modules

[little whale]

Sexual Squid Game Fan Club Owner (926879219655524352) has been banned until 2022-12-21 03:29:16 (UTC).

[graceful rampart]

Rippp

[tiny ember]

Cause you left your caps lock on? 🤣

[fathom pendant]

Ok so this one stumped me because the module teaches you a specific tool which may not be installed on a VM, but is on the pwnbox

[tiny ember]

the answer is in || the introduction to the 3 boxes ||

[fathom pendant]

I know, I also found the way to do it without installing that tool as well

I got the flag :D

Just figured I'd see if you still needed help with it since I just did it

[tiny ember]

I DMed you

[graceful mortar]

Helllllllloooooo

[runic walrus]

Hello, I the question What is the name of the security regulation for credit card payments a company must adhere to? (Answer Format: acronym) is giving me an error saying it is wrong but i am fairly certain it is right. Can someone help me?

Penetration Testing Process: Post Exploitation

[fathom pendant]

Hint: Check the regulation section and look for payment card and acronyms

[hardy glen]

Hello, I'm stuck answering the following question in the footprinting

What is the FQDN of the host where the last octet ends with "x.x.x.203"?

I have tried all the possibilities using the wordlist. But I couldn't get the answer

I did > Subdomain Brute Forcing

[runic walrus]

I did, is it not PCI?

[fathom pendant]

it's close

one sec while I pull it up

[hardy glen]

using dnsenum with SecLists. word list

[runic walrus]

Is the regulation section inside the Post-Exploitation page? or do i need to go somewhere else in the modules

[fathom pendant]

it's in the Post-Exploitation Page

but it's within that page area that you'll find it :)

[runic walrus]

Oh, i just got it. I tried that before, but i didn't have the hyphon. Thanks for the help!

[fathom pendant]

No Problem! also as just a note: sometimes the labs can be touchy/buggy so if you're having an issue with a box or trying to nab info when you get to it - sometimes refreshing the host is the key :)

[fathom pendant]

Also if you plan to JUST use the pwnbox remember whenever it is terminated and restarted it starts fresh with no made directories or files downloaded etc

[fathom pendant]

It warns you as such; but they do provide you the resources (If your pc can run it) to the parrot VM they use (though it's not required) but good luck in moving forward! if you ever need help you can always field a question in here; to get best results try and phrase things in ways like
"I am stuck at this module, and have tried this - but no luck" the veterans usually will swoop in and push you in the right direction. The reason they won't tell you the direct command to run is that it doesn't help you learn to use resources :)

[last cape]

hey can somebody help me with a question on the wordpress module

https://academy.hackthebox.com/module/17/section/64

its this section

i got everything except for "Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download"

and i am not sure what to do for that one

help would be appreciated 😄

[fathom pendant]

have you checked all your choices for exploiting vulnerabilities?

[last cape]

yeah, i found out that the plugin im supposed to exploit is the site-editor one

i found this directory on exploit-db

/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd

[fathom pendant]

what happens when that is run?

[last cape]

i get this

i sent a ss in dms

[normal wind]

Appreciate it

@raven cairn

[fierce pond]

Which version of the FTP server is running on the target system? Submit the entire banner as the answer.
what do thy mean by entering the entire banner ?

i mean i have the version off the scan and its 1.1 so what kind of stuff are they asking for

Please someone help , i even added the option to trace the packet to see if there's something hidden , but nothing showed up , one script showed some nonsense , but i think the answer needs only the version , and it seems i cant type it right 😄

btw module footprinting

[proper pagoda]

When you are trying to connect to the FTP server, it usually sends you a banner.
If this isn’t the case with your scanner application, then you can always try to connect to it with any other tools, and just grab the whole banner it sends you

[ripe terrace]

Has anyone done the hard lab in the footprinting module and is willing to point me in the right direction? I feel as if I have enumerated all possibilities (which clearly isn't the case, otherwise, I wouldn't be stuck), and I'm not sure what else I can/should try.

[fierce pond]

i tried nmap , ftp , netcat , openssl

other than FTP v1.1 nothing really came up

so can u please be more specific about what other tools you are talking about ? should i try the telnet ?

[ripe terrace]

@fierce pond , you have the answer in the first screenshot.

[fierce pond]

i tried that couple times now , its not working , and i keep getting the same answer , there is no other one , let me check the upper case while im entering the banner in the field

ah damn

i was entering that with the 220 ! that was dumb , sorry to waste your time guys

[ripe terrace]

Yeah, the 220 at the front is just a status code, not part of the banner 🙂

[fierce pond]

well its kinda part of the banner XD !!

anyway , yeah i should have tried to just delete the status code , you are right !

[ripe terrace]

@fierce pond if you have any luck with the next lab (Hard), let me know... I'm stuck there at the moment.

[fierce pond]

i skipped it all just to take a look XD , if i pass it i will let u know

[stiff tapir]

I am trying to connect to openvpn using mac terminal but I am unable to connect. can someone help me?

i installed openvpn using homebrew

[deep tendon]

What group type is best utilized for assigning permissions and right to users? I know what group it is but it tells me that it is not

[rustic sage]

Please someone help me with predictable reset token module?

[jade gulch]

my target is spawned and now i dont want it

how to disconnect from it

[hallow oxide]

Need help with Password Attacks/Credential Hunting in Linux module. Can i DM someone?

[still violet]

I am stuck on Broken Authentication in Weak Bruteforce Protections section. Question 2. I used|| X-Forwareded-For: TargetIp:Port with deafault-credentials.csv || I've used other lists as well but still can't figure out the correct credentials. Any hints ??

[hallow oxide]

im not sure its possible. just wait for it to end. Or if u broke something and it and want to respawn it - reset it.

[jade gulch]

it resets with a different ip

but the timer ticks

in thm there is a button to terminate

but i cant find any here

[deep tendon]

What group type is best utilized for assigning permissions and right to users? I know what group it is but it tells me that it is not

[hallow oxide]

sometimes timer doesnt reset. I fix this my reloading page or just opening a new tab and closing existing one. Looks like there is now way to terminate the target before timer runs out. tho maybe "finishing" the page after u type in all the answers does the trick

[hallow oxide]

which module is this?

[deep tendon]

active directory

section active directory groups

[hallow oxide]

Introduction to AD? what is your answer

[deep tendon]

||Security groups||

[hallow oxide]

just read the question with care for each word. it says WHICH GROUP, not WHICH GROUPS

even which GROUP TYPE

correct your answer accordingly. You are right, but should answer the question they ask.

[deep tendon]

group type and group scopes is the same?

[hallow oxide]

"What group type" should probably have a one-worded answer

[hallow oxide]

no

[deep tendon]

okey its solved thanks for your help

[hallow oxide]

Your welcome. Just read the questions with care. Mistake in quantity is a mistake.

Need help with Password Attacks/Credential Hunting in Linux module. Can i DM someone?

[fierce pond]

if you only have the ssh , imaps , pop3 ports , you need to enumerate more , there's 6 ports open ! 🙂

[sinful falcon]

Hello world, I need help, I have a problem with the "Pivoting, Tunneling, and Port Forwarding" module. When I use my kali, the port forwarding reverses do not work and I tried with the workstation, it works perfectly.

I have no response on msf

[fierce pond]

as long as you can connect to the ubuntu client and to the windows desktop , then there's no problem , check your the ports and the Ip you providing !

[still violet]

sure.. If you are still stuck.. You can dm me

[sinful falcon]

I have tried different ports, I have the same problem.

On the workstations of HTB, it works. And not on my kali. I'm going through exactly the same steps.

[fierce pond]

oh Yeah i remember that well , can you connect to the VPN correctly ?

[sinful falcon]

Sure

[fierce pond]

send a screen shot of your configuration

[sinful falcon]

I have never had a problem yet, I am following the CPTS path. I have problems only with this module.

[sinful falcon]

What do you need ?

[fierce pond]

you need to specify the ip of your tun0

[sinful falcon]

Yeah I tried too

[fierce pond]

you dont need to try that , it doesnt work otherwise

so the first thing you need to do , is that you need to be sure that the ubuntu will connect to the tun0

[sinful falcon]

I tried 0.0.0.0 and tun0 ip and differents ports

just 1 min

I will try

[orchid ingot]

Can someone help me on Skills Assessment of PIVOTING, TUNNELING, AND PORT FORWARDING module? stuck on the last question. I found another host from the last machine which is 172.16.10.5 (I think this is a DC) but cannot move further.

[fierce pond]

im not that far yet with that module , sorry 😦

[sinful falcon]

With this command right ? : ssh -R 172.16.5.129:8080:tun0ip:8000 ubuntu@10.129.x.x -vN

[candid zephyr]

there's so much going on for ad assessment 2 :-s

[final salmon]

Trying to do the BloodHound assessment, but the BloodHound user//pass is not working. Has anybody experienced this?

[fierce pond]

you confused me now lol ! , let me check !

[vital adder]

bug hint you don't need to 🤣

[orchid ingot]

Howw

[vital adder]

hint click this pc in the file explorer

[fierce pond]

did you use the msfvenom ?

[sinful falcon]

yes

[orchid ingot]

Will check it tonight. Thanks

[sinful falcon]

for windows machine ? yes

[fierce pond]

lhost= ubuntu ?

[sinful falcon]

yes 172.16.5.129

Does it work on your own kali?

[fierce pond]

i remember having a problem there on my own kali once but it was related to VPN connection

[vital adder]

@sinful falcon i remember helping some guy on this module with a weird issue and the issue end up to be the meterpreter shell is too big to be route through multiple machine but which section are you on?

