modules

[prisma spruce]

I liked the THM network boxes.

[acoustic owl]

If you still need help, then write me a DM

But it's when you have to try really hard that what you've learned sticks in your head.

[prisma spruce]

I don't like it because the website's layout is a mess and a huge number of the rooms are just copying and pasting commands.

[acoustic owl]

In your opinion, which texts are not professional?

[prisma spruce]

@acoustic owl It probably depends on the definition of professional being used.

[rare topaz]

What? Htb modules are written way too professionally lol dunno what ur on abt.

THM rooms are more casual and treat you on a childish tone.

The problem w htb is assumption of prior knowledge, or the capability to self-research.

THM assumes you know absolutely nothing.

Thm is also mostly copy pasting commands which ig is good for memorization but doesn't help actual application.

[prisma spruce]

I thought the learning process module was pretty bad lol.

[rare topaz]

Forgot which one the learning process one is, is it the one that lectures you on mindset and philosophy or smthn.

[prisma spruce]

Yeah. It's full of dubious nonsense.

[acoustic owl]

Sure, criticism is good too. Only I think, you should then write what disturbs. Only in this way can the author really improve.

[prisma spruce]

I think that isn't a problem as much as the fact that modules sort of jump everywhere.

The linux fundamentals module covers way too much, with each section covering way too little.

At least the windows fundamentals module states what an ip address and port are.

[rare topaz]

Again, htb modules assume prior knowledge or the ability to research.

[prisma spruce]

I don't think it's wrong, but I think that sort of stuff does not belong in a fundamentals module.

You're asked to give an inode number, but it's never really stated what exactly an inode is.

It talks about soft links, and could easily make a comparison to shortcuts in windows

and completely neglects hard links

It then brushes through apparmor and selinux, and iirc it also jumps around with the old service name restart and systemctl name restart syntax

[rare topaz]

I agree w everything (especially since I attempted buffer overflow and got so lost) but all this goes under the #858470491676737536 channel

Here is mostly for like helping people w modules so like....

[barren escarp]

Is anyone here good with nosql injection for mongodb?

[rare topaz]

Ask the question.

[fathom pendant]

https://github.com/Charlie-belmer/nosqli

[prisma spruce]

Write a script for it.

You can just make a hack for it using bash. It'll be easier that way.

Well, not bash. You can use python.

[pulsar needle]

Are you doing the SQL injections fundamentals course?

[barren escarp]

I passed that one. I'm doing Introduction to NoSQL Injection now

[pulsar needle]

Aaaa ok

Some people are not the best at using google and i feel the module kind of teaches one to do research with google

[proud pine]

This just shows a fundamental misunderstanding of the field. You're not going to have everything spoon-fed for you in pentesting.

Then the problem is your expectations. You're being taught a set of skills - not being given a set of bullet points.

This isn't a subject that you can just be given the answer all the time. You will often come across situations that don't fit in the box, and you need to think outside.

With your current attitude, you're going to get a pretty strong reality check, if you want to keep going forward with pentesting. There's just no universal way to teach you the skills you need for this - you have to be open to self-research, and to know what to search.

The same thing applies to the medical field. Doctors have to cram an absolutely insane amount of material, but the end goal isn't that you memorize everything - it's tthat you know how to get the information you need, when you need it.

You are being taught well.

You just don't seem to like what you are being taught.

I mean, you're 4 modules in to a course with 28 modules. You have barely even scratched the surface.

So you're doing the modules out of order?

... what?

[thorn urchin]

Sometimes I think people complain too much because it wasnt handed to them on a silver platter and some other times people blame not being able to instantly succeed as a failing of the material.

[proud pine]

The problem is that you don't know what a high standard is here. This is a high standard.

You have expectations, which do not align with the industry.

[thorn urchin]

yup

atm I think it is

the only stuff Ive seen be better has been very niche advanced content

[proud pine]

It has room for improvement, but not in the ways you are saying.

[acoustic owl]

I see a lot of people coming here with no foundation knowledge and then complaining about not understanding things.
Maybe the expectation here is to learn everything from scratch.

[thorn urchin]

Exactly

Thats a terrible expectation to have

thats not what htb is for or designed to do

full stop

I didnt do fundementals so I dont know their particular quality level

[proud pine]

Shoult it teach you how to plug a keyboard in? How to touch type? There's a limit to what 'fundamentals' means.

[thorn urchin]

what

[proud pine]

Please show me the marketing that misled you.

[thorn urchin]

also the fundementals are free modules

didnt you say earlier your complaint was about paying for content?

you said this

[frozen mesa]

Keep it with the modules in this channel please.

[thorn urchin]

I don't think its perfect either. I agree though that frequently I see your suggestions just amount to more handholding

[thorn urchin]

we are literally discussing modules right now

[frozen mesa]

I thought this was talking about help for modules instead of personal opinions which are endless.

[thorn urchin]

I fundementally disagree with that

I think a lesson should always include area for exploration to understand the concepts

[proud pine]

He... doesn't mean the module...

[thorn urchin]

Things get a little more open ended when its late and theres little to no people actively asking for help

[frozen mesa]

Ah for me its early, its 8:45AM here 🙂

[proud pine]

This server is always absolutely dead at this hour.

[thorn urchin]

late/early same thing. Most of the htb population isnt up and grinding content right now

so things get loosey goosey

long as its relatively academy related

[proud pine]

I don't even think it's really off topic.

[thorn urchin]

I agree, but its a bit diff if there was swarm of people trying to ask for help and they got drowned out by a debate

[frozen mesa]

exactly 🙂

[thorn urchin]

help is channel priority #1, but when thats not needed debate is fine

[acoustic owl]

https://www.hackthebox.com/about-us

[thorn urchin]

or at least it is if nobody snitches

[acoustic owl]

Greece 99
UK 17
US 38
World 34

HTB is everywhere and not limited to Europe

[thorn urchin]

HQ is greece iirc

thats definitely off topic

[frozen mesa]

Module: ATTACKING WEB APPLICATIONS WITH FFUF --> i dont get to see any status codes. Whenever i use ffuf on THM for example, it does work like it should. On HTB not.

[proud pine]

You're going to have to provide an example.

[frozen mesa]

Have this problem since the beginning of the module (2 months ago). Ffuf does not seem to work properly on HTB for me, it does on my own parrot machine and other places similair to HTB

on my way with it

[thorn urchin]

gunna need to show your command and output

[frozen mesa]

https://imgtr.ee/image/wPm1H ffuf -w /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u https://FUZZ.hackthebox.eu/

all the commands from the module

[final maple]

For some reason, the password didn't work for me but the hash did.

[thorn urchin]

your terminal is too small

expand it

common go bin term output issue

[frozen mesa]

Did the job, full screen only to see the status codes. Thanks

[thorn urchin]

👍

[prisma spruce]

Try putting a known subdomain into a single word wordlist and figure out why it's breaking

[pulsar needle]

I do not have permissions to write files with my SQLi to /var/www or /usr/share

But according to the web configuration file at ||/etc/apache2/apache2.conf|| i should be able to (This file is shown in the picture)

Omah I made a dumb mistake, nvm

[acoustic owl]

This is a comment and only shows where the Webroot is usually located.

The default path is /var/www/html

[pulsar needle]

I found out the hard way (1 day of dying lol)

[acoustic owl]

Google is very powerful for this kind of thing. 😉

[frozen mesa]

Doesn't work all types of scans. Trying to finish the module with GoBuster because i dont like working with ffuf 😦

[thorn urchin]

that was the issue with the screenshot you shared. Further issues would be different problems

I like both gobuster and ffuf

gobuster is nice when I want something quick and simple. Ffuf when I need power.

[pulsar needle]

Agree lol

[frozen mesa]

Maybe thats the case, i didnt do things that required alot of power 🙂 I'm just a rookie!

Since the beginning i have trouble with ffuf and the results showing (or rather not showing) the proper way. Dont want to waste any more time on it and finish it. For now i dont need that " power".

[pulsar needle]

But in the future you will, knowing more tools will come in handy

[prisma spruce]

Did you try -mc all?

[frozen mesa]

Sorry i dont understand what you mean with that.

[prisma spruce]

There are http response code options with ffuf

[frozen mesa]

I am aware of that, those are mostly missing in my output/results

[fervent cove]

why isnt there a possibility to pay for hackthebox with paypal?

I dont have a creditcard

very frustating 😦

[frozen mesa]

Had that too! Indeed frustrating

[worthy briar]

Hello, anyone did the Linux Privilege Escalation - Linux Services & Internals Enumeration? I think the question is bugged.

[vivid igloo]

does anyone have a tip on content : (Interacting with Users) module :WINDOWS PRIVILEGE ESCALATION

stuck here so bad

i added Malicious SCF File in C:/

but only hash am getting is the hash of my own user lol

[acoustic owl]

See if there are any other directories where a user might be able to access them.

