modules

[lethal atlas]

that is a big problem

there is another way to get a shell from inside tomcat

[iron basin]

ye mean through the web manager or on the host?

[lethal atlas]

thru the manager

have you completed the hacking wordpress module?

check out Remote Code Execution (RCE) via the Theme Editor

you can get a shell that way and find flag4

[iron basin]

No, was finishing up this module to finish through and start back in a linear manner completing the CPTS path

Curious, I did this before on a past box where I had to upload the war file to get a shell, is this not possible on this box? Just wanting to make sure I am not missing something. But I will look at what you suggested

[lethal atlas]

I have done the same but I do not know if it will work or not in this module. I used the theme editor method and never went back

I guess the trick is to discover the upload directory

[iron basin]

i found it on the host, it allows me to access to other resources via the web manager but not the one I uploaded

[plain mountain]

on windows privilege escalation, looks like I need sysinternal but it is not installed

[devout cliff]

can people recommend some modules that talk about 'living off the land'? i know the file transfers module talks about it a bit, does the linux/windows priv esc modules talk about it as well?

[dim wolf]

yes

so does Active Directory Enumeration & Attacks

[devout cliff]

ty sir

[dim wolf]

see: GTFOBins, LOLBAS, and WADComs

actually not WADComs

[verbal ice]

Hi everyone, looking to copy a file from target to HTB Pwnbox - I might be missing something.
The command i use on target connected via ssh is
scp file htb-userNumber@htb-host:~/Desktop
in which he cannot DNS resolve the host part.

Anyone knows how I could fix my command to make it work ?
Without any DNS in IP i would do something like
scp file myUser@myIP:~/home/user

[devout cliff]

yeah im familiar with GTFObins and LOLBAS. was helping someone else and wanted to point them in the right direction to find more information on them and some examples in modules 😄

[fathom pendant]

you're specifying something that doesn't exist; ~is already the command line shortcut for /home/user/ so you're putting in /home/user/home/user if you want to just specify the home directory without the ~ then it'd be in the form of :/home/user

[verbal ice]

Right, thanks for this 😄 - I don't think the problem is coming from here tho, it has to do with the way i'm writing the pwnbox ip in the scp command I think

I wish i could post the screen but basically i get a "ssh could not resolve hostname htb-host : temporary failure in name resolution" Of course "htb-host" string is replaced by my pwnbox informations.

Im in the getting started module and I was trying to scp the id_rsa key instead of copy/paste the text.

[uncut sequoia]

Write the host and IP in /etc/hosts on your attacking machine. Example:

10.10.10.10  htb-host.htb

[verbal ice]

EDIT: Don't have permission to modify this, I believe I just don't write the pownbox IP properly, with the tunneling and the VPN it's out of my skill scope right now

[dim wolf]

sudo vi /etc/hosts?

[verbal ice]

on pownbox it works no problem, but i want to send from target to pownbox

and on target i can't do that, i don't have root access at that point of the box - just access to one user

[autumn pilot]

what is the target?

linux/windows?

[uncut sequoia]

NANO PLEASE

[autumn pilot]

https://tenor.com/view/vim-nodding-head-theprimeagen-linux-gif-24975873

[dim wolf]

what the heck is nano?

[uncut sequoia]

[fathom pendant]

same thing as vi/vim

I prefer vim

[simple zephyr]

Can someone help me with this on using Hydra, I have never seen this happen to me before. I am working on the Login Brute Force - Username Brute Force Module.

 hydra -L /usr/share/wordlists/seclists/Usernames/Names/names.txt -P /usr/share/wordlists/rockyou.txt -u -f 134.122.105.9 -s 31710 http-get / -vv -t 64 -I                                                                           ─╯
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-02-16 11:41:33
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 64 tasks per 1 server, overall 64 tasks, 145982948623 login tries (l:10177/p:14344399), ~2280983573 tries per task
[DATA] attacking http-get://134.122.105.9:31710/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[VERBOSE] Retrying connection for child 31
[VERBOSE] Retrying connection for child 20
[VERBOSE] Retrying connection for child 41
[VERBOSE] Retrying connection for child 33
[VERBOSE] Retrying connection for child 10
[VERBOSE] Retrying connection for child 58
[VERBOSE] Retrying connection for child 62
[VERBOSE] Retrying connection for child 7
[VERBOSE] Retrying connection for child 24
[VERBOSE] Retrying connection for child 50
[VERBOSE] Retrying connection for child 18
[VERBOSE] Retrying connection for child 49
[VERBOSE] Retrying connection for child 19
[VERBOSE] Retrying connection for child 30
[VERBOSE] Retrying connection for child 44
[VERBOSE] Retrying connection for child 6
[VERBOSE] Retrying connection for child 29
[VERBOSE] Retrying connection for child 59
[STATUS] 921.00 tries/min, 921 tries in 00:01h, 145982947702 to do in 2641747:10h, 64 active

[dim wolf]

macro installed

[uncut sequoia]

exposed !!

oh it actually exists

[verbal ice]

@autumn pilot linux ! It's the target in "GETTING STARTED Privilege Escalation" - basically they ask to copy the content of a file on the target to my Pownbox VM (won't spoil the exercice tho). Instead of copying/pasting i would like to send the file with scp, but i can't write the Pownbox IP properly it seems -> scp file htb-user@<IP>:~/Desktop i believe the IP is not standard since it's a VM on a HTB cluster, i thought it was htb-Numbers (what i can read on the terminal in the Pownbox) but it's seems that im wrong

[fathom pendant]

was there not a provided username list in resources?

[simple zephyr]

not that i can see, this is the command they highlight in the example.

 hydra -L /opt/useful/SecLists/Usernames/Names/names.txt -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou.txt -u -f 178.35.49.134 -s 32901 http-get /

[fathom pendant]

so if you look on the righthand side or bottom of the page there is not a "resources" button?

that's what I'm asking

[autumn pilot]

tun0 -> grep IP

[fathom pendant]

i'm not caring about the example; the example is just an example

[simple zephyr]

nope

[verbal ice]

Let me try this, obviously 😄 Thanks

[simple zephyr]

I can get the creds if I just run it with looking for either the user name or the password by itself but not like this

[fathom pendant]

have you tried with lowering the threadcount just to see if it's trying to run too many threads at a time?

[simple zephyr]

also ran it with default thread count

[autumn pilot]

are you sure you need http-get and not something else

[simple zephyr]

following the module, since its Basic HTTP Authentication its using the Request Method

[autumn pilot]

also, have you checked the target if it's working

[simple zephyr]

yeah because I was able to get it with just the user

hydra -L /usr/share/wordlists/seclists/Usernames/Names/names.txt -p admin -u -f 144.126.206.114 -s 31299 http-get / -vv -T 64  -I                                                                       ─╯
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-02-16 11:57:16
[WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 10177 login tries (l:10177/p:1), ~637 tries per task
[DATA] attacking http-get://144.126.206.114:31299/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[31299][http-get] host: 144.126.206.114   login: admin   password: admin
[STATUS] attack finished for 144.126.206.114 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-02-16 11:57:19

[autumn pilot]

okay, so what is the problem

[simple zephyr]

the module calls for you to use a password list and a user name list

[autumn pilot]

yes?

[simple zephyr]

─ hydra -L /usr/share/wordlists/seclists/Usernames/Names/names.txt -P /usr/share/wordlists/seclists/Passwords/darkweb2017-top100.txt -u -f 144.126.206.114 -s 31299 http-get / -vv  -I                    ─╯
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-02-16 11:58:13
[DATA] max 16 tasks per 1 server, overall 16 tasks, 1007523 login tries (l:10177/p:99), ~62971 tries per task
[DATA] attacking http-get://144.126.206.114:31299/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
[STATUS] 781.00 tries/min, 781 tries in 00:01h, 1006742 to do in 21:30h, 16 active
[VERBOSE] Retrying connection for child 12
[VERBOSE] Retrying connection for child 9

that is the results when running a username and password list

[thorn urchin]

sounds like you need a better list

[uncut sequoia]

I don't see any issues. Looks like it's retrying requests, but just turn off verbose

Unless it's failing all requests

[autumn pilot]

maybe with the 64 threads that you've done before that you could have DoS'sed the target

[uncut sequoia]

^

[simple zephyr]

ill reset and try that, the darkweb list was me just seeing if I would get a different result then using rockyou because admin isn't in the darkweb

[iron basin]

Anyone mind nudging, still stuck on trying to get the shell to work.

[graceful mortar]

Someone could help with this question?

Password Attacks - Pass the Ticket (PtP) from Linux

Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

I'm stuck here a long long time.

[fathom pendant]

trying to find the LINUX01$ ticket?

think: there is a service that runs the connection to the kerberos server - so there must be a filepath that relates to that service

[graceful mortar]

must i connect with root account?

[fathom pendant]

do you have the root password? remember you're only impersonating their KERBEROS information NOT their USER information

[rustic sage]

hello did anyone do the "Attacking LSASS" ?

[fathom pendant]

hint for finding the filepath to look into; it relates to Securing System Services

[graceful mortar]

svc_workstations is root

[fathom pendant]

@novel matrix

[fathom pendant]

well yes but that wasn't really the core of my hint

[rustic sage]

I got the hash only for the htb-student from the lsass.dmp file..

[fathom pendant]

also svc_workstations can switch to root; but is not inherently root

[rustic sage]

im not sure what the question is looking for..

[fathom pendant]

please change your name so you don't get whacked by mods with a name like "Andy McVerify"

[graceful mortar]

damn that is so confuse

[iron basin]

I did this module recently. You are going to need to be someone else beside david, and find where the kereberos tickets are located on the host.

[rustic sage]

Thank you!

[fathom pendant]

think about it this way; even as your user in your linux terminal you still need to use SUDO to do things

[fathom pendant]

if you have an account on http://hackthebox.com you can also verify that account in #bot-commands by typing in ++verify there

[iron basin]

@graceful mortar Look at the note under Identifying keytab files in cronjobs

As well the output of: realm list to see what groups can connect.. and what users you can impersonate that might have what you need

[rustic sage]

can anyone help me with the module "Attacking LSASS"

🙂

nvm

I am so blind..

[timber hatch]

oh man...i had the flag 60min ago...it always said it is not correct... search for another... than i thought okay..it has to be that..refreshed the page...said n not correct...then I searched again...nothing else found...
i logged out...logged in again i tried the same flag...said nope...really no joke..i searched again...have nothing found...tried again the same flag and the id says it is CORRECT?!?

so this is really annoying.....

