modules

[hallow kiln]

what Marcie said

[orchid pine]

hey

good good

hbu

[vital adder]

read #rules and #welcome this channel is for academy modules pls take general talk to #general if you guys want to chats

[nocturne shell]

ok sorry

[mystic jungle]

hi can anyone help me with the attacking common services dns part?

[fathom pendant]

What have you tried

[mystic jungle]

and then its just doing the fallback thing

[fathom pendant]

Switch the ns1 to the ip

Also should be inlanefreight.htb in your command

[mystic jungle]

okay! thank you, i tried that however it didnt work

its still doing the same thing with the fallback

[fathom pendant]

... I meant replace the whole line with the ip

Not just the ns1 part

[mystic jungle]

yeah i tried that too but im still getting the same result

[fathom pendant]

Only thing needed in revolvers.txt is ip

Don't forget to change the command from inlanefreight.com to inlanefreight.htb

[mystic jungle]

thank you for your help, its been trial and error haha but yeah im still getting the same result, its probably something stupid that im doing. ill show you my output

[fathom pendant]

What is your command and please put a ` in front and behind the command

Since you're not verified if you tried to multi-line code example, the bot will yeet it

it helps readability

That's a quote

Not a backtick

But anyway, did you copy/paste that from your terminal?

[mystic jungle]

yes

[fathom pendant]

Put a space after the flags

I'd suggest deleting your messages after because they are spoilers

[mystic jungle]

and thank you, i will

[fathom pendant]

Are you connected to the vpn?

Give me a minute to sanity check here

[mystic jungle]

okay haha thank you so much for your help i really appreciate it a ton ive been stuck on this module for like a week

and no im not, do i need to be?

[fathom pendant]

...

How do you expect to attack a machine that isn't on the same network

[mystic jungle]

you mean the ip?

[fathom pendant]

If you do ip a do you have a tun0 ip

[mystic jungle]

im connected to the ip using the pwnbox

[fathom pendant]

Oh OK you're using the pwnbox

Good

OK just did sanity check: and if you're doing it correctly: there should be no errors with nameservers

I did the same exact command you did (with my spawned ip)

You'll get the warning, that's normal

And you did not edit the names.txt yeah?

Yeah no even doing your command syntax it all worked fine for me

[mystic jungle]

hahaha yeah otherwise there'd be no shot of me getting any level of connection, and thank you so much, i just figured out the issue, id been working on it so long it became disconnected from the ip address i had it under omg. but the other issues were just because i didnt have the ip address in the right spot before you corrected me. yeah i didnt edit anything, i cant thank you enough for your help. now i think i just have to do the dig commands through each address that it finds and i should find the flag somewhere in there

[fathom pendant]

Yeah once it spits out the subdomains at you you can start digging :)

No problem

Expect to run into failures on dig commands until you hit the right one btw

[uneven barn]

Hi all, I am stuck on abusing http misconfiguration advanced cache poisoning attacks - if anyone on hes/shes free time will be able to help with this, just let me know. Thanks

[mystic jungle]

for the attacking common services dns

[fathom pendant]

Dig axfr subdomain.inlanefreight.htb @ip

[mystic jungle]

That’s the error I’m getting, im not too sure what that’s about

[fathom pendant]

...

https://tenor.com/view/ffs-baby-really-oh-god-just-stop-gif-20490509

Replace subdomain with one that popped up when you did the subbrute

Subbrute takes a few minutes to spit out some subdomains

[mystic jungle]

nevermind hahaha i just got it

im so sorry lol

ofc the one i gave up on

[fathom pendant]

I'm being abstract on purpose so as to not give away the answer. So don't take things as literal as I type them

But congrats on the answer

[mystic jungle]

yeah thank you so much for your help i was being a little stupid on this one

[topaz scaffold]

can someone help me with a hashcat error? 🙂
at module Password Attacks, at Passwd, Shadow & Opasswd section
i downloaded the resource zip and mutate the passwords to bruteforce unshadowed and i got this error

[dim crag]

can anyone help me with the command injection skill assessment plz?

i dont know where to put the payload

[fathom pendant]

The error is with the hashes not your password list

[thorn urchin]

hashcat is extremely picky with its hashes input

[tidal kelp]

Currently on Common Attack Services / SQL > what syntax are you suppose to use when connected with mssqlclient.py? Have tried the normal sql syntax. but it doesn't seem to work

[topaz scaffold]

i can use the hash file with rockyou 😦

[autumn pilot]

MSSQL has a slightly different syntax of the one you are using (mysql)

[fathom pendant]

Hey so uh, rdp with like a < 1Mb connection via tethering kinda sucks I'm getting 10 frames per minute over here 😢

[thorn urchin]

rough

[fathom pendant]

I managed though to successfully do the first host on shells & payloads, I realized I never took notes on this skills assessment

[topaz scaffold]

i tried on pwnbox, maybe is something from my machine

[fathom pendant]

Garfield, the cable is out

If you don't get the reference f0x I'll gladly dm it to you lol

I refer to it in these trying times

[fathom pendant]

Hashcat is picky about the hashes

That's all it is

So your unshadow process may have been a bit borked

[tidal kelp]

omg this is a pain. Can't locate the syntax at all

any pointers, the content on academy doesn't show to much on how to list db etc

[autumn pilot]

the command to list databases in MSSQL is in the section

[tidal kelp]

I must be blind

I can only connect also via mssqlclient.py not via sqsh..

is that by design or something i also do wrong?

[fathom pendant]

Sqsh is broken with parrot but either way

Syntax would be the same if you used either

Mysql is not mssql

You need to use the MSSQL syntax

[tidal kelp]

yeah

mental note check the cheat sheet

[fathom pendant]

I mean if you just read the section you're on

It literally tells you the commands

It gives both the mysql syntax AND the mssql syntax for enumeration

[tidal kelp]

this syntax is pain

so listing all the table in the db. no userss...

[fathom pendant]

Start from the top and move down slowly enumerating

First find database names, then select database, then find tables

If you wanna do something extra you can even find the column_name from a table : so you can just select the relevant columns from a table instead of *

But academy dbs are just like a few columns wide

[fathom pendant]

My brother in christ

Read the section

You're also meant to do something else first

Hint it involves hashes

Also you'll probably need a certain flag to authenticate with windows

[fathom pendant]

If you're still stuck in 30 minutes you can dm me.

I just reran it and had to re-remember how I did the second part to see the flag

[vagrant orbit]

Good morning all, I am not stuck but I am wondering if there is another way to get the answer to this question in the WordPress skills assessment: "Identify the only non-admin WordPress user. (Format: <first-name> <last-name>)". The way I got it feels kinda cheap.

[oblique spoke]

Hi! i got stucked on the module Shells and Payloads - The Live Engagement. I'm on the first Host trying to find an exploit for the apache tomcat. And as i gathered i should find somewhere some login creds for the tomcat manager, but i cant see any tomcat manager on the nmap output. Can someone help me? Thank you in advance 🙂

[acoustic owl]

||WPScan|| is your friend

[vagrant orbit]

Thanks 🙂 ended up moving on because I already had the answer. But, while you're here do you mind if I DM you about a later question in that section?

[acoustic owl]

sure

[wooden summit]

hey there guys, hope you re doing fine 🙂
I ;m having syntax problems w the CLI, meaning:
I 'm unable to understand command syntax at some points, I mean really, I don t get it.
e.g. can I use both
a. '-sV -sC' and
b. '-sVC and could I also add
c. '-sVCA'
or each option needs to be stand alone.
For ls it s ok to type e.g.= ls -lah,
same goes for everycommand?
Where could I find a very dumbproof guide to cli syntax?

or maybe it s a man page notation knowledge thing I have to get through before starting to comprehend stuff?

[naive wadi]

Okay, so you can't add those commands together

if you type man nmap into the terminal you will get the manual

and you can then look at all the different switches

[naive wadi]

https://www.stationx.net/nmap-cheat-sheet/

also there is no hard and fast rule

for cli syntax, there is conventions but sometimes applications use different conventions

[wooden summit]

@naive wadi Conventions seems to be a legit explanation to my problem.
I mean slight differentiations among cmds should be what gets me.
I guess thoroughly reading each command and searching for paradigms of use is the way to go.
I was just wondering if maybe I 'm just not getting it for some reason.
Thnx btw 🙂

[naive wadi]

Most programs will use arguments and switches in the same way e.g. -p password -u username but it's just a case of getting used to each program

Most of them are the same and then one dev will decide to use some obtuse way to do something that you have to remember or take notes of

just a case of repetition repetition

[wooden summit]

@naive wadi this I get. Also I understand that both '-U' & '--username' are exactly the same yes?