[vivid igloo]

u mean in the users or over all ?

[acoustic owl]

Over all

[acoustic owl]

Python Version?

[worthy briar]

yep

[acoustic owl]

Have a look at the installation directory

[coral wraith]

Hi all

Please, Can you help me on :Password Attacks Lab - Medium

I get the doc zip, but i can't use it

I had trying john with mut_password.list hash

But i had this message:
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
No password hashes left to crack (see FAQ)

[coral wraith]

I had alos: Dy! password, but dosn't work.

[heady tusk]

that's the correct approach. since the hash was loaded correctly I would assume your mut_password.list is broken

[vivid igloo]

@acoustic owl check ur dm please

[neat trench]

Hi, can u help me pls solve problem with tuneling
Module: AD Enumeration & Attacks - Skills Assessment Part I
Trying to use chisel + cme/xfreerdp as in this forum post https://forum.hackthebox.com/t/ad-enumeration-attacks-skills-assessment-part-i/259237/22
stuck on receiving timeout error
||proxychains4 cme smb 172.16.6.50 -u svc_sql -p lucky7||

Strict chain  ...  127.0.0.1:1080  ...  127.0.0.1:1080 <--socket error or timeout!
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  127.0.0.1:1080 <--socket error or timeout

[deep owl]

hey everyone

AD Enumeration & Attacks - Skills Assessment Part II

Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain.

how can i upload a mimikatz on the machine

[heady tusk]

that's not what you're looking for in this case

[fiery berry]

dm you

[vocal tusk]

hi guys any mod arround to give me a hand with #bot-coomands

im trying to identify and the bot is being mean

[torn blade]

for the session security skill assesment I have the auth session cookie for the admin but im stcuk trying to figure out how to use it to login to admin account

like i swap the auth session cookie and just nothing happens

[vestal fable]

I figure out how to finish the burp suit exercise, the problem was that even tho i put a "200 OK" it wasnt appearing there, so all the requests with 404 made me lost the 200 in the wordlist

[pulsar needle]

Does |\ seperate # and ; in this context and filter out both of those?

[umbral wigeon]

u can dm me, i may be able to help

but make sure the cookie you are getting is after u have sent the link to the /submit-solution endpoint

[fiery berry]

Since it's inside the double quotes probably you don't need to escape the ";", as alternative you could do:
grep -v -e "#" -e ";"

[pulsar needle]

Aa oke

[rustic sage]

It means you all ready decode the password

Before

[torn blade]

i figured it out, i fcking named the script .txt instad of .php like an idiot and it make the session a different token

[royal sigil]

( First, try to update any city's name to be 'flag'. Then, delete any city. Once done, search for a city named 'flag' to get the flag.) can you help me for this question when i try to update the name of an city to flag i have this . []

[torn blade]

I have an issue with fuff, and ive had this issue eveyrtime i use it. Whenever I run it it says every parameter in the list I use is a valid result but Ik thats not right, has anyone else had this issue?

like everytime ive ever had to use fuff its just like this

[pulsar needle]

Am I seeing wrong? - https://academy.hackthebox.com/module/112/section/1067

query user 0x3e9 and it talks about cry0l1t3 xd

[tired shard]

Hey all. I am in "Kerberoasting - from Linux" in Active Directory Enumeration & Attacks. I am on the question "Retrieve the TGS ticket for the SAPService account. Crack the ticket offline and submit the password as your answer". I am using hashcat: hashcat -m 13100 hash.txt rockyou.txt --force and I get that the Status is "Exhausted". I added the passwords we already found to the rockyou list also. Any guidance?

[pulsar needle]

Aaa nvm i was seeing wrong

[plain coral]

Submit a baseline request that has not been modified with valid parameters that will be processed successfully by the application and take note of the response. Then try submit invalid sequences of characters and logic in order to generate a database or application logic error to return to the client.

@barren escarp I haven’t completed this module yet, but MongoDB often faces attacks targeting its $where operator. Or parameter injection like https://example.tld?login?user[$ne]=1, u can attempt various attack strings, including JavaScript function insertion, JSON insertion ({}), and try fuzzing with different attack strings some attack strings to consider are

•    true, $where: '1 == 1'
•    $where: '1 == 1'
•    ', $where: '1 == 1'
•    1, $where: '1 == 1'
•    { $ne: 1 }
•    ', $or: [ {}, { 'a':'a' } ], $comment:'successful MongoDB injection'
•    db.injection.insert({success:1});
•    db.injection.insert({success:1});return 1;db.stores.mapReduce(function() { { emit(1,1
•    || 1==1
•    ' && this.password.match(/.*/)//+%00
•    ' && this.passwordzz.match(/.*/)//+%00
•    '%20%26%26%20this.password.match(/.*/)//+%00
•    '%20%26%26%20this.passwordzz.match(/.*/)//+%00
•    {$gt: ''}
•    [$ne]=1

[plain coral]

Why are you filtering the response size of 2287?

[plain coral]

In your case I’d be using the -fs 2309 switch because you want to find the response size that deviates from the norm

[pulsar needle]

Why dosent this work? Am I submitting the right SMB banner?

[fiery berry]

probably cause it's wrong

[pulsar needle]

:I

Lol

[acoustic owl]

Reload the page and make sure there are no spaces at the beginning or end of the string.

[pulsar needle]

I reloaded it

Tried the same, made sure there were zero spaces

didnt work

Footprinting - SMB

[fiery berry]

do a manual banner grabbing or use nmap

[pulsar needle]

Manual via netcat?

[fiery berry]

can work, otherwise use nmap

[plain coral]

Try running sudo nmap 10.129.X.X -sV -sC -p139,445

[pulsar needle]

Aaa

So its the version

Not the banner?

The service scan solved it

But I dont get why, is SMB and Samba the same

wait

Lol

asking the question i realised

[fiery berry]

you were looking probably at the outpout of smbclient

[pulsar needle]

yes

But why is the output different?

[fiery berry]

go ahead and you will find it out

[pulsar needle]

Why do I get the SMB share version using smbclient but using service version i get the samba version

[plain coral]

Samba is the open-source implementation of that protocol used by non-Windows systems to interact with Windows-based file sharing and networking services.

[pulsar needle]

But if i check the sambashare i get the SMB version, is it the version of that specific share?

[plain coral]

The question is a bit cryptic but it’s asking you what version of SMB server is running on the target system - not asking about the version of the share

[pulsar needle]

Can shares be run different versions of SMB?

Compared to the server

[torn blade]

I was an idiot and just overlooked the 1 that size was different cause I’m blind

[plain coral]

Yes, they are heterogeneous. You are getting confused because the question is saying to submit the full banner but by full banner they mean basically include the word samba with its version number

[plain coral]

Yeah looked like you were filtering the one size that you needed 😉

[whole grotto]

hello everyone, i really need help, i am in the chisel section in the PIVOTING, TUNNELING, AND PORT FORWARDING module, and when i want to start chisel in the pivot host (ubuntu) it tells me that:

./chisel: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./chisel)

The ubuntu is not connecting to internet so, what can i do ? pls

[sleek urchin]

just get a pre-compiled version

[sleek urchin]

https://github.com/jpillora/chisel/releases/tag/v1.8.1

[whole grotto]

ok thank you i'll test that

[pulsar needle]

Can a SMB server have another SMB share runned on it?

[whole grotto]

how can i download it ?

[pulsar needle]

As I can see it is built like Samba SMBD is the main server and ||InFreight SMB 3.1|| is a file share on that SMBD server

[plain coral]

Yes, you can set up multiple shares. Don’t overthink it. Stick to the methodology. You have an IP address and you want to find what ports are open, then what services are running on those ports. Then you want to find the version of those services. Then you interact with those services.

[pulsar needle]

Yes but it has a file share named ||InFreight SMB v3.1||

[sleek urchin]

scroll down the page, and select whatever version you need, either linux or winodws

[whole grotto]

ty

[pulsar needle]

So therefore I am thinking, can I host a SMB file share on a samba server

[plain coral]

Yes, but the question is not asking you to submit the name of the file share?

[sleek urchin]

then use: gunzip -d <YOURFILE>

[pulsar needle]

Nono, I got the answer

I am just asking as a general question

[sleek urchin]

and don't forget to chmod +x <YOURFILE>

[whole grotto]

Ahahah ok i'll do not ty

[plain coral]

Yes, It allows non-Windows operating systems such as Linux, Unix and macOS, to communicate and share files with Windows systems using the SMB/CIFS protocol. Samba provides file and print services that are compatible with Windows-based clients

[pulsar needle]

aaaa

so its like

a samba server with smb running on it

nvm it says the SMB share has a customized version

So I think they did that to confuse me

[coral wraith]

Please, I'm stuck in password attack labs,
I had the both user name J & D,
can someone give me a hint?