[fathom pendant]

people are more willing to help if you provide more information in your question btw; just "i need help, or can anyone help" is broad. As I've finished the module/section it's best to ask more pointed questions such as I am in as {user} but can't seem to get {function} to work

[fathom pendant]

extra spaces can be a bitch I always go to the start hit backspace a few times, and end hit del a few times to be sure

[timber hatch]

i am really 99% sure i have checked blanks also from the beginning.......

[fathom pendant]

again even if you don't see a blank doesn't mean one can't be there

[timber hatch]

i know

[wind gust]

Can i get assistance on windows privilege escalation for the creds of bob_adm

[acoustic owl]

This question?

Using the techniques shown in this section, find the cleartext password for the bob_adm user on the target system

[wind gust]

is it the one in stuff.txt?

[acoustic owl]

what?
What section and question are you in? What do you need help with?

[wind gust]

windows priv esc module. section is 'other files'. question is what is the plaintext password for bob_adm. Im trying to replicate the steps in the section but i cant figure out the password

[acoustic owl]

Where do users like to store passwords? A solution was discussed in the module.

[fathom pendant]

in places that make sysadmins mad :)

[ripe grove]

hello, I'm trying to practice the section DNS Tunneling with Dnscat2 in module PIVOTING, TUNNELING, AND PORT FORWARDING. But when I try to run dnscat2.ps1 on the target I get: Import-Module : File C:\users\htb-student\Downloads\dnscat2.ps1 cannot be loaded. The file
C:\users\htb-student\Downloads\dnscat2.ps1 is not digitally signed. You cannot run this script on the current system.

I've tried both cmd and powershells as admin

[acoustic owl]

Set-ExecutionPolicy Bypass -Scope Process

[dim cosmos]

hi guys

[ripe grove]

thanks, that fixed it. I didn't see that covered in the section

[iron basin]

LLPE - Skill Assessment: Is it possible to || priv esc via the tomcat manager on that is hosting on port 8080? What about the user mrb3n, is it possible to find their creds as well? ||

[acoustic owl]

i don't know if it was mentioned in the module.
Here you can read more about execution policies
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-5.1

[ripe grove]

thanks

[fathom pendant]

disable real-time protection also works

[iron basin]

Linux Local Privilege Escalation - Skills Assessment: I pwned the box, but I don't think I went the route that the module was trying to make you do. Found another exploit and got root. Didn't utilize the vulnerable external services.

[acoustic owl]

Yes, || Polkit || works. But there is nothing to prevent you from trying the other way.

[compact raft]

anyone knows how can I connect to the target in Attacking SQL database module? So confusing.

[iron basin]

I was successful in trying the other way or actual route the module wanted you to go. || Up until the point of executing the war reverse shell file I uploaded via the tomcat manager. For some reason it wouldnt allow me access to the directory where the file I uploaded was but would allow me access to the other directories. Not sure if it is some configuration issue that I have to solve. ||

[iron basin]

Which section?

[compact raft]

I’m trying to answer the first question password for the mssqlsvc but i don’t know how can I connect to the target. Should I first connect to the ip with RDP or what?

sometimes I feel the direction is not clear or maybe me 🤪

[iron basin]

No

For accessing the database, do you know what kind it is? Mysql or mssql? @compact raft

[compact raft]

Yes and I did that and keep getting error

[iron basin]

How you access it depends on which one, and how to access it you'll find in the information at the/near the top of the page

What ye try?

[compact raft]

First MySQL and sqsh and impacket. Nothing working for me

I see port 1433 is open but nothing is working.

[iron basin]

Have you tried mssqlclient.py?

[compact raft]

Yup

[iron basin]

Have you tried --windows-auth flag with it?

Check the syntax on that flag tho

Away from computer rn

[compact raft]

Let me try that

[wind gust]

does juciypotato not work anymore? im trying it for the skills assessment for the window priv esc module

[acoustic owl]

Yes, it works, but you need the right CLSID
https://github.com/ohpe/juicy-potato/tree/master/Test

[magic valve]

I am stuck Password Attacks - Hard Lab. How do I download the .vhd file to my machine. Attempted smbclient and received a timeout error and also with crackmapexec utilizing module spiderplus to no avail.

[iron basin]

@magic valve scp

Or see if you can make a python web server

[magic valve]

Thank you. I will try

[iron basin]

That's how I did it

[ripe grove]

In section RDP and SOCKS Tunneling with SocksOverRDP of Tunneling mod, is there a reason why the Windows host is deleting dlls?

cause I'm trying to copy over the SocksOverRDP binaries

[acoustic owl]

#modules message

[ripe grove]

very frustrating

[hallow swift]

Hello! I need help in the "Footprinting" module, the "Easy lab" !

please help 🙂

[stoic swift]

One message removed from a suspended account.

[raven cairn]

very broad question haha

are you wanting to learn?

if so you are in the right place

[stoic swift]

One message removed from a suspended account.

[raven cairn]

So I personally would recommend picking a domain that you are interested in first

Then I would highly recommend certs. You can technically learn everything for free but Imho a cert is the most efficient way to learn. You don't need to compile your resources or find out what you don't know that you don't know. You also usually get labs for certs.

After that start using said knowledge from that cert

For example there are many entry level certs like OSCP, CPTS, PNPT, Etc that will help with some of the basics. Which one is right for you depends because everyone is different

So for example if your interest was learning webExploitation you could pick a cert, get said cert, and then practice BBs

This 'killchain' is how you would learn a certain domain.

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[raven cairn]

@stoic swift This is also a good resource

Also fundamental IT knowledge like Linux, WIndows, Web Applications, AD could be helpful for what you are interested in

[thorn urchin]

thats not really a getting started subject lol

even trashy basic rootkits that get caught by AV and EDR are still pretty advanced subjects

also out of the scope of this channel, this is for discussing academy modules

[raven cairn]

🤣

[low star]

For the life of me, I cant get the module Public Exploits to work. I keep re trying it every couple days, and have not gotten it to work. It always spawns on some weird port that just will not version check

any ideas ?

[raven cairn]

i can try to help

[low star]

thanks! I checked erratum. I know what is supposed to happen, I just cant do it

[raven cairn]

what module and section???

[low star]

I run the nmap scan on both the ip, and the ip + port. Nothing for both. One of the first ones, Public Exploits

[raven cairn]

is this on getting started?

[low star]

yes

[raven cairn]

Can i see the nmap error?

[low star]

No error, jsut no response. ```
nmap -sV -Pn -p 31423 $ip1
Starting Nmap 7.92 ( https://nmap.org ) at 2023-02-16 20:06 EST
Nmap scan report for 134.209.17.36
Host is up.

PORT STATE SERVICE VERSION
31423/tcp filtered unknown

or just

nmap -sV $ip1               
Starting Nmap 7.92 ( https://nmap.org ) at 2023-02-16 20:05 EST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.42 seconds

[raven cairn]

it's been a long time since I have done the module.

have you tried full port scan?

you are just scanning 1 port

[stoic swift]

One message removed from a suspended account.

[raven cairn]

it's just a good blogpost on getting started

[stoic swift]

One message removed from a suspended account.

One message removed from a suspended account.

One message removed from a suspended account.

[low star]

I have, Yeah. it was a while ago when I did that. Why would it give me a port?

[raven cairn]

one sec. I am going to try doing the section really quick on my machine

[stoic swift]

One message removed from a suspended account.

[raven cairn]

I have also tried the bash one liner and nmap ping sweep

[raven cairn]

Yes and no.

[thorn urchin]

bruh the website is for this discord server lol

[raven cairn]

have you tried looking at the ip and port in your browser?

[low star]

I have, I know what its supposed to do. Even knowing that, I have no luck. Did you get it to work?

[raven cairn]

well you should find the exploit for what is running

[low star]

imma just run a full scan and go watch puss in boots. Ill get back to yah

thank

[raven cairn]

no you are close lol. If you need more help just dm

also new puss in boots is great

[raven cairn]

use searchsploit or google

you should quite literally see many results for the exploit if you google it

then run said exploit in msfconsole and you are golden

I am confused lol. Defs overthinking. Help would be appreciated.

[hazy grotto]

Such a hard module.

[raven cairn]

Nm. Issue has been resolved

I don't know how i was supposed to know how to use that network tho lol

[remote briar]

you should clog chat for records so people can use search function 😛

[fathom pendant]

Bruh that's from months ago

[remote briar]

I know.

I was using the Discord search function as I implied

[raven cairn]

Really? I think this is one of the easier ones

[hazy grotto]

Thanks for rubbing it in jerk.

[raven cairn]

sorry

love you homie

[hazy grotto]

love you

[dim wolf]

the easiest module is password attacks

[tight mesa]

I'm working through academy from the pwnbox and none of the ip addresses are pinging. When I run the nmap scan it says host is down. What can I do?

[bronze jay]

hi i need help -.-

[raven cairn]

can i see the exact error? You might need to specify -Pn ?

[bronze jay]

in german pls ^^

[raven cairn]

Welcome! I don't know german haha. Have you read the #rules ?

[bronze jay]

hey ty @raven cairn yeah i had but my english is soooo bad and its so mutch to tell ^^

[tight mesa]

when I run -Pn

[raven cairn]

🫂

I don't know if there are many german speakers here tbh

😢

[tight mesa]

It's not allowing me to ping any target. I even changed modules

[bronze jay]

im sorry but i cant get rid of my hacker -.- are there any commands for cmd ? register cleaning or remove github ?

[thorn urchin]

not the server for that

[cloud skiff]

use Grammarly as well as google translate.

[bronze jay]

em okay do you meen it really ? i would like to post a job but when u say thats not the right server for me... than i found anyone else how made it ... i cant starting my iphone or else than i must pay 8k € its so f:::: SH!! -.- sorry when im wrong, its okay ... but anyone are intrestet the hacker to catch contakt me pls .. it gos about 7 month and now i had enaught .. i hope u all can understand it -.- i can not work .. im at home and than so much money wasted ,... sorry but thats my last chance

nono i must learn it again ^^

[tidal mango]

On the Windows Privilege Escalation Skills Assessment - Part I Question #2 Find the password for the ldapadmin account somewhere on the system. . After I escalated myself to nt authority\system, I am trying to run ||findstr /SIM /C:“ldapadmin” *.txt *.ini *.cfg *.config *.xml ||However, I get a memory error when trying to do this. Is there another way I should be doing this?

[low star]

The only port that is open is 53; and although that is valid, I feel like its not the direction it wants me to go

[thorn urchin]

this isnt tech support and this is literally against the rules, so fuck off.

[bronze jay]

its okay i say sorry

[thorn urchin]

no, sorry doesnt cut it

fuck off

[bronze jay]

i dont need support ^^

[shell marsh]

anyone who can help in IDS/IPS evasion medium level , job-role path

[analog tendon]

which module? the footprinting?