[naive wadi]

correct

Powershell actually has a pretty good standard as outlined here - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_command_syntax?view=powershell-7.3

[wooden summit]

@naive wadi this is eyeopening, thnx

[naive wadi]

no worries, people hate on powershell but it's usually a skill issue, it's actually really powerful and well implemented with good standards

also to answer your original question here

a. '-sV -sC' these are seperate switches and invoke different functionaility.
b. '-sVC and could I also add (this would not work)
c. '-sVCA' (again this would not work.

the actual command would be -sV -sC -A

[viral slate]

Hi everyone!
Currently on windows PE Part 1.
Added new user with printnightmare, but can’t rdp or evil-winrm to it

[wooden summit]

@naive wadi Are there cases where seperating switches wouldn t work?
not literally for 'ls' but for understanding's sake e.g.:
ls -lah (works but)
ls -l -a -h (wouldn 't work)
I 'm probably pushing it too far lol

[naive wadi]

Yeah, because if -l -a -h is not a recognized function it wont' call anything. So if a program has a function that corresponds to -lah it has no way of inferring your meaning unless explicitily programmed too (which is a waste of programming time)

[wooden summit]

@naive wadi The way is paved w trial & error I recon... Off I go 😛
Thnx again

[naive wadi]

literally the best approach to have, just play and see what happens

[inner pawn]

I just enrolled in the "Detecting Windows Attacks With Splunk" course. I am a Splunk Professional Services Consultant and have worked with Splunk for many years. I just wanted to point out some issues with the SPL being used in this module. First off the index is set to main. In most cases a customers or your orgs windows data will not be and should not be contained in the "main" index, this index is usually reserved for data that is onboarded with an unconfigured index. Second, this search implies that XML is enabled for Windows Event Logs. 99.9% of organizations will have XML disabled for Windows logs, especially if me or any other consultant has been involved in the building of the environment. Why? Because compared to how Splunk visualizes events, XML is messy and terrible to look at. It also implies that sysmon is bein used by the customer, which is typically not the case. You will not be able to see any of the switches used for a command without sysmon being used in normal windows event logs.

[undone narwhal]

Can you Share a Screenshot?

[analog dock]

Please share your feedback in #858470491676737536

[inner pawn]

Ok I will, thank you!

[undone narwhal]

You Sure that is password and username you have given when executing the printnightmare script

[viral slate]

https://github.com/calebstewart/CVE-2021-1675
I used this one

[undone narwhal]

can you share the command you used

[viral slate]

Import-Module .\exp.ps1
Invoke-Nightmare

By default , it gives those creds

[hallow kiln]

Might be missing context further up, but -sCV for example is definitely valid

[undone narwhal]

Hm, I just tried it and it is working for me

[viral slate]

[undone narwhal]

It clearly says your credentials are not valid from the error

can you try to create a new user with the script and use that to login

[viral slate]

It also didn’t work actually : D
Maybe I have some problem with my shell, but I’m not sure

[lean jackal]

May I please get any help for Skills Assessment - File Upload Attacks? I guess I have everything I need to know. I found the upload path and how pictures are safed reading the file. But when I upload just a normal picture and browse to ||http://83.136.252.24:48352/contact/user_feedback_submissions/20231011_clean.jpeg|| I get a "Not Found" error.
What am I missing here?

[rustic sage]

bit stuck on the proxy chains module the section is "Web server pivoting with rpivot" i set everything up correctly however when i try to use the command "proxychains firefox-esr 172.16.5.129:80" it just sits loading my proxychains.conf file is setup correctly aswell so the only thing i can think of is maybe the ip or port of the webserver is wrong but idk what else it could be

[drifting spoke]

Can someone please help me with ACTIVE DIRECTORY ENUMERATION & ATTACKS > ACL Enumeration's last question What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word). I see many (too much people) are struggling to those stupid and nosense questions. Also the command needed to get the results is stucking for about 1 hour, anyone can give me the answer ? thx

[undone narwhal]

replace the * with group name, by default the command checks all the objects in the domain

[undone narwhal]

check your file name again, its not in the right format

[plain coral]

did you look at the hint? status.inlanefreight.local

[sly dome]

google: php date function

you dont have everything

[viral slate]

Yep, it was strange, but I had problems with my shell.
Thank you!

[umbral fulcrum]

Hi guys I'm in "Command Injections" ==>> "Skills Assessment"
I put ||/index.php?to=tmp&from=51459716.txt%26bash<<<$(base64%09-d<<<Y2F0IC9mbGFnLnR4dAo=)&finish=1&move=1||

but I get error:
|| Error while moving: mv: missing destination file operand after '/var/www/html/files/51459716.txt' ||
||Try 'mv --help' for more information.||
|| /var/www/html/files/tmp: /var/www/html/files/tmp: Is a directory||

does anyone have any idea what am I missing?

[quartz shore]

Interesting

[woven copper]

try inyecting your payload at the end of the mv command not at the middle.

[rustic sage]

can someone please help

[vale crescent]

Is there any free certification offering from HTB or THM?

[lusty thicket]

[vale crescent]

Dude don't judge me I have anxiety

[umbral fulcrum]

it still doesn't give me ....
hmmm what am I missing?

[rustic sage]

nvm i forgot to do a ping sweep 🤦‍♂️

[naive wadi]

My life is a lie

[umbral fulcrum]

can I DM ??

[hallow kiln]

it just saves the second it takes to type out the full thing, no big deal

[woven copper]

change your payload, start first with something more basic, don't go for the flag inmediatly.
Its possible its not on that directory

[naive wadi]

Looking for the actual spelling/syntax of an answer question for DACL Attacks I. I know the answer but unsure how it's actually to be entered? The question - RIGHT_WRITE_OWNER allows modifying what attribute of an object?

The answer should be ||Security Descriptor's Owner||

well at least that's what the page alludes too it being.

[rustic sage]

stuck on "web server pivoting with rpivot" section in the port forwarding module ive done everything right no errors i try to connect to the webserver using proxychains firefox-esr 172.16.5.135:80 and it doesnt load please help https://academy.hackthebox.com/module/158/section/1434

[naive wadi]

what have you set your proxy and server ports to?

[rustic sage]

proxychains.conf is socks4 127.0.0.1 9050 on server.py proxy port is 9050 and server port is 9999

[ebon jasper]

I need tech master's help
I really need to use tplmap tool to complete SSTI room. However I can't fix this problem. I tried to install pip mapping, collections. I tried to run with pyhton3 and python 2.7 still failed. However, when I tried to run it from htb box that problem didn't happen

[umbral fulcrum]

I'm missing somthing cuase no comand is working & it only show me if it moved or not ...

[naive wadi]

just to double check is the ip of 172.16.5.135 the actual IP of the host that has spawned? Because often the IP on the exapmples is differnt from what is spawned in the lab

[ebon jasper]

Even though I finished room, but I couldn't fix that problem

[naive wadi]

Sounds like a dependancy issue on your own machine? If it works on the pwnbox but not yours then that's an issue on your install.

[rustic sage]

i ran i ping sweep theres only 2 172.16.5.129 this is the ubuntu machine u ssh to then 172.16.5.135 this should be the webserver as i ran nmap and port 80 is open

[ebon jasper]

Yeah I know something issue from my pc, I couldn't know the real issue

[rustic sage]

i tried connect to 172.16.5.129 aswell obviously still doesnt work

[naive wadi]

it will be in whatever errors our output to the terminal?

[ebon jasper]

Only that error

Module collections has no attribute Mapping

[hot heart]

Does anyone know why HTB won't take my answer for "What role ensures the objects in a domain are not assigned the same SID? (Full name)"

I've tried submitting Relative ID (RID) Master and every other variation fathomable, and it will not take the answer, am I answering it wrong? Yes I've checked for proper spacing, and have tried all the case sensitive variations as well

[fiery berry]

what happen if you try to execute it with python2?

[ebon jasper]

It says yaml not installed I tried to install yaml2 but another error

So i think I have to install fresh linux to vm

[naive wadi]

bro! I googled that error and it's an open issue on github....? Did you google it....? https://github.com/epinna/tplmap/issues/104

It's literally the first hit

[ebon jasper]

I googled it but not with tplmap 🤦‍♂️

Thank you bro

[naive wadi]

without seeing the exact things you've posted it's hard to diagnose

Screenshot commands

[rustic sage]

yeah hang on

[naive wadi]

and I know you've said what you did do, but that doesn't mean you didn't misstype something you know?

[hot heart]

I've searched for different terms all over the module page and I'm 99.9% sure its RID Master

[fiery berry]

which section of a module is this? AD?

[hot heart]

Active Directory Functionality section

In the intro to AD module

It should be the very last question

Even the hint is telling me It's relative and still won't take my answer

[fiery berry]

remove the (...) from the answer

[hot heart]

wow

I did that

but i must've spelt it wrong

thanks

I was losing my mind over that question, thanks a lot!

[rustic sage]

ive sent them in dm if u dont mind its not allowing me to send them here

[hot heart]

How far into the academy are you @fiery berry

[fiery berry]

finished the CPTS path some time ago but I can't do the exam due to a full agenda

[hot heart]

Dang! That's sick, how hard would you say the material starts to get once you get past the fundamentals?

[fiery berry]

let's take this on dm

[hot heart]

Whenever you decide to take the exam, would you have to start completely over, or would you just have to touch up on some things

ok

[woven copper]

try following the methodology on the module, test on a local bash environment, you are inyection in some mv <from> <to> <here> , so first you have add new line , comma, redirector | , && , etc . Something to escape the mv sintax and also doesn't fail

[burnt sluice]

Hello, did u find the answer?

Hello everyone, Module bloodhound section nodes question Which non-default Group Policy affects all users?

if anyone got any hint i appreciate it, i can't seem to find the answer, i can see the default gpo but i didn't get how to enumerate the non-default ones

I found the answer, as a hint for anyone struggling, check the GPO link in the section, under the Users section, there's sth about GPOs, check it out :D

[tidal kelp]

I'm on the Common Services > DNS. Are there anyhting special you need to do with the pwnbox to get this to work. Cause I can't get the zone transfer to work no matter how I try

[acoustic owl]

Perhaps the zone is configured to allow zone transfer only from certain servers.