Examine the second target and submit the contents of flag.txt in /root/ as the answer.
https://academy.hackthebox.com/module/147/section/1335

[bleak mural]

This is is killing me - I’ve been trying to crack the hash from Attacking Common Services - Attacking SQL Databases. Nothing seems to work…Also, I get different hashes depending if I use Responder or Impacket-smbServer. Any help much appreciated 🙏!

[fathom pendant]

You do a bit of moving around from one user to the next, root isn't always achieved from one user

[rotund urchin]

what account are you trying to crack

[fathom pendant]

If using hashcat make sure you're using the right -m

[bleak mural]

Thanks for such quick reply! Account is mssqlsvc.

[fathom pendant]

Have you already tried everything from the section?

[bleak mural]

Thanks you response 🙂. I have used pretty much every single one for hashcat 😂. After using hashid I’ve mostly been using 1000

[fathom pendant]

Well if you're using the wrong hash mode you're not gonna get an answer loll

1000 seems correct though

What wordlist(s) have you tried?

[coral wraith]

can you give me more details please

[bleak mural]

Ah…don’t suppose you could give me a nudge on which one I should use instead? I think I went through the entire list here —> https://hashcat.net/wiki/doku.php?id=example_hashes

[bleak mural]

The one from the resources folder, fastrack, rock you and on e from the passwords folder in Seclists

[fathom pendant]

You start from user 1, then go to user 2 after finding their credentials. Something about abstract thinking on why a certain file would be password protected

[fathom pendant]

What is the command you are running

[bleak mural]

||hashcat-m 1000 - a 0 hash file.txt wordlist.txt ||

[fathom pendant]

Is hash file in your filesystem with a space?

[bleak mural]

No, sorry, spellcheck decided to add that. Just put in pseudo names for file names. I’m using txt file for the hash.

[fathom pendant]

Does hashcat tell you it's exhausted?

[bleak mural]

Yeah, constantly 😂

[spring sky]

Anybody can help me with the question from WEB REQUESTS module, is the part of CRUD API. The question is the following: First, try to update any city's name to be 'flag'. Then, delete any city. Once done, search for a city named 'flag' to get the flag.

I've sent the correct request to update the city using London, and I confirmed the exitence of the "flag" city with another curl command, but after deleting london the request to flag has the same info I sent with the PUT request.

[torn blade]

AHHH

im fianlly on the last part of the file inclusion skill assesment

i can literally see the flag.txt file but cating isnt working

i am losing my mind

nvm im an idiot i just had to vent

i thought the flag would be standard HTB[] format but it was a random string

[fathom pendant]

Use rockyou and john.

[bleak mural]

Thanks, but tried that and I got this error —> Unknown ciphertext format name requested. I can only think that my hash is incorrect at this stage?

[fathom pendant]

Whats the md5sum of your hash
md5sum file

Note it worked with john without needing to change or alter anything to the file

[fathom pendant]

OK figured it out for hashcat; it's ntlmv2, so 5600 not 1000

For the raw hash you should get

If you don't have the full hash it will not spit the answer out

[neat laurel]

is there any social engineering machine or module

[bleak mural]

You my friend, are a MASSIVE legend!! Thanks so much 🔥😎

[fathom pendant]

It took me a bit of troubleshooting myself to figure it out

[bleak mural]

😆

[fathom pendant]

Then I did ctrl-f on the page and was like "ohhh multiple ntlm types"

[lament kiln]

how do i remove lightspeed from my windows 11 laptop

[fathom pendant]

Google it

This is wholly unrelated to academy modules

Looks like it's an mobile device management tool for schools

¯_(ツ)_/¯

[unkempt cedar]

New to the I.T. world. Was wondering if anyone knew which module would be a good start for me to learn some fundamentals that lead towards an A+ cert and then to CCNA cert

[pulsar needle]

Professormesser

[fathom pendant]

Any of the fundamentals modules really. A+ is fairly basic

[neat kiln]

Linux Fundamentals

[pulsar needle]

I studied for the A+ then I went into the fundamentals path, I feel it would be a bit brutal without the A+ knowledge (I didnt take the test lmao)

[fathom pendant]

Linux isn't gonna be on A+

[pulsar needle]

Lol

[fathom pendant]

Also ccna covers networking, security and like a few other things

[pulsar needle]

Have you watched the networkchuck CCNA course(the free one)?

[fathom pendant]

No

[pulsar needle]

Ah, i really liked that one

wait, this is off topic

nvm

[unkempt cedar]

no but I have seen it pop up. I just noticed that when I am in school for some of my networking classes that I don't have a clear understanding on networking and the terminology so I feel like I am lost when listening to people talk about numerous topics in cybersecurity. If it's broken down barney style then I'll be able to get it down

[sly grotto]

hey could you help me for Oracle TNS?
i logged in with the scott/tiger but i can not find the password hash for the DBSNMP user. any help?
select password from all_users where username = 'DBSNMP';
will not return password hash.

[nimble zinc]

hello i just joined the server so wtf is happening

[neat laurel]

nothing

[nimble zinc]

wait i think a joined the wrong server my bad

[neat kiln]

Could anybady explane why i have mistake: "exploit completed, but no session was created.", ehen I use "msf > use exploit/windows/smb/ms17_010_psexec" ? Thanks for you help.

[rustic sage]

Just saw your message. Did u fix it already?

Yes.

[fathom pendant]

Because something could have been incorrect in your exploit settings

[neat kiln]

i have used defoult settings, what was in MSF at the HTB virtual machine

[quiet ember]

Execise link?

[neat kiln]

https://academy.hackthebox.com/module/39/section/404

[quiet ember]

You could try using a regular reverse shell instead of a meterpreter one, sometimes that works for me

[twin gulch]

hey guys, im stuck at common services attacking - sql part. trying to log in htbdbuser user with no succes from mysql, getting error tmyj-7i2o

anyone who dealt with it before?

[quiet ember]

Whats the command you're using?

[twin gulch]

mysql -u htbdbuser -p 'MSSQLAccess01!' -h

[thorn urchin]

I dont remember that section but Id be shocked if a mysql db had MSSQL as part of the password

[twin gulch]

well that's the password written on the authentication

[thorn urchin]

yeah but are you positive its mysql?

[quiet ember]

Try impacket-mssqlclient

[thorn urchin]

mssql and mysql are different sql services

[quiet ember]

^ this

[sweet echo]

i need help ha(kers

[fathom pendant]

The point being: the password even tells you mssql

[thorn urchin]

Like its not technically impossible for it to be that way. itd just be a dick move by HTB

[fathom pendant]

Inb4 it's completely unrelated to the channel

[thorn urchin]

and I dont remember such a dick move

[fathom pendant]

That sounds more like something that would be on a box

[twin gulch]

well got it guys lol

[thorn urchin]

and I remember most of the dick moves

[twin gulch]

thanks

[thorn urchin]

np

[sweet echo]

ayo

[fathom pendant]

Ask your question

[sweet echo]

are you hacker?

[fathom pendant]

Ask your actual question here

You knob

[sweet echo]

private dm

[thorn urchin]

this channel is for academy module discussion only

read #rules and #welcome

[sweet echo]

hushhh

[fathom pendant]

You can feck off then

:)

If you don't have the balls to ask your question publicly and be potentially directed to the right resources. Then I'm not helping privately

[sweet echo]

they yall gonna report meh

[fathom pendant]

Then that is all I need to know

You can feck off now

[sweet echo]

fine shawty

[fathom pendant]

He doesn't know

[thorn urchin]

Ill do it anyways

<@&861185840277487616> person is spamming module offtopic stuff with trying to DM people about server breaking rule stuff.

[sweet echo]

okiiiiiiiiiiiiii

[sweet echo]

feck off

[thorn urchin]

not helping your case 🙂

[sweet echo]

i need hikers friends 😦

[thorn urchin]

This is clearly the worst possible way to do so

[fathom pendant]

I like to hike

[sweet echo]

ha(ker

[thorn urchin]

its not a curse word

you can say hacker

[fathom pendant]

Ha*ker

[sly grotto]

any help?

i tried. but only shows me the users

i could not find the syntax. if you know then, tell me

[neat kiln]

I had some progress, when i used "set PAYLOAD payload/windows/x64/meterpreter/bind_tcp" . I connected. But i can`t find file "flag" or dir "Desktop". Operation failed: The system cannot find the file specified.

se the Metasploit-Framework to exploit the target with EternalRomance. Find the flag.txt file on Administrator's desktop and submit the contents as the answer. It is the goal

[thorn urchin]

why are you trying hydra against a ssh server that doesnt support password auth?

and the second one the error says it doesnt support smbv1, so youll have to target smbv2 or smbv3 n such

[sly grotto]

:/
its oracle

i know the sql syntax 😐

[thorn urchin]

I dunno

if hydra doesnt support it try something else

[sly grotto]

that was a bug for the module
didnt show me the sys.user$ data

[twin gulch]

guys i messed up a little with impacket-mssql, trying to locate the user and know how to use sql language but not mssql much

[trail leaf]

Yes, and it’s generally a bad thing to do so a lot of people will turn that off

[thorn urchin]

Yup, doesnt necessarily mean guest has access to anything useful, but worth checking

[cunning isle]

hey guys, I am working on the attacking drupal in attacking common applications, and when I try to upload the downloaded php filter file the webpage claims the php filter is already installed but then when I go to make a basic page, the page does not have the option for me to make it a php filter. Am i doing something wrong?

