modules

[rustic sage]

The subscription isn't super needed, but i go with silver so I can do all of the modules in good time

[fathom pendant]

I didn't buy the sub, I just flat out bought the cubes still worth it

¯_(ツ)_/¯

[ripe badge]

Yeah, this works also best for me. 200 cubes more than enough for 30 days

[rustic sage]

yeah, it's different for everyone

i have no life so

: D

[vital adder]

so i was only able to found a fix for the perl version of this tool so first run sudo apt-get install libcompress-raw-lzma-perl -y and use the perl version of 7z2john at /usr/share/john/7z2john.pl

[rustic sage]

parfait

merci

Can I DM @vital adder ?

[vital adder]

sure

[ripe badge]

You don't need that. For the win SCP, just turn logs on and mark the checkbox to log credentials, than start the connection and you are good to go

[rustic sage]

Hi everybody. I am doing "Public exploits" in the "Getting started" module. I nmaped IP and I got 2 open ports, 1 with apache 2.4.41 running on it. And second with Node.js. Where I am supposed to search for exploit. In "searchsploit" or "msfconsole"? I tried both and didn't find anything for apache 2.4.41 nor Node.js (Node.js is broad thing to search)?

[fathom pendant]

Well, what is Apache?

[rustic sage]

server?

[fathom pendant]

More importantly what type of server?

[rustic sage]

web server

[fathom pendant]

Mhm so maybe there's more to explore

[rustic sage]

it says Apache httpd 2.4.41 ((Ubuntu))

[rustic sage]

okay, Ill try

[fathom pendant]

Sometimes you need more than the terminal

What has the module shown you, so far

[rustic sage]

Google 😄

[fathom pendant]

Don't need google really

If it's a web server what other way can you see that IP?

[rustic sage]

One more question, if CVE says that it has impact on 2.4-2.4.51 does that mean it includes 2.4.41 also?

[rustic sage]

pf, idk to be honest

[fathom pendant]

What is port 80?

[rustic sage]

Oh

I opened it on Firefox

Simple Backup Plugin 2.7.10 for WordPress

[fathom pendant]

Have fun from there

[rustic sage]

Thank you mate a lot! 😄

[fathom pendant]

Also if you're doing the msfconsole don't forget to Show Options so you can see what you need to set

just look and see what can be done :)

[rustic sage]

Sorry for bothering. By using Wordpress Simple Backup Plugin exploit, I found these:

root0:0:root:/root:/bin/bash
daemon1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin2:2:bin:/bin:/usr/sbin/nologin
sys3:3:sys:/dev:/usr/sbin/nologin
sync4:65534:sync:/bin:/bin/sync
games5:60:games:/usr/games:/usr/sbin/nologin
man6:12/var/cache/man:/usr/sbin/nologin
lp7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail8:8:mail:/var/mail:/usr/sbin/nologin
news9:9:news:/var/spool/news:/usr/sbin/nologin
uucp10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy13:13:proxy:/bin:/usr/sbin/nologin
www-data33:33:www-data:/var/www:/usr/sbin/nologin
backup34:34:backup:/var/backups:/usr/sbin/nologin
list38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt100:65534::/nonexistent:/usr/sbin/nologin
mysql101:102:MySQL Server,,,:/nonexistent:/bin/false
systemd-timesync102:103:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network103:105:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve104:106:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus105:107::/nonexistent:/usr/sbin/nologin
sshd106:65534::/run/sshd:/usr/sbin/nologin

I am not sure what I could do with these?

[fathom pendant]

DM me

[cosmic crest]

hey guys, I have a question about a module, is any1 here able to answer this? : on Linux fundamentals module - working with web services.

Why is the document saying about curl tool, wget, if the question is actually how to start a http web server on 8080, but the lecture is not teaching you to do that or mentioning the command

[woeful ermine]

It worked thanks

[stuck hull]

Hi, I'm struggling with Footprinting (medium). I have found the sa credentials but it will not work for the SQL server. I've tried sa, admin and administrator for the the "login" field.

[round vortex]

Which box is that ?

[stuck hull]

It's the Footprinting (medium) Lab.

[proud pine]

Are you passing the password via command line flags?

[stuck hull]

No. I'm using Remmina to access the windows machine of Alex and then using the GUI Microsoft SQL studio thing, which is where I cannot log in

[dim hound]

Enumerate the ||accounts|| database

[cosmic crest]

up

sorry if I'm asking stupid Q, i'm new here

[fathom pendant]

Did the module talk about starting a web server?

[cosmic crest]

In the fisrt paragraph yes. Working with web services it's called.

is the module kind of trying to make you search for an information that they have not provided to actually make you grow the skill of searching the information on the web? or is something else that I am not paying attention to?

[fathom pendant]

The module should tell you what you need to know; it might not be in that same page sometimes but it's usually within the module

[stuck hull]

Thank you. I think I might be missing something, how would I enumerate the accounts database without being able to access the SQL service?

[cosmic crest]

thank you!

[fathom pendant]

Hint: you may need to look up the service they are referring to; found the answer within a few seconds - I can dm you the page that specifically talks about how to use it

[cosmic crest]

just dm you

[fathom pendant]

also curl and wget is for retrieving info from a site

[waxen barn]

For the AD Domain Trusts - Child -> Parent Trusts - from Linux module: How do I get the NT Hash for bross?

[fathom pendant]

huh,,,
not sure where to go from here

Only got this issue in pwnbox

[graceful rampart]

You can. Think about some of the ways you can use a password

What if someone shared it.... or it's reused from somewhere else..

[fathom pendant]

Reset my VPN, seems to be working now

[pastel gale]

how relevant is the job role path of htb wrt OSCP?

[candid zephyr]

There's a list of HTB boxes similar to OSCP. @lament tartan did a video just recently where he implies CPTS is harder.

[stuck hull]

"every windows box has an administrator account" haha! Thank you

[candid zephyr]

Or at least that's what I take from it. I don't mean to put words in their mouth.

https://youtu.be/UN5fTQtlKCc

[graceful rampart]

From what I've heard CPTS is harder than OSCP. There are some things like binary exploitation that OSCP has which CPTS does not but not anything major. The very big difference between the two is that OSCP feels very very ctf like where as CPTS is designed to feel like a realistic environment

[pastel gale]

what should be the order in your opinion i am an undergrad student currently doing the job role path as a foundation before purchasing oscp subscription or should i go for cpts

i am not working only studying

[graceful rampart]

Depends. They will both provide two very different things. CPTS will provide you with a very very solid knowledge base and if you really internalize everything you learn from it you'll pretty much be ready to start working in the field. OSCP on the other hand is very expensive, but the really big benifit is that it's basically an HR bypass. Once you have OSCP on your LinkedIn profile you'll have recruiters messaging you.

In my personal opinion I'd go for CPTS first and then OSCP. If you can pass CPTS then assuming you study the few things OSCP has that CPTS does not, you should be able to pass OSCP

But again, it all depends on what you can afford

[pastel gale]

Thanks for the opinion @graceful rampart

[graceful rampart]

Np

[fathom pendant]

I was about to give up on the ipmi module then I remembered that there's more than one way to rip a hash :D

[graceful rampart]

Lmao

Nice

[fathom pendant]

the module talks specifically about using hashcat but it kept erroring on me

[graceful rampart]

Oh I used hashcat when I did it. But I have hashcat installed on my main machine

It bugs out running in a vm

[fathom pendant]

ah

that's probably what it was then

because running it through the other, worked fine

[graceful rampart]

I also have a pretty powerful gpu that I use for cracking and my vm dosent have access to it

[fathom pendant]

checking if it happens in pwnbox

[graceful rampart]

Even if it does work I wouldn't reccomend doing your password cracking in a VM

Your host machine will almost always be faster if you have a half decent GPU

[fathom pendant]

fair

and since it's not connected to anything; no harm in having it installed

[stuck hull]

Could you not also pass through a GPU to a VM?

[graceful rampart]

You can but it can be finicky

Why bother?

Cracking hashes is done completely offline. Just copy paste hashes lol

[stuck hull]

Haha I think my OCD would just like everything in one place but I do see your point.

[graceful rampart]

A lot of people have an entirely separate rig for cracking

[stuck hull]

Like, their own hardware! That's pretty cool. I've heard people spin up a VPS with beefy GPU's

[graceful rampart]

Yea. People do that too

[proven marsh]

Hi, I'm looking for help to solve the "Mass IDOR Enumeration" section of the "webattack" module. Do you know where I can discuss this issue?

[thorn urchin]

Usually individuals that just need it for some moments go the VPS route, but any serious company will have their own dedicated rig just cause its more cost effective for the kind if volumes theyre doing.

[fathom pendant]

You can ask here you just need to include the issue you're facing. You'll generally be guided to the right answer.