[tidal kelp]

is this correct?

[thorn urchin]

that would indeed brute some subdomains, but thats not a zone transfer if that's what youre meant to do

[tidal kelp]

yeah, my problem is when i do the dig axfr , it gets me nowhere

got it

holy hell that was not my module

[waxen kayak]

Web Attacks - Skills Assessment
Was anyone able to get XXEInjector to work for this skills assessment?? I've already completed it manually but was just curious. Spent a bit of time tinkering with it to no avail.

[fathom pendant]

I'm starting to feel Deja Vu with the DNS questions

[oblique spoke]

Hi! Does anyone know how can i find the tomcat cred on Shells and Payloads Host 1?

[thorn urchin]

If we told you itd ruin the challenge

[oblique spoke]

maybe a hint then?

[fathom pendant]

Tbh it's more obvious than you think

[thorn urchin]

I dont do hints but if theres something youre attempting and having issues with then I could possibly help with that more

[glossy wedge]

i keep having problems with the ffuf skill assesment
Im using this command:
sudo ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt:FUZZ -u http://academy.htb:32896/ -H 'Host: FUZZ.academy.htb' -fs 985
For this question:
Run a sub-domain/vhost fuzzing scan on '*.academy.htb' for the IP shown above. What are all the sub-domains you can identify? (Only write the sub-domain name)
I get 0 output. i changed the /etc/hosts file to. am i doing something wrong?

[lusty thicket]

they’re in plain sight on the users desktop

[hot heart]

How many people have all 3 certificates as of today? Is there a way to check how many people have htb certs?

[fathom pendant]

Well it'd be hard to have all 3

[hot heart]

whys that

[fathom pendant]

Considering cdsa just launched

[hot heart]

oh yea

But what about the other two

[fathom pendant]

The only way to know how many have the certs individually is to get the cert yourself

But combined don't know

[hot heart]

They tell you once you've completed the certification? Interesting

[fathom pendant]

Well you get a badge in academy

Which tells you how many have it

But publicly they haven't disclosed I don't think

[hot heart]

Nice, do you have it yet? If you don't mind me asking

[fathom pendant]

Nope

Had to halt progress for personal reasons

[hot heart]

Understandable, how long does it usually take someone to complete the certificate in general? Starting from scrath in terms of HTB material

[acoustic sparrow]

ssh with root isnt possible

[lusty thicket]

spoiler btw

[acoustic sparrow]

yeh you right sry

[fathom pendant]

Depends on familiarity with topics it can take a couple months or longer , the exams themselves are roughly a week long each and feedback takes up to 20 business days

[hot heart]

👍

[acoustic sparrow]

but i got on a better track found where to use the creds i found for root

lets see where it leads me 😄

[steel blade]

Hello!
I have problem in Introduction

When i open firefox it's can't open any pages

I see - The connection has timed out

[acoustic sparrow]

check if your forxy proxy is on bro

[steel blade]

No proxy in my settings

[acoustic sparrow]

are you inside a vm?

[steel blade]

It's in Inroduction in acade,y

I start machine in - Intercative Section with Target

[fathom pendant]

Oh

The pwnbox has limited internet access

Try opening the webpage in your normal browser

[steel blade]

But i use link for task

[fathom pendant]

http://ip:port

I understand

Did you also click the "spawn target" button?

[steel blade]

Yes

[fathom pendant]

Which is located just above the questions

[steel blade]

Yes

I try to visit this link

But i have this problem

[fathom pendant]

It's a public ip

You don't need the pwnbox

[steel blade]

How i can send you screenshot?

[fathom pendant]

Don't

I know your issue. And the section

[steel blade]

сan I write to you in person or call you?

[fathom pendant]

You're given a public ip and port

I'm telling you how to solve it here

[thorn urchin]

send them a letter in the mail

[steel blade]

Must i use HTB VPN for that?

[fathom pendant]

No

It's not required

As the ip is public

[thorn urchin]

No, that's why its a public address

I recommend tackling some computer fundementals and coming back to HTB in a month or so

[steel blade]

Okey, it;s help for me

Thanks

I think i must open this link in machine

[thorn urchin]

Youve already been told the answer though

[fathom pendant]

Open it in your personal browser, not the machine

[steel blade]

Yeah. it's help me

Thank you very much!

Spawn your target!
Spawn My Workstation if you haven't done so.
From your workstation, open Firefox and browse to the target URL.
Answer the question below.

It's point from this task

[rustic sage]

Can someone help me lol... I dumped all the NTLM hashes with impacket-secretsdump, and I'm running "sudo hashcat -m 1000 domain_hashes.ntds /usr/share/wordlists/rockyou.txt" but it only cracks like 3 passwords and stops after 2-3 mins... There is 3,000+ hashes in there no way it's finishing that quick

[fathom pendant]

Also your screenshot is spoilers

[hallow kiln]

I don't think the module asks you to crack all of the hashes anyway

[fathom pendant]

Probably not

Some of the passwords may not even be in rockyou

[rustic sage]

But if you want to use https://github.com/clr2of8/DPAT and make a good report you need to lol

I've tried some of them in SecLists as well same thing

runs for like 3mins (not even) and only cracks those 3

[fathom pendant]

It could also be that the internal ones are getting escaped by the backslash

[thorn urchin]

Also the hashes are good as passwords 99% of the time. Cracking the ntds.dit is mostly just for providing the client password analysis

[hallow kiln]

plus if you want to try cracking 3000+ hashes, you wouldn't do that in a VM, you'd use a nice cracking rig

[thorn urchin]

yup

Id focus just on whatever user the question is asking for

[fathom pendant]

Most remote software allows you to use hashes in a pth method

[rustic sage]

It stills shouldn't stop... I was monitoring usage and it came no where close to maxing

[fathom pendant]

Sir

You're focusing on the wrong things

[rustic sage]

Not my goal... already completed the lab just trying to work on reporting

[thorn urchin]

is hashcat giving you an error when it stops

[fathom pendant]

^

[rustic sage]

Let me run it again

I didn't see one

[hallow kiln]

try it on your host

[thorn urchin]

it could just be either processing still or just done lol

[fathom pendant]

Or is it just saying "exhausted"

[naive wadi]

This

[rustic sage]

Is is saying "Status...........: Exhausted" but the usuage doesn't even spike...

[thorn urchin]

that means its done

[rustic sage]

I can try brining it to my host, but for reporting on the exam what would you do

[thorn urchin]

congrats

[naive wadi]

Means it's done

[thorn urchin]

hashcat has a cache iirc so it probably skipping once it already finished

[tranquil axle]

having only 3 accounts use easily guessable passwords is also report worthy

[rustic sage]

I find it hard to believe they only made 3 weak passwords

[thorn urchin]

For these labs? I believe it

[fathom pendant]

^

[thorn urchin]

remember by your own admission youre doing extra lol

[acoustic sparrow]

ok got nowhere

[rustic sage]

Have any of you done Attacking Enterprise Network and tried cracking them all?

[fathom pendant]

The 3 weak passwords are the intended passwords to get

[thorn urchin]

side note but machine account hashes can also sometimes be better than user hashes 🙂

[rustic sage]

Or did you all just skip that lol

[thorn urchin]

I skipped

[fathom pendant]

And if you get the system account then gg ez

[naive wadi]

If you really want to try more hashcat -m <mode> /use/share/wordlist/*

[thorn urchin]

a machine account hash IS the system account effectively

[naive wadi]

Just throw all the wordkists at it

[rustic sage]

Will impacket-secretsdump also dump the machine account hashes?

[thorn urchin]

yes

[acoustic sparrow]

i need help at the password attacking module medium lab found a root password in a docx but i cant figure out where to use it i might need a nugget pls help me ❤️

[thorn urchin]

you dont need to know machine account hash stuff for CPTS though

[rustic sage]

"WEB-0008$:1599:???:???:::" these?

[thorn urchin]

ye

remember in active directory machines are users too

WEB-008$ is also a domain user

DC01$ is also a domain user 😉

Domain admin even

[fathom pendant]

I dont recall a root password in the docx

[rustic sage]

Ahh so I know you say it's not important for CPTS, but why is a machine hash more valuable then say the domain admins hashes?

[thorn urchin]

sometimes more valuable

I cant say much but I recently had a situation where I skipped some things because they didnt realize you could dump the dc machine hash

[acoustic sparrow]

in the zip is a docx

[thorn urchin]

so went from basic user to DA in one jump

[fathom pendant]

I said specifically root

[thorn urchin]

but the DC built in admin was disabled so the local user hash was worthless

cant disable the machine hash though

[rustic sage]

Okay I understand

[thorn urchin]

persistence too

[hallow kiln]

What else is there besides the password?

[fathom pendant]

Nah the point is its not root password unless htb changed it

[rustic sage]

Welp I finished... guess I should redo some of the AD stuff before the exam

[thorn urchin]

A company that gets compromised might have the forethought to reset everyones passwords, but if they didnt reset the machine account hashes, then having the machine account hashes is a backdoor for Compromised 2: Electric Boogaloo

[hallow kiln]

I mean the document says Root Password, so their question isn't incorrect, but it's still clear what it is

[hot heart]

how are you guys able to send screenshots and I am not?