[thorn urchin]

You did though

SHAREDRIVE is not a default share

smbclient is just giving you some errors about smbv1 which you already knew was disabled anyways

What prompt

Cause you have the listing command

and didnt specify a share to access

review your notes on smbclient

[civic zenith]

the nmap module was surprisingly tough for me to finish so I ordered the Official Nmap Project Guide by Gordon Lyon

hopefully it will make as good study material for the CPTS

[timber ore]

thanks @west canopy !

[whole grotto]

hi everyone i need some help, idk how can i transfer socksoverRDP binary from my linux to the pivot in the PIVOTING, TUNNELING, AND PORT FORWARDING module, idea ?

i have tested wget with a pthon server in my linux but does'nt work

[heady tusk]

what kind of access do you have to the pivot host?

[whole grotto]

local admin

[heady tusk]

no I mean like RDP/SSH

[whole grotto]

ahh rdp

it's a windows victim

[autumn pilot]

if you are using xfreerdp you can specify a drive (directory) that you can mount

[whole grotto]

good idea

[burnt sluice]

hello everyone

im stuck on the last question on the AD Assement part 2, my brain just blocked so if u have any hints on how to get the KRBTGT hash please let me know

[heady tusk]

I'm not sure how to hint this without straight up giving away he method. let's say there is a method for stealing all hashes there are, which would include KRBTGT

[trail leaf]

I would be concerned if you got all the way to the end of the module and didn't know how to do that

[heady tusk]

eh if you've been staring at it for a couple of hours your brain is gonna melt at some point

I believe it's supposed to be you finding some kind of documentation file and simply grabbing credentials from it, regardless of what it actually documents

[burnt sluice]

ty all it's been infront of me the whole timem

[heady tusk]

the service you're looking for is on page 2

anyone available for a hint for Linux PrivEsc / escaping restricted shells?
https://academy.hackthebox.com/module/51/section/1845

I've tried a bunch of stuff but I have no clue how I could escape this

[steady hawk]

You'll need to try additional techniques not covered in the module

[heady tusk]

I figured. any useful resources on this?

[steady hawk]

https://0xffsec.com/handbook/shells/restricted-shells/

[heady tusk]

alright, I'll read through it. thanks 🙂

got it. thank you very much 😄

[tidal mango]

I have a question on the Broken Authentication Module. In the Default Credentials section https://academy.hackthebox.com/module/80/section/772 The question is "Inspect the login page and perform a bruteforce attack. What is the valid username?". I already solved it by looking at the HTB forums and doing some digging etc. My question is, is there a logical way to determine the list of default passwords needed for this? Nothing in the section, none of the links etc, lead me to the answer. I see looking at the source code that I get the hint HMI/Scada but the company and answer are not on any of the github repos etc that are listed in the section. It seems like I am either missing something or this is a serious fishing expedition to guess the answer. I appreciate any feedback on this! Thank you.

[trail leaf]

The contents of the target webpage should give you hints for specific lists of default creds to look for

Saying anymore would be a bit too much of a hint

[tidal mango]

Ok maybe my google foo was off the first time, I just tried it again and duckduckgo gave me results for the first hit. I guess I was reading too much into the links etc provided in the module. Thanks!

[trail leaf]

It be like that sometimes

madf0x has been saying this, but if what you’re doing deviates from what the modules say, but you’re still getting to the same place, that’s good!

Experimenting and messing with things is key. Sometimes the module’s text just gives you the answer, other times there’s just a much better way to do things.

[thorn urchin]

There are other times where its deliberately designed that way too

Ever wonder why AD is after pivoting? Or file inclusion after ffuf?

😉

[tidal mango]

for sure, I get they want us to think outside the box! I get that tunnel vision somethimes...

[thorn urchin]

There are elements in those modules that wont be stated you should do at all, but are 10x easier if you apply lessons from earlier modules without being told to do so

[vale timber]

Hey! Would it be possible to get a nudge for the Documentation & Reporting Practice Lab in the documentation & reporting module? The one where you have to get domain admin by completing an in-progress pentest?

gotta admit, i suck at AD lmao

[thorn urchin]

What part are you stuck on?

you can get DA in 5 minutes of starting the lab

[vale timber]

well, thats good to know because thats the part im stuck on

what am i missing?

[thorn urchin]

ignore the in progress report, do what youd normally upon first landing on an AD network

[vale timber]

I'd fire up responder and see if I could get any hashes. Doing that i get a bunch of hashes from a bunch of accounts. I'm assuming the password for the Domain Admin is behind one of these?

[thorn urchin]

¯_(ツ)_/¯

Find out

[trail leaf]

Why ask when you can try

[vale timber]

cool, thanks!

[cyan cosmos]

I want to learn from some expert player.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[novel matrix]

@cyan cosmos ^

[cyan cosmos]

hi

[thorn urchin]

I mean theres plenty of juicy looking stuff there to start investigating

Press 'q' or Ctrl-C to abort, almost any other key for status
<REDACTED>         (?)     
1g 0:00:00:03 DONE

also spoiler

[zinc marsh]

ah lol I never use john

I thought that means that it was cracked not that it was the password lol

[thorn urchin]

I think you also have to add the format with --show for it to to reveal it properly that way, but idr

[zinc marsh]

me too but I couldn't find the ID for sha512

[thorn urchin]

https://hashcat.net/wiki/doku.php?id=example_hashes

[zinc marsh]

I know but no of them work

[novel matrix]

Thanks @rustic sage

[rare topaz]

lmao it looks like Moo32 snitched on himself if not for time difference

[sleek urchin]

Help pls have been stuck on this for days, AD Skill_2: Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host.

I have the CT***** user and i know this user could changes some information for high privilege users, and finishes everything

I have been trying to do so , with no results what so ever, any help is well appreciated

https://academy.hackthebox.com/module/143/section/1279

[thorn urchin]

its a skill assessment so what help can be offered is limited

but you already have a key user, and know it has privileges that can be leveraged

review the section notes about how to leverage those privileges

[sleek urchin]

I really did review the section notes, it doesn't seems to be working and don't know why

I can dm if possible

[thorn urchin]

Im headed to bed unfortunately

CVE for Instagram

ahahahaha

Your account is even verified

you should no this isnt the channel let alone server for this

[valid cipher]

i just want to know for some ethical testing

ive checked exploit db

but nothing

[thorn urchin]

you cant be real

gotta be a troll

<@&861185840277487616>

[valid cipher]

i asked for ethical reasons

how is it rule break

[thorn urchin]

its completely off topic, and theres no ethical reason for asking for a CVE for a public website

any variant of 'how to hack Instagram' is going to be a rule 4 violation

[rare topaz]

Bro thinks he can gaslight us like chat gpt

[valid cipher]

i just wanted to know how instagram had been hacked in the past

for educational purposes

[rare topaz]

You can search on bb sites for disclosed Instagram bb reports.

But this is the wrong channel, you're asking the most off topic thing there is.

[uneven grotto]

Hello does someone has any material about becoming proficient with Linux and windows shell command line ? Thanks

[valid cipher]

ok my bad soz

[rare topaz]

For Linux, setup a vm and get used to using it.

Linux journey helps too.

https://linuxjourney.com/

[uneven grotto]

Thanks

[sleek urchin]

SOLVED!!

https://academy.hackthebox.com/achievement/badge/c424b591-1d57-11ee-acfc-bea50ffe6cb4

[sonic ferry]

Did you get this to work? Once again the instructions in the module are way too simplified...

[sleek urchin]

Indeed, I just over complicated the instructions in the module

[sonic ferry]

But how did you manage to ssh to that address since it's giving the error for wrong password

[sleek urchin]

actually you can't ssh, only RDP is possible

i didn't try chisel {proxychains} though, i just wanted to finish the section

[sonic ferry]

Even with RDP i can't get the secretsdump to work..

[sleek urchin]

dm me

[maiden bear]

does anyone solved the updated AD assessment level 1?

[eternal zealot]

Hi! I need a hint for the windows escalation path. I am trying to resolve the finals skils (part I), but i am very frustrated. I cant upload any files in the victim machine. I tried a lot of ways. I can stablish connection with metasploit and manually with a reverse shell. Can someone give me a hint for the best way to escalate privileges? Thanks a lot

I have tried in metasploit with the upload function and in the reverse shell with modules to download files through powershell from my attack machine, but everything gives me an error

I was inspired to ask, I just got it jajajajaj

[neon torrent]

Hi

[valid cipher]

27 modules left until i become a hacker

[quick crane]

who can help me?https://academy.hackthebox.com/module/147/section/1335

[acoustic owl]

What exactly do you need help with?