[rough tendon]

hello i'm new to htb and don't have a clue how to code or anything i'm young but very interested and was wondering if anyone is able to point me in a good direction

[fathom pendant]

Any of the basics modules are a good place to start on the academy site, they teach you basics

[rough tendon]

thanks @fathom pendant i appreciate the advice

[fathom pendant]

It's always a good idea to start from the roots and go up then get to a module and not be sure how to proceed

[rough tendon]

im intrested in software programming and malware prevention any specific modules

[fathom pendant]

Depends on the coding language tbh

[rough tendon]

c++/html/linux

[fathom pendant]

You can search and see if there's modules that teach you how to break those, html and Linux are very... Broad

[rough tendon]

i found a module caled tier 0 im going to have a go with it and let the path pave itself

[full echo]

Hi all,
I need help with Password Attacks Module - Credentials Hunting in Linux in which:

• I got stuck with brute-forcing the Notes.zip using John. John does not seem to work.
  Thank you so much for your help!

[fathom pendant]

Did you unzip?

[full echo]

The zip file requires password.
I used zip2john to get the hash file and then execute: john —wordlist=mut_password.txt hashzip. But it doesn’t seem to work

[thorn urchin]

<@&861185840277487616>

[fallen osprey]

in "PASSWORDS ATTACKS: Pass the Ticket (PtT) from Linux" I got stuck with this question (see my screenshot). I used smbclient to download the flag.txt file and read the content of it with cat command. But when I try enter it as a answer it said: Incorret Answer. Anyone have a hint or clue ?

[west rampart]

thanks

[fallen osprey]

@thorn urchin can I send you a DM ?

[thorn urchin]

not today, Im still doing Christmas

[fallen osprey]

okey

[rustic sage]

Hey all I.am starting classes covering everything in the course for FREE. NOT giving away answers but will explain what you need to know to be successful. They’ll start around the 15th Jan if interested dm me. Once we get started I won’t be able to take on more people so if you’re interested Nows the time to dm me. Happy hacking and holidays 🙂

[thorn urchin]

Or people can just ask for help like normal

[wheat garden]

what course?

[rustic sage]

I have began the password attacks module, what are the recommend files to use for users and passwords lists.

[proud pine]

There are some options for usernames in /opt/useful/SecLists/Usernames/, but it really depends on the situation there. For a lot of boxes/CTF stuff, rockyou.txt is usually what is used if it's 'supposed' to be brute-forced. Many of the academy modules will provide you specific user/pass lists, for the purpose of the module.

[rustic sage]

Did not realize the resources existed got it thanks.

[eternal vale]

Network Enumeration with Nmap - Firewall and IDS/IPS Evasion - Medium Lab - having some trouble with this if anyone is available. I feel like I've tried just most of the things listed in the the lessons and still getting filtered for DNS and no further info

[hasty scaffold]

Any suggestions on where to learn rootkit and bootkit malware coding

[wheat garden]

books. amazon got lots of good books on the subject. Though its actually a very advanced topic. Mastery of C, C++, and C# languages and operating systems programming will be needed

[hasty scaffold]

thanks for the info, im on amazon right now and they do have lots of books, i also looked through pdfdrive and found lots of pdfs on it. It is pretty advanced stuff its all in the kernal from the things i have learned so far

[rustic sage]

I need guidance on the Network Services section of the Password Attacks modules, I have completed SSH and WinRM. I have credentials for smb and rdp, but I am unable to connect to rdp, and I am getting an access denied error which does not allow me to check the contents of the smb share.

[wheat garden]

might try again but use the pwn box. Think networking isssues between your own vm and lab can interefere

[eternal vale]

ok, let me try that

[forest tapir]

sometimes it happens, yeah

happens on TryHackMe as well

[rustic sage]

Would you be able to take a look at my problem?

[proud pine]

Sure, DM me.

[wheat garden]

you can interact with smb using smbclient tool

[rustic sage]

I have, it's giving me an access denied error even though I'm enumerating the share.

I'm genuinely unsure why I'm receiving this error.

[fallen bobcat]

Hack

[wheat garden]

sounds like your not using the right credentials

you can dm me too if you want aobut that

[eternal vale]

same kind of errors on pwnbox if anyone is able to take a look to see if I'm on the right track

[wheat garden]

might want to try turning on the -v verbose switch or even -vv on while scanning. Think the flag you need could pop up in the enhanced log output.

[forest tapir]

try -d 3 with smbclient as well to find a reason for the failure

[rustic sage]

Solution solved, thanks for help.

[forest tapir]

I'm getting mixed up who's asking what, my bad

[eternal vale]

Can I dm screenshots?

[forest tapir]

i remember one of the nmap assessments needing to grab the version using a different tool: hint

[wheat garden]

ya been a while since ive done that module and my note taking game at that time was non existent. Trying to remember just off the top of my head how I did that

[forest tapir]

but i don't remember everything

[eternal vale]

oh so it could potentially need to be a totally separate tool outside of nmap?

I imagine I could find a metasploit module or something

[forest tapir]

you could use nmap but the reason it's not working is very meta/ not intuitive

[forest tapir]

no

it's a lot more basic then that

it's literally one sentence in the entire module.

and it alluded me for months because they never strongly touch on it

I don't remember which one it was So don't rely on what I'm saying

I don't even know why I'm mentioning it. I don't fully remember

[wheat garden]

-sA ack scans also have better chance of getting through firewalls too

can also try spoofing the i.p to being one internal to the firewall with an ack scan

[forest tapir]

they don't strongly teach about timeouts, or why they're used

[eternal vale]

But when I spoof to an IP in the same range and point to the tunnel is says it doesn't have a route. I add the route, no change

[wheat garden]

hmm not sure actually trying the lab now again myself

[eternal vale]

nvm I got it

thanks everyone

[wheat garden]

I got it too can you dm your command? going to write it down this time

[fathom pendant]

I could use a nudge in the Footprinting Medium Lab; having a hard time finding an entry point i believe some people were saying xfreerdp was being buggy is there another service that may be helpful in this case?

nevermind I didn't see the ports

[candid zephyr]

What time zone are you in? When do you sleep? 😂

[fathom pendant]

CST, I sleep whenever it happens LOL

[candid zephyr]

Hehe. You're flying through the modules.

[fathom pendant]

meh

some of the network stuff was self explanatory in this module (aside from being a pain

so some of my notes are light af

[fathom pendant]

Tfw right when I give up (system was being slow) I realized what I need to do next

[meager topaz]

i can`t login beef

please someone help me in this error

beef_over_wan_login_not_working

[feral stump]

hey guys happy christmas for everyone.

on the Shells & Payload module section Reverse Shell, have you guys tried to execute the || PowerShell command in Windows after rdp in order to set connection with nc in the attacking machine|| it is not working for me even if try with different ports

I mean in the end with the rdp connection ||you can run in cmd hostname and you get the flag but without settling|| the reverse shell which is what i want to do obviously

[pastel gale]

Module name: Password Attacks

Section name: Attacking lsass

#Question: Apply the concepts taught in this section to obtain the password to the Vendor user account on the target. Submit the clear-text password as the answer. (Format: Case sensitive)

PYPYKATZ is not working its crashes midway

[feral stump]

also when you ||rdp into the target machine you get the host-name|| if anyone can help would appreciate

thanks!

[pastel gale]

any help would be appreciated

[vital adder]

run the given powershell command on cmd 🤣

[vital adder]

use crackmapexec or metasploit with a nt authority system shell

[feral stump]

not in powershell oh gosh 😅

let me try

[earnest slate]

hey anyone would be able to help me recover my old gmails account i understand this is not a hacking service but my account got hack and it would mean a lot if i could get it back cause i had some family emails in there thats really personal sorry to bother

[feral stump]

excellent thanks a lot @vital adder

[candid zephyr]

Google support. Not this discord.

[earnest slate]

i understand i have tried but it doesn't work

[pastel gale]

so pypykat i snot working

?

[pastel gale]

i tried crackmap exec with local auth but its not wroking

[meager topaz]

beef-xss login not working on wide area WAN

can someone solve this problem

[dim hound]

Who else has the same issue?

[placid quest]

@dim hound why -debug

[dim hound]

Since I want to see, what is going wrong

[placid quest]

The server transfers data on ssl if mssqlclient had option -k to switch off ssl it would be ok

[vital adder]

try without the -windows-auth tag if that doesn't work just use sqsh

if you don't have that tool pre-install and can't install it from apt-get use

sudo bash -c 'echo "deb http://ftp.de.debian.org/debian buster main" >> /etc/apt/sources.list';sudo apt-get update;sudo apt-get install sqsh -y

[dim hound]

That doesn't work, I will try with sqsh

I have arch 😀 so that won't work haah

[vital adder]

oh yea i forgot about that

[proven marsh]

Thanks, Basically, I have made the following script that they suggest, modifying the ip and the documents route, but when I execute it, I do not get any results. I have also tried to do Fuzzing but I have not achieved anything.

[proven marsh]

#!/bin/bash

url="http://SERVER_IP:PORT"

for i in {1..10}; do
for link in $(curl -s "$url/documents.php?uid=$i" | grep -oP "/documents.*?.pdf"); do
wget -q $url/$link
done
done

[rough tendon]

hello i am wondering if linux fundamentals is a good starting course to learn the basics i have no previous knowledge of coding

[deep tendon]

What is the plugin ID of the highest criticality vulnerability for the Windows authenticated scan? I stuck here please help me

[devout cliff]

start with all the fundamental modules. coding is not necessarily a pre-req to understand most of the content.