[thorn urchin]

because we read #welcome

[fathom pendant]

Does it? I'll have to recheck my docx to see if it's different

[fathom pendant]

Unless I'm thinking different doc

[hallow kiln]

don't know if it's changed since you did it

[hot heart]

https://tenor.com/view/the-simpsons-homer-simpson-hiding-embarrassed-bush-gif-17685536

[rustic sage]

Thanks for explaining! So on the exam and in future tests if I can't crack the hashes either it's no big deal? I can say I was able to and since PtH exists I can just log in as anyone and demonstrate that?

[tranquil axle]

if you cant crack the hash then dont say you were able to

[thorn urchin]

yeah getting ntds.dit is GG for that domain

[fathom pendant]

Oh I ignored the root password is because the format it gave me

I just rechecked it

[hallow kiln]

yeah, same

[rustic sage]

So this DPAT just make the report look nicer

[hallow kiln]

it's just extra information you can deliver

[thorn urchin]

like that's it, youve won, take a victory lap. Unless theres further subnets/sibling domains/non-domain joined computers then youre king.

[thorn urchin]

yeah providing password analysis for the client

which they may not even request

[fathom pendant]

In report you can say "I was unsuccessful in cracking user passwords, however I did get several high level system accounts"

[rustic sage]

Okay!

Thanks for explaining everyone

I thought like you'd HAVE to crack more hashes and it was required..

[fathom pendant]

Nope

[rustic sage]

I don't have the money to afford a good cracking station yet😅

[fathom pendant]

You cracked the important ones

[thorn urchin]

in real life youd probably be working for a company that has their own 40k cracking rig

[fathom pendant]

^

[rustic sage]

must be nice..

[fathom pendant]

Export or do whatever SOP would be needed to crack it

[thorn urchin]

hand write a couple hashes down on paper so you can see if you get an instant win on a second engagement

(dont do this)

[thorn urchin]

also also even if they went through the herculean effort to stop PtH attacks, if you have the krbtgt account hash you can just forge kerberos tickets and use those instead for persistence

[rustic sage]

Now to learn double hop with ligolo-ng

(And then more Active Directory practice)

[hot heart]

https://tenor.com/view/leonardo-dicaprio-clapping-clap-applause-amazing-gif-16078907558888063471

niceeeeee

thats what I'm talking about

[hot heart]

Thanks

[fathom pendant]

Now get back to your module learning

https://tenor.com/view/get-back-to-work-gif-1126008344771276194

[thorn urchin]

congrats you finally did it

[hot heart]

HAHA

[hot heart]

[fathom pendant]

Reading is a tough skill

Critical thinking? Even harder

[hot heart]

Harder than hacking itself

[rustic sage]

Me expecting this double pivot to be a little complicated to understand on ligolo-ng and then this guy just does it with one listener 🫠

[fathom pendant]

Especially when you have your 2 braincells competing for 3rd place

[rustic sage]

this is sooo cool!

[hot heart]

I'm used to my two powerful hacks cntrl + c and cntrl + v

[thorn urchin]

easiest shit in the world. Second agent just connect to the server -> make sure you have a route for the new subnet added -> start and youre good to go.

If you dont have outbound then just listener_add to forward a port to your ligolo server and then connect the second agent to the opened port.

[fathom pendant]

That don't work in terminal and you get confused

[thorn urchin]

double pivoting is when I knew for sure that ligolo btfos other pivot methods

[hot heart]

I know 😭😭 TRUST ME I'VE TRIED

[thorn urchin]

ctrl+shift+C/V

[fathom pendant]

Yep

[hot heart]

This was what I was trying to show you guys earlier

Is this the new HTB theme?

[fathom pendant]

Oh, just refresh

This happens occasionally

[balmy pelican]

Hey I found the hash in the footprinting module Oracle TNS. I know it's not needed but just to practice I wanted to try and unhash the value but for some reason I can't figure it out.

This works

echo "stealth:d776dd32d662b8efbdf853837269bd725203c579" > crack.txt
john --single --format=raw-sha1 crack.txt

This doesn't

echo "DBSNMP:E066D214D5421CCC" > hash.txt
john --single --format=raw-sha1 hash.txt

[hot heart]

wow... I'm gettting off for the day

[fathom pendant]

Try not specifying the format

[hallow kiln]

hard to imagine using anything else, double, triple, quadruple pivots, you can stack them all day long

[fathom pendant]

Also adding a wordlist

[thorn urchin]

yup the first time you do it it youre like surely switching the session and starting it will kill the chain and ruin the pivot, because it would for literally any other tool. And instead its like magic and you teleported to the new subnet

[balmy pelican]

ok got it thanks

[rustic sage]

Anyone here good with evil-winrm? I sometimes start it within like /home/linty/project/random/here and when I try to do "upload /opt/toolname" it'll say it doesn't exist and I have to "upload ../../../../../opt/toolname" Is there any easy way to get around this? I guess I could just start evil-winrm in ~ or / but...

[hallow kiln]

it does feel like magic, glad I jumped on the ligolo-ng hype train when I did

[fathom pendant]

Because if you're incorrect on the format, John doesn't correct you

[solar willow]

for the file upload attacks skills assessment, is it possible to change the mime type to jpg (not content-type, but the actual file content through injecting magic bytes)

[thorn urchin]

evil-winrm works best when you specify full path name for both source and destination

[fathom pendant]

Start from /opt/toolname

[thorn urchin]

sometimes its just ass

[balmy pelican]

makes sense I just assumed the tutorial I read was giving me the right format

[thorn urchin]

but we dont have anything better

[fathom pendant]

But yeah

[hallow kiln]

I always just specify full paths, never had any issues

[fathom pendant]

No one has bothered to make a better tool

[thorn urchin]

anyone wants a security tool dev project: make a better version of evil-winrm

[hallow kiln]

what are ya'll waiting for, make one 😁

[fathom pendant]

Lazy

[hallow kiln]

skill issue for me

[thorn urchin]

I just might if I actually had the time

[rustic sage]

I do "upload /opt/toolname" but it says the path "/home/linty/htb/academy/attacking-enterprice-networks/opt/toolname" doesn't exist lol

[thorn urchin]

idk doesnt do that for me

[hallow kiln]

yeah, because it adds on to the path you're currently in

[fathom pendant]

It's dumb

[solar willow]

i've found the source code and everything, just having a hard time to bypass the type check specially mime type

[rustic sage]

Is there any way to fix that? or am I just going to have to remember to start in "/" or "~"?

[rustic sage]

😭

[hot heart]

Has anyone actually considered the job postings that HTB offers? How legitimate are they

[fathom pendant]

Just get good

Might do well to Uninstall and reinstall it

[rustic sage]

@thorn urchin can I dm you about ligolo since it really isn't module related😅

[thorn urchin]

You can but im at work so may slow to respond

[hallow kiln]

they should definitely add it to the modules

I even took the time to write a blog post about it (as if everyone isn't doing that already)

[balmy pelican]

does it take long to crack the password in footprinting module IPMI?

[thorn urchin]

Im sure itll be an update eventually

[thorn urchin]

pretty quickly

idr exactly how fast but negligible

aint waiting 10-15mins or anything like that

[balmy pelican]

ok

so I messed up somewhere

[fathom pendant]

What command are you using?

[balmy pelican]

I think I will try to figure it on my own rn

[elfin cedar]

man they really put you in the dark for this one. Chaining IDOR Vulnerabilities.

[fathom pendant]

K

[fathom pendant]

I mean you're creating a script based off of what you did manually

[elfin cedar]

Hi

[balmy pelican]

did it

[fathom pendant]

Nice

[elfin cedar]

The last script I wrote was a couple pages ago and it was for downloading contracts

I think I know what its asking

Its asking to find all the roles, so I can get the correct role for the "admin" right?

Then I would be able to find the uuid?

I am here: https://academy.hackthebox.com/module/134/section/1200

[fathom pendant]

I haven't done this module so I couldn't tell you exactly

[sly dome]

really simple with bash

for i in $(seq X Y); do curl ...; done

also you can grep and filter for the desired result

you can do it with Python and with Intruder if u like

[elfin cedar]

thank you, I think I found a way with intruder..

thats insane

[sly dome]

for this type of stuff i suggest bash scripting + curl

way easier and cleaner result to look at

also you can work with threads on bash using xargs

[woven copper]

Hi there, for GAME HACKING FUNDAMENTALS, skill assessment question 2, someone have a hint, i have identify two memory values related with the Score, All modifications make change back to original even if try change both. Any helps? thanks an advance

[tame ivy]

hello, in ffuf module there is question, i found all sub-domains, but what i need to type to this? there is 3 sub-domain, can anyone helo?

[sly dome]

only the subdomain

[tame ivy]

what does that mean? there is 3 sub-domains

[sly dome]

section?

[tame ivy]

Skills Assessment

[sly dome]

1 2 3

like that

[tame ivy]

oh ok, thanks

[sly dome]

any time

[umbral fulcrum]

thank U
the <from><to><here> hint did the trick
my location at the end of the URL was the problem
I must say that this assessment is nothing like the whole module...
thanx again

[tight mesa]

hey guys, under Initial Enumeration of the Domain from AD enum & attack module, you have only 3 host alive?, including the attack host..!!!

cuz the module says 9 including the host attack

[fathom pendant]

Pivoting

[solar willow]

I was stuck on upload attack skill assessment for 2 days and turns out the server date is different than my date🤣 such stupid mistake

[fathom pendant]

Mood

[sly dome]

?

what is your time zone? lol

yea in US its still October 11th

🤣 what a tragedy

[solar willow]

US. But the file name was always a day off

[sly dome]

not always

[solar willow]

Good lesson learned though. I'll always check server response time now

[sly dome]

yea

[rustic sage]

or just move to where the server is located 🙂

[umbral yacht]

I'm currently working on the Python3 module and I've been working on this question for an hour but still can't get the answer. If someone who has completed this module could help me that would be great 🙂

[fathom pendant]

Does the module/section not go over loops?

