modules

[rapid lion]

i can't register in thes url https://app.hackthebox.com/invite

just pop up network error

[sudden flax]

@eager merlin i don't know what to tell you

[eager merlin]

https://www.youtube.com/watch?v=LMCKbR_wWds&t=241s

[rapid lion]

any suggesstion?

[fresh compass]

Hi! I'm struggling with the Attacking Common Services - Hard lab. Anyone can help me?

[acoustic owl]

Works for me

[fresh compass]

I can access to || rdp || with || fiona || user but I cannot use || mssql with sqlcmd ||

[rapid lion]

can anyone tell me please

[fresh compass]

I can impersonate || john with sqsh || but I cant go in through there

[eager merlin]

i would suggest to clear cache and cookies, try again

[acoustic owl]

Take a look around. ||Are there linked servers?||

[rapid lion]

just pop again ,network error!!!!

[acoustic owl]

Check your DNS
dig app.hackthebox.com

[fresh compass]

Yes! I have found || LOCAL.TEST.LINKED.SRV || and I see some info executing || EXECUTE('select @@servername, @@version, system_user, is_srvrolemember(''sysadmin'')') AS LOGIN = 'john' AT [LOCAL.TEST.LINKED.SRV] || through sqsh but I'm stuck here

[rapid lion]

app.hackthebox.com. 1 IN A 104.18.21.126
app.hackthebox.com. 1 IN A 104.18.20.126
have the's

[fresh compass]

So I'm trying to access through || sqlcmd in fiona rdp session || with no luck

[sudden flax]

@eager merlin cmp_seq=3 Destination Net Unreachable when i use ping and ip from HTB

[eager merlin]

screenshot?

[acoustic owl]

You do not need RDP
You can do everything with sqsh

[fresh compass]

So how can I impersonate || testadmin || executing commands as || john ||?

[sudden flax]

i can't send

[acoustic owl]

read and follow #welcome

[acoustic owl]

J* has all the rights you need

[eager merlin]

I sent you a DM

[fresh compass]

Okey, everything done... thank you so much!

[fathom pendant]

You included the : to the emote in your copy paste, it fucked up

But proud of you my boi

[zinc sentinel]

https://academy.hackthebox.com/achievement/710422/path/16
🥳

[acoustic owl]

No
Read the #rules

[barren apex]

bruh havent you asked this question about 5 times now

[fathom pendant]

As that's explicitly illegal: no

[rustic sage]

what was he asking?

[vital adder]

some ddos stuff, that dump dump spam here before but last time someone try to help him so he just come back and ask the same thing

[rustic sage]

wtf

[shut wraith]

Hey @vital adder do you think it's enough to do the modules and exercises or is it a must to have VIP and do the extra boxes

[fathom pendant]

Everything on the exam is in the modules

[vital adder]

for what? the CPTS exam??

[rustic sage]

Which retired htb machine involves AD?

[vital adder]

there is a filter for this but it's kinda ass

[shut wraith]

For the exam and for Pro Labs & End games

[rustic sage]

that's why I like to ask people. It's a better filter

[vital adder]

if you are asking is only doing the modules enough for the CPTS then yes

but if you want to go a bit further then the prolabs

[rustic sage]

@vital adder I think you need to some htb machines to fully understand cpts concepts

[shut wraith]

I want to finish the course, then do only the Pro Labs. I think that will prepare me to the max for the exam

[vital adder]

if you can do offshore you can do the exam

[rustic sage]

If you can do Pro labs, I don't think you need the course

[vital adder]

not going to lie i think that too but the AD box's is either too easy or too ctf like

[vital adder]

CPTS is in between dante and offshore

[shut wraith]

So if I beat this guy then I will pass

[vital adder]

yes but trust me when i say he is going to kick you in the ball

[rustic sage]

how do pro labs work, do you need a subscription for that?

[shut wraith]

Pro labs is a separate subscription its like 50 dollars a month

[acoustic owl]

https://app.hackthebox.com/tracks/Active-Directory-101

[rustic sage]

Do they work like a real network?

@acoustic owl oh. Thank you, bro!

[vital adder]

just read the description

[acoustic owl]

A ProLab? Yes

[vital adder]

just counted all of the machine you will for the prolabs subscription and it's 113 it's steal for 50 buck

[shut wraith]

That's great

I will get it in 1-2 months when I'm done the modules

[shut wraith]

Nmap Scripting Engine
Use NSE and its scripts to find the flag that one of the services contain and submit it as the answer.
Web servers are among the most attacked services because they are made accessible to users and present a high attack potential.
I ran this command:
sudo nmap 10.129.2.49 -p 80 -sV --script http-enum
And got:

|_http-server-header: Apache/2.4.18 (Ubuntu)
| http-enum: 
|_  /robots.txt: Robots file

I went to robots.txt and found a flag.
FLAG{XXX}
But when I submit this flag it's the wrong answer. Did I do something wrong?

Solution: There was a space behind the flag which prevented me from answering correctly

[acoustic owl]

You should not post flags here. Please delete it

[shut wraith]

DOne

[primal turtle]

hey im new here so i dont know if this is the right place to ask.
im having issues connecting to the VPN with my Kali, who can help with?

[acoustic owl]

Maybe you just say what problems you have

[alpine nexus]

Should we keep the openvpn tab active? or we just only need to run it once to connect to the htb vpn? thank you

[urban valley]

no keep it open

[alpine nexus]

Alright, thank you

[wispy aspen]

Recommend utilizing one of the other workspaces in Kali for persistent things like your openvpn connection, and another workspace as your default "working" area

[alpine nexus]

didn't understand what did you mean, i just started this, any keyword i could search for so i can read more about it?

[wispy aspen]

Ah, one moment, let me grab a screenshot

So on the top bar of Kali, there will be the numbers 1, 2, 3, and 4, you can think of these as almost different virtual monitors. I keep my openvpn connection up on "monitor" 4:

And by clicking to 1, 2, 3 I can begin working on a different "monitor"

[pearl flint]

guys dow you know maybe how can i get pass this section (password attackes/ linux pass the ticket section)

when i get the hash for svc_workstation it gives me aes encrypted only as far as i know there is no chance that i can get it cracked

is this the right way im going do i need to crack it or is there somthing im missing/

[wispy aspen]

The svc_workstation hash is crackable

[pearl flint]

f.....
ok thats pretty much all i needed to hear xD

Thanks man!

[wispy aspen]

No problem, that's from my notes but I think I'm gonna spin it up just to verify

[alpine nexus]

I see, thank you so much

[hallow kiln]

the way I was scanning the wrong IP for half an hour and wondering why it's not working 💀

[alpine nexus]

Why when i changed tab back to my terminal, i can't type but suddenly after a random time it just writes all these stuff i just pressed earlier like htb-student@nixfund:~$ ls ^CsdsdsdzxcasdqwewewewlllkjhkhkjhfffS

[wispy aspen]

Okay, yeah, sorry this took me a bit. If one keytab file gives you problems, try another.

[wispy aspen]

That seems like a lag issue, you might want to make sure you're grabbing a VPN file for the region closest to you

[alpine nexus]

I see, sadly there isn't an asia server, should i pick US or EU server? im currently on EU server rn, i think US is closer to asia?

[wispy aspen]

Ah, yeah, that does factor in a bit. I'd say if you are closer to western Asia, EU would be better, but if you're eastern Asia, particularly southeastern Asia, US may work better for you.

[alpine nexus]

Alright, thank you so much

[wispy aspen]

No problem

[viscid crypt]

im struggling with the last step of the Web Attacks - Skills assessment for several hours. I didn't have any problems on the other items in the module. I even tried setting up the pwnbox because others suggested an issue with routing. Still doen't appear to be communicating to either the public or private IP address from the application. I tested pinging communications from a different machines and that seems to work find. Anyone willing to help direct me a little ?

[shut wraith]

***NETWORK ENUMERATION WITH NMAP ***
Firewall and IDS/IPS Evasion - Medium Lab
Question:
After the configurations are transferred to the system, our client wants to know if it is possible to find out our target's DNS server version. Submit the DNS server version of the target as the answer.
I've tried first: sudo nmap -p 53 -sV $IP
Because they want the version (-sV) name of the DNS server which is open on port 53.
Output:

53/tcp open  domain  NLnet Labs NSD

The version NLnet Labs NSD is not the correct answer.

I have also tried
sudo nmap -p 53 --script dns-nsid $IP
sudo nmap -p 53 --script=dns-service-discovery $IP
sudo nmap $IP -sS -Pn -n --disable-arp-ping
sudo nmap $IP -sA -Pn -n --disable-arp-ping
sudo nmap $IP -sA -sV -Pn -F --version-trace --disable-arp-ping -D RND:5 --source-port 53
& even netcat
nc -nv $IP 53

But nothing has provided me with a correct answer. Please help as I've been stuck on this for hours and it's no longer a learning process

Any ideas u can help me with please sir @wispy aspen

[acoustic owl]

Try it in the PwnBox, not with your VM.
If I remember correctly, there was a problem with the VPN

[shut wraith]

Okay will try now

[shut wraith]

On the exam did you go against IDS/IPS and get blocked from the network?

[acoustic owl]

Everything discussed in the modules can be tested on the exam.

[shut wraith]

Thanks btw it worked on the PWNbox

[viscid crypt]

The same is holding true for XXEinjector as it just times out. None of the local file disclosure seems to work for me and since everything else requires some kind of callback. It seems im out of luck.

[hallow kiln]

I also had to use the pwnbox for that, which is mighty inconvenient

[pulsar needle]

Have you checked the SMB service?