[fierce pond]

i dont think you are facing that kind since you can connect to the ubuntu and windows freely

[sinful falcon]

Remote/Reverse Port Forwarding with SSH

[sinful falcon]

With workstation, no problem, only with my own kali

[vital adder]

i got no note but i'm pretty sure it's this one

try with a normal instead of the meterpreter shell

[sinful falcon]

I have not to use this one ; windows/x64/meterpreter/reverse_https ?

[vital adder]

found an old screenshot on this

[vital adder]

nope that's still a meterpreter shell

[sinful falcon]

Ok i wil try, thanks

[vital adder]

use windows/x64/shell/reverse_tcp (that work for my babased on the screenshot)

or netcat 🤣

[sinful falcon]

I'll keep you informed

[sinful falcon]

I have this problem now

[hallow oxide]

Need help with Password Attacks/Credential Hunting in Linux module. Can i DM someone?

[vital adder]

oh yep i think that's the weird issue the guy i help before but the only "fix" i found for this is just use a light shell (like netcat)

[vital adder]

what's the issue? and sure shoot me a dm

[vital adder]

oh wait those are the same number of bytes as my first screenshot

try with netcat just for a sanity check

[sinful falcon]

Works with netcat

[vital adder]

yep so the issue still is the shell is way too big some how

even with the normal shell

[fierce pond]

you def have mistake in your exe file or the configuration on msf

[sinful falcon]

I followed the same steps.

[sinful falcon]

Thanks

Thank you for your help

[candid zephyr]

after finishing this ad module I am definitely going to figurre out a better, more orderly workflow hahaha

so many things open 😭

[still violet]

I’ve tried using basic-bruteforce.py with modifications. I’ve tried using burp.. I’ve tried wfuzz too.. can’t seem to figure this one out. Any hint would be appreciated

[candid zephyr]

Has anyone done AD Module Assessment 2 available for a quick Q?

Before I waste a bunch of time...

Nvm it was that stupid mimikatz thing.

[hallow oxide]

Still stuck on Password Attacks/Credential Hunting in Linux module. Can i DM anyone?

[fierce pond]

@sinful falcon

from my machine

you need to set the ip to your ip machine

[placid quest]

@hallow oxide dm

[sinful falcon]

Where?

[placid quest]

@vital adder hei man can i dm u because i am stuck on pivoting module skills assessment

[fierce pond]

so
ssh -R 172.16.5.129:8080:yourtunip:8000 ubuntu@10.129.50.110 -vN

[fierce pond]

this was right

[sinful falcon]

I tried but it didn't work. I'll try again and maybe on another VPN server, which one do you use? Europe 1 ?

[fierce pond]

idk , never looked , but it has nothing to do with the VPN , you are getting connected to the VPN and the connection is actually established as u can see from your screen shot here , it just that the msf doesnt get the connection for somereson , i thought it because of the connection through the VPN that's why i specified the redirection in the SSH -R to the ip of the tun , after i done that restarted the process of the msf , and it worked !

[sinful falcon]

Ok, too bad it doesn't work for me.

[fierce pond]

im trying to tell you that i got the same problem and i worked around it by just replacing the 0.0.0.0 with the actual ip from the tun0 and restarting the msf process , try that and maybe it will work

[sinful falcon]

Thanks, I will try today. Thanks for your help

[placid quest]

@fierce pond replacing 0.0.0.0 may not work

[sinful falcon]

I will test too with new kali instance

[fierce pond]

why not ?

he's getting connected to it , it just the matter of the msf , and idont know if msf has it own routing tables , but it worked for me while having the same problem , are you facing the same problem as well ?

[placid quest]

@fierce pond no i have completed that selection but on skills assessment i have tried to use the msf but i am still stuck since the payload is not showing any errors but i am not getting the shell

[fierce pond]

are you on the last step of that ?

[placid quest]

@fierce pond yes

[fierce pond]

check out the chat history

[placid quest]

@fierce pond i have done everything but i am not understanding where i am making the mistake

[fierce pond]

.

[autumn badge]

nnniiggeerrrss nniggeerrrsss

[fierce pond]

well im not there yet , but i will tell you to recheck everything from the start , maybe with some dawings it should help , i think drawing is essential in the first period of learning Pivoting

[pastel verge]

Ih

Sorry hi

[sinful falcon]

@fierce pond @vital adder I just tried with another kali VM and it's working !

[fierce pond]

your nat was the problem ? damn i hate when that happen !!

[sinful falcon]

I have a new problem with the following section... Meterpreter Tunneling & Port Forwarding. Same problem, no return, even with netcat ...

from "Meterpreter Reverse Port Forwarding" it does not work

Port forwarding is present though

[placid quest]

@sinful falcon i don't think u need to use nc

[fierce pond]

your port is open on 3389

[sinful falcon]

yes just a test

[sinful falcon]

the shell must go through port 1234 and return to me with port 8081

[placid quest]

@sinful falcon if it is a test u are doing it the wrong way

[sinful falcon]

meterpreter don't work too

[placid quest]

@sinful falcon u need to transfer the payload to the windows machine

[sinful falcon]

I did

[placid quest]

@sinful falcon can u dm

[sinful falcon]

ok

[fierce pond]

he's trying to just ping or use netcat instead which should work .

[sinful falcon]

yes exactly

this module will make me lose my mind

[fierce pond]

yeah that's why i left to another time 2 month ago , hahahaha ! but i already finished mostly everything

[placid quest]

@sinful falcon it will not work since ur local machine cannot ping the windows machine due to dmz

[fierce pond]

i will go back to that module because of you mate thanks for the motivation

[sinful falcon]

I'll move on to another module I think. I hope the problems will be solved in the meantime.

[fierce pond]

@sinful falcon notice something that IN THE MODULE the redirection is done through the ubuntu not your machine

[sinful falcon]

I follow exactly the steps of the module. If it doesn't work, there is a problem with the explanations given.

[placid quest]

@fierce pond yes but u cannot start the nc on ur local machine u need to start the nc on Ubuntu

[fierce pond]

no you dont , if there's a redirection it should just go , but for nc he would need another open port on his machine which is redirected from the ubuntu machine , omg it got complicated in my head LOL

[candid zephyr]

AD Attacks and Enumeration Module is great for anyone interested. Windows Priv Esc will help. Pivoting knowledge needs to be up to scratch.

[fierce pond]

how about we make a learning session on voice call if yall have time for that

[sinful falcon]

I will see the following sections. Hopefully it works.

[fierce pond]

you are absolutely right but there's a module for pivoting which is less intimidating i guess.

[placid quest]

@fierce pond That would be great 👍

[pastel ginkgo]

Hands down one of the best modules on HTB

[candid zephyr]

I knew enough about it before the AD assessment, not done the module but think if you've not learned to do it youi'll hit a hard wall in the assessment.

[sinful falcon]

I hope there is no fowarding port on the CPTS exam otherwise I'm in trouble

[pastel ginkgo]

its not that hard

[fierce pond]

good to know , i will def hop on that after the pivoting section , i need it anyway for the OSCP , i failed big time because of AD

[candid zephyr]

I think the hardest thing to do with pivoting imo is just keeping track of all your shit.

[pastel ginkgo]

Just use chisel for pivioting

its gold

[fierce pond]

practice will make the master . dont worry about it we will get to that level

[candid zephyr]

Idk how people do this stuff with tmux/terminator or whatever.

[pastel ginkgo]

Yeah im like 80% done with the pathway and plan on starting dante before the end of the year as my final prep for the exam

[fierce pond]

damn same thinking

[pastel ginkgo]

got to take advantage of that 95 dollars off lol

[fierce pond]

Exactly !!

[pastel ginkgo]

even if I dont get to it for a month im still saving 60 dollars

[fierce pond]

you will be saving the money either way so this is a good offer , specially i have time to do it because of the vacation

[pastel ginkgo]

right

people were like what are you doing for the holiday and got crazy looks when I said im trying to finish this hacking course 😆

[fierce pond]

😂

[sinful falcon]

When does the offer end? December 31?

[fierce pond]

same bro same !

[fierce pond]

yup

[pastel ginkgo]

im sure theres quite a few people in this discord with the same idea

[fierce pond]

but we need to finish the pivoting and the ad section , i guess we can achieve that till 31

[pastel ginkgo]

I loved that module

its kinda buggy though

[fierce pond]

yup i start to notice a sync of a schedule , we gonna have a good team for Dante !!

cracking Dante in 10 days

[pastel ginkgo]

lol thats wishful thinking

[sinful falcon]

I will be difficult with this tricky pivoting module lol

[pastel ginkgo]

im expecting to get wrecked lol

[fierce pond]

@sinful falcon @placid quest imma be on VC lets finish this pivoting section

[placid quest]

@fierce pond i have been stuck on skills assessment if u start that selection tell me i will be waiting ✋️ for u

[pastel ginkgo]

what ya stuck on?

[placid quest]

@pastel ginkgo on getting a reverse shell with msf

[fierce pond]

i started pivoting long time ago , i finished till netsh but im redoing it from Meterpreter tunneling

[pastel ginkgo]

I dont think I as able to get that working, the vpn tunnel bandwith isn't large enough to get meterpeter working

I kinda got it working from pwnbox

[placid quest]

@pastel ginkgo thanks let me try that

[pastel ginkgo]

You can also make a windows build of chisel

[pastel ginkgo]

For Web Attacks Mass Idor Enum, how did yall write the regix expression? As I couldn't figure out how to write it properly so I ended up || writing a script that did the curl request then I grep it to just the documents then just looked for the flag in my wall of text ||

[dusty citrus]

are you using dehashed?