[umbral yacht]

This section doesn't go over loops but it briefly did in the previous section. I use the lines of code from within the module but I keep getting errors. Can coding in Python3 only be done in Terminal?

[fathom pendant]

No

You can use a text editor iirc parrot also has vscode installed with python modules to code with

[umbral yacht]

How do I open the text editor in parrot OS?

[sly dome]

nano from terminal

code from terminal

the best 2 for beginners

[supple torrent]

Hi - I'm doing the windows attack and defend module - I'm struggling to connect from the RDP using xfreerdp from parrot terminal error:[03:35:48:593] [3054:3055] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[03:35:48:593] [3054:3055] [ERROR][com.freerdp.core] - failed to connect to 172.16.18.25
Which VPN do I have to connect? inside the parrot terminal? or the ovpn file from the academy? your response is really appreciated . TIA

[fathom pendant]

Well I'm assuming they give you an attack host to first rdp into

[cedar void]

For the last question of the 'Live and Engagement' section for the 'Shells and Payload' module, if I am using msfconsole to execute the 'eternalblue' payload, do I set the 'RHOSTS' to the IP address of HOST 3 and isn't the LHOST the IP address that I 'xfreerdp' into? I tried establishing a session but failed .

https://academy.hackthebox.com/module/115/section/1139

[fathom pendant]

The academy one is correct, usually when you see a 172.16.x.x ip you're expected to first rdp into a jump host: then to the target

[fathom pendant]

Nope you had a similar issue with a different target if I recall, you need to use the ip that's on the same network

Same concept applies here

[supple torrent]

it says , you need to connect to the vpn, I am not sure if the .ovpn file from the academy or an ovpn file from the parrot terminal - but it appears no ovpn file from the VM

[cedar void]

Oh yeah you are right, so I need to change the localhost

[fathom pendant]

The pwnbox is natively connected, if you're referring to the in-browser vm

Step 1) use pwnbox or connect to vpn from your own virtual machine.
Step 2) connect to the spawned ip
Step 3) further connect to the internal target

[fathom pendant]

LHOST stands for listening host

L for listen R for receive

[elfin cedar]

wow that web attacks skill assessment beginning enumeration

nothing to do with the module

[hallow kiln]

not there yet, but it's fair game if it involves anything from previous modules, since they're meant to be done in order

[supple torrent]

04:42:54:793] [7411:7412] [WARN][com.freerdp.crypto] - Certificate verification failure 'self signed certificate (18)' at stack position 0
got a new error

[fathom pendant]

Thatd just a warning lol

Not a full error

[sly dome]

what enumeration? you do not use anything outside of the module for that assessment

it literally gives credentials for the application and from there you have everything you need

[elfin cedar]

but how was I supposed to find the hidden directory?

[sly dome]

you dont have to find any hidden directory

[sly dome]

the assessment goes over IDOR enum into Verb tampering for password change and one special user has an extra function which is vulnerable to XXE

just all of what module teaches but in a more “complex” environment

[elfin cedar]

yeah it was easy after getting to the special user

[sly dome]

see how you didnt need hard enumeration

[elfin cedar]

my burp suite didnt show any of the good stuff

[sly dome]

huh?

[elfin cedar]

it didnt even show "token" "uuid" things like that

but only for the skills assessment

[sly dome]

weird

[elfin cedar]

maybe I shouldve reset it

[sly dome]

just use curl + bash scripting as i told you esrlier

i changed all passwords with 1 click 🤣

[elfin cedar]

nice

[sly dome]

way better than burp for this type of stuff

[hidden spade]

In the Introduction to Bash Scripting Module
Chapter: Flow Control - Loops
Can anyone confirm that the task script is solvable?
Because im really stuck

[lusty thicket]

the task script is solvable

[hidden spade]

great ...

and the only thing i have to do, is encode the variable with a for loop and assign the length of that variable to the salt?

[sullen torrent]

ok but lets say i did on a "permitted" target and get these results, what do i do now? like why's there a bipolarity in the results?

[sly dome]

yez the number of characters of the 28th iteration

after the*

[sullen torrent]

also im doing this section:
https://academy.hackthebox.com/module/19/section/103
it says
"One disadvantage to Nmap's presented results is that the automatic scan can miss some information because sometimes Nmap does not know how to handle it. Let us look at an example of this."
they then basically try to show how nmap can sometimes overlook some information (like the service) but if we use netcat & tcpdump we can see that. (but they're onto nothing)

[sly dome]

check if its open

interact with the port

[vital adder]

everything shown in the nmap section is for local scanning only (not public stuff) and even if you have permission to, scanning the domain youtube.com doesn't point to a 1 single ip plus they probably have a shit ton of protection in place so just using a tools like nmap won't get you anything much

also your ISP isn't going to be happy that you scan some random public server without permission through their stuff

[sullen torrent]

so do you manually check each port seperately? i mean, the command i ran earlier nmap youtube.com -Pn --reason --top-ports=12 is legit but still i got a wrong answer.

[sullen torrent]

alright i got the part that i've to be in the legal bounds but all im asking is how is a here netcat (paired with tcpdump) said to be giving better scan than nmap while both gave literally the same output?

[autumn pilot]

From where are you scanning that target?

[sullen torrent]

from my college ethernet cable 💀

[hearty heath]

In the Attacking Common Services in Attacking SQL Databases, I can not connect to the MSSQL server at all.
These do not work:
sqsh -S 10.129.203.130 -U htbdbuser -P 'MSSQLAccess01!'
mysql -u htbdbuser -pMSSQLAccess01! -h 10.129.203.130
This does work but I don't need it:
mssqlclient.py -p 1433 htbdbuser@10.129.203.130

Furthermore in the Attacking FTP, I have scanned all TCP and UDP ports and there is no FTP port open. I think that one is broken

[tidal kelp]

I just did that one, don't use 'sqsh'. use mssqlclient.py

also the box seems a bit unstable, had to respawn it a couple of times

[hearty heath]

Oh ok

Thanks

[hearty heath]

I am very lost in the Attacking SQL Databases section.
I have checked:
-No linked MSSQL servers found
-No users that I can impersonate
-Don't have permission to xp_cmdshell

[fathom pendant]

Attacking common services yeah?

[hearty heath]

Yeah, now that I looked again, I think I know

[fathom pendant]

Have you tried stealing something

[hearty heath]

It is always like that, as soon I ask for help then I realize what i missed

Thanks though

[fathom pendant]

(Also to save time add -windows-auth

😉

[hearty heath]

Aha ok, thank you

[fathom pendant]

I take it you answered the first question or no?

[hearty heath]

No

[fathom pendant]

Ah ok

Well good luck you'll be on the right track soon

[hearty heath]

Thanks again 😄

[fathom pendant]

Yeah that's my only gripe about this section us that you don't really explore too many of the other options

They come in handy in the skill assessment so be ready for that

[quaint hemlock]

In the Password Attacks - Attacking Sam

I am able to save the hklm* file, but when I try to move it it says 'access denied' and I'm already run as administrator, is there anything I did wrong?

[hidden spade]

INTRODUCTION TO BASH SCRIPTING | Flow Control - Loops
im lost and appreciate help
im pretty sure i did what was asked, but i get an error
||bad decrypt
140488265971008:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:../crypto/evp/evp_enc.c:612:||

[lusty thicket]

i don't think thats what the question was asking to do

[quaint hemlock]

"Apply the concepts taught in this section to obtain the password to the ITbackdoor user account on the target. Submit the clear-text password as the answer." this is the question I was working on, am I using the wrong method?

[lusty thicket]

iirc there are other concepts taught in that section

and you were provided valid credentials

😉

[quaint hemlock]

alr thx

[umbral fulcrum]

Hi guy, can someone help me please in "Skills Assessment - File Upload Attacks"

I got most of the puzzle but I can't get it together...

• found the black & white list
• got the Content-Type
  but I can't get it 2 work...

[gusty ivy]

Hi, Is it possible to run responder to capture hashes through proxychains on my Kali machine?I can’t see my target’s duel NICs, and I cannot run as root on my target to run responder. It sounds dumb but I thought I’d ask

[past compass]

Question on academy labs. Is there a problem with my VPN connection or are some labs intended to be done solely via pwnbox? I had issues receiving output (other than host online) in the nmap labs last night.

No issues via pwnbox, to be clear.

[cedar void]

Does what is underly imply that I this facebook exploit can be used in 'msfconsole'?