[warm drift]

On this module rn lol...hint: it's possible to get stuff from ftp server even if you can't log in

[vital adder]

that's still call a type of authentication 🤣

[vital adder]

why? the session is about ftp?

you may want to remove this due to spoiler also if the thing you blocked out is the -p then try without it

[vital adder]

so what exactly is the issue? connections issue?

[pulsar needle]

Its not unusual that the question is about one service but ypu have to work through another one to get there

[vital adder]

sound very unusual to me 🤣 either way that's not the right path in this case

[pulsar needle]

Idk idk

https://tenor.com/view/splash-puddle-shock-shocked-deeper-gif-22493379

Xd

[viscid crypt]

I believe so.
When I try Local File Disclosure that doesn't seem to return anything. So I figure I need to move onto the advanced File Disclosure.

I setup everything including the python3 server but when i send the request I get a response without information. Checking the python3 server nothing connected to it. If I try connecting from another browser, that browser will connect. But of course we want the app to connect. So I move onto blind data.

Setup the php server. Again requests lead to responses, but nothing contacts the PHP server. I can connect to the PHP server wtih another browser.

With XXEinjector it never connects either it just keeps asking if I want to wait.

I have tried different IPs, on VPN andoff VPN, with Kali and Pwnbox.

[wispy aspen]

If anonymous is not working, try to find another username

[vital adder]

shoot me a dm with your request

also no idea what you are trying to do but this assessment doesn't involved any type of call back

[wispy aspen]

also, for what it's worth, there's a username list in the button for this module

[vital adder]

using those wordlist is actually wrong for the first part of that section

[wispy aspen]

he needs to find the correct username, as he is using anonymous.

[vital adder]

using @ to login as anonymous in the last attempt doesn't work because that isn't how ftp authentication work 🤣

there will be ||brute forcing|| involved but not with the wordlist in the module Resources

[alpine nexus]

Earlier i change the vpn region from EU to US, after that i connect to the new htb vpn, but unfortunately i can't access the target shell like this, is there any step i miss?

[vital adder]

first make sure both of your vpn and the pwnbox isn't on at the same time and after each vpn change you will have to reset your target machine

[alpine nexus]

I didnt start an instance, and i have refreshed the target too. I tried to restart my machine, then it works (idk why). thank you so much

[wispy aspen]

Disregard what both @vital adder and I have told you in previous responses. I recommend refreshing your target (yellow arrows next to the IP address on the academy page), giving it 60 seconds, then try ftp <ip> <port> like you were doing before.

I spun up this module and confirmed it's working for me.

[vital adder]

the only thing i've suggest is to not use the -p which i think he did screenshot

[wispy aspen]

It worked both with and without -p.

[viscid crypt]

That did it! Thanks https://academy.hackthebox.com/achievement/820185/134

[vital adder]

can i dm you about that?

[wispy aspen]

If you feel it necessary

[digital pewter]

Did anyone manage to land a reverse shell on the File Upload Attacks skills assessment box? I'm thinking its pretty well isolated due to K8 but wondering if someone knows of a trick I'm unaware of. I've scripted a psuedo-shell, but it would be neat to land a real one.

[obsidian crag]

In this module what you like the most..

[rustic sage]

Someone can help me? - Pass the Ticket (PtT) from Linux

hello

[viscid crypt]

i like enumeration and making burp go brrrrrrrrrzt

[muted charm]

Hello

[fathom pendant]

This channel isn't the general channel read #welcome to see how to access more of the server @muted charm @rustic sage

[tender lake]

The Windows Box's for the Active Directory Enumeration and Attack keep on staying pure black screens when I RDP into them. Is it something that can be fixed by simply resetting them?

[wispy aspen]

Try clicking in the window and pressing space

[tender lake]

Well ... that was a simple solution

[tender lake]

It worked, thanks

[echo roost]

I am confused - https://academy.hackthebox.com/module/147/section/1328 - Trying to find the MySQL creds in here and I went to the default creds github and tried the following combinations. I also tired Sam's ssh password with all the users on the machine being: ||sam, kira, and will||:

||productvendor username password MySQL [e-mail] admin MySQL root <blank> MySQL (ssh) root root MySQL superdba admin Scrutinizer (MySQL) scrutremote admin||

What am I missing?

I added all the defaults to a password list in the following syntax also username:password in hydra and tried them manually.

[fathom pendant]

1. one of those works
2. the mysql service is running locally

So it's not accessible externally

[echo roost]

I know I'm like 99% sure I tried them all

[fathom pendant]

Staring at the right answer rn

[echo roost]

I'll try again it's that 1% that works lol

thanks

[fathom pendant]

Also as it says, "from the previous exercise" so you need to log in using the previous user you found first

[echo roost]

RIght, I am sshd in as sam

Let me try again, ty

omb i'm impatient, I got it

[fathom pendant]

Like I said I was staring at it lol

[echo roost]

I thought I tried that combo. I must have "tried" it in hydra and thought I tried it locally

anyways ty!

[fathom pendant]

Glgl

[rustic sage]

For who are stuck here, just use your own machine and not the pwn box

[manic hearth]

Hi all, I'm working through the web requests module and trying to find the flag in the network tab of dev tools and I can see where it is requested in script.js, but the console is saying that document.onload is not a function and so in not returning the flag. Any ideas?

[rustic sage]

Hello all, I've been stuck on the Skill Assesment - Website, 2nd question, of the Login Brute Forcing module (https://academy.hackthebox.com/module/57/section/515) . I'm running the command ||hydra -l admin -P /usr/share/wordlists/rockyou.txt -s PORT IP http-post-form "/admin_login.php:user=^USER^&pass=^PASS^:F=<form name='log-in'" -t 64 -I || for different usernames ||(admin, b.gates, m.gates)|| - all without success. Would anyone please take a moment and point me in the right direction? Been stuck here for a while...

[alpine oasis]

im at the linux modlu rn and i have no idea what to do someone please help me

[fathom pendant]

You're gonna have to elaborate on your issues

[alpine oasis]

i dont have image perms

[fathom pendant]

I'm aware

Read #welcome on how to verify your main htb account with discord and get image perms

[alpine oasis]

can i not just dm

[alpine oasis]

can i not just dm

[fathom pendant]

No

[alpine oasis]

why

[fathom pendant]

Because I am not accepting dms

¯_(ツ)_/¯

[acoustic owl]

If you want to upload pictures here, you have to verify your account

[fathom pendant]

^

[alpine oasis]

it doesnt work

for me

[acoustic owl]

why?

[alpine oasis]

idk i fill in my email and pass but doesnt let me in

[shut wraith]

PayLoad Bunny

[acoustic owl]

Read and follow #welcome

[fathom pendant]

Main site and academy are different logins

[shut wraith]

Stop hopping around for once

[alpine oasis]

i did that

look please its urgent

[fathom pendant]

Just describe your error or post the error in backticks (`)

this is an example

[acoustic owl]

https://tenor.com/view/funny-bunny-confused-bunny-great-job-bunny-gif-25289971

[alpine oasis]

its not a damn error i just dont know how to complete this question man

[shut wraith]

https://tenor.com/view/hunt-hunting-on-the-tunt-elmer-fudd-bugs-bunny-gif-4712569

[fathom pendant]

Well what section are you on

[alpine oasis]

system information

[fathom pendant]

Oh

That question has been busted

[alpine oasis]

what

[fathom pendant]

Because the command they give you to use doesn't give you the answer they want

(The uname question)

[alpine oasis]

so whats the answer then cuz idk how to do this stuff

[fathom pendant]

What have you tried so far

And what output did you get

[knotty nest]

Hello hope you don't mind I've been stuck on this question for 30 mins in the HTTPS fundamentals course: To get the flag, start the above exercise, then use cURL to download the file returned by '/download.php' in the server shown above. I'm getting "wrong version number" error when typing "curl -o https://94.237.49.11:45547/download.php"

[alpine oasis]

ssh (target) then it needs a password but idfk what to do

[fathom pendant]

Look above the first question it tells you how to authenticate

[alpine oasis]

how man

i see it but dont know what to do with it

[fathom pendant]

ssh <user>@<ip>

Then paste the password in the terminal with [ctrl]+[shift]+[v]

[alpine oasis]

i cant paste it for some reason

[fathom pendant]

https://academy.hackthebox.com/module/details/77 I recommend this module if you haven't already checked it out

[alpine oasis]

yeah thanks but im busy with this one rn

and i cant paste it

[fathom pendant]

Hit enter

After doing the paste command once

It's not showing what you're typing, this is intended, it's a security feature of linux

[eager merlin]

Hi all, just needed a command i forgot, is there a way to search on the academy?

[alpine oasis]

i did it but it says connection closed

[fathom pendant]

What command?

[knotty nest]

can someone help me with my account identifier please I can't find it in my HTB settings 😦

[fathom pendant]

It's on app.hackthebox.com

[eager merlin]

I was looking for a Telnet command, i have seen it in OS fundamentals or getting started module

[fathom pendant]

For connecting to?

[eager merlin]

does this search all text because i could not find it like this

[fathom pendant]

I believe the syntax is telnet ip port

[fathom pendant]

Short answer tho, take better notes

[alpine oasis]

bro it says permission dennied

[fathom pendant]

Then you're doing something wrong :)

Paste your ssh command here

[alpine oasis]

what the fuck could i be doing wrong man

im following your instructions

[eager merlin]

i know you love notes haha, but cant search them lol. need better ones yeah

[fathom pendant]

Brother take notes on your compyutah (most people here use obsidian)

[alpine oasis]

ssh htb-student@10.129.157.18

[eager merlin]

will check this one

[fathom pendant]

And you copy/pasted the password that's given to you (note in terminal you NEED to add the shift key to the paste combination)

[alpine oasis]

i didn't copy paste it manwdym by shift key

you mean space?