[deep tendon]

What is the plugin ID of the highest criticality vulnerability for the Windows authenticated scan? I stuck here please help me

[graceful rampart]

I mean, it's not hard. If you actually read the module, you'd know. Start up the machine, connect to either nessus or openvas (whichever you're doing) and look at the windows authenticated scan

[deep tendon]

I have done it and I have filtered by family and by level of vulnerability but the IDs I put, are not

Okey fixed, I did a new scan and I detected another vulnerability that I had not detected before

[crisp remnant]

Anyone for a small question on Pivoting's final skill assessment ?

[fiery berry]

What's wrong? Sorry, I haven't followed the whole conversation but I have been able to solve it so could you recap your issue?

[lament tartan]

rule break??

[restive mist]

yh i think

[uneven rock]

Is there anywhere I can go for help on a subject?

[meager topaz]

how to free port forwading without ngrok & router

[restive mist]

8 too

[fair flax]

Hi

[meager topaz]

can someone tell me beef page not login in wan network

[high zinc]

wrong server my dude

[queen pewter]

Hello guys I’m trying to solve updown machine stuck at reverse shell… php isn’t accepting any revshell functions

[uneven rock]

Is there a contact board/ directory? I’m new to discord but it seems useless

[rustic sage]

Nice

[vital adder]

try asking that in #boxes if you can't access that channel use ++verify at #bot-commands

[vital adder]

sure shoot me a dm a if you still need help with that

[vital adder]

big hint the format of the actual target is different then the example there is no uid parameter you have to do some enum to find the right parameter and from there enum to find the flag

[devout cliff]

anyone done with the footprinting module that i can dm with a question?

[proven marsh]

I'm really a bit lost with this challenge, but further down in the chat @vital adder gives a good hint, I'll follow that hint, thanks a lot anyway

[fiery berry]

np

[proven marsh]

thank you! I think this is the key

[vital adder]

sure shoot me a dm if you still have question

[proven marsh]

Perfect, thank again

[woeful mural]

Anyone here working on AD Skills assessment 2?

[pearl island]

I have done that. Do you need help?

[woeful mural]

Ys a little nudge

[graceful rampart]

Well, look at that one line of code. What does it do?

var flag = "HTB{..." + "..." + "..." + "..." + "..." + "..." + "}";

This is the line of code with the flag in it. What does this line of code do?

Yea, so its concating a bunch of strings. So putting the strings all together would be deobfusctaing the code

[vital adder]

nope it will print out the flag (image removed)

[graceful rampart]

i havent done the module myself yet but thats what i would be doing

[graceful rampart]

ah. to be fair, i didnt read most of the code lol

Well you were saying that you can infer what the flag is. My point is that by doing that youre deobfuscating the code

[vital adder]

@rustic sage also for the love of god pls remove spoiler so all that have any thing to do with the flag

[graceful rampart]

The question is pretty clear

first off, stop posting the freaking flag

thats considered a spoiler

Well then clearly you havent fully deobfuscated the code then

or you dont understand what its doing

[forest tapir]

I can read it right now..

[graceful rampart]

Have you tried running the code 😅

whats the error?

[forest tapir]

HTB originated in England, did it not?

[graceful rampart]

Well i mean, its really very simple. They want you to retrieve the flag from the code.

The first one you tried isnt it but i can see 2 in the code

have you tried the other one?

[candid zephyr]

It seems pretty clear. The variable is obfuscated.

[graceful rampart]

What module is this?

give me a name lmao

numbers arent helpful

[candid zephyr]

What part about the sentence gives you trouble? The question seems pretty clear.

Maybe you're struggling because you don't understand the terms it's using.

[graceful rampart]

ive done this module. You need to do exactly what you think you need to do

[candid zephyr]

You know the format of a htb flag. Do you understand what "var" is?

Do you understand basic obfuscation ideas and yara rules?

[fathom pendant]

I just scrolled up... And... Yeah it's super obvious and I haven't done this

[graceful rampart]

none of that matters. He already deobfuscated everything

Its sitting right there

[candid zephyr]

So he understands the question.

[fathom pendant]

Reminds me I keep getting yaml not installed is it as simple as Sudo apt install yaml?

[candid zephyr]

I just don't understand what is so confusing about it.

[graceful rampart]

its very very clear

[thorn urchin]

Whats the exact sentence of the question?

[graceful rampart]

i dont understand what youre having trouble with

[candid zephyr]

What part confuses you about this?

[thorn urchin]

Whats hard yo understand about it

[fathom pendant]

There's nothing confusing about this sentence

[graceful rampart]

Thats exactly what it means

[candid zephyr]

The variable is the part after the equals sign.

[graceful rampart]

thats not true lol.

[candid zephyr]

Not specifically the item denoting a variable.

Jesus you are dunning kruger.

[fathom pendant]

What is the value of flag, once the code is run

Is what it is asking

[candid zephyr]

Because its obfuscated in the code

🤦‍♂️

[graceful rampart]

The issue here is that you dont understand how code works lol.

var flag = ("xxx" + "yyy")
does not store a variable "xxx" + "yyy"
It stores it as "xxxyyy"

[fathom pendant]

^

[graceful rampart]

and if you dont know that you can just run that line and slap a console.log at the end

I call bs

no way

[candid zephyr]

A js dev whose first language is English is not what you're portraying.

[forest tapir]

console log (flag)?

[fathom pendant]

Console.log(flag)

[graceful rampart]

If you came from a full-stack js background youd know right away to do this

[fathom pendant]

Just another day in htb 🙃

[graceful rampart]

lol yea. Im all for helping people but dont lie about your background

[candid zephyr]

ItS tHe WoRdInG

[graceful rampart]

just makes you look dumb

[thorn urchin]

I feel like youre confused just because the flag asked you to concatenate the various string parts.

[graceful rampart]

no. i dont know what the issue is cuz he said it right here

[thorn urchin]

Which if so, kinda weird thing to be confused about, but its the only thing I can guess from you literally posting the flag and still not getting it.

There is literally nothing wrong about how the question is worded

[graceful rampart]

bro theres nothing wrong with how its worded lmao

[candid zephyr]

Elon Musk is that you?

[graceful rampart]

like 5 peoiple got it instatntly

fullstack js developer my rear

[thorn urchin]

"use the information learned in the module to deobfuscate the flag" idk whats confusing about it.

[candid zephyr]

He's American. American is his first language. Dw.

[thorn urchin]

Whatever works, the question never said you had to use a specific technique

[graceful rampart]

this

this is litteraly all you need to do

[thorn urchin]

I mean fuck me too and I got it lol

[candid zephyr]

It's fine to not understand but just say that. Don't say it's badly written.

[fathom pendant]

^

[candid zephyr]

There are badly wirrten questions. This isn't one.

[fathom pendant]

It's written just fine

[graceful rampart]

This is one of the more well written questions lol

[candid zephyr]

How would you've worded it?

[thorn urchin]

How would you have worded it? literally everyone else here understood it.

[fathom pendant]

Lol I wonder what your idea of a well written question is

[graceful rampart]

so how would you have written it?

[candid zephyr]

What's ambiguous? The js dev who doesn't understand what variables are?

[thorn urchin]

Like I dont like dogpiling someone just for not knowing things and this server is really terrible when it comes to bullying randos but im genuinely flabbergasted by how you became confused by such a straightforward question

[fathom pendant]

What was ambiguous about the question?

[graceful rampart]

yea. I try really hard not to bully people but like...

This kinda just blew me away

[thorn urchin]

Atm Im trying to figure out if its just a bad attempt to save face from having a rando brain fart moment(which is totally fine and happens to us all for the record) and blaming the question instead of saying ooos or if there genuinely is some fascinating disconnect between what literally everyone else is able to understand without issue and this person.

[graceful rampart]

yea idk

[forest tapir]

sometimes their questions are very strangely worded

but I don't see it here

[fathom pendant]

Yes, this is not one

[graceful rampart]

agreed. This is not one of them

[thorn urchin]

Sometimes yes, which is why I asked for the specific question earlier, this is not one of em

[candid zephyr]

I think the confusion was that as a full stack js dev he was unable to output the variable.

[fathom pendant]

Like sometimes they are like "lol good luck nerd"

[thorn urchin]

If theres any criticism is that this question isnt as hand holdy as many questions are as it just says "use what youve learned" instead of saying a specific technique. but that wouldnt be a wording fault and some people prefer that.

[thorn urchin]

except he had the flag without needing to output it and was still confused somehow

[candid zephyr]

So he wa a looking at the code and didn't understand the "obfuscation"

[forest tapir]

what a landslide lol...

[fathom pendant]

Speaking of good luck nerd; I got stuck after getting the username from the share on footprinting medium 🙃 tackling that later to see what I missed

[candid zephyr]

Oh well. He got the answer.

[forest tapir]

I'm not making fun of anybody.

[thorn urchin]

Im trying not to. I would like to think the handful of people that Ive made acquaintances here, you included know that Im not the bully type when it comes to newbs

[candid zephyr]

You got to own your stupid moments. Cause it'll happen lots. You can't save face all the time

[forest tapir]

yeah. I would have just deleted the " and + and just submit the flag

[thorn urchin]

John Hammond makes dumb mistakes in his videos all the time and leaves em in

[forest tapir]

if I was that new

[fathom pendant]

Kek

[fathom pendant]

It's all part of the process, which is funny when he goofs it

[thorn urchin]

Yeah I did similar during the Halloween ctf. Oh I got enough of the flag that I can manually piece it together, screw taking extra time to do it "right".