[shell marsh]

https://academy.hackthebox.com/module/19/section/106

[analog tendon]

ok yea this one

i DMd you

[dim cosmos]

starting the AD enumeration and attack module, wish my mental health good luck

[cunning drum]

All The Best . i am At The Ending Of The Module I Think Today Will Be Last Day For Me At Ad Enum And Attack Module .

[dim cosmos]

How did you find it ?

[cunning drum]

Fun 😊

Very interesting

Frustrated

All in one 😂

@dim cosmos just be consistent

[waxen barn]

Did you figure this out?

[waxen barn]

Good luck! The skills assessments are challenging but fun.

[rapid kiln]

Hi @here Can anyone help me FILE UPLOAD ATTACKS Whitelist Filters

[short cradle]

Hello, does anyone know the answer to this question? I guess it's not SQL injection.
What is the 2021 OWASP Top 10 classification for this vulnerability?
I keep seeing Broken Access Control at the top of the list.

[short cradle]

A03:2021-Injection

[young osprey]

what programming language do you use here?

how can I learn here?

[autumn pilot]

depends

[timber hatch]

port forwarding and tunneling, part with netsh.
could somebody explain this. i dont get it

[willow roost]

Is it just the port forwarding aspect you don't get?

[timber hatch]

They use this command in the explanation: Using Netsh.exe to Port Forward ==> C:\Windows\system32> netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.25

and after that they verify: netsh.exe interface portproxy show v4tov4 and the output is this:

the verifying part does not match with the specified ips above, right?

[autumn pilot]

those are examples

the point is that your spawned target can communicate internally on a different network with another machine (windows server)

not sure if my diagram is understandable, but at least can build some more friendlier look

[timber hatch]

thanks a lot!

[timber hatch]

i did this:

but it did not work. do i totally not udnerstand it...? or a small error?

[timber hatch]

never mind...had a typo...

[sudden galleon]

Hi, did you find a way for privesc ? Could you give me a hint ?

[chilly forge]

Hi, in SQLMap essentials: Running SQLMap on an HTTP Request
I've run SQLMap to get all the DB entries, which display in my shell.
The question is: What's the contents of table flag2? (Case #2)
What does HTB mean by this?

[placid quest]

@sudden galleon ssh with root

[chilly forge]

I see the entire table (which I'm assuming is flag2?). Do I need to enter a flag? Cause I cant find any. I tried the table name, but I don't see any other input I could give (besides guessing what the type of data would be, like credentials, users, etc.)

[devout torrent]

https://tenor.com/view/cat-whatever-cool-smooth-cute-gif-19939517

That feeling when you do Attacking Common Services - Easy for hours, and then you do Attacking Common Services - Medium in 5 minutes

[true belfry]

The flag is an actual row in one of the columns of that table.

[sudden galleon]

I got the flag! Thanks a lot!

[placid quest]

@sudden galleon no problem

[chilly forge]

I must be doing something wrong then 😛 I don't see any flag. Is it the HTB{Randommumbojumo} format?

[true belfry]

Yes

If you did things right and there was no data in the table, try resetting your target. It's weird though.

[chilly forge]

There is data in the table (32 rows). It's just.. all "normal" user data. There is a random string at the bottom but I tried that, that's not the flag either

[true belfry]

If I remember correctly, there should only be 1 row in that table.

[chilly forge]

In firefox I did CTRL+F '{' but it returned nothing

[true belfry]

DM me what you tried and the result. I'll reply to it in a bit, making lunch :p

[chilly forge]

Thankss!

[solid sage]

Module :Password-Attacks
Section :Protected-Archives:
i am unable to crack Kira's file Notes.zip.
I tried Hashcat , John , didn’t works. Any hint?

[hallow swift]

Module : Footprinting
Section : Easy lab

[hallow swift]

I need Help with this please!

[twilit gull]

which wordlist are you using? Use the one given in the htb. You will get the password by using John.

[twilit gull]

what do you need help with?

[hallow swift]

oooh, I was using rockyou

[hallow swift]

I will try! thanks evil man

[twilit gull]

it's the same password.

[echo roost]

You have to use zip2john first > file.txt then crack with john or use fcrackzip

[solid sage]

Aha ok i will try thanks

[solid sage]

Yes i did but i think i will use the mut.list and try again, thanks

[twilit gull]

that suggestion was for different person, can you tell me where you got struck?

[hallow swift]

yeah I notice that, I am still trying. there's only one question

[twilit gull]

It's not a huge password, so don't waste time by waiting for a long time. It will give you immediately or else you are doing something wrong.

[twilit gull]

all the best, if you have any doubts ping me.

[hallow swift]

but do I have to get a hash then use john? I used ssh-audit.py

they gave me ssh credentials in the hint

[twilit gull]

I'm confused now, are you talking about the footprinting one or the password attacks module

[hallow swift]

the footprinting, the easy lab

[twilit gull]

for this, download all the files from ftp 2121
chnage the permissions of the file
search for the flag after login.
Hope this should help.

[livid bluff]

Hi,
On footprinting module in IMPI section.
At the last question we need enter the password.
I have dump the hash with metasploit.
I use hashcat with the command in the course, it has been running for a while without result.
Metasploit didn't decrypt it either and I can't find any way to decrypt it.

[hallow swift]

that help a lot! I will try, thanks

[twilit gull]

it all depends on the wordlist you use.

[hallow swift]

I think you have to use rockyou

or another wordlist

but not the default metasploit gaves you

[livid bluff]

Oh yes i understand my error it's good, thanks !

[hallow swift]

well I try nc, telnet, openssl, ftp and I couldn't find anything 🤔

[twilit gull]

Are you sure did you scan with nmap and check what services were running?

[hallow swift]

well nmap -sV gave me this:
21/tcp open ftp?
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
53/tcp open domain ISC BIND 9.16.1 (Ubuntu Linux)
2121/tcp open ftp ProFTPD

[twilit gull]

did you brute force the ftp service

[hallow swift]

you mean with the nmap script ftp-brute ?

[twilit gull]

No there is a wordlist given in the resouces, use it and bruteforce the ftp servive using hydra or any brute force tool.

[twilit gull]

..

[hallow swift]

I can't find the resources

the footprinting module the easy lab

maaaaan

there I found it

sorry I didn't see it

[twilit gull]

When you open the htb footprinting module, check at the right side of your screen there will be an option called "Resources". Download from there.

[twilit gull]

no worries, mate.

[hallow swift]

thanks

[spare condor]

Anyone on this one?

[dim wolf]

what..?

[cinder mortar]

Module : Footfrinting, Section : DNS
Hello, the first question of this section is: Interact with the target DNS using its IP address and enumerate the FQDN of it for the “inlanefreight.htb” domain.

I don’t know what exactly are they asking for. Is there any FQDN like HTB{xxxx}?
tks

[dim wolf]

they're asking for a FQDN

the FQDN of the IP address

[lethal atlas]

FQDN (fully qualified domain name)

[ashen fog]

Module Footprinting Section SMTP:
Question:
Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer.
This is what i have tried
telnet <IP> 25
Tried with VRFY different Username
Do i have to use smtp-user-enum??

[solid sage]

i got the same result 0 cracked , i might doing smth wrong )

[twilit gull]

can you send me the command you used

[bleak willow]

Hi im in "Shells and Payloads" module in the Live engagement and idk what to do with the host 1, i tried all the upload exploits with different configurations with the correct interface ip and nothing.. Any hint please?

[twilit gull]

did you try onesixtystone tool

[bleak willow]

i know about the lhost part but its a apache server, it doesn't have smb

[faint rampart]

There are 2 ways, DM for specifics

[solid sage]

ok

[ashen fog]

No not yet. The hint was:On systems usernames are often named after the employee's name. We recommend to use the Footprinting-wordlist provided as resource. Remember that some SMTP servers have higher response times.

[twilit gull]

what happend when you tried to upload the war file?

[ashen fog]

So i used a couple of name text files in /opt/useful/SecLists/Usernames/Names/ non of them returned results

[twilit gull]

you should use the lists that are present in the resources. If you open the module, and check at the top right corner you will find resources click on it and download the files and use them.

[ashen fog]

IM STUPID THANKS

[sudden galleon]

Hi, Have you found a way to mount it ? I tried with 'guestmount' but i received some errors after insert bitlocker password

[torn blade]

so im on the command line injection module for bug bounty training, no matter what i do i cant seem to be able to pull up the target page in my browser

nvm i used the power of restart instnace and it fixed it

[dim wolf]

try this https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

[sudden galleon]

Yes, after try hard a little i opened vhd on windows box and got files. Thanks anyway

[dim wolf]

trying hard huh

isn't that the offsec motto

[sudden galleon]

ook 🙂 bye

[dim wolf]

??

[graceful parrot]

#Module Password Attacks

Section Pass the Ticket (PtT) from Linux

Question : Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.

The flag retrieved isn't accepted.
Can someone help me with this part?

[dim wolf]

get the file and cat it on your attack box

[west anvil]

Anyone stuck on the "Footprinting Lab - Hard" ? I could discover the SNMP-Server running on v3. As far as I know, v3 does not support/allow any community-strings, right?
Everything I read about the lab was about finding the right community-string, but it seems impossible to me in this case. Could nmap give me a wrong version of the snmp-server?

[graceful parrot]

of course yes but error appears

JuL1()_xxx_xxxx

[dim wolf]

iirc one of those domain share files has garbled text in it and i don't remember if it was that one or not

if it's not accepting the flag just make sure there are no trailing whitespaces

[graceful parrot]

I've tried all of that, with spaces and without spaces and it doesn't work

[dim wolf]

i'm not sure then

[dim wolf]

i never did a version scan but you might want to try anyway

[torn blade]

Ik the answer to this but HTB is saying its wrong

https://academy.hackthebox.com/module/109/section/1035

like ive used burp and Ik which operator isnt blacklisted but putting it in says incorrect

like i feel bad cause i had to hit the discord request help button but this is like 100% something simple i must be missing

[west anvil]

I'm pretty sure it's v3 after doing some more research.

[dim wolf]

can't hurt to try and find the string anyway, right?

[sick sphinx]

when i open an instance it turns blank does anyone know how to solve this?

[faint rampart]

Yeah I had this same question, because v3 uses username/authentication not community strings but I just treated it like I would a v2c and it worked lol

[west anvil]

lol, tried the same with onesixtyone but wasn't successful

[faint rampart]

try again look closely at the results, both snmp dictionaries from seclists actually work. XD

[analog tendon]

how fast do you have onesixtyone running?

[west anvil]

just tried another snmp-dictionary... it worked!