[weak marsh]

My phone locked how can I unnlock it without losing my data? It's Oppo a83 and I haven't used the phone today. I can't use whatsapp...payment apps etc...

Pllz mention me when u reply so tht i can a notification

[dry parrot]

Hi all, what type of decoder did you use to solve Brute Forcing Cookies

[rustic sage]

same

i use cyberchef

i'm stuck on the secoond answer

[dry parrot]

im using cyberchef

but probably i dont know how to use it correctly

[fathom pendant]

This isn't the chat for that sort of thing but good luck

[weak marsh]

lol

ik but still...

[dim hound]

I am doing Password Attacks -> Remote Passwords Attacks -> Network Services. I am not able to get the Winrm and SMB password... I am using the user and password list that are present at the resources tab of this module

Would someone be willing to provide me a nudge ?

[placid quest]

@dim hound yes

[dim hound]

Can I dm you? @placid quest

[placid quest]

@dim hound yes

[heavy dome]

I need help!!! I am running Network Enumeration with Nmap Hard Lab and ||found the hidden port 50000.|| I have made several attempts but it is always filtered. Can anyone help me?

[pastel ginkgo]

Its been a couple months since I last did that module, but are you changing where your ip is coming from?

[fierce pond]

theres 2 ways to get around that , changing source ip or source .... 🙂

[pastel ginkgo]

This web attacks module be like, hope you know how to script in bash xD

[fierce pond]

fr ?

[pastel ginkgo]

kinda, just a little you have to modify their scripts. although this one I just got to said write a script to change all users emails as an optional.

But that being said the bash module is a kinda ok intro into scripting

or you could chatgpt it out

[fierce pond]

i was waiting for someone to say that !! XD

chatgpt something is gonna be a new verb soon lol

[pastel ginkgo]

i already used it to help me solve one modules assessment lol

i am not super familiar with php so I asked it to explain the code lol

[fierce pond]

yeah its cool , actually its good way to learn with chatgpt , it can answer questions u have instantly so you dont have to search google for the best answer , i kinda like it when it comes to that

though some people say it delivers false information , which i didnt encounter still

[pastel ginkgo]

yup I had it write me a couple non related scripts to fix stuff already

I think it might be down atm though

im getting a 404 error

[pastel gale]

anyone do the live engagement from shells and payloadds recently

[fierce pond]

i had it once to explain me how routing tables function , i went with my curiosity till the kernel XD

[pastel ginkgo]

Not super recently but I have notes for it

[pastel gale]

i need help with the priv eesc of host 3

[pastel ginkgo]

check the cheat sheet

answer is there

[pastel gale]

BRUHHHH

never bothered to look there

thankss

[heavy dome]

I tried different types: ||IP address spoofing/Decoy IP, source port manipulation and MAC address spoofing||. the best result is|| with -sM --> 50000/tcp open|filtered ||

[pastel ginkgo]

how many decoys are you using?

[heavy dome]

||-D RND:10||

[fierce pond]

try a source port , with some rate modifications

[pastel ginkgo]

|| I think I used like 15 ||

but that should also be enough

[pastel gale]

for some reason the reverse shell doesnt want to connect

i am not sure where i am effing up

[vocal goblet]

Hi there. For Module "Getting Started", section "Service Scanning" one needs to grab the version of whatever service is running on port 8080. However nmap doesn't seem to return that:

nmap -sV 10.129.248.35 -p8080
Starting Nmap 7.92 ( https://nmap.org ) at 2022-12-20 19:15 GMT
Nmap scan report for 10.129.248.35
Host is up (0.011s latency).

PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache Tomcat

The hint also does not tell much more than running nmap with option -sV on the target IP

[pastel gale]

use another tag

with -sV

@vocal goblet

[vocal goblet]

What do you mean with tag?

[pastel gale]

just like -sV

there are other tags

try using them

[vocal goblet]

OK ill keep looking, thanks 🙂

[pastel gale]

dm me if you need help later

[heavy ferry]

Hello

I need help

[vocal goblet]

so turns out the version is literally what it says in the output of my command, I was looking for a version number 😅

[pastel gale]

correct

🙂

[fierce pond]

just ask

[heavy ferry]

Is there a channel for discussing hacking

Or can i just ask for the help here

[fierce pond]

this is the academy channel

[heavy ferry]

Where can i ask for help hacking smth

[pastel gale]

unless its not related to whitehat i would suggest you to not look around here

[fathom pendant]

I just did that one last night, and tbh the answer or how to get to it is given to you, hint: return to the IDS page and read carefully. As a note, if you do not get the flag, that happens sometimes, but you should be able to run it in pwnbox and get the results

[heavy ferry]

It's not really blackhat or whitehat

I just need to talk to someone that has experience

[graceful rampart]

Just ask your question. If this is the wrong channel for it ill direct you to the right place

[pastel ginkgo]

Well this channel is for talking about Modules from HTB Academy so if its not about that please look in another channel

[fathom pendant]

If you do not receive a flag, you may need to redownload your VPN key as well @heavy dome -- after redownloading and refreshing my VPN connection I got it in a jiffy with the right command

[heavy ferry]

I need to talk to someone that has experience in breaking into devices

[graceful rampart]

again, just ask the question

[fathom pendant]

What type of device, or devices, you're being obtuse which is making it harder to provide an answer and to redirect

[heavy ferry]

What does a hacker need to steal folders from a device

[graceful rampart]

One does not simply "Steal files" from a device

[heavy ferry]

Like an average hacker

[fierce pond]

you got hacked or something ?

[fathom pendant]

IP, SSH key, Credentials, access

[pastel gale]

hashes

[fathom pendant]

If only there was a course structure all about how to get information or something to help the man out

[heavy ferry]

I have relatives that work in the ministry of education and they think that ppl can get into their devices and get the exam files

[thorn urchin]

what module is this about? because youre posting in the modules channel which is for discussion about modules so surely you must be asking a module question and not being off topic?

[graceful rampart]

Hmm. I wonder where you could find such a thing

[graceful rampart]

lmao

i thought you wanted to do something illegal

[pastel gale]

+1

[graceful rampart]

wrong server buddy

[heavy ferry]

Sorry

[fathom pendant]

It sounds like they need to hire someone to run a test, to perhaps see if their network can be penetrated somehow

[pastel gale]

go to reddit you will find your answers there

[heavy ferry]

Ty guys sorry for interrupting

[graceful rampart]

Not trying to be mean but if you want to steal files without someones permissin youre in the wrong place.

[heavy dome]

i've thake the flag...THX

[fierce pond]

well its possible if that's what you are asking

[heavy ferry]

I'm not ty for ur help doe

[pastel ginkgo]

I was watching like yeah he's setting him up for a ban 😂

[pastel gale]

haha lool

[graceful rampart]

They youre asking if its possible for someone to steal files?

Yes it is

[fathom pendant]

If they are worried as well, they need to raise it to the relevant leadership so they can do the paperwork required to get a contract from a qualified pen tester.

[graceful rampart]

if youre concerned for a buisness then they likely need a pentest

[heavy ferry]

I mean like they don't know how much information they can put out

[pastel gale]

also i would suggest them to not store exam files unencrypted tell them to pssword protect all the files next time with a difficult password

[fathom pendant]

There is a reason there are people that get paid for this

[heavy ferry]

Like an ip adress can be grabbed from a home line number

[graceful rampart]

^

[heavy ferry]

Didn't think of that ig it's the right thing to do

[fathom pendant]

I mean that's just a bandaid solution

[heavy ferry]

I'll try to hire someone

[fathom pendant]

No

[pastel gale]

failsafe

AND PLEASEE do not store the passwords to the files in the notes of the same phone @heavy ferry

[fathom pendant]

You yourself cannot hire a pen tester on behalf of a company

[graceful rampart]

you cant leagly hire someone to perform a pentest if you dont own the systems they will be testing

[fathom pendant]

As stated only the relevant leadership for their team can hire someone

[heavy ferry]

They are old so I'll do everything for them

[pastel gale]

good

[heavy ferry]

They are my relatives i have permission

Ty guys

[pastel gale]

we actually need an off topic channel for sruff like this hmmm

[fathom pendant]

No... No you don't

Just because they're your relatives does not mean shit

[heavy ferry]

They asked me for it lmao

[pastel gale]

why so livid

[fathom pendant]

Do you work directly for the department? As in, are you on the payroll?

[heavy ferry]

I'm known as the tech guy in the family but I'm not really experienced in that topic

[graceful rampart]

More like, do you write the pay checks lol

[fathom pendant]

That too

[heavy ferry]

I asked for help here because i don't really know what to do yk

[fierce pond]

that's the important thing for TUX !! XDXDXD

😂

DEAD !!

[graceful rampart]

lol

[fathom pendant]

Because penetration testing is a serious legal topic lol

And if you're going to hire someone, you HAVE to use the proper channels within the organization to do so.

[heavy ferry]

And live in a shitty country we don't even have proper cyber security

[pastel gale]

Ahh yes i get that I thought you were pissed as he was working for his fam for free 😂

[heavy ferry]

System

Like primal shit yk

So that's why I'm afraid too

[fathom pendant]

Yes but there are still basic legality and ethics if there aren't strict laws.