[graceful rampart]

Making mistakes is how you learn. Im all for making a stupid mistake. The dumber the mistake the more chance youll never forget it.

[fathom pendant]

Yep

[graceful rampart]

Even better if someone calls me stupid for it. Cuz then i really wont forget it 😆

[forest tapir]

I am proven for overlooking very, very simple things.

for sometimes hours

[thorn urchin]

I got stuck on an assessment looking for a way to log into a particular mssql server and nothing worked, derped and forgot from my very first scan the port was just open and I could connect directly. it happens

[graceful rampart]

Ive spent hours on end doing a box, tearing my hair out cuz i misstyped a password and just assumed that wasnt the intended path when i couldnt log in

[forest tapir]

this+is+a+pretty+obvious+one

[graceful rampart]

lmao

yea

[forest tapir]

lol

[thorn urchin]

Or more recently I got stuck on an assessment trying to get a password for a service, resorted to bruteforcing and no dice. Hours spent, caved and looked up tips and no dice. Eventually turns out the password was in an earlier part of the assessment, I just got mislead by the question flow into thinking I was done with that part and I wasnt, even though it was something explicitly stated to check for in the sections and in my notes lol

[forest tapir]

"'1', not 'l'"

I think you were there when I fucked that one up

[thorn urchin]

maybe, sounds about right lol

All you did was make it more hand holdy

you dont have to output it in the console, thats just one way to do it

No it doesnt

The way it did already, where it leaves the choice up to you on how to you want to retrieve the final flag

Yours is just spoonfeeding a particular answer when there are multiple possible answers

[forest tapir]

i mean..

[thorn urchin]

Or manually piecing it together like you already did

It should be noted that the overarching goal of these modules is to also instill methodology and mindset over nitpicky specifics. The real world isnt going to guide you towards what you need to do, you have to figure it out. The modules complement this by often giving you multiple tools to solve a problem and encouraging you to device the solution from what works and what doesnt.

To that end, the question fits the spirit of the module and The Academy as a whole.

[forest tapir]

js deobf is a "hard" module isn't it?

I don't remember

[thorn urchin]

I thought it was rated "easy"

Again, nothing wrong with the questions, this is pretty clearly a you issue and ya need to adjust your paradigms if you want to fit in this world

[lethal schooner]

@thorn urchin are you talking about the password attacks module?

[thorn urchin]

no I mean this world as in the infosec and hacking world

[thorn urchin]

idk Ive alluded to like 5 different modules in the past hour

[lethal schooner]

@thorn urchin Well I can understand your frustration if you're talking about the pass attacks module

[forest tapir]

i swear that one is broken

in some parts

[thorn urchin]

I didnt like that module but im not the frustrated one, I think youre crossing some wires here

[fathom pendant]

The one he linked is the fundamentals t0

Reset the target then

[graceful rampart]

I'm in the middle of it. So far I've only had an issue with the password mutation section

[forest tapir]

it's a sign from the powers that be to take a step back

[forest tapir]

I don't know but I've had a lot of trouble with the PtT section.

tickets don't update properly or maybe I'm just a fool.

[fathom pendant]

Shouldn't need your own VM, for the most part all of the modules have been tested on pwnbox

Look at this guy, paying for VMware

[graceful rampart]

I havent gotten there yet lol. But I've done PtT before so I don't expect to have any issues with it

[fathom pendant]

Instead of using the free VirtualBox

[forest tapir]

eventually one day the ticket just " magically updated " and i was just like....

[fathom pendant]

Nice

[graceful rampart]

Lmao. Yea. Thats just kerberos in general

[forest tapir]

actually it was very frustrating and it made me stop.

[graceful rampart]

Kerberos is a royal pain in the rear to deal with

[forest tapir]

I finished it and then I just stopped for like 2 weeks lmao

[fathom pendant]

It's not about making money to afford it. VMware is more of a pain to use unless you're already used to it

[forest tapir]

yeah it works fine if you're on Windows using Rubeus but for some reason...

[graceful rampart]

Kerberos is usually my reason for malding when doing anything AD related

[candid zephyr]

VMware Pro is fine. You're just used to the shitty free version.

[lethal schooner]

I had to buy vmware im on an m1

[graceful rampart]

Well, I have a windows attack box set up anyway. I try to do most of my AD attack8ng from a windows machine. Since my end goal is red teaming and you can blend in better on a windows machine

[candid zephyr]

Virtualbox is better than the free Vmware.

[graceful rampart]

Agreed

[fathom pendant]

¯_(ツ)_/¯

[graceful rampart]

Vmware is only good if you have pro

[lethal schooner]

@rustic sage m1 max

[fathom pendant]

I also don't want to think about VMware outside of the context of work, my work uses VMware to sign in to tools... So it is generally a pain for me lol

[lethal schooner]

@rustic sage those are great too. I hear they are getting the m2 soon

[forest tapir]

It was specifically PtT from Linux that has the most problems

everything else in that module is perfect. I don't know what it is but something is goofy with Linux and Kerberos

or maybe it's the script HTB uses to update tickets? either way, I've had nothing but problems with it

[graceful rampart]

Yea. I don't know the exact reason for it but yea tickets get buggy

I'll play around with it when I get there. Will let you know what I find

[lethal schooner]

Curved monitor, I was thinking about getting one of those.

[graceful rampart]

Man you're better off posting screenshots. I can't speak for snyone else but in a server full of hackers I refuse to click links

[lethal schooner]

@graceful rampart it's fine lol just an image.

[graceful rampart]

Curved monitors are nice

[forest tapir]

you can if you're verified on Discord

you have to link your hack the box account with Discord

[graceful rampart]

Yea. Go to #welcome explains how to do it

As am i

You need to link you regularly htb account

And the emails don't need to be the same

Go read #welcome lol

[forest tapir]

you only need to link your API key from the settings on your hack the box account

I don't think emails have to match

[fathom pendant]

You just need your secret account identifier

[graceful rampart]

Dosent matter

Subscription dosent matter for discord

Np

[feral stump]

anyone I can clarify a quick one on web shells - laudanum section second question

Thx!

trying to find out where ||to upload the shell in the website||

[graceful rampart]

Do what it says lol. Message a mod

[vital adder]

did you get the dm from htb bot? also you'll a htb account to verify

that shouldn't an issue so yep just message a mod or support

[vital adder]

wdym? if you access the target site through the given subdomain you should be able to just upload the file and i think that's under Import configuration file or something

[feral stump]

yeah found it just when reading your ms

im so non focused today

thx

[pastel ginkgo]

Is there an error in the Linux Priv Esc - Misc Techniques? Under Weak NFS Privs, It talks about creating the binary on our local root host, then copying it over to the remote host. But the example starts from the remote then back and forth. Its confusing as hell lol

[vital adder]

all i got in my note for that section is about the ||NFS|| nothing about a binary but i do remember that section super confusing

[pastel ginkgo]

I think they just have it mixed up idk

[solar zodiac]

ooo there is a new cme module

cant wait to try it out once I finish this pro lab

😄

[graceful rampart]

Yea. cme is slowly but surely becoming an entire exploitation framework

[solar zodiac]

lol cme is awesome 🙂

its winrm module doesnt play well with metasploit socks proxies though

returns false negatives becuase of connection failures

so I just use chisel

[lethal schooner]

@warm sand Why the hell would they say ssh if you're not suppose to use ssh lol

[thorn urchin]

chisel is awesome

[solar zodiac]

I love it 😄

[thorn urchin]

chisels biggest downside is fairly heft bin size even with build flags to slim it down, but other than that it rocks. I moved my notes on chisel to the root of my obsidian vault for faster access and Ive used it pretty extensively throughout the modules when appropriate even if the module doesnt mention using it or pivoting

[solar zodiac]

also av flags it these days 😦

so I usually use it after I turn av off on a pivot point

[thorn urchin]

yeah but thats a given for most tools so I dont knock it against chisel specifically

[solar zodiac]

im loving all this new academy content 🙂

[fathom pendant]

@graceful rampart can I get a quick sanity check for the footprinting medium lab? I'm not running atm it but just wanted to confirm I was in the right direction

[solar zodiac]

waiting impatiently for the av module

i need some new tricks hehe 😄

[graceful rampart]

I don't have notes on those assessments. Wish I did but I honestly don't remember them

[fathom pendant]

Fair

Lol

[graceful rampart]

All I remember is that everything you need to do is pretty much straight out of the module aside from needing to change a few numbers here and there

[solar zodiac]

I think htb is doing a mentor thing now

if you get stuck

and you have silver+ membership

they will help you

😮

[graceful rampart]

https://github.com/Nicocha30/ligolo-ng

Best pivoting tool I've ever used

[solar zodiac]

looks nifty

🙂

[graceful rampart]

Yea. It's by far the easiest pivoting method I've ever used

[devout cliff]

does anyone know how to install the mysql package for parrot? im getting errors for it

[graceful rampart]

Funny thing is, I found it cuz someone mentioned it in here when they were talking about the pivoting module

[solar zodiac]

i always feel like im walking on the backs of giants

when I use these tools

[graceful rampart]

As do I. Eventually I'll get to the point where I'm writing my own tools

[solar zodiac]

nice

[graceful rampart]

If you can get the student discount there's no reason to do the yearly lmao

[solar zodiac]

😦

[graceful rampart]

And yea, for now only annual students get the tutoring but they said it will be coming to everyone else eventually

[solar zodiac]

im kinda jealous of HTB's b2b stuff

they have more pro labs

[high dove]

That's a very good news then.