[fathom pendant]

No

Highlight the password from the webpage

Right-click, copy or ctrl-c

In terminal do right-click paste or ctrl-shift-v

[acoustic owl]

https://en.wikipedia.org/wiki/Shift_key

[alpine oasis]

yeah ik what the damn shift key is i just dont see where its used

[alpine oasis]

i did that man

[fathom pendant]

And when you hit enter it tells you permission denied?

[alpine oasis]

yeah

[knotty nest]

ahh I have an academy.hackthebox account... damn. Anyway I'm stuck on the first interactive exercise on HTTP Fundamentals, does anyone know anything about cURL and "using cURL to download the file returned by /download.php in the server show above". I believe I am doing it right however I'm getting a "wrong version number error" in my terminal. I am typing curl -0 https://94.237.62.195:34787/download.php

[proud pine]

[fathom pendant]

In just the terminal [(without doing any other command)] just do a paste

Just to see what's on your clipboard

[alpine oasis]

the password

[fathom pendant]

HTB_@cademy_stdnt! should be the password

[alpine oasis]

yeah ik but it doesnt work

[fathom pendant]

It should

Are you using the browser pwnbox or your own vm

[alpine oasis]

browser

now i cant even paste bruh

[fathom pendant]

Yeah the browser pwnbox is trippy sometimes with copy/paste

[alpine oasis]

permission denied again-_-

this is making me mad

[fathom pendant]

Take a step back and breathe

First: try restarting the box using the reset button (the two arrows)

And try again with the new ip

[copper thunder]

Is there another chat that unlocks when I verify my account? I don’t see any other in off topic sorry for messaging here

[fathom pendant]

Yes the rest of the server opens up go yiu

[copper thunder]

Okay thank you 🙏

[alpine oasis]

i cant even respawn it cuz only once per day bruh how stupid

[fathom pendant]

Unverified only have access to the academy section, community-help, and welcome/rules

[fathom pendant]

Brother i meant the target

Not your pwnbox

[alpine oasis]

you said try restarting the box

[acoustic owl]

box = target

[alpine oasis]

man im so stupid i hate myself

[fathom pendant]

Just set up your own vm

or buy like $5 worth of cubes and you get unlimited spawns ¯_(ツ)_/¯

[alpine oasis]

i dont know how to do any of this shit

[fathom pendant]

I refer back to the getting started module I linked earlier

[alpine oasis]

maybe im just too stupid for this shit

[gusty ermine]

Hi, Anybody doing ''UNDERSTANDING LOG SOURCES & INVESTIGATING WITH SPLUNK'' module?

[acoustic owl]

37 people have completed the module

[alpine oasis]

why so little

[acoustic owl]

The module is quite new

[gusty ermine]

I did stuck on this one ''Access the Sysmon App for Splunk and go to the "Reports" tab. Fix the search associated with the "Net - net view" report and provide the complete executed command as your answer. Answer format: net view /Domain:_.local''

[acoustic owl]

Have you downloaded and installed the app?

[gusty ermine]

yep

I'm missing something in the search

[acoustic owl]

search for net view

[gusty ermine]

sysmon process=net.exe (CommandLine="net view") | stats count by Computer,CommandLine

my idea was sysmon (CommandLine="net view") | stats count by ComputerName,CommandLine

[acoustic owl]

Try it very simple.

Specify the logfile and what you are looking for

[gusty ermine]

Sorry but maybe my brain is not working today. Do you know how to to do it?

[acoustic owl]

Send me a dm

[shut wraith]

Dude this page is huge

[sly kelp]

Pass The Hash page ?

[shut wraith]

U can barely see the scroll bar

[sly kelp]

Which page is this lol

[shut wraith]

It's all just "SMB"

[sly kelp]

Attacking common services SMB?

[shut wraith]

Footprinting

[sly kelp]

Ohh Damn

Yeah man I agree

[hallow kiln]

ah, that, it's just a lot of terminal output

[shut wraith]

Dude thank god

I was getting the heeby jeebies

[sly kelp]

Meanwhile, I am waiting for John to complete it's John stuff so I can finish module

[shut wraith]

U know that feeling when u go "do I really need to pursue this career"

[hallow kiln]

been asking myself that every day

gotta push through

[sly kelp]

It is not so bad

🎵🎵🎵🎶🎶🎶

[wraith spoke]

So i have just finished the skill test for tunneling an pivoting. my question which i cannot figure out is how do i download a file from a windowshost when i have accessed is through a ssh -D from a linux pivot. I could not get a meterpreter shell to work. I had ssh acces to the windows host as well as rdp.
next question which remains is it possible to create chain through a linux machine to a windows machine to the next windows machine, in a way that i can start something from my attacking machine pivoting through 2 machines at once?

[acoustic owl]

If you have a RDP connection, you can easily mount a drive with xfreerdp
/drive:share,"/home/user/share"

[acoustic owl]

2. Question
   Yes, it is possible, although not easy.
   You could for example go through the first Linux machine with sshuttle.
   Then go through the second Windows machine with chisel and then, for example, open ports with netsh to access the third Windows machine.

I'm sure there are other ways, but I often solve it this way.

[wraith spoke]

amazing! great answer to my question!

[wraith spoke]

ill have a try on this one, thank you so much for taking the time to answer my questions.

[acoustic owl]

This would actually be the fourth machine.
You can reach the third one through the Chisel Tunnel.

-> Your VM -> sshuttle (1. Linux) -> chisel(2. Windows) -> netsh(3. Windows) - > 4. Target

By the way, you can try out and play around with such things in the ProLab Offshore.

[wraith spoke]

currently i am trying to finish the course first, i found out by doing the boxes in the labs that i miss some advanced understanding which takes the joy out of it. I will try to do it in the academy skill assessment enviroment and for the future i will take offshore on 😄

[urban valley]

Windows Priv Esc (Pillaging): Did anyone get cookieextractor.py to work on their Kali or PwnBox? Im getting this problem on Pwnbox:

[urban valley]

I also cant get cookie extractor to work on my Kali because Python shenanigans (no win32 module --> can't install pypiwin32 or pywin32 for some reason)

[frank moon]

can you provide more hint please ? I don't understand

[civic zenith]

How can I go back to see the recommended machines on academy? I am referring to the list in the bottom right of the screen that appears whenever you complete a module.

[high zinc]

I think I didn't do the assignment the intended way

It's a log of events that happen in sequence... So like... The next event is one above, right... But that's not what they actually ask for

[high zinc]

You should be able to view the summary page again yes. Try clicking the last section and then "Complete" it again (it's already filled out if you did it once)

[frank moon]

So how to do the research properly from what they ask for? I created a filter per hour with the event id as the person who asked the question at the beginning. Did you just look at the previous event?

[high zinc]

Yea that's what I did, which isn't the way I think

[mild cypress]

Little confused on the last step of this module:
https://academy.hackthebox.com/module/158/section/1434

It suggests using:
||proxychains firefox-esr 172.16.5.135:80||

Which doesn't seem to work, which I think would imply we need to:
||python client.py --server-ip <IPaddressofTargetWebServer> --server-port 8080 --ntlm-proxy-ip <IPaddressofProxy> --ntlm-proxy-port 8081 --domain <nameofWindowsDomain> --username <username> --password <password>||

But we don't yet have access to the internal machine domain/creds/etc 🤔

Am I misunderstanding the instructions? Or is the expectation that we would pwn the machine first? Or am I just getting something wrong with the first command?

[pine dagger]

You don't need credentials

[mild cypress]

What about the --username and --password flags? 😕

I feel like something obvious in the instructions just isn't clicking in my dumb morning brain. Haha.

[pine dagger]

You're not authenticating with a HTTP proxy

Forget that last section for the exercise.

[undone narwhal]

In my case client.py didn't work due to a python package issue I was too lazy to fix it so I used ssh dynamic port forwarding to solve it. So if you want to just solve the lab you can try this way or another method

[mild cypress]

Appreciate the workaround, I'll keep that in mind. Are you saying the first command should work?

[undone narwhal]

Oh wait

I believe You don't need to run client.py at all

With the credentials I mean

[mild cypress]

Wait, what? Isn't it required to establish a connection with rpivot? My brain hurts even more now.

[undone narwhal]

Forget that last section do the rest did you get the new connection message?

[mild cypress]

I did.

[undone narwhal]

Now what is your proxy port

[mild cypress]

9050

[undone narwhal]

Did you set the same port in proxy chains config?

[mild cypress]

Yes.

Connection:
python2.7 server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0
New connection from host 10.129.198.38, source port 46492

proxychains.conf:
socks4 127.0.0.1 9050

[undone narwhal]

Just to be sure you used this command in you attackhost right?

[mild cypress]

Correct!

On the pivothost:

python2.7 client.py --server-ip 10.10.15.22 --server-port 9999
Backconnecting to server 10.10.15.22 port 9999

[undone narwhal]

Can you send a screenshot of proxychains Firefox command

[undone narwhal]

That's it?

[mild cypress]

That's it 🤷

Should there be more output?

[undone narwhal]

Yeah like in the exercise

[mild cypress]

Yeah, that's all I get. Firefox opens, but it fails to connect.

[undone narwhal]

You are on the right path ig the only problem is with you proxychains

[civic zenith]

@high zinc Ok that did the trick. Now I can see which boxes to practice on. Thx!

[mild cypress]

Alright, thanks. I'll try a reboot or fresh proxychains install I guess 🤔 Weird silent failure.

Didn't have any issues with the previous proxychain labs.