[heavy ferry]

I get it

Ty

[graceful rampart]

At the end of the day, what youre looking for is a pentest. There is a lot of legal work that has to be done before any professional will perform said pentest. Now you know what youre looking for, so you can start looking into it

Or actually, if said company has never had a pentest done before youll probably want a vulnerability assesment instead

[heavy ferry]

Tysm 🤍

[graceful rampart]

np

[fathom pendant]

Vuln assessment is definitely a lot less risky as well

[graceful rampart]

Pentests are suually done after several vulnerability assments have been conducted and the results of those assesments have been acted upon

[fathom pendant]

Yep

[placid quest]

@graceful rampart vulnerability assessment and pentesting are different things

[graceful rampart]

yes i know

hence why i said usually you dont do a pentest until after youve already done several vulnerability assements

[fathom pendant]

Yes but you should probably know about vulnerabilities first, and mitigate risks prior to a pen test

The pen test is there to say 'hey there are still x y z flaws in the system'

[graceful rampart]

A pentest is pointless if its going to find 100 critical vulnerabilites that are gonna overwhelm the buisness. Cuz once they get overwhelmed, aint none of em getting fixed

so you do several vulnerability assements first to find and fix a mojority of them before hand. Then you do a pentest and see whats left

[fierce pond]

sounds professional

[fathom pendant]

Your mom is a professional

[placid quest]

@graceful rampart Using nessus and finding some vulnerability that does not mean that all vulnerability are real some are not vulnerability that is why u need to reconnaissance first

[graceful rampart]

again, I very much understand the difference between a pentest and a vulnerability assesment lmao

[fierce pond]

you know his mom ?

[rustic sage]

Hello

[placid quest]

@rustic sage hei

[rustic sage]

@placid quest Any tips ? In h@cking

[fierce pond]

did you start in the Academy ?

[placid quest]

@fierce pond thanks for ur help

[rustic sage]

I'm new here

@fierce pond i created my htb account 2 years ago

Now I'm just logged in

And i want to learn

[fierce pond]

on what , i need to help my self first lol , i need to finish the pivoting or at least finish till the skill assessment , so we can do that later

[placid quest]

@fierce pond yeap

@rustic sage start on getting started

[rustic sage]

@placid quest

[placid quest]

@rustic sage what

[fathom pendant]

She's expensive

[fading quail]

Oh, lord.. I promise you I've had enough ||ftp brute forcring||
I won't do it again after this ||Password Attacks easy lab||
1 billion tries, userlists, passwords, mutated, reversed, blablaed...
lead me to this point where I beg you for guidance in my path
or the next bruteforcing will be my lobotomy, followed by the
||cme ftp -u cus_mut_use -p cus_mut pass||... with a Intel3-no graphic card.
I'm crying out my soul to you right now..

[fierce pond]

LOL we talking money now !

[fathom pendant]

If you're looking to do a specific specialty I would suggest going to http:://academy.hackthebox.com and starting there. Or if you wanna test it out there are a few getting started modules that give you a gentle guide into what to expect.

[placid quest]

@fading quail anonymous login is enabled on ftp

[fathom pendant]

Try to avoid giving direct answers as spoilers, but guiding to the right answer is usually more helpful

[placid quest]

@fathom pendant I will try to improve on that thanks 😊

[fading quail]

I tried that already >.< But I'll hard-try then 😛 Thanks!!

[fierce pond]

u remind me of the Try harder moto from OFFENSIVE SECURITY 😤

can someone help me or direct me to talk to someone about something related to VM and stuff like that ?

i notice that im facing a problem with the VM , and everytime its a different shit , sometimes its the NAT sometimes its the routing table , sometimes is VPN is there anyway you guys are getting along with this ?

are you all connecting to HTB behind a NAT ?

[candid zephyr]

don't set your vm network adapter to nat

bridged.

[fierce pond]

and do you advice to get it bridged while im connecting to the Academy ? im not monitoring my network all the time im on HTB that's why nat was better choice for me

[candid zephyr]

what do you mean?

im not monitoring my network all the time im on HTB that's why nat was better choice for me

this doesn't make sense?

[fierce pond]

well i mean we are connecting to a platform to learn how to pentest , but some will take another road and try to hack us instead just for fun , we are all sharing VPN and maybe the instances as well in some cases

anyway i will change it to bridge as you advice if that will solve the Issue !

[candid zephyr]

It's highly unlikely. The kinds of people inclined to mess with your Kali VM don't have the ability to do so and the people with the ability have better things to do with their time.

unless your threat model is someone compromising your kali vm through the HTB VPN and escaping the VM into your host OS to install a bitcoin miner.

[candid zephyr]

Hopefully!

[fierce pond]

that would be very unlikely but yeah i think i was just being paranoid

[candid zephyr]

You'll be safe inside your VM :>

[fierce pond]

yeah i will totally ping you if that got hacked LOL

there is a pro lab channel you can go there and im sure they will help you

[candid zephyr]

#prolabs-dante

[low forge]

Okay, for some reason i am not able to view the channel #prolabs-dante

How do i access it?

[novel matrix]

#welcome

[low forge]

Oh alright, thanks for the help!

[graceful rampart]

Any module on HTB Academy with Fundamentals in the name is a really good place to start

Preferably do them all

[fathom pendant]

Fundamentally insane

[pastel ginkgo]

I like to compare learning hacking as researching eldritch truths so yes you need to be a little nuts.

[wide oak]

I think in "Pass the Hash (PtH)" (https://academy.hackthebox.com/module/147/section/1638) there is a mistake in the example:

PS c:\tools\Invoke-TheHash> Import-Module .\Invoke-TheHash.psd1
PS c:\tools\Invoke-TheHash> Invoke-SMBExec -Target 172.16.1.10 -Domain inlanefreight.htb -Username julio -Hash 64F12CDDAA88057E06A81B54E73B949B -Command "net user mark Password123 /add && net localgroup administrators mark /add" -Verbose

The Import-Module here seems like it should be on Invoke-SMBExec instead. Otherwise the second command won't execute properly.

[fathom pendant]

#858470491676737536

[raven cairn]

Could I have some help on the AD skills assessment 1?

I am pretty sure I know the way about how to do this, but I just need some clarification on a few things.

Been stuck on it for a while and would appreciate a nudge in the right direction

I don't think the tool I am supposed to use was touched on enough within the module.

[lethal schooner]

How many threads did you use? It's taking forever to find the password.

[pastel ginkgo]

I gotcha let me check my notes

[raven cairn]

Thank you my dude. 🙏 Always appreciate your help.

[pastel ginkgo]

So for where you are I made a reverse shell because it was just easier to work with, although madF0x insisted he didnt need one and just was ok with that crappy webshell

for a hint || These accounts tend to have weak passwords because they are not intended as user accounts ||

[raven cairn]

Can i dm? I don't want to give spoilers

[pastel ginkgo]

Sure

[wheat garden]

been having this same issue you find a solution? As soon as I login to the jason machine that has the flag I get this error before the desktop can load up so I cant read the flag.

[pastel ginkgo]

Oh that one is buggy as fuck

I never got Proxifier to work

I used a different pivoting method to get the flag

its a common complaint

For Web Attacks - Blind Data Exfiltration, Was anyone able to get the automated tool to work? I got the flag the good old fashioned way but the tool dose not work for me.

[fading quail]

Well, that sadly was unhelpfull...
But, remember, after abusing the drug and if it isn't working anymore, there always be a mythical creature around to help you

[wheat garden]

okay guess ill try another method I basically got to the final step but the rdp desktop bugs out before I can see the flag everytime lol

[pastel ginkgo]

I never got that far, I got stuck trying to get a connection

I think the issue is due to bandwith limitations

There's a similar problem on getting meterpreter working on the 2nd pivot in that module. Has to be done from pwnbox to work. Over the vpn it shits the bed.

[wheat garden]

ok

[wheat garden]

actually got it to work ....not really but I managed to open and copy and paste the flag right before it could crash on me haha take that buggy module

[pastel ginkgo]

lol there you go

[hazy grotto]

Anybody doing the THM advent event?

[shut matrix]

Should I learn some SQL before I take SQL Injection Fundamentals or will that teach me what I need to know

[sly tapir]

your fine to just take the SQLi module...its for beginners

[final elm]

search again, the exploit is a txt file

[pastel ginkgo]

The feeling when you finish a module you started working on at 10 this morning and finished 12 hours later

[sly tapir]

i have definitely been there...thought i was the only one

[graceful rampart]

Bro, this file transfers module is like an encyclopedia lmao. Theres a transfer method for everything. Not that im complaining. 3 pages of different commands so far and theres still more 😆

[raven cairn]

File Transfer's are super important tho!!!

[graceful rampart]

Agreed

And it's awesome how many methods they give

Always good to have something ti pull outta your back pocket for that one super obscure situation that you're inevitably gonna run into eventually

[raven cairn]

Loved how the module talked about evading detection

[gilded sonnet]

I completed CBBH modules today, looking forward for the exam

[weak kindle]

Good luck let us know how it was 🔥

[gilded sonnet]

Thanks man!

[woeful oxide]

Good luck man

I recommend you having your notes ready for the exam

[brisk geode]

~~hey can anyone help?

Module:Login Brute Forcing
Section: Service Authentication Brute Forcing

it seems like my container isnt responding i restarted the container multiple times~~

solved

[lime frigate]

I'm a new student. How do I get started?

[woeful ermine]

hello. I think there is a problem with metasploit - module section. Aim is finding an eternalromance exploit and get shell on target machine. I tried it on both vm and parrot instance. In both cases I ve got timed out error.