Still confused, why this works with v3

snmpwalk works with the -v2c flag tho. Nmap might have tricked us

[rotund meteor]

Guys related to cybersecurity certs how often should i get one?

[dim wolf]

you might want to ask that in #careers-and-certs

[rotund meteor]

No channel like this

[dim wolf]

check #welcome for instructions

[rotund meteor]

Yes there is nothing related

[dim wolf]

#welcome message

[rotund meteor]

?

Verification?

[dim wolf]

yeah

you need to verify yourself to see the rest of the channels

it might be ok to ask in #cpts but it's probably safer to ask in the other channel

[sick sphinx]

this is only applicable if i'd want to connect with my own computer instead of an instance right?

[opal lantern]

Yep, you will use that file to connect to vpn

[sick sphinx]

any idea why instances just blank out the whole time?

im using chrome dont know if thats the issue

[analog tendon]

resources? not sure. its better practice to use your own VM

[rotund meteor]

Now it is initiated or not?

@dim wolf

[dim wolf]

i don't think so

[rotund meteor]

What did wrong?

[dim wolf]

i'm not sure..

[livid bluff]

Hi,
Anyone have a hint for me for the Footprinting Lab - Medium
I'm connected with the RDP but I can't find any clues to get the database username and password.

[acoustic owl]

There is an || „important“ || file

[livid bluff]

Yes, thank you, I've looked around and I don't see which file it is.
It is certainly very stupid but I can't find it.

[acoustic owl]

DM

[graceful mortar]

Where's Kira cracked password in Passwod attacks module: Protected files?

Use the cracked password of the user Kira and log in to the host and crack the "id_rsa" SSH key. Then, submit the password for the SSH key as the answer.

I didnt understand this question

[acoustic owl]

ssh key are normally located here:
~/.ssh

[graceful mortar]

@acoustic owl ok but how i connect to the ssh?

[acoustic owl]

ssh user@ip

[graceful mortar]

lol

i dont have the target password

The question dont give me Kira cracked password

[acoustic owl]

You cracked the password in a previous lesson, right?

[graceful mortar]

i dont remember

lol

[thorn urchin]

thats a module where you really want to be logging that sort of thing lul

[graceful mortar]

F

@acoustic owl previous lesson i cracked david, julio and john

not kira

[timber hatch]

i transfer the chisel binary to a host, and than when i do: ./chisel server -v -p 1234 --socks5
comes this:

what am i doing wrong?

[acoustic owl]

Have a look at the section Credential Hunting in Linux

[simple zephyr]

Question on SQL Map - I am finding the flag, but I can't seem to find out the why. For example Case #6 hint. I have looked through burp and inspected the page and can not find out what would have lead to me that hint.

[graceful mortar]

@acoustic owl lol i need to do this lesson again to get kira password?

[acoustic owl]

If you have not noted the creds, then yes

[lyric inlet]

Hi, anyone for HttpMisconfiguration Skills Hard ? Payload locally works I'm not sure admin bot working

[acoustic owl]

Write down each command you use and the corresponding output. You might need these things again.

[graceful mortar]

im crying now

[fathom pendant]

The pass attacks module you will bounce back and forth between the same sets of users

[timber hatch]

has anybody done the pivot tunneling modul part socks5 tunneling with chisel and knows why this error occurs when i transfer the chisel binary to the ubuntu host.
./chisel: error while loading shared libraries: libgo.so.21: cannot open shared object file: No such file or directory

this error occurs aftr i do: ./chisel server -v -p 1234 --socks5

might be a bug at that modul...

[acoustic owl]

Have you tried to re-download Chisel?

https://github.com/jpillora/chisel/releases

[timber hatch]

yes

and at my own host the command is working fine

I think it is already reported

[acoustic owl]

Try to download an older version of Chisel.

The module was released on 3 June 22. Take a version of Chisel from that time.

Maybe 1.7.7 will work
https://github.com/jpillora/chisel/releases/tag/v1.7.7

[timber hatch]

thanks i will try

[autumn pilot]

yeah, try an older version

[timber hatch]

this version did not work

[acoustic owl]

Same error?

[timber hatch]

yes

and at my own host it is wrking fine again

[acoustic owl]

Did you compile yourself or did you download the binaries?

If you have compiled yourself, try downloading the binaries and see if the error still exists.

[timber hatch]

compiled myself. will try that. thanks

[quiet surge]

I've spent the last hour trying to get pypykatz to run on the pwnbox. It's still not working. Anyone know of an alternative I can try to dump hashes from an lsass.dmp file? preferrably something that is not python 😅

[timber hatch]

could i dm you? i have a qustion regarding the pre compiled file

[acoustic owl]

sure

[quiet surge]

For future reference, this works for me (if you do it before you break it):
pip3 install --upgrade pyopenssl==22.1.0 pip3 install pypykatz pip3 install --upgrade minikerberos==0.3.5

[gloomy hawk]

Hello hackers, I'm finishing the "Doc.. & Report..." module and i found this "error" about the DISPLAY var

I use export yo change but none, i searching in internet but i dont know if change the pwnedbox config

[gloomy hawk]

Sorry my english jajaja

[simple zephyr]

SQLMAP Essentials Case#7 can I get a sanity check on my syntax for my SQLMAP

sqlmap --flush-session -u 'http://178.62.20.33:32615/case7.php?id=1' --level=5 --risk=3 --union-cols=1-5 --technique=U --dump 

[true belfry]

You're missing some details in your command. Take a look at the request when you try it on the browser. What else should you add?

[true belfry]

What's case 7? I can't remember the details

DM me with a screenshot of the regular request from a browser and I'll try to guide you 🙂

[simple zephyr]

yeah your missing one important thing look at what you received over burp

[simple zephyr]

yeah case 7

now i got it and all i did was remove batch

yup the answer is staring at you in the face

[dim wolf]

no..

[simple zephyr]

"/login.php:user=^USER^&pass=^PASS^:F=<form name='log-in'"```

look at this

also, i wouldn't use the entire rockyou

[cyan oar]

I'm working through AD Enumeration & Attacks, and I have a question about the Internal Password Spraying from Linux section. When I run enum4linux and rpcclient, I get the same user list - about 500 users. When I run CME, I get a much larger list - about 2000 users. I've reloaded the box and this result reproduces on the second load. Does anyone know why the difference exists across tools?

[simple zephyr]

theres faster ways to do rockyou which they cover in the module

unless you want to just run it and leave

[true belfry]

What's the question on the page for case 7? That's what I can't remember

[simple zephyr]

you just have to get the flag from using SQL Map i ended up getting it

i honestly have no clue why my commands didn't work though. if i identified -T flag7 it would fail and if I batched it would fail. Then when I ran it without those like in the example that i gave it worked on the second time

must be a gremlin

[hazy grotto]

Its friday friday. Gonna get down on friday

[vocal musk]

In the module "Windows Privilege Escalation" , section "Credential Hunting", it's asking for a plaintext password as the answer. I have tried every password from "findstr", web.config, and the powershell history (all have passwords in cleartext) but none of them are accepted as the correct answer. The section also suggested looking for Unattend.xml (but it doesn't exist). Has anyone found the correct answer? Any help is appreciated. Thanks!

for what it's worth, i searched the chat history and 2 other people have found the same issue but no solutions seem to have been provided

[thorn urchin]

have you looked for any application specific passwords?

[vocal musk]

maybe it's a bug

[thorn urchin]

not a bug

[vocal musk]

these look to be the only 2 hits for application specific passwords

that passwords.txt file is full of passwords (too many to try w/o losing my mind) 🙂

[thorn urchin]

thats not a real passwords.txt so can be ignored

thats a chrome thingy

[vocal musk]

using the syntax from the module, it suggest using the following : findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml

there's a "stuff.txt" file that looks interesting but it doesn't like it

[thorn urchin]

hint suggests start at C:\Users

[vocal musk]

tons of output to look through, will see what i can come up with - thanks

[thorn urchin]

keep in mind the findstr commands starts looking from the directory youre currently in

this section is kinda annoying cause there are a couple diff cleartext passwords to find

[vocal musk]

yes, there are more than a few :/

[thorn urchin]

but I did just verify that the box is still working

[vocal musk]

this let me specify c:\users : findstr /SIM /C:"password" "c:\users*"

[thorn urchin]

never tried findstr like that

[vocal musk]

there's a "slash" not showing up in that command after users but before the asterisk - fwiw - discord is truncating it 🤷‍♂️

[thorn urchin]

ye, still never used findstr trying to specifiy a full path with wildcard

Ill trust ya if you say it works like that, just saying its not how I managed to complete the section.

[simple zephyr]

this SQLMAP Module is making my head hurt for case 8 how does this look

||```rust
sqlmap --flush-session -u "http://178.62.20.33:31952/case8.php" --data="id=1&t0ken=CEoRAX8CzzsOp8GL1CvNJro0nSW8s8dbw56hryqcOP0" --csrf-token="t0ken" --batch --dump

Burp Intercept

||```rust
POST /case8.php HTTP/1.1

Host: 178.62.20.33:31952

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

Content-Length: 54

Origin: http://178.62.20.33:31952

Connection: close

Referer: http://178.62.20.33:31952/case8.php

Cookie: PHPSESSID=nqpms2o435bn3e6olfghd9lhqq

Upgrade-Insecure-Requests: 1



id=1&t0ken=CEoRAX8CzzsOp8GL1CvNJro0nSW8s8dbw56hryqcOP0
```||

end of my results

```rust
[16:33:08] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[16:33:14] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[16:33:19] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[16:33:25] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[16:33:30] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK - comment)'
[16:33:33] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK)'
[16:33:35] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[16:33:41] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)'
[16:33:46] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SLEEP)'
[16:33:52] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SLEEP)'
[16:34:52] [CRITICAL] anti-CSRF token 't0ken' can't be found at 'http://178.62.20.33:31952/case8.php'. You can try to rerun by providing a valid value for option '--csrf-url'

[solid quarry]

Need help in the last flag "crackmapexec skill assessment"

[vocal musk]

btw, this is really helpful to ignore error lines

i got it! thanks again @thorn urchin

[thorn urchin]

np

[proud pine]

Not sure what you mean by 'does not work as intended', but it should definitely work.

I encountered no bugs with this module. You might want to go over everything again, and make sure all of your parameters are correct.

[nova dove]

guys m stuck at the find flag at / directory at file inclusion part rce help pls

[stuck flame]

Hi, I have a problem with module footprinting -> dns -> What is the FQDN of the host where the last octet ends with "x.x.x.203"? I have tried everything but I can't find this last question can someone help me?