[fathom pendant]

Yes and remove the image as it's spoiler

You could have blocked out the name and everything, because this is part of the skill assessment

[fiery berry]

responder works on layer 2 of the OSI stack, in case you land on a Windows machine you can use Inveigh

[thorn ingot]

Module: Broken Authentication
Section: Brute Forcing Cookies
Question: Tamper the session cookie for the application at subdirectory /question1/ to give yourself access as a super user. What is the flag?

||I changed the user role to super like this user:htbuser;role:super;time:1697111842 but I'm not getting any results||

[tame ivy]

hello everyone, in Hydra module, Skills Assessment - Website, im trying to attack with hydra but it just sends me a first password in my wordlist, it is because of wrong Failed statement flag, but how to fix this? i have done same thing on other sections and it worked, but there this is not working.
hydra -l admin -P /usr/share/wordlists/rockyou.txt -f 94.237.62.195 -s 38287 http-post-form "/admin_login.php:user=^USER^&pass=^PASS^:F=<form name='login'"
can anyone help please?

[rustic sage]

|| are you sure admin is the right username? ||

[rustic sage]

i’ve done every lab on my own VM (via VPN). what are you having issues with?

[tame ivy]

well maybe it is not admin, but my output like this:

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-10-12 15:20:35
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-post-form://94.237.62.195:38287/admin_login.php:user=^USER^&pass=^PASS^:F=<form name='login'
[38287][http-post-form] host: 94.237.62.195 login: admin password: 123456
[STATUS] attack finished for 94.237.62.195 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-10-12 15:20:36

its says that it found a password for admin username

[rustic sage]

i'd have to look at the lab again to verify but...
|| 1) don't just assume the user as admin, this isn't very stealthy either. Find the right user, use the hint if necessary ||
|| 2) i don't believe the login form uses user and pass which may be another issue. in other words hydra is injecting into a field that isn't there||
|| 3) verify <form name='login' is actually on the web page and won't be on the authenticated user dashboard either ||
|| my guess is it's not working because of point two. you're injecting into nothing and maybe you're being redirected to another page that <form name-'login' isn't actually on, hence hydra thinks it works ||

haven't done it yet sorry @thorn ingot 🫤

[thorn ingot]

no worries

[rustic sage]

check and see if there is a way to verify that you're actually a super user

[tame ivy]

hmm okay i will check it again, but point 2 is really like this, this from burp:user=test&pass=test, but thank you ❤️

[rustic sage]

i'll launch up the lab right now and double check

[tame ivy]

ok, thank you very much

[rustic sage]

nvm stupid question lol let me bypass the first part first

[acoustic sparrow]

hey still struggeling at the password attacking module medium lab found a root password in a docx but i cant figure out where to use it i might need a nugget pls help me pls ❤️

the docx talks about build your own inlane installation

[lusty thicket]

||there is a local sql database running on that host||

[rustic sage]

read the .docx carefully it hints at something

[acoustic sparrow]

but there fore i need access to a machine via ssh right?

[primal eagle]

https://academy.hackthebox.com/module/147/section/1657
The 'extract keytab' section has a different font 😛

[fathom pendant]

Then it's convenient you're given a username:password

[rustic sage]

if your reporting an issue go to #858470491676737536

[lusty thicket]

don't you already have access?

[acoustic sparrow]

via smb yeh

[fathom pendant]

No they just have smb

[tame ivy]

first part is ||login:user pass:password ||

[lusty thicket]

and he got a ||user|| and ||pass|| from there

[fathom pendant]

He hasn't realized that part and is only focused that the line in the doc says "root password is"

[acoustic sparrow]

but it doesnt work for ssh

[fathom pendant]

It should

[lusty thicket]

you need ti

[fathom pendant]

Hint: the user isn't root

[lusty thicket]

[acoustic sparrow]

user J and D let me check on that again sry for bothering you guys

[lusty thicket]

now you have all the information you need to get the flag

👍

[fathom pendant]

I mean the line that gives you the password tells you which user

Remember the format username:password

[rustic sage]

okay i see what burp is doing now, || you want to follow what the HTML is doing / what the login form says, not the parameters being passed ||, so you need to || 1) use the correct user, 2) use the correct fields (switch to username and password) and finally reread the source code, because it's not <form name='login'||

[acoustic sparrow]

oh damn i might just checked for the D user

[fathom pendant]

Me staring at the doc

[fathom pendant]

Take one quick step back: look at what it's given you

And thats literally all you needed this whole time to get in

Like I said it very much tells you which user the password is for

[acoustic sparrow]

yes is see thank you very much Sir im now logged into ssh

[tame ivy]

oh yeah, form name was incorrect, thanks for ur help

[fathom pendant]

Now just poke around and you'll get there

[stone prism]

How many disks exist in our Pwnbox? (Format: 0) i cant solve this for the life of me i tried lsblk, sudo fdisk - l both while disconnected from the ssh server

it's from the linux fundamentals

[lusty thicket]

lsblk -d

[stone prism]

i still dont get it, how do i type the answer. idk what's a format 0

[lusty thicket]

with the specified format

[fathom pendant]

The specified format is a number

[stone prism]

sorry i still dont get it, i put the command and it listed 2 disc but the answer isnt 2

[fathom pendant]

02

Try leading zero

[stone prism]

nah it isnt 02

this is what i got

[lusty thicket]

try 3

[rustic sage]

is it from Linux Fundamentals - File System Management?

[stone prism]

yes

[rustic sage]

did they update this section🧐

[stone prism]

i have no clue

[stone prism]

this is the question

[rustic sage]

i know the question lol, but my answer doesn't work with the current environment anymore

and i know "how" i got my answer and it wasn't from listing how many disks exist

so i'm wondering if the question itself changed

[stone prism]

lol i still dont understand what they're looking for

the listed disk is less than 10 i believe

[rustic sage]

you want to dm and we can try working it out without spoiling?

[stone prism]

yes please this is the one thing im so stumped at and the internet doesnt help

i tried so many list disk commands

maybe the module is screwed?

[sly dome]

the question used to be tje space

of the disk

my answer is 100

[rustic sage]

yeah i went through a few things with them and none of the numbers worked lol

mine was 160

the current space is 50 and that also doesn't work

[sly dome]

and they changed to 50Gb

try 0?

[stone prism]

nope doesnt work

[sly dome]

from 1 to 10 ? brute force

try also the old answer, 50 or 100

[stone prism]

i already did lmao

[rustic sage]

they did lol

[stone prism]

aah i already did that too

[sly dome]

yea its broken

#858470491676737536

[stone prism]

wow i should get my money back

[sly dome]

unlucky

[rustic sage]

i would report in #858470491676737536 and probably use the support button on the website

[stone prism]

oh yeah

the cargo website seems to be dead, i had to get my answer off the internet for that part

[tame ivy]

guys in hydra module, in Skills Assessment - Service, i have done everything(trying to brute-force ssh) and it brute-forcing at least a 30 min already, i dont think that must take so long

[sly dome]

try harder

you should not have more than 3000-4000 passwords and less than 10 users

then use -u flag for hydra to loop over users not passwords

[rustic sage]

it tells you what user to use doesn't it?

or is this the one you have to generate your own username list

[sly dome]

own username list

[tame ivy]

there is user, i generated with username-anarchy, and password list with cupp, sed it to password policy, then started a brute force,

[sly dome]

-u flag

and dont use too much information with cupp just the basic

[tame ivy]

well without -u flag this wont work? bcs i think hydra will try all users and all passwords too

[sly dome]

it will work

[stone prism]

damn linux has so much to remember but i think the --help will make things easier lol

[sly dome]

it will just take way longer

[rustic sage]

" As you now have the name of an employee from the previous skills assessment question, try to gather basic information about them, and generate a custom password wordlist that meets the password policy."

hint: || you don't need to provide all the information cupp wants you to give it just use what was given ||

[tame ivy]

understood, i didnt knew it
thank you ❤️

[tame ivy]

yeah i did it already, thank u2

[opal dagger]

hello there, can i ask for a bit of help, i'm doint the footprinting module and now i'm in the DNS section, but the last question asking for the FQDN of the IP that ends in 203 have me stuck, im been digging for the last 2 days all the subdomains in the normal zone and in the transfered zone for the last 2 days like an exemplar dwarf, i also try the route of brute forcing with dnsrecon and dnsenum but nothing, the only think i found is one subdomain that ends in 200 after one zone transfer

[lusty thicket]

maybe you aren't using the right wordlist

😉

[fathom pendant]

Subdomains of Subdomains

[lusty thicket]

😉

[acoustic owl]

Remember that not every zone allows a zone transfer from everyone.

[fathom pendant]

Aka this question has been asked so many times

[acoustic owl]

Someday I'll write a DNS module lol

[fathom pendant]

Write one that uses ips in the example and not just name server fqdn

[opal dagger]

that means i need to mask the request some how?
i already try to zone transfer to subdomains of subdomais but all i get is transfer failed

[lusty thicket]

you're on the right track with dnsenum

[acoustic owl]

No, if a zonetransfer is not allowed, then you have to query the zone manually. You can use automated tools for this.

[opal dagger]

ok it looks like i will need to try each list in seclist

[fathom pendant]

Start small go big

To save headache

[lusty thicket]

@opal dagger you should also follow this hint

😉

[fathom pendant]

You can use dnsenum with the same syntax just change it to {subdomain}.inlanefreight.htb

[rustic sage]

honestly doing Hacking WordPress, my new pet peeve is people doing curl -X GET ...

[warm kernel]

https://enterprise.hackthebox.com/storage/modules/80/scripts/timing_py.txt does this link work for anyone? It simply redirects me to the dashboard

[hallow kiln]

That's an enterprise link, so not very likely someone here can confirm either way

[warm kernel]

damn it, I can't progress without having their resources...