[frozen socket]

I had it, thanks

[frozen socket]

you want to get the shell on the 4444 port?

[frozen socket]

i am not sure but I think you have to change RPORT option

to te port you want and later being listening on thag port with nc

[strange vault]

can someone melt this guys router if i give you guys his ip address? stupid request, but he be creeping on girls on snap and I wanted to do a good deed lol

[frozen socket]

no

[strange vault]

i respect your decision

[woeful ermine]

@frozen socketno on 445 , 4444 lport for listening

[frozen socket]

the RPORT should be the same as the one on listening because

it is supposed to be open and ready to inject

and later you should have in your machine nc waiting on listening mode on that port

[fathom pendant]

the RPORT is the receiving port iirc

not to familiar with the msfconsole stuff but that rings a bell on it

[fathom pendant]

This isn't the type of server for black/greyhat requests :)

[woeful ermine]

@frozen socketwell no worries. I tried at that in instance

here you go

[strange vault]

my apologies, butttt if you have a server for that, plz provide @fathom pendant

[tepid thicket]

you shouldn't change rport for this exploit. 445 is default smb port
and lower ports are reserved. for listening port you shoud probably use a higher port

[woeful ermine]

@tepid thicketyepp I used 4444

[fathom pendant]

I do not, this server is for learning/using the http://academy.hackthebox.com and https://www.hackthebox.com; and in the rules it's strictly prohibited against distributing blackhat services :)

4. Keep it legal.
Do not request, suggest, perform, promote or in other way or shape discuss illegal activities. We respect and follow the Discord ToS as well as the HackTheBox ToS, and do not hesitate escalating matters appropriately, if we deem it necessary. If in doubt, ask a Community Administrator before posting or don’t post it at all.```

[blazing crow]

I know that is confusing questions but did you found the commands to get sid of the last two questions you are talking about.
these are the ones I found that gives correct sid.
||getting sid of user:- wmic useraccount get name,sid or whoami /user
getting sid of group:- wmic group get name,sid||

[fathom pendant]

The reason for win10 is most likely because a lot of corporate infrastructure still uses 10 and windows 11 isn't standard in corporations :)

[rich vale]

getting to the end of the AD enumeration module, this thing is -dense-

[candid zephyr]

It's really good. The assessments are kinda fun.

No. 2 was like a mini htb box.

[rich vale]

good to know, im trying to finish it off before i fly out for vacation thursday lol

running out of time

[candid zephyr]

You'll do the assessments quickly but just absorbing and taking notes for each section takes time haha

[blazing crow]

its like brainstorming

[rich vale]

can you use the golden ticket with secretsdump to get a specific users hash?

nvm, got it

[fathom pendant]

ok the smb module is super buggy x-x i had to try the access command like 5 times before it let me do the thing

[candid zephyr]

These boxes often take a while to boot properly. I always go straight to launching the box then to the top of page to read.

[fathom pendant]

Nah even after it was loaded for a minute I'd still get the nt timeout message lol

[normal wind]

What are you guys studying

[fathom pendant]

Penetration testing :)

[normal wind]

Nice

How long have u been in this field

[fathom pendant]

N00b time lol but tbh the modules are super simple to learn from

Super digestable

[normal wind]

I'm new to cyber security and I'm struggling to choose the path

[fathom pendant]

Well are you interested in finding bugs in programs, or sniffing and poking into networks is the first question

[normal wind]

Yes

I'm stuck to choose the path and I hope I can get an idea where to go

[candid zephyr]

Just dabble in everything, you'll find something that fits.

[fathom pendant]

^you can take a look at the general skill paths

Or the wider look at the career paths

[normal wind]

Right now I'm working on a pre-security certificate from try hack me

[candid zephyr]

TryHackMe might be better for you for a brief overview. They have a bit better step by step for Blue / Red team beginners.

[normal wind]

What's the difference between blue and red team

[candid zephyr]

Offensive / Defensive security.

[normal wind]

Aight

[fathom pendant]

Red is offensive

Blue is defensive

[candid zephyr]

It needn't be so black and white really, but when people refer to red team they refer to pen testing generally.

[fathom pendant]

^

[normal wind]

Thank you for the information

Blue team refers to ethical hacker

[fathom pendant]

Both are ethical

[normal wind]

Oh I see

[fathom pendant]

Penetration testing isn't necessarily an unethical thing. The goal of pen testing is just that, testing

[normal wind]

I think I'll just get the basic knowledge from tryhack me then I should come to hack the box

[fathom pendant]

You are testing within the scope defined by a contract,

[normal wind]

What do you say

Perfect

[fathom pendant]

Up to you man :)

[normal wind]

Appreciate it

What stuff are you doing on hackthebox

Are u a student

[fathom pendant]

https://academy.hackthebox.com/module/details/77

I'm a student :)

[normal wind]

Thanks for the link

I am a math tutor

[outer ledge]

Can somebody nudge me with the blacklist filter of FILE UPLOAD ATTACKS?

[kind turret]

DM me

[blazing crow]

hello, in this latest module MacOS Fundamentals https://academy.hackthebox.com/module/157/section/1522 how do i suppose to access MacOS desktop enviroment?
Like in Windows fundamental module there was remote rdp based windows desktop access I dont seem to find any similar to way to access macOS desktop here.

[vital tree]

Hello, you can only do the module if you have macOS or you have a VM with macOS.

[brisk geode]

exactly where are you stuck?

[outer ledge]

I got it ow thank you now trying to get Type Filters done! Thank you!

[vital adder]

well that make sense but i need to ask based on the fact that not many people have a mac is there any plan on adding something like a mac instance or like a section on showing how to make a mac VM?

[brisk geode]

np

[vital tree]

Having a mac instance is not very of a big importance for now as there is not much modules for it. This is my point of view.
An article for setting a macOS on VM would be a good idea.

[spare condor]

Trying to connect to the machine on Password Attacks / Pass the Ticket (PtT) from Windows, with RDP and I get the following:

Can anyone help with this?

[broken warren]

In the broken authentication module > predictable reset tokens section. I'm struggling to grasp what's being conveyed. The information just seems all over the place. I get that mt_rand() isn't like secure, but I don't understand what I'm supposed to do with my python script or if I'm even supposed to use it? The question says use the one from the open meeting example, but one link is just a whole php script that doesn't work (I tried serving it up on Apache locally and I get a page but it's wonky) and the other is the python reset token script. Then there's the two POC's.
Am I trying to actually get the flag with that python script or do I need to do something else? Do I need to modify the script beyond just the username? And current date (in milliseconds)? and do I need to change 'from hashlib import md5' to something different?

[rustic sage]

Yeahhh, it happened me as well... try reseting both the pawnbox and the target...

or try it from your own VM

[candid zephyr]

🦐 prawnbox

[spare condor]

I'm trying this from my own VM

I'm reaching the machine..

[rustic sage]

now try xfreerdp...

or gnome boxes...

[broken warren]

👌

[candid zephyr]

I think it's failing because the password? encase in ''

'P@ssw0rd' etc

[candid zephyr]

single quotes

'

[spare condor]

Worked. Thank you. But why it required ' here? Cause of special characters on password? If it was abc it wouldn't require ', right?

[candid zephyr]

the double quotes mean it'll still try to interpret the $ etc

so if you did 0xhai = 1337

echo "$ohai" would output 1337

and echo '$ohai' would out put $ohai

0xhai you know what i mean

[spare condor]

yesss, perfect, thank you!

👌

[candid zephyr]

So single quotes for your passwords basically xD

[echo portal]

hi

why i can't see gc in this server 😔

[rustic sage]

read #welcome and verify your account

[echo portal]

Thank you 😊

[rustic sage]

hi hi

can smeone help me with pivoting tunneling and port forwarding skill assessment?

[brisk geode]

https://academy.hackthebox.com/module/80/section/837

can anyone help me to use the script they have provided?

Broken Authentication > Weak Bruteforce Protections

the script is from previous section

[placid quest]

@rustic sage where are u stuck maybe we can help each other

[rustic sage]

dm?

[placid quest]

@rustic sage ok

[iron ermine]

Hey there, I was wondering if anyone can help me with the getting started, service scanning module, I am getting the following error: error NT_STATUS_NOT_FOUND when connecting to the target with the following command: smbclient -U bob ////{IP_ADRESS}//users

I should add that I am able to see the shares. I just can't seem to log in with the provided user credentials

[candid zephyr]

it'll be backslashes

smbclient is one of those stupid syntaxes i always get wrong first try.

[iron ermine]

Omg, I feel so stupid XD Thanks a ton xd

[hybrid plover]

Can anyone help me out on the pivot & tunnelling assessment?

[candid zephyr]

fyi https://wadcoms.github.io is a good website for windows-esque syntax

[iron ermine]

I will have a look at that, thanks again

[candid zephyr]

because i'll be damned if i can remember the slight dlffereinces with each impacket syntax /o\

[iron ermine]

Yeh, I have that problem myself >.<

[outer ledge]

Can someone help with Type Filters, I had the php file firing up and reflecting but then my pwnbox died. I treid to redo it but now it is just showing me the code when im trying to get the hello world reflecting.

[rustic sage]

Windows Privilege Escalation Skills Assessment - Part I, i got a reverse shell on the box but somehow powershell doesn't let me download Juicypotato.exe with either curl or wget. Any idea?

[placid quest]

@rustic sage what about Invoke-WebRequest

[frank blaze]

What happens when you try? Error message?

