanning over what I was looking for. I need to load up an IDE on my kali box so I can read code rather than just cating it out lol

Also huge shoutout to chatgpt helping me understand php code

[wet jolt]

I DID IT MY FRIEND!!!

Thank youuuu!!!! 🥰❤️

[brisk geode]

https://academy.hackthebox.com/module/136/section/1289
can anyone please help me?
i found some methods which can upload the file but i cant find the path to execute the file
shell.phps/.jpg shell.php/x00.jpg

these two gave me 403 error like i have no access
file upload > whitelist filters
heres the url im using
http://178.62.88.144:32124/profile_images/shell.phps/.jpg?cmd=id

[pastel ginkgo]

why are you adding a /.jpg?

that breaks it entirely as your saying a new subdirectory

also I found it handy to first run intruder to upload my shell, then run another separate intruder to see which one actually executes the code

[brisk geode]

i tried url encoding still didnt work

[pastel ginkgo]

How are you fuzzing it?

[brisk geode]

w/o the encoding

[pastel ginkgo]

have you tried playing with shell.jpg.php and flipping it with shell.php.jpg

[quartz surge]

Hello! I am new to HTB, I downloaded Virtualbox yesterday together with Ubuntu 22.04 and Kali (Virtual Machine Image).

The kali downloads as a zip, but should I import it to Virtualbox instead of creating a new vm?

[brisk geode]

can you elaborate?

[quartz surge]

?

Sorry, I didn't understand

You mean you want me to make my question easier to you to understand?

[brisk geode]

yeah

[brisk geode]

its saying extension not allowed

[quartz surge]

Sure!

So yesterday I downloaded Oracle Virtualbox, I also downloaded a Image of Kali named "Virtual Machines" and Ubuntu 22.04.

I am really new and I dont know how to add my kali (which is a zip) to my Virtualbox.
I am not sure if I need to import my Kali zip to Virtualbox. Could you guys help me please?

[brisk geode]

ig you can double click or directly import that zip file

[pastel ginkgo]

https://www.youtube.com/results?search_query=setup+kali+linux+virtualbox

theres like a billion videos lol

[quartz surge]

I was seeing NetworkChuck video but I think it's not up to date

[pastel ginkgo]

should be as simple as downloading the viirtual box vm from kali site

open virtual box

unzip the dl

drop the vm into virtual box

[brisk geode]

can you please help me @pastel ginkgo

[pastel ginkgo]

I can't think of a good hint atm I kinda breezed through whitelisting

I got stuck for hours on blacklisting lol

[brisk geode]

lol

i solved that

now am stuck on whitelisting idfk whats gonna happen in skill assesment

[pastel ginkgo]

cough it comes back up cough

just finished it this morning

[brisk geode]

am frustrated atp

tried everysingle method

[pastel ginkgo]

now im stuck on cmd injections. Once again on blacklist filters

except I found a way around the blacklist with fuzzing but none of the answers are the answer to their question lol

[brisk geode]

i can help you if you want

hint: payloadsallthethings wordlist

[pastel ginkgo]

whoops I see theres a blacklist page, im stuck on the Identifying filters one

I know the following work but htb says no

[pastel ginkgo]

Thought of one, are you fuzzing from .<fuzz>.jpg or <fuzz>.jpg

because the first is an error I made

[brisk geode]

am using the generated wordlist

[pastel ginkgo]

yeah that wont help you, use this wordlist https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload Insecure Files/Extension PHP/extensions.lst

idk how you got past the blacklist with that generated one

[brisk geode]

nah

[brisk geode]

you need that one for the blacklist

[pastel ginkgo]

rip I never used it, that wordlist IS REALLY GOOD cough cough

Also if your not familiar with php code like myself chatgpt is bae

[brisk geode]

lol

im not used to chatgpt yet

[pastel ginkgo]

"can you explain this code" <paste code>

[brisk geode]

ohh

sounds interesting

ty

[pastel ginkgo]

I had no idea how some functions worked and the php site was kinda confusing so I just asked it what x function would match

[brisk geode]

thats cool

now

i need to fix this whitelist asap

been stuck for more than 2 hours

[pastel ginkgo]

use the wordlist I sent you and you should breeze through until the assessment

[brisk geode]

how am i supposed to use backslash in the url

[pastel ginkgo]

uploads/<whatever your fuzzing> like any other site

[brisk geode]

i tried

but

my browser automatically converts a \ into a / which ultimately turns into a sub dir imo

[pastel ginkgo]

send a pic of what your trying and mark it as a spolier

use burp intruder

[brisk geode]

i did

[pastel ginkgo]

once burp finds it id just send it to repeater to ls out the flag.

[brisk geode]

like here

this \ automatically turns into a / after entering

[thorn urchin]

yeah use burp like he said, not your browser

burp will send exactly what you tell it to send

[brisk geode]

i didnt understand

[brisk geode]

can you kindly elaborate more

[thorn urchin]

if you send you payload with burp such as via the repeater, it wont convert the backslash into a forward slash

[brisk geode]

got it

[brisk geode]

i tired its not working ugghh

can you please check is this the correct path url?

http://68.183.47.198:31864/profile_images/sx.phpx\00.png

i tried with diff extensions

[thorn urchin]

yeah trying with different extensions is the entire point of the section/module.

[brisk geode]

only 6 extensions are able to upload the file and none of em seem working while executing the uploaded shell

[thorn urchin]

what I did was use ffuf to fuzz the entire range of possible extensions that they recommend from building the custom list(which I extended). Uploaded them all that way, then used the same fuzz list except formatted for executing the respective shells.

you actually get like a solid half dozen of em that will pass filters

[brisk geode]

i made the custom list

[pastel ginkgo]

use the wordlist I sent to fuzz upload them, then use again with a get request and see content length

[brisk geode]

i did

[pastel ginkgo]

what is your payload?

[brisk geode]

get req one? or fuzzing one

[pastel ginkgo]

fuzzing

you just want output atm, worry about cmds later

[pastel ginkgo]

remember KISS, Keep it simple stupid

[brisk geode]

its for the payloadsallthethings paylod

[pastel ginkgo]

Try using || <?php system('id'); ?> ||

that way it will actually print something on the screen and you know if you got a working cmd

[brisk geode]

these 3 are working

[pastel ginkgo]

with my payload in the response do you see uid?

[brisk geode]

nah

[pastel ginkgo]

then its not executing

[brisk geode]

HTTP/1.1 200 OK
Date: Sun, 18 Dec 2022 16:33:17 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 26
Connection: close
Content-Type: text/html; charset=UTF-8

File successfully uploaded

heres the response

[pastel ginkgo]

do a get request now

[thorn urchin]

yeah he meant after uploading and you checking the uploaded files do you see a response

[brisk geode]

nah it throws either 403 or 404

which one is the correct pathway?

http://68.183.47.198:31864/profile_images/....

[pastel ginkgo]

the one listed in the module

[brisk geode]

or

http://68.183.47.198:31864/upload.php/....

[pastel ginkgo]

use the one listed in the module

http://SERVER_IP:PORT/profile_images/shell.php.jpg?cmd=id

[brisk geode]

okay i got a diff response now

lemme try more

brb

[brisk geode]

can you please give me a hint?

[thorn urchin]

ive got nothing that hasnt been reiterated already

[quartz surge]

Hey uhm

How do I connect my htb openvpn with my kali VPN?

I see some cmd commands

But they throw err

I have that one already

[pastel ginkgo]

How come on file upload attacks {ls,..${PATH:0:1}} works but if you do something like {ls,${PATH:0:5}} it wont work, but will work in my normal shell 🤔

nvm I figured out with a little playing

it works its just that the path is different for the remote host

[vital adder]

even if your user is www-data that user should still be able to access /usr/ that is kinda weird (i test it on wsl but ${PATH:0:5} should be /home not /usr/)

[pastel ginkgo]

now why cant I chain it like a true masochist ${PATH:0:1}${PATH:1:1}${PATH:2:1}${PATH:3:1}${PATH:4:1}

nvm that worked too

maybe I was doing something wrong earlier

Yeah I already got the flag I just wanted to play with it more

it gets the usr directory for whatever reason

[vital adder]

oh i got the same thing on wsl

but a the pwnbox give me /home

[pastel ginkgo]

When I echo the path on the remote host Im command injecting I get

which explains why

I thought it be fun to whip up a python script that would let you write commands in just env variable chars

but it would only work for your local host lol

[quartz surge]

Someone pls?