[undone narwhal]

If you did the previous labs with proxychains you should already be familiar with the output you get when you run proxychains, it will clearly tell you whether you connected to the server or not

[zinc sentinel]

Was Firefox already open when you using command? Maybe you could proxychains curl to get what you want ?

[mild cypress]

Previous labs only had me running it against nmap, so the output looking different when running directly against a browser didn't seem all that unreasonable 🤷 Thanks though.

[mild cypress]

It was, great suggestion. I do get more information in the output with curl 🤔

[proxychains] Strict chain  ...  127.0.0.1:9050  ...  127.0.0.1:9050 <--denied
curl: (7) Failed to connect to 172.16.5.135 port 80 after 0 ms: Couldn't connect to server

[alpine oasis]

how do i make my own pwnbox if i cant use my 1 free one anymore?

[zinc sentinel]

What does your /etx/proxychains4.conf file look like?

[mild cypress]

Literally the default here: https://github.com/haad/proxychains/blob/master/src/proxychains.conf

[zinc sentinel]

Is recommended going around the issue nar3dra suggested dynamic ssh

[mild cypress]

Yeah, did a workaround to curl it, even more confusing is I'm getting what looks like the flag but it's not being accepted as the answer.

[zinc sentinel]

Will be a formatting issue I suspect

[mild cypress]

Ah, yeah, something about the copy-pasted characters. All good now.

Still very confused regarding what's blocking me.

But I'll make a note to check my proxychains installation I guess 🤷

Just seems odd that nmap was working without issue.

[zinc sentinel]

/etc/proxychains4.conf
Or
Etc/proxychains.conf

[mild cypress]

Yeah, maybe I'll just do a purge and re-install of proxychains and proxychains4 with fresh conf files and see if that resolves anything.

Appreciate all the help.

[zinc sentinel]

🙏

[urban sleet]

I found a vulnerability on the HTB academy webpage, nothing too critical but it worth addressing. How can I report it? HTB is not on HackerOne (nor in any other responsible disclosure)

[zinc sentinel]

iv run into this exact problem in that module some time ago
Glad you got it

[mild cypress]

Thanks, me too.

[fathom pendant]

Most of the module flags are variations regarding the techniques used

[mild cypress]

Yeah, just felt particularly comedic given then issues I was having 😛

[sullen crest]

Has anyone completed this course WINDOWS EVENT LOGS & FINDING EVIL? I cant seem to get past the first part, it doesnt explain what and where to look or am i missing something

[ocean night]

Email us on [e-mail] with details, steps to reproduce etc

[rugged veldt]

SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe) - Followed instructions to a T, got a date but is not valid ?

[livid pier]

Good evening! Hows everyone doing?

[rugged veldt]

great how are you @livid pier

im having trouble with one damn module

[livid pier]

Feeling pretty good.

[livid pier]

Which one?

[rugged veldt]

siem visualization example 4

[livid pier]

ooo, havent done that one yet

[rugged veldt]

can u see if u could do it

im following instructions to a T

but no luck

[livid pier]

I dont have it

[rugged veldt]

[livid pier]

have you asked gpt?

[rugged veldt]

its using a custom dataset within an SIEM

[obsidian crag]

My commands are not working for the web request module

Session GET

Basic authorization = access denied ?

And showing error HTTP/1.1 401 Authorization required

What does it mean

[livid pier]

It still may be able to help with what command you need, im guessing you are having to filter something

[livid pier]

It means you are denied, it told you

[obsidian crag]

I used curl -v with user@pass and ip:port

Then also denied..but how

[livid pier]

I dont have the mod up, i cant remember specifics, if you are still stuck when im done with the question im working on ill pull it up

[obsidian crag]

I'm right but in the os there is a problem

Hello admins....!
Here is one issue in matchine

[ocean night]

Try the --user parameter, username:password

[obsidian crag]

In the web request i have entered the correct flag but still it was incorrect

I got the flag

But while submitting it was incorrect...how it is possible

There is some problem on my matchine...requesting to solve it please

[ocean night]

DM me what you are submitting as the flag. I just checked it, and the flag works.

[obsidian crag]

Ok

[ocean night]

Academy flags start with HTB 🙂 Sorted

[rugged veldt]

Yea I'm doing it based off the instructions, I'm supposed to filter by date, I get the date but invalid

[rustic sage]

can somebody help me get started pls

[ocean night]

Hit up the free modules on https://academy.hackthebox.com @rustic sage, they guide you 🙂

[rustic sage]

oh ok thank you

[ocean night]

True

My bad

If you're asked for a flag, it'll likely start with HTB

If you're asked for something specific.. well.. it's that thing

[wind juniper]

hello, I am confused with js deobfuscation. first question " Repeat what you learned in this section, and you should find a secret flag, what is it?" I have found the flag in the script but it won't accept it. Am I supposed to do something else to decode the flag?

I did put it into jsnice and I have it in HTB format

[ocean night]

DM me what you have @wind juniper

Sorry whoever I pinged by mistake before 😅

[quaint hemlock]

Hi, I'm stuck on Introduction to c# modules libraries sections
I'm able to add reference library-question and run my code (I'm using visual studio 2022)

class Program
{
    static void Main(string[] args)
    {
        Flag.GetFlag();
    }
}

after I run it, it gave me this output :

To automatically close the console when debugging stops, enable Tools->Options->Debugging->Automatically close the console when debugging stops.
Press any key to close this window . . .

anyone know why?

[acoustic owl]

You want to output the flag in the terminal
Try it with ||Console.WriteLine||

[quaint hemlock]

thx a lot bro, it actually works 👍

[latent flame]

Hello, everyone! I'm doing a simple HTTP Requests and Response module, and it says: "Send a GET request to the above server, and read the response headers to find the version of Apache running on the server, then submit it as the answer. (answer format: X.Y.ZZ)". However curl 94.237.62.195:58288gets me a connection refused status. Can you help me guys?

[acoustic owl]

Is the Target still online?
Restart it and try again. Wait about 3-4 minutes after the reboot to make sure it has booted up correctly.

[latent flame]

Oh, yeah. Thanks, I'm able to get HTML response back

[latent flame]

Thanks. I solved the assignment

[quaint hemlock]

hello, I'm on Introduction to c# module skill assessment sections, I can't actually understand what it ask me to do, and what's the ip for?
and why did when I write Words.GetWordList(); it gave an error?

[acoustic owl]

The DLL gives you a list of possible file names.
Your program should now search for http://<ip>/<entry from the list>/flag.txt.

[quaint hemlock]

what do you mean with entry from the list?
is it the net6.0/win-x64?

[acoustic owl]

The DLL provides you with a list
Something like:
new List<string>() { "dir1", "dir2", "dir3" };

[quaint hemlock]

sorry, but I still can't understand

[acoustic owl]

Collection is the right term
https://academy.hackthebox.com/module/228/section/2427

[barren knoll]

Hey guys, does anyone have experience with windows server hardening ?

[ocean night]

Please avoid from posting any potential spoilers for Academy modules over Tier 0 - feel free to ask for advice, but do not post specifics

Spoilers for Academy modules over Tier 0 is against the ToS you agreed to 🙂

[quick magnet]

ok sorry

[verbal kraken]

can someone help me with broken authentication module first exercise

its been 2 days and i cant solve

i dont know what to change in the python script they gave us

[rare topaz]

wrong place to ask....

Also wtf is this slowmode for

it's like 2 seconds like, it's literally the time it takes to type

[acoustic owl]

What section are you in?

[acoustic owl]

It's a spam protection

It takes you so long to type. That's okay, too.
But a bot does not need so long and is thus kept away

[rare topaz]

Ah, is it for all other channels or is this one been raided lately

[acoustic owl]

I think it's only certain channels that are protected like that.

[iron plaza]

in the Linux Privilege Escalation module, LXD section, I followed the instruction in the section but I am getting an error... what is the cause of this error?

||**htb-student@ubuntu:~$** lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true Device host-root added to privesc **htb-student@ubuntu:~$** lxc start privesc **htb-student@ubuntu:~$** lxc exec privesc /bin/bash Error: Command not found||

[verbal kraken]

default credentials

[acoustic owl]

You don't need Python.
You only need to find the username. Google helps you with that

[verbal kraken]

it says i need to brute force though?

[acoustic owl]

Inspect the login page and perform a bruteforce attack. **What is the valid username? **

[verbal kraken]

i found it but it was with luck lol

i opened a random scada default credentials list and wrote them one by one

[acoustic owl]

Yes, that is also a way to find the solution.

[verbal kraken]

but seriously what was the actual way to find it

[acoustic owl]

But you could also have asked Google

[verbal kraken]

ask what exactly?

[acoustic owl]

A GitHub repo is referenced in the module. You would probably have found what you were looking for there.

Read the Hint from the Question

[verbal kraken]

yeah

but how am i supposed to use a csv file as a wordlist

[acoustic owl]

There are several ways

1. the GitHub repo
2. look at the hint on the page and then search for it in Google.

With both techniques you would have found what you are looking for.

Whether you find a csv, txt or any other file, it doesn't matter.

[verbal kraken]

how?

if i want to use a csv file as a wordlist how would i go about that?

in case i need to do it sometime in the future

i would like to know

[tranquil axle]

I'm at Attacking Common Applications in the Gitlab - Discovery & Enumeration section. I am supposed to find the version of gitlab running. According to the module I need to log in for that and look at the help section. The credentials provided in the text are not working and I can't create my own user (everytime I try to log in or create a user I get a 422). I doubt I'm supposed to bruteforce yet (that seems to come in the next section). Any hints?

[acoustic owl]

You can convert it to a txt file.
Depending on the csv, replace tab or comma or semicolon with a line break

[acoustic owl]

You should be able to create a login. Try it again, otherwise restart the machine.

