modules

[sly dome]

if you ask the question itself instead of asking to ask, we all would save time

[tribal wadi]

ive been stuck in this lab for days ... i finished all the module section expect this one and ive been writing the correct commands and saw some video but didn't solve it till now .... can anyone help

[tribal wadi]

[sly dome]

no information provided to help.

logrotate is a race condition abuse, dont try to establish a reverse shell

the attack is pretty straightforward if the system is vulnerable

[tribal wadi]

idk in the module was explained as making reverse shell and yt videos ..

[sly dome]

it can work but i would just make the bash have SUID

[tribal wadi]

ohhh okay ...

[next bronze]

yeah for that module, if you want to get a shell, it dies really fast for you to get the flag, setting SUID bash would be much easier

[fading oracle]

Hey Guys!

I am back with the same problem again

Now Attacking splunk module. Upload doesnt work

tried multiple browsers

even multiple internet connections too

[next bronze]

oh no

if I remember right, you need the exact directory structure as the example, and I think there are some specific thing you need to do, can't remember what exactly

[fading oracle]

i think i have it

[next bronze]

you sure uploading is the problem?

[fading oracle]

2 modules ago

attacking Jenkins

[next bronze]

right

hmm, try using pwnbox to make sure?

[fading oracle]

it has a built in Script console
in firefox when i paste the commands which result as a rev shell it actually never went thru.. i opened up chromium and worked instantly
i just dont understand

its odd because it is only happens in HTB Academy

[next bronze]

there's no proxy in the way?

[fading oracle]

nope

[next bronze]

I'd say try this just to make sure

[dreamy solar]

I look agains I don't see a passwd

[sly dome]

what

https://academy.hackthebox.com/module/143/section/1457

look with open eyes

[fading oracle]

https://i.imgur.com/lJs4IRU.png

even the pwnbox is broken

lol

[next bronze]

not sure what can be done about that lol

[fading oracle]

with the pwnbox it worked

so its my PC or internet

but idk what the fuck

[next bronze]

reset everything, get a new vpn file, create a new network adapter, update, reinstall firefox

[fading oracle]

now its too fast:DDD

[supple sparrow]

stuck at Q2 of Documentation and Reporting Lab, the krbtgt hash dumped from DC doesn't seem to be accepted

[next bronze]

did it work?

[fading oracle]

i continued

but resetted everything

i hope it never comesback again

[gray merlin]

Just wanted to let you know that I did the same. I just spent the past few minutes trying to find what wordlist I should have used. lol

[fathom pendant]

Meanwhile the txt file on the desktop

[gray merlin]

I feel so dumb. I was just excited to get started. 🤦‍♂️

[tulip mortar]

LOL, I closed my workstation on the second module... only to find that it's one workstation per day. Don't feel dumb.

[fathom pendant]

Just use a vm

[plush drum]

Do I need linux for hackthebox or is mac fine?

[tulip mortar]

https://tenor.com/view/how-is-that-possible-laura-bruh-how-did-it-happen-how-is-that-true-gif-25016807

[spring viper]

you can use the hackthebox provided VM or use your own

definitely dont hack off your base machine

[fathom pendant]

If you use a vm there are no time restrictions

[tulip mortar]

Is the HTB VM unique for each module / section? Or just on the site somewhere?

https://academy.hackthebox.com/module/15/section/453

Makes it sound like each section has a unique VM, but I think I'm being dense right now...

[fathom pendant]

each section is technically unique, as in nothing is really stored; however as stated multiple times by many people; you really should only be using the pwnbox (in-browser) vm if you have no other options

most modern(ish) computers can handle running vms

Most popular software being VirtualBox and VMware Fusion (for Windows Hosts) and Parallels for Mac M1/2 chips

[tulip mortar]

So I am being dense. I need to set up a VM, slap an OS on it, then navigate to the IP / port it provided in a browser.

I can do that, LOL

[fathom pendant]

if you're given an IP:port it's most likely a public IP that doesn't require vpn access

[rustic sage]

hello

[supple ingot]

hello, im currently doing the basic toolset module "network enumeration with nmap" and its explaining how you can use both icmp echo packets and arp packets to ping hosts to see if they're alive or not. but i dont understand the difference between arp and icmp echo packets?

[plush urchin]

how can i access the internet from the browser on the instance. i cant access website from there

[gray merlin]

You can read about ARP here: https://en.wikipedia.org/wiki/Address_Resolution_Protocol

[rustic sage]

Hi! Does anyone know if HTB is offering any cyber monday deals for the CPTS / Penetration Testing Certification bundle?
Thank you for any advice or info in advance. 🙂

[fathom pendant]

That would be the silver annual subscription

[rustic sage]

yes, just wondering in reguards to black friday, cybermonday coming up. Just seeing if HTB is gonna have any sales on it

[fathom pendant]

seeing as they're based in the UK idk ¯_(ツ)_/¯

[ebon minnow]

hola

need help with Shells and Payloads: Automating Payloads & Delivery with Metasploit

[fathom pendant]

Follow the section and you should be good

[ebon minnow]

it said to connect with the credentials, when i did the rdp cli said pipe error

[fathom pendant]

It helps if you be more descriptive

[ebon minnow]

2nd line is me

[fathom pendant]

Put the password in single quotes

Or double i forget which

[ebon minnow]

neither work

[fathom pendant]

I've not had too many issues with xfreerdp and creds

Also the question says rdp or ssh?

[ebon minnow]

no ssh port open on the target

[fathom pendant]

Oh

[fathom pendant]

You're misreading then

You're meant to use the exploit using the provided credentials iirc

[ebon minnow]

ok that makes sense

thanks

[fathom pendant]

Your slashes are the wrong way

For the outfile

I'd also recommend deleting that as its a spoiler

[ebon minnow]

Got a meterpreter session to work, the shell command times out

[next holly]

Hey, is there anyone available and could help with Attacking common services - Easy
Thanks 🙂

[supple patio]

It would be better if you provide more information

[inner snow]

I'm running into the situation where I put in the correct answer but it tells me the answer is incorrect. I reset the instance, reset the target machine, reset the HTB page, formatted the answer in both the way it came back from the curl request as well as added HTB{} format and nothing

i know it's the correct answer because i've reproduced the same answer every time and it's the only response the server has sent back

[supple patio]

did you check spaces?

[inner snow]

yeah, i've copy/pasted, typed it in

[hallow kiln]

If you actually specified what module and section it is, someone might be able to verify if it's the right answer or not

[inner snow]

it's the java obfuscation module

[fathom pendant]

which part

because you may be one step ahead of what it's asking

[inner snow]

decoding the base64

i used curl -s http:"theIPandport"/serial.php "serial=my_thingy" then piped it into the base64 decode and came out with the secret message

[fathom pendant]

what's the exact section name?

also you can just do http://IP:Port

[inner snow]

Javascript Deobfuscation > decoding

i don't want to just put the answer in here as I think that's against the rules

but it's leetspeak

[hallow kiln]

First word of it?

[inner snow]

7h15

[hallow kiln]

Isn't there an extra request you have to make

[fathom pendant]

yes it's meant to be leetspeek

[hallow kiln]

With that as the data to get the final output

[fathom pendant]

and yes you're meant to use that decoded output as the SERIAL= in your POST request

as indicated by the question

[inner snow]

curl -s http://94.237.54.59:40887/serial.php -X POST "serial=YOU_ DECODED_OUTPUT" | base64 -d

that's my request

and i get the response i'm looking for

[fathom pendant]

replace YOUR_DECODED_OUTPUT with the decoded output it gives you

and don't pipe to base64

[inner snow]

oooooh

i see

thank you

[fathom pendant]

you should learn how placeholder text works my guy

it's literally telling to use the decoded output as the variable

otherwise no matter WHAT your post message is it gives you the same result

you could leave it blank and it'll still give it to you

[fathom pendant]

also you need to put -D for the data portion

[inner snow]

i should learn that, thank you

i see now, thank you for the help

[fathom pendant]

sorry lowercase d

not uppercase

also you may need to respawn the target if you're not getting an answer

[ebon minnow]

RDP session keeps bugging out randomly, tried resetting the target a couple of times

[worthy laurel]

Module: ATTACKING ENTERPRISE NETWORKS
Topic: Lateral Movement
Question: Obtain the NTLMv2 password hash for the mpalledorous user and crack it to reveal the cleartext value. Submit the user's password as your answer.

I tried Inveigh.ps1 but it prompted this error “windows version is not compatible”. Then I tried Inveigh’s exe version. It worked. I captured this hash indeed:
mpalledorous::ACADEMY-AEN-DEV::C30EDB1345CBDFE2075EBFB3E023DA82:0101000000000000AADD4DD31714DA012552338…redacted
When I use "hashcat -m 5600 hash rockyou.txt, it prompts “token length exception”. Can someone help pls?

[autumn pilot]

try to understand the "token" that hashcat is expecting for the specified mode

[worthy laurel]

Can you provide more information please? I couldn't understand what you said. I stuck in this topic for a week.

[autumn pilot]

What kind of hash does hashcat expect for the mode that you are using, start from that

[high zinc]

https://hashcat.net/wiki/doku.php?id=example_hashes

[echo widget]

HI guys,
I moved on and found a password-protected zip. But I have no idea how to find it.
Any hints ? ty

[rustic sage]

b

[somber gorge]

Hey guys I am checking out Security Monitoring & SIEM Fundamentals to learn about Kibana, are there any other modules related to this topic on the academy?