[acoustic owl]

Then you take the exam?

[rare topaz]

well yeah he's required to XD

[valid cipher]

do i need the exam

i just wanna be a hacker

[rare topaz]

....legally...right?

[valid cipher]

yh ofc

legal

dmca and all that

[bright arrow]

he doesn't sound sincere

bring the lie detector

[acoustic owl]

You understand that
or 1=1

Congratulations, you are a hacker 🥳

[rare topaz]

well if you're doing bug bounties, you don't need the exam.

They don't require certifications to take part in those.

But if you want to get a job, then it's a different story.

[quick crane]

I got a person's smb credentials through crackmapexec in the medium lab, I got a Docs.zip file after connecting through smbclient, I also cracked it, but it was a docx document, I opened it with garbled code, so what should I do now

[valid cipher]

if i learn all of cpts i should have all the knowledge of a hacker right

[valid cipher]

i cant start working for another 2yrs unfortunately

[acoustic owl]

No, then you have learned the basics.
Okay, advanced basics, but in this field you will never be done learning.
Check out the Academy to see how many modules there are outside of the CPTS pathway.

[valid cipher]

way to many

how many have u done

[rustic sage]

[acoustic owl]

I have soon completed this module

[rare topaz]

bug bounties won't require the whole CPTS route, it's mainly just web bugs.

[valid cipher]

can u hack people now

ethically

and legally

[acoustic owl]

No, I can't hack people. How could I? A brain doesn't have a USB interface or anything.... 😉

[valid cipher]

come on u know what i mean

[acoustic owl]

I don't want to hack anyone's accounts at all. If I do, I want to help a company find vulnerabilities in their servers.

[rare topaz]

you can only hack someone if they consent or ask you to do so, or else it's illegal.

Doesn't take a genius to know all this.

[rustic sage]

classic alex

[valid cipher]

yes but sometimes people ask for penetration test on them right

[rare topaz]

no...?

[valid cipher]

to test for vulnerabilities

[rare topaz]

you don't penetration test someone wtf?

[acoustic owl]

Only companies do that

[proud pine]

Aside from being off topic, can we not humor him? He's asked nothing but inappropriate questions since he's joined.

[rare topaz]

Maybe if a person wants to know how much info you can get on them, or if you can get into their accounts, but that's just very very unlikely.

[rustic sage]

@proud pine first time reading him?

[valid cipher]

oh

[valid cipher]

srry i just didnt know

im new to all of this

[rare topaz]

hard to tell if somebody is trolling or genuinely oblivious nowadays

[acoustic owl]

If you attack someone's account, even if they ask you to, you must always get permission from the server operator as well.
The server operator must agree to a pentest

[valid cipher]

ok

[autumn pilot]

familiarise yourself with the #rules @valid cipher

[rare topaz]

i can never get why somebody wants to hack another person.

if it's easy for somebody as oblivious as you to do it, you should be worried for yourself.

[rustic sage]

@rare topaz except htb machines

[novel matrix]

Let's stick to the channel topic otherwise, either take it to #general or DM's. thank you

[quick crane]

who can help me this modulehttps://academy.hackthebox.com/module/147/section/1335

[acoustic owl]

DM

[sterile hawk]

🤔

[acoustic owl]

Nö

[compact patrol]

maxi._09 (733343360261161021) has been banned until 2133-05-02 12:00:54 (UTC). Could not DM banned member due to permission error.

[acoustic owl]

Thanks 🙂

[west rampart]

Anytime! 🙂

[pulsar needle]

Has anybody completed 80/80 of the modules?

[heady tusk]

If anyone is at least close to it that would be PayloadBunny but I think he isn't quite done either

[quick crane]

help me:https://academy.hackthebox.com/module/147/section/1335

[pulsar needle]

Wdym lol

[pulsar needle]

Oof

[quick crane]

what your mean?

[pulsar needle]

What is the question you want help with? What is the issue you are having?

[sly kelp]

What did you try to get the flag mind sharing your process and at what point are you stuck?

[quick crane]

Now I've reached the critical stage. I'm logged in to jason's server, but I don't know what I'm going to do to get into Dennis's server and read flag

[zinc sentinel]

Slow and steady

[quick crane]

Now I've reached the critical stage. I'm logged in to jason's server, but I don't know what I'm going to do to get into Dennis's server and read flag

[heady tusk]

Do some more enumeration on the server. Jason can get dennis' password

[quick crane]

I've enumerated jason's services, but I don't know what to use next. What should I do

[heady tusk]

What services does he have access to?

[quick crane]

mysql？

[timber ore]

thanks @west canopy

[turbid jolt]

in Web Server Pivoting with Rpivot the flag I got from the webserver isnt working, for the question: Using the concepts taught in this section, connect to the web server on the internal network. Submit the flag presented on the home page as the answer. Can somebody help me with it please?

[heady tusk]

ah sorry for not responding. yes, that seems interesting

[quick crane]

I connected to MySQL, got Dennis's password, and now I'm logged in to Dennis, but then I'm running out of ideas

[rustic sage]

is this password attacks medium?

[ivory dock]

Stuck on pivoting skills assessment and would appreciate some help with the final hop. I have access as ||mlefay|| to the first internal network host ||172.16.5.35|| and also got what I'm pretty certain are ||vfrank credentials (cleartext and NTLM hash) with sekurlsa::logonpasswords on .5.35||. I ran powershell one-liner to ping hosts in the ||.6.0/24 subnet|| and have come up completely empty handed. I'm also running the command in a cmd prompt running as administrator. Any nudge would be appreciated.

[quick crane]

yes

[rustic sage]

Nice, I am right behind you 🙂

[rustic sage]

You can dm me.

[bright arrow]

looks behind themselves frighteningly

[rustic sage]

I can help you out with this, you just need to find live hosts in the subnet.

Dm me.

[heady tusk]

umm you should find hosts in that subnet. I suspect you need to increase the timeout as connection in the internal network is very slow

[ivory dock]

ahh okay I'll try that

[floral fulcrum]

[-] Kerberos SessionError: KRB_AP_ERR_BADMATCH(Ticket and authenticator don't match)

[cedar void]

for the 'Introduction to windows command line" module , everytime I ssh into the machine why does it automatically take me to the Powershell prompt but not the command prompt? How do I get to the command prompt?

[plain coral]

Can’t you just type cmd in PowerShell to get to the command prompt?

[ember dragon]

Hi friends, I am stuck in Footprinting Lab-Easy. I have connected into the sftp server and have found the flag.txt. I am having trouble reading it. I cant cat it. it says invalid command. Can I get a hint please?

[pulsar needle]

simply write "cmd"

[rustic sage]

Hi

FTP is used for file transfers

Transfer the file to your local machine

[plain coral]

You cd to the flag directory, then you can cat flag.txt

[plain coral]

Your logged in as ceil right?

[ember dragon]

yes I did. Looking up where is the file I trx.

[plain coral]

Use ls -la

[ember dragon]

Thank you so much for prompt support!

Will mess with it!

I know I am very close

[plain coral]

Use cd .. to move to the parent directory.
Type ls -la to see a detailed listing of everything, including hidden items.
Use cd flag to navigate into the “flag” directory.
Enter cat flag.txt to view the content of the “flag.txt” file.

[pulsar needle]

I am trying to look for a host with the FQDN that ends with x.x.x.203

I cant find it

[rustic sage]

you may need to code a script for this to loop through what you already have and find more subdomains

[pulsar needle]

I tried doing it manually, but didnt find anything

[rustic sage]

module has provided you two I think

[pulsar needle]

Yes

[rustic sage]

first try is going to be easy:
try zone transfer on all websites/zones you hvae found

then move on to more time-consuming steps such as bruteforce

[pulsar needle]

ayayay ok

[wraith mural]

Same, I can't figure out the htbuser password, I also found the 5 possible passwords, but none work.

[past garden]

DM me

[heady tusk]

I need a hint for linux PrivEsc logrotate. I'm unable to figure out which log is being rotated. pspy told me that there is a cronjob running that rotates it but I can't figure out which one. is there a way to figure it out or do you have to just try everything you stumble upon?

[trail leaf]

Try appending data to some interesting looking log files. The one that gets removed shortly after is the target one.

[past garden]

I had the same issue first. It turned out I didn't try all combinations

[trail leaf]

Normally the rotation would take longer but they set it up to go every 5 seconds iirc

[heady tusk]

yeah I've seen that. aight lemme try

[whole grotto]

hi everyone, i'm a little bit stuck at the 3 last questions of the port tunneling, forwarding... skill assessment, i found the user vfrank but idk how can i get his password ? can someone help me pls ?