[pastel ginkgo]

the instructions are right next to where you download the vpn

[quartz surge]

Yeah ik

But they dont work

[pastel ginkgo]

check out the comunity help and #faq

[vital adder]

of you don't have hackthebox academy account make one and do the Getting Started module
https://academy.hackthebox.com/module/details/77

the Connecting Using VPN section should have everything you need to know to use open vpn

[pastel gale]

i am yet stuck on live engagement host 1

the reverse shell just doesnt work

any help?

[topaz prawn]

How do I find out what she’ll is specified for the htb-student user? And the path to htb-students mail? I got the rest of the questions stuck on these 2 any tips?

*shell

[pastel gale]

which module

[topaz prawn]

Linux fundamentals section system info

[quartz surge]

It drops error "Error opening configuration file: user.ovpn"

[vital adder]

the user.ovpn is just a placeholder for your vpn file

[pastel gale]

In live engagement host 3 i have got reverse shell using antak but i am just stuck there do we have to perform some sort of priv esc to get admin

[fathom pendant]

replace 'user' with the ovpn file you downloaded

[quartz surge]

And what if my file is on downloads

Do I have to move its location?

[silver zenith]

Hack the box should write blogs

[fathom pendant]

nope you just need to put in 'user'.ovpn you can specify absolute path if you want

[silver zenith]

About currently active topics

About hacking

[quartz surge]

Still says the same error

[rustic sage]

they do…

[silver zenith]

Wrong room:p

[vital adder]

after the lab get updated the new intended way to do it is the one you are doing and a hint for your next step is you can use something like exploit suggester to priv esc but the old method is still usable and the last time i check the hint didn't get updated and with the old exploit you should be able to get nt system

[silver zenith]

Damn didnt know that

[quartz surge]

It's the same err with my file

[vital adder]

can you send a screenshot?

[quartz surge]

Uhhh

Give me a sec

[vital adder]

this is the first the firefox spam you when open on the pwnbox https://www.hackthebox.com/blog

[pastel gale]

thanks for the info Also about host 1 is there anything weird? i have done everything but the reverse shell doesnt seem to be working

[silver zenith]

Tnx👍

[vital adder]

after the update nothing so far but i try with a shell that give you RCE instead of a rev shell

[vital adder]

i never saw or got that error code before and searching that error on htb discord only give me 48 results so no idea but try re-generate your vpn and download that new one

[pastel gale]

so basically another metasploit payload hmm

[quartz surge]

uh?

[vital adder]

hint nope one of the RCE show in previous section

[vital adder]

wait a sec

make sure your vpn file is even there 🤣

[quartz surge]

it is ._.

i mean my ovpn file is on downloads

[vital adder]

and are you running the openvpn command in downloads?

[quartz surge]

no-

yeah well thats maybe the problem

the thing is... how do I run in downloads

💀

[pastel gale]

ok but this antak webshell thing is such a pain

i am trying to et winpeas on it but i have no permissions

powershell is shit

[vital adder]

earlier i did send you 2 video i think both should have some stuff about linux you need to know how to linux work first before you can even start learn hacking

but you can just use cd into downloads (cd Downloads)

[vital adder]

wait i you are using the wrong shell

[quartz surge]

cd Downloads

[quartz surge]

yeh, i remembered

[silver zenith]

Jezus holy crist haha

[pastel gale]

i am using antak.aspx webshell i can also use a normal aspx shell tho i know it will work

[vital adder]

the target website should have some info on what shell you should use or something like that

[vital adder]

i use the normal one

for that the normal did you add your ip into the whitelist or something?

here just use this cp /usr/share/webshells/laudanum/aspx/shell.aspx ~/; sed -i 's/192.168.0.1/'$(/opt/vpnbash.sh)'/g' ~/shell.aspx

[pastel gale]

you talking about host 1 or 3

[vital adder]

1

[pastel gale]

atm i was talking about 3

[quartz surge]

it said completed, but now my htb doesnt show it is connected

[silver zenith]

Cd /home/<user>/Downloads; sudo openvpn file

If ur running linux

[vital adder]

you need to wait a sec for htb to show that or try refresh the page

[quartz surge]

it worked the refresh

ty

[vital adder]

oh i just double check i also use the same normal shell on that host

[pastel gale]

didnt know apache also uses aspx shells hmm i should try that

[silver zenith]

Or why bother cd?

Works fine whitout

[pastel gale]

wait but tomcat allows only .war uploads

is burpsuite the way

[candid zephyr]

What are you trying to do?

[vital adder]

the only note i got on getting a shell in copying the shell but nope i didn't use burp for this

[pastel gale]

i am trying to get a revrese shell on a tomcat manager

[quartz surge]

bruh what?

[vital adder]

don't hack the website

[thorn urchin]

rip

[quartz surge]

I am not trying that

I just tried logging on my account

[candid zephyr]

Do you have file upload? Have you tried the metasploit tomcat module?

[pastel gale]

i have got .war payload using msfvenom and manual ways

[candid zephyr]

Usually beginner tomcat boxes are trying to force you into using the metasploit module lol

[pastel gale]

uploaded them

run them

yes metasploit gives me exploited but no session created

[quartz surge]

i just wanted to enter my account

[pastel gale]

[quartz surge]

how to I take that ban off?

[pastel gale]

#1053986848394985492 message

[thorn urchin]

contact support

[pastel gale]

WHYYY do i have to use this shitty box with rdp its so slow my eyes just hurt tryng to move around the windows

[quartz surge]

it says it is a temp ban

so it means I can just wait?

[candid zephyr]

rdp shouldn't be slow. use remmina or something.

unless you're using a potato

[thorn urchin]

either its s legit ban and you wait it out, or its a mistake and you contact support.

[candid zephyr]

wait what are you trying to do? rdp into a windows box and get a reverse shell from a linux server? is it a pivoting room or smth?

[vital adder]

the update i mentioned is more like a downgrade to an older lab or something because of too much complain about the original nomachine

[quartz surge]

how do I contact support?

[vital adder]

also give me a sec i'll double check host 3

[quartz surge]

also

if i gtg

do I send my vpn to sleep?

like turn it off?

or i just close my virtualbox

[pastel gale]

power it off

[quartz surge]

how

[pastel gale]

suspending it generally gives you issues on next startp

on top right corner there should be a power button

like a small circle with arroe

clock on that and click power off

Also @quartz surge everytime you power on you will have to setup openvpn dont forget that

[quartz surge]

i dont see it

[topaz prawn]

I figured it out! Ha!

[quartz surge]

what i mean is openvpn

how do i turn it off

[pastel gale]

ohh

just close the terminal running it

[quartz surge]

kk

ty

cya!

[pastel gale]

exploit aborted due to unknown failure -_-

[pastel gale]

tried remmina and rdesktop its pretty much the same

it could be becoz of firefox running on the rdp

[vital adder]

i just give it a check and host 3 is supposed to be ||Microsoft IIS|| not tomcat

[pastel gale]

i know host 3 is not tomcat

i was talking about host 1

[vital adder]

nope whatweb show host 1 is the same thing

[pastel gale]

so basically
Host 1 : Tomcat .war shell with metasploit exploit doesnt seem to work for me
Host 3 : aspx webshell works but i am unable to escalate and go to the directory with the flag

[vital adder]

for host 3 hint ||exploit suggester||

and for host 1 no idea where did you found tomcat

[rustic sage]

hello, good afternoon, does anyone know what the wl command is to do a sql injection attack on a website?

[pastel gale]

this is so messed up

[thorn urchin]

what module is this for?

[pastel gale]

so basically i see the etc/hosts file i see status.inlanefreight.local

[thorn urchin]

because this is the modules channel for academy so clearly your question must be about a module right?

[rustic sage]

??

[pastel gale]

||172.16.1.11:8080||

[pastel gale]

This is what host 1 is supposed to be according to the module @vital adder

[thorn urchin]

youre in the wrong place

[vital adder]

i think it is but not on that port

[rustic sage]

and where can you help me with this?