[obtuse oxide]

Is it possible to automate testing all the auth bypass techniques for sqli instead of manually trying each and every one? I've just starting using sqlmap and I'm not sure if there's a script for it already

[wheat scroll]

Hello

I have problem with this question, someone can help me ?

The exercise above seems to be broken, as it returns incorrect results. Use the browser devtools to see what is the request it is sending when we search, and use cURL to search for ‘flag’ and obtain the flag

It’s on the module web requests

[umbral fulcrum]

hey guys
I'm in "Linux Privilege Escalation" ==>>"Privileged Groups"
the Q is: "Use the privileged group rights of the secaudit user to locate a flag. "

I did || id ||, saw that I'm in|| adm ||, and did || ls -lth /var/log/ || to see what interesting log there R.
went 2 || apache || and on and on

did someone did it some other way cause this way doesn't look like what I needed to do (at least not in the real world senecio)

[placid quest]

@umbral fulcrum go in var/logs and use grep ri to find the flag

[wheat scroll]

When i put cURL IP_SERVER/search.php they said me acces denied

[placid quest]

@wheat scroll that means you don't have access to search.php

[umbral fulcrum]

so basicity do ||grep in the /var/log||

btw || -rw flag|| show me a lot less mess

thank U

[placid quest]

@umbral fulcrum no worries

[wheat scroll]

I can’t put a command to have access to it ?

The flag is in this document or not ?

[silver mesa]

Hi, Anyone can we give some hint Attacking Common Applications - Skills Assessment II

Q5. What is the admin password to access this application?

I poke all around repo in the gitlab. Unablle to get.

[fiery berry]

are you sure? I would give another go to the gitlab repos

[obtuse oxide]

This is for the module sqli fundamentals, the final assessment.

[silver mesa]

Thanks I got it

[thin roost]

you guys know if htb academy is eligible for dutch STAP budgets?

[vital elk]

I'm not sure if this is the place to put feedback for modules, so please move or let me know so I can put in the right place.

System: VMware Workstation 17 Player - Ubuntu 22.04.3 LTS

For INFORMATION GATHERING - WEB EDITION module there is a portion to install Aquatone using go. The command in the module is no longer supported:

go get github.com/michenriksen/aquatone

'go get' is no longer supported outside a module.
To build and install a command, use 'go install' with a version,
like 'go install example.com/cmd@latest'
For more information, see https://golang.org/doc/go-get-install-deprecation
or run 'go help get' or 'go help install'.

Using go install github.com/michenriksen/aquatone@latest as mentioned gave me another error during install:

go/pkg/mod/github.com/michenriksen/aquatone@v1.7.0/parsers/regex.go:22:26: invalid operation: cannot call non-function xurls.Relaxed (variable of type *regexp.Regexp)

Ended up just grabbing the latest release from github and it worked without issue:

wget https://github.com/michenriksen/aquatone/releases/download/v1.7.0/aquatone_linux_amd64_1.7.0.zip

unzip aquatone_linux_amd64_1.7.0.zip

./aquatone --help
...snipped output...

[shrewd hazel]

made a question in community help for getting started module privilege escalation section https://discord.com/channels/473760315293696010/1173645702144983110

getting an error when using cat command vs no cat command

was able to get the flag though

but wanted to know if this was a platform error or an error on my end

[acoustic sparrow]

switch from udp vpn to tcp

[acoustic owl]

Which module do you need help with?

What do you mean by you can't access the PwnBox?

Can you not start them?

What exactly did you try?
The PwnBox does not require a VPN

Read and follow #welcome

[wet kite]

Hey, just wanted to download the cheatsheet from File Inclusion and my windows virus protection blocked it 😮

[shrewd hazel]

any ideas on this one? i am so close, just need some more hints on how to escalate to root https://discord.com/channels/473760315293696010/1173645702144983110

[tranquil axle]

Windows defender doesn’t like php webshells

[wet kite]

really annoying 😄

[shrewd hazel]

@rustic sage how did you get screenshots in this main chat? everytime i try it just doesnt work lol

[crimson walrus]

Hey guys, I need some help with the linux buffer overflow module. In the skills assessment we need to answer the question: Determine the file type of "leave_msg" binary and submit it as the answer.
I already used the file command and I know the answer but I do not know how to format it so that they will accept it.

[acoustic owl]

It is best to ask the support team

[shrewd hazel]

is there a way for me to attach screenshots here?

i cant for some reason whether its copy and paste or upload

[acoustic owl]

Read and follow #welcome

[shrewd hazel]

ohh, i dont have the hackthebox app, only academy right now

sweet i got it lol thank you

[next bronze]

please do not include answers to the questions
follow the privesc techniques given in the section

[fathom pendant]

what can user2 see/do

[grizzled schooner]

Enumerating SMTP for user on the system... Hint says to use the wordlist provided in footprinting, but there isn't one there

[fathom pendant]

Yes there is

In resources

[grizzled schooner]

oh it was at the top instead of in the footprinting section, sorry

[fathom pendant]

It's in the whole module

It's telling you to use the wordlist from resources

Which works for the whole module

[grizzled schooner]

any hint on how to use it?

yeah I got it now sorry

[fathom pendant]

With a tool

smtp-user-enum is a good script

[grizzled schooner]

thanks, I don't have much exp with SMTP and that was a big help

[fathom pendant]

it's useful ¯_(ツ)_/¯

[devout thorn]

Small tip regarding the Windows language package on lab VM 💡

If you aren't using English keyboard layout (QWERTY), every time you start a new instance, you'll need to install your language keyboard using the GUI
I've found a small PowerShell trick on this website: https://www.anoopcnair.com/add-language-packs-offline-in-image-using-dism/

$OldList.Add("fr-FR")
Set-WinUserLanguageList $OldList -Force```You can now quickly switch to your preferred keyboard layout in the bottom-right part of the taskbar (next to the clock)

PS: Language packs codes are available here --> https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/available-language-packs-for-windows?view=windows-10

[pastel hare]

working on the NETWORK ENUMERATION WITH NMAP : Service Enumeration. I'm on the question asking about "Enumerate all ports and their services. One of the services contains the flag you have to submit as the answer."

I was able to get all my ports and services, using -sV, and also with the NSOCK INFO. But running the tcpdump and nc -nc command is giving me nothing useful. I'm assuming my host for the tcpdump is the ip in the terminal line next to us-adcademy 3. I'm not sure where I'm going wrong

[fathom pendant]

If you use nc you need to wait

10-15 seconds

[pastel hare]

I use nc, 10-15 seconds, and nothing happens

I assume the format is nc -nv <target> port

[manic wolf]

it's more like 30

atleast that's how it was for me

[fathom pendant]

Ye

[pastel hare]

its not displaying anything even after a minute, is there something I have to do priot?

[fathom pendant]

No

Did you scan all ports?

[pastel hare]

sudo nmap 10.129.109.52 -p- -sV -Pn -n --disable-arp-ping --packet-trace

[fathom pendant]

Hint: it's a not standard port

[pastel hare]

ran this command and it gave me 7 ports

[manic wolf]

Hmmm

[manic wolf]

Well what possible ports does that command miss?

[fathom pendant]

That should hit the right port

[manic wolf]

Oh...

[pastel hare]

when I did nc -nv on the 80 i pressed enter and it said bad request

[manic wolf]

This is why I use RustScan

[fathom pendant]

Nope

[fathom pendant]

-p- is for all ports

[fathom pendant]

The scan tool doesn't matter, this is a user issue

[fathom pendant]

Then it's not on port 80, which is the standard http port btw

Like I said non-standard

[pastel hare]

I went through all the ports using nc -nv 22, 80, 110... and I they were either hanging or I clicked enter and it would throw wrong pipe

[fathom pendant]

It's a high port

[pastel hare]

31337

I run that and nothing

[fathom pendant]

Just wait

Like up to a minute

[shrewd hazel]

shoutout to @fathom pendant , should be offered a job with HTB for all the support

[fathom pendant]

220 is the response code

Also spoiler so you should delete it

220[space]HTB{FLAG}

[pastel hare]

Got it thank you! I guess the wording of the question threw me off. I was thinking I would have to find it in the tcpdump

[fathom pendant]

You can find it in tcpdump too

[pastel hare]

I was trying to get it to work but it wasn't displaying anything. I assume its a background process. How would I have it display items?

[fathom pendant]

You need to specify the tun0 interface with -i

If I'm recalling correctly

[pastel hare]

sudo tcpdump -i eth0 host <terminal ip> and 10.129.84.185

I pretty much copied from module example

changing the ips

[fathom pendant]

Use tun0

Instead of eth0

tun0 is academy interface

[pastel hare]

okay, and then would I do a nmap scan or nc scan>

[fathom pendant]

Nc connect to port iirc the section goes over the order

[pastel hare]

yea I'm starting to doubt the section examples, using eth0 and displaying things that don't appear in my terminal

[fathom pendant]

The examples are just that, examples

Sometimes you'll need to manipulate examples to fit your needs

In this example they use eth0 as the interface

[pastel hare]

I'm like fresh into this, so I'm unsure how I would know about tun0

[fathom pendant]

If you do ip a you'll see multiple interfaces, one is the private network address 10.10.x.x (where x is the last 2 octets of your ip)

[lyric raft]

Hello, anyone who is in the command injections module?