[novel matrix]

As arthos said, it’s EP so no user will see unless given reasons

[warm kernel]

yeah I get it, just sucks I can't progress because of their site isn't working as intended - Ill use another method, but my intention was to use their stuff instead of mine

[tame ivy]

hi there, doing a SQLMap module, Attack Tuning Section, dumped a database with sqlmap, and found a flag, but flag is incomplete, can someone help?

||Database: testdb
Table: flag5
[1 entry]
+----+-------------------------+
| id | content |
+----+-------------------------+
| 1 | HTB{700_much_r15k_bu7_x |
+----+-------------------------+
||

[warm kernel]

is this using blind sql?

[tame ivy]

well i think that is not, its "OR" statement, ||sqlmap -u http://94.237.56.76:30080/case5.php?id=1 --dump --dbs -T flag5 --level 5 --risk 3 || here what i used

[polar skiff]

information gathring / vhosts ... its says look for a flag but im suposed to curl the results of the fuzz ? and look all of the line?

[lusty thicket]

using ffuf

[polar skiff]

yes but when i curl the resault i fund nothing

[orchid pine]

on active dir skill assessement part 1

i cannot connect to the remot host

[polar skiff]

i got 6 vhosts

[warm kernel]

I remember those cases being extremely unreliable and needing to run the attacks a few times to get the proper flag

iirc my fourth attempt printed the proper flag

despite running the same command

[polar skiff]

lul im just d** i was doing the curl wrong

[rustic sage]

it's possible the user doesn't have rdp/winrm access, double check the lab is still up or trying running commands as them in a powershell window

[rustic sage]

although it's not the complete flag, you should remove it.

read the hint @tame ivy might help

[orchid pine]

im trying to check if i have adrp or remote mangement

bu i have no results with my cmnd

Get-NetLocalGroupMember -ComputerName MS01 -GroupName "Remote Desktop Users"

no results

[tame ivy]

oh it worked, thanks

[tame ivy]

thank you2

[granite shuttle]

Module Name: Login Brute Forcing
Section: Service Authentication Brute Forcing
Module ID?: module/57/section/491
VPN: EU Academy 1

Task Precursor text:
SSH to 94.237.53.115 with user "b.gates" and password ""

The task is to brute force the password of the user b.gates, but it doesn't look like the SSH allows for password authentication at all?

[DATA] attacking ssh://94.237.53.115:22/
[ERROR] target ssh://94.237.53.115:22/ does not support password authentication (method reply 4).

Either I'm missing something, or it's configured incorrectly right now?

[rustic sage]

you could try restarting the box, i think you also need to lower your thread count - try -t 4
hard to say without knowing what you're executing

if the above doesn't work, let me know and i'll redo the lab for you

[granite shuttle]

I've tried resetting the box a couple times to no avail. Just tried swapping VPNs as well in case there are different labs on each one, but that didn't help. o.o

Here's what I'm executing and my result:

> hydra -l b.gates -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-10.txt -u -f -t 4 ssh://94.237.53.115
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-10-12 11:52:24
[DATA] max 4 tasks per 1 server, overall 4 tasks, 92 login tries (l:1/p:92), ~23 tries per task
[DATA] attacking ssh://94.237.53.115:22/
[ERROR] target ssh://94.237.53.115:22/ does not support password authentication (method reply 4).

[rustic sage]

let me redo this section and get back to you 🙂

[granite shuttle]

Thank you! 😄

[tame stump]

Hi Jeremys556, I'm having some trouble regarding the ||SNMP, which is v3 for me, so it requires authentication afaik.||
How did you manage?

[fathom pendant]

Running the snmp tools worked fine for me

[granite shuttle]

Oh. Uh.. It was a fairly rookie mistake. x) It was because the port needed to be the box port rather than 22.

[tame stump]

If I run v 2 it doesn't respond, while on v3 it requires auth, what am I missing?

[granite shuttle]

So problem solved! I should've checked that first. But I really appreciate trying to help. 😄
The correct command would be:

hydra -l b.gates -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-10.txt -u -f -t 4 ssh://94.237.53.115:50341

Or whatever port the box is generated with.

[rustic sage]

that was the first thing i noticed, but i was waiting for my hydra scan to complete lol
secondly, || you might want to use cupp -i and use that wordlist ||

[fathom pendant]

Think about all the tools taught in the snmp section

[granite shuttle]

Okay ^,^ Thank you!

[rustic sage]

just follow how the module creates the password list and you should be golden

[tame stump]

Oh I see, I didn't think about one I could've tried without creds.
Thanks for helping me through 🙂
Hopefully, it's gonna work.

[opal dagger]

thanks to everyone for the help in the DNS question i finally got the FQDN, now just a simple DNS theory question, when you create a domain entry in a zone is the reverse dns created automatically or you can have domains that wont reply to a reverse dns query because the record was not created?

[tame stump]

Nevermind, nothing worked.

[rustic sage]

creating an entry in a zone does not automatically create a reverse dns entry

[tame stump]

Sorry to bother you again, but I don't see a solution here.
||- smnpbulkwalk needs authentication.

• I have tried onesixtyone with several community strings, plus the default wordlists and a custom wordlist but nothing hits.
• Gave braa a go with some common community strings and again no hits.||

[lusty thicket]

have you tried ||bruteforcing community srings||?

[tame stump]

yeah, that's what ||onesixtyone is for. Default lists don't hit, nor did my custom one (using hostname + 3 digits)||

[lusty thicket]

then you're doing something wrong iirc ||onesixtyone should output the right community string||

[tame stump]

Guess I'll reset the instance then, maybe something broke

[lusty thicket]

follow the exact syntax for ||onesixtyone|| used in the module

[tame stump]

Syntax was just fine, instance was not.
Resetting worked. FML.

[orchid pine]

is there a way to know the ip adresse of this instance ComputerName : SQL01.inlanefreight.local
Instance : SQL01.inlanefreight.local,1433
DomainAccountSid : 150000052100015021581135153197131788620723312701800
DomainAccount : svc_sql
DomainAccountCn : svc_sql
Service : MSSQLSvc
Spn : MSSQLSvc/SQL01.inlanefreight.local:1433
LastLogon : 4/11/2022 7:51 PM
Description :

[fathom pendant]

Well if you're on the computer: ipconfig

[orchid pine]

ano ther instance runing on the network

[tame ivy]

hello guys, in XSS module, Phishing Section, this js code is not working for me, it is not deleting a urlform,
document.getElementById('urlform').remove();
i tried a lot of times, document.write func is working, but not this

[orchid pine]

not the same computer

[rustic sage]

try using crackmapexec, crackmapexec smb 172.16.8.0/23

i don't know the ip range being used on that box though

[orchid pine]

i dont know hat to do anymore to connect SQL01.inlanefreight.local itried evrything i know so far

[rustic sage]

what happened when you did crackmapexec on the internal ip range?

[rustic sage]

did you name the file correctly, do you have the right contents, did you enter your IP correctly, did you access the share you put the malicious scf file in to trigger it?

you have to give more than, "it didn't work"

[orchid pine]

found 3 hosts

tried to look for which host have 1433 port open

but nop one has

[rustic sage]

if you run crackmapexec it should be able to identify SQL01.inlanefreight.local assuming it's on the same network

[iron hazel]

I have a question about the AD module DCSync. I have DCSynced the DC, however in the result I don't see the user that can rm into DC. Is it possible to perform DCSync and have some users missing?

[orchid pine]

use grep

[rustic sage]

assuming that the right ip/network then sql01 doesn't exist on that network. check the other hostnames there and see if they have an sql server or maybe the sql server is on a different subnet

i'm also not aware of what module and section you're on so it's possible you need to restart and wait like ten minutes for the lab to fully boot up

[orchid pine]

active dirctory

enum&attack

[orchid pine]

ComputerName : SQL01.inlanefreight.local
Instance : SQL01.inlanefreight.local,1433
DomainAccountSid : 150000052100015021581135153197131788620723312701800
DomainAccount : svc_sql
DomainAccountCn : svc_sql
Service : MSSQLSvc
Spn : MSSQLSvc/SQL01.inlanefreight.local:1433
LastLogon : 4/11/2022 7:51 PM

[iron hazel]

Thanks for the reply I did use grep. I am able to complete the questions, it is just that I am playing around and in the bloodhound I see a user called BDAVIS that have rights to rm into DC and I grep the DCSync result and can't find his hash.

So I am just wondering, when we perform DCSync are we dumping everything or is it possible for some user to not be on that DC.

[iron hazel]

does nslookup work?

[orchid pine]

for anyone who did the AD Enumeration & Attacks - Skills Assessment Part I i need his help

[thorn urchin]

what portion are you stuck on

[orchid pine]

i have the user and the password

for sql01

[thorn urchin]

okay

[orchid pine]

right

so i tried to connect to ms01 using those cred enter ps session

it didnt work

[thorn urchin]

yeah

use em on sql01

[orchid pine]

tried to acces to instance sql01.inlanefreight.local

it didnt work

[thorn urchin]

explain didnt work

cause it does work

[orchid pine]

wait ill send the screen shot

i tried to use this Get-SQLQuery to quesry the data base

[thorn urchin]

why

use a mssql client

[rustic sage]

you should remove that it leaks credentials

[orchid pine]

oh im sorry

so sorry

[rustic sage]

whenever you obtain credentials, you can use crackmapexec to see if they work anywhere else

[thorn urchin]

with this situation theres no need to check anywhere else

they have sql01 creds, they need to use em on sql01

[rustic sage]

there is no sql01 lol

[thorn urchin]

Yes there is

[orchid pine]

i can see the instance of sql01

[thorn urchin]

wait is this assessment 1 or 2

[rustic sage]

in my notes i don't think i ever access SQL01

unless i'm missing a portion...