[thorn urchin]

nowhere, get bent

[pastel gale]

can i dm you a ss

[vital adder]

sure

[jade gulch]

i enrolled for modules got 200 cubes

what will be the best way to start spending the cubes

[thorn urchin]

unless you decide to start doing academy and do some modules, then get unbent and come back to learn and then be more than happy to help

[thorn urchin]

depends in your background

[jade gulch]

i m in academy section

[thorn urchin]

that was for someone else, dont worry

[jade gulch]

i m used with nmap and other things

[thorn urchin]

if you need more fundementals, theres a couple of good fundementals modules you can grind out, otherwise Id stick with the CPTS pen tester path and just follow those modules in order.

worst case scenario is itll help you ascertain if you need better fundementals or not, but otherwise its a very well laid out out path, and 200 cubes will get you pretty far through the beginner sections.

most people doing academy are either aiming for the CPTS or the CBBH cert as a goal

[jade gulch]

i m aiming for cpts

[thorn urchin]

then yeah just enroll in the path and do the modules in order and take notes

[jade gulch]

ok any good notes making app for mac

[thorn urchin]

obsidian, regardless of OS

[jade gulch]

obsidian does not work in m2

[thorn urchin]

news to me

everything Ive seen says it still works

[fathom pendant]

anyone wanna help me figure out how to pivot? I'm remoted in and can execute commands as www-data but cannot pivot

trying to figure out from here (already grabbed the user flag) need to pivot to root

[thorn urchin]

what module?

[fathom pendant]

https://academy.hackthebox.com/module/77/section/859

[thorn urchin]

im on mobile and dont want to click links, just say it

[fathom pendant]

Knowledge Check for the getting started course...

GetSimple exploit

[thorn urchin]

ah I didnt take any notes for that one sorry, best of luck

but if youve exhausted normal manual checks for privesc, try out linpeas on it

[fathom pendant]

i'll see if I can pull it i'll have to download it but that may work I was trying linenum but when trying to pull it it said 404 file not found :^)

[vital adder]

hint go back to the PrivEsc section

[thorn urchin]

linenum isn't as good as linpeas imo

[vital adder]

the last time linenum get updated was like years ago and linpeas also check for PrivEsc vuln like Pwnkit

[jade gulch]

i tried downloading obsidian mac dmg on kali vm

lol it works fine

[thorn urchin]

only risk with that is it can be so new itll suggest things that are completely unintended paths lol

[fathom pendant]

I'm more trying to get it to pull on my end but It's giving me a 404 file not found when doing the request should i be trying a ||curl -L instead of wget?||

[thorn urchin]

so you can go down a rabbit hoke trying something super complex if youre not like, "well this box made in 2015 isnt going to be intended to ve solved by pwnkit, I ought to look deper"

[thorn urchin]

are you trying to pull from the host straight to the github?

[fathom pendant]

I'm pulling from my machine from the host

[thorn urchin]

then either should be fine, if youre getting 404 youre probably hosting it wrong

[fathom pendant]

sudo python3 -m http.server {port}

should be 80 or 8080 or?

[vital adder]

for this you don't need linpeas but if you want to learn how tool like that work by all means do it but you can just do some manual check and get root in no time

[vital adder]

it should be the port you give

[thorn urchin]

whatever youre not using, I like 80 because its more realistic for the rare outbound firewall rules

[fathom pendant]

My manual Checks are proving fruitless I'm not sure what I'm missing

[thorn urchin]

what manual checks have you done

[fathom pendant]

sudo -l showing I can run php

[thorn urchin]

welp there ya go

hint: if you can run any programming language interpreter as root, you can always privesc with it

[jade gulch]

if i unlocka module will it be available even my subscription is over

[fathom pendant]

even though it's showing ||All:All - nopasswd /usr/bin/php|| it still prompts for password

[thorn urchin]

did you specify the full path

[fathom pendant]

yes

[thorn urchin]

show your exact command

[fathom pendant]

www-data@gettingstarted:/var/www/html$ sudo /var/www/html/index.php

[thorn urchin]

yeah thats not gunns work at all

[jade gulch]

yes i subribed for a monthly 18 dollar basis help

[thorn urchin]

you dont have sudo rights to a random index.php page

you have sudo rights to /usr/bin/php

sudo is very literal in what it allows or not

[fathom pendant]

I feel like I'm missing something crucial that I'm not thinking about

[thorn urchin]

you have sudo rights to specifically the /usr/bin/php executable, no more no less

so you need leverage the executable /usr/bin/php to get to root

[graceful rampart]

GTFOBins is a fantastic resource you may want to take a look at

[fathom pendant]

I think part of what is breaking me is that I'm breaking in using metasploit so maybe some of that pivots that should work just aren't because of that?

[thorn urchin]

no that wouldnt be a factor at all

[graceful rampart]

Nope. If you can use sudo to run php as root then GTFObins has your answer

[thorn urchin]

remember you dont have to get a reverse shell or anything like that

[fathom pendant]

not me timing out so wondering why I couldn't do the thing

[wheat garden]

any on thats done module Pivoting, Tunneling, and Port Forwarding? Stuck on section
"ICMP Tunneling with SOCKS" been trying with built in ptunnel and ptunnel-ng programs and just cant get them to work. If anyone done this exercise could use some help

[fathom pendant]

THANKS! I found what I was looking for... my session timed out before I was able to root for the flag x-x

[graceful rampart]

Well now you know what to do. Congrats!

[fathom pendant]

I was hyperfocused on one thing I didn't even think! and since I already knew where I was starting just had to change IPs

||Tried Decrypting the "password," using john, found in the admin.xml for fun, it's not useful||

Had to exclude my notes from Windows Defender LOL it kept trying to quarantine and delete them

[fathom pendant]

To save myself headache in future, if i do sudo -l and see /bin/{executable type} I should check gtfobins for something if possible?

[graceful rampart]

Yes

GTFObins won't always have the answer but if you find SUID or Sudo access it's always a good place to start

[fathom pendant]

If not searching 'location' + exploit in google should generally work

but it really is appreciated the guidance because I guess being tired last night made me overlook it and coming back to it and getting to where I needed (slowly gaining mastery of metasploit)

basically leaving a terminal open that has msfconsole running

[thorn urchin]

sometimes even google wont help you and you have to do some manual analysis to see if theres a way to leverage the sudo perms on your own

had to do that with a box I did recently

[graceful rampart]

^

Most recent box I remember doing that with was precious

[wheat garden]

any one here complete Pivoting, Tunneling, and Port Forwarding module? Need help with the section ICMP Tunneling with SOCKS.

[thorn urchin]

ironically I did that one yesterday but wasnt what I was thinking of lol

[graceful rampart]

Haha

[drifting glacier]

Hiyah, a little stuck on the question "What is the FQDN of the IP address 10.10.34.136" in the Active Subdomain Enumeration section of the Information Gathering - Web Edition module. I thought a reverse lookup with dig -x would work, but no dice. Any nudge towards the right direction?

[drifting glacier]

Disregard, Had to keep doing zone transfers on the list given

[obsidian remnant]

Friends can anyone give me a roadmap to become a hacker. I am absolute beginner with no it experience and degree.

[graceful rampart]

Hackthebox Academy. There are modules called Windows Fundamentals, Linux Fundamentals, and Networking fundamentals. Start there

[obsidian remnant]

Networking and OSs are enough

[thorn urchin]

need to crawl before you can walk

[finite cypress]

is anyone else experiencing targets timing out rn?

[thorn urchin]

asking for a roadmap to become a hacker(which is such a nebulous goal) when you have no background is like asking how does one become a professional athlete when they havnt figured out how this whole standing upright without losing balance thing yet.

[graceful rampart]

Yea exactly

[obsidian remnant]

Thanks brothers I understand i will try my best

[frozen tree]

That my friend, is a good metaphor

[fathom pendant]

yep because if you don't know what makes it tick, you can't really understand what makes it break; like why (on linux systems) sudo -l is a good first step when on a machine as a user

[rustic sage]

anyone here doing PIVOTING or already done it?

[topaz prawn]

Hey I got a question about about the Linux fundamentals user management section can anyone help?