[fathom pendant]

Subdomains of subdomains

That's just in the inlanefreight axfr you can go deeper. Try zone transferring to any of the other subdomains

[stuck flame]

ok I re try thx

[nova dove]

. Help pls

[dim cosmos]

hi everyone 🙂

[magic valve]

I am stuck Password Attacks - Hard Lab. I’ve been attempting to mount the .vhd file to my machine. May I dm someone on the steps I’m using to mount the .vhd file?

[late wave]

Hello everyone! I'm trying to get this answer from the Command Prompt Basic. the question is :In what directory can the cmd executable be found? (just the folder name as answer) hint: there are 32 flavors of files and folders in this directory located at "C:\Windows" I have been stuck on this thing for two days now. If anyone can lead me in the right direction that will be great. 🙂

[magic valve]

Try googling command prompt location in Windows

[late wave]

@magic valve I will do that. thanks for the info 🙂

[magic valve]

No problem

[stiff python]

Hi, any idea how to do an automatic process migration as soon as a reverse shell is open? something like a script or something

[rustic sage]

Have you found any interesting files that may help you with rce?

[shadow canopy]

DM if still stuck

[rustic sage]

if you have a meterpreter shell you can use migrate for that

[uncut sequoia]

You can use session startup scripts in metasploit

[placid quest]

@late wave what if the answer is Syst--32

[robust adder]

can we connect to the modules through vpn
or can we only solve through pwnbox

could someone send a guide if possible

[knotty quest]

There are instructions in the "Getting Started" module, it is probably also in one of the FAQ's.

[robust adder]

tried those didnt work

[knotty quest]

So you followed the official guide and now you are looking for another guide? Perhaps you should be describing the problem you are having instead?

[robust adder]

ok so i can connect to the vpn with the ovpn file
but i cant access the spawned target

[knotty quest]

You are connecting to the vpn within your Linux box and are getting your tun0 adapter?

[robust adder]

yes i connect to the vpn through my virtual machine

[knotty quest]

You are seeing your tun0 adapter? It should just work unless you have a weird networking setup on your side, or you have connected to multiple VPN's or connected multiple times.

[graceful mortar]

hi, i'm stuck to get initial creds in the Password Attacks Medium lab, someone can help?

[lyric inlet]

Hi, Anyone for HTTPMisconfiguration Skills assessment 2 ? Just one problem to ask

[shadow verge]

@lyric inlet what is the question?

[lyric inlet]

@shadow verge I have a working payload, I have a doubt if the admin bot connect to the vulnerable webpage

@I can mp you ?

[shadow verge]

okay

[knotty quest]

You can try a traceroute to the target IP and make sure it is passing through the tun0 gateway. Other then that, can't really help you mate. Nobody knows what setup you have except you and attempting to obtain one piece of information at a time takes way too long.

[robust adder]

ohk thanks for your help

[spare condor]

Still haven't received an answer on this one. Anyone?

[graceful mortar]

anybody knows why i got this error using crackmapexec in pwnbox? in my kali linux it works....

[autumn pilot]

are you sure that this is the name of the file

[dim cosmos]

need --local-auth?

[autumn pilot]

nope, as he is passing a file which actually is not a file

therefore it gets considered as a password

[chilly forge]

@graceful mortar use the absolute path for your password file (/home/htb-/mut_password.list)

Can anyone give me a hint on Case 5 of Attacktuning of SQLMap essentials?

[acoustic owl]

Increase the || level and risk ||

[chilly forge]

Ah i'll give that a try! Thank you

[knotty quest]

The version on pwnbox is a bit wonky and doesn't handle file resolution very well. As ccjell suggested, use the absolute path or since you are in your home directory you can also use ~/mut_password.list

[dim cosmos]

makes sense

[dim cosmos]

anyone have a rough idea how long the Get-DomainObjectACL command takes to run in the AD enumeration module?

not sure if its borked and i need to reset

[proud pine]

Were you using the wildcard identity?

If so, it can take a LOT of time.

I would recommend setting it to a variable, without any parsing, in case you need to check multiple times. Something like

$variable = Get-DomainObjectACL -Identity *

[dim cosmos]

yes wildcard identity

[proud pine]

That way, you can always just pipe from the variable instead.

[dim cosmos]

oic, nice tip, many thanks

[proud pine]

If you change anything, obviously the variable won't reflect that. However, I'd always set up a baseline variable with it, since waiting 5-10 minutes for it to finish each time is not great.

[dim cosmos]

i actually just changed it from wildcard to the specific CN i was interested in

didnt realise teh wildcard would make it such a long wait 😛

[proud pine]

That works if you want to know what has an ACL over the specific entity, but not if you want to know what the entity has over others.

[dim cosmos]

yeh the question just asks for objectacetype a user has over a named group

"What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)"

[dim cosmos]

reported

https://tenor.com/view/wolf-of-wall-street-rookie-numbers-gif-20904132

[vital adder]

@novel matrix

[inner talon]

Buddy, did you finally get out ahead of it?

[stuck flame]

yes thanks you

[inner talon]

would you have any hints for me? it's been 2 days that I can't get through it

[stuck flame]

you try to find a subdomain of a subdomain but don't dwell on internal it leads to nothing

and i have a question, how did you get the "academy user "on discord rank?

[dim cosmos]

using #bot-commands i think from memory

[novel matrix]

Booted

[dim cosmos]

shame, i was looking forward to 47k per day

[ripe badge]

I found it there too. I think it's supposed to be like this. Tried to rdp on the ip 172.16.10.5 - i thought this is the one of the DC but never mind.

[stuck flame]

yea but i have no api key on my accounts academy.hackthebox

[nova dove]

Yes I gained access on command shell and when I did ls it shows me root files with akshakhdjansbpdhdkahsnd.txt I thought it's flag but it's not m stuck there

[pure cosmos]

Heya,i new in this world,i want get more skill and start working in cyber security,what you can recomendate first module or path for beginner?

[graceful mortar]

some tips to Password Attacks Hard lab?

[pure cosmos]

it is recomendation?

[graceful mortar]

i'm stuck in this lab

kkkrying

[pure cosmos]

in this lab you try hack password?

[graceful mortar]

im trying

crack johanna

failing miserably

[rustic sage]

There should be only one file in the root directory like /flagYadayadayada.txt
Feel free to DM

[dull zinc]

Login Brute Forcing - Skills Assessment - Service Login, first part: I'm at the end of my wits here, getting 25 attempts/minute and looking at 24 hours of brute forcing a container that is reset every 90 minutes or so. If I had enemies, this is the challenge I would send them. Anyone, please? DM ok.
(I know the employee name, I have used both anarchy and cupp to create my lists, and I know how to use hydra)

[graceful mortar]

should i use rockyou to crack johanna account in password attacks lab -hard?

[autumn pilot]

the password of that user is quite simple

[graceful mortar]

cracking about 40 min

around*

with mut_passwords.list

:/

[devout torrent]

Did you remove all entries discussed in previous sections?

And I hoped you used the hint “first start only with first name”

[rustic sage]

Hello guys for the "Hunting Credential in Linux" , the hint gave me username and password which is Kira and LoveYou1 but when I ssh given username and password it says password is wrong am I doing something wrong here?

:(...

[dull zinc]

i have done my sed's.. i did start with just the first name, but i then added another name.. and then set a couple of the yes/no params.. and now i'm having a bad day 🙂

[devout torrent]

It’s been a while but I am 90% sure you need only first name to generate the correct password

[dull zinc]

not even the y/n stuff? i did read the forum after a while, and there was a hint that this might be required
i just had to reset and am getting a blistering 580 requests/minute right now, so maybe this will work

[devout torrent]

I would suggest you run the brute forcing in pwnbox instead of openvpn as well , I had some problems getting the correct passwords in brute forcing module via openvpn

@dull zinc first name with all the yes/no options

[fathom pendant]

I had no issues

With my machine

[dull zinc]

thing is, the password list is not that long, but combined with the userlist it becomes .. well .. difficult

[fathom pendant]

If SMTP is open, you may be able to verify users first that way

[dull zinc]

docker instance, not a vm, unfortunately

i seem to remember another brute forcing thing from another module where there was an ftp port open also that could be used, but ssh is horrible

[fathom pendant]

Ssh is a last resort

As it's the slowest

[slender kelp]

hey, I'm on the module "network enumeration with nmap", module "host and port scanning". seems like to matter what arguments i supply nmap with I can't get it to divulge the hostname of my target?

[fathom pendant]

DM me one of your outputs

You also may want to closely look at the Packet - trace results

[slender kelp]

thanks, that's one argument that I haven't tried actually. I'll have a look

tried to grep the results but I'm not entirely sure what to grep. I

I've scrolled through the results, about 2000 lines and still can't find it

[fathom pendant]

Double check the commands given in that section

[slender kelp]

I ran another command in parallel that I found through some googling and eventually found the hostname. Reading up on specific options now to see which one of them was the responsible. Thanks a lot for the help 🙂

[modest isle]

Did you try the -A switch?

[modest isle]

I mean before the googling

[slender kelp]

I don't believe so. Also I just found out that the -sV switch alone didn't reveal the hostname. what I found by googling was ||nmap -PR -sS -sU -sV -O -T4 IP||. It worked but took 20 minutes. I'll try to experiment a bit more, and add the -A switch

[fathom pendant]

That's too much

Lol

[slender kelp]

Yeah I'm not getting a response at all now it seems, haha

[fathom pendant]

The reason it took so long is because -sV does a version scan, -O is another scan that runs after to attempt to discover the OS

[slender kelp]

The weird thing is I did -O by itself before but it didn't reveal the hostname, neither did -sV by itself. But yeah, I might've accidentally abused the target a bit so currently respawning it 🙂

..Yeah, -A was quick and got me the info from a fresh target. Not sure why the hostname was truncated by 1 character in parts of the result but it worked. Thanks all, on to the next section 😎

[vital adder]

finally 🥲

[acoustic owl]

Congrats!

[vital adder]

thanks, now that weird looking man with the cigar can finally stop kicking me in my nut

also should write a test report for this? (and maybe send it to mrb3n for grading 🤣) after this i will say goodbye to society for a week for the exam and maybe a few day after that for emotional recovery if i fail but i got 162 note file in obsidian so the reporting is going to be fun

[acoustic owl]

I know that
Every time you think you're close, he stands there and hits you with the spoon.

Good luck with the exam

[vital adder]

yeah this is actually kinda true for offshore 🤣

[compact raft]

Attacking DNS room how long subbrute tacking to complete?

[west canopy]

awesome work Tom!!!