[rustic sage]

there was an error message as well

[placid quest]

@rustic sage did u use powershell

[rustic sage]

yes

[frank blaze]

What does the error message say?

[formal crest]

@red obsidian Who can I contact for an issue on one of the academy modules? I do not need help with a module but is more in line with a bug.

[outer ledge]

Anyone nudge for:
FILE UPLOAD ATTACKS
Module: Typer Filter

[lethal schooner]

Did anyone in the password attacks module/password mutation section attack ftp instead of ssh when try to brute the user 'sam'?

[crisp remnant]

Anyone for quick question on login brute forcing module ?

[lethal schooner]

Update: Ok so ftp is faster to attack than ssh. Why didn't they just get us to attack ftp in the module..

[abstract orbit]

Need help to make a bypass system for subway tickets with an NFC card

Any assistance?

[frank blaze]

Your question doesn't seem to be related to a Module on the HTB Academy and at first glance appears illegal. You're not going to find any help here is you're not asking for help with educational content held on the HTB Academy.

[sinful falcon]

Hello world, SOCKS5 Tunneling with Chisel module, I have this error on ubuntu server

[crisp remnant]

Are you sure that you have downloaded the binary for your architecture ?

[sinful falcon]

I just followed the steps for moment : https://academy.hackthebox.com/module/158/section/1437

[abstract orbit]

im not going to use it for anything i just want to see if it can actually be done bc if i use the card i can go in jail bc im going to be commiting forgery

[rustic sage]

@frozen socket you may be able to get sensitive info from auxiliary one Backup might contain credentials

[rustic sage]

You would need a device like proxmark3 and get familiar with various nfc systems

[abstract orbit]

ah thanks man

much appreciated

[rustic sage]

It’s pretty cool tbh

I can get cheap ones off Amazon that read and write but none hold a candle to proxmark3

[abstract orbit]

i mean i need to see if someone can do it bc then i can get it to my gov and tell them that this can happen so they can reinforce their system

[rustic sage]

And you likely will need “magic” UID cards

[abstract orbit]

nah i can just jump the fence

[rustic sage]

True lol but it’s an area worth exploring

[abstract orbit]

hacking in general and programming is something worth exploring

i would like to get in that endless rabbit hole

[rustic sage]

There are a lot of phsyical access controls that can be bypassed with proxmark3 far more than you realize most likely

[abstract orbit]

idk how to do any of this

furthest ive gone is arduino XD

[outer ledge]

Anyone nudge for:
FILE UPLOAD ATTACKS
Module: Typer Filter

[rustic sage]

Everyone starts off knowing nothing 🙂

[abstract orbit]

:D

[rustic sage]

Even the best of the best

[abstract orbit]

or like the furthest i might have gone is put windows 10 or do some weird things on linux

but i would enjoy starting to learn

[outer ledge]

Anyone nudge for:
FILE UPLOAD ATTACKS
Module: Type Filter
Thnx in advance! I had it but since my pwnbox died I can not recreate the thing without failing..

[woeful mural]

Anyone here finish ACTIVE DIRECTORY ENUMERATION & ATTACKS Skills Assessment 1? I am stuck on the last 2 questions?

[stuck hull]

Hello I am struggling with FOOTPRINTING LAB (EASY). Any help greatly appreciated.

I have connected to the ftp server on both the standard and non-standard port. I had to use the hint... but when there I cannot even list the contents of the directory. I see this:

[candid zephyr]

What were the questions again?

It won't let me review the questions on mobile 😂

[candid zephyr]

Oh ya

I'm trying to think of a way to give a nudge without a spoiler. Have you enumerated what things the user you've got is able to do?

[dim hound]

I am working on the following module: https://academy.hackthebox.com/module/20/section/134. I identified the hash; ||Drupal 7|| but the answer is wrong?

[frail thicket]

Someone knows how to report issue with the target server in a module?
Module: Windows Privilege Escalation
Section: SeImpersonate and SeAssignPrimaryToken
The question ask to execute priv escalation but the user does not have SeImpersonate privilege.

[sly tapir]

check out #858470491676737536

[candid zephyr]

Just reset the box? Tho I'm sure it's fine I did it recently.

[frail thicket]

I reset the box 2 times already, disconnected from the VPN, connected again, spun-up the box again. Same issue.

I connected to the box using "htb-student" and ran cmd as sql_dev. But the user does not have the tokens privileges.

[graceful rampart]

iirc thats not an issue. If you remember in the module, it said youll only see the SeImpersonate privilege when you do whoami /priv if your process is running as an administrator

Also, someone call me stupdi but where exactly is the vrowser in the shells and payloads skills assement vm? I could very well just be blind but I dont see any bropwsers installed

Am i just dumb?

[frail thicket]

I don't think so @graceful rampart . From my understanding, the token should be listed as disabled when the user has the token privilege.

[graceful rampart]

If you arent running in a high integrity shell there are certain privileges you wont see even if theyre already enabled

SeImpersonate is one of them

iirc you get GUI access for that one right? Just run cmd or powershell as administrator

it should be there

[frail thicket]

No, I didn't. The sql_dev account is not in the Remote Desktop group, this is the first issue with the box.

[graceful rampart]

ohhh, right. I just looked back at my notes sorry

[frail thicket]

As workaround, I connected using htb-student and then executed cmd as sql_dev user.

[graceful rampart]

well thats youre issue likely lol

iirc youre supposed to connect usiong mssqlclient like they do in the example

you can pretty much just copy commands directly from the example for most of it

[frail thicket]

but I don't see the tokens and I also tried to execute JuicyPotato, RoguePotato and PrintSpoofer.exe - non of them worked

[graceful rampart]

Can you show me the output when you run whoami /priv?

[frail thicket]

humm ok, I didn't try to get access through mysqlclient... I thought we had to RDP to the server

thanks for the tip, let me try that

[graceful rampart]

mssqlclient not mysql

big difference

but yea, just follow what they do in the example

[outer ledge]

Anyone nudge for:
FILE UPLOAD ATTACKS
Module: Type Filter
Thnx in advance! I had it but since my pwnbox died I can not recreate the thing without failing..

[frail thicket]

worked fine man! Thank you!
what a shame for me! Sorry to waste your time with that!

[graceful rampart]

all good

[swift forge]

Anyone able to help with the SID question on the Window's Security lesson?

[graceful rampart]

Someone please tell me i dont have to use this god awful browser

ok, so I can run firefox from the commandline, but not from anywhere else on the system

fml

[swift forge]

How can I check which 3rd party security app is disabled at startup?

[outer ledge]

Anyone nudge for:
FILE UPLOAD ATTACKS
Module: Type Filter
Thnx in advance! I had it but since my pwnbox died I can not recreate the thing without failing.. Thnx in advance

[limpid maple]

Oussama Ben Laden is the goat

[swift forge]

Anyone available to help? I used Get-MpComputerStatus but everything appears to be enabled

[candid zephyr]

I have this in my general notes but I've never done the moduel you're doing Get-CimInstance -Namespace root/SecurityCenter2 -Classname AntiVirusProduct

[swift forge]

Only thing it's showing is Windows Defender

[candid zephyr]

Oh idk. I've not done th emodule. 3rd party implies not defender.

[swift forge]

Is there any way I can look up help or get in contact with someone that could help? Been getting stuck numerous times and ability to get help appears to be limited

[candid zephyr]

If you're getting stuck a lot then you need to spend more time parsing the information / taking notes to be honest. the answers are generally in the text above. There's here and the forum but nothing in the questions hasn't been answered in the section already.

[outer ledge]

I have to say the Academy pwnboxes are not stable as well. Still figuring out why my command worked before and now it does not..

[candid zephyr]

i don't understand the pwnbox. they run like shit for me - surely a vm will be better performance for anyone?

or even boot kali off a usb

[outer ledge]

Ya true but sometimes its just easier to do stuff on my dual screen setup from browser

but ya still, you pay for it.. why isnt it just stable..

Also target resetting is more like reset 8x before the target works again

[fathom pendant]

Sometimes they're buggy

Also if you're having issues with targets sometimes you need to refresh your VPN/VPN key

[outer ledge]

heh?

pwnbox is not using vpn

[fathom pendant]

It is

Just in the background

[outer ledge]

no as you just use a browser

I am using both pwnbox does not require you to set up vpn

[fathom pendant]

You don't need to set up VPN... Because it's already on it

[outer ledge]

pwnbox is casting a VM from HTB to your browser

VPN is only for your own attack box to connect to htb servers what are you talking about?

[outer ledge]

open the htb site, top right is your connection through vpn. Now disconnect your attack box vpn and start pwnbox, that status box will stay red and disconnected

[naive aspen]

Looking some help for the Pivoting, Tunneling, and Port Forwarding skills assessment. I'm on the 2nd box but when I try to do a reverse port forward from the 2nd box to my attack host via the 1st box, I can't get a connection. I've tried all the options outlined in the module. Breaking it down to see where it's not working, I started a python web server on my attacker box and used a ssh -R tunnel to the 1st pivot box but it's opening the listener on it on 127.0.0.1 so it won't accept connections. The I've tried a MSF reverse tunnel and I can see the port listening on the 1st pivot box on 0.0.0.0, and when I try to make a connection from the 2nd pivot box it establishes with the 1st pivot but the connection doesn't get established from the 1st box to my attack machine. Any ideas?

[graceful rampart]

yes thats cuz the pwnbox has its own vpn connection

[outer ledge]

Hahahaha oki so how do I reset the vpn of pwnbox?