[graceful rampart]

https://dontasktoask.com/

[topaz prawn]

Which option need to be set to create a home directory for a new user

[graceful rampart]

-m

Not to be mean but a simple Google search will find you that answer

You won't get far in any tech related field if you aren't good at google

[topaz prawn]

I’m new man. I actually tried the long version of that - -move- home but it didn’t work overlooked it

[graceful rampart]

All good. Just giving you some advice for the future

[topaz prawn]

For sure, I appreciate it

[rich vale]

can anyone help me with the 2nd question on the AD enumeration module, Kerberoasting from Linux? I got the answer but it feels janky.. wondering if there's a better way

[blissful anchor]

The MacOS Fundamental module has a problem - finishing it only gives back 8 cubes instead of 10

[rich vale]

from a Linux host, what is the best tool to pull the list of groups a user is a member of? i used enum4linux but feels like there's probably a more concise method

[wheat garden]

anyone do module Pivoting, Tunneling, and Port Forwarding stuck on section RDP and SOCKS Tunneling with SocksOverRDP getting an error at step one when trying to load the SocksOverRDP-Plugin.dll using regsrv32.exe

[wheat garden]

nevermind figured it out I loaded the wrong binary used arm64 insteead of just x64

[fathom pendant]

The Enumeration module intro just called me out LOL " Most of the time, however, it's not the tools we haven't tried, but rather the fact that we don't know how to interact with the service and what's relevant.

That's precisely the reason why so many people stay stuck in one spot and don't get ahead"

[fathom pendant]

ok the xsltproc to turn the xml to html for the nmap scan is so neat

[primal crag]

Hey everone, on the type filters for the File Upload Attacks module
I have found an extension that works, have uploaded it and adjusted mime type and added GIF8 as magic bytes. This gets the file onto the webserver but I keep getting the image can't be displayed because it contains errors.

Any ideas?

[warm turret]

@primal crag it is not the right extension, it have to be another one

[twilit halo]

guys anyone did finished the attacking authentication mechanisms module? having hard time solving the skill assessment, appreciated much the response

[ripe terrace]

Hey folks, why is it that when I connect to a particular FTP server and run DIR, LIST, etc., it basically comes up empty (nothing returned), but utilising wget --no-passive -m ftp://user:pass@w.x.y.z downloads a bunch of files? What does it do under the hood that allows it to see more than I can?

[low echo]

Has anyone done the Password Attacks Lab - Hard module? I am stuck on the last part and can't see any crackable hashes (can't pth with them either)

[waxen barn]

Have you run Hydra on all the users?

[low echo]

I'm right at the end after extracting the files from the encrypted drive

[waxen barn]

You should just need to crack the password over Hydra for the users.

[low echo]

Yes, I'm already well past that

[waxen barn]

Did you get the Administrator’s password?

[low echo]

That’s what I’m having issues with

[waxen barn]

Should just be Hydra and the mutated password list

[low echo]

Hmm that doesn’t sound right

[rapid sparrow]

Need some help for the broken authentication brute forcing username

[waxen barn]

This is the hard module, correct?

[low echo]

Yep

[waxen barn]

So there should be three users: Johanna, David, and Administrator. David and Administrator are discovered after cracking Johanna. After that you just need to crack those two passwords (or really just one of them).

[feral stump]

Spoilers pls … thank you

[brisk geode]

@pastel ginkgo i solved that section thanks for the help that section is quite cheeky so gl

[rustic sage]

stuck with third question on web proxies skill assessment(SOLVED)

i have the 31 characters long decoded cookie

i know im supposed to fuzz the last character of it then encode the whole thing with base64 then ascii hex, but idk how to encode the whole thing after fuzzing a character

and its kind of driving me crazy (SOLVED)

[mortal basin]

Incorrect.. if you solve all questions you get 10 cubes back. You can verify by counting the total number of cubes next to all questions in the module.

[rich vale]

for the AD enumeration module, does PowerView sometimes just... not work? trying to work through ACL enumeration and follow along but some of the commands just hang and never complete

[drowsy sedge]

Hello, does zapp proxy support recursive fuzzing?

[fathom pendant]

Wow... I just did the easy firewall one in the academy super easy... I was able to do the scans and enum and only hit it < 40

by far the quickest one and I learned some more convenient bash scripting to smooth my workflow :D

like how the Pipe actually works... I should read back up on terminal commands in linux

[candid zephyr]

Are you importing the module? import-module .\PowerView.ps1

[candid zephyr]

https://www.youtube.com/watch?v=QSq-aYYQpro&t=221s&ab_channel=NahamSec

This is an interesting watch for you, was on NahamCon this weekend.

[blissful anchor]

I actually counted and it summed up to an 8. Otherwise please correct me for my count in the picture?

[mortal basin]

Sorry, my bad.. corrected.. thanks for the note

[shy pilot]

I am doing hack the box academy cross site scripting phishing and session hijacking modules, I am getting struck in middle, I am bit confusing over there. Is anyone is done before kindly ping me and we both solve the issue.

[rustic sage]

Can somein help me on Brute forcing module - Login forms

I'm using hydra but it gets nowhere

I saw other had the same issue

[ripe terrace]

What does your current Hydra call look like (make sure to wrap it in spoiler tags)?

[rustic sage]

I am on the ssh part

i tried using rockyou and it takes something like 10000h

40 tries at minute

[lucid mirage]

stuck at this place too. There's no l1 in default zshrc file.

[rustic sage]

hydra -l b.gates -P Workspaces/Sicurezza/Seclists/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt -t 4 ssh://167.71.143.119:31444

[shut owl]

Has anyone finished the Intro to Windows Command Line Module Skills Assessment? I'm currently stuck on: "For this level, you must successfully authenticate to the Domain Controller host at 172.16.5.155 via SSH after first authenticating to the target host. This host seems to have several PowerShell modules loaded, and this user's flag is hidden in one of them. " I found the name of the Domain Controller, but whenever I try to ssh into it, it's asking for a password that I'm not sure how to get. Could someone give me a nudge? Thanks.

[fathom stump]

Does the student monthly subscription get access to all the modules? Or would I still need to buy cubes?

[burnt island]

Modules upto tier 2. For tier 3 and 4 you will need cubes.

[shut owl]

It should give you access to all modules up to tier 2

[fathom stump]

Says includes everything through tier 2, but looking at the pentester path - it doesn't show what tier each module is

[shut owl]

Though personally, I just did the platinum subscription

[burnt island]

All the modules in cpts and cbbh. Have modules upto tier 2.

[fathom stump]

OK cool, thanks

[rustic sage]

Hi I'm new in hacking, please can I know for what we need nmap?

[shut owl]

DM me and I can help answer your questions

[rustic sage]

Okay

[strong sierra]

Hello, sorry if this is the wrong place, i am currently at the tier 1 machine called responder. I am at the final steps using evil-winrm to get the flag file however i keep getting an error from evil saying openssl:digest:digest error, message is digest initialization error, exiting with code 1. Any ideas?

[shut owl]

That doesn't sound like it's on academy

[strong sierra]

its on htb, its at starting point

if this is the wrong channel could you tell me which one it is?

[shut owl]

Oh okay one second let me take a look

[autumn pilot]

#starting-point , you will have to verify your discord account

check #welcome and #rules

[strong sierra]

i see, thank you

[shut owl]

Thanks @autumn pilot

[candid zephyr]

I've been doing Windows and AD modules for so long I keep wanting to right click in terminal x(

[shut owl]

Which ones have you done?

[candid zephyr]

Just done Windows Privesc and finishing up Ad Attacks and Enumeration back to back.

[shut owl]

Dang man, that's intense. I haven't done them yet, but I've heard their long and intense

[candid zephyr]

They're really good modules. I've got so many notes haha.

[shut owl]

Have you done the new intro to windows command line yet?

[candid zephyr]

No I haven't, I've done some other random modules before these hehe.

[shut owl]

Gotcha. Yeah I've been working on that one and it's helping me sharpen my windows blade. Honestly, I know that windows scares a lot of intro to IT people off

[candid zephyr]

Windows is wild. There's a lot going on I think and people just get comfy with Linux

I know I do!

[shut owl]

Haha me too man!

[shut owl]

Just got the flag, but if anyone else is stuck on this one, feel free to DM me. (:

[deep tendon]

How many hashes does the Domain Cached Credentials mechanism save to a host by default?

i can't find that

[solid pivot]

Anyone here who can give me a nudge for the Active Directory Skills Assessment I?

i've got everything but the very last thing 😄

[deep tendon]

??

[rustic sage]

In the module RDP and SOCKS Tunneling with SocksOverRDP, i can run the .dll and connect to 172.16.5.19 (the 2nd box) but how am i suppose to send the SocksOverRDP-Server.exe to 172.16.5.19 (the 2nd box)? There is no internet to download it or webserver on the first box we rdp onto

Hey guys is there any free labs that involves tunneling over a compromised machine plus pivoting?