[fathom pendant]

Just ask your question

[slender wolf]

Module: WINDOWS ATTACKS & DEFENSE
Section: PKI - ESC1
I have already requested te Administrator certificate. I am attemping to convert it from PEM to PFX however I am confused how I am suppose to transfer the file over to the Kali box? It also doesnt help that the RDP sessions have high latency. Any permissible guidance would be appreciated.

[fathom pendant]

Use tcp connection, if using xfreerdp do /drive:(whatever name),/path/to/local/directory

[slender wolf]

thank you

[fathom pendant]

You should be able to download the tcp vpn from the site

[slender wolf]

I took your advice earlier and did that thank you it is working just not super well in teh portion where you rdp in that rdp session to the workstation

[fathom pendant]

Ah

[slender wolf]

I'm trying to open the pem to pfx in the kali session to use in the workstation session

the inception is messing with me I guess lol

[fathom pendant]

Ah ok

[nova ocean]

anyone can help me about this?

[fathom pendant]

Well if you do port forwarding/pivoting

[fathom pendant]

I swear if I Google and have your question answered I will tell you to Google

Yep found the answer quickly

IIS is tied to Windows Version

[static parcel]

haha lol

[fathom pendant]

Literally took 5 seconds

Google, click stackoverflow, one of the responses contains the answer

[slender wolf]

was this in response to me? I still don't understand how to run this command in the kali instance when it has me running a session in the workstation

[nova ocean]

cannot be upgraded separately?

i was looking to check if there is any possibility

nvm found it

[nova ocean]

good something new 😄

[fathom pendant]

If you do port forwarding with like chisel or something then you can skip over foothold but that's just a suggestion. You can always transfer back a step each time

[pastel hare]

How did you go into the robots.txt>

[wheat scroll]

Hello

I have problem with this question, someone can help me ? The exercise above seems to be broken, as it returns incorrect results. Use the browser devtools to see what is the request it is sending when we search, and use cURL to search for ‘flag’ and obtain the flag. I don’t know in which request i can get the flag

It’s in Web requests module

In Get sections

[pastel hare]

How do I access robots.txt? Do I put it in a url or is there a way to access it on the command line?

[fathom pendant]

Http://ip/robots.txt

[pastel hare]

🐐

[wheat scroll]

I have problem with this question, someone can help me ? The exercise above seems to be broken, as it returns incorrect results. Use the browser devtools to see what is the request it is sending when we search, and use cURL to search for ‘flag’ and obtain the flag. I don’t know in which request i can get the flag. It’s in Web requests module and it’s in Get section

[thorn urchin]

Its not broken, you need to review the section materials and try again

[wheat scroll]

Ok

[thorn urchin]

Honestly imo burp intruder just sucks and not worth using. Lile the rest of burpsuite is a great tool but intruder is so fiddly and wonky

[wheat scroll]

I review it for 1 hour

[thorn urchin]

Review it as long as it takes to grasp the content it teaches

Understanding is more critical than rote memorization

[wheat scroll]

Ok

Thx

[thorn urchin]

I usually prefer something like ffuf

or if you absolutely need to save results then bash script curl or something

[royal sigil]

hello i make the chain idor module i have problem to enumerate all users can you help me

[undone narwhal]

Did you uncheck the payload encoding checkbox in intruder?

[rustic sage]

i just updated the os and the latest version of metasploit removed an exploit 😦

[thorn urchin]

how do you know they didnt just remove two shitty exploits and add one better written one for the same cve

[half inlet]

Any help on the question for this module https://academy.hackthebox.com/module/147/section/1391 ?
I tried running hydra -l sam -P pwatk/mutations.list 10.129.202.64 ssh -V
the mutations.list file is created using hashcat --force password.list -r custom.rule --stdout | sort -u > mutations.list
(the custom.rule and password.list come from the module's given resources)

I let the hydra task run for about an hour, and I got no results. It only however got thru 9k out of like 94k results, I'm going to try using the best64.rule to mutate the passwords.list now but I wanted to ask here to save me some time incase im going in the wrong direction

To save you from having to click the link, the question is:
Create a mutated wordlist using the files in the ZIP file under "Resources" in the top right corner of this section. Use this wordlist to brute force the password for the user "sam". Once successful, log in with SSH and submit the contents of the flag.txt file as your answer.

[rustic sage]

i don't... gotta check their github for release notes

[thorn urchin]

absolutely do not use the best64 rules, keep with the provided list

[half inlet]

okay, do I just need to give it more time?

[thorn urchin]

also ssh is super slow, dont target ssh if you dont have to 😉

[thorn urchin]

Really its just nothing to worry about

[half inlet]

I figured that's what I have to target because that's what it asked for, but I'll look into it

[thorn urchin]

Dont let a questions wording stop you from applying critical thinking and better intuition

[half inlet]

Alright, thank you

[grizzled schooner]

enumerating SMTP module: have a list of usernames in email format but unsure how to get the specific username the module wants... any nudges?

[thorn urchin]

it mentions three different methods, have you tried all three

[grizzled schooner]

no I'm not really sure what to do from this point ||used smtp-user-enum -D inlanefreight.htb -U footprinting-wordlist.txt -w 10 -T footprinting-wordlist.txt -t <ip>|| which gave me a list of emails that says exist... I tried putting in the name without the email and then the whole thing, for the entire list, but it didn't work

[royal sigil]

hello i make the chain idor module i have problem to enumerate all users can you help me

[thorn urchin]

well like I said they teach three different enumeration methods, you need to try all three. I suggest reviewing the section again

[fathom pendant]

-M is used to specify method

[analog dock]

That doesn’t seem like the command I’ve seen in module, and you should use -w 25

At least according to my notes

Or use the metasploit

[grizzled schooner]

I didn't even see this being ran at all in the module regardless but that was the nudge I got earlier was to use this

[leaden yew]

Anyone have any insight into why Linux Privilege Escalation -> Escaping Restricted Shells is so light on information? Seems like a waste of a section.

[thorn urchin]

idk they got some new writer to add updated sections to modules and seems like the vast majority of new sections are just pretty bad

[leaden yew]

fun stuff

[grizzled schooner]

ran through all 3 methods, and I have two extremely long lists lol... Do I have to go through and manually enumerate each one to find a flag or something?

[fathom pendant]

You find a username first then you look for a password to go with it

[grizzled schooner]

yeah this is where I'm a little lost, all I have is email addresses, are those considered the usernames for this?

[fathom pendant]

Username@domain

[tulip mortar]

Which path / module are you doing?

[grizzled schooner]

Pentest path, SMTP

[fathom pendant]

Footprinting module yeah?

[grizzled schooner]

yeah

[tulip mortar]

(I am many cubes away from that...)

[fathom pendant]

If you do it correctly you should only have one valid user iirc

[grizzled schooner]

is there a faster way to tell which ones are valid? I have probably 40

[fathom pendant]

As in it should only return one user

[thorn urchin]

yes. follow the section instructions like I said

it teaches 3 different methods for confirming

try all three of em

[fathom pendant]

This section doesn't go over the smtp-user-enum tool

[thorn urchin]

and

[autumn pilot]

two cents, based on my observations about the channel, it seems that everyone who seeks help hasn't ask himself the three questions Why, What and How

most of the people seeking help are actually seeking the exact command to get the answer

[grizzled schooner]

no? I've simply asked for a nudge as you could see if you read it

[autumn pilot]

Just generally speaking, I'm not pointing fingers

[tulip mortar]

https://tenor.com/view/montypython-witch-burnthewitch-gif-5477103

[grizzled schooner]

ok, I was about to say lol... I'm just confused and looking for a nudge, I've always had trouble with SMTP

[thorn urchin]

Well youve gotten a couple nudges, so just waiting to see if you get a different result or have a real followup question

[grizzled schooner]

👍

[royal sigil]

hello i make the chain idor module i have problem to enumerate all users can you help me

[fathom pendant]

Yep after careful troubleshooting I can confirm that the issue is user error

[thorn urchin]

@royal sigil

No one can help you if you dont ask an actual question

[royal sigil]

OK I am going to think about it

[analog dock]

[thorn urchin]

I mean hey I give them props

It was pointed out they need to ask a real question, and they decided to pause to think of one first.

[fathom pendant]

And tbh sometimes in the process of coming up with/asking a question you reveal the answer to yourself

[thorn urchin]

Yeah. Its a highly amusing response but better than most randos that just get upset that people can't psychically implant the answer into their brains.

[fathom pendant]

It's also why sometimes my response is "are you asking me or telling me" which is a hint to just do it ™️

[runic remnant]

is htb having problems with the vms?

[fathom pendant]

mine is fine ¯_(ツ)_/¯

[runic remnant]

bruh im trying to rdp and its gonna make me go crazy

[analog dock]

It made me laugh personally

[hallow kiln]

Do you happen to be getting a black screen?