[fathom pendant]

^

Switch the VPN server

[outer ledge]

oki nvrmnd

talking to a wall here

[graceful rampart]

Bro, Ive done 4 modules in the past day and a half. If I continue at this pace ill be done with CPTS by the end of next week 😆

[graceful rampart]

lol hes just trying to help you. Considering you asked for help theres no need to be rude about it

[outer ledge]

congratz

[outer ledge]

I am just saying

What you are showing is for your personal computer vpn connection

Has nothing to do with the pwnbox

[fathom pendant]

Brother

Read the text

Warning: Each time you "Switch", your connection keys are regenerated and you must re-download your VPN connection file.

All VM instances associated with the old VPN Server will be terminated when switching to a new VPN server.
Existing PwnBox instances will automatically switch to the new VPN server.

[graceful rampart]

Yes. You download that file and use it to connect. But when you switch servers, the config is changed. This forces the pwnbox to reset its connection to the vpn

[outer ledge]

I understand that I need it for my own comp to connect to academy vpn

Pwn box generates a attack vm for me to attack on plus the module requires me to click another thing to spwan a target

[fathom pendant]

Ok

[outer ledge]

spawn*

[fathom pendant]

Let's break this down

[outer ledge]

Everytime I Start an instance a new VM will be generated

PWNbox generates a new instance VM every time I click Start Instance. Connected to their servers yes but not through my openvpn file

nvrmnd, I dont want to discuss I want to progress

All is good

[pastel ginkgo]

Was anyone able to get the Eyewitness.py to work in the Attacking Common Applications Module?

it just spits out a massive error for me

[outer ledge]

whats the error?

[pastel ginkgo]

its massive but it looks to be an issue with firefox

[outer ledge]

can you dm me the error

[pastel ginkgo]

I ran an apt update / upgrade but nada

[fathom pendant]

It still connects through the VPN tunnel, that's how it's able to actually connect to the local labs, because the actual local test labs are on an internal network, not connected to the outside world. The VPN tunnel connects us to an interim access point which we use to explore those labs/modules... So yes the VPN is the exact same. The only difference is, the VPN is connected in the background on pwnbox instead of manually on your own system/VM... There is no way to access the (non public) IPs without the VPN so changing servers resets and refreshes that connection

While it generates a new instance it's still using the same VPN key

[outer ledge]

Oki you win

Thank you for all the effort

Didnt wanna keep you from your projects srry for wasting your time

[fathom pendant]

Phone support job so I got time. not on my personal system ATM to assist with directly doing anything. But yeah if you are having difficulties with a specific module: best practices:
Be specific with your ask:
Provide screenshots:
If it's going to be a spoiler try to avoid it:
Ask yourself what you do know about the attack you are performing, what did the module teach you so far

Sometimes the answer is in plain text in the module

Aka the steps they show you are EXACTLY what they want you to do :)

Also with pwnbox I recommend opening it up in Fullscreen instead of the tiny window they give you

[outer ledge]

Nah my frustration is that I had the script reflecting what I needed then pwnbox died, so all my work gone. I have my notes so I retried from my own attack box but now the same comman does not worj

Supeerrrr annoying

[fathom pendant]

What module are you on?

[outer ledge]

FILE UPLOAD ATTACKS: Type Filters

The rest Ive completed

just that one before i can do skill assessment

[fathom pendant]

Sometimes the error you get can help determine if you need to regen your VPN key

I've had it where I copied the attack onto pwnbox and it worked so I just redownload my ovpn key

[outer ledge]

Oki ill try tomorrow

Thank you tho

[fathom pendant]

I wish you luck !

[twin gulch]

Anyone online for a question at skill assessment at password attacks?

[fathom pendant]

Sorry haven't done that one

[dim hound]

can I pm you regarding that matter?

[warm sail]

if i have a password encoded as a hash, what tool would i use to crack it?

[rustic sage]

John the Ripper or Hashcat

[rustic sage]

dm

[warm sail]

thanks, i'll try it

[rustic sage]

I'm on a budget recently and have to get rid of Pwnbox... is VirtualBox working for macOS again? I have an M1 chip

I'd also kinda like to have a VM again instead of doing everything in the browser

[proud pine]

You should not use a pentest distro as a daily driver.

[rustic sage]

anyone use macOS what do you do?

I want to use macOS as my main OS

and have VMs

[proud pine]

What's the problem you're running into with virtualbox?

[sly tapir]

is parrot as mainOS better than Kali?

[rustic sage]

I was told it doesn't work on M1 macs

or apple silicon in general

[rustic sage]

does it work on M1 macs?

people always said it didn't work

thats is why I've been using Pwnbox

[proud pine]

I don't know much about mac. Is it ARM or something?

[rustic sage]

it says it mainly uses the ARM architecture yeah

Apple silicon is a series of system on a chip (SoC) and system in a package (SiP) processors designed by Apple Inc., mainly using the ARM architecture.

[rustic sage]

https://www.macworld.com/article/668848/best-virtual-machine-software-for-mac-2022.html

Checkout VMware fusions or parallels @rustic sage

Pwnbox sucks it should be called painbox cuz it b a pita

[proud pine]

Ah yeah, pretty sure virtualbox would not work. I don't know if there's any other alternative that can run an x86 VM.

[rustic sage]

If you need license code just search for them online

VMware Fusion doesn't currently support M1 macs @rustic sage

[proud pine]

Doesn't kali have an ARM version, though?

[rustic sage]

What about parallels

haven't heard too much about Parallels I'll do some research

[rustic sage]

https://www.kali.org/get-kali/#kali-arm

[pastel ginkgo]

On the Attacking Common Apps - Worpress enum, where in the hell is this mysterious 3rd plugin. Everything ive found isnt the answer and ive found a few plugins.

[rustic sage]

Parallels looks interesting! I'll try that thanks @rustic sage

No problem

[fathom pendant]

VBox is fine

[rustic sage]

VirtualBox works for Mac M1?!

[onyx rapids]

Can someone explain the "Passwd, Shadow & Opasswd" objective? I SSH in with the username and password from the previous section and then I'm assuming I've got to do something with /etc/shadow. The probablem is that I have no access to this file at all

[rustic sage]

Have u tried ca /etc/passwd

Cat*

[fathom pendant]

https://osxdaily.com/2022/10/22/you-can-now-run-virtualbox-on-apple-silicon-m1-m2/#:~:text=Mac VirtualBox users will be,including the M1 and M2. Looks like it's a preview/test build available

[rustic sage]

I believe passwd is accessible by all users as it’s needed for certain things

[onyx rapids]

Yup, I can see the /etc/passwd

[rustic sage]

So typically you’d take a list of all those users and use that data for password attacks. Shadow contains password hashes and is protected

In general

I wish I could help more but can’t acces htb or my notes atm

[rustic sage]

The list I’m referring to is from passwd

[onyx rapids]

Apparently from doing searches, I see people can access the shadow file, but I don't understand how

[rustic sage]

Need to elevate permissions.

Or change permissions on shadow but that typically requires elevated perms anyways

So u need to get access to a higher user or one with proper permissions. The passwd file can help you do that

To access shadow all you’d do is cat /etc/shadow with right user/perms

[onyx rapids]

Yup, that's the strange thing, everyone who seems to have solved it, just goes straight for the shadow hash and cracks it

[rustic sage]

Copy the entire question you’re trying to solve into here

Do a ls -lah on shadow

[onyx rapids]

-rw-r----- 1 root shadow 1.7K Feb 9 2022 /etc/shadow

" Examine the target using the credentials from the user Will and find out the password of the "root" user. Then, submit the password as the answer"

[rustic sage]

Hmm looks like users can read the file try audio

sudo cat /etc/shadow

Actually I think it shows people in group shadow can read it my b

[onyx rapids]

Will isn't in the sudoers file

[rustic sage]

Try doing sudo -l and see if you can run any programs with no password

[onyx rapids]

Sorry, user will may not run sudo on nix01.

nervermind I found a hidden folder in will's homedirectory called backups with the shadow file in there

[rustic sage]

Nice there ya go always enumerate dies

[vital adder]

for that you'll need to find Passwd, Shadow & ( not Opasswd) backup file and crack those file

[onyx rapids]

HTB is just evil

[rustic sage]

Lol

It’s truuu

[vital adder]

@rustic sage oh wait you got a mac?

[rustic sage]

No it was just something to check out

[onyx rapids]

It's kind of a dumb because in the module they teach you about how sometimes the shadow file and passwd file can have these little flaws, but then they throw you a curveball and say "We're going to do absolutely nothing of what we just taught you"

[rustic sage]

The vm software I mean

[rustic sage]

I can’t stand when they do that luckily it’s only about 10-15% of labs

[onyx rapids]

Yes, I agree. Thankfully this community here exists because I would have gone crazy if not

[rustic sage]

Been there don’t dat didn’t get a tshirt haha

[tepid thicket]

Can anyone give me a nudge on Windows Privilege Escalation Miscellaneous Techniques? I have shell as nt authority/system, cracked a couple hashes, found a password from lsass dump, and found an additional password using lazagne.exe but none of these are the expected answer. It is asking for cleartext credentials for an "account" but doesn't specify which account ... 😤

[vital adder]

i got 0 note on how to get the answer for some reason all i got in my note is ||Get-LocalUser||

[iron basin]

Anyone mind helping on the web proxies module? It is the Web Proxies - Repeating Requests section. It says to use the repeat function to find the other flag. I use this function and pass the commands however I cannot find the flag due to inability to traverse directories(hint says its in another directory). Do I need to privesc in order to accomplish this? (Solved) Use the find command to help out, not sure why I wasn't allowed to cd out of the directory however.