[verbal kraken]

i still dont understand im sorry

some passwords are left blank

[acoustic owl]

You're looking for a name, not a password.
A csv is nothing else than a text file. You can handle and reformat it exactly as you like.

[verbal kraken]

oh ok

thank you

[tranquil axle]

hm okay it works on chrome, but on firefox I kept getting the same 422 error

[quick magnet]

hi i'm stuck in Attacking Email Services question 2
login with user m, didn't get flag
i got 2 suspect another user, but try brute force imaps,pop3,smtp cant get the password
any hint what should i do with this 2 user ?

[fathom pendant]

Attacking common services?

[quick magnet]

yes

[acoustic owl]

Login with the user m*
You should find the Flag

[fathom pendant]

m* is the right user

[quick magnet]

i try login in imaps and don't get the flag

• pop3 invalid command current state
• smtp auth fail

[acoustic owl]

Try it with an Mailclient like Thunderbird

[fathom pendant]

Did you try pop3s or just pop3

[quick magnet]

i just get pop3 in port 110

[fathom pendant]

Weird that imaps would be available but not pop3s

[quick magnet]

sorry i mean, i got 143 imaps and 110 pop3

[fathom pendant]

Do you mean imap and not imaps?

The [s] implies the secure version

[quick magnet]

ya i got imap not imaps and pop3 not pop3s

[fathom pendant]

Ahh

The logins should work. I could have sworn imaps and pop3s was running but it's been a minute

And there's no folder in imap for you to check?

[quick magnet]

oh my bad, i try login using base64 in pop3

[fathom pendant]

Lolwat

[tranquil axle]

Wew okay I put this here in case someone else gets the same error as me. In Attacking Common Applications, Attacking GitLab and Gitlab - Discovery & Enumeration I kept getting error 422 on user creation and login. The same happened with the gitlab_13_10_2_rce.py script. The error was that the clock on my VM wasnt set right. Runnin sudo ntpd -qg fixed it

[short gulch]

Attacking Common Services - WordPress - Discovery & Enumeration. Can someone help? I literally cannot reach any VHOST at all. I can reach the spawned IP, but no virual hosts. /etc/hosts file is edited properly, even manually I cannot reach it curl -s http://10.129.68.21:80 -H "Host: blog.inlanefreight.local"

[shut wraith]

FOOTPRINTING
SMB
QUESTION:
Find out which domain the server belongs to.

I got the domains using
impacket-samrdump $IP

 . DEVSMB
 . Builtin```
But none of the domains provided the right answer.

This is only my 3rd or 4th module but I have already found this pattern where the question is not properly formulated and the answer is too rigid and poorly programmed to be cap-sensitive and limited to one specific answer. I highly doubt that the devs provided this course to a new person in order to understand where these flaws are.

Very frustrated with the course as I had very high hopes that this would finally be the one I could learn from.

[ocean night]

Is that the only tool you can use that's documented in the section?

You're missing method with one of those tools

[shut wraith]

Just face it this question is fked and should be changed or properly reworded

[shut wraith]

Can u give more details please? I got these commands from the module itself

[ocean night]

I'd say look over the example outputs for the tools above, one of them has output different from the others

I can't give anything more direct than that, sorry

[acoustic owl]

If you are really at the very beginning, I recommend you not to do CPTS path, but to do Information Security Foundations path first
https://academy.hackthebox.com/path/preview/information-security-foundations

There you will learn all the basics that are necessary to properly understand the content in the CPTS path.

[ocean night]

The answer is in the section content

I mean, the command you need

[shut wraith]

I tried all of these as well

[ocean night]

I don't know what to say, the command you need is there.

[shut wraith]

I could be stupid but I just entered the same answer I entered before except this time its correct ?

This bug also happens in offsec modules so I wouldn't be surprised

[ocean night]

Trailing space perhaps?

Anyway, glad you got it

[shut wraith]

Thanks

[short gulch]

mabye blank space after answer?

[ocean night]

Is there an echo in here? 😅

[shut wraith]

I even got it in my output right here

I swear learning cyber security is less about intelligence and more about emotional control

[short gulch]

VPN was the issue

[wispy aspen]

Yes. Even with a background in IT, cybersecurity will have you questioning yourself. You have to be able to handle many things not working, and you have to be able to find comfort in being uncomfortable.

[austere ocean]

hey guys

do we have to pay to use this app?

like for the cubes....

does cube reward is more or less?

@shut wraith

can u pls tell me?

[shut wraith]

You're right. I feel very ashamed for losing my cool even though I'm still a beginner so there are many things that I don't understand. I hope I dont once again forget this fact so I don't say something here and get banned. Or say/do something in a job in the future and lose my career

[shut wraith]

If you're a student you pay 8 US dollars for a monthly subscription. and once you're ready you pay 200 US dollars for the exam

[frank moon]

Even like this i dont get any result...

[high zinc]

without any filters, the even right above the one you were told about has the answer

[frank moon]

Yes i found this without filter

||<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege</Data>||

and no process name

oh no i found

but i dont understand...

[high zinc]

this is waht I kept telling: it's not the intended way

[high zinc]

KEKW

[restive hound]

Can someone DM please. I am on the Credential Hunting in Linux, I have been able to ssh in and can't seem to download or transfer the tools needed to find the rest of the credentials. I have tried to use wget and cURL as well as a python server and I can't seem to get the tool over there.. Any help would be much appreciated. Thank you

[brazen apex]

Could someone please provide some advice for module: using the metasploit framework
Section: sessions

Metasploit keeps giving me an output of machine not vulnerable

I hight doubt this though as it's elfinder exploit for php connector

[restive hound]

I remember this one. When you run the first metssploit exploit look at what you can do with the sessions...

[brazen apex]

I haven't even obtained a shell yet though @restive hound

[restive hound]

One sec let me go back to that module and take a look for you

@brazen apex are you on the Sessions&Jobs or Meterpreter box?

[brazen apex]

Yeah sessions and jobs

[livid pier]

Good morning!

[brazen apex]

Also it did something else this time give me a sec

[restive hound]

Good Morning!

[brazen apex]

Now I get an error instead that the exploit aborts due to a failure

[restive hound]

make sure you are using the right exploit, it won't be the same number as in the reading info..

[brazen apex]

Idk what you mean by that

I'm using ||elfinder php connector||

I'm setting rhost to the target and lhost ||tun0||

[livid pier]

wrong one

[brazen apex]

Wrong exploit?

[livid pier]

[restive hound]

ya take a look at the available exploits again.

[brazen apex]

Alright I'll take another crack at it thanks for the advice

[restive hound]

I believe there are 4 right? and you used 4...

[brazen apex]

Okay I got it immediately that's embarrassing i thought I tried that one already

Thanks

[livid pier]

[restive hound]

No worries,has been happening to me the whole time too

I will overthink it and get stuck for way too long

[livid pier]

Days... Weeks

[restive hound]

Lol ya weeks for me not gonna lie

[livid pier]

lol me too

[restive hound]

I started in July of this year

[livid pier]

like 18 months

[restive hound]

what is your completion percent in the course?

[livid pier]

100%

[restive hound]

Oh nice, have you attempted the final?

[livid pier]

I finished a while ago, half the time has been review

I spent a couple months going to HTB and applying everything to the boxes there

[restive hound]

This is my plan too. I want to rush through the first time and then go through a second time and refine my notes

❓

[livid pier]

lol

[restive hound]

I saw that

[livid pier]

natiala 666 = Fracuz
Never forget

[ocean night]

😄

Thor saw, Thor knows

[livid pier]

Ive really worked on my notes too

ive tried to compile them into a hacktricks format

[restive hound]

Good idea, I had something similar in mind

[livid pier]

I feel like the organization of the notes is instrumental, when trying to fit things together it becomes clear where the gaps in knowledge are

[restive hound]

Ya I am still really new to all things red team so pretty much all of this is new to me, lol. Can be overwhelming at times

[livid pier]

I feel that

[restive hound]

Dang! got me beat. I started last year in November during the Advent of cyber from THM

Ya THM is definitley more beginner I think. HTB is like, okay here is how to do this now do and here is a twist, lol

How far are you @rustic sage in the course?

I am only 31%

[livid pier]

You guys do the SANS kringlecon?

[restive hound]

I did last year, but I will still so new that I felt so so lost. I can't wait for this year

[livid pier]

Me too, thats what got me into cyber 2 years ago

after i did that I was hooked and came here

[restive hound]

Nice! YA last year was fun, I kept having to google everything and try my best to figure it out. Same! I did that and THMs advent of cyber which is what got me hooked. I was able to get to the top 1% in THM and at one point had a 118 day streak, lol. Then I heard about HTB and here I am.

[livid pier]

GPT came out right before it hit, that ws my first time seeing its power

[restive hound]

LOL so true

[restive hound]

I felt like I didn't know anything when I came over here.

[livid pier]

Back when it wasnt nerfed

[restive hound]

So true

[livid pier]

It feels so nice to struggle with PICO at first, come here and train for a year then go back to PICO

https://tenor.com/view/mixed-emotions-i-want-my-cocomelen-gif-26439485

[restive hound]

Lol, I remember I tried Picoctf as well

Okay so who doesn't mind giving me some hints on the Credential Hunting in Linux

[fathom pendant]

Starting to get off-topic from the channel

[fathom pendant]

Try resetting your target. You generally shouldn't have issues with file transfer

[restive hound]

will do

[fathom pendant]

If you want access to more of the server read #welcome

--local-auth

Take that off and see if it makes a difference

[ocean night]

That hurt my eyes

Thanks Marcie, for helping 🙂

[fathom pendant]

I forget the syntax I used to get it to work

[thin otter]

heyyy

actually i need a help

do_connect: Connection to failed (Error NT_STATUS_NOT_FOUND) im getting this error while doing dacing machine

@rustic sage can u help me

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and ask that in #starting-point

[thin otter]

THX

[rich wraith]

I got this error message, Footprinting -> MSSQL

how could I install this module?