[runic remnant]

YESSS

[hallow kiln]

It's a screensaver, just press enter

[runic remnant]

bruh

thank you

[analog dock]

Another one bites the dust

[next bronze]

lol screensaver strikes again

[runic remnant]

but sometimes it doesnt even connect and then I try again and it works

its ok tho im fine with screaming at my laptop

[next bronze]

recommended to use tcp for vpn if you're having connection problems

[runic remnant]

I used to do vpn with wsl but it gave me so much errors that using the htb vm is just better

[fathom pendant]

Screensaver 20 | htb users 2

[fathom pendant]

Just use an actual vm WSL is trash

[runic remnant]

but wsl makes everything so easyyy

[fathom pendant]

It's garbage

[next bronze]

doing pentesting stuff on your host is a bad idea, wsl isn't isolated

[runic remnant]

Ya I dont do actual work on wsl but just learning I use wsl

[fathom pendant]

Even learning platforms

[warm flame]

After solving the active subdomain enumeration module, i would say that module needs a rewrite. The material is very loosely connected to the challenge. Its the worst feeling to put in a whole days worth of work and still thinking boy I didnt really learn anything.

[fathom pendant]

I found it was alright

By far the weaker modules, by nature of the tools, are Vulnerability Assessment and Pivoting modules

Just because they're very much copy/paste

[warm flame]

Sure i just like the material to translate into the challenge. For instance they list a command in their about using nslookup with the afxr type. Never used this. The comments in the forum kept specifying dig as the proper command line interface. So theres a lot of wasted time just trying to figure out on what terms the module really wants you to solve something as.

[fathom pendant]

Nslookup works the same as dig basically

It's just an alternative way, to get subdomains

[warm flame]

Never could work for me man. Maybe i suck. Also the module teaches gobuster. Never used that either

[thorn urchin]

Learning new things is fun!

[fathom pendant]

Again an alternate tool to do the same task

The module can be completed with nslookup

[warm flame]

What did i learn? The module asks to identify multiple zones. Again i figured this out but that module doesnt go over that.

Anyways doesnt matter im over it

Peace out

[fathom pendant]

DNS explanation is really lackluster in any module that goes over it

[thorn urchin]

You've learned several new tools for tackling a common enumeration step.

[lyric raft]

I am stuck in the command injection module, skills assessment, I try to move the file with the flag to the tmp folder, first I try to move any other file and insert the payload in the GET request with the obfuscated whoami command to check the execution, but in the response it gives an error in which the command is reflected, but it is not executed, can someone help me please. Maybe it is another way the solution.

[flint linden]

Has anyone here completed the game hacking modules? there is almost no forum posts that I am seeing to assist in the labs

[thorn urchin]

https://dontasktoask.com

I havnt done the module but I have RL experience with game hacking/modding/reverse engineering so who knows I might be able to help anyways but we will never know if you only ask if people have done the module instead of just asking the question you have about what youre stuck on.

[rustic sage]

i'm doing the skills assessment for this module: https://academy.hackthebox.com/module/54/section/511

question number 3: One of the pages you will identify should say 'You don't have access!'. What is the full page URL?

i had to look up the answer because none of my commands are returning the correct answer i even followed a video and i'm not getting the same reuslts as the video :/

now it decides to work...

literally all the same commands and everything as i was doing before but nothing was showing up

[rustic sage]

how do we know if a command is working like it's supposed to? in this case i didn't do anything wrong and the expected results weren't showing up

[thorn urchin]

¯_(ツ)_/¯

Tough to say when we cant see what you did and what results came back

maybe the instance just hadnt booted all the way, maybe there was connection issues, who knows

But that uncertainty is true to life as well

[rustic sage]

so it's good to run the same command multiple times to make sure i haven't missed anything?

[thorn urchin]

as in yeah youll see that shit irl too, not just labs

[thorn urchin]

depends. gotta use some judgement and intuition there

[rustic sage]

in the enumeration phase like when you're scanning for instance

[thorn urchin]

Depends

Like if Im suspecting connection instability, Ill slow things down

For as much press as big DDOS attacks get, a lot of webservers can still cave over a too aggressive gobuster scan lmao

Also that particular assessment is a public docker container. Theres tons of connection reasons that could interfere with your enumeration.

[rustic sage]

that's crazy... thank god there are answers!

the youtube video's example works but mine doesn't even though i switched over to the web browser pwnbox

my command is on the left and the youtube video is on the right

i hope i won't encounter these types of issues in the exam

[thorn urchin]

your commands not the same

[fathom pendant]

Also do the bare minimum editing to block out the answer

[thorn urchin]

fwiw your command looks more correct than their command, but unless theyre just using a wacky font, your commands are different lul

[fathom pendant]

I think it's font

Though one is clearly FUZZ=key

[thorn urchin]

im like 90%sure thats what its supposed to be but the vid looks like just FUZZ-key

[thorn urchin]

Also in this instance the key sign that somethings not going right and you should try your steps again is that youre just fuzzing for parameters but not getting any error code for the page itself, which youve already confirmed exists. Even if your wordlist was shit you should be getting something back, not just blank results.

Thatd be the clue to answer the earlier depends about when you should rerun commands.

[rustic sage]

that makes a lot of thanks sense thank you!

[lyric raft]

I was able to find the flag, very good module, I learned a lot.

[flint linden]

@thorn urchin It just seems fairly technical and extensive to generally ask here. I am surprised that there isnt posts and responses about it on the forums.

In "Identify and Dissect Data Structures" they reference using cheat engine to locate a point of interest then browsing the memory region. Looking for the red areas in the memory viewer to indicate change while the game is running. Converting those to 4 byte decimals in an attempt to locate specific values of interest. They offer the hackman game as a lab. Utilizing cheat engine with this game you can easily search and discover "score" however this seems to be a placeholder for the string "score" but not he actual score which is assumably a float. When searching the same area of memory, I cannot discover any red data points in the memory which could be related to the actual score. Also doing an initial scan, then follow-up scans for the score doesn't seem to present what I am looking for either. I am at a bit of a loss as to where to check next.

[fathom pendant]

Are you referring to the academy module?

[thorn urchin]

it could be a float but I also see score values often be a double, did you try scanning for that?

[flint linden]

@fathom pendant yes

I do remember seeing a double but it did not seem to align with my current score.

[thorn urchin]

Also while the score string may not itself be an indicator, you can check surrounding memory to see if its related. And if that doesnt work, putting a hook on the string to see what accesses it could also clue you in to the score value location

[flint linden]

can you explain what you mean when you say put a hook on the string?

[thorn urchin]

You can right click and do a find what accesses this address

[thorn urchin]

oops meant to reply to this one

Sometimes what Ill also do if I suspect a value but it doesnt look right is add it and then edit/freeze it anyways just to see what happens. Worst case is the program crashes and I start again lul

[flint linden]

also should we only be scanning the game process for these or all of the listed memory scan options?

[thorn urchin]

eh kinda depends

[flint linden]

nice I will mess with this more the hook seems like a good idea I wasnt aware of. I am loading it up now to check it out.

[thorn urchin]

for more complex games Ill scan full memory space. For simple shit Id just stick to the main process memory

[thorn urchin]

its far more useful when youre trying to patch code, but occasionally it can help with discovery. Though tbh I usually switch to static analysis with ghidra/dedicated decompiler if Im gunna be chasing strings

So while its worth a shot, dont be surprised if it doesnt lead anywhere useful for your scenario

[flint linden]

is there a way to condense the memory viewer to only show actively changing data points?

[thorn urchin]

not really because it cant predict whats an actively changing memory field or not

this is offtopic read #welcome

[flint linden]

@thorn urchin I assume this game could be decompiled and values changed then recompiled. If that how this works with modern gaming when people create mods and such?

[thorn urchin]

Sometimes

[fathom pendant]

Mods tend to piggyback off existing libraries

And have to do some funky stuff if there's anti-cheat on the device

[flint linden]

@thorn urchin got it. I was unable to find it by searching for score so I looked for the lives variable. I assumed it would be stored in memory around the same space. Thanks for the input.

[thorn urchin]

Always a good thing to try as well nj 🙂

[ebon minnow]

is there a web browser built into parrot os?

[haughty karma]

I hacked into the main frame

[acoustic owl]

Firefox should be installed

[ebon minnow]

I RDP'd into a VM for foothold and theres no firefox on the machine

[hallow kiln]

Open a terminal and type firefox

[ebon minnow]

sorted it, using burp

[fathom pendant]

Fwiw it's not working bc you're doing it as root

Root doesn't have a display variable set

[ebon minnow]

ok, thank you

[hallow remnant]

Module: Windows Event Logs & Finding Evil
Request: Unclear what I'm looking for as IOC of DLL Hijacking

More generally, I understand that Sysmon ID 7 is indicative of a module load event, which itself may signal a DLL Hijacking effort. However, I'm less clear on what else I'd be looking for. I figured the presence of such an event ID isn't in-and-of-itself is sufficient.

For context, I'm stepping through the Skills assessment for the module and just found the process that is responsible for the DLL hijacking by just grabbing a list of processes and brute-forcing my way through. That may work for the purposes of the assessment, but I'm missing the key takeaway from the section.

Put another way, outside of stepping through all the ID 7 events (which seems terribly inefficient), I'm not sure what I was meant to be looking for.

[heavy marsh]

So I'm in the Password Attacks Hard Lab and I have transferred the .VHD file to my attack machine. Where do I go from here?! I saw a mention to this

https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

in the forums, but I'm wondering what I missed in the modules?!