[near anvil]

Dm

[solar granite]

Hi guys, need some help with STACK-BASED BUFFER OVERFLOWS ON WINDOWS X86 - Finding a Return Instruction. I searched the pattern and found ||5 addresses||, but none are accepted as the answer.

Edit: solved! I was looking at the wrong address space

[weak kindle]

I've never done that module. But I've done BOF in other courses. Can you elaborate? I can try to help if possible

[solar granite]

Sure, thanks. The question is: Try to search the 'cdextract.exe' binary for the 'PUSH ESP; RET' instruction as pattern '54C3'. What is the address of the first result you get?
We are using x32dbg on Windows to search for the pattern 54C3 by pressing Ctrl+B and get 5 addresses back, but none are accepted.

[weak kindle]

Well, I've done basic BOF with immunity and can't recall using this step. You have to wait for others to help you

[solar granite]

Ye, I was afraid of that. Thanks anyway mate

[dusty citrus]

Guys which VPS is best?

[fathom pendant]

Saved thanks

[night trellis]

Hi, I am stuck in the Skills Assessment of the Broken Authentication module. I have identified the eight users (9 if you count guest) via the message function and have now reduced the rockyou.txt file to 14 passwords fitting the requirements. This leaves me with 126 or 112 possible user:pw combinations. I then used the rate_limiter.py file to generate requests but I have not been able to identify valid credentials even after creating an account and trying to log on with the script. I also tried copying the curl request from the browser and including the headers etc. The curl request with my created account as a standalone worked but not converted into my script. My current script with comments with removed due to the length limit:

import requests
import time
userpass_file = "pw.txt"
url = "http://165.22.119.202:30444/login.php"
lock_time = 30
lock_message = "Too many login failures"
with open(userpass_file, "r") as fh:
for fline in fh:
if fline.startswith("#"):
continue
print(fline)
username = fline.split(":")[0]
password = ":".join(fline.split(":")[1:])
print(password)
data = {
"userid": username,
"passwd": password,
"submit": "submit"
}
res = requests.post(url, data=data)
if "Invalid credentials" in res.text:
print("[-] Invalid credentials: userid:{} passwd:{}".format(username, password))
elif lock_message in res.text:
print("[-] Hit rate limit, sleeping 30")
time.sleep(lock_time+0.5)
elif "Welcome" in res.text:
print("[+] Valid credentials: userid:{} passwd:{}".format(username, password))
else:
print("[/] Nothing here?")

[idle kindle]

hi

[brisk geode]

hey can anyone help me with the file upload module and skills assesment section

i have found the path

im unable to find the correct extension cuz the get req is kinda weird compared to other section's get reqs all of the extensions get submitted no matter what i submit

[waxen barn]

When you run mstsc.exe, there’s an option in the tabs at the top where you you can link drives and printers and stuff like that.

[pastel ginkgo]

Read the source code

Also https://en.wikipedia.org/wiki/List_of_file_signatures is super handy

should honestly be part of the module itself lol

[brisk geode]

i did im just unable to find the executable extension

also did you complete this module?

[pastel ginkgo]

yup

My hint should be more than enough

[brisk geode]

nice

[brisk geode]

GET /contact/submit.php?Name=safdsaf&Email=asdfasdfsadff%40gmail.com&Message=asd&uploadFile=§htb.jpg§ HTTP/1.1
Host: 178.62.88.144:31842
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://178.62.88.144:31842/contact/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

the get req is weird

[thorn urchin]

looks normal to me

[brisk geode]

compared to other sections its kinda weird

wait is it using content type and mime in one header?

[brisk geode]

can i get a last hint which extension list should i use?

[pastel ginkgo]

its in the source code

use chatgpt to explain the code to you like I did lol

[crisp remnant]

Anyone for little assistance with using web proxies module

[brisk geode]

sure

[brisk geode]

im talking bout the fuzzing extension list

[pastel ginkgo]

For the assessment?

[brisk geode]

yeah

it seems like the backend server is accepting every single extension

[pastel ginkgo]

Read the source code

it will tell you what is black listed

what is white listed

[brisk geode]

alr cool

gotcha ty

are you doing the cbbh path?

[pastel ginkgo]

cpts

there is a lot of overlap

[brisk geode]

im doing cbbh then gonna do cpts

would you mind if i send you friend req?

[pastel ginkgo]

sure

[last cape]

hey I’m pretty new to cyber security and I’m stuck on a section in the Wordpress module, can someone help me out?

https://academy.hackthebox.com/module/17/section/88

it’s this one, I went into the /wp-includes directory but I can’t find the flag.txt file

idk if I’m doing something wrong

[candid zephyr]

lol the AD skills assessment. Here's a bunch of AD tips and techniques. BTW I hope you learned to pivot.

[pastel ginkgo]

Ok am I crazy but on the Web Attacks module, Bypassing Security Filters. It tells us to use the following payload: file; cp /flag.txt ./ As I've used that payload and have changed it to every http verb and NONE have worked. I even changed the payload and was getting my initial file to be created but Im still not seeing the flag.

[pastel ginkgo]

Yup Lmao

Also I've refreshed the docker a couple times now and each time it behaves differently xD

[junior cradle]

hey, can i connect to a machine using my own instance

[urban sage]

Yes. A VPN key is provided when needed. Otherwise, target instances are public facing.

[marble raft]

Note that not every machine will be public facing. Some will intentionally be on internal networks where you don't have internet access such as the ones on Pivoting Tunnelling and Port Forwarding and Active Directory modules

[silver zenith]

Pff im doing skill assessment of intro to assembly language

But cant seem to grasp the whole idea

Fckng frustrating

Need to be working on my thesis too but fuck

Wanna complete this

[candid zephyr]

https://youtu.be/6jSKldt7Eqs This guy has some good videos to try and get a grasp imo

[silver zenith]

Tnx gonna check it out

[candid zephyr]

The whole series is a good watch I think

[weak kindle]

LiveOverflow is underrated

[rustic sage]

Yeah

[low vine]

on the XSS final assessment is it intended to be a manual or use a tool listed sort of thing?

[rustic sage]

The CVE-2022-23093 I suggested for root part, I found from LiveOverFlow

https://youtu.be/bkkVClq9aGw

[pastel ginkgo]

I used a tool to find the first bit but the rest I did by hand

[low vine]

Gotcha hadnt started on it but wasnt sure of the "intended" way they wanted it to be solved

[pastel ginkgo]

For Web Attacks - Bypassing Security Filters, is it bugged? || I found it will accept Head Request without filtering them|| but I can't get it to execute the payload they provide. Or even my own hand crafted one that should also work.

[weak kindle]

Yet to watch this video? How was it?

[thorn urchin]

Sometimes you gotta try different verbs

[rustic sage]

Only watched first minutes but incredible interesting, someone should definetly make a root part of the cve

Would fit a "insane" or "hard" box

[pastel ginkgo]

So i've tried all of them, and each time ive reset the machine it acts differently One time it would only take get request. Anything else returned a server error

hence why im starting to wonder if its bugged

[weak kindle]

Box creaters are now getting some cool ideas 🤣

[rustic sage]

This is a really unique CVE, I'm tryna get some1 to do it

[pastel ginkgo]

Is https://academy.hackthebox.com/module/134/section/1178 Bugged? I cannot get any verb to work with their payload. When I provide my own I can get the file to be created but not the flag file. im at a loss right now with my only guess being the flag isn't located in /flag.txt or even at ../../../../../../../flag.txt

[brisk geode]

@lethal latch would you mind if i dm you?

[lethal latch]

Of course, go ahead

[dim hound]

You can pm me

[vale geyser]

Anyone on SQLMap Skill Assessment? Just want a sanity check no real hint

[sullen bane]

Any hint on footprinting lab hard ? . i have ssl access to the server but coulnt access to mysql or privilage escalation ?

[odd dawn]

Hey guys, I was wondering - is there a module in the academy that covers the topic of "anti-forensics"? I just recently discovered that and would love to learn more about it. Seems like a fascinating topic!