[eager pasture]

How to enable VT-x in Kali Linux

[wind totem]

I'm running into stability issues with the target machine for module 103 (XSS). The target machine frequently hangs and stops replying to pings & http requests. I've tried resetting the machine, but that doesn't seem to help much.

[manic bough]

This is an absurd joke, working through a module, terminate the instance cause I had some things to do and didn't want the time to run out, came back to continue through module later in the day, needed to spawn it again, but unless you pay for a plan vs buying cubes you can only spawn it once a day. scam.

[dry parrot]

can someone help me with the Directory Indexin - HACKING WP module?

[mossy hatch]

Hi, i'm currently on the intro to pyhon 3 module in "Continuously Improving The Code" section and i cant reveal the answer (also i cant see the hints in any modules) is it normal ?

[mint dagger]

Hi everybody. I am working in the Skills Assessment -Web Fuzzing (Attacking Web Applications with FFUF). I cannot get the right answer the following question:

Before you run your page fuzzing scan, you should first run an extension fuzzing scan. What are the different extensions accepted by the domains?
My answer: php, phps

But it is marked as wrong. I have the following identified vhosts: test, archive,faculty. I couldn't find any subdomain :(. I am not sure what I am doing wrong
I need help! Thanks 🙂

[sinful olive]

There is another extention.. search in faculty... (write the answer without ,)

[timid osprey]

for those doing Enumerating & Footprinting Services module which is part of CPTS, i have created this map which can help. just note many commands are out of what have been mentioned in the module. https://github.com/Osiris-OM/Cheat-sheet

hopefully it will be of help to someone

[placid quest]

@timid osprey 😥

[vast lichen]

anyone solve COMMAND INJECTIONS - Skills Assessment ?

[cerulean crow]

Did you ever figure it out?

[rustic sage]

Yeap

[cerulean crow]

For password attacks, can I get someone's hash of the mutated wordlist?

Mine seems to be incorrect

[sly tapir]

dang, i have new respect for Metasploit...this module is pretty fun

[golden vortex]

Can anyone help me on file inclusion assessment? I found hidden page and i know i need to exploit server log poisoning but the payloads dont work

[fathom pendant]

You have to mutate that password and also lowercase

[fathom pendant]

If you created the mutated list using the custom.rule and password.list from the resources you should be fine

[dim cosmos]

hi guys

[cerulean crow]

When I run the created list against the root user in Passwd, Shadow & Opasswd, I get no hits

Maybe my hashcat invocation is wrong?

I cant even recover Kira's password which I was able to bruteforce with hydra with the mutated wordlist

[fathom pendant]

Did you do the unshadow; not to mention cutting the list down to just the users you need that cuts the time significantly

[dim cosmos]

I'm doing abusing ACL's. I can change the damundsen password if I start a powershell session as wley but if i stick in the htb-user powershell and do the $secpassword and $cred objects I get errors when I try to do the Set-DomainUserPassword command with these credentials .... any ideas why?

[cerulean crow]

I exhaust the password list before finding matching password, even for the Kira user, and yes, I unshadowed

[fathom pendant]

Try rockyou then

[cerulean crow]

Did that as well, unfortunately

I have to have screwed something up but I don't know what

[fathom pendant]

Then idk what to tell you bro try recreating the wordlist with the rule and password and try again

[dim cosmos]

working now, i must have made a typo or something

[magic valve]

May I have some assistance with Password Attacks - Hard Lab. I cracked the hash for the .vhd file. I’m unable to mount it with guestmount. Looks like it is all processing correctly and asks for the passphrase and I input it and continues to process with no errors it seems. When I navigate to the directory where I mounted it nothing is there.

[fathom pendant]

If you're on a windows main system just mount it on your system

[dim cosmos]

or use a windows vm

[fathom pendant]

Or that

[magic valve]

Oh okay. I was attempting through my Kali vm

[dim cosmos]

nah needs windows

[magic valve]

Gotcha. Thank you @dim cosmos and @fathom pendant

[dim cosmos]

🤜

cant believe how much im learning in this AD enumeration and attack module

[golden vortex]

Can anyone help me on file inclusion assessment? I found hidden page and i know i need to exploit server log poisoning but the payloads dont work

[dark hollow]

Need some help on Linux Privilege Escalation/Special Permissions... I am not understanding the questions being asked to answere. What are they looking for?

[devout flint]

need help with the sqlmap essentials skill assestment, i already found the injectable parameter

it is missing the password parameter

for hydra you need both, a username and a password

if i remember correctly, there is a hint in the login of the page, in the question before

you need to create a dictionary for username and other for passwords

[fathom pendant]

try mounting using the disk management tool

then it lets you do the thing

or just click empty space in the disk management tool

@magic valve

[pure cosmos]

maybe i very stupid but i dont understand how get this answers,can whos one help or share samethin link where explain?

Submit the decimal representation of the subnet mask from the following CIDR: 10.200.20.0/27 | Submit the broadcast address of the following CIDR: 10.200.20.0/27 | Split the network 10.200.20.0/27 into 4 subnets and submit the network address of the 3rd subnet as the answer.

[simple zephyr]

For SQLMAP Case#11 it talks about: Filtering of characters '<', '>' and with the hint I did pick the right tamper script because of the > but I am confused about the < part of it.

I was literally trying to filter those characters for a while. Can someone explain to me a bit more if I am missing something because I feel like I just got lucky and guessed the right tramper script.

[sly tapir]

Metasploit Framework - Assessment: Looking for a hint, but if I put info here not sure if it will be a spoiler

can I throw someone a dm

[fathom pendant]

https://en.m.wikipedia.org/wiki/Classless_Inter-Domain_Routing

[dim cosmos]

PetitPotam hurts my brain!

[simple zephyr]

Anyone around that has completed the SQLMap assessment? I am still struggling with the Tamper-Scripts. I am pretty sure I am close to getting the flag but honestly still guessing.

[mighty trellis]

Can someone help me with the filter contents module of the workflow section in linux fundamentals?

Nevermind I found thr command it was ||ps aux||

[mighty trellis]

Now I need help with the last question of the Linux fundamentals module.

[fathom pendant]

ugh the pivoting module skill assessment not sure how to even take the first step ugh

[still inlet]

anyone is doing the white box pentesting 101 module

[simple zephyr]

This SQL MAP is really starting to troll me.....

Database: production
Table: final_flag
[1 entry]
+---------+---------+
| id      | content |
+---------+---------+
| <blank> | <blank> |
+---------+---------+

I sat here letting it go very slow to finally get the table to dump and this is what I get? Am I missing a completely different area to look?

[fathom pendant]

Pivoting; Tunneling; Port Forwarding Skills Assessment ugh not sure how to do this if there was a section that talked about this i don't mind being pointed to it but the section on webshells is not really existent

[proud pine]

You figure it out?

[fathom pendant]

yeah

i forgot to set meterpreter to the linux rev tcp :^)

now it's just scanning and setting up the proxies

:D

[proud pine]

If you need any further help on the module, you can DM me.

[simple zephyr]

have you done the SQL MAP one?

[fathom pendant]

i'll probably need it tbh

[fathom pendant]

got xfreerdp :^) it helps if i spell m* right xD

ugh i'm just gonna go to bed pivoting makes my brain hurt

[cinder mortar]

can anyone help explain what the main differences between Organizational units and groups are? im still confused even after doing some research myself

[bold drum]

hey

hackers

[brisk geode]

hey can anyone give me a nudge on Skills Assessment - File Inclusion?

i got the log file tried to change the user agent to poison the log file but nothing is working

[orchid jungle]

Please, could someone help me? I'm struggling in the [ATTACKING COMMON SERVICES - Attacking SQL Databases] module. I captured the flag but I can't crack it to get the mssqlsvc user password.

My command: hashcat -m 1000 F800D07797C939FBB74663CAB92E9D0B creds/pws.list

[glass sun]

Anyone can explain me, where I can get this nodule

[acoustic owl]

You have to grab the NTLMv2 hash and crack it.

[chilly forge]

Can anyone give me a hint here? The question: Use SQLMap to get an interactive OS shell on the remote host and try to find another flag within the host.
I have an interactive OS shell on the remote host, but I can't cd into other directories, I can't use 'find' to search the machine. the hint says ||"the flag is in a common directory"|| but I can't move out of my current directory? Could you point me in the right direction?

[placid quest]

@chilly forge look in the root

[chilly forge]

I cant :<
ls /
cd /
neither work

I get "no output"

[placid quest]

What about reading the flag.txt@chilly forge

[chilly forge]

@placid quest at the root or in that specific directory? Cause that was the answer for the previous challenge 😛

[placid quest]

@chilly forge how

[chilly forge]

oh right,|| cat /flag.txt did work somehow. Why can't i use ls or find, but cat is possible?|| That solved it, thank you! Weird question this one

[timber hatch]

at the modul pivot, tunneling and port forwarding, at the section RDP and SOCKS Tunneling with SocksOverRDP
there i have problem to start... am i supposed to transfer the files "SocksOverRDP x64 Binaries" and "Proxifier Portable Binary" with rdp to the windows host?

[autumn pilot]

yes

[timber hatch]

than it asks me for the domain name, is that right, do i have to find out the correct domain name?

[rustic sage]

Make sure to not use double quotes in your user agent payload. That will likely break as the user agent is put into double quotes in the log file.
Feel free to DM

[terse heart]

Im stuck on nmap evasion lab medium

I need a help

[vast lichen]

Module name: COMMAND INJECTIONS
Section: Skills Assessment
The question: What is the content of '/flag.txt'?
Can anyone give me a hint here to find injected user input?

[graceful rampart]

Yea. That tripped me up too. Also, if you can't view access.log due to an error, you'll likely be able to view error.log to help diagnose the issue

[lyric inlet]

Http misconfiguration , very good module

[subtle glen]

footprinting, dns, last question.
i know it has nothing to do with ||internal.inlanefreight.htb||,i tried ||dig axfr <sub.>inlanefreight.htb @target.ip|| for every subdomain i found and i get nothing, i dont know which ones are zones so im trying everything, may i please have some help?

transfer failed

i tried with +cmd too

[subtle glen]

dm me, i passed it yesterday

[ivory dock]

In the module RDP and SOCKS Tunneling with SocksOverRDP, I have everything setup to the point that all I need to do is connect to 172.16.6.155 as jason, but I don't know what endpoint to connect to with mstsc.exe.

Also, Proxifier isn't noticing any app use the proxy

So I'm doing something wrong, I don't know what it is though

[fathom pendant]

Your first host

[acoustic owl]

Not every DNS server allows zone transfer from everyone.