[solar zodiac]

😦

[thorn urchin]

looks nifty, would have to see how well it does reverse connections cause the age old firewall issue. That or im misunderstanding something from just skimming it. Filed away in my to look at later bit

[graceful rampart]

Haven't used it when a firewall is present yet. You're right, that's definetly something to test

[rustic sage]

Hi all,
I am stuck at "Getting started" module, "Privilege Escalation" part. I SSHed into machine, and I can't find way to user2 account. I ran 'sudo-l' as user1 and got:
"(user2 : user2) NOPASSWD: /bin/bash"

I can't move from here. Should I download enumeration script? Or there is other way around getting priv esc to user2?

[thorn urchin]

the agent/proxy wording seems to suggest that perhaps its actually the default, but Ive seen so many tools define those words differently that I dunno without testing lol

[rustic sage]

I am actually looking for some small hint, so I could continue alone 🙂

[graceful rampart]

Yea

[thorn urchin]

I mean the path is right what you posted

[graceful rampart]

Well, what is /bin/bash?

Answer that question and you'll understand how to privesc

[thorn urchin]

Look up sudoers and how to interpret the results from sudo -l

[ember jewel]

Hi, i was going through the "File Inclusion" module and under the title Basic Bypasses, section 'path truncation' it read as on the screenshot highlighted in blue...may i ask why would starting the path with a non existent directory would be necessary for the technique to work?

ooops, my screenshot did not attach

[thorn urchin]

because you may not know the full path, or they can be prepending a path so you need to use a relative path

need to verify your account before can post images here

[ember jewel]

this is how it said in part, since i cant attach the screenshot of the section "Path Truncation

In earlier versions of PHP, defined strings have a maximum length of 4096 characters, likely due to the limitation of 32-bit systems. If a longer string is passed, it will simply be truncated, and any characters after the maximum length will be ignored. Furthermore, PHP also used to remove trailing slashes and single dots in path names, so if we call (/etc/passwd/.) then the /. would also be truncated, and PHP would call (/etc/passwd). PHP, and Linux systems in general, also disregard multiple slashes in the path (e.g. ////etc/passwd is the same as /etc/passwd). Similarly, a current directory shortcut (.) in the middle of the path would also be disregarded (e.g. /etc/./passwd).

If we combine both of these PHP limitations together, we can create very long strings that evaluate to a correct path. Whenever we reach the 4096 character limitation, the appended extension (.php) would be truncated, and we would have a path without an appended extension. Finally, it is also important to note that we would also need to start the path with a non-existing directory for this technique to work.

An example of such payload would be the following:
Code: url

?language=non_existing_directory/../../../etc/passwd/./././.[./ REPEATED ~2048 times]
"

[thorn urchin]

idk I dont have that bit saved to my notes, I wouldnt start with an explicitly non existing directory

[rough tendon]

hey quick question how can i share the link to it a friend of mine wants to join

[drifting glacier]

Bit confused on this first question in the Shells & Payloads section

It's probably something super simple, but what am i missing on this answer?

[ember jewel]

maybe aspx bit on the file path

aspx instead of axpx

i havent done the module but i can only guess that from the context

[thorn urchin]

yeah looks like ya got a typo

[rustic sage]

Thanks for answer. I was a little bit dumb, so I overlooked sudo -su user2 command. Now I am into /root folder but can't 'cat' flag.txt file. I need permission. Could you provide me some small hint? I am stuck..

[graceful rampart]

Well only root can read the files in /root

are you root yet?

if not you may wanna start looking for more privesc vectors

[rough tendon]

any shortcuts of unneeded info for linux fundamentakls

[graceful rampart]

Privesc is very cyclical. You start your enumeration, find a vector, go to the next user, then go back and start enumeration again

[rustic sage]

yep. In "Hint" on HTB, it says "Dont forget to chmod". I tried to chmod flag.txt file for u+r and nothing. Tried various combinations, actually

[graceful rampart]

Nah. you arent there yet. Keep searching. iirc this vulnerability is straight out of the example the give

[thorn urchin]

yeah technically what youve done now going from user1 to user2 is called 'Lateral Movement' because youre moving from similar priv levels to similar priv levels. But other users may have access to escalation paths than others.

So if this was a real world situation, hypothetically you would have seen that there was no route from user1 to root, so you laterally moved to a different user to then see if they have a route instead.

[fathom pendant]

& thats a spoiler

[graceful rampart]

i mean, you can just copy the path from the example lol

[rustic sage]

Thank you so much, I think Im on the right path

[drifting glacier]

Didn't realize i needed to include directory in the hint as well, bit of a gotcha question, but that + fixing the typo = finally got it

[thorn urchin]

Yeah in the real world theres no gurantee that moving laterally is the correct path, but in these lab and challenge scenarios usually things are only there for a reason and rabbit holes from the box creator are rare(outside of some like hard or insane ranked boxes), so generally if you CAN laterally move to a different user, then youre supposed to.

Youll often find in the real world that actual exploitation steps are easier than lab boxes, but will have far more enumeration and dead end paths requiring triaging than in lab boxes.

[rustic sage]

Understood. Yep, I succeed at the end. Salute to SSH Private keys! 😂

[thorn urchin]

Ergo why you see every couple months some random google payout for several $K for the most mind numbing trivial web vulnerability and youre like '1. How did google mess this up and 2. Howd nobody else find it already.' the answer to both is the sheer scope and triaging required

[rustic sage]

I guess, lack of exploitation in lab is because it's not safe for HTB?

So they give to us more enumeration things?

[thorn urchin]

Hmm? I think you misunderstood what I said

[rustic sage]

Actually I did 🙂
Thank you so much for these infos, beside my question

[graceful rampart]

Yea. The amount of times you see payouts cuz someone put a key or password in a public github Repo is crazy

[celest vault]

hey, I'm on one of the easier modules (Getting Started - Service Scanning) and having a technical issue with connection timing out after inputting bob's password. I have the same issue whether or not I'm on my own VM w/VPN or the HTB web instance. Seems so basic that it must be user error, but have tried it every which way. Anyone have similar issue or see what I'm doing wrong?

[graceful rampart]

Try smbclient -U bob//IP/users

[celest vault]

tried this and several syntax variants but none working - syntax error coming back rather than connection error

it's strange because it only times out after inputting pw

[final salmon]

Can anybody assist wIth BloodHound -- Skills assessment. The third question, "What GPO does the VPN Users group have WriteProperty rights over? (case-sensitive)". What I believe to be the answer is not taking, and I am having issues figuring out what else it could be XD. I was right, it randomly took it today lol.

[hasty scaffold]

alright whos willing to help on the box HEALTH

[thorn urchin]

nobody cause this is the wrong channel

[hasty scaffold]

oh my bad didnt see i was in academy

[onyx pelican]

Module 88 Section 22
Introduction To Python 3

What are the values of target and port you want us to use?

[thorn urchin]

likely whatever your target is and the corresponding port number of whatever youre interacting with

[onyx pelican]

It's just a tutorial. No target and port is given, though in the example python code it is provided as target:port directly.

It's possible a domain exists for target, but it isn't defined in /etc/hosts so it would have to be some DNS server on the internal network of the box I'm working on. port, however, is invalid by itself and must signify a placeholder.

[thorn urchin]

Yes, if the module section has an interactive portion you need to spawn the instance first at the bottom. Otherwise if it doesnt the placeholder is just for demonstration sake.

Unless its a scenario where they want you to make the server portion as well, I havnt done that module specifically

[onyx pelican]

I didn't hit the "Spawn a target ..." option at the bottom. Apologies. Still figuring out the UI 🙂 Thank you

[graceful rampart]

Anyone for a nudge on the excersize at the end of "Credential Hunting in Linux" in the password attacks module? Im able to log in as Kira but i cant find anything after that. Im completely at a loss here. This feel like im trying to privesc an HTB box, not do an excersize on academy 😅

[thorn urchin]

Academy modules wouldnt be as useful if they didnt intentionally throw ya some curve balls 😉

[onyx pelican]

Is there a way to use my own environment instead of the HTML embedded shell for the academy assignments? Perhaps, VPN into my module or something? I think the HTML shell is extremely cool, but it's still a little slow compared to a local shell. If not, no worries.

[thorn urchin]

Ive never used the html shell

Always done either pwnbox or vpn connection

html shell is brand new.

[graceful rampart]

Fair, but like, im completely lost. Ive tried all the tools in the module. Mimipenguin needs root, firefox_decryptor asks for a master password that I dont have, I found the passwd.bak and shadow.bak but i cant read shadow.bak so those are useless. Im at a loss here

[thorn urchin]

Why cant you read shadow.bak?