[rustic sage]

it's one

[thorn urchin]

oh, nvm I actually dont have any notes on that one

are you following the questions? They hint at what to do next

[rustic sage]

it never asks you to connect to SQL01 it just asks to kerberoast that user, which you did

[rustic sage]

do this

[orchid pine]

ok ill try

[rustic sage]

they work somewhere else and then you can a technique you learned in an earlier module to escalate privileges

[thorn urchin]

which box are you doing this from

[orchid pine]

this is my attack box

[thorn urchin]

ah gotcha

[orchid pine]

i got a reverse shell to my machine

cuz that web shell unstable

now i need to pivot

to try crackmap

[thorn urchin]

So yeah. you're at the question where it asks you to get the flag on ms01 desktop

[orchid pine]

yes yes

[thorn urchin]

welp, then thats what you need to go after

[rustic sage]

no need for SQL01😛

[thorn urchin]

good opportunity to learn ligolo 😉 😉 shill shill

[thorn urchin]

yup I had it in my head that it was assessment 2 lol

[rustic sage]

ligolo😍

my new favorite word

[orchid pine]

alraedy now i can ping

trying crackmap

[rustic sage]

if you need help feel free to dm

[orchid pine]

thank you

[orchid pine]

is there any option on crack map to try the cred on all the prtocols and return the working ones

[rustic sage]

|| crackmapexec smb 172.16.6.0/24 -u user -p password ||

i'm debating right now do i want to unlock crackmapexec or bloodhound first🧐

[orchid pine]

XDDDDDDDDDD

u know what guys i need to take a break now and stsrt tomorrow cux my brain is klinda fkd up XD and im not thinking prperly

missing alot of things

thank you for evry one who helped me guys

i agree but like blodd hound is o useful

like there is a lot of things to learn about

blood hound

[thorn urchin]

I like bloodhound a lot but people over rely on it too

[iron hazel]

Guys I am curious...I performed a DCSync and in the result I find some users missing. In bloodhound I see a user BDAVIS that can winrm to DC, same domian, but in the DCSync result I don't see that BDAVIS user. Is it possible to have a user, but not show up in a DCSync?

[rustic sage]

if that's the user you're looking for, use impacket and only dump the hash for that user || -just-dc-user ||

[thorn urchin]

could be a removed user, could be you just missed the hash

[rustic sage]

in the future it's helpful to just say the name of the module and section... no one memorizes it by the number.

did you use the correct hashcat mode?

[thorn urchin]

youre last screenshot literally has the cracked password in it

btw remove cause spoilers

[rustic sage]

hello guys I want a training vm for account takeover and I'm absolute beginner and need an instructor

[dusk torrent]

ok deleted

[thorn urchin]

not only does your request make no sense, but this isnt the server to ask things like that

[dusk torrent]

mb i assumed a link would be easier. hashcat doesn't work. i looked it up and it's an error relating to POCL

[rustic sage]

so where should I ask my question?

[thorn urchin]

idk and idc

this channel is for module discussion only

read #rules and #welcome

[thorn urchin]

you already found the answer though

are you trying to make it work with hashcat for the sake of doing it with hashcat?

[main spear]

Hello guys, im doing the live assesment of the module "Shells & Payloads". When i RDP to the initial foothold machine, i can login to it but i dont have any browser it is normal ?

[dusk torrent]

no it turns out im just blind im sorry

[thorn urchin]

np happens

[rustic sage]

there is a module called account takeover. I can't access It because of lack of cube so I decided to get help from somebody and give a good instruction, If you don't know then at least give me some other hacking community like IRC servers or discord servers. thx by the way

[thorn urchin]

if you cant afford the module then tough luck

read #rules and #welcome like I said

[rustic sage]

i exclusively use hashcat and i believe that section even taught you to use hashcat so it does work😅

[thorn urchin]

john will occasionally have better hash support than hashcat

very rarely though

[dusk torrent]

sorry i didnt mean hashcat doesnt work. i meant it doesnt work on my pwnbox. i followed the error i got and it seemed others had the same issue https://github.com/hashcat/hashcat/issues/2689

[last quarry]

Am I the only one to have problem with rdp ?

Like I have my RDP for 3 minutes and dead

I need to relunch my vpn connexion each time

It's seems to be resolved by redownload vpn file

I'm on buffer overflow actually

I'll tell you in few minutes if it's a "fix"

Active ?

Only one

It's seems to be ok, I deleted all my config files and take a new one, and it's like 5 minutes that I haven't problems

Perhaps, nevermind thanks for your answer 🙂

[ornate lava]

Hello! I'm having trouble with completing the second question to the session security skills assessment. After downloading the .pcap file from the browser, I'm unable to open the file in Wireshark. Is this normal?

[undone narwhal]

# Module: Password Attacks
# Section: Password Attacks Lab - Medium

I solved the lab. I had to use a hint for the root part. But how can one leap from a history to the answer? Can anybody explain?

Edit: If this is too much information or violates any rules, please ping me to have it removed.

If anyone is seeking an explanation, here’s how you might have PrivEscd from user D to root. This might not be entirely accurate, so feel free to correct me. This is simply my understanding of the process.

||You’ve likely attempted to SSH as root, so you’re aware that a private key is required. You’ve found user D and successfully SSHed as D using the credentials. However, you’ve also discovered an encrypted private key. While it’s common to find encrypted keys, you don’t need a private key to log in as user D. So, why encrypt an SSH key?

You might think to use the passphrase from the encrypted key to switch user (su) to root, but that doesn’t work. So, what’s next? You need a private key to log in as root and you have an encrypted private key for user D.

At this point, it’s not commonly known (at least I don’t know) that you can use the same pair of keys with different users. Therefore, it might not occur to you to use user D’s private key with root. However, that’s the solution in this case.||

[thorn urchin]

No matter what kind of credential it is, always consider reuse

[orchid pine]

guys power dont need high privi right

[thorn urchin]

whose power

[orchid pine]

powerview

[undone narwhal]

||Yes, but isn’t it a bit weird? We already have a password for the user. Why would anyone want to crack the private key? There’s no point, right? The only reason I cracked it in the first place was just to see what passphrase they used.||

[orchid pine]

trying to identify the goups of the current member

[thorn urchin]

I dont have notes on that assessment so I cant speak too much to the specific scenario, but remember users can always have multiple passwords and may even share passwords amongst each other. Expanding your range of acquired credentials is never a wrong move

[undone narwhal]

Yup, that is the first thing I usually try, but here the privesc came out of the syllabus. Anyways, thanks for the explanation.

[orchid pine]

guys someone know why the eroor appaering

[orchid pine]

btw i have admin rights on the machinelocaly

[thorn urchin]

sounds like a double hop problem

https://neutronsec.com/active_directory/stacking_the_deck/kerberos_double_hop/

[orchid pine]

why its a double probleme cred

im giving my creds

[thorn urchin]

idk man Im not psychic sitting next to your computer

[orchid pine]

trying to excute cmnd on the same machine

[thorn urchin]

just saying the error lines up with a double hop fault

[orchid pine]

i see

[thorn urchin]

the link I sent explains it and tells you how to fix it

read it and see if its applicable

[orchid pine]

thx tho

[thorn urchin]

usually my preferred workflow dodges the double hop problem altogether so I dont think about it too much

[orchid pine]

yes its a double hop

i had bad understanding of it

[orchid pine]

how XD

[thorn urchin]

I prefer impacket and linux based tools over powershell/running commands on the host as much as possible

sometimes I cant avoid it, but oh well

[hot heart]

Good evening mates, how yall been

Does anyone else feel like the material covered on HTB make college related classes feel almost outdated?

I've noticed the material covered in class doesn't come anywhere near as in depth or as complex as the material covered in HTB. Not to mention one 3 hour session only covers about 10% of can be learned in a 3 hour session on HTB

[thorn urchin]

college classes are notoriously outdated against pretty much any training platform in this industry

the whole meme is Masters in cybersecurity that doesnt know what nmap is

(because it happens)

[orchid pine]

true

[tame ivy]

hello there, im trying to connect a windows machine with xfreerdp, but there is a error, do anyone know a solution?
[01:49:29:981] [862578:862579] [WARN][com.freerdp.core.nla] - SPNEGO received NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] from server
[01:49:29:981] [862578:862579] [ERROR][com.freerdp.core] - nla_recv_pdu:freerdp_set_last_error_ex ERRCONNECT_LOGON_FAILURE [0x00020014]
[01:49:29:981] [862578:862579] [ERROR][com.freerdp.core.rdp] - rdp_recv_callback: CONNECTION_STATE_NLA - nla_recv_pdu() fail
[01:49:29:981] [862578:862579] [ERROR][com.freerdp.core.transport] - transport_check_fds: transport->ReceiveCallback() - -1

[orchid pine]

cyber security is all about lraning by your self

btw anyone know why i cannot get a tgt with the user i want to try analyze with blood hound but kind not working

[thorn urchin]

login failure. Your creds are no good