[ivory dock]

what port? I'm having a lot of trouble understanding this section

[fathom pendant]

Once it's set up you don't need to change port of anything

[dusty timber]

Hm, sorry. I had a similar issue in the info gathering module and thats how I solved it

[ivory dock]

So how do I end up connecting to jason's machine? I don't understand that at all

[fathom pendant]

Just put in his IP and it should connect

[fair mortar]

Hello, I am very new here. I want learn website hacking. How can I learn?

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fair mortar]

O thank you.

[still inlet]

anyone have done the white box pentesting 101 skill assessment ??

[ivory dock]

do this on the first host, or on the DC 172.16.5.19?

[fathom pendant]

The first host

[ivory dock]

on the first host, I keep getting an error

[fathom pendant]

This module is all about jumping hosts

That's because you need to still be connected to the DC for it to work

[ivory dock]

I am, look at my screenshot

[fathom pendant]

That's why the module states "hey you may want to change the connection speed to lower"

[fathom pendant]

Also you dont have the proxifier server set up

[ivory dock]

yes, it is

[fathom pendant]

If you follow the section it mostly guides you through everything

I don't see a server in your proxifier window

[ivory dock]

yeah, I followed the section step by step

[rustic sage]

Check what the firewall evasion section says about DNS proxying. Maybe that gives you an idea what you are missing (hint: it's not about using --source-port)

[fathom pendant]

And when you opened mstsc.exe it gave you the notification it was using 127.0.0.1:1080?

[ivory dock]

no

So with the "second" mstsc.exe instance, I have to set the target to 127.0.0.1:1080? Nothing seemed to happen when I tried that

[fathom pendant]

Sorry I meant when you connected to the 172.16.5.19 one

[winged zodiac]

Hey can someone tell me wrong with academy's payment this is my second time having academy subscription with the same credit card previously it didn't throw any error but this time its saying "no funds" but I'm pretty sure there is no problem with the funds and overseas payment is enabled too. Is there any any way to remove the recurring payment method card and readd the card details and try ?

[fathom pendant]

Open a support ticket by clicking the green bubble on the site , also you should be able to remove card details

[ivory dock]

Ah I didn't try connecting to the same host after setting everything up.

Just to be sure, proxifier needs to be run on the first host, right? Not the DC at 172.16.5.19

[fathom pendant]

When you initially connected to the DC, did you get that popup as shown in the pictures of the section?

[fathom pendant]

Yes

[ivory dock]

Which popup?

[arctic sentinel]

Hello everyone! Any help appreciate it! I`m working on the comparision operations section (bash scripting) and I'm stuck with this challenge:

[fathom pendant]

The "socks over RDP plugin is enabled"

[ivory dock]

Yes

[fathom pendant]

Give me like an hour and I'll sanity check, I'm just waking up

[arctic sentinel]

if [[ $var == $value && $var -ge 113450 ]]

Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters.

[ivory dock]

Ah okay, machine just shutdown for me also, so I'll try again later too. Thanks

[fathom pendant]

[arctic sentinel]

Anyone you can provide some guidance in the bash scripting module!

[subtle glen]

im aware, i just have no clue what to include there so i tried every sub i found, none of them worked

[acoustic owl]

A DNS server that does not allow you to transfer zones must be forced to hand over the data.

[rustic sage]

I don't know the module but ${#var} should give you the number of chars in the var variable

[arctic sentinel]

yeah, I don't know if that is what I'm missing

[rustic sage]

At least this is what is not matching in your statement with the question you provided

[ripe grove]

on the tunneling skills assessment, I'm trying to use sshuttle to scan ||172.16.6.25|| but when I run nmap, every port comes back as open. I'm using nmap with -sT and -Pn. Is sshuttle not compatible with nmap?

I'm pivoting through ||webadmin||

[rustic sage]

Hi om stuck on Skills Assessment on into to windows command line I'm trying to connect with ssh as ||"user1"|| and pass ||"previous flag"|| but it wont work just gives me permission denied.

[arctic acorn]

Check again if you copied the right flag in the previous exercise. The skills assessment flag are case-insensitive, but the logon passwords are case-sensitive.

[rustic sage]

Writing it as it is but still permission denied and I'm sure it is the right pass

[arctic acorn]

Can you send it to me over DM?

[vital adder]

did you have a typo on the ip or something? that's the one of the right ip just not your next target after the linux box

[ripe grove]

I checked and I set it in an env variable to avoid typos. I can get to ||172.16.5.35|| already. But I'm not clear why an nmap scan through sshuttle would show all ports as open

[vital adder]

for the me skill assessment of that module print the flag character by character it's super slow and yep a bit trolling also if you still need help with that shoot me a dm

[vital adder]

for that i just use the ||dynamic port forward|| thing, so i just add the tag ||-D|| in

[pine dagger]

Anyone able to give some pointers on Broken Authentication - Skill Assessment? I've ||created an account and seen the hints about the support account|| and then ||tried to enumerate different support accounts with various country codes|| and then attempted ||to brute force with a password list made up from rockyou meeting the criteria||, but I don't seem to be getting anywhere.

[ripe grove]

ok, I'll play around with that. I just found proxychains with nmap to be a little unpredictable

but sshuttle is being unpredictable anyway

[rustic sage]

I'm stuck on intro to windows command line, ||"User4 has a lot of files and folders in their Documents folder. The flag can be found within one of them." || I tried the ||"Type"|| command to try and output all the ||flag.txt ||but dsnt seem to work I'm kinda stuck here and not sure how to move on. On Section "Skills Assessment"

[vital adder]

unpredictable but fast not good for pivot but for scan

[vital adder]

so did you get the support username? or the policy?

[vital adder]

google / research about how powershell read multiple files syntax

i mean you can use cmd if you want but powershell is better

[pine dagger]

I've got a list of usernames which I think are likely candidates, but not confirmed.

[vital adder]

and the password policy?

[fathom pendant]

sanity check @ivory dock : was able to get it to work just fine with my system; connection can be a bit of a pain sometimes

[pine dagger]

I believe so, but without stating it, its hard to confirm if I'm missing the obivous. My cut down rockyou is 29 passwords.

[vital adder]

seem about right did you try brute forcing?

[pine dagger]

Yeah with a 10 second wait between each try to rate limit

[vital adder]

i do 25 but if you didn't get block then i think it should be fine

[pine dagger]

I double checked in Burp, and all the responses show "Invalid creds" rather than "too many tries"

[rustic sage]

I did that, I think i have the right syntax ||"Get-content" ||but the problem is every dir has a subfolder with ||flag.txt|| so it's an crazy amount of|| flag.txt ||i need to ||get-content|| and it did not work

[vital adder]

i use ||Get-ChildItem||

[rustic sage]

Yes, and within every dir is another dir with flag.txt

[subtle glen]

im using this command ||dnsenum --dnsserver 10.129.42.195 --enum -p 0 -s 0 -o subdomains.txt -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt inlanefreight.htb|| then i try to run || dig @10.129.42.195 NS axfr +cmd <sub>.inlanefreight.htb, removing the +cmd has the same results || im using a completely wrong command arent i

[fathom pendant]

use a more fierce discovery list

[vital adder]

i also got the ||sls|| filter at the end right now i'm not even sure what that is for but it's for the flag

[fathom pendant]

also you can use dnsenum on subdomains

[rustic sage]

Get-ChildItem sls ?

[vital adder]

a | between the 2 command of course

[rustic sage]

so get-childitem | sls

[rustic sage]

Tried it wont work, im in dir C:\Users\user4\Documents

I just get error message

[pine dagger]

An suggestions on what I'm missing?

[rugged stag]

A question on Linux Privilege Escalation Skill Assessment Flag 5:

||How did you manage to stabilize your shell? I get a dumb reverse shell (through uploading the war file to tomcat manager), but I can't stabilize it in order to do the busctl GTFOBin thingy. ||

I tried ||python||, didn't work. I tried ||socat||, didn't work. I tried ||nc with the -e option||, didn't work. Any other suggestions anyone?

[vital adder]

i really need to update my note for this one but the get-childitem is for getting which file have the flag and the sls is for i think reading the flag

[rustic sage]

https://i.imgur.com/fXFWML4.png using the command all the info i get is this

[vital adder]

the password part i think you may got right but just for sure shoot me a dm if your username and password list both them shouldn't be long and if that is also right i got no idea why you don't get a hit

[rustic sage]

But i used the tree command with cmd and got more than 100 flag.txt within documents and the other dir

like dir "1" as 10 more dir and so on

and all of them has flag.txt when i use get-childitem while im in c:users\user4\document this is all i get

[vital adder]

for the shell i use metasploit

[rugged stag]

Hm, should have thought of that. Meterpreter, I presume? Thanks, I'll give it a try.

[pine dagger]

I did it with Meterpreter, then I did two different shells from inside that

[subtle glen]

got u, i still dont get results tho for ||sub, nc, dev, root, v,|| may i dm u?

[lavish mist]

Hello guys, I'm stuck on Host Based Enumeration with DNS part. I have no idea where find answer "Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain." help plz

[subtle glen]

u need to enumerate a subdomain of inlanefreight.htb, what have u tried so far?

[lavish mist]

dig ns inlanefreight.htb @IP ADDRESS GENERATED

[rustic sage]

Anyone? I'm stuck on Introduction to Windows Command Line; Section;Skills Assessment; Question; user4 has a lot of files and folders in their Documents folder. The flag can be found within one of them. - I have found the correct path but within this path there is multiple subfolder with the same name flag.txt and this is the hint i get "We want to see a full listing of the files within the hive, and then read the contents of each file. How can we see through this tree?"

[ivory dock]

Okay thanks again, I'll try it out later. Connect 2 times to the DC, right?

[ripe grove]

on the tunneling skills assessment, I use ||sshuttle to create a tunnel to get to 172.16.5.35 via the foothold unix box. Then I'm creating a SOCKS tunnel via ssh -D 9050 to 172.16.5.35 in order to get at 172.16.6.25. I can proxychains RDP to 6.25 with the vfrank creds.|| But when I try to proxychains nmap scan|| 6.25||, every port comes back as open. This is with the -sT option

[subtle glen]

its another subdomain, it is used as an example on the module

[fathom pendant]

so the order is:

1. start the RDP.dll
2. Connect to the dc01 with credentials
3. Transfer and run the server.exe on the connected host
4. back on the foothold server ; start the proxifier (may need to run as admin), set 127.0.0.1; 1080 - SOCKS5
5. connect to final target IP {the x.x.x.155} with creds from question from the foothold connection

[fathom pendant]

you should have the answer then; are you sure you're connected to the network? also if you put the IP in your /etc/hosts that may also f with it

L

[rugged stag]

Can I DM you?