[onyx pelican]

I'm sure this info is available somewhere that I just haven't seen yet. Would you mind sending over instructions? I'd appreciate it.

[graceful rampart]

cuz its only readable by will lmao

and if i had his password id be set

[thorn urchin]

I dont have notes on the section by section practicals so need to jog my memory a little

[thorn urchin]

pwnbox is just click on the start pwnbox instance button. vpn is download the openvpn profile and use openvpn to connect. Google how if youre unfamiliar.

[thorn urchin]

with the caveat that my memory is fuzzy, have you also checked say bash history?

I remember one of the sections being like that and just glossing over a password in clear text

[onyx pelican]

thanks, I'll setup the VPN

Not sure if @thorn urchin is a Hack The Box affiliate or anything, but mad props for helping folks here. 👍

[thorn urchin]

I just like helping when I can

[onyx pelican]

Appreciated. I'll be around much more in the future 🙂

[graceful rampart]

I hate this module so much. I reset the box and now one of the tools that i tried before magically worked

[thorn urchin]

Its my least favorite module by far

[graceful rampart]

Yea. Lots of very poorly designed excersizes

[thorn urchin]

if so should probably verify your account with #welcome like 90% of the discord is locked out to white names lol

[graceful rampart]

the informational parts are just as good as the rest of academy. But the excersizes are brutal

[thorn urchin]

The biggest problem with the exercises is a ton of them are time wasters where you dont even know if youve made a mistake until 30minutes+ into an attempt

[graceful rampart]

yea

[lethal schooner]

yes for sure

[graceful rampart]

Ive been sitting here for an hour pulling my hair out only to reset the box and have a tool that a tried at the very beginning magically work now

[thorn urchin]

Doing everything perfectly will still take several hours purely from processing time. I know its more real world realistic but rapid feedback is more important for learning than realism in this case.

[graceful rampart]

Agreed

[thorn urchin]

That specifically I havnt had an issue with but yeah the module overall could use a slight rework

Notably the newer added sections with PtH and PtT are much better designed and doesnt waste your time, most peoples issues with it are just their own issues dealing with curve balls.

[onyx pelican]

appreciate the tip once again. I think I'm identified now

[thorn urchin]

you are

[onyx pelican]

Ahh yes, the n00b tag

[thorn urchin]

I've noticed more than a few people be like, "This section was hard for me, that makes it bad" and im just like 🤦‍♂️

[onyx pelican]

It's not an easy discipline

[graceful rampart]

lmao. yea. Hard is good most of the time

thats the best way to learn

I just dont enjoy spending an hour only to find out im on the wrong path

[thorn urchin]

Yeah but sometimes thats just the nature of the beast

[graceful rampart]

Fair

but imo an excersize shouldnt take longer than most of the labs 😆

[thorn urchin]

Kinda like my earlier rant about the difference between real world and lab environments. The real world isnt going to be limited to just relevant stuff, you will absolutely be spending hours and hours on rabbit holes and wrong paths with utterly zero indication youre on the wrong path. Just how it is sometimes.

But yeah difference between "oops IM on the wrong path" and "teehee you won't know youre on the wrong path till over half the instance lifetime has passed already because thats how the challenge was calibrated"

[graceful rampart]

I totally agree. But an excersize is expected to be an excersize. You wanna throw rabbit holes into the labs, by all means, thats fair game. But if im doing an excersize, i assume its supposed to test what i just learned

[thorn urchin]

yeah im on the same page there

[graceful rampart]

If the excersize dosent test what you just learned and instead tests on something that you did an excersize on 2 sections ago whats the point?

[thorn urchin]

eh im a little more picky on that particular statement

[fathom pendant]

I would add on, unless up until that section it's building on top of itself

[graceful rampart]

like, it took me like 20 minutes to figure out i needed to bruteforce Kiras password. Not because i dont know how to do it but because I wasnt expecting to need to generate a mutated password list because i did that in the previuous section

[thorn urchin]

Theres been more than a few modules that are 10x easier if you apply lessons from totally different modules and its a great joy to discover those. Being able to find moments where you can go off the beaten path and use a better path you figured out yourself is a valuable learning moment and I suspect secretly some of the modules has that in mind.

[graceful rampart]

idk,m aybe its just a falw with how im going throught he modules. Ill defiently be thinking about everything goign forward but i thinkt hat defeats the purpose of excersizes

[thorn urchin]

Yeah the mutated password list is used for most of the whole module and assessments, keep that file handy

Order to use is Mut password list>Unmutated list>rockyou

cause iirc youll use all three in the assessments

[graceful rampart]

I totally hear that. Ive done that in a few places as well. But before this module I would never have thought "Ill try this thing that i was just tested on in the previous section"

[thorn urchin]

can swap unmutated list and mutated list though cause its shorter

Yeah itd be nicer if there was a little bit more of a hint that the mutated section was going to be a foundational piece for future sections to reuse

[graceful rampart]

Yea. Agreed. Like, ont he labs id expect that. But not for the excersizes

[thorn urchin]

But yeah I mean more like applying pivoting module lessons to the AD assessments or the ffuf section for the file inclusions and uploads modules

those are the offbeaten paths I really liked to use

[graceful rampart]

Yea of course

[rough tendon]

any short cuts in the modules for malware prevention

?

[thorn urchin]

what

[rough tendon]

if i am studying attack prevention on htb is there any short cuts of unneeded info

[thorn urchin]

whats a "shortcut of unneeded info"?

are you asking about what parts you can skip?

[rough tendon]

yes

exactly

things that are unimportant or mimic other parts of the lesson

[thorn urchin]

none, study well

[fathom pendant]

I mean there is no real shortcut, the goal is to teach you the concept, but if you have or know of a tool that works with the concept then great.

[thorn urchin]

Yeah its a question of if you have to ask then its not something you should skip

[turbid lily]

Hi, I need some help in "Attacking Common Services - Medium". I have enumerated all ports and found ||port 2121 open (FTP proxy) beside other ports. I mention this one specially since this is the one you should focus based on previous questions for this.|| However, I tried to brute forcing it (with resources lists), login as anonymous, but nothing seems to work. Any little hint about how to procedure?

[thorn urchin]

enumerate harder

The med lab is actually the easiest of all three labs for that one. You just have to do your due diligence

[turbid lily]

Well, that was easy...

ty

[thorn urchin]

yup and np

literally the last bit of my notes for that lab lol

[fathom pendant]

Lolll it do be that way

[eternal vale]

Could use an assist on nmap firewall ids/idp evasion hard module if anyone is available

[fathom pendant]

The answer is in the lesson

Check carefully

[eternal vale]

I've read the lesson, question and hint and nothing is jumping out at me. The ports that show open enumerate the services fine but neither are the answer.

[fathom pendant]

Look VERY carefully

Once you see it

[languid glacier]

Hey I am just about to graduate highschool and am trying to get into cyber security. If anyone has any tips or advice to pass down that would be awesome I’m completely new trying to prep and get ahead for college. Appreciate y’all

[fathom pendant]

But the tools and commands are there

[fathom pendant]

Tip: if you ever get stuck , don't stop trying, and Uncle Google is always your friend

[languid glacier]

I will remember that

[eternal vale]

In which lesson, the hard module or the preceding modules?

[fathom pendant]

Also if you're ever stuck, just think about the few things: what can you see, what can you not see, and how do these combine for the whole picture

[languid glacier]

Thank you so much

[fathom pendant]

It's in one of the lesson sections

[eternal vale]

ok

[fathom pendant]

Can't say much more but it's fairly obvious once you see it

I had to get nudged to it myself, so don't worry

[graceful rampart]

Password Attacks: Pass the hash section. What exactly is this question asking for? I tried HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy LocalAccountTokenFilterPolicy and FilterAdministratorToken

[fallen osprey]

in "PASSWORDS ATTACKS: Pass the Ticket (PtT) from Linux" I got stuck with this question (see my screenshot). I used smbclient to download the flag.txt file and read the content of it with cat command. But when I try enter it as a answer it said: Incorret Answer. Anyone have a hint or clue ?

[fallen osprey]

it ask for the name of the key that you set to 0

[bright oracle]

Hello

[graceful rampart]

Ah. Had a minor brainfsrt there. Thanks

[oak dagger]

What framework would be followed?

[fathom pendant]

You know what would probably help me enumerate on my vm... connecting to the vpn 🤡

[dull moth]

anyone working on Footprinting IMAP/POP3?

[wheat garden]

you need help on it?