[deft jewel]

I'm curious if there is a problem with the metasploit module. I'm trying to answer "Which version of Metasploit is free and can be used only through a CLI? " I've tried every combo of Metasploit Framework I can think of. Am I missing something?

[acoustic owl]

Should be pre-installed in Kali.
Try it like this:
impacket-mssqlclient backdoor@10.129.44.152 -windows-auth

[acoustic owl]

The solution is right in front of you in the module
https://academy.hackthebox.com/module/39/section/383

[rich wraith]

thank you, its working:)

[deft jewel]

I have tried every single highlighted word in this module. Is it something completely different than Metasploit Framework, Metasploit Project, Metasploit Framework (MSF), msfconsole. I'm confused the answer seems obvious

[fiery berry]

have you tried to use metasploit from the CLI? What command do you execute to open the framework?

[deft jewel]

msfconsole

msfconsole -q

[fiery berry]

this is only if you don't want the banner to be printed

[deft jewel]

right, I swear to god I've tried that hundred times

just worked, apparently I can't spell or type like shit

thank you!

[trail depot]

often i get wrong then realize it’s because of extra spaces on the right or left when i copy paste the answer

[ocean night]

You're not the first 😄

[sly kelp]

Welcome to Club Buddy 😂😂

[kindred comet]

Doing Introduction to Malware Analysis and I am in the Code Analysis section. It asks to download a zip and put it in the section's target. Howver, I am not sure how to do this. This is a common issue I have with HTB - I try opening the page in the box and downloading the zip from there but then the box crashes, I try curling it but it doesn't work, what am I meant to do to get the zip into the target?

[acoustic owl]

Use xfreerdp with the share option

xfreerdp /v:<ip> /u:<username> /p:<password> /dynamic-resolution /drive:share,"/home/username/share"

[kindred comet]

What does this do?

[acoustic owl]

It mounts a share drive.
With it you can easily move data back and forth

[kindred comet]

Ok understood, will try this. Thank you

[ocean night]

When you say the box crashes, do you mean the Pwnbox instance?

(downloading from resources in the top right)

Or do you open Academy on the Pwnbox and try to download from there?

[kindred comet]

Yes, the pwnbox instance crashes when I try to open the HTB academy website inside of it

[ocean night]

hmm

At which point?

Like, can you enter your username / password?

Or it just falls over right away

[kindred comet]

I can enter username / password, but when I navigate to the module page it crashes

[ocean night]

Ohhhhh

Ok

Hm maybe not, nvm.. let me see

[kindred comet]

Yeah I’ve had problems w that that prevented me from finishing other modules as well

[ocean night]

hahah I see

The window just keeps shrinking?

[kindred comet]

Yeah keeps shrinking and then it dies

I assume it has problems with the fact that the page also loads the instance

Loading the instance inside of the instance

[ocean night]

It's due to the Pwnbox trying to render the Pwnbox in the Pwnbox in the Pwnbox, that's odd for sure

[kindred comet]

Yeah

[ocean night]

Instead of navigating to the module page

Copy the link to the resource

Then you can proceed to work on it as intended 🙂

(you can paste from the host tab to the Pwnbox shown on the screen on the host)

As soon as you open the module page that displays the Pwnbox, it just loses its marbels though of course

[kindred comet]

Ahh got it, now I have it in the box and I’ll use the share option with xfreerdp

Thank you!!

[ocean night]

Ok cool, that works too 🙂

Cheers PayloadBunny

[shut wraith]

Hey @ocean night

Can u help me out for the one timeskies?

[ocean night]

I think others here can help, I just got in to bed

No module specifics please, that's a tier 2 module

Ask if someone can help you, without chucking that lot out there 🙂

[shut wraith]

I see. that's very nice of you @ocean night.

[ocean night]

but maybe not, can't recall what grants that

[shut wraith]

I have no access sir

All I have is pain

[shut wraith]

How do I word my question so that I don't leak information

[ocean night]

Honestly, I do not know. @carmine kiln are you able to have a chat?

[acoustic owl]

I have seen your question

First of all, you should understand DNS correctly.
Just because you have seen a command somewhere and think that it is correct, does not mean that it is really correct 😉

You can write me a DM, then I can surely help you further

[ocean night]

Thank you again 🤗

[carmine kiln]

hey

about what

[ocean night]

No problem

Payload is handling it I believe

I'm just gonna lay back down 😄

[acoustic owl]

Yes, I was able to help him

[tiny reef]

I am at the SQLMap Module, "Attack Tuning" at Case 6. I do not understand how you would get the prefix from the hint on your own??!?

xD

[ocean night]

Google the man page, weird it's not included there

But there is an option

Might feed that one back to the team

👍

Feeding back to the team to update the section

Oh

The man on the pwnbox has the details regarding the option

But yeah, it's not obvious

It's resolved

[rustic sage]

Wow, well I was struggling at this one the whole evening. Well at least I did the right things, just from the wrong machine... Thanks for pointing that out and thanks to @shut wraith for just asking that exact question! 😉

[shut wraith]

Welcome to suffering friend! Any questions?

[ocean night]

IIRC some FTP servers introduce delays before refusing auth, like SSH does

[shut wraith]

g0blin go to sleep

[ocean night]

I'm in bed watching a film and helping here

I'll be asleep once the film is done 🙂

[shut wraith]

Which film

[ocean night]

Sherlock Holmes: A Game of Shadows

[shut wraith]

Do u wanna watch a comedy? Ill tape myself trying to learn cyber

[ocean night]

hehe

[shut wraith]

Theres no climax

[ocean night]

Awh

[latent sigil]

No

[ocean night]

The scene of this film has just landed on a naked Stephen Fry doing what he does best

Being himself

I'm just gonna keep going

[latent sigil]

Check your connection settings

[ocean night]

His role in V for Vendetta, all be it short is awesome

[latent sigil]

Dm me

[ocean night]

Oh yeah.. 30 in 5 min, I read that wrong

Yeah that's not right

[latent sigil]

It's almost certain it's a connection setting that's bad

[ocean night]

Sleep setting 3s seconds by default between tries, so you should at least be getting 60/3 per minute, or something close to that

Dependent upon latency etc

If still confused, get some verbose output on the go 🙂

Hail Hydra 🐙

medusa does have some delay and concurrency options mind

Not saying it'll be better, just saying as I saw it this time in the docs 😄

or maybe no grep just more

😄

[analog dock]

Goblin starting to enjoy life in the academy channels

[ocean night]

I like to help if I can

[latent sigil]

Its legit like a revision for me helping people, its lit

[amber sorrel]

Hey can someone help me? module getting started, section privilege escalation. Now read /root/.ssh/id_rsa, save and chmod 600, use ssh to log in and prompt "invalid format", I don't know where the error is, or what I did wrong. please help me

[iron plaza]

Google will help you with that

[iron plaza]

what is the full command you entered?

[pale wraith]

i didnt know it was supposed to write the code for the vuln...

got it, thanks

[amber sorrel]

After getting id_rsa through sudo -u user2 /bin/bash /root/.ssh/id_rsa, kali saved it with vi id_rsa, then chmod 600 id_rsa, and then tried ssh root@94.237.49.11 -p 49728 -i id_rsa, prompt "invalid format".

[ocean night]

Looks like you're on your pwnbox, not the target

Perhaps?

No never mind, that's the target, ignore me.

[iron plaza]

thats target box through pwnbox

oh my God that worked... was googling this since yesterday

[trail depot]

I got the same issue actually, it's probably because in the module the container is ubuntu (which has bash), but in the target it's alpine

[iron plaza]

tried bin/zsh and was like naa

[ocean night]

Cheers @trail depot 🙂

🧹

[iron plaza]

check the content of the id_rsa

[amber sorrel]

I tried to remove all spaces in the content, and also tried to fix the -----BEGIN OPENSSH PRIVATE KEY----- at the beginning and end
----END OPENSSH PRIVATE KEY---- But still no success.

[iron plaza]

dont fiddle with the key mate ... use it as you got it

[iron plaza]

you probably messed up the format while beautifying it (which is not needed)

[amber sorrel]

When using sudo -u user2 /bin/bash /root/.ssh/id_rsa, the content returned by line is: /root/.ssh/id_rsa: line number: content: No such file or directory
/root/.ssh/id_rsa: line 20: F9hwG/dmzqij4NiM7mxLrA2mcQO/oJKBoNvcmGXEYkSHqQysAti2XDisrP2Clzh5CjMfPu: No such file or directory

I used awk -F ":" '{print $3}' id_rsa to filter out the content and copy and paste it, then chmod 600 for ssh

[trail depot]

sudo -u user2 /bin/bash /root/.ssh/id_rsa
Looks like you're trying to execute id_rsa as a bash script here, which is why it doesn't work
First just do sudo -u user2 /bin/bash, this will get you a shell as user2
Then you can display the full contents with cat or vi etc.

[amber sorrel]

Thanks a lot for the help, it worked.

[quick magnet]

hi i'm in Attacking Common Services - Easy
already in webshell /xampp/htdocs
i can't find any flag, there is folder called flags but no flag there
is this correct way ?