[fallen osprey]

I had worked with smbclient in several days and get stuck. in Password Attacks: Pass the Ticket (PtT) from Linux module I have to "read the contents of julio.txt from the domain share folder \DC01\julio."
smbclient //dc01/julio -k -c ls -no-pass list the file in that dictory. But I have no clue how to read the julio.txt file. I have tried smbclient //dc01/julio -k -c more 'julio.txt' -no-pass . I have tried different kind like: -c 'more julio.txt' -c more julio.txt, etc but it not work. Can anyone help me with a hint?

[thorn urchin]

you copy the file over

[raven cairn]

Isn't liveoverflow a Minecraft youtuber?

[thorn urchin]

lol

he only relatively recently went on a minecraft hacking bent

[rustic sage]

No?

I mean he plays the game, but mainly I don't think so.

[fallen osprey]

smbclient //dc01/julio -k -c get 'julio.txt' -no-pass is that correct?

[thorn urchin]

dunno never used -c Ive always used the interactive portion when doing smbclient

run it and find out

[raven cairn]

I was joking haha

I like liveoverflow's technical videos

[night pier]

Anyone finish the Attacking Authentication Mechanisms skill assessment? I've found the vulnerability, got the key, crafted my token but unsure where to send it.

[vale geyser]

anyone?

[dry parrot]

Hey

can someone help me with the User injection section? i been trying this section for a week and i dont get it, someone please

[candid zephyr]

Oh well AD Assessment 1 wasn't so bad.

It kidna sucks for people who haven't done any pivoting though to hit that suddenly I bet.

[vital adder]

sure shoot me a dm if you still need help with that

[vital adder]

which module are you on?

[vital adder]

hint ||password spraying||

[pastel ginkgo]

@vital adder Have you done the Web Attacks Module?

[vital adder]

yep

[dry parrot]

BROKEN AUTHENTICATION module

[vale geyser]

fixed it already but thanks

[pastel ginkgo]

For the Bypassing Security Filters, did you use their payload?

I cannot get it to work at all ive tried all the verbs lol

[vital adder]

oh yeah i did noted down that section was super buggy for my if something isn't work restart your target machine

[autumn badge]

06 16 30 15 62

[vital adder]

if you think you are doing something wrong shoot me a dm i'll help you with that

[dry parrot]

Can i DM you?

[vital adder]

sure

[vital adder]

hint for you'll some ||command injection|| but a hint about the main part i the ||request method||

[heady nova]

Hello, for the module "Using the Metasploit Framework", on the section "Payloads", my metasploit said "The target is vulnerable" but no session was created. I'm in wrong or my metasploit troll me ?

[pastel ginkgo]

So i've dont this payload and I can see a file being created but no flag. || file&&${IFS}cp${IFS}${PATH:0:1}flag.txt${IFS}.${PATH:0:1} ||

[vital adder]

oh no for this you don't need to use any bypass you can just cat /flag.txt

[frozen socket]

Someone can help here.

I am doing Setting UP module and I am unable to attack the targets, it happened me 2 days ago and yesterday, I have no connection with them. I tried reloading my VM, downloading another VPN (such as different servers and protocols) and I am still unable to establish connection. I even reloged to my academy account and nothing happens. I would like to upload a photo but I can't

[vital adder]

i did noted down if the exploit fail run it again so try that or restart your target machine if running it a few time doesn't worked

[frozen socket]

Ive done that

nothing happens

still unable to ping, do banner grabbing or nmap

[pastel ginkgo]

Nope didnt work It does not display the flag at all

I cant copy it to the local directory

[vital adder]

oh sorry i forgot to ping the other guy but that wasn't for you

[pastel ginkgo]

Im convinced its bugged at this point

[vital adder]

i did noted down if the exploit fail run it again so try that or restart your target machine if running it a few time doesn't worked

[vital adder]

check my second hint

if even changing that doesn't help yep give your target machine a restart

[autumn badge]

06 16 30 15 62

[pastel ginkgo]

I fuzzed all the verbs and nothing

same as before

been at this now for like 6 hours x)

[vital adder]

try at #general

[vital adder]

if you doing this in burp shoot me dm with a screenshot (of burp)

[heady nova]

why you drop a french mobile phone number here ? Creepy

[frozen socket]

Can some1?

[vital adder]

to upload anything you'll first need to verify your account first use ++verify at #bot-commands

and for the you can't access the target thing because there is no target is that module

[rich vale]

yeah, I think it was just taking a long time. it would eventually spit out the results, just took 3-5 minutes for the command to run for just one SID

[frozen socket]

of course there is, im on setting up module, the part of the METASPLOIT

[vital adder]

so you are in the metasploit module? which section?

yeah that doesn't look like a htb academy target ip

oh wait is that a public ip?

[frozen socket]

https://academy.hackthebox.com/module/77/section/843

[vital adder]

that's a docker container you can't scan or ping it

that port is the only thing you have access to

[frozen socket]

so?

[vital adder]

just go to that on your browser

[frozen socket]

i cant

[frozen socket]

no things load

eternal loading

[vital adder]

yep i just give that target a try and nothing load try restart your target

[frozen socket]

keeps giving me the same target

[frozen socket]

can you try with this one

139.59.161.137:30843

worked

tahnks

[vital adder]

that load just fine for me

[fathom pendant]

Yeah the targets do a little bit of trolling sometimes

[frozen socket]

Can someone help me with the module of metasploit

When I run a searchsploit capable of run on the web said, there are like 20 exploits

I tried using one but it is not working

I feel like this part of the module is partially empty of info

[thorn urchin]

looks like the right one to me

[frozen socket]

yep

but it is auxiliary

i tried with another

but not working neither

[thorn urchin]

I mean you tried to create a reverse handler on an internal vpn IP address when the target is an external public IP

[frozen socket]

how should I do it

[frozen socket]

the module only show an example that have nothing to do with the exercise

and I cant understand it

[thorn urchin]

youre supposed to be able to expand beyond the module lessons

you could try a bind shell, but im 99% sure thats not the right exploit to use

[lethal cargo]

Hello I'm new here

[frozen socket]

im very very new

I just know linux, some networking and kind

[thorn urchin]

you had an exact version match and dismissed it cause it said aux instead of exploit

silly reason to ignore a potentially useful avenue

sometimes its not about getting shell

[frozen socket]

yes I know but with the auxiliary one i just got this (photo) and I should get to the flag.txt

[thorn urchin]

yeah cause it defaults to /etc/passwd, gotta change the settings

[frozen socket]

ok, thanks I didn't think on thatt

[fathom pendant]

Yep the 'show options' command shows you what options you can set even if not required

[frozen socket]

yeah, I am trying changing it but only with the /etc/passwd is giving me the file, Im trying to search where flag.txt is but at the moment im unable

[fathom pendant]

Are you doing it as /dir/to/flag.txt, you do need to have the leading / I believe to start from root

[frozen socket]

yes but I don't know in which dir flag.txt is

[lethal cargo]

I find difficulties installing discord on my pc some one help

[frozen socket]

this is not the place to ask that

[lethal cargo]

Sorry I'm very new here

[frozen socket]

you are on a hacking server, go and look over the internet, this is not the place

[novel matrix]

Not the place to ask especially when you can contact discord directly for assistance

[quartz surge]

Is there any XSS or stuff like that modules to work with?

[forest tapir]

i don't want to shill but XSSRat has good content

[frozen socket]

Can someone help with the module of metasploit from the academy I ve tried like 20 exploits and none of them work

im getting crazy

[fallen osprey]

I had worked with smbclient in several days and get stuck. in Password Attacks: Pass the Ticket (PtT) from Linux module I have to "read the contents of julio.txt from the domain share folder \DC01\julio."
When I try: smbclient //dc01/julio -k -c 'get julio.txt' -no-pass I get NT_ACCESS_DENIED /julio.txt I need to read the content of the julio.txt file but I'm stuck. Can anyone give me a hint?

[deep tendon]

How many hashes does the Domain Cached Credentials mechanism save to a host by default?
i can't find that

[vital adder]

which module and section are you in?

[vital adder]

hint make sure you are using the right and not ||expired|| ticket

[deep tendon]

introduction to active directory

NTLM authentication

[ripe terrace]

Does anybody know how to get around the mount.nfs: failed to apply fstab options error? Most of what I can find via Google suggests running it as root (sudo) - but that ends up with the mount's files/directories being mapped to nobody - which I then cannot access. I've tried adding a new user and manually updating /etc/passwd so that the user's SID/GID matches nobody, but I still get a permission denied error.