[fathom pendant]

The modules don't go over mounting that type of drive

That's a research and find out

[hallow kiln]

I just did it on my Windows host

[heavy marsh]

I was going to try transferring it back to the Windows target machine. Any guidance on how to get that to work?

The medium link seemed a bit vague

[hallow kiln]

Don't remember the module and not at the computer to check my notes, but if you've got RDP access you can use the /drive option with xfreerdp, mount the entire folder where the file is

[heavy marsh]

Is there a future module I could skip to for more info? I feel like something is missing here.

[hallow kiln]

I don't think so, I just transferred it to my Windows host and googled how to mount it there, was very straightforward

[hallow remnant]

Module: Windows Event Logs & Finding Evil
Section: Skills Assessment
Request: Answer attained, but rationale unclear

Task 5 is a simply "Yes" or "No" response, which I simply guessed. I'm not altogether certain why my answer is correct however. My intuition is that I'm meant to correlate the datetime of the event from Task 4 against the Security log, but I'm not certain how - at glancing at the Logon/Special Logon events, I'd determine the correct answer. Since I have the answer already, I'd appreciate some guidance on explaining the rationale.

[heavy marsh]

Tried to copy the Backup.vhd back and got this error

I hosted the VHD from my attack machine with:

sudo impacket-smbserver share -smb2support /home/kali

[heavy marsh]

how does the /drive option work?

would it be /drive:Backup.vhd?

[sly dome]

i downloaded it with smbclient

after that i used a simple http server to transfer to Windows

then i double clicked it and it asked me for the password

after that it was mounted

[sly dome]

this should be the credentials error we talked about

if you use google you will find the solution real quick

[heavy marsh]

What is the credentials error?

[sharp nexus]

I’m in 😇

[fathom pendant]

Bad credentials

You didn't even try and crack the password

Is my guess

You just saw people suggest mounting a certain way without understanding why

[sly dome]

no no

Since some windows version/security update you cant access smb as guest

[fathom pendant]

Ohhh yeah

That you need to set a dummy pw

[sly dome]

just use simple http server

[fathom pendant]

Either way

File transfer module gotcha covered

[sly dome]

or smbserver.py <folder> <sharename> -username <dummy user> -password <dummy password>

and from Windows net use x: \\<IP>\<sharename> /user:<dummy user> <dummy password>

move it to local folder with copy x:\Backup.vh <some local path>

but yea Google has all this commands xd

[fathom pendant]

I mean a lot of this is gone over in file transfers long long ago

[sly dome]

also 🤷

people seeking for straightforward commands is an usual thing

[heavy marsh]

So I set a dummy password and got the VHD transferred to the desktop of the target machine. Now the cracked password I got is not working.

I don't want to post it here, spoilers.

[sly dome]

to the desktop of the target?

you should be transferring it to your local windows host

[heavy marsh]

I did bitlocker2john, pulled a single hash from that, then used hashcat with mode 22100.

[sly dome]

is that one

[heavy marsh]

YEAH!

[sly dome]

should work

i did it on my Win11

[fathom pendant]

Just saying you can do it on a Linux system pretty painless

I think one of the old articles that was shared around had like 20 steps

New one had like 8

[sly dome]

since it is a native windows file, would hesitate on tryna do it on Unix tho

[fathom pendant]

Yeah fair, but it's still good knowledge

[sly dome]

it is

im just a windows lover xD

[fathom pendant]

And it works fine, I tested it, helped someone else troubleshoot a step they skipped, and it's easy

Like legit all you gotta do is follow the steps

[sly dome]

always hahaha

[fathom pendant]

And not have to try and figure out what xyz means

Legit though that article is the easiest one to follow

[heavy marsh]

This is what I'm getting

[sly dome]

my boy

transfer it to your windows host

that password is totally unrelated to admin password on that host

if you do not have have a windows personal instance (weird tho) you can do it from your linux

[heavy marsh]

My windows host is isolated from my vm

[sly dome]

how that?

you dont have a LAN in your home?

[heavy marsh]

No file transfer capability

[sly dome]

with your ISP router

[heavy marsh]

I keep them seperate

[sly dome]

what xd

how is your VM getting access to the Internet

[heavy marsh]

I'm in bridged mode

for network adapter

[heavy marsh]

Is this any good?

https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

[sly dome]

never done

ask Marcie

[heavy marsh]

It mounts a drive, but then closes it?!

[sly dome]

bro

can you issue ip a

from your Parrot/Linux

[heavy marsh]

Is this any good?

https://medium.com/@kartik.sharma522/mounting-bit-locker-encrypted-vhd-files-in-linux-4b3f543251f0

[sly dome]

what output you get?

[heavy marsh]

it mounts the drive and then unmounts and closes it

[sly dome]

dont you have your parrot/kali connected to the same router than your Windows?

[heavy marsh]

I keep my Windows and Kali seperate.

[sly dome]

you have 2 internet subscriptions?

2 routers

[heavy marsh]

No. Windows and then a VM for Kali.

I used to use a USB live boot, but now I just used the Kali in a VM with bridged mode.

[sly dome]

🤦‍♂️

im done

[heavy marsh]

I know, me too, this is rough

[sly dome]

do you have Kali and Windows connected to the same router?

for internet access

yes or no?

[heavy marsh]

I have one router, so yes.

I just don't transfer anything from HTB to my windows machine.

From what I understand the labs are shared.

Is that correct?

I should clarify, HTB Academy is shared from my understanding.

I get VIP+ with HTB main platform.

[sly dome]

do what you did for the smbserver but from your windows machine xd

no one altered that backup.vhd, relax

[ebon minnow]

for shells and payloads, the live engagement I put all the right creds but the exploit isnt working

[heavy marsh]

I'm just going to run a windows VM and transfer via internal network tomorrow.

Thanks for the help!

[vital adder]

nope, all HTB academy labs is personal and private for you only, only boxes on HTB is share

also may i ask is all of the troubleshooting so far is because you can't get the backup.vhd back to your kali?

[heavy marsh]

No I got it on my kali easy, got it to the windows target machine easy too.

[vital adder]

which question?

[heavy marsh]

Password just doesn't work

[sly dome]

no

[ebon minnow]

"Exploit the blog site and establish a shell session with the target OS. Submit the contents of /customscripts/flag.txt"

[sly dome]

its asking for admin password on WINSRV

that is a totally different password

hes afraid to transfer it to his Windows host

which makes no sense for me ...

[vital adder]

same lol

[vital adder]

sorry for the delay, my browser just hang for a bit but why tf did you put the vhost in rhost and the ip in vhost??

[ebon minnow]

it keeps resetting

[vital adder]

you'll need to set the target vhost to the vhost option not the ip

[ebon minnow]

umm, that worked. Can i ask how?

[vital adder]

lol

all you just did was set the right option

[hallow kiln]

You keep them separate... By running in bridged mode?

[ebon minnow]

last section, host 03. Exploit works fine but then no session was created

all my options are fine

[glossy phoenix]

i need help, disclaimer, im just started using HTB and take this course

[hallow kiln]

you're gonna have to be a lot more specific

[glossy phoenix]

i cant copy paste picture here ?

:'

[hallow kiln]

read #welcome

[ebon minnow]

halp

[sly dome]

should this be working? Enter-PSSession -ComputerName ACADEMY-EA-DC03.FREIGHTLOGISTICS.LOCAL -Credential INLANEFREIGHT\administrator

it asks for a password but we do not have it

i think its just an example

[hallow kiln]

is this from the double hop section? it's just a demonstration, section didn't have a lab attached

[sly dome]

noo

attacking trusts cross forest

[hallow kiln]

found it, yeah, it's an example

[sly dome]

thx !

[sly dome]

why i cant fix the clock skew problem?

tried ntpdate and rdate with the domain controllers ip

it is showing 08:58 but when i run ntpdate it shows 10:58

[hallow kiln]

if these two aren't working, the last option is prepending all commands with faketime

faketime -f +7h or whatever the clock skew is

[sly dome]

-1 hour from my timezone

i think

[hallow kiln]

nmap shows it

[sly dome]

also -debug with impacket o.O

[sly dome]

worked like a fkn charm

[hallow kiln]

nice

[sly dome]

thx

[brave lily]

Hi guys im having a trouble with a module

File Upload Attacks

I managed to upload a file called "shell.php.\.jpg" to a site in http://94.237.59.185:54581 but can't under stand how can i visit this file (because of the unconventional extesnsions)

[hallow kiln]

Why?

If you have an actual question, ask it

[sly dome]

i restarted my parrot and it works now without ant type of time adjustment

anyone understands kerberos time stuff?

[vapid fiber]

Hi
I need help for http response splitting
I found XXS and I made my exploit
It’s work but when i trying to get “document.cookie”
I got empty
How to get admin session

Can someone help me please

[acoustic owl]

Which module is this from?

[vapid fiber]

HTTP attack => HTTP Response Splitting

[acoustic owl]

You cannot read the cookie. You have to find another way

[vapid fiber]

How ? Which way you mean !

Just i need hint

[acoustic owl]

If you can't access the cookie, just get the user to do what you need

[vapid fiber]

I need to get flag I think the flag on cookie that why i need to dump cookie but as you told me I have to control user to visit what i need i have control by JS code but how to use that to get flag

[candid lily]

how can i access a internal web page through port forwarding

i want to open the web page with a browser

[acoustic owl]

You have to make sure that a report is sent to the admin
Then you can check the log

[acoustic owl]

From which module?