[ocean night]

You got a shell? Look around 🙂

[neon ingot]

😆

[potent grail]

Hi everyone, i Have a problems with this module
https://academy.hackthebox.com/module/147/section/1318
What credentials does Bob use with WinSCP to connect to the file server? (Format: username:password, Case-Sensitive)
As I understood after reading the module, I will need to transfer the file to the rdp host, everything turned out fine.I also checked the integrity of the file and everything is fine.But there was a problem, I can't run the exe file because of this error.I tried googling but I didn't find an answer

The system cannot execute the specified program.

[rustic sage]

type "locate flag" or "find / -name 'flag'

[potent grail]

or Invalid access to memory location

[trail leaf]

Is the file you downloaded in the same directory that you're in on the command line?

Like, if you downloaded it to the desktop, but you're in C:\Users\Bob

[potent grail]

no, i downloaded exe file to Desktop, and run from desktop

i tried to run from powershell and cmd also using gui,i can't add here a screenshot to show you exact problem

[rustic sage]

you can type ".\your.exe"

[trail leaf]

You can verify if you checkout #welcome

Then you can send screenshots

[trail leaf]

Yeah do what this guy said

.\LaZagne.exe all will work

[rustic sage]

i guess

[potent grail]

same

also runned with admin privileges

[rustic sage]

its kinda weird tbh no idea about this error

[rustic sage]

hmm

[potent grail]

I also have an assumption, maybe the problem occurs when transferring a file.

[trail leaf]

You said you checked the integrity though?

[potent grail]

yep

i used ftp to transfer

[trail leaf]

This is a dumb question but worth asking: Is the file actually a windows executable? Sometimes people download from GitHub and accidentally grab the HTML instead of the actual binary.

Because usually LaZagne has the PyInstaller icon as well

[rustic sage]

oh true lol

[potent grail]

i downloaded this one

[copper thunder]

where can i link my account to the discord again? sorry

[potent grail]

everything works, thanks to everyone, I'm a fool I didn't transfer the file correctly

[trail leaf]

not a fool, everyone has run into an issue like yours before 🙂

now you know what to check for when you run into it

[quick magnet]

its windows not linux,
already find the flag, stupid eyes miss flag in white screen webshell 🥲

[acoustic owl]

Read #welcome

[round gale]

hi, performing the attacking common applications module. wanted to know if there is any way we can configure aquatone with firefox. cause by default it works with chrome and the HTB browser doesnt have chrome installed

[trail leaf]

Unfortunately no as far as I'm aware, it's built around chromium

[round gale]

tried to install chromium using sudo apt, but it cant find some ip to download chromium

[trail leaf]

Yeah, I think you need a subscription for internet connection

https://www.youtube.com/watch?v=_y2IKGXMMGU

^ should cover whatever the question is asking for

[round gale]

thanks @trail leaf

[trail leaf]

np

[round gale]

works with firefox, just put in the firefox path :p

[trail leaf]

I feel like you won't get the screenshots correctly if the tool does what it claims, which is use chromium

because firefox isn't chromium-based

[novel shoal]

I need help on mounting Backup.vhd
has anyone completed this module?
Password Attacks Lab - Hard:
https://academy.hackthebox.com/module/147/section/1356

[fathom pendant]

Mount it on a windows host or try: https://itsfoss.com/mount-encrypted-windows-partition-linux/

[quick magnet]

this one help me
#modules message

[fathom pendant]

That's the method described in the article I linked lol

[umbral fulcrum]

hello guys, can some1 please help me in "Pivoting, Tunneling, and Port Forwarding " : "Web Server Pivoting with Rpivot"

[hybrid drum]

In terminal you can use csvkit package - it parses out specified columns from csv file (it's easier to use cut, but it doesn't take csv string values in account). This is how I did it (with some extra filtering and few manual fixes):

# Grab all cred pairs     | Search for USER:PASSWORD pairs         | Remove wrappings | Sort and remove duplicates
csvcut -c 3 scadapass.csv | grep -Po '[" ^][\w\s\d]+?:[\w]+?[",$]' | tr -d ',"()' | sort -u

[rustic sage]

i thought its linux

[high reef]

Gm

[proud pine]

If you're getting to that point, you're going beyond anything necessary for modules, or anything realistic.

Yeah, but this is extreme overkill for modules, and you're more likely to just crash them. You wouldn't be doing that in a real engagement anyway.

[plain coral]

you can always skip -sC and -sV on a large scale scan and then perform them on individual ports as necessary later.

[latent sage]

hello friend is it already okay for you regarding this question ?

[plain coral]

Also, disabling DNS resolution with the -n flag speeds up scans. You can also use timing templates with -T <1-5> depending on how aggressive or stealthy you want to be

[livid pier]

[stone slate]

Morning guys! I have a question regarding the sqlmap module, the first cases numers 5,6,7, can someone help me?

especially number 6

https://academy.hackthebox.com/module/58/section/526

[torpid haven]

Hi. Doing the server side attacks module and I'm on the following question:

Replicate the steps shown in this section to connect to the above server's "hidden" Tomcat page through the AJP proxy, then write the Tomcat version as your answer. Remember that the port you will see next to "Target:" will be the AJP proxy port. Answer format: X.X.XX

I am stuck on this:

curl http://127.0.0.1:8080
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.21.3</center>
</body>
</html>

[quick magnet]

use mssqlclient work for me

[vital adder]

or try sqsh -S (ip) -U htbdbuser -P 'MSSQLAccess01!' -h

hint it's not in the DBs, go through each method of the section again and you need a hint for that then you are look a ||different user||

[flat silo]

I'm working on the file upload module assessment. I have read the hint tried to follow the steps best I can but I know I'm missing something, I think it has to do with the content filters, can anyone give me a hand please and thank you

[warm drift]

Please need help on attacking email services questions I've tried runnin this command "smtp-user-enum -M RCPT -U userlist.txt -D inlanefreight.htb -t 10.129.221.177" but no results....https://academy.hackthebox.com/module/116/section/1173

[shut wraith]

Hey bro I'm not there yet but try searching for SMTP on metasploit

[shut wraith]

This module works for sure auxiliary/scanner/smtp/smtp_enum

[warm drift]

ok I'll try that

[warm drift]

will my RHOST be the inlanefreight.htb or generated ip?

[shut wraith]

RHOST = Target IP

[warm drift]

this is wgat the question says : What is the available username for the domain inlanefreight.htb in the SMTP server?

[raven locust]

have you tried actually contacting a mod or admin?

explicitly, that is

[raven locust]

hey, anyone i can DM to give me a little nudge on the footprinting lab - medium?

oh, never mind -- there was a connection i didn't see, solved now!

the moment i decide to ask for help after trying for an hour is also the moment i suddenly figure it out

[torpid haven]

Hi. Doing the server side attacks module and I'm on the following question:

Replicate the steps shown in this section to connect to the above server's "hidden" Tomcat page through the AJP proxy, then write the Tomcat version as your answer. Remember that the port you will see next to "Target:" will be the AJP proxy port. Answer format: X.X.XX

I am stuck on this:

curl http://127.0.0.1:8080/
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.21.3</center>
</body>
</html>

[fathom mango]

If I have blind SQLi with this payload ELT(1337=1337,SLEEP(5)), how to implement to see version of MySQL DB

[tender acorn]

aHR0cHM6Ly95b3V0dS5iZS9kUXc0dzlXZ1hjUQ==

[elfin cedar]

hello. I don't understand what I am doing wrong. This should be the easiest thing in the world and I am embarrassed. I am just uploading this basic php webshell https://github.com/Arrexel/phpbash but all I get is a black screen when I go to it. https://academy.hackthebox.com/module/136/section/1261

[rotund urchin]

Anyone else having issues with the tuning section in the SQL Map Essentials? I have done it three times and each time I get the flag but its still wrong.

[torpid haven]

I am using nginx as a reverse proxy. How do I check that it's correctly forwarding requests?

[elfin cedar]

nevermind I got it.. so ridiculous

[vital adder]

have you done that section?

the issue that guy have is specifically about the section so the 2 wall of text that you copy from somewhere are completely wrong, helping other is good but pls make sure you know that you are doing or it will backfire and even confused the heck out of the person you help

[misty elk]

@narrow solar stuck on this same thing... what am I missing

[vital adder]

if you are on the Nginx Reverse Proxy & AJP section shoot me a dm, my note on this section isn't perfect but it's should be enough to help troubleshoot

[vital adder]

for case 5? shoot me a dm with the flag that you have

[vital adder]

what's the issue? also did you read the hint?

[vital adder]

mind sharing your issue?

nvm i know what issue you are having if you are on the Kerberoasting - from Linux section, you can use the user showed in the example for and the cred is given in the Credentialed Enumeration - from Linux section

[misty elk]

Ohhh jeesh!! thanks @vital adder I did that one a few days back

[zinc marsh]

someone know how to fix this?

[rare topaz]

you broke the terminal somehow, usually i'd just close it and restart while trying to find out what caused it

I think that mainly happens in the dumb shell upgrading process

[zinc marsh]

I don't understand why it doesn't work lol

[rare topaz]

if this is on linux, what other dumb shell upgrades have you tried, i usually go for script if python isn't avail

[ornate arrow]

greetings everyone
im almost done with linux local privilege escalation asessment, but have been stuck on flag4 for a while now
I have tried a number of things but cant figure out what to do
ive checked the services and found one, even tried metasploit login on that service but it didnt work, have also tried to use the credential i found in a xml file on wp-login but the website becomes unreachable (I feel like that particular credentials is a rabbit hole or something)
any hint is appreciated

I have flag5 as well but I dont think that will be related to this

[zinc marsh]

all fine now

[rare topaz]

Sometimes somebody messed with the box and shells get funky

[ornate arrow]

whoop nvm I think I got it

[vital adder]

unrelated but can i dm you about Cybermonday? the Fing RCE thing is driving me crazy

[zinc marsh]

yea

[trail leaf]

Don't know if this was solved, but I found it easiest to use Docker instead of trying to set nginx or apache up locally: https://github.com/An00bRektn/apache-ajp-docker

[valid sinew]

Hi Guys so I am taking time out of work and looking to do more ethical hacking as well as cloud technologies. Just wondering how I can go about making friends with other hackers doing the hack the box academy modules with them as a team. I see the teams page on HTB but don’t know how to join a team. Also I assuming those are for challenge machines as I am looking more for someone that is doing the academy and modules.