I'm on the footprinting - medium lab btw.

[fallen osprey]

Password Attacks: Pass the Ticket (PtT) from Linux

[deep tendon]

introduction to active directory
NTLM authentication

[vital adder]

hint read the stuff under ||Domain Cached Credentials (MSCache2)||

[vital adder]

oh that was for the other guy the hint was for you

[rotund swallow]

I have two irrelevant questions since Im a beginner...

[deep tendon]

I'm looking and there is nothing there, is in another section or something?

[rotund swallow]

when I type in cmd 'arp -a', I only see a few MAC address and judging by the IP address related to the MAC

I can't see other's MAC address in my network

[vital adder]

nope i just check it and it's in there but it's a number it's word

[fathom pendant]

Ugh having issues with the Firewall/IDS/IPS can't figure out why I can't tag the domain name I feel like there's something obvious I'm missing

The medium one

[vital adder]

make sure you are using the -t nfs also go back to the NFS section they show you 1 example command and you can just use that command

[fathom pendant]

I was able to determine that if I specify port 53 I "open" the ports but after that I'm lost

[deep tendon]

i can't find that

[fallen osprey]

I copy the ccache file for julio and used Imported it about 1-2 minutes later in current session. Can that be too late?

[vital adder]

give me a sec i'll send you a screenshot of that

[deep tendon]

okey thanks

[ripe terrace]

I am using that, e.g, ||mount -t nfs w.x.y.z:/ ./mount-nfs/ -o nolock|| - which then gives me the fstab error.

[forest tapir]

for some reason, they were both expired for me.

then suddenly one updated and I have no f* clue how

[vital adder]

nope use klist to get the imported ticket info

[vital adder]

try mount -t nfs (IP):/(share name) /mnt -o nolock

[fathom pendant]

I reread the goal... I swear if this is the answer..

[vital adder]

thought i was the only one who got that dumb issue

[forest tapir]

noooope.

[fallen osprey]

I used klist and directly after that the smbclient. So I not know how it can be expired

[forest tapir]

2 days

for nothing

I don't know if hack the box has some kind of automated script that updates tickets??

[vital adder]

i mean use klist to get the Expires info

[forest tapir]

whatever it is they need to fix it

[deep tendon]

I just found it thanks anyway I have looked well and I have reread it

[vital adder]

i think yes but for something like evey new target

[fallen osprey]

to make a screenshot on it or what?

[vital adder]

i just done taking the screenshot but nice

[ripe terrace]

Ends up with the same result, unfortunately.

||```
mount -t nfs IP:/Share /mnt -o nolock
mount.nfs: failed to apply fstab options

[vital adder]

if you like to but nope if the ticket isn't expired you can use it if not then restart the target because that could be a bug on the target site

@ripe terrace @deep tendon for the love of god don't post spoiler

[vital adder]

try with sudo

[deep tendon]

deleted sorry

[vital adder]

also shoot me a dm if that still doesn't work

[fallen osprey]

okey I try it then. Now I need to take a sleep (long day today)

[fathom pendant]

Still having issues with the Firewall one

[hazy grotto]

The target system has an old version of Sudo running. Find the relevant exploit and get root access to the target system.

Metasploit Module, Sessions, last question

I'm stumped on this one.... I'm trying to figure a command that will give me the sudo version but I'm lost on that.

[fathom pendant]

Firewall IDS/IPS evasion - medium lab still having problems

[fathom pendant]

Sudo -v or -V?

[hazy grotto]

it says sudo is an unknown command in meterpreter

[vital adder]

hint other protocol

[vital adder]

i just check it's sudo -V

[vital adder]

that isn't a meterpreter command

use shell to get a bash (or sh) shell and use that command on the target linux machine

[hazy grotto]

lol yeah. ive gone through the list of commands. nothing really works

[vital adder]

guess that user don't have sudo permissions

[hazy grotto]

🙂

[proud wigeon]

hello

im new comer

[vital adder]

[hazy grotto]

So... maybe you can explain this.. I'm pretty new to all of this so certain fundamental things I may not get. (I've done all the fundamental modules)

The target system has an old version of Sudo running. Find the relevant exploit and get root access to the target system.

So this question is telling me to find the old version... Does this mean the only way to tell the sudo version is if you have sudo priv?

@vital adder

[proud wigeon]

guys how i could hack facebook account easy!

any method

[hazy grotto]

get a life

[proud wigeon]

[vital adder]

for this you'll need to research about old sudo version vuln / exploit and use the one on metasploit but for finding the sudo version i'm sure there is a lot of way but most if all of the some i just use linpeas to check so manual check command i got no idea

also a tip for privesc you can use metasploit exploit suggester for thing like this

if there is a way to Fing hack a $911.054 billion company everyone would do it and if there is a way to do it no one would just share it on Fing discord so like RudeRaph said get a life will ya

also

[hazy grotto]

Give me your facebook account... I'll show you. lol

[proud wigeon]

bro i want to learn

not hurting anybody

if u cant help me just let me go away

and dont judging me

[hazy grotto]

Please tell me what reason you would have to hack someones facebook if it wasn't for bad reasons?

[proud wigeon]

thats simple

[thorn urchin]

thats not allowed here and even if it was this wouldnt be the chat for it.

[proud wigeon]

im sorry everyone

[thorn urchin]

Youre lucky nobodies bothered to tag a mod to remove you yet

[proud wigeon]

im sorry

[vital adder]

@proud wigeon if you just want to do stupid stuff like hack facebook pls F off but if you are interesting to learn cybersecurity give both of these video a check to see where you should start
https://www.youtube.com/watch?v=0vu_Hs4N8B8
https://www.youtube.com/watch?v=lhz0-qAQlBM

[fathom pendant]

Ok thanks for the tip on the protocol shift and I was able to use that protocol @vital adder I feel like there's just a crucial thing ik I'm missing just not sure how to resolve the DNS version

[hazy grotto]

Why don't you just break up with her if you think she's cheating?

[proud wigeon]

because i love her so much and its not easy to broke up

[proud wigeon]

thank you so much

[hazy grotto]

Man, IDk what the heck im doing.

[vital adder]

If you break up and got a new girlfriend give glimpse of us by JoJi a try

[vital adder]

I actually got some stuff do to now so can't help for the time but if you got any questions just ask it here

[hazy grotto]

Ok thanks buddy! Have a good day!

[hollow thunder]

could i get anyone to help me with AD assessment 1

1

[graceful rampart]

What youre looking for is sudo --version if you havent figured that out yet

Alternatively, running something like linpeas will instantly identify a sudo version thats vulnerable to an exploit

[hazy grotto]

So I'm trying to run this exploit.... I watched a video where they used this to get the answer but i'm getting this and i'm unsure what to do.

[hazy grotto]

Am i barking up the wrong tree here?

[graceful rampart]

not sure what module youre doing lol. Just saw you were trying to get the sudo version

whats the question youre trying to answer?

[hazy grotto]

That would be metasploit sessions and jobs last question

I'm connected via meterpreter.

[fathom pendant]

Ugh how can I use smb to resolve the DNS version, what the heck am I missing

[hazy grotto]

The target system has an old version of Sudo running. Find the relevant exploit and get root access to the target system.

[fathom pendant]

Unless I'm really wrong and looking in the wrong tree

[graceful rampart]

try this post/multi/recon/local_exploit_suggester

[hazy grotto]

I'm trying that but it's not finding it

[graceful rampart]

hmm. Drop into a shell then, run sudo --version and get googling? idk

[hazy grotto]

wait i may have something.... I was having issues running "sessions" i didn't know the background command was what i was missing

[thorn urchin]

meterpreter changed some of the post exploitation module stuff, but idr what the new way was

[graceful rampart]

here it looks like you have the wrong target set. Type show targets to see what targets can be used with that exploit. Choose the one mopst closely matches the target system

[fathom pendant]

||can't you also do exec (command)?||

[graceful rampart]

hm? I was pointing him to the exploit suggester tot ry to find the vuln hes looking for

[hazy grotto]

HMMM i think it's working

[fathom pendant]

I just meant I thought msf had a way to run without dropping to shell

[graceful rampart]

oh yea, i think you can use exec but i honestly dont remember

i dont use metasploit a ton

[hazy grotto]

One of my first times lol. Besides maybe a few starting point boxes if the walkthrough used it.