[candid lily]

its for a htb machine

i thought i would ask in general

[vapid fiber]

I used report Issues to send URL with JS code to exploit it when admin visit that link and I control it but no idea how to get flag

[acoustic owl]

Then better ask in #boxes

[candid lily]

okay

[cedar void]

I am having trouble with the DNS ATTACK section of the Attack common services module:

"https://academy.hackthebox.com/module/116/section/1512"
"Find all available DNS records for the "inlanefreight.htb" domain on the target name server and submit the flag found as a DNS record as the answer. "

[acoustic owl]

htb is not an official TLD. It can therefore not be resolved by the root name servers.
Enter the IP as nameserver

[sudden cloak]

I am having the same problem. What flag did you add?

I am doing Kerberos Attacks Unconstrained Delegation User, but I am stuk at the last step. Already have the ticket but getting this error: ┌──(kali㉿kali)-[~/krbrelayx]
└─$ secretsdump.py -k -no-pass dc01.inlanefreight.local
Impacket v0.12.0.dev1+20231108.130828.33058eb2 - Copyright 2023 Fortra

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Cleaning up...

Can someone tell me how to proceed, stuck for a while now

[misty current]

The flag to add would be the DC's IP address. It should be -ns or -dc-ip something. I don't remember exactly but play around those and it should work.

[sudden cloak]

OMG.... I feel so stupid now haha

Thank you

[shadow current]

on sqlmap module on skill assesment part im having a hard time finding the injection point i clicked already a lot of buttons but still no post request popping up on my network tab can someone help me with this?

[nocturne glacier]

Hi guys , i wanna ask that student plan has direct access to bug bounty and penetration tester path right ?

[shadow current]

Yes

All tier 1 and tier 2 modules this includes those 2paths you mentioned

[nocturne glacier]

Thanks 👍🏻😀

[shadow current]

No probbb

[manic wolf]

So I cracked the hash of the root user in the "Passwd,Shadow & Opasswd" section of the Password Attacks module, but when I submit the password which is ||named after a DC hero|| HTB doesn't accept the result

I checked for trailing spaces

I fixed it

By using John

Which is weird

The only thing I did was switch from hashcat to John

How the hell did I get two whole different hashes?

Yeah that's a mystery, lol

Shout out to John I guess

[vagrant orbit]

Has anyone completed Windows Event Logs & Finding Evil? I am so stuck on the second question. Seemingly you just need to do as they do in the tutorial but alas that has not worked

[rare swan]

Module:Active Directory Section:Bleeding Edge Vulns Question:Apply what was taught in this section to gain a shell on DC01. Submit the contents of flag.txt located in the DailyTasks directory on the Administrator's desktop. Cant read Daily Tasks even with system shell... Any help would be appreciated

[ebon minnow]

Help

[vagrant orbit]

For the homies in the future - just close and reopen everything 😄

[ebon minnow]

Exploit completes but doesn’t work

[vagrant orbit]

I had this before - pretty sure I fixed by trying the other exploits

[ebon minnow]

Ok

[rustic sage]

which ip address do we use for reverse shells in pwnbox?

[vagrant orbit]

whatever ip your pwnbox is, the one at the tun0 interface

[rustic sage]

tun0 is the first ip i tried from pwnbox and my reverse shell is not working 😦

z

[vagrant orbit]

Wanna DM me and tell me what you be doin?

[rustic sage]

yes

[valid cairn]

Hey
I'm a newbie to hackthebox academy and i just finished the ffuf module and i've taken the skilled assessment but it still shows on my dashboard as incomplete. What can i do?

[acoustic owl]

You must answer all questions in the module to mark the module as completed

[valid cairn]

I have answered all the questions in the module already

[manic wolf]

On the Pass the Hash module, regarding the "Using David's hash, perform a Pass the Hash attack to connect to the shared folder \DC01\david and read the file david.txt." exercise, I think I'm supposed to use || Invoke-SMBExec, but I can't figure out what command to give it in order to connect to the \DC01\ share||

[acoustic owl]

Take a look at the module. Is there no green check somewhere?

[fathom pendant]

I believe the section shows you

[manic wolf]

I checked it, but I couldn't find anything about || specifying a share. Maybe I could try impacket-smbexec?||

Sorry if I'm blind. unless it's referring to || -Target DC01 but I think that's just specifing the hostname instead of the IP||

[fathom pendant]

Launch a powershell session as David and it should work

[manic wolf]

Alright, thanks a lot

[fathom pendant]

There is a -Hash option

If you actually read the full command line

Where it has -Target

[undone narwhal]

thats container's root directory

[wheat scroll]

Hello

ZAP don’t want to accept 8080 port

And i settle my ZAP with certficate but when i put the IP_ADRESS in the web i have a problem

I have an infinite loading

I think that it is due to the port

Help pls

[devout geyser]

hey , i am stuck in the Footprinting Hard Lab ... can anyone give me hints?

[thorn urchin]

then change the port

[wheat scroll]

Ok

[acoustic owl]

Have you tried this in the PwnBox?

[ruby mango]

Hi, I am completely new here, and I am going through the linux fundamentals course. I cannot ssh into the server. It times out. I have tried using the pwnbox, setting up my own kali vm, and using a raspberry pi with parrot. I was able to do this one time about a week ago using the vm, but ever since it times out every time. Any ideas?

[acoustic owl]

reach out to support

[ruby mango]

TY. This gives me a place to start.

[acoustic owl]

https://help.hackthebox.com/en/articles/5986762-contacting-htb-support

[dreamy jacinth]

Anyone managed to finish most of the Defensive Modules out there in HTB ACADEMY?

[thorn urchin]

Some people have all the modules completed

[dreamy jacinth]

Im considering spending this year to try finish all the modules myself. That's why

[distant forge]

@dreamy jacinth yes

[dreamy jacinth]

i still have 2 years in Cyber Security in University and i wanna get as much information as possible

[thorn urchin]

Go for it

Either youll learn something or you wont

[dreamy jacinth]

Appreciate it

i don't really know which Plan to go with ...

[torn cave]

hello, do someone the Web Fuzzing module of academy_

[next bronze]

if you're asking about academy subscriptions, student plan, nothing else comes close in value

[dreamy jacinth]

is there a student Plan?

that would really be nice

[fathom pendant]

In academy? Yes, just need a university email from your school

[dreamy jacinth]

Perfect, thank you

[thorn urchin]

also if your uni isn't auto accepted, just message support they can usually verify the uni and add it

[dreamy jacinth]

Okay Thank you!

the funny thing is gentlemen, is that i cant pay with my credit card in my country haha.

[thorn urchin]

idr if they take paypal but you may be SoL

[dreamy jacinth]

another funny fact, we still don't have Paypal in here 🙂

[thorn urchin]

Emigrate

[dreamy jacinth]

haha yeah thinking about it after i finsh my studies

[thorn urchin]

No personal offense but if your country is enough in early development that you cant even properly pay for shit online then succeeding in a security IT role is highly difficult

[dreamy jacinth]

Actually true, but you have to be really talented to find a good job in here

we have a lot of IT Companies in Tunisia but the only problem is the Salary is not enough.

[next bronze]

that sucks

apply to an overseas company and get them to sponsor your relocation

[dreamy jacinth]

I have time don't worry. Im chatting here while writing a Playbook in centos for a project

[dreamy jacinth]

My Uni can pay for any certification i want to get as long as i Obtain it. But i don't really know if they can with HTB

[thorn urchin]

Tunisia is one of those countries that spies in movies make vague references about doing special ops.

"I owe you one for the incident in Tunisia" type shit 😂

[dreamy jacinth]

hahaha true

[next bronze]

that's awesome, if your uni has a working credit card, then maybe you can pay though then? the student plan is pretty cheap

[dreamy jacinth]

Its not a certificate tho

they paid for my Cisco CCNA and CCNP Security because i managed to get them.

But i don t think they heard of HTB haha

[thorn urchin]

the course is mandatory for the cert

[next bronze]

you need to finish the modules to get cpts, so it is a part of cpts

[thorn urchin]

rough

[next bronze]

oscp then? it's way too expensive for no reason, perfect to get someone else to pay

[dreamy jacinth]

Actually considering CEH for my final year

but i wanna work with HTB first before CEH

[next bronze]

if it's free then sure.. but ceh is trash

[dreamy jacinth]

wait what

why is that?

[next bronze]

I mean, it doesn't hurt to get it if it's free, but also, it doesn't really add any value

[undone narwhal]

If someone is paying for it then do it, but if its your own money then a big nooo

[dreamy jacinth]

I see

[gray merlin]

After CCNA and CCNP, CEH will be a let down.

[dreamy jacinth]

tbh, im really interested in Audit and started on ISO 27001 Lead implanter which i think its awesome and easy to get. and CEH to get better at Pentesting and theory

[next bronze]

best one to take is oscp is someone else is paying imo, purely because of the price, not really the quality

[dreamy jacinth]

Im scared to get that one really..

[next bronze]

if you want to do blue team then oscp isn't excatly for you though

[dreamy jacinth]

its a really good certification but it takes a lot of time and practice

exactly im into Blue more then Red really

[undone narwhal]

You did Certifications in Networking, Interested in Compliance, ready to take ceh and also wanted to do Blue team labs?