[lavish mist]

; <<>> DiG 9.16.33-Debian <<>> ns 10.129.77.77
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 62175
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;10.129.77.77. IN NS

;; AUTHORITY SECTION:
. 86389 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2023021900 1800 900 604800 86400

;; Query time: 6 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Feb 19 18:10:14 GMT 2023
;; MSG SIZE rcvd: 116

"Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain."

[lavish mist]

where?

[dim wolf]

NXDOMAIN,

you need to query the domain name at the nameserver

[grand bane]

Hello, can somebody help me with XSS - Session Hijacking exercice ?

[fathom pendant]

http://dontasktoask.com/

[hazy grotto]

I'm working on the ffuf assessment. question 3. I wanted to ask someone if my code is ok but don't want to spoil. anyone willing to dm me?

[rustic sage]

Anyone? I'm stuck on Introduction to Windows Command Line; Section;Skills Assessment; Question; user4 has a lot of files and folders in their Documents folder. The flag can be found within one of them. - I have found the correct path but within this path there is multiple subfolder with the same name flag.txt and this is the hint i get "We want to see a full listing of the files within the hive, and then read the contents of each file. How can we see through this tree?"

[fathom pendant]

let's GOOOOOOOO

[hazy grotto]

Congrats. That was really tough. I wasn't able to finish so i moved to an easier module.

[pine dagger]

sup?

[fathom pendant]

if you need some help with it I got you :D I did this over a few days because wrapping my brain around pivoting hurts ;w;

[rustic sage]

If i cant get help with a module in this channel where can i get help?

[hazy grotto]

I appreciate you. Did you do ffuff?

[fathom pendant]

not yet lol I'm trying to do these mostly in order xD

[hazy grotto]

I was until pivot. lol

[fathom pendant]

can you not type C:\Path\to\files\*.txt ?

or type C:\path\to\files\flag*.txt

* is a wildcard character it means every character up until the next not wildcard character

[rustic sage]

No cause, within Documents i have other dir, and there after a lot more dir with "flag.txt" https://i.imgur.com/M6sagEu.png

Like this, and HTB wants me to read all the files and get the flag

[fathom pendant]

¯_(ツ)_/¯

[rustic sage]

https://i.imgur.com/sGvGIG5.png

Been stuck on this question for 2-3 hours its fucking crazy

about to give up on everything rn

https://i.imgur.com/WPjXkd4.png

[fathom pendant]

take a break for a bit then dude :) if you're getting frustrated best to step away

[hazy grotto]

You can always start a new module until someone is able to help you. Ive spent days on a single question.

[fathom pendant]

oh dude i figured out why people keep struggling with the where thing in the windows cli module

the ssh shell you're in is in powershell; which requires additional positional arguments

so you need to do the cmd.exe /c <command> to get it to work

[ripe grove]

Ok I completed the tunneling skills assessment, but have a few questions. All the targets were ||on the 172.16.0.0/16 subnet but each target acted like it was on a /24. I'm assuming the networks were segregated using a firewall? || I still don't understand why nmap scans would show all ports as open when trying to scan the internal hosts ||via sshuttle and proxychains. Is this related to firewalls also?||

[fathom pendant]

if you're doing -Pn it may assume that it's just open; it's best to run the for loop

[ripe grove]

but I've used -Pn with other scans (full TCP connect scans), and it wouldn't return all ports as open

[fathom pendant]

sometimes it's weird with proxy

[ripe grove]

what about the network configuration? Is that something that is typical?

[fathom pendant]

that's fairly typical

[ripe grove]

ok thanks

[hazy grotto]

Can you help me on this one?

[deft escarp]

im on the last flag for the DNS sections of the footprinting module. i've tried brute force the dns with almost every list, but it's taking hours upon hours, still, cant find the IP with the last octet of 203. not sure what i'm doing wrong

[acoustic owl]

Did you try to bruteforce the right zone? Take the smallest list of SecLists

[deft escarp]

now that I think about it, I don't think i was

[polar crest]

I'm at NETWORK ENUMERATION WITH NMAP hard lab. Can anyone help me with this ques: Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer. Thanks

[ivory dock]

okay tried this, step by step, and still getting an error when trying to connect to .155

losing my mind here

There is 0 traffic going through Proxifier also

[gray ledge]

Hello
I'm at LINUX FUNDAMENTALS>System Management>User Management
the question is : Which option needs to be set to execute a command as a different user using the "su" command? (long version of the option)

I didn't find anything in man or --help so I googled it and found that the answer is --command but I still didn't understand it, could anyone explain it for me, please???

[deft escarp]

yeah, cant seem to find the right zone, idk what im missing

[analog tendon]

can anyone assist me on the pwnbox question in the Laundanum section of the shells and payloads module?

ive put in all 4 paths i found with and without the filename itself and it doesnt accept it as an answer. of course i used my kali to get the webshell though

[acoustic owl]

DM

[tight mesa]

I'm currently working on the login brute forcing module and i'm stuck on the service authentication brute forcing section where it deals with b.gates. When I try to ssh into b.gates, i get nothing, then it says connection timed out. Does anyone know whats going on? The command i use is ssh b.gates@<ip address> -p 22

[autumn pilot]

change -p 22 with the port from your target

[tight mesa]

didn't work. Still got the connection timed out error message

[autumn pilot]

<user>@target_IP -p <PORT>
e.g. if your target is 12.34.56.78:4321, the command will be ssh <user>@12.34.56.78 -p 4321

[tight mesa]

I tried that. This was my command exactly: ssh b.gates@134.209.17.36 -p 31335

I get this message back: ssh: connect to host 134.209.17.36 port 31335: Connection timed out

[autumn pilot]

reset the target

[tight mesa]

I did. I've been struggling with this for a few days now. Even reached out to support

[autumn pilot]

Try with this target 138.68.YY.YY:XXXX

[tight mesa]

That one works! Someone in support just gave me the exact same ip address

[autumn pilot]

tell them that you suspect to have some zombie targets

[tight mesa]

What's that?

When the targets don't work?

[autumn pilot]

yeah

[tight mesa]

They said it's something they're working on

[autumn pilot]

¯_(ツ)_/¯

[solid wedge]

Hey have a question if I have the $490 subscription do I get help with questions to modules

[autumn pilot]

yes

but you can generally get help here as well, but you must learn how to structure your question

based on what you are attempting, have attempted and what you think it is the path to achieve the answer

[solid wedge]

Ok cause I have not answered a question correctly but normally a message pops up asking if I would like help. So thats why I am asking

[solid wedge]

Connect to the discovered share and find the flag.txt file. Submit the contents as the answer. having trouble with this question

[autumn pilot]

honestly, no idea from which module and section is that question

[solid wedge]

Footprinting in the SMB section of the Jr Pentester job path

[autumn pilot]

have you tried using the commands in the examples?

[solid wedge]

Yes

[autumn pilot]

which ones

[acoustic owl]

What exactly have you tried? What exactly is not working?

[solid wedge]

smbclient //10.129.14.128/notes

[autumn pilot]

if thats the share that you can access, then you should get a connection using smb

your shell would become like: smb: \>

[solid wedge]

OK so no smbclient

[autumn pilot]

and also that is the IP from the examples, you must specify the IP of the target that you have spawned

[acoustic owl]

You have chosen a wrong directory. First list all possible directories.

[solid wedge]

Ok I see what you mean I will re read and try it so everything is just in the examples basicly

[solid wedge]

I am in the wrong directory

[acoustic owl]

If I'm not mistaken, the module explains how to list all available directories.
Have a look at it again.

[solid wedge]

ok thank you

[dim cosmos]

about to start the AD skills assessments, wish me luck 😛

[solid wedge]

Good luck

[acoustic owl]

Good luck
If you get stuck, you will surely get help here 😉

[dim cosmos]

ill need it

[round dune]

Hi all, would like to ask some help ref 'Credential Hunting in Linux' . For some reason I can't log in via SSH to the victim box with the given creds at all.. (Kira) Tried brute forcing it with the pw list given within resources but it did not work either. Any further hints?

[acoustic owl]

You need to create your own list based on the password in the hint

[round dune]

thanks i'll try to tweak it with the mutation rule file and see if that gives me the required output 👍

ok so that did not work, do I need to mutate all the passwords given from 'Resources' or only the ones related to the hint?

if i mutate all, the list of potential pws will increase dramatically and pw spraying will likely take a few hours

[acoustic owl]

There is a password in the Hint. Unfortunately, there is still a number attached.
Omit the number and then create your own mutated list with this word

[round dune]

thanks will try. funny that accessing the box (preliminary step to complete the actual task) is harder than the task itself 😆

[polar crest]

Hi, I've the same issue. Did you figure it out?

[round dune]

@acoustic owl the problem was with the username haha! Had to be lowercase, i think that's enough internet for me today!

[void gate]

That issue took me an embarrassingly long time to figure out 😣 but huge relief when it worked

[dim cosmos]

if i have a reverse shell powershell session running in netcat and i do a silly command that will take forever to run, is there a way to break it without dumping the entire netcat session?

i.e. not ctrl-c

[rustic depot]

Has anyone completed the Linux Fundamentals course? I'm having an issue with a Find command that's not searching for a config file.

[magic valve]

May I have some assistance/nudge with Password Attacks - Hard Lab I opened the encrypted bitlocker .vhd but only see SAM and SYSTEM and no SECURITY. Is this correct? I’m having a hard time extracting hashes with multiple tools.

[ripe grove]

I think that's correct. I think you only need sam and system

[ripe grove]

See the Attacking SAM section

[magic valve]

I looked at that section. Attempted to use secretsdump.py but didn’t work. I tried pwdump.py and didn’t work either

[ripe grove]

secretsdump dumps the hashes doesn't crack them

[magic valve]

Im saying those tools didn’t extract the hashes

[ripe grove]

did you open the files in a text editor?

[analog tendon]

anyone able to assist with the live engagement on shells and payloads?

[ripe grove]

what's the question?

[analog tendon]

having an issue on getting a shell on the first machine. ive found where i can upload the shell and ive attempted to get it to call back using msfconsole and netcat. i can get it uploaded and started but i cant get it to reach back. ports and IPs are correct

[ripe grove]

If I remember correctly, I did something simpler. Take another look at the ||Laudanum|| section

[analog tendon]

ill take another look. thank you

[balmy radish]

Did you see this part of the section?

||Keep in mind that the Foothold host has access to the Internal inlanefreight network (172.16.1.0/23 network) so you may want to pay careful attention to the IP address you pick when starting your listeners.||

[analog tendon]

i did. but nothing reaching back. and i just tried what cretan told me to try and im just getting error 404 when i try to access it

[naive sky]

excuse me is it right ?