[wheat garden]

[dull moth]

i dont know if im too tired of been working on modules the whole day but im having trouble to login into IMAP

im tagging LOGIN login pass and getting error

[wheat garden]

try the syntax as they have it here. Dont think they give correct or updated syntax in the module

https://www.atmail.com/blog/imap-commands/

[dull moth]

i just got

tks

i forgot to tag IMAP before the command

xD

[wheat garden]

https://www.atmail.com/blog/imap-101-manual-imap-sessions/

[wheat garden]

👍

[hollow thunder]

AD Assessment 1 down!

moving on to the next one

[fathom pendant]

Ok I'm frustrated at this point I can't RDP into this lab (Footprinting Medium) unless I'm just missing something if someone wants to nudge me in the right direction that'd be great; because I do have a password/login but that's about it

[fathom pendant]

[04:30:22:263] [9814:9814] [ERROR][com.freerdp.client.x11] - failed to open display: :1
[04:30:22:264] [9814:9814] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set. I get this error each time so I guess I'm moving one step forward

[rough trail]

after disassembling main function there is no eip in the dump so how can i find it and perform buffer overflow . please help

[fathom pendant]

https://tenor.com/view/hacker-pc-meme-matrix-codes-gif-16730883

I'm in bois LET'S GOOOOOOO

[waxen barn]

How was it? I just finished up the learning material today.

[hollow thunder]

I personally found it a little challenging. It's more or less figuring out what steps you should be taking next

Pivoting, and enumeraiton are key

[waxen barn]

That’s what I was thinking it would be about. Piecing it all together seems like a pretty big challenge, though the individual parts aren’t too difficult.

[hard knot]

admin

can i get help

[fathom pendant]

Why do you specifically need admin assistance?

[hard knot]

where is the link for hack the box website?

[hollow thunder]

Yea. Doing assessment 2 now. I really want to take my time and enumerate/information gather, and then after that slowly formulate what I should be able to do, and then make a checklist for me to go down

[fathom pendant]

Do you mean the academy? Or the standard site?

[hard knot]

site

u can dm me

[fathom pendant]

http://www.hackthebox.com

[hard knot]

thnsk

[fathom pendant]

Np, this chat is really for the modules found on http://academy.hackthebox.com

[thorn urchin]

how do you sit ON the HTB discord and NOT know how to find the HTB website....

[graceful rampart]

https://github.com/Jaratai/AD-mindmap-by-m4yfly-and-vikingfr-Sant0rryufrom-Orange-Cyberdefense/blob/main/pentest_ad_dark_2022_11.svg

This is one of the best AD mindmaps I've ever used. I havent done the AD module yet so idk how helpful itll be but I use it any time im attacking AD

Also, bloodhound is a very very useful tool, altho im sure the module covers it right?

[fathom pendant]

I watched John Hammond demo how to use it's actually neat

[fathom pendant]

I finally was able to get into the footprinting medium :D

[graceful rampart]

Congrats!

[fathom pendant]

Ohhhh I just brain blasted this part

[graceful rampart]

Yea. Bloodhound is really good. Altho if you're trying to be stealthy you'll have problems. The collectors will set off every flag you can set off

[fathom pendant]

True

I do like it as a vuln assess tool though

Because if your ids/IPS doesn't catch or stop it... Then you got major issues

[graceful rampart]

Even as a pentest tool. As long as you dont need ti evade detection

[fathom pendant]

True

If you're permitted to run in guns ablazing

[graceful rampart]

Well I mean how wiuld they? The ingestors run locally on the target machine and you exfiltrate a zip file to import to bloodhound

[fathom pendant]

Ah fair point

[graceful rampart]

It's AV/IDS/EDR that you need to worry about

[fathom pendant]

Yeah

[graceful rampart]

Altho there are ways to get around them. But we won't get into that now

[thorn urchin]

if bloodhound isnt caught locally its mostly because of the sheer volume of abnormal requests it makes

[graceful rampart]

Usually yea

[fathom pendant]

I'm just feeling good that I was able to privesc without any troubles in this module

[graceful rampart]

Nice!

[thorn urchin]

but even then, its gotta be a pretty tight environment to truly ring alarms

[graceful rampart]

Fair

[fathom pendant]

Most of my issue was that I was using stinky xfreerdp

[thorn urchin]

but yes AD module covers Bloodhound

[graceful rampart]

I figured as much

[fathom pendant]

Then I remembered I installed the GUI tool for it

And was like 'oh... This is fantastic'

[thorn urchin]

AD module is actually insanely in depth. PtH, CME, Bloodhound, Kerberoasting, DACLS, forest trusts

[graceful rampart]

Nice. Thats good

I'll get there eventually

[thorn urchin]

like practically the only thing it doesnt cover is ACDS and it at least gives an honory nod to it.

[graceful rampart]

As soon as a stop banging my head against a wall with this God damn password attacks module

[graceful rampart]

Ah. Well ADCS I feel is more advanced anyway

[hard knot]

||@fathom pendant||

[graceful rampart]

Altho it's a really big topic in red teaming currently

[thorn urchin]

yeah exactly

[hard knot]

i need help again

CAN send screenshots?

?

?

i have trouble setting up the vpn

csn i send screenshots here ????

[graceful rampart]

If you're interested in ADCS, Alh4zr3d is writing a course on it. Not sure what the planned release is but he will proly put it on his patreon before it gets released on TCM

[thorn urchin]

Im aware and already on the patreon 😉

[hard knot]

HELP!

[thorn urchin]

stop spamming

[hard knot]

sorry

just help PLS

[thorn urchin]

nah

[hard knot]

-_-

[thorn urchin]

I dont have the kind of patience to aid someone that tags somebody and then writes 9 messages screeching for help in sub-2 minutes, sorry. Best of luck though.

[graceful rampart]

Do you not realize that you're asking other people to take the time to help you? Right after you send 9 messages in 30 seconds because you didn't get a response?

[hard knot]

😧

ye

[graceful rampart]

Nobody is going to take the time to help you after you do something like that

[hard knot]

where else can i go?

[thorn urchin]

support chat on the website

[graceful rampart]

^

[hard knot]

i saw the role of "PRO" on ur profile and asked for help

[thorn urchin]

or exercise the slightest of patience to wait for a reply

[hard knot]

..

[thorn urchin]

this is a place for discussion and helping others about academy modules but nobody is entitled to help you. The more entitled you sound, the less most people are gunna want to actually help you.

[hard knot]

how not to be "entitled" ?

[thorn urchin]

its like a child throwing a tantrum in the supermarket, aint nobody but their mother wants to deal with the tantrum child

Be more patient, ask more politely

[hard knot]

😂

[thorn urchin]

learn to ask good questions too

HELP

isnt a good question

[graceful rampart]

Just act like a human being and understand that nobody here is required to help you.

[hard knot]

"hello my friends"

Can i get ur polite attention

I needed a helping hand....

[graceful rampart]

Also give this a read: https://dontasktoask.com/

[thorn urchin]

"Hey, Im trying to connect to the vpn but im having issues with it, can anybody help me with it?" thats a better question

yeah unironically read that link

[hard knot]

THANK U 😘

[thorn urchin]

Ive set it as my status in the past 😂

[graceful rampart]

Lmao

I should really do that

[hard knot]

thnks ❤️

[graceful rampart]

The amount of times I get people dming me with "I have a question about x module"

Drives me nuts

[thorn urchin]

My bio literally says to ask me before DMing for help, which shouldn't be necessary because its in the rules

[hard knot]

LOL

[thorn urchin]

I just auto ignore all DMs from those I havnt said okay to

[hard knot]

heh

[graceful rampart]

Nice

I do that most of the time too

Unless I'm bored

[thorn urchin]

best part is they show up from here as message requests and not actual notifications so usually I dont even see they tried till three days after the fact

[graceful rampart]

Lmao

[thorn urchin]

like damn bruh, shoulda asked I might've actually said okay three days ago

I usually say okay unless im heading to bed or busy with something

[hard knot]

um

hello

"Hey, Im trying to connect to the vpn but im having issues with it, can anybody help me with it?" This message was recommended from a friend

[thorn urchin]

Well, what have you tried and what issues are you having with it

[hard knot]

i tried putting those commands into the terminal

but the errors occures

wanna se/

[fathom pendant]

if you're meaning copying it exactly as path/to/file?

[hard knot]

nope

[fathom pendant]

if you're using the pwnbox you don't need to do anything it's already on the vpn

[hard knot]

i coppied the path the actual path

[fathom pendant]

did you download the vpn file?

[hard knot]

yes

[fathom pendant]

ok show us what command you did and what error you're getting :)

[hard knot]

ok wait

[fathom pendant]

you can't post screenshots in here until you verify in #bot-commands btw

[hard knot]

ok

@fathom pendant

can i dm?

[fathom pendant]

sure

[rustic sage]

Hello people I am a beginner and I am unable to connect to the ssh in my instance

eventhough I typed the credentials given by HTB that is HTB_@cademy_stdnt! it says that the authentication have failed

What command you running. What error you getting?

I tried changing my ip and password too

[hard knot]

@thorn urchin @rustic sage need ur help 😂

[rustic sage]

I gave
ssh [username]@[ipaddress]

wait lemme share the screenshots if u dont mind

Sure

[hard knot]

nooo

@rustic sage

first u have to verifh

or ull be muted

[rustic sage]

Send me dm @rustic sage

[hard knot]

RIP

[rough trail]

i have doubt in module stack based buffer overflow in linux

[hard knot]

he is muted

[rustic sage]

He didn’t even send them lol dayum

How can i verify ??!