[proud pine]

While it's not impossible, it's kinda hard to do modules with other people, due to the self-paced nature of it. Struggling through some of the things on your own is even beneficial, rather than looking at the modules as something just to finish.

[valid sinew]

Ok would it be better to do the cahllenge machines along side the modules

How would i find a newbie team that is doing the challenge machines and i can join and work with them

[proud pine]

It really depends on your goal - if you're trying to follow the path (say, for CPTS or CBBH), it would probably be better to finish the path, before moving on to other stuff.

[gray sigil]

Need help on Javascript Deobfuscation, decoding. Last question. I'm doing exactly what it says but it's returning the same answer.

Question: Using what you learned in this section, determine the type of encoding used in the string you got at previous exercise, and decode it. To get the flag, you can send a 'POST' request to 'serial.php', and set the data as "serial=YOUR_DECODED_OUTPUT".

I have decoded the output of the previous task, but when I substitute it in for the "YOUR_DECODED_OUTPUT" it just returns the same output that I've already decoded and swapped in.

Solution: Reset target.

[valid sinew]

Ok thanks for your advice mate 🙂 I am currently doing NMAP next in the modules will do that as well as follow along videos

[royal saffron]

hello anyone konws what is a badsec script

[vital adder]

a quick nudge help him solved in 2 sec but your way is definitely cooler than the module, can't say if it's better or not yet because editing a conf file is different than using docker especially for beginner but i'll definitely give that a good look right after my ape brain stop frying from the new seasons box

[trail leaf]

Check to make sure that you're setting up the POST request correctly

Just did the lab again and I can verify it works

[gray sigil]

I had to reset my target.

I was doing everything correctly but for some reason it was messed up on the target end.

[trail leaf]

I do think it's weird that you can just POST to the endpoint with the wrong string and still get the encoded stuff back got it confused with the skills assessment, my bad

[gray sigil]

Yeah, I dunno.

Just reset the target, swapped in the new IP to the same exact command and it gave me the right flag so... shrugs

At least I was doing it right and am not crazy after all 😂

[flat silo]

I'm working on the file upload module assessment. I used intruder to fuzz extensions and I'm pretty sure its just whitelisting on the front end because you get the same thank you for submitting message no matter the extension. I've noticed in the request header the app accepts xml so because I'm unable to locate the uploaded directory I attempted a couple xml scripts but I'm not getting anywhere with those. Can someone maybe help me figure out what step I'm missing

I used the character injection script and modified the file name in attempts throw errors and get information that way but nothing worked.

In the script.js there is a /contact/upload.php directory but no matter what everytime I visit it it's the same message 'Only images allowed' I even used an unaltered .jpeg photo to test the process and got the same result

[urban valley]

Windows Priv Esc (Pillaging): Did anyone get cookieextractor.py to work on their Kali or PwnBox? I can't get cookieextractor to work because of Python shenanigans (no win 32 module --> can't install pypiwin32 or pywin32 for some reason)

[fathom pendant]

Shouldn't you be trying to run that on the target?

[digital pewter]

Are you using the contact form? One thing that is easy to miss is the green, image attachment button. It works differently than the submit button. They serve different purposes.

[flat silo]

Ok I'll try and see what different results I get just using that, thank you

[trail leaf]

For future reference, that pywin32 module is only available on Windows

[urban valley]

O

[urban valley]

In the example, they used cookie extracotr on kali so i assumed we were suppsoed to do the same

[fathom pendant]

Perhaps you're using the wrong version of the tool?

[urban valley]

did you use cookieextractor on the Grace or Peter machine?

[fathom pendant]

I have not done this module, merely offering suggestions

[trail leaf]

You're using the wrong script

https://raw.githubusercontent.com/juliourena/plaintext/master/Scripts/cookieextractor.py

[urban valley]

that was the problem. got the cookies. ty

[trail leaf]

Always read the scripts you run before you run them, even if it's a quick skim to make sure you have a general idea of what it's doing 😉

[acoustic owl]

No risk - no fun

[thorn urchin]

and for any suspicious usage of hex chars or subprocess stuff;)

[leaden pond]

I have a file on a linux machine that I'd like to transfer to a Windows machine using SMB. On the linux machine, I made a directory called "share" and placed file.txt inside of share. Then I ran the command "sudo impacket-smbserver share -smb2support /share", which launched an SMBserver. Next, I RDPed into the Windows machine, opened PowerShell and ran "copy \<IP of Linux machine>\share\file.txt." In the linux terminal where I ran the first command, I see a confirmation message that the share has been connected to, but then I get a message that it has been disconnected from. In PowerShell, I get a PathNotFound error. Any ideas on what I'm doing wrong? This is for the File Transfers module, Windows File Transfer Methods.

[digital pewter]

You should format the commands you share as code using single, or preferably, triple backticks to make it easier to see what commands you are using. Did you put a dot in front of ./share?

mkdir share
impacket-smbserver -smb2support share ./share

Then be sure to use double-backslashes before the IP when reaching out to your share:

copy \\IP\share\file.txt file.txt

[leaden pond]

That did it! I had been using the double backslashes but hadn't specified the absolute path to the share directory. I appreciate your help.

Also, thanks for the pointer on formatting code in Discord.

[quasi wave]

hi I need help getting hostname of device in nmap for nmap introduction module section's host and port scanning section

sudo nmap -sn 10.129.144.202```

that's one thing I tried but tried other stuff too

it seems to say host is up but I don't think that's the hostname

I tried going to IP address web page but its just showing apache

[fathom pendant]

The host name starts with 'N'

[quasi wave]

I'm supposed to guess?

[trail depot]

Try version scanning every open port

[quasi wave]

ok

I did that with

┌─[us-academy-1]─[10.10.15.192]─[htb-ac-605555@htb-nn36mohrcq]─[~]
└──╼ [★]$ sudo nmap -sT 10.129.144.202
Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-21 21:34 BST
Nmap scan report for 10.129.144.202
Host is up (0.026s latency).
Not shown: 993 closed tcp ports (conn-refused)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
110/tcp   open  pop3
139/tcp   open  netbios-ssn
143/tcp   open  imap
445/tcp   open  microsoft-ds
31337/tcp open  Elite

Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds

it didn't do anything

[trail leaf]

That's not version scanning

[quasi wave]

ok hold on

-sV right?

ok wait let me try that

scan is taking a little longer but I'm doing that

we'll see how well it works

solved

[fathom pendant]

It pays to read the information on the page too

The page tells you to do something like that

[raven locust]

make sure you know what the commands you are executing do, -sT is a tcp connect scan and has nothing to do with versions

[urban valley]

Windows Priv Esc (Pillaging): on the last task (task 5), is the password to restore the directory with the password hashes the same as the password for restic backups in task 4?

[raven locust]

don't blindly copy from the module but try to understand what you're executing

[fathom pendant]

Have you tried it?

[urban valley]

nvm i was using the wrong restic repository. thought there were two different passwords

[fathom pendant]

This seems like a spoiler

[urban valley]

it seems pretty vague

[fathom pendant]

In relation to the question you asked, it seems less vague

[shut wraith]

2 pages left of this footprinting module

Its my 3rd day on it

[fathom pendant]

As long as you're learning, the most annoying one is definitely the Oracle one

[shut wraith]

Thanks I'm trying

I've been doing a lot of courses throughout this year

I think this one is gonna be it

I'm finally gonna get my barings through this course I believe

[fathom pendant]

Eh speed through the content is all relative

[raven locust]

the footprinting one felt like it dragged on for ages

[fathom pendant]

Most of the people that blitz through contents are just infodumping

Pass attacks is needlessly long

[raven locust]

i took notes for every page and even tho the little exercises were fun it was a lot of theory

i didnt have many issues with odat personally

[proven ibex]

yo

wsg

[fathom pendant]

Relative

I spent maybe a day or two on it. But I also didn't face too many issues

[zinc marsh]

[rustic sage]

guys how do i can download nmap into target machine for scan local stuff

i need a single file like sh file it should work like nmap

[fathom pendant]

Why exactly do you need Nmap on your target, what module are you working on?

Because there's other tools that exist that might do what you want, but more efficiently

[rustic sage]

im not in the module but im doing tryhackme ctf room so im reading a write up because i was stuck

[fathom pendant]

Ah, then you're in the wrong place, read #welcome

This channel is for the academy.hackthebox.com modules

[proud pine]

Why not ask in the tryhackme discord?

[rustic sage]

i know but i need a help

[fathom pendant]

Not thm

[trail leaf]

Just search “static nmap binary” and you’ll find stuff 🤷‍♂️

[rustic sage]

i got perma muted i guess i cant talk in channels

[fathom pendant]

Also this

[rustic sage]

thanks

[fathom pendant]

If the walk-through is telling you to upload it to the target who am I to judge

[rustic sage]

what do you mean its a ctf not walk through

[fathom pendant]

You said you're reading a writeup

[thorn urchin]

thm rooms might as well be walkthroughs

[rustic sage]

because i was stucked

[raven locust]

if it works it works