[ivory dock]

I tried adding a timeout in windows CMD (no timeout option I'm aware of for powershell) and the whole loop completes in a second... 😅

[whole grotto]

let 100, you have to start it mutiple time for it to work

[heady tusk]

okay I found the log and logrotten is saying that it rotated and that my payload has been copied over. I'm not getting a reverse shell though :/

[heady tusk]

worked well with 200 for me

[pulsar needle]

None of these have the IP, i tried bruteforcing the other subdomains and I got nothing

[ivory dock]

Trying it out now

[vocal tusk]

guys im banging my head against the desk for the last few hours with something non htb related is it allright if i ask here its a linux thing im trying to do for some extra practice

[acoustic owl]

Use the smallest list. If you don't find anything, use the next larger list. 5000 entries are too many

[heady tusk]

got it 🙂

[whole grotto]

I found the vfrank hash but i can't crack it, is it normal ?

[heady tusk]

That's which module/section?

[pulsar needle]

So it stops after 5000?

I tried with 11000

And found nothing lmao

[acoustic owl]

No, but all lists with 5000 and more entries do not contain the searched host 😉

[pulsar needle]

WHa

[acoustic owl]

Look at the hint

[ivory dock]

finally found some new hosts!!

thanks! @heady tusk @whole grotto

[heady tusk]

Awesome 🙂

[pulsar needle]

So, I should use a different wordlist

[whole grotto]

ok i found his hash but should i have to crack it, because i tried with rockyou and i found nothing

[rustic sage]

hey everyone , I am new cyber security

[rare topaz]

sup

[rare topaz]

whats the hash in?

[heady tusk]

You actually don't need to crack it. You can find a cleartext version

[whole grotto]

really ? how ?

i dumped it with mimikatz

[heady tusk]

Check the output again

[pulsar needle]

I have tried all of them, from the ones that dont give errors ive got this

[acoustic owl]

5000 are to big

[whole grotto]

i see nothing, i ran this command : sekurlsa::msv

[heady tusk]

Bunny, may I ask how many modules you've got done? Iirc you've been pretty close to having all of them done

[heady tusk]

How about sekurlsa::logonpasswords?

[whole grotto]

how ty

[whole grotto]

[heady tusk]

🙂

[acoustic owl]

#modules message

[heady tusk]

Ah cool 🙂
Gonna take me a while to catch up to that 😄

[acoustic owl]

at some point you get addicted to these modules

[heady tusk]

Yeah I'd probably be doing them all day if it wasn't for uni keeping me busy

[whole grotto]

did you finish the module ?

[heady tusk]

I've done CPTS path all the way up to Linux PrivEsc. currently working on that

[acoustic owl]

well, actually it's just a login and not a real priv esc

[whole grotto]

oh ok cool, so do you if it's normal that the xx.xx.10.5 it's note up for the last question ?

[whole grotto]

is it the dc ?

[heady tusk]

that host is supposed to be up, yeah

[heady tusk]

||yes||

[whole grotto]

and i have to rdp on it

[heady tusk]

if it has RDP up, sure

[whole grotto]

[acoustic owl]

What did you find?

[rustic sage]

I have notes on these but they are a little rusty, dm me.

[gloomy ibex]

Hack the planet!

Muhahaha!!!

[whole grotto]

RDP is not up

[quick crane]

who can help me the modulehttps://academy.hackthebox.com/module/147/section/1356

[rustic sage]

what have you tried so far?

[acoustic owl]

What does not work?

[quick crane]

I will Dm you

[rustic sage]

Sure, let's solve it 🙂

[heady tusk]

I know. But there is another way

[whole grotto]

psexec ?

[heady tusk]

Haven't tried that. Did something much more simple

But there are multiple ways at this point so feel free to experiment

[whole grotto]

i go too far ahah

ty

[rustic sage]

I tried ssh root@{ip} -p {port} -i id_rsa, and it's nor working for some reason. Do you have any idea why?

[rustic sage]

What Have you done so far

I gained access to user1

and copied id_rsa from root, but it's not connecting for some reason

[rustic sage]

Is this an exercise?

yes

[heady tusk]

Have you checked permissions on id_rsa?

[rustic sage]

yes

[rustic sage]

Which exercise?

shh doesn't connect

Getting Started Privilege Escalation

[heady tusk]

Well then providing us with the error message would probably be helpful

[rustic sage]

Yh definitely

that's the problem, there isn't an error

[heady tusk]

Huh

[rustic sage]

Maybe check your pwnbox connection

Or the ssh key was copied correctly

[rustic sage]

Let me see my notes

I used cp to copy the ssh key

[rustic sage]

Okay

and wc -l says they're the same

Then I don't know why the ssh ain't running then

neither do I

Damn

[rustic sage]

I don't have notes on these but I am sure it was something very simple. Are you at initial foothold stage or do you already have access to the machine?

it's very simple

[rustic sage]

Did you resolve it?

If no, share your errors and I might be able to figure it out.

[brittle herald]

Passed my CCNA today... Now I'm ready to knock out these modules (after a week's rest) 😄

[acoustic owl]

Congrats 🎉

[scenic badge]

Hello guys! I need help in one question for "Filter Contents" exercise in Linux Fundamentals module, the last question with host "https://www.inlanefreight.com" not works.

[acoustic owl]

What exactly is not working? What have you tried?

[scenic badge]

The command curl in this URL not working

I have tried curl in ssh connection and in my machine

[acoustic owl]

It's a com address, you can access it from anywhere.

[pulsar needle]

I cant understand the question?

Did you try to SSH to the website?

[night karma]

Hi all I'm new here just joined

Where is the discussion for begginers ?

[scenic badge]

no, i use the ssh connection for connect my machine in vpn

and inside htbstudent user i tried use curl in this url

The question is ""

"Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer."

[acoustic owl]

The PwnBox does not have access to the Internet, right?

[scenic badge]

right

in my machine not works too

[night karma]

Sorry to interrupt dudes...but is there no begginer discussion section?

[acoustic owl]

Then it can not work

[acoustic owl]

why not?
I have just tried it and it works fine

[scenic badge]

lol i will try again

[night karma]

Hello..can anyone see me typing?

[rustic sage]

Hi

Welcome

Wait a moment, I am about to find the link

[night karma]

Ahh ok 👍 I was worried I had to do more verification lol

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rustic sage]

Check this out ^

[night karma]

Thank you 😊

[rustic sage]

No worries, if you have more questions, you may ask them on #general

[scenic badge]

My command: curl https://www.inlanefreight.com
Response: curl: (6) Could not resolve host: www.inlanefreight.com

[acoustic owl]

This seems to be a DNS problem.

[scenic badge]

hmmm how i can solve this?

[acoustic owl]

What happens when you enter dig www.inlanefreight.com?

[scenic badge]

i have a response

";; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 47570"

[acoustic owl]

;; ANSWER SECTION:
www.inlanefreight.com. 60 IN A 134.209.24.248

[scenic badge]

not have this line

[acoustic owl]

and with
dig www.inlanefreight.com @1.1.1.1

[scenic badge]

with this command i have a authority section

maybe i need change the DNS?

[acoustic owl]

Yes, your DNS resolver does not seem to resolve inlanefreight.com.

[acoustic owl]

Authority? You mean Answer?

[scenic badge]

In got answer line

maybe the DNS no resolve the host

i will change

this is it, the DNS not resolving the host, thx for the help!

[acoustic owl]

Probably your DNS resolver requires DNSSEC.

[noble fiber]

Hi guys, im not able to proxy ffuf request, on ffuf itself with -proxy-reply nor with proxychains (i wanted to proxying the tool to view some requests through Burp). Does anybody have the same problem?

I tried with dirb and it worked, but when i try ffuf it doesn't(via proxychains as taught on the module "Using Web Proxies")

[rustic sage]

Which section is that, can you send its link?

[noble fiber]

module/110/section/1053 is the guide i followed

[rustic sage]

Are you trying to solve the exercise or is it something else?

[noble fiber]

I'm trying to solve an exercise on the FFuf module, and i encountered this problem

I can work around on this, but i just wanted to know why i'm having problems proxying ffuf

[rustic sage]

The section you have linked does not mention ffuf anywhere.

Nevertheless, proxychains has a config file, it's going to use a proxy for making connections. Make sure it was setup properly

[noble fiber]

Maybe wrong sections to ask help, i do apologize, thank you anyway

[rustic sage]

No it's okay, you are working with ATTACKING WEB APPLICATIONS WITH FFUF and you are trying to reuse what you learned in using web proxies on a exercise but this time with ffuf, is that correct?

[noble fiber]

Yes, correct

[scenic badge]

i got it by changing the dns settings, thx for help

[rustic sage]

I can understand a little but don't give up. Try to explain your issue with a little more details and see if someone else has a clue.

[noble fiber]

Thanks once again, i will

[ivory dock]

Stuck on pivoting assessment. I am currently RDP'd into ||.25|| as ||vfrank|| and can see that the next hop is to the DC. However, I have no idea how to get access to the DC. I ran an nmap scan and didn't find any open ports, and I can't seem to connect to the DC at all.