[fathom pendant]

That's fair

[graceful rampart]

Yea. Its definetly worth learning tho

[quartz surge]

So uhm

I tried HTB Academy

[fathom pendant]

Think you can help unstuck me, Tom pointed me in the right direction of what service to use but not sure where to go from here

[quartz surge]

but it doesnt let me make another terminal (pwnbox)

is there an alternative?

[rancid bobcat]

use screen

[fathom pendant]

What do you mean by another terminal?

[graceful rampart]

Well unles you tell me whatmodule and question youre on probably not

[quartz surge]

pwnbox

the instance you create

[rancid bobcat]

screen -S test

[graceful rampart]

No. He used his 1 pwnbox for the day

[fathom pendant]

You can open a full screen version by hitting the "full screen button"

F

[quartz surge]

is there any other option?

[hazy grotto]

pay

[quartz surge]

lol

[graceful rampart]

Spin up a vm and connect over the vpn

[rancid bobcat]

ok

[quartz surge]

I am on my kali linux vm

[fathom pendant]

Firewall and IDS/IPS evasion medium lab in the network enumeration with nmap module

[quartz surge]

should I just connect my terminal to the academy vpn?

[graceful rampart]

yes

[quartz surge]

but how do I run the cmds?

[graceful rampart]

wdym?

[hazy grotto]

If i background a module in metasploit, set the new module to that session. Do i have to change to port number?

[quartz surge]

like

the ones they ask you to do

like uname

id

[graceful rampart]

i dont think so. Try it and find out

[graceful rampart]

what module are you on?

[hazy grotto]

I was able to get the priv thing you suggested to find some but it keeps giving me exploit completed but no session created.

[quartz surge]

Linux Fundamentals

the one btw I can not pass from the first question 💀

[graceful rampart]

Do you know what ssh is?

[rancid bobcat]

uname depend of os

[fathom pendant]

It tells you what you need to do and gives you the credentials

Btw to copy/paste into terminals you add the shift key into your key combo

[graceful rampart]

Yea the last part of that page tells you how to log in via ssh

[quartz surge]

secure shell, yeah the one I used to connect to the ip of the project

[graceful rampart]

Then it gives you the credentials right above the question

[graceful rampart]

So if youre already connected then whats the problem?

[fathom pendant]

Are you doing ssh [name]@targetip?

[quartz surge]

yeah Ik, but like when I connect my terminal it doesnt let me type any cmds

[quartz surge]

yeah, it works but my question aint that

[graceful rampart]

can you share a screenshot?

[spring sigil]

what do you mean by "typing the cmds" 😄

[spring sigil]

i think your question isnt questioning

[fathom pendant]

It sounds like the ssh didn't go through and it's a blank line

Oh

[spring sigil]

hah

[graceful rampart]

Open a new terminal window

[fathom pendant]

You're on the vpn

[quartz surge]

and thats all?

[spring sigil]

@quartz surge have you read through the module carefully first?

[quartz surge]

ik, it aint my question

[fathom pendant]

You can't do commands in the same terminal window you connect to the VPN on

[graceful rampart]

Yes. Youre connected to the vpn as long as you leave that terminal open in the background.

[spring sigil]

Man in Tux asked you if you know what ssh is, I'd recommend reading the module again

[quartz surge]

ty!

[spring sigil]

You have to connect with ssh (I assume)

[graceful rampart]

np

[fathom pendant]

So minimize that terminal or do Ctrl+shift+t to open a terminal tab

[quartz surge]

I know!! That wasnt my question

[graceful rampart]

^

[quartz surge]

ty!

[fathom pendant]

We were confused how you were stuck at first that's why

[spring sigil]

ah my bad

[quartz surge]

lol nws

[graceful rampart]

In the future, if youre stuck, giving the module name, question youre stuck on and a screenshot (if applicable) will help you get an answer much faster

[fathom pendant]

Yup

[quartz surge]

ty!

[fathom pendant]

Also when it asks for password and you start typing it will not show the password as you type

[hollow thunder]

I've been stuck for a few days on AD assessment 1

if i can get any assitsance

[graceful rampart]

pkexec isnt a sudo vuln. The question specifically asks for a sudo vulnerability

[hazy grotto]

exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec Yes The target is vulnerable.
2 exploit/linux/local/pkexec Yes The service is running, but could not be validated.
3 exploit/linux/local/su_login Yes The target appears to be vulnerable.
4 exploit/linux/local/ubuntu_enlightenment_mount_priv_esc

[graceful rampart]

Wish i could but i havent done that module yet.

[hazy grotto]

ive tried all of these

[graceful rampart]

thats a bit spoiler ish might wanna delete that

feel free to dm me tho and we can try to figure it out

[hollow thunder]

I've exhaused everything I know, but I have a feeling im having some type of logic failure when trying to run some commands. I'm attempting the very last thing i can think of, but its out of scope of the module. Which i guess in the real world is fine but im not even sure if it will allow me to proceed anyways

Here is the part im stuck on for AD assessment 1

[graceful rampart]

8 modules till i get there. AD is my favorite lmao. I just wanna get there already

[hollow thunder]

I have the credentials for sql but having the hardest time authenticating

[hazy grotto]

Congrats! I Dm'd you

[hollow thunder]

lol ive started the pentest path in august

[graceful rampart]

feel free to shoot me a dm to troubleshoot

[graceful rampart]

damn. Ive been at this for 2 weeks lol

I also did the windows privesc module lmao

[hollow thunder]

do you take notes when reading

[graceful rampart]

yes

tons

lots of gems in here

[hollow thunder]

well i feel like dog water now haha

two weeks your moving along fast

[graceful rampart]

I guess, but ive also been studying cyber security for like 4 years

[hollow thunder]

i don't want to dm you becuase i don't want to spoil the assessment

[graceful rampart]

yea fair

[hollow thunder]

There was a point there where i was knocking them out week by week

i was locked in

[tiny ember]

question on the final box for nmap module. The hint is ||Our client also mentioned that they were forced to add a service that plays a vital role for their customer because they require large amounts of data.|| does this mean that i should be looking for || big data ports like found on https://www.syncfusion.com/forums/126348/big-data-services-ports||?

[quartz surge]

hey why is an ip at the top right corner of my kali?

not sure if it is of openvpn

[hollow thunder]

when i connect via vpn the ip in the top right corner is usually the vpn ip assigned to you

check your ifconfig

should be tun0

[quartz surge]

uh?

oh ye

it is tun0

but what is it?

my vpn ip?

[tiny ember]

its your IP on that subnet

[quartz surge]

basically my vpn

[tiny ember]

well just like at home where your ip address is something like 192.168.1.<number>.

[hollow thunder]

yes its your vpn ip

[tiny ember]

but yes on Kali that shows the vpn ip

[quartz surge]

kk ty

[cunning plume]

Hi everyone, I wonder if someone is available to help me

I´ve just started the SQL injection module on HTB, obviously.

[kind turret]

Whats your question

[cunning plume]

When I tried to connect to Mysql

I can´t send a image here

[kind turret]

DM me.

[tiny ember]

https://discordapp.com/channels/473760315293696010/774040263278592041/1054580177637756959

[fathom pendant]

Start with a scan and you'll see, I recommend one from a previous tab. I just finished it, and I did nothing wrong it just turns out my VM was being dumb, ran the EXACT same line in pwnbox it worked

[rustic sage]

anyone done the proxifier lab in pivoting module?

[fathom pendant]

But I'm on that exact same lab, and it turns out that, no, I'm not dumb, the module was just hating me

[tiny ember]

I did a scan and got returns for || port 22, 80, and 50000 ||. My guess is I need to dive more into || the last port there ||

[fathom pendant]

Oh wait different lab but what services are running, what connections and how can we grab specific info for those

[tiny ember]

nvm, i got it

should these be completed in the order they are in, or doesn't matter?

or should i sort on easy first, then medium?

[kind turret]

It doesn't matter.

[graceful rampart]

Technically it dosent matter but there's designed to be done in order

[raven cairn]

You should do them in order

Take it from me, who has been doing them out of order

[tiny ember]

lol, noted

[rustic sage]

<@&861185840277487616> OMG THIS IDIOT REALLY JUST DID THAT FR BRO

OH SHIT WRONG PING

WHY AM I SUCH A FUCKING IDIOT