[hazy grotto]

Anybody ever have issues with my VM not allowing you to change the display resolution anymore? Also can't enable my second monitor anymore.

[solid wedge]

Hey DM me I think I might know the issue with the second monitor

[iron basin]

Anyone familiar with proxychains? Having some issues with it on Web Proxies module - Proxy tools. Not able to run commands with proxychain

[pastel ginkgo]

So how do you pip install a module for python 2.7 if you have python 3 and 2.7 installed

because I already have it installed for python3 sooo pip install click says its good lol

but when I try and run this 2.7 script it wants click x)

[vital adder]

you can use pip --version to see which version your pip is using by default pip will using python2.7 but in kali it used python3

or if you need to install something from pip but you nee python2.7 you can use pip2 and if that isn't installed you can install it manually

@pastel ginkgo also can i dm you about the AD Enumeration & Attacks module?

[pastel ginkgo]

sure

[fresh reef]

Im currently on the Passwd, Shadow & Opasswd, Ive retrieved the hashes and am now solo cracking the root hash per the Question... May I PM someone for a Sanity Check?

[vital adder]

to use proxychains you'll need to have a proxy server running some like metasploit socks server and you have to set the port / ip to the proxy server in proxychains config file also i recommend proxychains4

[vital adder]

sure shoot me a dm

[fresh reef]

Thankyou~

[hazy grotto]

Is there a HTB rep that can help me with an issue? I was told that if you submit a question wrong 3x. you can ask help from HTB. I do not get this pop up.

[pastel ginkgo]

Thats only if you have the annual sub

& its also xmass soooo support is limited

[hazy grotto]

I have silver annual

I'm a HTB faithful servant. I pay homage.

Finally made it to 40 percent of the pentest path. uffda. Started this journey knowing nothing and never using linux. Been a stressful trip but i've learned alot. Thanks to all the heros in here that help the inferior out.

[strange stone]

alguem br?

need help

[fathom pendant]

What do you need help with brother?

[pastel ginkgo]

Wait till you hit the AD module I call it the Mid term lol

[rustic sage]

ngl I thought everyone said CleanMyMac was a scam😂 (only posting here because of the macOS Fundamentals module)

[thorn urchin]

It is, do they seriously have it in the fundementals module??

I literally get paid in my day job to remove that shit

I did it today in fact

[rustic sage]

yes they recommended it in the "Security Tips" section, CleanMyMac is an excellent tool for any macOS user.

also recommended Objective See's products, which I've never heard anything about so I'm looking into these at the moment

I need a bit of help on the third question in info gathering web edition subdomain enumeration
so i ran a dig command on the server and i found two zones
||a.root-servers.net. nstld.verisign-grs.com.||
and i ran a dig command on ||a.root-servers.net.||to read the txt record but i cant
how do i find its txt record

[rustic sage]

Wow even as a daily macOS users I still learned some things from macOS Fundamentals. Highly recommended, especially if you want to learn more about the security & privacy benefits that come with Mac and Apple devices in general.

Really only compliant is the suggestion to install CleanMyMac😂 Don't install this... Rather take the time to learn the security & privacy settings you can set, don't install sketchy software, and don't go to sketchy sights. If you do you'll be okay👌

[ripe terrace]

Out of curiosity, what exactly is wrong with CleanMyMac?

[fathom pendant]

Speaking of things: don't download CCleaner - https://techxplore.com/news/2020-08-windows-thumbs-ccleaner.html

[rustic sage]

let me start by saying I’m not one of those “Macs never get viruses” people…

macOS is very secure in the sense apps only do what you give them explicit permissions to do. Meaning if you configure them properly you’re fine. Yes there are some 0 days and macOS vulnerabilities that bypass these security features, but the chance you encounter one is very rare.

If you properly configure the settings, update the system, update your applications, and remove outdated/unused applications, AVs and auto cleaners are a waste. If you download safe apps and go to safe sites you really don’t need them.

you will also find very few people vouch for CleanMyMac and a lot of people against it. I’ve never personally used CleanMyMac, but the majority of people saying don’t use it turned me away.

[rustic sage]

Maybe these are not the zones 🙂 I was also struggling and still don't know how to tell there were two zones.
Can I DM someone to not spoil anything here?

[brisk geode]

https://academy.hackthebox.com/module/80/section/767

here they mentioned small username list im using the /opt/useful/SecLists/Usernames/top-usernames-shortlists.txt

seems like the wordlist isnt working

[brisk geode]

lol

[fathom pendant]

Is there a username list that is provided in the Resources button? @brisk geode ? The Footprinting Module I'm doing has a Footprinting-Wordlist that I have yet to use but there may be a resource that you needed to add if it's something you don't have yet?

[brisk geode]

none of these are wordlist

[brisk geode]

this one is one of the worst modules i ever did

less informative

[magic valve]

Hey everyone! May I message someone for some further assistance regarding AD Enumeration & Attacks Skills Assessment Part 1 question 4. I have attempted to login via evil-winrm with the credentials from previous questions and doesn’t work. I’m lost on what to do and wondering if I am on the right track.

[latent sage]

hello @thorn urchin can you please check your DM ?

[thorn urchin]

checked, I see nothing

also like brushing my teeth n shit before bed so

[latent sage]

sorry if i messaged at a wrong time 😅

so can you please check again !

[shadow owl]

What is the hardest module you came across?🤔

[rustic sage]

PM me as well if you`re stuck!

[fathom pendant]

Not sure yet but I'm divinginto this rabbit hole; a command that I'm given is using specific numbers and format arguments so I'm researching what those do since they aren't really touched on we're just given the command and told "hey this is a brute force" @shadow owl

But I wanna know WHY/How it's a brute force

[rustic sage]

Good morning from Spain! Anyone working with the password attacks medium lab?!?!

[rustic sage]

Password Attacks... no doubt!!!

[vital adder]

hello from wakanda, shoot me a dm

[rustic sage]

Thanks man!

[fathom pendant]

Hey tom! I'm doing the smb and the basic code they have to iterate to find users and groups is pretty cool :D! I had to use uncle google to find out why the specific range but hey it's a thing. And I learned how to grab the flag without fully connecting to the server too :D I knew how to get in and pull the flag from last night.... but I forgot to actually pull it LOL

[vital adder]

the password attacks module?

[fathom pendant]

Footprints module

:) still in the baby steps

I figured they'll elaborate on the code but they also said "here's some other automated codes as well LOL

[vital adder]

yea i think i do that section manually or something because i got like 0 note on any given code

also for the flag if you are too lazy to download and cat the flag when you access the share with smbclient you can use more flag.txt to just view flag

[fathom pendant]

LOL yeah i've done that a bit too in other modules where you pull files forgetting i could you know get the file

[shadow owl]

@rustic sage Thanks for the tip

[fathom pendant]

@vital adder printf() is a neat command :)

[rich vale]

just got to the skills assessment for the AD module and... it feels kind of janky

i mean its early, but specifically the web shell you start with

[candid zephyr]

What about it?

PowerShell webshells are a thing.

The only trip up is it assumes a basic level of competency in general.

[rich vale]

I guess it just feels weird and kind of unstable, after the module focused more on starting from an attack host or one configured for loading necessary tools

[candid zephyr]

I haven't done the CPTS path etc but I can only assume the AD one comes after a bunch of other modules.

If your first ever experience with offensive security was this AD module you'd hit a wall fast in the assessment.

If you've ever done a CTF box etc then it's somewhat of a trivial step.

[rich vale]

sure, its not that I can't get beyond it, more of a comment on that it feels a bit out of step with the rest of the module

the module is pretty focused, dense and solid, then you get to the skills assessment is a janky webshell that you can't tell if its working or not

[candid zephyr]

Sure, but you can get out of the webshell with one quick command. The module already taught you how to do this.

Imo the danger with the modules is they make you lazy. SSH into a box with all the tools and privs ready to go - I can only assume the rest of the modules teach you the basics of work flow in general, moving tools about etc.

The AD module kinda assumes a level of knowledge is what I mean, it's teaching you to do AD specific things - not to hack.

The assessment is you using them in an "actual" environment.

I don't think it's "janky" but I do agree it's a significant leap from what you've done in the sections. That's why I can only assume it's meant to be taken as part of a course.

[outer ledge]

Anyone nudge for:
FILE UPLOAD ATTACKS
Module: Type Filter
Thank you in advance!

[fathom pendant]

Not sure what I'm missing for this in the smb module I don't even really know what this is supposed to mean tbh

[kind turret]

You connected with the rpcclient already right?

[fathom pendant]

yes lol

[kind turret]

Then use netsharegetinfo

[fathom pendant]

DMing you my followup question in a moment had to reset my virtualbox it had been running for a bit

[fathom pendant]

I'm thinking if recording myself doing these blind then record them at a later date once I know what I'm doing just to see progress

[kind turret]

@rustic sage OR @tropic pollen If you are the author of this post (https://forum.hackthebox.com/t/pivoting-tunneling-and-port-forwarding-socks5-tunneling-with-chisel/269338) please DM me and I will help you out with this problem. You need to build the binary from source then transfer it the pivot host doesn't need to be updated.

[vital adder]

hi guys, need a nudge for the last part of AD Enumeration & Attacks - Skills Assessment Part II i already got the cred for question 9-10

[candid zephyr]

The very last question?

[vital adder]

the last 2 so yes

[candid zephyr]

Send a DM

[vital adder]

sure thanks