[quiet ember]

Check for ||shares||

[ivory dock]

Bro, just found it. 🤦‍♂️

thank you anyways

[quiet ember]

No problem lol

[timber hatch]

can someone give me a hint at the WINDOWS ATTACKS & DEFENSE , "After performing the Kerberoasting attack, connect to DC1 (172.16.18.3) as 'htb-student:HTB_@cademy_stdnt!' and look at the logs in Event Viewer. What is the ServiceSid of the webservice user?"

[acoustic owl]

The event ID is communicated in the module.

[summer lava]

please.. anyone avaliable to offer little help on LINUX PRIVILEGE ESCALATION ==>> Logrotate

[rustic sage]

Hi

I know that one is very difficult

I can help you out, dm me

[verbal mountain]

I would like to start a study group for the people just starting out on HTB. DM me to discuss.

[zinc marsh]

I am mounting another vm with windows 10 to run dnspy, visual studio and that things. Do u think it is worth it having both?

[acoustic owl]

Check out ComandoVM
https://github.com/mandiant/commando-vm

[zinc marsh]

ty

that is installed with pentesting tools already?

[acoustic owl]

This script installs hacking tools on your Windows VM

[zinc marsh]

oh nice ty

[acoustic owl]

But it is already a bit older

[zinc marsh]

I can install when I need the tool manually

[final maple]

I used https://gchq.github.io/CyberChef/ It has a much easier interface than Burp or ZAP.

[plain shell]

Heyyy - Just completed the XSS module and I'm also working on the port swigg site and the stuff over at swigg has quite a few extra layers of complexity - is there a more advanced XSS module that anyone knows of? the academy platform is leagues ahead so if possible Id prefer to use it 😄

[trail leaf]

that's the classic ctf experience

[trail leaf]

There are so many ways that things can happen that I don't think it's necessarily wrong to use something that isn't explicitly stated in the module, and many times (as you noted), it'll stick with you as an option going forward.

That being said, started doing the password attacks module to see if it is as bad as people make it out to be, and whoever made the password mutations challenge just really wants you to waste your time huh

[red current]

Is anyone available to assist with a question in the Attacking Enterprise Networks module? I'm having an issue with the Web Enumeration & Exploitation section. I've tried different payloads using sqlmap to get access to the database and nothing seems to be working.

[tidal mango]

Do you still need help? I might be able to

[red current]

Yes, I could use some help. Thank you!

I'm on the fourth question and I'm trying to use sqlmap to get into the database and so far nothing is working.

[tidal mango]

Did you review this module? https://academy.hackthebox.com/module/33/section/217 it should help, looking at my notes that was what I started with

[tidal mango]

I did not use sqlmap, I did it manually. Oh wait scratch that I did it both ways..

[red current]

No, this is the module. https://academy.hackthebox.com/module/163/section/1544

[tidal mango]

Yeah I understand that. The module I referenced is worth reviewing for the part you are on. What have you been trying? Maybe showing some of what you tried will give me a better idea of how to help.

[red current]

Ah, gotcha. I misunderstood.

I've been just trying different variations of sqlmap with different level and risk switches. So far, it looks like sqlmap just doesn't work here.

[tidal mango]

it does work, are you trying on a GET or POST request?

[red current]

It was a POST request.

I'm guessing I probably need to try a GET instead?

[tidal mango]

ok good, I captured the request in Burp and saved it as a file, to make it easier to deal with.

[red current]

So a POST is fine?

I have it saved to a file as well with the searchitem set as my injection point.

[tidal mango]

that sounds right

your getting nothing at all on it?

[red current]

I get the same output in the lesson when I run this command $ sqlmap -r sqli.txt --dbms=mysql -D status --tables. However, when I try to modify it and add switches for level and risk, it just runs forever and appears to just continously start over.

[tidal mango]

I dont think you need to mess with level and risk, your pretty much there, you just need to pull the data...

[red current]

I guess that's where I'm confused. I don't see how to pull any data if I can't get logged into the database.

[tidal mango]

use that same command you have shown me, you just need to tack one more thing onto it..

How would you dump data out of the table?

[red current]

Yeah, it's a dump alright. I got it! Thank you!

[tidal mango]

No problem!

[red current]

I just couldn't recall how to get the database to dump its contents. I was looking all over for it and I kept over looking it. Thank you so much!

[tidal mango]

For sure! happy to help, I know how that tunnel vision etc can go...

[red current]

I really thought the only way was to find a way to log in.

Yeah, no kidding.

[quick crane]

for this module ：https://academy.hackthebox.com/module/147/section/1356, I find a file that name is Backup.vhd,I got this file through smb protocol from David's user. How do I decrypt this file

[tidal mango]

If I remeber correctly that is a Windows backup, you need to figure how to mount it. I know there was some information on how to do this in Linux, I ended up booting into a windows machine and mounting it in there. I am going off memory so I might be off.

[quick crane]

so can you help me

[trail leaf]

Is the initial bruteforce for Password Attacks - Hard skill assessment supposed to take this long?

Feel like I've been letting this run forever, and not sure if there's anything better I could be doing

[rustic sage]

Not really, the ssh doesn't seem to be working, even if I make a mistake on purpose still doesn't reject me

[steady hawk]

Were you able to get it?

[trail leaf]

we are about an hour in, probably a little more

but haven't exhausted the list yet

[steady hawk]

There are some lists provided in the resources, it should only take a couple of minutes

[trail leaf]

using those lists with the mutations and have gotten nothing

[steady hawk]

Strange

[rustic sage]

@rustic sage It works when I ssh from my pc rather than from user2

[rustic sage]

hey what are you talking

[vital adder]

no idea why but the brute forcing for for the initial foothold could be buggy for me so i just give that a quick try and was able to get the password in about 1 min

you have RDP with that user so iether use xfreerdp with a mouted share drive or just use updog

[finite basin]

I am having problem with unlocking modules

[vital adder]

contact support via the chat bubble

[kind fern]

Hi, I'm in 'AD Enumeration & Attacks - Skills Assessment Part I' is anyone have any idea about how to download Rubeus tool to the target machine?

[zinc sentinel]

What access do you have already ?

[vital adder]

if you are on the first machine just host a python server and wget the tool on the target machine but if you are on ||MS01|| then there an existing web site on the first machine so just put the tool there and on the second machine wget the tool from the first machine running site

[gritty galleon]

TAT

[gritty galleon]

finally QAQ

[umbral wigeon]

just finished Password Attacks module... definitely need more than 8 hours -.-

[gritty galleon]

Skills Assessment on progress

[acoustic owl]

The important thing is that you have understood everything, not how long it took you to do it.

[gritty galleon]

hydra toooooo slow (

[rare topaz]

better to suffer the 8 hours in training than in a real job

[gritty galleon]

lol

[sly kelp]

Sweat in training so you don't have to bleed in battle

[gritty galleon]

POWER

[umbral wigeon]

Yeap. It was tiring but satisfying at the end 😀

[pulsar needle]

How can I find the mail of the administrator when I have a IMAP/POP3 server? I have tried to connect to these servers and list out the mails but I got nothing, then I tried to use NMap and got nothing, then I used curl and I got nothing. Is the answer a part of the banner?

[wraith abyss]

Can someone help me on Attacking Common Application - thick client, where I already downloaded the fatty-server.jar but for some reason it's not opening. stuck in this machine for 4 days 😦

[fiery berry]

"[...] I have tried to connect to these servers and list out the mails but I got nothing [...]"
Try to give it another go and pay attention to the output it may be that you have overlooked something

[pulsar needle]

There are 0 mails on both of the servers

[autumn pilot]

keep enumerating

[wraith abyss]

I'm encountering the same problem. anyone who could give me hints? thanks in advance.

[pulsar needle]

Does this mean i cant select them but I can still list them?

WHA

Its case sensetive

Omah

:I

Lol

yes, i found it but aaaaa it would have saved so much headache knowing that

[burnt sluice]

hello guys, im looking for a piece of advice if anyone got one, i have finished the AD enumeration module but I don't feel like I've digested all of it's contents, and the assessment felt like 30% of what the contents rly were, is it normal and i just have to practice more or should i go back and redo the module until I've digested every concept there?

[pulsar needle]

If you go back you'll learn it now, maybe to the same level, if you try to do a box or lab you'll learn it and get a deeper understanding

(My opinion, or you could do both)

[rare topaz]

go through it again, but i can suggest creating your own simple AD lab to play with things. or finding an AD lab online

[proud pine]

You'll get some more when you get to the 'Attacking Enterprise Networks' module.

[rustic sage]

Can you ping the host from user2?