[next bronze]

then ceh makes no sense tbh

[dreamy jacinth]

Yes, i have TWO FULL YEARS to do all of that

then gentlemen i shall seek your opinion then

[gray merlin]

For compliance go with CISSP.

[dreamy jacinth]

Im into Audit, i want to follow the Blue team Path. What are your suggestion? i have CCNA 200-301 and CCNP

[next bronze]

https://pauljerimy.com/security-certification-roadmap/
take the rankings with a big grain of salt, but it's a good look at what certs are out there

[dreamy jacinth]

This is perfect

No siir

[dreamy jacinth]

This is really interesting

i've seen it before

[gray merlin]

It is a good cert if you are looking for more leadership in blue team.

[next bronze]

yes but that's like for people with 5-10 years careers, not when you're just starting lmao

[dreamy jacinth]

Oh

[gray merlin]

meh. It is just a cert. there are no requirements for entry.

[undone narwhal]

You dont get the cert even if you pass the exam if you dont have relevant experience

[dreamy jacinth]

Im trying to get the certs that allow me to get into entry level job quickly with good salary

[gray merlin]

I got mine 10ish years ago... I don't remember all the reqs.

[dreamy jacinth]

but i will keep CISSP in mind for now

what about Cisco Certified CyberOps Associate?

[gray merlin]

Start with a job in mind. Then we can give you better suggestions.

[dreamy jacinth]

Blue

Incident Response (SOC - SIEM - Forensics) and ISO 27001

Done it in a Internship for a company

[gray merlin]

iso 27001 is the oddball in that grouping. Do you want to be technical, or business? If your day consists of writing policies and attending meetings, will that be good?

[dreamy jacinth]

Technical first

with experience i will lean towards management

[next bronze]

does your uni have career guidance? I know those can be hit or miss, but it would be useful to consult given that we can only give suggestions based on our experience/countries

[dreamy jacinth]

It does

but im not planning to stay long there

[gray merlin]

The CDSA sounds like a good option for you.

[dreamy jacinth]

Im planning to head to the UK or Canada tbh

[gray merlin]

OSCP is often a good way to get a foot in the door for the positions you are describing.

[dreamy jacinth]

lmao

[next bronze]

still, they might be able give more revelant suggestions

[dreamy jacinth]

Okay

really appreciate it gentlemen.

have a pleasant evening.

[gray merlin]

Good luck!

[naive shell]

I'm doing the Active Directory - Skills Assessment 1 and the server constantly dies and restarts... is/was anyone else experiencing something similar?

--- inlanefreight.local ping statistics ---
515 packets transmitted, 232 received, 54.9515% packet loss, time 521124ms
rtt min/avg/max/mdev = 18.832/69.656/962.274/146.494 ms

Just for the record, it's not because I'm pinging - lol.

[wanton jasper]

I am working on getting started and I am on the Nibbles box trying to do it with out the guide but this box keeps going offline or lagging to the point where I cant work on it. Any suggestions? I cant even browse the site half of the time to look around

[naive shell]

Looks like I'm not the only one... maybe up the specs, HTB? 🙂

[wanton jasper]

or let us pay for private instances.

[next bronze]

the academy instances are private

[wanton jasper]

ah then its just slow

[next bronze]

restart the target, there might be some server hiccups atm

[naive shell]

It was always soooo good.

I already did, like twice.

[next bronze]

I'm able to get a stable shell on the first host

[naive shell]

Weird. Which region are you on?

[thorn urchin]

are you using vpn and pwnbox

[next bronze]

eu 2

[naive shell]

No, own box.

[thorn urchin]

confirmed you dont have multiple openvpn sessions running?

[naive shell]

Yes.

I'm trying a new connection pack.

[next bronze]

use tcp

[twilit panther]

are TCM certs worth it or should you go Sec+ > HTB cert > OSCP for example?

[naive shell]

Thanks, at least the connection seems stable - but now the reverse shell doesn't work anymore. 😅

[thorn urchin]

did you update your IP for the rev shell

[woven copper]

its saids waiting for rotating your log file, consider to read again the module.

yeah lol and it will no happend until you read again and change what you have to change

[thorn urchin]

and what might you be able to do to trigger a log rotation early

[blissful elm]

oh new update

[hybrid prairie]

Hello, I'm on the Windows Priv Esc Module; Citrix Breakout page, I'm having issues uploading files onto the Citrix Server using smbserver.py. the ubuntu server won't allow me to run smbserver.py, sudo command isn't accepting the htb-student password to escalate linux privs. I've tried relocating the files to my local htb server and uploading that way through impacket smbserver.py but the citrix server is giving me errors when trying to connect to the share. I've also tried to xcopy but I have the same issues.

I also tried to simply curl/wget/Invoke-WebRequest the files onto the citrix server but none of the commands are available in the current shell

[twilit panther]

are TCM certs worth it or should you go Sec+ > HTB cert > OSCP for example?

[idle kestrel]

Anyone available to DM on Broken authentication, predictable reset token? I'm stuck replicating the algorithm used to generate the token..

[fiery berry]

"sudo command isn't accepting the htb-student password to escalate linux privs", try again I just did a quick try and it works

[hybrid prairie]

Ty I’ll give it another try

[devout geyser]

Hey , has anyone done the codify active machine ?

[agile torrent]

might have a bit more luck in #1170418907513897001, flick me a dm also if you need

[orchid pine]

I think its not the right place

[snow coyote]

hi, do i really become unlimited pwnboxes if i buy any amount of cubes? Like for example lets say i'd buy 50 cubes, would i have unlimited pwnboxes forever or is it still limited somehow then?

[manic wolf]

Still stuck on connecting to \DC01\david using David's hash

I can't figure what command to pass to || Invoke-SMBExec|| if I try to set the || -Target flag to DC01 it tells me david doesn't have service control manager write privilege there||

[strong elk]

Hi guys i just need some help for Password Attacks Lab - Medium i extracted a docx file from an encrypted archive. The docx file was also encrypted and i found the password, my problem is that i can't figure out how to open this file on linux using the password i found

[acoustic owl]

yes, as soon as you have purchased cubes, the PwnBox is activated without limits

[acoustic owl]

For example with LibreOffice

[strong elk]

I couldn't find the apt repo to download it but i'll retry

[analog dock]

We can’t help you with that

Just message support

[strong elk]

Ok

I just had to fix apt, libreoffice is installed. Thanks for your help

[orchid pine]

heloo guys on the file upload module limited file upload

im having trouble doing the first question tried to read the source code but nothing the server keeps crashing

any hint what am doing wrong

never mind need to understand the xml

first

[orchid pine]

<@&861185840277487616>

[winged hedge]

[undone narwhal]

I never tried it with SMBExec but it should also work with mimikatz. Give it a try

[silver iris]

Hi guys, idk if i missing something or i´m just stupid. For Password Attacks: Passwd, Shadow & Opasswd i need to ssh in the target for initial access (with the creds from the last module), right? My connection from my own system and pawnbox just takes forever and then dies. Am i missing something or is this a techniqual issue? I scanned the target and ssh is running.

nvm, when i deactivated my vpn it worked -.- never had that issue before with htb

[umbral fulcrum]

hey guy, in module "Linux Privilege Escalation" ==>> "Logrotate" they explained that needed to check the "/etc/logrotate.conf"
and C which version the Logrotate is & of curse have W on it

but I can't C any of that, someone can help?

[left pulsar]

Hey guys i'm new here and i have a little problem. I'm currently doing the "Starting point" to Learn the basics of penetration testing (Tier 0) and i'm doing the last room called "Synced" but when i'm trying to get the flag i just get "Permission Denied"
Any one who know the problem?

[zinc thunder]

HEYA!
module: BROKEN AUTHENTICATION
section: Brute Forcing Usernames
question2: I know the answer but I don't get how I should catch it. Feel like i've tried everything in the section but nothing stands out.

[pine dagger]

Try fuzzing

[zinc thunder]

Total time: 0.033627
Processed Requests: 17
Filtered Requests: 17
Requests/sec.: 505.5420

[bright quiver]

hey all...real quick...i am just starting on this journey and am at the web enum portion. I have my instance started in web browser...and the target spawned...shouldn't i be able to ping this box? or do i need to run ovpn? I'd get it if it is supposed to happen then i'll move on, but...

[zinc thunder]

wfuzz -c -z file,/opt/useful/SecLists/Usernames/top-usernames-shortlist.txt -d "Username=FUZZ&Password=dummypass" --hs "Invalid credentials" http://94.237.56.76:36957/question2

[bright quiver]

nvm...looks like i need port included

[dull thunder]

im on Try to exploit the upload form to read the flag found at the root directory "/". and im really stuck on getting past the mime filter. ive tried a few magic bytes and ive successfuly uploaded but i cant locate it on the server.

and ive figured out where and what it should be called. but still cant find it

can anyone dm for a little help?

[umbral fulcrum]

the explanation in the module is poor
and I can't get to the bottom of this

[pine dagger]

Check your hs switch value. You're hiding the wrong values

[orchid pine]

guys im on the upload skill assessement but how the fuck we can put image to the server with get request XD am i missing something

[acoustic owl]

Yeah, Wolfiej is back. Long time no see

[pine dagger]

o/

I never left 😄

Just had other things on my mind.