Just copy paste your terminal command

[rough trail]

there is no eip in the given program file , when i disassemble the main function

[thorn urchin]

why would eip be in the file, eip only exists during run time

[hard knot]

go in #bot-commands and type "++verify"

[fathom pendant]

#bot-commands is where you verify

[warm turret]

@rough trail you have to debug, not disassemble

[rough trail]

that program is running in background , this is given in the description

[rough trail]

by gdb debugger

right

[warm turret]

Yep

[thorn urchin]

EIP still doesnt exists inside a file, it only exists during run time

EIP is just what the cpu uses to say "Im executing this opcode next" that's it.

[hard knot]

hmm

[warm turret]

That's right madf0x, the adress of the eip it is tied to the RAM of the machine, it can change even from one architecture to another

[rustic sage]

@thorn urchin what percentage are you with cpts

[fathom pendant]

The IP stands for Instruction Pointer

[thorn urchin]

85% ive been slacking the past couple weeks

[rustic sage]

Nice just curious

[warm turret]

What are cpts ?? 😅

[rustic sage]

How long did it take you to get there like in days/months?

[rustic sage]

That’s the htb academy course

[thorn urchin]

I wanted to finish linux priv esc to night but eyes were hurting so I cant read focus on a monitor screen atm.

[rustic sage]

For pen test

[fathom pendant]

Cpts the certified penetration tester ya goon on the academy site

[rustic sage]

Lol ya goon

[thorn urchin]

Overall im 3 months in from when I started roughly

[warm turret]

Omg okok 🙂

[rustic sage]

For sure cool man

[fathom pendant]

I'm about a week or so in lol I'd be further along if footprinting /andRDP/ wasn't a bitch

[warm turret]

I just did all the tier 0 and the bbh path 🙂

[rustic sage]

It says you accepts messages only from your friends

[thorn urchin]

The first half went by way faster for me than the second half, but that's mostly been cause if life stuff

[rustic sage]

now I have verified

[rustic sage]

Nice you’ll get there man just gotta keep on truckin

[fathom pendant]

I had the right idea, but xfreerdp can suckit

Because once I used Remmina... I was in, grabbed the data and was out...

[warm turret]

@fathom pendant install a windows vm and use mstsc 😉

[rustic sage]

Rdesktop is nice can manipulate size of screen iirc

[fathom pendant]

Sticking with one VM my poor 4 core processor can barely handle it

[thorn urchin]

xfreerdp can too with option

[fathom pendant]

By that I mean if I tried running multiple I'd probably burn the house down

[thorn urchin]

can also mount the local folder as a remote share too, which I wouldnt recommend doing in the real world but is convenient for some of the annoying manual rdp sections

[hard knot]

"Hey, do anyone know how to change kali linux password , having issues with it, can anybody help me with it?"

[rustic sage]

Interesting that would of been useful so many times ha know the option off top of your head I’m not at terminal right now so can’t research

[thorn urchin]

its either like +dynamic-resolution or /dynamic-resolution

[rustic sage]

Dope I’ll have to try that tmrw

[fathom pendant]

passwd

[hard knot]

okie thanks

almost forgot that

[fathom pendant]

Default is root:toor

[thorn urchin]

+home-drive or something like that for automounting as a remote share when connecting to windows

[rustic sage]

Fun fact for xfreerdp you can set up a share automatically by typing /drive:./ or something similar I learned that the long and hard way haha

[hard knot]

and what about user name ?

[thorn urchin]

and I wanna say its like /hashes or /pth for connecting via PtH too which is nifty

[fathom pendant]

Neat

So you're the local xfreerdp to complain too :^)

[thorn urchin]

I mean I avoid rdp at all costs

[hard knot]

hello

~

[thorn urchin]

annoying

[hard knot]

sorry

XD

[thorn urchin]

you already asked your question, show more patience

[hard knot]

~patience~

[thorn urchin]

its a basic linux operation, google it

[hard knot]

okie

[thorn urchin]

the channel is for modules discussion, not linux fundementals (unless youre literally doing the linux fundementals module and asking about something in there)

[fathom pendant]

Unless there was a different way to access the file that had the important document in it, if there was, DM me

[thorn urchin]

idr

[fathom pendant]

probably not since the biggest flags in that was that NFS and RDP were there. ¯_(ツ)_/¯

Anyway time to break my sanity with the hard lab

[candid zephyr]

So you mean unless you're doing something in Windows? 😬

[thorn urchin]

only if I cant psexec, wmiexec, win-rm, ect instead

[candid zephyr]

Well if you can psexec then you're starting out with lots of privileges. Which is unusual...

[hard knot]

btw do u guys know i am gonna get a "active developer badge" after 5hrs

i built a bot and submitted it

[thorn urchin]

not module related, nobody cares

share it in gen chat instead 😉

[hard knot]

hmm ur right

okie

ur very help full 😂😂😂😂

[mossy solstice]

no matter the chat tbh..

[thorn urchin]

ssshhhhh

[thorn urchin]

ye, Im just saying Id rather exhaust all other auth methods before using rdp personally

[hard knot]

broo see what i found 😂😂😂😂😂

[patent whale]

Hi, anyone that could help a bit with the Pivoting Skill assessment? Details in the message, so that I don't spoil publicly.

[meager topaz]

how to crack wpa2 hash fastly with bruteforce

or best worldlist

[patent whale]

I use rockyou.txt

[meager topaz]

this worldlist not work means this is old worldlist and useless

[thorn urchin]

also off topic, need to stop before a mod gets mad at ya

[thorn urchin]

not the right channel for that, also dont ask your question in multiple channels its just spam

[dawn flame]

Dave McKay to the rescue: https://www.howtogeek.com/447443/how-to-change-account-passwords-on-linux/

[iron patio]

Is the official nmap book + the site still the best resource for nmap?

the book from the dev is from 2009 and I see several other guides as well

[sonic wyvern]

does anyone here know maybe how to ffuf with the -recursion?

on the ATTACKING WEB APPLICATIONS WITH FFUF it's not finding anything

[sonic wyvern]

Oh, I finally found it, awesome

[fathom pendant]

honestly if you're looking for specific use cases a lot of time it's referenced to the online manual; but i would say experimenting is the best teacher

[fathom pendant]

i mean i'm a bit late to announcing i made it in... just running in circles lol

and done

1h50 where the medium lab took me a headscratching few days

definitely taking notes on this one

i hate re-reading over the lab instruction... then reading a KEY BIT OF INFORMATION that would have saved me time...

[thorn urchin]

yeah I recommend taking a lot of notes

[fathom pendant]

Obsidian?

[thorn urchin]

yup

[fathom pendant]

I'm thinking of transferring my notes over because the flow seems cleaner

not to mention I can build a path of discovery when attacking labs

and do a full checklist of things i have and haven't done

I'm just using sublime because i like having the markup, but i think obsidian does that too?

[thorn urchin]

yup

[iron patio]

@thorn urchin based obsidian user

yeah note taking is absolutely essential

[iron patio]

im on the medium lab right now

i assume you mean the nmap one

[fathom pendant]

NOPE

i mean the footprinting one

[iron patio]

oh, dont even know what that is lol

[fathom pendant]

nmap medium is a toughie too

[iron patio]

yeah i ran all the dns scripts but no easy win

[fathom pendant]

lemme look up what the medium goal is

[iron patio]

find the dns server version

[fathom pendant]

ah that one can be tricky

sometimes it doesn't want to spit it out at you the first try

[iron patio]

wdym? Was my solution correct, it just doesnt always work?

[fathom pendant]

if it's open, just wait

[feral stump]

Hello everyone ... Antak Webshell section of Shells and Payloads

I get to upload the antak webshell

don't get the format of the question based on the output of ||whoami||

anybody can help?

thx

[fathom pendant]

what does whoami do?

[feral stump]

I get this ||iis apppool\defaultapppool||

but nothing to do with how you need to submit the answer which according to the question is Format: **, 1 space)

that's what I mean

[fathom pendant]

i mean

[feral stump]

have tried different options but can't get the right one

[fathom pendant]

haven't done this one. so can't answer but maybe someone can nudge that knows ¯_(ツ)_/¯

[feral stump]

ok thx anyway

[thorn urchin]

I just closed my laptop to go to bed again. tag me in precisely 6 hours from this message if you dont get by then and ill double check it.

[fathom pendant]

night f0x

[feral stump]

ok thank you

[hollow thunder]

Anyone know how to get xfreerdp to copy from target to local machine

I have a bloodhound zip i want to bring over to local

[feral stump]

last time I found myself in your position I just dragged it

[hollow thunder]

im for some reason not getting it to work. Does it have to be on the desktop?

[feral stump]

When i did it i moved it to the Desktop

haven't tried from another place though

[swift osprey]

Can i message someone regards to XSS Final skill assessment?

[rustic sage]

is anyone there i need urgent help

[candid zephyr]

Host smb server with impacket is easiest

[feral stump]

stuck on php webshell section... trying to figure out why chrome is not connecting to the target ip so that i can ||change the application type to gif once the shell has been uploaded||

anybody?

[brisk sable]

any here working blacksky Blizzard Exam ?

need some help

[winged zodiac]

Hey I'm new to academy I was on getting started module but I wasn't able to connect through VPN file when I entered ip a it gave me 10.10.x.x IP in tun0 adapter and my instance ip was showing 170..x.x.x But nevertheless I tried -Pn in nmap but no results