[pulsar needle]

I can't seem to find the flag, I have found 1 mail and 2 emails but the flag was neither of those

[rustic sage]

@rustic sage no, but I can connect from my pc. It must be a bug or something like that

[burnt sluice]

oke oke, ty all

[rustic sage]

Isn't this the one where you need to find a flag in inbox?

[rustic sage]

if user2 can't ping the host then it's a network related issue, but you got the flag right?

@rustic sage yep

[slate palm]

the council has decided skill issue: I completed the AD Enumeration & Attacks - Skills Assessment Part I but I had no luck getting the second users cleartext password. I tried what was suggested in the chat but no luck 😦

[coarse raven]

I can create new files or directories

ah nm lol

im in the users dir, had to go up a few levels!

[forest tree]

Hi I am hardstucked in footprinting module in the DNS Section

Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain.

[plain coral]

Try dig any inlanefreight.htb @10.X.X.X

[forest tree]

Already did that

none of the results here count me as correct answer

ok thanks got it @plain coral

[slate palm]

FML just because you cant psremote with it doesnt mean its not real

[quick cloud]

Im stuck on attacking common services easy. I found the user and the user's password but cant figure out how to use these credentials to get the flag

any hint would be great help! I also attempted to use curl to upload web shell but couldnt get it to work. Now im wondering if It was even inteneded to use curl

[rustic sage]

Section link would help here

[quick cloud]

https://academy.hackthebox.com/module/116/section/1466

[rustic sage]

dm me

[rich wraith]

why do I need " cn' " there?

[rare topaz]

you dont

it's just an example data

the first ' is the entrypoint of the injection

[rich wraith]

Oh I understand, thanks

[quartz stag]

hi guys, I'm new to cybersec/HTB Academy and am hoping for some feedback. for the Hacking Wordpress assessment, to find flag.txt in a directory I did wget to download all txt files from the two vulnerable plugin websites and then used tree to find the file. unfortunately no luck finding the file.

could anyone nudge me in the right direction without giving the answer? definitely stuck on this

[cedar void]

I am having trouble ssh's into this particular address with the password "previous result" in the Skills assessment section of the 'Introduction to the windows command line " module and I think it has something to do with the space between the two words for this password.

[cedar void]

Nevermind, I fixed it . I was supposed to use the result of the previous flag from the previous question and so I misunderstood

[mortal shadow]

https://academy.hackthebox.com/module/35/section/224
web server seems bugged, web server says "Received content contained invalid JSON!" evenotugh it's working with postman, etc.

[rustic sage]

hi

[pulsar needle]

So the flag is in the Inbox? But there are no mails there

what is uidnext?

[quartz stag]

finally figured this one out..... talk about a simple solution

[spring sky]

Hello fellas, I'm stuck with a file inclusion lessons, to be more specific this one: Fuzz the web application for other php scripts, and then read one of the configuration files and submit the database password as the answer. I already tried with the ||php://filter/read=convert.base64-encode/resource=config|| payload, but the only thing I get is a blank zone in the website. Same thing with other php filters from payloadallthethings

[floral fulcrum]

anyone can help me out with verifying? i tried /verify in the bot-commands channel but its been stuck verifying since

[tulip coral]

Hey need help with attacking common services the EASY lab

[slate palm]

make sure you use the correct quotes

[spring sky]

https://academy.hackthebox.com/module/23/section/1492 this is the lesson I'm stuck with

[pulsar needle]

I can only find tree emails and one mail, when i try to submit the emails it dosent work

I try to input the emails and it dosent work :I

[acoustic owl]

Flag, not Mail Address 😉

[mortal shadow]

i have

even used checke with the commands from the cheatsheet

[pulsar needle]

No?

[hazy grotto]

Hey!!!!

[quick cloud]

Can anybody help Module: Attacking Common Services Section: Attacking Common Services Easy? I don't know what to do after I find the user:pass of the user. Things ive tried is doing the cURL command I found on the htb forum but I cant get it to work. Is what I have to do even covered in the module attacking common services?

[hazy grotto]

Just the person i wanted to talk to

[acoustic owl]

Hi

[hazy grotto]

https://academy.hackthebox.com/module/51/section/1777
Linux Escalation.

What is the latest Python version that is installed on the target.

I found the answer and submitted it. Although I'm unsure how to get it. Python --version or -version or -v doesn't work.

[spring sky]

dpkg -l

And you can see the packages installed... dpkg -l | grep "python"

[acoustic owl]

|| Simply look in the installation directory ||

[hazy grotto]

apt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.lis

This?

[rustic sage]

list all installed packages and grab python, easy

[spring sky]

By the way, I'm still lost with the file include exercise 😆

[acoustic owl]

There are several ways

[hazy grotto]

Thanks

[hazy grotto]

Your EZ

[spring sky]

If anybody has a clue, it will be welcome ^^

Just a clue, not the answer please.

[hazy grotto]

Ok I was going through that huge list and trying a few and i was like meh there must be a different way. But i see where i was blind.

[rustic sage]

You can dm me.

[hazy grotto]

Thanks for the fast and awesome input everyone.

Muah

[pulsar needle]

It still dosent work

[spring sky]

Noke1, that's not the flag... The flag should be something like HTB{W3ll_D0n3_Th1s_1s_4n_3x4mpl3_0f_4_Fl4g}

[pulsar needle]

Why does it specify the format then?

[spring sky]

Yes, that's the format... HTB{The_Flag}

Try to look something like that in the exercise.

[pulsar needle]

I have several, but they are from past exercises

I cant get it to show

I searched for the email which contains "HTB{" then I try to fetch it and I dont get the flag

how

lol

[rustic sage]

Wanna do vc in private?

[pulsar needle]

ok

[tidal mango]

Did you get it?

[raven locust]

make sure you’re aware what you’re doing there

you’re fetching the subject only

[pulsar needle]

Yes

I found out

I found the flag

I was stupid lmao

[raven locust]

nice, gj

[pulsar needle]

I read the documentation

xd

I had to ||Fetch the body text||

[raven locust]

yeah, i was gonna suggest the rfc page

[rustic sage]

Is this a code project?

May I suggest using github?

alrighty 😄

[pulsar needle]

Lol

Uploading it to discord seems sketch

[fossil crescent]

Anyone avail to chat about the linux privesc: logrotate? DONE. Thx c0nstant and scriptie

[forest bolt]

Repo

Wtf

[rustic sage]

I can help you out with this. Dm me.

[forest bolt]

Logrotate

I’ma walk away and pretend I understand

[misty current]

Idk if it was just me but, the position of the arguments used for the exploit mattered.

Ah, Thanks! xD

[rustic sage]

suggestion: you can use github's gists for smaller things, here is an example of one my rusty codes:
https://gist.github.com/0xkasra/bcc222d180a1cc00e819d97a4570928a

[atomic thicket]

struggling on AD Enumeration & Attacks - Skill Assessment Part II, Q7 ("Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host")

I currently have a shell on SQL01, but failing to ||exploit PrintNightmare as the POC script errors with "Failed to enumerate remote pDriverPath" even though I validated that the SMB path to my DLL is valid.||

||I also tried JuicyPotato, but for some reason I am unable to write to any directory from the service account||

any suggestions appreciated, stuck on this for days

[tidal mango]

try another escalation technique. ||Print nigthmare is close...||

[trail leaf]

There is a writeable location on that host, there are more places than C:\Windows\Temp 😉

[mortal shadow]

got it

thought it ended with cd ..

[rustic sage]

-d is not necessary

[kind fern]

In 'AD Enumeration & Attacks - Skills Assessment Part I' how to find 'Submit this user's cleartext password.' it is Q6

[rustic sage]

Yeah, it's going to be fun

[autumn pilot]

Kindly, please do not post and upload any ZIP files, no matter what they have inside

Plus do not spoil with any commands any of the exercises that are not from tier 0 modules

[slow ruin]

Anyone able to give me a nudge on Linux Privilege Escalation - Logrotate?

Found the .log file and it seemed like the log did rotate and got some output that looked promising but still not able to catch a reverse shell

[rustic sage]

Deleted.

[mortal shadow]

tried to re-create the example

[-] The following options failed to validate: Value 'PORT' is not valid for option 'RPORT'.
RPORT => 80

RHOSTS = Target

[atomic thicket]

any suggestions for how to enumerate for it? been manually digging for it for some time due to no luck with tools

[heady tusk]

logrotten will print "Done!" if it actually worked. might have to run it multiple times from my experience

[trail leaf]

You could do some looping with icacls, or you could look for a particular "user". That said, I just knew about this place, didn't need to enumerate.

If you want to wrestle with that some more, be my guest, otherwise, click here: ||C:\Users\Public||

[slow ruin]

Can I dm you?

[heady tusk]

sure

[atomic thicket]

ah, that was my first intuition on this box
looks like the shell is at fault then 😓
at least that narrows it down, thank you

[rustic sage]

Hi people, is there someone on sau machine ?

I’m kinda stuck in the part of redirecting the 55555 to the filtered port 80