(and I just wanted to reply to someone so that I could see if I was still listed as a hacker) 😄

[zinc thunder]

I've gone through a few. could you send med the right one in a DM if you have the time.

[acoustic owl]

Why should you no longer be listed as a hacker? Has your rank at HTB changed?

[pine dagger]

I thought it decreased as they removed things

[orchid pine]

got it XD

[pine dagger]

Had to go back and double check. Try checking the site out with Burp Suite, and try with some random names, and check the data string of the HTTP POST 🙂

[fathom pendant]

You need to specify the port

[wanton mica]

Hello all, need a bit of advice.

Just finished the Attacking Common Applications module (UGH) and was wondering if I absolutely had to do the Linux PE module before doing the Windows PE module…long story short I’ve heard that the Windows PE module is a pain and I’d like to get that out of the way first

[fathom pendant]

Tbh I'd do the linux one first as a sort of breather

[fierce solstice]

yo, can somebody explain to me what this code is doing::

[fathom pendant]

⏰ waiting

[fierce solstice]

I can't post imgs for some reason smh

[fathom pendant]

Because your account isn't linked

[fierce solstice]

oh I see I see

https://imgur.com/a/IVPy5DW

[fathom pendant]

It requires an account on https://app.hackthebox.com

[fierce solstice]

Are links okay?

[fathom pendant]

Meh

If you read under description it tells you

I'm assuming it's off the hacking WordPress module?

[fierce solstice]

nope just experimenting, already finished the module

[soft reef]

Can anyone give me a nudge on AD Enumeration & Attacks - Skills Assessment Part II - Use a common method to obtain weak credentials for another user. Submit the username for the user whose credentials you obtain.

[fierce solstice]

the disc does not make any sense, it says rce, but the disc is something else
(am I re7ardd?)

[fierce solstice]

.

[fathom pendant]

Yes

[fierce solstice]

good to know

[fathom pendant]

If you're doing stuff outside the module you're really not gonna get much help

You're better off verifying and asking in #web

Or one of the other channels that become available

[fierce solstice]

Alright I will right away, much obliged

[fierce solstice]

wait where do you verify you acc again,
(sorry for the stupid questions I'm fresh the boat haha)

[fathom pendant]

Read #welcome

[fierce solstice]

yayy done, hi five

[fathom pendant]

Not gonna congratulate you on the bare minimum

[muted peak]

Is this where I learn to heck

[small sage]

Try password spraying

[woven copper]

I'm currently working through the 'Abusing HTTP Misconfigurations, Hard Skills Assessment' and I've hit a bit of a snag. I've identified a reflected XSS vulnerability in a Python server that seems to be susceptible to parameter cloaking. I suspect I need to employ some form of Host header attack in conjunction with an interact server, but I'm struggling to pinpoint the exact method. If anyone has insights or can offer guidance, it would be greatly appreciated. Thanks in advance!

[fathom pendant]

https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[umbral fulcrum]

does someone knows Y the shell I use in Logrotate close after a few seconds??

[acoustic owl]

I don't know, but you can simply change the password. Then the shell will remain, or you can log in again

[umbral fulcrum]

ok so I saw this:
https://ivanitlearning.wordpress.com/2021/04/17/hackthebox-book/
thanx to @tidal mango (thanx BTW)

I don't C how from the that section in HTB I could understand that I need to do it like that

[tough crystal]

Hello, guys I am stuck on the the 4 question Pillaging Windows priv, I cant find the credentials for the Jeff user, so I can log in and finish the 4 question. I saw nobody is asking about the Jeff Cred so it has to be something dumb easy, but I swear i dont see the way. Can somebody give me a hint or something. Please

[bright quiver]

So let me ask this as I feel like I am missing something...for web enumeration/certificates...Am i going to the IP presented as target box and supposed to view cert or go to inlanefreight.com to view it? Becasue whenever I put in the IP with https i get secure connection failed...then without the https i get the htb academy blog page....kind of confused because not sure what to use in order to get the info from cert and robots.txt

[undone narwhal]

you can try, but yeah… Linux privilege escalation is one of those modules that isn’t up to the HTB quality

[undone narwhal]

Hint: ||restic||

[dull thunder]

anyone insterested in helping out with file upload skills assessment?

[fiery berry]

did you verify your account? #welcome

[acoustic owl]

Then your name would no longer be white 😉

[tough crystal]

Sorry I cant find anything in the restic Backup folder, is that the thing you meant or

[undone narwhal]

What is the path to restic backup folder?

[tough crystal]

It is in e drive

[undone narwhal]

right, now check for snapshots in that drive

[tough crystal]

I just see the 5 files which names are letters and numbers

[undone narwhal]

good now just follow the module

[silk prism]

im doing the footprinting module and im having a little bit of a struggle with the mount part, i think i have the right command but i want to make sure if i can dm someone to see if im in the right path it will be of great help

[late summit]

i'm doing the Analyzing Evil With Sysmon & Event Logs module and for some reason when I pull up the sysmon logs in event viewer I'm getting no logs with an Event ID of 7. I'm not sure if i'm setting it up wrong or what

[analog dock]

What exactly is not working? Can you not access the mount?

[silk prism]

everything is working perfect till i get to try to open dir

[analog dock]

So, you can’t access it?

Switch to root and try opening again

[silk prism]

i dont have permission to open the folder, yes

[analog dock]

Sudo su

[silk prism]

that was really help full :)))))

[analog dock]

You’re welcome

[silk prism]

i had all day doing that, deleted my vm in the process two times and everything

[tough crystal]

Thanks, got it

[orchid pine]

guys i dont want to spoil annything but so i have some questions about the file upload skill assessement i finished it but i still dont understand something if i can sm someone about

just to avoide spoil

[fiery berry]

you can use spoiler tags in case

[dull thunder]

yeah i just finished it as well

it really messed with my brain

file upload assessment that is

[fiery berry]

but of course feel free to dm

[orchid pine]

||when trying to upload an .phar.svg file with only the php shell i got only image allowed but when trying to upload the shell with ?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE svg > it worked just confused even tho the uplaod.php its not checking what is inside the file ||

[rare swan]

Module:Active Directory Section:Attacking Domain Trusts - Child -> Parent Trusts - from Linux Stuck on the question to get bross ntlm hash... got golden ticket but dont know how to get the bross hash

[undone narwhal]

Where do you think the hash of “bross” is stored?

[orchid pine]

thx to @fiery berry ❤️

[fiery berry]

no problem

[rare swan]

@undone narwhal guessing in the sam file

[undone narwhal]

Nope, that is true for a non-domain joined host

[rare swan]

Do i need system shell to get the hash - im confused

Which section do i have to lookup?

[wheat scroll]

I try to settle my ZAP for 1 hours and i failed. Can you, if you have time, send me like a video which show how to settle a ZAP.

[undone narwhal]

did you complete the PASSWORD ATTACKS module?

[rare swan]

yes

ntds.dit

[undone narwhal]

revisit these two sections from that module
Attacking Active Directory & NTDS.dit
Pass the Ticket (PtT) from Linux

[rare swan]

hey thx

[undone narwhal]

I could have given you a straightforward answer, but it wouldn’t help you understand the concept. But If you need it, ping me

[rare swan]

im trying it out for now... maybe ill come back

[small sage]

From my notes you’re missing a /c before the cmd expression

[velvet sedge]

Thanks!

[sudden wigeon]

I am doing Network Enumeration with Nmap, and trying to answer the question on the Service Enumeration page https://academy.hackthebox.com/module/19/section/103. When I scan all ports of the IP, or even specific ports or ranges, the output always shows all ports scanned as filtered. I don't understand how I am supposed to find what service to find to submit the flag. I have tried different scan types (-sY, -sA, -sT, -sS, -sV, -sC), --packet-trace shows no bytes recieved, all to no avail. I think I am missing something but I don't understand what.

below is an example (have tried without min rate but wanted a quick example). And VPN is showing initialisation sequence completed so should be good in that regard

[ebon minnow]

|| Pn and sV should be fine||

[gray merlin]

Run ip a and ip route. It looks like you have a networking issue.

also ps aux | grep openvpn to make sure you don't have more than one running.

Finally, try switching the vpn from udp to tcp (or the other way around).

[buoyant void]

So I'm doing the Password Attack modules and it says to use the resources provided (password.list, custom.rule) to mutate the password list and brute force a login for the user "sam". Now I used Hashcat to mutate the password list with the custom rule provided but Im wondering how long this should take, been running hydra with 64 threads for about an hour now with the mutated password list.

[gray merlin]

Can you do it against a port that responds faster?

[buoyant void]

Yeah that's what my next idea was. I assumed it would be easiest to bruteforce via SSH since the question says to login with SSH after you have the password. What about running hydra through RDP, would that be a quicker port to target?

[gray merlin]

Test it, but there is a faster port.

[fathom pendant]

Don't do it against ssh

[buoyant void]

Okay no SSH got it

[fathom pendant]

Ssh is a slow as balls port

Don't just read a question and assume: always enumerate the given target first

[buoyant void]

Fair point

[fathom pendant]

Just because you know the end goal doesn't mean it's the intended way

[buoyant void]

didn't even enumerate now that you mention it, dumb on my part